deepline 0.1.298 → 0.1.300

package/dist/bundling-sources/sdk/src/client.ts

@@ -93,6 +93,7 @@ import {
   normalizePlayRuntimeSelection,
   type PlayRuntimeSelection,
 } from '../../shared_libs/play-runtime/runtime-environment.js';
+import { decodePlayRunPublicStatus } from '../../shared_libs/play-runtime/run-lifecycle-policy.js';
 
 const TERMINAL_PLAY_STATUSES = new Set(['completed', 'failed', 'cancelled']);
 const INCLUDE_TOOL_METADATA_HEADER = 'x-deepline-include-tool-metadata';
@@ -991,12 +992,18 @@ function normalizePlayStatus(raw: Record<string, unknown>): PlayStatus {
       ? raw.package
       : null;
   const packageRun = runPackage?.run;
-  const status =
+  const rawStatus =
     typeof raw.status === 'string'
       ? raw.status
       : typeof packageRun?.status === 'string'
         ? packageRun.status
-        : 'running';
+        : null;
+  const status = decodePlayRunPublicStatus(rawStatus);
+  if (!status) {
+    throw new Error(
+      `Invalid play run lifecycle status in API response: ${JSON.stringify(rawStatus)}.`,
+    );
+  }
   const runId =
     typeof raw.runId === 'string'
       ? raw.runId
@@ -1007,7 +1014,7 @@ function normalizePlayStatus(raw: Record<string, unknown>): PlayStatus {
     ...(raw as unknown as Omit<PlayStatus, 'runId' | 'status'>),
     runId,
     ...(runPackage ? { package: runPackage, outputs: runPackage.outputs } : {}),
-    status: status as PlayStatus['status'],
+    status,
   };
 }
 

package/dist/bundling-sources/sdk/src/http.ts

@@ -54,8 +54,8 @@ interface RequestOptions {
    * Treat HTTP 403 as a regular API error instead of a generic {@link AuthError}.
    * Use for endpoints that return 403 with a meaningful server error message
    * (e.g. feature-flagged-off billing subscription checkout) so the server
-   * message is preserved and surfaced loudly. HTTP 401 still maps to
-   * {@link AuthError}.
+   * message is preserved and surfaced loudly. A provider-originated HTTP 401
+   * remains a regular API error when its response envelope says so.
    */
   forbiddenAsApiError?: boolean;
   /**
@@ -311,7 +311,7 @@ export class HttpClient {
    * @param path - API path (e.g. `"/api/v2/tools"`)
    * @param options - HTTP method, body, headers, and timeout
    * @returns Parsed JSON response body
-   * @throws {@link AuthError} on HTTP 401/403 (immediate, no retry)
+   * @throws {@link AuthError} on Deepline-auth HTTP 401/403 (immediate, no retry)
    * @throws {@link RateLimitError} on HTTP 429 after all retries exhausted
    * @throws {@link DeeplineError} on other API errors or connection failures
    */
@@ -374,13 +374,6 @@ export class HttpClient {
 
           clearTimeout(timeoutId);
 
-          if (
-            response.status === 401 ||
-            (response.status === 403 && !options?.forbiddenAsApiError)
-          ) {
-            throw new AuthError();
-          }
-
           if (response.status === 429) {
             const retryAfter = parseRetryAfter(response);
             lastError = new RateLimitError(retryAfter);
@@ -392,11 +385,14 @@ export class HttpClient {
           }
 
           const body = await response.text();
-          let parsed: unknown;
-          try {
-            parsed = JSON.parse(body);
-          } catch {
-            parsed = body;
+          const parsed = parseResponseBody(body);
+
+          if (
+            (response.status === 401 &&
+              !isProviderOriginatedHttpError(parsed)) ||
+            (response.status === 403 && !options?.forbiddenAsApiError)
+          ) {
+            throw new AuthError();
           }
 
           if (!response.ok) {
@@ -451,16 +447,7 @@ export class HttpClient {
                         'string'
                     ? (parsed as Record<string, string>).message
                     : `HTTP ${response.status}`;
-            const apiErrorCode =
-              errorValue &&
-              typeof errorValue === 'object' &&
-              typeof (errorValue as Record<string, unknown>).code === 'string'
-                ? (errorValue as Record<string, string>).code
-                : typeof parsed === 'object' &&
-                    parsed &&
-                    typeof (parsed as Record<string, unknown>).code === 'string'
-                  ? (parsed as Record<string, string>).code
-                  : 'API_ERROR';
+            const apiErrorCode = apiErrorCodeFromResponse(parsed);
             lastError = new DeeplineError(msg, response.status, apiErrorCode, {
               response: parsed,
             });
@@ -547,11 +534,16 @@ export class HttpClient {
           signal: options?.signal,
         });
 
-        if (response.status === 401 || response.status === 403) {
-          throw new AuthError();
-        }
         if (!response.ok) {
           const body = await response.text();
+          const parsed = parseResponseBody(body);
+          if (
+            (response.status === 401 &&
+              !isProviderOriginatedHttpError(parsed)) ||
+            response.status === 403
+          ) {
+            throw new AuthError();
+          }
           const htmlError = detectHtmlErrorBody(
             body,
             response.headers.get('content-type'),
@@ -570,11 +562,10 @@ export class HttpClient {
               },
             );
           }
-          const parsed = parseResponseBody(body);
           throw new DeeplineError(
             apiErrorMessage(parsed, response.status),
             response.status,
-            'API_ERROR',
+            apiErrorCodeFromResponse(parsed),
             { response: parsed },
           );
         }
@@ -679,6 +670,33 @@ function parseResponseBody(body: string): unknown {
   }
 }
 
+/**
+ * A provider can reject its own credential with HTTP 401 while the caller's
+ * Deepline API key remains valid. The API envelope is authoritative in that
+ * case, so preserve it as a regular DeeplineError rather than prompting the
+ * caller to replace DEEPLINE_API_KEY.
+ */
+function isProviderOriginatedHttpError(parsed: unknown): boolean {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const failureOrigin = error?.failure_origin ?? response?.failure_origin;
+  const code = error?.code ?? response?.code;
+  return failureOrigin === 'provider' || code === 'UPSTREAM_BLOCKED';
+}
+
+function apiErrorCodeFromResponse(parsed: unknown): string {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const code = error?.code ?? response?.code;
+  return typeof code === 'string' ? code : 'API_ERROR';
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
 function isRetryableApiErrorResponse(status: number): boolean {
   return status === 408 || status === 425 || (status >= 500 && status < 600);
 }

package/dist/bundling-sources/sdk/src/release.ts

@@ -155,7 +155,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.298',
+  version: '0.1.300',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/run-ledger.ts

@@ -3,7 +3,6 @@ import {
   PLATFORM_DEPLOY_INTERRUPTED_MESSAGE,
 } from './run-failure';
 import {
-  isAuthoritativePlayRunTerminalSource,
   nextPlayRunLedgerTerminalSource,
   normalizePlayRunLedgerTerminalSource,
 } from './run-terminal-source';
@@ -643,16 +642,6 @@ function nextTerminalSource(
   });
 }
 
-function shouldUpgradeFromCoordinatorTerminal(
-  base: PlayRunLedgerSnapshot,
-  eventSource: PlayRunLedgerEventSource,
-): boolean {
-  return (
-    base.terminalSource === 'coordinator' &&
-    isAuthoritativePlayRunTerminalSource(eventSource)
-  );
-}
-
 function shouldIgnoreNonTerminalAfterStickyTerminal(
   base: PlayRunLedgerSnapshot,
 ): boolean {
@@ -908,13 +897,10 @@ function appendLogLines(
 }
 
 /**
- * Terminal-status precedence. Conflicting terminal events use
- * newest-terminal-wins by event time: older events are ignored and logged,
- * newer events reconcile the snapshot. Same-status terminal events continue to
- * the reducer so recovery/transport paths can fill in canonical payloads after
- * an earlier partial terminal snapshot. Retryable platform-deploy failures are
- * the narrow exception: they are never allowed to replace a real terminal
- * result from the runtime.
+ * Terminal-status precedence. The first accepted run terminal is immutable:
+ * later events may enrich the same terminal payload, but may never change its
+ * outcome. Attempt retries are not authority to rewrite a terminal run, and
+ * producer timestamps are telemetry rather than an ordering mechanism.
  */
 function conflictingTerminalSnapshot(
   base: PlayRunLedgerSnapshot,
@@ -923,26 +909,12 @@ function conflictingTerminalSnapshot(
   eventError?: string | null,
   options?: {
     allowStaleSameStatusPayloadMerge?: boolean;
-    allowCoordinatorTerminalUpgrade?: boolean;
   },
 ): PlayRunLedgerSnapshot | null {
   if (!isTerminalPlayRunLedgerStatus(base.status)) {
     return null;
   }
   const terminalAt = base.finishedAt ?? base.updatedAt ?? 0;
-  if (base.status === 'cancelled' && eventType !== 'run.cancelled') {
-    if (occurredAt <= terminalAt) {
-      return withTiming(
-        appendLogLines(base, [
-          `[ledger] stale conflicting terminal event ${eventType} ignored; status already ${base.status}`,
-        ]),
-      );
-    }
-    return withTiming(base);
-  }
-  if (options?.allowCoordinatorTerminalUpgrade === true) {
-    return null;
-  }
   if (
     base.status === 'completed' &&
     eventType === 'run.failed' &&
@@ -970,12 +942,6 @@ function conflictingTerminalSnapshot(
     }
     return null;
   }
-  if (occurredAt > terminalAt) {
-    // Newer terminal evidence reconciles the run. This covers replay/receipt
-    // races where an earlier attempt failed but a later attempt recovered and
-    // completed with the durable result.
-    return null;
-  }
   return withTiming(
     appendLogLines(base, [
       `[ledger] stale conflicting terminal event ${eventType} ignored; status already ${base.status}`,
@@ -1205,12 +1171,7 @@ export function reducePlayRunLedgerEvent(
     case 'run.completed':
       return (
         conflictingTerminalSnapshot(base, event.type, occurredAt, null, {
-          allowCoordinatorTerminalUpgrade: shouldUpgradeFromCoordinatorTerminal(
-            base,
-            event.source,
-          ),
           allowStaleSameStatusPayloadMerge:
-            shouldUpgradeFromCoordinatorTerminal(base, event.source) ||
             (base.result === undefined && event.result !== undefined) ||
             (base.resultSummary === undefined &&
               event.resultSummary !== undefined),
@@ -1234,7 +1195,6 @@ export function reducePlayRunLedgerEvent(
         retryablePlatformDeployFailureSnapshot(base, event.error) ??
         conflictingTerminalSnapshot(base, event.type, occurredAt, event.error, {
           allowStaleSameStatusPayloadMerge:
-            shouldUpgradeFromCoordinatorTerminal(base, event.source) ||
             (base.error == null && event.error != null) ||
             (base.result === undefined && event.result !== undefined),
         }) ??
@@ -1258,7 +1218,6 @@ export function reducePlayRunLedgerEvent(
       return (
         conflictingTerminalSnapshot(base, event.type, occurredAt, event.error, {
           allowStaleSameStatusPayloadMerge:
-            shouldUpgradeFromCoordinatorTerminal(base, event.source) ||
             (base.error == null && event.error != null) ||
             (base.result === undefined && event.result !== undefined),
         }) ??

package/dist/bundling-sources/shared_libs/play-runtime/run-lifecycle-policy.ts

@@ -9,6 +9,15 @@ export type PlayRunLifecycleStatus =
   | 'timed_out'
   | 'unknown';
 
+/** The only lifecycle states exposed by the API, SDK, CLI, and UI. */
+export type PlayRunPublicStatus =
+  | 'queued'
+  | 'running'
+  | 'waiting'
+  | 'completed'
+  | 'failed'
+  | 'cancelled';
+
 const TERMINAL_PLAY_RUN_STATUSES = new Set<PlayRunLifecycleStatus>([
   'completed',
   'failed',
@@ -33,7 +42,7 @@ export function normalizePlayRunLifecycleStatus(
   switch (normalized) {
     case 'queued':
     case 'pending':
-      return 'running';
+      return 'queued';
     case 'running':
     case 'started':
       return 'running';
@@ -60,12 +69,43 @@ export function normalizePlayRunLifecycleStatus(
 }
 
 export function isTerminalPlayRunLifecycleStatus(status: unknown): boolean {
-  return TERMINAL_PLAY_RUN_STATUSES.has(normalizePlayRunLifecycleStatus(status));
+  return TERMINAL_PLAY_RUN_STATUSES.has(
+    normalizePlayRunLifecycleStatus(status),
+  );
 }
 
 export function isActivePlayRunLifecycleStatus(status: unknown): boolean {
   const normalized = normalizePlayRunLifecycleStatus(status);
-  return normalized === 'running' || normalized === 'waiting';
+  return (
+    normalized === 'queued' ||
+    normalized === 'running' ||
+    normalized === 'waiting'
+  );
+}
+
+/**
+ * Decode a public lifecycle value without inventing progress. Internal
+ * termination reasons intentionally collapse to the one public cancellation
+ * outcome at this Adapter boundary. Unknown/missing values are invalid.
+ */
+export function decodePlayRunPublicStatus(
+  value: unknown,
+): PlayRunPublicStatus | null {
+  const status = normalizePlayRunLifecycleStatus(value);
+  switch (status) {
+    case 'queued':
+    case 'running':
+    case 'waiting':
+    case 'completed':
+    case 'failed':
+    case 'cancelled':
+      return status;
+    case 'terminated':
+    case 'timed_out':
+      return 'cancelled';
+    case 'unknown':
+      return null;
+  }
 }
 
 export function isRecoverableDatasetRowStatus(status: unknown): boolean {

package/dist/cli/index.js

@@ -718,7 +718,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.298",
+  version: "0.1.300",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1063,7 +1063,7 @@ var HttpClient = class {
    * @param path - API path (e.g. `"/api/v2/tools"`)
    * @param options - HTTP method, body, headers, and timeout
    * @returns Parsed JSON response body
-   * @throws {@link AuthError} on HTTP 401/403 (immediate, no retry)
+   * @throws {@link AuthError} on Deepline-auth HTTP 401/403 (immediate, no retry)
    * @throws {@link RateLimitError} on HTTP 429 after all retries exhausted
    * @throws {@link DeeplineError} on other API errors or connection failures
    */
@@ -1102,9 +1102,6 @@ var HttpClient = class {
             signal: controller.signal
           });
           clearTimeout(timeoutId);
-          if (response.status === 401 || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
-          }
           if (response.status === 429) {
             const retryAfter = parseRetryAfter(response);
             lastError = new RateLimitError(retryAfter);
@@ -1115,11 +1112,9 @@ var HttpClient = class {
             throw lastError;
           }
           const body = await response.text();
-          let parsed;
-          try {
-            parsed = JSON.parse(body);
-          } catch {
-            parsed = body;
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
+            throw new AuthError();
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1146,7 +1141,7 @@ var HttpClient = class {
             }
             const errorValue = typeof parsed === "object" && parsed && "error" in parsed ? parsed.error : void 0;
             const msg = typeof errorValue === "string" ? errorValue : errorValue && typeof errorValue === "object" && "message" in errorValue && typeof errorValue.message === "string" ? errorValue.message : typeof parsed === "object" && parsed && "message" in parsed && typeof parsed.message === "string" ? parsed.message : `HTTP ${response.status}`;
-            const apiErrorCode2 = errorValue && typeof errorValue === "object" && typeof errorValue.code === "string" ? errorValue.code : typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : "API_ERROR";
+            const apiErrorCode2 = apiErrorCodeFromResponse(parsed);
             lastError = new DeeplineError(msg, response.status, apiErrorCode2, {
               response: parsed
             });
@@ -1220,11 +1215,12 @@ var HttpClient = class {
           body: options?.body !== void 0 ? JSON.stringify(options.body) : void 0,
           signal: options?.signal
         });
-        if (response.status === 401 || response.status === 403) {
-          throw new AuthError();
-        }
         if (!response.ok) {
           const body = await response.text();
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
+            throw new AuthError();
+          }
           const htmlError = detectHtmlErrorBody(
             body,
             response.headers.get("content-type")
@@ -1241,11 +1237,10 @@ var HttpClient = class {
               }
             );
           }
-          const parsed = parseResponseBody(body);
           throw new DeeplineError(
             apiErrorMessage(parsed, response.status),
             response.status,
-            "API_ERROR",
+            apiErrorCodeFromResponse(parsed),
             { response: parsed }
           );
         }
@@ -1320,6 +1315,22 @@ function parseResponseBody(body) {
     return body;
   }
 }
+function isProviderOriginatedHttpError(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const failureOrigin = error?.failure_origin ?? response?.failure_origin;
+  const code = error?.code ?? response?.code;
+  return failureOrigin === "provider" || code === "UPSTREAM_BLOCKED";
+}
+function apiErrorCodeFromResponse(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const code = error?.code ?? response?.code;
+  return typeof code === "string" ? code : "API_ERROR";
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
 function isRetryableApiErrorResponse(status) {
   return status === 408 || status === 425 || status >= 500 && status < 600;
 }
@@ -2113,7 +2124,7 @@ function normalizePlayRunLifecycleStatus(value) {
   switch (normalized) {
     case "queued":
     case "pending":
-      return "running";
+      return "queued";
     case "running":
     case "started":
       return "running";
@@ -2139,7 +2150,26 @@ function normalizePlayRunLifecycleStatus(value) {
   }
 }
 function isTerminalPlayRunLifecycleStatus(status) {
-  return TERMINAL_PLAY_RUN_STATUSES.has(normalizePlayRunLifecycleStatus(status));
+  return TERMINAL_PLAY_RUN_STATUSES.has(
+    normalizePlayRunLifecycleStatus(status)
+  );
+}
+function decodePlayRunPublicStatus(value) {
+  const status = normalizePlayRunLifecycleStatus(value);
+  switch (status) {
+    case "queued":
+    case "running":
+    case "waiting":
+    case "completed":
+    case "failed":
+    case "cancelled":
+      return status;
+    case "terminated":
+    case "timed_out":
+      return "cancelled";
+    case "unknown":
+      return null;
+  }
 }
 
 // ../shared_libs/play-runtime/run-snapshot-stream.ts
@@ -3080,7 +3110,13 @@ function isPlayRunPackage(value) {
 function normalizePlayStatus(raw) {
   const runPackage = isPlayRunPackage(raw) ? raw : isPlayRunPackage(raw.package) ? raw.package : null;
   const packageRun = runPackage?.run;
-  const status = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : "running";
+  const rawStatus = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : null;
+  const status = decodePlayRunPublicStatus(rawStatus);
+  if (!status) {
+    throw new Error(
+      `Invalid play run lifecycle status in API response: ${JSON.stringify(rawStatus)}.`
+    );
+  }
   const runId = typeof raw.runId === "string" ? raw.runId : typeof raw.workflowId === "string" ? raw.workflowId : packageRun?.id ?? "";
   return {
     ...raw,
@@ -24940,7 +24976,7 @@ function monitorsErrorExitCode(error) {
 }
 function monitorsFailureNextCommand(error, exitCode) {
   if (error instanceof DeeplineError) {
-    const response = asRecord(asRecord(error.details)?.response);
+    const response = asRecord2(asRecord2(error.details)?.response);
     const serverNextAction = asString(response?.next_action);
     if (serverNextAction) return serverNextAction;
   }
@@ -24956,10 +24992,10 @@ function monitorsFailureNextCommand(error, exitCode) {
 }
 function readValidationIssues(error) {
   if (!(error instanceof DeeplineError)) return [];
-  const response = asRecord(asRecord(error.details)?.response);
+  const response = asRecord2(asRecord2(error.details)?.response);
   const issues = Array.isArray(response?.issues) ? response.issues : [];
   return issues.flatMap((raw) => {
-    const issue = asRecord(raw);
+    const issue = asRecord2(raw);
     if (!issue) return [];
     return [
       {
@@ -25052,7 +25088,7 @@ or from a file / stdin:
   cat monitor.json | ${input2.command} --file -`
   );
 }
-function asRecord(value) {
+function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -25062,7 +25098,7 @@ function asFiniteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function monitorPricingLine(rawPricing) {
-  const pricing = asRecord(rawPricing);
+  const pricing = asRecord2(rawPricing);
   if (!pricing) return void 0;
   const display = asString(pricing.display);
   if (display) return display;
@@ -25077,16 +25113,16 @@ function yesNo(value) {
   return "unknown";
 }
 function readDeployOutputContract(payload) {
-  const contract = asRecord(payload.output_contract);
+  const contract = asRecord2(payload.output_contract);
   if (!contract) return { streams: [] };
   const rawOutputs = Array.isArray(contract.outputs) ? contract.outputs : [];
   const streams = rawOutputs.flatMap((raw) => {
-    const output2 = asRecord(raw);
+    const output2 = asRecord2(raw);
     const stream = output2 ? asString(output2.stream) : void 0;
     const table = output2 ? asString(output2.table) : void 0;
     if (!output2 || !stream || !table) return [];
     const columns = Array.isArray(output2.columns) ? output2.columns.flatMap((rawColumn) => {
-      const column = asRecord(rawColumn);
+      const column = asRecord2(rawColumn);
       const name = column ? asString(column.name) : void 0;
       return name ? [name] : [];
     }) : [];
@@ -25103,7 +25139,7 @@ function readDeployOutputContract(payload) {
   return { tool: asString(contract.tool), streams };
 }
 function renderMonitorDeployCompletion(payload) {
-  const monitor = asRecord(payload.monitor);
+  const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
   const { tool, streams } = readDeployOutputContract(payload);
   if (!key || streams.length === 0) return void 0;
@@ -25154,13 +25190,13 @@ function renderMonitorDeployPlan(payload) {
   if (!valid) {
     const issues = Array.isArray(payload.issues) ? payload.issues : [];
     for (const raw of issues) {
-      const issue = asRecord(raw);
+      const issue = asRecord2(raw);
       const path = issue ? asString(issue.path) : void 0;
       const message = issue ? asString(issue.message) : void 0;
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
-  const estimate = asRecord(payload.deploy_cost_estimate);
+  const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
     const note = estimate ? asString(estimate.note) : void 0;
@@ -25178,7 +25214,7 @@ function renderMonitorDeployPlan(payload) {
   }
   const candidates = Array.isArray(payload.reuse_candidates) ? payload.reuse_candidates : [];
   const candidateLines = candidates.flatMap((raw) => {
-    const candidate = asRecord(raw);
+    const candidate = asRecord2(raw);
     const key = candidate ? asString(candidate.key) : void 0;
     if (!candidate || !key) return [];
     const name = asString(candidate.name);
@@ -25204,7 +25240,7 @@ function renderMonitorDeployPlan(payload) {
 `;
 }
 function renderMonitorDeletePlan(payload, fallbackKey) {
-  const plan = asRecord(payload.plan);
+  const plan = asRecord2(payload.plan);
   const key = (plan ? asString(plan.monitor_key) : void 0) ?? fallbackKey;
   const lines = [
     "DRY RUN \u2014 nothing was deleted.",
@@ -25218,7 +25254,7 @@ function renderMonitorDeletePlan(payload, fallbackKey) {
 `;
 }
 function renderMonitorReactivatePlan(payload, key) {
-  const estimate = asRecord(payload.cost_estimate);
+  const estimate = asRecord2(payload.cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   const lines = [
     "DRY RUN \u2014 nothing was reactivated.",
@@ -25270,7 +25306,7 @@ function renderAvailableToolsText(payload) {
   ];
   let currentProvider;
   for (const raw of tools) {
-    const entry = asRecord(raw);
+    const entry = asRecord2(raw);
     const id = entry ? asString(entry.tool) : void 0;
     if (!entry || !id) continue;
     const name = asString(entry.name) ?? asString(entry.display_name);
@@ -25340,7 +25376,7 @@ function renderDeployedListText(payload, requestedStatus) {
   const header = monitors.length === 0 ? "No deployed monitors matched." : total !== void 0 && total > monitors.length ? `Deployed monitors (${monitors.length} of ${total}):` : `Deployed monitors (${monitors.length}):`;
   const lines = [header];
   for (const raw of monitors) {
-    const entry = asRecord(raw);
+    const entry = asRecord2(raw);
     const key = entry ? asString(entry.key) ?? asString(entry.monitor_key) : void 0;
     if (!entry || !key) continue;
     const status = asString(entry.status);
@@ -25425,11 +25461,11 @@ function renderMonitorGet(payload) {
   const tool = asString(payload.tool);
   if (!key || !tool) return void 0;
   const status = asString(payload.status);
-  const definition = asRecord(payload.definition);
+  const definition = asRecord2(payload.definition);
   const pricingLine = monitorPricingLine(payload.pricing);
-  const billing = asRecord(payload.billing);
+  const billing = asRecord2(payload.billing);
   const nextRenewalAt = billing ? asString(billing.next_renewal_at) : void 0;
-  const dependents = asRecord(payload.dependents);
+  const dependents = asRecord2(payload.dependents);
   const plays = dependents && Array.isArray(dependents.plays) ? dependents.plays : [];
   const lines = [
     `Monitor: ${key}`,
@@ -25446,7 +25482,7 @@ function renderMonitorGet(payload) {
     lines.push("  none");
   } else {
     for (const raw of plays) {
-      const play = asRecord(raw);
+      const play = asRecord2(raw);
       const name = play ? asString(play.name) : void 0;
       if (!play || !name) continue;
       const listener = asString(play.listener_key);
@@ -31191,7 +31227,7 @@ function parseCapturedJson(stdout) {
     return null;
   }
 }
-function asRecord2(value) {
+function asRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function safeRead(path) {
@@ -31893,8 +31929,8 @@ async function runSetupCommand(options) {
     status: "complete",
     phases
   });
-  const doctorChecks = asRecord2(doctorPayload?.checks);
-  const apiCheck = asRecord2(doctorChecks?.api);
+  const doctorChecks = asRecord3(doctorPayload?.checks);
+  const apiCheck = asRecord3(doctorChecks?.api);
   printCommandEnvelope(
     {
       ok: true,

package/dist/cli/index.mjs

@@ -703,7 +703,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.298",
+  version: "0.1.300",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1048,7 +1048,7 @@ var HttpClient = class {
    * @param path - API path (e.g. `"/api/v2/tools"`)
    * @param options - HTTP method, body, headers, and timeout
    * @returns Parsed JSON response body
-   * @throws {@link AuthError} on HTTP 401/403 (immediate, no retry)
+   * @throws {@link AuthError} on Deepline-auth HTTP 401/403 (immediate, no retry)
    * @throws {@link RateLimitError} on HTTP 429 after all retries exhausted
    * @throws {@link DeeplineError} on other API errors or connection failures
    */
@@ -1087,9 +1087,6 @@ var HttpClient = class {
             signal: controller.signal
           });
           clearTimeout(timeoutId);
-          if (response.status === 401 || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
-          }
           if (response.status === 429) {
             const retryAfter = parseRetryAfter(response);
             lastError = new RateLimitError(retryAfter);
@@ -1100,11 +1097,9 @@ var HttpClient = class {
             throw lastError;
           }
           const body = await response.text();
-          let parsed;
-          try {
-            parsed = JSON.parse(body);
-          } catch {
-            parsed = body;
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
+            throw new AuthError();
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1131,7 +1126,7 @@ var HttpClient = class {
             }
             const errorValue = typeof parsed === "object" && parsed && "error" in parsed ? parsed.error : void 0;
             const msg = typeof errorValue === "string" ? errorValue : errorValue && typeof errorValue === "object" && "message" in errorValue && typeof errorValue.message === "string" ? errorValue.message : typeof parsed === "object" && parsed && "message" in parsed && typeof parsed.message === "string" ? parsed.message : `HTTP ${response.status}`;
-            const apiErrorCode2 = errorValue && typeof errorValue === "object" && typeof errorValue.code === "string" ? errorValue.code : typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : "API_ERROR";
+            const apiErrorCode2 = apiErrorCodeFromResponse(parsed);
             lastError = new DeeplineError(msg, response.status, apiErrorCode2, {
               response: parsed
             });
@@ -1205,11 +1200,12 @@ var HttpClient = class {
           body: options?.body !== void 0 ? JSON.stringify(options.body) : void 0,
           signal: options?.signal
         });
-        if (response.status === 401 || response.status === 403) {
-          throw new AuthError();
-        }
         if (!response.ok) {
           const body = await response.text();
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
+            throw new AuthError();
+          }
           const htmlError = detectHtmlErrorBody(
             body,
             response.headers.get("content-type")
@@ -1226,11 +1222,10 @@ var HttpClient = class {
               }
             );
           }
-          const parsed = parseResponseBody(body);
           throw new DeeplineError(
             apiErrorMessage(parsed, response.status),
             response.status,
-            "API_ERROR",
+            apiErrorCodeFromResponse(parsed),
             { response: parsed }
           );
         }
@@ -1305,6 +1300,22 @@ function parseResponseBody(body) {
     return body;
   }
 }
+function isProviderOriginatedHttpError(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const failureOrigin = error?.failure_origin ?? response?.failure_origin;
+  const code = error?.code ?? response?.code;
+  return failureOrigin === "provider" || code === "UPSTREAM_BLOCKED";
+}
+function apiErrorCodeFromResponse(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const code = error?.code ?? response?.code;
+  return typeof code === "string" ? code : "API_ERROR";
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
 function isRetryableApiErrorResponse(status) {
   return status === 408 || status === 425 || status >= 500 && status < 600;
 }
@@ -2098,7 +2109,7 @@ function normalizePlayRunLifecycleStatus(value) {
   switch (normalized) {
     case "queued":
     case "pending":
-      return "running";
+      return "queued";
     case "running":
     case "started":
       return "running";
@@ -2124,7 +2135,26 @@ function normalizePlayRunLifecycleStatus(value) {
   }
 }
 function isTerminalPlayRunLifecycleStatus(status) {
-  return TERMINAL_PLAY_RUN_STATUSES.has(normalizePlayRunLifecycleStatus(status));
+  return TERMINAL_PLAY_RUN_STATUSES.has(
+    normalizePlayRunLifecycleStatus(status)
+  );
+}
+function decodePlayRunPublicStatus(value) {
+  const status = normalizePlayRunLifecycleStatus(value);
+  switch (status) {
+    case "queued":
+    case "running":
+    case "waiting":
+    case "completed":
+    case "failed":
+    case "cancelled":
+      return status;
+    case "terminated":
+    case "timed_out":
+      return "cancelled";
+    case "unknown":
+      return null;
+  }
 }
 
 // ../shared_libs/play-runtime/run-snapshot-stream.ts
@@ -3065,7 +3095,13 @@ function isPlayRunPackage(value) {
 function normalizePlayStatus(raw) {
   const runPackage = isPlayRunPackage(raw) ? raw : isPlayRunPackage(raw.package) ? raw.package : null;
   const packageRun = runPackage?.run;
-  const status = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : "running";
+  const rawStatus = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : null;
+  const status = decodePlayRunPublicStatus(rawStatus);
+  if (!status) {
+    throw new Error(
+      `Invalid play run lifecycle status in API response: ${JSON.stringify(rawStatus)}.`
+    );
+  }
   const runId = typeof raw.runId === "string" ? raw.runId : typeof raw.workflowId === "string" ? raw.workflowId : packageRun?.id ?? "";
   return {
     ...raw,
@@ -24976,7 +25012,7 @@ function monitorsErrorExitCode(error) {
 }
 function monitorsFailureNextCommand(error, exitCode) {
   if (error instanceof DeeplineError) {
-    const response = asRecord(asRecord(error.details)?.response);
+    const response = asRecord2(asRecord2(error.details)?.response);
     const serverNextAction = asString(response?.next_action);
     if (serverNextAction) return serverNextAction;
   }
@@ -24992,10 +25028,10 @@ function monitorsFailureNextCommand(error, exitCode) {
 }
 function readValidationIssues(error) {
   if (!(error instanceof DeeplineError)) return [];
-  const response = asRecord(asRecord(error.details)?.response);
+  const response = asRecord2(asRecord2(error.details)?.response);
   const issues = Array.isArray(response?.issues) ? response.issues : [];
   return issues.flatMap((raw) => {
-    const issue = asRecord(raw);
+    const issue = asRecord2(raw);
     if (!issue) return [];
     return [
       {
@@ -25088,7 +25124,7 @@ or from a file / stdin:
   cat monitor.json | ${input2.command} --file -`
   );
 }
-function asRecord(value) {
+function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -25098,7 +25134,7 @@ function asFiniteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function monitorPricingLine(rawPricing) {
-  const pricing = asRecord(rawPricing);
+  const pricing = asRecord2(rawPricing);
   if (!pricing) return void 0;
   const display = asString(pricing.display);
   if (display) return display;
@@ -25113,16 +25149,16 @@ function yesNo(value) {
   return "unknown";
 }
 function readDeployOutputContract(payload) {
-  const contract = asRecord(payload.output_contract);
+  const contract = asRecord2(payload.output_contract);
   if (!contract) return { streams: [] };
   const rawOutputs = Array.isArray(contract.outputs) ? contract.outputs : [];
   const streams = rawOutputs.flatMap((raw) => {
-    const output2 = asRecord(raw);
+    const output2 = asRecord2(raw);
     const stream = output2 ? asString(output2.stream) : void 0;
     const table = output2 ? asString(output2.table) : void 0;
     if (!output2 || !stream || !table) return [];
     const columns = Array.isArray(output2.columns) ? output2.columns.flatMap((rawColumn) => {
-      const column = asRecord(rawColumn);
+      const column = asRecord2(rawColumn);
       const name = column ? asString(column.name) : void 0;
       return name ? [name] : [];
     }) : [];
@@ -25139,7 +25175,7 @@ function readDeployOutputContract(payload) {
   return { tool: asString(contract.tool), streams };
 }
 function renderMonitorDeployCompletion(payload) {
-  const monitor = asRecord(payload.monitor);
+  const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
   const { tool, streams } = readDeployOutputContract(payload);
   if (!key || streams.length === 0) return void 0;
@@ -25190,13 +25226,13 @@ function renderMonitorDeployPlan(payload) {
   if (!valid) {
     const issues = Array.isArray(payload.issues) ? payload.issues : [];
     for (const raw of issues) {
-      const issue = asRecord(raw);
+      const issue = asRecord2(raw);
       const path = issue ? asString(issue.path) : void 0;
       const message = issue ? asString(issue.message) : void 0;
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
-  const estimate = asRecord(payload.deploy_cost_estimate);
+  const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
     const note = estimate ? asString(estimate.note) : void 0;
@@ -25214,7 +25250,7 @@ function renderMonitorDeployPlan(payload) {
   }
   const candidates = Array.isArray(payload.reuse_candidates) ? payload.reuse_candidates : [];
   const candidateLines = candidates.flatMap((raw) => {
-    const candidate = asRecord(raw);
+    const candidate = asRecord2(raw);
     const key = candidate ? asString(candidate.key) : void 0;
     if (!candidate || !key) return [];
     const name = asString(candidate.name);
@@ -25240,7 +25276,7 @@ function renderMonitorDeployPlan(payload) {
 `;
 }
 function renderMonitorDeletePlan(payload, fallbackKey) {
-  const plan = asRecord(payload.plan);
+  const plan = asRecord2(payload.plan);
   const key = (plan ? asString(plan.monitor_key) : void 0) ?? fallbackKey;
   const lines = [
     "DRY RUN \u2014 nothing was deleted.",
@@ -25254,7 +25290,7 @@ function renderMonitorDeletePlan(payload, fallbackKey) {
 `;
 }
 function renderMonitorReactivatePlan(payload, key) {
-  const estimate = asRecord(payload.cost_estimate);
+  const estimate = asRecord2(payload.cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   const lines = [
     "DRY RUN \u2014 nothing was reactivated.",
@@ -25306,7 +25342,7 @@ function renderAvailableToolsText(payload) {
   ];
   let currentProvider;
   for (const raw of tools) {
-    const entry = asRecord(raw);
+    const entry = asRecord2(raw);
     const id = entry ? asString(entry.tool) : void 0;
     if (!entry || !id) continue;
     const name = asString(entry.name) ?? asString(entry.display_name);
@@ -25376,7 +25412,7 @@ function renderDeployedListText(payload, requestedStatus) {
   const header = monitors.length === 0 ? "No deployed monitors matched." : total !== void 0 && total > monitors.length ? `Deployed monitors (${monitors.length} of ${total}):` : `Deployed monitors (${monitors.length}):`;
   const lines = [header];
   for (const raw of monitors) {
-    const entry = asRecord(raw);
+    const entry = asRecord2(raw);
     const key = entry ? asString(entry.key) ?? asString(entry.monitor_key) : void 0;
     if (!entry || !key) continue;
     const status = asString(entry.status);
@@ -25461,11 +25497,11 @@ function renderMonitorGet(payload) {
   const tool = asString(payload.tool);
   if (!key || !tool) return void 0;
   const status = asString(payload.status);
-  const definition = asRecord(payload.definition);
+  const definition = asRecord2(payload.definition);
   const pricingLine = monitorPricingLine(payload.pricing);
-  const billing = asRecord(payload.billing);
+  const billing = asRecord2(payload.billing);
   const nextRenewalAt = billing ? asString(billing.next_renewal_at) : void 0;
-  const dependents = asRecord(payload.dependents);
+  const dependents = asRecord2(payload.dependents);
   const plays = dependents && Array.isArray(dependents.plays) ? dependents.plays : [];
   const lines = [
     `Monitor: ${key}`,
@@ -25482,7 +25518,7 @@ function renderMonitorGet(payload) {
     lines.push("  none");
   } else {
     for (const raw of plays) {
-      const play = asRecord(raw);
+      const play = asRecord2(raw);
       const name = play ? asString(play.name) : void 0;
       if (!play || !name) continue;
       const listener = asString(play.listener_key);
@@ -31256,7 +31292,7 @@ function parseCapturedJson(stdout) {
     return null;
   }
 }
-function asRecord2(value) {
+function asRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function safeRead(path) {
@@ -31958,8 +31994,8 @@ async function runSetupCommand(options) {
     status: "complete",
     phases
   });
-  const doctorChecks = asRecord2(doctorPayload?.checks);
-  const apiCheck = asRecord2(doctorChecks?.api);
+  const doctorChecks = asRecord3(doctorPayload?.checks);
+  const apiCheck = asRecord3(doctorChecks?.api);
   printCommandEnvelope(
     {
       ok: true,

package/dist/index.js

@@ -438,7 +438,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.298",
+  version: "0.1.300",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -783,7 +783,7 @@ var HttpClient = class {
    * @param path - API path (e.g. `"/api/v2/tools"`)
    * @param options - HTTP method, body, headers, and timeout
    * @returns Parsed JSON response body
-   * @throws {@link AuthError} on HTTP 401/403 (immediate, no retry)
+   * @throws {@link AuthError} on Deepline-auth HTTP 401/403 (immediate, no retry)
    * @throws {@link RateLimitError} on HTTP 429 after all retries exhausted
    * @throws {@link DeeplineError} on other API errors or connection failures
    */
@@ -822,9 +822,6 @@ var HttpClient = class {
             signal: controller.signal
           });
           clearTimeout(timeoutId);
-          if (response.status === 401 || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
-          }
           if (response.status === 429) {
             const retryAfter = parseRetryAfter(response);
             lastError = new RateLimitError(retryAfter);
@@ -835,11 +832,9 @@ var HttpClient = class {
             throw lastError;
           }
           const body = await response.text();
-          let parsed;
-          try {
-            parsed = JSON.parse(body);
-          } catch {
-            parsed = body;
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
+            throw new AuthError();
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -866,7 +861,7 @@ var HttpClient = class {
             }
             const errorValue = typeof parsed === "object" && parsed && "error" in parsed ? parsed.error : void 0;
             const msg = typeof errorValue === "string" ? errorValue : errorValue && typeof errorValue === "object" && "message" in errorValue && typeof errorValue.message === "string" ? errorValue.message : typeof parsed === "object" && parsed && "message" in parsed && typeof parsed.message === "string" ? parsed.message : `HTTP ${response.status}`;
-            const apiErrorCode = errorValue && typeof errorValue === "object" && typeof errorValue.code === "string" ? errorValue.code : typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : "API_ERROR";
+            const apiErrorCode = apiErrorCodeFromResponse(parsed);
             lastError = new DeeplineError(msg, response.status, apiErrorCode, {
               response: parsed
             });
@@ -940,11 +935,12 @@ var HttpClient = class {
           body: options?.body !== void 0 ? JSON.stringify(options.body) : void 0,
           signal: options?.signal
         });
-        if (response.status === 401 || response.status === 403) {
-          throw new AuthError();
-        }
         if (!response.ok) {
           const body = await response.text();
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
+            throw new AuthError();
+          }
           const htmlError = detectHtmlErrorBody(
             body,
             response.headers.get("content-type")
@@ -961,11 +957,10 @@ var HttpClient = class {
               }
             );
           }
-          const parsed = parseResponseBody(body);
           throw new DeeplineError(
             apiErrorMessage(parsed, response.status),
             response.status,
-            "API_ERROR",
+            apiErrorCodeFromResponse(parsed),
             { response: parsed }
           );
         }
@@ -1040,6 +1035,22 @@ function parseResponseBody(body) {
     return body;
   }
 }
+function isProviderOriginatedHttpError(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const failureOrigin = error?.failure_origin ?? response?.failure_origin;
+  const code = error?.code ?? response?.code;
+  return failureOrigin === "provider" || code === "UPSTREAM_BLOCKED";
+}
+function apiErrorCodeFromResponse(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const code = error?.code ?? response?.code;
+  return typeof code === "string" ? code : "API_ERROR";
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
 function isRetryableApiErrorResponse(status) {
   return status === 408 || status === 425 || status >= 500 && status < 600;
 }
@@ -1833,7 +1844,7 @@ function normalizePlayRunLifecycleStatus(value) {
   switch (normalized) {
     case "queued":
     case "pending":
-      return "running";
+      return "queued";
     case "running":
     case "started":
       return "running";
@@ -1859,7 +1870,26 @@ function normalizePlayRunLifecycleStatus(value) {
   }
 }
 function isTerminalPlayRunLifecycleStatus(status) {
-  return TERMINAL_PLAY_RUN_STATUSES.has(normalizePlayRunLifecycleStatus(status));
+  return TERMINAL_PLAY_RUN_STATUSES.has(
+    normalizePlayRunLifecycleStatus(status)
+  );
+}
+function decodePlayRunPublicStatus(value) {
+  const status = normalizePlayRunLifecycleStatus(value);
+  switch (status) {
+    case "queued":
+    case "running":
+    case "waiting":
+    case "completed":
+    case "failed":
+    case "cancelled":
+      return status;
+    case "terminated":
+    case "timed_out":
+      return "cancelled";
+    case "unknown":
+      return null;
+  }
 }
 
 // ../shared_libs/play-runtime/run-snapshot-stream.ts
@@ -2800,7 +2830,13 @@ function isPlayRunPackage(value) {
 function normalizePlayStatus(raw) {
   const runPackage = isPlayRunPackage(raw) ? raw : isPlayRunPackage(raw.package) ? raw.package : null;
   const packageRun = runPackage?.run;
-  const status = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : "running";
+  const rawStatus = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : null;
+  const status = decodePlayRunPublicStatus(rawStatus);
+  if (!status) {
+    throw new Error(
+      `Invalid play run lifecycle status in API response: ${JSON.stringify(rawStatus)}.`
+    );
+  }
   const runId = typeof raw.runId === "string" ? raw.runId : typeof raw.workflowId === "string" ? raw.workflowId : packageRun?.id ?? "";
   return {
     ...raw,

package/dist/index.mjs

@@ -367,7 +367,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.298",
+  version: "0.1.300",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -712,7 +712,7 @@ var HttpClient = class {
    * @param path - API path (e.g. `"/api/v2/tools"`)
    * @param options - HTTP method, body, headers, and timeout
    * @returns Parsed JSON response body
-   * @throws {@link AuthError} on HTTP 401/403 (immediate, no retry)
+   * @throws {@link AuthError} on Deepline-auth HTTP 401/403 (immediate, no retry)
    * @throws {@link RateLimitError} on HTTP 429 after all retries exhausted
    * @throws {@link DeeplineError} on other API errors or connection failures
    */
@@ -751,9 +751,6 @@ var HttpClient = class {
             signal: controller.signal
           });
           clearTimeout(timeoutId);
-          if (response.status === 401 || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
-          }
           if (response.status === 429) {
             const retryAfter = parseRetryAfter(response);
             lastError = new RateLimitError(retryAfter);
@@ -764,11 +761,9 @@ var HttpClient = class {
             throw lastError;
           }
           const body = await response.text();
-          let parsed;
-          try {
-            parsed = JSON.parse(body);
-          } catch {
-            parsed = body;
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
+            throw new AuthError();
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -795,7 +790,7 @@ var HttpClient = class {
             }
             const errorValue = typeof parsed === "object" && parsed && "error" in parsed ? parsed.error : void 0;
             const msg = typeof errorValue === "string" ? errorValue : errorValue && typeof errorValue === "object" && "message" in errorValue && typeof errorValue.message === "string" ? errorValue.message : typeof parsed === "object" && parsed && "message" in parsed && typeof parsed.message === "string" ? parsed.message : `HTTP ${response.status}`;
-            const apiErrorCode = errorValue && typeof errorValue === "object" && typeof errorValue.code === "string" ? errorValue.code : typeof parsed === "object" && parsed && typeof parsed.code === "string" ? parsed.code : "API_ERROR";
+            const apiErrorCode = apiErrorCodeFromResponse(parsed);
             lastError = new DeeplineError(msg, response.status, apiErrorCode, {
               response: parsed
             });
@@ -869,11 +864,12 @@ var HttpClient = class {
           body: options?.body !== void 0 ? JSON.stringify(options.body) : void 0,
           signal: options?.signal
         });
-        if (response.status === 401 || response.status === 403) {
-          throw new AuthError();
-        }
         if (!response.ok) {
           const body = await response.text();
+          const parsed = parseResponseBody(body);
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
+            throw new AuthError();
+          }
           const htmlError = detectHtmlErrorBody(
             body,
             response.headers.get("content-type")
@@ -890,11 +886,10 @@ var HttpClient = class {
               }
             );
           }
-          const parsed = parseResponseBody(body);
           throw new DeeplineError(
             apiErrorMessage(parsed, response.status),
             response.status,
-            "API_ERROR",
+            apiErrorCodeFromResponse(parsed),
             { response: parsed }
           );
         }
@@ -969,6 +964,22 @@ function parseResponseBody(body) {
     return body;
   }
 }
+function isProviderOriginatedHttpError(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const failureOrigin = error?.failure_origin ?? response?.failure_origin;
+  const code = error?.code ?? response?.code;
+  return failureOrigin === "provider" || code === "UPSTREAM_BLOCKED";
+}
+function apiErrorCodeFromResponse(parsed) {
+  const response = asRecord(parsed);
+  const error = asRecord(response?.error);
+  const code = error?.code ?? response?.code;
+  return typeof code === "string" ? code : "API_ERROR";
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
 function isRetryableApiErrorResponse(status) {
   return status === 408 || status === 425 || status >= 500 && status < 600;
 }
@@ -1762,7 +1773,7 @@ function normalizePlayRunLifecycleStatus(value) {
   switch (normalized) {
     case "queued":
     case "pending":
-      return "running";
+      return "queued";
     case "running":
     case "started":
       return "running";
@@ -1788,7 +1799,26 @@ function normalizePlayRunLifecycleStatus(value) {
   }
 }
 function isTerminalPlayRunLifecycleStatus(status) {
-  return TERMINAL_PLAY_RUN_STATUSES.has(normalizePlayRunLifecycleStatus(status));
+  return TERMINAL_PLAY_RUN_STATUSES.has(
+    normalizePlayRunLifecycleStatus(status)
+  );
+}
+function decodePlayRunPublicStatus(value) {
+  const status = normalizePlayRunLifecycleStatus(value);
+  switch (status) {
+    case "queued":
+    case "running":
+    case "waiting":
+    case "completed":
+    case "failed":
+    case "cancelled":
+      return status;
+    case "terminated":
+    case "timed_out":
+      return "cancelled";
+    case "unknown":
+      return null;
+  }
 }
 
 // ../shared_libs/play-runtime/run-snapshot-stream.ts
@@ -2729,7 +2759,13 @@ function isPlayRunPackage(value) {
 function normalizePlayStatus(raw) {
   const runPackage = isPlayRunPackage(raw) ? raw : isPlayRunPackage(raw.package) ? raw.package : null;
   const packageRun = runPackage?.run;
-  const status = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : "running";
+  const rawStatus = typeof raw.status === "string" ? raw.status : typeof packageRun?.status === "string" ? packageRun.status : null;
+  const status = decodePlayRunPublicStatus(rawStatus);
+  if (!status) {
+    throw new Error(
+      `Invalid play run lifecycle status in API response: ${JSON.stringify(rawStatus)}.`
+    );
+  }
   const runId = typeof raw.runId === "string" ? raw.runId : typeof raw.workflowId === "string" ? raw.workflowId : packageRun?.id ?? "";
   return {
     ...raw,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.298",
+  "version": "0.1.300",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {