deepline 0.3.89 → 0.3.91

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -68,6 +68,7 @@ import {
   stringifyPostgresJson,
 } from './postgres-json';
 import { RECEIPT_STATUS_CODE, receiptStatusFromCode } from './receipt-status';
+import { WORK_RECEIPT_EXECUTION_LOCK_TABLE } from './work-receipt-storage-contract';
 import {
   workReceiptClaimableStatusCodes,
   workReceiptActiveOwnerPredicateSql,
@@ -298,7 +299,6 @@ const dbSessionCache = new Map<string, DbSessionCacheEntry>();
 const dbSessionInFlight = new Map<string, Promise<CreateDbSessionResponse>>();
 const postgresPools = new Map<string, CachedRuntimePostgresPool>();
 const runtimePostgresAdmissions = new Map<string, RuntimePostgresAdmission>();
-const runtimeWorkReceiptEnsureCache = new Map<string, Promise<void>>();
 const runtimeSheetEnsureCache = new Map<
   string,
   { expiresAt: number; promise: Promise<void> }
@@ -313,25 +313,13 @@ const APPEND_KEY_SUFFIX_LENGTH = 12;
 // 60-min alignment fixed. A shorter TTL only causes periodic re-mints (cheap;
 // the tenant runtime role is long-lived), not run failures.
 const RUNTIME_DB_SESSION_TTL_SECONDS = 10 * 60;
-const RUNTIME_WORK_RECEIPT_LEASE_COLUMNS = [
-  'lease_id',
-  'lease_owner_run_id',
-  'lease_owner_attempt',
-  'lease_expires_at',
-] as const;
-const RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN = 'failure_kind';
-const RUNTIME_WORK_RECEIPT_ERROR_PAYLOAD_COLUMN = 'error_payload';
-const RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS = [
-  ...RUNTIME_WORK_RECEIPT_LEASE_COLUMNS,
-  RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN,
-  RUNTIME_WORK_RECEIPT_ERROR_PAYLOAD_COLUMN,
-] as const;
 const RUNTIME_SHEET_ATTEMPT_COLUMNS = [
   '_attempt_id',
   '_attempt_owner_run_id',
   '_attempt_seq',
   '_attempt_expires_at',
 ] as const;
+const RUNTIME_SHEET_TIMESTAMP_COLUMNS = ['_created_at', '_updated_at'] as const;
 const RUNTIME_SHEET_ENSURE_CACHE_TTL_MS = 10 * 60_000;
 const RUNTIME_SHEET_READY_AFTER_ENSURE_RETRY_DELAYS_MS = [
   100, 250, 500, 1_000, 2_000,
@@ -1020,9 +1008,28 @@ async function isRuntimeSheetSchemaReady(
         [...RUNTIME_SHEET_ATTEMPT_COLUMNS],
       ],
     );
+    const timestampColumns = await client.query<Record<string, unknown>>(
+      `
+        SELECT count(*)::int AS ready_count
+        FROM information_schema.columns
+        WHERE table_schema = $1
+          AND table_name = $2
+          AND column_name = ANY($3::text[])
+          AND data_type = 'timestamp with time zone'
+          AND is_nullable = 'NO'
+          AND column_default IS NOT NULL
+      `,
+      [
+        session.postgres.schema,
+        session.postgres.sheetTable,
+        [...RUNTIME_SHEET_TIMESTAMP_COLUMNS],
+      ],
+    );
     return (
       Number(attemptColumns.rows[0]?.present_count ?? 0) ===
-      RUNTIME_SHEET_ATTEMPT_COLUMNS.length
+        RUNTIME_SHEET_ATTEMPT_COLUMNS.length &&
+      Number(timestampColumns.rows[0]?.ready_count ?? 0) ===
+        RUNTIME_SHEET_TIMESTAMP_COLUMNS.length
     );
   };
   try {
@@ -1053,9 +1060,14 @@ async function readRuntimeSheetSchemaDiagnostic(
   const query = async (
     client: RuntimeQueryClient,
   ): Promise<Record<string, unknown>> => {
-    const visibleColumns = await client.query<{ column_name: string }>(
+    const visibleColumns = await client.query<{
+      column_name: string;
+      data_type: string;
+      is_nullable: string;
+      column_default: string | null;
+    }>(
       `
-        SELECT column_name
+        SELECT column_name, data_type, is_nullable, column_default
         FROM information_schema.columns
         WHERE table_schema = $1
           AND table_name = $2
