deepline 0.3.70 → 0.3.72

package/dist/cli/index.mjs

@@ -159,7 +159,7 @@ configureProxyFromEnv();
 
 // src/cli/index.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile6 } from "fs/promises";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import { tmpdir as tmpdir6 } from "os";
 import { Command as Command4 } from "commander";
 
@@ -1199,7 +1199,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.70",
+  version: "0.3.72",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3539,6 +3539,133 @@ function decodePlayRunPublicStatus(value) {
   }
 }
 
+// ../play-runtime/log-provenance.ts
+var LOG_LEVELS = [
+  "debug",
+  "info",
+  "warn",
+  "error"
+];
+var LOG_LEVEL_RANK = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var LOG_PROVENANCE_CLASSES = [
+  "user",
+  "lifecycle",
+  "replay",
+  "infra",
+  "diagnostic",
+  "receipt"
+];
+var LOG_PROVENANCE_POLICY = {
+  user: { watch: true, ui: true, debug: true },
+  lifecycle: { watch: true, ui: true, debug: true },
+  replay: { watch: false, ui: false, debug: true },
+  infra: { watch: false, ui: false, debug: true },
+  diagnostic: { watch: true, ui: true, debug: true },
+  receipt: { watch: false, ui: false, debug: true }
+};
+function logProvenanceReaches(provenance, surface) {
+  return LOG_PROVENANCE_POLICY[provenance][surface];
+}
+var PROVENANCE_SENTINEL = "
";
+var PROVENANCE_PREFIX = `${PROVENANCE_SENTINEL}prov:`;
+function logLevelReaches(level, minimum) {
+  return LOG_LEVEL_RANK[level] >= LOG_LEVEL_RANK[minimum];
+}
+function parseLogLevel(value) {
+  const normalized = value.trim().toLowerCase();
+  return LOG_LEVELS.includes(normalized) ? normalized : null;
+}
+function readProvenanceTag(line) {
+  if (!line.startsWith(PROVENANCE_PREFIX)) {
+    return { provenance: null, line };
+  }
+  const end = line.indexOf(PROVENANCE_SENTINEL, PROVENANCE_PREFIX.length);
+  if (end === -1) {
+    return { provenance: null, line };
+  }
+  const candidate = line.slice(PROVENANCE_PREFIX.length, end);
+  const provenance = LOG_PROVENANCE_CLASSES.includes(candidate) ? candidate : null;
+  return { provenance, line: line.slice(end + 1) };
+}
+function stripProvenanceTag(line) {
+  return readProvenanceTag(line).line;
+}
+function classifyLegacyLogLine(line) {
+  const message = stripLeadingTimestamp(line);
+  if (/recovered (?:from checkpoint|response from checkpoint)/i.test(message)) {
+    return "replay";
+  }
+  if (/^\[perf\] runtime receipt\b/i.test(message)) {
+    return "receipt";
+  }
+  if (/^\[perf\] runtime (?:map|state)\b/i.test(message) || /\[worker\] picked up run\b/.test(message) || /\[worker\] heartbeat\b/.test(message) || /\[worker\] progress completedRows=\d+ totalRows=\d+ rowUpdates=\d+/.test(
+    message
+  ) || /\[worker\] step started\b/.test(message) || /\[worker\] Preparing run files\b/.test(message) || /\[worker\] Run files ready\b/.test(message) || /\[worker\] Runtime ready\b/.test(message) || /\[worker\] Sandbox (?:starting|create start|create done|workspace ready|upload start|runner uploaded)\b/.test(
+    message
+  ) || /^\[event\] play\.step\.progress\b/.test(message) || /^\[event\] play\.run\.snapshot\b/.test(message) || /^\[event\] play\.sheet\.summary\b/.test(message)) {
+    return "infra";
+  }
+  if (/^\[warn\]/i.test(message) || /^\[error\]/i.test(message) || /^\[runtime\.[a-z_]*(?:failure|error)\]/i.test(message)) {
+    return "diagnostic";
+  }
+  return "user";
+}
+function classifyLogLine(line) {
+  const tagged = readProvenanceTag(line);
+  const provenance = tagged.provenance ?? classifyLegacyLogLine(tagged.line);
+  if (tagged.provenance !== null) {
+    return {
+      provenance,
+      level: inferLogLevel(provenance, tagged.line),
+      line: tagged.line
+    };
+  }
+  return {
+    provenance,
+    level: inferLogLevel(provenance, tagged.line),
+    line: tagged.line
+  };
+}
+function inferLogLevel(provenance, line) {
+  const message = stripLeadingTimestamp(line);
+  if (/^\[info\]/i.test(message)) {
+    return "info";
+  }
+  if (/^\[debug\]/i.test(message)) {
+    return "debug";
+  }
+  if (/^\[console\.error\]/i.test(message) || /^\[error\]/i.test(message)) {
+    return "error";
+  }
+  if (/^\[console\.warn\]/i.test(message) || /^\[warn\]/i.test(message)) {
+    return "warn";
+  }
+  if (/^\[console\.debug\]/i.test(message)) {
+    return "debug";
+  }
+  if (provenance === "replay" || provenance === "infra" || provenance === "receipt") {
+    return "debug";
+  }
+  if (provenance === "diagnostic") {
+    return "warn";
+  }
+  return "info";
+}
+function stripLeadingTimestamp(line) {
+  const match = line.match(/^\[([^\]]+)\]\s*([\s\S]*)$/);
+  if (!match) {
+    return line;
+  }
+  const inner = match[1] ?? "";
+  const isTimestamp = !Number.isNaN(new Date(inner).getTime());
+  return isTimestamp ? match[2] ?? line : line;
+}
+
 // ../play-runtime/run-snapshot-stream.ts
 function normalizePlayRunLiveStatus(value) {
   return normalizePlayRunLifecycleStatus(value);
@@ -3611,7 +3738,9 @@ function buildSnapshotFromLedger(snapshot) {
     finishedAt: snapshot.finishedAt ?? null,
     durationMs: snapshot.durationMs ?? null,
     updatedAt: snapshot.updatedAt ?? snapshot.finishedAt ?? snapshot.startedAt ?? null,
-    logs: snapshot.logTail,
+    // This snapshot is public SDK/API transport. Keep the historical plain
+    // timestamp-prefixed text while provenance remains runtime metadata.
+    logs: snapshot.logTail.map(stripProvenanceTag),
     totalLogCount: snapshot.totalLogCount,
     ...snapshot.logsTruncated ? { logsTruncated: true } : {},
     activeArtifactTableNamespace: snapshot.activeArtifactTableNamespace ?? null,
@@ -4839,6 +4968,8 @@ var DeeplineClient = class {
   db;
   /** Billing namespace: subscription status/cancel and invoice history. */
   billing;
+  /** Workspace lifecycle namespace. */
+  workspaces;
   /** Monitors namespace: access, catalog, deploy/check, and lifecycle. */
   monitors;
   /**
@@ -4887,6 +5018,9 @@ var DeeplineClient = class {
       transitionPlan: (options2) => this.transitionTargetBillingPlan(options2),
       portalSession: () => this.createTargetBillingPortalSession()
     };
+    this.workspaces = {
+      create: (options2) => this.createWorkspace(options2)
+    };
     this.monitors = {
       status: () => this.getMonitorsAccess(),
       available: (toolIdOrOptions, options2) => this.getMonitorsAvailable(toolIdOrOptions, options2),
@@ -7038,6 +7172,23 @@ var DeeplineClient = class {
     const response = await this.http.post("/api/v2/billing/portal-sessions", {});
     return response.data;
   }
+  /** Create an additional workspace through the durable PAYG workflow. */
+  async createWorkspace(options) {
+    const idempotencyKey = requireTargetBillingIdempotencyKey(
+      options.idempotencyKey
+    );
+    const response = await this.http.post(
+      "/api/v2/workspaces",
+      { name: options.name },
+      { "Idempotency-Key": idempotencyKey },
+      { maxRetries: 0, exactUrlOnly: true }
+    );
+    return {
+      ...response.data,
+      operation: response.operation,
+      ...response.request_id ? { request_id: response.request_id } : {}
+    };
+  }
   // ——————————————————————————————————————————————————————————
   // Monitors
   // ——————————————————————————————————————————————————————————
@@ -15232,7 +15383,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
-  "  log(message: string): void;",
+  "  log(message: string, options?: { level?: 'debug' | 'info' | 'warn' | 'error' }): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
   "}",
   "export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = { id: string; description?: string; input: PlayInputContract<TInput>; run: (ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>; bindings?: PlayBindings<TInput>; billing?: PlayBindings<TInput>['billing']; runtime?: PlayBindings<TInput>['runtime']; compatibility?: PlayBindings<TInput>['compatibility'] };",
@@ -16789,77 +16940,6 @@ function isInternalGlueStepId(stepId) {
   return typeof stepId === "string" && stepId.startsWith(INTERNAL_GLUE_NODE_ID_PREFIX);
 }
 
-// ../play-runtime/log-provenance.ts
-var LOG_PROVENANCE_CLASSES = [
-  "user",
-  "lifecycle",
-  "replay",
-  "infra",
-  "diagnostic",
-  "receipt"
-];
-var LOG_PROVENANCE_POLICY = {
-  user: { watch: true, ui: true, debug: true },
-  lifecycle: { watch: true, ui: true, debug: true },
-  replay: { watch: false, ui: false, debug: true },
-  infra: { watch: false, ui: false, debug: true },
-  diagnostic: { watch: true, ui: true, debug: true },
-  receipt: { watch: false, ui: false, debug: true }
-};
-function logProvenanceReaches(provenance, surface) {
-  return LOG_PROVENANCE_POLICY[provenance][surface];
-}
-var PROVENANCE_SENTINEL = "
";
-var PROVENANCE_PREFIX = `${PROVENANCE_SENTINEL}prov:`;
-function readProvenanceTag(line) {
-  if (!line.startsWith(PROVENANCE_PREFIX)) {
-    return { provenance: null, line };
-  }
-  const end = line.indexOf(PROVENANCE_SENTINEL, PROVENANCE_PREFIX.length);
-  if (end === -1) {
-    return { provenance: null, line };
-  }
-  const candidate = line.slice(PROVENANCE_PREFIX.length, end);
-  const provenance = LOG_PROVENANCE_CLASSES.includes(candidate) ? candidate : null;
-  return { provenance, line: line.slice(end + 1) };
-}
-function classifyLegacyLogLine(line) {
-  const message = stripLeadingTimestamp(line);
-  if (/recovered (?:from checkpoint|response from checkpoint)/i.test(message)) {
-    return "replay";
-  }
-  if (/^\[perf\] runtime receipt\b/i.test(message)) {
-    return "receipt";
-  }
-  if (/^\[perf\] runtime (?:map|state)\b/i.test(message) || /\[worker\] picked up run\b/.test(message) || /\[worker\] heartbeat\b/.test(message) || /\[worker\] progress completedRows=\d+ totalRows=\d+ rowUpdates=\d+/.test(
-    message
-  ) || /\[worker\] step started\b/.test(message) || /\[worker\] Preparing run files\b/.test(message) || /\[worker\] Run files ready\b/.test(message) || /\[worker\] Runtime ready\b/.test(message) || /\[worker\] Sandbox (?:starting|create start|create done|workspace ready|upload start|runner uploaded)\b/.test(
-    message
-  ) || /^\[event\] play\.step\.progress\b/.test(message) || /^\[event\] play\.run\.snapshot\b/.test(message) || /^\[event\] play\.sheet\.summary\b/.test(message)) {
-    return "infra";
-  }
-  if (/^\[warn\]/i.test(message) || /^\[error\]/i.test(message) || /^\[runtime\.[a-z_]*(?:failure|error)\]/i.test(message)) {
-    return "diagnostic";
-  }
-  return "user";
-}
-function classifyLogLine(line) {
-  const tagged = readProvenanceTag(line);
-  if (tagged.provenance !== null) {
-    return { provenance: tagged.provenance, line: tagged.line };
-  }
-  return { provenance: classifyLegacyLogLine(tagged.line), line: tagged.line };
-}
-function stripLeadingTimestamp(line) {
-  const match = line.match(/^\[([^\]]+)\]\s*([\s\S]*)$/);
-  if (!match) {
-    return line;
-  }
-  const inner = match[1] ?? "";
-  const isTimestamp = !Number.isNaN(new Date(inner).getTime());
-  return isTimestamp ? match[2] ?? line : line;
-}
-
 // ../play-runtime/fixture-behavior.ts
 var FIXTURE_BEHAVIOR_VERSION = 1;
 var FIXTURE_BEHAVIOR_RESPONSE_VERSION = 2;
@@ -18287,7 +18367,11 @@ var TERMINAL_PLAY_STATUSES2 = /* @__PURE__ */ new Set([
 var PLAY_START_TRANSIENT_RETRY_DELAYS_MS = [500, 1500];
 var PLAY_PROGRESS_HEARTBEAT_INTERVAL_MS = 15e3;
 var PLAY_STATUS_HEARTBEAT_INTERVAL_MS = 15e3;
-function watchSurfaceReaches(state, provenance) {
+function watchSurfaceReaches(state, provenance, level) {
+  const minimumLevel = state.logLevel ?? (state.verbose ? "debug" : "info");
+  if (!logLevelReaches(level, minimumLevel)) {
+    return false;
+  }
   if (logProvenanceReaches(provenance, "watch")) {
     return true;
   }
@@ -18482,7 +18566,7 @@ function emitLiveDebugTableHints(input2) {
       process.stdout
     );
   }
-  if (!watchSurfaceReaches(input2.state, "infra")) {
+  if (!watchSurfaceReaches(input2.state, "infra", "debug")) {
     return;
   }
   const tableNamespace = extractTableNamespaceFromLiveEvent(input2.event);
@@ -18585,7 +18669,7 @@ function getStepTransitionLineFromLiveEvent(event, state) {
   if (isTerminal) {
     state.terminalStepIds.add(stepId);
   }
-  if (isReplayEcho && !watchSurfaceReaches(state, "replay")) {
+  if (isReplayEcho && !watchSurfaceReaches(state, "replay", "debug")) {
     return null;
   }
   return `step ${label}: ${status}`;
@@ -18989,6 +19073,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input2) {
     lastLogIndex: 0,
     emittedRunnerStarted: false,
     verbose: input2.verboseLogs === true,
+    logLevel: input2.logLevel ?? "info",
     lastProgressSignature: null,
     lastProgressHeartbeatAt: 0,
     lastStatusHeartbeatAt: 0
@@ -19367,6 +19452,9 @@ function formatPlayLogLine(rawLine, status, state) {
   const message = timestampMatch?.[2] ?? line;
   const prefix = timestamp ? `${timestamp} ` : "";
   if (/\[worker\] picked up run\b/.test(message)) {
+    if (!logLevelReaches("info", state.logLevel ?? "info")) {
+      return null;
+    }
     if (state.emittedRunnerStarted) {
       return null;
     }
@@ -19383,6 +19471,9 @@ function formatPlayLogLine(rawLine, status, state) {
     /^Starting map over (\d+) items with (\d+) fields \(key: ([^;]+); (\d+) already satisfied; (\d+) pending\)$/
   );
   if (mapStart) {
+    if (!logLevelReaches("info", state.logLevel ?? "info")) {
+      return null;
+    }
     const [, rows, fields, namespace, cached, pending] = mapStart;
     return `${prefix}map ${sourceLabelForNamespace(namespace)}: ${formatInteger(Number(rows))} rows, ${fields} fields, ${formatInteger(Number(cached))} cached, ${formatInteger(Number(pending))} pending`;
   }
@@ -19390,10 +19481,13 @@ function formatPlayLogLine(rawLine, status, state) {
     /^Map completed: (\d+) results \((\d+) executed, (\d+) already satisfied\)$/
   );
   if (mapDone) {
+    if (!logLevelReaches("info", state.logLevel ?? "info")) {
+      return null;
+    }
     const [, results, executed, cached] = mapDone;
     return `${prefix}done: ${formatInteger(Number(results))} results, ${formatInteger(Number(executed))} executed, ${formatInteger(Number(cached))} cached`;
   }
-  if (!watchSurfaceReaches(state, classified.provenance)) {
+  if (!watchSurfaceReaches(state, classified.provenance, classified.level)) {
     return null;
   }
   return `${prefix}${message}`;
@@ -21129,13 +21223,12 @@ function parsePlayRunOptions(args) {
   const watch = !args.includes("--no-wait");
   let jsonOutput = watch ? args.includes("--json") : argsWantJson(args);
   const fullJson = args.includes("--full");
-  const explicitDebugLogs = args.includes("--logs") || args.some((_, index) => isBarePlayRunDebugFlag(args, index));
-  const emitLogs = !jsonOutput || explicitDebugLogs;
   const force = args.includes("--force");
   const forceToolRefresh = args.includes("--force-tool-refresh");
   const open2 = args.includes("--open");
   const debugMapLatency = args.includes("--debug-map-latency");
-  const verboseLogs = explicitDebugLogs || debugMapLatency;
+  let logLevel = "info";
+  let hasExplicitLogLevel = false;
   let waitTimeoutMs = null;
   let maxConcurrentExternalCalls = null;
   let maxConcurrentRows = null;
@@ -21156,6 +21249,23 @@ function parsePlayRunOptions(args) {
       input2 = parseJsonInput(args[++index]);
       continue;
     }
+    if (arg === "--log-level" || arg.startsWith("--log-level=")) {
+      const value = arg === "--log-level" ? args[++index] : arg.slice("--log-level=".length);
+      if (!value || value.startsWith("--")) {
+        throw new Error(
+          "--log-level requires one of: debug, info, warn, error."
+        );
+      }
+      const parsed = parseLogLevel(value);
+      if (!parsed) {
+        throw new Error(
+          `Unsupported --log-level ${JSON.stringify(value)}. Use debug, info, warn, or error.`
+        );
+      }
+      logLevel = parsed;
+      hasExplicitLogLevel = true;
+      continue;
+    }
     if (arg === "--run-id-file") {
       const value = args[index + 1];
       if (!value || value.startsWith("--")) {
@@ -21334,6 +21444,17 @@ function parsePlayRunOptions(args) {
       "--live, --latest, and --revision-id only apply to named plays."
     );
   }
+  if (debugMapLatency && logLevel === "info") logLevel = "debug";
+  const usesDebugAlias = args.includes("--logs") || args.some((_, index) => isBarePlayRunDebugFlag(args, index));
+  if (usesDebugAlias && hasExplicitLogLevel && logLevel !== "debug") {
+    throw new Error(
+      "--debug/--logs conflicts with a non-debug --log-level. Use one level selector."
+    );
+  }
+  if (usesDebugAlias) logLevel = "debug";
+  const explicitDebugLogs = usesDebugAlias || logLevel === "debug";
+  const emitLogs = !jsonOutput || explicitDebugLogs || hasExplicitLogLevel;
+  const verboseLogs = explicitDebugLogs || debugMapLatency;
   return {
     target: filePath ? { kind: "file", path: filePath } : { kind: "name", name: playName },
     input: input2,
@@ -21342,6 +21463,7 @@ function parsePlayRunOptions(args) {
     watch,
     emitLogs,
     verboseLogs,
+    logLevel,
     jsonOutput,
     fullJson,
     waitTimeoutMs,
@@ -22239,6 +22361,7 @@ async function handleFileBackedRun(options, hooks) {
         jsonOutput: options.jsonOutput,
         emitLogs: options.emitLogs,
         verboseLogs: options.verboseLogs,
+        logLevel: options.logLevel,
         waitTimeoutMs: options.waitTimeoutMs,
         open: options.open,
         progress,
@@ -22421,6 +22544,7 @@ async function handleNamedRun(options, hooks) {
         jsonOutput: options.jsonOutput,
         emitLogs: options.emitLogs,
         verboseLogs: options.verboseLogs,
+        logLevel: options.logLevel,
         waitTimeoutMs: options.waitTimeoutMs,
         open: options.open,
         progress,
@@ -22538,12 +22662,13 @@ async function handlePlayRun(args, hooks) {
 function parseRunIdPositional(args, usage) {
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
-    if (arg === "--json" || arg === "--full" || arg === "--input" || arg === "--logs" || arg === "--debug" || arg === "--compact" || arg === "--log-failed" || arg === "--failed" || arg === "--limit") {
-      if (arg === "--limit" && args[index + 1]) {
+    if (arg === "--json" || arg === "--full" || arg === "--input" || arg === "--logs" || arg === "--debug" || arg === "--compact" || arg === "--log-failed" || arg === "--failed" || arg === "--limit" || arg === "--log-level") {
+      if ((arg === "--limit" || arg === "--log-level") && args[index + 1]) {
         index += 1;
       }
       continue;
     }
+    if (arg.startsWith("--log-level=")) continue;
     if ((arg === "--out" || arg === "--reason" || arg === "--dataset") && args[index + 1]) {
       index += 1;
       continue;
@@ -22705,7 +22830,7 @@ async function handleRunsList(args) {
   return 0;
 }
 async function handleRunTail(args) {
-  const usage = "Usage: deepline runs tail <run-id> [--json | --jsonl] [--compact] [--debug]";
+  const usage = "Usage: deepline runs tail <run-id> [--json | --jsonl] [--compact] [--log-level debug|info|warn|error]";
   let runId;
   try {
     runId = parseRunIdPositional(args, usage);
@@ -22713,6 +22838,9 @@ async function handleRunTail(args) {
     console.error(error instanceof Error ? error.message : usage);
     return 1;
   }
+  let logLevel = "info";
+  let hasExplicitLogLevel = false;
+  let usesDebugAlias = false;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--cursor") {
@@ -22721,7 +22849,28 @@ async function handleRunTail(args) {
       );
       return 1;
     }
-    if (arg.startsWith("--") && arg !== "--json" && arg !== "--jsonl" && arg !== "--compact" && arg !== "--logs" && arg !== "--debug") {
+    if (arg === "--log-level" || arg.startsWith("--log-level=")) {
+      const value = arg === "--log-level" ? args[++index] : arg.slice("--log-level=".length);
+      if (!value || value.startsWith("--")) {
+        console.error("--log-level requires one of: debug, info, warn, error.");
+        return 1;
+      }
+      const parsed = parseLogLevel(value);
+      if (!parsed) {
+        console.error(
+          `Unsupported --log-level ${JSON.stringify(value)}. Use debug, info, warn, or error.`
+        );
+        return 1;
+      }
+      logLevel = parsed;
+      hasExplicitLogLevel = true;
+      continue;
+    }
+    if (arg === "--logs" || arg === "--debug") {
+      usesDebugAlias = true;
+      continue;
+    }
+    if (arg.startsWith("--") && arg !== "--json" && arg !== "--jsonl" && arg !== "--compact") {
       console.error(`${arg} is not supported by deepline runs tail.`);
       return 1;
     }
@@ -22730,10 +22879,17 @@ async function handleRunTail(args) {
     console.error("--json and --jsonl cannot be used together.");
     return 1;
   }
-  const debug = args.includes("--logs") || args.includes("--debug");
-  if (args.includes("--jsonl") && debug) {
+  if (usesDebugAlias && hasExplicitLogLevel && logLevel !== "debug") {
+    console.error(
+      "--debug conflicts with a non-debug --log-level. Use one level selector."
+    );
+    return 1;
+  }
+  if (usesDebugAlias) logLevel = "debug";
+  const debug = logLevel === "debug";
+  if (args.includes("--jsonl") && (debug || hasExplicitLogLevel)) {
     console.error(
-      "--debug is redundant with --jsonl: JSON Lines already includes every canonical live event."
+      "--log-level cannot be combined with --jsonl: JSON Lines already includes every canonical live event."
     );
     return 1;
   }
@@ -22747,7 +22903,8 @@ async function handleRunTail(args) {
     lastProgressSignature: null,
     lastProgressHeartbeatAt: 0,
     lastStatusHeartbeatAt: 0,
-    verbose: debug
+    verbose: debug,
+    logLevel
   };
   const status = await client2.runs.tail(runId, {
     onEvent: jsonLines ? (event) => {
@@ -22759,8 +22916,8 @@ async function handleRunTail(args) {
         })}
 `
       );
-    } : compact || debug ? (event) => {
-      if (debug) {
+    } : compact || debug || hasExplicitLogLevel ? (event) => {
+      if (debug || hasExplicitLogLevel) {
         for (const line of getLogLinesFromLiveEvent(event)) {
           const formatted = formatPlayLogLine(
             line,
@@ -22795,7 +22952,7 @@ async function handleRunTail(args) {
       }
     } : void 0,
     // Human mode only: in --json mode emit nothing non-protocol.
-    onReconnect: jsonOutput && !debug ? void 0 : ({ reason }) => {
+    onReconnect: jsonOutput && !debug && !hasExplicitLogLevel ? void 0 : ({ reason }) => {
       process.stderr.write(
         `[runs tail] stream ended without a terminal status; reconnecting to run ${runId} (${reason})
 `
@@ -22811,7 +22968,7 @@ async function handleRunTail(args) {
   return status.status === "failed" ? 1 : 0;
 }
 async function handleRunLogs(args) {
-  const usage = "Usage: deepline runs logs <run-id> [--limit 200] [--failed] [--out run.log] [--json] [--debug]";
+  const usage = "Usage: deepline runs logs <run-id> [--limit 200] [--failed] [--out run.log] [--log-level debug|info|warn|error] [--json]";
   let runId;
   try {
     runId = parseRunIdPositional(args, usage);
@@ -22821,10 +22978,34 @@ async function handleRunLogs(args) {
   }
   let limit = 200;
   let outPath = null;
+  let logLevel = "debug";
+  let hasExplicitLogLevel = false;
+  let usesDebugAlias = false;
   const failed = args.includes("--failed");
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
-    if (arg === "--debug" || arg === "--logs" || arg === "--json" || arg === "--failed") {
+    if (arg === "--debug" || arg === "--logs") {
+      usesDebugAlias = true;
+      continue;
+    }
+    if (arg === "--json" || arg === "--failed") {
+      continue;
+    }
+    if (arg === "--log-level" || arg.startsWith("--log-level=")) {
+      const value = arg === "--log-level" ? args[++index] : arg.slice("--log-level=".length);
+      if (!value || value.startsWith("--")) {
+        console.error("--log-level requires one of: debug, info, warn, error.");
+        return 1;
+      }
+      const parsed = parseLogLevel(value);
+      if (!parsed) {
+        console.error(
+          `Unsupported --log-level ${JSON.stringify(value)}. Use debug, info, warn, or error.`
+        );
+        return 1;
+      }
+      logLevel = parsed;
+      hasExplicitLogLevel = true;
       continue;
     }
     if (arg === "--limit" && args[index + 1]) {
@@ -22840,6 +23021,13 @@ async function handleRunLogs(args) {
       return 1;
     }
   }
+  if (usesDebugAlias && hasExplicitLogLevel && logLevel !== "debug") {
+    console.error(
+      "--debug conflicts with a non-debug --log-level. Use one level selector."
+    );
+    return 1;
+  }
+  if (usesDebugAlias) logLevel = "debug";
   if (failed && outPath) {
     console.error(
       "--failed cannot be combined with --out. Remove --failed to export the full persisted log stream."
@@ -22849,7 +23037,7 @@ async function handleRunLogs(args) {
   const client2 = new DeeplineClient();
   if (outPath) {
     const result2 = await client2.runs.logs(runId, { all: true });
-    const logs = result2.entries;
+    const logs = result2.entries.filter((line) => logLevelReaches(classifyLogLine(line).level, logLevel)).map((line) => classifyLogLine(line).line);
     writeFileSync10(outPath, `${logs.join("\n")}${logs.length > 0 ? "\n" : ""}`);
     printCommandEnvelope(
       {
@@ -22857,6 +23045,7 @@ async function handleRunLogs(args) {
         log_path: outPath,
         lineCount: logs.length,
         totalCount: result2.totalCount,
+        logLevel,
         ...result2.logsTruncated ? { logsTruncated: true } : {},
         local: { log_path: outPath },
         render: {
@@ -22877,27 +23066,47 @@ async function handleRunLogs(args) {
     );
     return 0;
   }
-  const result = await client2.runs.logs(runId, { limit, failed });
-  const text = buildRunLogsText(result);
+  const result = await client2.runs.logs(runId, {
+    ...failed ? { limit, failed: true } : { all: logLevel !== "debug", limit }
+  });
+  const matchingEntries = result.entries.filter(
+    (line) => logLevelReaches(classifyLogLine(line).level, logLevel)
+  );
+  const entries = failed ? matchingEntries : matchingEntries.slice(-limit);
+  const matchingEntriesTruncated = !failed && matchingEntries.length > limit;
+  const filteredResult = {
+    ...result,
+    entries,
+    returnedCount: entries.length,
+    truncated: result.truncated || matchingEntriesTruncated,
+    hasMore: result.hasMore || matchingEntriesTruncated,
+    view: failed ? result.view : "tail",
+    next: {
+      ...result.next ?? {},
+      logs: `deepline runs logs ${result.runId} --out run.log --log-level ${logLevel} --json`
+    }
+  };
+  const text = buildRunLogsText(filteredResult);
   printCommandEnvelope(
     {
       runId: result.runId,
       totalCount: result.totalCount,
-      returnedCount: result.returnedCount,
+      returnedCount: entries.length,
       firstSequence: result.firstSequence,
       lastSequence: result.lastSequence,
-      truncated: result.truncated,
-      hasMore: result.hasMore,
+      truncated: filteredResult.truncated,
+      hasMore: filteredResult.hasMore,
+      logLevel,
       ...result.logsTruncated ? { logsTruncated: true } : {},
-      entries: result.entries,
-      ...result.view ? { view: result.view } : {},
+      entries,
+      ...filteredResult.view ? { view: filteredResult.view } : {},
       ...result.association ? { association: result.association } : {},
       ...result.warning ? { warning: result.warning } : {},
       next: {
         ...result.next ?? {},
-        export: `deepline runs logs ${result.runId} --out run.log --json`
+        export: `deepline runs logs ${result.runId} --out run.log --log-level ${logLevel} --json`
       },
-      render: { sections: [{ title: "run logs", lines: result.entries }] }
+      render: { sections: [{ title: "run logs", lines: entries }] }
     },
     {
       json: argsWantJson(args),
@@ -22907,7 +23116,7 @@ async function handleRunLogs(args) {
   return 0;
 }
 function buildRunLogsText(result) {
-  const lines = [...result.entries];
+  const lines = result.entries.map((line) => classifyLogLine(line).line);
   if (result.warning) {
     if (lines.length > 0) lines.push("");
     lines.push(`warning: ${result.warning}`);
@@ -24291,6 +24500,7 @@ Examples:
   deepline plays run long-background-play --no-wait
   deepline plays run long-background-play --run-id-file ./run-id.json
   deepline plays run my.play.ts --input '{"domain":"stripe.com"}'
+  deepline plays run my.play.ts --input '{"domain":"stripe.com"}' --log-level debug
   deepline plays run my.play.ts --profile absurd
   deepline plays run my.play.ts --max-concurrent-external-calls 20
   deepline plays run my.play.ts --input @input.json --json
@@ -24310,9 +24520,12 @@ Examples:
   ).option("--watch", "Compatibility alias; run waits by default").option("--wait", "Compatibility alias; run waits by default").option("--no-wait", "Start the run and return immediately").option(
     "--run-id-file <path>",
     "Atomically write the accepted run id to a new JSON file"
-  ).option("--logs", "Compatibility alias for --debug").option(
+  ).option("--logs", "Compatibility alias for --log-level debug").option(
     "--debug [value]",
-    "Stream complete customer-safe runtime logs when passed without a value; otherwise pass input.debug"
+    "Compatibility alias for --log-level debug when bare; --debug <value> remains legacy Play input.debug"
+  ).option(
+    "--log-level <level>",
+    "Minimum live log severity: debug, info (default), warn, or error"
   ).option("--tail-timeout-ms <ms>", "Timeout while watching the run stream").option("--force", "Start a fresh run graph").option(
     "--force-tool-refresh",
     "Refresh completed tool receipts; may repeat billed provider calls"
@@ -24362,6 +24575,7 @@ Pass-through input flags:
       ...options.watch || options.wait ? ["--watch"] : [],
       ...options.logs ? ["--logs"] : [],
       ...options.debug === true ? ["--debug"] : typeof options.debug === "string" ? ["--debug", options.debug] : [],
+      ...options.logLevel ? ["--log-level", options.logLevel] : [],
       ...options.tailTimeoutMs ? ["--tail-timeout-ms", options.tailTimeoutMs] : [],
       ...options.force ? ["--force"] : [],
       ...options.forceToolRefresh ? ["--force-tool-refresh"] : [],
@@ -24670,10 +24884,15 @@ Concepts:
   tail reads the live stream. logs fetches persisted logs after the fact.
   stop mutates cloud state by requesting cancellation.
 
+Debug a run:
+  Active:    deepline runs tail <run-id> --log-level debug
+  Historical: deepline runs logs <run-id> --out run.log --log-level debug --json
+  Full state: deepline runs get <run-id> --full --json
+
 Examples:
   deepline runs get play/my-play/run/20260501t000000-000 --json
   deepline runs tail play/my-play/run/20260501t000000-000
-  deepline runs logs play/my-play/run/20260501t000000-000 --out run.log --json
+  deepline runs logs play/my-play/run/20260501t000000-000 --out run.log --log-level debug --json
   deepline runs list --play my-play --status failed --json
   deepline runs list --status running --json
   deepline runs stop play/my-play/run/20260501t000000-000 --reason "stale lock" --json
@@ -24779,13 +24998,15 @@ Notes:
   logs for persisted log history. In human output, --compact prints deduplicated
   step transitions and progress instead of the full event stream. --json emits
   one terminal package. --jsonl emits canonical live events as JSON Lines and
-  ends with the same compact package shape as runs get --json. Use --debug
-  (or legacy --logs) to also print customer-safe runtime log lines to stderr.
+  ends with the same compact package shape as runs get --json. --log-level
+  filters the rendered customer-safe runtime log lines; debug includes runtime
+  and receipt diagnostics and writes them to stderr alongside JSON output.
 
 Examples:
   deepline runs tail play/my-play/run/20260501t000000-000
   deepline runs tail play/my-play/run/20260501t000000-000 --compact
-  deepline runs tail play/my-play/run/20260501t000000-000 --debug
+  deepline runs tail play/my-play/run/20260501t000000-000 --log-level debug
+  deepline runs tail play/my-play/run/20260501t000000-000 --log-level error
   deepline runs tail play/my-play/run/20260501t000000-000 --jsonl
 `
   ).option("--json", "Emit one terminal JSON package after the run completes").option(
@@ -24794,9 +25015,9 @@ Examples:
   ).option(
     "--compact",
     "Show deduplicated human step transitions and progress"
-  ).option("--logs", "Compatibility alias for --debug").option(
-    "--debug",
-    "Print customer-safe runtime log lines to stderr while tailing"
+  ).option("--logs", "Compatibility alias for --log-level debug").option("--debug", "Compatibility alias for --log-level debug").option(
+    "--log-level <level>",
+    "Minimum severity: debug, info (default), warn, or error"
   ).action(async (runId, options) => {
     process.exitCode = await handleRunTail([
       runId,
@@ -24804,7 +25025,8 @@ Examples:
       ...options.jsonl ? ["--jsonl"] : [],
       ...options.compact ? ["--compact"] : [],
       ...options.logs ? ["--logs"] : [],
-      ...options.debug ? ["--debug"] : []
+      ...options.debug ? ["--debug"] : [],
+      ...options.logLevel ? ["--log-level", options.logLevel] : []
     ]);
   });
   runs.command("logs <runId>").description("Fetch persisted logs for a play run.").addHelpText(
@@ -24812,29 +25034,30 @@ Examples:
     `
 Notes:
   Prints a bounded recent log preview by default. Use --out to write the full
-  persisted log stream to a local file. --debug (or legacy --logs) is accepted
-  for script parity; this command already returns the unfiltered durable stream.
+  retained stream to a local file. Use --log-level to filter by severity;
+  default debug preserves the complete historical stream.
 
 Examples:
   deepline runs logs play/my-play/run/20260501t000000-000
   deepline runs logs play/my-play/run/20260501t000000-000 --limit 500
   deepline runs logs play/my-play/run/20260501t000000-000 --failed --json
-  deepline runs logs play/my-play/run/20260501t000000-000 --debug
-  deepline runs logs play/my-play/run/20260501t000000-000 --out run.log --json
+  deepline runs logs play/my-play/run/20260501t000000-000 --log-level error
+  deepline runs logs play/my-play/run/20260501t000000-000 --out run.log --log-level debug --json
 `
   ).option(
     "--limit <count>",
     "Maximum recent log lines to print without --out",
     "200"
-  ).option("--out <path>", "Write the full persisted log stream to a file").option("--failed", "Show the bounded terminal-failure log window").option("--logs", "Compatibility alias for --debug").option(
-    "--debug",
-    "Explicitly request the same persisted log view (no provenance filtering)"
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (runId, options) => {
+  ).option("--out <path>", "Write the full retained log stream to a file").option("--failed", "Show the bounded terminal-failure log window").option(
+    "--log-level <level>",
+    "Minimum severity: debug (default), info, warn, or error"
+  ).option("--logs", "Compatibility alias for --log-level debug").option("--debug", "Compatibility alias for --log-level debug").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (runId, options) => {
     process.exitCode = await handleRunLogs([
       runId,
       ...options.limit ? ["--limit", options.limit] : [],
       ...options.out ? ["--out", options.out] : [],
       ...options.failed ? ["--failed"] : [],
+      ...options.logLevel ? ["--log-level", options.logLevel] : [],
       ...options.logs ? ["--logs"] : [],
       ...options.debug ? ["--debug"] : [],
       ...options.json ? ["--json"] : []
@@ -33827,6 +34050,92 @@ Examples:
 }
 
 // src/cli/commands/org.ts
+import { createHash as createHash5, randomUUID as randomUUID6 } from "crypto";
+import {
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync12,
+  unlinkSync,
+  writeFileSync as writeFileSync13
+} from "fs";
+import { join as join13 } from "path";
+function pendingOrgCreatePath(baseUrl, accountId, sourceOrgId, name) {
+  const intent = createHash5("sha256").update(accountId).update("\0").update(sourceOrgId).update("\0").update(name).digest("hex");
+  return join13(sdkCliStateDirPath(baseUrl), `pending-org-create-${intent}.json`);
+}
+function readPendingOrgCreate(path, accountId, sourceOrgId, name) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync12(path, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `Cannot resume the pending workspace creation recorded at ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof value !== "object" || value === null || value.accountId !== accountId || value.sourceOrgId !== sourceOrgId || value.name !== name || typeof value.idempotencyKey !== "string" || !value.idempotencyKey.trim()) {
+    throw new Error(
+      `Cannot resume the pending workspace creation recorded at ${path}: the saved intent is invalid.`
+    );
+  }
+  return value;
+}
+function loadOrCreatePendingOrgCreate(input2) {
+  const stateDir = sdkCliStateDirPath(input2.baseUrl);
+  const path = pendingOrgCreatePath(
+    input2.baseUrl,
+    input2.accountId,
+    input2.sourceOrgId,
+    input2.name
+  );
+  mkdirSync9(stateDir, { recursive: true });
+  if (existsSync11(path)) {
+    return {
+      ...readPendingOrgCreate(
+        path,
+        input2.accountId,
+        input2.sourceOrgId,
+        input2.name
+      ),
+      path
+    };
+  }
+  const pending = {
+    accountId: input2.accountId,
+    sourceOrgId: input2.sourceOrgId,
+    name: input2.name,
+    idempotencyKey: randomUUID6()
+  };
+  try {
+    writeFileSync13(path, `${JSON.stringify(pending)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    return { ...pending, path };
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    return {
+      ...readPendingOrgCreate(
+        path,
+        input2.accountId,
+        input2.sourceOrgId,
+        input2.name
+      ),
+      path
+    };
+  }
+}
+async function fetchWorkspaceCreationIdentity(http, apiKey) {
+  const status = await http.post("/api/v2/auth/cli/status", { api_key: apiKey });
+  const accountId = status.user_id?.trim();
+  if (!accountId) {
+    throw new Error(
+      "Workspace creation requires an API key linked to a user account."
+    );
+  }
+  return { accountId, orgId: status.org_id?.trim() || null };
+}
 async function fetchOrganizations(http, apiKey) {
   return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
 }
@@ -34295,23 +34604,58 @@ async function handleOrgSwitch(selection, options) {
 }
 async function handleOrgCreate(name, options) {
   const config = resolveConfig();
+  const normalizedName = name.trim();
+  if (!normalizedName) {
+    throw new Error("Workspace name is required.");
+  }
   const http = new HttpClient(config);
-  const created = await http.post("/api/v2/auth/cli/org-create", {
-    api_key: config.apiKey,
-    name
-  });
+  const identity = await fetchWorkspaceCreationIdentity(http, config.apiKey);
+  let created;
+  let workspaceApiKey;
+  let pendingIntentPath = null;
+  if (!identity.orgId) {
+    const firstWorkspace = await http.post("/api/v2/auth/cli/org-create", {
+      api_key: config.apiKey,
+      name: normalizedName
+    });
+    const { api_key: apiKey, ...publicFirstWorkspace } = firstWorkspace;
+    workspaceApiKey = apiKey;
+    created = publicFirstWorkspace;
+  } else {
+    const pending = loadOrCreatePendingOrgCreate({
+      baseUrl: config.baseUrl,
+      accountId: identity.accountId,
+      sourceOrgId: identity.orgId,
+      name: normalizedName
+    });
+    const workspace = await new DeeplineClient({
+      apiKey: config.apiKey,
+      baseUrl: config.baseUrl
+    }).workspaces.create({
+      name: normalizedName,
+      idempotencyKey: pending.idempotencyKey
+    });
+    const switched = await http.post("/api/v2/auth/cli/switch", {
+      api_key: config.apiKey,
+      org_id: workspace.org_id
+    });
+    workspaceApiKey = switched.api_key;
+    created = { ...workspace };
+    pendingIntentPath = pending.path;
+  }
   const authValues = organizationAuthValues({
     baseUrl: config.baseUrl,
-    apiKey: created.api_key,
+    apiKey: workspaceApiKey,
     orgId: created.org_id,
     orgName: created.org_name
   });
   saveHostEnvValues(config.baseUrl, authValues);
-  const { api_key: _apiKey, ...publicCreated } = created;
+  if (pendingIntentPath) unlinkSync(pendingIntentPath);
   printCommandEnvelope(
     {
       ok: true,
-      ...publicCreated,
+      ...created,
+      initial_credits: typeof created.initial_credits === "number" ? created.initial_credits : 0,
       api_key_saved: true,
       switched: true,
       host_env_path: hostEnvFilePath(config.baseUrl),
@@ -34394,9 +34738,9 @@ Examples:
     "after",
     `
 Notes:
-  Mutates workspace state. The new organization is created for the current
-  authenticated user, then the returned API key is saved for this host so later
-  CLI commands target the new organization.
+  Mutates workspace and billing state. The new organization is created for the
+  current authenticated user and provisioned on the active PAYG offer before
+  this CLI switches to it. Interrupted requests resume automatically.
 
 Examples:
   deepline org create Acme
@@ -34854,27 +35198,27 @@ Examples:
 // src/cli/commands/setup.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync15,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync4,
-  writeFileSync as writeFileSync15
+  writeFileSync as writeFileSync16
 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname16, join as join16, resolve as resolve16 } from "path";
+import { dirname as dirname16, join as join17, resolve as resolve16 } from "path";
 
 // src/cli/installation-lifecycle.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   lstatSync,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   realpathSync as realpathSync3,
   rmSync as rmSync4
 } from "fs";
-import { basename as basename6, dirname as dirname13, join as join13, relative as relative5, resolve as resolve15 } from "path";
+import { basename as basename6, dirname as dirname13, join as join14, relative as relative5, resolve as resolve15 } from "path";
 var nodeFileSystem = {
-  exists: existsSync11,
+  exists: existsSync12,
   isSymbolicLink(path) {
     try {
       return lstatSync(path).isSymbolicLink();
@@ -34884,7 +35228,7 @@ var nodeFileSystem = {
   },
   read(path) {
     try {
-      return readFileSync12(path, "utf8");
+      return readFileSync13(path, "utf8");
     } catch {
       return "";
     }
@@ -34928,25 +35272,25 @@ var CliInstallation = class _CliInstallation {
     });
   }
   static isNpmPackagePath(path) {
-    return path?.includes(`${join13("node_modules", "deepline")}`) ?? false;
+    return path?.includes(`${join14("node_modules", "deepline")}`) ?? false;
   }
   launcher(path) {
     return inspectLauncher(path, this.input.fileSystem);
   }
   retiredArtifacts() {
-    const hostDir = join13(
+    const hostDir = join14(
       this.input.home,
       ".local",
       "deepline",
       this.input.baseUrlSlug
     );
-    const legacyLauncherPath = join13(
+    const legacyLauncherPath = join14(
       this.input.home,
       ".local",
       "bin",
       "deepline"
     );
-    const installerCommandPath = this.input.fileSystem.read(join13(hostDir, "sdk", ".command-path")).trim();
+    const installerCommandPath = this.input.fileSystem.read(join14(hostDir, "sdk", ".command-path")).trim();
     const ownedInstallerCommand = isOwnedInstallerCommandPath({
       hostDir,
       commandPath: installerCommandPath
@@ -34954,16 +35298,16 @@ var CliInstallation = class _CliInstallation {
     const legacyLauncher = this.launcher(legacyLauncherPath);
     const candidates = [
       ...legacyLauncher.ownership === "installer_legacy" ? [legacyLauncherPath] : [],
-      join13(this.input.home, ".local", "bin", "deepline-real"),
-      join13(hostDir, "bin", "deepline"),
-      join13(hostDir, "bin", "deepline-real"),
-      join13(hostDir, "cli", ".install-method"),
-      join13(hostDir, "cli", ".version"),
-      join13(hostDir, "sdk", ".install-method"),
-      join13(hostDir, "sdk", ".command-path"),
+      join14(this.input.home, ".local", "bin", "deepline-real"),
+      join14(hostDir, "bin", "deepline"),
+      join14(hostDir, "bin", "deepline-real"),
+      join14(hostDir, "cli", ".install-method"),
+      join14(hostDir, "cli", ".version"),
+      join14(hostDir, "sdk", ".install-method"),
+      join14(hostDir, "sdk", ".command-path"),
       ...ownedInstallerCommand ? [
         installerCommandPath,
-        join13(dirname13(installerCommandPath), "deepline-sdk")
+        join14(dirname13(installerCommandPath), "deepline-sdk")
       ] : []
     ];
     return {
@@ -34994,9 +35338,9 @@ function isOwnedInstallerCommandPath(input2) {
 
 // src/cli/commands/skills.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync15 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname15, join as join15 } from "path";
+import { dirname as dirname15, join as join16 } from "path";
 
 // ../../shared_libs/cli/install-commands.json
 var install_commands_default = {
@@ -35107,13 +35451,13 @@ function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
 // src/cli/skills-sync.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import {
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync9,
-  readFileSync as readFileSync13,
-  unlinkSync,
-  writeFileSync as writeFileSync13
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync14,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname14, join as join14 } from "path";
+import { dirname as dirname14, join as join15 } from "path";
 
 // src/cli/windows-arg-escape.ts
 var CMD_META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
@@ -35460,10 +35804,10 @@ function shouldSkipSkillsSync() {
   return value === "1" || value === "true" || value === "yes" || value === "on";
 }
 function unavailableSkillsNoticePath(baseUrl) {
-  return join14(sdkCliStateDirPath(baseUrl), "skills-sync-unavailable-version");
+  return join15(sdkCliStateDirPath(baseUrl), "skills-sync-unavailable-version");
 }
 function failedSkillsSyncPath(baseUrl, agents) {
-  return join14(
+  return join15(
     sdkCliStateDirPath(baseUrl),
     `skills-sync-failed-${agents.join("-")}-version`
   );
@@ -35473,15 +35817,15 @@ function hasMarkedSkillsSyncVersion(path, version) {
 }
 function readMarkedSkillsSyncVersion(path) {
   try {
-    return existsSync12(path) ? readFileSync13(path, "utf-8").trim() : "";
+    return existsSync13(path) ? readFileSync14(path, "utf-8").trim() : "";
   } catch {
     return "";
   }
 }
 function writeMarkedSkillsSyncVersion(path, version) {
   try {
-    mkdirSync9(dirname14(path), { recursive: true });
-    writeFileSync13(path, `${version}
+    mkdirSync10(dirname14(path), { recursive: true });
+    writeFileSync14(path, `${version}
 `, "utf-8");
     return true;
   } catch {
@@ -35500,7 +35844,7 @@ ${manualCommand}`
 }
 function clearUnavailableSkillsNotice(baseUrl) {
   try {
-    unlinkSync(unavailableSkillsNoticePath(baseUrl));
+    unlinkSync2(unavailableSkillsNoticePath(baseUrl));
   } catch {
   }
 }
@@ -35511,7 +35855,7 @@ function hasFailedSkillsSync(baseUrl, remoteVersion, agents) {
   );
 }
 function hasFailedAutomaticSkillsSync(baseUrl, agents) {
-  return existsSync12(failedSkillsSyncPath(baseUrl, agents));
+  return existsSync13(failedSkillsSyncPath(baseUrl, agents));
 }
 function markFailedSkillsSync(baseUrl, remoteVersion, agents) {
   return writeMarkedSkillsSyncVersion(
@@ -35521,7 +35865,7 @@ function markFailedSkillsSync(baseUrl, remoteVersion, agents) {
 }
 function clearFailedSkillsSync(baseUrl, agents) {
   try {
-    unlinkSync(failedSkillsSyncPath(baseUrl, agents));
+    unlinkSync2(failedSkillsSyncPath(baseUrl, agents));
   } catch {
   }
 }
@@ -35888,13 +36232,13 @@ function detectSkillsAgents(input2) {
   ];
   const detected = AGENT_MARKERS.filter(
     (marker) => roots.some(
-      (root) => marker.paths.some((path) => existsSync13(join15(root, path)))
+      (root) => marker.paths.some((path) => existsSync14(join16(root, path)))
     )
   ).map((marker) => marker.agent);
   return detected.length > 0 ? detected : ["*"];
 }
 function skillsStatePathForScope(baseUrl, scope, root) {
-  return scope === "local" && root ? join15(root, ".deepline", "setup", "skills.json") : join15(sdkCliStateDirPath(baseUrl), "skills-install.json");
+  return scope === "local" && root ? join16(root, ".deepline", "setup", "skills.json") : join16(sdkCliStateDirPath(baseUrl), "skills-install.json");
 }
 function buildSkillsPlan(input2) {
   const scopeArgs = input2.scope === "global" ? ["--global"] : [];
@@ -35961,7 +36305,7 @@ function isSkillsPlanCurrent(plan, state) {
 }
 function readSkillsInstallState(path) {
   try {
-    const parsed = JSON.parse(readFileSync14(path, "utf8"));
+    const parsed = JSON.parse(readFileSync15(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -36114,8 +36458,8 @@ async function runSkillsCommand(options, dependencies = {}) {
 `
     );
   }
-  mkdirSync10(dirname15(plan.statePath), { recursive: true });
-  writeFileSync14(
+  mkdirSync11(dirname15(plan.statePath), { recursive: true });
+  writeFileSync15(
     plan.statePath,
     `${JSON.stringify(
       {
@@ -36253,7 +36597,7 @@ function phasesFromLegacyStatus(status) {
 function readSetupState(input2) {
   try {
     const parsed = JSON.parse(
-      readFileSync15(
+      readFileSync16(
         setupStatePath(input2.baseUrl, input2.scope, input2.root),
         "utf8"
       )
@@ -36329,7 +36673,7 @@ function buildPendingAuthorizationOutput(input2) {
   };
 }
 function setupStatePath(baseUrl, scope, root) {
-  return scope === "local" && root ? join16(root, ".deepline", "setup", "state.json") : join16(sdkCliStateDirPath(baseUrl), "setup.json");
+  return scope === "local" && root ? join17(root, ".deepline", "setup", "state.json") : join17(sdkCliStateDirPath(baseUrl), "setup.json");
 }
 async function captureStdout2(run) {
   let stdout = "";
@@ -36358,7 +36702,7 @@ function asRecord3(value) {
 }
 function safeRead(path) {
   try {
-    return readFileSync15(path, "utf8");
+    return readFileSync16(path, "utf8");
   } catch {
     return "";
   }
@@ -36398,7 +36742,7 @@ function isHomebrewFormulaCommand(path) {
 function resolvePersistentGlobalCommand(dependencies = {}) {
   const platform3 = dependencies.platform ?? process.platform;
   const run = dependencies.spawn ?? spawnSync2;
-  const pathExists = dependencies.exists ?? existsSync14;
+  const pathExists = dependencies.exists ?? existsSync15;
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
   if (homebrewCommand) return homebrewCommand;
@@ -36410,7 +36754,7 @@ function resolvePersistentGlobalCommand(dependencies = {}) {
   if (prefix.status !== 0) return null;
   const root = String(prefix.stdout ?? "").trim();
   if (!root) return null;
-  const candidates = platform3 === "win32" ? [join16(root, "deepline.cmd"), join16(root, "deepline")] : [join16(root, "bin", "deepline")];
+  const candidates = platform3 === "win32" ? [join17(root, "deepline.cmd"), join17(root, "deepline")] : [join17(root, "bin", "deepline")];
   return candidates.find((candidate) => pathExists(candidate)) ?? null;
 }
 function inspectGlobalCliAvailability(input2) {
@@ -36436,7 +36780,7 @@ function isKnownDeeplineCommand(path) {
   } catch {
   }
   if (entrypoint && resolvedPath === entrypoint) return true;
-  if (resolvedPath.includes(`${join16("node_modules", "deepline")}`)) return true;
+  if (resolvedPath.includes(`${join17("node_modules", "deepline")}`)) return true;
   const content = safeRead(path);
   return content.includes("node_modules/deepline") || content.includes("node_modules\\deepline") || content.includes("DEEPLINE_CONFIG_SCOPE") || content.includes("deepline-real");
 }
@@ -36446,7 +36790,7 @@ function inspectPathConflict() {
   try {
     if (lstatSync2(commandPath).isSymbolicLink()) {
       const target = realpathSync4(commandPath);
-      if (target.includes(`${join16("node_modules", "deepline")}`)) return null;
+      if (target.includes(`${join17("node_modules", "deepline")}`)) return null;
     }
   } catch {
   }
@@ -36454,8 +36798,8 @@ function inspectPathConflict() {
 }
 function writeSetupState(input2) {
   const path = setupStatePath(input2.baseUrl, input2.scope, input2.root);
-  mkdirSync11(dirname16(path), { recursive: true });
-  writeFileSync15(
+  mkdirSync12(dirname16(path), { recursive: true });
+  writeFileSync16(
     path,
     `${JSON.stringify(
       {
@@ -36495,7 +36839,7 @@ function failSetupPhase(phases, phase, code) {
   phases[phase] = { status: "failed", code };
 }
 function rollbackCommand(scope, root) {
-  const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join16(root, ".deepline", "runtime"))}` : "";
+  const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join17(root, ".deepline", "runtime"))}` : "";
   return `npm install -g${prefix} --no-audit --no-fund --include=optional --allow-scripts=esbuild deepline@${SDK_VERSION}`;
 }
 function setupResumeCommand(baseUrl, scope) {
@@ -36587,7 +36931,7 @@ function buildDoctorAssessment(input2) {
   const pathGlobalCli = globalCli?.path ?? null;
   const cliPath = input2.scope === "global" ? pathGlobalCli : runningCliPath;
   const cliScopeOk = input2.scope === "global" ? Boolean(pathGlobalCli) : Boolean(
-    input2.root && runningCliPath?.includes(join16(input2.root, ".deepline", "runtime"))
+    input2.root && runningCliPath?.includes(join17(input2.root, ".deepline", "runtime"))
   );
   const checks = {
     cli: {
@@ -37120,15 +37464,15 @@ Examples:
 
 // src/cli/update-preferences.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync16,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync17,
   renameSync,
   rmSync as rmSync5,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "fs";
 import { homedir as homedir10 } from "os";
-import { dirname as dirname17, join as join17 } from "path";
+import { dirname as dirname17, join as join18 } from "path";
 var UPDATE_PREFERENCES_SCHEMA_VERSION = 1;
 var CLI_UPDATE_MESSAGES = [
   {
@@ -37157,7 +37501,7 @@ function unreadablePreferences(path, error) {
   };
 }
 function cliUpdatePreferencesPath(homeDir2 = homedir10()) {
-  return join17(
+  return join18(
     homeDir2,
     ".local",
     "deepline",
@@ -37167,9 +37511,9 @@ function cliUpdatePreferencesPath(homeDir2 = homedir10()) {
 }
 function readCliUpdatePreferences(homeDir2 = homedir10()) {
   const path = cliUpdatePreferencesPath(homeDir2);
-  if (!existsSync15(path)) return defaultPreferences();
+  if (!existsSync16(path)) return defaultPreferences();
   try {
-    const parsed = JSON.parse(readFileSync16(path, "utf8"));
+    const parsed = JSON.parse(readFileSync17(path, "utf8"));
     return {
       schemaVersion: UPDATE_PREFERENCES_SCHEMA_VERSION,
       autoUpdateEnabled: typeof parsed.autoUpdateEnabled === "boolean" ? parsed.autoUpdateEnabled : true,
@@ -37185,9 +37529,9 @@ function readCliUpdatePreferences(homeDir2 = homedir10()) {
 function writeCliUpdatePreferences(preferences, homeDir2 = homedir10()) {
   const path = cliUpdatePreferencesPath(homeDir2);
   const tempPath = `${path}.${process.pid}.tmp`;
-  mkdirSync12(dirname17(path), { recursive: true });
+  mkdirSync13(dirname17(path), { recursive: true });
   try {
-    writeFileSync16(tempPath, `${JSON.stringify(preferences, null, 2)}
+    writeFileSync17(tempPath, `${JSON.stringify(preferences, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384
@@ -37245,29 +37589,29 @@ function consumePendingCliUpdateMessages(homeDir2 = homedir10()) {
 // src/cli/commands/update.ts
 import { spawn as spawn4, spawnSync as spawnSync3 } from "child_process";
 import {
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync13,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync14,
   realpathSync as realpathSync5,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   renameSync as renameSync2,
   rmSync as rmSync6,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync17
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync18
 } from "fs";
 import { homedir as homedir11 } from "os";
 import {
   basename as basename7,
   dirname as dirname18,
   isAbsolute as isAbsolute7,
-  join as join19,
+  join as join20,
   relative as relative7,
   resolve as resolve18
 } from "path";
 
