deepline 0.1.214 → 0.1.216

package/dist/cli/index.js

@@ -623,10 +623,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.216",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.216",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1364,8 +1364,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1382,7 +1384,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -3047,8 +3049,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
@@ -10763,6 +10764,18 @@ var PLAY_RUNTIME_PROVIDER_IDS = {
   workersEdge: "workers_edge",
   absurd: "absurd"
 };
+var PLAY_RUNTIME_PROVIDER_DISABLED_CODE = "PLAY_RUNTIME_PROVIDER_DISABLED";
+var PlayRuntimeProviderDisabledError = class extends Error {
+  code = PLAY_RUNTIME_PROVIDER_DISABLED_CODE;
+  profile;
+  constructor(profile) {
+    super(
+      `Play runtime profile "${profile}" is disabled. Deepline runs now execute on the "absurd" profile.`
+    );
+    this.name = "PlayRuntimeProviderDisabledError";
+    this.profile = profile;
+  }
+};
 var PLAY_RUNTIME_PROVIDERS = {
   workers_edge: {
     id: PLAY_RUNTIME_PROVIDER_IDS.workersEdge,
@@ -10787,6 +10800,11 @@ var PLAY_RUNTIME_PROVIDERS = {
 function defaultPlayRuntimeProvider() {
   return PLAY_RUNTIME_PROVIDERS.absurd;
 }
+function assertPlayRuntimeProviderEnabled(provider) {
+  if (provider.id === PLAY_RUNTIME_PROVIDER_IDS.workersEdge) {
+    throw new PlayRuntimeProviderDisabledError(provider.id);
+  }
+}
 function resolvePlayRuntimeProvider(override) {
   if (override?.trim()) {
     const id = override.trim();
@@ -10801,17 +10819,22 @@ function resolvePlayRuntimeProvider(override) {
   }
   return defaultPlayRuntimeProvider();
 }
+function resolveEnabledPlayRuntimeProvider(override) {
+  const provider = resolvePlayRuntimeProvider(override);
+  assertPlayRuntimeProviderEnabled(provider);
+  return provider;
+}
 
 // ../shared_libs/play-runtime/profiles.ts
 var PLAY_EXECUTION_PROFILE_IDS = {
   ...PLAY_RUNTIME_PROVIDER_IDS
 };
 var PLAY_EXECUTION_PROFILES = PLAY_RUNTIME_PROVIDERS;
-function resolveExecutionProfile(override) {
+function resolveEnabledExecutionProfile(override) {
   try {
-    return resolvePlayRuntimeProvider(override);
+    return resolveEnabledPlayRuntimeProvider(override);
   } catch (error) {
-    if (override?.trim()) {
+    if (override?.trim() && error instanceof Error && /Unsupported play runtime provider/.test(error.message)) {
       throw new Error(
         `Unknown execution profile "${override.trim()}". Expected one of: ${Object.keys(
           PLAY_EXECUTION_PROFILES
@@ -11759,7 +11782,7 @@ async function collectBundledPlayGraph(entryFile, profile = null) {
   const playBundler = await loadPlayBundler();
   const nodes = /* @__PURE__ */ new Map();
   const visiting = /* @__PURE__ */ new Set();
-  const artifactKind = resolveExecutionProfile(profile).artifactKind;
+  const artifactKind = resolveEnabledExecutionProfile(profile).artifactKind;
   const visit = async (filePath) => {
     const absolutePath = normalizePlayPath(filePath);
     const cached = nodes.get(absolutePath);
@@ -13325,7 +13348,9 @@ function normalizeProgressForEnvelope(status, rowsInfo) {
   const pending = getNumericField(progress, "pending") ?? (typeof total === "number" && typeof completed === "number" && typeof failed === "number" ? Math.max(0, total - completed - failed) : null);
   return {
     total,
+    totalRows: total,
     completed,
+    completedRows: completed,
     pending,
     failed,
     executed: getNumericField(progress, "executed"),
@@ -14473,7 +14498,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Production defaults to absurd. Use --profile workers_edge only for an explicit Cloudflare run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Runs default to absurd. The workers_edge profile is disabled.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -14512,7 +14537,7 @@ function parsePlayRunOptions(args) {
         throw new Error("--profile requires an execution profile id.");
       }
       profile = value.trim();
-      resolveExecutionProfile(profile);
+      resolveEnabledExecutionProfile(profile);
       index += 1;
       continue;
     }
@@ -15460,7 +15485,7 @@ async function handleRunsList(args) {
   return 0;
 }
 async function handleRunTail(args) {
-  const usage = "Usage: deepline runs tail <run-id> [--json] [--compact]";
+  const usage = "Usage: deepline runs tail <run-id> [--json | --jsonl] [--compact]";
   let runId;
   try {
     runId = parseRunIdPositional(args, usage);
@@ -15476,13 +15501,18 @@ async function handleRunTail(args) {
       );
       return 1;
     }
-    if (arg.startsWith("--") && arg !== "--json" && arg !== "--compact") {
+    if (arg.startsWith("--") && arg !== "--json" && arg !== "--jsonl" && arg !== "--compact") {
       console.error(`${arg} is not supported by deepline runs tail.`);
       return 1;
     }
   }
+  if (args.includes("--json") && args.includes("--jsonl")) {
+    console.error("--json and --jsonl cannot be used together.");
+    return 1;
+  }
   const client2 = new DeeplineClient();
-  const jsonOutput = argsWantJson(args);
+  const jsonLines = args.includes("--jsonl");
+  const jsonOutput = !jsonLines && argsWantJson(args);
   const compact = args.includes("--compact");
   const compactState = {
     lastLogIndex: 0,
@@ -15492,7 +15522,16 @@ async function handleRunTail(args) {
     lastStatusHeartbeatAt: 0
   };
   const status = await client2.runs.tail(runId, {
-    onEvent: compact && !jsonOutput ? (event) => {
+    onEvent: jsonLines ? (event) => {
+      process.stdout.write(
+        `${JSON.stringify({
+          schemaVersion: 1,
+          kind: "play_run_event",
+          event
+        })}
+`
+      );
+    } : compact && !jsonOutput ? (event) => {
       const transition = getStepTransitionLineFromLiveEvent(
         event,
         compactState
@@ -15522,7 +15561,12 @@ async function handleRunTail(args) {
       );
     }
   });
-  writePlayResult(status, jsonOutput);
+  if (jsonLines) {
+    process.stdout.write(`${JSON.stringify(compactPlayStatus(status))}
+`);
+  } else {
+    writePlayResult(status, jsonOutput);
+  }
   return status.status === "failed" ? 1 : 0;
 }
 async function handleRunLogs(args) {
@@ -16888,19 +16932,26 @@ Examples:
 Notes:
   Streams live run events until the stream ends. Use get for current status and
   logs for persisted log history. In human output, --compact prints deduplicated
-  step transitions and progress instead of the full event stream.
+  step transitions and progress instead of the full event stream. --json emits
+  one terminal package. --jsonl emits canonical live events as JSON Lines and
+  ends with the same compact package shape as runs get --json.
 
 Examples:
   deepline runs tail play/my-play/run/20260501t000000-000
-  deepline runs tail play/my-play/run/20260501t000000-000 --compact --json
+  deepline runs tail play/my-play/run/20260501t000000-000 --compact
+  deepline runs tail play/my-play/run/20260501t000000-000 --jsonl
 `
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
+  ).option("--json", "Emit one terminal JSON package after the run completes").option(
+    "--jsonl",
+    "Stream live events as JSON Lines, then the terminal package"
+  ).option(
     "--compact",
-    "Show deduplicated step transitions and progress; compact JSON output"
+    "Show deduplicated human step transitions and progress"
   ).action(async (runId, options) => {
     process.exitCode = await handleRunTail([
       runId,
       ...options.json ? ["--json"] : [],
+      ...options.jsonl ? ["--jsonl"] : [],
       ...options.compact ? ["--compact"] : []
     ]);
   });

package/dist/cli/index.mjs

@@ -608,10 +608,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.216",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.216",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1349,8 +1349,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1367,7 +1369,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -3032,8 +3034,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
@@ -10792,6 +10793,18 @@ var PLAY_RUNTIME_PROVIDER_IDS = {
   workersEdge: "workers_edge",
   absurd: "absurd"
 };
+var PLAY_RUNTIME_PROVIDER_DISABLED_CODE = "PLAY_RUNTIME_PROVIDER_DISABLED";
+var PlayRuntimeProviderDisabledError = class extends Error {
+  code = PLAY_RUNTIME_PROVIDER_DISABLED_CODE;
+  profile;
+  constructor(profile) {
+    super(
+      `Play runtime profile "${profile}" is disabled. Deepline runs now execute on the "absurd" profile.`
+    );
+    this.name = "PlayRuntimeProviderDisabledError";
+    this.profile = profile;
+  }
+};
 var PLAY_RUNTIME_PROVIDERS = {
   workers_edge: {
     id: PLAY_RUNTIME_PROVIDER_IDS.workersEdge,
@@ -10816,6 +10829,11 @@ var PLAY_RUNTIME_PROVIDERS = {
 function defaultPlayRuntimeProvider() {
   return PLAY_RUNTIME_PROVIDERS.absurd;
 }
+function assertPlayRuntimeProviderEnabled(provider) {
+  if (provider.id === PLAY_RUNTIME_PROVIDER_IDS.workersEdge) {
+    throw new PlayRuntimeProviderDisabledError(provider.id);
+  }
+}
 function resolvePlayRuntimeProvider(override) {
   if (override?.trim()) {
     const id = override.trim();
@@ -10830,17 +10848,22 @@ function resolvePlayRuntimeProvider(override) {
   }
   return defaultPlayRuntimeProvider();
 }
+function resolveEnabledPlayRuntimeProvider(override) {
+  const provider = resolvePlayRuntimeProvider(override);
+  assertPlayRuntimeProviderEnabled(provider);
+  return provider;
+}
 
 // ../shared_libs/play-runtime/profiles.ts
 var PLAY_EXECUTION_PROFILE_IDS = {
   ...PLAY_RUNTIME_PROVIDER_IDS
 };
 var PLAY_EXECUTION_PROFILES = PLAY_RUNTIME_PROVIDERS;
-function resolveExecutionProfile(override) {
+function resolveEnabledExecutionProfile(override) {
   try {
-    return resolvePlayRuntimeProvider(override);
+    return resolveEnabledPlayRuntimeProvider(override);
   } catch (error) {
-    if (override?.trim()) {
+    if (override?.trim() && error instanceof Error && /Unsupported play runtime provider/.test(error.message)) {
       throw new Error(
         `Unknown execution profile "${override.trim()}". Expected one of: ${Object.keys(
           PLAY_EXECUTION_PROFILES
@@ -11788,7 +11811,7 @@ async function collectBundledPlayGraph(entryFile, profile = null) {
   const playBundler = await loadPlayBundler();
   const nodes = /* @__PURE__ */ new Map();
   const visiting = /* @__PURE__ */ new Set();
-  const artifactKind = resolveExecutionProfile(profile).artifactKind;
+  const artifactKind = resolveEnabledExecutionProfile(profile).artifactKind;
   const visit = async (filePath) => {
     const absolutePath = normalizePlayPath(filePath);
     const cached = nodes.get(absolutePath);
@@ -13354,7 +13377,9 @@ function normalizeProgressForEnvelope(status, rowsInfo) {
   const pending = getNumericField(progress, "pending") ?? (typeof total === "number" && typeof completed === "number" && typeof failed === "number" ? Math.max(0, total - completed - failed) : null);
   return {
     total,
+    totalRows: total,
     completed,
+    completedRows: completed,
     pending,
     failed,
     executed: getNumericField(progress, "executed"),
@@ -14502,7 +14527,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Production defaults to absurd. Use --profile workers_edge only for an explicit Cloudflare run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Runs default to absurd. The workers_edge profile is disabled.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -14541,7 +14566,7 @@ function parsePlayRunOptions(args) {
         throw new Error("--profile requires an execution profile id.");
       }
       profile = value.trim();
-      resolveExecutionProfile(profile);
+      resolveEnabledExecutionProfile(profile);
       index += 1;
       continue;
     }
@@ -15489,7 +15514,7 @@ async function handleRunsList(args) {
   return 0;
 }
 async function handleRunTail(args) {
-  const usage = "Usage: deepline runs tail <run-id> [--json] [--compact]";
+  const usage = "Usage: deepline runs tail <run-id> [--json | --jsonl] [--compact]";
   let runId;
   try {
     runId = parseRunIdPositional(args, usage);
@@ -15505,13 +15530,18 @@ async function handleRunTail(args) {
       );
       return 1;
     }
-    if (arg.startsWith("--") && arg !== "--json" && arg !== "--compact") {
+    if (arg.startsWith("--") && arg !== "--json" && arg !== "--jsonl" && arg !== "--compact") {
       console.error(`${arg} is not supported by deepline runs tail.`);
       return 1;
     }
   }
+  if (args.includes("--json") && args.includes("--jsonl")) {
+    console.error("--json and --jsonl cannot be used together.");
+    return 1;
+  }
   const client2 = new DeeplineClient();
-  const jsonOutput = argsWantJson(args);
+  const jsonLines = args.includes("--jsonl");
+  const jsonOutput = !jsonLines && argsWantJson(args);
   const compact = args.includes("--compact");
   const compactState = {
     lastLogIndex: 0,
@@ -15521,7 +15551,16 @@ async function handleRunTail(args) {
     lastStatusHeartbeatAt: 0
   };
   const status = await client2.runs.tail(runId, {
-    onEvent: compact && !jsonOutput ? (event) => {
+    onEvent: jsonLines ? (event) => {
+      process.stdout.write(
+        `${JSON.stringify({
+          schemaVersion: 1,
+          kind: "play_run_event",
+          event
+        })}
+`
+      );
+    } : compact && !jsonOutput ? (event) => {
       const transition = getStepTransitionLineFromLiveEvent(
         event,
         compactState
@@ -15551,7 +15590,12 @@ async function handleRunTail(args) {
       );
     }
   });
-  writePlayResult(status, jsonOutput);
+  if (jsonLines) {
+    process.stdout.write(`${JSON.stringify(compactPlayStatus(status))}
+`);
+  } else {
+    writePlayResult(status, jsonOutput);
+  }
   return status.status === "failed" ? 1 : 0;
 }
 async function handleRunLogs(args) {
@@ -16917,19 +16961,26 @@ Examples:
 Notes:
   Streams live run events until the stream ends. Use get for current status and
   logs for persisted log history. In human output, --compact prints deduplicated
-  step transitions and progress instead of the full event stream.
+  step transitions and progress instead of the full event stream. --json emits
+  one terminal package. --jsonl emits canonical live events as JSON Lines and
+  ends with the same compact package shape as runs get --json.
 