@@ -1079,6 +1091,15 @@ async function readRuntimeSheetSchemaDiagnostic(
       ],
     );
     const visible = new Set(visibleColumns.rows.map((row) => row.column_name));
+    const timestampColumns = new Map(
+      visibleColumns.rows
+        .filter((row) =>
+          RUNTIME_SHEET_TIMESTAMP_COLUMNS.includes(
+            row.column_name as (typeof RUNTIME_SHEET_TIMESTAMP_COLUMNS)[number],
+          ),
+        )
+        .map((row) => [row.column_name, row]),
+    );
     return {
       schema: session.postgres.schema,
       table: session.postgres.sheetTable,
@@ -1091,6 +1112,15 @@ async function readRuntimeSheetSchemaDiagnostic(
       missingAttemptColumns: RUNTIME_SHEET_ATTEMPT_COLUMNS.filter(
         (column) => !visible.has(column),
       ),
+      timestampColumnStates: RUNTIME_SHEET_TIMESTAMP_COLUMNS.map((column) => {
+        const state = timestampColumns.get(column);
+        return {
+          column,
+          dataType: state?.data_type ?? null,
+          isNullable: state?.is_nullable ?? null,
+          hasDefault: state?.column_default != null,
+        };
+      }),
     };
   };
   try {
@@ -2483,11 +2513,7 @@ function workReceiptTable(session: RuntimePostgresSession): string {
 }
 
 function receiptExecutionLockTable(session: RuntimePostgresSession): string {
-  return fqRuntimeTable(session, '_deepline_receipt_execution_locks');
-}
-
-function postgresUrlCacheKey(value: string): string {
-  return createHash('sha256').update(value).digest('hex').slice(0, 24);
+  return fqRuntimeTable(session, WORK_RECEIPT_EXECUTION_LOCK_TABLE);
 }
 
 function workReceiptKeyHex(key: string): string {
@@ -2548,134 +2574,6 @@ function mapRuntimeWorkReceiptRow(raw: Record<string, unknown>): WorkReceipt {
   };
 }
 
-function isMissingRuntimeWorkReceiptSelfHealColumnError(
-  error: unknown,
-): boolean {
-  if (!error || typeof error !== 'object') {
-    return false;
-  }
-  const code = 'code' in error ? String(error.code) : '';
-  const message = 'message' in error ? String(error.message) : '';
-  if (code !== '42703' && !/column .* does not exist/i.test(message)) {
-    return false;
-  }
-  return RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS.some((column) =>
-    message.includes(column),
-  );
-}
-
-function runtimeWorkReceiptEnsureCacheKey(
-  session: RuntimePostgresSession,
-): string {
-  return `${postgresUrlCacheKey(session.postgresUrl)}::${session.postgres.schema}::${session.postgres.receiptTable ?? RUNTIME_WORK_RECEIPT_POSTGRES_TABLE}`;
-}
-
-async function missingRuntimeWorkReceiptSelfHealColumns(
-  session: RuntimePostgresSession,
-  client: RuntimeQueryClient,
-): Promise<string[]> {
-  const result = await client.query(
-    `
-      SELECT column_name
-      FROM information_schema.columns
-      WHERE table_schema = $1
-        AND table_name = $2
-        AND column_name = ANY($3::text[])
-    `,
-    [
-      session.postgres.schema,
-      session.postgres.receiptTable ?? RUNTIME_WORK_RECEIPT_POSTGRES_TABLE,
-      [...RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS],
-    ],
-  );
-  const present = new Set(
-    result.rows.map((row) => String(row.column_name ?? '')),
-  );
-  return RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS.filter(
-    (column) => !present.has(column),
-  );
-}
-
-// COMPAT / SELF-HEAL — owner: runtime. Removal milestone: runtime-ledger
-// cutover. The customer-Neon
-// work-receipt table (lease columns + failure_kind) is the dying surface. The
-// F2 rolling migration (scripts/migrate-play-runtime-storage.ts) backfills these
-// columns; this lazy CREATE/ALTER self-heal is a compat-window safety net and is
-// deleted together with the Neon receipt path at M1.
-async function ensureRuntimeWorkReceiptTable(
-  session: RuntimePostgresSession,
-  client: RuntimeQueryClient,
-): Promise<void> {
-  const cacheKey = runtimeWorkReceiptEnsureCacheKey(session);
-  const cached = runtimeWorkReceiptEnsureCache.get(cacheKey);
-  if (cached) {
-    await cached;
-    return;
-  }
-  const promise = client
-    .query(
-      `
-    CREATE TABLE IF NOT EXISTS ${workReceiptTable(session)} (
-      k bytea PRIMARY KEY,
-      status smallint NOT NULL DEFAULT 0,
-      output jsonb,
-      error text,
-      error_payload jsonb,
-      failure_kind smallint NOT NULL DEFAULT 0,
-      run_id text,
-      lease_id text,
-      lease_owner_run_id text,
-      lease_owner_attempt integer,
-      lease_expires_at timestamptz,
-      updated_at timestamptz NOT NULL DEFAULT now()
-    )
-  `,
-    )
-    .then(async () => {
-      await client.query(`
-        CREATE TABLE IF NOT EXISTS ${receiptExecutionLockTable(session)} (
-          k bytea PRIMARY KEY,
-          owner_execution_id text NOT NULL,
-          expires_at timestamptz NOT NULL,
-          updated_at timestamptz NOT NULL DEFAULT now()
-        )
-      `);
-      const missingColumns = await missingRuntimeWorkReceiptSelfHealColumns(
-        session,
-        client,
-      );
-      if (missingColumns.length === 0) return;
-      await client.query(`
-        ALTER TABLE ${workReceiptTable(session)}
-          ${missingColumns
-            .map((column) => {
-              const type =
-                column === 'lease_expires_at'
-                  ? 'timestamptz'
-                  : column === 'lease_owner_attempt'
-                    ? 'integer'
-                    : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
-                      ? 'smallint NOT NULL DEFAULT 0'
-                      : column === RUNTIME_WORK_RECEIPT_ERROR_PAYLOAD_COLUMN
-                        ? 'jsonb'
-                        : 'text';
-              return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
-            })
-            .join(',\n          ')}
-      `);
-    })
-    .then(() => undefined);
-  runtimeWorkReceiptEnsureCache.set(cacheKey, promise);
-  try {
-    await promise;
-  } catch (error) {
-    if (runtimeWorkReceiptEnsureCache.get(cacheKey) === promise) {
-      runtimeWorkReceiptEnsureCache.delete(cacheKey);
-    }
-    throw error;
-  }
-}
-
 export async function acquireRuntimeReceiptExecutionLock(
   context: RuntimeApiContext,
   input: {
@@ -2752,13 +2650,10 @@ async function withRuntimeWorkReceiptClient<T>(
   session: RuntimePostgresSession,
   operation: (client: RuntimeQueryClient) => Promise<T>,
 ): Promise<T> {
-  // Receipt tables are part of customer Postgres bootstrap, so the hot path
-  // should not pay DDL on every fresh runtime isolate. Try the receipt query
-  // first, then self-heal once on a missing relation/column. Permission loss
-  // during an operational receipt query must fail loud: silently repairing it
-  // can let provider work continue after durable receipt persistence is gone.
-  // Only the schema-migration branch below may repair ownership before its
-  // retry. A genuinely missing schema or second failure also rethrows loudly.
+  // Receipt tables are customer-Postgres bootstrap state. The operation path
+  // never performs DDL or schema repair: a missing table/column is the real
+  // operation failure and must remain visible to the caller. We retry only
+  // transient connection/transport failures, never a semantic SQL error.
