feat(sdk,core,webapp,run-engine): runtime override for the combined queue concurrency limit

[matt-aitken]

Summary

Adjust a queue's combined concurrency limit at runtime without a deploy. queues.overrideCombinedConcurrencyLimit raises or lowers the cap on concurrent runs across all of a queue's concurrencyKey values, and queues.resetCombinedConcurrencyLimit reverts to the declared configuration. Stacked on #4827.

await queues.overrideCombinedConcurrencyLimit("my-queue", 100);
await queues.resetCombinedConcurrencyLimit("my-queue");

Design

Combined overrides follow the existing override bookkeeping exactly: validated against the environment limit, the declared base captured on first override, reset restoring it, and deploys preserving an active override instead of clobbering it from the code manifest (the declared value lands in the base). The read path clamps to the environment limit at admit time.

Per-key runtime overrides were built in earlier revisions of this PR and then deliberately removed: composing a per-key override hash with pause semantics and keeping it convergent with durable rows across deploys, resets, and races needs its own design, so that feature is deferred to a future PR. Declared per-key behavior is unchanged (concurrencyLimit applies per key as before).

[changeset-bot]

🦋 Changeset detected

Latest commit: 43c724e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/sdk	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/schema-to-json	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@trigger.dev/rbac	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/tracing	Patch
@internal/webhook-engine	Patch
@internal/webhook-sources	Patch
@internal/cache	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/rsc	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/sso	Patch
@internal/testcontainers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad3b3fa8-6657-41f1-a54e-aae53b0ee8d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Observability map

As of 43c724e.

19/100 over 456 measured of 474 entry points (base 20, down 1)

What this PR changed

route	base	head	now failing
/api/v1/queues/:queueParam/concurrency/combined/override	new	0	request-context
/api/v1/queues/:queueParam/concurrency/combined/reset	new	0	request-context

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 23 of 456 entry points name a tenant on a failure path. 354 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  184 applicable, 106 pass,   0 sole, global without it 11
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 16
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 19
  request-context       456 applicable,  23 pass, 250 sole, global without it 65
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@43c724e

trigger.dev

npm i https://pkg.pr.new/trigger.dev@43c724e

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@43c724e

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@43c724e

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@43c724e

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@43c724e

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@43c724e

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@43c724e

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@43c724e

commit: 43c724e