deepline 0.1.74 → 0.1.77

package/dist/cli/index.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli/index.ts
-import { mkdtemp, rm, writeFile as writeFile4 } from "fs/promises";
-import { join as join12 } from "path";
-import { tmpdir as tmpdir4 } from "os";
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile5 } from "fs/promises";
+import { join as join13 } from "path";
+import { tmpdir as tmpdir5 } from "os";
 import { Command as Command3 } from "commander";
 
 // src/config.ts
@@ -206,10 +206,10 @@ import { join as join2 } from "path";
 
 // src/release.ts
 var SDK_RELEASE = {
-  version: "0.1.74",
-  apiContract: "2026-06-dataset-column-syntax-cutover",
+  version: "0.1.77",
+  apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.74",
+    latest: "0.1.77",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53"
   }
@@ -556,7 +556,7 @@ function decodeSseFrame(frame) {
   return parsed;
 }
 function sleep(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
 // src/client.ts
@@ -566,7 +566,7 @@ var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
 var V2_EXECUTE_RESPONSE_CONTRACT = "v2-tool-response";
 var COMPILE_MANIFEST_RETRY_DELAYS_MS = [250, 1e3];
 function sleep2(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function isTransientCompileManifestError(error) {
   if (error instanceof DeeplineError && typeof error.statusCode === "number") {
@@ -1092,6 +1092,9 @@ var DeeplineClient = class {
   async checkPlayArtifact(input2) {
     return this.http.post("/api/v2/plays/check", input2);
   }
+  async compileEnrichPlan(input2) {
+    return this.http.post("/api/v2/enrich/compile", input2);
+  }
   async startPlayRunFromBundle(input2) {
     const compilerManifest = input2.compilerManifest ?? await this.compilePlayManifest({
       name: input2.name,
@@ -2380,7 +2383,7 @@ function buildCandidateUrls2(url) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function printDeeplineLogo() {
   if (process.stdout.isTTY && (process.stdout.columns ?? 80) >= 70) {
@@ -3758,38 +3761,38 @@ function buildDatasetStats(rows, totalRows = rows.length, columns = inferColumns
       }
     }
     const denominator = nonEmpty + empty;
-    const stat3 = {
+    const stat4 = {
       non_empty: percentText(nonEmpty, denominator),
       unique: valueCounts.size
     };
     const rawExecutionStats = executionStats?.columnStats[column];
     if (rawExecutionStats) {
-      stat3.execution = formatDatasetExecutionStats(
+      stat4.execution = formatDatasetExecutionStats(
         rawExecutionStats,
         totalRows
       );
     }
     if (sampleValue !== void 0 && sampleValueType) {
-      stat3.sample_value = sampleValue;
-      stat3.sample_type = sampleValueType;
+      stat4.sample_value = sampleValue;
+      stat4.sample_type = sampleValueType;
     }
     if (valueCounts.size > 0 && valueCounts.size < nonEmpty) {
       const top = [...valueCounts.entries()].sort((left, right) => right[1] - left[1]).slice(0, 3);
       const topKeys = new Set(top.map(([key]) => key));
       const otherCount = [...valueCounts.entries()].filter(([key]) => !topKeys.has(key)).reduce((sum, [, count]) => sum + count, 0);
-      stat3.top_values = Object.fromEntries(
+      stat4.top_values = Object.fromEntries(
         top.map(([key, count]) => [key, countPercentText(count, denominator)])
       );
       if (otherCount > 0) {
-        stat3.top_values["(other)"] = countPercentText(otherCount, denominator);
+        stat4.top_values["(other)"] = countPercentText(otherCount, denominator);
       }
       if (empty > 0) {
-        stat3.top_values["(null)"] = countPercentText(empty, denominator);
+        stat4.top_values["(null)"] = countPercentText(empty, denominator);
       }
     } else if (empty > 0 && nonEmpty > 0) {
-      stat3.top_values = { "(null)": countPercentText(empty, denominator) };
+      stat4.top_values = { "(null)": countPercentText(empty, denominator) };
     }
-    columnStats[column] = stat3;
+    columnStats[column] = stat4;
   }
   return {
     total_rows: totalRows,
@@ -4170,13 +4173,18 @@ function registerDbCommands(program) {
     "after",
     `
 Notes:
-  Runs SQL against the active workspace customer database through Deepline APIs.
+  Agent-safe SQL for the active workspace customer database.
+  Reads: SELECT, EXPLAIN, and read-only WITH can inspect permitted schemas.
+  Writes: CREATE TABLE, INSERT, UPDATE, DELETE, ALTER, DROP, TRUNCATE, and
+  CREATE INDEX must target schema-qualified storage tables, such as storage.agent_notes.
+  If CREATE TABLE blocked (...) fails, use CREATE TABLE storage.blocked (...).
   Results are bounded by the server and --max-rows. Use --json for stable output.
   Use --format csv or --format markdown for agent-readable exports and display tables.
 
 Examples:
   deepline db query --sql "select * from companies limit 20"
   deepline db query --sql "select domain, name from companies limit 20" --json
+  deepline db query --sql "create table if not exists storage.agent_notes (id text primary key, note text not null)"
   deepline db query --sql "select * from contacts" --max-rows 100 --json
   deepline db query --sql "select * from contacts limit 20" --format csv --out contacts.csv
   deepline db query --sql "select domain, name from companies limit 20" --format markdown
@@ -4188,12 +4196,16 @@ Examples:
 Notes:
   Requires --sql. Output is a compact table in a terminal and raw JSON with
   --json or when stdout is piped. The active auth workspace determines scope.
+  Read permitted schemas with SELECT, EXPLAIN, or read-only WITH.
+  Write only to schema-qualified storage tables. For example, use
+  CREATE TABLE storage.blocked (...) instead of CREATE TABLE blocked (...).
   --format csv and --format markdown are explicit data/display formats and can
   be written directly with --out.
 
 Examples:
   deepline db query --sql "select * from companies limit 20"
   deepline db query --sql "select domain, name from companies limit 20" --json
+  deepline db query --sql "create table if not exists storage.agent_notes (id text primary key, note text not null)"
   deepline db psql --sql "select count(*) from contacts" --json
   deepline db query --sql "select * from contacts limit 20" --format csv --out contacts.csv
   deepline db query --sql "select domain, name from companies limit 20" --format markdown
@@ -4213,210 +4225,10 @@ Examples:
   });
 }
 
-// src/cli/commands/feedback.ts
-async function handleFeedback(text, options) {
-  const { http } = getAuthedHttpClient();
-  const response = await http.post("/api/v2/cli/feedback", {
-    text,
-    environment: collectLocalEnvInfo(),
-    ...options.command ? { command: options.command } : {},
-    ...options.payload ? { payload: options.payload } : {}
-  });
-  printCommandEnvelope(
-    {
-      ...response,
-      render: {
-        sections: [
-          { title: "feedback", lines: ["Feedback submitted. Thank you."] }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-function registerFeedbackCommands(program) {
-  const feedback = program.command("feedback").description("Submit CLI feedback to Deepline.").addHelpText(
-    "after",
-    `
-Notes:
-  Sends the feedback text plus local CLI environment info to Deepline support.
-  Use --command and --payload to attach a reproducible command shape.
-
-Examples:
-  deepline feedback "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
-  deepline feedback "unexpected billing output" --payload '{"command":"billing usage"}' --json
-`
-  );
-  feedback.argument("<text>", "Feedback text").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option("--json", "Emit JSON output").action(handleFeedback);
-  program.command("provide-feedback").description("Legacy alias for `deepline feedback`.").addHelpText(
-    "after",
-    `
-Notes:
-  Compatibility alias. Prefer deepline feedback in new scripts and docs.
-
-Examples:
-  deepline feedback "tools search returned stale results" --json
-`
-  ).argument("<text>", "Feedback text").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option("--json", "Emit JSON output").action(handleFeedback);
-}
-
-// src/cli/commands/org.ts
-async function fetchOrganizations(http, apiKey) {
-  return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
-}
-function orgListLines(orgs) {
-  return orgs.map((org, index) => {
-    const current = org.is_current ? " (current)" : "";
-    const role = org.role ? ` [${org.role}]` : "";
-    return `${index + 1}. ${org.name}${role}${current}`;
-  });
-}
-async function handleOrgList(options) {
-  const config = resolveConfig();
-  const http = new HttpClient(config);
-  const payload = await fetchOrganizations(http, config.apiKey);
-  printCommandEnvelope(
-    {
-      ...payload,
-      render: {
-        sections: [
-          {
-            title: "Your organizations:",
-            lines: orgListLines(payload.organizations)
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleOrgSwitch(selection, options) {
-  const config = resolveConfig();
-  const http = new HttpClient(config);
-  const payload = await fetchOrganizations(http, config.apiKey);
-  if (!selection && !options.orgId) {
-    printCommandEnvelope(
-      {
-        ...payload,
-        next: { switch: "deepline org switch <number>" },
-        render: {
-          sections: [
-            {
-              title: "Your organizations:",
-              lines: orgListLines(payload.organizations)
-            }
-          ],
-          actions: [{ label: "Run", command: "deepline org switch <number>" }]
-        }
-      },
-      { json: options.json }
-    );
-    return;
-  }
-  let target = payload.organizations.find(
-    (org) => org.org_id === options.orgId
-  );
-  if (!target && selection) {
-    const index = Number.parseInt(selection, 10);
-    if (Number.isFinite(index) && index >= 1 && index <= payload.organizations.length) {
-      target = payload.organizations[index - 1];
-    } else {
-      target = payload.organizations.find(
-        (org) => org.name === selection || org.org_id === selection
-      );
-    }
-  }
-  if (!target) {
-    throw new Error("Could not resolve the selected organization.");
-  }
-  if (target.is_current) {
-    printCommandEnvelope(
-      {
-        ok: true,
-        unchanged: true,
-        organization: target,
-        render: {
-          sections: [
-            { title: "org switch", lines: [`Already on ${target.name}.`] }
-          ]
-        }
-      },
-      { json: options.json }
-    );
-    return;
-  }
-  const switched = await http.post("/api/v2/auth/cli/switch", {
-    api_key: config.apiKey,
-    org_id: target.org_id
-  });
-  saveHostEnvValues(config.baseUrl, {
-    DEEPLINE_API_KEY: switched.api_key,
-    DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
-    DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
-  });
-  const { api_key: _apiKey, ...publicSwitched } = switched;
-  printCommandEnvelope(
-    {
-      ok: true,
-      host_env_path: hostEnvFilePath(config.baseUrl),
-      ...publicSwitched,
-      api_key_saved: true,
-      render: {
-        sections: [
-          {
-            title: "org switch",
-            lines: [
-              `Switched to ${switched.org_name}.`,
-              `Saved host auth in ${hostEnvFilePath(config.baseUrl)}`
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-function registerOrgCommands(program) {
-  const org = program.command("org").description("List and switch organizations.").addHelpText(
-    "after",
-    `
-Notes:
-  Organizations are workspaces. Switching organizations mutates the saved host
-  auth file so later CLI commands target the selected workspace.
-
-Examples:
-  deepline org list --json
-  deepline org switch 2
-  deepline org switch --org-id org_123 --json
-`
-  );
-  org.command("list").description("List your organizations.").addHelpText(
-    "after",
-    `
-Notes:
-  Read-only. Marks the active organization when the server returns that metadata.
-
-Examples:
-  deepline org list
-  deepline org list --json
-`
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgList);
-  org.command("switch [selection]").description(
-    "Switch to another organization and save the new API key in the host auth file."
-  ).addHelpText(
-    "after",
-    `
-Notes:
-  Mutates the saved host auth file. Selection can be a list number, exact
-  organization name, or organization id. Without a selection, prints choices.
-
-Examples:
-  deepline org switch
-  deepline org switch 2
-  deepline org switch --org-id org_123 --json
-`
-  ).option("--org-id <id>", "Switch using an explicit organization id").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgSwitch);
-}
+// src/cli/commands/enrich.ts
+import { mkdtemp, readFile as readFile3, rm, stat as stat3, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir4, tmpdir as tmpdir3 } from "os";
+import { join as join8, resolve as resolve11 } from "path";
 
 // src/cli/commands/play.ts
 import { createHash as createHash3 } from "crypto";
@@ -6721,54 +6533,54 @@ function exampleValueComment(field) {
   if (field === "roles" || field.endsWith("s")) return '["..."]';
   return '"..."';
 }
-function generateContactInputObjectFromSchema(schema, indent, label, fallbackFields = ["first_name", "last_name", "domain"]) {
+function generateContactInputObjectFromSchema(schema, indent2, label, fallbackFields = ["first_name", "last_name", "domain"]) {
   const details = schemaFieldDetails(schema);
   const required = details.required.length ? details.required : fallbackFields;
   const optional = details.optional;
   const lines = [
-    `${indent}// TODO: map row fields into ${label}.`,
-    ...playInspectionComments(label, indent),
-    `${indent}// Required: ${required.join(", ") || "none declared"}.`
+    `${indent2}// TODO: map row fields into ${label}.`,
+    ...playInspectionComments(label, indent2),
+    `${indent2}// Required: ${required.join(", ") || "none declared"}.`
   ];
   for (const field of required) {
-    lines.push(`${indent}// ${field}: row["TODO_SOURCE_FIELD"],`);
+    lines.push(`${indent2}// ${field}: row["TODO_SOURCE_FIELD"],`);
   }
   if (optional.length > 0) {
     lines.push("");
-    lines.push(`${indent}// optional (delete unused):`);
+    lines.push(`${indent2}// optional (delete unused):`);
     for (const field of optional) {
-      lines.push(`${indent}// ${field}: row["TODO_SOURCE_FIELD"],`);
+      lines.push(`${indent2}// ${field}: row["TODO_SOURCE_FIELD"],`);
     }
   }
   return `{
 ${lines.join("\n")}
-${indent.slice(2)}}`;
+${indent2.slice(2)}}`;
 }
-function generateCompanyInputObjectFromSchema(schema, indent, label, fallbackFields = ["domain", "company_name"]) {
+function generateCompanyInputObjectFromSchema(schema, indent2, label, fallbackFields = ["domain", "company_name"]) {
   const details = schemaFieldDetails(schema);
   const required = details.required.length ? details.required : fallbackFields;
   const optional = details.optional;
   const lines = [
-    `${indent}// TODO: map company fields into ${label}.`,
-    ...playInspectionComments(label, indent),
-    `${indent}// Required: ${required.join(", ") || "none declared"}.`
+    `${indent2}// TODO: map company fields into ${label}.`,
+    ...playInspectionComments(label, indent2),
+    `${indent2}// Required: ${required.join(", ") || "none declared"}.`
   ];
   for (const field of required) {
-    lines.push(`${indent}// ${field}: company["TODO_SOURCE_FIELD"],`);
+    lines.push(`${indent2}// ${field}: company["TODO_SOURCE_FIELD"],`);
   }
   if (optional.length > 0) {
     lines.push("");
-    lines.push(`${indent}// optional (delete unused):`);
+    lines.push(`${indent2}// optional (delete unused):`);
     for (const field of optional) {
-      lines.push(`${indent}// ${field}: company["TODO_SOURCE_FIELD"],`);
+      lines.push(`${indent2}// ${field}: company["TODO_SOURCE_FIELD"],`);
     }
   }
   return `{
 ${lines.join("\n")}
-${indent.slice(2)}}`;
+${indent2.slice(2)}}`;
 }
 function generateSourceProviderInputObject(input2) {
-  const { tool, indent, label, entity } = input2;
+  const { tool, indent: indent2, label, entity } = input2;
   const properties = inputPropertyNames(tool?.inputSchema);
   const details = schemaFieldDetails(tool?.inputSchema);
   const required = details.required;
@@ -6789,18 +6601,18 @@ function generateSourceProviderInputObject(input2) {
     ].includes(field)
   );
   const lines = [
-    `${indent}// TODO: fill ${entity} source inputs for ${label}.`,
-    `${indent}// Inspect: deepline tools describe ${label} --json`
+    `${indent2}// TODO: fill ${entity} source inputs for ${label}.`,
+    `${indent2}// Inspect: deepline tools describe ${label} --json`
   ];
   for (const field of required) {
-    lines.push(`${indent}// ${field}: ${exampleValueComment(field)},`);
+    lines.push(`${indent2}// ${field}: ${exampleValueComment(field)},`);
   }
   const activeTodoField = required.length === 0 ? ["query", "q", "search", "title", "role", "persona"].find(
     (field) => includeOptional.includes(field)
   ) ?? "query" : null;
   if (activeTodoField) {
     lines.push(
-      `${indent}// ${activeTodoField}: ${exampleValueComment(activeTodoField)},`
+      `${indent2}// ${activeTodoField}: ${exampleValueComment(activeTodoField)},`
     );
   }
   const optionalExamples = includeOptional.filter(
@@ -6808,40 +6620,40 @@ function generateSourceProviderInputObject(input2) {
   );
   if (optionalExamples.length > 0) {
     lines.push("");
-    lines.push(`${indent}// optional - uncomment what this provider supports:`);
+    lines.push(`${indent2}// optional - uncomment what this provider supports:`);
     for (const field of optionalExamples) {
       if (field === "limit" || field === "numResults" || field === "num_results" || field === "page_size") {
-        lines.push(`${indent}// ${field}: limit,`);
+        lines.push(`${indent2}// ${field}: limit,`);
       } else {
-        lines.push(`${indent}// ${field}: ${exampleValueComment(field)},`);
+        lines.push(`${indent2}// ${field}: ${exampleValueComment(field)},`);
       }
     }
   }
   if (!required.some(
     (field) => ["limit", "numResults", "num_results", "page_size"].includes(field)
   )) {
-    lines.push(`${indent}limit,`);
+    lines.push(`${indent2}limit,`);
   }
   return `{
 ${lines.join("\n")}
-${indent.slice(2)}}`;
+${indent2.slice(2)}}`;
 }
 function generatePlayInputObject(input2) {
-  const { schema, indent, label, entity } = input2;
+  const { schema, indent: indent2, label, entity } = input2;
   const details = schemaFieldDetails(schema);
   const fallback = entity === "company" ? ["domain", "company_name"] : ["first_name", "last_name", "domain"];
   const required = details.required.length ? details.required : fallback;
   const lines = [
-    `${indent}// TODO: fill source play inputs for ${label}.`,
-    ...playInspectionComments(label, indent)
+    `${indent2}// TODO: fill source play inputs for ${label}.`,
+    ...playInspectionComments(label, indent2)
   ];
   for (const field of required) {
-    lines.push(`${indent}// ${field}: ${exampleValueComment(field)},`);
+    lines.push(`${indent2}// ${field}: ${exampleValueComment(field)},`);
   }
-  if (!required.includes("limit")) lines.push(`${indent}limit,`);
+  if (!required.includes("limit")) lines.push(`${indent2}limit,`);
   return `{
 ${lines.join("\n")}
-${indent.slice(2)}}`;
+${indent2.slice(2)}}`;
 }
 function requiredPlayInputFields(play) {
   const schema = play?.inputSchema;
@@ -6882,8 +6694,8 @@ function finderProviderStepPrefix(finder) {
 function safeIdentifier(value) {
   return value.replace(/[^A-Za-z0-9_]+/g, "_");
 }
-function playInspectionComments(playRef, indent) {
-  return [`${indent}// Inspect: deepline plays describe ${playRef} --json`];
+function playInspectionComments(playRef, indent2) {
+  return [`${indent2}// Inspect: deepline plays describe ${playRef} --json`];
 }
 function accessorExpression(base, field) {
   return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(field) ? `${base}.${field}` : `${base}[${jsString(field)}]`;
@@ -7982,7 +7794,7 @@ function traceCliSync(phase, fields, run) {
   }
 }
 function sleep4(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function parseReferencedPlayTarget2(target) {
   const trimmed = target.trim();
@@ -9625,20 +9437,20 @@ function attachDatasetStatsToResult(result, datasetStats) {
   };
   return attach(result, "");
 }
-function formatDatasetStatsLines(datasetStats, indent = "  ") {
+function formatDatasetStatsLines(datasetStats, indent2 = "  ") {
   if (!datasetStats) {
     return [];
   }
-  const lines = [`${indent}summary:`];
-  for (const [column, stat3] of Object.entries(datasetStats.columnStats).slice(
+  const lines = [`${indent2}summary:`];
+  for (const [column, stat4] of Object.entries(datasetStats.columnStats).slice(
     0,
     12
   )) {
-    const topValues = stat3.top_values ? `, top_values=${Object.entries(stat3.top_values).slice(0, 3).map(([value, count]) => `${value}=${count}`).join(", ")}` : "";
-    const sample = stat3.sample_value !== void 0 ? `, sample_value=${JSON.stringify(stat3.sample_value)}` : "";
-    const execution = stat3.execution ? `, execution=${Object.entries(stat3.execution).map(([bucket, count]) => `${bucket}=${count}`).join(", ")}` : "";
+    const topValues = stat4.top_values ? `, top_values=${Object.entries(stat4.top_values).slice(0, 3).map(([value, count]) => `${value}=${count}`).join(", ")}` : "";
+    const sample = stat4.sample_value !== void 0 ? `, sample_value=${JSON.stringify(stat4.sample_value)}` : "";
+    const execution = stat4.execution ? `, execution=${Object.entries(stat4.execution).map(([bucket, count]) => `${bucket}=${count}`).join(", ")}` : "";
     lines.push(
-      `${indent}  ${column}: non_empty=${stat3.non_empty}, unique=${stat3.unique}${topValues}${sample}${execution}`
+      `${indent2}  ${column}: non_empty=${stat4.non_empty}, unique=${stat4.unique}${topValues}${sample}${execution}`
     );
   }
   return lines;
@@ -9679,7 +9491,7 @@ function formatSummaryScalarParts(record, skipKeys = /* @__PURE__ */ new Set())
   }
   return parts;
 }
-function formatPackageDatasetSummaryLines(summary, indent = "    ") {
+function formatPackageDatasetSummaryLines(summary, indent2 = "    ") {
   const record = readRecord(summary);
   const columnStats = readRecord(record?.columnStats);
   if (!record || !columnStats) {
@@ -9688,7 +9500,7 @@ function formatPackageDatasetSummaryLines(summary, indent = "    ") {
   const lines = [];
   const parts = formatSummaryScalarParts(record, /* @__PURE__ */ new Set(["columnStats"]));
   if (parts.length > 0) {
-    lines.push(`${indent}summary: ${parts.join(" ")}`);
+    lines.push(`${indent2}summary: ${parts.join(" ")}`);
   }
   for (const [column, rawColumnSummary] of Object.entries(columnStats)) {
     const columnSummary = readRecord(rawColumnSummary);
@@ -9700,7 +9512,7 @@ function formatPackageDatasetSummaryLines(summary, indent = "    ") {
       executionText ? `execution=${executionText}` : null
     ].filter(Boolean);
     if (columnParts.length > 0) {
-      lines.push(`${indent}  ${column}: ${columnParts.join(" ")}`);
+      lines.push(`${indent2}  ${column}: ${columnParts.join(" ")}`);
     }
   }
   return lines;
@@ -11910,9 +11722,11 @@ Idempotent execution:
       .run({ key: 'domain' });
 
   Reuse needs the same play, tool id, dataset name, row key, and compatible logic.
-  To refresh, change the id/dataset key or set staleAfterSeconds:
+  To recompute a visible cell on a later cron/user run after a window, put
+  staleAfterSeconds on the cell-producing column:
 
-    .run({ key: 'domain', staleAfterSeconds: 86400 })
+    .withColumn('cto', resolver, { staleAfterSeconds: 86400 })
+    .run({ key: 'domain' })
 
 Examples:
   deepline plays run my.play.ts --input '{"domain":"stripe.com"}'
@@ -12441,7 +12255,9 @@ async function handlePlayShareStatus(args) {
     );
     return 0;
   }
-  console.log(`${status.playName}: published v${status.share.publishedVersion}`);
+  console.log(
+    `${status.playName}: published v${status.share.publishedVersion}`
+  );
   console.log(`  url:  ${status.share.publicPath}`);
   console.log(`  seo:  ${status.share.seoIndexing}`);
   console.log(
@@ -12603,7 +12419,9 @@ async function handlePlayShareRegenerate(args) {
 async function handlePlayShareUnpublish(args) {
   const target = args[0];
   if (!target) {
-    console.error("Usage: deepline plays share unpublish <play> --yes [--json]");
+    console.error(
+      "Usage: deepline plays share unpublish <play> --yes [--json]"
+    );
     return 2;
   }
   if (!args.includes("--yes")) {
@@ -12623,53 +12441,1194 @@ async function handlePlayShareUnpublish(args) {
   return 0;
 }
 
-// src/cli/commands/secrets.ts
-import { stdin as input, stdout as output } from "process";
-var hiddenInputBuffer = "";
-function normalizeSecretName(value) {
-  const normalized = value.trim().toUpperCase();
-  if (!/^[A-Z][A-Z0-9_]{1,63}$/.test(normalized)) {
-    throw new Error(
-      "Secret names must be 2-64 characters and use uppercase letters, numbers, and underscores."
-    );
+// src/cli/enrich-play-compiler.ts
+var RESERVED_WORDS = /* @__PURE__ */ new Set([
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "export",
+  "extends",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "new",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield"
+]);
+function isWaterfall(command) {
+  return "with_waterfall" in command;
+}
+function safeIdentifier2(value, fallback) {
+  const cleaned = value.replace(/[^A-Za-z0-9_$]/g, "_");
+  const prefixed = /^[A-Za-z_$]/.test(cleaned) ? cleaned : `_${cleaned}`;
+  if (!prefixed || RESERVED_WORDS.has(prefixed)) {
+    return fallback;
   }
-  return normalized;
+  return prefixed;
 }
-function renderSecret(secret) {
-  const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
-  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
+function stringLiteral(value) {
+  return JSON.stringify(value);
 }
-async function readHiddenLine(prompt) {
-  if (!input.isTTY || !output.isTTY) {
-    throw new Error(
-      "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
+function stableJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableJson).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).sort(
+      ([left], [right]) => left.localeCompare(right)
     );
+    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
   }
-  output.write(prompt);
-  const previousRawMode = input.isRaw;
-  if (typeof input.setRawMode === "function") input.setRawMode(true);
-  let value = "";
-  input.resume();
-  return await new Promise((resolve12, reject) => {
-    let settled = false;
-    const cleanup = () => {
-      input.off("data", onData);
-      input.off("end", onEnd);
-      input.off("error", onError);
-      if (typeof input.setRawMode === "function") {
-        input.setRawMode(previousRawMode);
-      }
-    };
-    const finish = (line) => {
-      if (settled) return;
-      settled = true;
-      output.write("\n");
-      cleanup();
-      resolve12(line);
-    };
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
+  return JSON.stringify(value);
+}
+function indent(source, spaces) {
+  const pad = " ".repeat(spaces);
+  return source.split("\n").map((line) => line ? `${pad}${line}` : line).join("\n");
+}
+function commandCallId(command) {
+  return `${command.alias}__${command.tool}`;
+}
+function normalizeAlias(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function renderExecuteStep(command, options = { force: false }) {
+  const alias = stringLiteral(command.alias);
+  const callId = stringLiteral(commandCallId(command));
+  const tool = stringLiteral(command.tool);
+  const payload = stableJson(command.payload ?? {});
+  const extractJs = command.extract_js ? `({ row, result, data, raw, pick, extract, target }) => { const input = row; const context = row;
+${indent(renderJavascriptBody(command.extract_js), 6)}
+    }` : "null";
+  const runIfJs = command.run_if_js ? `(row) => { const input = row; const context = row;
+${indent(renderJavascriptBody(command.run_if_js), 6)}
+    }` : "null";
+  const description = command.description ? `,
+      description: ${stringLiteral(command.description)}` : "";
+  const force = options.force ? `,
+    force: true` : "";
+  return [
+    `async (row, stepCtx) => {`,
+    ...options.precheck ? [`  if (${options.precheck}) return null;`] : [],
+    `  return __dlRunCommand({`,
+    `    alias: ${alias},`,
+    `    callId: ${callId},`,
+    `    tool: ${tool},`,
+    `    payload: ${payload},`,
+    `    extract: ${extractJs},`,
+    `    runIf: ${runIfJs},`,
+    `    row,`,
+    `    stepCtx${description}${force}`,
+    `  });`,
+    `}`
+  ].join("\n");
+}
+function renderJavascriptBody(source) {
+  const trimmed = source.trim();
+  if (trimmed && !trimmed.includes("\n") && !trimmed.includes(";") && !/\breturn\b/.test(trimmed)) {
+    return `return (${trimmed});`;
+  }
+  return source;
+}
+function renderWaterfallProgram(command, index, forceAliases) {
+  const variableName = safeIdentifier2(
+    `${command.with_waterfall}_${index}_waterfall`,
+    `waterfall_${index}`
+  );
+  const stepLines = command.commands.map((nested, stepIndex) => {
+    if (isWaterfall(nested)) {
+      throw new Error("Nested with_waterfall blocks are not supported.");
+    }
+    if (nested.disabled) {
+      return null;
+    }
+    const priorAliases = command.commands.slice(0, stepIndex).filter((prior) => !isWaterfall(prior)).filter((prior) => !prior.disabled).map((prior) => prior.alias);
+    const minResults = typeof command.min_results === "number" ? Math.max(1, Math.trunc(command.min_results)) : 1;
+    return [
+      `  .step(${stringLiteral(nested.alias)},`,
+      indent(
+        renderExecuteStep(nested, {
+          force: forceAliases.has(normalizeAlias(nested.alias)),
+          precheck: priorAliases.length > 0 ? `__dlWaterfallSatisfied(row, ${stableJson(priorAliases)}, ${minResults})` : void 0
+        }),
+        4
+      ),
+      `  )`
+    ].join("\n");
+  }).filter((line) => line !== null);
+  const aliases = command.commands.filter((nested) => !isWaterfall(nested)).filter((nested) => !nested.disabled).map((nested) => nested.alias);
+  const returnExpr = typeof command.min_results === "number" ? `__dlFirstMinResults(row, ${stableJson(aliases)}, ${Math.max(
+    1,
+    Math.trunc(command.min_results)
+  )})` : `__dlFirstMeaningful(row, ${stableJson(aliases)})`;
+  return {
+    variableName,
+    hasSteps: stepLines.length > 0,
+    source: [
+      `const ${variableName} = steps<Record<string, unknown>>()`,
+      ...stepLines,
+      `  .return((row) => ${returnExpr});`
+    ].join("\n")
+  };
+}
+function compileEnrichConfigToPlaySource(config, options = {}) {
+  const playName = options.playName ?? "deepline-enrich-v1-compat";
+  const mapName = options.mapName ?? "deepline_enrich_rows";
+  const forceAliases = new Set(
+    [...options.forceAliases ?? []].map((alias) => normalizeAlias(alias))
+  );
+  const waterfalls = [];
+  const mapSteps = [];
+  config.commands.forEach((command, index) => {
+    if (isWaterfall(command)) {
+      const rendered = renderWaterfallProgram(command, index, forceAliases);
+      if (!rendered.hasSteps) {
+        return;
+      }
+      waterfalls.push({
+        alias: command.with_waterfall,
+        variableName: rendered.variableName,
+        source: rendered.source
+      });
+      mapSteps.push(
+        `      .step(${stringLiteral(command.with_waterfall)}, ${rendered.variableName})`
+      );
+      return;
+    }
+    if (command.disabled) {
+      return;
+    }
+    mapSteps.push(
+      [
+        `      .step(${stringLiteral(command.alias)},`,
+        indent(
+          renderExecuteStep(command, {
+            force: forceAliases.has(normalizeAlias(command.alias))
+          }),
+          8
+        ),
+        `      )`
+      ].join("\n")
+    );
+  });
+  const waterfallSource = waterfalls.map((entry) => indent(entry.source, 4));
+  const mapStepSource = mapSteps.length > 0 ? mapSteps.join("\n") : `      .step('noop', (row) => row)`;
+  return [
+    `import { definePlay, steps } from 'deepline';`,
+    ``,
+    `type EnrichInput = { file: string; rowStart?: number | null; rowEnd?: number | null };`,
+    ``,
+    helperSource(),
+    ``,
+    `export default definePlay(${stringLiteral(playName)}, async (ctx, input: EnrichInput) => {`,
+    `  const allRows = await ctx.csv<Record<string, unknown>>(input.file);`,
+    `  const rowStart = Number.isFinite(input.rowStart) ? Math.max(0, Math.trunc(Number(input.rowStart))) : 0;`,
+    `  const rowEnd = Number.isFinite(input.rowEnd) ? Math.max(rowStart, Math.trunc(Number(input.rowEnd))) : allRows.length;`,
+    `  const rows = allRows.slice(rowStart, rowEnd);`,
+    ...waterfallSource,
+    `  const enriched = await ctx`,
+    `    .map(${stringLiteral(mapName)}, rows)`,
+    mapStepSource,
+    `    .run({ key: (row, index) => __dlStableRowKey(row, index + rowStart) });`,
+    `  return { rows: enriched, count: await enriched.count() };`,
+    `});`,
+    ``
+  ].join("\n");
+}
+function helperSource() {
+  return [
+    `function __dlGetByPath(root: unknown, path: string): unknown {`,
+    `  return String(path || '')`,
+    `    .replace(/\\[(\\d+)\\]/g, '.$1')`,
+    `    .split('.')`,
+    `    .map((part) => part.trim())`,
+    `    .filter(Boolean)`,
+    `    .reduce((cursor: unknown, part: string) => {`,
+    `      if (!cursor || typeof cursor !== 'object') return undefined;`,
+    `      const record = cursor as Record<string, unknown>;`,
+    `      if (part in record) return record[part];`,
+    `      const data = record.data;`,
+    `      return data && typeof data === 'object' ? (data as Record<string, unknown>)[part] : undefined;`,
+    `    }, root);`,
+    `}`,
+    ``,
+    `function __dlMeaningful(value: unknown): boolean {`,
+    `  return value !== null && value !== undefined && !(typeof value === 'string' && value.trim() === '') && !(Array.isArray(value) && value.length === 0);`,
+    `}`,
+    ``,
+    `function __dlRawToolOutput(result: unknown): unknown {`,
+    `  if (!result || typeof result !== 'object') return result;`,
+    `  const record = result as Record<string, unknown>;`,
+    `  return __dlGetByPath(record, 'toolOutput.raw') ?? __dlGetByPath(record, 'toolResponse.raw') ?? record.result ?? record.output ?? result;`,
+    `}`,
+    ``,
+    `function __dlTemplate(value: unknown, row: Record<string, unknown>): unknown {`,
+    `  if (Array.isArray(value)) return value.map((entry) => __dlTemplate(entry, row));`,
+    `  if (value && typeof value === 'object') {`,
+    `    return Object.fromEntries(Object.entries(value as Record<string, unknown>).map(([key, entry]) => [key, __dlTemplate(entry, row)]));`,
+    `  }`,
+    `  if (typeof value !== 'string') return value;`,
+    `  const exact = value.match(/^\\{\\{\\s*([^{}]+?)\\s*\\}\\}$/);`,
+    `  if (exact) return __dlGetByPath(row, exact[1] || '');`,
+    `  return value.replace(/\\{\\{\\s*([^{}]+?)\\s*\\}\\}/g, (_match, path) => {`,
+    `    const replacement = __dlGetByPath(row, String(path || ''));`,
+    `    return replacement === null || replacement === undefined ? '' : String(replacement);`,
+    `  });`,
+    `}`,
+    ``,
+    `function __dlStableRowKey(row: Record<string, unknown>, index: number): string {`,
+    `  for (const key of ['id', 'ID', 'email', 'Email', 'linkedin_url', 'LINKEDIN_URL', 'domain', 'DOMAIN']) {`,
+    `    const value = row[key];`,
+    `    if (__dlMeaningful(value)) return String(value);`,
+    `  }`,
+    `  return String(index);`,
+    `}`,
+    ``,
+    `function __dlFirstMeaningful(row: Record<string, unknown>, aliases: string[]): unknown {`,
+    `  for (const alias of aliases) {`,
+    `    const value = row[alias];`,
+    `    if (__dlMeaningful(value)) return value;`,
+    `  }`,
+    `  return null;`,
+    `}`,
+    ``,
+    `function __dlFirstMinResults(row: Record<string, unknown>, aliases: string[], minResults: number): unknown {`,
+    `  const values: unknown[] = [];`,
+    `  for (const alias of aliases) {`,
+    `    const value = row[alias];`,
+    `    if (Array.isArray(value)) values.push(...value.filter(__dlMeaningful));`,
+    `    else if (__dlMeaningful(value)) values.push(value);`,
+    `    if (values.length >= minResults) return values.slice(0, minResults);`,
+    `  }`,
+    `  return values.length > 0 ? values : null;`,
+    `}`,
+    ``,
+    `function __dlWaterfallSatisfied(row: Record<string, unknown>, aliases: string[], minResults: number): boolean {`,
+    `  let count = 0;`,
+    `  for (const alias of aliases) {`,
+    `    const value = row[alias];`,
+    `    if (Array.isArray(value)) count += value.filter(__dlMeaningful).length;`,
+    `    else if (__dlMeaningful(value)) count += 1;`,
+    `    if (count >= Math.max(1, Math.trunc(minResults))) return true;`,
+    `  }`,
+    `  return false;`,
+    `}`,
+    ``,
+    `function __dlExtract(alias: string, result: unknown, row: Record<string, unknown>, extractor: ((args: { row: Record<string, unknown>; result: unknown; data: unknown; raw: unknown; pick: (paths: string[] | string) => unknown; extract: (paths: string[] | string) => unknown; target: (paths: string[] | string) => unknown }) => unknown) | null): unknown {`,
+    `  const raw = __dlRawToolOutput(result);`,
+    `  if (!extractor) return raw;`,
+    `  const pick = (paths: string[] | string) => {`,
+    `    const candidates = Array.isArray(paths) ? paths : [paths];`,
+    `    for (const path of candidates) {`,
+    `      const value = __dlGetByPath(raw, String(path));`,
+    `      if (__dlMeaningful(value)) return value;`,
+    `    }`,
+    `    return null;`,
+    `  };`,
+    `  const extracted = extractor({ row, result, data: raw, raw, pick, extract: pick, target: pick });`,
+    `  if (extracted && typeof extracted === 'object' && !Array.isArray(extracted) && alias in (extracted as Record<string, unknown>)) {`,
+    `    return (extracted as Record<string, unknown>)[alias];`,
+    `  }`,
+    `  return extracted === undefined ? raw : extracted;`,
+    `}`,
+    ``,
+    `async function __dlRunCommand(input: { alias: string; callId: string; tool: string; payload: Record<string, unknown>; extract: ((args: { row: Record<string, unknown>; result: unknown; data: unknown; raw: unknown; pick: (paths: string[] | string) => unknown; extract: (paths: string[] | string) => unknown; target: (paths: string[] | string) => unknown }) => unknown) | null; runIf: ((row: Record<string, unknown>) => unknown) | null; row: Record<string, unknown>; stepCtx: { tools: { execute: (request: Record<string, unknown>) => Promise<unknown> } }; description?: string; force?: boolean }): Promise<unknown> {`,
+    `  if (input.runIf) {`,
+    `    const shouldRun = input.runIf(input.row);`,
+    `    if (!shouldRun) return null;`,
+    `  }`,
+    `  const result = await input.stepCtx.tools.execute({`,
+    `    id: input.callId,`,
+    `    tool: input.tool,`,
+    `    input: __dlTemplate(input.payload, input.row) as Record<string, unknown>,`,
+    `    ...(input.description ? { description: input.description } : {}),`,
+    `    ...(input.force ? { staleAfterSeconds: 0 } : {}),`,
+    `  });`,
+    `  return __dlExtract(input.alias, result, input.row, input.extract);`,
+    `}`
+  ].join("\n");
+}
+
+// src/cli/commands/enrich.ts
+var PLAN_SHAPING_OPTION_NAMES = [
+  "with",
+  "withWaterfall",
+  "minResults",
+  "endWaterfall"
+];
+var ENRICH_DEPRECATION_NOTICE = {
+  status: "deprecated",
+  message: "The enrich compatibility command is deprecated. This run generates a temporary .play.ts file and executes it through plays run.",
+  generatedPlayFile: "Temporary compatibility play file; deleted after the command exits.",
+  printGeneratedPlayCommand: "deepline enrich <same args> --dry-run > enrich.play.ts",
+  recommendedCommand: `deepline plays run enrich.play.ts --input '{"file":"<input.csv>"}'`
+};
+var ENRICH_DEPRECATION_TEXT = `${ENRICH_DEPRECATION_NOTICE.message} Print the generated play with: ${ENRICH_DEPRECATION_NOTICE.printGeneratedPlayCommand}. Then run: ${ENRICH_DEPRECATION_NOTICE.recommendedCommand}
+`;
+function optionWasProvided(args, ...flags) {
+  return args.some(
+    (arg) => flags.some((flag) => arg === flag || arg.startsWith(`${flag}=`))
+  );
+}
+function normalizeAlias2(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function hasPlanShapingArgs(args) {
+  return optionWasProvided(args, "--with") || optionWasProvided(args, "--with-waterfall") || optionWasProvided(args, "--min-results") || optionWasProvided(args, "--end-waterfall");
+}
+function printDeprecationNotice(options) {
+  if (!options.json) {
+    process.stderr.write(ENRICH_DEPRECATION_TEXT);
+  }
+}
+function expandAtFilePath(rawPath) {
+  let expanded = rawPath.trim();
+  expanded = expanded.replace(
+    /\$([A-Za-z_][A-Za-z0-9_]*)|\$\{([^}]+)\}/g,
+    (_match, bareName, bracedName) => process.env[bareName ?? bracedName ?? ""] ?? ""
+  );
+  if (expanded === "~") {
+    return homedir4();
+  }
+  if (expanded.startsWith("~/") || expanded.startsWith("~\\")) {
+    return join8(homedir4(), expanded.slice(2));
+  }
+  return expanded;
+}
+async function readAtFileReference(value, argumentName, strip = true) {
+  if (!value.startsWith("@")) {
+    return strip ? value.trim() : value.replace(/^\uFEFF/, "");
+  }
+  const filePath = expandAtFilePath(value.slice(1));
+  if (!filePath) {
+    throw new Error(`Invalid ${argumentName} value: empty @file path.`);
+  }
+  try {
+    const text = await readFile3(filePath, "utf8");
+    const normalized = text.replace(/^\uFEFF/, "");
+    return strip ? normalized.trim() : normalized;
+  } catch (error) {
+    throw new Error(
+      `Failed to read ${argumentName} file '${filePath}': ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function normalizeExtractJs(source) {
+  return source.replace(/\\"/g, '"').replace(/\\'/g, "'");
+}
+async function normalizeWithSpec(rawSpec) {
+  const raw = await readAtFileReference(rawSpec.trim(), "--with");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(
+      `Invalid JSON payload in --with spec: ${raw} (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Invalid --with spec: expected JSON object.");
+  }
+  const spec = parsed;
+  const normalized = { ...spec };
+  for (const field of ["extract_js", "run_if_js"]) {
+    const value = normalized[field];
+    if (typeof value !== "string" || !value.trim()) {
+      continue;
+    }
+    const fromFile = value.trim().startsWith("@") ? await readAtFileReference(value.trim(), `--with ${field}`, false) : null;
+    normalized[field] = fromFile !== null ? fromFile.trim() : normalizeExtractJs(value.trim());
+  }
+  const tool = String(
+    normalized.tool ?? normalized.tool_ref ?? normalized.tool_id ?? ""
+  ).trim();
+  const payload = normalized.payload;
+  if (tool === "run_javascript" && payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const payloadRecord = payload;
+    const code = payloadRecord.code;
+    if (typeof code === "string" && code.trim().startsWith("@")) {
+      normalized.payload = {
+        ...payloadRecord,
+        code: await readAtFileReference(
+          code.trim(),
+          "run_javascript payload.code",
+          false
+        )
+      };
+    }
+  }
+  return JSON.stringify(normalized);
+}
+async function expandCompiledConfigAtFiles(value) {
+  if (Array.isArray(value)) {
+    return Promise.all(
+      value.map((entry) => expandCompiledConfigAtFiles(entry))
+    );
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  const record = value;
+  const expanded = {};
+  for (const [key, entry] of Object.entries(record)) {
+    expanded[key] = await expandCompiledConfigAtFiles(entry);
+  }
+  for (const field of ["extract_js", "run_if_js"]) {
+    const entry = expanded[field];
+    if (typeof entry === "string" && entry.trim().startsWith("@")) {
+      expanded[field] = (await readAtFileReference(entry.trim(), `--config ${field}`, false)).trim();
+    }
+  }
+  const tool = String(
+    expanded.tool ?? expanded.tool_ref ?? expanded.tool_id ?? ""
+  ).trim();
+  const payload = expanded.payload;
+  if (tool === "run_javascript" && payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const payloadRecord = payload;
+    const code = payloadRecord.code;
+    if (typeof code === "string" && code.trim().startsWith("@")) {
+      expanded.payload = {
+        ...payloadRecord,
+        code: await readAtFileReference(
+          code.trim(),
+          "--config run_javascript payload.code",
+          false
+        )
+      };
+    }
+  }
+  return expanded;
+}
+function currentEnrichArgs() {
+  const index = process.argv.findIndex((arg) => arg === "enrich");
+  return index >= 0 ? process.argv.slice(index + 1) : [];
+}
+async function buildPlanArgs(args) {
+  const passthrough = /* @__PURE__ */ new Set([
+    "--with",
+    "--with-waterfall",
+    "--min-results",
+    "--end-waterfall"
+  ]);
+  const localOptionsWithValue = /* @__PURE__ */ new Set([
+    "--input",
+    "--csv",
+    "--output",
+    "--config",
+    "--rows",
+    "--with-force"
+  ]);
+  const localBooleanOptions = /* @__PURE__ */ new Set([
+    "--dry-run",
+    "--json",
+    "--force",
+    "--all",
+    "--in-place"
+  ]);
+  const planArgs = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    const equalsIndex = arg.indexOf("=");
+    const flag = equalsIndex >= 0 ? arg.slice(0, equalsIndex) : arg;
+    const inlineValue = equalsIndex >= 0 ? arg.slice(equalsIndex + 1) : void 0;
+    if (!passthrough.has(flag)) {
+      if (localOptionsWithValue.has(flag)) {
+        if (inlineValue === void 0) {
+          const value = args[index + 1];
+          if (!value || value.startsWith("--")) {
+            throw new Error(`${flag} requires a value.`);
+          }
+          index += 1;
+        }
+        continue;
+      }
+      if (localBooleanOptions.has(flag)) {
+        if (inlineValue !== void 0) {
+          throw new Error(`${flag} does not accept a value.`);
+        }
+        continue;
+      }
+      if (flag.startsWith("--")) {
+        throw new Error(`Unknown enrich option: ${flag}.`);
+      }
+      throw new Error(`Unexpected enrich argument: ${arg}.`);
+    }
+    planArgs.push(flag);
+    if (inlineValue !== void 0) {
+      planArgs.push(
+        flag === "--with" ? await normalizeWithSpec(inlineValue) : inlineValue
+      );
+      continue;
+    }
+    if (flag !== "--end-waterfall") {
+      const value = args[++index];
+      if (!value) {
+        throw new Error(`${flag} requires a value.`);
+      }
+      planArgs.push(flag === "--with" ? await normalizeWithSpec(value) : value);
+    }
+  }
+  return planArgs;
+}
+async function assertInputCsvExists(inputCsv) {
+  const path = resolve11(inputCsv);
+  try {
+    const info = await stat3(path);
+    if (info.isFile()) {
+      return;
+    }
+    throw new Error("not a file");
+  } catch (error) {
+    throw new Error(
+      `Input CSV does not exist or is not a file: ${path}${error instanceof Error && error.message !== "not a file" ? ` (${error.message})` : ""}`
+    );
+  }
+}
+async function assertSafeOutputPath(inputCsv, outputPath) {
+  const input2 = resolve11(inputCsv);
+  const output2 = resolve11(outputPath);
+  if (input2 === output2) {
+    throw new Error(
+      "--output must be a different path from --input. --in-place is not supported by this V2 enrich runner yet."
+    );
+  }
+  try {
+    const [inputInfo, outputInfo] = await Promise.all([
+      stat3(input2),
+      stat3(output2)
+    ]);
+    if (inputInfo.dev === outputInfo.dev && inputInfo.ino === outputInfo.ino) {
+      throw new Error(
+        "--output must be a different file from --input. --in-place is not supported by this V2 enrich runner yet."
+      );
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("--output must")) {
+      throw error;
+    }
+    const code = error && typeof error === "object" ? error.code : void 0;
+    if (code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
+async function readConfig(path) {
+  const source = await readFile3(resolve11(path), "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(source);
+  } catch (error) {
+    throw new Error(
+      `Invalid JSON in --config ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  return expandCompiledConfigAtFiles(parsed);
+}
+function parseRows(value, all) {
+  if (all && value) {
+    throw new Error("Do not combine --rows with --all.");
+  }
+  if (all || !value) {
+    return { rowStart: null, rowEnd: null };
+  }
+  const trimmed = value.trim();
+  const range = trimmed.match(/^(\d*)\s*:\s*(\d*)$/);
+  if (range) {
+    if (!range[1] && !range[2]) {
+      throw new Error(
+        "--rows must be a zero-based row number or end-exclusive range like 0:10."
+      );
+    }
+    const start = range[1] ? Number.parseInt(range[1], 10) : 0;
+    const end = range[2] ? Number.parseInt(range[2], 10) : null;
+    return { rowStart: start, rowEnd: end };
+  }
+  if (!/^\d+$/.test(trimmed)) {
+    throw new Error(
+      "--rows must be a zero-based row number or end-exclusive range like 0:10."
+    );
+  }
+  const single = Number.parseInt(trimmed, 10);
+  if (!Number.isFinite(single) || single < 0) {
+    throw new Error(
+      "--rows must be a zero-based row number or end-exclusive range like 0:10."
+    );
+  }
+  return { rowStart: single, rowEnd: single + 1 };
+}
+function summarizePlan(config, playSource) {
+  const steps = [];
+  for (const command of config.commands) {
+    if ("with_waterfall" in command) {
+      steps.push({
+        type: "waterfall",
+        alias: command.with_waterfall,
+        min_results: command.min_results ?? 1,
+        steps: command.commands.map(
+          (step) => "with_waterfall" in step ? { type: "waterfall", alias: step.with_waterfall } : { alias: step.alias, tool: step.tool, operation: step.operation }
+        )
+      });
+      continue;
+    }
+    steps.push({
+      type: "step",
+      alias: command.alias,
+      tool: command.tool,
+      operation: command.operation
+    });
+  }
+  return {
+    version: config.version,
+    commandCount: config.commands.length,
+    steps,
+    generatedPlay: playSource
+  };
+}
+function collectCommandAliases(config) {
+  const allAliases = /* @__PURE__ */ new Set();
+  const scalarAliases = /* @__PURE__ */ new Set();
+  const waterfallGroups = /* @__PURE__ */ new Map();
+  for (const command of config.commands) {
+    if ("with_waterfall" in command) {
+      const groupAlias = normalizeAlias2(command.with_waterfall);
+      if (groupAlias) {
+        allAliases.add(groupAlias);
+      }
+      const childAliases = /* @__PURE__ */ new Set();
+      for (const child of command.commands) {
+        if ("with_waterfall" in child || child.disabled) {
+          continue;
+        }
+        const childAlias = normalizeAlias2(child.alias);
+        if (!childAlias) {
+          continue;
+        }
+        allAliases.add(childAlias);
+        scalarAliases.add(childAlias);
+        childAliases.add(childAlias);
+      }
+      if (groupAlias) {
+        waterfallGroups.set(groupAlias, childAliases);
+      }
+      continue;
+    }
+    if (command.disabled) {
+      continue;
+    }
+    const alias = normalizeAlias2(command.alias);
+    if (alias) {
+      allAliases.add(alias);
+      scalarAliases.add(alias);
+    }
+  }
+  return { allAliases, scalarAliases, waterfallGroups };
+}
+function parseWithForceAliases(values) {
+  const aliases = /* @__PURE__ */ new Set();
+  for (const value of values ?? []) {
+    for (const item of value.split(",")) {
+      const alias = normalizeAlias2(item.trim());
+      if (alias) {
+        aliases.add(alias);
+      }
+    }
+  }
+  return aliases;
+}
+function resolveForceAliases(config, options) {
+  const { allAliases, scalarAliases, waterfallGroups } = collectCommandAliases(config);
+  if (options.force) {
+    return new Set(scalarAliases);
+  }
+  const requested = parseWithForceAliases(options.withForce);
+  const unknown = [...requested].filter((alias) => !allAliases.has(alias));
+  if (unknown.length > 0) {
+    throw new Error(
+      `--with-force references unknown --with column alias(es): ${unknown.sort().join(", ")}.`
+    );
+  }
+  const resolved = /* @__PURE__ */ new Set();
+  for (const alias of requested) {
+    const children = waterfallGroups.get(alias);
+    if (children) {
+      for (const child of children) {
+        resolved.add(child);
+      }
+    } else {
+      resolved.add(alias);
+    }
+  }
+  return resolved;
+}
+function parseJsonOutput(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return null;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    const start = trimmed.lastIndexOf("\n{");
+    if (start >= 0) {
+      return JSON.parse(trimmed.slice(start + 1));
+    }
+    throw new Error(
+      "The generated play completed but did not emit parseable JSON."
+    );
+  }
+}
+async function captureStdout(run) {
+  const originalWrite = process.stdout.write.bind(process.stdout);
+  let stdout = "";
+  process.stdout.write = ((chunk, ..._args) => {
+    stdout += typeof chunk === "string" ? chunk : String(chunk);
+    return true;
+  });
+  try {
+    const result = await run();
+    return { result, stdout };
+  } finally {
+    process.stdout.write = originalWrite;
+  }
+}
+async function writeOutputCsv(outputPath, status) {
+  const rowsInfo = extractCanonicalRowsInfo(status);
+  if (!rowsInfo) {
+    throw new Error("The generated play did not return row-shaped output.");
+  }
+  assertCompleteRowsForCsvExport(rowsInfo, status, outputPath);
+  const rows = dataExportRows(rowsInfo.rows);
+  const columns = dataExportColumns(rows, rowsInfo.columns);
+  await writeFile4(
+    resolve11(outputPath),
+    csvStringFromRows(rows, columns),
+    "utf8"
+  );
+  return { rows: rows.length, path: resolve11(outputPath) };
+}
+function assertCompleteRowsForCsvExport(rowsInfo, status, outputPath) {
+  if (rowsInfo.complete) {
+    return;
+  }
+  const runId = status && typeof status === "object" && !Array.isArray(status) && typeof status.runId === "string" ? status.runId : null;
+  const dataset = rowsInfo.source ?? "result.rows";
+  const retry = runId ? ` Retry after the run finalizes its backing dataset with: deepline runs export ${runId} --dataset ${dataset} --out ${outputPath}` : "";
+  throw new Error(
+    `Refusing to write a partial CSV export: the run returned ${rowsInfo.rows.length} preview row(s) out of ${rowsInfo.totalRows}.${retry}`
+  );
+}
+async function compileConfig(input2) {
+  if (input2.options.config) {
+    if (hasPlanShapingArgs(input2.args)) {
+      throw new Error(
+        `Do not mix --config with plan-shaping flags (${PLAN_SHAPING_OPTION_NAMES.join(", ")}). Put the plan in the config file or pass flags directly.`
+      );
+    }
+    const config = await readConfig(input2.options.config);
+    return (await input2.client.compileEnrichPlan({ config })).config;
+  }
+  const planArgs = await buildPlanArgs(input2.args);
+  return (await input2.client.compileEnrichPlan({ plan_args: planArgs })).config;
+}
+function registerEnrichCommand(program) {
+  program.command("enrich").allowUnknownOption(true).description("Run v1-style CSV enrichment through the V2 play runner.").option("--input <path>", "Input CSV path.").option("--csv <path>", "Alias for --input.").option("--output <path>", "Output CSV path.").option("--config <path>", "JSON enrich config.").option(
+    "--with <json>",
+    "Add a scalar enrich command.",
+    (value, previous = []) => [...previous, value]
+  ).option(
+    "--with-waterfall <alias>",
+    "Start a waterfall group.",
+    (value, previous = []) => [...previous, value]
+  ).option(
+    "--min-results <count>",
+    "Minimum list results for the current waterfall."
+  ).option("--end-waterfall", "End the current waterfall group.").option(
+    "--rows <range>",
+    "Zero-based row number or end-exclusive range, e.g. 0:10."
+  ).option("--all", "Run all rows.").option(
+    "--dry-run",
+    "Compile and print the generated plan without starting a run."
+  ).option("--json", "Emit JSON.").option("--force", "Force rerun for all enrich aliases.").option(
+    "--with-force <aliases>",
+    "Force rerun for selected aliases.",
+    (value, previous = []) => [...previous, value]
+  ).option(
+    "--in-place",
+    "Not supported by the V2 enrich compatibility runner yet."
+  ).action(async (options, _command) => {
+    if (options.inPlace) {
+      throw new Error(
+        "--in-place is not supported by this V2 enrich runner yet. Use --output instead."
+      );
+    }
+    const inputCsv = options.input ?? options.csv;
+    if (!inputCsv) {
+      throw new Error("Missing required --input <csv> (or --csv <csv>).");
+    }
+    await assertInputCsvExists(inputCsv);
+    if (options.output) {
+      await assertSafeOutputPath(inputCsv, options.output);
+    }
+    if (!options.config && !hasPlanShapingArgs(currentEnrichArgs())) {
+      throw new Error("Pass --config or at least one --with enrich spec.");
+    }
+    const client = new DeeplineClient();
+    const args = currentEnrichArgs();
+    const config = await compileConfig({ client, args, options });
+    const forceAliases = resolveForceAliases(config, options);
+    const playSource = compileEnrichConfigToPlaySource(config, {
+      forceAliases
+    });
+    const summary = summarizePlan(config, playSource);
+    printDeprecationNotice(options);
+    if (options.dryRun) {
+      if (options.json) {
+        printJson({
+          dryRun: true,
+          deprecation: ENRICH_DEPRECATION_NOTICE,
+          input: resolve11(inputCsv),
+          output: options.output ? resolve11(options.output) : null,
+          plan: summary
+        });
+        return;
+      }
+      process.stdout.write(`${playSource}
+`);
+      return;
+    }
+    const rows = parseRows(options.rows, options.all);
+    if (options.output && options.rows) {
+      throw new Error(
+        "CSV export with --rows is not supported yet because it would write only the selected rows. Run without --rows or omit --output."
+      );
+    }
+    const tempDir = await mkdtemp(join8(tmpdir3(), "deepline-enrich-play-"));
+    const tempPlay = join8(tempDir, "deepline-enrich.play.ts");
+    try {
+      await writeFile4(tempPlay, playSource, "utf8");
+      const runtimeInput = {
+        file: resolve11(inputCsv),
+        ...rows.rowStart !== null ? { rowStart: rows.rowStart } : {},
+        ...rows.rowEnd !== null ? { rowEnd: rows.rowEnd } : {}
+      };
+      const runArgs = [
+        "--file",
+        tempPlay,
+        "--input",
+        JSON.stringify(runtimeInput),
+        "--watch",
+        "--no-open",
+        "--json"
+      ];
+      const captured = await captureStdout(() => handlePlayRun(runArgs));
+      const status = parseJsonOutput(captured.stdout);
+      if (captured.result !== 0) {
+        if (options.json) {
+          printJson({
+            deprecation: ENRICH_DEPRECATION_NOTICE,
+            result: status
+          });
+        } else {
+          process.stdout.write(captured.stdout);
+        }
+        process.exitCode = captured.result;
+        return;
+      }
+      const exportResult = options.output ? await writeOutputCsv(options.output, status) : null;
+      if (options.json) {
+        printJson({
+          ok: true,
+          deprecation: ENRICH_DEPRECATION_NOTICE,
+          run: status,
+          output: exportResult
+        });
+        return;
+      }
+      process.stdout.write(captured.stdout);
+      if (exportResult) {
+        process.stderr.write(
+          `Wrote ${exportResult.rows} row(s) to ${exportResult.path}
+`
+        );
+      }
+    } finally {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+}
+
+// src/cli/commands/feedback.ts
+async function handleFeedback(text, options) {
+  const { http } = getAuthedHttpClient();
+  const response = await http.post("/api/v2/cli/feedback", {
+    text,
+    environment: collectLocalEnvInfo(),
+    ...options.command ? { command: options.command } : {},
+    ...options.payload ? { payload: options.payload } : {}
+  });
+  printCommandEnvelope(
+    {
+      ...response,
+      render: {
+        sections: [
+          { title: "feedback", lines: ["Feedback submitted. Thank you."] }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerFeedbackCommands(program) {
+  const feedback = program.command("feedback").description("Submit CLI feedback to Deepline.").addHelpText(
+    "after",
+    `
+Notes:
+  Sends the feedback text plus local CLI environment info to Deepline support.
+  Use --command and --payload to attach a reproducible command shape.
+
+Examples:
+  deepline feedback "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
+  deepline feedback "unexpected billing output" --payload '{"command":"billing usage"}' --json
+`
+  );
+  feedback.argument("<text>", "Feedback text").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option("--json", "Emit JSON output").action(handleFeedback);
+  program.command("provide-feedback").description("Legacy alias for `deepline feedback`.").addHelpText(
+    "after",
+    `
+Notes:
+  Compatibility alias. Prefer deepline feedback in new scripts and docs.
+
+Examples:
+  deepline feedback "tools search returned stale results" --json
+`
+  ).argument("<text>", "Feedback text").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option("--json", "Emit JSON output").action(handleFeedback);
+}
+
+// src/cli/commands/org.ts
+async function fetchOrganizations(http, apiKey) {
+  return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
+}
+function orgListLines(orgs) {
+  return orgs.map((org, index) => {
+    const current = org.is_current ? " (current)" : "";
+    const role = org.role ? ` [${org.role}]` : "";
+    return `${index + 1}. ${org.name}${role}${current}`;
+  });
+}
+async function handleOrgList(options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  printCommandEnvelope(
+    {
+      ...payload,
+      render: {
+        sections: [
+          {
+            title: "Your organizations:",
+            lines: orgListLines(payload.organizations)
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleOrgSwitch(selection, options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  if (!selection && !options.orgId) {
+    printCommandEnvelope(
+      {
+        ...payload,
+        next: { switch: "deepline org switch <number>" },
+        render: {
+          sections: [
+            {
+              title: "Your organizations:",
+              lines: orgListLines(payload.organizations)
+            }
+          ],
+          actions: [{ label: "Run", command: "deepline org switch <number>" }]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  let target = payload.organizations.find(
+    (org) => org.org_id === options.orgId
+  );
+  if (!target && selection) {
+    const index = Number.parseInt(selection, 10);
+    if (Number.isFinite(index) && index >= 1 && index <= payload.organizations.length) {
+      target = payload.organizations[index - 1];
+    } else {
+      target = payload.organizations.find(
+        (org) => org.name === selection || org.org_id === selection
+      );
+    }
+  }
+  if (!target) {
+    throw new Error("Could not resolve the selected organization.");
+  }
+  if (target.is_current) {
+    printCommandEnvelope(
+      {
+        ok: true,
+        unchanged: true,
+        organization: target,
+        render: {
+          sections: [
+            { title: "org switch", lines: [`Already on ${target.name}.`] }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const switched = await http.post("/api/v2/auth/cli/switch", {
+    api_key: config.apiKey,
+    org_id: target.org_id
+  });
+  saveHostEnvValues(config.baseUrl, {
+    DEEPLINE_API_KEY: switched.api_key,
+    DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
+    DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
+  });
+  const { api_key: _apiKey, ...publicSwitched } = switched;
+  printCommandEnvelope(
+    {
+      ok: true,
+      host_env_path: hostEnvFilePath(config.baseUrl),
+      ...publicSwitched,
+      api_key_saved: true,
+      render: {
+        sections: [
+          {
+            title: "org switch",
+            lines: [
+              `Switched to ${switched.org_name}.`,
+              `Saved host auth in ${hostEnvFilePath(config.baseUrl)}`
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerOrgCommands(program) {
+  const org = program.command("org").description("List and switch organizations.").addHelpText(
+    "after",
+    `
+Notes:
+  Organizations are workspaces. Switching organizations mutates the saved host
+  auth file so later CLI commands target the selected workspace.
+
+Examples:
+  deepline org list --json
+  deepline org switch 2
+  deepline org switch --org-id org_123 --json
+`
+  );
+  org.command("list").description("List your organizations.").addHelpText(
+    "after",
+    `
+Notes:
+  Read-only. Marks the active organization when the server returns that metadata.
+
+Examples:
+  deepline org list
+  deepline org list --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgList);
+  org.command("switch [selection]").description(
+    "Switch to another organization and save the new API key in the host auth file."
+  ).addHelpText(
+    "after",
+    `
+Notes:
+  Mutates the saved host auth file. Selection can be a list number, exact
+  organization name, or organization id. Without a selection, prints choices.
+
+Examples:
+  deepline org switch
+  deepline org switch 2
+  deepline org switch --org-id org_123 --json
+`
+  ).option("--org-id <id>", "Switch using an explicit organization id").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgSwitch);
+}
+
+// src/cli/commands/secrets.ts
+import { stdin as input, stdout as output } from "process";
+var hiddenInputBuffer = "";
+function normalizeSecretName(value) {
+  const normalized = value.trim().toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,63}$/.test(normalized)) {
+    throw new Error(
+      "Secret names must be 2-64 characters and use uppercase letters, numbers, and underscores."
+    );
+  }
+  return normalized;
+}
+function renderSecret(secret) {
+  const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
+}
+async function readHiddenLine(prompt) {
+  if (!input.isTTY || !output.isTTY) {
+    throw new Error(
+      "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
+    );
+  }
+  output.write(prompt);
+  const previousRawMode = input.isRaw;
+  if (typeof input.setRawMode === "function") input.setRawMode(true);
+  let value = "";
+  input.resume();
+  return await new Promise((resolve13, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      input.off("data", onData);
+      input.off("end", onEnd);
+      input.off("error", onError);
+      if (typeof input.setRawMode === "function") {
+        input.setRawMode(previousRawMode);
+      }
+    };
+    const finish = (line) => {
+      if (settled) return;
+      settled = true;
+      output.write("\n");
+      cleanup();
+      resolve13(line);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
       output.write("\n");
       cleanup();
       reject(error);
@@ -12838,13 +13797,13 @@ Examples:
 // src/cli/commands/tools.ts
 import { Option } from "commander";
 import { chmodSync, mkdtempSync, writeFileSync as writeFileSync8 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join9 } from "path";
+import { tmpdir as tmpdir4 } from "os";
+import { join as join10 } from "path";
 
 // src/tool-output.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join9 } from "path";
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -12940,19 +13899,19 @@ function tryConvertToList(payload, options) {
   return null;
 }
 function ensureOutputDir() {
-  const outputDir = join8(homedir4(), ".local", "share", "deepline", "data");
+  const outputDir = join9(homedir5(), ".local", "share", "deepline", "data");
   mkdirSync4(outputDir, { recursive: true });
   return outputDir;
 }
 function writeJsonOutputFile(payload, stem) {
   const outputDir = ensureOutputDir();
-  const outputPath = join8(outputDir, `${stem}_${Date.now()}.json`);
+  const outputPath = join9(outputDir, `${stem}_${Date.now()}.json`);
   writeFileSync7(outputPath, JSON.stringify(payload, null, 2), "utf-8");
   return outputPath;
 }
 function writeCsvOutputFile(rows, stem) {
   const outputDir = ensureOutputDir();
-  const outputPath = join8(outputDir, `${stem}_${Date.now()}.csv`);
+  const outputPath = join9(outputDir, `${stem}_${Date.now()}.csv`);
   const seen = /* @__PURE__ */ new Set();
   const columns = [];
   for (const row of rows) {
@@ -13711,7 +14670,7 @@ function printToolExamplesOnly(tool, requestedToolId, options = {}) {
     const expression = stringField(firstGetter, "expression");
     if (expression)
       console.log(
-        `const ${safeIdentifier2(name)} = ${expression.replace(/^toolExecutionResult\./, "result.")};`
+        `const ${safeIdentifier3(name)} = ${expression.replace(/^toolExecutionResult\./, "result.")};`
       );
   }
   console.log("```");
@@ -13780,7 +14739,7 @@ function samplePayloadForInputFields(fields) {
 function stableStepIdForTool(toolId) {
   return toolId.replace(/^[a-z0-9]+_/, "").replace(/[^a-z0-9_]+/gi, "_") || "tool_call";
 }
-function safeIdentifier2(name) {
+function safeIdentifier3(name) {
   const cleaned = name.replace(/[^a-zA-Z0-9_$]+/g, "_").replace(/^[^a-zA-Z_$]+/, "");
   return cleaned || "value";
 }
@@ -14043,9 +15002,9 @@ function powerShellQuote(value) {
 function seedToolListScript(input2) {
   const stem = safeFileStem(input2.toolId);
   const fileName = `${stem}-workflow-seed-${Date.now()}.play.ts`;
-  const scriptDir = mkdtempSync(join9(tmpdir3(), "deepline-workflow-seed-"));
+  const scriptDir = mkdtempSync(join10(tmpdir4(), "deepline-workflow-seed-"));
   chmodSync(scriptDir, 448);
-  const scriptPath = join9(scriptDir, fileName);
+  const scriptPath = join10(scriptDir, fileName);
   const projectDir = `deepline/projects/${stem}-workflow`;
   const playName = `${stem}-workflow`;
   const sampleRows = input2.rows.length > 0 ? `${JSON.stringify(input2.rows.slice(0, 2)).replace(/\]$/, "")}, ...]` : "[]";
@@ -14337,7 +15296,7 @@ async function executeTool(args) {
 // src/cli/commands/update.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname9, join as join10, resolve as resolve11 } from "path";
+import { dirname as dirname9, join as join11, resolve as resolve12 } from "path";
 function posixShellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -14356,9 +15315,9 @@ function buildSourceUpdateCommand(sourceRoot) {
   return `${cdCommand} && git fetch origin main --tags && git merge --ff-only origin/main`;
 }
 function findRepoBackedSdkRoot(startPath) {
-  let current = resolve11(startPath);
+  let current = resolve12(startPath);
   while (true) {
-    if (existsSync8(join10(current, "sdk", "package.json")) && existsSync8(join10(current, "sdk", "bin", "deepline-dev.ts"))) {
+    if (existsSync8(join11(current, "sdk", "package.json")) && existsSync8(join11(current, "sdk", "bin", "deepline-dev.ts"))) {
       return current;
     }
     const parent = dirname9(current);
@@ -14367,7 +15326,7 @@ function findRepoBackedSdkRoot(startPath) {
   }
 }
 function resolveUpdatePlan() {
-  const entrypoint = process.argv[1] ? resolve11(process.argv[1]) : "";
+  const entrypoint = process.argv[1] ? resolve12(process.argv[1]) : "";
   const sourceRoot = entrypoint ? findRepoBackedSdkRoot(dirname9(entrypoint)) : null;
   if (sourceRoot) {
     return {
@@ -14639,8 +15598,8 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync9
 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname10, join as join11 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname10, join as join12 } from "path";
 var CHECK_TIMEOUT_MS2 = 3e3;
 var SDK_SKILL_NAME = "deepline-sdk";
 var attemptedSync = false;
@@ -14649,8 +15608,8 @@ function shouldSkipSkillsSync() {
   return value === "1" || value === "true" || value === "yes" || value === "on";
 }
 function sdkSkillsVersionPath(baseUrl) {
-  const home = process.env.HOME?.trim() || homedir5();
-  return join11(
+  const home = process.env.HOME?.trim() || homedir6();
+  return join12(
     home,
     ".local",
     "deepline",
@@ -14675,10 +15634,10 @@ function writeLocalSkillsVersion(baseUrl, version) {
 `, "utf-8");
 }
 function installedSdkSkillHasStalePositionalExecuteExamples() {
-  const home = process.env.HOME?.trim() || homedir5();
+  const home = process.env.HOME?.trim() || homedir6();
   const roots = [
-    join11(home, ".claude", "skills", SDK_SKILL_NAME),
-    join11(home, ".agents", "skills", SDK_SKILL_NAME)
+    join12(home, ".claude", "skills", SDK_SKILL_NAME),
+    join12(home, ".agents", "skills", SDK_SKILL_NAME)
   ];
   const staleMarkers = [
     "ctx.tools.execute(key",
@@ -14689,9 +15648,9 @@ function installedSdkSkillHasStalePositionalExecuteExamples() {
   ];
   const scan = (dir) => {
     for (const entry of readdirSync2(dir)) {
-      const path = join11(dir, entry);
-      const stat3 = statSync2(path);
-      if (stat3.isDirectory()) {
+      const path = join12(dir, entry);
+      const stat4 = statSync2(path);
+      if (stat4.isDirectory()) {
         if (scan(path)) return true;
         continue;
       }
@@ -14775,7 +15734,7 @@ function resolveSkillsInstallCommands(baseUrl) {
   return [npxInstall];
 }
 function runOneSkillsInstall(install) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawn2(install.command, install.args, {
       stdio: ["ignore", "ignore", "pipe"],
       env: process.env
@@ -14785,7 +15744,7 @@ function runOneSkillsInstall(install) {
       stderr += chunk.toString("utf-8");
     });
     child.on("error", (error) => {
-      resolve12({
+      resolve13({
         ok: false,
         detail: `failed to start ${install.command}: ${error.message}`,
         manualCommand: install.manualCommand
@@ -14793,11 +15752,11 @@ function runOneSkillsInstall(install) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve12({ ok: true, detail: "", manualCommand: install.manualCommand });
+        resolve13({ ok: true, detail: "", manualCommand: install.manualCommand });
         return;
       }
       const detail = stderr.trim();
-      resolve12({
+      resolve13({
         ok: false,
         detail: detail ? `${install.command}: ${detail}` : `${install.command} exited ${code}`,
         manualCommand: install.manualCommand
@@ -14880,10 +15839,10 @@ function shouldDeferSkillsSyncForCommand() {
   return (command === "play" || command === "plays") && subcommand === "run" && args.includes("--json");
 }
 async function runPlayRunnerHealthCheck() {
-  const dir = await mkdtemp(join12(tmpdir4(), "deepline-health-play-"));
-  const file = join12(dir, "health-check.play.ts");
+  const dir = await mkdtemp2(join13(tmpdir5(), "deepline-health-play-"));
+  const file = join13(dir, "health-check.play.ts");
   try {
-    await writeFile4(
+    await writeFile5(
       file,
       [
         "import { definePlay } from 'deepline';",
@@ -14931,7 +15890,7 @@ async function runPlayRunnerHealthCheck() {
       }
     };
   } finally {
-    await rm(dir, { recursive: true, force: true });
+    await rm2(dir, { recursive: true, force: true });
   }
 }
 async function main() {
@@ -15008,6 +15967,7 @@ Exit codes:
   registerSecretsCommands(program);
   registerBillingCommands(program);
   registerOrgCommands(program);
+  registerEnrichCommand(program);
   registerCsvCommands(program);
   registerDbCommands(program);
   registerFeedbackCommands(program);