 Examples:
   deepline runs tail play/my-play/run/20260501t000000-000
-  deepline runs tail play/my-play/run/20260501t000000-000 --compact --json
+  deepline runs tail play/my-play/run/20260501t000000-000 --compact
+  deepline runs tail play/my-play/run/20260501t000000-000 --jsonl
 `
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
+  ).option("--json", "Emit one terminal JSON package after the run completes").option(
+    "--jsonl",
+    "Stream live events as JSON Lines, then the terminal package"
+  ).option(
     "--compact",
-    "Show deduplicated step transitions and progress; compact JSON output"
+    "Show deduplicated human step transitions and progress"
   ).action(async (runId, options) => {
     process.exitCode = await handleRunTail([
       runId,
       ...options.json ? ["--json"] : [],
+      ...options.jsonl ? ["--jsonl"] : [],
       ...options.compact ? ["--compact"] : []
     ]);
   });

package/dist/index.d.mts

@@ -1085,9 +1085,8 @@ interface StartPlayRunRequest {
     /** Optionally let the start request wait briefly and return a terminal result. */
     waitForCompletionMs?: number;
     /**
-     * Per-run execution profile override. The server defaults to absurd;
-     * callers that need workers_edge can pass it here. Most callers should leave
-     * this unset.
+     * Per-run execution profile override. The server defaults to absurd. The
+     * workers_edge profile is disabled; most callers should leave this unset.
      */
     profile?: string;
     /** Optional per-run provider execution mode for eval/smoke runs. */

package/dist/index.d.ts

@@ -1085,9 +1085,8 @@ interface StartPlayRunRequest {
     /** Optionally let the start request wait briefly and return a terminal result. */
     waitForCompletionMs?: number;
     /**
-     * Per-run execution profile override. The server defaults to absurd;
-     * callers that need workers_edge can pass it here. Most callers should leave
-     * this unset.
+     * Per-run execution profile override. The server defaults to absurd. The
+     * workers_edge profile is disabled; most callers should leave this unset.
      */
     profile?: string;
     /** Optional per-run provider execution mode for eval/smoke runs. */

package/dist/index.js

@@ -422,10 +422,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.216",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.216",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1163,8 +1163,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1181,7 +1183,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -2846,8 +2848,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}

package/dist/index.mjs

@@ -352,10 +352,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.214",
+  version: "0.1.216",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.214",
+    latest: "0.1.216",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -1093,8 +1093,10 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 function escapeRegExp(value) {
@@ -1111,7 +1113,7 @@ function redactSecretLikeString(value) {
     }
     if (!URL_SECRET_VALUE_RE.test(value)) return value;
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -2776,8 +2778,7 @@ var DeeplineClient = class {
         ...forceToolRefresh ? { forceToolRefresh: true } : {},
         ...typeof request.waitForCompletionMs === "number" ? { waitForCompletionMs: request.waitForCompletionMs } : {},
         // Profile selection is the API's job, not the CLI's. The server
-        // defaults to absurd; callers that need workers_edge pass
-        // `request.profile` explicitly.
+        // defaults to absurd; callers normally omit this field.
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.214",
+  "version": "0.1.216",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {