deepline 0.3.315 → 0.3.317

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-outbox-recovery.ts

@@ -523,10 +523,24 @@ export function startRunLedgerOutboxRecovery(
 /**
  * Latency budget for the inline `run.created` attempt made by an admitting
  * process after its Runtime Postgres commit. The whole attempt (claim, token,
- * append, acknowledgement) must settle or be abandoned inside this bound so an
- * admission response is never held longer than this for projection.
+ * append, acknowledgement) must settle or be abandoned inside this bound. An
+ * abandoned attempt then gets `RUN_CREATED_INLINE_RELEASE_GRACE_MS` to hand
+ * its lease back, so an admission response is never held longer than the two
+ * together for projection.
  */
 export const RUN_CREATED_INLINE_DELIVERY_DEADLINE_MS = 1_500;
+/**
+ * How long an abandoned inline attempt may keep its caller while it gives the
+ * lease back. The caller is the only owner of that release: a serverless
+ * invocation can be suspended as soon as the admitting request returns, and a
+ * release left running in the background then never lands. The row stays
+ * leased until `RUN_CREATED_INLINE_DELIVERY_LEASE_SECONDS` expires, and until
+ * then no other deliverer may claim it, so an API or CLI run waits behind its
+ * own `run.created` gate for about five seconds. One fresh checkout and one
+ * fenced UPDATE fit well inside this bound; if they do not, the lease expiry
+ * remains the fallback, exactly as before.
+ */
+export const RUN_CREATED_INLINE_RELEASE_GRACE_MS = 500;
 /**
  * The inline attempt's lease is the scheduler minimum. If the admitting
  * process is frozen or killed mid-attempt, the durable projector can reclaim
@@ -545,9 +559,38 @@ export type RunCreatedInlineDeliveryOutcome =
    * shared idempotency key made any duplicate ledger append a no-op.
    */
   | { status: 'superseded'; durationMs: number }
-  | { status: 'timed_out'; durationMs: number }
+  /**
+   * The deadline elapsed. `leaseSettled` is true only when the abandoned
+   * attempt finished before this returned and holds no lease: its release
+   * statement completed, or it never took one. False means the lease, if one
+   * was taken, is left to expire: the release failed, the grace elapsed
+   * first, or the attempt itself failed. `attemptError` then names that
+   * failure's class, so a failed attempt that held nothing is not counted as
+   * a stranded lease.
+   */
+  | {
+      status: 'timed_out';
+      durationMs: number;
+      leaseSettled: boolean;
+      attemptError?: string;
+    }
   | { status: 'error'; durationMs: number; error: string };
 
+const INLINE_ATTEMPT_ERROR_CLASS_MAX_CHARS = 80;
+
+/**
+ * A short, bounded label for a failed attempt: the error's name and, for a
+ * database error, its SQLSTATE. Never the message, which can carry run ids.
+ */
+function inlineAttemptErrorClass(error: unknown): string {
+  const name =
+    error instanceof Error && error.name.trim() ? error.name.trim() : 'Error';
+  const code = (error as { code?: unknown } | null | undefined)?.code;
+  const label =
+    typeof code === 'string' && code.trim() ? `${name}:${code.trim()}` : name;
+  return label.slice(0, INLINE_ATTEMPT_ERROR_CLASS_MAX_CHARS);
+}
+
 /**
  * One bounded, idempotent attempt to deliver exactly `run-created:<runId>`
  * from the admitting process, right after the admission commit.
@@ -561,8 +604,10 @@ export type RunCreatedInlineDeliveryOutcome =
  * one ledger admission and one `delivered_at`. The projector remains the
  * durable owner: every non-delivered outcome leaves the row pending for it.
  *
- * Never throws and never exceeds `deadlineMs`; a deadline abandons the
- * append and releases its lease without charging a retry.
+ * Never throws and never exceeds `deadlineMs` plus the release grace. A
+ * deadline abandons the append and releases its lease without charging a
+ * retry, and that release completes before this returns whenever it fits the
+ * grace: nothing else keeps the admitting invocation alive for it.
  */
 export async function deliverRunCreatedOutboxEventInline(input: {
   runId: string;
@@ -570,6 +615,8 @@ export async function deliverRunCreatedOutboxEventInline(input: {
   schedulerOptions?: Pick<PostgresSchedulerOptions, 'schema'>;
   tokenAuthority: RunLedgerOutboxTokenAuthority;
   deadlineMs?: number;
+  /** Test seam; clamped to `RUN_CREATED_INLINE_RELEASE_GRACE_MS`. */
+  releaseGraceMs?: number;
   now?: () => number;
 }): Promise<RunCreatedInlineDeliveryOutcome> {
   const now = input.now ?? Date.now;
@@ -582,11 +629,23 @@ export async function deliverRunCreatedOutboxEventInline(input: {
       input.deadlineMs ?? RUN_CREATED_INLINE_DELIVERY_DEADLINE_MS,
     ),
   );
+  const releaseGraceMs = Math.max(
+    1,
+    Math.min(
+      RUN_CREATED_INLINE_RELEASE_GRACE_MS,
+      input.releaseGraceMs ?? RUN_CREATED_INLINE_RELEASE_GRACE_MS,
+    ),
+  );
   const runId = input.runId.trim();
   if (!runId) {
     return { status: 'error', durationMs: 0, error: 'missing run id' };
   }
   const controller = new AbortController();
+  // What the abandoned attempt reported about its own tail.
+  const abandoned: { releaseFailed: boolean; errorClass: string | null } = {
+    releaseFailed: false,
+    errorClass: null,
+  };
   const attempt = dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
     input.withClient,
     {
@@ -596,18 +655,28 @@ export async function deliverRunCreatedOutboxEventInline(input: {
       leaseSeconds: RUN_CREATED_INLINE_DELIVERY_LEASE_SECONDS,
       tokenAuthority: input.tokenAuthority,
       signal: controller.signal,
+      onAbortedLeaseRelease: (released) => {
+        abandoned.releaseFailed = !released;
+      },
     },
     input.schedulerOptions ?? {},
   ).then(
     (result): RunCreatedInlineDeliveryOutcome => {
-      if (result.attempted === 0) {
-        return { status: 'not_claimed', durationMs: elapsed() };
-      }
       if (result.projected > 0) {
         return { status: 'delivered', durationMs: elapsed() };
       }
       if (controller.signal.aborted) {
-        return { status: 'timed_out', durationMs: elapsed() };
+        // Settled after the deadline without delivering. The lease was
+        // never taken or its release statement completed, unless the abort
+        // branch reported that the release could not run.
+        return {
+          status: 'timed_out',
+          durationMs: elapsed(),
+          leaseSettled: !abandoned.releaseFailed,
+        };
+      }
+      if (result.attempted === 0) {
+        return { status: 'not_claimed', durationMs: elapsed() };
       }
       if (result.failed === 0 && result.retrying === 0) {
         return { status: 'superseded', durationMs: elapsed() };
@@ -617,28 +686,63 @@ export async function deliverRunCreatedOutboxEventInline(input: {
         durationMs: elapsed(),
       };
     },
-    (error: unknown): RunCreatedInlineDeliveryOutcome => ({
-      status: 'error',
-      durationMs: elapsed(),
-      error: error instanceof Error ? error.message : String(error),
-    }),
+    (error: unknown): RunCreatedInlineDeliveryOutcome => {
+      abandoned.errorClass = inlineAttemptErrorClass(error);
+      return {
+        status: 'error',
+        durationMs: elapsed(),
+        error: error instanceof Error ? error.message : String(error),
+      };
+    },
   );
+  const DEADLINE = Symbol('deadline');
+  const GRACE = Symbol('grace');
   let deadline: ReturnType<typeof setTimeout> | undefined;
-  const timedOut = new Promise<RunCreatedInlineDeliveryOutcome>((resolve) => {
+  let grace: ReturnType<typeof setTimeout> | undefined;
+  const deadlineElapsed = new Promise<typeof DEADLINE>((resolve) => {
     deadline = setTimeout(() => {
-      // Abort the append; the attempt's own tail (a short, lease-fenced
-      // release) completes in the background and cannot fail the caller.
+      // Abort the append. The attempt's own tail is a short, lease-fenced
+      // release; it cannot fail the caller.
       controller.abort(
         new Error('Inline run.created delivery deadline elapsed.'),
       );
-      resolve({ status: 'timed_out', durationMs: elapsed() });
+      resolve(DEADLINE);
     }, deadlineMs);
     deadline.unref?.();
   });
   try {
-    return await Promise.race([attempt, timedOut]);
+    const first = await Promise.race([attempt, deadlineElapsed]);
+    if (first !== DEADLINE) return first;
+    // The attempt is abandoned, and this caller is the only owner of its
+    // release. Wait for that tail, bounded, instead of returning while the
+    // lease is still held: the admitting invocation may be suspended as soon
+    // as this resolves, which would strand the lease until it expires.
+    const graceElapsed = new Promise<typeof GRACE>((resolve) => {
+      grace = setTimeout(() => resolve(GRACE), releaseGraceMs);
+      grace.unref?.();
+    });
+    const tail = await Promise.race([attempt, graceElapsed]);
+    if (tail !== GRACE) {
+      // The acknowledgement was already in flight when the deadline fired.
+      if (tail.status === 'delivered') return tail;
+      // The attempt reported its own lease state (see the mapping above).
+      if (tail.status === 'timed_out') return tail;
+    }
+    // The grace elapsed with the tail still running, or the attempt failed.
+    // Either way nothing proves the lease was handed back, so it is reported
+    // as left to expire. A failed attempt names its error class, because it
+    // may have held no lease at all.
+    return {
+      status: 'timed_out',
+      durationMs: elapsed(),
+      leaseSettled: false,
+      ...(tail !== GRACE && abandoned.errorClass
+        ? { attemptError: abandoned.errorClass }
+        : {}),
+    };
   } finally {
     if (deadline) clearTimeout(deadline);
+    if (grace) clearTimeout(grace);
   }
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/work-receipt-storage-contract.ts

@@ -13,6 +13,19 @@ export const WORK_RECEIPT_KEY_FORMAT = {
   separator: ':',
 } as const;
 
+/** Reserved scalar admission fact, distinct from customer-authored work output. */
+export const RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND =
+  'runtime-sheet-write-intent';
+
+/** Keep internal sheet admission facts out of customer work-output projections. */
+export function workReceiptOutputPredicateSql(keyColumn = 'k'): string {
+  const keySql = `convert_from(${keyColumn}, 'UTF8')`;
+  const intentPrefix = encodeURIComponent(
+    `["${RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND}",`,
+  );
+  return `NOT (starts_with(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.prefix}${WORK_RECEIPT_KEY_FORMAT.separator}') AND starts_with(split_part(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.separator}', 4), '${intentPrefix}'))`;
+}
+
 export const WORK_RECEIPT_STATUS_CODE = {
   queued: 0,
   pending: 0,

package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts

@@ -117,6 +117,7 @@ export async function mintWorkflowExecutorToken(input: {
   terminalContract?: DirectCompletedTerminalContract | null;
   capabilities?: readonly RuntimeExecutionCapability[];
   runtimeOrigin?: string | null;
+  runLedgerIngressPrefixOrigin?: string | null;
 }) {
   const playName = input.playName?.trim() || input.workflowId;
   return mintWorkflowRunExecutionToken({
@@ -138,6 +139,7 @@ export async function mintWorkflowExecutorToken(input: {
     terminalContract: input.terminalContract,
     capabilities: input.capabilities,
     runtimeOrigin: input.runtimeOrigin,
+    runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
   });
 }
 

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -1548,7 +1548,7 @@ export interface PlayAuthoringRuntimeContext {
   ): Promise<T>;
 
   /**
-   * Execute a guarded HTTP request. By default it is durable and replay-safe; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
+   * Execute a guarded HTTP request. By default, completed responses are durably reused; `staleAfterSeconds` governs only that completed call receipt, never dataset/request identity. Failed requests do not publish completed cache entries. A headers timeout leaves an upstream write's outcome unknown and does not establish whether its body was sent. The transport does not automatically retry that timed-out write, but a later invocation can execute it again. Mutating requests require provider-supported idempotency with the same key retained across retries and replay. Deadlines are platform-controlled; callers may cancel through `init.signal`. Pass `{ transient: true }` for short-lived credential exchanges or other response data that must not be retained in a receipt or checkpoint. Edition 5+ throws `CtxFetchHttpError` for non-2xx; catch it only when the Play intentionally recovers, otherwise let it fail the Play. Editions 1–4 retain their previous response projections.
    *
    * @sdkReference runtime 170 ctx.fetch(key, url, init)
    */
@@ -3033,7 +3033,8 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     required: false,
     resolution: 'runtime-allowed',
     issueCode: 'play_authoring_fetch_idempotency_required',
-    description: 'Required for mutating HTTP methods to make replay safe.',
+    description:
+      'Required for mutating HTTP methods. The provider must support idempotency, and the same key must be retained across retries and replay.',
     errorMessage: 'Idempotency-Key must be a non-empty string when provided.',
   },
 } as const satisfies Record<

package/dist/cli/auth-XPLGQ2KO.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunk2FKXFTOFjs = require('./chunk-2FKXFTOF.js');
+require('./chunk-DSTUP75H.js');
+require('./chunk-SUPQQYGY.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-UGQHYOT4.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunk2FKXFTOFjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunk2FKXFTOFjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunk2FKXFTOFjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunk2FKXFTOFjs.handleRegister; exports.handleStatus = _chunk2FKXFTOFjs.handleStatus; exports.handleWait = _chunk2FKXFTOFjs.handleWait; exports.readPendingAuthClaim = _chunk2FKXFTOFjs.readPendingAuthClaim; exports.registerAuthCommands = _chunk2FKXFTOFjs.registerAuthCommands; exports.reportSetupCompleted = _chunk2FKXFTOFjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunk2FKXFTOFjs.resolvePendingAuthClaimForResume;

package/dist/cli/{auth-OVWOO5NP.mjs → auth-YAHBE5WU.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-OUIIYFG3.mjs";
-import "./chunk-HNKHMHJ7.mjs";
-import "./chunk-AZWQJAQF.mjs";
+} from "./chunk-GX3WO4M4.mjs";
+import "./chunk-FRK2AGSG.mjs";
+import "./chunk-QPKHOZI3.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-JF4O5OMH.mjs";
+import "./chunk-OTI562P3.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";

package/dist/cli/{billing-W3OXKWNE.mjs → billing-AY4OS7MR.mjs}

@@ -1,7 +1,7 @@
 import {
   DeeplineClient,
   iterateCursorPages
-} from "./chunk-IGE7EJJY.mjs";
+} from "./chunk-NDFBAMVI.mjs";
 import "./chunk-CBVIJSHF.mjs";
 import {
   createTimestampedName,
@@ -9,13 +9,13 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-HNKHMHJ7.mjs";
+} from "./chunk-FRK2AGSG.mjs";
 import {
   AuthError,
   ConfigError
-} from "./chunk-AZWQJAQF.mjs";
+} from "./chunk-QPKHOZI3.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-JF4O5OMH.mjs";
+import "./chunk-OTI562P3.mjs";
 import "./chunk-6IKARAYD.mjs";
 import {
   DeeplineError