deepline 0.1.306 → 0.1.307

package/dist/bundling-sources/sdk/src/client.ts

@@ -1785,7 +1785,6 @@ export class DeeplineClient {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -1848,17 +1847,11 @@ export class DeeplineClient {
   async repairIngestionStorage(input?: {
     provider?: string;
   }): Promise<IngestionStorageRepairResult> {
-    // forbiddenAsApiError: the repair route returns a meaningful 403 for
-    // non-org-admin callers. Without it, http.ts collapses 403 into a generic
-    // AuthError (statusCode 401) and the CLI's "requires org admin" branch
-    // could never fire.
     return this.http.post<IngestionStorageRepairResult>(
       '/api/v2/ingestion/repair',
       {
         ...(input?.provider ? { provider: input.provider } : {}),
       },
-      undefined,
-      { forbiddenAsApiError: true },
     );
   }
 
@@ -2080,7 +2073,7 @@ export class DeeplineClient {
         compilerManifest,
       },
       undefined,
-      { forbiddenAsApiError: true, retryApiErrors: true },
+      { retryApiErrors: true },
     );
   }
 
@@ -2124,7 +2117,7 @@ export class DeeplineClient {
         '/api/v2/plays/artifacts',
         { artifacts },
         undefined,
-        { forbiddenAsApiError: true, retryApiErrors: true },
+        { retryApiErrors: true },
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -2166,7 +2159,7 @@ export class DeeplineClient {
             artifacts: chunk,
           },
           undefined,
-          { forbiddenAsApiError: true, retryApiErrors: true },
+          { retryApiErrors: true },
         ),
       );
     }
@@ -3612,8 +3605,6 @@ export class DeeplineClient {
     return this.http.post<PublishPlayVersionResult>(
       `/api/v2/plays/${encodedName}/live`,
       request,
-      undefined,
-      { forbiddenAsApiError: true },
     );
   }
 
@@ -3935,8 +3926,7 @@ export class DeeplineClient {
    * `client.monitors.status()`.
    */
   async getMonitorsAccess(): Promise<MonitorsAccessStatus> {
-    // No forbiddenAsApiError: the endpoint answers 200 in both the granted and
-    // denied cases, so a 403 would be a real auth failure, not a denial body.
+    // The endpoint answers 200 in both the granted and denied cases.
     const payload = await this.http.request<MonitorsAccessStatus>(
       '/api/v2/monitors/access',
       { method: 'GET' },
@@ -3989,7 +3979,7 @@ export class DeeplineClient {
     const suffix = query ? `?${query}` : '';
     return this.http.request<MonitorsAvailableResult>(
       `/api/v2/monitors/tools${suffix}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4000,7 +3990,6 @@ export class DeeplineClient {
     return this.http.request<MonitorCheckResult>('/api/v2/monitors/check', {
       method: 'POST',
       body: definition,
-      forbiddenAsApiError: true,
     });
   }
 
@@ -4019,13 +4008,11 @@ export class DeeplineClient {
       return this.http.request<MonitorDeployResult>('/api/v2/monitors/check', {
         method: 'POST',
         body: definition,
-        forbiddenAsApiError: true,
       });
     }
     return this.http.request<MonitorDeployResult>('/api/v2/monitors/deploy', {
       method: 'POST',
       body: definition,
-      forbiddenAsApiError: true,
     });
   }
 
@@ -4045,7 +4032,7 @@ export class DeeplineClient {
     const suffix = query ? `?${query}` : '';
     return this.http.request<MonitorsListResult>(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4053,7 +4040,7 @@ export class DeeplineClient {
   async getMonitor(key: string): Promise<MonitorDetail> {
     return this.http.request<MonitorDetail>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4061,7 +4048,7 @@ export class DeeplineClient {
   async getMonitorDependents(key: string): Promise<MonitorDependents> {
     return this.http.request<MonitorDependents>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4072,7 +4059,7 @@ export class DeeplineClient {
   ): Promise<MonitorUpdateResult> {
     return this.http.request<MonitorUpdateResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: 'PATCH', body: patch, forbiddenAsApiError: true },
+      { method: 'PATCH', body: patch },
     );
   }
 
@@ -4091,7 +4078,7 @@ export class DeeplineClient {
     const query = params.toString();
     return this.http.request<MonitorDeleteResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ''}`,
-      { method: 'DELETE', forbiddenAsApiError: true },
+      { method: 'DELETE' },
     );
   }
 
@@ -4106,7 +4093,7 @@ export class DeeplineClient {
     const query = options?.dryRun ? '?dry_run=true' : '';
     return this.http.request<MonitorReactivateResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: 'POST', body: {}, forbiddenAsApiError: true },
+      { method: 'POST', body: {} },
     );
   }
 

package/dist/bundling-sources/sdk/src/errors.ts

@@ -30,7 +30,9 @@ export {
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via

package/dist/bundling-sources/sdk/src/http.ts

@@ -9,7 +9,7 @@
  * - **Max attempts**: `1 + maxRetries` (default: 4 total attempts)
  * - **Backoff**: exponential — 1s, 2s, 4s, 8s, ... capped at 30s
  * - **Retryable**: network errors, timeouts, HTTP 429 (rate limit)
- * - **Not retryable**: HTTP 401/403 (auth errors), other 4xx API errors
+ * - **Not retryable**: HTTP 401 (auth error), HTTP 403 and other 4xx API errors
  *
  * ## Localhost failover
  *
@@ -61,14 +61,6 @@ interface RequestOptions {
   headers?: Record<string, string>;
   /** Per-request timeout override in milliseconds. */
   timeout?: number;
-  /**
-   * Treat HTTP 403 as a regular API error instead of a generic {@link AuthError}.
-   * Use for endpoints that return 403 with a meaningful server error message
-   * (e.g. feature-flagged-off billing subscription checkout) so the server
-   * message is preserved and surfaced loudly. A provider-originated HTTP 401
-   * remains a regular API error when its response envelope says so.
-   */
-  forbiddenAsApiError?: boolean;
   /**
    * Retry HTTP 408/425/5xx JSON API responses. Use only for idempotent requests;
    * most mutating API calls must fail loudly after the first server response.
@@ -437,11 +429,10 @@ export class HttpClient {
           }
 
           if (
-            (response.status === 401 &&
-              !isProviderOriginatedHttpError(parsed)) ||
-            (response.status === 403 && !options?.forbiddenAsApiError)
+            response.status === 401 &&
+            !isProviderOriginatedHttpError(parsed)
           ) {
-            throw new AuthError();
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError =
@@ -576,10 +567,17 @@ export class HttpClient {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get<T = unknown>(path: string): Promise<T> {
+  async get<T = unknown>(
+    path: string,
+    options?: Pick<
+      RequestOptions,
+      'retryApiErrors' | 'timeout' | 'maxRetries' | 'exactUrlOnly' | 'toolId'
+    >,
+  ): Promise<T> {
     return this.request<T>(path, {
       method: 'GET',
       retryApiErrors: true,
+      ...options,
     });
   }
 
@@ -614,11 +612,10 @@ export class HttpClient {
           const body = await response.text();
           const parsed = parseResponseBody(body);
           if (
-            (response.status === 401 &&
-              !isProviderOriginatedHttpError(parsed)) ||
-            response.status === 403
+            response.status === 401 &&
+            !isProviderOriginatedHttpError(parsed)
           ) {
-            throw new AuthError();
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -681,12 +678,7 @@ export class HttpClient {
     headers?: Record<string, string>,
     options?: Pick<
       RequestOptions,
-      | 'forbiddenAsApiError'
-      | 'retryApiErrors'
-      | 'timeout'
-      | 'maxRetries'
-      | 'exactUrlOnly'
-      | 'toolId'
+      'retryApiErrors' | 'timeout' | 'maxRetries' | 'exactUrlOnly' | 'toolId'
     >,
   ): Promise<T> {
     return this.request<T>(path, {

package/dist/bundling-sources/sdk/src/release.ts

@@ -157,7 +157,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.306',
+  version: '0.1.307',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/cli/index.js

@@ -1037,7 +1037,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.306",
+  version: "0.1.307",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1456,8 +1456,8 @@ var HttpClient = class {
             }
             throw lastError;
           }
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1556,10 +1556,11 @@ var HttpClient = class {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get(path) {
+  async get(path, options) {
     return this.request(path, {
       method: "GET",
-      retryApiErrors: true
+      retryApiErrors: true,
+      ...options
     });
   }
   async *streamSse(path, options) {
@@ -1584,8 +1585,8 @@ var HttpClient = class {
         if (!response.ok) {
           const body = await response.text();
           const parsed = parseResponseBody(body);
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -3983,7 +3984,6 @@ var DeeplineClient = class {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input2),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -4034,9 +4034,7 @@ var DeeplineClient = class {
       "/api/v2/ingestion/repair",
       {
         ...input2?.provider ? { provider: input2.provider } : {}
-      },
-      void 0,
-      { forbiddenAsApiError: true }
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -4192,7 +4190,7 @@ var DeeplineClient = class {
         compilerManifest
       },
       void 0,
-      { forbiddenAsApiError: true, retryApiErrors: true }
+      { retryApiErrors: true }
     );
   }
   /**
@@ -4207,7 +4205,7 @@ var DeeplineClient = class {
         "/api/v2/plays/artifacts",
         { artifacts },
         void 0,
-        { forbiddenAsApiError: true, retryApiErrors: true }
+        { retryApiErrors: true }
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -4232,7 +4230,7 @@ var DeeplineClient = class {
             artifacts: chunk
           },
           void 0,
-          { forbiddenAsApiError: true, retryApiErrors: true }
+          { retryApiErrors: true }
         )
       );
     }
@@ -5361,9 +5359,7 @@ var DeeplineClient = class {
     const encodedName = encodeURIComponent(name);
     return this.http.post(
       `/api/v2/plays/${encodedName}/live`,
-      request,
-      void 0,
-      { forbiddenAsApiError: true }
+      request
     );
   }
   /**
@@ -5654,15 +5650,14 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/tools${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Validate a monitor definition without deploying it. Prefer `client.monitors.check(...)`. */
   async checkMonitor(definition) {
     return this.http.request("/api/v2/monitors/check", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /**
@@ -5674,14 +5669,12 @@ var DeeplineClient = class {
     if (options?.dryRun) {
       return this.http.request("/api/v2/monitors/check", {
         method: "POST",
-        body: definition,
-        forbiddenAsApiError: true
+        body: definition
       });
     }
     return this.http.request("/api/v2/monitors/deploy", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /** List deployed monitors. Prefer `client.monitors.list(...)`. */
@@ -5696,28 +5689,28 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
   async getMonitor(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
   async getMonitorDependents(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Update a deployed monitor by public key. Prefer `client.monitors.update(...)`. */
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch, forbiddenAsApiError: true }
+      { method: "PATCH", body: patch }
     );
   }
   /**
@@ -5732,7 +5725,7 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE", forbiddenAsApiError: true }
+      { method: "DELETE" }
     );
   }
   /**
@@ -5743,7 +5736,7 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {}, forbiddenAsApiError: true }
+      { method: "POST", body: {} }
     );
   }
   /**
@@ -7866,8 +7859,7 @@ async function handleSubscribe(planVersionId, options) {
     "/api/v2/billing/subscription/checkout",
     {
       method: "POST",
-      body: { plan_version_id: planVersionId },
-      forbiddenAsApiError: true
+      body: { plan_version_id: planVersionId }
     }
   );
   const url = String(payload.checkout_url || "");

package/dist/cli/index.mjs

@@ -1022,7 +1022,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.306",
+  version: "0.1.307",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1441,8 +1441,8 @@ var HttpClient = class {
             }
             throw lastError;
           }
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1541,10 +1541,11 @@ var HttpClient = class {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get(path) {
+  async get(path, options) {
     return this.request(path, {
       method: "GET",
-      retryApiErrors: true
+      retryApiErrors: true,
+      ...options
     });
   }
   async *streamSse(path, options) {
@@ -1569,8 +1570,8 @@ var HttpClient = class {
         if (!response.ok) {
           const body = await response.text();
           const parsed = parseResponseBody(body);
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -3968,7 +3969,6 @@ var DeeplineClient = class {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input2),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -4019,9 +4019,7 @@ var DeeplineClient = class {
       "/api/v2/ingestion/repair",
       {
         ...input2?.provider ? { provider: input2.provider } : {}
-      },
-      void 0,
-      { forbiddenAsApiError: true }
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -4177,7 +4175,7 @@ var DeeplineClient = class {
         compilerManifest
       },
       void 0,
-      { forbiddenAsApiError: true, retryApiErrors: true }
+      { retryApiErrors: true }
     );
   }
   /**
@@ -4192,7 +4190,7 @@ var DeeplineClient = class {
         "/api/v2/plays/artifacts",
         { artifacts },
         void 0,
-        { forbiddenAsApiError: true, retryApiErrors: true }
+        { retryApiErrors: true }
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -4217,7 +4215,7 @@ var DeeplineClient = class {
             artifacts: chunk
           },
           void 0,
-          { forbiddenAsApiError: true, retryApiErrors: true }
+          { retryApiErrors: true }
         )
       );
     }
@@ -5346,9 +5344,7 @@ var DeeplineClient = class {
     const encodedName = encodeURIComponent(name);
     return this.http.post(
       `/api/v2/plays/${encodedName}/live`,
-      request,
-      void 0,
-      { forbiddenAsApiError: true }
+      request
     );
   }
   /**
@@ -5639,15 +5635,14 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/tools${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Validate a monitor definition without deploying it. Prefer `client.monitors.check(...)`. */
   async checkMonitor(definition) {
     return this.http.request("/api/v2/monitors/check", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /**
@@ -5659,14 +5654,12 @@ var DeeplineClient = class {
     if (options?.dryRun) {
       return this.http.request("/api/v2/monitors/check", {
         method: "POST",
-        body: definition,
-        forbiddenAsApiError: true
+        body: definition
       });
     }
     return this.http.request("/api/v2/monitors/deploy", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /** List deployed monitors. Prefer `client.monitors.list(...)`. */
@@ -5681,28 +5674,28 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
   async getMonitor(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
   async getMonitorDependents(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Update a deployed monitor by public key. Prefer `client.monitors.update(...)`. */
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch, forbiddenAsApiError: true }
+      { method: "PATCH", body: patch }
     );
   }
   /**
@@ -5717,7 +5710,7 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE", forbiddenAsApiError: true }
+      { method: "DELETE" }
     );
   }
   /**
@@ -5728,7 +5721,7 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {}, forbiddenAsApiError: true }
+      { method: "POST", body: {} }
     );
   }
   /**
@@ -7863,8 +7856,7 @@ async function handleSubscribe(planVersionId, options) {
     "/api/v2/billing/subscription/checkout",
     {
       method: "POST",
-      body: { plan_version_id: planVersionId },
-      forbiddenAsApiError: true
+      body: { plan_version_id: planVersionId }
     }
   );
   const url = String(payload.checkout_url || "");

package/dist/index.d.mts

@@ -3171,7 +3171,9 @@ declare const SDK_API_CONTRACT: string;
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via

package/dist/index.d.ts

@@ -3171,7 +3171,9 @@ declare const SDK_API_CONTRACT: string;
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via

package/dist/index.js

@@ -760,7 +760,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.306",
+  version: "0.1.307",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1179,8 +1179,8 @@ var HttpClient = class {
             }
             throw lastError;
           }
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1279,10 +1279,11 @@ var HttpClient = class {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get(path) {
+  async get(path, options) {
     return this.request(path, {
       method: "GET",
-      retryApiErrors: true
+      retryApiErrors: true,
+      ...options
     });
   }
   async *streamSse(path, options) {
@@ -1307,8 +1308,8 @@ var HttpClient = class {
         if (!response.ok) {
           const body = await response.text();
           const parsed = parseResponseBody(body);
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -3706,7 +3707,6 @@ var DeeplineClient = class {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -3757,9 +3757,7 @@ var DeeplineClient = class {
       "/api/v2/ingestion/repair",
       {
         ...input?.provider ? { provider: input.provider } : {}
-      },
-      void 0,
-      { forbiddenAsApiError: true }
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -3915,7 +3913,7 @@ var DeeplineClient = class {
         compilerManifest
       },
       void 0,
-      { forbiddenAsApiError: true, retryApiErrors: true }
+      { retryApiErrors: true }
     );
   }
   /**
@@ -3930,7 +3928,7 @@ var DeeplineClient = class {
         "/api/v2/plays/artifacts",
         { artifacts },
         void 0,
-        { forbiddenAsApiError: true, retryApiErrors: true }
+        { retryApiErrors: true }
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -3955,7 +3953,7 @@ var DeeplineClient = class {
             artifacts: chunk
           },
           void 0,
-          { forbiddenAsApiError: true, retryApiErrors: true }
+          { retryApiErrors: true }
         )
       );
     }
@@ -5084,9 +5082,7 @@ var DeeplineClient = class {
     const encodedName = encodeURIComponent(name);
     return this.http.post(
       `/api/v2/plays/${encodedName}/live`,
-      request,
-      void 0,
-      { forbiddenAsApiError: true }
+      request
     );
   }
   /**
@@ -5377,15 +5373,14 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/tools${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Validate a monitor definition without deploying it. Prefer `client.monitors.check(...)`. */
   async checkMonitor(definition) {
     return this.http.request("/api/v2/monitors/check", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /**
@@ -5397,14 +5392,12 @@ var DeeplineClient = class {
     if (options?.dryRun) {
       return this.http.request("/api/v2/monitors/check", {
         method: "POST",
-        body: definition,
-        forbiddenAsApiError: true
+        body: definition
       });
     }
     return this.http.request("/api/v2/monitors/deploy", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /** List deployed monitors. Prefer `client.monitors.list(...)`. */
@@ -5419,28 +5412,28 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
   async getMonitor(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
   async getMonitorDependents(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Update a deployed monitor by public key. Prefer `client.monitors.update(...)`. */
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch, forbiddenAsApiError: true }
+      { method: "PATCH", body: patch }
     );
   }
   /**
@@ -5455,7 +5448,7 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE", forbiddenAsApiError: true }
+      { method: "DELETE" }
     );
   }
   /**
@@ -5466,7 +5459,7 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {}, forbiddenAsApiError: true }
+      { method: "POST", body: {} }
     );
   }
   /**

package/dist/index.mjs

@@ -686,7 +686,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.306",
+  version: "0.1.307",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1105,8 +1105,8 @@ var HttpClient = class {
             }
             throw lastError;
           }
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1205,10 +1205,11 @@ var HttpClient = class {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get(path) {
+  async get(path, options) {
     return this.request(path, {
       method: "GET",
-      retryApiErrors: true
+      retryApiErrors: true,
+      ...options
     });
   }
   async *streamSse(path, options) {
@@ -1233,8 +1234,8 @@ var HttpClient = class {
         if (!response.ok) {
           const body = await response.text();
           const parsed = parseResponseBody(body);
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -3632,7 +3633,6 @@ var DeeplineClient = class {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -3683,9 +3683,7 @@ var DeeplineClient = class {
       "/api/v2/ingestion/repair",
       {
         ...input?.provider ? { provider: input.provider } : {}
-      },
-      void 0,
-      { forbiddenAsApiError: true }
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -3841,7 +3839,7 @@ var DeeplineClient = class {
         compilerManifest
       },
       void 0,
-      { forbiddenAsApiError: true, retryApiErrors: true }
+      { retryApiErrors: true }
     );
   }
   /**
@@ -3856,7 +3854,7 @@ var DeeplineClient = class {
         "/api/v2/plays/artifacts",
         { artifacts },
         void 0,
-        { forbiddenAsApiError: true, retryApiErrors: true }
+        { retryApiErrors: true }
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -3881,7 +3879,7 @@ var DeeplineClient = class {
             artifacts: chunk
           },
           void 0,
-          { forbiddenAsApiError: true, retryApiErrors: true }
+          { retryApiErrors: true }
         )
       );
     }
@@ -5010,9 +5008,7 @@ var DeeplineClient = class {
     const encodedName = encodeURIComponent(name);
     return this.http.post(
       `/api/v2/plays/${encodedName}/live`,
-      request,
-      void 0,
-      { forbiddenAsApiError: true }
+      request
     );
   }
   /**
@@ -5303,15 +5299,14 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/tools${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Validate a monitor definition without deploying it. Prefer `client.monitors.check(...)`. */
   async checkMonitor(definition) {
     return this.http.request("/api/v2/monitors/check", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /**
@@ -5323,14 +5318,12 @@ var DeeplineClient = class {
     if (options?.dryRun) {
       return this.http.request("/api/v2/monitors/check", {
         method: "POST",
-        body: definition,
-        forbiddenAsApiError: true
+        body: definition
       });
     }
     return this.http.request("/api/v2/monitors/deploy", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /** List deployed monitors. Prefer `client.monitors.list(...)`. */
@@ -5345,28 +5338,28 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
   async getMonitor(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
   async getMonitorDependents(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Update a deployed monitor by public key. Prefer `client.monitors.update(...)`. */
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch, forbiddenAsApiError: true }
+      { method: "PATCH", body: patch }
     );
   }
   /**
@@ -5381,7 +5374,7 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE", forbiddenAsApiError: true }
+      { method: "DELETE" }
     );
   }
   /**
@@ -5392,7 +5385,7 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {}, forbiddenAsApiError: true }
+      { method: "POST", body: {} }
     );
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.306",
+  "version": "0.1.307",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {