deepline 0.3.315 → 0.3.316

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-progress.ts

@@ -1,4 +1,5 @@
 import { RUN_EVENT_KIND } from '../run-event-catalog';
+import { normalizeTableNamespace } from '../../plays/row-identity';
 /**
  * Live step/progress ledger reporting for Node runtime workers.
  *
@@ -109,7 +110,7 @@ export function buildOrderedNodeList(
   }));
 }
 
-/** Map logical dataset namespaces to their static-pipeline node IDs. */
+/** Keep authored node identity separate from the normalized Runtime Sheet namespace. */
 type StaticDatasetNodeRef = {
   nodeId: string;
   logicalNamespace: string;
@@ -129,10 +130,16 @@ function buildMapNodeLookup(
   for (let index = 0; index < substeps.length; index += 1) {
     const substep = substeps[index]!;
     if (substep.type !== 'dataset') continue;
-    const logicalNamespace =
-      substep.tableNamespace?.trim() || substep.field.trim();
+    const staticNamespace = substep.tableNamespace?.trim();
+    const logicalNamespace = staticNamespace || substep.field.trim();
     if (!logicalNamespace) continue;
-    lookup.set(logicalNamespace, {
+    // Literal dataset keys share the Runtime Sheet namespace contract. A legacy
+    // field-only label can be source-expression text, so retain its existing
+    // lookup behavior rather than validating or guessing a physical identity.
+    const lookupNamespace = staticNamespace
+      ? normalizeTableNamespace(staticNamespace)
+      : logicalNamespace;
+    lookup.set(lookupNamespace, {
       nodeId: getStaticSubstepNodeId(substep, index),
       logicalNamespace,
     });
@@ -140,6 +147,7 @@ function buildMapNodeLookup(
   return lookup;
 }
 
+/** Resolve normalized literal dataset namespaces to unchanged authored node IDs. */
 export function buildMapNodeIdLookup(
   contractSnapshot: unknown,
 ): Map<string, string> {
@@ -1219,23 +1227,21 @@ export function createPostgresSchedulerProgressReporter(input: {
     ) {
       mapsWithResolverActivity.delete(nodeId);
       stepLifecycle.onMapStarted(nodeId);
+      const failedRows = 'failedRows' in event ? (event.failedRows ?? 0) : 0;
+      const startedRows =
+        event.completedRows + failedRows + (event.supersededRows ?? 0);
       setNodeProgress(nodeId, {
         completed: event.completedRows,
-        failed: 0,
+        failed: failedRows,
         total: eventTotalRows,
         rowActivitySource: 'map_start',
         rowActivityStartedAt: event.at,
         rowActivityObservedAt: event.at,
-        startedRows: event.completedRows + (event.supersededRows ?? 0),
+        startedRows,
         activeRows: 0,
         waitingRows:
           typeof eventTotalRows === 'number'
-            ? Math.max(
-                0,
-                eventTotalRows -
-                  event.completedRows -
-                  (event.supersededRows ?? 0),
-              )
+            ? Math.max(0, eventTotalRows - startedRows)
             : undefined,
         completedRows: event.completedRows,
         ...(event.supersededRows !== undefined

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -32,7 +32,10 @@ import type {
   PlayRunnerResult,
   PlayRunnerRuntimeTiming,
 } from '../protocol';
-import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
+import {
+  normalizeRuntimeSchedulerSchema,
+  PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA,
+} from '../runtime-scheduler-topology';
 import {
   RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
   RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
@@ -20480,6 +20483,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             tokenAuthority,
             options,
             input.runtimeApi?.signal,
+            reuseMarginMs,
           )
         : loadPostgresSchedulerRuntimeApiForRun(
             withClient,
@@ -20490,6 +20494,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             tokenAuthority,
             options,
             input.runtimeApi?.signal,
+            reuseMarginMs,
           );
     const gatewayRuntimeApi =
       needsRuntimeApi && tokenAuthority === 'gateway'
@@ -20645,6 +20650,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           tokenAuthority,
           options,
           runtimeApi.signal,
+          reuseMarginMs,
         );
         if (refreshed.baseUrl !== runtimeApi.baseUrl) {
           throw new Error(
@@ -21373,6 +21379,7 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
+  tokenReuseMarginMs = 0,
 ): Promise<
   WorkerRuntimeApiContext & {
     refreshExecutorToken?: () => Promise<string>;
@@ -21414,18 +21421,37 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
       schedulerSchema: options?.schema ?? null,
       signal,
     };
-    const dispatchAuthority =
-      await requestRunLedgerDispatchToken(dispatchRequest);
-    invalidateExecutorToken = () =>
-      runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
-    if (dispatchAuthority.reused) {
+    const preMintedToken = usableRunLedgerExecutorToken(
+      launch,
+      tokenReuseMarginMs,
+      options,
+    );
+    if (preMintedToken) {
+      // Admission minted this token with only `run.ledger.project`.
+      // Each projection request still proves its exact outbox lease at the
+      // receiver, and the scheduler ACK remains fenced to that same lease.
+      executorToken = preMintedToken.executorToken;
+      // The issuer advertises its own immutable receiver in the signed token.
+      // Merely targeting an immutable URL never proves receipt support.
+      runLedgerIngressPrefixBatching =
+        preMintedToken.runLedgerIngressPrefixBatching;
       refreshExecutorToken = async () =>
         (await requestRunLedgerDispatchToken(dispatchRequest, true))
           .executorToken;
+    } else {
+      const dispatchAuthority =
+        await requestRunLedgerDispatchToken(dispatchRequest);
+      invalidateExecutorToken = () =>
+        runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
+      if (dispatchAuthority.reused) {
+        refreshExecutorToken = async () =>
+          (await requestRunLedgerDispatchToken(dispatchRequest, true))
+            .executorToken;
+      }
+      executorToken = dispatchAuthority.executorToken;
+      runLedgerIngressPrefixBatching =
+        dispatchAuthority.runLedgerIngressPrefixBatching;
     }
-    executorToken = dispatchAuthority.executorToken;
-    runLedgerIngressPrefixBatching =
-      dispatchAuthority.runLedgerIngressPrefixBatching;
   }
   return {
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
@@ -21448,6 +21474,7 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
+  tokenReuseMarginMs = 0,
 ): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
   // A continuation already owns its next event lease, so its launch context
   // is not part of the preclaim result. Load only the authority fields here.
@@ -21467,9 +21494,85 @@ async function loadPostgresSchedulerRuntimeApiForRun(
     tokenAuthority,
     options,
     signal,
+    tokenReuseMarginMs,
   );
 }
 
+/**
+ * Admission persists an optional, run-scoped `run.ledger.project` token for the
+ * worker's terminal fast path. Treat it as usable only when its decoded claims
+ * match the exact durable launch contract and it has enough time left for a
+ * complete projection. The app runtime still verifies the signature, action
+ * capability, and live outbox lease before writing; a mismatch falls back to
+ * the lease-validated mint endpoint. Prefix grouping additionally requires the
+ * issuer's explicit advertisement to match the launch's immutable receiver;
+ * its absence preserves legacy grouping without discarding the usable token.
+ */
+function usableRunLedgerExecutorToken(
+  launch: RunLedgerDispatchLaunch,
+  reuseMarginMs: number,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): {
+  executorToken: string;
+  runLedgerIngressPrefixBatching?: true;
+} | null {
+  const token = launch.runLedgerExecutorToken;
+  if (!token || typeof token !== 'string') return null;
+
+  try {
+    const claims = decodeJwt(token) as Record<string, unknown>;
+    const authority = launch.runtimeAuthority;
+    if (!authority || typeof authority !== 'object') return null;
+
+    const expiresAtMs =
+      typeof claims.exp === 'number' &&
+      Number.isSafeInteger(claims.exp) &&
+      Number.isSafeInteger(claims.exp * 1_000)
+        ? claims.exp * 1_000
+        : null;
+    const expectedOrigin = new URL(runtimeTokenOriginFromLaunch(launch)).origin;
+    const expectedSchedulerSchema = normalizeRuntimeSchedulerSchema(
+      authority.schedulerSchema,
+    );
+    const requestedSchedulerSchema = normalizeRuntimeSchedulerSchema(
+      options?.schema,
+    );
+
+    if (
+      expiresAtMs === null ||
+      expiresAtMs <= Date.now() + reuseMarginMs ||
+      claims.iss !== 'deepline.internal' ||
+      claims.aud !== 'deepline.workflow.execution' ||
+      claims.purpose !== 'workflow_run_execution' ||
+      claims.org_id !== launch.orgId ||
+      claims.org_id !== authority.orgId ||
+      claims.run_id !== launch.runId ||
+      claims.run_id !== authority.runId ||
+      claims.workflow_id !== authority.workflowId ||
+      claims.runtime_origin !== expectedOrigin ||
+      normalizeRuntimeSchedulerSchema(claims.scheduler_schema) !==
+        expectedSchedulerSchema ||
+      (requestedSchedulerSchema !== null &&
+        requestedSchedulerSchema !== expectedSchedulerSchema) ||
+      !Array.isArray(claims.capabilities) ||
+      claims.capabilities.length !== 1 ||
+      claims.capabilities[0] !== 'run.ledger.project'
+    ) {
+      return null;
+    }
+    const receiverOrigin = new URL(runtimeApiBaseUrlFromLaunch(launch)).origin;
+    return {
+      executorToken: token,
+      ...(claims.run_ledger_ingress_prefix_origin === receiverOrigin &&
+      isImmutableRuntimeExecutionRecoveryOrigin(receiverOrigin)
+        ? { runLedgerIngressPrefixBatching: true as const }
+        : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
 // Reuse only gateway-issued run.progress authority. A prefix advertisement
 // remains reusable only for the same immutable app build; mutable receivers
 // must reacquire their current receipt shape on every drain. Every delivery

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-dispatch-authority.ts

@@ -12,6 +12,7 @@ export type RunLedgerDispatchLaunch = Pick<
   | 'playId'
   | 'playName'
   | 'executorToken'
+  | 'runLedgerExecutorToken'
   | 'baseUrl'
   | 'runtimeApiBaseUrl'
   | 'runtimeTokenOrigin'
@@ -27,6 +28,7 @@ export function runLedgerDispatchLaunchSql(alias: string): string {
     'playId',
     'playName',
     'executorToken',
+    'runLedgerExecutorToken',
     'baseUrl',
     'runtimeApiBaseUrl',
     'runtimeTokenOrigin',

package/dist/bundling-sources/shared_libs/play-runtime/work-receipt-storage-contract.ts

@@ -13,6 +13,19 @@ export const WORK_RECEIPT_KEY_FORMAT = {
   separator: ':',
 } as const;
 
+/** Reserved scalar admission fact, distinct from customer-authored work output. */
+export const RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND =
+  'runtime-sheet-write-intent';
+
+/** Keep internal sheet admission facts out of customer work-output projections. */
+export function workReceiptOutputPredicateSql(keyColumn = 'k'): string {
+  const keySql = `convert_from(${keyColumn}, 'UTF8')`;
+  const intentPrefix = encodeURIComponent(
+    `["${RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND}",`,
+  );
+  return `NOT (starts_with(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.prefix}${WORK_RECEIPT_KEY_FORMAT.separator}') AND starts_with(split_part(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.separator}', 4), '${intentPrefix}'))`;
+}
+
 export const WORK_RECEIPT_STATUS_CODE = {
   queued: 0,
   pending: 0,

package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts

@@ -117,6 +117,7 @@ export async function mintWorkflowExecutorToken(input: {
   terminalContract?: DirectCompletedTerminalContract | null;
   capabilities?: readonly RuntimeExecutionCapability[];
   runtimeOrigin?: string | null;
+  runLedgerIngressPrefixOrigin?: string | null;
 }) {
   const playName = input.playName?.trim() || input.workflowId;
   return mintWorkflowRunExecutionToken({
@@ -138,6 +139,7 @@ export async function mintWorkflowExecutorToken(input: {
     terminalContract: input.terminalContract,
     capabilities: input.capabilities,
     runtimeOrigin: input.runtimeOrigin,
+    runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
   });
 }
 

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -1548,7 +1548,7 @@ export interface PlayAuthoringRuntimeContext {
   ): Promise<T>;
 
   /**
-   * Execute a guarded HTTP request. By default it is durable and replay-safe; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
+   * Execute a guarded HTTP request. By default, completed responses are durably reused; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Failed requests do not publish completed cache entries. A headers timeout leaves an upstream write's outcome unknown and does not establish whether its body was sent. The transport does not automatically retry that timed-out write, but a later invocation can execute it again. Mutating requests require provider-supported idempotency with the same key retained across retries and replay. Deadlines are platform-controlled; callers may cancel through `init.signal`. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
    *
    * @sdkReference runtime 170 ctx.fetch(key, url, init)
    */
@@ -3033,7 +3033,8 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     required: false,
     resolution: 'runtime-allowed',
     issueCode: 'play_authoring_fetch_idempotency_required',
-    description: 'Required for mutating HTTP methods to make replay safe.',
+    description:
+      'Required for mutating HTTP methods. The provider must support idempotency, and the same key must be retained across retries and replay.',
     errorMessage: 'Idempotency-Key must be a non-empty string when provided.',
   },
 } as const satisfies Record<

package/dist/cli/{auth-OVWOO5NP.mjs → auth-JP7ZJ4OI.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-OUIIYFG3.mjs";
-import "./chunk-HNKHMHJ7.mjs";
-import "./chunk-AZWQJAQF.mjs";
+} from "./chunk-VC25WFXV.mjs";
+import "./chunk-46ZOD4PQ.mjs";
+import "./chunk-IDSDRGKF.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-JF4O5OMH.mjs";
+import "./chunk-F2T5UENG.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";

package/dist/cli/auth-SPUJ4EXC.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunkBOKHMPCZjs = require('./chunk-BOKHMPCZ.js');
+require('./chunk-GHLWDXUB.js');
+require('./chunk-MCPHK7AF.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-C6QGM72M.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkBOKHMPCZjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkBOKHMPCZjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkBOKHMPCZjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkBOKHMPCZjs.handleRegister; exports.handleStatus = _chunkBOKHMPCZjs.handleStatus; exports.handleWait = _chunkBOKHMPCZjs.handleWait; exports.readPendingAuthClaim = _chunkBOKHMPCZjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkBOKHMPCZjs.registerAuthCommands; exports.reportSetupCompleted = _chunkBOKHMPCZjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkBOKHMPCZjs.resolvePendingAuthClaimForResume;

package/dist/cli/{billing-W3OXKWNE.mjs → billing-KG6MC2BC.mjs}

@@ -1,7 +1,7 @@
 import {
   DeeplineClient,
   iterateCursorPages
-} from "./chunk-IGE7EJJY.mjs";
+} from "./chunk-D3NMIACS.mjs";
 import "./chunk-CBVIJSHF.mjs";
 import {
   createTimestampedName,
@@ -9,13 +9,13 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-HNKHMHJ7.mjs";
+} from "./chunk-46ZOD4PQ.mjs";
 import {
   AuthError,
   ConfigError
-} from "./chunk-AZWQJAQF.mjs";
+} from "./chunk-IDSDRGKF.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-JF4O5OMH.mjs";
+import "./chunk-F2T5UENG.mjs";
 import "./chunk-6IKARAYD.mjs";
 import {
   DeeplineError