deepline 0.3.89 → 0.3.91

package/dist/cli/index.js

@@ -6,6 +6,10 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -22,6 +26,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cli/index.ts
+var cli_exports = {};
+__export(cli_exports, {
+  main: () => main
+});
+module.exports = __toCommonJS(cli_exports);
 
 // src/cli/proxy-env.ts
 var import_undici = require("undici");
@@ -186,6 +198,26 @@ var import_node_path29 = require("path");
 var import_node_os18 = require("os");
 var import_commander5 = require("commander");
 
+// src/pagination.ts
+async function* iterateCursorPages(fetchPage) {
+  let cursor = null;
+  const seen = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const page = await fetchPage(cursor);
+    if (page.hasMore) {
+      if (!page.cursor || seen.has(page.cursor)) {
+        throw new Error(
+          "Pagination reported more results without an advancing cursor"
+        );
+      }
+      seen.add(page.cursor);
+    }
+    yield page.items;
+    if (!page.hasMore) return;
+    cursor = page.cursor;
+  }
+}
+
 // src/config.ts
 var import_node_fs = require("fs");
 var import_node_os = require("os");
@@ -1265,20 +1297,22 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.89",
-  updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
+  // 0.3.90 is the first deliberately versioned SDK release for API v3.
+  version: "0.3.91",
+  updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
   },
   contracts: {
     api: {
       name: "sdk-http-api",
-      // API v2 is append-only. A breaking public request/response change needs
-      // v3 and an explicit v2 support-window decision, never a patch release.
-      currentMajor: 2,
-      supportedMajors: [2],
-      // Accepted only to bridge SDKs released before X-Deepline-API-Major.
+      // Concise Play grep has the current wire id. Older ids follow the
+      // standard API support window.
+      currentMajor: 3,
+      supportedMajors: [3, 2],
+      // Older ids remain subject to the API support window.
       legacyWireIds: [
+        "2026-09-play-grep-concise-results",
         "2026-07-admin-cli-local-cutover",
         "2026-07-native-monitor-launch-hard-cutover"
       ]
@@ -2527,6 +2561,10 @@ function normalizeProductNotificationEmail(value) {
   const email = typeof value === "string" ? value.trim().toLowerCase() : "";
   return email && email.length <= 320 && PRODUCT_NOTIFICATION_EMAIL_PATTERN.test(email) ? email : null;
 }
+var DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING = {
+  mode: "rolling_limit",
+  windowMs: 36e5
+};
 
 // src/stream-reconnect.ts
 var STREAM_RECONNECT_BASE_DELAY_MS = 500;
@@ -5120,6 +5158,7 @@ var DeeplineClient = class {
     this.runs = {
       get: (runId, options2) => this.getRunStatus(runId, options2),
       list: (options2) => this.listRuns(options2),
+      listPage: (options2) => this.listRunsPage(options2),
       tail: (runId, options2) => this.tailRun(runId, options2),
       logs: (runId, options2) => this.getRunLogs(runId, options2),
       input: (runId) => this.getRunInput(runId),
@@ -5145,9 +5184,19 @@ var DeeplineClient = class {
       targetStatus: () => this.getTargetBillingStatus(),
       autoRecharge: {
         get: () => this.getTargetAutoRecharge(),
+        trigger: (options2) => this.http.post(
+          "/api/v2/billing/auto-recharge/trigger",
+          {},
+          {
+            "Idempotency-Key": requireTargetBillingIdempotencyKey(
+              options2?.idempotencyKey ?? globalThis.crypto.randomUUID()
+            )
+          }
+        ),
         update: (options2) => this.updateTargetAutoRecharge(options2)
       },
       purchaseCredits: (options2) => this.purchaseTargetBillingCredits(options2),
+      recoverCreditPurchase: (options2) => this.recoverTargetBillingCreditPurchase(options2),
       transitionPlan: (options2) => this.transitionTargetBillingPlan(options2),
       portalSession: () => this.createTargetBillingPortalSession()
     };
@@ -5316,6 +5365,14 @@ var DeeplineClient = class {
     if (options.playName !== void 0) params.set("play", options.playName);
     return this.http.get(`/api/v2/secrets?${params.toString()}`);
   }
+  /** Add, replace, or clear the non-sensitive note attached to one secret. */
+  async updateSecretNote(secretId, note) {
+    const response = await this.http.patch(
+      `/api/v2/secrets/${encodeURIComponent(secretId)}`,
+      { note }
+    );
+    return response.secret;
+  }
   // ——————————————————————————————————————————————————————————
   // Tools
   // ——————————————————————————————————————————————————————————
@@ -6333,6 +6390,10 @@ var DeeplineClient = class {
    * ```
    */
   async listRuns(options) {
+    return (await this.listRunsPage(options)).runs;
+  }
+  /** Read one run page without discarding server pagination metadata. */
+  async listRunsPage(options) {
     const playName = options.play?.trim();
     const params = new URLSearchParams();
     if (playName) {
@@ -6363,7 +6424,7 @@ var DeeplineClient = class {
     const response = await this.http.get(
       `/api/v2/runs?${params.toString()}`
     );
-    return response.runs ?? [];
+    return { ...response, runs: response.runs ?? [] };
   }
   /**
    * Observe one run's live events. Uses the Convex Run Snapshot subscription
@@ -6758,13 +6819,33 @@ var DeeplineClient = class {
     );
   }
   /**
-   * List callable plays visible to the workspace.
+   * List one page of callable plays; grep retains exhaustive matching results.
+   * Use listPlaysPage to retain pagination metadata.
    *
    * Pass `origin: "prebuilt"` for Deepline-managed prebuilts or
    * `origin: "owned"` for org-owned plays.
    */
   async listPlays(options) {
+    if (!options?.grep?.trim()) {
+      return (await this.requestPlaysPage(options, false)).plays;
+    }
+    const plays = [];
+    for await (const items of iterateCursorPages(async (cursor) => {
+      const page = await this.listPlaysPage({ ...options, cursor });
+      return { items: page.plays, cursor: page.cursor, hasMore: page.hasMore };
+    })) {
+      plays.push(...items);
+    }
+    return plays;
+  }
+  /** Read one bounded inventory page; cursor continues the same filters. */
+  async listPlaysPage(options) {
+    return this.requestPlaysPage(options);
+  }
+  async requestPlaysPage(options, paginateInventory = true) {
     const params = new URLSearchParams();
+    if (paginateInventory && !options?.grep?.trim())
+      params.set("inventory_paginated", "1");
     if (options?.origin) params.set("origin", options.origin);
     if (options?.categories) {
       params.set(
@@ -6776,26 +6857,27 @@ var DeeplineClient = class {
       params.set("include_tool_categories", "1");
     }
     if (options?.includeArchived) params.set("include_archived", "1");
+    if (options?.includeCostEstimates) {
+      params.set("include_cost_estimates", "1");
+    }
     if (options?.grep?.trim()) {
       params.set("grep", options.grep.trim());
-      params.set("grep_mode", options.grepMode ?? "all");
-      params.set("grep_paginated", "1");
       params.set("limit", "60");
     }
-    const plays = [];
-    let cursor = null;
-    let hasMore = true;
-    do {
-      if (cursor) params.set("cursor", cursor);
-      const suffix = params.toString() ? `?${params.toString()}` : "";
-      const response = await this.http.get(
-        `/api/v2/plays${suffix}`
-      );
-      plays.push(...response.plays ?? []);
-      cursor = response.pagination?.cursor ?? response.cursor ?? null;
-      hasMore = Boolean(response.pagination?.hasMore ?? response.hasMore);
-    } while (Boolean(options?.grep?.trim()) && hasMore && cursor);
-    return plays;
+    if (options?.limit !== void 0) {
+      if (!Number.isSafeInteger(options.limit) || options.limit < 1) {
+        throw new Error("Play page limit must be a positive integer");
+      }
+      params.set("limit", String(options.limit));
+    }
+    if (options?.cursor) params.set("cursor", options.cursor);
+    const suffix = params.size ? `?${params.toString()}` : "";
+    const response = await this.http.get(`/api/v2/plays${suffix}`);
+    return {
+      plays: response.plays ?? [],
+      cursor: response.pagination?.cursor ?? response.cursor ?? null,
+      hasMore: Boolean(response.pagination?.hasMore ?? response.hasMore)
+    };
   }
   /** Set whether an org-owned Play sorts before unpinned Plays. */
   async setPlayPinned(playName, pinned) {
@@ -6929,7 +7011,7 @@ var DeeplineClient = class {
       groupKey,
       name,
       enabled: true,
-      deliveryTiming: { mode: "immediate" },
+      deliveryTiming: DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING,
       source: "workspace",
       configMode: "custom",
       version: 0
@@ -7484,7 +7566,8 @@ var DeeplineClient = class {
       options.enabled ? {
         enabled: true,
         threshold_credits: options.thresholdCredits,
-        refill_to_credits: options.refillToCredits
+        refill_to_credits: options.refillToCredits,
+        ...options.purchaseLimitCents !== void 0 ? { purchase_limit_cents: options.purchaseLimitCents } : {}
       } : { enabled: false },
       { "Idempotency-Key": idempotencyKey }
     );
@@ -7505,6 +7588,39 @@ var DeeplineClient = class {
       { maxRetries: 0, exactUrlOnly: true }
     );
   }
+  /** Recover only the original workspace, credit amount, and purchase key; never charge. */
+  async recoverTargetBillingCreditPurchase(options) {
+    if (typeof options.idempotencyKey !== "string") {
+      throw new DeeplineError(
+        "The original billing idempotencyKey is required.",
+        void 0,
+        "INVALID_BILLING_IDEMPOTENCY_KEY"
+      );
+    }
+    const idempotencyKey = requireTargetBillingIdempotencyKey(
+      options.idempotencyKey
+    );
+    if (!Number.isSafeInteger(options.credits) || options.credits <= 0) {
+      throw new DeeplineError(
+        "credits must be a positive safe integer.",
+        void 0,
+        "INVALID_CREDITS"
+      );
+    }
+    if (typeof options.orgId !== "string" || !options.orgId.trim() || options.orgId !== options.orgId.trim()) {
+      throw new DeeplineError(
+        "The original orgId is required without surrounding whitespace.",
+        void 0,
+        "INVALID_ORG_ID"
+      );
+    }
+    return this.http.post(
+      "/api/v2/billing/credit-purchases/recover",
+      { credits: options.credits, org_id: options.orgId },
+      { "Idempotency-Key": idempotencyKey },
+      { maxRetries: 0, exactUrlOnly: true }
+    );
+  }
   /**
    * Start, change, cancel, or restore a target plan through one idempotent
    * commercial operation.
@@ -8145,13 +8261,6 @@ function getAuthedHttpClient() {
   const config = resolveConfig();
   return { config, http: new HttpClient(config) };
 }
-async function writeOutputFile(filename, content) {
-  const outputDir = (0, import_node_path4.resolve)(process.cwd(), "deepline", "data");
-  await (0, import_promises.mkdir)(outputDir, { recursive: true });
-  const fullPath = (0, import_node_path4.join)(outputDir, filename);
-  await (0, import_promises.writeFile)(fullPath, content, "utf-8");
-  return fullPath;
-}
 function stableOsUserId() {
   try {
     const info = (0, import_node_os4.userInfo)();
@@ -8794,13 +8903,6 @@ function createTimestampedName(prefix, extension) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   return `${prefix}-${timestamp}.${extension}`;
 }
-async function writeCsvRowsFile(prefix, rows) {
-  const path = await writeOutputFile(
-    createTimestampedName(prefix, "csv"),
-    csvStringFromRows(rows)
-  );
-  return path;
-}
 function clip(value, maxLength) {
   return value.length > maxLength ? `${value.slice(0, maxLength - 1)}\u2026` : value;
 }
@@ -9585,7 +9687,7 @@ Notes:
   workspace. To switch, use deepline org list and deepline org set <org-id>.
 `
   );
-  auth.command("workspaces").description("Deprecated. Use deepline org list to see workspaces.").action(() => {
+  auth.command("workspaces", { hidden: true }).description("Deprecated. Use deepline org list to see workspaces.").action(() => {
     console.error(
       "Workspaces live under `deepline org`.\n  List:   deepline org list\n  Switch: deepline org set <org-id>\n`deepline auth register` re-approves this device; it does not change the active workspace."
     );
@@ -9682,7 +9784,6 @@ var SUBSCRIPTION_STATUS_NEXT_COMMAND = "deepline billing subscription status --j
 var SUBSCRIPTION_CANCEL_PATH = "/api/v2/billing/subscription/cancel";
 var BILLING_TOP_UP_PATH = "/api/v2/billing/top-up";
 var DEFAULT_BALANCE_RECOVERY_CREDITS = 100;
-var BILLING_HISTORY_EXPORT_LIMIT = 5e3;
 function billingFailureFromError(error, options) {
   if (error instanceof AuthError) {
     return {
@@ -9947,6 +10048,17 @@ async function handleBalance(options) {
   const needsCredits = status === "no_billing" || status === "zero_balance" || status === "payment_method_only";
   const recovery = needsCredits ? balanceRecoveryForCredits() : null;
   const lines = [`Balance: ${payload.balance ?? "(unknown)"} credits`];
+  const temporaryHolds = payload.temporary_hold_credits;
+  if (typeof temporaryHolds === "number" && temporaryHolds > 0) {
+    lines.push(
+      `Temporarily reserved: ${temporaryHolds} credits \u2014 not charged; unused credits are released after final usage is calculated.`
+    );
+  } else if (temporaryHolds === null) {
+    lines.push("Temporary reservation status is temporarily unavailable.");
+  }
+  if (payload.temporary_hold_credits_truncated === true) {
+    lines.push("Temporary reservation total may be incomplete.");
+  }
   if (status === "no_billing") {
     lines.push(
       "Billing: No billing account or payment method set up for this workspace."
