deepline 0.3.88 → 0.3.89

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-start-admission.ts

@@ -0,0 +1,68 @@
+import { RUNTIME_CAPACITY_POLICY } from '../../runtime-capacity-policy';
+
+export type DaytonaSandboxStartAdmission = {
+  run<T>(operation: () => Promise<T>): Promise<T>;
+};
+
+/**
+ * Daytona sandbox starts are control-plane transitions, not execution work.
+ * Keep their admission independent from Absurd worker slots so a run burst can
+ * still multiplex started sandboxes without stampeding the provider's create
+ * transition. A permit covers timeout reconciliation too: releasing it when
+ * `create` times out would admit another create while the first named sandbox
+ * is still transitioning, recreating the unsafe overlap this gate prevents.
+ */
+export function createDaytonaSandboxStartAdmission(
+  concurrency =
+    RUNTIME_CAPACITY_POLICY.sandboxAcquisition
+      .daytonaConcurrentStartsPerProcess,
+): DaytonaSandboxStartAdmission {
+  if (!Number.isInteger(concurrency) || concurrency <= 0) {
+    throw new Error(
+      'Daytona sandbox-start concurrency must be a positive integer.',
+    );
+  }
+
+  let active = 0;
+  const waiters: Array<(release: () => void) => void> = [];
+
+  const createRelease = (): (() => void) => {
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const next = waiters.shift();
+      if (next) {
+        // Transfer the occupied permit directly. Keeping `active` unchanged
+        // prevents a new eager caller from jumping ahead of the FIFO waiter.
+        next(createRelease());
+        return;
+      }
+      active -= 1;
+    };
+  };
+
+  return {
+    async run<T>(operation: () => Promise<T>): Promise<T> {
+      // Preserve eager prepare semantics when capacity is free: the provider
+      // create begins in this turn, just as it did before admission existed.
+      // Only contended callers cross an asynchronous queue boundary.
+      const release =
+        active < concurrency
+          ? (() => {
+              active += 1;
+              return createRelease();
+            })()
+          : await new Promise<() => void>((resolve) => waiters.push(resolve));
+      try {
+        return await operation();
+      } finally {
+        release();
+      }
+    },
+  };
+}
+
+/** One admission queue per worker process; all run slots share it. */
+export const daytonaSandboxStartAdmission =
+  createDaytonaSandboxStartAdmission();

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -43,6 +43,7 @@ import {
   prepareDetachedDaytonaRunner,
 } from './daytona-session-execution';
 import { RUNTIME_RELIABILITY_POLICY } from '../../runtime-reliability-policy';
+import { daytonaSandboxStartAdmission } from './daytona-start-admission';
 
 const DAYTONA_COMMAND_RECOVERY_TIMEOUT_MS =
   RUNTIME_RELIABILITY_POLICY.sandbox.daytonaCommandRecoveryTimeoutMs;
@@ -973,6 +974,7 @@ function prepareDaytonaExecution(
           callbacks.reserveSandboxCapacity!('daytona', providerAttempt)
       : undefined,
     releaseSandboxCapacity: callbacks?.releaseSandboxCapacity,
+    startAdmission: daytonaSandboxStartAdmission,
   });
   return {
     kind: 'daytona',

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/runtime-sandbox-reconciliation.ts

@@ -11,6 +11,7 @@ import type { DetachedRunnerSuspension } from '../suspension';
 export type RuntimeSandboxProviderId = 'daytona' | 'modal';
 
 export type RuntimeSandboxRef = {
+  /** Frozen at 1: persisted in suspension_json, so readers must keep taking 1. */
   schemaVersion: 1;
   provider: RuntimeSandboxProviderId;
   resourceId: string;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -3361,8 +3361,8 @@ async function writeRuntimeRows(
         const insertedRowsCte =
           input.mode === 'upsert'
             ? `inserted_rows AS (
-                INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index${physicalInsertColumnsSql})
-                SELECT _key, 'pending', $4::text, _input_index${physicalInsertValuesSql}
+                INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _created_at${physicalInsertColumnsSql})
+                SELECT _key, 'pending', $4::text, _input_index, now()${physicalInsertValuesSql}
                 FROM input_rows
                 ON CONFLICT (_key) DO UPDATE SET
                   _status = 'pending',
@@ -3374,8 +3374,8 @@ async function writeRuntimeRows(
                 RETURNING _key
               ),`
             : `inserted_rows AS (
-                INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index${physicalInsertColumnsSql})
-                SELECT _key, 'pending', $4::text, _input_index${physicalInsertValuesSql}
+                INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _created_at${physicalInsertColumnsSql})
+                SELECT _key, 'pending', $4::text, _input_index, now()${physicalInsertValuesSql}
                 FROM input_rows
                 RETURNING _key
               ),`;
@@ -3660,8 +3660,8 @@ async function prepareRuntimeSheetDatasetRows(
           RETURNING target._key
         ),
         inserted_rows AS (
-          INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _attempt_id, _attempt_owner_run_id, _attempt_expires_at, _attempt_seq, _write_version, _writer_run_id${input.physicalInsertColumnsSql})
-          SELECT _key, 'pending', $4::text, _input_index, $7::text, $8::text, $9::timestamptz, $10::integer, $12::bigint, $4::text${input.physicalInsertValuesSql}
+          INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _attempt_id, _attempt_owner_run_id, _attempt_expires_at, _attempt_seq, _write_version, _writer_run_id, _created_at${input.physicalInsertColumnsSql})
+          SELECT _key, 'pending', $4::text, _input_index, $7::text, $8::text, $9::timestamptz, $10::integer, $12::bigint, $4::text, now()${input.physicalInsertValuesSql}
           FROM input_rows
           ON CONFLICT (_key) DO UPDATE SET
             _status = 'pending',
@@ -3991,9 +3991,9 @@ async function prepareNetNewRuntimeSheetDatasetRows(
        inserted_rows AS (
          INSERT INTO ${sheetTable(session)}
          (_key, _status, _run_id, _input_index, _attempt_id, _attempt_owner_run_id,
-          _attempt_expires_at, _attempt_seq, _write_version, _writer_run_id${input.physicalInsertColumnsSql})
+          _attempt_expires_at, _attempt_seq, _write_version, _writer_run_id, _created_at${input.physicalInsertColumnsSql})
        SELECT _key, 'pending', $4::text, _input_index, $5::text, $6::text,
-              $7::timestamptz, $8::integer, $9::bigint, $4::text${input.physicalInsertValuesSql}
+              $7::timestamptz, $8::integer, $9::bigint, $4::text, now()${input.physicalInsertValuesSql}
        FROM input_rows
        ON CONFLICT (_key) DO NOTHING
        RETURNING _key
@@ -7642,6 +7642,7 @@ async function insertMissingCompletedMapRowChunks(
            _attempt_owner_run_id,
            _attempt_expires_at,
            _attempt_seq,
+           _created_at,
            _cell_meta${physicalInsertColumnsSql}
          )
          SELECT _key,
@@ -7652,6 +7653,7 @@ async function insertMissingCompletedMapRowChunks(
                 $9::text,
                 $10::timestamptz,
                 $11::integer,
+                now(),
                 cell_meta_patch${physicalInsertValuesSql}
            FROM missing_rows
          ON CONFLICT (_key) DO NOTHING

package/dist/bundling-sources/shared_libs/play-runtime/runtime-capacity-policy.ts

@@ -26,6 +26,14 @@ export const RUNTIME_CAPACITY_POLICY = {
     claimOperationTimeoutMs: 20_000,
     requestTimeoutMs: 30_000,
   },
+  sandboxAcquisition: {
+    /**
+     * Starting a Daytona sandbox is a provider control-plane transition, not
+     * an Absurd execution slot. Serialize starts within each worker process;
+     * once started, all eight execution slots may run concurrently.
+     */
+    daytonaConcurrentStartsPerProcess: 1,
+  },
 } as const;
 
 export const ABSURD_GLOBAL_RUN_CONCURRENCY =
@@ -96,6 +104,18 @@ function nonNegativeNumber(value: number): number {
 }
 
 export function assertRuntimeCapacityPolicy(): void {
+  if (
+    !Number.isInteger(
+      RUNTIME_CAPACITY_POLICY.sandboxAcquisition
+        .daytonaConcurrentStartsPerProcess,
+    ) ||
+    RUNTIME_CAPACITY_POLICY.sandboxAcquisition
+      .daytonaConcurrentStartsPerProcess <= 0
+  ) {
+    throw new Error(
+      'Daytona sandbox-start concurrency must be a positive integer.',
+    );
+  }
   if (
     RUNTIME_CAPACITY_POLICY.receiptGateway.requestTimeoutMs <=
     RUNTIME_CAPACITY_POLICY.receiptGateway.admissionTimeoutMs

package/dist/bundling-sources/shared_libs/play-runtime/runtime-contract.ts

@@ -3,11 +3,17 @@
  * receipt presentations. New operations must not use this as a version gate.
  */
 export const LEGACY_RUNTIME_RECEIPT_WIRE_HEADER = 'x-deepline-runtime-contract';
+// Frozen: production lane main-9281ae259f still sends wire format 2. Delete
+// this and `resolveLegacyRuntimeReceiptWireFormat` after that lane retires.
 export const LEGACY_RUNTIME_RECEIPT_WIRE_FORMAT = 3 as const;
 /**
  * Historical workers validate this readiness range before they claim work.
  * It is an output-only compatibility presentation; current callers use named
  * operation capabilities and do not treat it as a global admission contract.
+ *
+ * Frozen: a lane built before the global compatibility gate was removed calls
+ * /readyz at boot and throws when this range is absent. Delete after every such
+ * lane has retired.
  */
 export const LEGACY_RUNTIME_READINESS_MIN_SUPPORTED = 1 as const;
 export const LEGACY_RUNTIME_READINESS_CURRENT = 6 as const;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-env.ts

@@ -53,3 +53,9 @@ export function getRuntimeEnvInfo() {
     node_env: process.env.NODE_ENV ?? null,
   };
 }
+
+/** Test seams must never be reachable from a Vercel production deployment. */
+export function isTestOnlyRuntime(): boolean {
+  if (process.env.VERCEL_ENV === 'production') return false;
+  return process.env.VERCEL_ENV === 'preview' || getRuntimeEnv() !== 'prod';
+}

package/dist/bundling-sources/shared_libs/play-runtime/runtime-scheduler-topology.ts

@@ -12,6 +12,30 @@
  */
 export const PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA = 'runtime_scheduler';
 
+/** A wire-safe Postgres schema name that identifies one runtime topology. */
+export const RUNTIME_SCHEDULER_SCHEMA_RE = /^[a-z_][a-z0-9_]{0,62}$/;
+
+export function normalizeRuntimeSchedulerSchema(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const schema = value.trim();
+  return RUNTIME_SCHEDULER_SCHEMA_RE.test(schema) ? schema : null;
+}
+
+/**
+ * The one release-id shape. A release id is minted by the release controller
+ * and doubles as the lane's queue suffix (`runs_<releaseId>`) and the
+ * `DEEPLINE_RUNTIME_DEPLOY_VERSION` on every Machine in the lane, so it must be
+ * a stable lowercase engine-safe slug: no uppercase, no underscore, no repeated
+ * or trailing hyphen, 6 to 64 characters.
+ *
+ * It lives here, dependency-free, because the Fly lane operator, the release
+ * controller, the internal registry route, and the admin routes must all agree
+ * on it — a second copy is how one surface silently starts accepting an id the
+ * queue cannot name.
+ */
+export const ABSURD_RELEASE_ID_RE =
+  /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){5,63}$/;
+
 /**
  * True when the scheduler schema names an isolated (preview CI / worktree)
  * topology. Null/empty/prod-default => false (production topology). Callers

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backend.ts

@@ -41,10 +41,36 @@ export type { PlayRunInputPayload };
 
 export type PlaySchedulerSubmitInput = {
   runId: string;
+  /** First-class async-child lineage. Absent for root launches. */
+  parentRunId?: string | null;
+  rootRunId?: string | null;
+  asyncLaunchKey?: string | null;
+  asyncInvocationKey?: string | null;
+  asyncRequestFingerprint?: string | null;
+  /** Full play ancestry for a scheduled child, including this play. */
+  asyncAncestryPlayIds?: string[] | null;
   playId: string;
   playName: string;
+  playReference?: string | null;
+  /**
+   * Immutable scheduler namespace for this admission. The durable
+   * `run.created` projector persists it onto the Play Run so replay/control
+   * paths stay on the original runtime lane instead of falling back to a host
+   * default.
+   */
+  schedulerSchema?: string | null;
+  definitionScope?: 'org' | 'system' | null;
+  revisionId?: string | null;
   workflowFamilyKey?: string | null;
   artifactStorageKey: string;
+  /**
+   * The runtime PostgreSQL admission path committed this launch before its
+   * Convex `run.created` projection exists. The worker must deliver that
+   * causal fact before it can claim an execution attempt.
+   *
+   * Omitted for legacy launches whose Play Run row was persisted synchronously.
+   */
+  requiresRunCreatedProjection?: boolean;
   /** Optional inline artifact for the Node scheduler. */
   runtimeArtifact?: unknown;
   artifactHash: string;
@@ -52,6 +78,9 @@ export type PlaySchedulerSubmitInput = {
   /** Immutable scheduler/worker/runner ABI snapshot (not a Git SHA). */
   runtimeProtocolVersion?: PlayRuntimeProtocolVersion | null;
   input: PlayRunInputPayload;
+  /** Bounded launch metadata used only by the asynchronous ledger projector. */
+  staticPipeline?: unknown;
+  inputSummary?: Record<string, unknown>;
   /** Convex metadata for the exact input saved before scheduler submission. */
   inputFileId?: string;
   inputBytes?: number;
@@ -127,7 +156,7 @@ export type PlaySchedulerSubmitInput = {
   userId?: string | null;
   source?: 'published' | 'ad_hoc' | 'draft';
   /** Invocation origin, distinct from the artifact source above. */
-  triggerSource?: 'api' | 'webhook' | 'cron' | 'sql_listener';
+  triggerSource?: 'api' | 'webhook' | 'cron' | 'sql_listener' | 'async_child';
   /** Null lets a durable trigger wait for capacity; a number bounds queue delay. */
   queueMaxDelaySeconds?: number | null;
   /**

package/dist/bundling-sources/shared_libs/play-runtime/tool-http-errors.ts

@@ -186,7 +186,7 @@ function isInsufficientCreditsBilling(
  * credit/cap denial: a funded org is temporarily blocked because our billing
  * store hiccuped, so it must be repairable on the next run rather than cached as
  * a terminal failure. See `billingUnavailableResponse` in
- * src/lib/integrations/execute-billing.ts. This class is the exact incident
+ * packages/integrations/execute-billing.ts. This class is the exact incident
  * poison closed by issues #2561/#2706: without this carve-out a billing-plane
  * outage classifies every affected tool call as `hard_billing_error` ->
  * `terminal` and the next run replays the cached failure instead of retrying.

package/dist/bundling-sources/shared_libs/play-runtime/tool-result.ts

@@ -206,7 +206,7 @@ function adaptV2ExecuteResponseToToolResult(data: Record<string, unknown>): {
  *
  * Boundary note: provider-specific redaction (wiza/apify/bettercontact billing
  * fields) happens server-side in
- * `src/lib/integrations/execute-result-normalization.ts` BEFORE the response
+ * `packages/integrations/execute-result-normalization.ts` BEFORE the response
  * leaves the API. This module only ever sees the already-redacted public
  * response — do not move redaction here, it would leak provider internals
  * into the shared runtime bundles.

package/dist/bundling-sources/shared_libs/plays/artifact-types.ts

@@ -20,10 +20,13 @@ export type PlayRuntimeFeature =
   | 'packaged_files';
 
 export type PlayArtifactCompatibility = {
-  apiVersion: number;
+  /** Historical marker carried by stored artifacts. Nothing branches on it. */
+  apiVersion?: number;
   artifactVersion: number;
-  minRunnerVersion: number;
-  runtimeFeatures: PlayRuntimeFeature[];
+  /** Historical marker carried by stored artifacts. Every runner reads every artifact. */
+  minRunnerVersion?: number;
+  /** Historical marker carried by stored artifacts. Capabilities are named per operation. */
+  runtimeFeatures?: PlayRuntimeFeature[];
   runtimeBackend?: string | null;
   /** Missing preserves the legacy schema used before this field existed. */
   toolErrorSchemaVersion?: ToolExecutionErrorSchemaVersion;