prefect-client 3.7.4.dev3__tar.gz → 3.7.5.dev1__tar.gz

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prefect-client
-Version: 3.7.4.dev3
+Version: 3.7.5.dev1
 Summary: Workflow orchestration and management.
 Project-URL: Changelog, https://github.com/PrefectHQ/prefect/releases
 Project-URL: Documentation, https://docs.prefect.io

prefect_client-3.7.5.dev1/src/prefect/_build_info.py

@@ -0,0 +1,5 @@
+# Generated by versioningit
+__version__ = "3.7.5.dev1"
+__build_date__ = "2026-06-06 08:58:56.783483+00:00"
+__git_commit__ = "db66b14dbaea18e726fc4ea0100fd194383c6c59"
+__dirty__ = False

prefect_client-3.7.5.dev1/src/prefect/_internal/urls.py

@@ -0,0 +1,57 @@
+import re
+from collections.abc import Iterable
+from urllib.parse import urlparse, urlunparse
+
+_URL_AUTH_PATTERN = re.compile(
+    r"(?P<scheme>https?://)[^/\s'\"<>]*@", flags=re.IGNORECASE
+)
+
+
+def strip_auth_from_url(url: str) -> str:
+    """
+    Remove authentication credentials (username/password) from a URL.
+
+    Useful for sanitizing URLs before including them in error messages
+    or logs to avoid leaking secrets.
+    """
+    try:
+        parsed = urlparse(url)
+
+        if not parsed.hostname:
+            return url
+
+        netloc = parsed.hostname
+        if parsed.port:
+            netloc = f"{netloc}:{parsed.port}"
+
+        return urlunparse(
+            (
+                parsed.scheme,
+                netloc,
+                parsed.path,
+                parsed.params,
+                parsed.query,
+                parsed.fragment,
+            )
+        )
+    except ValueError:
+        return strip_auth_from_urls_in_text(url)
+
+
+def strip_auth_from_urls_in_text(
+    text: str, extra_secrets: Iterable[str] | None = None
+) -> str:
+    """
+    Remove authentication credentials from HTTP(S) URLs embedded in text.
+
+    Useful for sanitizing command output before including it in error messages
+    or logs. Any caller-supplied secrets are replaced with a redaction marker.
+    """
+    if not text:
+        return text
+
+    sanitized = _URL_AUTH_PATTERN.sub(r"\g<scheme>", text)
+    for secret in extra_secrets or ():
+        if secret:
+            sanitized = sanitized.replace(secret, "***")
+    return sanitized

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/client/schemas/schedules.py

@@ -26,6 +26,26 @@ MAX_ITERATIONS = 1000
 MAX_RRULE_LENGTH = 6500
 
 
+def _iana_timezone_name(tzinfo: datetime.tzinfo) -> str:
+    """Return a valid IANA timezone name for *tzinfo*, or `"UTC"`."""
+    for attr in ("key", "name"):
+        value: Optional[str] = getattr(tzinfo, attr, None)
+        if value and is_valid_timezone(value):
+            return value
+
+    filename: Optional[str] = getattr(tzinfo, "_filename", None)
+    if filename:
+        normalized = filename.replace("\\", "/")
+        marker = "/zoneinfo/"
+        idx = normalized.find(marker)
+        if idx != -1:
+            candidate = normalized[idx + len(marker) :]
+            if candidate and is_valid_timezone(candidate):
+                return candidate
+
+    return "UTC"
+
+
 def is_valid_timezone(v: str) -> bool:
     """
     Validate that the provided timezone is a valid IANA timezone.
@@ -204,26 +224,27 @@ class RRuleSchedule(PrefectBaseModel):
         if isinstance(rrule, dateutil.rrule.rrule):
             dtstart = _rrule_dt(rrule)
             if dtstart and dtstart.tzinfo is not None:
-                timezone = dtstart.tzinfo.tzname(dtstart)
+                timezone = _iana_timezone_name(dtstart.tzinfo)
             else:
                 timezone = "UTC"
             return RRuleSchedule(rrule=str(rrule), timezone=timezone)
         rrules = _rrule(rrule)
         dtstarts = [dts for rr in rrules if (dts := _rrule_dt(rr)) is not None]
         unique_dstarts = set(d.astimezone(ZoneInfo("UTC")) for d in dtstarts)
-        unique_timezones = set(d.tzinfo for d in dtstarts if d.tzinfo is not None)
+        unique_tz_names = set(
+            _iana_timezone_name(d.tzinfo) for d in dtstarts if d.tzinfo is not None
+        )
 
-        if len(unique_timezones) > 1:
+        if len(unique_tz_names) > 1:
             raise ValueError(
-                f"rruleset has too many dtstart timezones: {unique_timezones}"
+                f"rruleset has too many dtstart timezones: {unique_tz_names}"
             )
 
         if len(unique_dstarts) > 1:
             raise ValueError(f"rruleset has too many dtstarts: {unique_dstarts}")
 
-        if unique_dstarts and unique_timezones:
-            [unique_tz] = unique_timezones
-            timezone = unique_tz.tzname(dtstarts[0])
+        if unique_dstarts and unique_tz_names:
+            [timezone] = unique_tz_names
         else:
             timezone = "UTC"
 

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/deployments/base.py

@@ -278,6 +278,33 @@ def _interval_schedule_to_dict(schedule: IntervalSchedule) -> dict[str, Any]:
     return schedule_config
 
 
+def _deployment_already_saved_to_prefect_file(
+    deployment: dict[str, Any],
+    prefect_file: Path = Path("prefect.yaml"),
+) -> bool:
+    """
+    Return True if `prefect.yaml` already contains a deployment entry matching the
+    given deployment's name and entrypoint.
+
+    Used to decide whether the interactive `prefect deploy` flow should offer to
+    persist a newly-created deployment: a deployment that is already declared in
+    the file does not need to be saved again, but a brand-new one (even when the
+    file otherwise exists) should still be offered up for saving.
+    """
+    if not prefect_file.exists():
+        return False
+
+    with prefect_file.open(mode="r") as f:
+        contents = yaml.safe_load(f) or {}
+
+    for existing in contents.get("deployments") or []:
+        if existing.get("name") == deployment.get("name") and existing.get(
+            "entrypoint"
+        ) == deployment.get("entrypoint"):
+            return True
+    return False
+
+
 def _save_deployment_to_prefect_file(
     deployment: dict[str, Any],
     build_steps: list[dict[str, Any]] | None = None,

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/runner/storage.py

@@ -14,7 +14,7 @@ from typing import (
     Union,
     runtime_checkable,
 )
-from urllib.parse import quote, urlparse, urlsplit, urlunparse
+from urllib.parse import quote, unquote, urlparse, urlsplit, urlunparse
 from uuid import uuid4
 
 import fsspec  # pyright: ignore[reportMissingTypeStubs]
@@ -22,7 +22,7 @@ from anyio import run_process
 from pydantic import SecretStr
 
 from prefect._internal.concurrency.api import create_call, from_async
-from prefect._internal.urls import strip_auth_from_url
+from prefect._internal.urls import strip_auth_from_url, strip_auth_from_urls_in_text
 from prefect.blocks.core import Block, BlockNotSavedError
 from prefect.blocks.system import Secret
 from prefect.filesystems import ReadableDeploymentStorage, WritableDeploymentStorage
@@ -499,6 +499,21 @@ class GitRepository:
                 else exc
             )
             safe_url = strip_auth_from_url(self._url)
+            sanitized_stderr = strip_auth_from_urls_in_text(
+                _decode_stderr(exc),
+                extra_secrets=_url_auth_secrets(self._url, repository_url),
+            )
+            # Surface the raw git error at DEBUG so users can opt in via log
+            # level when the hint patterns don't match. The exception chain is
+            # suppressed above when credentials are present, so DEBUG is the
+            # only way to see the actual git output in that case.
+            if sanitized_stderr:
+                self._logger.debug(
+                    "git clone failed (exit %d) for %r: %s",
+                    exc.returncode,
+                    safe_url,
+                    sanitized_stderr.strip(),
+                )
             error_message = (
                 f"Failed to clone repository {safe_url!r} with exit code"
                 f" {exc.returncode}."
@@ -506,6 +521,14 @@ class GitRepository:
             hint = _get_git_clone_error_hint(exc)
             if hint:
                 error_message += f" {hint}"
+            elif sanitized_stderr:
+                # No pattern matched -- surface the actual git error so the
+                # user doesn't have to enable DEBUG to know what went wrong.
+                snippet = sanitized_stderr.strip().splitlines()
+                # Keep the last few lines; git's final 'fatal:' line is usually
+                # the actionable one.
+                tail = " | ".join(snippet[-3:])
+                error_message += f" git stderr: {tail}"
             raise RuntimeError(error_message) from exc_chain
 
         if self._commit_sha:
@@ -985,15 +1008,34 @@ _GIT_CLONE_ERROR_HINTS: list[tuple[str, str]] = [
 ]
 
 
+def _decode_stderr(exc: subprocess.CalledProcessError) -> str:
+    """Decode a CalledProcessError's stderr to text, tolerating bytes/None."""
+    if not exc.stderr:
+        return ""
+    if isinstance(exc.stderr, bytes):
+        return exc.stderr.decode("utf-8", errors="replace")
+    return str(exc.stderr)
+
+
+def _url_auth_secrets(*urls: str) -> list[str]:
+    """Extract userinfo values from URLs so echoed auth can be redacted."""
+    secrets: list[str] = []
+    seen: set[str] = set()
+    for url in urls:
+        parsed = urlparse(url)
+        for value in (parsed.username, parsed.password):
+            if not value:
+                continue
+            for secret in (value, unquote(value)):
+                if secret and secret not in seen:
+                    secrets.append(secret)
+                    seen.add(secret)
+    return secrets
+
+
 def _get_git_clone_error_hint(exc: subprocess.CalledProcessError) -> str | None:
     """Extract a resolution hint from a git clone CalledProcessError's stderr."""
-    stderr = ""
-    if exc.stderr:
-        stderr = (
-            exc.stderr.decode("utf-8", errors="replace")
-            if isinstance(exc.stderr, bytes)
-            else str(exc.stderr)
-        )
+    stderr = _decode_stderr(exc)
     for pattern, hint in _GIT_CLONE_ERROR_HINTS:
         if pattern.lower() in stderr.lower():
             return hint

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/server/api/workers.py

@@ -25,8 +25,10 @@ import prefect.server.models as models
 import prefect.server.schemas as schemas
 from prefect._internal.uuid7 import uuid7
 from prefect.client.schemas.worker_channel import (
+    CLEANUP_DELIVERY_CAPABILITY,
     WORK_POOL_SNAPSHOT_CAPABILITY,
     WORKER_HEARTBEAT_CAPABILITY,
+    WorkerChannelCapability,
     WorkerChannelCloseReason,
     WorkerChannelProtocolError,
     WorkerHelloFrame,
@@ -48,6 +50,10 @@ from prefect.server.schemas.statuses import WorkQueueStatus
 from prefect.server.utilities import subscriptions
 from prefect.server.utilities import worker_channel as worker_channel_utils
 from prefect.server.utilities.server import PrefectRouter
+from prefect.server.worker_communication.cleanup_queue import (
+    WorkerCleanupQueue,
+    get_worker_cleanup_queue,
+)
 from prefect.types import DateTime
 from prefect.types._datetime import now
 
@@ -61,7 +67,7 @@ router: PrefectRouter = PrefectRouter(
 )
 logger: Logger = get_logger("prefect.server.api.workers")
 
-_OSS_WORKER_CHANNEL_ACCEPTED_CAPABILITIES = [
+_OSS_WORKER_CHANNEL_REQUIRED_CAPABILITIES: list[WorkerChannelCapability] = [
     WORKER_HEARTBEAT_CAPABILITY,
     WORK_POOL_SNAPSHOT_CAPABILITY,
 ]
@@ -183,6 +189,26 @@ class WorkerChannelWorkPoolUpdateEvent:
     changed_fields: dict[str, dict[str, Any]]
 
 
+def _worker_requested_cleanup_delivery(hello: WorkerHelloFrame) -> bool:
+    return (
+        CLEANUP_DELIVERY_CAPABILITY in hello.payload.requested_capabilities
+        and bool(hello.payload.handled_cleanup_kinds)
+        and hello.payload.max_cleanup_concurrency > 0
+    )
+
+
+def _accepted_worker_channel_capabilities(
+    hello: WorkerHelloFrame,
+    *,
+    cleanup_queue_available: bool,
+) -> list[WorkerChannelCapability]:
+    accepted = list(_OSS_WORKER_CHANNEL_REQUIRED_CAPABILITIES)
+    if cleanup_queue_available and _worker_requested_cleanup_delivery(hello):
+        accepted.append(CLEANUP_DELIVERY_CAPABILITY)
+
+    return accepted
+
+
 async def _receive_worker_hello(websocket: WebSocket) -> WorkerHelloFrame:
     try:
         message = await websocket.receive_json()
@@ -290,6 +316,7 @@ async def _build_worker_ready_frame(
     session: AsyncSession,
     work_pool_name: str,
     hello: WorkerHelloFrame,
+    cleanup_queue_available: bool,
 ) -> tuple[WorkerReadyFrame, WorkerChannelWorkPoolUpdateEvent | None]:
     try:
         selected_channel_version = select_worker_channel_version(
@@ -371,7 +398,10 @@ async def _build_worker_ready_frame(
     )
 
     requested_capabilities = list(dict.fromkeys(hello.payload.requested_capabilities))
-    accepted = _OSS_WORKER_CHANNEL_ACCEPTED_CAPABILITIES
+    accepted = _accepted_worker_channel_capabilities(
+        hello,
+        cleanup_queue_available=cleanup_queue_available,
+    )
     accepted_set = set(accepted)
     rejected = [
         capability
@@ -393,7 +423,11 @@ async def _build_worker_ready_frame(
                 ),
                 "accepted_capabilities": accepted,
                 "rejected_capabilities": rejected,
-                "effective_max_cleanup_concurrency": 0,
+                "effective_max_cleanup_concurrency": (
+                    hello.payload.max_cleanup_concurrency
+                    if CLEANUP_DELIVERY_CAPABILITY in accepted_set
+                    else 0
+                ),
                 "resolved_work_queues": [
                     {"id": work_queue.id, "name": work_queue.name}
                     for work_queue in work_queues
@@ -1058,6 +1092,16 @@ async def worker_channel_connect(
 
     try:
         hello = await _receive_worker_hello(websocket)
+        cleanup_queue: WorkerCleanupQueue | None = None
+        if _worker_requested_cleanup_delivery(hello):
+            try:
+                cleanup_queue = get_worker_cleanup_queue()
+            except Exception:
+                logger.exception(
+                    "Worker cleanup delivery queue initialization failed; "
+                    "rejecting cleanup delivery capability"
+                )
+
         async with worker_channel_utils.messaging.ephemeral_subscription(
             worker_channel_utils.WORKER_CHANNEL_SNAPSHOT_TOPIC,
         ) as consumer_kwargs:
@@ -1066,6 +1110,7 @@ async def worker_channel_connect(
                     session=session,
                     work_pool_name=work_pool_name,
                     hello=hello,
+                    cleanup_queue_available=cleanup_queue is not None,
                 )
 
             if work_pool_update_event is not None:
@@ -1094,6 +1139,17 @@ async def worker_channel_connect(
                 work_pool_id=ready.payload.initial_snapshot.work_pool.id,
                 consumer_id=hello.payload.consumer_id,
                 worker_name=hello.payload.worker_name,
+                cleanup_queue=(
+                    cleanup_queue
+                    if CLEANUP_DELIVERY_CAPABILITY
+                    in ready.payload.accepted_capabilities
+                    else None
+                ),
+                cleanup_kinds=tuple(hello.payload.handled_cleanup_kinds),
+                cleanup_work_queue_ids=tuple(
+                    work_queue.id for work_queue in ready.payload.resolved_work_queues
+                ),
+                max_cleanup_concurrency=ready.payload.effective_max_cleanup_concurrency,
             )
             await connection.run(ready, consumer_kwargs)
 

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/settings/_types.py

@@ -140,6 +140,9 @@ SettingAccessor: TypeAlias = Literal[
     "server.register_blocks_on_start",
     "server.services.cancellation_cleanup.enabled",
     "server.services.cancellation_cleanup.loop_seconds",
+    "server.services.cleanup_reconciler.batch_size",
+    "server.services.cleanup_reconciler.enabled",
+    "server.services.cleanup_reconciler.loop_seconds",
     "server.services.db_vacuum.batch_size",
     "server.services.db_vacuum.enabled",
     "server.services.db_vacuum.event_retention_overrides",

{prefect_client-3.7.4.dev3 → prefect_client-3.7.5.dev1}/src/prefect/settings/models/server/services.py

@@ -542,6 +542,33 @@ class ServerServicesRepossessorSettings(ServicesBaseSetting):
     )
 
 
+class ServerServicesCleanupReconcilerSettings(ServicesBaseSetting):
+    """
+    Settings for controlling the cleanup reconciler service.
+    """
+
+    model_config: ClassVar[SettingsConfigDict] = build_settings_config(
+        ("server", "services", "cleanup_reconciler")
+    )
+
+    enabled: bool = Field(
+        default=True,
+        description="Whether or not to start the cleanup reconciler service in the server application.",
+    )
+
+    loop_seconds: float = Field(
+        default=5,
+        gt=0,
+        description="The cleanup reconciler service will look for expired cleanup message leases this often. Defaults to `5`.",
+    )
+
+    batch_size: int = Field(
+        default=100,
+        gt=0,
+        description="The maximum number of expired cleanup message leases to process per service loop. Defaults to `100`.",
+    )
+
+
 class ServerServicesTaskRunRecorderSettings(ServicesBaseSetting):
     """
     Settings for controlling the task run recorder service
@@ -677,6 +704,10 @@ class ServerServicesSettings(PrefectBaseSettings):
         default_factory=ServerServicesRepossessorSettings,
         description="Settings for controlling the repossessor service",
     )
+    cleanup_reconciler: ServerServicesCleanupReconcilerSettings = Field(
+        default_factory=ServerServicesCleanupReconcilerSettings,
+        description="Settings for controlling the cleanup reconciler service",
+    )
     task_run_recorder: ServerServicesTaskRunRecorderSettings = Field(
         default_factory=ServerServicesTaskRunRecorderSettings,
         description="Settings for controlling the task run recorder service",

prefect_client-3.7.4.dev3/src/prefect/_build_info.py

@@ -1,5 +0,0 @@
-# Generated by versioningit
-__version__ = "3.7.4.dev3"
-__build_date__ = "2026-06-04 09:26:14.779709+00:00"
-__git_commit__ = "80846482817539c21fe22cf2372b55e953a27e92"
-__dirty__ = False

prefect_client-3.7.4.dev3/src/prefect/_internal/urls.py

@@ -1,29 +0,0 @@
-from urllib.parse import urlparse, urlunparse
-
-
-def strip_auth_from_url(url: str) -> str:
-    """
-    Remove authentication credentials (username/password) from a URL.
-
-    Useful for sanitizing URLs before including them in error messages
-    or logs to avoid leaking secrets.
-    """
-    parsed = urlparse(url)
-
-    if not parsed.hostname:
-        return url
-
-    netloc = parsed.hostname
-    if parsed.port:
-        netloc = f"{netloc}:{parsed.port}"
-
-    return urlunparse(
-        (
-            parsed.scheme,
-            netloc,
-            parsed.path,
-            parsed.params,
-            parsed.query,
-            parsed.fragment,
-        )
-    )