deepline 0.3.88 → 0.3.90

package/dist/cli/index.mjs

@@ -163,6 +163,26 @@ import { join as join24 } from "path";
 import { tmpdir as tmpdir6 } from "os";
 import { Command as Command5 } from "commander";
 
+// src/pagination.ts
+async function* iterateCursorPages(fetchPage) {
+  let cursor = null;
+  const seen = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const page = await fetchPage(cursor);
+    if (page.hasMore) {
+      if (!page.cursor || seen.has(page.cursor)) {
+        throw new Error(
+          "Pagination reported more results without an advancing cursor"
+        );
+      }
+      seen.add(page.cursor);
+    }
+    yield page.items;
+    if (!page.hasMore) return;
+    cursor = page.cursor;
+  }
+}
+
 // src/config.ts
 import {
   existsSync,
@@ -572,6 +592,7 @@ var HOST_URL_ENV = "DEEPLINE_HOST_URL";
 var API_KEY_ENV = "DEEPLINE_API_KEY";
 var ACTIVE_ORG_ID_ENV = "DEEPLINE_ACTIVE_ORG_ID";
 var ACTIVE_ORG_NAME_ENV = "DEEPLINE_ACTIVE_ORG_NAME";
+var FEATURES_ENV = "DEEPLINE_FEATURES";
 var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
@@ -596,8 +617,40 @@ var CLI_ENV_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   HOST_URL_ENV,
   API_KEY_ENV,
   ACTIVE_ORG_ID_ENV,
-  ACTIVE_ORG_NAME_ENV
+  ACTIVE_ORG_NAME_ENV,
+  FEATURES_ENV
 ]);
+function featureEnvValues(data) {
+  if (!Array.isArray(data.features)) return {};
+  return {
+    [FEATURES_ENV]: data.features.filter(
+      (key) => typeof key === "string" && key.trim() !== ""
+    ).map((key) => key.trim()).join(",")
+  };
+}
+function storedHostApiKey(baseUrl) {
+  return loadCliEnv(normalizeBaseUrl(baseUrl) || baseUrl)[API_KEY_ENV] ?? "";
+}
+function storedHostFeatures(baseUrl) {
+  return loadCliEnv(normalizeBaseUrl(baseUrl) || baseUrl)[FEATURES_ENV];
+}
+function envHasFeature(env, feature) {
+  return (env[FEATURES_ENV] ?? "").split(",").map((key) => key.trim()).includes(feature);
+}
+function cliFeatureEnabled(feature) {
+  const processEnv = process.env;
+  if (envHasFeature(processEnv, feature)) return true;
+  if (processEnv[API_KEY_ENV]?.trim()) return false;
+  try {
+    const baseUrl = resolveBaseUrlOnly();
+    const projectEnv = loadProjectEnvCandidates().find(
+      ({ env }) => normalizeBaseUrl(env[HOST_URL_ENV] ?? "") === baseUrl && Boolean(env[API_KEY_ENV])
+    );
+    return envHasFeature(projectEnv?.env ?? loadCliEnv(baseUrl), feature);
+  } catch {
+    return false;
+  }
+}
 function baseUrlSlug(baseUrl) {
   let url;
   try {
@@ -797,6 +850,10 @@ function mergePersistedEnvValues(existing, values) {
   if (nextApiKey !== void 0 && nextApiKey !== existing[API_KEY_ENV] && values[ACTIVE_ORG_ID_ENV] === void 0) {
     delete merged[ACTIVE_ORG_ID_ENV];
     delete merged[ACTIVE_ORG_NAME_ENV];
+    delete merged[FEATURES_ENV];
+  }
+  if (values[FEATURES_ENV] === "") {
+    delete merged[FEATURES_ENV];
   }
   return merged;
 }
@@ -920,7 +977,10 @@ function resolveConfig(options) {
     apiKey,
     baseUrl,
     timeout: options?.timeout ?? DEFAULT_TIMEOUT,
-    maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES
+    maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES,
+    // Pass through untouched: the transport owns case-insensitive merging so
+    // there is exactly one place that decides which header wins.
+    ...options?.headers ? { headers: { ...options.headers } } : {}
   };
 }
 function mergeProjectEnvFile(filePath, values) {
@@ -1210,20 +1270,27 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.88",
-  updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
+  // 0.3.90 is the first deliberately versioned SDK release for API v3. Play
+  // grep hard-cuts to the single Convex full-text index; it does not retain a
+  // registry/scanner reader for any SDK/API major.
+  version: "0.3.90",
+  updateSummary: "Play grep now uses one source-only Convex full-text index. It no longer scans the registry, pages through the complete indexed match set, and rejects retired grep modes. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
   },
   contracts: {
     api: {
       name: "sdk-http-api",
-      // API v2 is append-only. A breaking public request/response change needs
-      // v3 and an explicit v2 support-window decision, never a patch release.
-      currentMajor: 2,
-      supportedMajors: [2],
-      // Accepted only to bridge SDKs released before X-Deepline-API-Major.
+      // API v3 hard-cuts Play grep to the canonical Convex index. API v2 stays
+      // admitted for the explicit SDK support window, but it selects neither a
+      // registry scanner nor another grep reader: every accepted grep request
+      // uses the same indexed query and retired flags fail at the API boundary.
+      currentMajor: 3,
+      supportedMajors: [3, 2],
+      // The first wire id is emitted by the current SDK. Remaining ids are
+      // accepted only while the API v2 support window is open.
       legacyWireIds: [
+        "2026-09-play-grep-convex-index-hard-cutover",
         "2026-07-admin-cli-local-cutover",
         "2026-07-native-monitor-launch-hard-cutover"
       ]
@@ -1764,11 +1831,33 @@ function normalizeRequestAbortError(error, input2) {
   }
   return normalized;
 }
+function applyExplicitHeaders(headers, explicit) {
+  if (!explicit) return headers;
+  for (const [rawName, value] of Object.entries(explicit)) {
+    const name = rawName.trim().toLowerCase();
+    if (!name) continue;
+    for (const existing of Object.keys(headers)) {
+      if (existing.toLowerCase() === name) delete headers[existing];
+    }
+    headers[name] = value;
+  }
+  return headers;
+}
 function isAbortLikeError(error) {
   const name = error.name.toLowerCase();
   const message = error.message.toLowerCase();
   return name === "aborterror" || message.includes("operation was aborted") || message === "aborted";
 }
+function withErrorCause(error, cause) {
+  if (cause !== null && cause !== void 0) {
+    Object.defineProperty(error, "cause", {
+      value: cause,
+      configurable: true,
+      writable: true
+    });
+  }
+  return error;
+}
 function mapNetworkError(baseUrl, error, targetLabel2) {
   const tagged = error;
   const timeoutMs = tagged?.[REQUEST_TIMEOUT_MARKER];
@@ -1885,7 +1974,7 @@ var HttpClient = class {
     if (coordinatorInternalToken?.trim() && (coordinatorUrl?.trim() || workerCallbackUrl?.trim() || runtimeTestFault?.trim() || absurdReleaseOverride?.trim() || preferredReceiptGatewayMachineId?.trim())) {
       headers[COORDINATOR_INTERNAL_TOKEN_HEADER] = coordinatorInternalToken.trim();
     }
-    return headers;
+    return applyExplicitHeaders(headers, this.config.headers);
   }
   /**
    * Send an HTTP request with automatic retries and error handling.
@@ -2039,32 +2128,38 @@ var HttpClient = class {
     );
     if (options?.toolId) {
       const code = mappedNetworkError.code;
-      throw new ToolExecutionError(
-        withCoworkNetworkHint(mappedNetworkError.message),
-        {
-          toolId: options.toolId,
-          provider: providerLabelFromToolId(options.toolId),
-          operation: options.toolId,
-          code,
-          origin: "deepline",
-          category: "network",
-          // A direct client timeout has ambiguous delivery. Fail closed unless
-          // the server returns the authoritative action delivery contract.
-          retryable: false,
-          statusCode: null,
-          requestId: null,
-          retryAfterMs: null,
-          networkKind: code === "NETWORK_TIMEOUT" ? "timeout" : code === "NETWORK_ABORTED" ? "unknown" : "unavailable",
-          networkScope: "client_to_deepline",
-          details: mappedNetworkError.details
-        }
+      throw withErrorCause(
+        new ToolExecutionError(
+          withCoworkNetworkHint(mappedNetworkError.message),
+          {
+            toolId: options.toolId,
+            provider: providerLabelFromToolId(options.toolId),
+            operation: options.toolId,
+            code,
+            origin: "deepline",
+            category: "network",
+            // A direct client timeout has ambiguous delivery. Fail closed unless
+            // the server returns the authoritative action delivery contract.
+            retryable: false,
+            statusCode: null,
+            requestId: null,
+            retryAfterMs: null,
+            networkKind: code === "NETWORK_TIMEOUT" ? "timeout" : code === "NETWORK_ABORTED" ? "unknown" : "unavailable",
+            networkScope: "client_to_deepline",
+            details: mappedNetworkError.details
+          }
+        ),
+        lastError
       );
     }
-    throw new DeeplineError(
-      withCoworkNetworkHint(mappedNetworkError.message),
-      void 0,
-      mappedNetworkError.code,
-      mappedNetworkError.details
+    throw withErrorCause(
+      new DeeplineError(
+        withCoworkNetworkHint(mappedNetworkError.message),
+        void 0,
+        mappedNetworkError.code,
+        mappedNetworkError.details
+      ),
+      lastError
     );
   }
   /**
@@ -2438,6 +2533,17 @@ var PRODUCT_NOTIFICATION_DELIVERY_LEASE_MS = 2 * 6e4;
 var PRODUCT_NOTIFICATION_SUCCESS_TTL_MS = 15 * 6e4;
 var PRODUCT_NOTIFICATION_FAILURE_TTL_MS = 24 * 60 * 6e4;
 
+// ../product-notifications/configuration.ts
+var PRODUCT_NOTIFICATION_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function normalizeProductNotificationEmail(value) {
+  const email = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return email && email.length <= 320 && PRODUCT_NOTIFICATION_EMAIL_PATTERN.test(email) ? email : null;
+}
+var DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING = {
+  mode: "rolling_limit",
+  windowMs: 36e5
+};
+
 // src/stream-reconnect.ts
 var STREAM_RECONNECT_BASE_DELAY_MS = 500;
 var STREAM_RECONNECT_MAX_DELAY_MS = 15e3;
@@ -2966,7 +3072,7 @@ function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isPlayActivityObservation(value) {
-  if (!isRecord4(value) || value.schemaVersion !== 1 || typeof value.activityId !== "string" || !value.activityId.trim() || typeof value.observedAt !== "number" || !Number.isFinite(value.observedAt) || !isRecord4(value.target) || !isRecord4(value.state)) {
+  if (!isRecord4(value) || value.schemaVersion !== void 0 && value.schemaVersion !== 1 || typeof value.activityId !== "string" || !value.activityId.trim() || typeof value.observedAt !== "number" || !Number.isFinite(value.observedAt) || !isRecord4(value.target) || !isRecord4(value.state)) {
     return false;
   }
   const targetKinds = /* @__PURE__ */ new Set([
@@ -3073,7 +3179,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "detached_runner") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "runner:managed",
         target: {
           kind: "runner",
@@ -3089,7 +3194,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "sleep") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "run:sleep",
         target: {
           kind: "step",
@@ -3109,7 +3213,6 @@ function projectPlayRunActivity(input2) {
   if (input2.waitKind === "integration_event" || input2.waitKind === "integration_event_batch") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: `event:${input2.activeNodeId ?? "run"}`,
         stepId: input2.activeNodeId ?? void 0,
         target: {
@@ -3133,7 +3236,6 @@ function projectPlayRunActivity(input2) {
   if (normalizedStatus === "waiting") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "run:legacy-wait",
         target: {
           kind: "step",
@@ -3160,7 +3262,6 @@ function projectPlayRunActivity(input2) {
     const datasetProgress = datasetStep?.progress ?? null;
     return projection(
       {
-        schemaVersion: 1,
         activityId: `dataset:${pendingDataset.datasetId ?? pendingDataset.tableNamespace}`,
         target: {
           kind: "dataset",
@@ -3188,7 +3289,6 @@ function projectPlayRunActivity(input2) {
     const provider = toolId?.split(/[._]/)[0]?.trim() || null;
     return projection(
       {
-        schemaVersion: 1,
         activityId: `step:${activeStep.nodeId}`,
         stepId: activeStep.nodeId,
         target: toolId && provider ? {
@@ -3213,7 +3313,6 @@ function projectPlayRunActivity(input2) {
   if (normalizedStatus === "queued") {
     return projection(
       {
-        schemaVersion: 1,
         activityId: "capacity:worker",
         target: { kind: "capacity", pool: "worker" },
         state: { kind: "queued", reason: "capacity" },
@@ -3223,7 +3322,6 @@ function projectPlayRunActivity(input2) {
     );
   }
   const fallback = {
-    schemaVersion: 1,
     activityId: "run:legacy",
     target: {
       kind: "step",
@@ -4338,7 +4436,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -4392,7 +4490,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",
@@ -4483,6 +4581,42 @@ function providerMetaFromToolResponseRawV2(rawV2, view) {
 }
 
 // src/client.ts
+var MAX_NOTIFICATION_GROUP_CREATE_TARGETS = 50;
+function parseNotificationGroupTarget(value) {
+  const normalized = value.trim();
+  if (normalized.toLowerCase().startsWith("email:")) {
+    const email = normalizeProductNotificationEmail(normalized.slice(6));
+    if (!email) {
+      throw new Error(
+        `Invalid email notification target "${value}". Use --to email:name@example.com.`
+      );
+    }
+    return { kind: "email", email };
+  }
+  const slack = /^slack:(.+)$/i.exec(normalized)?.[1]?.trim();
+  if (!slack) {
+    const provider = normalized.split(":", 1)[0] || normalized;
+    throw new Error(
+      `Unsupported notification destination "${provider}". Use email: or slack:.`
+    );
+  }
+  const member = /^member:([UW][A-Z0-9]{8,})$/i.exec(slack);
+  if (member?.[1]) {
+    return { kind: "slack", memberId: member[1].toUpperCase() };
+  }
+  if (slack.toLowerCase().startsWith("member:")) {
+    throw new Error(
+      "Slack member IDs must look like slack:member:U0123456789."
+    );
+  }
+  if (!slack.replace(/^#/, "").trim()) {
+    throw new Error("Use --to slack:#channel.");
+  }
+  return { kind: "slack", channel: slack };
+}
+function notificationObjectKey(kind) {
+  return `${kind}.${globalThis.crypto.randomUUID()}`;
+}
 var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
@@ -5002,6 +5136,7 @@ var DeeplineClient = class {
     this.runs = {
       get: (runId, options2) => this.getRunStatus(runId, options2),
       list: (options2) => this.listRuns(options2),
+      listPage: (options2) => this.listRunsPage(options2),
       tail: (runId, options2) => this.tailRun(runId, options2),
       logs: (runId, options2) => this.getRunLogs(runId, options2),
       input: (runId) => this.getRunInput(runId),
@@ -5052,6 +5187,10 @@ var DeeplineClient = class {
       audit: (options2) => this.auditMonitors(options2),
       repair: (options2) => this.repairMonitors(options2),
       health: (options2) => this.readMonitorsHealth(options2),
+      batch: {
+        submit: (options2) => this.submitMonitorBatch(options2),
+        get: (operationId, options2) => this.getMonitorBatch(operationId, options2)
+      },
       fleets: {
         sync: (definitionOrId, options2) => this.syncMonitorFleet(definitionOrId, options2),
         get: (fleetId, options2) => fleetId === void 0 ? this.listMonitorFleets() : this.getMonitorFleet(fleetId, options2),
@@ -5184,6 +5323,16 @@ var DeeplineClient = class {
       (secret) => secret.name === normalized && secret.status === "active" && secret.hasValue
     ) ?? null;
   }
+  /** Check effective scope and active-version health without reading the value.
+   * Without playName, checks the organization-scoped secret only. With a Play
+   * name, an active Play secret takes precedence; a deleted/disabled Play
+   * secret falls back to the organization-scoped secret.
+   */
+  async inspectSecret(name, options = {}) {
+    const params = new URLSearchParams({ name: name.trim().toUpperCase() });
+    if (options.playName !== void 0) params.set("play", options.playName);
+    return this.http.get(`/api/v2/secrets?${params.toString()}`);
+  }
   // ——————————————————————————————————————————————————————————
   // Tools
   // ——————————————————————————————————————————————————————————
@@ -5275,6 +5424,10 @@ var DeeplineClient = class {
       `/api/v2/integrations/${encodeURIComponent(toolId)}/get`,
       {
         method: "GET",
+        // Tool metadata is a read-only catalog lookup. Keep the metadata
+        // header while opting into the same transient edge-response retries as
+        // other GET catalog methods such as searchTools().
+        retryApiErrors: true,
         headers: {
           "x-deepline-tool-meta-only": "1"
         }
@@ -6197,6 +6350,10 @@ var DeeplineClient = class {
    * ```
    */
   async listRuns(options) {
+    return (await this.listRunsPage(options)).runs;
+  }
+  /** Read one run page without discarding server pagination metadata. */
+  async listRunsPage(options) {
     const playName = options.play?.trim();
     const params = new URLSearchParams();
     if (playName) {
@@ -6227,7 +6384,7 @@ var DeeplineClient = class {
     const response = await this.http.get(
       `/api/v2/runs?${params.toString()}`
     );
-    return response.runs ?? [];
+    return { ...response, runs: response.runs ?? [] };
   }
   /**
    * Observe one run's live events. Uses the Convex Run Snapshot subscription
@@ -6622,13 +6779,33 @@ var DeeplineClient = class {
     );
   }
   /**
-   * List callable plays visible to the workspace.
+   * List one page of callable plays; grep retains exhaustive matching results.
+   * Use listPlaysPage to retain pagination metadata.
    *
    * Pass `origin: "prebuilt"` for Deepline-managed prebuilts or
    * `origin: "owned"` for org-owned plays.
    */
   async listPlays(options) {
+    if (!options?.grep?.trim()) {
+      return (await this.requestPlaysPage(options, false)).plays;
+    }
+    const plays = [];
+    for await (const items of iterateCursorPages(async (cursor) => {
+      const page = await this.listPlaysPage({ ...options, cursor });
+      return { items: page.plays, cursor: page.cursor, hasMore: page.hasMore };
+    })) {
+      plays.push(...items);
+    }
+    return plays;
+  }
+  /** Read one bounded inventory page; cursor continues the same filters. */
+  async listPlaysPage(options) {
+    return this.requestPlaysPage(options);
+  }
+  async requestPlaysPage(options, paginateInventory = true) {
     const params = new URLSearchParams();
+    if (paginateInventory && !options?.grep?.trim())
+      params.set("inventory_paginated", "1");
     if (options?.origin) params.set("origin", options.origin);
     if (options?.categories) {
       params.set(
@@ -6640,26 +6817,27 @@ var DeeplineClient = class {
       params.set("include_tool_categories", "1");
     }
     if (options?.includeArchived) params.set("include_archived", "1");
+    if (options?.includeCostEstimates) {
+      params.set("include_cost_estimates", "1");
+    }
     if (options?.grep?.trim()) {
       params.set("grep", options.grep.trim());
-      params.set("grep_mode", options.grepMode ?? "all");
-      params.set("grep_paginated", "1");
       params.set("limit", "60");
     }
-    const plays = [];
-    let cursor = null;
-    let hasMore = true;
-    do {
-      if (cursor) params.set("cursor", cursor);
-      const suffix = params.toString() ? `?${params.toString()}` : "";
-      const response = await this.http.get(
-        `/api/v2/plays${suffix}`
-      );
-      plays.push(...response.plays ?? []);
-      cursor = response.pagination?.cursor ?? response.cursor ?? null;
-      hasMore = Boolean(response.pagination?.hasMore ?? response.hasMore);
-    } while (Boolean(options?.grep?.trim()) && hasMore && cursor);
-    return plays;
+    if (options?.limit !== void 0) {
+      if (!Number.isSafeInteger(options.limit) || options.limit < 1) {
+        throw new Error("Play page limit must be a positive integer");
+      }
+      params.set("limit", String(options.limit));
+    }
+    if (options?.cursor) params.set("cursor", options.cursor);
+    const suffix = params.size ? `?${params.toString()}` : "";
+    const response = await this.http.get(`/api/v2/plays${suffix}`);
+    return {
+      plays: response.plays ?? [],
+      cursor: response.pagination?.cursor ?? response.cursor ?? null,
+      hasMore: Boolean(response.pagination?.hasMore ?? response.hasMore)
+    };
   }
   /** Set whether an org-owned Play sorts before unpinned Plays. */
   async setPlayPinned(playName, pinned) {
@@ -6730,6 +6908,197 @@ var DeeplineClient = class {
   async getNotifications() {
     return this.http.get("/api/v2/notifications");
   }
+  /** Read the group-based product-notification configuration and rule catalog. */
+  async getNotificationConfiguration() {
+    return this.http.get("/api/v2/notifications/configuration");
+  }
+  /** Atomically apply one retry-safe desired configuration change. */
+  async changeNotificationConfiguration(expectedWorkspaceVersion, change) {
+    return this.http.put("/api/v2/notifications/configuration", {
+      expectedWorkspaceVersion,
+      change
+    });
+  }
+  /** Create one notification group and its destinations as a retry-safe unit. */
+  async createNotificationGroup(input2) {
+    const name = input2.name.trim().replace(/\s+/g, " ");
+    if (!name) throw new Error("Notification group name is required.");
+    if (input2.targets.length < 1 || input2.targets.length > MAX_NOTIFICATION_GROUP_CREATE_TARGETS) {
+      throw new Error(
+        `Choose between 1 and ${MAX_NOTIFICATION_GROUP_CREATE_TARGETS} notification targets.`
+      );
+    }
+    const targets = input2.targets.map(parseNotificationGroupTarget);
+    const legacyEvents = input2.legacyEvents ?? [];
+    const legacyTarget = targets.length === 1 && targets[0]?.kind === "slack" && legacyEvents.length > 0 ? targets[0] : null;
+    if (legacyEvents.length > 0 && !legacyTarget) {
+      throw new Error(
+        "--for is supported only by the legacy one-Slack-target form. Create the group first, then add rules in notification configuration."
+      );
+    }
+    if (!legacyTarget && name.toLowerCase() === "default") {
+      throw new Error(
+        "Default is reserved for the workspace default notification group."
+      );
+    }
+    const normalizedTargets = targets.map(
+      (target) => target.kind === "email" ? `email:${target.email}` : "memberId" in target ? `slack:member:${target.memberId}` : `slack:${target.channel}`
+    );
+    if (input2.dryRun) {
+      return {
+        mode: "dry_run",
+        compatibilityMode: legacyTarget !== null,
+        name: legacyTarget ? input2.name : name,
+        targets: normalizedTargets,
+        legacyEvents
+      };
+    }
+    if (legacyTarget) {
+      const notification = await this.createNotification({
+        name: input2.name,
+        provider: "slack",
+        ..."channel" in legacyTarget ? { channel: legacyTarget.channel } : { memberId: legacyTarget.memberId },
+        eventTypes: legacyEvents
+      });
+      return { mode: "legacy", notification };
+    }
+    const current = await this.getNotificationConfiguration();
+    const existingGroup = current.configuration.groups.find(
+      (candidate) => candidate.name.toLowerCase() === name.toLowerCase()
+    );
+    const groupKey = existingGroup?.groupKey ?? notificationObjectKey("group");
+    const group = existingGroup ?? {
+      groupKey,
+      name,
+      enabled: true,
+      deliveryTiming: DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING,
+      source: "workspace",
+      configMode: "custom",
+      version: 0
+    };
+    const destinations = current.configuration.destinations.filter(
+      (destination) => destination.groupKey === groupKey
+    );
+    const emails = [
+      ...new Set(
+        targets.flatMap(
+          (target) => target.kind === "email" ? [target.email] : []
+        )
+      )
+    ].sort();
+    const existingEmails = new Set(
+      destinations.flatMap(
+        (destination) => destination.settings.kind === "email_addresses" ? destination.settings.to : []
+      )
+    );
+    const newEmails = emails.filter((email) => !existingEmails.has(email));
+    if (newEmails.length > 0) {
+      destinations.push({
+        destinationKey: notificationObjectKey("destination"),
+        groupKey,
+        name: "Email recipients",
+        enabled: true,
+        source: "workspace",
+        configMode: "custom",
+        version: 0,
+        status: "active",
+        settings: { kind: "email_addresses", to: newEmails }
+      });
+    }
+    const slackTargets = /* @__PURE__ */ new Map();
+    for (const target of targets) {
+      if (target.kind !== "slack") continue;
+      const targetKey = "memberId" in target ? `member:${target.memberId}` : `channel:${target.channel.replace(/^#/, "").toLowerCase()}`;
+      slackTargets.set(targetKey, target);
+    }
+    const connectionId = current.slackConnection.connectionId;
+    if (slackTargets.size > 0 && !connectionId) {
+      throw new Error(
+        "Slack is not connected to this workspace. Connect it in Dashboard \u2192 Integrations, then retry."
+      );
+    }
+    const resolvedSlackTargets = await Promise.all(
+      [...slackTargets.values()].map(async (target) => {
+        if ("memberId" in target) {
+          return {
+            targetKind: "member",
+            targetId: target.memberId,
+            targetName: target.memberId
+          };
+        }
+        const channel = target.channel;
+        const requested = channel.replace(/^#/, "");
+        const response = await this.listNotificationChannels(channel);
+        const matches = response.channels.filter(
+          (candidate) => candidate.id === requested || candidate.name.toLowerCase() === requested.toLowerCase()
+        );
+        if (matches.length !== 1) {
+          throw new Error(
+            matches.length === 0 ? `Slack channel ${channel} was not found or is not visible to the Deepline app.` : `Slack channel ${channel} is ambiguous. Use its channel ID.`
+          );
+        }
+        return {
+          targetKind: "channel",
+          targetId: matches[0].id,
+          targetName: matches[0].name
+        };
+      })
+    );
+    const uniqueSlackTargets = new Map(
+      resolvedSlackTargets.map((target) => [
+        `${target.targetKind}:${target.targetId}`,
+        target
+      ])
+    );
+    for (const target of uniqueSlackTargets.values()) {
+      if (destinations.some(
+        (destination) => destination.settings.kind === "slack" && destination.settings.targetKind === target.targetKind && destination.settings.targetId === target.targetId
+      )) {
+        continue;
+      }
+      destinations.push({
+        destinationKey: notificationObjectKey("destination"),
+        groupKey,
+        name: `${target.targetKind === "channel" ? "#" : "@"}${target.targetName}`,
+        enabled: true,
+        source: "workspace",
+        configMode: "custom",
+        version: 0,
+        status: "pending_verification",
+        settings: {
+          kind: "slack",
+          ...target,
+          oauthConnectionId: connectionId
+        }
+      });
+    }
+    const draft = {
+      group,
+      destinations,
+      rules: current.configuration.rules.filter(
+        (rule) => rule.groupKey === groupKey
+      )
+    };
+    const result = await this.changeNotificationConfiguration(
+      current.configuration.workspaceVersion,
+      { kind: "save_group", draft }
+    );
+    const storedGroup = result.configuration.groups.find(
+      (candidate) => candidate.groupKey === groupKey
+    );
+    if (!storedGroup) {
+      throw new Error("Notification group creation returned no saved group.");
+    }
+    return {
+      mode: "native",
+      groupKey,
+      targets: normalizedTargets,
+      group: storedGroup,
+      destinations: result.configuration.destinations.filter(
+        (destination) => destination.groupKey === groupKey
+      )
+    };
+  }
   /** List Slack channels available to an already-connected Slack integration. */
   async listNotificationChannels(query) {
     const suffix = query ? `?search=${encodeURIComponent(query)}` : "";
@@ -7274,6 +7643,78 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
+  /** Submit durable monitor work; transport retries use the same idempotency key. */
+  async submitMonitorBatch(options) {
+    const idempotencyKey = options.idempotencyKey.trim();
+    if (!idempotencyKey) {
+      throw new DeeplineError(
+        "Monitor batch idempotencyKey is required.",
+        void 0,
+        "INVALID_MONITOR_BATCH_IDEMPOTENCY_KEY"
+      );
+    }
+    if (options.kind === "deploy") {
+      if (!options.manifestNdjson.trim()) {
+        throw new DeeplineError(
+          "Monitor batch deploy requires a non-empty NDJSON manifest.",
+          void 0,
+          "INVALID_MONITOR_BATCH_MANIFEST"
+        );
+      }
+      return this.http.request(
+        "/api/v2/monitors/batch",
+        {
+          method: "POST",
+          body: {
+            kind: "deploy",
+            manifest_ndjson: options.manifestNdjson,
+            dry_run: options.dryRun === true,
+            idempotency_key: idempotencyKey
+          },
+          headers: { "Idempotency-Key": idempotencyKey },
+          maxRetries: 0,
+          exactUrlOnly: true
+        }
+      );
+    }
+    const scope = options.scope.kind === "keys" ? { kind: "keys", monitor_keys: options.scope.monitorKeys } : options.scope.kind === "fleet" ? { kind: "fleet", fleet_id: options.scope.fleetId } : { kind: "target", target: options.scope.target };
+    return this.http.request(
+      "/api/v2/monitors/batch",
+      {
+        method: "POST",
+        body: {
+          kind: options.kind,
+          scope,
+          dry_run: options.dryRun === true,
+          idempotency_key: idempotencyKey,
+          ...options.deactivationReason === void 0 ? {} : { deactivation_reason: options.deactivationReason }
+        },
+        headers: { "Idempotency-Key": idempotencyKey },
+        // Durable submission is itself idempotent, but an ambiguous local retry
+        // must retain the exact key and never turn a CLI attempt into two runs.
+        maxRetries: 0,
+        exactUrlOnly: true
+      }
+    );
+  }
+  /** Get durable batch progress and a bounded retained evidence page. */
+  async getMonitorBatch(operationId, options) {
+    const runId = operationId.trim();
+    if (!runId) {
+      throw new DeeplineError(
+        "Monitor batch operation id is required.",
+        void 0,
+        "INVALID_MONITOR_BATCH_OPERATION_ID"
+      );
+    }
+    const params = new URLSearchParams();
+    if (options?.cursor) params.set("cursor", options.cursor);
+    const suffix = params.size > 0 ? `?${params}` : "";
+    return this.http.request(
+      `/api/v2/monitors/batch/${encodeURIComponent(runId)}${suffix}`,
+      { method: "GET" }
+    );
+  }
   /**
    * The deployable monitor tools catalog. Pass a tool id (positional or
    * `{ tool }`) to describe one tool's full payload/stream contract, or no tool
@@ -7758,13 +8199,6 @@ function getAuthedHttpClient() {
   const config = resolveConfig();
   return { config, http: new HttpClient(config) };
 }
-async function writeOutputFile(filename, content) {
-  const outputDir = resolve2(process.cwd(), "deepline", "data");
-  await mkdir(outputDir, { recursive: true });
-  const fullPath = join4(outputDir, filename);
-  await writeFile(fullPath, content, "utf-8");
-  return fullPath;
-}
 function stableOsUserId() {
   try {
     const info = userInfo();
@@ -8407,13 +8841,6 @@ function createTimestampedName(prefix, extension) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   return `${prefix}-${timestamp}.${extension}`;
 }
-async function writeCsvRowsFile(prefix, rows) {
-  const path = await writeOutputFile(
-    createTimestampedName(prefix, "csv"),
-    csvStringFromRows(rows)
-  );
-  return path;
-}
 function clip(value, maxLength) {
   return value.length > maxLength ? `${value.slice(0, maxLength - 1)}\u2026` : value;
 }
@@ -8591,7 +9018,9 @@ function saveEnvValues(values, baseUrl, scope) {
     ...values[HOST_URL_ENV] ? { [HOST_URL_ENV]: values[HOST_URL_ENV] } : {},
     ...values[API_KEY_ENV] ? { [API_KEY_ENV]: values[API_KEY_ENV] } : {},
     ...values[ACTIVE_ORG_ID_ENV] ? { [ACTIVE_ORG_ID_ENV]: values[ACTIVE_ORG_ID_ENV] } : {},
-    ...Object.prototype.hasOwnProperty.call(values, ACTIVE_ORG_NAME_ENV) ? { [ACTIVE_ORG_NAME_ENV]: values[ACTIVE_ORG_NAME_ENV] } : {}
+    ...Object.prototype.hasOwnProperty.call(values, ACTIVE_ORG_NAME_ENV) ? { [ACTIVE_ORG_NAME_ENV]: values[ACTIVE_ORG_NAME_ENV] } : {},
+    // An explicit empty list must reach the store: it clears a stale line.
+    ...Object.prototype.hasOwnProperty.call(values, FEATURES_ENV) ? { [FEATURES_ENV]: values[FEATURES_ENV] } : {}
   };
   if (scope === "folder") {
     saveProjectDeeplineEnvValues(filtered);
@@ -8605,7 +9034,8 @@ function activeOrgEnvValues(data) {
   const orgName = typeof data.org_name === "string" ? data.org_name.trim() : "";
   return {
     [ACTIVE_ORG_ID_ENV]: orgId,
-    [ACTIVE_ORG_NAME_ENV]: orgName
+    [ACTIVE_ORG_NAME_ENV]: orgName,
+    ...featureEnvValues(data)
   };
 }
 async function httpJson(method, url, apiKey, body, timeoutMs = AUTH_HTTP_TIMEOUT_MS) {
@@ -9130,6 +9560,8 @@ async function handleStatus(args) {
         savedApiKeyPath = envFilePath(baseUrl);
       }
     }
+  } else if (resolvedAuthScope === "folder" || storedHostApiKey(baseUrl) === apiKey) {
+    saveEnvValues(featureEnvValues(data), baseUrl, resolvedAuthScope);
   }
   printCommandEnvelope(
     {
@@ -9193,7 +9625,7 @@ Notes:
   workspace. To switch, use deepline org list and deepline org set <org-id>.
 `
   );
-  auth.command("workspaces").description("Deprecated. Use deepline org list to see workspaces.").action(() => {
+  auth.command("workspaces", { hidden: true }).description("Deprecated. Use deepline org list to see workspaces.").action(() => {
     console.error(
       "Workspaces live under `deepline org`.\n  List:   deepline org list\n  Switch: deepline org set <org-id>\n`deepline auth register` re-approves this device; it does not change the active workspace."
     );
@@ -9290,7 +9722,6 @@ var SUBSCRIPTION_STATUS_NEXT_COMMAND = "deepline billing subscription status --j
 var SUBSCRIPTION_CANCEL_PATH = "/api/v2/billing/subscription/cancel";
 var BILLING_TOP_UP_PATH = "/api/v2/billing/top-up";
 var DEFAULT_BALANCE_RECOVERY_CREDITS = 100;
-var BILLING_HISTORY_EXPORT_LIMIT = 5e3;
 function billingFailureFromError(error, options) {
   if (error instanceof AuthError) {
     return {
@@ -9581,6 +10012,9 @@ async function handleBalance(options) {
   );
   return;
 }
+function quoteShellArgument(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 async function handleUsage(options) {
   const { http } = getAuthedHttpClient();
   const params = new URLSearchParams();
@@ -9597,6 +10031,7 @@ async function handleUsage(options) {
   const recent = payload.recent ?? {};
   const last30Usage = usage.last_30_days_usage_credits ?? usage.month_spent_credits;
   const temporaryHolds = Number(usage.temporary_hold_credits ?? 0);
+  const nextPage = typeof recent.next_cursor === "string" && recent.next_cursor.length > 0 ? `deepline billing usage --cursor ${quoteShellArgument(recent.next_cursor)}${options.limit ? ` --limit ${options.limit}` : ""}${options.runId ? ` --run-id ${quoteShellArgument(options.runId)}` : ""} --json` : null;
   const lines = [
     `Balance: ${payload.balance ?? "(unknown)"}`,
     `Last 30 days usage: ${last30Usage ?? "(unknown)"}`,
@@ -9608,13 +10043,20 @@ async function handleUsage(options) {
     ...recentUsageLines(
       Array.isArray(recent.entries) ? recent.entries : []
     ),
-    ...typeof recent.next_cursor === "string" && recent.next_cursor.length > 0 ? [
-      `Next page: deepline billing usage --cursor ${recent.next_cursor}${options.limit ? ` --limit ${options.limit}` : ""}${options.runId ? ` --run-id ${options.runId}` : ""}`
+    ...recent.has_more === true || recent.incomplete === true ? ["List truncated \u2014 more recent calls match this query."] : [],
+    ...nextPage ? [`Next page: ${nextPage}`] : [],
+    ...!nextPage && (recent.has_more === true || recent.incomplete === true) ? [
+      "No continuation is available for this view. Use deepline billing ledger export all --json for the full ledger."
     ] : []
   ];
   printCommandEnvelope(
     {
       ...payload,
+      recent: {
+        ...recent,
+        is_truncated: recent.has_more === true || recent.incomplete === true
+      },
+      next: { page: nextPage },
       render: { sections: [{ title: "billing usage", lines }] }
     },
     { json: options.json }
@@ -9678,6 +10120,39 @@ async function handleLimitOff(options) {
     { json: options.json }
   );
 }
+async function exportLedger(http, outputPath, options) {
+  let summary = { row_count: 0, net_delta_credits: 0 };
+  let initialized = false;
+  for await (const entries of iterateCursorPages(async (cursor) => {
+    const params = new URLSearchParams({ limit: "5000" });
+    if (cursor) params.set("cursor", cursor);
+    if (options.sinceAt !== null)
+      params.set("since_at", String(options.sinceAt));
+    if (options.runId) params.set("run_id", options.runId);
+    if (options.operation) params.set("operation", options.operation);
+    const payload = await http.get(
+      `/api/v2/billing/ledger?${params.toString()}`
+    );
+    if (!Array.isArray(payload.entries) || typeof payload.has_more !== "boolean") {
+      throw new Error("Billing ledger response is missing entries");
+    }
+    return {
+      items: payload.entries,
+      hasMore: payload.has_more === true,
+      cursor: typeof payload.next_cursor === "string" ? payload.next_cursor : null
+    };
+  })) {
+    if (!initialized) {
+      await mkdir2(dirname6(outputPath), { recursive: true });
+      await writeFile2(outputPath, ledgerRowsToCsv([], true), "utf-8");
+      initialized = true;
+    }
+    const rows = entries.map(ledgerApiEntryToRow);
+    await appendFile(outputPath, ledgerRowsToCsv(rows, false), "utf-8");
+    summary = summarizeLedgerRows(summary, rows);
+  }
+  return summary;
+}
 async function handleHistory(options) {
   const { http } = getAuthedHttpClient();
   const windows = {
@@ -9687,41 +10162,20 @@ async function handleHistory(options) {
     "1y": 31536e3
   };
   const sinceAt = Math.max(0, Math.floor(Date.now() / 1e3) - windows[options.time]) * 1e3;
-  const entries = [];
-  let cursor = null;
-  while (entries.length < BILLING_HISTORY_EXPORT_LIMIT) {
-    const params = new URLSearchParams({
-      since_at: String(sinceAt),
-      limit: String(BILLING_HISTORY_EXPORT_LIMIT - entries.length)
-    });
-    if (cursor !== null) params.set("cursor", cursor);
-    const payload = await http.get(
-      `/api/v2/billing/ledger?${params.toString()}`
-    );
-    if (Array.isArray(payload.entries)) {
-      entries.push(
-        ...payload.entries.slice(
-          0,
-          BILLING_HISTORY_EXPORT_LIMIT - entries.length
-        )
-      );
-    }
-    const nextCursor = typeof payload.next_cursor === "string" && payload.next_cursor.length > 0 ? payload.next_cursor : null;
-    if (payload.has_more !== true || nextCursor === null) break;
-    if (nextCursor === cursor) {
-      throw new Error("Billing history pagination cursor did not advance");
-    }
-    cursor = nextCursor;
-  }
-  const rows = entries.map(ledgerApiEntryToRow);
-  const outputPath = await writeCsvRowsFile(
-    `billing-history-${options.time}`,
-    rows
+  const outputPath = resolve3(
+    process.cwd(),
+    "deepline",
+    "data",
+    createTimestampedName(`billing-history-${options.time}`, "csv")
   );
+  const summary = await exportLedger(http, outputPath, { sinceAt });
   printCommandEnvelope(
     {
       output_path: outputPath,
-      row_count: rows.length,
+      row_count: summary.row_count,
+      has_more: false,
+      is_truncated: false,
+      next_cursor: null,
       time_window: options.time,
       render: {
         sections: [
@@ -9729,7 +10183,7 @@ async function handleHistory(options) {
             title: "billing history",
             lines: [
               `Billing history written to ${outputPath}`,
-              `${rows.length} row(s) exported.`
+              `${summary.row_count} row(s) exported.`
             ]
           }
         ]
@@ -9754,40 +10208,18 @@ async function handleLedgerExportAll(options) {
   }
   const { http } = getAuthedHttpClient();
   const outputPath = options.output ? resolve3(String(options.output)) : defaultLedgerExportPath();
-  let summary = { row_count: 0, net_delta_credits: 0 };
-  let cursor = null;
-  let initializedOutput = false;
-  for (; ; ) {
-    const params = new URLSearchParams({ limit: "5000" });
-    if (cursor !== null) params.set("cursor", cursor);
-    if (options.runId) params.set("run_id", options.runId);
-    if (options.operation) params.set("operation", options.operation);
-    if (sinceAt !== null) params.set("since_at", String(sinceAt));
-    const payload = await http.get(
-      `/api/v2/billing/ledger?${params.toString()}`
-    );
-    const entries = Array.isArray(payload.entries) ? payload.entries : [];
-    const rows = entries.map(ledgerApiEntryToRow);
-    if (!initializedOutput) {
-      await mkdir2(dirname6(outputPath), { recursive: true });
-      await writeFile2(outputPath, ledgerRowsToCsv([], true), "utf-8");
-      initializedOutput = true;
-    }
-    if (rows.length > 0) {
-      await appendFile(outputPath, ledgerRowsToCsv(rows, false), "utf-8");
-      summary = summarizeLedgerRows(summary, rows);
-    }
-    const nextCursor = typeof payload.next_cursor === "string" && payload.next_cursor.length > 0 ? payload.next_cursor : null;
-    if (payload.has_more !== true || nextCursor === null) {
-      break;
-    }
-    if (nextCursor === cursor) break;
-    cursor = nextCursor;
-  }
+  const summary = await exportLedger(http, outputPath, {
+    sinceAt,
+    runId: options.runId,
+    operation: options.operation
+  });
   printCommandEnvelope(
     {
       output_path: outputPath,
       row_count: summary.row_count,
+      has_more: false,
+      is_truncated: false,
+      next_cursor: null,
       net_delta_credits: summary.net_delta_credits,
       scope: "workspace",
       ...options.runId ? { run_id: options.runId } : {},
@@ -10334,12 +10766,12 @@ async function handleBuyCredits(creditsRaw, options) {
   );
 }
 async function handleTargetPlan(planSku, options) {
-  if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "team-v1") {
+  if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "growth-v1" && planSku !== "growth-canary-v1" && planSku !== "team-v1") {
     reportBillingFailure(
       {
         exitCode: 2,
         code: "INVALID_PLAN",
-        message: "Plan must be payg-v1, builder-v1, or team-v1."
+        message: "Plan must be payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1."
       },
       options
     );
@@ -10532,7 +10964,9 @@ Examples:
     `
 Notes:
   Read-only server query that writes a local CSV file. With --json, stdout is a
-  summary containing the output path and row count.
+  summary containing the output path, row count, and completeness metadata.
+  Exports the complete window using bounded pages. For an exact start timestamp:
+  deepline billing ledger export all --since <ISO-8601> --json
 
 Examples:
   deepline billing history --time 1m
@@ -10600,7 +11034,10 @@ Examples:
       "Disable automatic recharge without clearing saved amounts."
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeOff)
   );
-  billing.command("change-plan").description("Start or change the target billing plan.").argument("<plan_sku>", "payg-v1, builder-v1, or team-v1").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
+  billing.command("change-plan").description("Start or change the target billing plan.").argument(
+    "<plan_sku>",
+    "payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1"
+  ).option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
   billing.command("cancel-plan").description("Cancel a target subscription at period end, or undo it.").option("--undo", "Undo a pending period-end cancellation").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlanCancellation);
   billing.command("portal").description("Open the Stripe-hosted billing recovery portal.").option("--no-open", "Print the URL without opening a browser").option("--json", "Emit JSON output").action(handleTargetPortal);
   billing.command("plans").description("Show published plans and the plan you are on.").addHelpText(
@@ -10894,6 +11331,12 @@ function mergeCanonicalRowsInfo(left, right) {
   const exportUnavailableReason = left.exportUnavailableReason === "shared_table_namespace" || right.exportUnavailableReason === "shared_table_namespace" ? "shared_table_namespace" : left.exportUnavailableReason ?? right.exportUnavailableReason;
   const unavailableSource = left.exportUnavailableReason === exportUnavailableReason ? left : right.exportUnavailableReason === exportUnavailableReason ? right : null;
   const columns = preferred.columns.length > 0 ? preferred.columns : fallback.columns;
+  const recoveredReturnPaths2 = [
+    .../* @__PURE__ */ new Set([
+      ...left.recoveredReturnPaths ?? [],
+      ...right.recoveredReturnPaths ?? []
+    ])
+  ];
   return {
     ...fallback,
     ...preferred,
@@ -10906,6 +11349,7 @@ function mergeCanonicalRowsInfo(left, right) {
     datasetId: preferred.datasetId ?? fallback.datasetId,
     tableNamespace: preferred.tableNamespace ?? fallback.tableNamespace,
     ...left.recovered || right.recovered ? { recovered: true } : {},
+    ...recoveredReturnPaths2.length ? { recoveredReturnPaths: recoveredReturnPaths2 } : {},
     ...exportUnavailableReason ? {
       exportUnavailableReason,
       ...unavailableSource?.exportUnavailableMessage ? {
@@ -10966,6 +11410,16 @@ function isSerializedDataset(value) {
 function isPackagedDatasetOutput(value) {
   return isRecord8(value) && value.kind === "dataset" && isRecord8(value.preview) && Array.isArray(value.preview.rows);
 }
+function recoveredReturnPaths(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.filter(
+        (path) => typeof path === "string" && /^result\.[A-Za-z_$][A-Za-z0-9_$]*$/.test(path)
+      ).slice(0, 200)
+    )
+  ];
+}
 function pathParts(path) {
   return path.split(".").map((part) => part.trim()).filter(Boolean);
 }
@@ -11062,6 +11516,11 @@ function canonicalRowsInfoFromCandidate(input2) {
       datasetId: typeof candidate.value.datasetId === "string" ? candidate.value.datasetId : null,
       tableNamespace: typeof candidate.value.tableNamespace === "string" ? candidate.value.tableNamespace : null,
       ...candidate.value.recovered === true ? { recovered: true } : {},
+      ...recoveredReturnPaths(candidate.value.recoveredReturnPaths).length ? {
+        recoveredReturnPaths: recoveredReturnPaths(
+          candidate.value.recoveredReturnPaths
+        )
+      } : {},
       ...isRecord8(candidate.value.exportUnavailable) && (candidate.value.exportUnavailable.reason === "empty_dataset" || candidate.value.exportUnavailable.reason === "shared_table_namespace") ? {
         exportUnavailableReason: candidate.value.exportUnavailable.reason,
         ...typeof candidate.value.exportUnavailable.message === "string" ? {
@@ -15217,6 +15676,82 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "Unsupported legacy child-workflow timeout.",
     errorMessage: "ctx.runPlay timeoutMs is unsupported because child Plays execute inline."
   },
+  "ctx.runPlayAsync.key": {
+    schema: Type.String({ minLength: 1 }),
+    fixtures: {
+      valid: "request-approval",
+      invalid: "",
+      absent: void 0,
+      unresolved: { expression: "callKey" },
+      edition1: "request-approval"
+    },
+    referenceType: "string",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Stable identity for one independent child Play Run.",
+    errorMessage: "ctx.runPlayAsync key must be a non-empty string."
+  },
+  "ctx.runPlayAsync.playRef": {
+    schema: Type.Union([
+      Type.String({ minLength: 1 }),
+      Type.Union([
+        Type.Object(
+          { playName: Type.String({ minLength: 1 }) },
+          { additionalProperties: true }
+        ),
+        Type.Object(
+          { name: Type.String({ minLength: 1 }) },
+          { additionalProperties: true }
+        )
+      ])
+    ]),
+    fixtures: {
+      valid: "request-approval",
+      invalid: {},
+      absent: void 0,
+      unresolved: { expression: "playRef" },
+      edition1: "request-approval"
+    },
+    referenceType: "string | PlayReferenceLike",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Independently published scalar child Play name or strongly typed definition handle.",
+    errorMessage: "ctx.runPlayAsync playRef must be a non-empty Play name or definition handle."
+  },
+  "ctx.runPlayAsync.input": {
+    schema: Type.Record(Type.String(), Type.Unknown()),
+    fixtures: {
+      valid: { draftId: "draft-1" },
+      invalid: "draft-1",
+      absent: void 0,
+      unresolved: "childInput",
+      edition1: {}
+    },
+    referenceType: "Record<string, unknown>",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Scalar input object submitted to the independent child Run.",
+    errorMessage: "ctx.runPlayAsync input must be an object."
+  },
+  "ctx.runPlayAsync.options.description": {
+    schema: Type.String({ minLength: 1 }),
+    fixtures: {
+      valid: "Request approval.",
+      invalid: "",
+      absent: void 0,
+      unresolved: { expression: "description" },
+      edition1: "Request approval."
+    },
+    referenceType: "string",
+    required: true,
+    resolution: "runtime-dynamic",
+    issueCode: "play_authoring_run_play_option_invalid",
+    description: "Non-empty purpose for one independent child Play Run.",
+    errorMessage: "ctx.runPlayAsync options.description must be non-empty."
+  },
   "runtime.timeout": {
     schema: Type.String({ pattern: "^\\d+\\s*[mh]$" }),
     fixtures: {
@@ -15504,6 +16039,10 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `export type CsvOptions = { description?: ${cloudReferenceType("ctx.csv.options.description")}; columns?: ${cloudReferenceType("ctx.csv.options.columns")}; rename?: ${cloudReferenceType("ctx.csv.options.rename")}; required?: ${cloudReferenceType("ctx.csv.options.required")} };`,
   "export type PlayCallExecution = 'inline';",
   `export type PlayCallOptions = { description: ${cloudReferenceType("ctx.runPlay.options.description")}; execution?: ${cloudReferenceType("ctx.runPlay.options.execution")}; timeoutMs?: ${cloudReferenceType("ctx.runPlay.options.timeoutMs")} };`,
+  `export type PlayAsyncCallOptions = { description: ${cloudReferenceType("ctx.runPlayAsync.options.description")} };`,
+  "declare const PLAY_RUN_ID_BRAND: unique symbol;",
+  "export type PlayRunId = string & { readonly [PLAY_RUN_ID_BRAND]: 'PlayRunId' };",
+  "export type AsyncPlayRunRef = Readonly<{ runId: PlayRunId }>;",
   `export type RuntimeStepOptions = { semanticKey?: ${cloudReferenceType("ctx.step.semanticKey")}; staleAfterSeconds?: ${cloudReferenceType("ctx.step.staleAfterSeconds")} };`,
   `export type FetchOptions = { staleAfterSeconds?: ${cloudReferenceType("ctx.fetch.staleAfterSeconds")}; transient?: boolean };`,
   "export type PlayFetchResponse = { ok: boolean; status: number; statusText: string; url: string; headers: Record<string, string>; bodyText: string; json: unknown | null };",
@@ -15529,11 +16068,11 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  withColumn<Name extends string, Value>(name: Name, definition: DatasetColumnDefinition<OutputRow, Value> & { readonly runIf: (row: OutputRow, index: number) => boolean | Promise<boolean> }): DatasetBuilder<InputRow, OutputRow & Record<Name, Value | null>>;",
   "  withColumn<Name extends string, Value>(name: Name, definition: DatasetColumnDefinition<OutputRow, Value>): DatasetBuilder<InputRow, OutputRow & Record<Name, Value>>;",
   "  withColumn<Name extends string, Value>(name: Name, resolver: StepResolver<OutputRow, Value> | RunnableColumnStepProgram<Value>, options: StepOptions<OutputRow, Value>): DatasetBuilder<InputRow, OutputRow & Record<Name, Value | null>>;",
-  "  withColumns<Program extends StepProgram<OutputRow, object, unknown>>(program: Program): DatasetBuilder<InputRow, StepProgramOutput<Program>>;",
+  "  withColumns<ProgramOutput extends OutputRow, Return>(program: StepProgram<OutputRow, ProgramOutput, Return>): DatasetBuilder<InputRow, ProgramOutput>;",
   "  step<Name extends string, Value>(name: Name, resolver: ColumnResolver<OutputRow, Value>): never;",
   "  run(options?: DatasetRunOptions<InputRow>): Promise<PlayDataset<OutputRow>>;",
   "};",
-  "export type PlayReferenceLike = { readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string };",
+  "export type PlayReferenceLike<TInput extends Record<string, unknown> = Record<string, unknown>> = ({ readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string }) & { readonly __inputType?: TInput };",
   "export interface DeeplinePlayRuntimeContext {",
   "  csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;",
   "  dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;",
@@ -15547,6 +16086,8 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
+  "  runPlayAsync<TInput extends Record<string, unknown>>(key: string, playRef: PlayReferenceLike<TInput>, input: NoInfer<TInput>, options: PlayAsyncCallOptions): Promise<AsyncPlayRunRef>;",
+  "  runPlayAsync(key: string, playRef: string, input: Record<string, unknown>, options: PlayAsyncCallOptions): Promise<AsyncPlayRunRef>;",
   "  log(message: string, options?: { level?: 'debug' | 'info' | 'warn' | 'error' }): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
   "}",
@@ -15821,7 +16362,7 @@ function collectInlineSecretFindings(sourceCode) {
 var MAX_PLAY_BUNDLE_BYTES = 30 * 1024 * 1024;
 
 // ../plays/bundling/index.ts
-var PLAY_BUNDLE_CACHE_VERSION = 36;
+var PLAY_BUNDLE_CACHE_VERSION = 37;
 var PLAY_ARTIFACT_CACHE_DIR = join7(
   tmpdir2(),
   `deepline-play-artifacts-v${PLAY_BUNDLE_CACHE_VERSION}`
@@ -16560,7 +17101,7 @@ var RunDataset = class _RunDataset {
     return this.#info.exportUnavailableMessage;
   }
   matches(path) {
-    return this.source === path || this.datasetId === path || this.tableNamespace === path;
+    return this.source === path || this.datasetId === path || this.tableNamespace === path || this.#info.recoveredReturnPaths?.includes(path) === true;
   }
   /** Return a new Handle when its preview has been replaced by fetched rows. */
   withRows(info) {
@@ -17070,7 +17611,7 @@ function resolveDaytonaSandboxComputeItem(input2) {
   };
 }
 
-// ../../shared_libs/billing/compute-pricing.ts
+// ../billing/compute-pricing-contract.ts
 var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
 var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
 var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
@@ -17405,6 +17946,39 @@ var PLAY_RUN_RESERVED_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "--open",
   "--debug-map-latency"
 ]);
+var PLAY_RUN_HEADER_FLAG_USAGE = `--header requires "<name>: <value>", for example: --header 'x-deepline-absurd-release: 2026-09-07.1'`;
+var HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+function parsePlayRunHeaderFlag(raw) {
+  const separator = raw.indexOf(":");
+  if (separator < 0) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Got ${JSON.stringify(raw)} with no ":" separator.`
+    );
+  }
+  const name = raw.slice(0, separator).trim().toLowerCase();
+  const value = raw.slice(separator + 1).trim();
+  if (!name) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Got ${JSON.stringify(raw)} with an empty header name.`
+    );
+  }
+  if (!HTTP_HEADER_NAME_PATTERN.test(name)) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. ${JSON.stringify(name)} is not a valid HTTP header name.`
+    );
+  }
+  if (!value) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Header ${JSON.stringify(name)} was given an empty value.`
+    );
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      `${PLAY_RUN_HEADER_FLAG_USAGE}. Header ${JSON.stringify(name)} contains a control character.`
+    );
+  }
+  return { name, value };
+}
 function isBarePlayRunDebugFlag(args, index) {
   return args[index] === "--debug" && (args[index + 1] === void 0 || args[index + 1].startsWith("--"));
 }
@@ -19018,6 +19592,9 @@ function assertPlayWaitNotTimedOut(input2) {
   }
 }
 var PLAY_DURABLE_STATUS_PROBE_INTERVAL_MS = 15e3;
+function isAdmittedRunVisibilityDelay(error) {
+  return error instanceof DeeplineError && error.statusCode === 404 && error.message.trim() === "Workflow run not found.";
+}
 async function waitForPlayCompletionByStream(input2) {
   let lastPhase = null;
   let reconnectAttempt = 0;
@@ -19031,7 +19608,7 @@ async function waitForPlayCompletionByStream(input2) {
         billing: false
       });
     } catch (error) {
-      if (isTransientPlayStreamError(error)) {
+      if (isTransientPlayStreamError(error) || isAdmittedRunVisibilityDelay(error)) {
         return null;
       }
       throw error;
@@ -19142,7 +19719,7 @@ async function waitForPlayCompletionByStream(input2) {
       if (timedOut) {
         return { kind: "timed_out", sawEvent };
       }
-      if (!isTransientPlayStreamError(error)) {
+      if (!isTransientPlayStreamError(error) && !isAdmittedRunVisibilityDelay(error)) {
         throw error;
       }
       return {
@@ -19310,6 +19887,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input2) {
             runId: workflowId,
             playName: input2.playName,
             dashboardUrl,
+            inputFieldCount: Object.keys(input2.request.input ?? {}).length,
             jsonOutput: false,
             progress: input2.progress
           });
@@ -21378,7 +21956,7 @@ function writeStartedPlayRun(input2) {
   );
 }
 function parsePlayRunOptions(args) {
-  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--json] [--full] [--<input> value]\n       Runs use the Absurd CJS runtime.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
+  const usage = "Usage: deepline plays run <play-name> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run <play-file.ts> [--input '{...}'] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --file <play-file.ts> [--input '{...}'] [--profile <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--full] [--<input> value]\n       deepline plays run --name <name> [--input '{...}'] [--profile <id>] [--live|--latest|--revision-id <id>] [--run-id-file <path>] [--no-wait] [--tail-timeout-ms 30000] [--force] [--open] [--json] [--full] [--<input> value]\n       Runs use the Absurd CJS runtime.\n       --header '<name>: <value>' may repeat; each is sent on every request for this run.\n       Unknown --<input> value flags, such as --limit 5, are passed into play input.\nRun `deepline plays run --help` for idempotent call caching and ctx.dataset guidance.";
   let filePath = null;
   let playName = null;
   let input2 = null;
@@ -21399,8 +21977,20 @@ function parsePlayRunOptions(args) {
   let profile = null;
   let fixtureBehavior = null;
   let runIdFile = null;
+  let headers = null;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
+    if (arg === "--header" || arg.startsWith("--header=")) {
+      const raw = arg === "--header" ? args[index + 1] : arg.slice("--header=".length);
+      if (raw === void 0 || arg === "--header" && raw.startsWith("--")) {
+        throw new Error(`${PLAY_RUN_HEADER_FLAG_USAGE}. No value was given.`);
+      }
+      const header = parsePlayRunHeaderFlag(raw);
+      headers ??= {};
+      headers[header.name] = header.value;
+      if (arg === "--header") index += 1;
+      continue;
+    }
     if (arg === "--file" && args[index + 1]) {
       filePath = args[++index];
       continue;
@@ -21639,7 +22229,8 @@ function parsePlayRunOptions(args) {
     profile,
     debugMapLatency,
     fixtureBehavior,
-    runIdFile
+    runIdFile,
+    headers
   };
 }
 function parsePlayCheckOptions(args) {
@@ -22395,11 +22986,14 @@ function printPlayCheckOutcomes(outcomes, target) {
     printPlayCheckOutcome(outcome, target, `[${outcome.exportName}] `);
   }
 }
+function playRunClientOptions(options) {
+  return options.headers ? { headers: options.headers } : void 0;
+}
 async function handleFileBackedRun(options, hooks) {
   if (options.target.kind !== "file") {
     throw new Error("Expected a file-backed play run target.");
   }
-  const client2 = new DeeplineClient();
+  const client2 = new DeeplineClient(playRunClientOptions(options));
   const progress = getActiveCliProgress() ?? createCliProgress(!options.jsonOutput);
   const absolutePlayPath = resolve11(options.target.path);
   progress.phase("compiling play");
@@ -22607,7 +23201,7 @@ async function handleNamedRun(options, hooks) {
   if (options.target.kind !== "name") {
     throw new Error("Expected a named play run target.");
   }
-  const client2 = new DeeplineClient();
+  const client2 = new DeeplineClient(playRunClientOptions(options));
   const progress = getActiveCliProgress() ?? createCliProgress(!options.jsonOutput);
   const playName = options.target.name;
   const runtimeInput = options.input ? { ...options.input } : {};
@@ -22937,12 +23531,13 @@ async function handleRunsList(args) {
     return 1;
   }
   const client2 = new DeeplineClient();
-  const runs = (await client2.runs.list({
+  const page = await client2.runs.listPage({
     ...playName ? { play: playName } : {},
     ...statusFilter ? { status: statusFilter } : {},
     ...limit !== void 0 ? { limit } : {},
     ...offset !== void 0 ? { offset } : {}
-  })).map((run) => ({
+  });
+  const runs = page.runs.map((run) => ({
     runId: run.workflowId,
     // `workflowId` is the legacy SDK name for the same public Deepline run
     // identity. Keep it during the compatibility window, but never label the
@@ -22980,11 +23575,24 @@ async function handleRunsList(args) {
     if (run.rootRunId) lines2.push(`  root: ${run.rootRunId}`);
     return lines2.join("\n");
   });
+  const nextOffset = (page.offset ?? offset ?? 0) + runs.length;
+  const nextPage = page.hasMore && playName ? `deepline runs list --play ${shellQuote2(playName)}${statusFilter ? ` --status ${shellQuote2(statusFilter)}` : ""} --limit ${page.limit ?? limit ?? 20} --offset ${nextOffset} --json` : null;
+  if (page.hasMore) {
+    lines.push("List truncated \u2014 more runs match this filter.");
+    lines.push(
+      nextPage ? `Next page: ${nextPage}` : "Narrow with --play <play-name> to page through runs."
+    );
+  }
   printCommandEnvelope(
     {
       runs,
       count: runs.length,
+      ...page.total !== void 0 ? { total: page.total } : {},
+      offset: page.offset ?? offset ?? 0,
+      limit: page.limit ?? limit ?? (playName ? 20 : 100),
+      ...page.hasMore !== void 0 ? { has_more: page.hasMore, is_truncated: page.hasMore } : {},
       next: {
+        page: nextPage,
         get: runs[0]?.runId ? `deepline runs get ${runs[0].runId} --json` : null
       },
       render: { sections: [{ title: "runs", lines }] }
@@ -23632,23 +24240,47 @@ async function handlePlayVersions(args) {
   }
   return 0;
 }
+function formatPlayCostEstimate(estimate) {
+  if (!estimate || estimate.status === "unavailable") {
+    return `unavailable${estimate ? `: ${estimate.message}` : ""}`;
+  }
+  const formatCredits = (value) => value.toLocaleString("en-US", {
+    maximumFractionDigits: value < 1 ? 4 : 2
+  });
+  const credits = estimate.lowCredits === estimate.highCredits ? `${estimate.source === "observed" ? "~" : ""}${formatCredits(estimate.lowCredits)}` : `${formatCredits(estimate.lowCredits)}\u2013${formatCredits(estimate.highCredits)}`;
+  const unit = estimate.unit === "row" ? "output row" : "run";
+  const source = estimate.source === "observed" ? `observed from ${estimate.sampleRunCount} ${estimate.sampleRunCount === 1 ? "run" : "runs"}` : "static estimate";
+  return `${credits} Deepline credits per ${unit} (${source})`;
+}
 async function handlePlayList(args) {
   const jsonOutput = argsWantJson(args);
+  const showCost = args.includes("--show-cost");
   const client2 = new DeeplineClient();
   const categoriesIndex = args.indexOf("--categories");
   const categories = categoriesIndex >= 0 ? args[categoriesIndex + 1]?.trim() : void 0;
-  const plays = await client2.listPlays({
+  const limitIndex = args.indexOf("--limit");
+  const cursorIndex = args.indexOf("--cursor");
+  const limit = limitIndex >= 0 ? Number(args[limitIndex + 1]) : void 0;
+  const cursor = cursorIndex >= 0 ? args[cursorIndex + 1] : void 0;
+  if (limitIndex >= 0 && (!Number.isSafeInteger(limit) || limit < 1) || cursorIndex >= 0 && !cursor?.trim()) {
+    console.error("Pass a positive --limit and a non-empty --cursor.");
+    return 2;
+  }
+  const page = await client2.listPlaysPage({
     categories,
-    includeToolCategories: true
-  });
-  if (jsonOutput) {
-    process.stdout.write(`${JSON.stringify(plays)}
-`);
-    return 0;
+    includeToolCategories: true,
+    ...showCost ? { includeCostEstimates: true } : {},
+    limit,
+    cursor
+  });
+  const plays = page.plays;
+  const nextPage = page.hasMore && page.cursor ? `deepline plays list${categories ? ` --categories ${shellQuote2(categories)}` : ""}${limit ? ` --limit ${limit}` : ""}${showCost ? " --show-cost" : ""} --cursor ${shellQuote2(page.cursor)} --json` : null;
+  if (page.hasMore && !nextPage) {
+    throw new Error(
+      "Play list reported more results without a continuation cursor"
+    );
   }
-  process.stdout.write(`${plays.length} plays available:
-
-`);
+  const lines = [`${plays.length} plays in this page:`];
   for (const play of plays) {
     const flags = [
       play.pinned ? "pinned" : null,
@@ -23658,32 +24290,48 @@ async function handlePlayList(args) {
       play.isDraftDirty ? "draft-dirty" : null
     ].filter(Boolean).join(", ");
     const reference = formatPlayListReference(play);
-    process.stdout.write(`  ${reference}${flags ? ` [${flags}]` : ""}
-`);
+    lines.push(`  ${reference}${flags ? ` [${flags}]` : ""}`);
     if (play.inputSchema || play.hasInputSchema) {
-      process.stdout.write("    inputSchema: yes\n");
+      lines.push("    inputSchema: yes");
     }
     if (play.triggerStatus?.cron) {
-      process.stdout.write(
-        `    scheduled execution: ${cronExecutionLabel(play.triggerStatus.cron)}
-`
+      lines.push(
+        `    scheduled execution: ${cronExecutionLabel(play.triggerStatus.cron)}`
       );
       if (play.triggerStatus.blockedReason) {
-        process.stdout.write(
-          `    schedule issue: ${play.triggerStatus.blockedReason}
-`
-        );
+        lines.push(`    schedule issue: ${play.triggerStatus.blockedReason}`);
       }
     } else {
-      process.stdout.write("    scheduled execution: not configured\n");
+      lines.push("    scheduled execution: not configured");
     }
     if (play.triggerStatus?.webhook) {
-      process.stdout.write(`    webhook: ${play.triggerStatus.webhook}
-`);
+      lines.push(`    webhook: ${play.triggerStatus.webhook}`);
     }
-    process.stdout.write(`    run: deepline plays run ${reference} --watch
-`);
+    if (showCost) {
+      lines.push(
+        `    cost estimate: ${formatPlayCostEstimate(play.costEstimate)}`
+      );
+    }
+    lines.push(`    run: deepline plays run ${reference} --watch`);
+  }
+  if (page.hasMore) {
+    lines.push("List truncated \u2014 more plays are available.");
+    lines.push(`Next page: ${nextPage}`);
   }
+  printCommandEnvelope(
+    {
+      plays,
+      count: plays.length,
+      has_more: page.hasMore,
+      is_truncated: page.hasMore,
+      next_cursor: page.cursor,
+      next: { page: nextPage },
+      render: {
+        sections: [{ title: "plays", lines }]
+      }
+    },
+    { json: jsonOutput }
+  );
   return 0;
 }
 async function handlePlayPin(args, pinned) {
@@ -23947,76 +24595,23 @@ async function handlePlaySearch(args) {
   }
   return 0;
 }
-function normalizePlayGrepText(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "string") return value.toLowerCase();
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value).toLowerCase();
-  }
-  if (Array.isArray(value)) return value.map(normalizePlayGrepText).join(" ");
-  if (typeof value === "object") {
-    return Object.values(value).map(normalizePlayGrepText).join(" ");
-  }
-  return "";
-}
-function parsePlayGrepTerms(query, mode) {
-  const trimmed = query.trim().toLowerCase();
-  if (!trimmed) return [];
-  if (mode === "phrase") return [trimmed];
-  const matches = trimmed.match(/"([^"]+)"|'([^']+)'|\S+/g) ?? [];
-  return matches.map((term) => term.replace(/^["']|["']$/g, "").trim()).filter(Boolean);
-}
-function matchesPlayGrepQuery(value, query, mode) {
-  const terms = parsePlayGrepTerms(query, mode);
-  if (terms.length === 0) return true;
-  const haystack = normalizePlayGrepText(value);
-  if (mode === "any") return terms.some((term) => haystack.includes(term));
-  return terms.every((term) => haystack.includes(term));
-}
 async function handlePlayGrep(args) {
   const query = args[0]?.trim();
   if (!query) {
-    console.error(
-      "Usage: deepline plays grep <query> [--mode all|any|phrase] [--compact] [--json]"
-    );
+    console.error("Usage: deepline plays grep <query> [--compact] [--json]");
     return 1;
   }
-  let mode = "all";
-  for (let index = 1; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--mode" && args[index + 1]) {
-      const rawMode = args[++index].trim().toLowerCase();
-      mode = rawMode === "any" || rawMode === "phrase" ? rawMode : "all";
-    }
-  }
   const compact = args.includes("--compact");
   const client2 = new DeeplineClient();
-  const plays = (await client2.listPlays({
-    grep: query,
-    grepMode: mode
-  })).filter(
-    (play) => matchesPlayGrepQuery(
-      {
-        name: play.name,
-        reference: play.reference,
-        displayName: play.displayName,
-        origin: play.origin,
-        ownerType: play.ownerType,
-        aliases: play.aliases,
-        toolCategories: play.toolCategories,
-        inputSchema: play.inputSchema,
-        outputSchema: play.outputSchema
-      },
-      query,
-      mode
-    )
-  ).map((play) => summarizePlayListItemForCli(play, { compact }));
+  const plays = (await client2.listPlays({ grep: query })).map(
+    (play) => summarizePlayListItemForCli(play, { compact })
+  );
   if (argsWantJson(args)) {
     printCompactJson({
       plays,
       count: plays.length,
       query,
-      grep: { mode, terms: parsePlayGrepTerms(query, mode) }
+      grep: { engine: "convex_full_text" }
     });
     return 0;
   }
@@ -24724,7 +25319,7 @@ Pass-through input flags:
     if (effectiveTarget && passthroughArgs[0] === effectiveTarget) {
       passthroughArgs.shift();
     }
-    process.exitCode = await handlePlayRun([
+    const exitCode = await handlePlayRun([
       ...effectiveTarget ? [effectiveTarget] : [],
       ...options.file ? ["--file", options.file] : [],
       ...options.name ? ["--name", options.name] : [],
@@ -24754,6 +25349,11 @@ Pass-through input flags:
       ...options.full ? ["--full"] : [],
       ...passthroughArgs
     ]);
+    recordCliTrace({
+      phase: "cli.play_command_exit",
+      exitCode
+    });
+    process.exitCode = exitCode;
   });
   registerPlayBootstrapCommand(play);
   play.command("get <target>").description(
@@ -24795,17 +25395,22 @@ Examples:
     `
 Notes:
   Inventory command for saved org plays and prebuilt plays. Use search for
-  ranked discovery by task or schema.
+  ranked discovery by task or schema. Returns one bounded page with has_more,
+  is_truncated, next_cursor, and a next-page command. Use --limit to choose
+  the page size and --cursor to continue with the same filters.
 
 Examples:
   deepline plays list
   deepline plays search email --json
 `
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
+  ).option("--limit <count>", "Page size").option("--cursor <cursor>", "Continue a previous page").option("--show-cost", "Include the per-row or per-run cost estimate").option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
     "--categories <categories>",
     "Filter by comma-separated canonical tool categories"
   ).action(async (options) => {
     process.exitCode = await handlePlayList([
+      ...options.limit ? ["--limit", options.limit] : [],
+      ...options.cursor ? ["--cursor", options.cursor] : [],
+      ...options.showCost ? ["--show-cost"] : [],
       ...options.categories ? ["--categories", options.categories] : [],
       ...options.json ? ["--json"] : []
     ]);
@@ -24844,8 +25449,8 @@ Notes:
   because they are trusted, robust plays with maintained contracts. Use describe
   on a result before running it.
   Add --all only when you are specifically looking for a play you created.
-  The grep alias is the same ranked retrieval surface with a more literal name
-  for agents that are filtering the play registry.
+  Use plays grep to search active org-owned Plays through Convex's indexed
+  authored corpus. It does not search prebuilt or archived Plays.
 
 Examples:
   deepline plays search email
@@ -24863,25 +25468,24 @@ Examples:
     ]);
   });
   addPlaySearchCommand(play.command("search <query>"));
-  play.command("grep <query>").description("Literal grep over play names, schemas, and descriptions.").addHelpText(
+  play.command("grep <query>").description(
+    "Search active org-owned Plays through Convex full-text search."
+  ).addHelpText(
     "after",
     `
 Notes:
-  Literal registry filtering. Terms are matched case-insensitively against play
-  names, references, display names, ownership, and schemas. Use
-  --mode phrase for exact phrase matching, --mode any for OR, and the default
-  --mode all for AND.
+  Queries use Convex token semantics over the indexed authored Play corpus.
+  Prebuilt and archived Plays are not part of this index.
 
 Examples:
   deepline plays grep email --json
-  deepline plays grep "company contact" --mode all --json
+  deepline plays grep "company contact" --compact --json
   deepline plays describe prebuilt/company-to-contact --json
 `
-  ).option("--compact", "Emit compact schemas").option("--mode <mode>", "Grep matching mode: all, any, or phrase").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
+  ).option("--compact", "Emit compact schemas").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
     process.exitCode = await handlePlayGrep([
       query,
       ...options.compact ? ["--compact"] : [],
-      ...options.mode ? ["--mode", options.mode] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
@@ -30479,7 +31083,7 @@ async function compileConfig(input2) {
   })).config;
 }
 function registerEnrichCommand(program) {
-  program.command("enrich").allowUnknownOption(true).description("Run v1-style CSV enrichment through the V2 play runner.").configureHelp({
+  program.command("enrich", { hidden: true }).allowUnknownOption(true).description("Run v1-style CSV enrichment through the V2 play runner.").configureHelp({
     optionTerm(option) {
       return option.long === "--timeout" ? "--timeout SECONDS" : option.flags;
     }
@@ -31542,7 +32146,7 @@ function loadViewerAssets() {
         "viewer"
       )
     ] : [],
-    join12(process.cwd(), "src", "lib", "cli", "viewer")
+    join12(process.cwd(), "apps", "deepline-api", "src", "lib", "cli", "viewer")
   ];
   for (const root of candidateRoots2) {
     try {
@@ -31759,7 +32363,7 @@ function addDeprecatedSubcommand(parent, family, subcommand, description) {
   });
 }
 function registerDeprecatedCommands(program) {
-  const session = program.command("session").description("Deprecated legacy session command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
+  const session = program.command("session", { hidden: true }).description("Deprecated legacy session command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
     "after",
     `
 Notes:
@@ -31791,7 +32395,7 @@ Examples:
       `Deprecated legacy "deepline session ${subcommand}" command.`
     );
   }
-  const backend = program.command("backend").description("Deprecated legacy local backend command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
+  const backend = program.command("backend", { hidden: true }).description("Deprecated legacy local backend command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
     "after",
     `
 Notes:
@@ -32702,7 +33306,7 @@ function renderDeployedListText(payload, requestedStatus) {
   }
   const applied = asString(payload.status_filter_applied) ?? requestedStatus ?? "active";
   lines.push(
-    `Status filter: ${applied}${requestedStatus === void 0 && applied === "active" ? " (default)" : ""} \u2014 use --status all to include disabled monitors.`
+    `Status filter: ${applied}${requestedStatus === void 0 && applied === "active" ? " (default)" : ""} \u2014 use --status all to include inactive monitors.`
   );
   const summary = Array.isArray(payload.status_summary) ? payload.status_summary.flatMap((raw) => {
     const item = asRecord2(raw);
@@ -32710,7 +33314,7 @@ function renderDeployedListText(payload, requestedStatus) {
     const count = item ? asFiniteNumber(item.count) : void 0;
     return status && count !== void 0 ? [`${status}: ${count}`] : [];
   }).join("  ") : "";
-  if (summary) lines.push(`All lifecycle states: ${summary}`);
+  if (summary) lines.push(`All monitor states: ${summary}`);
   if (payload.has_more === true || payload.is_truncated === true) {
     const nextCursor = asString(payload.next_cursor);
     lines.push(
@@ -33799,11 +34403,16 @@ async function handleMonitorsReactivate(key, options) {
 }
 var MONITOR_VERB_POLL_INTERVAL_MS = 2e3;
 function monitorHealthLine(health) {
+  if (health.refresh?.state === "running") {
+    return `refreshing whole scope \xB7 scanned ${health.scanned} so far`;
+  }
+  const alignmentRequired = health.alignment_required ?? 0;
   return [
     `converged ${health.converged}/${health.scanned}`,
     `needs_repair ${health.needs_repair}`,
     `missing ${health.observed.missing}`,
     `unaudited ${health.observed.unknown + health.observed.unset}`,
+    ...alignmentRequired > 0 ? [`needs_alignment ${alignmentRequired}`] : [],
     `silent ${health.silent}`
   ].join(" \xB7 ");
 }
@@ -33837,7 +34446,11 @@ async function watchMonitorHealth(input2) {
   let last = await input2.client.monitors.health(scope);
   input2.onProgress(last);
   while (Date.now() < deadlineAt) {
-    if (last.needs_repair === 0 && last.observed.unknown === 0) return last;
+    const unresolved = last.observed.unknown + last.observed.unset;
+    const alignmentRequired = last.alignment_required ?? 0;
+    if (last.refresh?.state !== "running" && !last.truncated && last.needs_repair === 0 && (unresolved === 0 || alignmentRequired === unresolved)) {
+      return last;
+    }
     await new Promise(
       (resolve21) => setTimeout(resolve21, MONITOR_VERB_POLL_INTERVAL_MS)
     );
@@ -33847,11 +34460,22 @@ async function watchMonitorHealth(input2) {
   return last;
 }
 function monitorHealthText(health) {
-  const partial = health.truncated ? " (partial \u2014 scope larger than one read)" : "";
+  const partial = health.refresh?.state === "running" ? " (refreshing \u2014 counts below are not final)" : health.truncated ? " (partial \u2014 scope larger than one read)" : "";
+  const unauditedMonitors = health.unaudited_monitors ?? [];
   const lines = [
     `scope: ${health.scope.fleet_id ?? "workspace"}${partial}`,
     monitorHealthLine(health)
   ];
+  if ((health.batch_operations?.length ?? 0) > 0) {
+    lines.push("");
+    lines.push("batch work in progress:");
+    for (const operation of health.batch_operations ?? []) {
+      const retry = operation.next_attempt_at === void 0 ? "" : ` \xB7 next ${new Date(operation.next_attempt_at).toISOString()}`;
+      lines.push(
+        `  ${operation.kind} ${operation.run_id} \xB7 ${operation.state}${retry}`
+      );
+    }
+  }
   if (health.deactivation_reasons.length > 0) {
     lines.push("");
     lines.push("deactivated by Deepline:");
@@ -33860,6 +34484,29 @@ function monitorHealthText(health) {
       lines.push(`  ${entry.reason} (${entry.count})${how}`);
     }
   }
+  if (unauditedMonitors.length > 0) {
+    const reason = {
+      not_yet_audited: "has not been observed yet",
+      missing_provider_resource_id: "has no stored upstream resource id",
+      provider_observation_unknown: "the provider observation is still unknown"
+    };
+    lines.push("");
+    lines.push("unresolved monitor observations:");
+    for (const entry of unauditedMonitors) {
+      lines.push(
+        `  ${entry.monitor_key}  ${entry.tool}  \u2014 ${reason[entry.reason]}`
+      );
+    }
+  }
+  if ((health.alignment_required ?? 0) > 0) {
+    lines.push("");
+    lines.push(
+      `${health.alignment_required} monitor(s) need provider identity alignment; normal repair intentionally will not guess or create a paid replacement.`
+    );
+    lines.push(
+      `Run the exact inventory audit, then review one safe adoption candidate: deepline-admin monitors reconcile ${health.scope.org_id} --monitor <monitor-key> --environment production --json`
+    );
+  }
   if (health.worst_offenders.length > 0) {
     lines.push("");
     lines.push(
@@ -33924,78 +34571,143 @@ async function handleMonitorsAudit(options) {
   );
 }
 async function handleMonitorsRepair(options) {
-  const client2 = new DeeplineClient();
+  return await handleMonitorBatch("repair", {
+    ...options,
+    ...options.fleet?.trim() ? {} : { target: "needs-repair" }
+  });
+}
+async function handleMonitorsHealth(options) {
   const fleetId = options.fleet?.trim() || void 0;
-  const scope = fleetId ? { fleetId } : {};
-  const result = await client2.monitors.repair({
-    ...scope,
-    ...options.dryRun ? { dryRun: true } : {}
+  const health = await new DeeplineClient().monitors.health(
+    fleetId ? { fleetId } : {}
+  );
+  printCommandEnvelope(health, {
+    json: options.json,
+    text: monitorHealthText(health)
   });
-  if (options.dryRun) {
-    assertMonitorDryRunAcknowledged(
-      result,
-      { command: "monitors repair", mutation: "repair" }
+}
+function monitorBatchScope(options, kind) {
+  const selectors = [
+    options.target ? "target" : null,
+    options.fleet?.trim() ? "fleet" : null,
+    options.keys?.trim() ? "keys" : null
+  ].filter((value) => value !== null);
+  if (selectors.length === 0 && kind === "audit") {
+    return { kind: "target", target: "all" };
+  }
+  if (selectors.length !== 1) {
+    throw new MonitorsUsageError(
+      `monitors batch ${kind} needs exactly one selector: --target, --fleet, or --keys.`
     );
   }
-  let health = result.health;
-  if (options.watch && !options.dryRun) {
-    const progress = monitorVerbProgressReporter();
-    try {
-      health = await watchMonitorHealth({
-        client: client2,
-        ...scope,
-        timeoutMs: fleetTimeoutMs(options.timeout),
-        onProgress: progress.report
-      });
-    } finally {
-      progress.finish();
-    }
+  if (options.target) return { kind: "target", target: options.target };
+  if (options.fleet?.trim())
+    return { kind: "fleet", fleetId: options.fleet.trim() };
+  const monitorKeys = (options.keys ?? "").split(",").map((key) => key.trim()).filter(Boolean);
+  if (monitorKeys.length === 0) {
+    throw new MonitorsUsageError(
+      "--keys needs one or more comma-separated monitor keys."
+    );
   }
-  const verb = options.dryRun ? "would queue" : "queued";
-  const lines = [
-    `${verb} ${result.repair.queued} of ${result.repair.scanned} monitors`
-  ];
-  for (const item of result.repair.plan.slice(0, REPAIR_PLAN_PREVIEW)) {
-    const why = item.deactivation_reason ? ` \xB7 ${item.deactivation_reason}` : "";
-    lines.push(
-      `  ${item.action.padEnd(6)} ${item.monitor_key}  desired ${item.desired} \xB7 observed ${item.observed}${why}`
+  return { kind: "keys", monitorKeys };
+}
+function monitorBatchIdempotencyKey(kind, value) {
+  return value?.trim() || `monitor-batch-${kind}-${randomUUID5()}`;
+}
+async function handleMonitorBatchDeploy(options) {
+  if (!options.file?.trim()) {
+    throw new MonitorsUsageError(
+      "monitors batch deploy requires --file <monitors.ndjson>."
     );
   }
-  if (result.repair.plan.length > REPAIR_PLAN_PREVIEW) {
-    lines.push(`  \u2026 ${result.repair.plan.length - REPAIR_PLAN_PREVIEW} more`);
+  if (options.dryRun !== true && options.yes !== true) {
+    throw new MonitorsUsageError(
+      "monitors batch deploy changes provider monitors asynchronously. Preview with --dry-run, then confirm with --yes."
+    );
   }
-  if (result.repair.unaudited.length > 0) {
-    lines.push(
-      `${result.repair.unaudited.length} monitors have never been observed \u2014 run 'deepline monitors audit' first.`
+  let manifestNdjson;
+  try {
+    manifestNdjson = readFileSync11(resolve14(options.file), "utf8");
+  } catch (error) {
+    throw new MonitorsUsageError(
+      `Could not read monitor batch manifest '${options.file}': ${error instanceof Error ? error.message : String(error)}`
     );
   }
-  if (result.repair.unowned.length > 0) {
-    lines.push(
-      `${result.repair.unowned.length} monitors disagree but no fleet owns them; repair those with 'deepline monitors deploy' or 'deepline monitors delete'.`
+  if (!manifestNdjson.trim()) {
+    throw new MonitorsUsageError("Monitor batch manifest is empty.");
+  }
+  const idempotencyKey = monitorBatchIdempotencyKey(
+    "deploy",
+    options.idempotencyKey
+  );
+  const result = await new DeeplineClient().monitors.batch.submit({
+    kind: "deploy",
+    manifestNdjson,
+    dryRun: options.dryRun === true,
+    idempotencyKey
+  });
+  const operation = result.operation;
+  printCommandEnvelope(
+    { ...result, idempotency_key: idempotencyKey },
+    {
+      json: options.json,
+      text: [
+        `${result.rejoined ? "rejoined" : "submitted"} deploy batch ${operation.runId}`,
+        `state ${operation.state} \xB7 retry key ${idempotencyKey}`,
+        `inspect: deepline monitors batch get ${operation.runId} --json`
+      ].join("\n") + "\n"
+    }
+  );
+}
+async function handleMonitorBatch(kind, options) {
+  if ((kind === "deactivate" || kind === "reactivate" || kind === "repair") && options.dryRun !== true && options.yes !== true) {
+    throw new MonitorsUsageError(
+      `monitors batch ${kind} changes provider monitors asynchronously. Preview with --dry-run, then confirm with --yes.`
     );
   }
-  if (result.repair.fenced.length > 0) {
-    lines.push(
-      `${result.repair.fenced.length} monitors have a provider operation in flight; Deepline is finishing those and repair left them alone.`
+  if (kind === "deactivate" && !options.reason?.trim()) {
+    throw new MonitorsUsageError(
+      "monitors batch deactivate requires --reason (for example insufficient_balance or billing_failure)."
     );
   }
-  lines.push("");
-  lines.push(monitorHealthText(health));
+  const idempotencyKey = monitorBatchIdempotencyKey(
+    kind,
+    options.idempotencyKey
+  );
+  const result = await new DeeplineClient().monitors.batch.submit({
+    kind,
+    scope: monitorBatchScope(options, kind),
+    dryRun: options.dryRun === true,
+    ...options.reason?.trim() ? { deactivationReason: options.reason.trim() } : {},
+    idempotencyKey
+  });
+  const operation = result.operation;
+  const text = [
+    `${result.rejoined ? "rejoined" : "submitted"} ${operation.kind} batch ${operation.runId}`,
+    `state ${operation.state} \xB7 retry key ${idempotencyKey}`,
+    `inspect: deepline monitors batch get ${operation.runId} --json`
+  ].join("\n");
   printCommandEnvelope(
-    { ...result, health },
-    { json: options.json, text: lines.join("\n") }
+    { ...result, idempotency_key: idempotencyKey },
+    { json: options.json, text: `${text}
+` }
   );
 }
-var REPAIR_PLAN_PREVIEW = 20;
-async function handleMonitorsHealth(options) {
-  const fleetId = options.fleet?.trim() || void 0;
-  const health = await new DeeplineClient().monitors.health(
-    fleetId ? { fleetId } : {}
-  );
-  printCommandEnvelope(health, {
-    json: options.json,
-    text: monitorHealthText(health)
+async function handleMonitorBatchGet(operationId, options) {
+  const result = await new DeeplineClient().monitors.batch.get(operationId, {
+    ...options.cursor ? { cursor: options.cursor } : {}
   });
+  const summary = result.operation.summary ?? {};
+  const text = [
+    `${result.operation.kind} batch ${result.operation.runId}`,
+    `state ${result.operation.state}`,
+    `progress ${JSON.stringify(summary)}`,
+    ...result.results ? [
+      `results ${result.results.page.length}${result.results.isDone ? "" : " (more; pass --cursor)"}`
+    ] : []
+  ].join("\n");
+  printCommandEnvelope(result, { json: options.json, text: `${text}
+` });
 }
 function registerMonitorsCommands(program) {
   const monitors = program.command("monitors").description("Discover, deploy, and manage Deepline monitors.").showSuggestionAfterError(true).addHelpText(
@@ -34019,9 +34731,8 @@ Exit codes:
 
 Examples:
   deepline monitors status --json
-  deepline monitors available --json          # compact list by default
-  deepline monitors available --full --json   # complete catalog
-  deepline monitors available deepline_native.company_radar --json
+  deepline tools list --categories monitors --json
+  deepline tools get deepline_native.company_radar --json
   deepline monitors check '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'
   deepline monitors deploy --dry-run --file monitor.json
   deepline monitors deploy --file monitor.json
@@ -34060,25 +34771,29 @@ Examples:
   withJsonOption(
     monitors.command("repair").description(
       "Converge the monitors whose desired and observed states disagree."
-    ).option("--fleet <fleet-id>", "Repair one fleet instead of every monitor").option("--dry-run", "Show what would be queued without queueing it").option("--watch", "Keep polling health until the scope settles").option(
-      "--timeout <duration>",
-      "How long --watch waits, e.g. 90s, 5m, 1h (default 10m)"
+    ).option("--fleet <fleet-id>", "Repair one fleet instead of every monitor").option(
+      "--dry-run",
+      "Record the bounded repair plan without provider changes"
+    ).option("--yes", "Confirm the asynchronous provider repair").option(
+      "--idempotency-key <key>",
+      "Stable retry key (generated when omitted)"
     ).addHelpText(
       "after",
       `
 Notes:
-  Queues the monitors that disagree with the provider onto the same convergence
-  loop a fleet sync uses; the provider work happens on Deepline's own schedule.
-  Idempotent \u2014 the queue IS the disagreement, so a repeat run queues only what
-  is still wrong.
+  This is the short spelling of 'monitors batch repair --target needs-repair'.
+  It handles both direct monitors and Fleet members through one durable
+  service-account worker. An active historical monitor without an upstream id
+  is selected for repair; current Convex writes cannot create that state.
 
-  Monitors nobody has observed are never repaired: run 'deepline monitors audit'
-  first. Monitors no fleet owns are reported rather than queued; deploy or delete
-  those directly.
+  It returns a run id immediately. Inspect retained results with
+  'deepline monitors batch get <run-id> --json'. Reuse --idempotency-key after
+  a lost response to rejoin the exact run without another provider request.
 
 Examples:
   deepline monitors repair --dry-run
-  deepline monitors repair --fleet accounts-eu --watch
+  deepline monitors repair --yes
+  deepline monitors repair --fleet accounts-eu --yes --idempotency-key repair-eu-2026-09-09
 `
     )
   ).action(monitorsAction(handleMonitorsRepair));
@@ -34101,6 +34816,75 @@ Examples:
 `
     )
   ).action(monitorsAction(handleMonitorsHealth));
+  const batch = monitors.command("batch").description("Submit or inspect durable bulk monitor operations.");
+  const batchSelectorOptions = (command) => command.option(
+    "--target <target>",
+    "One of: all, all-active, billing-suspended, needs-repair"
+  ).option("--fleet <fleet-id>", "Select one Fleet").option("--keys <keys>", "Up to 100 comma-separated monitor keys").option(
+    "--dry-run",
+    "Record the same bounded plan without provider changes"
+  ).option(
+    "--idempotency-key <key>",
+    "Stable retry key (generated when omitted)"
+  );
+  withJsonOption(
+    batch.command("deploy").description(
+      "Durably create complete NDJSON monitor definitions through provider bulk create."
+    ).requiredOption(
+      "--file <path>",
+      "NDJSON file of complete monitor definitions"
+    ).option("--dry-run", "Validate and record the durable deploy plan").option("--yes", "Confirm asynchronous provider creation").option(
+      "--idempotency-key <key>",
+      "Stable retry key (generated when omitted)"
+    )
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatchDeploy(options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("audit").description("Durably audit a selection; defaults to --target all.")
+    )
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("audit", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("repair").description(
+        "Durably re-audit and converge a selection through the existing lifecycle fences."
+      )
+    ).option("--yes", "Confirm the asynchronous provider repair")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("repair", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("deactivate").description(
+        "Durably deactivate a selection through provider batch deletes."
+      )
+    ).requiredOption("--reason <reason>", "Declared deactivation reason").option("--yes", "Confirm the asynchronous provider deactivation")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("deactivate", options)
+    )
+  );
+  withJsonOption(
+    batchSelectorOptions(
+      batch.command("reactivate").description("Durably reactivate a selection after a suspension.")
+    ).option("--yes", "Confirm provider reactivation and possible billing")
+  ).action(
+    monitorsAction(
+      (options) => handleMonitorBatch("reactivate", options)
+    )
+  );
+  withJsonOption(
+    batch.command("get <operation-id>").description("Read batch progress and one bounded evidence page.").option("--cursor <cursor>", "Read the next retained evidence page")
+  ).action(monitorsAction(handleMonitorBatchGet));
   withJsonOption(
     monitors.command("status").description("Check whether you have access to Deepline monitors.").addHelpText(
       "after",
@@ -34118,7 +34902,7 @@ Examples:
     )
   ).action(monitorsAction(handleMonitorsStatus));
   withJsonOption(
-    monitors.command("available [tool-id]").alias("tools").description(
+    monitors.command("available [tool-id]", { hidden: true }).alias("tools").description(
       "List the monitor types you can deploy, or describe one by tool id."
     ).addHelpText(
       "after",
@@ -34152,8 +34936,9 @@ Examples:
       "after",
       `
 Notes:
-  Read-only. --status filters by monitor status: active (default), disabled, or
-  all. The output echoes the status filter that was applied. The response reports
+  Read-only. A monitor state is active or inactive; provider disagreement is
+  reported separately by audit/health. The output echoes the state filter that
+  was applied. The response reports
   total (the true registry count, not the page size), returned, has_more, and
   next_cursor. When has_more is true, page with --cursor <next_cursor> until it
   is false \u2014 a "no matching
@@ -34171,7 +34956,7 @@ Examples:
 `
     ).option(
       "--status <status>",
-      "Filter by monitor status: active (default), disabled, or all"
+      "Filter by monitor state: active (default), inactive, or all"
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
@@ -34234,7 +35019,7 @@ Notes:
   Play delivery. The JSON response reports this validation scope explicitly.
   Provider-specific grammar, precedence, enum applicability, examples, and
   update semantics are returned by the live monitor contract. Inspect it with
-  \`deepline monitors available deepline_native.company_radar --json\`.
+  \`deepline tools get deepline_native.company_radar --json\`.
   For a bounded urgent Deepline Native preview, use
   controls.execution_type="priority". Deepline injects the upstream marker;
   do not author custom_fields yourself. Priority is capped at ten upstream or
@@ -34272,6 +35057,10 @@ Notes:
   no separate repair command or retry queue: rerun the same deploy/update.
   Scheduled reconciliation can also finish that exact saved cleanup; it never
   creates another monitor.
+  For TamRadar, deliberately changing payload.updates_since is an explicit
+  historical replay request, including when redeploying a disabled monitor.
+  Deepline preserves that selected boundary; filter-only deploys and ordinary
+  reactivation start from a fresh future-only source boundary instead.
   For a bounded urgent Deepline Native preview, set
   controls.execution_type="priority". Deepline injects the provider custom
   field and enforces a ten-slot per-org cap; do not use it for regular or bulk
@@ -34301,6 +35090,11 @@ positionally, via --file <path>, or from stdin with --file -.
 When <patch> includes payload, its top-level fields are merged with the stored
 payload before validation. This lets you change one filter without resending
 domain or radar_type; nested values and arrays replace atomically.
+For TamRadar, changing payload.updates_since is an explicit historical replay
+request. Deepline passes that requested boundary upstream, but previously
+delivered canonical findings are deduplicated before dispatch and billing; only
+previously unseen historical findings are chargeable. Filter-only updates,
+repair, and reactivation instead use a fresh future-only source boundary.
 Use {"controls":{"execution_type":"priority"}} only for a bounded urgent
 Deepline Native preview. The ten-radar priority cap applies on update too.
 Use {"controls":{"execution_type":null}} to release priority without
@@ -34387,7 +35181,7 @@ ${MONITOR_FLEET_HELP_EPILOG}`
 Creates a ready-to-review JSON definition. Fleets always sync ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.cadence} and retain
 a missing member for ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.removalGrace} before it is ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.onRemoved}d; those
 policies are not authored in the file. ${MONITOR_FLEET_DOCUMENTATION.stickyMembership} The payload remains the actual monitor payload for the chosen tool, so use
-\`deepline monitors available\` to discover a tool first.
+\`deepline tools list --categories monitors\` to discover a tool first.
 
 Example:
   deepline monitors fleets init account-job-openings \\
@@ -34564,7 +35358,7 @@ Example:
   const deployed = withJsonOption(
     monitors.command("deployed", { hidden: true }).description("Alias of `monitors list` (plus get/update/delete aliases).").option(
       "--status <status>",
-      "Filter by monitor status: active (default), disabled, or all"
+      "Filter by monitor state: active (default), inactive, or all"
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
@@ -34712,7 +35506,8 @@ function organizationAuthValues(input2) {
     [HOST_URL_ENV]: input2.baseUrl,
     [API_KEY_ENV]: input2.apiKey,
     [ACTIVE_ORG_ID_ENV]: input2.orgId,
-    [ACTIVE_ORG_NAME_ENV]: input2.orgName
+    [ACTIVE_ORG_NAME_ENV]: input2.orgName,
+    ...featureEnvValues(input2)
   };
 }
 function organizationCommandContext(input2) {
@@ -34928,6 +35723,7 @@ async function handleOrgSwitch(selection, options) {
   if (!selection && !options.orgId && authScope === "folder" && provenance.scope === "global" && provenance.project.state === "project") {
     const commandContext = resolveCliCommandContext(config);
     const activeOrganization = commandContext.active_organization;
+    const pinnedFeatures = storedHostFeatures(config.baseUrl);
     const project_env_paths2 = saveProjectDeeplineEnvValues(
       {
         [HOST_URL_ENV]: config.baseUrl,
@@ -34935,7 +35731,8 @@ async function handleOrgSwitch(selection, options) {
         ...activeOrganization ? {
           [ACTIVE_ORG_ID_ENV]: activeOrganization.org_id,
           [ACTIVE_ORG_NAME_ENV]: activeOrganization.org_name ?? ""
-        } : {}
+        } : {},
+        ...pinnedFeatures !== void 0 ? { [FEATURES_ENV]: pinnedFeatures } : {}
       },
       provenance.project.dir
     );
@@ -35015,11 +35812,15 @@ async function handleOrgSwitch(selection, options) {
   const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
     let project_env_paths2 = [];
+    const features = await http.post("/api/v2/auth/cli/status", {
+      api_key: config.apiKey
+    }).then((status) => status.features).catch(() => void 0);
     const authValues2 = organizationAuthValues({
       baseUrl: config.baseUrl,
       apiKey: config.apiKey,
       orgId: target.org_id,
-      orgName: target.name
+      orgName: target.name,
+      features
     });
     if (authTarget.kind === "folder") {
       project_env_paths2 = saveProjectDeeplineEnvValues(authValues2);
@@ -35086,7 +35887,8 @@ async function handleOrgSwitch(selection, options) {
     baseUrl: config.baseUrl,
     apiKey: switched.api_key,
     orgId: switched.org_id,
-    orgName: switched.org_name
+    orgName: switched.org_name,
+    features: switched.features
   });
   if (authTarget.kind === "folder") {
     project_env_paths = saveProjectDeeplineEnvValues(authValues);
@@ -35158,14 +35960,20 @@ async function handleOrgCreate(name, options) {
   const identity = await fetchWorkspaceCreationIdentity(http, config.apiKey);
   let created;
   let workspaceApiKey;
+  let workspaceFeatures;
   let pendingIntentPath = null;
   if (!identity.orgId) {
     const firstWorkspace = await http.post("/api/v2/auth/cli/org-create", {
       api_key: config.apiKey,
       name: normalizedName
     });
-    const { api_key: apiKey, ...publicFirstWorkspace } = firstWorkspace;
+    const {
+      api_key: apiKey,
+      features,
+      ...publicFirstWorkspace
+    } = firstWorkspace;
     workspaceApiKey = apiKey;
+    workspaceFeatures = features;
     created = publicFirstWorkspace;
   } else {
     const pending = loadOrCreatePendingOrgCreate({
@@ -35186,6 +35994,7 @@ async function handleOrgCreate(name, options) {
       org_id: workspace.org_id
     });
     workspaceApiKey = switched.api_key;
+    workspaceFeatures = switched.features;
     created = { ...workspace };
     pendingIntentPath = pending.path;
   }
@@ -35193,7 +36002,8 @@ async function handleOrgCreate(name, options) {
     baseUrl: config.baseUrl,
     apiKey: workspaceApiKey,
     orgId: created.org_id,
-    orgName: created.org_name
+    orgName: created.org_name,
+    features: workspaceFeatures
   });
   saveHostEnvValues(config.baseUrl, authValues);
   if (pendingIntentPath) unlinkSync(pendingIntentPath);
@@ -35364,7 +36174,7 @@ Examples:
     )
   ).action(handleOrgSwitch);
   addOrgSetOptions(
-    org.command("switch [selection]").description(
+    org.command("switch [selection]", { hidden: true }).description(
       "Deprecated alias for org set. Set the organization for the selected auth scope."
     ).addHelpText(
       "after",
@@ -35390,6 +36200,10 @@ Examples:
 }
 
 // src/cli/commands/git.ts
+var GIT_DEPLOY_FEATURE = "github-deploy";
+function shellQuote3(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function renderProject(project) {
   const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
   const flags = [
@@ -35428,6 +36242,98 @@ async function handleList(options) {
     { json: options.json }
   );
 }
+function describeInstallationStatus(installation) {
+  switch (installation.status) {
+    case "active":
+      return [
+        `Connected to ${installation.accountLogin} (installation ${installation.installationId}).`
+      ];
+    case "uninstalled":
+      return [
+        `The Deepline GitHub App was uninstalled from ${installation.accountLogin}${installation.uninstalledAt ? ` at ${new Date(installation.uninstalledAt).toISOString()}` : ""}.`,
+        "Deploys are paused for every linked repository. Run `deepline git connect`, then `deepline git link <owner/repo>` again for each repository; links from the old installation cannot be resumed."
+      ];
+    case "suspended":
+      return [
+        `GitHub suspended the Deepline App on ${installation.accountLogin}${installation.suspendedAt ? ` at ${new Date(installation.suspendedAt).toISOString()}` : ""}.`,
+        "Pushes are not delivered while it is suspended; unsuspend it in GitHub settings."
+      ];
+  }
+}
+async function handleStatus2(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get("/api/v2/github/installation");
+  const installation = payload.installation;
+  const others = (payload.installations ?? []).filter(
+    (row) => row.installationId !== installation?.installationId
+  );
+  const lines = installation ? describeInstallationStatus(installation) : [
+    "No GitHub installation is connected to this workspace. Run `deepline git connect`."
+  ];
+  for (const other of others) {
+    lines.push(
+      `Also: ${other.accountLogin} (installation ${other.installationId}) is ${other.status}.`
+    );
+  }
+  const byId = new Map(
+    (payload.installations ?? []).map((row) => [row.installationId, row])
+  );
+  const { projects } = await http.get(
+    "/api/v2/play-projects?includeDisabled=1"
+  );
+  const affected_links = projects.map((project) => {
+    const own = byId.get(project.installationId);
+    const verdict = !own ? "unknown" : own.status === "active" ? null : own.status;
+    return verdict ? {
+      id: project.id,
+      repoId: project.repoId,
+      repoFullName: project.repoFullName,
+      rootDirectory: project.rootDirectory,
+      productionBranch: project.productionBranch,
+      manifestPath: project.manifestPath,
+      checkOnPullRequest: project.checkOnPullRequest,
+      disabled: project.disabled,
+      installationId: project.installationId,
+      installationStatus: verdict
+    } : null;
+  }).filter((row) => row !== null);
+  const activeInstallations = (payload.installations ?? []).filter(
+    (row) => row.status === "active"
+  );
+  const relinkCommand = (link2) => [
+    // The numeric repo id, not the name: a repository renamed while the
+    // App was gone keeps a stale name here, and `git link` accepts the id.
+    `deepline git link ${link2.repoId}`,
+    // Stored values are admin-controlled text and this line is
+    // copy-pasted into a shell by whoever reads it, so every
+    // interpolated value below is quoted.
+    `--branch ${shellQuote3(link2.productionBranch)}`,
+    link2.rootDirectory ? `--root-dir ${shellQuote3(link2.rootDirectory)}` : "",
+    link2.manifestPath && link2.manifestPath !== "deepline.json" ? `--manifest ${shellQuote3(link2.manifestPath)}` : "",
+    link2.checkOnPullRequest ? "" : "--no-pr-checks",
+    // With several active installations no id is guessed: the reader picks.
+    activeInstallations.length > 1 ? "--installation <id>" : ""
+  ].filter(Boolean).join(" ");
+  for (const link2 of affected_links) {
+    const label = `${link2.repoFullName}${link2.rootDirectory ? ` (${link2.rootDirectory})` : ""}`;
+    lines.push(
+      link2.installationStatus !== "suspended" ? `Link again: ${label} \u2014 its installation ${link2.installationId} is ${link2.installationStatus}; run \`${relinkCommand(link2)}\`${activeInstallations.length > 1 ? ` with <id> being the installation that reaches this repo: ${activeInstallations.map((row) => `${row.installationId} (${row.accountLogin})`).join(", ")}` : ""}.` : (
+        // A link disabled during the suspension stays disabled; only an
+        // enabled one picks up again on its own when GitHub unsuspends.
+        link2.disabled ? `Paused and disabled: ${label} \u2014 its installation is suspended, and the link stays disabled after GitHub unsuspends it until you run \`deepline git set ${link2.id} --enabled\`.` : `Paused: ${label} \u2014 its installation is suspended; pushes resume when GitHub unsuspends it.`
+      )
+    );
+  }
+  printCommandEnvelope(
+    {
+      installation,
+      installations: payload.installations ?? [],
+      affected_links,
+      render: { sections: [{ title: "github installation", lines }] }
+    },
+    { json: options.json }
+  );
+}
 async function handleRepos(options) {
   const { http } = getAuthedHttpClient();
   const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
@@ -35642,7 +36548,7 @@ async function handleDeploymentGet(id, options) {
   );
 }
 function registerGitCommands(program) {
-  const git = program.command("git").alias("projects").description(
+  const git = program.command("git", { hidden: !cliFeatureEnabled(GIT_DEPLOY_FEATURE) }).alias("projects").description(
     "Git deploys: link repositories to this workspace and deploy plays on push."
   ).addHelpText(
     "after",
@@ -35658,6 +36564,9 @@ Examples:
 `
   );
   git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
+  git.command("status").description(
+    "Show the workspace's GitHub installation and whether it is still usable."
+  ).option("--json", "Emit JSON output").action(async (options) => handleStatus2(options));
   git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
     "--installation <id>",
     "GitHub installation id (required when several are connected)"
@@ -35768,7 +36677,7 @@ async function handleQuickstart(options) {
   return 0;
 }
 function registerQuickstartCommands(program) {
-  program.command("quickstart").description(
+  program.command("quickstart", { hidden: true }).description(
     "Deprecated compatibility command. Use /deepline-gtm in your agent."
   ).addHelpText(
     "after",
@@ -35963,18 +36872,25 @@ async function handleList2(options) {
 async function handleCheck(nameInput, options) {
   const name = normalizeSecretName(nameInput);
   const client2 = new DeeplineClient();
-  const secret = await client2.checkSecret(name);
+  const check = options.play !== void 0 ? await client2.inspectSecret(name, { playName: options.play }) : null;
+  const secret = check ? check.secret : await client2.checkSecret(name);
+  const ok = check ? check.ok : Boolean(secret);
+  const quotedPlay = `'${(options.play ?? "PLAY").replace(/'/g, `'"'"'`)}'`;
+  const scopeHint = check ? secret?.scope === "play" ? check.reason === "disabled" ? `The Play-scoped secret is disabled and no active org fallback is available. Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}` : `The active Play-scoped secret takes precedence over the org secret.${ok ? "" : ` Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}`}` : `No Play override.${ok ? " The org secret is available." : ` Set or rotate the org secret with: deepline secrets set ${name}`}` : `Metadata only. Verify effective scope and active version with: deepline secrets check ${name} --play <play-name>`;
   printCommandEnvelope(
     {
-      ok: Boolean(secret),
+      ok,
       name,
       secret: secret ?? null,
+      check: check ? { playName: check.playName, reason: check.reason } : null,
+      scopeHint,
       render: {
         sections: [
           {
             title: "secret check",
             lines: [
-              secret ? `${name}: active \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`
+              check ? `${name}: ${check.reason} for ${check.playName}${secret ? ` (${secret.scope})` : ""}` : secret ? `${name}: active metadata \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`,
+              scopeHint
             ]
           }
         ]
@@ -35982,7 +36898,7 @@ async function handleCheck(nameInput, options) {
     },
     { json: options.json }
   );
-  if (!secret) process.exitCode = 4;
+  if (!ok) process.exitCode = 4;
 }
 async function handleSet2(nameInput, forbidden, options) {
   preventShellHistoryLeak(forbidden);
@@ -36036,6 +36952,7 @@ Notes:
 Examples:
   deepline secrets list
   deepline secrets check HUBSPOT_TOKEN
+  deepline secrets check HUBSPOT_TOKEN --play hubspot-sync
   deepline secrets set HUBSPOT_TOKEN
   printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
   deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
@@ -36045,7 +36962,12 @@ Examples:
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
     await handleList2(options);
   });
-  secrets.command("check").description("Check whether a secret exists and is active.").argument("<name>", "Secret name").option("--json", "Emit JSON output").action(async (name, options) => {
+  secrets.command("check").description(
+    "Check secret metadata, or effective availability with --play."
+  ).argument("<name>", "Secret name").option(
+    "--play <name>",
+    "Validate the effective secret for a bare Play name and active version"
+  ).option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
   secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
@@ -36202,7 +37124,7 @@ import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as r
 import { homedir as homedir8 } from "os";
 import { dirname as dirname15, join as join16 } from "path";
 
-// ../../shared_libs/cli/install-commands.json
+// contracts/install-commands.json
 var install_commands_default = {
   skills: {
     index_path: "/.well-known/skills/index.json",
@@ -36310,10 +37232,15 @@ function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
 
 // src/cli/skills-sync.ts
 import { spawn as spawn2, spawnSync } from "child_process";
+import { randomUUID as randomUUID7 } from "crypto";
 import {
   existsSync as existsSync13,
   mkdirSync as mkdirSync10,
+  readdirSync as readdirSync4,
   readFileSync as readFileSync14,
+  renameSync,
+  rmdirSync,
+  statSync as statSync5,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync14
 } from "fs";
@@ -36438,6 +37365,20 @@ function classifyNetworkFailure(error) {
   }
   return "network_error";
 }
+function classifyNetworkCauseCategory(error) {
+  switch (classifyNetworkFailure(error)) {
+    case "network_dns_resolution_failed":
+      return "dns";
+    case "network_ssl_error":
+      return "tls";
+    case "network_connection_reset":
+      return "reset";
+    case "network_timeout":
+      return "connect_timeout";
+    default:
+      return "unknown";
+  }
+}
 function isNetworkFailure(error) {
   if (!(error instanceof Error)) return false;
   if (error instanceof DeeplineError && error.statusCode) return false;
@@ -36607,6 +37548,7 @@ function buildFailureReport(input2) {
   });
   const code = failureCode({ exitCode: input2.exitCode, error: input2.error });
   const errorBody = input2.error === void 0 ? `SDK CLI command exited ${input2.exitCode ?? "unknown"}` : errorMessage3(input2.error);
+  const networkCauseCategory = input2.error !== void 0 && isNetworkFailure(input2.error) ? classifyNetworkCauseCategory(input2.error) : null;
   return {
     command: sanitizeCommand(input2.argv),
     subcommand: subcommandFromArgv(input2.argv),
@@ -36628,7 +37570,8 @@ function buildFailureReport(input2) {
       failure_code: code,
       failure_stage: input2.error === void 0 ? "command_exit" : "cli_main",
       duration_ms: durationMs,
-      ...input2.exitCode !== null ? { exit_code: input2.exitCode } : {}
+      ...input2.exitCode !== null ? { exit_code: input2.exitCode } : {},
+      ...networkCauseCategory ? { network_cause_category: networkCauseCategory } : {}
     }
   };
 }
@@ -36656,6 +37599,7 @@ async function maybeReportSdkCliFailure(input2) {
 
 // src/cli/skills-sync.ts
 var CHECK_TIMEOUT_MS2 = 3e3;
+var SKILLS_SYNC_CLAIM_MAX_AGE_MS = 60 * 60 * 1e3;
 function shouldSkipSkillsSync() {
   if (detectAgentRuntime() === "claude_cowork") {
     return true;
@@ -36672,6 +37616,60 @@ function failedSkillsSyncPath(baseUrl, agents) {
     `skills-sync-failed-${agents.join("-")}-version`
   );
 }
+function inProgressSkillsSyncPath(baseUrl, agents) {
+  return join15(
+    sdkCliStateDirPath(baseUrl),
+    `skills-sync-in-progress-${agents.join("-")}`
+  );
+}
+function removeSkillsSyncClaim(path, token) {
+  try {
+    unlinkSync2(join15(path, token));
+    rmdirSync(path);
+  } catch {
+  }
+}
+function claimSkillsSync(baseUrl, agents) {
+  const path = inProgressSkillsSyncPath(baseUrl, agents);
+  try {
+    mkdirSync10(dirname14(path), { recursive: true });
+  } catch {
+    return { status: "unavailable" };
+  }
+  const token = randomUUID7();
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const pendingPath = `${path}-pending-${token}`;
+    try {
+      mkdirSync10(pendingPath);
+      writeFileSync14(join15(pendingPath, token), "", { flag: "wx" });
+      renameSync(pendingPath, path);
+      return { status: "claimed", token };
+    } catch {
+      removeSkillsSyncClaim(pendingPath, token);
+      if (!existsSync13(path)) continue;
+    }
+    if (attempt > 0) return { status: "held" };
+    try {
+      if (Date.now() - statSync5(path).mtimeMs <= SKILLS_SYNC_CLAIM_MAX_AGE_MS) {
+        return { status: "held" };
+      }
+      const owners = readdirSync4(path);
+      if (owners.length === 0) {
+        rmdirSync(path);
+        continue;
+      }
+      if (owners.length !== 1) return { status: "held" };
+      renameSync(path, `${path}-stale-${owners[0]}`);
+    } catch {
+      return { status: "held" };
+    }
+  }
+  return { status: "held" };
+}
+function clearSkillsSyncClaim(baseUrl, agents, token) {
+  const path = inProgressSkillsSyncPath(baseUrl, agents);
+  removeSkillsSyncClaim(path, token);
+}
 function hasMarkedSkillsSyncVersion(path, version) {
   return Boolean(version) && readMarkedSkillsSyncVersion(path) === version;
 }
@@ -36807,7 +37805,7 @@ function hasCommand(command) {
   });
   return result.status === 0;
 }
-function shellQuote3(arg) {
+function shellQuote4(arg) {
   return `'${arg.replace(/'/g, `'\\''`)}'`;
 }
 function temporarySkillsSyncSkipCommand() {
@@ -36826,7 +37824,7 @@ function resolveSkillsInstallCommands(baseUrl, skillNames = DEFAULT_SDK_SKILL_NA
     commands.push({
       command: "bunx",
       args: bunxArgs,
-      manualCommand: `bunx ${bunxArgs.map(shellQuote3).join(" ")}`
+      manualCommand: `bunx ${bunxArgs.map(shellQuote4).join(" ")}`
     });
   }
   if (hasCommand("npx")) {
@@ -36834,7 +37832,7 @@ function resolveSkillsInstallCommands(baseUrl, skillNames = DEFAULT_SDK_SKILL_NA
     commands.push({
       command: "npx",
       args: npxArgs,
-      manualCommand: `npx ${npxArgs.map(shellQuote3).join(" ")}`
+      manualCommand: `npx ${npxArgs.map(shellQuote4).join(" ")}`
     });
   }
   return commands;
@@ -37001,30 +37999,43 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
     writeUnavailableSkillsNotice(baseUrl, update.remoteVersion, skillNames);
     return;
   }
-  writeSdkSkillsStatusLine("Deepline skills changed; syncing agent skills...");
-  const installResult = await runSkillsInstall(installs, agents);
-  if (!installResult.installed) {
-    const markerWritten = markFailedSkillsSync(
-      baseUrl,
-      update.remoteVersion,
-      agents
+  const claim = claimSkillsSync(baseUrl, agents);
+  if (claim.status === "held") return;
+  try {
+    if (hasFailedSkillsSync(baseUrl, update.remoteVersion, agents) || readSdkSkillsLocalVersion(baseUrl) === update.remoteVersion) {
+      return;
+    }
+    writeSdkSkillsStatusLine(
+      "Deepline skills changed; syncing agent skills..."
     );
-    void maybeReportAutomaticSkillsSyncFailure({
-      baseUrl,
-      remoteSkillsVersion: update.remoteVersion,
-      agents,
-      skillsPackage: SKILLS_NPX_PACKAGE,
-      targetSkillCount: skillNames.length,
-      markerWritten,
-      attempts: installResult.attempts
-    });
-    return;
+    const installResult = await runSkillsInstall(installs, agents);
+    if (!installResult.installed) {
+      const markerWritten = markFailedSkillsSync(
+        baseUrl,
+        update.remoteVersion,
+        agents
+      );
+      void maybeReportAutomaticSkillsSyncFailure({
+        baseUrl,
+        remoteSkillsVersion: update.remoteVersion,
+        agents,
+        skillsPackage: SKILLS_NPX_PACKAGE,
+        targetSkillCount: skillNames.length,
+        markerWritten,
+        attempts: installResult.attempts
+      });
+      return;
+    }
+    runLegacySkillsCleanup(agents);
+    writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents);
+    clearUnavailableSkillsNotice(baseUrl);
+    clearFailedSkillsSync(baseUrl, agents);
+    writeSdkSkillsStatusLine("Deepline agent skills are up to date.");
+  } finally {
+    if (claim.status === "claimed") {
+      clearSkillsSyncClaim(baseUrl, agents, claim.token);
+    }
   }
-  runLegacySkillsCleanup(agents);
-  writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents);
-  clearUnavailableSkillsNotice(baseUrl);
-  clearFailedSkillsSync(baseUrl, agents);
-  writeSdkSkillsStatusLine("Deepline agent skills are up to date.");
 }
 
 // src/cli/commands/skills.ts
@@ -38333,12 +39344,15 @@ Examples:
   });
 }
 
+// src/cli/commands/settings.ts
+import { readFileSync as readFileSync20 } from "fs";
+
 // src/cli/update-preferences.ts
 import {
   existsSync as existsSync16,
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync17,
-  renameSync,
+  renameSync as renameSync2,
   rmSync as rmSync5,
   writeFileSync as writeFileSync17
 } from "fs";
@@ -38407,7 +39421,7 @@ function writeCliUpdatePreferences(preferences, homeDir2 = homedir10()) {
       encoding: "utf8",
       mode: 384
     });
-    renameSync(tempPath, path);
+    renameSync2(tempPath, path);
   } finally {
     rmSync5(tempPath, { force: true });
   }
@@ -38464,7 +39478,7 @@ import {
   mkdirSync as mkdirSync14,
   realpathSync as realpathSync5,
   readFileSync as readFileSync19,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   rmSync as rmSync6,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync18
@@ -38481,7 +39495,7 @@ import {
 
 // src/cli/install-integrity.ts
 import { createRequire } from "module";
-import { existsSync as existsSync17, readFileSync as readFileSync18, statSync as statSync5 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync18, statSync as statSync6 } from "fs";
 import { isAbsolute as isAbsolute6, join as join19, relative as relative6, resolve as resolve17 } from "path";
 var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/cli/index.mjs",
@@ -38489,6 +39503,8 @@ var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/index.d.ts",
   "dist/plays/bundle-play-file.mjs",
   "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
   "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
   "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
   "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
@@ -38519,7 +39535,7 @@ function parseJson(path) {
 }
 function isFile(path) {
   try {
-    return statSync5(path).isFile();
+    return statSync6(path).isFile();
   } catch {
     return false;
   }
@@ -38666,14 +39682,14 @@ function posixShellQuote(value) {
 function windowsCmdQuote(value) {
   return `"${value.replace(/"/g, '""')}"`;
 }
-function shellQuote4(value) {
+function shellQuote5(value) {
   if (process.platform === "win32") {
     return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : windowsCmdQuote(value);
   }
   return posixShellQuote(value);
 }
 function buildSourceUpdateCommand(sourceRoot) {
-  const quotedRoot = shellQuote4(sourceRoot);
+  const quotedRoot = shellQuote5(sourceRoot);
   const cdCommand = process.platform === "win32" ? `cd /d ${quotedRoot}` : `cd ${quotedRoot}`;
   return `${cdCommand} && git fetch origin main --tags && git merge --ff-only origin/main`;
 }
@@ -38685,7 +39701,7 @@ function buildSidecarProjectConfigCommand(versionDir, nodeBin) {
     "fs.mkdirSync(dir,{recursive:true});",
     `fs.writeFileSync(path.join(dir,'package.json'),${JSON.stringify(NPM_SDK_SIDECAR_PACKAGE_JSON)});`
   ].join("");
-  return `${shellQuote4(nodeBin)} -e ${shellQuote4(script)} ${shellQuote4(versionDir)}`;
+  return `${shellQuote5(nodeBin)} -e ${shellQuote5(script)} ${shellQuote5(versionDir)}`;
 }
 function sidecarStateDir(input2) {
   const scope = input2.env.DEEPLINE_CONFIG_SCOPE?.trim();
@@ -38748,7 +39764,7 @@ function resolvePythonSidecarUpdatePlan(options) {
   const npmCommand = "npm";
   const registryUrl = sidecarRegistryUrl(hostUrl);
   const versionDir = join20(stateDir, "versions", "<version>");
-  const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote4(versionDir)} --registry ${shellQuote4(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote4).join(" ")} ${shellQuote4(packageSpec)}`;
+  const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote5(versionDir)} --registry ${shellQuote5(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote5).join(" ")} ${shellQuote5(packageSpec)}`;
   return {
     kind: "python-sidecar",
     stateDir,
@@ -38895,7 +39911,7 @@ function resolveUpdatePlan(options = {}) {
     args,
     ...installPrefix ? { installPrefix } : {},
     ...fallbackRegistryUrl ? { fallbackRegistryUrl } : {},
-    manualCommand: `${command} ${args.map(shellQuote4).join(" ")}`
+    manualCommand: `${command} ${args.map(shellQuote5).join(" ")}`
   };
 }
 var AUTO_UPDATE_FAILURE_FILE = ".auto-update-failure.json";
@@ -39163,23 +40179,23 @@ function writeSidecarLauncher(input2) {
     input2.path,
     [
       "#!/usr/bin/env sh",
-      `export DEEPLINE_HOST_URL=${shellQuote4(input2.hostUrl)}`,
-      `export DEEPLINE_CONFIG_SCOPE=${shellQuote4(input2.scope)}`,
-      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote4(path)} ]`).join(" || ")}; then`,
+      `export DEEPLINE_HOST_URL=${shellQuote5(input2.hostUrl)}`,
+      `export DEEPLINE_CONFIG_SCOPE=${shellQuote5(input2.scope)}`,
+      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote5(path)} ]`).join(" || ")}; then`,
       '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
       '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
       "  fi",
       '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
       "  exit 1",
       "fi",
-      `if ! ${shellQuote4(input2.nodeBin)} -e ${shellQuote4(esbuildProbe)} ${shellQuote4(versionDir)} >/dev/null 2>&1; then`,
+      `if ! ${shellQuote5(input2.nodeBin)} -e ${shellQuote5(esbuildProbe)} ${shellQuote5(versionDir)} >/dev/null 2>&1; then`,
       '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
       '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
       "  fi",
       '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
       "  exit 1",
       "fi",
-      `exec ${shellQuote4(input2.nodeBin)} ${shellQuote4(input2.entryPath)} "$@"`,
+      `exec ${shellQuote5(input2.nodeBin)} ${shellQuote5(input2.entryPath)} "$@"`,
       ""
     ].join("\n"),
     { encoding: "utf8", mode: 493 }
@@ -39247,7 +40263,7 @@ async function runPythonSidecarUpdatePlan(plan) {
         `.backup-${installedVersion}-${process.pid}-${Date.now()}`
       );
       try {
-        renameSync2(finalDir, backupDir);
+        renameSync3(finalDir, backupDir);
       } catch (error) {
         const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
         if (!concurrentlyPublishedFailure) {
@@ -39266,7 +40282,7 @@ async function runPythonSidecarUpdatePlan(plan) {
     }
     if (shouldPublishTemp) {
       try {
-        renameSync2(tempDir, finalDir);
+        renameSync3(tempDir, finalDir);
       } catch (error) {
         rmSync6(tempDir, { recursive: true, force: true });
         const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
@@ -39277,7 +40293,7 @@ async function runPythonSidecarUpdatePlan(plan) {
           let restoreFailure = "";
           if (backupDir && existsSync18(backupDir) && !existsSync18(finalDir)) {
             try {
-              renameSync2(backupDir, finalDir);
+              renameSync3(backupDir, finalDir);
               backupDir = null;
             } catch (restoreError) {
               restoreFailure = `; failed to restore previous install: ${restoreError.message}`;
@@ -39297,7 +40313,7 @@ async function runPythonSidecarUpdatePlan(plan) {
     if (backupDir && existsSync18(backupDir)) {
       rmSync6(finalDir, { recursive: true, force: true });
       try {
-        renameSync2(backupDir, finalDir);
+        renameSync3(backupDir, finalDir);
         backupDir = null;
       } catch {
       }
@@ -40045,21 +41061,104 @@ function displaySlackTarget(target) {
 function collectEvent(value, previous = []) {
   return [...previous, value];
 }
+function collectNotificationTarget(value, previous = []) {
+  return [...previous, value];
+}
+async function readNotificationConfigurationChange(source, read = (path, encoding) => readFileSync20(path, encoding)) {
+  const label = source === "-" ? "stdin" : source;
+  let text;
+  try {
+    text = await read(source === "-" ? 0 : source, "utf8");
+  } catch (error) {
+    throw new Error(
+      `Could not read notification configuration from ${label}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new Error(
+      `Notification configuration from ${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed.expectedWorkspaceVersion !== "number" || !Number.isInteger(parsed.expectedWorkspaceVersion) || !parsed.change || typeof parsed.change !== "object") {
+    throw new Error(
+      `Notification configuration from ${label} must contain an integer expectedWorkspaceVersion and a change object.`
+    );
+  }
+  return {
+    expectedWorkspaceVersion: parsed.expectedWorkspaceVersion,
+    change: parsed.change
+  };
+}
 function registerNotificationCommands(program) {
-  const notifications = program.command("notifications").description("Choose which Play outcomes notify which people and channels.").addHelpText(
+  const notifications = program.command("notifications").description("Configure notification groups, destinations, and rules.").addHelpText(
     "after",
     `
 Examples:
+  deepline notifications add oncall --to email:oncall@example.com --to slack:#oncall
   deepline notifications events
   deepline notifications slack channels --search pipeline
   deepline notifications add pipeline-watchdog --to slack:#pipeline-alerts --for play.cron.failed
   deepline notifications add owner-alerts --to slack:member:U0123456789 --for play.cron.failed
   deepline notifications test pipeline-watchdog
 
-Slack connections are managed in Dashboard \u2192 Integrations. This command only
-chooses the connected Slack channel or member and the events it receives.
+Each named notification is a group. Repeat --to to give it email and Slack
+destinations. Add rules from the dashboard or notification configuration. The
+existing one-Slack-target form with --for remains supported and creates the
+equivalent compatibility group and rules. Slack connections are managed in
+Dashboard \u2192 Integrations.
 `
   );
+  const configuration = notifications.command("configuration").description("Read or atomically update notification groups and rules.").addHelpText(
+    "after",
+    `
+Examples:
+  deepline notifications configuration get --json
+  deepline notifications configuration apply change.json --dry-run --json
+  jq '{expectedWorkspaceVersion: .configuration.workspaceVersion, change: {kind: "delete_group", groupKey: "oncall"}}' current.json | deepline notifications configuration apply - --json
+`
+  );
+  configuration.command("get").description("Show the effective group-based notification configuration.").option("--json", "Emit JSON output").action(async (options) => {
+    const result = await new DeeplineClient().getNotificationConfiguration();
+    printCommandEnvelope(
+      {
+        ...result,
+        render: {
+          sections: [
+            {
+              title: "notification groups",
+              lines: result.configuration.groups.length ? result.configuration.groups.map(
+                (group) => `${group.name}: ${group.enabled ? "active" : "paused"}`
+              ) : ["No notification groups are configured."]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+  });
+  configuration.command("apply").argument(
+    "<file>",
+    "JSON file, or - for stdin, containing expectedWorkspaceVersion and one desired change"
+  ).description(
+    "Atomically apply a configuration draft exported by an agent or UI."
+  ).option("--dry-run", "Validate and display the file without saving it").option("--json", "Emit JSON output").action(async (file, options) => {
+    const input2 = await readNotificationConfigurationChange(file);
+    if (options.dryRun) {
+      printCommandEnvelope(
+        { dryRun: true, ...input2 },
+        { json: options.json }
+      );
+      return;
+    }
+    const result = await new DeeplineClient().changeNotificationConfiguration(
+      input2.expectedWorkspaceVersion,
+      input2.change
+    );
+    printCommandEnvelope(result, { json: options.json });
+  });
   notifications.command("events").description("List the Play events available to a notification.").option("--json", "Emit JSON output").action(async (options) => {
     const settings = await new DeeplineClient().getNotifications();
     printCommandEnvelope(
@@ -40115,42 +41214,82 @@ chooses the connected Slack channel or member and the events it receives.
     );
     printCommandEnvelope({ notification: rule }, { json: options.json });
   });
-  notifications.command("add").argument("<name>", "Short stable name, for example pipeline-watchdog").requiredOption(
+  notifications.command("add").argument("<name>", "Group name, for example oncall").requiredOption(
     "--to <target>",
-    "Target, for example slack:#pipeline-alerts or slack:member:U0123456789"
+    "Target; repeat email:name@example.com, slack:#channel, or slack:member:U0123456789",
+    collectNotificationTarget,
+    []
   ).option(
     "--for <event>",
-    "Event ID; repeat for more events. Run notifications events to list them",
+    "Legacy one-Slack-target event ID; repeat for more events",
     collectEvent,
     []
   ).option("--dry-run", "Describe the notification without saving it").option("--json", "Emit JSON output").action(
     async (name, options) => {
-      if (!options.for.length) {
-        throw new Error("Choose at least one event with --for <event>.");
+      const result = await new DeeplineClient().createNotificationGroup({
+        name,
+        targets: options.to,
+        legacyEvents: options.for,
+        dryRun: options.dryRun
+      });
+      if (result.mode === "dry_run") {
+        printCommandEnvelope(
+          result.compatibilityMode ? {
+            dryRun: true,
+            name: result.name,
+            target: options.to[0],
+            eventTypes: result.legacyEvents
+          } : {
+            dryRun: true,
+            group: result.name,
+            targets: result.targets,
+            compatibilityMode: false
+          },
+          { json: options.json }
+        );
+        return;
       }
-      const target = parseSlackTarget(options.to);
-      if (options.dryRun) {
+      if (result.mode === "legacy") {
         printCommandEnvelope(
-          { dryRun: true, name, target: options.to, eventTypes: options.for },
+          {
+            notification: result.notification,
+            render: {
+              sections: [
+                {
+                  title: "notification saved",
+                  lines: [name]
+                }
+              ],
+              actions: [
+                {
+                  label: "Send a test",
+                  command: `deepline notifications test ${name}`
+                }
+              ]
+            }
+          },
           { json: options.json }
         );
         return;
       }
-      const result = await new DeeplineClient().createNotification({
-        name,
-        provider: "slack",
-        ...target,
-        eventTypes: options.for
-      });
       printCommandEnvelope(
         {
-          notification: result,
+          ...result,
           render: {
-            sections: [{ title: "notification saved", lines: [name] }],
+            sections: [
+              {
+                title: "notification group saved",
+                lines: [
+                  result.group.name,
+                  `${result.destinations.length} destination${result.destinations.length === 1 ? "" : "s"}`,
+                  "0 rules"
+                ]
+              }
+            ],
             actions: [
               {
-                label: "Send a test",
-                command: `deepline notifications test ${name}`
+                label: "View configuration",
+                command: "deepline notifications configuration get"
               }
             ]
           }
@@ -40268,7 +41407,7 @@ import {
   chmodSync,
   existsSync as existsSync19,
   mkdtempSync,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   writeFileSync as writeFileSync20
 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
@@ -41137,6 +42276,9 @@ async function findPlayForToolId(client2, toolId) {
   const plays = await client2.searchPlays({ query: requested, compact: true });
   return plays.find((play) => playIdentifiers(play).includes(requested)) ?? null;
 }
+function isMissingToolMetadataError(error) {
+  return error instanceof DeeplineError && error.statusCode === 404;
+}
 function playAliasToolErrorMessage(toolId, play) {
   const playName = play.reference ?? play.name;
   return `${toolId} is a play, not a tool.
@@ -41418,10 +42560,12 @@ async function getTool(toolId, options = {}) {
   try {
     tool = await client2.getTool(toolId);
   } catch (error) {
-    const play = await findPlayForToolId(client2, toolId);
-    if (play) {
-      printPlayAliasToolError(toolId, play);
-      return 2;
+    if (isMissingToolMetadataError(error)) {
+      const play = await findPlayForToolId(client2, toolId);
+      if (play) {
+        printPlayAliasToolError(toolId, play);
+        return 2;
+      }
     }
     throw error;
   }
@@ -42321,9 +43465,9 @@ function apifySyncRecoveryNext(rawResponse) {
   const getDatasetItemsTool = stringField2(getDatasetItems, "tool");
   const getDatasetItemsPayload = recordField2(getDatasetItems, "payload");
   return {
-    getActorRun: `deepline tools execute ${getActorRunTool} --input ${shellQuote5(JSON.stringify(getActorRunPayload))} --json`,
+    getActorRun: `deepline tools execute ${getActorRunTool} --input ${shellQuote6(JSON.stringify(getActorRunPayload))} --json`,
     ...getDatasetItemsTool && Object.keys(getDatasetItemsPayload).length > 0 ? {
-      getDatasetItems: `deepline tools execute ${getDatasetItemsTool} --input ${shellQuote5(JSON.stringify(getDatasetItemsPayload))} --json`
+      getDatasetItems: `deepline tools execute ${getDatasetItemsTool} --input ${shellQuote6(JSON.stringify(getDatasetItemsPayload))} --json`
     } : {}
   };
 }
@@ -42409,7 +43553,7 @@ function readJsonArgument(raw, flagName) {
     throw new Error(`Invalid ${flagName} value: empty @file path.`);
   }
   try {
-    return readFileSync20(resolveAtFilePath(filePath), "utf8").replace(
+    return readFileSync21(resolveAtFilePath(filePath), "utf8").replace(
       /^\uFEFF/,
       ""
     );
@@ -42496,7 +43640,7 @@ function parseExecuteOptions(args) {
 function safeFileStem(value) {
   return value.trim().replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || "tool";
 }
-function shellQuote5(value) {
+function shellQuote6(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function powerShellQuote(value) {
@@ -42566,7 +43710,7 @@ export default definePlay(${JSON.stringify(playName)}, async (ctx) => {
     path: scriptPath,
     sourceCode: script,
     projectDir,
-    macCopyCommand: `mkdir -p ${shellQuote5(projectDir)} && cp ${shellQuote5(scriptPath)} ${shellQuote5(`${projectDir}/${fileName}`)}`,
+    macCopyCommand: `mkdir -p ${shellQuote6(projectDir)} && cp ${shellQuote6(scriptPath)} ${shellQuote6(`${projectDir}/${fileName}`)}`,
     windowsCopyCommand: `New-Item -ItemType Directory -Force -Path ${powerShellQuote(projectDir.replace(/\//g, "\\"))} | Out-Null; Copy-Item -LiteralPath ${powerShellQuote(scriptPath)} -Destination ${powerShellQuote(`${projectDir.replace(/\//g, "\\")}\\${fileName}`)}`
   };
 }
@@ -42593,7 +43737,7 @@ function buildToolExecuteBaseEnvelope(input2) {
     envelope,
     "output"
   );
-  const inspectCommand = `deepline tools execute ${input2.toolId} --input ${shellQuote5(JSON.stringify(input2.params))} --json`;
+  const inspectCommand = `deepline tools execute ${input2.toolId} --input ${shellQuote6(JSON.stringify(input2.params))} --json`;
   const actions = input2.listConversion ? [
     {
       label: "next",
@@ -42760,19 +43904,18 @@ async function executeTool(args) {
   try {
     metadata = await client2.getTool(parsed.toolId);
   } catch (error) {
-    const play = await findPlayForToolId(client2, parsed.toolId);
-    if (play) {
-      if (argsWantJson(args)) {
-        printJsonError(
-          new Error(playAliasToolErrorMessage(parsed.toolId, play))
-        );
-      } else {
-        printPlayAliasToolError(parsed.toolId, play);
+    if (isMissingToolMetadataError(error)) {
+      const play = await findPlayForToolId(client2, parsed.toolId);
+      if (play) {
+        if (argsWantJson(args)) {
+          printJsonError(
+            new Error(playAliasToolErrorMessage(parsed.toolId, play))
+          );
+        } else {
+          printPlayAliasToolError(parsed.toolId, play);
+        }
+        return 2;
       }
-      return 2;
-    }
-    if (error instanceof DeeplineError) {
-      throw error;
     }
     throw error;
   }
@@ -43414,7 +44557,7 @@ async function handleTail(id, runId, options) {
   }
 }
 function registerWorkflowCommands(program) {
-  const workflows = program.command("workflows").description(
+  const workflows = program.command("workflows", { hidden: true }).description(
     "Legacy cloud workflows (now becoming plays). Commands still work; use `workflows transform` to migrate one to a play. " + TRIGGER_REDIRECT
   ).addHelpText(
     "after",
@@ -44234,4 +45377,10 @@ Examples:
   }
   process.exitCode = process.exitCode ?? 0;
 }
-main();
+var DEV_CLI_AWAIT_MAIN = Symbol.for("@deepline/sdk/dev-cli-await-main");
+if (globalThis[DEV_CLI_AWAIT_MAIN] !== true) {
+  void main();
+}
+export {
+  main
+};