deepline 0.3.314 → 0.3.316

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (134) hide show
  1. package/dist/bundling-sources/sdk/src/client.ts +12 -0
  2. package/dist/bundling-sources/sdk/src/release.ts +1 -1
  3. package/dist/bundling-sources/sdk/src/runs/overview.ts +17 -10
  4. package/dist/bundling-sources/sdk/src/types.ts +16 -5
  5. package/dist/bundling-sources/shared_libs/play-runtime/context.ts +217 -488
  6. package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts +15 -0
  7. package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts +4 -1
  8. package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts +13 -4
  9. package/dist/bundling-sources/shared_libs/play-runtime/launch-identity.ts +1 -0
  10. package/dist/bundling-sources/shared_libs/play-runtime/live-events.ts +31 -0
  11. package/dist/bundling-sources/shared_libs/play-runtime/map-execution-frame.ts +444 -51
  12. package/dist/bundling-sources/shared_libs/play-runtime/run-snapshot-stream.ts +22 -43
  13. package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts +4 -3
  14. package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts +136 -87
  15. package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts +24 -6
  16. package/dist/bundling-sources/shared_libs/play-runtime/runtime-operation-contract.ts +56 -0
  17. package/dist/bundling-sources/shared_libs/play-runtime/runtime-sheet-errors.ts +94 -0
  18. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backend.ts +2 -0
  19. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-shared.ts +5 -2
  20. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd.ts +20 -11
  21. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-progress.ts +18 -12
  22. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts +140 -9
  23. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-dispatch-authority.ts +2 -0
  24. package/dist/bundling-sources/shared_libs/play-runtime/work-receipt-storage-contract.ts +13 -0
  25. package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts +2 -0
  26. package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts +3 -2
  27. package/dist/bundling-sources/shared_libs/plays/docflow-binding-owner.ts +61 -11
  28. package/dist/cli/{auth-GWF55S3N.mjs → auth-JP7ZJ4OI.mjs} +4 -4
  29. package/dist/cli/auth-SPUJ4EXC.js +31 -0
  30. package/dist/cli/{billing-WWOJN7GV.mjs → billing-KG6MC2BC.mjs} +4 -4
  31. package/dist/cli/{billing-2YU6E2IF.js → billing-WZGS32ME.js} +70 -70
  32. package/dist/cli/{chunk-OJ243ZA5.js → chunk-2HKPAZVJ.js} +1 -1
  33. package/dist/cli/{chunk-YVMJTXEG.js → chunk-35YXDTOB.js} +26 -26
  34. package/dist/cli/{chunk-QB5MAFCU.mjs → chunk-46ZOD4PQ.mjs} +1 -1
  35. package/dist/cli/{chunk-CPN2N6EZ.mjs → chunk-6R5ACEWN.mjs} +43 -17
  36. package/dist/cli/{chunk-US4S3E4Y.mjs → chunk-7PZFGB7L.mjs} +1 -1
  37. package/dist/cli/{chunk-3CKNUJVZ.mjs → chunk-AXAPMVUC.mjs} +4 -4
  38. package/dist/cli/{chunk-ENQZV7NR.js → chunk-B6OOVO3A.js} +562 -536
  39. package/dist/cli/{chunk-WDPRE6DU.js → chunk-BOKHMPCZ.js} +48 -48
  40. package/dist/cli/{chunk-VFRZG4OW.js → chunk-C6QGM72M.js} +1 -1
  41. package/dist/cli/{chunk-IZTIBG7A.mjs → chunk-D3NMIACS.mjs} +29 -15
  42. package/dist/cli/{chunk-DR3S76BG.mjs → chunk-DAFGPNVW.mjs} +1 -1
  43. package/dist/cli/{chunk-3K6QD7Z3.mjs → chunk-F2T5UENG.mjs} +1 -1
  44. package/dist/cli/{chunk-VWW6VHQX.js → chunk-G2G67D3L.js} +60 -60
  45. package/dist/cli/{chunk-ODEWOXWW.js → chunk-GHLWDXUB.js} +6 -6
  46. package/dist/cli/{chunk-25SPKKF2.mjs → chunk-IDSDRGKF.mjs} +1 -1
  47. package/dist/cli/{chunk-OUHCJL5B.mjs → chunk-J3ZPMADG.mjs} +1 -1
  48. package/dist/cli/{chunk-MLEJ2FYH.js → chunk-K3BIRBT3.js} +248 -234
  49. package/dist/cli/{chunk-N5V2SBB2.mjs → chunk-KP7W5NO6.mjs} +1 -1
  50. package/dist/cli/{chunk-B5LUKLKH.js → chunk-MCPHK7AF.js} +4 -4
  51. package/dist/cli/{chunk-2Q2IKUL5.mjs → chunk-OB3SYJGU.mjs} +3 -3
  52. package/dist/cli/{chunk-UZTTPEG2.js → chunk-PJERS5VW.js} +6 -6
  53. package/dist/cli/{chunk-VBRO5QCI.js → chunk-RBBSRB56.js} +15 -15
  54. package/dist/cli/{chunk-NG4WDOGN.js → chunk-SRUWVQ66.js} +6 -6
  55. package/dist/cli/{chunk-WTO3ITBC.mjs → chunk-TYSAKSX7.mjs} +2 -2
  56. package/dist/cli/{chunk-HTXZLCSP.mjs → chunk-VC25WFXV.mjs} +2 -2
  57. package/dist/cli/{chunk-3A4LJUX6.mjs → chunk-VDPBQCRQ.mjs} +2 -2
  58. package/dist/cli/{chunk-IALPYID6.js → chunk-XSEMQ4II.js} +3 -3
  59. package/dist/cli/{chunk-JNUHGWB2.js → chunk-YEMOOWZI.js} +50 -50
  60. package/dist/cli/{chunk-JZZT4GAY.mjs → chunk-YNSAVFWL.mjs} +5 -5
  61. package/dist/cli/{chunk-GSRDZD7R.js → chunk-ZNHGAWYI.js} +2 -2
  62. package/dist/cli/client-GMMPQT7B.js +20 -0
  63. package/dist/cli/{client-EYGNDORT.mjs → client-MNPM4ME3.mjs} +3 -3
  64. package/dist/cli/{csv-YOW5JMOH.js → csv-G72FIQWI.js} +12 -12
  65. package/dist/cli/{csv-NZCN7SVV.mjs → csv-ZME7HAPR.mjs} +3 -3
  66. package/dist/cli/{db-HALJV3KY.mjs → db-K2DS4PEY.mjs} +4 -4
  67. package/dist/cli/{db-6BIYLZ6F.js → db-KRBWHSMA.js} +20 -20
  68. package/dist/cli/{describe-KY2ZYGBR.mjs → describe-LXBJP6OP.mjs} +10 -10
  69. package/dist/cli/{describe-WA6R2JSH.js → describe-UKFV376D.js} +17 -17
  70. package/dist/cli/{executions-CBOAN6KI.mjs → executions-2V3AROY6.mjs} +4 -4
  71. package/dist/cli/{executions-NMCTN7XM.js → executions-E66AM4JU.js} +6 -6
  72. package/dist/cli/{feedback-ZZFDSCWS.js → feedback-7C2N7M37.js} +6 -6
  73. package/dist/cli/{feedback-FOMPE3DJ.mjs → feedback-IEPZ2XKZ.mjs} +3 -3
  74. package/dist/cli/{git-YQR2NBCO.mjs → git-AR5KGN4O.mjs} +4 -4
  75. package/dist/cli/git-EXYB66IH.js +23 -0
  76. package/dist/cli/index.js +171 -98
  77. package/dist/cli/index.mjs +114 -41
  78. package/dist/cli/{legacy-noops-XH2TFFI6.js → legacy-noops-A2SH45P4.js} +7 -7
  79. package/dist/cli/{legacy-noops-KMU6P3K4.mjs → legacy-noops-LC2EGAZU.mjs} +4 -4
  80. package/dist/cli/{monitors-2ONK5L3I.mjs → monitors-5YPW3IZQ.mjs} +4 -4
  81. package/dist/cli/{monitors-5M3BZ5OR.js → monitors-IZBUPKPW.js} +85 -85
  82. package/dist/cli/{org-LR5BMCGL.mjs → org-2OMYI5KJ.mjs} +4 -4
  83. package/dist/cli/{org-6MKULUZI.js → org-L42SQ65U.js} +60 -60
  84. package/dist/cli/play-CQI3IDDN.js +152 -0
  85. package/dist/cli/{play-4NOSD7DW.mjs → play-UPCBLAOH.mjs} +9 -9
  86. package/dist/cli/{providers-UFJD3VKF.js → providers-GGNDWUKB.js} +7 -7
  87. package/dist/cli/{providers-UBGIKGCA.mjs → providers-VE2RM56M.mjs} +4 -4
  88. package/dist/cli/{quickstart-KQZHZE6C.js → quickstart-4CZHURUX.js} +5 -5
  89. package/dist/cli/{quickstart-KDUKQRUH.mjs → quickstart-HSJ7FU7Z.mjs} +3 -3
  90. package/dist/cli/{search-4BVOOS5Q.mjs → search-MWBM3I2L.mjs} +5 -5
  91. package/dist/cli/search-PD5FBCUN.js +26 -0
  92. package/dist/cli/{secrets-TVXZ3WJ3.js → secrets-CWBPGDZV.js} +13 -13
  93. package/dist/cli/{secrets-YGV23N3N.mjs → secrets-W5DQYKGU.mjs} +4 -4
  94. package/dist/cli/{sessions-RWIQWDFD.js → sessions-EDCFU6P2.js} +5 -5
  95. package/dist/cli/{sessions-G7ROUW35.mjs → sessions-Q42GUYTF.mjs} +4 -4
  96. package/dist/cli/{settings-TG3E2NR7.js → settings-OKRENZGX.js} +74 -74
  97. package/dist/cli/{settings-QZEVGCXE.mjs → settings-SO56AJPQ.mjs} +7 -7
  98. package/dist/cli/{setup-3KDUNEEE.js → setup-7PLHLNLS.js} +41 -41
  99. package/dist/cli/{setup-HUXINKOH.mjs → setup-OTYMF5CZ.mjs} +6 -6
  100. package/dist/cli/{skills-LHU3DB7J.mjs → skills-4UFS4FXP.mjs} +4 -4
  101. package/dist/cli/skills-IP7IW7EQ.js +28 -0
  102. package/dist/cli/{tools-J5WQ33BB.mjs → tools-6FV543YV.mjs} +6 -6
  103. package/dist/cli/tools-A2YNR6PI.js +38 -0
  104. package/dist/cli/{update-T6744RM7.mjs → update-6POGDXYW.mjs} +6 -6
  105. package/dist/cli/update-QXSGKLJG.js +28 -0
  106. package/dist/cli/{workflow-CG2B65HD.mjs → workflow-HVZSFWYR.mjs} +5 -5
  107. package/dist/cli/{workflow-YF5SQJLG.js → workflow-RB4POZP5.js} +15 -15
  108. package/dist/{client-OBwghxPC.d.ts → client-BV68GMPo.d.ts} +19 -6
  109. package/dist/{client-CtVdLZux.d.mts → client-D9ACjiRC.d.mts} +19 -6
  110. package/dist/{compiler-manifest-wOKNiXpa.d.mts → compiler-manifest-BXcZ4P4W.d.mts} +2 -2
  111. package/dist/{compiler-manifest-wOKNiXpa.d.ts → compiler-manifest-BXcZ4P4W.d.ts} +2 -2
  112. package/dist/index.d.mts +4 -4
  113. package/dist/index.d.ts +4 -4
  114. package/dist/index.js +7 -7
  115. package/dist/index.mjs +4 -4
  116. package/dist/install-integrity.json +82 -82
  117. package/dist/plays/bundle-play-file.d.mts +2 -2
  118. package/dist/plays/bundle-play-file.d.ts +2 -2
  119. package/dist/plays/bundle-play-file.mjs +2 -2
  120. package/dist/plays/run-request.d.mts +2 -2
  121. package/dist/plays/run-request.d.ts +2 -2
  122. package/dist/release.d.mts +1 -1
  123. package/dist/release.d.ts +1 -1
  124. package/dist/release.js +2 -2
  125. package/dist/release.mjs +1 -1
  126. package/package.json +1 -1
  127. package/dist/cli/auth-QX2L4LPM.js +0 -31
  128. package/dist/cli/client-Z4VFNTUB.js +0 -20
  129. package/dist/cli/git-AC2ATBDK.js +0 -23
  130. package/dist/cli/play-U3CZ4F2W.js +0 -152
  131. package/dist/cli/search-Y7OTFRCI.js +0 -26
  132. package/dist/cli/skills-CO5YUWBK.js +0 -28
  133. package/dist/cli/tools-MWPT5X47.js +0 -38
  134. package/dist/cli/update-VVIJW7ZJ.js +0 -28
@@ -1,4 +1,5 @@
1
1
  import { RUN_EVENT_KIND } from '../run-event-catalog';
2
+ import { normalizeTableNamespace } from '../../plays/row-identity';
2
3
  /**
3
4
  * Live step/progress ledger reporting for Node runtime workers.
4
5
  *
@@ -109,7 +110,7 @@ export function buildOrderedNodeList(
109
110
  }));
110
111
  }
111
112
 
112
- /** Map logical dataset namespaces to their static-pipeline node IDs. */
113
+ /** Keep authored node identity separate from the normalized Runtime Sheet namespace. */
113
114
  type StaticDatasetNodeRef = {
114
115
  nodeId: string;
115
116
  logicalNamespace: string;
@@ -129,10 +130,16 @@ function buildMapNodeLookup(
129
130
  for (let index = 0; index < substeps.length; index += 1) {
130
131
  const substep = substeps[index]!;
131
132
  if (substep.type !== 'dataset') continue;
132
- const logicalNamespace =
133
- substep.tableNamespace?.trim() || substep.field.trim();
133
+ const staticNamespace = substep.tableNamespace?.trim();
134
+ const logicalNamespace = staticNamespace || substep.field.trim();
134
135
  if (!logicalNamespace) continue;
135
- lookup.set(logicalNamespace, {
136
+ // Literal dataset keys share the Runtime Sheet namespace contract. A legacy
137
+ // field-only label can be source-expression text, so retain its existing
138
+ // lookup behavior rather than validating or guessing a physical identity.
139
+ const lookupNamespace = staticNamespace
140
+ ? normalizeTableNamespace(staticNamespace)
141
+ : logicalNamespace;
142
+ lookup.set(lookupNamespace, {
136
143
  nodeId: getStaticSubstepNodeId(substep, index),
137
144
  logicalNamespace,
138
145
  });
@@ -140,6 +147,7 @@ function buildMapNodeLookup(
140
147
  return lookup;
141
148
  }
142
149
 
150
+ /** Resolve normalized literal dataset namespaces to unchanged authored node IDs. */
143
151
  export function buildMapNodeIdLookup(
144
152
  contractSnapshot: unknown,
145
153
  ): Map<string, string> {
@@ -1219,23 +1227,21 @@ export function createPostgresSchedulerProgressReporter(input: {
1219
1227
  ) {
1220
1228
  mapsWithResolverActivity.delete(nodeId);
1221
1229
  stepLifecycle.onMapStarted(nodeId);
1230
+ const failedRows = 'failedRows' in event ? (event.failedRows ?? 0) : 0;
1231
+ const startedRows =
1232
+ event.completedRows + failedRows + (event.supersededRows ?? 0);
1222
1233
  setNodeProgress(nodeId, {
1223
1234
  completed: event.completedRows,
1224
- failed: 0,
1235
+ failed: failedRows,
1225
1236
  total: eventTotalRows,
1226
1237
  rowActivitySource: 'map_start',
1227
1238
  rowActivityStartedAt: event.at,
1228
1239
  rowActivityObservedAt: event.at,
1229
- startedRows: event.completedRows + (event.supersededRows ?? 0),
1240
+ startedRows,
1230
1241
  activeRows: 0,
1231
1242
  waitingRows:
1232
1243
  typeof eventTotalRows === 'number'
1233
- ? Math.max(
1234
- 0,
1235
- eventTotalRows -
1236
- event.completedRows -
1237
- (event.supersededRows ?? 0),
1238
- )
1244
+ ? Math.max(0, eventTotalRows - startedRows)
1239
1245
  : undefined,
1240
1246
  completedRows: event.completedRows,
1241
1247
  ...(event.supersededRows !== undefined
@@ -32,7 +32,10 @@ import type {
32
32
  PlayRunnerResult,
33
33
  PlayRunnerRuntimeTiming,
34
34
  } from '../protocol';
35
- import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
35
+ import {
36
+ normalizeRuntimeSchedulerSchema,
37
+ PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA,
38
+ } from '../runtime-scheduler-topology';
36
39
  import {
37
40
  RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
38
41
  RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
@@ -15682,6 +15685,34 @@ export async function getPostgresSchedulerObservations(
15682
15685
  return result.rows.map(mapObservationRow);
15683
15686
  }
15684
15687
 
15688
+ /** Read the newest settled observation for one node across a bounded page of runs. */
15689
+ export async function getPostgresSchedulerObservationsForRuns(
15690
+ client: PostgresSchedulerQueryClient,
15691
+ input: { runIds: readonly string[]; nodeId: string },
15692
+ options: PostgresSchedulerReceiptOptions,
15693
+ ): Promise<DocflowObservationRecord[]> {
15694
+ const runIds = [
15695
+ ...new Set(input.runIds.map((runId) => runId.trim()).filter(Boolean)),
15696
+ ];
15697
+ if (runIds.length === 0) return [];
15698
+ const result = await client.query<ObservationRow>(
15699
+ `
15700
+ SELECT DISTINCT ON (run_id)
15701
+ run_id, attempt, node_id, invocation_seq, invocation_id, status,
15702
+ inputs_json, outputs_json, inputs_truncated, outputs_truncated,
15703
+ error, started_at, settled_at
15704
+ FROM ${tableName('observations', options)}
15705
+ WHERE org_id = $1
15706
+ AND run_id = ANY($2::text[])
15707
+ AND node_id = $3
15708
+ AND status IN ('completed', 'failed')
15709
+ ORDER BY run_id, attempt DESC, invocation_seq DESC
15710
+ `,
15711
+ [receiptOrgId(options), runIds, input.nodeId],
15712
+ );
15713
+ return result.rows.map(mapObservationRow);
15714
+ }
15715
+
15685
15716
  export async function countPostgresSchedulerReceipts(
15686
15717
  client: PostgresSchedulerQueryClient,
15687
15718
  input: {
@@ -20452,6 +20483,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
20452
20483
  tokenAuthority,
20453
20484
  options,
20454
20485
  input.runtimeApi?.signal,
20486
+ reuseMarginMs,
20455
20487
  )
20456
20488
  : loadPostgresSchedulerRuntimeApiForRun(
20457
20489
  withClient,
@@ -20462,6 +20494,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
20462
20494
  tokenAuthority,
20463
20495
  options,
20464
20496
  input.runtimeApi?.signal,
20497
+ reuseMarginMs,
20465
20498
  );
20466
20499
  const gatewayRuntimeApi =
20467
20500
  needsRuntimeApi && tokenAuthority === 'gateway'
@@ -20617,6 +20650,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
20617
20650
  tokenAuthority,
20618
20651
  options,
20619
20652
  runtimeApi.signal,
20653
+ reuseMarginMs,
20620
20654
  );
20621
20655
  if (refreshed.baseUrl !== runtimeApi.baseUrl) {
20622
20656
  throw new Error(
@@ -21345,6 +21379,7 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
21345
21379
  tokenAuthority: RunLedgerOutboxTokenAuthority,
21346
21380
  options?: Pick<PostgresSchedulerOptions, 'schema'>,
21347
21381
  signal?: AbortSignal,
21382
+ tokenReuseMarginMs = 0,
21348
21383
  ): Promise<
21349
21384
  WorkerRuntimeApiContext & {
21350
21385
  refreshExecutorToken?: () => Promise<string>;
@@ -21386,18 +21421,37 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
21386
21421
  schedulerSchema: options?.schema ?? null,
21387
21422
  signal,
21388
21423
  };
21389
- const dispatchAuthority =
21390
- await requestRunLedgerDispatchToken(dispatchRequest);
21391
- invalidateExecutorToken = () =>
21392
- runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
21393
- if (dispatchAuthority.reused) {
21424
+ const preMintedToken = usableRunLedgerExecutorToken(
21425
+ launch,
21426
+ tokenReuseMarginMs,
21427
+ options,
21428
+ );
21429
+ if (preMintedToken) {
21430
+ // Admission minted this token with only `run.ledger.project`.
21431
+ // Each projection request still proves its exact outbox lease at the
21432
+ // receiver, and the scheduler ACK remains fenced to that same lease.
21433
+ executorToken = preMintedToken.executorToken;
21434
+ // The issuer advertises its own immutable receiver in the signed token.
21435
+ // Merely targeting an immutable URL never proves receipt support.
21436
+ runLedgerIngressPrefixBatching =
21437
+ preMintedToken.runLedgerIngressPrefixBatching;
21394
21438
  refreshExecutorToken = async () =>
21395
21439
  (await requestRunLedgerDispatchToken(dispatchRequest, true))
21396
21440
  .executorToken;
21441
+ } else {
21442
+ const dispatchAuthority =
21443
+ await requestRunLedgerDispatchToken(dispatchRequest);
21444
+ invalidateExecutorToken = () =>
21445
+ runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
21446
+ if (dispatchAuthority.reused) {
21447
+ refreshExecutorToken = async () =>
21448
+ (await requestRunLedgerDispatchToken(dispatchRequest, true))
21449
+ .executorToken;
21450
+ }
21451
+ executorToken = dispatchAuthority.executorToken;
21452
+ runLedgerIngressPrefixBatching =
21453
+ dispatchAuthority.runLedgerIngressPrefixBatching;
21397
21454
  }
21398
- executorToken = dispatchAuthority.executorToken;
21399
- runLedgerIngressPrefixBatching =
21400
- dispatchAuthority.runLedgerIngressPrefixBatching;
21401
21455
  }
21402
21456
  return {
21403
21457
  baseUrl: runtimeApiBaseUrlFromLaunch(launch),
@@ -21420,6 +21474,7 @@ async function loadPostgresSchedulerRuntimeApiForRun(
21420
21474
  tokenAuthority: RunLedgerOutboxTokenAuthority,
21421
21475
  options?: Pick<PostgresSchedulerOptions, 'schema'>,
21422
21476
  signal?: AbortSignal,
21477
+ tokenReuseMarginMs = 0,
21423
21478
  ): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
21424
21479
  // A continuation already owns its next event lease, so its launch context
21425
21480
  // is not part of the preclaim result. Load only the authority fields here.
@@ -21439,9 +21494,85 @@ async function loadPostgresSchedulerRuntimeApiForRun(
21439
21494
  tokenAuthority,
21440
21495
  options,
21441
21496
  signal,
21497
+ tokenReuseMarginMs,
21442
21498
  );
21443
21499
  }
21444
21500
 
21501
+ /**
21502
+ * Admission persists an optional, run-scoped `run.ledger.project` token for the
21503
+ * worker's terminal fast path. Treat it as usable only when its decoded claims
21504
+ * match the exact durable launch contract and it has enough time left for a
21505
+ * complete projection. The app runtime still verifies the signature, action
21506
+ * capability, and live outbox lease before writing; a mismatch falls back to
21507
+ * the lease-validated mint endpoint. Prefix grouping additionally requires the
21508
+ * issuer's explicit advertisement to match the launch's immutable receiver;
21509
+ * its absence preserves legacy grouping without discarding the usable token.
21510
+ */
21511
+ function usableRunLedgerExecutorToken(
21512
+ launch: RunLedgerDispatchLaunch,
21513
+ reuseMarginMs: number,
21514
+ options?: Pick<PostgresSchedulerOptions, 'schema'>,
21515
+ ): {
21516
+ executorToken: string;
21517
+ runLedgerIngressPrefixBatching?: true;
21518
+ } | null {
21519
+ const token = launch.runLedgerExecutorToken;
21520
+ if (!token || typeof token !== 'string') return null;
21521
+
21522
+ try {
21523
+ const claims = decodeJwt(token) as Record<string, unknown>;
21524
+ const authority = launch.runtimeAuthority;
21525
+ if (!authority || typeof authority !== 'object') return null;
21526
+
21527
+ const expiresAtMs =
21528
+ typeof claims.exp === 'number' &&
21529
+ Number.isSafeInteger(claims.exp) &&
21530
+ Number.isSafeInteger(claims.exp * 1_000)
21531
+ ? claims.exp * 1_000
21532
+ : null;
21533
+ const expectedOrigin = new URL(runtimeTokenOriginFromLaunch(launch)).origin;
21534
+ const expectedSchedulerSchema = normalizeRuntimeSchedulerSchema(
21535
+ authority.schedulerSchema,
21536
+ );
21537
+ const requestedSchedulerSchema = normalizeRuntimeSchedulerSchema(
21538
+ options?.schema,
21539
+ );
21540
+
21541
+ if (
21542
+ expiresAtMs === null ||
21543
+ expiresAtMs <= Date.now() + reuseMarginMs ||
21544
+ claims.iss !== 'deepline.internal' ||
21545
+ claims.aud !== 'deepline.workflow.execution' ||
21546
+ claims.purpose !== 'workflow_run_execution' ||
21547
+ claims.org_id !== launch.orgId ||
21548
+ claims.org_id !== authority.orgId ||
21549
+ claims.run_id !== launch.runId ||
21550
+ claims.run_id !== authority.runId ||
21551
+ claims.workflow_id !== authority.workflowId ||
21552
+ claims.runtime_origin !== expectedOrigin ||
21553
+ normalizeRuntimeSchedulerSchema(claims.scheduler_schema) !==
21554
+ expectedSchedulerSchema ||
21555
+ (requestedSchedulerSchema !== null &&
21556
+ requestedSchedulerSchema !== expectedSchedulerSchema) ||
21557
+ !Array.isArray(claims.capabilities) ||
21558
+ claims.capabilities.length !== 1 ||
21559
+ claims.capabilities[0] !== 'run.ledger.project'
21560
+ ) {
21561
+ return null;
21562
+ }
21563
+ const receiverOrigin = new URL(runtimeApiBaseUrlFromLaunch(launch)).origin;
21564
+ return {
21565
+ executorToken: token,
21566
+ ...(claims.run_ledger_ingress_prefix_origin === receiverOrigin &&
21567
+ isImmutableRuntimeExecutionRecoveryOrigin(receiverOrigin)
21568
+ ? { runLedgerIngressPrefixBatching: true as const }
21569
+ : {}),
21570
+ };
21571
+ } catch {
21572
+ return null;
21573
+ }
21574
+ }
21575
+
21445
21576
  // Reuse only gateway-issued run.progress authority. A prefix advertisement
21446
21577
  // remains reusable only for the same immutable app build; mutable receivers
21447
21578
  // must reacquire their current receipt shape on every drain. Every delivery
@@ -12,6 +12,7 @@ export type RunLedgerDispatchLaunch = Pick<
12
12
  | 'playId'
13
13
  | 'playName'
14
14
  | 'executorToken'
15
+ | 'runLedgerExecutorToken'
15
16
  | 'baseUrl'
16
17
  | 'runtimeApiBaseUrl'
17
18
  | 'runtimeTokenOrigin'
@@ -27,6 +28,7 @@ export function runLedgerDispatchLaunchSql(alias: string): string {
27
28
  'playId',
28
29
  'playName',
29
30
  'executorToken',
31
+ 'runLedgerExecutorToken',
30
32
  'baseUrl',
31
33
  'runtimeApiBaseUrl',
32
34
  'runtimeTokenOrigin',
@@ -13,6 +13,19 @@ export const WORK_RECEIPT_KEY_FORMAT = {
13
13
  separator: ':',
14
14
  } as const;
15
15
 
16
+ /** Reserved scalar admission fact, distinct from customer-authored work output. */
17
+ export const RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND =
18
+ 'runtime-sheet-write-intent';
19
+
20
+ /** Keep internal sheet admission facts out of customer work-output projections. */
21
+ export function workReceiptOutputPredicateSql(keyColumn = 'k'): string {
22
+ const keySql = `convert_from(${keyColumn}, 'UTF8')`;
23
+ const intentPrefix = encodeURIComponent(
24
+ `["${RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND}",`,
25
+ );
26
+ return `NOT (starts_with(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.prefix}${WORK_RECEIPT_KEY_FORMAT.separator}') AND starts_with(split_part(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.separator}', 4), '${intentPrefix}'))`;
27
+ }
28
+
16
29
  export const WORK_RECEIPT_STATUS_CODE = {
17
30
  queued: 0,
18
31
  pending: 0,
@@ -117,6 +117,7 @@ export async function mintWorkflowExecutorToken(input: {
117
117
  terminalContract?: DirectCompletedTerminalContract | null;
118
118
  capabilities?: readonly RuntimeExecutionCapability[];
119
119
  runtimeOrigin?: string | null;
120
+ runLedgerIngressPrefixOrigin?: string | null;
120
121
  }) {
121
122
  const playName = input.playName?.trim() || input.workflowId;
122
123
  return mintWorkflowRunExecutionToken({
@@ -138,6 +139,7 @@ export async function mintWorkflowExecutorToken(input: {
138
139
  terminalContract: input.terminalContract,
139
140
  capabilities: input.capabilities,
140
141
  runtimeOrigin: input.runtimeOrigin,
142
+ runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
141
143
  });
142
144
  }
143
145
 
@@ -1548,7 +1548,7 @@ export interface PlayAuthoringRuntimeContext {
1548
1548
  ): Promise<T>;
1549
1549
 
1550
1550
  /**
1551
- * Execute a guarded HTTP request. By default it is durable and replay-safe; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
1551
+ * Execute a guarded HTTP request. By default, completed responses are durably reused; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Failed requests do not publish completed cache entries. A headers timeout leaves an upstream write's outcome unknown and does not establish whether its body was sent. The transport does not automatically retry that timed-out write, but a later invocation can execute it again. Mutating requests require provider-supported idempotency with the same key retained across retries and replay. Deadlines are platform-controlled; callers may cancel through `init.signal`. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
1552
1552
  *
1553
1553
  * @sdkReference runtime 170 ctx.fetch(key, url, init)
1554
1554
  */
@@ -3033,7 +3033,8 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
3033
3033
  required: false,
3034
3034
  resolution: 'runtime-allowed',
3035
3035
  issueCode: 'play_authoring_fetch_idempotency_required',
3036
- description: 'Required for mutating HTTP methods to make replay safe.',
3036
+ description:
3037
+ 'Required for mutating HTTP methods. The provider must support idempotency, and the same key must be retained across retries and replay.',
3037
3038
  errorMessage: 'Idempotency-Key must be a non-empty string when provided.',
3038
3039
  },
3039
3040
  } as const satisfies Record<
@@ -239,9 +239,9 @@ function callSiteExtent(substep: PlayStaticSubstep): DocflowLineExtent | null {
239
239
  * An annotation written in the ENTRY file keeps the existing behavior exactly:
240
240
  * whatever the resolver prefers, no path check. An annotation written in an
241
241
  * imported module is only comparable to a range from that same module — two
242
- * files both have a line 42 — so it picks the substep's own range or its call
243
- * site, whichever was recorded in the annotation's file, and matches nothing
244
- * when neither was.
242
+ * files both have a line 42. Owner extents union only the children in that
243
+ * file, while own-call extents stay local. A call reached through another
244
+ * function remains bounded by its matching caller range.
245
245
  */
246
246
  function extentForBinding(
247
247
  substep: PlayStaticSubstep,
@@ -249,11 +249,34 @@ function extentForBinding(
249
249
  extentOf: DocflowExtentResolver,
250
250
  ): DocflowLineExtent | null {
251
251
  if (!binding.sourcePath) return extentOf(substep);
252
- for (const range of [substep.sourceRange, substep.callSiteRange]) {
253
- if (range?.sourcePath !== binding.sourcePath) continue;
254
- return { startLine: range.startLine, endLine: range.endLine };
252
+ const sourcePath = binding.sourcePath;
253
+ const caller = substep.callSiteRange;
254
+ if (caller?.sourcePath === sourcePath)
255
+ return { startLine: caller.startLine, endLine: caller.endLine };
256
+ if (extentOf !== substepSourceExtent) {
257
+ const own = substep.sourceRange;
258
+ return own?.sourcePath === sourcePath
259
+ ? { startLine: own.startLine, endLine: own.endLine }
260
+ : null;
255
261
  }
256
- return null;
262
+ const ranges: PlayStaticSourceRange[] = [];
263
+ const collect = (candidate: PlayStaticSubstep) => {
264
+ if (candidate.callSiteRange?.sourcePath === sourcePath) {
265
+ ranges.push(candidate.callSiteRange);
266
+ return;
267
+ }
268
+ if (candidate.sourceRange?.sourcePath === sourcePath)
269
+ ranges.push(candidate.sourceRange);
270
+ const nested = (candidate as { steps?: PlayStaticSubstep[] }).steps;
271
+ if (Array.isArray(nested)) for (const step of nested) collect(step);
272
+ };
273
+ collect(substep);
274
+ return ranges.length > 0
275
+ ? {
276
+ startLine: Math.min(...ranges.map((range) => range.startLine)),
277
+ endLine: Math.max(...ranges.map((range) => range.endLine)),
278
+ }
279
+ : null;
257
280
  }
258
281
 
259
282
  function extentContainsLine(
@@ -268,7 +291,10 @@ function extentContainsLine(
268
291
  : null;
269
292
  }
270
293
 
271
- /** Smallest containing extent wins, so a nested construct beats its parent. */
294
+ /**
295
+ * Smallest containing extent wins, so a nested construct beats its parent.
296
+ * Equal extents in a named file cannot distinguish two imported callers.
297
+ */
272
298
  function smallestContaining<TSubstep extends PlayStaticSubstep>(
273
299
  candidates: readonly TSubstep[],
274
300
  binding: PlayDocflowBinding,
@@ -276,6 +302,7 @@ function smallestContaining<TSubstep extends PlayStaticSubstep>(
276
302
  ): TSubstep | null {
277
303
  let best: TSubstep | null = null;
278
304
  let bestSpan = Number.POSITIVE_INFINITY;
305
+ let tied = false;
279
306
  for (const candidate of candidates) {
280
307
  const extent = extentContainsLine(candidate, binding, extentOf);
281
308
  if (!extent) continue;
@@ -283,9 +310,17 @@ function smallestContaining<TSubstep extends PlayStaticSubstep>(
283
310
  if (span < bestSpan) {
284
311
  best = candidate;
285
312
  bestSpan = span;
313
+ tied = false;
314
+ } else if (
315
+ binding.sourcePath &&
316
+ span === bestSpan &&
317
+ best &&
318
+ substepIdentity(candidate) !== substepIdentity(best)
319
+ ) {
320
+ tied = true;
286
321
  }
287
322
  }
288
- return best;
323
+ return tied ? null : best;
289
324
  }
290
325
 
291
326
  /**
@@ -416,7 +451,7 @@ export function docflowBoundToolSubsteps(
416
451
  const roots = docflowOutputRoots(binding);
417
452
  if (roots.length === 0) return [];
418
453
  const matched: DocflowToolSubstep[] = [];
419
- const seen = new Set<string>();
454
+ const seen = new Set<string | DocflowToolSubstep>();
420
455
  // Callers hand over whatever shape they hold — the config model passes the
421
456
  // top-level stages, whose tools sit several levels down inside step suites
422
457
  // and control flow. Flatten here so the answer never depends on that.
@@ -430,7 +465,7 @@ export function docflowBoundToolSubsteps(
430
465
  );
431
466
  if (!paths.includes(binding.sourcePath)) continue;
432
467
  }
433
- const identity = `${substep.toolId}::${substep.paramsSource ?? ''}`;
468
+ const identity = docflowToolCallIdentity(substep) ?? substep;
434
469
  if (seen.has(identity)) continue;
435
470
  seen.add(identity);
436
471
  matched.push(substep);
@@ -438,6 +473,21 @@ export function docflowBoundToolSubsteps(
438
473
  return matched;
439
474
  }
440
475
 
476
+ /** A retained call site, including its imported declaration and caller. */
477
+ export function docflowToolCallIdentity(
478
+ substep: DocflowToolSubstep,
479
+ ): string | null {
480
+ if (!substep.sourceRange && !substep.callSiteRange) return null;
481
+ return JSON.stringify([
482
+ substep.field,
483
+ substep.sourceRange,
484
+ substep.callSiteRange,
485
+ substep.toolId,
486
+ substep.paramsSource,
487
+ substep.inputPrelude,
488
+ ]);
489
+ }
490
+
441
491
  /**
442
492
  * The `ctx.runPlay` or `ctx.runPlayAsync` call a `type:"play"` docflow node
443
493
  * names. Same join as every other binding — symbol first, extent as the fallback
@@ -9,11 +9,11 @@ import {
9
9
  registerAuthCommands,
10
10
  reportSetupCompleted,
11
11
  resolvePendingAuthClaimForResume
12
- } from "./chunk-HTXZLCSP.mjs";
13
- import "./chunk-QB5MAFCU.mjs";
14
- import "./chunk-25SPKKF2.mjs";
12
+ } from "./chunk-VC25WFXV.mjs";
13
+ import "./chunk-46ZOD4PQ.mjs";
14
+ import "./chunk-IDSDRGKF.mjs";
15
15
  import "./chunk-DLIRSHV6.mjs";
16
- import "./chunk-3K6QD7Z3.mjs";
16
+ import "./chunk-F2T5UENG.mjs";
17
17
  import "./chunk-NXGCO4JB.mjs";
18
18
  import "./chunk-WZYKRD7T.mjs";
19
19
  import "./chunk-KRD6H754.mjs";
@@ -0,0 +1,31 @@
1
+ "use strict";Object.defineProperty(exports, "__esModule", {value: true});
2
+
3
+
4
+
5
+
6
+
7
+
8
+
9
+
10
+
11
+
12
+ var _chunkBOKHMPCZjs = require('./chunk-BOKHMPCZ.js');
13
+ require('./chunk-GHLWDXUB.js');
14
+ require('./chunk-MCPHK7AF.js');
15
+ require('./chunk-XNYIZMNQ.js');
16
+ require('./chunk-C6QGM72M.js');
17
+ require('./chunk-7P5AA3SN.js');
18
+ require('./chunk-OG64RBAC.js');
19
+ require('./chunk-COGTRVWW.js');
20
+
21
+
22
+
23
+
24
+
25
+
26
+
27
+
28
+
29
+
30
+
31
+ exports.EXIT_WORKSPACE_MISMATCH = _chunkBOKHMPCZjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkBOKHMPCZjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkBOKHMPCZjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkBOKHMPCZjs.handleRegister; exports.handleStatus = _chunkBOKHMPCZjs.handleStatus; exports.handleWait = _chunkBOKHMPCZjs.handleWait; exports.readPendingAuthClaim = _chunkBOKHMPCZjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkBOKHMPCZjs.registerAuthCommands; exports.reportSetupCompleted = _chunkBOKHMPCZjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkBOKHMPCZjs.resolvePendingAuthClaimForResume;
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  DeeplineClient,
3
3
  iterateCursorPages
4
- } from "./chunk-IZTIBG7A.mjs";
4
+ } from "./chunk-D3NMIACS.mjs";
5
5
  import "./chunk-CBVIJSHF.mjs";
6
6
  import {
7
7
  createTimestampedName,
@@ -9,13 +9,13 @@ import {
9
9
  openInBrowser,
10
10
  printCommandEnvelope,
11
11
  shouldEmitJson
12
- } from "./chunk-QB5MAFCU.mjs";
12
+ } from "./chunk-46ZOD4PQ.mjs";
13
13
  import {
14
14
  AuthError,
15
15
  ConfigError
16
- } from "./chunk-25SPKKF2.mjs";
16
+ } from "./chunk-IDSDRGKF.mjs";
17
17
  import "./chunk-DLIRSHV6.mjs";
18
- import "./chunk-3K6QD7Z3.mjs";
18
+ import "./chunk-F2T5UENG.mjs";
19
19
  import "./chunk-6IKARAYD.mjs";
20
20
  import {
21
21
  DeeplineError