deepline 0.3.185 → 0.3.187

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.185',
+  version: '0.3.187',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/sdk/src/types.ts

@@ -1331,6 +1331,8 @@ export interface PlayDefinitionDetail {
     cronTimezone?: string | null;
     nextScheduledAt?: number | null;
     lastScheduledAt?: number | null;
+    blockedAt?: number | null;
+    blockedReasonCode?: string | null;
     blockedReason?: string | null;
     [key: string]: unknown;
   } | null;
@@ -1403,6 +1405,8 @@ export interface PlayTriggerStatus {
   cron: string | null;
   webhook: string | null;
   blockedReason: string | null;
+  blockedReasonCode?: string;
+  blockedAt?: number;
 }
 
 export interface ProductNotificationEventDefinition {

package/dist/bundling-sources/shared_libs/play-runtime/launch-identity.ts

@@ -0,0 +1,229 @@
+import { sha256Hex, stableStringify } from '../plays/row-identity';
+import { LEGACY_MAX_CONCURRENT_EXTERNAL_CALLS } from './governor/policy';
+import type { PlaySchedulerSubmitInput } from './scheduler-backend';
+
+/** Optional launch-envelope field used by the mixed-release admission fence. */
+export const PLAY_LAUNCH_IDENTITY_DIGEST_FIELD = 'launchIdentityDigest';
+const PLAY_LAUNCH_IDENTITY_DIGEST_NAMESPACE = 'deepline:play-launch-identity';
+
+export type PlayLaunchFieldRole = 'identity' | 'detail';
+
+/**
+ * Keep this list exhaustive over the launch envelope. A newly added field must
+ * be classified before it can participate in launch admission.
+ */
+export const PLAY_LAUNCH_ENVELOPE_FIELD_ROLES: {
+  readonly [K in keyof PlaySchedulerSubmitInput]-?: PlayLaunchFieldRole;
+} = {
+  orgId: 'identity',
+  playName: 'identity',
+  playReference: 'identity',
+  definitionScope: 'identity',
+  revisionId: 'identity',
+  artifactStorageKey: 'identity',
+  artifactHash: 'identity',
+  graphHash: 'identity',
+  workflowFamilyKey: 'identity',
+  inputSha256: 'identity',
+  source: 'identity',
+  triggerSource: 'identity',
+  parentRunId: 'identity',
+  rootRunId: 'identity',
+  asyncLaunchKey: 'identity',
+  asyncInvocationKey: 'identity',
+  asyncRequestFingerprint: 'identity',
+  force: 'identity',
+  forceToolRefresh: 'identity',
+  maxConcurrentExternalCalls: 'identity',
+  maxConcurrentRows: 'identity',
+  integrationMode: 'identity',
+  runtimeSandboxPlacementPolicyId: 'identity',
+  input: 'identity',
+  inputFile: 'identity',
+  inlineInputFile: 'identity',
+  inlineCsv: 'identity',
+  packagedFiles: 'identity',
+  runId: 'detail',
+  existingOnly: 'detail',
+  asyncParentRunAttempt: 'detail',
+  asyncParentRunLeaseToken: 'detail',
+  asyncParentAttemptRequired: 'detail',
+  asyncAncestryPlayIds: 'detail',
+  playId: 'detail',
+  schedulerSchema: 'detail',
+  requiresRunCreatedProjection: 'detail',
+  runtimeArtifact: 'detail',
+  runtimeProtocolVersion: 'detail',
+  staticPipeline: 'detail',
+  inputSummary: 'detail',
+  inputBytes: 'detail',
+  inputFileId: 'detail',
+  replayedFromRunId: 'detail',
+  totalRows: 'detail',
+  contractSnapshot: 'detail',
+  executionPlan: 'detail',
+  preloadedDbSessions: 'detail',
+  preloadedDbSessionUnwrapKey: 'detail',
+  executorToken: 'detail',
+  runtimeAuthority: 'detail',
+  runtimeApiBaseUrl: 'detail',
+  runtimeTokenOrigin: 'detail',
+  baseUrl: 'detail',
+  coordinatorUrl: 'detail',
+  coordinatorInternalToken: 'detail',
+  runtimeDeployVersion: 'detail',
+  absurdReleaseId: 'detail',
+  absurdReleaseEnvironment: 'detail',
+  vercelProtectionBypassToken: 'detail',
+  preferredReceiptGatewayMachineId: 'detail',
+  runtimeTestFaultHeader: 'detail',
+  testPolicyOverrides: 'detail',
+  submittedAtMs: 'detail',
+  schedulerBackend: 'detail',
+  executionProfile: 'detail',
+  runtimeBackend: 'detail',
+  queueMaxDelaySeconds: 'detail',
+  queuePriority: 'detail',
+  userEmail: 'detail',
+  userId: 'detail',
+  launchIdentityDigest: 'detail',
+};
+
+export const PLAY_LAUNCH_IDENTITY_FIELDS_COMPARED_OUTSIDE_DIGEST: readonly string[] =
+  Object.freeze(['runtimeSandboxPlacementPolicyId']);
+
+export const PLAY_LAUNCH_IDENTITY_FIELDS: readonly string[] = Object.freeze(
+  Object.entries(PLAY_LAUNCH_ENVELOPE_FIELD_ROLES)
+    .filter(([, role]) => role === 'identity')
+    .map(([field]) => field)
+    .sort(),
+);
+
+export const PLAY_LAUNCH_DETAIL_FIELDS: readonly string[] = Object.freeze(
+  Object.entries(PLAY_LAUNCH_ENVELOPE_FIELD_ROLES)
+    .filter(([, role]) => role === 'detail')
+    .map(([field]) => field)
+    .sort(),
+);
+
+export type PlayLaunchIdentitySource = Readonly<
+  Partial<Record<keyof PlaySchedulerSubmitInput, unknown>>
+>;
+
+function text(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function flag(value: unknown): boolean {
+  return value === true;
+}
+
+function count(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function stagedFileIdentity(value: unknown): Record<string, unknown> | null {
+  const file = record(value);
+  if (!file) return null;
+  return {
+    logicalPath:
+      text(file.logicalPath) ?? text(file.path) ?? text(file.playPath),
+    fileName: text(file.fileName) ?? text(file.name),
+    contentType: text(file.contentType),
+    bytes: count(file.bytes),
+    contentDigest:
+      typeof file.contentBase64 === 'string'
+        ? sha256Hex(file.contentBase64)
+        : typeof file.inlineText === 'string'
+          ? sha256Hex(file.inlineText)
+          : null,
+  };
+}
+
+function stagedFileListIdentity(
+  value: unknown,
+): Array<Record<string, unknown>> {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((entry) => stagedFileIdentity(entry))
+    .filter((entry): entry is Record<string, unknown> => entry !== null)
+    .sort((left, right) =>
+      stableStringify(left).localeCompare(stableStringify(right)),
+    );
+}
+
+/** Return only customer intent; transport, authority, and release details are excluded. */
+export function buildPlayLaunchIdentity(
+  launch: PlayLaunchIdentitySource,
+): Record<string, unknown> {
+  const inlineCsv = record(launch.inlineCsv);
+  return {
+    orgId: text(launch.orgId),
+    playName: text(launch.playName),
+    playReference: text(launch.playReference) ?? text(launch.playName),
+    definitionScope: text(launch.definitionScope),
+    revisionId: text(launch.revisionId),
+    artifactStorageKey: text(launch.artifactStorageKey),
+    artifactHash: text(launch.artifactHash),
+    graphHash: text(launch.graphHash),
+    workflowFamilyKey: text(launch.workflowFamilyKey),
+    inputSha256: text(launch.inputSha256),
+    source: text(launch.source),
+    triggerSource: text(launch.triggerSource),
+    parentRunId: text(launch.parentRunId),
+    rootRunId: text(launch.rootRunId),
+    asyncLaunchKey: text(launch.asyncLaunchKey),
+    asyncInvocationKey: text(launch.asyncInvocationKey),
+    asyncRequestFingerprint: text(launch.asyncRequestFingerprint),
+    force: flag(launch.force),
+    forceToolRefresh: flag(launch.forceToolRefresh),
+    integrationMode: text(launch.integrationMode),
+    maxConcurrentExternalCalls:
+      count(launch.maxConcurrentExternalCalls) ??
+      LEGACY_MAX_CONCURRENT_EXTERNAL_CALLS,
+    maxConcurrentRows: count(launch.maxConcurrentRows),
+    inputDigest: sha256Hex(stableStringify(launch.input ?? {})),
+    inputFile: stagedFileIdentity(launch.inputFile),
+    inlineInputFile: stagedFileIdentity(launch.inlineInputFile),
+    inlineCsv: inlineCsv
+      ? {
+          name: text(inlineCsv.name),
+          rowsDigest: sha256Hex(stableStringify(inlineCsv.rows ?? [])),
+        }
+      : null,
+    packagedFiles: stagedFileListIdentity(launch.packagedFiles),
+  };
+}
+
+export const PLAY_LAUNCH_DIGESTED_IDENTITY_FIELDS: readonly string[] =
+  Object.freeze(
+    PLAY_LAUNCH_IDENTITY_FIELDS.filter(
+      (field) =>
+        !PLAY_LAUNCH_IDENTITY_FIELDS_COMPARED_OUTSIDE_DIGEST.includes(field),
+    ),
+  );
+
+export function buildPlayLaunchIdentityDigest(
+  launch: PlayLaunchIdentitySource,
+): string {
+  return sha256Hex(
+    `${PLAY_LAUNCH_IDENTITY_DIGEST_NAMESPACE}\0${stableStringify(
+      buildPlayLaunchIdentity(launch),
+    )}`,
+  );
+}
+
+export function withPlayLaunchIdentityDigest<
+  T extends PlaySchedulerSubmitInput,
+>(launch: T): T {
+  return {
+    ...launch,
+    launchIdentityDigest: buildPlayLaunchIdentityDigest(launch),
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/admission/contracts.ts

@@ -42,16 +42,31 @@ export type PlayRunAdmissionJob = {
   admit(input: PlayRunAdmissionInput): Promise<PlayRunAdmissionOutcome>;
 };
 
+export type PlayRunLaunchConflictReason = 'launch_identity_mismatch';
+
 /** A stable, machine-readable rejection for a reused run id with new intent. */
 export class PlayRunLaunchConflictError extends Error {
   readonly code = 'PLAY_RUN_LAUNCH_CONFLICT';
+  readonly conflictReason: PlayRunLaunchConflictReason | undefined;
+  readonly conflictingFields: string[] | undefined;
 
-  constructor(runId: string, options?: { cause?: unknown }) {
+  constructor(
+    runId: string,
+    options?: {
+      cause?: unknown;
+      conflictReason?: PlayRunLaunchConflictReason;
+      conflictingFields?: readonly string[];
+    },
+  ) {
     super(
       `Play run "${runId}" already exists with a different launch.`,
       options,
     );
     this.name = 'PlayRunLaunchConflictError';
+    this.conflictReason = options?.conflictReason;
+    this.conflictingFields = options?.conflictingFields
+      ? [...options.conflictingFields]
+      : undefined;
   }
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/admission/postgres-adapter.ts

@@ -54,6 +54,9 @@ export function createPostgresPlayRunAdmissionPorts(input: {
               artifactHash: admission.launch.artifactHash,
               graphHash: admission.launch.graphHash,
               inputSha256: admission.launch.inputSha256,
+              launchIdentityDigest: admission.launch.launchIdentityDigest,
+              conflictReason: conflict.conflictReason ?? null,
+              conflictingFields: conflict.conflictingFields ?? null,
               error: conflict,
             });
             throw conflict;