deepline 0.3.295 → 0.3.297

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.295',
+  version: '0.3.297',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -193,6 +193,7 @@ import {
   readAbsurdSchemaSql,
 } from './absurd-pool';
 import {
+  isImmutableRuntimeExecutionRecoveryOrigin,
   runtimeApiBaseUrlFromLaunch,
   runtimeTokenOriginFromLaunch,
 } from './runtime-api-origin';
@@ -349,11 +350,15 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // v58 installs deferred outbox readers while retaining synchronous writers
 // until the separately operated, reader-first cutover.
 // v59 adds origin identity bulk projection and independent durable search progress.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 59;
+// v60 indexes all sandbox leases by Run, including released custody history.
+// This marker records deployment work, never a runtime schema floor.
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 60;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
   'runtime_scheduler_runs_open_recovery_idx';
+export const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX =
+  'runtime_scheduler_sandbox_capacity_leases_custody_idx';
 const POSTGRES_SCHEDULER_DEPENDENCY_CIRCUITS_TABLE =
   'runtime_dependency_circuits';
 /**
@@ -2693,6 +2698,12 @@ export async function ensurePostgresSchedulerSchema(
     const hasLegacyAdmissionRows =
       legacyAdmissionRows?.rows[0]?.present === true;
     if (schemaCoreIsCurrent) {
+      if (!options?.deferRuntimeAdminIndexes) {
+        await ensurePostgresSchedulerSandboxCustodyIndex(client, {
+          schema,
+          concurrently: false,
+        });
+      }
       await ensurePostgresSchedulerLaunchAdmissionFunctions(client, options);
       if (!schemaIsCurrent) {
         await ensurePostgresSchedulerTerminalComputeBillingOutboxTrigger(
@@ -3163,6 +3174,12 @@ export async function ensurePostgresSchedulerSchema(
       (run_id, provider, sandbox_id)
       WHERE released_at IS NULL
   `);
+    if (!options?.deferRuntimeAdminIndexes) {
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS ${POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX}
+          ON ${tableName('runtime_sandbox_capacity_leases', options)} (run_id, lease_id)
+      `);
+    }
     // Deletion note: runtime outbox producers were removed from the legacy
     // store path, but the table stays in bootstrap while run-read-model/admin
     // callers still import the projector against existing runtime_scheduler
@@ -4122,7 +4139,17 @@ export type PostgresSchedulerIndexState =
   | { kind: 'invalid'; ready: boolean }
   | { kind: 'ready' };
 
+// Custody locks include released history. The active-resource partial index
+// cannot serve that read while the transaction owns the Run and attempt locks.
+// This is a deploy-owned optimization, never a runtime admission prerequisite.
+const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION = {
+  name: POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX,
+  table: 'runtime_sandbox_capacity_leases',
+  definition: '(run_id, lease_id)',
+} as const;
+
 const POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES = [
+  POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION,
   {
     name: 'runtime_scheduler_attempts_active_status_created_idx',
     table: 'attempts',
@@ -4337,38 +4364,73 @@ export async function ensurePostgresSchedulerRuntimeAdminIndexesConcurrently(
   client: PostgresSchedulerQueryClient,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
-  const schema = schemaName(options);
   for (const index of POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES) {
-    const state = await readPostgresSchedulerIndexState(
-      client,
-      index.name,
-      index.table,
-      options,
+    await ensurePostgresSchedulerIndex(client, index, options, true);
+  }
+}
+
+async function ensurePostgresSchedulerIndex(
+  client: PostgresSchedulerQueryClient,
+  index: { name: string; table: string; definition: string },
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  concurrently: boolean,
+): Promise<void> {
+  const schema = schemaName(options);
+  const state = await readPostgresSchedulerIndexState(
+    client,
+    index.name,
+    index.table,
+    options,
+  );
+  if (state.kind === 'ready') return;
+  const mode = concurrently ? 'CONCURRENTLY ' : '';
+  if (state.kind === 'invalid') {
+    await client.query(
+      `DROP INDEX ${mode}IF EXISTS ${quoteIdent(schema)}.${quoteIdent(index.name)}`,
     );
-    if (state.kind === 'ready') continue;
-    if (state.kind === 'invalid') {
-      await client.query(
-        `DROP INDEX CONCURRENTLY IF EXISTS ${quoteIdent(schema)}.${quoteIdent(index.name)}`,
-      );
-    }
-    await client.query(`
-      CREATE INDEX CONCURRENTLY IF NOT EXISTS ${quoteIdent(index.name)}
-        ON ${tableName(index.table, options)} ${index.definition}
-    `);
-    const installed = await readPostgresSchedulerIndexState(
-      client,
-      index.name,
-      index.table,
-      options,
+  }
+  await client.query(`
+    CREATE INDEX ${mode}IF NOT EXISTS ${quoteIdent(index.name)}
+      ON ${tableName(index.table, options)} ${index.definition}
+  `);
+  const installed = await readPostgresSchedulerIndexState(
+    client,
+    index.name,
+    index.table,
+    options,
+  );
+  if (installed.kind !== 'ready') {
+    throw new Error(
+      `Runtime scheduler index ${schema}.${index.name} is not valid and ready after creation.`,
     );
-    if (installed.kind !== 'ready') {
-      throw new Error(
-        `Runtime scheduler index ${schema}.${index.name} is not valid and ready after concurrent creation.`,
-      );
-    }
   }
 }
 
+export async function readPostgresSchedulerSandboxCustodyIndexState(
+  client: PostgresSchedulerQueryClient,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerIndexState> {
+  return readPostgresSchedulerIndexState(
+    client,
+    POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX,
+    'runtime_sandbox_capacity_leases',
+    options,
+  );
+}
+
+/** Shared schemas build concurrently; only quiesced run-scoped schemas opt out. */
+export async function ensurePostgresSchedulerSandboxCustodyIndex(
+  client: PostgresSchedulerQueryClient,
+  options: Pick<PostgresSchedulerOptions, 'schema'> & { concurrently: boolean },
+): Promise<void> {
+  await ensurePostgresSchedulerIndex(
+    client,
+    POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION,
+    options,
+    options.concurrently,
+  );
+}
+
 export async function readPostgresSchedulerOpenRecoveryIndexState(
   client: PostgresSchedulerQueryClient,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -20976,12 +21038,12 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   );
 }
 
-// Only freshly gateway-issued legacy run.progress authority is reused.
-// Prefix advertisements are reacquired for each drain because they select its
-// receipt shape, including recovery across receiver capability changes. This is not
-// a lease cache: every delivery still claims, renews, and proves its own lease
-// at append. Include the complete pinned authority/routing and internal-token
-// fingerprint so a different run, schema, origin, or authority never shares it.
+// Reuse only gateway-issued run.progress authority. A prefix advertisement
+// remains reusable only for the same immutable app build; mutable receivers
+// must reacquire their current receipt shape on every drain. Every delivery
+// still claims, renews, and proves its own live lease at append. The complete
+// authority/routing and internal-token fingerprint isolates each run, schema,
+// origin, and authority. Cache loss or signer rotation never owns delivery.
 const RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS = 30_000;
 const RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES = 256;
 const runLedgerDispatchTokens = new Map<
@@ -21025,6 +21087,9 @@ async function requestRunLedgerDispatchToken(
       executorToken: cached.token,
       reused: true,
       cacheKey,
+      ...(cached.runLedgerIngressPrefixBatching
+        ? { runLedgerIngressPrefixBatching: true as const }
+        : {}),
     };
   runLedgerDispatchTokens.delete(cacheKey);
   const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
@@ -21096,6 +21161,11 @@ async function requestRunLedgerDispatchToken(
             : 'invalid response',
     });
   }
+  const reusablePrefix =
+    body.runLedgerIngressPrefixBatching === true &&
+    isImmutableRuntimeExecutionRecoveryOrigin(
+      runtimeApiBaseUrlFromLaunch(input.launch),
+    );
   // Decode only the lifetime, never an authentication decision: the app
   // validates the signature, run scope, and live delivery lease on append.
   // Opaque/older token formats continue to work without this optimization.
@@ -21107,7 +21177,7 @@ async function requestRunLedgerDispatchToken(
       ).toString(),
     ) as { exp?: unknown };
     if (
-      body.runLedgerIngressPrefixBatching === undefined &&
+      (body.runLedgerIngressPrefixBatching === undefined || reusablePrefix) &&
       typeof claims.exp === 'number' &&
       Number.isFinite(claims.exp)
     ) {
@@ -21119,6 +21189,9 @@ async function requestRunLedgerDispatchToken(
         runLedgerDispatchTokens.set(cacheKey, {
           token: body.executorToken,
           expiresAt,
+          ...(reusablePrefix
+            ? { runLedgerIngressPrefixBatching: true as const }
+            : {}),
         });
         while (
           runLedgerDispatchTokens.size > RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES
@@ -21132,7 +21205,7 @@ async function requestRunLedgerDispatchToken(
   } catch {
     // A cache miss never changes delivery or hides a gateway rejection.
   }
-  if (body.runLedgerIngressPrefixBatching !== undefined) {
+  if (body.runLedgerIngressPrefixBatching !== undefined && !reusablePrefix) {
     runLedgerDispatchTokens.delete(cacheKey);
   }
   return {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-outbox-recovery.ts

@@ -8,6 +8,7 @@
  * as a wake hint, and one exact timer for the next due row. There is
  * deliberately no worker fleet polling cadence.
  */
+import { isIsolatedRuntimeSchedulerSchema } from '../runtime-scheduler-topology';
 import {
   dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope,
   postgresSchedulerNotifyChannel,
@@ -36,7 +37,17 @@ const RECOVERY_FAILURE_RETRY_MAX_MS = 60_000;
 // seconds of worker deferrals. Only the dedicated projector performs this
 // fallback; the worker fleet still never polls the outbox.
 export const NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS = 1_000;
+/** Isolated Preview/dev schemas have no LISTEN session, so halve discovery latency. */
+export const ISOLATED_NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS = 500;
 const MAX_TIMEOUT_MS = 2_147_483_647;
+
+export function runLedgerOutboxNotifySafetyWakeMs(
+  schedulerSchema: string | null | undefined,
+): number {
+  return isIsolatedRuntimeSchedulerSchema(schedulerSchema)
+    ? ISOLATED_NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS
+    : NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS;
+}
 /**
  * One projector can keep this many independent Run Ledger deliveries in
  * flight after it has found durable work. Each delivery owns only short
@@ -84,6 +95,8 @@ export type RunLedgerOutboxRecoveryDeps = {
   acquireNotifyHub: () => PgNotifyHubLease | null;
   /** Bounded number of independent runs this replica may deliver at once. */
   parallelism?: number;
+  /** Fast polling is used only when the topology intentionally has no LISTEN session. */
+  notifyUnavailableSafetyWakeMs?: number;
   now?: () => number;
   setTimer?: (callback: () => void, delayMs: number) => RecoveryTimer;
   clearTimer?: (timer: RecoveryTimer) => void;
@@ -135,6 +148,8 @@ export function startRunLedgerOutboxRecovery(
   const clearTimer = deps.clearTimer ?? clearTimeout;
   const logger = deps.logger ?? console;
   const requestedParallelism = Math.floor(deps.parallelism ?? 1);
+  const notifyUnavailableSafetyWakeMs =
+    deps.notifyUnavailableSafetyWakeMs ?? NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS;
   const parallelism = Number.isFinite(requestedParallelism)
     ? Math.max(
         1,
@@ -240,13 +255,13 @@ export function startRunLedgerOutboxRecovery(
     failureCount += 1;
     // A rejected pooled query is normally worth exponential backoff. The
     // exception is an unavailable LISTEN session: this dedicated projector is
-    // the one durable poller, and its one-second safety wake is what keeps
+    // the one durable poller, and its topology-specific safety wake keeps
     // `run.created` delivery live while a direct PostgreSQL connection is
     // refused (for example, during a connection-capacity spike). Do not let a
     // process-local exponential cooldown silently disable that fallback.
     const delayMs = listenerIsAvailable()
       ? boundedFailureDelayMs(failureCount)
-      : NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS;
+      : notifyUnavailableSafetyWakeMs;
     logger.warn('[run-ledger-outbox.recovery_retry]', {
       stage,
       delayMs,
@@ -281,7 +296,7 @@ export function startRunLedgerOutboxRecovery(
     const exactDueMs = dueAt ? Math.max(0, dueAt.getTime() - now()) : null;
     const delayMs = listenerIsAvailable()
       ? exactDueMs
-      : Math.min(exactDueMs ?? Infinity, NOTIFY_UNAVAILABLE_SAFETY_WAKE_MS);
+      : Math.min(exactDueMs ?? Infinity, notifyUnavailableSafetyWakeMs);
     if (delayMs === null || !Number.isFinite(delayMs)) return;
     clearWakeTimer();
     timer = setTimer(
@@ -631,6 +646,9 @@ export function startRunLedgerOutboxRecoveryController(input: {
     // replicas therefore drain up to sixteen independent runs concurrently
     // without turning one outbox notification into sixty-four head scans.
     parallelism: RUN_LEDGER_OUTBOX_RECOVERY_PRODUCTION_IN_FLIGHT,
+    notifyUnavailableSafetyWakeMs: runLedgerOutboxNotifySafetyWakeMs(
+      schedulerOptions.schema,
+    ),
     readNextDueAt: () =>
       withRuntimeSchedulerClient(input.poolOptions, (client) =>
         readPostgresSchedulerOutboxNextDueAt(client, schedulerOptions),

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-api-origin.ts

@@ -1,5 +1,30 @@
 import type { PlaySchedulerSubmitInput } from '../scheduler-backend';
 
+const RUNTIME_EXECUTION_RECOVERY_DEPLOYMENT_HOST_RE =
+  /^deepline(?:-api-[a-z0-9]+|-(?!api-)[a-z0-9]+)-aero-team-0f650658\.vercel\.app$/;
+
+/** A recovery reader must remain on one immutable, Deepline-owned app build. */
+export function isImmutableRuntimeExecutionRecoveryOrigin(
+  origin: string,
+): boolean {
+  try {
+    const url = new URL(origin);
+    return (
+      url.origin === origin &&
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.port === '' &&
+      url.pathname === '/' &&
+      url.search === '' &&
+      url.hash === '' &&
+      RUNTIME_EXECUTION_RECOVERY_DEPLOYMENT_HOST_RE.test(url.hostname)
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Resolve the app origin used for authenticated runtime API calls.
  *

package/dist/cli/auth-DLGUNY3B.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunkV24XJVLXjs = require('./chunk-V24XJVLX.js');
+require('./chunk-34A5RSXF.js');
+require('./chunk-OSUS6K5I.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-IJGJKU4L.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkV24XJVLXjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkV24XJVLXjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkV24XJVLXjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkV24XJVLXjs.handleRegister; exports.handleStatus = _chunkV24XJVLXjs.handleStatus; exports.handleWait = _chunkV24XJVLXjs.handleWait; exports.readPendingAuthClaim = _chunkV24XJVLXjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkV24XJVLXjs.registerAuthCommands; exports.reportSetupCompleted = _chunkV24XJVLXjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkV24XJVLXjs.resolvePendingAuthClaimForResume;

package/dist/cli/{auth-EDTRERZP.mjs → auth-FOHTQKQV.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-YWWAF7KZ.mjs";
-import "./chunk-6O5YZOVN.mjs";
-import "./chunk-EACVZI6N.mjs";
+} from "./chunk-DBZX2IWV.mjs";
+import "./chunk-SZJM7D7W.mjs";
+import "./chunk-YFPOHUWQ.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-LDWT7RJK.mjs";
+import "./chunk-R2COLUYE.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";