deepline 0.1.214 → 0.1.215

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -95,7 +95,7 @@ import {
   PLAY_RUNTIME_CONTRACT,
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from './runtime-contract';
-import { PLAY_RUNTIME_API_COMPAT_PATH } from './runtime-api-paths';
+import { PLAY_RUNTIME_API_CURRENT_PATH } from './runtime-api-paths';
 import {
   PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
   PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
@@ -298,6 +298,7 @@ const RUNTIME_WORK_RECEIPT_LEASE_COLUMNS = [
   'lease_expires_at',
 ] as const;
 const RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN = 'failure_kind';
+const RUNTIME_WORK_RECEIPT_KEY_INDEX = 'idx_deepline_step_receipts_k_unique';
 const RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS = [
   ...RUNTIME_WORK_RECEIPT_LEASE_COLUMNS,
   RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN,
@@ -504,7 +505,7 @@ function resolveRuntimeApiUrl(context: RuntimeApiContext): string {
   if (!baseUrl) {
     throw new Error('Runner runtime API requires a baseUrl.');
   }
-  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
+  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`;
 }
 
 function resolveRuntimeApiHeaders(
@@ -588,9 +589,11 @@ async function postRuntimeApi<TResponse>(
     const details =
       typeof parsed?.details === 'string'
         ? parsed.details
-        : typeof parsed?.debug_error === 'string'
-          ? parsed.debug_error
-          : null;
+        : typeof parsed?.detail === 'string'
+          ? parsed.detail
+          : typeof parsed?.debug_error === 'string'
+            ? parsed.debug_error
+            : null;
     const shouldRetryRuntimeResponse =
       (response.status === 503 &&
         parsed?.code === 'ingestion_plane_not_ready') ||
@@ -2040,6 +2043,22 @@ function isMissingRuntimeWorkReceiptSelfHealColumnError(
   );
 }
 
+function isMissingRuntimeWorkReceiptKeyConstraintError(
+  error: unknown,
+): boolean {
+  if (!error || typeof error !== 'object') {
+    return false;
+  }
+  const code = 'code' in error ? String(error.code) : '';
+  const message = 'message' in error ? String(error.message) : '';
+  return (
+    code === '42P10' ||
+    /no unique or exclusion constraint matching the ON CONFLICT specification/i.test(
+      message,
+    )
+  );
+}
+
 function runtimeWorkReceiptEnsureCacheKey(
   session: RuntimePostgresSession,
 ): string {
@@ -2119,22 +2138,29 @@ async function ensureRuntimeWorkReceiptTable(
         session,
         client,
       );
-      if (missingColumns.length === 0) return;
+      if (missingColumns.length > 0) {
+        await client.query(`
+          ALTER TABLE ${workReceiptTable(session)}
+            ${missingColumns
+              .map((column) => {
+                const type =
+                  column === 'lease_expires_at'
+                    ? 'timestamptz'
+                    : column === 'lease_owner_attempt'
+                      ? 'integer'
+                      : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
+                        ? 'smallint NOT NULL DEFAULT 0'
+                        : 'text';
+                return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
+              })
+              .join(',\n          ')}
+        `);
+      }
       await client.query(`
-        ALTER TABLE ${workReceiptTable(session)}
-          ${missingColumns
-            .map((column) => {
-              const type =
-                column === 'lease_expires_at'
-                  ? 'timestamptz'
-                  : column === 'lease_owner_attempt'
-                    ? 'integer'
-                    : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
-                      ? 'smallint NOT NULL DEFAULT 0'
-                      : 'text';
-              return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
-            })
-            .join(',\n          ')}
+        CREATE UNIQUE INDEX IF NOT EXISTS ${quoteIdentifier(
+          RUNTIME_WORK_RECEIPT_KEY_INDEX,
+        )}
+        ON ${workReceiptTable(session)} (k)
       `);
     })
     .then(() => undefined);
@@ -2238,7 +2264,8 @@ async function withRuntimeWorkReceiptClient<T>(
     } catch (error) {
       if (
         isMissingRelationError(error) ||
-        isMissingRuntimeWorkReceiptSelfHealColumnError(error)
+        isMissingRuntimeWorkReceiptSelfHealColumnError(error) ||
+        isMissingRuntimeWorkReceiptKeyConstraintError(error)
       ) {
         runtimeWorkReceiptEnsureCache.delete(
           runtimeWorkReceiptEnsureCacheKey(session),
@@ -4636,6 +4663,7 @@ export async function completeRuntimeWorkReceipt(
     runAttempt?: number | null;
     leaseId?: string | null;
     output: unknown;
+    returnOutput?: boolean;
   },
 ): Promise<WorkReceipt | null> {
   if (
@@ -4741,7 +4769,7 @@ export async function completeRuntimeWorkReceipt(
             })}
 	          RETURNING convert_from(k, 'UTF8') AS k,
 	                    status,
-	                    output,
+	                    CASE WHEN $7::boolean THEN output ELSE NULL::jsonb END AS output,
 	                    error,
 	                    failure_kind,
 	                    run_id,
@@ -4754,7 +4782,7 @@ export async function completeRuntimeWorkReceipt(
 	        replay AS (
 	          SELECT convert_from(k, 'UTF8') AS k,
 	                 status,
-	                 output,
+	                 CASE WHEN $7::boolean THEN output ELSE NULL::jsonb END AS output,
 	                 error,
 	                 failure_kind,
 	                 run_id,
@@ -4783,6 +4811,7 @@ export async function completeRuntimeWorkReceipt(
           input.runId,
           leaseId,
           runAttempt,
+          input.returnOutput !== false,
         ],
       );
       return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -4801,6 +4830,7 @@ export async function completeRuntimeWorkReceipts(
       leaseId?: string | null;
       runAttempt?: number | null;
     }>;
+    returnOutput?: boolean;
   },
 ): Promise<Array<WorkReceipt | null>> {
   const receipts = input.receipts.filter((receipt) => receipt.key.trim());
@@ -4819,6 +4849,7 @@ export async function completeRuntimeWorkReceipts(
         await completeRuntimeWorkReceipts(context, {
           playName: input.playName,
           receipts: siblingReceipts,
+          returnOutput: input.returnOutput,
         });
       } catch (error) {
         siblingError = error;
@@ -4938,7 +4969,7 @@ export async function completeRuntimeWorkReceipts(
            })}
         RETURNING target.k,
                   target.status,
-	                  target.output,
+	                  CASE WHEN $7::boolean THEN target.output ELSE NULL::jsonb END AS output,
 	                  target.error,
 	                  target.failure_kind,
 	                  target.run_id,
@@ -4952,7 +4983,7 @@ export async function completeRuntimeWorkReceipts(
       replay AS (
         SELECT target.k,
                target.status,
-               target.output,
+               CASE WHEN $7::boolean THEN target.output ELSE NULL::jsonb END AS output,
                target.error,
                target.failure_kind,
                target.run_id,
@@ -5020,6 +5051,7 @@ export async function completeRuntimeWorkReceipts(
             ),
           ),
           RECEIPT_STATUS_COMPLETED,
+          input.returnOutput !== false,
         ],
       );
       return rows.map((row) =>

package/dist/bundling-sources/shared_libs/play-runtime/runtime-contract.ts

@@ -1,8 +1,15 @@
-export const PLAY_RUNTIME_CONTRACT = 2;
+export const PLAY_RUNTIME_CONTRACT = 3;
 export const PLAY_RUNTIME_CONTRACT_MIN_SUPPORTED = 1;
 export const PLAY_RUNTIME_CONTRACT_HEADER = 'x-deepline-runtime-contract';
 
 export const RUNTIME_CONTRACT_CHANGELOG = [
+  {
+    contract: 3,
+    changed:
+      'Runtime receipt completion responses are compact acknowledgements; receipt reads remain the payload replay path.',
+    compatOwner: 'runtime',
+    compatRemoval: 'contract 2 support window closure',
+  },
   {
     contract: 2,
     changed:
@@ -12,6 +19,15 @@ export const RUNTIME_CONTRACT_CHANGELOG = [
   },
 ] as const;
 
+export function runtimeReceiptCompletionResponse<
+  T extends { output?: unknown },
+>(runtimeContract: number | null | undefined, receipt: T | null): T | null {
+  if (!receipt || (runtimeContract ?? 1) < 3) return receipt;
+  const { output, ...ack } = receipt;
+  void output;
+  return ack as T;
+}
+
 export type RuntimeContractResolution =
   | { ok: true; contract: number }
   | {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backend.ts

@@ -4,8 +4,9 @@
  * One of three pluggable axes (alongside runner-backends and dedup-backends).
  * Selected per-run via PlayExecutionProfile.
  *
- * Absurd is the default production scheduler through the absurd profile.
- * Cloudflare Workflows remains available through the workers_edge profile.
+ * Absurd is the enabled production scheduler. The Cloudflare Workflows
+ * adapter is retained for historical run interpretation while workers_edge
+ * launch admission is disabled.
  *
  * Customer plays are unaffected — this is purely the orchestration layer.
  */

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -5,10 +5,18 @@ const JWT_RE =
   /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+// Only redact self-identifying credential prefixes here. Generic words such as
+// `key`, `token`, and `secret` are common in harmless play/run slugs (for
+// example `absurd-key-rotation-check`) and need an assignment context before
+// they are sensitive; HIGH_ENTROPY_ASSIGNMENT_RE handles that case below.
 const COMMON_SECRET_RE =
-  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+const GENERIC_PREFIXED_SECRET_RE =
+  /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const URL_SECRET_VALUE_RE =
   /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+const GENERIC_SECRET_ASSIGNMENT_RE =
+  /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 const HIGH_ENTROPY_ASSIGNMENT_RE =
   /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 const SENSITIVE_URL_PARAM_RE =
@@ -39,6 +47,8 @@ export function redactSecretLikeString(value: string): string {
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)
     .replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
+    .replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
+    .replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
       const separator = match.includes('=') ? '=' : ':';
       const [key] = match.split(separator, 1);

package/dist/bundling-sources/shared_libs/play-runtime/transient-service-error.ts

@@ -0,0 +1,10 @@
+export function transientServiceUnavailableDetail(
+  error: unknown,
+): string | null {
+  const detail = error instanceof Error ? error.message : String(error);
+  return /ServiceUnavailable|Service temporarily unavailable|temporarily unavailable \(Code:\s*\d+\)/i.test(
+    detail,
+  )
+    ? detail
+    : null;
+}

package/dist/cli/index.js

@@ -623,10 +623,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.215",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.215",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1364,8 +1364,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1382,7 +1384,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -3047,8 +3049,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
@@ -10763,6 +10764,18 @@ var PLAY_RUNTIME_PROVIDER_IDS = {
   workersEdge: "workers_edge",
   absurd: "absurd"
 };
+var PLAY_RUNTIME_PROVIDER_DISABLED_CODE = "PLAY_RUNTIME_PROVIDER_DISABLED";
+var PlayRuntimeProviderDisabledError = class extends Error {
+  code = PLAY_RUNTIME_PROVIDER_DISABLED_CODE;
+  profile;
+  constructor(profile) {
+    super(
+      `Play runtime profile "${profile}" is disabled. Deepline runs now execute on the "absurd" profile.`
+    );
+    this.name = "PlayRuntimeProviderDisabledError";
+    this.profile = profile;
+  }
+};
 var PLAY_RUNTIME_PROVIDERS = {
   workers_edge: {
     id: PLAY_RUNTIME_PROVIDER_IDS.workersEdge,
@@ -10787,6 +10800,11 @@ var PLAY_RUNTIME_PROVIDERS = {
 function defaultPlayRuntimeProvider() {
   return PLAY_RUNTIME_PROVIDERS.absurd;
 }
+function assertPlayRuntimeProviderEnabled(provider) {
+  if (provider.id === PLAY_RUNTIME_PROVIDER_IDS.workersEdge) {
+    throw new PlayRuntimeProviderDisabledError(provider.id);
+  }
+}
 function resolvePlayRuntimeProvider(override) {
   if (override?.trim()) {
     const id = override.trim();
@@ -10801,17 +10819,22 @@ function resolvePlayRuntimeProvider(override) {
   }
   return defaultPlayRuntimeProvider();
 }
+function resolveEnabledPlayRuntimeProvider(override) {
+  const provider = resolvePlayRuntimeProvider(override);
+  assertPlayRuntimeProviderEnabled(provider);
+  return provider;
+}
 
 // ../shared_libs/play-runtime/profiles.ts
 var PLAY_EXECUTION_PROFILE_IDS = {
   ...PLAY_RUNTIME_PROVIDER_IDS
 };
 var PLAY_EXECUTION_PROFILES = PLAY_RUNTIME_PROVIDERS;
-function resolveExecutionProfile(override) {
+function resolveEnabledExecutionProfile(override) {
   try {
-    return resolvePlayRuntimeProvider(override);
+    return resolveEnabledPlayRuntimeProvider(override);
   } catch (error) {
-    if (override?.trim()) {
+    if (override?.trim() && error instanceof Error && /Unsupported play runtime provider/.test(error.message)) {
       throw new Error(
         `Unknown execution profile "${override.trim()}". Expected one of: ${Object.keys(
           PLAY_EXECUTION_PROFILES
@@ -11759,7 +11782,7 @@ async function collectBundledPlayGraph(entryFile, profile = null) {
   const playBundler = await loadPlayBundler();
   const nodes = /* @__PURE__ */ new Map();
   const visiting = /* @__PURE__ */ new Set();
-  const artifactKind = resolveExecutionProfile(profile).artifactKind;
+  const artifactKind = resolveEnabledExecutionProfile(profile).artifactKind;
   const visit = async (filePath) => {
     const absolutePath = normalizePlayPath(filePath);
     const cached = nodes.get(absolutePath);
@@ -14473,7 +14496,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Production defaults to absurd. Use --profile workers_edge only for an explicit Cloudflare run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Runs default to absurd. The workers_edge profile is disabled.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -14512,7 +14535,7 @@ function parsePlayRunOptions(args) {
         throw new Error("--profile requires an execution profile id.");
       }
       profile = value.trim();
-      resolveExecutionProfile(profile);
+      resolveEnabledExecutionProfile(profile);
       index += 1;
       continue;
     }

package/dist/cli/index.mjs

@@ -608,10 +608,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.215",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.215",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1349,8 +1349,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1367,7 +1369,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -3032,8 +3034,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
@@ -10792,6 +10793,18 @@ var PLAY_RUNTIME_PROVIDER_IDS = {
   workersEdge: "workers_edge",
   absurd: "absurd"
 };
+var PLAY_RUNTIME_PROVIDER_DISABLED_CODE = "PLAY_RUNTIME_PROVIDER_DISABLED";
+var PlayRuntimeProviderDisabledError = class extends Error {
+  code = PLAY_RUNTIME_PROVIDER_DISABLED_CODE;
+  profile;
+  constructor(profile) {
+    super(
+      `Play runtime profile "${profile}" is disabled. Deepline runs now execute on the "absurd" profile.`
+    );
+    this.name = "PlayRuntimeProviderDisabledError";
+    this.profile = profile;
+  }
+};
 var PLAY_RUNTIME_PROVIDERS = {
   workers_edge: {
     id: PLAY_RUNTIME_PROVIDER_IDS.workersEdge,
@@ -10816,6 +10829,11 @@ var PLAY_RUNTIME_PROVIDERS = {
 function defaultPlayRuntimeProvider() {
   return PLAY_RUNTIME_PROVIDERS.absurd;
 }
+function assertPlayRuntimeProviderEnabled(provider) {
+  if (provider.id === PLAY_RUNTIME_PROVIDER_IDS.workersEdge) {
+    throw new PlayRuntimeProviderDisabledError(provider.id);
+  }
+}
 function resolvePlayRuntimeProvider(override) {
   if (override?.trim()) {
     const id = override.trim();
@@ -10830,17 +10848,22 @@ function resolvePlayRuntimeProvider(override) {
   }
   return defaultPlayRuntimeProvider();
 }
+function resolveEnabledPlayRuntimeProvider(override) {
+  const provider = resolvePlayRuntimeProvider(override);
+  assertPlayRuntimeProviderEnabled(provider);
+  return provider;
+}
 
 // ../shared_libs/play-runtime/profiles.ts
 var PLAY_EXECUTION_PROFILE_IDS = {
   ...PLAY_RUNTIME_PROVIDER_IDS
 };
 var PLAY_EXECUTION_PROFILES = PLAY_RUNTIME_PROVIDERS;
-function resolveExecutionProfile(override) {
+function resolveEnabledExecutionProfile(override) {
   try {
-    return resolvePlayRuntimeProvider(override);
+    return resolveEnabledPlayRuntimeProvider(override);
   } catch (error) {
-    if (override?.trim()) {
+    if (override?.trim() && error instanceof Error && /Unsupported play runtime provider/.test(error.message)) {
       throw new Error(
         `Unknown execution profile "${override.trim()}". Expected one of: ${Object.keys(
           PLAY_EXECUTION_PROFILES
@@ -11788,7 +11811,7 @@ async function collectBundledPlayGraph(entryFile, profile = null) {
   const playBundler = await loadPlayBundler();
   const nodes = /* @__PURE__ */ new Map();
   const visiting = /* @__PURE__ */ new Set();
-  const artifactKind = resolveExecutionProfile(profile).artifactKind;
+  const artifactKind = resolveEnabledExecutionProfile(profile).artifactKind;
   const visit = async (filePath) => {
     const absolutePath = normalizePlayPath(filePath);
     const cached = nodes.get(absolutePath);
@@ -14502,7 +14525,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Production defaults to absurd. Use --profile workers_edge only for an explicit Cloudflare run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Runs default to absurd. The workers_edge profile is disabled.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -14541,7 +14564,7 @@ function parsePlayRunOptions(args) {
         throw new Error("--profile requires an execution profile id.");
       }
       profile = value.trim();
-      resolveExecutionProfile(profile);
+      resolveEnabledExecutionProfile(profile);
       index += 1;
       continue;
     }

package/dist/index.d.mts

@@ -1085,9 +1085,8 @@ interface StartPlayRunRequest {
     /** Optionally let the start request wait briefly and return a terminal result. */
     waitForCompletionMs?: number;
     /**
-     * Per-run execution profile override. The server defaults to absurd;
-     * callers that need workers_edge can pass it here. Most callers should leave
-     * this unset.
+     * Per-run execution profile override. The server defaults to absurd. The
+     * workers_edge profile is disabled; most callers should leave this unset.
      */
     profile?: string;
     /** Optional per-run provider execution mode for eval/smoke runs. */

package/dist/index.d.ts

@@ -1085,9 +1085,8 @@ interface StartPlayRunRequest {
     /** Optionally let the start request wait briefly and return a terminal result. */
     waitForCompletionMs?: number;
     /**
-     * Per-run execution profile override. The server defaults to absurd;
-     * callers that need workers_edge can pass it here. Most callers should leave
-     * this unset.
+     * Per-run execution profile override. The server defaults to absurd. The
+     * workers_edge profile is disabled; most callers should leave this unset.
      */
     profile?: string;
     /** Optional per-run provider execution mode for eval/smoke runs. */

package/dist/index.js

@@ -422,10 +422,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.215",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.215",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1163,8 +1163,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1181,7 +1183,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -2846,8 +2848,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}

package/dist/index.mjs

@@ -352,10 +352,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.215",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.215",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1093,8 +1093,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1111,7 +1113,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -2776,8 +2778,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}