@@ -9973,6 +10085,9 @@ async function handleBalance(options) {
   );
   return;
 }
+function quoteShellArgument(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 async function handleUsage(options) {
   const { http } = getAuthedHttpClient();
   const params = new URLSearchParams();
@@ -9989,24 +10104,32 @@ async function handleUsage(options) {
   const recent = payload.recent ?? {};
   const last30Usage = usage.last_30_days_usage_credits ?? usage.month_spent_credits;
   const temporaryHolds = Number(usage.temporary_hold_credits ?? 0);
+  const nextPage = typeof recent.next_cursor === "string" && recent.next_cursor.length > 0 ? `deepline billing usage --cursor ${quoteShellArgument(recent.next_cursor)}${options.limit ? ` --limit ${options.limit}` : ""}${options.runId ? ` --run-id ${quoteShellArgument(options.runId)}` : ""} --json` : null;
   const lines = [
     `Balance: ${payload.balance ?? "(unknown)"}`,
     `Last 30 days usage: ${last30Usage ?? "(unknown)"}`,
     ...Number.isFinite(temporaryHolds) && temporaryHolds > 0 ? [`Temporary holds: ${temporaryHolds}`] : [],
-    `Monthly limit: ${quota.enabled ? quota.monthly_credits_limit ?? "(unknown)" : "off"}`,
+    `Monthly spend guidance: ${quota.enabled ? quota.monthly_credits_limit ?? "(unknown)" : "off"}`,
     ...options.runId && recent.run_id ? [
       `Run spend: ${(payload.run ?? {}).spent_credits ?? "(unknown)"} Deepline Credits`
     ] : [],
     ...recentUsageLines(
       Array.isArray(recent.entries) ? recent.entries : []
     ),
-    ...typeof recent.next_cursor === "string" && recent.next_cursor.length > 0 ? [
-      `Next page: deepline billing usage --cursor ${recent.next_cursor}${options.limit ? ` --limit ${options.limit}` : ""}${options.runId ? ` --run-id ${options.runId}` : ""}`
+    ...recent.has_more === true || recent.incomplete === true ? ["List truncated \u2014 more recent calls match this query."] : [],
+    ...nextPage ? [`Next page: ${nextPage}`] : [],
+    ...!nextPage && (recent.has_more === true || recent.incomplete === true) ? [
+      "No continuation is available for this view. Use deepline billing ledger export all --json for the full ledger."
     ] : []
   ];
   printCommandEnvelope(
     {
       ...payload,
+      recent: {
+        ...recent,
+        is_truncated: recent.has_more === true || recent.incomplete === true
+      },
+      next: { page: nextPage },
       render: { sections: [{ title: "billing usage", lines }] }
     },
     { json: options.json }
@@ -10018,9 +10141,9 @@ async function handleLimit(options) {
     "/api/v2/billing/limit"
   );
   const lines = payload.enabled ? [
-    `Monthly limit: ${payload.monthly_credits_limit ?? "(unknown)"}`,
-    `Remaining before cap: ${payload.remaining_credits ?? "(unknown)"}`
-  ] : ["Monthly limit: off"];
+    `Monthly spend guidance: ${payload.monthly_credits_limit ?? "(unknown)"}`,
+    "Enforcement: advisory; available balance remains the exact admission control."
+  ] : ["Monthly spend guidance: off"];
   printCommandEnvelope(
     {
       ...payload,
@@ -10042,7 +10165,7 @@ async function handleSetLimit(credits, options) {
         sections: [
           {
             title: "billing limit",
-            lines: [`Monthly billing limit set to ${credits} credits.`]
+            lines: [`Monthly spend guidance set to ${credits} credits.`]
           }
         ]
       }
@@ -10062,7 +10185,7 @@ async function handleLimitOff(options) {
         sections: [
           {
             title: "billing limit",
-            lines: ["Monthly billing limit is now off."]
+            lines: ["Monthly spend guidance is now off."]
           }
         ]
       }
@@ -10070,6 +10193,39 @@ async function handleLimitOff(options) {
     { json: options.json }
   );
 }
+async function exportLedger(http, outputPath, options) {
+  let summary = { row_count: 0, net_delta_credits: 0 };
+  let initialized = false;
+  for await (const entries of iterateCursorPages(async (cursor) => {
+    const params = new URLSearchParams({ limit: "5000" });
+    if (cursor) params.set("cursor", cursor);
+    if (options.sinceAt !== null)
+      params.set("since_at", String(options.sinceAt));
+    if (options.runId) params.set("run_id", options.runId);
+    if (options.operation) params.set("operation", options.operation);
+    const payload = await http.get(
+      `/api/v2/billing/ledger?${params.toString()}`
+    );
+    if (!Array.isArray(payload.entries) || typeof payload.has_more !== "boolean") {
+      throw new Error("Billing ledger response is missing entries");
+    }
+    return {
+      items: payload.entries,
+      hasMore: payload.has_more === true,
+      cursor: typeof payload.next_cursor === "string" ? payload.next_cursor : null
+    };
+  })) {
