feat(sdk,core,webapp,run-engine): runtime overrides for combined and per-key queue limits

[matt-aitken]

Summary

Stacked on #4827. Makes queue concurrency adjustable at runtime, per key and in total:

import { queues } from "@trigger.dev/sdk";

await queues.overrideConcurrencyLimit("my-queue", 20, { concurrencyKey: "tenant-123" });
await queues.resetConcurrencyLimit("my-queue", { concurrencyKey: "tenant-123" });

await queues.overrideCombinedConcurrencyLimit("my-queue", 100);
await queues.resetCombinedConcurrencyLimit("my-queue");

Today overrideConcurrencyLimit moves every key's limit at once, which is the structural blocker for "raise one tenant". The named concurrencyKey parameter routes to a per-key override that leaves the rest of the queue alone, and the total override adjusts the cross-key cap that #4823 introduced.

Design

Per-key overrides live in a sparse Redis hash on the base queue whose fields are the exact key-variant names, so the dequeue admit reads them with a single lookup and no parsing; a new child table mirrors them for durability, unique per queue and key, cascading with the queue. Writes go through an atomic script that caps the number of overrides per queue (default 1000) and rejects new keys past the cap while always allowing updates to existing ones. Resetting deletes the row and the hash field, falling back to the queue's limit.

Total overrides follow the existing override bookkeeping exactly: validated against the environment limit, the declared base captured on first override, reset restoring it, and deploys preserving an active override instead of clobbering it from the code manifest (the declared value lands in the base). Both read paths clamp to the environment limit at admit time, and per-key enforcement sits behind the same server flag as the total cap.

Not included, by design: dashboard surfacing for overrides (rides the metrics work) and automatic redistribution between keys.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0bef7b3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/sdk	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/schema-to-json	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@trigger.dev/rbac	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/tracing	Patch
@internal/webhook-engine	Patch
@internal/webhook-sources	Patch
@internal/cache	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/rsc	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/sso	Patch
@internal/testcontainers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6dfedf38-869d-4730-8302-784744105579

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Observability map

As of 0bef7b3.

20/100 over 454 measured of 472 entry points (base 20, no change)

What this PR changed

route	base	head	now failing
/api/v1/queues/:queueParam/concurrency/combined/override	new	0	request-context
/api/v1/queues/:queueParam/concurrency/combined/reset	new	0	request-context
/api/v1/queues/:queueParam/concurrency/key/override	new	0	request-context
/api/v1/queues/:queueParam/concurrency/key/reset	new	0	request-context

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 23 of 454 entry points name a tenant on a failure path. 352 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  184 applicable, 106 pass,   0 sole, global without it 12
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 16
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 19
  request-context       454 applicable,  23 pass, 248 sole, global without it 65
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@0bef7b3

trigger.dev

npm i https://pkg.pr.new/trigger.dev@0bef7b3

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@0bef7b3

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@0bef7b3

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@0bef7b3

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@0bef7b3

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@0bef7b3

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@0bef7b3

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@0bef7b3

commit: 0bef7b3