deepline 0.1.121 → 0.1.122

package/dist/bundling-sources/sdk/src/release.ts

@@ -99,10 +99,10 @@ export const SDK_RELEASE = {
   // skill on the sdk sync surface, and the people-search-to-email prebuilt.
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
-  version: '0.1.121',
+  version: '0.1.122',
   apiContract: '2026-06-dataset-column-cell-stale-hard-cutover',
   supportPolicy: {
-    latest: '0.1.121',
+    latest: '0.1.122',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -188,6 +188,8 @@ function isUnsafeOutboundUrlError(error: unknown): boolean {
 
 const EXECUTE_TOOL_METADATA_HEADER = 'x-deepline-include-tool-metadata';
 const EXECUTE_RESPONSE_CONTRACT_HEADER = 'x-deepline-execute-response-contract';
+const AUTH_ACTIVITY_SUPPRESS_SLACK_HEADER =
+  'x-deepline-suppress-auth-activity-slack';
 const V2_EXECUTE_RESPONSE_CONTRACT = 'v2-tool-response';
 const IN_MEMORY_STEP_RESULT_PREVIEW_LIMIT = 25;
 const WATERFALL_ROW_MATCH_LOG_SAMPLE_LIMIT = 10;
@@ -5338,6 +5340,7 @@ export class PlayContextImpl {
                   [EXECUTE_RESPONSE_CONTRACT_HEADER]:
                     V2_EXECUTE_RESPONSE_CONTRACT,
                   [EXECUTE_TOOL_METADATA_HEADER]: 'true',
+                  [AUTH_ACTIVITY_SUPPRESS_SLACK_HEADER]: 'true',
                   ...(this.#options.vercelProtectionBypassToken?.trim()
                     ? {
                         'x-vercel-protection-bypass':

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -217,6 +217,11 @@ type RuntimeApiActionRequest =
         alg: 'RSA-OAEP-256+A256GCM';
         publicKeyJwk: JsonWebKey;
       } | null;
+    }
+  | {
+      action: 'repair_runtime_storage_grants';
+      playName: string;
+      runId?: string | null;
     };
 
 type RuntimeApiRowRecord = MapRowOutcome & {
@@ -544,9 +549,28 @@ async function ensureRuntimeSheetForPreloadedSession(
     runtimeSheetEnsureCache.delete(cacheKey);
   }
   const checkStartedAt = Date.now();
-  const ready = await isRuntimeSheetSchemaReady(input.session, {
-    sheetContract: input.sheetContract,
-  });
+  let ready: boolean;
+  try {
+    ready = await isRuntimeSheetSchemaReady(input.session, {
+      sheetContract: input.sheetContract,
+    });
+  } catch (error) {
+    if (!isPostgresPermissionDeniedError(error)) {
+      throw error;
+    }
+    const repairStartedAt = Date.now();
+    await repairRuntimeStorageGrants(context, {
+      playName: context.playName,
+    });
+    input.timings?.push({
+      phase: 'repair_storage_grants_after_schema_check_permission_error',
+      ms: Date.now() - repairStartedAt,
+      retried: true,
+    });
+    ready = await isRuntimeSheetSchemaReady(input.session, {
+      sheetContract: input.sheetContract,
+    });
+  }
   input.timings?.push({
     phase: 'schema_check_for_preloaded_session',
     ms: Date.now() - checkStartedAt,
@@ -1231,6 +1255,28 @@ function isMissingRelationError(error: unknown): boolean {
   );
 }
 
+function isPostgresPermissionDeniedError(error: unknown): boolean {
+  return (
+    error !== null &&
+    typeof error === 'object' &&
+    'code' in error &&
+    String(error.code) === '42501'
+  );
+}
+
+async function repairRuntimeStorageGrants(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+  },
+): Promise<void> {
+  await postRuntimeApi<{ ok: true }>(context, {
+    action: 'repair_runtime_storage_grants',
+    playName: input.playName,
+    runId: context.runId ?? null,
+  });
+}
+
 async function withRuntimeSheetProvisioningRetry<T>(
   context: RuntimeApiContext,
   input: {
@@ -1257,16 +1303,27 @@ async function withRuntimeSheetProvisioningRetry<T>(
       retried: false,
       error: error instanceof Error ? error.message : String(error),
     });
-    if (!isMissingRelationError(error)) {
+    if (isMissingRelationError(error)) {
+      const ensureStartedAt = Date.now();
+      await ensureRuntimeSheet(context, input);
+      input.timings?.push({
+        phase: 'ensure_sheet_after_provisioning_error',
+        ms: Date.now() - ensureStartedAt,
+        retried: true,
+      });
+    } else if (isPostgresPermissionDeniedError(error)) {
+      const repairStartedAt = Date.now();
+      await repairRuntimeStorageGrants(context, {
+        playName: input.playName,
+      });
+      input.timings?.push({
+        phase: 'repair_storage_grants_after_permission_error',
+        ms: Date.now() - repairStartedAt,
+        retried: true,
+      });
+    } else {
       throw error;
     }
-    const ensureStartedAt = Date.now();
-    await ensureRuntimeSheet(context, input);
-    input.timings?.push({
-      phase: 'ensure_sheet_after_provisioning_error',
-      ms: Date.now() - ensureStartedAt,
-      retried: true,
-    });
     const retryStartedAt = Date.now();
     const result = await operation();
     input.timings?.push({
@@ -1458,13 +1515,18 @@ async function withRuntimeWorkReceiptClient<T>(
     try {
       return await operation(client);
     } catch (error) {
-      if (!isMissingRelationError(error)) {
+      if (isMissingRelationError(error)) {
+        runtimeWorkReceiptEnsureCache.delete(
+          runtimeWorkReceiptEnsureCacheKey(session),
+        );
+        await ensureRuntimeWorkReceiptTable(session, client);
+      } else if (isPostgresPermissionDeniedError(error)) {
+        await repairRuntimeStorageGrants(context, {
+          playName: context.playName?.trim() || session.playName,
+        });
+      } else {
         throw error;
       }
-      runtimeWorkReceiptEnsureCache.delete(
-        runtimeWorkReceiptEnsureCacheKey(session),
-      );
-      await ensureRuntimeWorkReceiptTable(session, client);
       return await operation(client);
     }
   };

package/dist/bundling-sources/shared_libs/security/safe-outbound-fetch.ts

@@ -13,6 +13,7 @@ import {
 
 type NodeSafeFetchOptions = {
   maxRedirects?: number;
+  maxResponseBytes?: number;
   sensitiveHeaders?: Iterable<string>;
 };
 
@@ -124,6 +125,7 @@ function createRequest(
   url: URL,
   init: RequestInit,
   prepared: PreparedBody,
+  maxResponseBytes: number | undefined,
 ): Promise<Response> {
   return new Promise((resolve, reject) => {
     const transport = url.protocol === 'https:' ? https : http;
@@ -137,9 +139,38 @@ function createRequest(
         signal: init.signal ?? undefined,
       },
       (response) => {
+        const contentLength = Number(response.headers['content-length']);
+        if (
+          maxResponseBytes !== undefined &&
+          Number.isFinite(contentLength) &&
+          contentLength > maxResponseBytes
+        ) {
+          response.resume();
+          reject(
+            new Error(
+              `Response body exceeds ${maxResponseBytes} byte limit.`,
+            ),
+          );
+          return;
+        }
+
         const chunks: Buffer[] = [];
+        let receivedBytes = 0;
         response.on('data', (chunk) => {
-          chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+          const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          receivedBytes += buffer.byteLength;
+          if (
+            maxResponseBytes !== undefined &&
+            receivedBytes > maxResponseBytes
+          ) {
+            response.destroy(
+              new Error(
+                `Response body exceeds ${maxResponseBytes} byte limit.`,
+              ),
+            );
+            return;
+          }
+          chunks.push(buffer);
         });
         response.on('error', reject);
         response.on('end', () => {
@@ -208,6 +239,7 @@ export async function safeOutboundFetch(
 ): Promise<Response> {
   const redirectMode = init.redirect ?? 'follow';
   const maxRedirects = options.maxRedirects ?? 10;
+  const maxResponseBytes = options.maxResponseBytes;
   const sensitiveHeaders = options.sensitiveHeaders ?? [];
   let currentUrl = assertPublicHttpUrl(input);
   let currentInit: RequestInit = { ...init, redirect: 'manual' };
@@ -228,6 +260,7 @@ export async function safeOutboundFetch(
       currentUrl,
       currentInit,
       await prepareBody(currentInit),
+      maxResponseBytes,
     );
 
     Object.defineProperty(response, 'url', {

package/dist/cli/index.js

@@ -403,10 +403,10 @@ var SDK_RELEASE = {
   // skill on the sdk sync surface, and the people-search-to-email prebuilt.
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
-  version: "0.1.121",
+  version: "0.1.122",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.121",
+    latest: "0.1.122",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/cli/index.mjs

@@ -380,10 +380,10 @@ var SDK_RELEASE = {
   // skill on the sdk sync surface, and the people-search-to-email prebuilt.
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
-  version: "0.1.121",
+  version: "0.1.122",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.121",
+    latest: "0.1.122",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.js

@@ -274,10 +274,10 @@ var SDK_RELEASE = {
   // skill on the sdk sync surface, and the people-search-to-email prebuilt.
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
-  version: "0.1.121",
+  version: "0.1.122",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.121",
+    latest: "0.1.122",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -196,10 +196,10 @@ var SDK_RELEASE = {
   // skill on the sdk sync surface, and the people-search-to-email prebuilt.
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
-  version: "0.1.121",
+  version: "0.1.122",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.121",
+    latest: "0.1.122",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.121",
+  "version": "0.1.122",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {