deepline 0.3.87 → 0.3.89

package/dist/cli/index.mjs

@@ -572,6 +572,7 @@ var HOST_URL_ENV = "DEEPLINE_HOST_URL";
 var API_KEY_ENV = "DEEPLINE_API_KEY";
 var ACTIVE_ORG_ID_ENV = "DEEPLINE_ACTIVE_ORG_ID";
 var ACTIVE_ORG_NAME_ENV = "DEEPLINE_ACTIVE_ORG_NAME";
+var FEATURES_ENV = "DEEPLINE_FEATURES";
 var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
@@ -596,8 +597,40 @@ var CLI_ENV_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   HOST_URL_ENV,
   API_KEY_ENV,
   ACTIVE_ORG_ID_ENV,
-  ACTIVE_ORG_NAME_ENV
+  ACTIVE_ORG_NAME_ENV,
+  FEATURES_ENV
 ]);
+function featureEnvValues(data) {
+  if (!Array.isArray(data.features)) return {};
+  return {
+    [FEATURES_ENV]: data.features.filter(
+      (key) => typeof key === "string" && key.trim() !== ""
+    ).map((key) => key.trim()).join(",")
+  };
+}
+function storedHostApiKey(baseUrl) {
+  return loadCliEnv(normalizeBaseUrl(baseUrl) || baseUrl)[API_KEY_ENV] ?? "";
+}
+function storedHostFeatures(baseUrl) {
+  return loadCliEnv(normalizeBaseUrl(baseUrl) || baseUrl)[FEATURES_ENV];
+}
+function envHasFeature(env, feature) {
+  return (env[FEATURES_ENV] ?? "").split(",").map((key) => key.trim()).includes(feature);
+}
+function cliFeatureEnabled(feature) {
+  const processEnv = process.env;
+  if (envHasFeature(processEnv, feature)) return true;
+  if (processEnv[API_KEY_ENV]?.trim()) return false;
+  try {
+    const baseUrl = resolveBaseUrlOnly();
+    const projectEnv = loadProjectEnvCandidates().find(
+      ({ env }) => normalizeBaseUrl(env[HOST_URL_ENV] ?? "") === baseUrl && Boolean(env[API_KEY_ENV])
+    );
+    return envHasFeature(projectEnv?.env ?? loadCliEnv(baseUrl), feature);
+  } catch {
+    return false;
+  }
+}
 function baseUrlSlug(baseUrl) {
   let url;
   try {
@@ -797,6 +830,10 @@ function mergePersistedEnvValues(existing, values) {
   if (nextApiKey !== void 0 && nextApiKey !== existing[API_KEY_ENV] && values[ACTIVE_ORG_ID_ENV] === void 0) {
     delete merged[ACTIVE_ORG_ID_ENV];
     delete merged[ACTIVE_ORG_NAME_ENV];
+    delete merged[FEATURES_ENV];
+  }
+  if (values[FEATURES_ENV] === "") {
+    delete merged[FEATURES_ENV];
   }
   return merged;
 }
@@ -920,7 +957,10 @@ function resolveConfig(options) {
     apiKey,
     baseUrl,
     timeout: options?.timeout ?? DEFAULT_TIMEOUT,
-    maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES
+    maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES,
+    // Pass through untouched: the transport owns case-insensitive merging so
+    // there is exactly one place that decides which header wins.
+    ...options?.headers ? { headers: { ...options.headers } } : {}
   };
 }
 function mergeProjectEnvFile(filePath, values) {
@@ -1210,7 +1250,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.87",
+  version: "0.3.89",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -1764,11 +1804,33 @@ function normalizeRequestAbortError(error, input2) {
   }
   return normalized;
 }
+function applyExplicitHeaders(headers, explicit) {
+  if (!explicit) return headers;
+  for (const [rawName, value] of Object.entries(explicit)) {
+    const name = rawName.trim().toLowerCase();
+    if (!name) continue;
+    for (const existing of Object.keys(headers)) {
+      if (existing.toLowerCase() === name) delete headers[existing];
+    }
+    headers[name] = value;
+  }
+  return headers;
+}
 function isAbortLikeError(error) {
   const name = error.name.toLowerCase();
   const message = error.message.toLowerCase();
   return name === "aborterror" || message.includes("operation was aborted") || message === "aborted";
 }
+function withErrorCause(error, cause) {
+  if (cause !== null && cause !== void 0) {
+    Object.defineProperty(error, "cause", {
+      value: cause,
+      configurable: true,
+      writable: true
+    });
+  }
+  return error;
+}
 function mapNetworkError(baseUrl, error, targetLabel2) {
   const tagged = error;
   const timeoutMs = tagged?.[REQUEST_TIMEOUT_MARKER];
@@ -1885,7 +1947,7 @@ var HttpClient = class {
     if (coordinatorInternalToken?.trim() && (coordinatorUrl?.trim() || workerCallbackUrl?.trim() || runtimeTestFault?.trim() || absurdReleaseOverride?.trim() || preferredReceiptGatewayMachineId?.trim())) {
       headers[COORDINATOR_INTERNAL_TOKEN_HEADER] = coordinatorInternalToken.trim();
     }
-    return headers;
+    return applyExplicitHeaders(headers, this.config.headers);
   }
   /**
    * Send an HTTP request with automatic retries and error handling.
@@ -2039,32 +2101,38 @@ var HttpClient = class {
     );
     if (options?.toolId) {
       const code = mappedNetworkError.code;
-      throw new ToolExecutionError(
-        withCoworkNetworkHint(mappedNetworkError.message),
-        {
-          toolId: options.toolId,
-          provider: providerLabelFromToolId(options.toolId),
-          operation: options.toolId,
-          code,
-          origin: "deepline",
-          category: "network",
-          // A direct client timeout has ambiguous delivery. Fail closed unless
-          // the server returns the authoritative action delivery contract.
-          retryable: false,
-          statusCode: null,
-          requestId: null,
-          retryAfterMs: null,
-          networkKind: code === "NETWORK_TIMEOUT" ? "timeout" : code === "NETWORK_ABORTED" ? "unknown" : "unavailable",
-          networkScope: "client_to_deepline",
-          details: mappedNetworkError.details
-        }
+      throw withErrorCause(
+        new ToolExecutionError(
+          withCoworkNetworkHint(mappedNetworkError.message),
+          {
+            toolId: options.toolId,
+            provider: providerLabelFromToolId(options.toolId),
+            operation: options.toolId,
+            code,
+            origin: "deepline",
+            category: "network",
+            // A direct client timeout has ambiguous delivery. Fail closed unless
+            // the server returns the authoritative action delivery contract.
+            retryable: false,
+            statusCode: null,
+            requestId: null,
+            retryAfterMs: null,
+            networkKind: code === "NETWORK_TIMEOUT" ? "timeout" : code === "NETWORK_ABORTED" ? "unknown" : "unavailable",
+            networkScope: "client_to_deepline",
+            details: mappedNetworkError.details
+          }
+        ),
+        lastError
       );
     }
-    throw new DeeplineError(
-      withCoworkNetworkHint(mappedNetworkError.message),
-      void 0,
-      mappedNetworkError.code,
-      mappedNetworkError.details
+    throw withErrorCause(
+      new DeeplineError(
+        withCoworkNetworkHint(mappedNetworkError.message),
+        void 0,
+        mappedNetworkError.code,
+        mappedNetworkError.details
+      ),
+      lastError
     );
   }
   /**
@@ -2438,6 +2506,13 @@ var PRODUCT_NOTIFICATION_DELIVERY_LEASE_MS = 2 * 6e4;
 var PRODUCT_NOTIFICATION_SUCCESS_TTL_MS = 15 * 6e4;
 var PRODUCT_NOTIFICATION_FAILURE_TTL_MS = 24 * 60 * 6e4;
 
+// ../product-notifications/configuration.ts
+var PRODUCT_NOTIFICATION_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function normalizeProductNotificationEmail(value) {
+  const email = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return email && email.length <= 320 && PRODUCT_NOTIFICATION_EMAIL_PATTERN.test(email) ? email : null;
+}
+
 // src/stream-reconnect.ts
 var STREAM_RECONNECT_BASE_DELAY_MS = 500;
 var STREAM_RECONNECT_MAX_DELAY_MS = 15e3;
@@ -2966,7 +3041,7 @@ function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isPlayActivityObservation(value) {
-  if (!isRecord4(value) || value.schemaVersion !== 1 || typeof value.activityId !== "string" || !value.activityId.trim() || typeof value.observedAt !== "number" || !Number.isFinite(value.observedAt) || !isRecord4(value.target) || !isRecord4(value.state)) {
+  if (!isRecord4(value) || value.schemaVersion !== void 0 && value.schemaVersion !== 1 || typeof value.activityId !== "string" || !value.activityId.trim() || typeof value.observedAt !== "number" || !Number.isFinite(value.observedAt) || !isRecord4(value.target) || !isRecord4(value.state)) {
     return false;
   }
   const targetKinds = /* @__PURE__ */ new Set([
@@ -3073,7 +3148,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "detached_runner") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "runner:managed",
         target: {
           kind: "runner",
@@ -3089,7 +3163,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "sleep") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "run:sleep",
         target: {
           kind: "step",
@@ -3109,7 +3182,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "integration_event" || input2.waitKind === "integration_event_batch") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: `event:${input2.activeNodeId ?? "run"}`,
         stepId: input2.activeNodeId ?? void 0,
         target: {
@@ -3133,7 +3205,6 @@ function projectPlayRunActivity(input2) {
   if (normalizedStatus === "waiting") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "run:legacy-wait",
         target: {
           kind: "step",
@@ -3160,7 +3231,6 @@ function projectPlayRunActivity(input2) {
     const datasetProgress = datasetStep?.progress ?? null;
     return projection(
       {
-        schemaVersion: 1,
         activityId: `dataset:${pendingDataset.datasetId ?? pendingDataset.tableNamespace}`,
         target: {
           kind: "dataset",
@@ -3188,7 +3258,6 @@ function projectPlayRunActivity(input2) {
     const provider = toolId?.split(/[._]/)[0]?.trim() || null;
     return projection(
       {
-        schemaVersion: 1,
         activityId: `step:${activeStep.nodeId}`,
         stepId: activeStep.nodeId,
         target: toolId && provider ? {
@@ -3213,7 +3282,6 @@ function projectPlayRunActivity(input2) {
   if (normalizedStatus === "queued") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "capacity:worker",
         target: { kind: "capacity", pool: "worker" },
         state: { kind: "queued", reason: "capacity" },
@@ -3223,7 +3291,6 @@ function projectPlayRunActivity(input2) {
     );
   }
   const fallback = {
-    schemaVersion: 1,
     activityId: "run:legacy",
     target: {
       kind: "step",
@@ -4483,6 +4550,42 @@ function providerMetaFromToolResponseRawV2(rawV2, view) {
 }
 
 // src/client.ts
+var MAX_NOTIFICATION_GROUP_CREATE_TARGETS = 50;
+function parseNotificationGroupTarget(value) {
+  const normalized = value.trim();
+  if (normalized.toLowerCase().startsWith("email:")) {
+    const email = normalizeProductNotificationEmail(normalized.slice(6));
+    if (!email) {
+      throw new Error(
+        `Invalid email notification target "${value}". Use --to email:name@example.com.`
+      );
+    }
+    return { kind: "email", email };
+  }
+  const slack = /^slack:(.+)$/i.exec(normalized)?.[1]?.trim();
+  if (!slack) {
+    const provider = normalized.split(":", 1)[0] || normalized;
+    throw new Error(
+      `Unsupported notification destination "${provider}". Use email: or slack:.`
+    );
+  }
+  const member = /^member:([UW][A-Z0-9]{8,})$/i.exec(slack);
+  if (member?.[1]) {
+    return { kind: "slack", memberId: member[1].toUpperCase() };
+  }
+  if (slack.toLowerCase().startsWith("member:")) {
+    throw new Error(
+      "Slack member IDs must look like slack:member:U0123456789."
+    );
+  }
+  if (!slack.replace(/^#/, "").trim()) {
+    throw new Error("Use --to slack:#channel.");
+  }
+  return { kind: "slack", channel: slack };
+}
+function notificationObjectKey(kind) {
+  return `${kind}.${globalThis.crypto.randomUUID()}`;
+}
 var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
@@ -5052,6 +5155,10 @@ var DeeplineClient = class {
       audit: (options2) => this.auditMonitors(options2),
       repair: (options2) => this.repairMonitors(options2),
       health: (options2) => this.readMonitorsHealth(options2),
+      batch: {
+        submit: (options2) => this.submitMonitorBatch(options2),
+        get: (operationId, options2) => this.getMonitorBatch(operationId, options2)
+      },
       fleets: {
         sync: (definitionOrId, options2) => this.syncMonitorFleet(definitionOrId, options2),
         get: (fleetId, options2) => fleetId === void 0 ? this.listMonitorFleets() : this.getMonitorFleet(fleetId, options2),
@@ -5184,6 +5291,16 @@ var DeeplineClient = class {
       (secret) => secret.name === normalized && secret.status === "active" && secret.hasValue
     ) ?? null;
   }
+  /** Check effective scope and active-version health without reading the value.
+   * Without playName, checks the organization-scoped secret only. With a Play
+   * name, an active Play secret takes precedence; a deleted/disabled Play
+   * secret falls back to the organization-scoped secret.
+   */
+  async inspectSecret(name, options = {}) {
+    const params = new URLSearchParams({ name: name.trim().toUpperCase() });
+    if (options.playName !== void 0) params.set("play", options.playName);
+    return this.http.get(`/api/v2/secrets?${params.toString()}`);
+  }
   // ——————————————————————————————————————————————————————————
   // Tools
   // ——————————————————————————————————————————————————————————
@@ -5275,6 +5392,10 @@ var DeeplineClient = class {
       `/api/v2/integrations/${encodeURIComponent(toolId)}/get`,
       {
         method: "GET",
+        // Tool metadata is a read-only catalog lookup. Keep the metadata
+        // header while opting into the same transient edge-response retries as
+        // other GET catalog methods such as searchTools().
+        retryApiErrors: true,
         headers: {
           "x-deepline-tool-meta-only": "1"
         }
@@ -6730,6 +6851,197 @@ var DeeplineClient = class {
   async getNotifications() {
     return this.http.get("/api/v2/notifications");
   }
+  /** Read the group-based product-notification configuration and rule catalog. */
+  async getNotificationConfiguration() {
+    return this.http.get("/api/v2/notifications/configuration");
+  }
+  /** Atomically apply one retry-safe desired configuration change. */
+  async changeNotificationConfiguration(expectedWorkspaceVersion, change) {
+    return this.http.put("/api/v2/notifications/configuration", {
+      expectedWorkspaceVersion,
+      change
+    });
+  }
+  /** Create one notification group and its destinations as a retry-safe unit. */
+  async createNotificationGroup(input2) {
+    const name = input2.name.trim().replace(/\s+/g, " ");
+    if (!name) throw new Error("Notification group name is required.");
+    if (input2.targets.length < 1 || input2.targets.length > MAX_NOTIFICATION_GROUP_CREATE_TARGETS) {
+      throw new Error(
+        `Choose between 1 and ${MAX_NOTIFICATION_GROUP_CREATE_TARGETS} notification targets.`
+      );
+    }
+    const targets = input2.targets.map(parseNotificationGroupTarget);
+    const legacyEvents = input2.legacyEvents ?? [];
+    const legacyTarget = targets.length === 1 && targets[0]?.kind === "slack" && legacyEvents.length > 0 ? targets[0] : null;
+    if (legacyEvents.length > 0 && !legacyTarget) {
+      throw new Error(
+        "--for is supported only by the legacy one-Slack-target form. Create the group first, then add rules in notification configuration."
+      );
+    }
+    if (!legacyTarget && name.toLowerCase() === "default") {
+      throw new Error(
+        "Default is reserved for the workspace default notification group."
+      );
+    }
+    const normalizedTargets = targets.map(
+      (target) => target.kind === "email" ? `email:${target.email}` : "memberId" in target ? `slack:member:${target.memberId}` : `slack:${target.channel}`
+    );
+    if (input2.dryRun) {
+      return {
+        mode: "dry_run",
+        compatibilityMode: legacyTarget !== null,
+        name: legacyTarget ? input2.name : name,
+        targets: normalizedTargets,
+        legacyEvents
+      };
+    }
+    if (legacyTarget) {
+      const notification = await this.createNotification({
+        name: input2.name,
+        provider: "slack",
+        ..."channel" in legacyTarget ? { channel: legacyTarget.channel } : { memberId: legacyTarget.memberId },
+        eventTypes: legacyEvents
+      });
+      return { mode: "legacy", notification };
+    }
+    const current = await this.getNotificationConfiguration();
+    const existingGroup = current.configuration.groups.find(
+      (candidate) => candidate.name.toLowerCase() === name.toLowerCase()
+    );
+    const groupKey = existingGroup?.groupKey ?? notificationObjectKey("group");
+    const group = existingGroup ?? {
+      groupKey,
+      name,
+      enabled: true,
+      deliveryTiming: { mode: "immediate" },
+      source: "workspace",
+      configMode: "custom",
+      version: 0
+    };
+    const destinations = current.configuration.destinations.filter(
+      (destination) => destination.groupKey === groupKey
+    );
+    const emails = [
+      ...new Set(
+        targets.flatMap(
+          (target) => target.kind === "email" ? [target.email] : []
+        )
+      )
+    ].sort();
+    const existingEmails = new Set(
+      destinations.flatMap(
+        (destination) => destination.settings.kind === "email_addresses" ? destination.settings.to : []
+      )
+    );
+    const newEmails = emails.filter((email) => !existingEmails.has(email));
+    if (newEmails.length > 0) {
+      destinations.push({
+        destinationKey: notificationObjectKey("destination"),
+        groupKey,
+        name: "Email recipients",
+        enabled: true,
+        source: "workspace",
+        configMode: "custom",
+        version: 0,
+        status: "active",
+        settings: { kind: "email_addresses", to: newEmails }
+      });
+    }
+    const slackTargets = /* @__PURE__ */ new Map();
+    for (const target of targets) {
+      if (target.kind !== "slack") continue;
+      const targetKey = "memberId" in target ? `member:${target.memberId}` : `channel:${target.channel.replace(/^#/, "").toLowerCase()}`;
+      slackTargets.set(targetKey, target);
+    }
+    const connectionId = current.slackConnection.connectionId;
+    if (slackTargets.size > 0 && !connectionId) {
+      throw new Error(
+        "Slack is not connected to this workspace. Connect it in Dashboard \u2192 Integrations, then retry."
+      );
+    }
+    const resolvedSlackTargets = await Promise.all(
+      [...slackTargets.values()].map(async (target) => {
+        if ("memberId" in target) {
+          return {
+            targetKind: "member",
+            targetId: target.memberId,
+            targetName: target.memberId
+          };
+        }
+        const channel = target.channel;
+        const requested = channel.replace(/^#/, "");
+        const response = await this.listNotificationChannels(channel);
+        const matches = response.channels.filter(
+          (candidate) => candidate.id === requested || candidate.name.toLowerCase() === requested.toLowerCase()
+        );
+        if (matches.length !== 1) {
+          throw new Error(
+            matches.length === 0 ? `Slack channel ${channel} was not found or is not visible to the Deepline app.` : `Slack channel ${channel} is ambiguous. Use its channel ID.`
+          );
+        }
+        return {
+          targetKind: "channel",
+          targetId: matches[0].id,
+          targetName: matches[0].name
+        };
+      })
+    );
+    const uniqueSlackTargets = new Map(
+      resolvedSlackTargets.map((target) => [
+        `${target.targetKind}:${target.targetId}`,
+        target
+      ])
+    );
+    for (const target of uniqueSlackTargets.values()) {
+      if (destinations.some(
+        (destination) => destination.settings.kind === "slack" && destination.settings.targetKind === target.targetKind && destination.settings.targetId === target.targetId
+      )) {
+        continue;
+      }
+      destinations.push({
+        destinationKey: notificationObjectKey("destination"),
+        groupKey,
+        name: `${target.targetKind === "channel" ? "#" : "@"}${target.targetName}`,
+        enabled: true,
+        source: "workspace",
+        configMode: "custom",
+        version: 0,
+        status: "pending_verification",
+        settings: {
+          kind: "slack",
+          ...target,
+          oauthConnectionId: connectionId
+        }
+      });
+    }
+    const draft = {
+      group,
+      destinations,
+      rules: current.configuration.rules.filter(
+        (rule) => rule.groupKey === groupKey
+      )
+    };
+    const result = await this.changeNotificationConfiguration(
+      current.configuration.workspaceVersion,
+      { kind: "save_group", draft }
+    );
+    const storedGroup = result.configuration.groups.find(
+      (candidate) => candidate.groupKey === groupKey
+    );
+    if (!storedGroup) {
+      throw new Error("Notification group creation returned no saved group.");
+    }
+    return {
+      mode: "native",
+      groupKey,
+      targets: normalizedTargets,
+      group: storedGroup,
+      destinations: result.configuration.destinations.filter(
+        (destination) => destination.groupKey === groupKey
+      )
+    };
+  }
   /** List Slack channels available to an already-connected Slack integration. */
   async listNotificationChannels(query) {
     const suffix = query ? `?search=${encodeURIComponent(query)}` : "";
@@ -7274,6 +7586,78 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
+  /** Submit durable monitor work; transport retries use the same idempotency key. */
+  async submitMonitorBatch(options) {
+    const idempotencyKey = options.idempotencyKey.trim();
+    if (!idempotencyKey) {
+      throw new DeeplineError(
+        "Monitor batch idempotencyKey is required.",
+        void 0,
+        "INVALID_MONITOR_BATCH_IDEMPOTENCY_KEY"
+      );
+    }
+    if (options.kind === "deploy") {
+      if (!options.manifestNdjson.trim()) {
+        throw new DeeplineError(
+          "Monitor batch deploy requires a non-empty NDJSON manifest.",
+          void 0,
+          "INVALID_MONITOR_BATCH_MANIFEST"
+        );
+      }
+      return this.http.request(
+        "/api/v2/monitors/batch",
+        {
+          method: "POST",
+          body: {
+            kind: "deploy",
+            manifest_ndjson: options.manifestNdjson,
+            dry_run: options.dryRun === true,
+            idempotency_key: idempotencyKey
+          },
+          headers: { "Idempotency-Key": idempotencyKey },
+          maxRetries: 0,
+          exactUrlOnly: true
+        }
+      );
+    }
+    const scope = options.scope.kind === "keys" ? { kind: "keys", monitor_keys: options.scope.monitorKeys } : options.scope.kind === "fleet" ? { kind: "fleet", fleet_id: options.scope.fleetId } : { kind: "target", target: options.scope.target };
+    return this.http.request(
+      "/api/v2/monitors/batch",
+      {
+        method: "POST",
+        body: {
+          kind: options.kind,
+          scope,
+          dry_run: options.dryRun === true,
+          idempotency_key: idempotencyKey,
+          ...options.deactivationReason === void 0 ? {} : { deactivation_reason: options.deactivationReason }
+        },
+        headers: { "Idempotency-Key": idempotencyKey },
+        // Durable submission is itself idempotent, but an ambiguous local retry
+        // must retain the exact key and never turn a CLI attempt into two runs.
+        maxRetries: 0,
+        exactUrlOnly: true
+      }
+    );
+  }
+  /** Get durable batch progress and a bounded retained evidence page. */
+  async getMonitorBatch(operationId, options) {
+    const runId = operationId.trim();
+    if (!runId) {
+      throw new DeeplineError(
+        "Monitor batch operation id is required.",
+        void 0,
+        "INVALID_MONITOR_BATCH_OPERATION_ID"
+      );
+    }
+    const params = new URLSearchParams();
+    if (options?.cursor) params.set("cursor", options.cursor);
+    const suffix = params.size > 0 ? `?${params}` : "";
+    return this.http.request(
+      `/api/v2/monitors/batch/${encodeURIComponent(runId)}${suffix}`,
+      { method: "GET" }
+    );
+  }
   /**
    * The deployable monitor tools catalog. Pass a tool id (positional or
    * `{ tool }`) to describe one tool's full payload/stream contract, or no tool
@@ -8591,7 +8975,9 @@ function saveEnvValues(values, baseUrl, scope) {
     ...values[HOST_URL_ENV] ? { [HOST_URL_ENV]: values[HOST_URL_ENV] } : {},
     ...values[API_KEY_ENV] ? { [API_KEY_ENV]: values[API_KEY_ENV] } : {},
     ...values[ACTIVE_ORG_ID_ENV] ? { [ACTIVE_ORG_ID_ENV]: values[ACTIVE_ORG_ID_ENV] } : {},
-    ...Object.prototype.hasOwnProperty.call(values, ACTIVE_ORG_NAME_ENV) ? { [ACTIVE_ORG_NAME_ENV]: values[ACTIVE_ORG_NAME_ENV] } : {}
+    ...Object.prototype.hasOwnProperty.call(values, ACTIVE_ORG_NAME_ENV) ? { [ACTIVE_ORG_NAME_ENV]: values[ACTIVE_ORG_NAME_ENV] } : {},
+    // An explicit empty list must reach the store: it clears a stale line.
+    ...Object.prototype.hasOwnProperty.call(values, FEATURES_ENV) ? { [FEATURES_ENV]: values[FEATURES_ENV] } : {}
   };
   if (scope === "folder") {
     saveProjectDeeplineEnvValues(filtered);
@@ -8605,7 +8991,8 @@ function activeOrgEnvValues(data) {
   const orgName = typeof data.org_name === "string" ? data.org_name.trim() : "";
   return {
     [ACTIVE_ORG_ID_ENV]: orgId,
-    [ACTIVE_ORG_NAME_ENV]: orgName
+    [ACTIVE_ORG_NAME_ENV]: orgName,
+    ...featureEnvValues(data)
   };
 }
 async function httpJson(method, url, apiKey, body, timeoutMs = AUTH_HTTP_TIMEOUT_MS) {
@@ -9130,6 +9517,8 @@ async function handleStatus(args) {
         savedApiKeyPath = envFilePath(baseUrl);
       }
     }
+  } else if (resolvedAuthScope === "folder" || storedHostApiKey(baseUrl) === apiKey) {
+    saveEnvValues(featureEnvValues(data), baseUrl, resolvedAuthScope);
   }
   printCommandEnvelope(
     {
@@ -10334,12 +10723,12 @@ async function handleBuyCredits(creditsRaw, options) {
   );
 }
 async function handleTargetPlan(planSku, options) {
-  if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "team-v1") {
+  if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "growth-v1" && planSku !== "growth-canary-v1" && planSku !== "team-v1") {
     reportBillingFailure(
       {
         exitCode: 2,
         code: "INVALID_PLAN",
-        message: "Plan must be payg-v1, builder-v1, or team-v1."
+        message: "Plan must be payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1."
       },
       options
     );
@@ -10600,7 +10989,7 @@ Examples:
       "Disable automatic recharge without clearing saved amounts."
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeOff)
   );
-  billing.command("change-plan").description("Start or change the target billing plan.").argument("<plan_sku>", "payg-v1, builder-v1, or team-v1").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
+  billing.command("change-plan").description("Start or change the target billing plan.").argument("<plan_sku>", "payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
   billing.command("cancel-plan").description("Cancel a target subscription at period end, or undo it.").option("--undo", "Undo a pending period-end cancellation").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlanCancellation);
   billing.command("portal").description("Open the Stripe-hosted billing recovery portal.").option("--no-open", "Print the URL without opening a browser").option("--json", "Emit JSON output").action(handleTargetPortal);
   billing.command("plans").description("Show published plans and the plan you are on.").addHelpText(
@@ -10894,6 +11283,12 @@ function mergeCanonicalRowsInfo(left, right) {
   const exportUnavailableReason = left.exportUnavailableReason === "shared_table_namespace" || right.exportUnavailableReason === "shared_table_namespace" ? "shared_table_namespace" : left.exportUnavailableReason ?? right.exportUnavailableReason;
   const unavailableSource = left.exportUnavailableReason === exportUnavailableReason ? left : right.exportUnavailableReason === exportUnavailableReason ? right : null;
   const columns = preferred.columns.length > 0 ? preferred.columns : fallback.columns;
+  const recoveredReturnPaths2 = [
+    .../* @__PURE__ */ new Set([
+      ...left.recoveredReturnPaths ?? [],
+      ...right.recoveredReturnPaths ?? []
+    ])
+  ];
   return {
     ...fallback,
     ...preferred,
@@ -10906,6 +11301,7 @@ function mergeCanonicalRowsInfo(left, right) {
     datasetId: preferred.datasetId ?? fallback.datasetId,
     tableNamespace: preferred.tableNamespace ?? fallback.tableNamespace,
     ...left.recovered || right.recovered ? { recovered: true } : {},
+    ...recoveredReturnPaths2.length ? { recoveredReturnPaths: recoveredReturnPaths2 } : {},
     ...exportUnavailableReason ? {
       exportUnavailableReason,
       ...unavailableSource?.exportUnavailableMessage ? {
@@ -10966,6 +11362,16 @@ function isSerializedDataset(value) {
 function isPackagedDatasetOutput(value) {
   return isRecord8(value) && value.kind === "dataset" && isRecord8(value.preview) && Array.isArray(value.preview.rows);
 }
+function recoveredReturnPaths(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.filter(
+        (path) => typeof path === "string" && /^result\.[A-Za-z_$][A-Za-z0-9_$]*$/.test(path)
+      ).slice(0, 200)
+    )
+  ];
+}
 function pathParts(path) {
   return path.split(".").map((part) => part.trim()).filter(Boolean);
 }
@@ -11062,6 +11468,11 @@ function canonicalRowsInfoFromCandidate(input2) {
       datasetId: typeof candidate.value.datasetId === "string" ? candidate.value.datasetId : null,
       tableNamespace: typeof candidate.value.tableNamespace === "string" ? candidate.value.tableNamespace : null,
       ...candidate.value.recovered === true ? { recovered: true } : {},
+      ...recoveredReturnPaths(candidate.value.recoveredReturnPaths).length ? {
+        recoveredReturnPaths: recoveredReturnPaths(
+          candidate.value.recoveredReturnPaths
+        )
+      } : {},
       ...isRecord8(candidate.value.exportUnavailable) && (candidate.value.exportUnavailable.reason === "empty_dataset" || candidate.value.exportUnavailable.reason === "shared_table_namespace") ? {
         exportUnavailableReason: candidate.value.exportUnavailable.reason,
         ...typeof candidate.value.exportUnavailable.message === "string" ? {
@@ -15217,6 +15628,82 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "Unsupported legacy child-workflow timeout.",
     errorMessage: "ctx.runPlay timeoutMs is unsupported because child Plays execute inline."
   },
+  "ctx.runPlayAsync.key": {
+    schema: Type.String({ minLength: 1 }),
+    fixtures: {
+      valid: "request-approval",
+      invalid: "",
+      absent: void 0,
+      unresolved: { expression: "callKey" },
+      edition1: "request-approval"
+    },
+    referenceType: "string",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Stable identity for one independent child Play Run.",
+    errorMessage: "ctx.runPlayAsync key must be a non-empty string."
+  },
+  "ctx.runPlayAsync.playRef": {
+    schema: Type.Union([
+      Type.String({ minLength: 1 }),
+      Type.Union([
+        Type.Object(
+          { playName: Type.String({ minLength: 1 }) },
+          { additionalProperties: true }
+        ),
+        Type.Object(
+          { name: Type.String({ minLength: 1 }) },
+          { additionalProperties: true }
+        )
+      ])
+    ]),
+    fixtures: {
+      valid: "request-approval",
+      invalid: {},
+      absent: void 0,
+      unresolved: { expression: "playRef" },
+      edition1: "request-approval"
+    },
+    referenceType: "string | PlayReferenceLike",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Independently published scalar child Play name or strongly typed definition handle.",
+    errorMessage: "ctx.runPlayAsync playRef must be a non-empty Play name or definition handle."
+  },
+  "ctx.runPlayAsync.input": {
+    schema: Type.Record(Type.String(), Type.Unknown()),
+    fixtures: {
+      valid: { draftId: "draft-1" },
+      invalid: "draft-1",
+      absent: void 0,
+      unresolved: "childInput",
+      edition1: {}
+    },
+    referenceType: "Record<string, unknown>",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Scalar input object submitted to the independent child Run.",
+    errorMessage: "ctx.runPlayAsync input must be an object."
+  },
+  "ctx.runPlayAsync.options.description": {
+    schema: Type.String({ minLength: 1 }),
+    fixtures: {
+      valid: "Request approval.",
+      invalid: "",
+      absent: void 0,
+      unresolved: { expression: "description" },
+      edition1: "Request approval."
+    },
+    referenceType: "string",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Non-empty purpose for one independent child Play Run.",
+    errorMessage: "ctx.runPlayAsync options.description must be non-empty."
+  },
   "runtime.timeout": {
     schema: Type.String({ pattern: "^\\d+\\s*[mh]$" }),
     fixtures: {
@@ -15504,6 +15991,10 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `export type CsvOptions = { description?: ${cloudReferenceType("ctx.csv.options.description")}; columns?: ${cloudReferenceType("ctx.csv.options.columns")}; rename?: ${cloudReferenceType("ctx.csv.options.rename")}; required?: ${cloudReferenceType("ctx.csv.options.required")} };`,
   "export type PlayCallExecution = 'inline';",
   `export type PlayCallOptions = { description: ${cloudReferenceType("ctx.runPlay.options.description")}; execution?: ${cloudReferenceType("ctx.runPlay.options.execution")}; timeoutMs?: ${cloudReferenceType("ctx.runPlay.options.timeoutMs")} };`,
+  `export type PlayAsyncCallOptions = { description: ${cloudReferenceType("ctx.runPlayAsync.options.description")} };`,
+  "declare const PLAY_RUN_ID_BRAND: unique symbol;",
+  "export type PlayRunId = string & { readonly [PLAY_RUN_ID_BRAND]: 'PlayRunId' };",
+  "export type AsyncPlayRunRef = Readonly<{ runId: PlayRunId }>;",
   `export type RuntimeStepOptions = { semanticKey?: ${cloudReferenceType("ctx.step.semanticKey")}; staleAfterSeconds?: ${cloudReferenceType("ctx.step.staleAfterSeconds")} };`,
   `export type FetchOptions = { staleAfterSeconds?: ${cloudReferenceType("ctx.fetch.staleAfterSeconds")}; transient?: boolean };`,
   "export type PlayFetchResponse = { ok: boolean; status: number; statusText: string; url: string; headers: Record<string, string>; bodyText: string; json: unknown | null };",
@@ -15529,11 +16020,11 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  withColumn<Name extends string, Value>(name: Name, definition: DatasetColumnDefinition<OutputRow, Value> & { readonly runIf: (row: OutputRow, index: number) => boolean | Promise<boolean> }): DatasetBuilder<InputRow, OutputRow & Record<Name, Value | null>>;",
   "  withColumn<Name extends string, Value>(name: Name, definition: DatasetColumnDefinition<OutputRow, Value>): DatasetBuilder<InputRow, OutputRow & Record<Name, Value>>;",
   "  withColumn<Name extends string, Value>(name: Name, resolver: StepResolver<OutputRow, Value> | RunnableColumnStepProgram<Value>, options: StepOptions<OutputRow, Value>): DatasetBuilder<InputRow, OutputRow & Record<Name, Value | null>>;",
-  "  withColumns<Program extends StepProgram<OutputRow, object, unknown>>(program: Program): DatasetBuilder<InputRow, StepProgramOutput<Program>>;",
+  "  withColumns<ProgramOutput extends OutputRow, Return>(program: StepProgram<OutputRow, ProgramOutput, Return>): DatasetBuilder<InputRow, ProgramOutput>;",
   "  step<Name extends string, Value>(name: Name, resolver: ColumnResolver<OutputRow, Value>): never;",
   "  run(options?: DatasetRunOptions<InputRow>): Promise<PlayDataset<OutputRow>>;",
   "};",
-  "export type PlayReferenceLike = { readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string };",
+  "export type PlayReferenceLike<TInput extends Record<string, unknown> = Record<string, unknown>> = ({ readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string }) & { readonly __inputType?: TInput };",
   "export interface DeeplinePlayRuntimeContext {",
   "  csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;",
   "  dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;",
@@ -15547,6 +16038,8 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
+  "  runPlayAsync<TInput extends Record<string, unknown>>(key: string, playRef: PlayReferenceLike<TInput>, input: NoInfer<TInput>, options: PlayAsyncCallOptions): Promise<AsyncPlayRunRef>;",
+  "  runPlayAsync(key: string, playRef: string, input: Record<string, unknown>, options: PlayAsyncCallOptions): Promise<AsyncPlayRunRef>;",
   "  log(message: string, options?: { level?: 'debug' | 'info' | 'warn' | 'error' }): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
   "}",
@@ -15821,7 +16314,7 @@ function collectInlineSecretFindings(sourceCode) {
 var MAX_PLAY_BUNDLE_BYTES = 30 * 1024 * 1024;
 
 // ../plays/bundling/index.ts
-var PLAY_BUNDLE_CACHE_VERSION = 36;
+var PLAY_BUNDLE_CACHE_VERSION = 37;
 var PLAY_ARTIFACT_CACHE_DIR = join7(
   tmpdir2(),
   `deepline-play-artifacts-v${PLAY_BUNDLE_CACHE_VERSION}`
@@ -16560,7 +17053,7 @@ var RunDataset = class _RunDataset {
     return this.#info.exportUnavailableMessage;
   }
   matches(path) {
-    return this.source === path || this.datasetId === path || this.tableNamespace === path;
+    return this.source === path || this.datasetId === path || this.tableNamespace === path || this.#info.recoveredReturnPaths?.includes(path) === true;
   }
   /** Return a new Handle when its preview has been replaced by fetched rows. */
   withRows(info) {
@@ -17405,6 +17898,39 @@ var PLAY_RUN_RESERVED_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "--open",
   "--debug-map-latency"
 ]);
+var PLAY_RUN_HEADER_FLAG_USAGE = `--header requires "<name>: <value>", for example: --header 'x-deepline-absurd-release: 2026-09-07.1'`;
+var HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+function parsePlayRunHeaderFlag(raw) {
+  const separator = raw.indexOf(":");
+  if (separator < 0) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Got ${JSON.stringify(raw)} with no ":" separator.`
+    );
+  }
+  const name = raw.slice(0, separator).trim().toLowerCase();
+  const value = raw.slice(separator + 1).trim();
+  if (!name) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Got ${JSON.stringify(raw)} with an empty header name.`
+    );
+  }
+  if (!HTTP_HEADER_NAME_PATTERN.test(name)) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. ${JSON.stringify(name)} is not a valid HTTP header name.`
+    );
+  }
+  if (!value) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Header ${JSON.stringify(name)} was given an empty value.`
+    );
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Header ${JSON.stringify(name)} contains a control character.`
+    );
+  }
+  return { name, value };
+}
 function isBarePlayRunDebugFlag(args, index) {
   return args[index] === "--debug" && (args[index + 1] === void 0 || args[index + 1].startsWith("--"));
 }
@@ -19018,6 +19544,9 @@ function assertPlayWaitNotTimedOut(input2) {
   }
 }
 var PLAY_DURABLE_STATUS_PROBE_INTERVAL_MS = 15e3;
+function isAdmittedRunVisibilityDelay(error) {
+  return error instanceof DeeplineError && error.statusCode === 404 && error.message.trim() === "Workflow run not found.";
+}
 async function waitForPlayCompletionByStream(input2) {
   let lastPhase = null;
   let reconnectAttempt = 0;
@@ -19031,7 +19560,7 @@ async function waitForPlayCompletionByStream(input2) {
         billing: false
       });
     } catch (error) {
-      if (isTransientPlayStreamError(error)) {
+      if (isTransientPlayStreamError(error) || isAdmittedRunVisibilityDelay(error)) {
         return null;
       }
       throw error;
@@ -19142,7 +19671,7 @@ async function waitForPlayCompletionByStream(input2) {
       if (timedOut) {
         return { kind: "timed_out", sawEvent };
       }
-      if (!isTransientPlayStreamError(error)) {
+      if (!isTransientPlayStreamError(error) && !isAdmittedRunVisibilityDelay(error)) {
         throw error;
       }
       return {
@@ -21378,7 +21907,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--json] [--full] [--<input> value]\n       Runs use the Absurd CJS runtime.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--json] [--full] [--<input> value]\n       Runs use the Absurd CJS runtime.\n       --header '<name>: <value>' may repeat; each is sent on every request for this run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -21399,8 +21928,20 @@ function parsePlayRunOptions(args) {
   let profile = null;
   let fixtureBehavior = null;
   let runIdFile = null;
+  let headers = null;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
+    if (arg === "--header" || arg.startsWith("--header=")) {
+      const raw = arg === "--header" ? args[index + 1] : arg.slice("--header=".length);
+      if (raw === void 0 || arg === "--header" && raw.startsWith("--")) {
+        throw new Error(`${PLAY_RUN_HEADER_FLAG_USAGE}. No value was given.`);
+      }
+      const header = parsePlayRunHeaderFlag(raw);
+      headers ??= {};
+      headers[header.name] = header.value;
+      if (arg === "--header") index += 1;
+      continue;
+    }
     if (arg === "--file" && args[index + 1]) {
       filePath = args[++index];
       continue;
@@ -21639,7 +22180,8 @@ function parsePlayRunOptions(args) {
     profile,
     debugMapLatency,
     fixtureBehavior,
-    runIdFile
+    runIdFile,
+    headers
   };
 }
 function parsePlayCheckOptions(args) {
@@ -22395,11 +22937,14 @@ function printPlayCheckOutcomes(outcomes, target) {
     printPlayCheckOutcome(outcome, target, `[${outcome.exportName}] `);
   }
 }
+function playRunClientOptions(options) {
+  return options.headers ? { headers: options.headers } : void 0;
+}
 async function handleFileBackedRun(options, hooks) {
   if (options.target.kind !== "file") {
     throw new Error("Expected a file-backed play run target.");
   }
-  const client2 = new DeeplineClient();
+  const client2 = new DeeplineClient(playRunClientOptions(options));
   const progress = getActiveCliProgress() ?? createCliProgress(!options.jsonOutput);
   const absolutePlayPath = resolve11(options.target.path);
   progress.phase("compiling play");
@@ -22607,7 +23152,7 @@ async function handleNamedRun(options, hooks) {
   if (options.target.kind !== "name") {
     throw new Error("Expected a named play run target.");
   }
-  const client2 = new DeeplineClient();
+  const client2 = new DeeplineClient(playRunClientOptions(options));
   const progress = getActiveCliProgress() ?? createCliProgress(!options.jsonOutput);
   const playName = options.target.name;
   const runtimeInput = options.input ? { ...options.input } : {};
@@ -32702,7 +33247,7 @@ function renderDeployedListText(payload, requestedStatus) {
   }
   const applied = asString(payload.status_filter_applied) ?? requestedStatus ?? "active";
   lines.push(
-    `Status filter: ${applied}${requestedStatus === void 0 && applied === "active" ? " (default)" : ""} \u2014 use --status all to include disabled monitors.`
+    `Status filter: ${applied}${requestedStatus === void 0 && applied === "active" ? " (default)" : ""} \u2014 use --status all to include inactive monitors.`
   );
   const summary = Array.isArray(payload.status_summary) ? payload.status_summary.flatMap((raw) => {
     const item = asRecord2(raw);
@@ -32710,7 +33255,7 @@ function renderDeployedListText(payload, requestedStatus) {
     const count = item ? asFiniteNumber(item.count) : void 0;
     return status && count !== void 0 ? [`${status}: ${count}`] : [];
   }).join("  ") : "";
-  if (summary) lines.push(`All lifecycle states: ${summary}`);
+  if (summary) lines.push(`All monitor states: ${summary}`);
   if (payload.has_more === true || payload.is_truncated === true) {
     const nextCursor = asString(payload.next_cursor);
     lines.push(
@@ -33799,6 +34344,9 @@ async function handleMonitorsReactivate(key, options) {
 }
 var MONITOR_VERB_POLL_INTERVAL_MS = 2e3;
 function monitorHealthLine(health) {
+  if (health.refresh?.state === "running") {
+    return `refreshing whole scope \xB7 scanned ${health.scanned} so far`;
+  }
   return [
     `converged ${health.converged}/${health.scanned}`,
     `needs_repair ${health.needs_repair}`,
@@ -33837,7 +34385,9 @@ async function watchMonitorHealth(input2) {
   let last = await input2.client.monitors.health(scope);
   input2.onProgress(last);
   while (Date.now() < deadlineAt) {
-    if (last.needs_repair === 0 && last.observed.unknown === 0) return last;
+    if (last.refresh?.state !== "running" && last.needs_repair === 0 && last.observed.unknown === 0) {
+      return last;
+    }
     await new Promise(
       (resolve21) => setTimeout(resolve21, MONITOR_VERB_POLL_INTERVAL_MS)
     );
@@ -33847,11 +34397,21 @@ async function watchMonitorHealth(input2) {
   return last;
 }
 function monitorHealthText(health) {
-  const partial = health.truncated ? " (partial \u2014 scope larger than one read)" : "";
+  const partial = health.refresh?.state === "running" ? " (refreshing \u2014 counts below are not final)" : health.truncated ? " (partial \u2014 scope larger than one read)" : "";
   const lines = [
     `scope: ${health.scope.fleet_id ?? "workspace"}${partial}`,
     monitorHealthLine(health)
   ];
+  if ((health.batch_operations?.length ?? 0) > 0) {
+    lines.push("");
+    lines.push("batch work in progress:");
+    for (const operation of health.batch_operations ?? []) {
+      const retry = operation.next_attempt_at === void 0 ? "" : ` \xB7 next ${new Date(operation.next_attempt_at).toISOString()}`;
+      lines.push(
+        `  ${operation.kind} ${operation.run_id} \xB7 ${operation.state}${retry}`
+      );
+    }
+  }
   if (health.deactivation_reasons.length > 0) {
     lines.push("");
     lines.push("deactivated by Deepline:");
@@ -33924,78 +34484,143 @@ async function handleMonitorsAudit(options) {
   );
 }
 async function handleMonitorsRepair(options) {
-  const client2 = new DeeplineClient();
+  return await handleMonitorBatch("repair", {
+    ...options,
+    ...options.fleet?.trim() ? {} : { target: "needs-repair" }
+  });
+}
+async function handleMonitorsHealth(options) {
   const fleetId = options.fleet?.trim() || void 0;
-  const scope = fleetId ? { fleetId } : {};
-  const result = await client2.monitors.repair({
-    ...scope,
-    ...options.dryRun ? { dryRun: true } : {}
+  const health = await new DeeplineClient().monitors.health(
+    fleetId ? { fleetId } : {}
+  );
+  printCommandEnvelope(health, {
+    json: options.json,
+    text: monitorHealthText(health)
   });
-  if (options.dryRun) {
-    assertMonitorDryRunAcknowledged(
-      result,
-      { command: "monitors repair", mutation: "repair" }
+}
+function monitorBatchScope(options, kind) {
+  const selectors = [
+    options.target ? "target" : null,
+    options.fleet?.trim() ? "fleet" : null,
+    options.keys?.trim() ? "keys" : null
+  ].filter((value) => value !== null);
+  if (selectors.length === 0 && kind === "audit") {
+    return { kind: "target", target: "all" };
+  }
+  if (selectors.length !== 1) {
+    throw new MonitorsUsageError(
+      `monitors batch ${kind} needs exactly one selector: --target, --fleet, or --keys.`
     );
   }
-  let health = result.health;
-  if (options.watch && !options.dryRun) {
-    const progress = monitorVerbProgressReporter();
-    try {
-      health = await watchMonitorHealth({
-        client: client2,
-        ...scope,
-        timeoutMs: fleetTimeoutMs(options.timeout),
-        onProgress: progress.report
-      });
-    } finally {
-      progress.finish();
-    }
+  if (options.target) return { kind: "target", target: options.target };
+  if (options.fleet?.trim())
+    return { kind: "fleet", fleetId: options.fleet.trim() };
+  const monitorKeys = (options.keys ?? "").split(",").map((key) => key.trim()).filter(Boolean);
+  if (monitorKeys.length === 0) {
+    throw new MonitorsUsageError(
+      "--keys needs one or more comma-separated monitor keys."
+    );
   }
-  const verb = options.dryRun ? "would queue" : "queued";
-  const lines = [
-    `${verb} ${result.repair.queued} of ${result.repair.scanned} monitors`
-  ];
-  for (const item of result.repair.plan.slice(0, REPAIR_PLAN_PREVIEW)) {
-    const why = item.deactivation_reason ? ` \xB7 ${item.deactivation_reason}` : "";
-    lines.push(
-      `  ${item.action.padEnd(6)} ${item.monitor_key}  desired ${item.desired} \xB7 observed ${item.observed}${why}`
+  return { kind: "keys", monitorKeys };
+}
+function monitorBatchIdempotencyKey(kind, value) {
+  return value?.trim() || `monitor-batch-${kind}-${randomUUID5()}`;
+}
+async function handleMonitorBatchDeploy(options) {
+  if (!options.file?.trim()) {
+    throw new MonitorsUsageError(
+      "monitors batch deploy requires --file <monitors.ndjson>."
     );
   }
-  if (result.repair.plan.length > REPAIR_PLAN_PREVIEW) {
-    lines.push(`  \u2026 ${result.repair.plan.length - REPAIR_PLAN_PREVIEW} more`);
+  if (options.dryRun !== true && options.yes !== true) {
+    throw new MonitorsUsageError(
+      "monitors batch deploy changes provider monitors asynchronously. Preview with --dry-run, then confirm with --yes."
+    );
   }
-  if (result.repair.unaudited.length > 0) {
-    lines.push(
-      `${result.repair.unaudited.length} monitors have never been observed \u2014 run 'deepline monitors audit' first.`
+  let manifestNdjson;
+  try {
+    manifestNdjson = readFileSync11(resolve14(options.file), "utf8");
+  } catch (error) {
+    throw new MonitorsUsageError(
+      `Could not read monitor batch manifest '${options.file}': ${error instanceof Error ? error.message : String(error)}`
     );
   }
-  if (result.repair.unowned.length > 0) {
-    lines.push(
-      `${result.repair.unowned.length} monitors disagree but no fleet owns them; repair those with 'deepline monitors deploy' or 'deepline monitors delete'.`
+  if (!manifestNdjson.trim()) {
+    throw new MonitorsUsageError("Monitor batch manifest is empty.");
+  }
+  const idempotencyKey = monitorBatchIdempotencyKey(
+    "deploy",
+    options.idempotencyKey
+  );
+  const result = await new DeeplineClient().monitors.batch.submit({
+    kind: "deploy",
+    manifestNdjson,
+    dryRun: options.dryRun === true,
+    idempotencyKey
+  });
+  const operation = result.operation;
+  printCommandEnvelope(
+    { ...result, idempotency_key: idempotencyKey },
+    {
+      json: options.json,
+      text: [
+        `${result.rejoined ? "rejoined" : "submitted"} deploy batch ${operation.runId}`,
+        `state ${operation.state} \xB7 retry key ${idempotencyKey}`,
+        `inspect: deepline monitors batch get ${operation.runId} --json`
+      ].join("\n") + "\n"
+    }
+  );
+}
+async function handleMonitorBatch(kind, options) {
+  if ((kind === "deactivate" || kind === "reactivate" || kind === "repair") && options.dryRun !== true && options.yes !== true) {
+    throw new MonitorsUsageError(
+      `monitors batch ${kind} changes provider monitors asynchronously. Preview with --dry-run, then confirm with --yes.`
     );
   }
-  if (result.repair.fenced.length > 0) {
-    lines.push(
-      `${result.repair.fenced.length} monitors have a provider operation in flight; Deepline is finishing those and repair left them alone.`
+  if (kind === "deactivate" && !options.reason?.trim()) {
+    throw new MonitorsUsageError(
+      "monitors batch deactivate requires --reason (for example insufficient_balance or billing_failure)."
     );
   }
-  lines.push("");
-  lines.push(monitorHealthText(health));
+  const idempotencyKey = monitorBatchIdempotencyKey(
+    kind,
+    options.idempotencyKey
+  );
+  const result = await new DeeplineClient().monitors.batch.submit({
+    kind,
+    scope: monitorBatchScope(options, kind),
+    dryRun: options.dryRun === true,
+    ...options.reason?.trim() ? { deactivationReason: options.reason.trim() } : {},
+    idempotencyKey
+  });
+  const operation = result.operation;
+  const text = [
+    `${result.rejoined ? "rejoined" : "submitted"} ${operation.kind} batch ${operation.runId}`,
+    `state ${operation.state} \xB7 retry key ${idempotencyKey}`,
+    `inspect: deepline monitors batch get ${operation.runId} --json`
+  ].join("\n");
   printCommandEnvelope(
-    { ...result, health },
-    { json: options.json, text: lines.join("\n") }
+    { ...result, idempotency_key: idempotencyKey },
+    { json: options.json, text: `${text}
+` }
   );
 }
-var REPAIR_PLAN_PREVIEW = 20;
-async function handleMonitorsHealth(options) {
-  const fleetId = options.fleet?.trim() || void 0;
-  const health = await new DeeplineClient().monitors.health(
-    fleetId ? { fleetId } : {}
-  );
-  printCommandEnvelope(health, {
-    json: options.json,
-    text: monitorHealthText(health)
+async function handleMonitorBatchGet(operationId, options) {
+  const result = await new DeeplineClient().monitors.batch.get(operationId, {
+    ...options.cursor ? { cursor: options.cursor } : {}
   });
+  const summary = result.operation.summary ?? {};
+  const text = [
+    `${result.operation.kind} batch ${result.operation.runId}`,
+    `state ${result.operation.state}`,
+    `progress ${JSON.stringify(summary)}`,
+    ...result.results ? [
+      `results ${result.results.page.length}${result.results.isDone ? "" : " (more; pass --cursor)"}`
+    ] : []
+  ].join("\n");
+  printCommandEnvelope(result, { json: options.json, text: `${text}
+` });
 }
 function registerMonitorsCommands(program) {
   const monitors = program.command("monitors").description("Discover, deploy, and manage Deepline monitors.").showSuggestionAfterError(true).addHelpText(
@@ -34060,25 +34685,29 @@ Examples:
   withJsonOption(
     monitors.command("repair").description(
       "Converge the monitors whose desired and observed states disagree."
-    ).option("--fleet <fleet-id>", "Repair one fleet instead of every monitor").option("--dry-run", "Show what would be queued without queueing it").option("--watch", "Keep polling health until the scope settles").option(
-      "--timeout <duration>",
-      "How long --watch waits, e.g. 90s, 5m, 1h (default 10m)"
+    ).option("--fleet <fleet-id>", "Repair one fleet instead of every monitor").option(
+      "--dry-run",
+      "Record the bounded repair plan without provider changes"
+    ).option("--yes", "Confirm the asynchronous provider repair").option(
+      "--idempotency-key <key>",
+      "Stable retry key (generated when omitted)"
     ).addHelpText(
       "after",
       `
 Notes:
-  Queues the monitors that disagree with the provider onto the same convergence
-  loop a fleet sync uses; the provider work happens on Deepline's own schedule.
-  Idempotent \u2014 the queue IS the disagreement, so a repeat run queues only what
-  is still wrong.
+  This is the short spelling of 'monitors batch repair --target needs-repair'.
+  It handles both direct monitors and Fleet members through one durable
+  service-account worker. An active historical monitor without an upstream id
+  is selected for repair; current Convex writes cannot create that state.
 
-  Monitors nobody has observed are never repaired: run 'deepline monitors audit'
-  first. Monitors no fleet owns are reported rather than queued; deploy or delete
-  those directly.
+  It returns a run id immediately. Inspect retained results with
+  'deepline monitors batch get <run-id> --json'. Reuse --idempotency-key after
+  a lost response to rejoin the exact run without another provider request.
 
 Examples:
   deepline monitors repair --dry-run
-  deepline monitors repair --fleet accounts-eu --watch
+  deepline monitors repair --yes
+  deepline monitors repair --fleet accounts-eu --yes --idempotency-key repair-eu-2026-09-09
 `
     )
   ).action(monitorsAction(handleMonitorsRepair));
@@ -34101,6 +34730,75 @@ Examples:
 `
     )
   ).action(monitorsAction(handleMonitorsHealth));
+  const batch = monitors.command("batch").description("Submit or inspect durable bulk monitor operations.");
+  const batchSelectorOptions = (command) => command.option(
+    "--target <target>",
+    "One of: all, all-active, billing-suspended, needs-repair"
+  ).option("--fleet <fleet-id>", "Select one Fleet").option("--keys <keys>", "Up to 100 comma-separated monitor keys").option(
+    "--dry-run",
+    "Record the same bounded plan without provider changes"
+  ).option(
+    "--idempotency-key <key>",
+    "Stable retry key (generated when omitted)"
+  );
+  withJsonOption(
+    batch.command("deploy").description(
+      "Durably create complete NDJSON monitor definitions through provider bulk create."
+    ).requiredOption(
+      "--file <path>",
+      "NDJSON file of complete monitor definitions"
+    ).option("--dry-run", "Validate and record the durable deploy plan").option("--yes", "Confirm asynchronous provider creation").option(
+      "--idempotency-key <key>",
+      "Stable retry key (generated when omitted)"
+    )
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatchDeploy(options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("audit").description("Durably audit a selection; defaults to --target all.")
+    )
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("audit", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("repair").description(
+        "Durably re-audit and converge a selection through the existing lifecycle fences."
+      )
+    ).option("--yes", "Confirm the asynchronous provider repair")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("repair", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("deactivate").description(
+        "Durably deactivate a selection through provider batch deletes."
+      )
+    ).requiredOption("--reason <reason>", "Declared deactivation reason").option("--yes", "Confirm the asynchronous provider deactivation")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("deactivate", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("reactivate").description("Durably reactivate a selection after a suspension.")
+    ).option("--yes", "Confirm provider reactivation and possible billing")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("reactivate", options)
+    )
+  );
+  withJsonOption(
+    batch.command("get <operation-id>").description("Read batch progress and one bounded evidence page.").option("--cursor <cursor>", "Read the next retained evidence page")
+  ).action(monitorsAction(handleMonitorBatchGet));
   withJsonOption(
     monitors.command("status").description("Check whether you have access to Deepline monitors.").addHelpText(
       "after",
@@ -34152,8 +34850,9 @@ Examples:
       "after",
       `
 Notes:
-  Read-only. --status filters by monitor status: active (default), disabled, or
-  all. The output echoes the status filter that was applied. The response reports
+  Read-only. A monitor state is active or inactive; provider disagreement is
+  reported separately by audit/health. The output echoes the state filter that
+  was applied. The response reports
   total (the true registry count, not the page size), returned, has_more, and
   next_cursor. When has_more is true, page with --cursor <next_cursor> until it
   is false \u2014 a "no matching
@@ -34171,7 +34870,7 @@ Examples:
 `
     ).option(
       "--status <status>",
-      "Filter by monitor status: active (default), disabled, or all"
+      "Filter by monitor state: active (default), inactive, or all"
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
@@ -34564,7 +35263,7 @@ Example:
   const deployed = withJsonOption(
     monitors.command("deployed", { hidden: true }).description("Alias of `monitors list` (plus get/update/delete aliases).").option(
       "--status <status>",
-      "Filter by monitor status: active (default), disabled, or all"
+      "Filter by monitor state: active (default), inactive, or all"
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
@@ -34712,7 +35411,8 @@ function organizationAuthValues(input2) {
     [HOST_URL_ENV]: input2.baseUrl,
     [API_KEY_ENV]: input2.apiKey,
     [ACTIVE_ORG_ID_ENV]: input2.orgId,
-    [ACTIVE_ORG_NAME_ENV]: input2.orgName
+    [ACTIVE_ORG_NAME_ENV]: input2.orgName,
+    ...featureEnvValues(input2)
   };
 }
 function organizationCommandContext(input2) {
@@ -34928,6 +35628,7 @@ async function handleOrgSwitch(selection, options) {
   if (!selection && !options.orgId && authScope === "folder" && provenance.scope === "global" && provenance.project.state === "project") {
     const commandContext = resolveCliCommandContext(config);
     const activeOrganization = commandContext.active_organization;
+    const pinnedFeatures = storedHostFeatures(config.baseUrl);
     const project_env_paths2 = saveProjectDeeplineEnvValues(
       {
         [HOST_URL_ENV]: config.baseUrl,
@@ -34935,7 +35636,8 @@ async function handleOrgSwitch(selection, options) {
         ...activeOrganization ? {
           [ACTIVE_ORG_ID_ENV]: activeOrganization.org_id,
           [ACTIVE_ORG_NAME_ENV]: activeOrganization.org_name ?? ""
-        } : {}
+        } : {},
+        ...pinnedFeatures !== void 0 ? { [FEATURES_ENV]: pinnedFeatures } : {}
       },
       provenance.project.dir
     );
@@ -35015,11 +35717,15 @@ async function handleOrgSwitch(selection, options) {
   const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
     let project_env_paths2 = [];
+    const features = await http.post("/api/v2/auth/cli/status", {
+      api_key: config.apiKey
+    }).then((status) => status.features).catch(() => void 0);
     const authValues2 = organizationAuthValues({
       baseUrl: config.baseUrl,
       apiKey: config.apiKey,
       orgId: target.org_id,
-      orgName: target.name
+      orgName: target.name,
+      features
     });
     if (authTarget.kind === "folder") {
       project_env_paths2 = saveProjectDeeplineEnvValues(authValues2);
@@ -35086,7 +35792,8 @@ async function handleOrgSwitch(selection, options) {
     baseUrl: config.baseUrl,
     apiKey: switched.api_key,
     orgId: switched.org_id,
-    orgName: switched.org_name
+    orgName: switched.org_name,
+    features: switched.features
   });
   if (authTarget.kind === "folder") {
     project_env_paths = saveProjectDeeplineEnvValues(authValues);
@@ -35158,14 +35865,20 @@ async function handleOrgCreate(name, options) {
   const identity = await fetchWorkspaceCreationIdentity(http, config.apiKey);
   let created;
   let workspaceApiKey;
+  let workspaceFeatures;
   let pendingIntentPath = null;
   if (!identity.orgId) {
     const firstWorkspace = await http.post("/api/v2/auth/cli/org-create", {
       api_key: config.apiKey,
       name: normalizedName
     });
-    const { api_key: apiKey, ...publicFirstWorkspace } = firstWorkspace;
+    const {
+      api_key: apiKey,
+      features,
+      ...publicFirstWorkspace
+    } = firstWorkspace;
     workspaceApiKey = apiKey;
+    workspaceFeatures = features;
     created = publicFirstWorkspace;
   } else {
     const pending = loadOrCreatePendingOrgCreate({
@@ -35186,6 +35899,7 @@ async function handleOrgCreate(name, options) {
       org_id: workspace.org_id
     });
     workspaceApiKey = switched.api_key;
+    workspaceFeatures = switched.features;
     created = { ...workspace };
     pendingIntentPath = pending.path;
   }
@@ -35193,7 +35907,8 @@ async function handleOrgCreate(name, options) {
     baseUrl: config.baseUrl,
     apiKey: workspaceApiKey,
     orgId: created.org_id,
-    orgName: created.org_name
+    orgName: created.org_name,
+    features: workspaceFeatures
   });
   saveHostEnvValues(config.baseUrl, authValues);
   if (pendingIntentPath) unlinkSync(pendingIntentPath);
@@ -35390,6 +36105,7 @@ Examples:
 }
 
 // src/cli/commands/git.ts
+var GIT_DEPLOY_FEATURE = "github-deploy";
 function renderProject(project) {
   const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
   const flags = [
@@ -35642,7 +36358,7 @@ async function handleDeploymentGet(id, options) {
   );
 }
 function registerGitCommands(program) {
-  const git = program.command("git").alias("projects").description(
+  const git = program.command("git", { hidden: !cliFeatureEnabled(GIT_DEPLOY_FEATURE) }).alias("projects").description(
     "Git deploys: link repositories to this workspace and deploy plays on push."
   ).addHelpText(
     "after",
@@ -35963,18 +36679,25 @@ async function handleList2(options) {
 async function handleCheck(nameInput, options) {
   const name = normalizeSecretName(nameInput);
   const client2 = new DeeplineClient();
-  const secret = await client2.checkSecret(name);
+  const check = options.play !== void 0 ? await client2.inspectSecret(name, { playName: options.play }) : null;
+  const secret = check ? check.secret : await client2.checkSecret(name);
+  const ok = check ? check.ok : Boolean(secret);
+  const quotedPlay = `'${(options.play ?? "PLAY").replace(/'/g, `'"'"'`)}'`;
+  const scopeHint = check ? secret?.scope === "play" ? check.reason === "disabled" ? `The Play-scoped secret is disabled and no active org fallback is available. Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}` : `The active Play-scoped secret takes precedence over the org secret.${ok ? "" : ` Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}`}` : `No Play override.${ok ? " The org secret is available." : ` Set or rotate the org secret with: deepline secrets set ${name}`}` : `Metadata only. Verify effective scope and active version with: deepline secrets check ${name} --play <play-name>`;
   printCommandEnvelope(
     {
-      ok: Boolean(secret),
+      ok,
       name,
       secret: secret ?? null,
+      check: check ? { playName: check.playName, reason: check.reason } : null,
+      scopeHint,
       render: {
         sections: [
           {
             title: "secret check",
             lines: [
-              secret ? `${name}: active \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`
+              check ? `${name}: ${check.reason} for ${check.playName}${secret ? ` (${secret.scope})` : ""}` : secret ? `${name}: active metadata \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`,
+              scopeHint
             ]
           }
         ]
@@ -35982,7 +36705,7 @@ async function handleCheck(nameInput, options) {
     },
     { json: options.json }
   );
-  if (!secret) process.exitCode = 4;
+  if (!ok) process.exitCode = 4;
 }
 async function handleSet2(nameInput, forbidden, options) {
   preventShellHistoryLeak(forbidden);
@@ -36036,6 +36759,7 @@ Notes:
 Examples:
   deepline secrets list
   deepline secrets check HUBSPOT_TOKEN
+  deepline secrets check HUBSPOT_TOKEN --play hubspot-sync
   deepline secrets set HUBSPOT_TOKEN
   printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
   deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
@@ -36045,7 +36769,12 @@ Examples:
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
     await handleList2(options);
   });
-  secrets.command("check").description("Check whether a secret exists and is active.").argument("<name>", "Secret name").option("--json", "Emit JSON output").action(async (name, options) => {
+  secrets.command("check").description(
+    "Check secret metadata, or effective availability with --play."
+  ).argument("<name>", "Secret name").option(
+    "--play <name>",
+    "Validate the effective secret for a bare Play name and active version"
+  ).option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
   secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
@@ -36438,6 +37167,20 @@ function classifyNetworkFailure(error) {
   }
   return "network_error";
 }
+function classifyNetworkCauseCategory(error) {
+  switch (classifyNetworkFailure(error)) {
+    case "network_dns_resolution_failed":
+      return "dns";
+    case "network_ssl_error":
+      return "tls";
+    case "network_connection_reset":
+      return "reset";
+    case "network_timeout":
+      return "connect_timeout";
+    default:
+      return "unknown";
+  }
+}
 function isNetworkFailure(error) {
   if (!(error instanceof Error)) return false;
   if (error instanceof DeeplineError && error.statusCode) return false;
@@ -36607,6 +37350,7 @@ function buildFailureReport(input2) {
   });
   const code = failureCode({ exitCode: input2.exitCode, error: input2.error });
   const errorBody = input2.error === void 0 ? `SDK CLI command exited ${input2.exitCode ?? "unknown"}` : errorMessage3(input2.error);
+  const networkCauseCategory = input2.error !== void 0 && isNetworkFailure(input2.error) ? classifyNetworkCauseCategory(input2.error) : null;
   return {
     command: sanitizeCommand(input2.argv),
     subcommand: subcommandFromArgv(input2.argv),
@@ -36628,7 +37372,8 @@ function buildFailureReport(input2) {
       failure_code: code,
       failure_stage: input2.error === void 0 ? "command_exit" : "cli_main",
       duration_ms: durationMs,
-      ...input2.exitCode !== null ? { exit_code: input2.exitCode } : {}
+      ...input2.exitCode !== null ? { exit_code: input2.exitCode } : {},
+      ...networkCauseCategory ? { network_cause_category: networkCauseCategory } : {}
     }
   };
 }
@@ -38333,6 +39078,9 @@ Examples:
   });
 }
 
+// src/cli/commands/settings.ts
+import { readFileSync as readFileSync20 } from "fs";
+
 // src/cli/update-preferences.ts
 import {
   existsSync as existsSync16,
@@ -40047,21 +40795,104 @@ function displaySlackTarget(target) {
 function collectEvent(value, previous = []) {
   return [...previous, value];
 }
+function collectNotificationTarget(value, previous = []) {
+  return [...previous, value];
+}
+async function readNotificationConfigurationChange(source, read = (path, encoding) => readFileSync20(path, encoding)) {
+  const label = source === "-" ? "stdin" : source;
+  let text;
+  try {
+    text = await read(source === "-" ? 0 : source, "utf8");
+  } catch (error) {
+    throw new Error(
+      `Could not read notification configuration from ${label}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new Error(
+      `Notification configuration from ${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed.expectedWorkspaceVersion !== "number" || !Number.isInteger(parsed.expectedWorkspaceVersion) || !parsed.change || typeof parsed.change !== "object") {
+    throw new Error(
+      `Notification configuration from ${label} must contain an integer expectedWorkspaceVersion and a change object.`
+    );
+  }
+  return {
+    expectedWorkspaceVersion: parsed.expectedWorkspaceVersion,
+    change: parsed.change
+  };
+}
 function registerNotificationCommands(program) {
-  const notifications = program.command("notifications").description("Choose which Play outcomes notify which people and channels.").addHelpText(
+  const notifications = program.command("notifications").description("Configure notification groups, destinations, and rules.").addHelpText(
     "after",
     `
 Examples:
+  deepline notifications add oncall --to email:oncall@example.com --to slack:#oncall
   deepline notifications events
   deepline notifications slack channels --search pipeline
   deepline notifications add pipeline-watchdog --to slack:#pipeline-alerts --for play.cron.failed
   deepline notifications add owner-alerts --to slack:member:U0123456789 --for play.cron.failed
   deepline notifications test pipeline-watchdog
 
-Slack connections are managed in Dashboard \u2192 Integrations. This command only
-chooses the connected Slack channel or member and the events it receives.
+Each named notification is a group. Repeat --to to give it email and Slack
+destinations. Add rules from the dashboard or notification configuration. The
+existing one-Slack-target form with --for remains supported and creates the
+equivalent compatibility group and rules. Slack connections are managed in
+Dashboard \u2192 Integrations.
+`
+  );
+  const configuration = notifications.command("configuration").description("Read or atomically update notification groups and rules.").addHelpText(
+    "after",
+    `
+Examples:
+  deepline notifications configuration get --json
+  deepline notifications configuration apply change.json --dry-run --json
+  jq '{expectedWorkspaceVersion: .configuration.workspaceVersion, change: {kind: "delete_group", groupKey: "oncall"}}' current.json | deepline notifications configuration apply - --json
 `
   );
+  configuration.command("get").description("Show the effective group-based notification configuration.").option("--json", "Emit JSON output").action(async (options) => {
+    const result = await new DeeplineClient().getNotificationConfiguration();
+    printCommandEnvelope(
+      {
+        ...result,
+        render: {
+          sections: [
+            {
+              title: "notification groups",
+              lines: result.configuration.groups.length ? result.configuration.groups.map(
+                (group) => `${group.name}: ${group.enabled ? "active" : "paused"}`
+              ) : ["No notification groups are configured."]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+  });
+  configuration.command("apply").argument(
+    "<file>",
+    "JSON file, or - for stdin, containing expectedWorkspaceVersion and one desired change"
+  ).description(
+    "Atomically apply a configuration draft exported by an agent or UI."
+  ).option("--dry-run", "Validate and display the file without saving it").option("--json", "Emit JSON output").action(async (file, options) => {
+    const input2 = await readNotificationConfigurationChange(file);
+    if (options.dryRun) {
+      printCommandEnvelope(
+        { dryRun: true, ...input2 },
+        { json: options.json }
+      );
+      return;
+    }
+    const result = await new DeeplineClient().changeNotificationConfiguration(
+      input2.expectedWorkspaceVersion,
+      input2.change
+    );
+    printCommandEnvelope(result, { json: options.json });
+  });
   notifications.command("events").description("List the Play events available to a notification.").option("--json", "Emit JSON output").action(async (options) => {
     const settings = await new DeeplineClient().getNotifications();
     printCommandEnvelope(
@@ -40117,42 +40948,82 @@ chooses the connected Slack channel or member and the events it receives.
     );
     printCommandEnvelope({ notification: rule }, { json: options.json });
   });
-  notifications.command("add").argument("<name>", "Short stable name, for example pipeline-watchdog").requiredOption(
+  notifications.command("add").argument("<name>", "Group name, for example oncall").requiredOption(
     "--to <target>",
-    "Target, for example slack:#pipeline-alerts or slack:member:U0123456789"
+    "Target; repeat email:name@example.com, slack:#channel, or slack:member:U0123456789",
+    collectNotificationTarget,
+    []
   ).option(
     "--for <event>",
-    "Event ID; repeat for more events. Run notifications events to list them",
+    "Legacy one-Slack-target event ID; repeat for more events",
     collectEvent,
     []
   ).option("--dry-run", "Describe the notification without saving it").option("--json", "Emit JSON output").action(
     async (name, options) => {
-      if (!options.for.length) {
-        throw new Error("Choose at least one event with --for <event>.");
+      const result = await new DeeplineClient().createNotificationGroup({
+        name,
+        targets: options.to,
+        legacyEvents: options.for,
+        dryRun: options.dryRun
+      });
+      if (result.mode === "dry_run") {
+        printCommandEnvelope(
+          result.compatibilityMode ? {
+            dryRun: true,
+            name: result.name,
+            target: options.to[0],
+            eventTypes: result.legacyEvents
+          } : {
+            dryRun: true,
+            group: result.name,
+            targets: result.targets,
+            compatibilityMode: false
+          },
+          { json: options.json }
+        );
+        return;
       }
-      const target = parseSlackTarget(options.to);
-      if (options.dryRun) {
+      if (result.mode === "legacy") {
         printCommandEnvelope(
-          { dryRun: true, name, target: options.to, eventTypes: options.for },
+          {
+            notification: result.notification,
+            render: {
+              sections: [
+                {
+                  title: "notification saved",
+                  lines: [name]
+                }
+              ],
+              actions: [
+                {
+                  label: "Send a test",
+                  command: `deepline notifications test ${name}`
+                }
+              ]
+            }
+          },
           { json: options.json }
         );
         return;
       }
-      const result = await new DeeplineClient().createNotification({
-        name,
-        provider: "slack",
-        ...target,
-        eventTypes: options.for
-      });
       printCommandEnvelope(
         {
-          notification: result,
+          ...result,
           render: {
-            sections: [{ title: "notification saved", lines: [name] }],
+            sections: [
+              {
+                title: "notification group saved",
+                lines: [
+                  result.group.name,
+                  `${result.destinations.length} destination${result.destinations.length === 1 ? "" : "s"}`,
+                  "0 rules"
+                ]
+              }
+            ],
             actions: [
               {
-                label: "Send a test",
-                command: `deepline notifications test ${name}`
+                label: "View configuration",
+                command: "deepline notifications configuration get"
               }
             ]
           }
@@ -40270,7 +41141,7 @@ import {
   chmodSync,
   existsSync as existsSync19,
   mkdtempSync,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   writeFileSync as writeFileSync20
 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
@@ -41139,6 +42010,9 @@ async function findPlayForToolId(client2, toolId) {
   const plays = await client2.searchPlays({ query: requested, compact: true });
   return plays.find((play) => playIdentifiers(play).includes(requested)) ?? null;
 }
+function isMissingToolMetadataError(error) {
+  return error instanceof DeeplineError && error.statusCode === 404;
+}
 function playAliasToolErrorMessage(toolId, play) {
   const playName = play.reference ?? play.name;
   return `${toolId} is a play, not a tool.
@@ -41420,10 +42294,12 @@ async function getTool(toolId, options = {}) {
   try {
     tool = await client2.getTool(toolId);
   } catch (error) {
-    const play = await findPlayForToolId(client2, toolId);
-    if (play) {
-      printPlayAliasToolError(toolId, play);
-      return 2;
+    if (isMissingToolMetadataError(error)) {
+      const play = await findPlayForToolId(client2, toolId);
+      if (play) {
+        printPlayAliasToolError(toolId, play);
+        return 2;
+      }
     }
     throw error;
   }
@@ -42411,7 +43287,7 @@ function readJsonArgument(raw, flagName) {
     throw new Error(`Invalid ${flagName} value: empty @file path.`);
   }
   try {
-    return readFileSync20(resolveAtFilePath(filePath), "utf8").replace(
+    return readFileSync21(resolveAtFilePath(filePath), "utf8").replace(
       /^\uFEFF/,
       ""
     );
@@ -42762,19 +43638,18 @@ async function executeTool(args) {
   try {
     metadata = await client2.getTool(parsed.toolId);
   } catch (error) {
-    const play = await findPlayForToolId(client2, parsed.toolId);
-    if (play) {
-      if (argsWantJson(args)) {
-        printJsonError(
-          new Error(playAliasToolErrorMessage(parsed.toolId, play))
-        );
-      } else {
-        printPlayAliasToolError(parsed.toolId, play);
+    if (isMissingToolMetadataError(error)) {
+      const play = await findPlayForToolId(client2, parsed.toolId);
+      if (play) {
+        if (argsWantJson(args)) {
+          printJsonError(
+            new Error(playAliasToolErrorMessage(parsed.toolId, play))
+          );
+        } else {
+          printPlayAliasToolError(parsed.toolId, play);
+        }
+        return 2;
       }
-      return 2;
-    }
-    if (error instanceof DeeplineError) {
-      throw error;
     }
     throw error;
   }