   const withClient = async <R>(
     run: (client: RuntimeQueryClient) => Promise<R>,
   ): Promise<R> =>
@@ -2768,8 +2663,6 @@ async function withRuntimeWorkReceiptClient<T>(
           cachePool: !context.disablePostgresPoolCache,
           signal: context.abortSignal,
         });
-  let selfHealAttempted = false;
-
   for (
     let attempt = 1;
     attempt <= RUNTIME_WORK_RECEIPT_QUERY_MAX_ATTEMPTS;
@@ -2778,34 +2671,6 @@ async function withRuntimeWorkReceiptClient<T>(
     try {
       return await withClient(operation);
     } catch (error) {
-      const missingStorage =
-        isMissingRelationError(error) ||
-        isMissingRuntimeWorkReceiptSelfHealColumnError(error);
-      if (missingStorage && !selfHealAttempted) {
-        selfHealAttempted = true;
-        runtimeWorkReceiptEnsureCache.delete(
-          runtimeWorkReceiptEnsureCacheKey(session),
-        );
-        try {
-          await withClient((client) =>
-            ensureRuntimeWorkReceiptTable(session, client),
-          );
-        } catch (ensureError) {
-          if (!isPostgresPermissionDeniedError(ensureError)) {
-            throw ensureError;
-          }
-          runtimeWorkReceiptEnsureCache.delete(
-            runtimeWorkReceiptEnsureCacheKey(session),
-          );
-          await repairRuntimeStorageGrants(context, {
-            playName: context.playName?.trim() || session.playName,
-          });
-          await withClient((client) =>
-            ensureRuntimeWorkReceiptTable(session, client),
-          );
-        }
-        continue;
-      }
       if (
         attempt >= RUNTIME_WORK_RECEIPT_QUERY_MAX_ATTEMPTS ||
         !isTransientRuntimePostgresOperationError(error)
@@ -7047,11 +6912,6 @@ async function completeRuntimeMapRowChunks(
         OR coalesce(target._attempt_owner_run_id, target._run_id) IS DISTINCT FROM $10::text
       )
     )`;
-    const sameOwnerTerminalEpochSql = sameOwnerTerminalAttemptEpochSql(
-      'target',
-      '$10::text',
-      '$12',
-    );
     const { rows } = await client.query<{
       updated: number;
       matched_keys: string[];
@@ -7106,6 +6966,15 @@ async function completeRuntimeMapRowChunks(
               target._status <> 'enriched'
               OR (${targetChangedPatchedCellSql})
             )
+            -- First terminal wins: suppress conflict for same owner+epoch already-terminal row.
+            -- Durable replay (omitted_terminal_replay) from same attempt epoch is idempotent.
+            AND NOT (
+              $10::text IS NOT NULL
+              AND $12::integer IS NOT NULL
+              AND target._status = 'enriched'
+              AND coalesce(target._attempt_owner_run_id, target._run_id) = $10::text
+              AND COALESCE(target._attempt_seq, 0) = $12::integer
+            )
        ),
        applied_rows AS (
          UPDATE ${sheetTable(session)} AS target
@@ -7127,13 +6996,21 @@ async function completeRuntimeMapRowChunks(
 		           AND ($13::bigint IS NULL OR target._write_version = $13::bigint)
                    AND ($13::bigint IS NOT NULL OR target._status <> 'enriched')
 		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
-           AND NOT (${sameOwnerTerminalEpochSql})
            AND (
              ($9::text IS NULL AND target._run_id = $5::text)
              OR ($9::text IS NOT NULL AND ${writableNonTerminalAttemptSql})
              OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
 		             OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
            )
+           -- First terminal wins: skip UPDATE for already-terminal same-owner+epoch row.
+           -- Even though we excluded from conflicts, we still no-op here for idempotency.
+           AND NOT (
+             $10::text IS NOT NULL
+             AND $12::integer IS NOT NULL
+             AND target._status = 'enriched'
+             AND coalesce(target._attempt_owner_run_id, target._run_id) = $10::text
+             AND COALESCE(target._attempt_seq, 0) = $12::integer
+           )
            AND (
              target._status <> 'enriched'
              OR target._run_id IS DISTINCT FROM $5::text
@@ -7339,11 +7216,6 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
       '$11::timestamptz',
       '$12',
     );
-    const sameOwnerTerminalEpochSql = sameOwnerTerminalAttemptEpochSql(
-      'target',
-      '$10::text',
-      '$12',
-    );
     const { rows } = await client.query<{
       _key?: string;
       fenced_keys?: string[];
@@ -7403,6 +7275,15 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
               target._status <> 'enriched'
               OR (${targetChangedPatchedCellSql})
             )
+            -- First terminal wins: suppress conflict for same owner+epoch already-terminal row.