 // src/cli/install-integrity.ts
 import { createRequire } from "module";
-import { existsSync as existsSync16, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute6, join as join18, relative as relative6, resolve as resolve17 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync18, statSync as statSync5 } from "fs";
+import { isAbsolute as isAbsolute6, join as join19, relative as relative6, resolve as resolve17 } from "path";
 var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/cli/index.mjs",
   "dist/index.mjs",
@@ -37300,7 +37644,7 @@ function resolveContainedPath(root, value) {
   return target;
 }
 function parseJson(path) {
-  return JSON.parse(readFileSync17(path, "utf8"));
+  return JSON.parse(readFileSync18(path, "utf8"));
 }
 function isFile(path) {
   try {
@@ -37310,7 +37654,7 @@ function isFile(path) {
   }
 }
 function readManifest(packageRoot) {
-  const packageJsonPath = join18(packageRoot, "package.json");
+  const packageJsonPath = join19(packageRoot, "package.json");
   let packageJson;
   try {
     packageJson = parseJson(packageJsonPath);
@@ -37318,7 +37662,7 @@ function readManifest(packageRoot) {
     return {
       mode: "manifest",
       invalidReason: `invalid Deepline package metadata: ${error.message}`,
-      missing: existsSync16(packageJsonPath) ? [] : ["deepline/package.json"]
+      missing: existsSync17(packageJsonPath) ? [] : ["deepline/package.json"]
     };
   }
   if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
@@ -37384,8 +37728,8 @@ function readManifest(packageRoot) {
   return { mode: "manifest", manifest };
 }
 function inspectSdkSidecarInstall(versionDir) {
-  const nodeModulesRoot = join18(versionDir, "node_modules");
-  const packageRoot = join18(nodeModulesRoot, "deepline");
+  const nodeModulesRoot = join19(versionDir, "node_modules");
+  const packageRoot = join19(nodeModulesRoot, "deepline");
   const manifestResult = readManifest(packageRoot);
   if ("invalidReason" in manifestResult) {
     return {
@@ -37396,8 +37740,8 @@ function inspectSdkSidecarInstall(versionDir) {
     };
   }
   const missing = [
-    ...manifestResult.manifest.packageFiles.filter((path) => !isFile(join18(packageRoot, path))).map((path) => `deepline/${path}`),
-    ...manifestResult.manifest.dependencyFiles.filter((path) => !isFile(join18(nodeModulesRoot, path))).map((path) => `node_modules/${path}`)
+    ...manifestResult.manifest.packageFiles.filter((path) => !isFile(join19(packageRoot, path))).map((path) => `deepline/${path}`),
+    ...manifestResult.manifest.dependencyFiles.filter((path) => !isFile(join19(nodeModulesRoot, path))).map((path) => `node_modules/${path}`)
   ];
   return {
     ok: missing.length === 0,
@@ -37408,7 +37752,7 @@ function inspectSdkSidecarInstall(versionDir) {
 }
 function probeSdkSidecarEsbuild(versionDir) {
   try {
-    const requireFromInstall = createRequire(join18(versionDir, "package.json"));
+    const requireFromInstall = createRequire(join19(versionDir, "package.json"));
     const esbuild = requireFromInstall("esbuild");
     if (typeof esbuild.transformSync !== "function") {
       return "esbuild does not export transformSync";
@@ -37483,7 +37827,7 @@ function sidecarStateDir(input2) {
   if (!scope || scope.includes("/") || scope.includes("\\")) {
     return null;
   }
-  return join19(input2.homeDir, ".local", "deepline", scope, "sdk-cli");
+  return join20(input2.homeDir, ".local", "deepline", scope, "sdk-cli");
 }
 function sidecarRegistryUrl(hostUrl) {
   let url;
@@ -37510,7 +37854,7 @@ function publicNpmFallbackRegistryUrl(hostUrl) {
 }
 function readOptionalText(path) {
   try {
-    return readFileSync18(path, "utf8").trim();
+    return readFileSync19(path, "utf8").trim();
   } catch {
     return "";
   }
@@ -37525,12 +37869,12 @@ function resolvePythonSidecarUpdatePlan(options) {
   if (!relativeEntrypoint || relativeEntrypoint.startsWith("..") || isAbsolute7(relativeEntrypoint)) {
     return null;
   }
-  const installMethod = readOptionalText(join19(stateDir, ".install-method"));
+  const installMethod = readOptionalText(join20(stateDir, ".install-method"));
   if (installMethod !== "python-sidecar") return null;
   const scope = options.env.DEEPLINE_CONFIG_SCOPE?.trim() || "";
   const hostUrl = options.env.DEEPLINE_HOST_URL?.trim() || "";
-  const nodeBin = readOptionalText(join19(stateDir, ".node-bin")) || process.execPath;
-  const sidecarPath = readOptionalText(join19(stateDir, ".command-path")) || join19(
+  const nodeBin = readOptionalText(join20(stateDir, ".node-bin")) || process.execPath;
+  const sidecarPath = readOptionalText(join20(stateDir, ".command-path")) || join20(
     stateDir,
     "bin",
     process.platform === "win32" ? "deepline-sdk.cmd" : "deepline-sdk"
@@ -37538,7 +37882,7 @@ function resolvePythonSidecarUpdatePlan(options) {
   const packageSpec = options.packageSpec || "deepline@latest";
   const npmCommand = "npm";
   const registryUrl = sidecarRegistryUrl(hostUrl);
-  const versionDir = join19(stateDir, "versions", "<version>");
+  const versionDir = join20(stateDir, "versions", "<version>");
   const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote4(versionDir)} --registry ${shellQuote4(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote4).join(" ")} ${shellQuote4(packageSpec)}`;
   return {
     kind: "python-sidecar",
@@ -37556,11 +37900,11 @@ function resolvePythonSidecarUpdatePlan(options) {
 function findRepoBackedSdkRoot(startPath) {
   let current = resolve18(startPath);
   while (true) {
-    if (existsSync17(join19(current, "package.json")) && existsSync17(join19(current, "bin", "deepline-dev.ts"))) {
+    if (existsSync18(join20(current, "package.json")) && existsSync18(join20(current, "bin", "deepline-dev.ts"))) {
       const parent2 = dirname18(current);
       return basename7(parent2) === "packages" && basename7(current) === "sdk" ? dirname18(parent2) : parent2;
     }
-    if (existsSync17(join19(current, "sdk", "package.json")) && existsSync17(join19(current, "sdk", "bin", "deepline-dev.ts"))) {
+    if (existsSync18(join20(current, "sdk", "package.json")) && existsSync18(join20(current, "sdk", "bin", "deepline-dev.ts"))) {
       return current;
     }
     const parent = dirname18(current);
@@ -37588,7 +37932,7 @@ function inferNpmGlobalPrefixFromEntrypoint(entrypoint, env) {
     const directPrefix = prefixParts.join("/").toLowerCase();
     const knownWindowsPrefixes = [
       env.npm_config_prefix,
-      env.APPDATA ? join19(env.APPDATA, "npm") : void 0
+      env.APPDATA ? join20(env.APPDATA, "npm") : void 0
     ].filter((value) => Boolean(value)).map((value) => resolve18(value).replace(/\\/g, "/").toLowerCase());
     if (!knownWindowsPrefixes.includes(
       resolve18(directPrefix).replace(/\\/g, "/").toLowerCase()
@@ -37693,9 +38037,9 @@ var AUTO_UPDATE_FAILURE_FILE = ".auto-update-failure.json";
 function autoUpdateFailurePath(plan) {
   if (plan.kind === "source" || plan.kind === "homebrew") return null;
   if (plan.kind === "python-sidecar") {
-    return join19(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
+    return join20(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
   }
-  return join19(
+  return join20(
     homedir11(),
     ".local",
     "deepline",
@@ -37713,7 +38057,7 @@ function readAutoUpdateFailure(plan) {
   if (!path) return null;
   try {
     const parsed = JSON.parse(
-      readFileSync18(path, "utf8")
+      readFileSync19(path, "utf8")
     );
     if ((parsed.kind === "npm-global" || parsed.kind === "python-sidecar") && typeof parsed.packageSpec === "string" && typeof parsed.failedAt === "string" && typeof parsed.exitCode === "number" && typeof parsed.manualCommand === "string") {
       return parsed;
@@ -37734,8 +38078,8 @@ function writeAutoUpdateFailure(plan, exitCode) {
     manualCommand: plan.manualCommand
   };
   try {
-    mkdirSync13(dirname18(path), { recursive: true });
-    writeFileSync17(path, `${JSON.stringify(marker, null, 2)}
+    mkdirSync14(dirname18(path), { recursive: true });
+    writeFileSync18(path, `${JSON.stringify(marker, null, 2)}
 `, "utf8");
   } catch {
   }
@@ -37744,7 +38088,7 @@ function clearAutoUpdateFailure(plan) {
   const path = autoUpdateFailurePath(plan);
   if (!path) return;
   try {
-    unlinkSync2(path);
+    unlinkSync3(path);
   } catch {
   }
 }
@@ -37782,7 +38126,7 @@ function safeVersionSegment(value) {
   return /^[0-9A-Za-z._-]+$/.test(normalized) ? normalized : "";
 }
 function entryPathInVersionDir(versionDir) {
-  return join19(
+  return join20(
     versionDir,
     "node_modules",
     "deepline",
@@ -37792,14 +38136,14 @@ function entryPathInVersionDir(versionDir) {
   );
 }
 function installedPackageVersion(versionDir) {
-  const packageJsonPath = join19(
+  const packageJsonPath = join20(
     versionDir,
     "node_modules",
     "deepline",
     "package.json"
   );
   try {
-    const parsed = JSON.parse(readFileSync18(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync19(packageJsonPath, "utf8"));
     return typeof parsed.version === "string" ? safeVersionSegment(parsed.version) : "";
   } catch {
     return "";
@@ -37914,20 +38258,20 @@ async function runNpmInstallWithRegistryFallback(input2) {
   return first.exitCode;
 }
 function writeSidecarLauncher(input2) {
-  mkdirSync13(dirname18(input2.path), { recursive: true });
+  mkdirSync14(dirname18(input2.path), { recursive: true });
   const packageRoot = dirname18(dirname18(dirname18(input2.entryPath)));
   const versionDir = dirname18(dirname18(packageRoot));
   const esbuildProbe = "const {createRequire}=require('node:module');const path=require('node:path');const req=createRequire(path.join(process.argv[1],'package.json'));const result=req('esbuild').transformSync('const value: number = 1;',{loader:'ts'});if(!result||typeof result.code!=='string')process.exit(3);";
   const criticalPaths = [
     ...SDK_SIDECAR_CRITICAL_PACKAGE_FILES.map(
-      (path) => join19(packageRoot, path)
+      (path) => join20(packageRoot, path)
     ),
     ...SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES.map(
-      (path) => join19(versionDir, "node_modules", path)
+      (path) => join20(versionDir, "node_modules", path)
     )
   ];
   if (process.platform === "win32") {
-    writeFileSync17(
+    writeFileSync18(
       input2.path,
       [
         `@set DEEPLINE_HOST_URL=${input2.hostUrl.replace(/\r?\n/g, "")}`,
@@ -37950,7 +38294,7 @@ function writeSidecarLauncher(input2) {
     );
     return;
   }
-  writeFileSync17(
+  writeFileSync18(
     input2.path,
     [
       "#!/usr/bin/env sh",
@@ -37977,14 +38321,14 @@ function writeSidecarLauncher(input2) {
   );
 }
 async function runPythonSidecarUpdatePlan(plan) {
-  const versionsDir = join19(plan.stateDir, "versions");
-  const tempDir = join19(
+  const versionsDir = join20(plan.stateDir, "versions");
+  const tempDir = join20(
     versionsDir,
     `.tmp-sdk-update-${process.pid}-${Date.now()}`
   );
   rmSync6(tempDir, { recursive: true, force: true });
-  mkdirSync13(tempDir, { recursive: true });
-  writeFileSync17(join19(tempDir, "package.json"), NPM_SDK_SIDECAR_PACKAGE_JSON);
+  mkdirSync14(tempDir, { recursive: true });
+  writeFileSync18(join20(tempDir, "package.json"), NPM_SDK_SIDECAR_PACKAGE_JSON);
   const env = {
     ...process.env,
     PATH: `${dirname18(plan.nodeBin)}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
@@ -38024,7 +38368,7 @@ async function runPythonSidecarUpdatePlan(plan) {
     rmSync6(tempDir, { recursive: true, force: true });
     return 1;
   }
-  const finalDir = join19(versionsDir, installedVersion);
+  const finalDir = join20(versionsDir, installedVersion);
   const finalEntryPath = entryPathInVersionDir(finalDir);
   const finalFailure = sidecarInstallFailure(finalDir);
   let backupDir = null;
@@ -38032,8 +38376,8 @@ async function runPythonSidecarUpdatePlan(plan) {
     rmSync6(tempDir, { recursive: true, force: true });
   } else {
     let shouldPublishTemp = true;
-    if (existsSync17(finalDir)) {
-      backupDir = join19(
+    if (existsSync18(finalDir)) {
+      backupDir = join20(
         versionsDir,
         `.backup-${installedVersion}-${process.pid}-${Date.now()}`
       );
@@ -38066,7 +38410,7 @@ async function runPythonSidecarUpdatePlan(plan) {
           backupDir = null;
         } else {
           let restoreFailure = "";
-          if (backupDir && existsSync17(backupDir) && !existsSync17(finalDir)) {
+          if (backupDir && existsSync18(backupDir) && !existsSync18(finalDir)) {
             try {
               renameSync2(backupDir, finalDir);
               backupDir = null;
@@ -38085,7 +38429,7 @@ async function runPythonSidecarUpdatePlan(plan) {
   }
   const publishedFailure = sidecarStructureFailure(finalDir);
   if (publishedFailure) {
-    if (backupDir && existsSync17(backupDir)) {
+    if (backupDir && existsSync18(backupDir)) {
       rmSync6(finalDir, { recursive: true, force: true });
       try {
         renameSync2(backupDir, finalDir);
@@ -38107,28 +38451,28 @@ async function runPythonSidecarUpdatePlan(plan) {
     nodeBin: plan.nodeBin,
     entryPath: finalEntryPath
   });
-  writeFileSync17(
-    join19(plan.stateDir, ".version"),
+  writeFileSync18(
+    join20(plan.stateDir, ".version"),
     `${installedVersion}
 `,
     "utf8"
   );
-  writeFileSync17(
-    join19(plan.stateDir, ".install-method"),
+  writeFileSync18(
+    join20(plan.stateDir, ".install-method"),
     "python-sidecar\n",
     "utf8"
   );
-  writeFileSync17(
-    join19(plan.stateDir, ".command-path"),
+  writeFileSync18(
+    join20(plan.stateDir, ".command-path"),
     `${plan.sidecarPath}
 `,
     "utf8"
   );
-  writeFileSync17(join19(plan.stateDir, ".runner"), "node\n", "utf8");
-  writeFileSync17(join19(plan.stateDir, ".node-bin"), `${plan.nodeBin}
+  writeFileSync18(join20(plan.stateDir, ".runner"), "node\n", "utf8");
+  writeFileSync18(join20(plan.stateDir, ".node-bin"), `${plan.nodeBin}
 `, "utf8");
-  writeFileSync17(
-    join19(plan.stateDir, ".entry-path"),
+  writeFileSync18(
+    join20(plan.stateDir, ".entry-path"),
     `${finalEntryPath}
 `,
     "utf8"
@@ -39057,24 +39401,24 @@ chooses the connected Slack channel or member and the events it receives.
 import { Option as Option2 } from "commander";
 import {
   chmodSync,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdtempSync,
-  readFileSync as readFileSync19,
-  writeFileSync as writeFileSync19
+  readFileSync as readFileSync20,
+  writeFileSync as writeFileSync20
 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { join as join21, resolve as resolve19 } from "path";
+import { join as join22, resolve as resolve19 } from "path";
 
 // src/tool-output.ts
 import {
   closeSync as closeSync3,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync15,
   openSync as openSync3,
-  writeFileSync as writeFileSync18,
+  writeFileSync as writeFileSync19,
   writeSync
 } from "fs";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname19, join as join20 } from "path";
+import { dirname as dirname19, join as join21 } from "path";
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -39201,19 +39545,19 @@ function projectRowOutput(conversion) {
   };
 }
 function ensureOutputDir() {
-  const outputDir = join20(homedir12(), ".local", "share", "deepline", "data");
-  mkdirSync14(outputDir, { recursive: true });
+  const outputDir = join21(homedir12(), ".local", "share", "deepline", "data");
+  mkdirSync15(outputDir, { recursive: true });
   return outputDir;
 }
 function writeJsonOutputFile(payload, stem) {
   const outputDir = ensureOutputDir();
-  const outputPath = join20(outputDir, `${stem}_${Date.now()}.json`);
-  writeFileSync18(outputPath, JSON.stringify(payload, null, 2), "utf-8");
+  const outputPath = join21(outputDir, `${stem}_${Date.now()}.json`);
+  writeFileSync19(outputPath, JSON.stringify(payload, null, 2), "utf-8");
   return outputPath;
 }
 function writeCsvOutputFile(rows, stem, options) {
-  const outputPath = options?.outPath ? options.outPath : join20(ensureOutputDir(), `${stem}_${Date.now()}.csv`);
-  mkdirSync14(dirname19(outputPath), { recursive: true });
+  const outputPath = options?.outPath ? options.outPath : join21(ensureOutputDir(), `${stem}_${Date.now()}.csv`);
+  mkdirSync15(dirname19(outputPath), { recursive: true });
   const columns = columnsForRows(rows);
   const escapeCell = (value) => {
     const normalized = value == null ? "" : typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : JSON.stringify(value);
@@ -41174,10 +41518,10 @@ function normalizeOutputFormat(raw) {
 function resolveAtFilePath(rawPath) {
   const trimmed = rawPath.trim();
   const resolved = resolve19(trimmed);
-  if (existsSync18(resolved)) return resolved;
+  if (existsSync19(resolved)) return resolved;
   if (process.platform !== "win32" && trimmed.includes("\\")) {
     const normalized = resolve19(trimmed.replace(/\\/g, "/"));
-    if (existsSync18(normalized)) return normalized;
+    if (existsSync19(normalized)) return normalized;
   }
   return resolved;
 }
@@ -41188,7 +41532,7 @@ function readJsonArgument(raw, flagName) {
     throw new Error(`Invalid ${flagName} value: empty @file path.`);
   }
   try {
-    return readFileSync19(resolveAtFilePath(filePath), "utf8").replace(
+    return readFileSync20(resolveAtFilePath(filePath), "utf8").replace(
       /^\uFEFF/,
       ""
     );
@@ -41295,9 +41639,9 @@ function starterScriptJson(script) {
 function seedToolListScript(input2) {
   const stem = safeFileStem(input2.toolId);
   const fileName = `${stem}-workflow-seed-${Date.now()}.play.ts`;
-  const scriptDir = mkdtempSync(join21(tmpdir5(), "deepline-workflow-seed-"));
+  const scriptDir = mkdtempSync(join22(tmpdir5(), "deepline-workflow-seed-"));
   chmodSync(scriptDir, 448);
-  const scriptPath = join21(scriptDir, fileName);
+  const scriptPath = join22(scriptDir, fileName);
   const projectDir = `deepline/projects/${stem}-workflow`;
   const playName = `${stem}-workflow`;
   const sampleRows = input2.rows.length > 0 ? `${JSON.stringify(input2.rows.slice(0, 2)).replace(/\]$/, "")}, ...]` : "[]";
@@ -41340,7 +41684,7 @@ export default definePlay(${JSON.stringify(playName)}, async (ctx) => {
   description: ${JSON.stringify(`Seed ${input2.toolId} rows into a Deepline workflow-ready dataset.`)},
 });
 `;
-  writeFileSync19(scriptPath, script, { encoding: "utf-8", mode: 384 });
+  writeFileSync20(scriptPath, script, { encoding: "utf-8", mode: 384 });
   return {
     path: scriptPath,
     sourceCode: script,
@@ -41766,10 +42110,10 @@ Examples:
 
 // src/cli/commands/workflow.ts
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname20, join as join22, resolve as resolve20 } from "path";
+import { dirname as dirname20, join as join23, resolve as resolve20 } from "path";
 
 // src/cli/workflow-to-play.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var HITL_WAIT_FOR_SIGNAL_TOOL = "deepline_workflow_wait_for_signal";
 var HITL_SLACK_TOOL = "slack_message_with_hitl";
 var SUB_WORKFLOW_TOOL_PREFIX = "deepline_workflow_";
@@ -41875,7 +42219,7 @@ function sanitizePlayNameSegment(value) {
 }
 function deriveWorkflowPlayName(workflowName) {
   const base = sanitizePlayNameSegment(workflowName) || "workflow";
-  const suffix = createHash5("sha256").update(workflowName).digest("hex").slice(0, 8);
+  const suffix = createHash6("sha256").update(workflowName).digest("hex").slice(0, 8);
   const reserved = suffix.length + 1;
   const allowedBase = Math.max(1, MAX_PLAY_NAME_LENGTH - reserved);
   let name = `${base.slice(0, allowedBase)}_${suffix}`;
@@ -42017,7 +42361,7 @@ async function transformOne(api, workflowId, outDir, publish) {
       revision.config,
       { workflowName: workflow.name, version: revision.version }
     );
-    const file = join22(resolve20(outDir), `${compiled.playName}.play.ts`);
+    const file = join23(resolve20(outDir), `${compiled.playName}.play.ts`);
     await mkdir5(dirname20(file), { recursive: true });
     await writeFile5(file, compiled.sourceCode, "utf8");
     let published = false;
@@ -42650,8 +42994,8 @@ function topLevelCommandKnown(program, commandName) {
   );
 }
 async function runPlayRunnerHealthCheck() {
-  const dir = await mkdtemp2(join23(tmpdir6(), "deepline-health-play-"));
-  const file = join23(dir, "health-check.play.ts");
+  const dir = await mkdtemp2(join24(tmpdir6(), "deepline-health-play-"));
+  const file = join24(dir, "health-check.play.ts");
   try {
     await writeFile6(
       file,