deepline 0.3.74 → 0.3.76

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -574,6 +574,16 @@ export type IntegrationEventWaitHandler = {
     context: IntegrationEventWaitRuntimeContext;
     boundary: IntegrationEventWaitBoundary;
   }) => Promise<IntegrationEventWaitBoundary>;
+  /**
+   * Runs during the resumed execution only when this boundary reached its
+   * durable timeout. Providers use this to make their external interaction
+   * terminal before the Play consumes the timeout payload.
+   */
+  onTimeout?: (input: {
+    payload: Record<string, unknown>;
+    context: IntegrationEventWaitRuntimeContext;
+    boundary: IntegrationEventWaitBoundary;
+  }) => Promise<void>;
 };
 
 export interface ContextOptions {

package/dist/bundling-sources/shared_libs/play-runtime/durable-call-cache.ts

@@ -197,25 +197,23 @@ export function buildDurableToolReceiptPrefix(input: {
   return `ctx:${orgId}:call:tool:${normalizeTableNamespace(toolId)}:`;
 }
 
-export function buildDurableToolProviderIdempotencyKey(input: {
-  receiptKey: string;
+export function buildProviderOperationIdempotencyKey(input: {
+  operationKey: string;
   force?: boolean;
-  receiptLeaseId?: string | null;
   fallbackAttemptId?: string | null;
 }): string {
-  const receiptKey = input.receiptKey.trim();
-  if (!receiptKey) {
-    throw new Error('Need receipt key.');
+  const operationKey = input.operationKey.trim();
+  if (!operationKey) {
+    throw new Error('Need provider operation key.');
   }
   if (input.force !== true) {
-    return receiptKey;
+    return operationKey;
   }
-  const attemptId =
-    input.receiptLeaseId?.trim() || input.fallbackAttemptId?.trim() || null;
+  const attemptId = input.fallbackAttemptId?.trim() || null;
   if (!attemptId) {
-    throw new Error('Forced idempotency needs lease id.');
+    throw new Error('Forced idempotency needs a logical call identity.');
   }
-  return `${receiptKey}:force:${attemptId}`;
+  return `${operationKey}:force:${attemptId}`;
 }
 
 export function buildDurableToolAggregateReceiptKey(input: {
@@ -258,25 +256,10 @@ function commonDurableToolReceiptPrefix(
   return commonPrefix ?? '';
 }
 
-export function buildDurableToolAggregateProviderIdempotencyKey(input: {
-  aggregateReceiptKey: string;
-  receiptKeys: string[];
-  providerIdempotencyKeys: string[];
-}): string {
-  const receiptKeys = input.receiptKeys.map((key) => key.trim());
-  const providerIdempotencyKeys = input.providerIdempotencyKeys.map((key) =>
-    key.trim(),
-  );
-  return `${input.aggregateReceiptKey}:ordered:${sha256Hex(
-    stableStringify({ receiptKeys, providerIdempotencyKeys }),
-  )}`;
-}
-
 /**
  * Provider-native batch caching is keyed by the exact compiled provider
- * payload. Receipt identities coordinate ownership and terminal results; they
- * cannot stand in for request identity because cache hits and foreign leases
- * can remove members after the original batch was planned.
+ * payload. Result-cache identities coordinate local publication; they never
+ * stand in for a provider operation identity.
  *
  * An explicit force refresh is deliberately a separate namespace: it asks for
  * a fresh provider operation even when the payload itself is unchanged.
@@ -298,10 +281,8 @@ export function buildDurableToolPayloadProviderIdempotencyKey(input: {
   const forceRefreshIdentities = input.forceRefreshIdentities
     ?.map((identity) => identity.trim())
     .filter(Boolean);
-  return `${buildDurableToolReceiptPrefix({
-    orgId: input.orgId,
-    toolId,
-  })}payload-v1:${sha256Hex(
+  const orgId = input.orgId?.trim() || 'org';
+  return `ctx:${orgId}:operation:tool:${normalizeTableNamespace(toolId)}:payload-v1:${sha256Hex(
     stableStringify({
       executionAuthScopeDigest: input.executionAuthScopeDigest?.trim() || null,
       providerActionVersion: input.providerActionVersion?.trim() || null,

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -439,7 +439,11 @@ export function createPlayExecutionGovernor(
         slot.release();
         throw error;
       }
-      return slot;
+      return {
+        release() {
+          slot.release();
+        },
+      };
     },
 
     acquireIntegrationRequestSlot: (opts) =>

package/dist/bundling-sources/shared_libs/play-runtime/resource-governor.ts

@@ -1,4 +1,7 @@
-import type { PlayExecutionGovernor, WorkLease } from './governor/governor';
+import type {
+  PlayExecutionGovernor,
+  WorkLease,
+} from './governor/governor';
 
 export type RuntimeResourceLease = WorkLease;
 
