deepline 0.1.305 → 0.1.306

package/dist/bundling-sources/sdk/src/release.ts

@@ -157,7 +157,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.305',
+  version: '0.1.306',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -69,6 +69,12 @@ function isInFlightRuntimeReceipt(
 export function runtimeReceiptFailureKindForError(
   error: unknown,
 ): WorkReceiptFailureKind {
+  // A failed ownership check means the runner cannot prove whether the
+  // invocation gateway or a newer attempt owns/completed the side effect. It
+  // must never stamp that receipt terminal: a later fenced Play Run attempt
+  // first reconciles the invocation receipt, then replays or reclaims safely.
+  if (error instanceof RuntimeReceiptLeaseLostError) return 'repairable';
+
   const toolFailureKind = getToolHttpErrorReceiptFailureKind(error);
   if (toolFailureKind) return toolFailureKind;
 
@@ -832,6 +838,13 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
     if (input.shouldPersistFailure?.(error) === false) {
       throw error;
     }
+    // The ownership is uncertain, so neither `fail` nor `release` is safe.
+    // Let the attempt-level cleanup and the receipt lease fence reconcile this
+    // on the next Play Run attempt. In particular, never replace a possibly
+    // completed invocation with a terminal error from the old owner.
+    if (error instanceof RuntimeReceiptLeaseLostError) {
+      throw error;
+    }
     if (
       isPlayExecutionSuspendedError(error) ||
       isPlayRowExecutionSuspendedError(error)

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -100,7 +100,24 @@ export type PlayRunnerBudgetChargeResult = {
 export interface PlayRunnerContextConfig {
   executorToken?: string;
   baseUrl?: string;
+  /**
+   * Runtime API origin reachable from a customer-code sandbox. Production sends
+   * execution traffic directly to the app; preview may use the combined gateway
+   * because the preview app requires a protection-bypass credential.
+   */
+  executionGatewayBaseUrl?: string | null;
   receiptGatewayBaseUrl?: string | null;
+  /**
+   * Request execution through the relay's durable invocation fence. This is
+   * required when the execution relay and receipt gateway have different
+   * origins, where the legacy same-origin inference cannot apply.
+   */
+  requestDurableInvocationFence?: boolean;
+  /**
+   * Preserves the explicit fence capability for callers that validate an
+   * ambiguous dispatched provider request before allowing a retry.
+   */
+  durableInvocationFence?: boolean;
   runtimeTestFaultHeader?: string | null;
   vercelProtectionBypassToken?: string | null;
   integrationMode?: 'live' | 'eval_stub' | 'fixture';

package/dist/bundling-sources/shared_libs/play-runtime/row-isolation.ts

@@ -1,4 +1,5 @@
 import { isHardBillingToolHttpError, ToolHttpError } from './tool-http-errors';
+import { RuntimeReceiptLeaseLostError } from './durable-receipt-execution';
 import { isRuntimePersistenceCircuitOpenError } from './persistence-latch';
 import { isWorkspaceStorageNotReadyFailure } from './run-failure';
 
@@ -33,6 +34,10 @@ export function isAbortLikeError(error: unknown): boolean {
  */
 export function isRowIsolationExemptError(error: unknown): boolean {
   if (isAbortLikeError(error)) return true;
+  // Receipt ownership loss is a control-plane uncertainty, not a provider row
+  // result. Propagate it to the one fenced Play Run task so its normal retry
+  // path can reconcile/replay the durable invocation before any redelivery.
+  if (error instanceof RuntimeReceiptLeaseLostError) return true;
   // A remote tool can return arbitrary provider/database wording. Its message
   // must never be mistaken for a failure of the runner's own receipt or sheet
   // persistence plane. Hard Deepline billing denials are the sole typed tool

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -362,10 +362,22 @@ function remoteRuntimeContextForDaytona(
       'Daytona execution requires DEEPLINE_RUNTIME_RECEIPT_GATEWAY_URL. Refusing to put app credentials or database sessions in the customer-code sandbox.',
     );
   }
+  const executionGatewayBaseUrl =
+    context.executionGatewayBaseUrl?.trim() || gatewayBaseUrl;
   return {
     ...context,
-    baseUrl: gatewayBaseUrl,
+    // Receipt ownership and runner terminal publication must stay on the Fly
+    // receipt gateway. Production execution calls go to the separate relay,
+    // keeping a blue/green receipt-gateway deploy out of long provider calls.
+    // Protected preview apps intentionally fall back to the combined gateway.
+    baseUrl: executionGatewayBaseUrl,
+    executionGatewayBaseUrl,
     receiptGatewayBaseUrl: gatewayBaseUrl,
+    // The execution relay owns the Postgres-backed invocation fence even though
+    // receipt control traffic has a different origin. This must stay explicit:
+    // origin equality was only a legacy shortcut for the combined gateway.
+    requestDurableInvocationFence: true,
+    durableInvocationFence: true,
     vercelProtectionBypassToken: null,
     dbSessionStrategy: 'gateway_only',
     preloadedDbSessions: undefined,

package/dist/cli/index.js

@@ -1037,7 +1037,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.305",
+  version: "0.1.306",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/cli/index.mjs

@@ -1022,7 +1022,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.305",
+  version: "0.1.306",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/index.js

@@ -760,7 +760,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.305",
+  version: "0.1.306",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/index.mjs

@@ -686,7 +686,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.305",
+  version: "0.1.306",
   contracts: {
     api: {
       name: "sdk-http-api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.305",
+  "version": "0.1.306",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {