deepline 0.3.292 → 0.3.293

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.292',
+  version: '0.3.293',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -80,6 +80,7 @@ import {
   recognizedRuntimeTestFaultCount,
 } from './/test-runtime-seams';
 import {
+  fetchWithVercelProtectionBypass,
   isVercelSecurityCheckpointResponse,
   vercelProtectionBypassHeaders,
 } from './/vercel-protection';
@@ -1455,12 +1456,16 @@ async function postAppRuntimeApi<TResponse>(
   }
   const runtimeFetch = context.fetch ?? fetch;
   const boundaryLabel = runtimeApiBoundaryLabel(context);
-  const vercelHeaders = await vercelProtectionBypassHeaders({
-    baseUrl,
-    token: context.vercelProtectionBypassToken,
-    fetchImpl: runtimeFetch,
-    signal: context.signal,
-  });
+  const fastRunLedgerBypass =
+    body.action === 'append_run_events' || body.action === 'project_run_events';
+  const vercelHeaders = fastRunLedgerBypass
+    ? null
+    : await vercelProtectionBypassHeaders({
+        baseUrl,
+        token: context.vercelProtectionBypassToken,
+        fetchImpl: runtimeFetch,
+        signal: context.signal,
+      });
 
   const maxAttempts =
     context.retryPolicy === 'none' ? 1 : appRuntimeMaxAttempts(body.action);
@@ -1523,43 +1528,53 @@ async function postAppRuntimeApi<TResponse>(
       runtimeTestFaultHeader: context.runtimeTestFaultHeader,
     });
     try {
-      response = await runtimeFetch(resolveAppRuntimeApiUrl(context), {
-        method: 'POST',
-        headers: {
-          // The payload is JSON either way; `content-encoding` describes only
-          // how those JSON bytes were packed for the wire.
-          'content-type': 'application/json',
-          ...(wireBody.contentEncoding
-            ? { 'content-encoding': wireBody.contentEncoding }
-            : {}),
-          authorization: `Bearer ${token}`,
-          [LEGACY_RUNTIME_RECEIPT_WIRE_HEADER]: String(
-            LEGACY_RUNTIME_RECEIPT_WIRE_FORMAT,
-          ),
-          [PLAY_RUNTIME_TRANSPORT_ATTEMPT_HEADER]: transportAttemptId,
-          ...vercelHeaders,
-          ...(context.preferredReceiptGatewayMachineId?.trim()
-            ? {
-                'fly-force-instance-id':
-                  context.preferredReceiptGatewayMachineId.trim(),
-              }
-            : {}),
-          ...(runtimeTestFaultHeader
-            ? {
-                [PLAY_RUNTIME_TEST_FAULT_HEADER]: runtimeTestFaultHeader,
-              }
-            : {}),
-        },
-        // DOM fetch accepts ArrayBuffer, while Node 24 deliberately rejects a
-        // Uint8Array backed by an arbitrary ArrayBufferLike. Copy only the
-        // compressed branch into an exact ArrayBuffer; its wire bytes remain
-        // identical and the plain JSON fast path stays allocation-free.
-        body:
-          typeof wireBody.body === 'string'
-            ? wireBody.body
-            : Uint8Array.from(wireBody.body).buffer,
-        signal: requestSignal,
-      });
+      const sendRequest = (protectionHeaders: Record<string, string>) =>
+        runtimeFetch(resolveAppRuntimeApiUrl(context), {
+          method: 'POST',
+          headers: {
+            // The payload is JSON either way; `content-encoding` describes only
+            // how those JSON bytes were packed for the wire.
+            'content-type': 'application/json',
+            ...(wireBody.contentEncoding
+              ? { 'content-encoding': wireBody.contentEncoding }
+              : {}),
+            authorization: `Bearer ${token}`,
+            [LEGACY_RUNTIME_RECEIPT_WIRE_HEADER]: String(
+              LEGACY_RUNTIME_RECEIPT_WIRE_FORMAT,
+            ),
+            [PLAY_RUNTIME_TRANSPORT_ATTEMPT_HEADER]: transportAttemptId,
+            ...protectionHeaders,
+            ...(context.preferredReceiptGatewayMachineId?.trim()
+              ? {
+                  'fly-force-instance-id':
+                    context.preferredReceiptGatewayMachineId.trim(),
+                }
+              : {}),
+            ...(runtimeTestFaultHeader
+              ? {
+                  [PLAY_RUNTIME_TEST_FAULT_HEADER]: runtimeTestFaultHeader,
+                }
+              : {}),
+          },
+          // DOM fetch accepts ArrayBuffer, while Node 24 deliberately rejects a
+          // Uint8Array backed by an arbitrary ArrayBufferLike. Copy only the
+          // compressed branch into an exact ArrayBuffer; its wire bytes remain
+          // identical and the plain JSON fast path stays allocation-free.
+          body:
+            typeof wireBody.body === 'string'
+              ? wireBody.body
+              : Uint8Array.from(wireBody.body).buffer,
+          signal: requestSignal,
+        });
+      response = fastRunLedgerBypass
+        ? await fetchWithVercelProtectionBypass({
+            baseUrl,
+            token: context.vercelProtectionBypassToken,
+            fetchImpl: runtimeFetch,
+            signal: requestSignal,
+            send: sendRequest,
+          })
+        : await sendRequest(vercelHeaders ?? {});
       const preferredMachineId =
         context.preferredReceiptGatewayMachineId?.trim() ?? '';
       if (

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -197,6 +197,7 @@ import {
   runtimeTokenOriginFromLaunch,
 } from './runtime-api-origin';
 import {
+  fetchWithVercelProtectionBypass,
   isVercelSecurityCheckpointResponse,
   vercelProtectionBypassHeaders,
 } from '../vercel-protection';
@@ -20312,7 +20313,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           error.status !== 401
         )
           throw error;
-        runtimeApi.executorToken = await gatewayRuntimeApi.refreshExecutorToken();
+        runtimeApi.executorToken =
+          await gatewayRuntimeApi.refreshExecutorToken();
         await append(runtimeApi);
       }
     } else if (tokenAuthority !== 'gateway') {
@@ -21027,34 +21029,35 @@ async function requestRunLedgerDispatchToken(
     };
   runLedgerDispatchTokens.delete(cacheKey);
   const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
-  const vercelProtectionHeaders = await vercelProtectionBypassHeaders({
+  const requestSignal = input.signal
+    ? AbortSignal.any([
+        input.signal,
+        AbortSignal.timeout(RUN_LEDGER_DISPATCH_TOKEN_TIMEOUT_MS),
+      ])
+    : AbortSignal.timeout(RUN_LEDGER_DISPATCH_TOKEN_TIMEOUT_MS);
+  const requestBody = JSON.stringify({
+    runId: input.launch.runId,
+    eventId: input.eventId,
+    leaseOwner: input.leaseOwner,
+    schedulerSchema: input.schedulerSchema,
+  });
+  const response = await fetchWithVercelProtectionBypass({
     baseUrl: runtimeApiBaseUrlFromLaunch(input.launch),
     token: input.launch.vercelProtectionBypassToken,
-    signal: input.signal,
-  });
-  const response = await fetch(url, {
-    method: 'POST',
-    signal: input.signal
-      ? AbortSignal.any([
-          input.signal,
-          AbortSignal.timeout(RUN_LEDGER_DISPATCH_TOKEN_TIMEOUT_MS),
-        ])
-      : AbortSignal.timeout(RUN_LEDGER_DISPATCH_TOKEN_TIMEOUT_MS),
-    headers: {
-      'content-type': 'application/json',
-      'x-deepline-internal-token': internalToken,
-      // Thread the durable outbox identity through the authority hop. This is
-      // not a credential; it lets the app-side lease lookup report one stable
-      // correlation id when a retryable scheduler failure occurs.
-      'x-deepline-runtime-trace-id': `run-ledger:${input.eventId}`,
-      ...vercelProtectionHeaders,
-    },
-    body: JSON.stringify({
-      runId: input.launch.runId,
-      eventId: input.eventId,
-      leaseOwner: input.leaseOwner,
-      schedulerSchema: input.schedulerSchema,
-    }),
+    signal: requestSignal,
+    send: (protectionHeaders) =>
+      fetch(url, {
+        method: 'POST',
+        signal: requestSignal,
+        headers: {
+          'content-type': 'application/json',
+          'x-deepline-internal-token': internalToken,
+          // Preserve the durable identity across a pre-app checkpoint retry.
+          'x-deepline-runtime-trace-id': `run-ledger:${input.eventId}`,
+          ...protectionHeaders,
+        },
+        body: requestBody,
+      }),
   });
   const responseText = await response.text();
   const body = (() => {

package/dist/bundling-sources/shared_libs/play-runtime/vercel-protection.ts

@@ -157,6 +157,49 @@ export async function vercelProtectionBypassHeaders(input: {
   };
 }
 
+/**
+ * Use the server-to-server bypass header without a blocking cookie preflight.
+ * A Vercel checkpoint is generated before the application sees the request,
+ * so replaying the same request once with its bypass cookie is safe.
+ */
+export async function fetchWithVercelProtectionBypass(input: {
+  baseUrl: string;
+  token: string | null | undefined;
+  fetchImpl?: FetchLike;
+  signal?: AbortSignal;
+  send: (headers: Record<string, string>) => Promise<Response>;
+}): Promise<Response> {
+  const token = input.token?.trim();
+  const response = await input.send(vercelProtectionBypassHeader(token));
+  if (!token || response.status !== 403) return response;
+  const contentType = response.headers.get('content-type');
+  if (!/^text\/html(?:\s*;|$)/i.test(contentType?.trim() ?? '')) {
+    return response;
+  }
+  let body: string;
+  try {
+    body = await response.clone().text();
+  } catch {
+    return response;
+  }
+  if (
+    !isVercelSecurityCheckpointResponse({
+      status: response.status,
+      contentType,
+      body,
+    })
+  ) {
+    return response;
+  }
+  const bypassHeaders = await vercelProtectionBypassHeaders({
+    baseUrl: input.baseUrl,
+    token,
+    fetchImpl: input.fetchImpl,
+    signal: input.signal,
+  });
+  return bypassHeaders.cookie ? input.send(bypassHeaders) : response;
+}
+
 export function resolveVercelProtectionBypassTokenForRequest(
   req: Pick<Request, 'headers'>,
 ): string | null {

package/dist/cli/index.js

@@ -3515,7 +3515,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3510,7 +3510,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -1328,7 +1328,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -1232,7 +1232,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.292";
+    readonly version: "0.3.293";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.292";
+    readonly version: "0.3.293";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.292",
+  version: "0.3.293",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.292",
+  "version": "0.3.293",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",