deepline 0.1.178 → 0.1.180

package/dist/cli/index.mjs

@@ -608,10 +608,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.178",
+  version: "0.1.180",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.178",
+    latest: "0.1.180",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -772,6 +772,58 @@ var SYNTHETIC_RUN_HEADER = "x-deepline-synthetic-run";
 // src/http.ts
 var MAX_DIAGNOSTIC_HEADER_LENGTH = 120;
 var COWORK_NETWORK_HINT = "Claude Cowork appears to be running Deepline in a network-restricted sandbox. In Claude Desktop, open Settings > Capabilities, turn on Allow network egress, and set Domain allowlist to All domains for the Cowork session.";
+var REQUEST_TIMEOUT_MARKER = /* @__PURE__ */ Symbol("deeplineRequestTimeout");
+var REQUEST_ABORT_MARKER = /* @__PURE__ */ Symbol("deeplineRequestAbort");
+function normalizeRequestAbortError(error, input2) {
+  const normalized = error instanceof Error ? error : new Error(String(error));
+  const tagged = normalized;
+  if (input2.timedOut) {
+    tagged[REQUEST_TIMEOUT_MARKER] = input2.timeoutMs;
+  } else if (isAbortLikeError(normalized)) {
+    tagged[REQUEST_ABORT_MARKER] = true;
+  }
+  return normalized;
+}
+function isAbortLikeError(error) {
+  const name = error.name.toLowerCase();
+  const message = error.message.toLowerCase();
+  return name === "aborterror" || message.includes("operation was aborted") || message === "aborted";
+}
+function mapNetworkError(baseUrl, error, targetLabel) {
+  const tagged = error;
+  const timeoutMs = tagged?.[REQUEST_TIMEOUT_MARKER];
+  if (typeof timeoutMs === "number") {
+    return {
+      message: `Request to ${targetLabel} timed out after ${timeoutMs}ms while waiting for a response.`,
+      code: "NETWORK_TIMEOUT",
+      details: { timeoutMs, target: targetLabel }
+    };
+  }
+  if (tagged?.[REQUEST_ABORT_MARKER]) {
+    return {
+      message: `Request to ${targetLabel} was aborted before it completed.`,
+      code: "NETWORK_ABORTED"
+    };
+  }
+  return {
+    message: error?.message ? `Unable to connect to ${baseUrl}. ${error.message}` : `Unable to connect to ${baseUrl}. Is the computer able to access the url?`,
+    code: "NETWORK_ERROR"
+  };
+}
+function describeRequestTarget(path) {
+  const toolExecuteMatch = path.match(
+    /^\/api\/v2\/integrations\/([^/?#]+)\/execute(?:[/?#]|$)/
+  );
+  if (toolExecuteMatch) {
+    return providerLabelFromToolId(decodeURIComponent(toolExecuteMatch[1]));
+  }
+  return "Deepline";
+}
+function providerLabelFromToolId(toolId) {
+  const normalized = toolId.trim().toLowerCase();
+  const provider = normalized.split(/[_:./-]+/)[0];
+  return provider || normalized || "provider";
+}
 var HttpClient = class {
   constructor(config) {
     this.config = config;
@@ -884,10 +936,12 @@ var HttpClient = class {
       }
       for (const candidateUrl of candidateUrls) {
         const controller = new AbortController();
-        const timeoutId = setTimeout(
-          () => controller.abort(),
-          options?.timeout ?? this.config.timeout
-        );
+        const timeoutMs = options?.timeout ?? this.config.timeout;
+        let requestTimedOut = false;
+        const timeoutId = setTimeout(() => {
+          requestTimedOut = true;
+          controller.abort();
+        }, timeoutMs);
         try {
           const response = await fetch(candidateUrl, {
             method,
@@ -960,7 +1014,10 @@ var HttpClient = class {
             lastError = error;
             break;
           }
-          lastError = error instanceof Error ? error : new Error(String(error));
+          lastError = normalizeRequestAbortError(error, {
+            timeoutMs,
+            timedOut: requestTimedOut
+          });
         }
       }
       if (attempt < maxRetries) continue;
@@ -968,8 +1025,17 @@ var HttpClient = class {
     if (lastError instanceof DeeplineError) {
       throw lastError;
     }
-    const errorMessage4 = lastError?.message ? `Unable to connect to ${baseUrl}. ${lastError.message}` : `Unable to connect to ${baseUrl}. Is the computer able to access the url?`;
-    throw new DeeplineError(withCoworkNetworkHint(errorMessage4));
+    const mappedNetworkError = mapNetworkError(
+      baseUrl,
+      lastError,
+      describeRequestTarget(path)
+    );
+    throw new DeeplineError(
+      withCoworkNetworkHint(mappedNetworkError.message),
+      void 0,
+      mappedNetworkError.code,
+      mappedNetworkError.details
+    );
   }
   /**
    * Send a GET request.
@@ -2240,6 +2306,57 @@ function decodeBase64Bytes(value) {
   }
   return bytes;
 }
+var STAGE_LEGACY_MULTIPART_MAX_BYTES = 4e6;
+var STAGE_DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+function stagedUploadIdentity(logicalPath, contentHash) {
+  return `${contentHash}:${logicalPath}`;
+}
+function isStagedUploadMintUnsupported(error) {
+  return error instanceof DeeplineError && error.statusCode === 404;
+}
+function formatMegabytes(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function uploadStagedFileToPresignedUrl(input2) {
+  const arrayBuffer = input2.body.buffer.slice(
+    input2.body.byteOffset,
+    input2.body.byteOffset + input2.body.byteLength
+  );
+  let lastError;
+  for (let attempt = 1; attempt <= STAGE_DIRECT_UPLOAD_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      const response = await fetch(input2.url, {
+        method: "PUT",
+        headers: input2.headers,
+        body: new Blob([arrayBuffer])
+      });
+      if (response.ok) {
+        return;
+      }
+      const text = await response.text().catch(() => "");
+      lastError = new DeeplineError(
+        `Direct storage upload of ${input2.logicalPath} failed: ${response.status} ${text.slice(0, 200)}`,
+        response.status,
+        "STAGED_FILE_UPLOAD_FAILED",
+        { logicalPath: input2.logicalPath }
+      );
+      if (response.status < 500 && response.status !== 429) {
+        break;
+      }
+    } catch (error) {
+      lastError = error;
+    }
+    if (attempt < STAGE_DIRECT_UPLOAD_MAX_ATTEMPTS) {
+      await sleep2(250 * attempt);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new DeeplineError(
+    `Direct storage upload of ${input2.logicalPath} failed.`,
+    void 0,
+    "STAGED_FILE_UPLOAD_FAILED",
+    { logicalPath: input2.logicalPath }
+  );
+}
 function readStringArray(value) {
   return Array.isArray(value) ? value.filter((line) => typeof line === "string") : [];
 }
@@ -2645,6 +2762,21 @@ var DeeplineClient = class {
       ...input2.maxRows ? { max_rows: input2.maxRows } : {}
     });
   }
+  /**
+   * Re-establish this workspace's tenant storage contract: role/DB connect
+   * grants plus materialized table grants. Org-admin only. Use when a run fails
+   * with WORKSPACE_STORAGE_NOT_READY.
+   */
+  async repairIngestionStorage(input2) {
+    return this.http.post(
+      "/api/v2/ingestion/repair",
+      {
+        ...input2?.provider ? { provider: input2.provider } : {}
+      },
+      void 0,
+      { forbiddenAsApiError: true }
+    );
+  }
   // ——————————————————————————————————————————————————————————
   // Plays — submission and lifecycle
   // ——————————————————————————————————————————————————————————
@@ -3022,6 +3154,94 @@ var DeeplineClient = class {
    * ```
    */
   async stagePlayFiles(files) {
+    let uploads;
+    try {
+      uploads = await this.mintStagedPlayFileUploads(
+        files.map((file) => ({
+          logicalPath: file.logicalPath,
+          contentHash: file.contentHash,
+          contentType: file.contentType,
+          bytes: file.bytes
+        }))
+      );
+    } catch (error) {
+      if (isStagedUploadMintUnsupported(error)) {
+        return this.stagePlayFilesViaMultipart(files);
+      }
+      throw error;
+    }
+    const uploadByIdentity = /* @__PURE__ */ new Map();
+    for (const upload of uploads) {
+      uploadByIdentity.set(
+        stagedUploadIdentity(upload.logicalPath, upload.contentHash),
+        upload
+      );
+    }
+    await Promise.all(
+      files.map(async (file) => {
+        const upload = uploadByIdentity.get(
+          stagedUploadIdentity(file.logicalPath, file.contentHash)
+        );
+        if (!upload) {
+          throw new DeeplineError(
+            `The staging server did not return an upload target for ${file.logicalPath}.`,
+            void 0,
+            "STAGED_FILE_MINT_INCOMPLETE"
+          );
+        }
+        if (upload.alreadyStaged || !upload.uploadUrl) {
+          return;
+        }
+        await uploadStagedFileToPresignedUrl({
+          url: upload.uploadUrl,
+          headers: upload.uploadHeaders ?? {
+            "content-type": file.contentType
+          },
+          body: decodeBase64Bytes(file.contentBase64),
+          logicalPath: file.logicalPath
+        });
+      })
+    );
+    return files.map((file) => {
+      const upload = uploadByIdentity.get(
+        stagedUploadIdentity(file.logicalPath, file.contentHash)
+      );
+      if (!upload) {
+        throw new DeeplineError(
+          `The staging server did not return an upload target for ${file.logicalPath}.`,
+          void 0,
+          "STAGED_FILE_MINT_INCOMPLETE"
+        );
+      }
+      return upload.ref;
+    });
+  }
+  /**
+   * Mint short-lived presigned upload targets for staged play files.
+   *
+   * Internal primitive used by {@link stagePlayFiles}. The server returns an
+   * already-staged ref (no upload needed) for content-addressed files it
+   * already holds, or a presigned PUT URL the caller uploads the body to.
+   */
+  async mintStagedPlayFileUploads(files) {
+    const response = await this.http.post("/api/v2/plays/files/stage/mint", { files });
+    return response.uploads ?? [];
+  }
+  async stagePlayFilesViaMultipart(files) {
+    for (const file of files) {
+      if (file.bytes > STAGE_LEGACY_MULTIPART_MAX_BYTES) {
+        throw new DeeplineError(
+          `Cannot stage ${file.logicalPath} (${formatMegabytes(file.bytes)}): the connected Deepline server does not support direct-to-storage uploads, and this file exceeds the ~4.5MB request-body limit the legacy upload path is subject to. Update the Deepline server (or target code.deepline.com) to stage files this large.`,
+          413,
+          "STAGED_FILE_TOO_LARGE_FOR_LEGACY_UPLOAD",
+          {
+            logicalPath: file.logicalPath,
+            bytes: file.bytes,
+            maxBytes: STAGE_LEGACY_MULTIPART_MAX_BYTES
+          }
+        );
+      }
+    }
     const buildFormData = () => {
       const formData = new FormData();
       formData.set(
@@ -7673,6 +7893,53 @@ async function handleDbQuery(args) {
   );
   return 0;
 }
+async function handleDbRepair(args) {
+  const providerIndex = args.indexOf("--provider");
+  const provider = providerIndex >= 0 ? args[providerIndex + 1]?.trim() : void 0;
+  const jsonOutput = argsWantJson(args);
+  const client2 = new DeeplineClient();
+  let result;
+  try {
+    result = await client2.repairIngestionStorage(
+      provider ? { provider } : void 0
+    );
+  } catch (error) {
+    if (error instanceof DeeplineError && error.statusCode === 403) {
+      console.error(
+        "deepline db repair requires org admin. Ask an organization admin to run it."
+      );
+      return 1;
+    }
+    console.error(errorMessage(error));
+    return 1;
+  }
+  printCommandEnvelope(
+    {
+      command: "db repair",
+      repaired: result.repaired,
+      count: result.count,
+      connection_grants: result.connection_grants,
+      render: {
+        sections: [
+          {
+            title: "storage contract repair",
+            lines: [
+              `Repaired ${result.count} table(s).`,
+              `Runtime role: ${result.connection_grants.runtime_role}`,
+              `Customer DB role: ${result.connection_grants.customer_db_role}`
+            ]
+          }
+        ]
+      }
+    },
+    {
+      json: jsonOutput,
+      text: `Repaired ${result.count} table(s). Storage grants re-established.
+`
+    }
+  );
+  return 0;
+}
 function registerDbCommands(program) {
   const db = program.command("db").description("Query the tenant customer database.").addHelpText(
     "after",
@@ -7728,6 +7995,26 @@ Examples:
       ...options.json ? ["--json"] : []
     ]);
   });
+  db.command("repair").description(
+    "Repair this workspace storage contract (role/DB grants). Org admin only."
+  ).addHelpText(
+    "after",
+    `
+Notes:
+  Re-establishes tenant runtime and customer-db role grants plus materialized
+  table grants for the active workspace. Run this after a play run fails with
+  WORKSPACE_STORAGE_NOT_READY, then re-run the play. Requires org admin.
+
+Examples:
+  deepline db repair
+  deepline db repair --json
+`
+  ).option("--provider <provider>", "Limit materialized-table repair to one provider").option("--json", "Emit raw JSON response. Also automatic when stdout is piped").action(async (options) => {
+    process.exitCode = await handleDbRepair([
+      ...options.provider ? ["--provider", options.provider] : [],
+      ...options.json ? ["--json"] : []
+    ]);
+  });
 }
 
 // src/cli/commands/enrich.ts
@@ -12558,6 +12845,26 @@ function resolveDatasetByName(available, datasetPath) {
   }
   return null;
 }
+function assertDatasetHasExportableRows(input2) {
+  if (input2.rowsInfo.rows.length > 0) {
+    return input2.rowsInfo;
+  }
+  const datasetLabel = input2.datasetPath ?? input2.rowsInfo.tableNamespace ?? input2.rowsInfo.source ?? "result.rows";
+  const available = input2.availableRows.map((info) => info.tableNamespace ?? info.source).filter((name) => typeof name === "string");
+  const runStatus = String(input2.status.status ?? "").toLowerCase();
+  const failedBeforePersisting = runStatus !== "completed";
+  throw new DeeplineError(
+    `Run ${input2.status.runId} has zero rows to export from dataset '${datasetLabel}'.` + (failedBeforePersisting ? ` The run status is '${runStatus || "unknown"}', so it likely failed before persisting rows to this dataset \u2014 provider calls may have been billed without a durable row. Fix the run's failure cause and re-run to resume.` : " The run completed but this dataset materialized no rows.") + (available.length > 0 ? ` Available datasets: ${available.join(", ")}.` : " No datasets were materialized for this run."),
+    void 0,
+    "RUN_EXPORT_EMPTY",
+    {
+      runId: input2.status.runId,
+      dataset: datasetLabel,
+      available,
+      runStatus: runStatus || null
+    }
+  );
+}
 async function exportPlayStatusRows(client2, status, outPath, options = {}) {
   if (!outPath) {
     return null;
@@ -12603,13 +12910,25 @@ async function exportPlayStatusRows(client2, status, outPath, options = {}) {
       }
     }
     if (fetchedRowsInfo?.complete) {
+      const guarded2 = assertDatasetHasExportableRows({
+        rowsInfo: fetchedRowsInfo,
+        status,
+        availableRows,
+        datasetPath: options.datasetPath
+      });
       return {
-        path: writeCanonicalRowsCsv(fetchedRowsInfo, outPath),
-        rowsInfo: fetchedRowsInfo
+        path: writeCanonicalRowsCsv(guarded2, outPath),
+        rowsInfo: guarded2
       };
     }
     if (rowsInfo.complete) {
-      return { path: writeCanonicalRowsCsv(rowsInfo, outPath), rowsInfo };
+      const guarded2 = assertDatasetHasExportableRows({
+        rowsInfo,
+        status,
+        availableRows,
+        datasetPath: options.datasetPath
+      });
+      return { path: writeCanonicalRowsCsv(guarded2, outPath), rowsInfo: guarded2 };
     }
     if (attempt < attempts && retryDelayMs > 0) {
       await sleep5(retryDelayMs);
@@ -12635,7 +12954,13 @@ async function exportPlayStatusRows(client2, status, outPath, options = {}) {
       }
     );
   }
-  return { path: writeCanonicalRowsCsv(rowsInfo, outPath), rowsInfo };
+  const guarded = assertDatasetHasExportableRows({
+    rowsInfo,
+    status,
+    availableRows,
+    datasetPath: options.datasetPath
+  });
+  return { path: writeCanonicalRowsCsv(guarded, outPath), rowsInfo: guarded };
 }
 function extractActiveRunsFromError(error) {
   if (!(error instanceof DeeplineError)) {

package/dist/index.d.mts

@@ -1381,6 +1381,21 @@ type BillingNamespace = {
         }) => Promise<BillingInvoicesResult>;
     };
 };
+/**
+ * A staged-file upload target minted by POST /api/v2/plays/files/stage/mint.
+ * When `alreadyStaged` is true the server already holds the content-addressed
+ * object and `uploadUrl` is null; otherwise the client PUTs the body to
+ * `uploadUrl` with `uploadHeaders`.
+ */
+type MintStagedFileUpload = {
+    logicalPath: string;
+    contentHash: string;
+    ref: PlayStagedFileRef;
+    alreadyStaged: boolean;
+    uploadUrl: string | null;
+    uploadHeaders: Record<string, string> | null;
+    uploadExpiresAt: string | null;
+};
 /**
  * Low-level client for the Deepline REST API.
  *
@@ -1524,6 +1539,21 @@ declare class DeeplineClient {
         sql: string;
         maxRows?: number;
     }): Promise<CustomerDbQueryResult>;
+    /**
+     * Re-establish this workspace's tenant storage contract: role/DB connect
+     * grants plus materialized table grants. Org-admin only. Use when a run fails
+     * with WORKSPACE_STORAGE_NOT_READY.
+     */
+    repairIngestionStorage(input?: {
+        provider?: string;
+    }): Promise<{
+        connection_grants: {
+            runtime_role: string;
+            customer_db_role: string;
+        };
+        repaired: unknown[];
+        count: number;
+    }>;
     /**
      * Start a play run.
      *
@@ -1763,6 +1793,20 @@ declare class DeeplineClient {
         contentType: string;
         bytes: number;
     }>): Promise<PlayStagedFileRef[]>;
+    /**
+     * Mint short-lived presigned upload targets for staged play files.
+     *
+     * Internal primitive used by {@link stagePlayFiles}. The server returns an
+     * already-staged ref (no upload needed) for content-addressed files it
+     * already holds, or a presigned PUT URL the caller uploads the body to.
+     */
+    mintStagedPlayFileUploads(files: Array<{
+        logicalPath: string;
+        contentHash: string;
+        contentType: string;
+        bytes: number;
+    }>): Promise<MintStagedFileUpload[]>;
+    private stagePlayFilesViaMultipart;
     /**
      * Resolve staged play files by content hash without uploading bytes.
      *

package/dist/index.d.ts

@@ -1381,6 +1381,21 @@ type BillingNamespace = {
         }) => Promise<BillingInvoicesResult>;
     };
 };
+/**
+ * A staged-file upload target minted by POST /api/v2/plays/files/stage/mint.
+ * When `alreadyStaged` is true the server already holds the content-addressed
+ * object and `uploadUrl` is null; otherwise the client PUTs the body to
+ * `uploadUrl` with `uploadHeaders`.
+ */
+type MintStagedFileUpload = {
+    logicalPath: string;
+    contentHash: string;
+    ref: PlayStagedFileRef;
+    alreadyStaged: boolean;
+    uploadUrl: string | null;
+    uploadHeaders: Record<string, string> | null;
+    uploadExpiresAt: string | null;
+};
 /**
  * Low-level client for the Deepline REST API.
  *
@@ -1524,6 +1539,21 @@ declare class DeeplineClient {
         sql: string;
         maxRows?: number;
     }): Promise<CustomerDbQueryResult>;
+    /**
+     * Re-establish this workspace's tenant storage contract: role/DB connect
+     * grants plus materialized table grants. Org-admin only. Use when a run fails
+     * with WORKSPACE_STORAGE_NOT_READY.
+     */
+    repairIngestionStorage(input?: {
+        provider?: string;
+    }): Promise<{
+        connection_grants: {
+            runtime_role: string;
+            customer_db_role: string;
+        };
+        repaired: unknown[];
+        count: number;
+    }>;
     /**
      * Start a play run.
      *
@@ -1763,6 +1793,20 @@ declare class DeeplineClient {
         contentType: string;
         bytes: number;
     }>): Promise<PlayStagedFileRef[]>;
+    /**
+     * Mint short-lived presigned upload targets for staged play files.
+     *
+     * Internal primitive used by {@link stagePlayFiles}. The server returns an
+     * already-staged ref (no upload needed) for content-addressed files it
+     * already holds, or a presigned PUT URL the caller uploads the body to.
+     */
+    mintStagedPlayFileUploads(files: Array<{
+        logicalPath: string;
+        contentHash: string;
+        contentType: string;
+        bytes: number;
+    }>): Promise<MintStagedFileUpload[]>;
+    private stagePlayFilesViaMultipart;
     /**
      * Resolve staged play files by content hash without uploading bytes.
      *