deepline 0.1.67 → 0.1.69

package/dist/cli/index.mjs

@@ -206,10 +206,10 @@ import { join as join2 } from "path";
 
 // src/release.ts
 var SDK_RELEASE = {
-  version: "0.1.67",
+  version: "0.1.69",
   apiContract: "2026-05-play-bootstrap-dataset-summary",
   supportPolicy: {
-    latest: "0.1.67",
+    latest: "0.1.69",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53"
   }
@@ -716,7 +716,7 @@ var DeeplineClient = class {
       list: (options2) => this.listRuns(options2),
       tail: (runId, options2) => this.tailRun(runId, options2),
       logs: (runId, options2) => this.getRunLogs(runId, options2),
-      exportDatasetRows: (input) => this.getPlaySheetRows(input),
+      exportDatasetRows: (input2) => this.getPlaySheetRows(input2),
       stop: (runId, options2) => this.stopRun(runId, options2)
     };
   }
@@ -803,6 +803,22 @@ var DeeplineClient = class {
     };
   }
   // ——————————————————————————————————————————————————————————
+  // Secrets
+  // ——————————————————————————————————————————————————————————
+  async listSecrets() {
+    const response = await this.http.get(
+      "/api/v2/secrets"
+    );
+    return Array.isArray(response.secrets) ? response.secrets : [];
+  }
+  async checkSecret(name) {
+    const normalized = name.trim().toUpperCase();
+    const secrets = await this.listSecrets();
+    return secrets.find(
+      (secret) => secret.name === normalized && secret.status === "active" && secret.hasValue
+    ) ?? null;
+  }
+  // ——————————————————————————————————————————————————————————
   // Tools
   // ——————————————————————————————————————————————————————————
   /**
@@ -895,24 +911,24 @@ var DeeplineClient = class {
    * Top-level fields such as `status`, `job_id`, and `billing` describe the
    * Deepline execution envelope.
    */
-  async executeTool(toolId, input, options) {
+  async executeTool(toolId, input2, options) {
     const headers = {
       [EXECUTE_RESPONSE_CONTRACT_HEADER]: V2_EXECUTE_RESPONSE_CONTRACT,
       ...options?.includeToolMetadata ? { [INCLUDE_TOOL_METADATA_HEADER]: "true" } : {}
     };
     return this.http.post(
       `/api/v2/integrations/${encodeURIComponent(toolId)}/execute`,
-      { payload: input },
+      { payload: input2 },
       headers
     );
   }
-  async executeToolRaw(toolId, input, options) {
-    return this.executeTool(toolId, input, options);
+  async executeToolRaw(toolId, input2, options) {
+    return this.executeTool(toolId, input2, options);
   }
-  async queryCustomerDb(input) {
+  async queryCustomerDb(input2) {
     return this.http.post("/api/v2/db/query", {
-      sql: input.sql,
-      ...input.maxRows ? { max_rows: input.maxRows } : {}
+      sql: input2.sql,
+      ...input2.maxRows ? { max_rows: input2.maxRows } : {}
     });
   }
   // ——————————————————————————————————————————————————————————
@@ -1019,15 +1035,15 @@ var DeeplineClient = class {
    * Internal/advanced primitive used by packaging flows. Public callers should
    * prefer the CLI, {@link submitPlay}, or {@link runPlay}.
    */
-  async registerPlayArtifact(input) {
-    const compilerManifest = input.compilerManifest ?? await this.compilePlayManifest({
-      name: input.name,
-      sourceCode: input.sourceCode,
-      sourceFiles: input.sourceFiles,
-      artifact: input.artifact
+  async registerPlayArtifact(input2) {
+    const compilerManifest = input2.compilerManifest ?? await this.compilePlayManifest({
+      name: input2.name,
+      sourceCode: input2.sourceCode,
+      sourceFiles: input2.sourceFiles,
+      artifact: input2.artifact
     });
     return this.http.post("/api/v2/plays/artifacts", {
-      ...input,
+      ...input2,
       compilerManifest
     });
   }
@@ -1047,14 +1063,14 @@ var DeeplineClient = class {
       artifacts: compiledArtifacts
     });
   }
-  async compilePlayManifest(input) {
+  async compilePlayManifest(input2) {
     const retryDelays = COMPILE_MANIFEST_RETRY_DELAYS_MS.slice(
       0,
       Math.max(0, this.config.maxRetries)
     );
     for (let attempt = 0; ; attempt += 1) {
       try {
-        const response = await this.http.post("/api/v2/plays/compile-manifest", input);
+        const response = await this.http.post("/api/v2/plays/compile-manifest", input2);
         return response.compilerManifest;
       } catch (error) {
         const delayMs = retryDelays[attempt];
@@ -1072,21 +1088,21 @@ var DeeplineClient = class {
    * publish a revision, or start a run. It is the authoritative cloud validation
    * path used by `deepline play check`.
    */
-  async checkPlayArtifact(input) {
-    return this.http.post("/api/v2/plays/check", input);
-  }
-  async startPlayRunFromBundle(input) {
-    const compilerManifest = input.compilerManifest ?? await this.compilePlayManifest({
-      name: input.name,
-      sourceCode: input.sourceCode,
-      sourceFiles: input.sourceFiles,
-      artifact: input.artifact
+  async checkPlayArtifact(input2) {
+    return this.http.post("/api/v2/plays/check", input2);
+  }
+  async startPlayRunFromBundle(input2) {
+    const compilerManifest = input2.compilerManifest ?? await this.compilePlayManifest({
+      name: input2.name,
+      sourceCode: input2.sourceCode,
+      sourceFiles: input2.sourceFiles,
+      artifact: input2.artifact
     });
     const registeredArtifact = await this.registerPlayArtifact({
-      name: input.name,
-      sourceCode: input.sourceCode,
-      sourceFiles: input.sourceFiles,
-      artifact: input.artifact,
+      name: input2.name,
+      sourceCode: input2.sourceCode,
+      sourceFiles: input2.sourceFiles,
+      artifact: input2.artifact,
       compilerManifest,
       publish: false
     });
@@ -1096,13 +1112,13 @@ var DeeplineClient = class {
       );
     }
     return this.startPlayRun({
-      name: input.name,
+      name: input2.name,
       artifactStorageKey: registeredArtifact.artifactStorageKey,
       compilerManifest,
-      ...input.input ? { input: input.input } : {},
-      ...input.inputFile ? { inputFile: input.inputFile } : {},
-      ...input.packagedFiles?.length ? { packagedFiles: input.packagedFiles } : {},
-      ...input.force ? { force: true } : {}
+      ...input2.input ? { input: input2.input } : {},
+      ...input2.inputFile ? { inputFile: input2.inputFile } : {},
+      ...input2.packagedFiles?.length ? { packagedFiles: input2.packagedFiles } : {},
+      ...input2.force ? { force: true } : {}
     });
   }
   /**
@@ -1447,17 +1463,17 @@ var DeeplineClient = class {
       entries
     };
   }
-  async getPlaySheetRows(input) {
+  async getPlaySheetRows(input2) {
     const params = new URLSearchParams({
-      tableNamespace: input.tableNamespace,
-      limit: String(input.limit ?? 5e3),
-      offset: String(input.offset ?? 0)
+      tableNamespace: input2.tableNamespace,
+      limit: String(input2.limit ?? 5e3),
+      offset: String(input2.offset ?? 0)
     });
-    if (input.runId?.trim()) {
-      params.set("runId", input.runId.trim());
+    if (input2.runId?.trim()) {
+      params.set("runId", input2.runId.trim());
     }
     return await this.http.get(
-      `/api/v2/plays/${encodeURIComponent(input.playName)}/sheet?${params.toString()}`
+      `/api/v2/plays/${encodeURIComponent(input2.playName)}/sheet?${params.toString()}`
     );
   }
   /**
@@ -1906,7 +1922,7 @@ function browserAppNameFromBundleId(bundleId) {
 }
 function readDefaultMacBrowserBundleId(runner = defaultBrowserCommandRunner) {
   try {
-    const output = runner.execFileSync(
+    const output2 = runner.execFileSync(
       "/usr/bin/defaults",
       [
         "read",
@@ -1915,10 +1931,10 @@ function readDefaultMacBrowserBundleId(runner = defaultBrowserCommandRunner) {
       ],
       { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
     );
-    const httpsMatch = output.match(
+    const httpsMatch = output2.match(
       /LSHandlerURLScheme\s*=\s*https;[\s\S]*?LSHandlerRole(?:All|Viewer|Editor)\s*=\s*"([^"]+)"/
     );
-    const httpMatch = output.match(
+    const httpMatch = output2.match(
       /LSHandlerURLScheme\s*=\s*http;[\s\S]*?LSHandlerRole(?:All|Viewer|Editor)\s*=\s*"([^"]+)"/
     );
     return (httpsMatch?.[1] ?? httpMatch?.[1] ?? "").trim();
@@ -3363,9 +3379,9 @@ function stripCsvProjectionColumns(columns, rows) {
     (column) => column !== CSV_PROJECTED_FIELDS_KEY && !projectedFields.has(column)
   );
 }
-function sanitizeCsvProjectionInfo(input) {
-  const columns = stripCsvProjectionColumns(input.columns, input.rows);
-  const rows = input.rows.map(stripCsvProjectionFields);
+function sanitizeCsvProjectionInfo(input2) {
+  const columns = stripCsvProjectionColumns(input2.columns, input2.rows);
+  const rows = input2.rows.map(stripCsvProjectionFields);
   return { rows, columns };
 }
 function isRecord2(value) {
@@ -3421,8 +3437,8 @@ function inferColumns(rows) {
   }
   return columns;
 }
-function canonicalRowsInfoFromCandidate(input) {
-  const candidate = input;
+function canonicalRowsInfoFromCandidate(input2) {
+  const candidate = input2;
   if (isSerializedDataset(candidate.value)) {
     const rawRows = rowArray(candidate.value.preview) ?? [];
     const totalRows2 = readNumber(candidate.value.count) ?? rawRows.length;
@@ -3463,31 +3479,31 @@ function canonicalRowsInfoFromCandidate(input) {
     source: candidate.source
   };
 }
-function collectDatasetCandidates(input) {
-  if (input.depth && input.depth > 16) {
+function collectDatasetCandidates(input2) {
+  if (input2.depth && input2.depth > 16) {
     return;
   }
-  if (isSerializedDataset(input.value)) {
-    input.output.push({
-      source: input.path,
-      value: input.value,
-      total: input.total
+  if (isSerializedDataset(input2.value)) {
+    input2.output.push({
+      source: input2.path,
+      value: input2.value,
+      total: input2.total
     });
     return;
   }
-  if (!isRecord2(input.value)) {
+  if (!isRecord2(input2.value)) {
     return;
   }
-  for (const [key, child] of Object.entries(input.value)) {
+  for (const [key, child] of Object.entries(input2.value)) {
     if (key === "preview" || key === "access") {
       continue;
     }
     collectDatasetCandidates({
       value: child,
-      path: `${input.path}.${key}`,
-      total: totalRowsForDataset(input.value, `${input.path}.${key}`),
-      output: input.output,
-      depth: (input.depth ?? 0) + 1
+      path: `${input2.path}.${key}`,
+      total: totalRowsForDataset(input2.value, `${input2.path}.${key}`),
+      output: input2.output,
+      depth: (input2.depth ?? 0) + 1
     });
   }
 }
@@ -4005,26 +4021,26 @@ function writeCustomerDbCsv(result, outPath) {
   );
   return resolved;
 }
-function dbQueryExportEnvelope(input) {
-  const destination = input.outPath ?? "stdout";
+function dbQueryExportEnvelope(input2) {
+  const destination = input2.outPath ?? "stdout";
   return {
-    command: input.result.command,
-    format: input.format,
-    row_count: input.result.row_count,
-    row_count_returned: input.result.row_count_returned,
-    truncated: input.result.truncated,
-    ...input.outPath ? { file: input.outPath, local: { file: input.outPath } } : {},
-    next: { toolEquivalent: input.toolCommand },
+    command: input2.result.command,
+    format: input2.format,
+    row_count: input2.result.row_count,
+    row_count_returned: input2.result.row_count_returned,
+    truncated: input2.result.truncated,
+    ...input2.outPath ? { file: input2.outPath, local: { file: input2.outPath } } : {},
+    next: { toolEquivalent: input2.toolCommand },
     render: {
       sections: [
         {
           title: "customer db export",
           lines: [
-            `Rendered ${input.result.row_count_returned} row(s) as ${input.format} to ${destination}`
+            `Rendered ${input2.result.row_count_returned} row(s) as ${input2.format} to ${destination}`
           ]
         }
       ],
-      actions: [{ label: "Tool equivalent", command: input.toolCommand }]
+      actions: [{ label: "Tool equivalent", command: input2.toolCommand }]
     }
   };
 }
@@ -4475,16 +4491,63 @@ var PLAY_RUNTIME_FEATURES = [
   "durable_sleep",
   "packaged_files"
 ];
-function buildPlayContractCompatibility(input) {
+function buildPlayContractCompatibility(input2) {
   return {
     apiVersion: PLAY_PUBLIC_API_VERSION,
     artifactVersion: PLAY_ARTIFACT_VERSION,
     minRunnerVersion: PLAY_MIN_RUNNER_VERSION,
     runtimeFeatures: [...PLAY_RUNTIME_FEATURES],
-    runtimeBackend: input?.runtimeBackend ?? null
+    runtimeBackend: input2?.runtimeBackend ?? null
   };
 }
 
+// ../shared_libs/plays/secret-guardrails.ts
+var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
+var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
+var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
+var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+function shannonEntropy(value) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
+  return [...counts.values()].reduce((entropy, count) => {
+    const p = count / value.length;
+    return entropy - p * Math.log2(p);
+  }, 0);
+}
+function validatePlaySourceHasNoInlineSecrets(input2) {
+  const findings = [];
+  for (const match of input2.sourceCode.matchAll(SECRET_ENV_PATTERN)) {
+    findings.push(`process.env.${match[1]}`);
+  }
+  if (PRIVATE_KEY_PATTERN.test(input2.sourceCode)) findings.push("private key block");
+  if (BEARER_LITERAL_PATTERN.test(input2.sourceCode)) findings.push("bearer token literal");
+  if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(input2.sourceCode)) {
+    findings.push("secret-looking assignment literal");
+  }
+  for (const match of input2.sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
+    const literal = match[1] ?? "";
+    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
+      findings.push("high-entropy string literal");
+      break;
+    }
+  }
+  if (!findings.length) return;
+  throw new Error(
+    [
+      `Play source ${input2.filePath} appears to contain inline secret material: ${[
+        ...new Set(findings)
+      ].join(", ")}.`,
+      'Author secrets in the dashboard and use ctx.secrets.get("NAME") with an approved helper such as ctx.secrets.bearer(handle).'
+    ].join(" ")
+  );
+}
+function validatePlaySourceFilesHaveNoInlineSecrets(sourceFiles) {
+  for (const [filePath, sourceCode] of Object.entries(sourceFiles)) {
+    validatePlaySourceHasNoInlineSecrets({ filePath, sourceCode });
+  }
+}
+
 // ../shared_libs/plays/bundling/index.ts
 var PLAY_BUNDLE_CACHE_VERSION = 24;
 var MAX_PLAY_BUNDLE_BYTES = 30 * 1024 * 1024;
@@ -4546,12 +4609,12 @@ function createPlayWorkspace(entryFile) {
 function isPathInsideDirectory(filePath, directory) {
   return filePath === directory || filePath.startsWith(`${directory}/`);
 }
-function assertWithinPlayWorkspace(input) {
-  if (isPathInsideDirectory(input.resolvedPath, input.workspace.rootDir)) {
+function assertWithinPlayWorkspace(input2) {
+  if (isPathInsideDirectory(input2.resolvedPath, input2.workspace.rootDir)) {
     return;
   }
   throw new Error(
-    `${input.importer}:${input.line}:${input.column} Local play imports must stay inside the play workspace (${input.workspace.rootDir}). Import "${input.specifier}" resolved to ${input.resolvedPath}, which crosses into app/backend code. Use the public SDK/API surface or move shared helpers into the play workspace.`
+    `${input2.importer}:${input2.line}:${input2.column} Local play imports must stay inside the play workspace (${input2.workspace.rootDir}). Import "${input2.specifier}" resolved to ${input2.resolvedPath}, which crosses into app/backend code. Use the public SDK/API surface or move shared helpers into the play workspace.`
   );
 }
 function getPackageName(specifier) {
@@ -5406,6 +5469,15 @@ entry-export:${exportName}`
 workers-harness:${harnessFingerprint}`
       );
     }
+    try {
+      validatePlaySourceFilesHaveNoInlineSecrets(analysis.sourceFiles);
+    } catch (error) {
+      return {
+        success: false,
+        filePath: absolutePath,
+        errors: [error instanceof Error ? error.message : String(error)]
+      };
+    }
     const typecheckErrors = [
       ...await adapter.typecheckPlaySource?.({
         sourceCode: analysis.sourceCode,
@@ -6015,11 +6087,13 @@ function createSdkPlayBundlingAdapter() {
   };
 }
 async function bundlePlayFile2(filePath, options = {}) {
-  return bundlePlayFile(filePath, {
+  const result = await bundlePlayFile(filePath, {
     target: options.target ?? defaultPlayBundleTarget(),
     exportName: options.exportName,
     adapter: createSdkPlayBundlingAdapter()
   });
+  if (result.success) validatePlaySourceFilesHaveNoInlineSecrets(result.sourceFiles);
+  return result;
 }
 
 // src/cli/commands/plays/bootstrap.ts
@@ -6613,28 +6687,28 @@ function objectPropertySchema(schema, property) {
 function finderResultTypeName(finder) {
   return finder === "email_finder" ? "EmailFinderPlayResult" : "PhoneFinderPlayResult";
 }
-function renderFinderPlayResultType(input) {
-  if (!input.play) return null;
-  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input.finder];
+function renderFinderPlayResultType(input2) {
+  if (!input2.play) return null;
+  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input2.finder];
   const fieldSchema = objectPropertySchema(
-    input.play.outputSchema,
+    input2.play.outputSchema,
     outputField
   );
   const fieldType = fieldSchema ? jsonSchemaTypeExpression(fieldSchema) : "string | null";
-  return `type ${finderResultTypeName(input.finder)} =
+  return `type ${finderResultTypeName(input2.finder)} =
   | string
   | null
   | {
       ${outputField}?: ${fieldType};
     };`;
 }
-function generatedFinderPlayResultTypes(input) {
+function generatedFinderPlayResultTypes(input2) {
   return ["email_finder", "phone_finder"].flatMap((finder) => {
-    const stage = finderStage(input.options, finder);
+    const stage = finderStage(input2.options, finder);
     if (stage?.kind !== "play") return [];
     const typeDefinition = renderFinderPlayResultType({
       finder,
-      play: input.finderPlays[finder]
+      play: input2.finderPlays[finder]
     });
     return typeDefinition ? [typeDefinition] : [];
   }).join("\n\n");
@@ -6692,8 +6766,8 @@ function generateCompanyInputObjectFromSchema(schema, indent, label, fallbackFie
 ${lines.join("\n")}
 ${indent.slice(2)}}`;
 }
-function generateSourceProviderInputObject(input) {
-  const { tool, indent, label, entity } = input;
+function generateSourceProviderInputObject(input2) {
+  const { tool, indent, label, entity } = input2;
   const properties = inputPropertyNames(tool?.inputSchema);
   const details = schemaFieldDetails(tool?.inputSchema);
   const required = details.required;
@@ -6751,8 +6825,8 @@ function generateSourceProviderInputObject(input) {
 ${lines.join("\n")}
 ${indent.slice(2)}}`;
 }
-function generatePlayInputObject(input) {
-  const { schema, indent, label, entity } = input;
+function generatePlayInputObject(input2) {
+  const { schema, indent, label, entity } = input2;
   const details = schemaFieldDetails(schema);
   const fallback = entity === "company" ? ["domain", "company_name"] : ["first_name", "last_name", "domain"];
   const required = details.required.length ? details.required : fallback;
@@ -6819,80 +6893,80 @@ function needsWhenImport(options) {
 function sourceCollectionTypeName(entity) {
   return entity === "company" ? "CompanySourceRow" : "ContactSourceRow";
 }
-function renderPartialRowType(input) {
-  if (input.fields.length === 0) {
-    return `type ${input.typeName} = Record<string, unknown>;`;
+function renderPartialRowType(input2) {
+  if (input2.fields.length === 0) {
+    return `type ${input2.typeName} = Record<string, unknown>;`;
   }
-  const properties = input.fields.map((field) => `  ${jsString(field)}?: unknown;`).join("\n");
-  return `type ${input.typeName} = Record<string, unknown> & Partial<{
-  // ${input.comment}
+  const properties = input2.fields.map((field) => `  ${jsString(field)}?: unknown;`).join("\n");
+  return `type ${input2.typeName} = Record<string, unknown> & Partial<{
+  // ${input2.comment}
 ${properties}
 }>;`;
 }
-function fieldsFromSchemaDetails(input) {
+function fieldsFromSchemaDetails(input2) {
   return [
-    ...input.details.required.length ? input.details.required : input.fallbackFields,
-    ...input.details.optional
+    ...input2.details.required.length ? input2.details.required : input2.fallbackFields,
+    ...input2.details.optional
   ];
 }
-function schemaFieldsForStage(stage, input) {
+function schemaFieldsForStage(stage, input2) {
   switch (stage?.kind) {
     case void 0:
       return [];
     case "play":
       return fieldsFromSchemaDetails({
-        details: schemaFieldDetails(input.play?.inputSchema),
-        fallbackFields: input.fallbackFields
+        details: schemaFieldDetails(input2.play?.inputSchema),
+        fallbackFields: input2.fallbackFields
       });
     case "providers":
-      return input.tools.flatMap(
+      return input2.tools.flatMap(
         (tool) => fieldsFromSchemaDetails({
           details: schemaFieldDetails(tool.inputSchema),
-          fallbackFields: input.fallbackFields
+          fallbackFields: input2.fallbackFields
         })
       );
   }
 }
-function sourceRowTypeDefinition(input) {
-  switch (input.options.from.kind) {
+function sourceRowTypeDefinition(input2) {
+  switch (input2.options.from.kind) {
     case "csv":
-      return `type ${input.sourceTypeName} = SourceCsvRow;`;
+      return `type ${input2.sourceTypeName} = SourceCsvRow;`;
     case "providers":
       return renderPartialRowType({
-        typeName: input.sourceTypeName,
+        typeName: input2.sourceTypeName,
         fields: [
-          ...new Set(input.sourceTools.flatMap(listRowCandidateKeysFromTool))
+          ...new Set(input2.sourceTools.flatMap(listRowCandidateKeysFromTool))
         ].sort(),
         comment: "Candidate source row keys from described list getters; confirm the actual provider keys with source_*.extractedLists.*.keys before mapping."
       });
     case "play": {
-      const details = schemaFieldDetails(input.sourcePlay?.outputSchema);
+      const details = schemaFieldDetails(input2.sourcePlay?.outputSchema);
       return renderPartialRowType({
-        typeName: input.sourceTypeName,
+        typeName: input2.sourceTypeName,
         fields: [...details.required, ...details.optional].sort(),
         comment: "Candidate source play output fields; confirm the selected rows field before mapping."
       });
     }
   }
 }
-function contactBridgeRowTypeDefinition(input) {
-  const config = playBootstrapTemplateConfig(input.options.template);
-  if (config.sourceEntity !== "company" || !input.options.people) return null;
-  const emailFields = schemaFieldsForStage(input.options.email, {
-    tools: input.finderTools.email_finder ?? [],
-    play: input.finderPlays.email_finder,
+function contactBridgeRowTypeDefinition(input2) {
+  const config = playBootstrapTemplateConfig(input2.options.template);
+  if (config.sourceEntity !== "company" || !input2.options.people) return null;
+  const emailFields = schemaFieldsForStage(input2.options.email, {
+    tools: input2.finderTools.email_finder ?? [],
+    play: input2.finderPlays.email_finder,
     fallbackFields: ["first_name", "last_name", "domain"]
   });
-  const phoneFields = schemaFieldsForStage(input.options.phone, {
-    tools: input.finderTools.phone_finder ?? [],
-    play: input.finderPlays.phone_finder,
+  const phoneFields = schemaFieldsForStage(input2.options.phone, {
+    tools: input2.finderTools.phone_finder ?? [],
+    play: input2.finderPlays.phone_finder,
     fallbackFields: ["first_name", "last_name", "domain"]
   });
   return renderPartialRowType({
     typeName: "ContactSourceRow",
     fields: [
       .../* @__PURE__ */ new Set([
-        ...inputPropertyNames(input.peoplePlay?.outputSchema),
+        ...inputPropertyNames(input2.peoplePlay?.outputSchema),
         ...emailFields,
         ...phoneFields
       ])
@@ -6900,27 +6974,27 @@ function contactBridgeRowTypeDefinition(input) {
     comment: "Fields the people play or later finder stages may need; the generated code still requires explicit mapping."
   });
 }
-function generateRowTypeDefinitions(input) {
-  const config = playBootstrapTemplateConfig(input.options.template);
+function generateRowTypeDefinitions(input2) {
+  const config = playBootstrapTemplateConfig(input2.options.template);
   const sourceTypeName = sourceCollectionTypeName(config.sourceEntity);
   const definitions = [
     sourceRowTypeDefinition({
-      options: input.options,
+      options: input2.options,
       sourceTypeName,
-      sourceTools: input.sourceTools,
-      sourcePlay: input.sourcePlay
+      sourceTools: input2.sourceTools,
+      sourcePlay: input2.sourcePlay
     }),
-    contactBridgeRowTypeDefinition(input)
+    contactBridgeRowTypeDefinition(input2)
   ];
   return definitions.filter(Boolean).join("\n\n");
 }
-function validateBootstrapRoutes(input) {
-  const config = playBootstrapTemplateConfig(input.options.template);
+function validateBootstrapRoutes(input2) {
+  const config = playBootstrapTemplateConfig(input2.options.template);
   const sourceCategory = config.sourceEntity === "company" ? PLAY_BOOTSTRAP_COMPANY_PROVIDER_CATEGORY : PLAY_BOOTSTRAP_PEOPLE_PROVIDER_CATEGORY;
-  for (const tool of input.sourceTools) {
+  for (const tool of input2.sourceTools) {
     if (!tool.categories.includes(sourceCategory)) {
       throw new PlayBootstrapValidationError(
-        `Cannot use ${tool.toolId} as a ${config.sourceEntity} source for ${input.options.template}: expected category ${sourceCategory}, got ${tool.categories.join(", ") || "none"}. Run: deepline tools grep ${sourceCategory} --categories ${sourceCategory} --json`
+        `Cannot use ${tool.toolId} as a ${config.sourceEntity} source for ${input2.options.template}: expected category ${sourceCategory}, got ${tool.categories.join(", ") || "none"}. Run: deepline tools grep ${sourceCategory} --categories ${sourceCategory} --json`
       );
     }
     if (getterNamesFromTool(tool, "list").length === 0) {
@@ -6929,14 +7003,14 @@ function validateBootstrapRoutes(input) {
       );
     }
   }
-  if (input.options.people?.kind === "providers") {
+  if (input2.options.people?.kind === "providers") {
     throw new PlayBootstrapValidationError(
       "Company-to-people bootstrap only accepts --people play:<play-ref> for now. Providers are too task-specific; choose or create a people play so the generated file can show the mapping contract."
     );
   }
   for (const finder of ["email_finder", "phone_finder"]) {
     const requiredCategory = PLAY_BOOTSTRAP_PROVIDER_CATEGORY_BY_FINDER[finder];
-    for (const tool of input.finderTools[finder] ?? []) {
+    for (const tool of input2.finderTools[finder] ?? []) {
       if (!tool.categories.includes(requiredCategory)) {
         throw new PlayBootstrapValidationError(
           `Cannot use ${tool.toolId} for ${finder}: expected category ${requiredCategory}, got ${tool.categories.join(", ") || "none"}. Run: deepline tools grep ${requiredCategory} --categories ${requiredCategory} --json`
@@ -6958,118 +7032,118 @@ function sourceCollectionName(entity) {
       return "contacts";
   }
 }
-function requiredGetterName(input) {
-  const getter = getterNamesFromTool(input.tool, input.kind)[0];
+function requiredGetterName(input2) {
+  const getter = getterNamesFromTool(input2.tool, input2.kind)[0];
   if (!getter) {
-    switch (input.kind) {
+    switch (input2.kind) {
       case "list":
         throw new PlayBootstrapValidationError(
-          `Cannot use ${input.label} as a source: it exposes no extracted list getters.`
+          `Cannot use ${input2.label} as a source: it exposes no extracted list getters.`
         );
       case "value":
         throw new PlayBootstrapValidationError(
-          `Cannot use ${input.label} as a finder: it exposes no extracted value getters.`
+          `Cannot use ${input2.label} as a finder: it exposes no extracted value getters.`
         );
     }
   }
   return getter;
 }
-function generateCsvSourceRowsBlock(input) {
-  return `const sourceDataset = await ctx.csv<SourceCsvRow>(${jsString(input.packagedSourceCsvPath ?? input.source.value)});
-  const ${input.collection}: ${input.collectionType}[] = await sourceDataset.peek(limit);`;
+function generateCsvSourceRowsBlock(input2) {
+  return `const sourceDataset = await ctx.csv<SourceCsvRow>(${jsString(input2.packagedSourceCsvPath ?? input2.source.value)});
+  const ${input2.collection}: ${input2.collectionType}[] = await sourceDataset.peek(limit);`;
 }
-function generatePlaySourceRowsBlock(input) {
+function generatePlaySourceRowsBlock(input2) {
   const playInput = generatePlayInputObject({
-    schema: input.sourcePlay?.inputSchema,
+    schema: input2.sourcePlay?.inputSchema,
     indent: "    ",
-    label: input.source.value,
-    entity: input.entity
+    label: input2.source.value,
+    entity: input2.entity
   });
   return `const sourceInput = ${playInput};
-  throw new Error(${jsString(`TODO: map sourceInput for ${input.source.value}, choose the play output rows field, then delete this throw.`)});
-  const sourceResult = await ctx.runPlay('source_play', ${jsString(input.source.value)}, sourceInput, {
-    description: ${jsString(`Seed ${input.entity} rows from the selected play.`)},
+  throw new Error(${jsString(`TODO: map sourceInput for ${input2.source.value}, choose the play output rows field, then delete this throw.`)});
+  const sourceResult = await ctx.runPlay('source_play', ${jsString(input2.source.value)}, sourceInput, {
+    description: ${jsString(`Seed ${input2.entity} rows from the selected play.`)},
   });
   // TODO: Replace sourceResult.rows with the selected play's actual row output field.
-  const ${input.collection}: ${input.collectionType}[] = (sourceResult.rows ?? []) as ${input.collectionType}[];`;
+  const ${input2.collection}: ${input2.collectionType}[] = (sourceResult.rows ?? []) as ${input2.collectionType}[];`;
 }
-function generateProviderSourceBlock(input) {
+function generateProviderSourceBlock(input2) {
   const getter = requiredGetterName({
-    tool: input.tool,
+    tool: input2.tool,
     kind: "list",
-    label: input.provider
+    label: input2.provider
   });
-  const inputName = `${input.entity}Input_${input.index}`;
-  return `// ${input.entity === "company" ? "Company" : "People"} source provider: ${input.provider}
+  const inputName = `${input2.entity}Input_${input2.index}`;
+  return `// ${input2.entity === "company" ? "Company" : "People"} source provider: ${input2.provider}
   const ${inputName}: Record<string, unknown> = ${generateSourceProviderInputObject(
     {
-      tool: input.tool,
+      tool: input2.tool,
       indent: "    ",
-      label: input.provider,
-      entity: input.entity
+      label: input2.provider,
+      entity: input2.entity
     }
   )};
-  throw new Error(${jsString(`TODO: fill ${inputName} for ${input.provider}, then delete this throw.`)});
-  const source_${input.index} = await ctx.tools.execute({
-    id: ${jsString(`${input.entity}_source_${input.index}`)},
-    tool: ${jsString(input.provider)},
+  throw new Error(${jsString(`TODO: fill ${inputName} for ${input2.provider}, then delete this throw.`)});
+  const source_${input2.index} = await ctx.tools.execute({
+    id: ${jsString(`${input2.entity}_source_${input2.index}`)},
+    tool: ${jsString(input2.provider)},
     input: ${inputName},
-    description: ${jsString(`Seed ${input.entity} rows from ${input.provider}.`)},
+    description: ${jsString(`Seed ${input2.entity} rows from ${input2.provider}.`)},
   });
   // extractedLists.${getter}.get() returns provider-shaped rows. Do not assume canonical fields;
-  // inspect source_${input.index}.extractedLists.${getter}.keys or the provider output schema, then map explicitly below.
-  const sourceRows_${input.index} = ${accessorExpression(`source_${input.index}.extractedLists`, getter)}.get() as ${input.collectionType}[];`;
+  // inspect source_${input2.index}.extractedLists.${getter}.keys or the provider output schema, then map explicitly below.
+  const sourceRows_${input2.index} = ${accessorExpression(`source_${input2.index}.extractedLists`, getter)}.get() as ${input2.collectionType}[];`;
 }
-function generateProviderSourceRowsBlock(input) {
-  const blocks = input.source.values.map(
+function generateProviderSourceRowsBlock(input2) {
+  const blocks = input2.source.values.map(
     (provider, index) => generateProviderSourceBlock({
       provider,
       index,
-      tool: input.sourceTools[index] ?? null,
-      entity: input.entity,
-      collectionType: input.collectionType
+      tool: input2.sourceTools[index] ?? null,
+      entity: input2.entity,
+      collectionType: input2.collectionType
     })
   );
   return `${blocks.join("\n\n  ")}
-  const ${input.collection}: ${input.collectionType}[] = [${input.source.values.map((_, index) => `...sourceRows_${index}`).join(", ")}];`;
+  const ${input2.collection}: ${input2.collectionType}[] = [${input2.source.values.map((_, index) => `...sourceRows_${index}`).join(", ")}];`;
 }
-function generateSourceRowsBlock(input) {
-  const config = playBootstrapTemplateConfig(input.options.template);
+function generateSourceRowsBlock(input2) {
+  const config = playBootstrapTemplateConfig(input2.options.template);
   const entity = config.sourceEntity;
   const collection = sourceCollectionName(entity);
   const collectionType = sourceCollectionTypeName(entity);
-  switch (input.options.from.kind) {
+  switch (input2.options.from.kind) {
     case "csv":
       return generateCsvSourceRowsBlock({
-        source: input.options.from,
+        source: input2.options.from,
         collection,
         collectionType,
-        packagedSourceCsvPath: input.packagedSourceCsvPath
+        packagedSourceCsvPath: input2.packagedSourceCsvPath
       });
     case "play":
       return generatePlaySourceRowsBlock({
-        source: input.options.from,
-        sourcePlay: input.sourcePlay,
+        source: input2.options.from,
+        sourcePlay: input2.sourcePlay,
         entity,
         collection,
         collectionType
       });
     case "providers":
       return generateProviderSourceRowsBlock({
-        source: input.options.from,
-        sourceTools: input.sourceTools,
+        source: input2.options.from,
+        sourceTools: input2.sourceTools,
         entity,
         collection,
         collectionType
       });
   }
 }
-function generateSourceSeedBlock(input) {
-  const sourceRows = generateSourceRowsBlock(input);
-  const peoplePlayRef = stagePlayRef(input.options.people);
+function generateSourceSeedBlock(input2) {
+  const sourceRows = generateSourceRowsBlock(input2);
+  const peoplePlayRef = stagePlayRef(input2.options.people);
   if (!peoplePlayRef) return sourceRows;
   const peopleInput = generateCompanyInputObjectFromSchema(
-    input.peoplePlay?.inputSchema,
+    input2.peoplePlay?.inputSchema,
     "      ",
     peoplePlayRef,
     ["domain", "company_name"]
@@ -7091,15 +7165,15 @@ function generateSourceSeedBlock(input) {
     contacts.push(...((peopleResult.rows ?? []) as ContactSourceRow[]));
   }`;
 }
-function finderProviderStepName(input) {
-  return `${input.aggregateStepName}${input.index}_${safeIdentifier(input.provider)}`;
+function finderProviderStepName(input2) {
+  return `${input2.aggregateStepName}${input2.index}_${safeIdentifier(input2.provider)}`;
 }
-function finderValueGetter(input) {
-  const getters = getterNamesFromTool(input.tool, "value");
-  const getter = getters.find((name) => name === input.outputField) ?? requiredGetterName({
-    tool: input.tool,
+function finderValueGetter(input2) {
+  const getters = getterNamesFromTool(input2.tool, "value");
+  const getter = getters.find((name) => name === input2.outputField) ?? requiredGetterName({
+    tool: input2.tool,
     kind: "value",
-    label: input.provider
+    label: input2.provider
   });
   return getter;
 }
@@ -7107,157 +7181,157 @@ function optionalFinderValueExpression(candidateExpression, outputField) {
   const valueExpression = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(outputField) ? `${candidateExpression}?.${outputField}` : `${candidateExpression}?.[${jsString(outputField)}]`;
   return `${valueExpression}?.trim()`;
 }
-function generateFinderPlayStep(input) {
-  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input.finder];
-  const resultTypeName = finderResultTypeName(input.finder);
+function generateFinderPlayStep(input2) {
+  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input2.finder];
+  const resultTypeName = finderResultTypeName(input2.finder);
   const payload = generateContactInputObjectFromSchema(
-    input.play?.inputSchema,
+    input2.play?.inputSchema,
     "        ",
-    input.stage.value
+    input2.stage.value
   );
   return `.step(${jsString(outputField)}, async (row, rowCtx) => {
-      const ${input.aggregateStepName}Input = ${payload};
-      throw new Error(${jsString(`TODO: map ${input.aggregateStepName}Input for ${input.stage.value}, then delete this throw.`)});
-      const ${input.aggregateStepName}Result = await rowCtx.runPlay<${resultTypeName}>(
-        ${jsString(`${input.aggregateStepName}Play`)},
-        ${jsString(input.stage.value)},
-        ${input.aggregateStepName}Input,
+      const ${input2.aggregateStepName}Input = ${payload};
+      throw new Error(${jsString(`TODO: map ${input2.aggregateStepName}Input for ${input2.stage.value}, then delete this throw.`)});
+      const ${input2.aggregateStepName}Result = await rowCtx.runPlay<${resultTypeName}>(
+        ${jsString(`${input2.aggregateStepName}Play`)},
+        ${jsString(input2.stage.value)},
+        ${input2.aggregateStepName}Input,
         {
-          description: ${jsString(`Run ${input.finder} play.`)},
+          description: ${jsString(`Run ${input2.finder} play.`)},
         },
       );
-      return typeof ${input.aggregateStepName}Result === 'string'
-        ? ${input.aggregateStepName}Result.trim() || null
-        : ${input.aggregateStepName}Result?.${outputField} ?? null;
+      return typeof ${input2.aggregateStepName}Result === 'string'
+        ? ${input2.aggregateStepName}Result.trim() || null
+        : ${input2.aggregateStepName}Result?.${outputField} ?? null;
     })`;
 }
-function generateFinderProviderResolver(input) {
+function generateFinderProviderResolver(input2) {
   const payload = generateContactInputObjectFromSchema(
-    input.tool?.inputSchema,
+    input2.tool?.inputSchema,
     "        ",
-    input.provider
+    input2.provider
   );
   const getter = finderValueGetter({
-    tool: input.tool,
-    provider: input.provider,
-    outputField: input.outputField
+    tool: input2.tool,
+    provider: input2.provider,
+    outputField: input2.outputField
   });
   return `async (row, rowCtx) => {
       const providerInput = ${payload};
-      throw new Error(${jsString(`TODO: map providerInput for ${input.provider}, then delete this throw.`)});
+      throw new Error(${jsString(`TODO: map providerInput for ${input2.provider}, then delete this throw.`)});
       const result = await rowCtx.tools.execute({
-        id: ${jsString(`${input.aggregateStepName}_${input.providerIndex}`)},
-        tool: ${jsString(input.provider)},
+        id: ${jsString(`${input2.aggregateStepName}_${input2.providerIndex}`)},
+        tool: ${jsString(input2.provider)},
         input: providerInput,
-        description: ${jsString(`Try ${input.provider} as a ${input.finder}.`)},
+        description: ${jsString(`Try ${input2.provider} as a ${input2.finder}.`)},
       });
       return {
-        ${input.outputField}: (${accessorExpression("result.extractedValues", getter)}.get() as string | null) ?? null,
+        ${input2.outputField}: (${accessorExpression("result.extractedValues", getter)}.get() as string | null) ?? null,
         result,
       };
     }`;
 }
-function generateFinderProviderStep(input) {
-  const stepName = input.stepNames[input.index];
-  switch (input.index) {
+function generateFinderProviderStep(input2) {
+  const stepName = input2.stepNames[input2.index];
+  switch (input2.index) {
     case 0:
-      return `.step(${jsString(stepName)}, ${input.resolver})`;
+      return `.step(${jsString(stepName)}, ${input2.resolver})`;
     default: {
-      const priorCandidates = input.stepNames.slice(0, input.index).map((name) => `row.${name}`).join(", ");
+      const priorCandidates = input2.stepNames.slice(0, input2.index).map((name) => `row.${name}`).join(", ");
       return `.step(
       ${jsString(stepName)},
       when(
-        (row) => ![${priorCandidates}].some((candidate) => ${optionalFinderValueExpression("candidate", input.outputField)}),
-        ${input.resolver},
+        (row) => ![${priorCandidates}].some((candidate) => ${optionalFinderValueExpression("candidate", input2.outputField)}),
+        ${input2.resolver},
       ),
     )`;
     }
   }
 }
-function generateFinderProviderWaterfall(input) {
-  const legPrefix = finderProviderStepPrefix(input.finder);
-  const stepNames = input.stage.values.map(
+function generateFinderProviderWaterfall(input2) {
+  const legPrefix = finderProviderStepPrefix(input2.finder);
+  const stepNames = input2.stage.values.map(
     (provider, index) => finderProviderStepName({
       aggregateStepName: legPrefix,
       provider,
       index
     })
   );
-  const providerSteps = input.stage.values.map(
+  const providerSteps = input2.stage.values.map(
     (provider, index) => generateFinderProviderStep({
       index,
       stepNames,
-      outputField: input.outputField,
+      outputField: input2.outputField,
       resolver: generateFinderProviderResolver({
-        finder: input.finder,
+        finder: input2.finder,
         provider,
         providerIndex: index,
-        tool: input.tools[index] ?? null,
-        aggregateStepName: input.aggregateStepName,
-        outputField: input.outputField
+        tool: input2.tools[index] ?? null,
+        aggregateStepName: input2.aggregateStepName,
+        outputField: input2.outputField
       })
     })
   );
   const candidateNames = stepNames.map((name) => `row.${name}`).join(", ");
-  return `// ${input.aggregateStepName} provider waterfall. Each provider leg is active once its TODO throw is removed;
+  return `// ${input2.aggregateStepName} provider waterfall. Each provider leg is active once its TODO throw is removed;
     // delete or comment out legs you do not want before running. Later legs are gated with when(...).
     ${providerSteps.join("\n    ")}
-    .step(${jsString(input.aggregateStepName)}, (row) => {
+    .step(${jsString(input2.aggregateStepName)}, (row) => {
       const candidates = [${candidateNames}];
-      const match = candidates.find((candidate) => ${optionalFinderValueExpression("candidate", input.outputField)});
-      return ${optionalFinderValueExpression("match", input.outputField)} ?? null;
+      const match = candidates.find((candidate) => ${optionalFinderValueExpression("candidate", input2.outputField)});
+      return ${optionalFinderValueExpression("match", input2.outputField)} ?? null;
     })`;
 }
-function generateFinderStageSteps(input) {
-  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input.finder];
-  const aggregateStepName = stepFieldName(input.finder);
-  switch (input.stage.kind) {
+function generateFinderStageSteps(input2) {
+  const outputField = PLAY_BOOTSTRAP_OUTPUT_FIELD_BY_FINDER[input2.finder];
+  const aggregateStepName = stepFieldName(input2.finder);
+  switch (input2.stage.kind) {
     case "play":
       return generateFinderPlayStep({
-        finder: input.finder,
-        stage: input.stage,
-        play: input.finderPlays[input.finder],
+        finder: input2.finder,
+        stage: input2.stage,
+        play: input2.finderPlays[input2.finder],
         aggregateStepName
       });
     case "providers":
       return generateFinderProviderWaterfall({
-        finder: input.finder,
-        stage: input.stage,
-        tools: input.finderTools[input.finder] ?? [],
+        finder: input2.finder,
+        stage: input2.stage,
+        tools: input2.finderTools[input2.finder] ?? [],
         aggregateStepName,
         outputField
       });
   }
 }
-function generateFinderSteps(input) {
+function generateFinderSteps(input2) {
   return ["email_finder", "phone_finder"].flatMap((finder) => {
-    const stage = finderStage(input.options, finder);
+    const stage = finderStage(input2.options, finder);
     return stage ? [
       generateFinderStageSteps({
-        ...input,
+        ...input2,
         finder,
         stage
       })
     ] : [];
   }).join("\n    ");
 }
-function generateBootstrapPlaySource(input) {
-  const config = playBootstrapTemplateConfig(input.options.template);
-  const sourceSeedBlock = generateSourceSeedBlock(input);
-  const finderSteps = generateFinderSteps(input);
-  const hasPeople = config.sourceEntity === "people" || Boolean(input.options.people);
+function generateBootstrapPlaySource(input2) {
+  const config = playBootstrapTemplateConfig(input2.options.template);
+  const sourceSeedBlock = generateSourceSeedBlock(input2);
+  const finderSteps = generateFinderSteps(input2);
+  const hasPeople = config.sourceEntity === "people" || Boolean(input2.options.people);
   const sourceCollection = hasPeople ? "contacts" : "companies";
   const mapSteps = finderSteps ? `
     ${finderSteps}` : "";
-  const sourceCsvRowType = input.options.from.kind === "csv" ? renderSourceCsvRowType(input.sourceCsvColumns) : "";
-  const rowTypeDefinitions = generateRowTypeDefinitions(input);
-  const finderPlayResultTypes = generatedFinderPlayResultTypes(input);
+  const sourceCsvRowType = input2.options.from.kind === "csv" ? renderSourceCsvRowType(input2.sourceCsvColumns) : "";
+  const rowTypeDefinitions = generateRowTypeDefinitions(input2);
+  const finderPlayResultTypes = generatedFinderPlayResultTypes(input2);
   const typeDefinitions = [
     sourceCsvRowType.trimEnd(),
     rowTypeDefinitions,
     finderPlayResultTypes
   ].filter((definition) => definition.trim().length > 0).join("\n\n");
-  const importNames = needsWhenImport(input.options) ? "definePlay, when" : "definePlay";
+  const importNames = needsWhenImport(input2.options) ? "definePlay, when" : "definePlay";
   return `import { ${importNames} } from 'deepline';
 
 ${typeDefinitions}
@@ -7266,8 +7340,8 @@ type Input = {
   limit?: number;
 };
 
-export default definePlay(${jsString(input.options.name)}, async (ctx, input: Input = {}) => {
-  const limit = Math.max(1, Math.min(Number(input.limit ?? ${input.options.limit}), ${input.options.limit}));
+export default definePlay(${jsString(input2.options.name)}, async (ctx, input: Input = {}) => {
+  const limit = Math.max(1, Math.min(Number(input.limit ?? ${input2.options.limit}), ${input2.options.limit}));
   ${sourceSeedBlock}
 
   const rowsToProcess = ${sourceCollection}.slice(0, limit);
@@ -7279,7 +7353,7 @@ export default definePlay(${jsString(input.options.name)}, async (ctx, input: In
     .map('bootstrap_rows', rowsToProcess)${mapSteps}
     .run({
       key: (_row, index) => index,
-      description: ${jsString(`Bootstrap ${input.options.template}: seed source rows, run requested stages, then return the mapped rows.`)},
+      description: ${jsString(`Bootstrap ${input2.options.template}: seed source rows, run requested stages, then return the mapped rows.`)},
     });
 
   return {
@@ -7687,8 +7761,8 @@ var SHA256_ROUND_CONSTANTS = [
 function rightRotate32(value, bits) {
   return value >>> bits | value << 32 - bits;
 }
-function sha256Hex(input) {
-  const bytes = Array.from(new TextEncoder().encode(input));
+function sha256Hex(input2) {
+  const bytes = Array.from(new TextEncoder().encode(input2));
   const bitLength = bytes.length * 8;
   bytes.push(128);
   while (bytes.length % 64 !== 56) {
@@ -7862,10 +7936,10 @@ function looksLikeInvalidExtractedGetter(error, sourceLine) {
   if (!/Property '[^']+' does not exist on type/.test(error)) return false;
   return /\bextracted(?:Values|Lists)\s*\./.test(sourceLine);
 }
-function addPlayCheckRepairHints(input) {
+function addPlayCheckRepairHints(input2) {
   let addedHint = false;
-  return input.errors.map((error) => {
-    const line = sourceLineForError(input.sourceCode, error);
+  return input2.errors.map((error) => {
+    const line = sourceLineForError(input2.sourceCode, error);
     if (addedHint || !looksLikeInvalidExtractedGetter(error, line) || error.includes(EXTRACTED_GETTER_ERROR_HINT)) {
       return error;
     }
@@ -7927,9 +8001,9 @@ function parseReferencedPlayTarget2(target) {
 function isPrebuiltReferenceTarget(target) {
   return target.trim().toLowerCase().startsWith("prebuilt/");
 }
-function buildBarePrebuiltReferenceError(input) {
+function buildBarePrebuiltReferenceError(input2) {
   return new Error(
-    `Prebuilt play "${input.requested}" must be referenced as "${input.reference}". Use the prebuilt/ namespace anywhere you run, describe, get, or link to Deepline-managed plays.`
+    `Prebuilt play "${input2.requested}" must be referenced as "${input2.reference}". Use the prebuilt/ namespace anywhere you run, describe, get, or link to Deepline-managed plays.`
   );
 }
 async function assertCanonicalNamedPlayReference(client, target) {
@@ -7972,23 +8046,23 @@ function buildCloneEditStarter(play) {
     checkCommand: `deepline plays check ${path}`
   };
 }
-function materializeRemotePlaySource(input) {
-  if (isFileTarget(input.target)) {
+function materializeRemotePlaySource(input2) {
+  if (isFileTarget(input2.target)) {
     return null;
   }
-  if (!input.sourceCode.trim()) {
+  if (!input2.sourceCode.trim()) {
     return null;
   }
-  const outputPath = input.outPath ?? defaultMaterializedPlayPath(input.playName);
+  const outputPath = input2.outPath ?? defaultMaterializedPlayPath(input2.playName);
   if (existsSync7(outputPath)) {
     const existingSource = readFileSync6(outputPath, "utf-8");
-    if (existingSource === input.sourceCode) {
+    if (existingSource === input2.sourceCode) {
       return { path: outputPath, status: "unchanged", created: false };
     }
-    writeFileSync6(outputPath, input.sourceCode, "utf-8");
+    writeFileSync6(outputPath, input2.sourceCode, "utf-8");
     return { path: outputPath, status: "updated", created: false };
   }
-  writeFileSync6(outputPath, input.sourceCode, "utf-8");
+  writeFileSync6(outputPath, input2.sourceCode, "utf-8");
   return { path: outputPath, status: "created", created: true };
 }
 function formatLoadedPlayMessage(materializedFile) {
@@ -8038,12 +8112,12 @@ function isFileTarget(target) {
 function looksLikeRunId(target) {
   return /^play\/[^/]+\/run\/[^/]+/.test(target.trim());
 }
-function formatPlayCommandReceivedRunIdError(input) {
-  return `\`deepline plays ${input.command} <run-id>\` expects a play name, but this looks like a run id.
+function formatPlayCommandReceivedRunIdError(input2) {
+  return `\`deepline plays ${input2.command} <run-id>\` expects a play name, but this looks like a run id.
 Use:
-  deepline runs get ${input.runId} --json
-  deepline runs logs ${input.runId} --json
-  deepline runs export ${input.runId} --out output.csv`;
+  deepline runs get ${input2.runId} --json
+  deepline runs logs ${input2.runId} --json
+  deepline runs export ${input2.runId} --out output.csv`;
 }
 function looksLikeFilePath(target) {
   if (target.trim().toLowerCase().startsWith("prebuilt/")) {
@@ -8097,9 +8171,9 @@ function parseInputFlagValue(raw) {
   }
   return raw;
 }
-function getDottedInputValue(input, path) {
+function getDottedInputValue(input2, path) {
   const parts = path.split(".").map((part) => part.trim()).filter(Boolean);
-  let cursor = input;
+  let cursor = input2;
   for (const part of parts) {
     if (!cursor || typeof cursor !== "object" || Array.isArray(cursor)) {
       return void 0;
@@ -8108,12 +8182,12 @@ function getDottedInputValue(input, path) {
   }
   return cursor;
 }
-function setDottedInputValue(input, path, value) {
+function setDottedInputValue(input2, path, value) {
   const parts = path.split(".").map((part) => part.trim()).filter(Boolean);
   if (parts.length === 0) {
     throw new Error(`Invalid play input flag path: ${path}`);
   }
-  let cursor = input;
+  let cursor = input2;
   for (const part of parts.slice(0, -1)) {
     const existing = cursor[part];
     if (existing !== void 0 && (!existing || typeof existing !== "object" || Array.isArray(existing))) {
@@ -8180,17 +8254,17 @@ function inputContainsLocalFilePath(value) {
   }
   return false;
 }
-function namedRunNeedsPlayDefinition(input) {
-  return input.revisionSelector === "latest" || inputContainsLocalFilePath(input.runtimeInput);
+function namedRunNeedsPlayDefinition(input2) {
+  return input2.revisionSelector === "latest" || inputContainsLocalFilePath(input2.runtimeInput);
 }
-async function stageFileInputArgs(input) {
+async function stageFileInputArgs(input2) {
   const uniqueBindings = [
     ...new Map(
-      input.bindings.map((binding) => [binding.inputPath, binding])
+      input2.bindings.map((binding) => [binding.inputPath, binding])
     ).values()
   ];
   const localFiles = uniqueBindings.flatMap((binding) => {
-    const value = getDottedInputValue(input.runtimeInput, binding.inputPath);
+    const value = getDottedInputValue(input2.runtimeInput, binding.inputPath);
     if (!isLocalFilePathValue(value)) return [];
     const absolutePath = resolve10(value);
     return [{ binding, absolutePath, logicalPath: basename3(absolutePath) }];
@@ -8198,22 +8272,22 @@ async function stageFileInputArgs(input) {
   if (localFiles.length === 0) {
     return { inputFile: null, packagedFiles: [] };
   }
-  input.progress.phase(
+  input2.progress.phase(
     localFiles.length === 1 ? "staging input file" : "staging input files"
   );
-  const staged = await input.client.stagePlayFiles(
+  const staged = await input2.client.stagePlayFiles(
     localFiles.map((file) => stageFile(file.logicalPath, file.absolutePath))
   );
   for (const [index, file] of localFiles.entries()) {
     setDottedInputValue(
-      input.runtimeInput,
+      input2.runtimeInput,
       file.binding.inputPath,
       file.logicalPath
     );
     const stagedFile = staged[index];
     if (stagedFile && stagedFile.logicalPath !== file.logicalPath) {
       setDottedInputValue(
-        input.runtimeInput,
+        input2.runtimeInput,
         file.binding.inputPath,
         stagedFile.logicalPath
       );
@@ -8498,16 +8572,16 @@ function buildStepReceiptsDebugCommand(runId) {
   const sql = `select convert_from(k, 'UTF8') as receipt_key, case status when 0 then 'pending' when 1 then 'running' when 2 then 'completed' when 3 then 'failed' when 4 then 'skipped' else status::text end as status, output, error, updated_at from ${table} where run_id = ${quoteSqlLiteral(runId)} order by updated_at asc, receipt_key asc limit 20`;
   return buildDebugDbQueryCommand(sql);
 }
-function buildMapTableDebugCommand(input) {
+function buildMapTableDebugCommand(input2) {
   try {
     const tableName = validatePlaySheetTableName(
-      input.playName,
-      input.tableNamespace
+      input2.playName,
+      input2.tableNamespace
     );
     const table = `${quoteSqlIdentifier(
       PLAY_CUSTOMER_STORAGE_SCHEMA_NAME
     )}.${quoteSqlIdentifier(tableName)}`;
-    const sql = `select * from ${table} where _run_id = ${quoteSqlLiteral(input.runId)} limit 20`;
+    const sql = `select * from ${table} where _run_id = ${quoteSqlLiteral(input2.runId)} limit 20`;
     return buildDebugDbQueryCommand(sql);
   } catch {
     return null;
@@ -8527,37 +8601,37 @@ function extractTableNamespaceFromLiveEvent(event) {
   }
   return null;
 }
-function emitLiveDebugTableHints(input) {
-  if (input.jsonOutput || !input.runId || input.runId === "pending") {
+function emitLiveDebugTableHints(input2) {
+  if (input2.jsonOutput || !input2.runId || input2.runId === "pending") {
     return;
   }
-  input.state.emittedDebugKeys ??= /* @__PURE__ */ new Set();
-  const receiptsKey = `receipts:${input.runId}`;
-  if (!input.state.emittedDebugKeys.has(receiptsKey)) {
-    input.state.emittedDebugKeys.add(receiptsKey);
-    input.progress.writeLine(
-      `Debug top-level outputs: ${buildStepReceiptsDebugCommand(input.runId)}`,
+  input2.state.emittedDebugKeys ??= /* @__PURE__ */ new Set();
+  const receiptsKey = `receipts:${input2.runId}`;
+  if (!input2.state.emittedDebugKeys.has(receiptsKey)) {
+    input2.state.emittedDebugKeys.add(receiptsKey);
+    input2.progress.writeLine(
+      `Debug top-level outputs: ${buildStepReceiptsDebugCommand(input2.runId)}`,
       process.stdout
     );
   }
-  const tableNamespace = extractTableNamespaceFromLiveEvent(input.event);
+  const tableNamespace = extractTableNamespaceFromLiveEvent(input2.event);
   if (!tableNamespace) {
     return;
   }
-  const tableKey = `table:${input.runId}:${tableNamespace}`;
-  if (input.state.emittedDebugKeys.has(tableKey)) {
+  const tableKey = `table:${input2.runId}:${tableNamespace}`;
+  if (input2.state.emittedDebugKeys.has(tableKey)) {
     return;
   }
   const command = buildMapTableDebugCommand({
-    playName: input.playName,
-    runId: input.runId,
+    playName: input2.playName,
+    runId: input2.runId,
     tableNamespace
   });
   if (!command) {
     return;
   }
-  input.state.emittedDebugKeys.add(tableKey);
-  input.progress.writeLine(
+  input2.state.emittedDebugKeys.add(tableKey);
+  input2.progress.writeLine(
     `Debug rows for ${tableNamespace}: ${command}`,
     process.stdout
   );
@@ -8590,9 +8664,9 @@ function formatProgressLabel(raw) {
   const value = typeof raw === "string" && raw.trim() ? raw.trim() : "step";
   return value.replace(/^map:/, "").replace(/^tool:/, "");
 }
-function formatProgressCounts(input) {
-  const completed = typeof input.completed === "number" && Number.isFinite(input.completed) ? input.completed : null;
-  const total = typeof input.total === "number" && Number.isFinite(input.total) ? input.total : null;
+function formatProgressCounts(input2) {
+  const completed = typeof input2.completed === "number" && Number.isFinite(input2.completed) ? input2.completed : null;
+  const total = typeof input2.total === "number" && Number.isFinite(input2.total) ? input2.total : null;
   if (completed === null || total === null || total <= 0) {
     return null;
   }
@@ -8600,7 +8674,7 @@ function formatProgressCounts(input) {
     0,
     Math.min(100, Math.round(completed / total * 100))
   );
-  const failed = typeof input.failed === "number" && Number.isFinite(input.failed) && input.failed > 0 ? `, failed ${formatInteger(input.failed)}` : "";
+  const failed = typeof input2.failed === "number" && Number.isFinite(input2.failed) && input2.failed > 0 ? `, failed ${formatInteger(input2.failed)}` : "";
   return `${formatInteger(completed)}/${formatInteger(total)} (${percent}%)${failed}`;
 }
 function getProgressLinesFromLiveEvent(event) {
@@ -8642,14 +8716,14 @@ function getProgressLinesFromLiveEvent(event) {
   }
   return lines;
 }
-function printPlayProgressLines(input) {
-  for (const line of input.lines) {
+function printPlayProgressLines(input2) {
+  for (const line of input2.lines) {
     const signature = line.trim();
-    if (!signature || input.state.lastProgressSignature === signature) {
+    if (!signature || input2.state.lastProgressSignature === signature) {
       continue;
     }
-    input.state.lastProgressSignature = signature;
-    input.progress.writeLine(line);
+    input2.state.lastProgressSignature = signature;
+    input2.progress.writeLine(line);
   }
 }
 function buildPlayDashboardUrl(baseUrl, playName) {
@@ -8657,102 +8731,102 @@ function buildPlayDashboardUrl(baseUrl, playName) {
   const encodedPlayName = encodeURIComponent(playName);
   return `${trimmedBase}/dashboard/plays/${encodedPlayName}`;
 }
-function openPlayDashboard(input) {
-  if (input.jsonOutput || input.noOpen || !input.dashboardUrl) {
+function openPlayDashboard(input2) {
+  if (input2.jsonOutput || input2.noOpen || !input2.dashboardUrl) {
     return;
   }
-  openInBrowser(input.dashboardUrl);
+  openInBrowser(input2.dashboardUrl);
 }
-function printPlayLogLines(input) {
-  for (const line of input.lines) {
-    if (input.emitLogs) {
+function printPlayLogLines(input2) {
+  for (const line of input2.lines) {
+    if (input2.emitLogs) {
       const formatted = formatPlayLogLine(
         line,
-        input.status ?? void 0,
-        input.state
+        input2.status ?? void 0,
+        input2.state
       );
       if (formatted) {
-        input.progress.writeLogLine(formatted);
+        input2.progress.writeLogLine(formatted);
       }
     }
-    input.state.lastLogIndex += 1;
+    input2.state.lastLogIndex += 1;
   }
 }
-function assertPlayWaitNotTimedOut(input) {
-  if (input.waitTimeoutMs !== null && Date.now() - input.startedAt >= input.waitTimeoutMs) {
-    const hasRealRunId = input.workflowId.length > 0 && input.workflowId !== "pending";
-    const phaseSuffix = input.lastPhase && input.lastPhase.trim() ? ` (last observed phase: ${input.lastPhase.trim()})` : "";
-    const tailHint = hasRealRunId ? ` Run 'deepline runs tail ${input.workflowId} --json' to inspect it, or rerun with a larger --tail-timeout-ms.` : ` The run never reported a workflow id \u2014 the start request likely failed before reaching the scheduler. Check server logs and rerun with a larger --tail-timeout-ms.`;
+function assertPlayWaitNotTimedOut(input2) {
+  if (input2.waitTimeoutMs !== null && Date.now() - input2.startedAt >= input2.waitTimeoutMs) {
+    const hasRealRunId = input2.workflowId.length > 0 && input2.workflowId !== "pending";
+    const phaseSuffix = input2.lastPhase && input2.lastPhase.trim() ? ` (last observed phase: ${input2.lastPhase.trim()})` : "";
+    const tailHint = hasRealRunId ? ` Run 'deepline runs tail ${input2.workflowId} --json' to inspect it, or rerun with a larger --tail-timeout-ms.` : ` The run never reported a workflow id \u2014 the start request likely failed before reaching the scheduler. Check server logs and rerun with a larger --tail-timeout-ms.`;
     throw new DeeplineError(
-      `Timed out waiting for play ${hasRealRunId ? input.workflowId : "<no run id>"} after ${Math.ceil(input.waitTimeoutMs / 1e3)}s${phaseSuffix}.${tailHint}`,
+      `Timed out waiting for play ${hasRealRunId ? input2.workflowId : "<no run id>"} after ${Math.ceil(input2.waitTimeoutMs / 1e3)}s${phaseSuffix}.${tailHint}`,
       void 0,
       "PLAY_WAIT_TIMEOUT",
       {
-        ...hasRealRunId ? { runId: input.workflowId, workflowId: input.workflowId } : {},
-        ...input.lastPhase ? { phase: input.lastPhase } : {},
-        timeoutMs: input.waitTimeoutMs
+        ...hasRealRunId ? { runId: input2.workflowId, workflowId: input2.workflowId } : {},
+        ...input2.lastPhase ? { phase: input2.lastPhase } : {},
+        timeoutMs: input2.waitTimeoutMs
       }
     );
   }
 }
-async function waitForPlayCompletionByStream(input) {
+async function waitForPlayCompletionByStream(input2) {
   const controller = new AbortController();
   let timedOut = false;
   let lastPhase = null;
-  const timeout = input.waitTimeoutMs === null ? null : setTimeout(
+  const timeout = input2.waitTimeoutMs === null ? null : setTimeout(
     () => {
       timedOut = true;
       controller.abort();
     },
-    Math.max(1, input.waitTimeoutMs - (Date.now() - input.startedAt))
+    Math.max(1, input2.waitTimeoutMs - (Date.now() - input2.startedAt))
   );
   try {
-    for await (const event of input.client.streamPlayRunEvents(
-      input.workflowId,
+    for await (const event of input2.client.streamPlayRunEvents(
+      input2.workflowId,
       { signal: controller.signal }
     )) {
-      assertPlayWaitNotTimedOut({ ...input, lastPhase });
+      assertPlayWaitNotTimedOut({ ...input2, lastPhase });
       const phase = describeLiveEventPhase(event);
       if (phase) {
         lastPhase = phase;
-        input.progress.phase(phase);
+        input2.progress.phase(phase);
       }
       emitLiveDebugTableHints({
         event,
-        playName: input.playName,
-        runId: input.workflowId,
-        jsonOutput: input.jsonOutput,
-        state: input.state,
-        progress: input.progress
+        playName: input2.playName,
+        runId: input2.workflowId,
+        jsonOutput: input2.jsonOutput,
+        state: input2.state,
+        progress: input2.progress
       });
       printPlayLogLines({
         lines: getLogLinesFromLiveEvent(event),
         status: null,
-        jsonOutput: input.jsonOutput,
-        emitLogs: input.emitLogs,
-        state: input.state,
-        progress: input.progress
+        jsonOutput: input2.jsonOutput,
+        emitLogs: input2.emitLogs,
+        state: input2.state,
+        progress: input2.progress
       });
-      if (!input.jsonOutput) {
+      if (!input2.jsonOutput) {
         printPlayProgressLines({
           lines: getProgressLinesFromLiveEvent(event),
-          state: input.state,
-          progress: input.progress
+          state: input2.state,
+          progress: input2.progress
         });
       }
       const status = getStatusFromLiveEvent(event);
       if (status && TERMINAL_PLAY_STATUSES2.has(status)) {
-        const finalStatus = await input.client.getPlayStatus(input.workflowId, {
+        const finalStatus = await input2.client.getPlayStatus(input2.workflowId, {
           billing: false
         });
         if (TERMINAL_PLAY_STATUSES2.has(finalStatus.status)) {
-          return input.dashboardUrl ? { ...finalStatus, dashboardUrl: input.dashboardUrl } : finalStatus;
+          return input2.dashboardUrl ? { ...finalStatus, dashboardUrl: input2.dashboardUrl } : finalStatus;
         }
       }
     }
   } catch (error) {
     if (timedOut) {
-      assertPlayWaitNotTimedOut({ ...input, lastPhase });
+      assertPlayWaitNotTimedOut({ ...input2, lastPhase });
     }
     throw error;
   } finally {
@@ -8762,25 +8836,25 @@ async function waitForPlayCompletionByStream(input) {
   }
   const phaseSuffix = lastPhase && lastPhase.trim() ? ` (last observed phase: ${lastPhase.trim()})` : "";
   throw new DeeplineError(
-    `Play live stream ended before the run reached a terminal state runId=${input.workflowId}${phaseSuffix}.`,
+    `Play live stream ended before the run reached a terminal state runId=${input2.workflowId}${phaseSuffix}.`,
     void 0,
     "PLAY_LIVE_STREAM_ENDED",
     {
-      runId: input.workflowId,
-      workflowId: input.workflowId,
+      runId: input2.workflowId,
+      workflowId: input2.workflowId,
       ...lastPhase ? { phase: lastPhase } : {}
     }
   );
 }
-async function startAndWaitForPlayCompletionByStream(input) {
+async function startAndWaitForPlayCompletionByStream(input2) {
   for (let attempt = 0; attempt <= PLAY_START_TRANSIENT_RETRY_DELAYS_MS.length; attempt += 1) {
-    const status = await startAndWaitForPlayCompletionByStreamOnce(input);
+    const status = await startAndWaitForPlayCompletionByStreamOnce(input2);
     const retryDelayMs = PLAY_START_TRANSIENT_RETRY_DELAYS_MS[attempt];
     if (retryDelayMs === void 0 || !isRetryablePendingStartFailure(status)) {
       return status;
     }
-    if (!input.jsonOutput) {
-      input.progress.writeLine(
+    if (!input2.jsonOutput) {
+      input2.progress.writeLine(
         `[play watch] start failed before run id with a transient error; retrying (${playStatusErrorText(status)})`
       );
     }
@@ -8788,23 +8862,23 @@ async function startAndWaitForPlayCompletionByStream(input) {
       phase: "cli.play_start_stream_retry",
       ms: 0,
       ok: true,
-      playName: input.playName,
+      playName: input2.playName,
       attempt: attempt + 1,
       reason: playStatusErrorText(status)
     });
     await sleep4(retryDelayMs);
   }
   throw new DeeplineError(
-    `Play ${input.playName} did not start after retrying transient start failures.`,
+    `Play ${input2.playName} did not start after retrying transient start failures.`,
     void 0,
     "PLAY_START_RETRY_EXHAUSTED"
   );
 }
-async function startAndWaitForPlayCompletionByStreamOnce(input) {
+async function startAndWaitForPlayCompletionByStreamOnce(input2) {
   const startedAt = Date.now();
   const dashboardUrl = buildPlayDashboardUrl(
-    input.client.baseUrl,
-    input.playName
+    input2.client.baseUrl,
+    input2.playName
   );
   const state = {
     lastLogIndex: 0,
@@ -8818,15 +8892,15 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
   let eventCount = 0;
   let firstRunIdMs = null;
   let lastPhase = null;
-  const timeout = input.waitTimeoutMs === null ? null : setTimeout(
+  const timeout = input2.waitTimeoutMs === null ? null : setTimeout(
     () => {
       timedOut = true;
       controller.abort();
     },
-    Math.max(1, input.waitTimeoutMs)
+    Math.max(1, input2.waitTimeoutMs)
   );
   try {
-    for await (const event of input.client.startPlayRunStream(input.request, {
+    for await (const event of input2.client.startPlayRunStream(input2.request, {
       signal: controller.signal
     })) {
       eventCount += 1;
@@ -8837,55 +8911,55 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
       }
       const workflowId = lastKnownWorkflowId || "pending";
       if (workflowId !== "pending" && !emittedDashboardUrl) {
-        if (!input.jsonOutput) {
+        if (!input2.jsonOutput) {
           writeStartedPlayRun({
             runId: workflowId,
-            playName: input.playName,
+            playName: input2.playName,
             dashboardUrl,
             jsonOutput: false,
-            progress: input.progress
+            progress: input2.progress
           });
         }
         openPlayDashboard({
           dashboardUrl,
-          jsonOutput: input.jsonOutput,
-          noOpen: input.noOpen
+          jsonOutput: input2.jsonOutput,
+          noOpen: input2.noOpen
         });
-        input.progress.phase(`loading play on ${dashboardUrl}`);
+        input2.progress.phase(`loading play on ${dashboardUrl}`);
         emittedDashboardUrl = true;
       }
       assertPlayWaitNotTimedOut({
         workflowId,
         startedAt,
-        waitTimeoutMs: input.waitTimeoutMs,
+        waitTimeoutMs: input2.waitTimeoutMs,
         lastPhase
       });
       const phase = describeLiveEventPhase(event);
       if (phase) {
         lastPhase = phase;
-        input.progress.phase(phase);
+        input2.progress.phase(phase);
       }
       printPlayLogLines({
         lines: getLogLinesFromLiveEvent(event),
         status: null,
-        jsonOutput: input.jsonOutput,
-        emitLogs: input.emitLogs,
+        jsonOutput: input2.jsonOutput,
+        emitLogs: input2.emitLogs,
         state,
-        progress: input.progress
+        progress: input2.progress
       });
       emitLiveDebugTableHints({
         event,
-        playName: input.playName,
+        playName: input2.playName,
         runId: workflowId,
-        jsonOutput: input.jsonOutput,
+        jsonOutput: input2.jsonOutput,
         state,
-        progress: input.progress
+        progress: input2.progress
       });
-      if (!input.jsonOutput) {
+      if (!input2.jsonOutput) {
         printPlayProgressLines({
           lines: getProgressLinesFromLiveEvent(event),
           state,
-          progress: input.progress
+          progress: input2.progress
         });
       }
       const finalStatus = getFinalStatusFromLiveEvent(event);
@@ -8894,7 +8968,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
           phase: "cli.play_start_stream_terminal",
           ms: Date.now() - startedAt,
           ok: true,
-          playName: input.playName,
+          playName: input2.playName,
           workflowId: finalStatus.runId || lastKnownWorkflowId || null,
           eventCount,
           firstRunIdMs,
@@ -8908,7 +8982,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
       assertPlayWaitNotTimedOut({
         workflowId: lastKnownWorkflowId,
         startedAt,
-        waitTimeoutMs: input.waitTimeoutMs,
+        waitTimeoutMs: input2.waitTimeoutMs,
         lastPhase
       });
     }
@@ -8917,7 +8991,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
         clearTimeout(timeout);
       }
       const reason = error instanceof Error ? error.message : String(error);
-      if (!input.jsonOutput) {
+      if (!input2.jsonOutput) {
         process.stderr.write(
           `[play watch] start stream failed after run ${lastKnownWorkflowId}; reconnecting to run stream (${reason})
 `
@@ -8927,7 +9001,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
         phase: "cli.play_start_stream_reconnect",
         ms: Date.now() - startedAt,
         ok: true,
-        playName: input.playName,
+        playName: input2.playName,
         workflowId: lastKnownWorkflowId,
         eventCount,
         firstRunIdMs,
@@ -8935,16 +9009,16 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
         reason
       });
       return waitForPlayCompletionByStream({
-        client: input.client,
-        playName: input.playName,
+        client: input2.client,
+        playName: input2.playName,
         workflowId: lastKnownWorkflowId,
         dashboardUrl,
-        jsonOutput: input.jsonOutput,
-        emitLogs: input.emitLogs,
-        waitTimeoutMs: input.waitTimeoutMs,
+        jsonOutput: input2.jsonOutput,
+        emitLogs: input2.emitLogs,
+        waitTimeoutMs: input2.waitTimeoutMs,
         startedAt,
         state,
-        progress: input.progress
+        progress: input2.progress
       });
     }
     throw error;
@@ -8954,8 +9028,8 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
     }
   }
   if (lastKnownWorkflowId) {
-    if (!input.jsonOutput) {
-      input.progress.writeLine(
+    if (!input2.jsonOutput) {
+      input2.progress.writeLine(
         `[play watch] start stream ended after run ${lastKnownWorkflowId}; reconnecting to run stream`
       );
     }
@@ -8963,7 +9037,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
       phase: "cli.play_start_stream_reconnect",
       ms: Date.now() - startedAt,
       ok: true,
-      playName: input.playName,
+      playName: input2.playName,
       workflowId: lastKnownWorkflowId,
       eventCount,
       firstRunIdMs,
@@ -8971,16 +9045,16 @@ async function startAndWaitForPlayCompletionByStreamOnce(input) {
       reason: "stream ended before terminal event"
     });
     return waitForPlayCompletionByStream({
-      client: input.client,
-      playName: input.playName,
+      client: input2.client,
+      playName: input2.playName,
       workflowId: lastKnownWorkflowId,
       dashboardUrl,
-      jsonOutput: input.jsonOutput,
-      emitLogs: input.emitLogs,
-      waitTimeoutMs: input.waitTimeoutMs,
+      jsonOutput: input2.jsonOutput,
+      emitLogs: input2.emitLogs,
+      waitTimeoutMs: input2.waitTimeoutMs,
       startedAt,
       state,
-      progress: input.progress
+      progress: input2.progress
     });
   }
   const phaseSuffix = lastPhase && lastPhase.trim() ? ` (last observed phase: ${lastPhase.trim()})` : "";
@@ -9061,7 +9135,7 @@ function compactReturnValue(value, depth = 0) {
   if (!value || typeof value !== "object") {
     return value;
   }
-  const output = {};
+  const output2 = {};
   for (const [key, entry] of Object.entries(value)) {
     if (depth === 0 && key === "_metadata") {
       continue;
@@ -9072,9 +9146,9 @@ function compactReturnValue(value, depth = 0) {
     if (key === "access") {
       continue;
     }
-    output[key] = compactReturnValue(entry, depth + 1);
+    output2[key] = compactReturnValue(entry, depth + 1);
   }
-  return output;
+  return output2;
 }
 function formatJsonPreview(value) {
   const json = JSON.stringify(value, null, 2);
@@ -9283,22 +9357,22 @@ function extractBillingForStatus(status, error) {
   const progressError = getStringField(status.progress, "error");
   return extractBillingFromText(error) ?? extractBillingFromText(progressError) ?? getObjectField(status, "billing");
 }
-function formatInsufficientCreditsMessage(input) {
-  const operation = getStringField(input.billing, "operation_id") ?? getStringField(input.billing, "operation") ?? extractToolIdFromErrorText(input.error) ?? getStringField(input.billing, "provider") ?? "tool call";
-  const balance = formatCreditAmount(input.billing.balance_credits);
-  const required = formatCreditAmount(input.billing.required_credits);
+function formatInsufficientCreditsMessage(input2) {
+  const operation = getStringField(input2.billing, "operation_id") ?? getStringField(input2.billing, "operation") ?? extractToolIdFromErrorText(input2.error) ?? getStringField(input2.billing, "provider") ?? "tool call";
+  const balance = formatCreditAmount(input2.billing.balance_credits);
+  const required = formatCreditAmount(input2.billing.required_credits);
   const recommended = formatCreditAmount(
-    input.billing.recommended_add_credits ?? input.billing.needed_credits
+    input2.billing.recommended_add_credits ?? input2.billing.needed_credits
   );
-  const billingUrl = getStringField(input.billing, "billing_url");
-  const workspace = getStringField(input.billing, "workspace_id") ?? getStringField(input.billing, "workspaceId");
+  const billingUrl = getStringField(input2.billing, "billing_url");
+  const workspace = getStringField(input2.billing, "workspace_id") ?? getStringField(input2.billing, "workspaceId");
   const workspaceSuffix = workspace ? ` (workspace=${workspace})` : "";
   const addSuffix = billingUrl && recommended !== "-" ? ` Add >=${recommended} at ${billingUrl}.` : billingUrl ? ` Add credits at ${billingUrl}.` : "";
   return `Workspace balance ${balance} < required ${required} for ${operation}${workspaceSuffix}.${addSuffix}`;
 }
-function buildInsufficientCreditsSummaryLines(input) {
-  const progress = input.status.progress;
-  const rowsInfo = extractCanonicalRowsInfo(input.status);
+function buildInsufficientCreditsSummaryLines(input2) {
+  const progress = input2.status.progress;
+  const rowsInfo = extractCanonicalRowsInfo(input2.status);
   const completed = getNumericField(progress, "completed") ?? getNumericField(progress, "completedRows") ?? rowsInfo?.rows.length ?? null;
   const total = getNumericField(progress, "total") ?? getNumericField(progress, "totalRows") ?? rowsInfo?.totalRows ?? null;
   const lines = [
@@ -9306,16 +9380,16 @@ function buildInsufficientCreditsSummaryLines(input) {
     completed === null ? "  completed rows: unknown" : `  completed rows: ${formatInteger(completed)}${total !== null ? ` of ${formatInteger(total)}` : ""}`,
     "  reusable receipts: yes; rerun after adding credits to continue from completed provider work"
   ];
-  const billingUrl = getStringField(input.billing, "billing_url");
+  const billingUrl = getStringField(input2.billing, "billing_url");
   const recommended = formatCreditAmount(
-    input.billing.recommended_add_credits ?? input.billing.needed_credits
+    input2.billing.recommended_add_credits ?? input2.billing.needed_credits
   );
   if (billingUrl) {
     lines.push(
       recommended !== "-" ? `  add credits: add >=${recommended} at ${billingUrl}` : `  add credits: ${billingUrl}`
     );
   }
-  const runId = input.status.runId?.trim();
+  const runId = input2.status.runId?.trim();
   if (runId) {
     lines.push(`  inspect: deepline runs get ${runId} --json`);
     lines.push(
@@ -9650,8 +9724,8 @@ function actionToCommand(action) {
 }
 function readFirstDatasetActions(packaged) {
   for (const step of readRecordArray(packaged.steps)) {
-    const output = step.output && typeof step.output === "object" && !Array.isArray(step.output) ? step.output : null;
-    const actions = output?.actions && typeof output.actions === "object" && !Array.isArray(output.actions) ? output.actions : null;
+    const output2 = step.output && typeof step.output === "object" && !Array.isArray(step.output) ? step.output : null;
+    const actions = output2?.actions && typeof output2.actions === "object" && !Array.isArray(output2.actions) ? output2.actions : null;
     if (actions) {
       return actions;
     }
@@ -9673,12 +9747,12 @@ function buildRunPackageTextLines(packaged) {
     const id = typeof step.id === "string" ? step.id : "step";
     const kind = typeof step.kind === "string" ? step.kind : "step";
     const stepStatus = typeof step.status === "string" ? step.status : status;
-    const output = step.output && typeof step.output === "object" && !Array.isArray(step.output) ? step.output : null;
-    const rowCount = output && typeof output.rowCount === "number" ? ` rows=${formatInteger(output.rowCount)}` : "";
-    const preview = output?.preview && typeof output.preview === "object" && !Array.isArray(output.preview) ? output.preview : null;
+    const output2 = step.output && typeof step.output === "object" && !Array.isArray(step.output) ? step.output : null;
+    const rowCount = output2 && typeof output2.rowCount === "number" ? ` rows=${formatInteger(output2.rowCount)}` : "";
+    const preview = output2?.preview && typeof output2.preview === "object" && !Array.isArray(output2.preview) ? output2.preview : null;
     const previewRows = Array.isArray(preview?.rows) ? preview.rows.length : null;
     lines.push(`  ${kind} ${id}: ${stepStatus}${rowCount}`);
-    lines.push(...formatPackageDatasetSummaryLines(output?.summary));
+    lines.push(...formatPackageDatasetSummaryLines(output2?.summary));
     if (previewRows !== null) {
       lines.push(
         `    preview=${previewRows}${preview?.truncated ? " truncated" : ""}`
@@ -9761,19 +9835,19 @@ function writePlayResult(status, jsonOutput, options) {
 ` }
   );
 }
-async function resolvePlayRunOutputStatus(input) {
-  if (!getPlayRunPackage(input.status)) {
-    return input.status;
+async function resolvePlayRunOutputStatus(input2) {
+  if (!getPlayRunPackage(input2.status)) {
+    return input2.status;
   }
-  const runId = input.status.runId;
+  const runId = input2.status.runId;
   if (!runId) {
-    return input.status;
+    return input2.status;
   }
-  const refreshedStatus = await input.client.getPlayStatus(runId, {
+  const refreshedStatus = await input2.client.getPlayStatus(runId, {
     billing: false,
-    full: input.fullJson
+    full: input2.fullJson
   });
-  const dashboardUrl = input.status.dashboardUrl;
+  const dashboardUrl = input2.status.dashboardUrl;
   return typeof dashboardUrl === "string" ? { ...refreshedStatus, dashboardUrl } : refreshedStatus;
 }
 var RUN_EXPORT_PAGE_SIZE = 5e3;
@@ -9804,21 +9878,21 @@ function extractRunPlayName(status) {
 function normalizeCustomerDbIdentifier(value) {
   return value.split("/").pop().replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
 }
-function buildCustomerDbQueryPlan(input) {
-  const playName = extractRunPlayName(input.status);
-  const tableNamespace = input.rowsInfo.tableNamespace?.trim();
-  if (!playName || !tableNamespace || input.rowsInfo.totalRows <= 0) {
+function buildCustomerDbQueryPlan(input2) {
+  const playName = extractRunPlayName(input2.status);
+  const tableNamespace = input2.rowsInfo.tableNamespace?.trim();
+  if (!playName || !tableNamespace || input2.rowsInfo.totalRows <= 0) {
     return null;
   }
   const tableName = `${normalizeCustomerDbIdentifier(playName)}_${normalizeCustomerDbIdentifier(
     tableNamespace
   )}`;
-  const sql = `select * from "storage"."${tableName}" where _run_id = ${sqlStringLiteral(input.status.runId)} limit ${input.rowsInfo.totalRows}`;
-  const base = `deepline customer-db query --sql ${shellSingleQuote(sql)} --max-rows ${input.rowsInfo.totalRows}`;
+  const sql = `select * from "storage"."${tableName}" where _run_id = ${sqlStringLiteral(input2.status.runId)} limit ${input2.rowsInfo.totalRows}`;
+  const base = `deepline customer-db query --sql ${shellSingleQuote(sql)} --max-rows ${input2.rowsInfo.totalRows}`;
   return {
     sql,
     json: `${base} --json`,
-    csv: `${base} --format csv --out ${shellSingleQuote(resolve10(input.outPath))}`
+    csv: `${base} --format csv --out ${shellSingleQuote(resolve10(input2.outPath))}`
   };
 }
 function exportableSheetRow(row) {
@@ -9869,20 +9943,20 @@ function mergeExportColumns(preferredColumns, rows) {
   }
   return columns;
 }
-async function fetchBackingDatasetRows(input) {
-  const playName = extractRunPlayName(input.status);
-  const tableNamespace = input.rowsInfo.tableNamespace?.trim();
+async function fetchBackingDatasetRows(input2) {
+  const playName = extractRunPlayName(input2.status);
+  const tableNamespace = input2.rowsInfo.tableNamespace?.trim();
   if (!playName || !tableNamespace) {
     return null;
   }
   const sheetRows = [];
   let offset = 0;
-  let expectedTotal = input.rowsInfo.totalRows;
+  let expectedTotal = input2.rowsInfo.totalRows;
   while (true) {
-    const page = await input.client.runs.exportDatasetRows({
+    const page = await input2.client.runs.exportDatasetRows({
       playName,
       tableNamespace,
-      runId: input.status.runId,
+      runId: input2.status.runId,
       limit: RUN_EXPORT_PAGE_SIZE,
       offset
     });
@@ -9897,20 +9971,20 @@ async function fetchBackingDatasetRows(input) {
     offset += page.rows.length;
   }
   const rows = sheetRows.map(exportableSheetRow).filter((row) => Boolean(row));
-  if (rows.length < input.rowsInfo.totalRows) {
+  if (rows.length < input2.rowsInfo.totalRows) {
     return null;
   }
   const columns = mergeExportColumns(
-    input.rowsInfo.columnsExplicit ? input.rowsInfo.columns : [],
+    input2.rowsInfo.columnsExplicit ? input2.rowsInfo.columns : [],
     rows
   );
   return {
-    ...input.rowsInfo,
+    ...input2.rowsInfo,
     rows,
     columns,
     totalRows: rows.length,
     complete: true,
-    source: `${input.rowsInfo.source ?? "result.rows"} -> /api/v2/plays/${playName}/sheet?tableNamespace=${tableNamespace}`
+    source: `${input2.rowsInfo.source ?? "result.rows"} -> /api/v2/plays/${playName}/sheet?tableNamespace=${tableNamespace}`
   };
 }
 async function exportPlayStatusRows(client, status, outPath, options = {}) {
@@ -10012,11 +10086,11 @@ function extractActiveRunsFromError(error) {
 function activeRunId(run) {
   return getStringField(run, "workflowId") ?? getStringField(run, "runId");
 }
-function formatActiveRunConflictError(input) {
+function formatActiveRunConflictError(input2) {
   const lines = [
-    `Active run exists for ${input.playName}. Use --force to supersede, or inspect/stop the active run first.`
+    `Active run exists for ${input2.playName}. Use --force to supersede, or inspect/stop the active run first.`
   ];
-  for (const run of input.activeRuns.slice(0, 3)) {
+  for (const run of input2.activeRuns.slice(0, 3)) {
     const runId = activeRunId(run);
     if (!runId) {
       continue;
@@ -10130,49 +10204,49 @@ function renderServerResultView(value) {
   }
   return { lines: lines.length > 1 ? lines : [], actions: [] };
 }
-function writeStartedPlayRun(input) {
-  if (input.package && isPlayRunPackageValue(input.package)) {
-    if (input.jsonOutput) {
-      printCommandEnvelope(input.package, { json: true });
+function writeStartedPlayRun(input2) {
+  if (input2.package && isPlayRunPackageValue(input2.package)) {
+    if (input2.jsonOutput) {
+      printCommandEnvelope(input2.package, { json: true });
       return;
     }
-    const lines2 = buildRunPackageTextLines(input.package);
-    const output2 = lines2.join("\n");
-    if (input.progress) {
-      input.progress.writeLine(output2, process.stdout);
+    const lines2 = buildRunPackageTextLines(input2.package);
+    const output3 = lines2.join("\n");
+    if (input2.progress) {
+      input2.progress.writeLine(output3, process.stdout);
       return;
     }
-    printCommandEnvelope(input.package, {
+    printCommandEnvelope(input2.package, {
       json: false,
-      text: `${output2}
+      text: `${output3}
 `
     });
     return;
   }
   const payload = {
-    runId: input.runId,
-    workflowId: input.runId,
-    name: input.playName,
-    status: input.status ?? "started",
-    dashboardUrl: input.dashboardUrl,
+    runId: input2.runId,
+    workflowId: input2.runId,
+    name: input2.playName,
+    status: input2.status ?? "started",
+    dashboardUrl: input2.dashboardUrl,
     next: {
-      inspect: `deepline runs get ${input.runId} --json`,
-      full: `deepline runs get ${input.runId} --full --json`,
-      logs: `deepline runs logs ${input.runId} --json`,
-      export: `deepline runs export ${input.runId} --out output.csv`,
-      stop: `deepline runs stop ${input.runId} --reason "stale lock" --json`
+      inspect: `deepline runs get ${input2.runId} --json`,
+      full: `deepline runs get ${input2.runId} --full --json`,
+      logs: `deepline runs logs ${input2.runId} --json`,
+      export: `deepline runs export ${input2.runId} --out output.csv`,
+      stop: `deepline runs stop ${input2.runId} --reason "stale lock" --json`
     }
   };
   const lines = [
-    `Started ${input.playName}`,
-    `  run id: ${input.runId}`,
-    `  inspect: deepline runs get ${input.runId} --json`,
-    `  full debug: deepline runs get ${input.runId} --full --json`,
-    `  logs: deepline runs logs ${input.runId} --json`,
-    `  export after completion: deepline runs export ${input.runId} --out output.csv`,
-    `  stop run: deepline runs stop ${input.runId} --reason "stale lock" --json`
+    `Started ${input2.playName}`,
+    `  run id: ${input2.runId}`,
+    `  inspect: deepline runs get ${input2.runId} --json`,
+    `  full debug: deepline runs get ${input2.runId} --full --json`,
+    `  logs: deepline runs logs ${input2.runId} --json`,
+    `  export after completion: deepline runs export ${input2.runId} --out output.csv`,
+    `  stop run: deepline runs stop ${input2.runId} --reason "stale lock" --json`
   ];
-  if (input.jsonOutput) {
+  if (input2.jsonOutput) {
     printCommandEnvelope(
       {
         ...payload,
@@ -10182,12 +10256,12 @@ function writeStartedPlayRun(input) {
     );
     return;
   }
-  if (input.dashboardUrl) {
-    lines.push(`  play page: ${input.dashboardUrl}`);
+  if (input2.dashboardUrl) {
+    lines.push(`  play page: ${input2.dashboardUrl}`);
   }
-  const output = lines.join("\n");
-  if (input.progress) {
-    input.progress.writeLine(output, process.stdout);
+  const output2 = lines.join("\n");
+  if (input2.progress) {
+    input2.progress.writeLine(output2, process.stdout);
     return;
   }
   printCommandEnvelope(
@@ -10195,7 +10269,7 @@ function writeStartedPlayRun(input) {
       ...payload,
       render: { sections: [{ title: "play run", lines }] }
     },
-    { json: false, text: `${output}
+    { json: false, text: `${output2}
 ` }
   );
 }
@@ -10203,7 +10277,7 @@ function parsePlayRunOptions(args) {
   const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--no-wait] [--tail-timeout-ms 30000] [--force] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--live|--latest|--revision-id <id>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--no-open] [--json] [--full] [--<input> value]\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotency, tool call id, and ctx.map guidance.";
   let filePath = null;
   let playName = null;
-  let input = null;
+  let input2 = null;
   let revisionId = null;
   let revisionSelector = null;
   const watch = !args.includes("--no-wait");
@@ -10224,7 +10298,7 @@ function parsePlayRunOptions(args) {
       continue;
     }
     if ((arg === "--input" || arg === "-i") && args[index + 1]) {
-      input = parseJsonInput(args[++index]);
+      input2 = parseJsonInput(args[++index]);
       continue;
     }
     if (arg === "--revision-id" && args[index + 1]) {
@@ -10273,8 +10347,8 @@ function parsePlayRunOptions(args) {
     }
     if (arg.startsWith("--")) {
       const { path, value } = parseInputFieldFlag(arg, args[index + 1]);
-      input ??= {};
-      setDottedInputValue(input, path, parseInputFlagValue(value));
+      input2 ??= {};
+      setDottedInputValue(input2, path, parseInputFlagValue(value));
       if (!arg.includes("=")) {
         index += 1;
       }
@@ -10309,7 +10383,7 @@ function parsePlayRunOptions(args) {
   }
   return {
     target: filePath ? { kind: "file", path: filePath } : { kind: "name", name: playName },
-    input,
+    input: input2,
     revisionId,
     revisionSelector,
     watch,
@@ -10676,15 +10750,15 @@ async function handleFileBackedRun(options) {
   });
   return 0;
 }
-async function resolveNamedRunRevisionId(input) {
-  if (input.revisionId) {
-    return input.revisionId;
+async function resolveNamedRunRevisionId(input2) {
+  if (input2.revisionId) {
+    return input2.revisionId;
   }
-  if (input.selector === "latest") {
-    const versions = await input.client.listPlayVersions(input.playName);
+  if (input2.selector === "latest") {
+    const versions = await input2.client.listPlayVersions(input2.playName);
     const latest = versions[0];
     if (!latest?._id) {
-      throw new Error(`No saved revisions found for ${input.playName}.`);
+      throw new Error(`No saved revisions found for ${input2.playName}.`);
     }
     return latest._id;
   }
@@ -12484,6 +12558,218 @@ async function handlePlayShareUnpublish(args) {
   return 0;
 }
 
+// src/cli/commands/secrets.ts
+import { stdin as input, stdout as output } from "process";
+var hiddenInputBuffer = "";
+function normalizeSecretName(value) {
+  const normalized = value.trim().toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,63}$/.test(normalized)) {
+    throw new Error(
+      "Secret names must be 2-64 characters and use uppercase letters, numbers, and underscores."
+    );
+  }
+  return normalized;
+}
+function renderSecret(secret) {
+  const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
+}
+async function readHiddenLine(prompt) {
+  if (!input.isTTY || !output.isTTY) {
+    throw new Error(
+      "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
+    );
+  }
+  output.write(prompt);
+  const previousRawMode = input.isRaw;
+  if (typeof input.setRawMode === "function") input.setRawMode(true);
+  let value = "";
+  input.resume();
+  return await new Promise((resolve12, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      input.off("data", onData);
+      input.off("end", onEnd);
+      input.off("error", onError);
+      if (typeof input.setRawMode === "function") {
+        input.setRawMode(previousRawMode);
+      }
+    };
+    const finish = (line) => {
+      if (settled) return;
+      settled = true;
+      output.write("\n");
+      cleanup();
+      resolve12(line);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      output.write("\n");
+      cleanup();
+      reject(error);
+    };
+    const processText = (text) => {
+      for (let index = 0; index < text.length; index++) {
+        const char = text[index];
+        const code = char.charCodeAt(0);
+        if (char === "\r" || char === "\n") {
+          hiddenInputBuffer = text.slice(index + 1);
+          finish(value);
+          return;
+        }
+        if (code === 3) {
+          fail(new Error("Secret input cancelled."));
+          return;
+        }
+        if (code === 8 || code === 127) {
+          value = value.slice(0, -1);
+          continue;
+        }
+        if (code >= 32) {
+          value += char;
+        }
+      }
+      hiddenInputBuffer = "";
+    };
+    const onData = (chunk) => {
+      processText(chunk.toString());
+    };
+    const onEnd = () => fail(new Error("Secret input ended before a value was entered."));
+    const onError = (error) => fail(error);
+    input.on("data", onData);
+    input.once("end", onEnd);
+    input.once("error", onError);
+    if (hiddenInputBuffer) {
+      const buffered = hiddenInputBuffer;
+      hiddenInputBuffer = "";
+      processText(buffered);
+    }
+  });
+}
+async function readSecretValue() {
+  const first = await readHiddenLine("Secret value: ");
+  if (!first) throw new Error("Secret value is required.");
+  const second = await readHiddenLine("Confirm secret value: ");
+  if (first !== second) {
+    throw new Error("Secret values did not match.");
+  }
+  return first;
+}
+function preventShellHistoryLeak(forbidden) {
+  if (forbidden.length > 0) {
+    throw new Error(
+      "Do not pass secret values as command arguments. Run `deepline secrets set NAME` and enter the value at the hidden prompt."
+    );
+  }
+}
+async function handleList(options) {
+  const client = new DeeplineClient();
+  const secrets = await client.listSecrets();
+  printCommandEnvelope(
+    {
+      secrets,
+      count: secrets.length,
+      render: {
+        sections: [
+          {
+            title: "secrets",
+            lines: secrets.length ? secrets.map(renderSecret) : ["No play secrets are configured."]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleCheck(nameInput, options) {
+  const name = normalizeSecretName(nameInput);
+  const client = new DeeplineClient();
+  const secret = await client.checkSecret(name);
+  printCommandEnvelope(
+    {
+      ok: Boolean(secret),
+      name,
+      secret: secret ?? null,
+      render: {
+        sections: [
+          {
+            title: "secret check",
+            lines: [
+              secret ? `${name}: active` : `${name}: missing, disabled, or empty`
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+  if (!secret) process.exitCode = 4;
+}
+async function handleSet(nameInput, forbidden, options) {
+  preventShellHistoryLeak(forbidden);
+  const name = normalizeSecretName(nameInput);
+  const scope = options.scope === "play" ? "play" : "org";
+  const playName = options.play?.trim();
+  if (scope === "play" && !playName) {
+    throw new Error("--play <name> is required when --scope play is used.");
+  }
+  const value = await readSecretValue();
+  const { http } = getAuthedHttpClient();
+  const response = await http.post(
+    "/api/v2/secrets",
+    {
+      name,
+      value,
+      scope,
+      ...playName ? { playName } : {}
+    }
+  );
+  const secret = response.secret;
+  printCommandEnvelope(
+    {
+      ok: true,
+      secret,
+      render: {
+        sections: [
+          {
+            title: "secret saved",
+            lines: [`${secret.name}: saved (${secret.scope})`]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerSecretsCommands(program) {
+  const secrets = program.command("secrets").description("Manage play secrets without revealing values.").addHelpText(
+    "after",
+    `
+Notes:
+  Secret values are never accepted as command arguments, stdin pipes, env vars,
+  or files. Use deepline secrets set NAME and type the value at the hidden TTY
+  prompt. Agents can list/check metadata but should not enter secret values.
+
+Examples:
+  deepline secrets list
+  deepline secrets check HUBSPOT_TOKEN
+  deepline secrets set HUBSPOT_TOKEN
+`
+  );
+  secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
+    await handleList(options);
+  });
+  secrets.command("check").description("Check whether a secret exists and is active.").argument("<name>", "Secret name").option("--json", "Emit JSON output").action(async (name, options) => {
+    await handleCheck(name, options);
+  });
+  secrets.command("set").description("Set or rotate a secret through a hidden interactive prompt.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").action(
+    async (name, forbidden, options) => {
+      await handleSet(name, forbidden ?? [], options);
+    }
+  );
+}
+
 // src/cli/commands/tools.ts
 import { Option } from "commander";
 import { chmodSync, mkdtempSync, writeFileSync as writeFileSync8 } from "fs";
@@ -13689,25 +13975,25 @@ function shellQuote(value) {
 function powerShellQuote(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
-function seedToolListScript(input) {
-  const stem = safeFileStem(input.toolId);
+function seedToolListScript(input2) {
+  const stem = safeFileStem(input2.toolId);
   const fileName = `${stem}-workflow-seed-${Date.now()}.play.ts`;
   const scriptDir = mkdtempSync(join9(tmpdir3(), "deepline-workflow-seed-"));
   chmodSync(scriptDir, 448);
   const scriptPath = join9(scriptDir, fileName);
   const projectDir = `deepline/projects/${stem}-workflow`;
   const playName = `${stem}-workflow`;
-  const sampleRows = input.rows.length > 0 ? `${JSON.stringify(input.rows.slice(0, 2)).replace(/\]$/, "")}, ...]` : "[]";
-  const columns = Object.keys(input.rows[0] ?? {}).join(", ");
-  const rowKey = Object.prototype.hasOwnProperty.call(input.rows[0] ?? {}, "id") ? '"id"' : "(row) => JSON.stringify(row)";
+  const sampleRows = input2.rows.length > 0 ? `${JSON.stringify(input2.rows.slice(0, 2)).replace(/\]$/, "")}, ...]` : "[]";
+  const columns = Object.keys(input2.rows[0] ?? {}).join(", ");
+  const rowKey = Object.prototype.hasOwnProperty.call(input2.rows[0] ?? {}, "id") ? '"id"' : "(row) => JSON.stringify(row)";
   const script = `import { definePlay } from 'deepline';
 
 export default definePlay(${JSON.stringify(playName)}, async (ctx) => {
   const result = await ctx.tools.execute({
-    id: ${JSON.stringify(input.toolId)},
-    tool: ${JSON.stringify(input.toolId)},
-    input: ${JSON.stringify(input.payload)},
-    description: ${JSON.stringify(`Seed ${input.toolId} rows for workflow expansion.`)},
+    id: ${JSON.stringify(input2.toolId)},
+    tool: ${JSON.stringify(input2.toolId)},
+    input: ${JSON.stringify(input2.payload)},
+    description: ${JSON.stringify(`Seed ${input2.toolId} rows for workflow expansion.`)},
   });
 
   const list = Object.values(result.extractedLists)[0];
@@ -13739,23 +14025,23 @@ export default definePlay(${JSON.stringify(playName)}, async (ctx) => {
     windowsCopyCommand: `New-Item -ItemType Directory -Force -Path ${powerShellQuote(projectDir.replace(/\//g, "\\"))} | Out-Null; Copy-Item -LiteralPath ${powerShellQuote(scriptPath)} -Destination ${powerShellQuote(`${projectDir.replace(/\//g, "\\")}\\${fileName}`)}`
   };
 }
-function buildToolExecuteBaseEnvelope(input) {
-  const envelope = commandEnvelopeFromRawResponse(input.rawResponse);
-  const summaryEntries = Object.entries(input.summary);
-  const outputPreview = input.listConversion ? {
+function buildToolExecuteBaseEnvelope(input2) {
+  const envelope = commandEnvelopeFromRawResponse(input2.rawResponse);
+  const summaryEntries = Object.entries(input2.summary);
+  const outputPreview = input2.listConversion ? {
     kind: "list",
-    rowCount: input.listConversion.rows.length,
-    columns: Object.keys(input.listConversion.rows[0] ?? {}),
-    preview: input.listConversion.rows.slice(0, 5),
-    listStrategy: input.listConversion.strategy,
-    listSourcePath: input.listConversion.sourcePath
+    rowCount: input2.listConversion.rows.length,
+    columns: Object.keys(input2.listConversion.rows[0] ?? {}),
+    preview: input2.listConversion.rows.slice(0, 5),
+    listStrategy: input2.listConversion.strategy,
+    listSourcePath: input2.listConversion.sourcePath
   } : {
     kind: summaryEntries.length > 0 ? "object" : "raw",
-    summary: input.summary
+    summary: input2.summary
   };
   const envelopeHasCanonicalOutput = isRecord5(envelope.toolResponse) && Object.prototype.hasOwnProperty.call(envelope.toolResponse, "raw");
-  const inspectCommand = `deepline tools execute ${input.toolId} --input ${shellQuote(JSON.stringify(input.params))} --json`;
-  const actions = input.listConversion ? [
+  const inspectCommand = `deepline tools execute ${input2.toolId} --input ${shellQuote(JSON.stringify(input2.params))} --json`;
+  const actions = input2.listConversion ? [
     {
       label: "next",
       command: "move starter script into a project folder and expand it into a Deepline play"
@@ -13764,24 +14050,24 @@ function buildToolExecuteBaseEnvelope(input) {
   return {
     ...envelope,
     ...envelopeHasCanonicalOutput ? { output_preview: outputPreview } : { output: outputPreview },
-    ...summaryEntries.length > 0 ? { summary: input.summary } : {},
+    ...summaryEntries.length > 0 ? { summary: input2.summary } : {},
     next: {
       inspect: inspectCommand,
       playDebugging: "When fixing a play getter, inspect the actual play run table with runs get / inspect rows; do not copy CLI preview paths blindly.",
-      ...input.listConversion ? {
+      ...input2.listConversion ? {
         expandToPlay: "Use stable map and step keys so reruns are idempotent: completed rows are reused, and only missing or stale work runs again.",
-        listSourcePath: input.listConversion.sourcePath ?? "auto-detected list in the CLI response preview"
+        listSourcePath: input2.listConversion.sourcePath ?? "auto-detected list in the CLI response preview"
       } : {}
     },
     render: {
-      sections: input.listConversion ? [
+      sections: input2.listConversion ? [
         {
           title: "output",
           lines: [
-            `${input.listConversion.rows.length} row(s) extracted from ${input.listConversion.sourcePath ?? "auto-detected list"}`,
+            `${input2.listConversion.rows.length} row(s) extracted from ${input2.listConversion.sourcePath ?? "auto-detected list"}`,
             "paths above are observed from this execute response; use run table rows to debug play getters",
-            `columns: ${JSON.stringify(Object.keys(input.listConversion.rows[0] ?? {}))}`,
-            `preview: ${JSON.stringify(input.listConversion.rows.slice(0, 5))}`
+            `columns: ${JSON.stringify(Object.keys(input2.listConversion.rows[0] ?? {}))}`,
+            `preview: ${JSON.stringify(input2.listConversion.rows.slice(0, 5))}`
           ]
         }
       ] : [
@@ -13789,7 +14075,7 @@ function buildToolExecuteBaseEnvelope(input) {
           title: "result",
           lines: summaryEntries.length > 0 ? summaryEntries.map(
             ([key, value]) => `${key}=${String(value)}`
-          ) : [JSON.stringify(input.rawResponse, null, 2)]
+          ) : [JSON.stringify(input2.rawResponse, null, 2)]
         }
       ],
       actions
@@ -14110,6 +14396,174 @@ Examples:
   });
 }
 
+// ../shared_libs/cli/command-compatibility.json
+var command_compatibility_default = {
+  enrich: {
+    family: "python",
+    label: "a legacy Python CLI enrichment command",
+    sdk_alternative: "Use `deepline plays ...` for durable workflows or `deepline tools execute ...` for one tool call."
+  },
+  session: {
+    family: "python",
+    label: "a legacy Python CLI session/playground command",
+    sdk_alternative: "Use SDK play run output and run commands such as `deepline plays run ...`."
+  },
+  workflows: {
+    family: "python",
+    label: "a legacy Python CLI workflow command",
+    sdk_alternative: "Use `deepline plays ...` in the SDK CLI."
+  },
+  backend: {
+    family: "python",
+    label: "a legacy Python CLI playground backend command"
+  },
+  events: {
+    family: "python",
+    label: "a legacy Python CLI event command"
+  },
+  plays: {
+    family: "sdk",
+    label: "an SDK CLI play command",
+    python_alternative: "Use `deepline workflows ...` only for legacy workflows."
+  },
+  play: {
+    family: "sdk",
+    label: "an SDK CLI play command",
+    python_alternative: "Use `deepline workflows ...` only for legacy workflows."
+  },
+  runs: {
+    family: "sdk",
+    label: "an SDK CLI run inspection command"
+  },
+  health: {
+    family: "sdk",
+    label: "an SDK CLI health command"
+  }
+};
+
+// ../shared_libs/cli/install-commands.json
+var install_commands_default = {
+  skills: {
+    index_path: "/.well-known/skills/index.json",
+    default_agents: ["codex", "claude-code", "cursor"],
+    npx_binary: "npx",
+    npx_add_args_template: [
+      "--yes",
+      "skills",
+      "add",
+      "{skills_index_url}",
+      "--agent",
+      "{agents}",
+      "--global",
+      "--yes",
+      "--skill",
+      "{skill_name}",
+      "--full-depth"
+    ]
+  },
+  cli: {
+    legacy_python_shell_template: "curl -s {base_url}/api/v2/cli/install | bash",
+    sdk_npm_global: "npm install -g deepline@latest"
+  }
+};
+
+// src/cli/install-commands.ts
+var INSTALL_COMMANDS = install_commands_default;
+function normalizeBaseUrl2(baseUrl) {
+  return baseUrl.replace(/\/$/, "");
+}
+function renderTemplate(template, values) {
+  return template.replace(/\{([a-z_]+)\}/g, (match, key) => {
+    return values[key] ?? match;
+  });
+}
+function shellJoin(args) {
+  return args.join(" ");
+}
+function skillsIndexUrl(baseUrl) {
+  return `${normalizeBaseUrl2(baseUrl)}${INSTALL_COMMANDS.skills.index_path}`;
+}
+function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
+  const values = {
+    skills_index_url: skillsIndexUrl(baseUrl),
+    agents: INSTALL_COMMANDS.skills.default_agents.join(" "),
+    skill_name: skillName
+  };
+  const rendered = INSTALL_COMMANDS.skills.npx_add_args_template.flatMap(
+    (arg, index) => {
+      const next = index === 0 && options.firstArg ? options.firstArg : arg;
+      const value = renderTemplate(next, values);
+      return arg === "{agents}" ? INSTALL_COMMANDS.skills.default_agents : value;
+    }
+  );
+  return rendered;
+}
+function skillsInstallCommand(baseUrl, skillName) {
+  return `${INSTALL_COMMANDS.skills.npx_binary} ${shellJoin(
+    buildSkillsAddArgs(baseUrl, skillName)
+  )}`;
+}
+function legacyPythonInstallCommand(baseUrl) {
+  return renderTemplate(INSTALL_COMMANDS.cli.legacy_python_shell_template, {
+    base_url: normalizeBaseUrl2(baseUrl)
+  });
+}
+function sdkNpmGlobalInstallCommand() {
+  return INSTALL_COMMANDS.cli.sdk_npm_global;
+}
+
+// src/cli/command-compatibility.ts
+var COMMAND_COMPATIBILITY = command_compatibility_default;
+function cliFamilyLabel(family) {
+  return family === "sdk" ? "SDK CLI" : "legacy Python CLI";
+}
+function commandCompatibilityHint(currentFamily, commandName, baseUrl) {
+  const compatibility = COMMAND_COMPATIBILITY[commandName];
+  if (!compatibility || compatibility.family === currentFamily) {
+    return null;
+  }
+  const expectedFamily = compatibility.family;
+  const currentLabel = cliFamilyLabel(currentFamily);
+  const expectedLabel = cliFamilyLabel(expectedFamily);
+  const lines = [
+    "",
+    "Command compatibility:",
+    `  \`deepline ${commandName}\` is ${compatibility.label}.`,
+    `  Current binary: ${currentLabel}. Required binary: ${expectedLabel}.`,
+    "  If this came from an agent skill, the installed skill likely targets the other Deepline CLI."
+  ];
+  if (currentFamily === "sdk") {
+    lines.push(
+      "",
+      "  To stay on the SDK CLI, install the SDK agent skill:",
+      `    ${skillsInstallCommand(baseUrl, "deepline-sdk")}`,
+      "  To use the legacy Python CLI instead:",
+      `    ${legacyPythonInstallCommand(baseUrl)}`,
+      "  `deepline update` updates this SDK CLI, but it will not switch CLI families."
+    );
+    if (compatibility.sdk_alternative) {
+      lines.push(`  SDK alternative: ${compatibility.sdk_alternative}`);
+    }
+  } else {
+    lines.push(
+      "",
+      "  To use SDK commands, install the SDK CLI and SDK agent skill:",
+      `    ${sdkNpmGlobalInstallCommand()}`,
+      `    ${skillsInstallCommand(baseUrl, "deepline-sdk")}`,
+      "  `deepline update` updates this Python CLI and its skills, but it will not switch CLI families."
+    );
+    if (compatibility.python_alternative) {
+      lines.push(`  Python alternative: ${compatibility.python_alternative}`);
+    }
+  }
+  return lines.join("\n");
+}
+function unknownCommandNameFromMessage(message) {
+  const match = message.match(/unknown command ['"]([^'"]+)['"]/i);
+  const command = match?.[1]?.trim();
+  return command ? command : null;
+}
+
 // src/cli/skills-sync.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import {
@@ -14124,7 +14578,6 @@ import { homedir as homedir5 } from "os";
 import { dirname as dirname10, join as join11 } from "path";
 var CHECK_TIMEOUT_MS2 = 3e3;
 var SDK_SKILL_NAME = "deepline-sdk";
-var SKILL_AGENTS = ["codex", "claude-code", "cursor"];
 var attemptedSync = false;
 function shouldSkipSkillsSync() {
   const value = process.env.DEEPLINE_SKIP_SKILLS_SYNC?.trim().toLowerCase();
@@ -14221,42 +14674,10 @@ async function fetchSkillsUpdate(baseUrl, localVersion) {
   }
 }
 function buildSkillsInstallArgs(baseUrl) {
-  const packageUrl = new URL(
-    "/.well-known/skills/index.json",
-    baseUrl
-  ).toString();
-  return [
-    "--yes",
-    "skills",
-    "add",
-    packageUrl,
-    "--agent",
-    ...SKILL_AGENTS,
-    "--global",
-    "--yes",
-    "--skill",
-    SDK_SKILL_NAME,
-    "--full-depth"
-  ];
+  return buildSkillsAddArgs(baseUrl, SDK_SKILL_NAME);
 }
 function buildBunxSkillsInstallArgs(baseUrl) {
-  const packageUrl = new URL(
-    "/.well-known/skills/index.json",
-    baseUrl
-  ).toString();
-  return [
-    "--bun",
-    "skills",
-    "add",
-    packageUrl,
-    "--agent",
-    ...SKILL_AGENTS,
-    "--global",
-    "--yes",
-    "--skill",
-    SDK_SKILL_NAME,
-    "--full-depth"
-  ];
+  return buildSkillsAddArgs(baseUrl, SDK_SKILL_NAME, { firstArg: "--bun" });
 }
 function hasCommand(command) {
   const result = spawnSync(command, ["--version"], {
@@ -14368,6 +14789,13 @@ async function syncSdkSkillsIfNeeded(baseUrl) {
 }
 
 // src/cli/index.ts
+function asCommanderError(error) {
+  if (!(error instanceof Error) || !("code" in error)) {
+    return null;
+  }
+  const code = error.code;
+  return typeof code === "string" && code.startsWith("commander.") ? error : null;
+}
 function shouldPrintStartupPhase() {
   if (process.argv.includes("--json")) {
     return false;
@@ -14453,7 +14881,7 @@ async function main() {
     progress?.phase("loading deepline cli");
   }
   const program = new Command3();
-  program.name("deepline").description("Deepline CLI (TypeScript SDK)").version(SDK_VERSION, "-v, --version", "Show version").showHelpAfterError().showSuggestionAfterError(true).addHelpText(
+  program.name("deepline").description("Deepline CLI (TypeScript SDK)").version(SDK_VERSION, "-v, --version", "Show version").exitOverride().showHelpAfterError().showSuggestionAfterError(true).addHelpText(
     "after",
     `
 Common commands:
@@ -14462,6 +14890,7 @@ Common commands:
   deepline plays search email --json
   deepline plays describe person-linkedin-to-email --json
   deepline plays run my.play.ts --input '{"domain":"stripe.com"}'
+  deepline secrets check HUBSPOT_TOKEN
   deepline tools execute hunter_email_verifier --input '{"email":"a@b.com"}'
   deepline update
 
@@ -14511,6 +14940,7 @@ Exit codes:
   registerAuthCommands(program);
   registerToolsCommands(program);
   registerPlayCommands(program);
+  registerSecretsCommands(program);
   registerBillingCommands(program);
   registerOrgCommands(program);
   registerCsvCommands(program);
@@ -14580,6 +15010,7 @@ Examples:
       ok: true
     });
   } catch (error) {
+    const commanderError = asCommanderError(error);
     recordCliTrace({
       phase: "cli.main_total",
       ms: Date.now() - mainStartedAt,
@@ -14587,7 +15018,26 @@ Examples:
       error: error instanceof Error ? error.message : String(error)
     });
     progress?.fail();
-    if (process.argv.includes("--json")) {
+    const wantsJson = process.argv.includes("--json");
+    if (commanderError) {
+      if (commanderError.code === "commander.unknownCommand") {
+        const commandName = unknownCommandNameFromMessage(
+          commanderError.message
+        );
+        if (commandName && !wantsJson) {
+          const hint = commandCompatibilityHint(
+            "sdk",
+            commandName,
+            autoDetectBaseUrl()
+          );
+          if (hint) {
+            console.error(hint);
+          }
+        }
+      }
+      process.exitCode = commanderError.code === "commander.unknownCommand" && !wantsJson ? 2 : commanderError.exitCode ?? 1;
+      return;
+    } else if (wantsJson) {
       printJsonError(error);
     } else if (error instanceof Error) {
       console.error(`Error: ${error.message}`);