deepline 0.1.204 → 0.1.206

package/dist/bundling-sources/sdk/src/release.ts

@@ -106,10 +106,10 @@ export const SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: '0.1.204',
+  version: '0.1.206',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.204',
+    latest: '0.1.206',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -108,9 +108,11 @@ type RuntimeApiRequest =
       action: 'append_run_events';
       playId: string;
       events: PlayRunLedgerEvent[];
+      idempotencyKey?: string;
     }
   | {
       action: 'start_inline_child_run';
+      idempotencyKey?: string;
       playName: string;
       runId: string;
       parentRunId?: string | null;
@@ -912,7 +914,11 @@ async function updateRunStatusViaAppRuntimeUnlocked(
 
 export async function appendRunEventsViaAppRuntime(
   context: WorkerRuntimeApiContext,
-  input: { playId: string; events: PlayRunLedgerEvent[] },
+  input: {
+    playId: string;
+    events: PlayRunLedgerEvent[];
+    idempotencyKey?: string;
+  },
 ): Promise<void> {
   await postAppRuntimeApi<{ ok: true }>(context, {
     action: 'append_run_events',
@@ -938,6 +944,7 @@ export async function startRunViaAppRuntime(
     maxCreditsPerRun?: number | null;
     staticPipeline?: unknown;
     source?: 'published' | 'ad_hoc' | 'draft';
+    idempotencyKey?: string;
   },
 ): Promise<void> {
   await postAppRuntimeApi<{ ok: true }>(context, {

package/dist/bundling-sources/shared_libs/play-runtime/coordinator-headers.ts

@@ -34,7 +34,10 @@ export const RUNTIME_SCHEDULER_SCHEMA_OVERRIDE_HEADER =
  * `/api/v2/plays/run`. The run route pins the child to this release lane over
  * the resolver's schema-derived default, so a child always finishes on the
  * release that launched its parent. Honored ONLY for internal `internalRunPlay`
- * child launches (executor-token authed, lineage-validated). Absent =>
+ * child launches (executor-token authed, lineage-validated), plus internally
+ * authenticated root `profile=absurd` launches used by deploy canaries to pin
+ * an exact candidate release before activation. Public API keys cannot use
+ * this override. Absent =>
  * inherit-when-absent back-compat: the resolver default applies unchanged.
  */
 export const ABSURD_RELEASE_OVERRIDE_HEADER = 'x-deepline-absurd-release';

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -82,7 +82,8 @@ export function validateDaytonaExecutionContext(
  * CUSTOMER code in PRODUCTION never runs with unrestricted egress — the
  * production worker must provision `DEEPLINE_DAYTONA_NETWORK_ALLOW_LIST`
  * (comma-separated CIDRs, per the Daytona `networkAllowList` contract) and
- * every prod sandbox is created `networkBlockAll: true` + that allow-list.
+ * every prod sandbox is created with that allow-list, which Daytona treats as
+ * "block all egress except these CIDRs".
  *
  * "Production" here is the RUN'S topology, not the build flag: a run whose
  * scheduler schema is isolated (per-PR preview CI, per-worktree dev — see
@@ -97,12 +98,43 @@ export function validateDaytonaExecutionContext(
  * An explicitly provisioned allow-list is always honored (preview included),
  * so a future preview fleet with enumerable egress can opt in to full parity.
  */
+/**
+ * Keep only IPv4 CIDR entries from a comma-separated allow-list. Daytona's
+ * `networkAllowList` is IPv4-only; an IPv6 entry fails every sandbox create.
+ * Returns null when nothing valid remains so the production guard below still
+ * fires loudly rather than sending an empty list.
+ */
+export function filterIpv4CidrAllowList(raw: string | null): string | null {
+  if (!raw) return raw;
+  const entries = raw
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  const ipv4 = entries.filter((entry) => !entry.includes(':'));
+  const dropped = entries.filter((entry) => entry.includes(':'));
+  if (dropped.length > 0) {
+    console.warn(
+      `[daytona] dropping ${dropped.length} non-IPv4 CIDR(s) from ` +
+        `${DAYTONA_NETWORK_ALLOW_LIST_ENV} (Daytona networkAllowList is ` +
+        `IPv4-only): ${dropped.join(', ')}`,
+    );
+  }
+  return ipv4.length > 0 ? ipv4.join(',') : null;
+}
+
 export function resolveDaytonaSandboxNetworkPolicy(input: {
   runtimeSchedulerSchema: string | null | undefined;
   env?: NodeJS.ProcessEnv;
 }): { networkAllowList: string | null } {
   const env = input.env ?? process.env;
-  const networkAllowList = env[DAYTONA_NETWORK_ALLOW_LIST_ENV]?.trim() || null;
+  // Daytona's `networkAllowList` accepts IPv4 CIDRs only — it rejects sandbox
+  // create outright if any entry is IPv6 ("Invalid IP address ... Must be a
+  // valid IPv4 address"). An operator-provisioned list can pick up AAAA-resolved
+  // hosts, so drop IPv6 (colon-bearing) entries and keep the IPv4 CIDRs that
+  // actually constrain egress. Warn loudly so a dropped entry is visible.
+  const networkAllowList = filterIpv4CidrAllowList(
+    env[DAYTONA_NETWORK_ALLOW_LIST_ENV]?.trim() || null,
+  );
   if (
     !networkAllowList &&
     env.NODE_ENV === 'production' &&
@@ -153,12 +185,13 @@ async function createOneShotDaytonaSandbox(input: {
       ephemeral: true,
       autoStopInterval: DAYTONA_AUTO_STOP_INTERVAL_MINUTES,
       autoArchiveInterval: DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES,
-      ...(networkAllowList
-        ? {
-            networkBlockAll: true,
-            networkAllowList,
-          }
-        : {}),
+      // A non-empty `networkAllowList` IS the "block all egress except these
+      // CIDRs" control; Daytona rejects create when `networkBlockAll: true` is
+      // combined with a non-empty allow-list ("networkBlockAll: true cannot be
+      // combined with a non-empty networkAllowList or domainAllowList"). Pass
+      // the allow-list alone so the egress restriction holds without the
+      // contradictory flag.
+      ...(networkAllowList ? { networkAllowList } : {}),
     },
     { timeout: DAYTONA_CREATE_TIMEOUT_SECONDS },
   );

package/dist/cli/index.js

@@ -623,10 +623,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.204",
+  version: "0.1.206",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.204",
+    latest: "0.1.206",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/cli/index.mjs

@@ -608,10 +608,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.204",
+  version: "0.1.206",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.204",
+    latest: "0.1.206",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.js

@@ -422,10 +422,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.204",
+  version: "0.1.206",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.204",
+    latest: "0.1.206",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -352,10 +352,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.204",
+  version: "0.1.206",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.204",
+    latest: "0.1.206",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.204",
+  "version": "0.1.206",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {