deepline 0.1.213 → 0.1.215

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -95,7 +95,7 @@ import {
   PLAY_RUNTIME_CONTRACT,
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from './runtime-contract';
-import { PLAY_RUNTIME_API_COMPAT_PATH } from './runtime-api-paths';
+import { PLAY_RUNTIME_API_CURRENT_PATH } from './runtime-api-paths';
 import {
   PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
   PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
@@ -298,6 +298,7 @@ const RUNTIME_WORK_RECEIPT_LEASE_COLUMNS = [
   'lease_expires_at',
 ] as const;
 const RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN = 'failure_kind';
+const RUNTIME_WORK_RECEIPT_KEY_INDEX = 'idx_deepline_step_receipts_k_unique';
 const RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS = [
   ...RUNTIME_WORK_RECEIPT_LEASE_COLUMNS,
   RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN,
@@ -504,7 +505,7 @@ function resolveRuntimeApiUrl(context: RuntimeApiContext): string {
   if (!baseUrl) {
     throw new Error('Runner runtime API requires a baseUrl.');
   }
-  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
+  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`;
 }
 
 function resolveRuntimeApiHeaders(
@@ -588,9 +589,11 @@ async function postRuntimeApi<TResponse>(
     const details =
       typeof parsed?.details === 'string'
         ? parsed.details
-        : typeof parsed?.debug_error === 'string'
-          ? parsed.debug_error
-          : null;
+        : typeof parsed?.detail === 'string'
+          ? parsed.detail
+          : typeof parsed?.debug_error === 'string'
+            ? parsed.debug_error
+            : null;
     const shouldRetryRuntimeResponse =
       (response.status === 503 &&
         parsed?.code === 'ingestion_plane_not_ready') ||
@@ -2040,6 +2043,22 @@ function isMissingRuntimeWorkReceiptSelfHealColumnError(
   );
 }
 
+function isMissingRuntimeWorkReceiptKeyConstraintError(
+  error: unknown,
+): boolean {
+  if (!error || typeof error !== 'object') {
+    return false;
+  }
+  const code = 'code' in error ? String(error.code) : '';
+  const message = 'message' in error ? String(error.message) : '';
+  return (
+    code === '42P10' ||
+    /no unique or exclusion constraint matching the ON CONFLICT specification/i.test(
+      message,
+    )
+  );
+}
+
 function runtimeWorkReceiptEnsureCacheKey(
   session: RuntimePostgresSession,
 ): string {
@@ -2119,22 +2138,29 @@ async function ensureRuntimeWorkReceiptTable(
         session,
         client,
       );
-      if (missingColumns.length === 0) return;
+      if (missingColumns.length > 0) {
+        await client.query(`
+          ALTER TABLE ${workReceiptTable(session)}
+            ${missingColumns
+              .map((column) => {
+                const type =
+                  column === 'lease_expires_at'
+                    ? 'timestamptz'
+                    : column === 'lease_owner_attempt'
+                      ? 'integer'
+                      : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
+                        ? 'smallint NOT NULL DEFAULT 0'
+                        : 'text';
+                return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
+              })
+              .join(',\n          ')}
+        `);
+      }
       await client.query(`
-        ALTER TABLE ${workReceiptTable(session)}
-          ${missingColumns
-            .map((column) => {
-              const type =
-                column === 'lease_expires_at'
-                  ? 'timestamptz'
-                  : column === 'lease_owner_attempt'
-                    ? 'integer'
-                    : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
-                      ? 'smallint NOT NULL DEFAULT 0'
-                      : 'text';
-              return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
-            })
-            .join(',\n          ')}
+        CREATE UNIQUE INDEX IF NOT EXISTS ${quoteIdentifier(
+          RUNTIME_WORK_RECEIPT_KEY_INDEX,
+        )}
+        ON ${workReceiptTable(session)} (k)
       `);
     })
     .then(() => undefined);
@@ -2238,7 +2264,8 @@ async function withRuntimeWorkReceiptClient<T>(
     } catch (error) {
       if (
         isMissingRelationError(error) ||
-        isMissingRuntimeWorkReceiptSelfHealColumnError(error)
+        isMissingRuntimeWorkReceiptSelfHealColumnError(error) ||
+        isMissingRuntimeWorkReceiptKeyConstraintError(error)
       ) {
         runtimeWorkReceiptEnsureCache.delete(
           runtimeWorkReceiptEnsureCacheKey(session),
@@ -4636,6 +4663,7 @@ export async function completeRuntimeWorkReceipt(
     runAttempt?: number | null;
     leaseId?: string | null;
     output: unknown;
+    returnOutput?: boolean;
   },
 ): Promise<WorkReceipt | null> {
   if (
@@ -4741,7 +4769,7 @@ export async function completeRuntimeWorkReceipt(
             })}
 	          RETURNING convert_from(k, 'UTF8') AS k,
 	                    status,
-	                    output,
+	                    CASE WHEN $7::boolean THEN output ELSE NULL::jsonb END AS output,
 	                    error,
 	                    failure_kind,
 	                    run_id,
@@ -4754,7 +4782,7 @@ export async function completeRuntimeWorkReceipt(
 	        replay AS (
 	          SELECT convert_from(k, 'UTF8') AS k,
 	                 status,
-	                 output,
+	                 CASE WHEN $7::boolean THEN output ELSE NULL::jsonb END AS output,
 	                 error,
 	                 failure_kind,
 	                 run_id,
@@ -4783,6 +4811,7 @@ export async function completeRuntimeWorkReceipt(
           input.runId,
           leaseId,
           runAttempt,
+          input.returnOutput !== false,
         ],
       );
       return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -4801,6 +4830,7 @@ export async function completeRuntimeWorkReceipts(
       leaseId?: string | null;
       runAttempt?: number | null;
     }>;
+    returnOutput?: boolean;
   },
 ): Promise<Array<WorkReceipt | null>> {
   const receipts = input.receipts.filter((receipt) => receipt.key.trim());
@@ -4819,6 +4849,7 @@ export async function completeRuntimeWorkReceipts(
         await completeRuntimeWorkReceipts(context, {
           playName: input.playName,
           receipts: siblingReceipts,
+          returnOutput: input.returnOutput,
         });
       } catch (error) {
         siblingError = error;
@@ -4938,7 +4969,7 @@ export async function completeRuntimeWorkReceipts(
            })}
         RETURNING target.k,
                   target.status,
-	                  target.output,
+	                  CASE WHEN $7::boolean THEN target.output ELSE NULL::jsonb END AS output,
 	                  target.error,
 	                  target.failure_kind,
 	                  target.run_id,
@@ -4952,7 +4983,7 @@ export async function completeRuntimeWorkReceipts(
       replay AS (
         SELECT target.k,
                target.status,
-               target.output,
+               CASE WHEN $7::boolean THEN target.output ELSE NULL::jsonb END AS output,
                target.error,
                target.failure_kind,
                target.run_id,
@@ -5020,6 +5051,7 @@ export async function completeRuntimeWorkReceipts(
             ),
           ),
           RECEIPT_STATUS_COMPLETED,
+          input.returnOutput !== false,
         ],
       );
       return rows.map((row) =>

package/dist/bundling-sources/shared_libs/play-runtime/runtime-contract.ts

@@ -1,8 +1,15 @@
-export const PLAY_RUNTIME_CONTRACT = 2;
+export const PLAY_RUNTIME_CONTRACT = 3;
 export const PLAY_RUNTIME_CONTRACT_MIN_SUPPORTED = 1;
 export const PLAY_RUNTIME_CONTRACT_HEADER = 'x-deepline-runtime-contract';
 
 export const RUNTIME_CONTRACT_CHANGELOG = [
+  {
+    contract: 3,
+    changed:
+      'Runtime receipt completion responses are compact acknowledgements; receipt reads remain the payload replay path.',
+    compatOwner: 'runtime',
+    compatRemoval: 'contract 2 support window closure',
+  },
   {
     contract: 2,
     changed:
@@ -12,6 +19,15 @@ export const RUNTIME_CONTRACT_CHANGELOG = [
   },
 ] as const;
 
+export function runtimeReceiptCompletionResponse<
+  T extends { output?: unknown },
+>(runtimeContract: number | null | undefined, receipt: T | null): T | null {
+  if (!receipt || (runtimeContract ?? 1) < 3) return receipt;
+  const { output, ...ack } = receipt;
+  void output;
+  return ack as T;
+}
+
 export type RuntimeContractResolution =
   | { ok: true; contract: number }
   | {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backend.ts

@@ -4,8 +4,9 @@
  * One of three pluggable axes (alongside runner-backends and dedup-backends).
  * Selected per-run via PlayExecutionProfile.
  *
- * Cloudflare Workflows is the default production scheduler through the
- * workers_edge profile. Absurd is the durable Daytona-backed scheduler.
+ * Absurd is the enabled production scheduler. The Cloudflare Workflows
+ * adapter is retained for historical run interpretation while workers_edge
+ * launch admission is disabled.
  *
  * Customer plays are unaffected — this is purely the orchestration layer.
  */

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -5,10 +5,18 @@ const JWT_RE =
   /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+// Only redact self-identifying credential prefixes here. Generic words such as
+// `key`, `token`, and `secret` are common in harmless play/run slugs (for
+// example `absurd-key-rotation-check`) and need an assignment context before
+// they are sensitive; HIGH_ENTROPY_ASSIGNMENT_RE handles that case below.
 const COMMON_SECRET_RE =
-  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+const GENERIC_PREFIXED_SECRET_RE =
+  /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const URL_SECRET_VALUE_RE =
   /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+const GENERIC_SECRET_ASSIGNMENT_RE =
+  /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 const HIGH_ENTROPY_ASSIGNMENT_RE =
   /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 const SENSITIVE_URL_PARAM_RE =
@@ -39,6 +47,8 @@ export function redactSecretLikeString(value: string): string {
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)
     .replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
+    .replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
+    .replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
       const separator = match.includes('=') ? '=' : ':';
       const [key] = match.split(separator, 1);

package/dist/bundling-sources/shared_libs/play-runtime/transient-service-error.ts

@@ -0,0 +1,10 @@
+export function transientServiceUnavailableDetail(
+  error: unknown,
+): string | null {
+  const detail = error instanceof Error ? error.message : String(error);
+  return /ServiceUnavailable|Service temporarily unavailable|temporarily unavailable \(Code:\s*\d+\)/i.test(
+    detail,
+  )
+    ? detail
+    : null;
+}