+            -- Durable replay (omitted_terminal_replay) from same attempt epoch is idempotent.
+            AND NOT (
+              $10::text IS NOT NULL
+              AND $12::integer IS NOT NULL
+              AND target._status = 'enriched'
+              AND coalesce(target._attempt_owner_run_id, target._run_id) = $10::text
+              AND COALESCE(target._attempt_seq, 0) = $12::integer
+            )
        ),
        applied_rows AS (
          UPDATE ${sheetTable(session)} AS target
@@ -7425,7 +7306,6 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
            AND ($13::bigint IS NULL OR target._write_version = $13::bigint)
            AND ($13::bigint IS NOT NULL OR target._status <> 'enriched')
 		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
-           AND NOT (${sameOwnerTerminalEpochSql})
            AND (
              ($9::text IS NULL AND target._run_id = $5::text)
              OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
@@ -7862,6 +7742,16 @@ async function failRuntimeMapRowChunks(
               OR target._error IS DISTINCT FROM updates.error
               OR (${targetChangedPatchedCellSql})
             )
+            -- Same-owner terminal replay is not a conflict. Normal replay
+            -- preserves the first value below; explicit force-failure may update it.
+            -- Different owners and attempt epochs still conflict.
+            AND NOT (
+              $12::text IS NOT NULL
+              AND $14::integer IS NOT NULL
+              AND target._status IN ('failed', 'enriched')
+              AND coalesce(target._attempt_owner_run_id, target._run_id) = $12::text
+              AND COALESCE(target._attempt_seq, 0) = $14::integer
+            )
        ),
        applied_rows AS (
          UPDATE ${sheetTable(session)} AS target
@@ -7888,13 +7778,15 @@ async function failRuntimeMapRowChunks(
              ($11::text IS NULL AND target._run_id = $6::text)
              OR ($11::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$11::text', '$12::text', '$13::timestamptz', '$14::integer')})
 	           )
+           -- First terminal wins for failed rows too, BUT only when NOT force-failing.
+           -- Normal replay: no-op when already-failed OR already-enriched from same owner+epoch.
            AND NOT (
-             $16::bigint IS NOT NULL
-             AND target._write_version = $16::bigint
-             AND target._run_id = $6::text
-             AND target._status = 'failed'
-             AND target._error IS NOT DISTINCT FROM updates.error
-             AND NOT (${targetChangedPatchedCellSql})
+             $15::boolean = FALSE
+             AND $12::text IS NOT NULL
+             AND $14::integer IS NOT NULL
+             AND target._status IN ('failed', 'enriched')
+             AND coalesce(target._attempt_owner_run_id, target._run_id) = $12::text
+             AND COALESCE(target._attempt_seq, 0) = $14::integer
            )
          RETURNING target._key, prev._status AS prev_status
        ),
@@ -8006,9 +7898,12 @@ async function failRuntimeMapRowChunks(
         input.writeVersion,
       ],
     );
-    updated += Number(rows[0]?.updated ?? 0);
-    fencedKeys.push(...(rows[0]?.fenced_keys ?? []));
-    conflictKeys.push(...(rows[0]?.conflict_keys ?? []));
+    const appliedCount = Number(rows[0]?.updated ?? 0);
+    const chunkFencedKeys = rows[0]?.fenced_keys ?? [];
+    const chunkConflictKeys = rows[0]?.conflict_keys ?? [];
+    updated += appliedCount;
+    fencedKeys.push(...chunkFencedKeys);
+    conflictKeys.push(...chunkConflictKeys);
   }
   return { updated, fencedKeys, conflictKeys };
 }

package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts

@@ -0,0 +1,201 @@
+import { mintWorkflowExecutorToken } from './/workflow-executor-auth';
+import {
+  DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
+  normalizeRuntimeExecutionCapabilities,
+  type RuntimeAuthorityDescriptor,
+  type RuntimeExecutionCapability,
+} from './/execution-capabilities';
+import type { FixtureBehavior } from './/fixture-behavior';
+import type { PlaySchedulerSubmitInput } from './/scheduler-backend';
+import type { DirectCompletedTerminalContract } from './/scheduler-backends/terminal-contract';
+
+export type RuntimeAuthority = {
+  executorToken: string;
+  descriptor: RuntimeAuthorityDescriptor;
+};
+
+/**
+ * Derive a child Run's durable authority from its admitted parent. The child
+ * owns its authored secret names and play identity; organization, actor,
+ * billing, scheduler placement, and capability policy remain parent-owned
+ * durable facts. This deliberately does not intersect secret names: a child
+ * Play resolves its own scoped declaration, where an equal name can identify
+ * a different Play-specific secret.
+ */
+export function deriveAsyncChildRuntimeAuthority(input: {
+  parent: RuntimeAuthorityDescriptor;
+  workflowId: string;
+  runId: string;
+  playName: string;
+  billingRunId: string;
+  allowedSecrets: readonly string[];
+}): RuntimeAuthorityDescriptor {
+  return {
+    orgId: input.parent.orgId,
+    workflowId: input.workflowId,
+    runId: input.runId,
+    // The scheduler-owned parent launch resolves the billing owner to the
+    // root before child admission. Keep the descriptor's token claim aligned
+    // with that durable run-state fact even for a legacy intermediate parent
+    // that predates `billingRunId` on its authority descriptor.
+    billingRunId: input.billingRunId,
+    playName: input.playName,
+    allowedSecrets: [...new Set(input.allowedSecrets)],
+    maxCreditsPerRun: input.parent.maxCreditsPerRun ?? null,
+    integrationMode: input.parent.integrationMode ?? null,
+    fixtureBehavior: input.parent.fixtureBehavior ?? null,
+    synthetic: input.parent.synthetic === true,
+    actorUserId: input.parent.actorUserId ?? null,
+    actorEmail: input.parent.actorEmail ?? null,
+    schedulerSchema: input.parent.schedulerSchema ?? null,
+    docflowEnabled: input.parent.docflowEnabled === true,
+    asyncChildAdmissionAttemptRequired:
+      input.parent.asyncChildAdmissionAttemptRequired === true,
+    capabilities: normalizeRuntimeExecutionCapabilities(
+      input.parent.capabilities,
+    ),
+  };
+}
+
+export async function mintPlayRunRuntimeAuthorityDescriptor(input: {
+  descriptor: RuntimeAuthorityDescriptor;
+  runtimeOrigin?: string | null;
+}): Promise<RuntimeAuthority> {
+  return {
+    descriptor: input.descriptor,
+    executorToken: await mintWorkflowExecutorToken({
+      ...runtimeAuthorityMintInput(input.descriptor),
+      runtimeOrigin: input.runtimeOrigin,
+    }),
+  };
+}
+
+export async function mintPlayRunRuntimeAuthority(input: {
+  orgId: string;
+  workflowId: string;
+  runId: string;
+  billingRunId?: string | null;
+  playName: string;
+  allowedSecrets?: readonly string[] | null;
+  maxCreditsPerRun?: number | null;
+  integrationMode?: 'live' | 'eval_stub' | 'fixture' | null;
+  fixtureBehavior?: FixtureBehavior | null;
+  synthetic?: boolean | null;
+  actorUserId?: string | null;
+  actorEmail?: string | null;
+  schedulerSchema?: string | null;
+  /** Docflow rollout answer for the launching actor, resolved by the caller. */
+  docflowEnabled?: boolean | null;
+  runtimeOrigin?: string | null;
+}): Promise<RuntimeAuthority> {
+  const descriptor: RuntimeAuthorityDescriptor = {
+    orgId: input.orgId,
+    workflowId: input.workflowId,
+    runId: input.runId,
+    billingRunId: input.billingRunId ?? null,
+    playName: input.playName,
+    allowedSecrets: [...new Set(input.allowedSecrets ?? [])],
+    maxCreditsPerRun: input.maxCreditsPerRun ?? null,
+    integrationMode: input.integrationMode ?? null,
+    fixtureBehavior: input.fixtureBehavior ?? null,
+    synthetic: input.synthetic === true,
+    actorUserId: input.actorUserId ?? null,
+    actorEmail: input.actorEmail ?? null,
+    schedulerSchema: input.schedulerSchema ?? null,
+    docflowEnabled: input.docflowEnabled === true,
+    capabilities: normalizeRuntimeExecutionCapabilities(
+      DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
+    ),
+  };
+  return await mintPlayRunRuntimeAuthorityDescriptor({
+    descriptor,
+    runtimeOrigin: input.runtimeOrigin,
+  });
+}
+
+export function runtimeAuthorityMintInput(
+  descriptor: RuntimeAuthorityDescriptor,
+  input: {
+    runAttempt?: number | null;
+    runLeaseToken?: string | null;
+    terminalContract?: DirectCompletedTerminalContract | null;
+    capabilities?: readonly RuntimeExecutionCapability[];
+    runtimeOrigin?: string | null;
+  } = {},
+) {
+  return {
+    orgId: descriptor.orgId,
+    workflowId: descriptor.workflowId,
+    runId: descriptor.runId,
+    billingRunId: descriptor.billingRunId,
+    playName: descriptor.playName,
+    allowedSecrets: descriptor.allowedSecrets,
+    maxCreditsPerRun: descriptor.maxCreditsPerRun,
+    integrationMode: descriptor.integrationMode,
+    fixtureBehavior: descriptor.fixtureBehavior,
+    synthetic: descriptor.synthetic,
+    actorUserId: descriptor.actorUserId,
+    actorEmail: descriptor.actorEmail,
+    schedulerSchema: descriptor.schedulerSchema,
+    runAttempt: input.runAttempt,
+    runLeaseToken: input.runLeaseToken,
+    terminalContract: input.terminalContract,
+    capabilities: input.capabilities ?? descriptor.capabilities,
+    runtimeOrigin: input.runtimeOrigin,
+  };
+}
+
+export async function mintPlayRunAttemptRuntimeToken(input: {
+  descriptor: RuntimeAuthorityDescriptor;
+  runAttempt?: number | null;
+  runLeaseToken?: string | null;
+  terminalContract?: DirectCompletedTerminalContract | null;
+  capabilities?: readonly RuntimeExecutionCapability[];
+  runtimeOrigin?: string | null;
+}): Promise<string> {
+  return await mintWorkflowExecutorToken(
+    runtimeAuthorityMintInput(input.descriptor, input),
+  );
+}
+
+/**
+ * Reconstruct the smallest authority needed to settle compute billing for a
+ * terminal launch row written before runtimeAuthority became durable state.
+ *
+ * This is deliberately not a general legacy-token fallback. The caller may
+ * mint only billing.write, and every fact comes from the leased launch row
+ * selected by the scheduler rather than the worker's request body.
+ */
+export function requireComputeBillingDispatchRuntimeAuthority(
+  launch: Pick<
+    PlaySchedulerSubmitInput,
+    'orgId' | 'runId' | 'playName' | 'userId' | 'userEmail'
+  >,
+): RuntimeAuthorityDescriptor {
+  const orgId = launch.orgId?.trim();
+  const runId = launch.runId?.trim();
+  const playName = launch.playName?.trim();
+  if (!orgId || !runId || !playName) {
+    throw new Error(
+      'Legacy compute-billing launch is missing orgId, runId, or playName.',
+    );
+  }
+
+  return {
+    orgId,
+    // Scheduler envelopes use the workflow id as the durable run id.
+    workflowId: runId,
+    runId,
+    billingRunId: runId,
+    playName,
+    allowedSecrets: [],
+    maxCreditsPerRun: null,
+    integrationMode: null,
+    fixtureBehavior: null,
+    synthetic: false,
+    actorUserId: launch.userId?.trim() || null,
+    actorEmail: launch.userEmail?.trim() || null,
+    docflowEnabled: false,
+    capabilities: ['billing.write'],
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/runtime-env.ts

@@ -59,3 +59,9 @@ export function isTestOnlyRuntime(): boolean {
   if (process.env.VERCEL_ENV === 'production') return false;
   return process.env.VERCEL_ENV === 'preview' || getRuntimeEnv() !== 'prod';
 }
+
+export function shouldEnableMarketingIntegrations(): boolean {
+  return getRuntimeEnv() === 'prod';
+}
+
+export { isBuildContext } from '../observability/build-context';