@@ -211,7 +214,9 @@ export function createRuntimeResourceGovernor(input: {
       const startedAt = Date.now();
       const lease = await input.executionGovernor.acquireToolSlot(
         toolInput.toolId,
-        { signal: toolInput.signal },
+        {
+          signal: toolInput.signal,
+        },
       );
       toolCounters.acquired += 1;
       observe({

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -15,7 +15,7 @@ import { DAYTONA_PLAY_RUNNER_LABEL_SOURCE } from './daytona-labels';
 const DAYTONA_CREATE_TIMEOUT_SECONDS = 10;
 const DAYTONA_CREATE_RETRY_DELAYS_MS = [0, 500, 1_500] as const;
 const DAYTONA_TIMED_OUT_CREATE_RECONCILE_DELAYS_MS = [
-  0, 1_000, 3_000, 6_000, 12_000,
+  0, 1_000, 3_000, 6_000, 12_000, 24_000, 36_000,
 ] as const;
 // Explicit runner deadline + scheduler GC own the normal lifecycle. Daytona's
 // inactivity stop is a wider crash backstop measured from sandbox creation, so
@@ -115,6 +115,11 @@ function isDaytonaSandboxStateChangeConflict(error: unknown): boolean {
   return /Sandbox state change in progress/i.test(message);
 }
 
+function isDaytonaSandboxNotFound(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return /\b(?:sandbox )?not found\b|\b404\b/i.test(message);
+}
+
 type DaytonaCreateResult = {
   sandbox: DaytonaSandbox;
   attempt: number;
@@ -329,7 +334,11 @@ async function reconcileAndDeleteTimedOutDaytonaSandbox(input: {
     let sandbox: DaytonaSandbox;
     try {
       sandbox = await input.daytona.get(input.sandboxName);
-    } catch {
+    } catch (error) {
+      // A confirmed absence cannot become a cleanup-addressable resource on a
+      // later read. Stop immediately; only uncertain lookup failures merit
+      // the bounded retry window below.
+      if (isDaytonaSandboxNotFound(error)) return { kind: 'not_found' };
       continue;
     }
     // `create` waits only a bounded interval, but the named sandbox may finish

package/dist/bundling-sources/shared_libs/play-runtime/runtime-incident-drills.ts

@@ -218,7 +218,7 @@ export const RUNTIME_INCIDENT_DRILL_CATALOG: readonly RuntimeIncidentDrill[] = [
     },
     expected: {
       outcome:
-        'The same logical run completes through receipt replay; recovery remains bounded if the provider outcome must be retried.',
+        'The same logical run completes through terminal-cache replay; any provider retry is governed by its separate operation policy.',
       safetyFacts: ['same_logical_run', 'bounded_provider_execution'],
     },
     verification: {

package/dist/bundling-sources/shared_libs/play-runtime/suspension.ts

@@ -14,6 +14,10 @@ export type PlayExecutionSuspension =
       boundaryId: string;
       eventKey: string;
       timeoutMs: number;
+      messageRef?: {
+        channel: string;
+        ts: string;
+      };
     }
   | {
       kind: 'integration_event_batch';
@@ -21,6 +25,10 @@ export type PlayExecutionSuspension =
         boundaryId: string;
         eventKey: string;
         timeoutMs: number;
+        messageRef?: {
+          channel: string;
+          ts: string;
+        };
       }>;
     }
   | {
@@ -115,12 +123,20 @@ export class PlayRowExecutionSuspendedError extends Error {
     boundaryId: string;
     eventKey: string;
     timeoutMs: number;
+    messageRef?: {
+      channel: string;
+      ts: string;
+    };
   };
 
   constructor(boundary: {
     boundaryId: string;
     eventKey: string;
     timeoutMs: number;
+    messageRef?: {
+      channel: string;
+      ts: string;
+    };
   }) {
     super(
       `Play row execution suspended waiting for integration event ${JSON.stringify(boundary.eventKey)}.`,

package/dist/bundling-sources/shared_libs/play-runtime/tool-call/native-batch.ts

@@ -61,6 +61,7 @@ export type NativeBatchToolCallJob = {
  *
  * It reads each member's completed-result cache before assembling one physical
  * provider batch for the misses, then atomically stores each successful split.
+ * The cache neither owns nor recovers a provider job.
  */
 export function createNativeBatchToolCallJob(dependencies: {
   receiptCohort: ToolCallReceiptCohortJob;

package/dist/bundling-sources/shared_libs/play-runtime/tool-call/testkit.ts

@@ -119,8 +119,9 @@ export function createMemoryToolResultReceipts(): ToolResultReceipts & {
 }
 
 /**
- * Models the server-side operation fence: multiple receipt representations
- * may share one provider operation key while keeping separate result receipts.
+ * Models in-process request single-flight. Multiple result-cache
+ * representations may share a completed response, but no receipt identifies
+ * or recovers an external provider job.
  */
 export function createSingleFlightToolCallDispatcher(input: {
   dispatch(
@@ -134,8 +135,8 @@ export function createSingleFlightToolCallDispatcher(input: {
   const dispatches: Parameters<ToolCallDispatcher['dispatch']>[0][] = [];
   return {
     async dispatch(call) {
-      // Receiptless calls are intentionally not single-flighted: they make no
-      // provider-operation claim and every invocation reaches the adapter.
+      // Receiptless calls are intentionally not single-flighted: every
+      // invocation reaches the adapter.
       if (!call.providerOperationKey) {
         dispatches.push(call);
         return await input.dispatch(call);

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -3,7 +3,10 @@ import {
   normalizeToolHttpErrorMessage,
   type ToolHttpError,
 } from './tool-http-errors';
-import type { ToolExecutionErrorSchemaVersion } from '../plays/tool-execution-error';
+import {
+  ToolExecutionError,
+  type ToolExecutionErrorSchemaVersion,
+} from '../plays/tool-execution-error';
 
 export const TOOL_EXECUTE_TRANSIENT_HTTP_MAX_ATTEMPTS = 2;
 // A provider may need to finish the original request before it can replay the
@@ -439,8 +442,15 @@ export function classifyToolExecuteHttpFailure(input: {
         ? 'fail_run'
         : 'settle_row_failure',
     retryDelayMs,
+    // Only a provider-owned 429 may cool the shared provider bucket. Platform,
+    // caller, and malformed responses are never evidence that a provider is
+    // throttling; feeding any of them into the pacer can incorrectly exhaust
+    // every customer sharing that provider credential.
     backpressureDelayMs:
-      input.status === 429 && retryDecision.reason !== 'hard_billing_error'
+      input.status === 429 &&
+      retryDecision.reason !== 'hard_billing_error' &&
+      error instanceof ToolExecutionError &&
+      error.origin === 'provider'
         ? hasRetryAfterHeader && retryAfterMs > 0
           ? retryAfterMs
           : TOOL_EXECUTE_BARE_RATE_LIMIT_BACKPRESSURE_MS

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -1139,7 +1139,7 @@ export interface PlayAuthoringRuntimeContext {
 
   tools: {
     /**
-     * Execute a provider tool through the durable receipt contract.
+     * Execute a provider tool through the terminal-result cache contract.
      * @sdkReference runtime 150 ctx.tools.execute(request)
      */
     execute<TOutput = PlayLooseObject>(

package/dist/bundling-sources/shared_libs/plays/deployment-status.ts

@@ -0,0 +1,74 @@
+/**
+ * The play deployment status machine, shared by the Convex control plane
+ * (convex/playDeployments.ts), worker auth (src/lib/auth/play-deploy-auth.ts),
+ * and the deploy-worker API surface. One spelling of the union, the terminal
+ * set, and the allowed transitions.
+ */
+
+export const PLAY_DEPLOYMENT_STATUSES = [
+  'queued',
+  'building',
+  'publishing',
+  'succeeded',
+  // Everything this deployment set out to deploy deployed, but it has
+  // something the reader must see — today a play file skipped because
+  // another file already claimed its name. A warning, never a failure:
+  // deliberately its own terminal status rather than a flag on `succeeded`,
+  // so future warning reasons have somewhere to live and so the API, CLI,
+  // and dashboard can all filter on it without reading per-play results.
+  'succeeded_with_warnings',
+  'failed',
+  // Live pointers flipped, then per-play SQL listener reconciliation failed
+  // and the pointers were reverted. Loud, never silent.
+  'reconcile_failed',
+  'cancelled',
+  'superseded',
+] as const;
+
+export type PlayDeploymentStatus = (typeof PLAY_DEPLOYMENT_STATUSES)[number];
+
+/**
+ * A terminal deployment's token is dead: worker auth returns the typed
+ * "superseded"/"terminal" code so the worker aborts instead of retrying.
+ * Typed ReadonlySet<string> so unvalidated route input can be tested for
+ * membership directly.
+ */
+export const TERMINAL_PLAY_DEPLOYMENT_STATUSES: ReadonlySet<string> =
+  new Set<PlayDeploymentStatus>([
+    'succeeded',
+    'succeeded_with_warnings',
+    'failed',
+    'reconcile_failed',
+    'cancelled',
+    'superseded',
+  ]);
+
+export const ALLOWED_PLAY_DEPLOYMENT_TRANSITIONS: Record<
+  PlayDeploymentStatus,
+  readonly PlayDeploymentStatus[]
+> = {
+  queued: ['building', 'failed', 'cancelled', 'superseded'],
+  building: [
+    'publishing',
+    'succeeded',
+    'succeeded_with_warnings',
+    'failed',
+    'cancelled',
+    'superseded',
+  ],
+  // publishing -> superseded: the atomic stale-promotion guard fired (a
+  // newer production deployment exists), so the worker retires itself.
+  publishing: [
+    'succeeded',
+    'succeeded_with_warnings',
+    'failed',
+    'reconcile_failed',
+    'superseded',
+  ],
+  succeeded: [],
+  succeeded_with_warnings: [],
+  failed: [],
+  reconcile_failed: [],
+  cancelled: [],
+  superseded: [],
+};