+    if (!initialized) {
+      await (0, import_promises2.mkdir)((0, import_node_path6.dirname)(outputPath), { recursive: true });
+      await (0, import_promises2.writeFile)(outputPath, ledgerRowsToCsv([], true), "utf-8");
+      initialized = true;
+    }
+    const rows = entries.map(ledgerApiEntryToRow);
+    await (0, import_promises2.appendFile)(outputPath, ledgerRowsToCsv(rows, false), "utf-8");
+    summary = summarizeLedgerRows(summary, rows);
+  }
+  return summary;
+}
 async function handleHistory(options) {
   const { http } = getAuthedHttpClient();
   const windows = {
@@ -10079,41 +10235,20 @@ async function handleHistory(options) {
     "1y": 31536e3
   };
   const sinceAt = Math.max(0, Math.floor(Date.now() / 1e3) - windows[options.time]) * 1e3;
-  const entries = [];
-  let cursor = null;
-  while (entries.length < BILLING_HISTORY_EXPORT_LIMIT) {
-    const params = new URLSearchParams({
-      since_at: String(sinceAt),
-      limit: String(BILLING_HISTORY_EXPORT_LIMIT - entries.length)
-    });
-    if (cursor !== null) params.set("cursor", cursor);
-    const payload = await http.get(
-      `/api/v2/billing/ledger?${params.toString()}`
-    );
-    if (Array.isArray(payload.entries)) {
-      entries.push(
-        ...payload.entries.slice(
-          0,
-          BILLING_HISTORY_EXPORT_LIMIT - entries.length
-        )
-      );
-    }
-    const nextCursor = typeof payload.next_cursor === "string" && payload.next_cursor.length > 0 ? payload.next_cursor : null;
-    if (payload.has_more !== true || nextCursor === null) break;
-    if (nextCursor === cursor) {
-      throw new Error("Billing history pagination cursor did not advance");
-    }
-    cursor = nextCursor;
-  }
-  const rows = entries.map(ledgerApiEntryToRow);
-  const outputPath = await writeCsvRowsFile(
-    `billing-history-${options.time}`,
-    rows
+  const outputPath = (0, import_node_path6.resolve)(
+    process.cwd(),
+    "deepline",
+    "data",
+    createTimestampedName(`billing-history-${options.time}`, "csv")
   );
+  const summary = await exportLedger(http, outputPath, { sinceAt });
   printCommandEnvelope(
     {
       output_path: outputPath,
-      row_count: rows.length,
+      row_count: summary.row_count,
+      has_more: false,
+      is_truncated: false,
+      next_cursor: null,
       time_window: options.time,
       render: {
         sections: [
@@ -10121,7 +10256,7 @@ async function handleHistory(options) {
             title: "billing history",
             lines: [
               `Billing history written to ${outputPath}`,
-              `${rows.length} row(s) exported.`
+              `${summary.row_count} row(s) exported.`
             ]
           }
         ]
@@ -10146,40 +10281,18 @@ async function handleLedgerExportAll(options) {
   }
   const { http } = getAuthedHttpClient();
   const outputPath = options.output ? (0, import_node_path6.resolve)(String(options.output)) : defaultLedgerExportPath();
-  let summary = { row_count: 0, net_delta_credits: 0 };
-  let cursor = null;
-  let initializedOutput = false;
-  for (; ; ) {
-    const params = new URLSearchParams({ limit: "5000" });
-    if (cursor !== null) params.set("cursor", cursor);
-    if (options.runId) params.set("run_id", options.runId);
-    if (options.operation) params.set("operation", options.operation);
-    if (sinceAt !== null) params.set("since_at", String(sinceAt));
-    const payload = await http.get(
-      `/api/v2/billing/ledger?${params.toString()}`
-    );
-    const entries = Array.isArray(payload.entries) ? payload.entries : [];
-    const rows = entries.map(ledgerApiEntryToRow);
-    if (!initializedOutput) {
-      await (0, import_promises2.mkdir)((0, import_node_path6.dirname)(outputPath), { recursive: true });
-      await (0, import_promises2.writeFile)(outputPath, ledgerRowsToCsv([], true), "utf-8");
-      initializedOutput = true;
-    }
-    if (rows.length > 0) {
-      await (0, import_promises2.appendFile)(outputPath, ledgerRowsToCsv(rows, false), "utf-8");
-      summary = summarizeLedgerRows(summary, rows);
-    }
-    const nextCursor = typeof payload.next_cursor === "string" && payload.next_cursor.length > 0 ? payload.next_cursor : null;
-    if (payload.has_more !== true || nextCursor === null) {
-      break;
-    }
-    if (nextCursor === cursor) break;
-    cursor = nextCursor;
-  }
+  const summary = await exportLedger(http, outputPath, {
+    sinceAt,
+    runId: options.runId,
+    operation: options.operation
+  });
   printCommandEnvelope(
     {
       output_path: outputPath,
       row_count: summary.row_count,
+      has_more: false,
+      is_truncated: false,
+      next_cursor: null,
       net_delta_credits: summary.net_delta_credits,
       scope: "workspace",
       ...options.runId ? { run_id: options.runId } : {},
@@ -10208,42 +10321,28 @@ function planPriceText(priceUsd, priceInterval) {
   }
   return `$${priceUsd}${priceInterval ? `/${priceInterval}` : ""}`;
 }
-function planRolloverText(rollover) {
-  const mode = rollover?.mode ?? "none";
-  if (mode === "none") return "no rollover";
-  if (mode === "bounded") {
-    return `rollover up to ${rollover?.max_credits ?? "(unknown)"} credits`;
-  }
-  return `rollover ${mode}`;
+function targetPlanLine(plan) {
+  return `${plan.name} (${plan.sku}) | ${planPriceText(plan.recurring_price_usd, plan.interval)} | ${plan.included_credits} included credits/month | $${plan.purchased_credit_price_usd}/purchased credit | ${plan.acquisition_enabled ? "available" : "unavailable"}`;
 }
 async function handlePlans(options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get(
-    "/api/v2/billing/catalog/current"
+  const client2 = new DeeplineClient();
+  const payload = await client2.billing.targetPlans();
+  const listedCurrentPlan = payload.plans.find(
+    (plan) => plan.sku === payload.current_plan_sku
   );
-  const activePlan = payload.active_plan ?? {};
-  const plans = Array.isArray(payload.plans) ? payload.plans : [];
-  const meters = Array.isArray(payload.meters) ? payload.meters : Array.isArray(payload.metrics) ? payload.metrics : [];
+  const currentPlan = listedCurrentPlan ?? (await client2.billing.targetStatus()).plan;
   const lines = [
-    `Catalog: ${payload.catalog_id ?? "(unknown)"} (version ${payload.catalog_version ?? "(unknown)"})`,
-    `Active plan: ${activePlan.public_name ?? "(unknown)"} (${activePlan.plan_version_id ?? "(unknown)"})`,
-    `Assigned by: ${activePlan.assigned_by ?? "default"} | subscription: ${activePlan.has_subscription ? "yes" : "no"}`,
-    ...plans.length === 0 ? ["Plans: none published"] : [
-      "Plans:",
-      ...plans.map(
-        (plan) => `${plan.public_name ?? "(unknown)"} (${plan.plan_version_id ?? "(unknown)"}) | ${planPriceText(plan.price_usd, plan.price_interval)} | ${plan.monthly_grant_credits ?? 0} credits/cycle | ${planRolloverText(plan.rollover)} | ${plan.acquirable ? "acquirable" : "not acquirable"}`
-      )
-    ],
-    ...meters.length === 0 ? ["Metrics: none"] : [
-      "Metrics:",
-      ...meters.map(
-        (meter) => `${meter.id ?? "(unknown)"} | ${meter.name ?? "(unknown)"}`
-      )
-    ]
+    `Current plan: ${currentPlan.name} (${currentPlan.sku}) | ${planPriceText(currentPlan.recurring_price_usd, currentPlan.interval)} | ${currentPlan.included_credits ?? "(unknown)"} included credits/month`,
+    `Pending plan: ${payload.pending_plan_sku ?? "none"}`,
+    `Plan changes: ${payload.acquisition_enabled ? "enabled" : "disabled"}`,
+    ...payload.plans.length === 0 ? ["Plans: none available"] : ["Plans:", ...payload.plans.map(targetPlanLine)],
+    "Change plan: deepline billing change-plan <plan_sku> --json"
   ];
+  const legacyPayload = shouldEmitJson(options.json) ? await client2.billing.plans() : null;
   printCommandEnvelope(
     {
-      ...payload,
+      ...legacyPayload ?? payload,
+      ...legacyPayload ? { target_billing: payload } : {},
       render: { sections: [{ title: "billing plans", lines }] }
     },
     { json: options.json }
@@ -10618,7 +10717,10 @@ async function handleAutoRechargeStatus(options) {
   const lines = [
     `State: ${state}`,
     ...payload.threshold_credits !== null ? [`Threshold: ${payload.threshold_credits} credits`] : [],
-    ...payload.refill_to_credits !== null ? [`Refill balance to: ${payload.refill_to_credits} credits`] : []
+    ...payload.refill_to_credits !== null ? [`Refill balance to: ${payload.refill_to_credits} credits`] : [],
+    ...payload.purchase_limit_cents !== void 0 ? [
+      payload.purchase_limit_cents === null ? "Automatic purchase cap: none" : `Automatic purchase cap: $${(payload.purchase_limit_cents / 100).toFixed(2)} per rolling 30 days`
+    ] : []
   ];
   printCommandEnvelope(
     {
@@ -10632,6 +10734,18 @@ async function handleAutoRechargeStatus(options) {
 async function handleAutoRechargeSet(options) {
   const thresholdCredits = parseTopUpCredits(options.thresholdCredits);
   const refillToCredits = parseTopUpCredits(options.refillToCredits);
+  const rollingLimitCents = options.purchaseLimitCents === void 0 ? void 0 : options.purchaseLimitCents === "none" ? null : Number(options.purchaseLimitCents);
+  if (rollingLimitCents !== void 0 && rollingLimitCents !== null && (!Number.isSafeInteger(rollingLimitCents) || rollingLimitCents <= 0)) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        code: "INVALID_AUTO_RECHARGE_CONFIGURATION",
+        message: "--purchase-limit-cents must be a positive whole number of USD cents or none."
+      },
+      options
+    );
+    return;
+  }
   if (thresholdCredits === null || refillToCredits === null || refillToCredits <= thresholdCredits) {
     reportBillingFailure(
       {
@@ -10656,7 +10770,8 @@ async function handleAutoRechargeSet(options) {
           body: {
             enabled: true,
             threshold_credits: thresholdCredits,
-            refill_to_credits: refillToCredits
+            refill_to_credits: refillToCredits,
+            ...rollingLimitCents !== void 0 ? { purchase_limit_cents: rollingLimitCents } : {}
           }
         }
       },
@@ -10668,6 +10783,7 @@ async function handleAutoRechargeSet(options) {
     enabled: true,
     thresholdCredits,
     refillToCredits,
+    ...rollingLimitCents !== void 0 ? { purchaseLimitCents: rollingLimitCents } : {},
     idempotencyKey
   });
   printCommandEnvelope(
@@ -10725,6 +10841,60 @@ async function handleBuyCredits(creditsRaw, options) {
     { json: options.json }
   );
 }
+async function handleTopUpRecover(creditsRaw, options) {
+  const credits = parseTopUpCredits(creditsRaw);
+  if (credits === null) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        code: "INVALID_CREDITS",
+        message: "<credits> must be a positive integer."
+      },
+      options
+    );
+    return;
+  }
+  const failure = !options.orgId?.trim() || options.orgId !== options.orgId.trim() ? {
+    code: "INVALID_ORG_ID",
+    message: "--org-id must be the original workspace ID without surrounding whitespace."
+  } : !options.idempotencyKey || options.idempotencyKey.length > 200 || options.idempotencyKey !== options.idempotencyKey.trim() ? {
+    code: "INVALID_BILLING_IDEMPOTENCY_KEY",
+    message: "--idempotency-key must be the original key (1\u2013200 characters without surrounding whitespace)."
+  } : null;
+  if (failure) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        ...failure
+      },
+      options
+    );
+    return;
+  }
+  if (options.dryRun) {
+    printCommandEnvelope(
+      {
+        ok: true,
+        dry_run: true,
+        method: "POST",
+        path: "/api/v2/billing/credit-purchases/recover",
+        idempotency_key: options.idempotencyKey,
+        body: { credits, org_id: options.orgId }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const payload = await new DeeplineClient().billing.recoverCreditPurchase({
+    credits,
+    orgId: options.orgId,
+    idempotencyKey: options.idempotencyKey
+  });
+  printCommandEnvelope(
+    { ok: true, idempotency_key: options.idempotencyKey, ...payload },
+    { json: options.json }
+  );
+}
 async function handleTargetPlan(planSku, options) {
   if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "growth-v1" && planSku !== "growth-canary-v1" && planSku !== "team-v1") {
     reportBillingFailure(
@@ -10842,35 +11012,36 @@ Examples:
     "--cursor <cursor>",
     "Recent-call cursor from the previous response"
   ).option("--run-id <run_id>", "Show recent usage for one play run").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleUsage);
-  billing.command("limit").description("Show configured monthly limit state.").addHelpText(
+  billing.command("limit").description("Show configured monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
-  Read-only. Shows whether the monthly workspace cap is enabled and how many
-  Deepline credits remain before the cap.
+  Read-only. Shows whether monthly workspace spend guidance is enabled.
+  Guidance does not reject funded work; available balance remains exact.
 
 Examples:
   deepline billing limit
   deepline billing limit --json
 `
   ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleLimit);
-  billing.command("set-limit").description("Set monthly credit cap.").addHelpText(
+  billing.command("set-limit").description("Set monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
   Mutates workspace billing settings. The argument is a Deepline credit amount,
-  not dollars and not provider credits.
+  not dollars and not provider credits. Guidance is advisory; it does not
+  replace the exact available-balance admission check.
 
 Examples:
   deepline billing set-limit 500
   deepline billing set-limit 500 --json
 `
   ).argument("<credits>", "Monthly credits limit").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSetLimit);
-  billing.command("off").description("Disable monthly credit cap.").addHelpText(
+  billing.command("off").description("Disable monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
-  Mutates workspace billing settings by removing the monthly Deepline credit cap.
+  Mutates workspace billing settings by removing monthly Deepline spend guidance.
 
 Examples:
   deepline billing off
@@ -10924,7 +11095,9 @@ Examples:
     `
 Notes:
   Read-only server query that writes a local CSV file. With --json, stdout is a
-  summary containing the output path and row count.
+  summary containing the output path, row count, and completeness metadata.
+  Exports the complete window using bounded pages. For an exact start timestamp:
+  deepline billing ledger export all --since <ISO-8601> --json
 
 Examples:
   deepline billing history --time 1m
@@ -10966,6 +11139,18 @@ Examples:
     "Stable retry key for the same intended top-up"
   ).option("--dry-run", "Print the planned top-up without charging").option("--compact", "Keep only high-signal fields in JSON output").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleTopUp);
   billing.command("buy").description("Buy credits through the target billing contract.").argument("<credits>", "Positive integer Deepline credit amount").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleBuyCredits);
+  billing.command("top-up-recover").description(
+    "Inspect or retire an original top-up intent without starting a payment."
+  ).argument("<credits>", "Original positive integer Deepline credit amount").requiredOption(
+    "--org-id <original-org>",
+    "Original workspace ID (must match the authenticated workspace)"
+  ).requiredOption(
+    "--idempotency-key <original-key>",
+    "Original purchase key; never generates a new key"
+  ).option("--dry-run", "Print the recovery request without changing state").option("--json", "Emit JSON output. Also automatic when stdout is piped").addHelpText(
+    "after",
+    "\nAn absent intent is durably retired; an existing operation is returned unchanged.\nThis command never starts a payment. Use the original amount, workspace, and key.\nExample:\n  deepline billing top-up-recover 1000 --org-id org_original --idempotency-key original-purchase-key --json\n"
+  ).action(handleTopUpRecover);
   billing.command("status").description("Show normalized target billing state.").option("--json", "Emit JSON output").action(handleTargetStatus);
   billing.command("auto-recharge").description("Inspect and manage automatic Deepline credit recharge.").addHelpText(
     "after",
@@ -10986,24 +11171,37 @@ Examples:
     ).requiredOption(
       "--refill-to-credits <credits>",
       "Recharge the balance to this amount"
+    ).option(
+      "--purchase-limit-cents <cents>",
+      "Limit automatic purchases over rolling 30 days (USD cents)"
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeSet)
   ).addCommand(
     new import_commander.Command("off").description(
       "Disable automatic recharge without clearing saved amounts."
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeOff)
+  ).addCommand(
+    new import_commander.Command("trigger").description(
+      "Evaluate capped automatic recharge and resume any pending purchase."
+    ).option("--json", "Emit JSON output").action(async (options) => {
+      const result = await new DeeplineClient().billing.autoRecharge.trigger();
+      printCommandEnvelope({ ok: true, ...result }, { json: options.json });
+    })
   );
-  billing.command("change-plan").description("Start or change the target billing plan.").argument("<plan_sku>", "payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
+  billing.command("change-plan").description("Start or change the target billing plan.").argument(
+    "<plan_sku>",
+    "payg-v1, builder-v1, growth-v1, growth-canary-v1, or team-v1"
+  ).option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlan);
   billing.command("cancel-plan").description("Cancel a target subscription at period end, or undo it.").option("--undo", "Undo a pending period-end cancellation").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleTargetPlanCancellation);
   billing.command("portal").description("Open the Stripe-hosted billing recovery portal.").option("--no-open", "Print the URL without opening a browser").option("--json", "Emit JSON output").action(handleTargetPortal);
   billing.command("plans").description("Show published plans and the plan you are on.").addHelpText(
     "after",
     `
 Notes:
-  Read-only. Answers "what plans exist and what am I on": each plan's price,
-  monthly grant credits, rollover policy, and whether it is open for
-  subscription, plus the catalog's usage metrics. All amounts are Deepline
-  credits and Deepline-facing USD, never raw provider spend. Subscribe to a
-  listed plan with: deepline billing subscribe <plan_version_id>
+  Read-only. Shows the current target billing plan, pending plan, and every
+  visible plan's recurring price, included credits, purchased-credit price,
+  and current acquisition availability. All amounts are Deepline credits and
+  Deepline-facing USD, never raw provider spend. Change to an available plan
+  with: deepline billing change-plan <plan_sku>
 
 Examples:
   deepline billing plans
@@ -11025,7 +11223,7 @@ Examples:
   deepline billing subscribe runtime-395-2026-07-v1
   deepline billing subscribe runtime-395-2026-07-v1 --no-open --json
 `
-  ).argument("<plan_version_id>", "Plan version id from `billing plans`").option("--no-open", "Print the checkout URL without opening a browser").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSubscribe);
+  ).argument("<plan_version_id>", "Legacy billing plan version id").option("--no-open", "Print the checkout URL without opening a browser").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSubscribe);
   billing.command("subscription").description("Inspect and manage subscription state for the workspace.").addHelpText(
     "after",
     `
@@ -11284,6 +11482,7 @@ function mergeCanonicalRowsInfo(left, right) {
       ...right.recoveredReturnPaths ?? []
     ])
   ];
+  const currentTable = left.currentTable || right.currentTable;
   return {
     ...fallback,
     ...preferred,
@@ -11297,6 +11496,7 @@ function mergeCanonicalRowsInfo(left, right) {
     tableNamespace: preferred.tableNamespace ?? fallback.tableNamespace,
     ...left.recovered || right.recovered ? { recovered: true } : {},
     ...recoveredReturnPaths2.length ? { recoveredReturnPaths: recoveredReturnPaths2 } : {},
+    ...currentTable ? { currentTable: true } : {},
     ...exportUnavailableReason ? {
       exportUnavailableReason,
       ...unavailableSource?.exportUnavailableMessage ? {
@@ -11357,6 +11557,11 @@ function isSerializedDataset(value) {
 function isPackagedDatasetOutput(value) {
   return isRecord8(value) && value.kind === "dataset" && isRecord8(value.preview) && Array.isArray(value.preview.rows);
 }
+function hasCurrentTableExport(value) {
+  if (!isRecord8(value) || !isRecord8(value.actions)) return false;
+  const exportCsv = value.actions.exportCsv;
+  return isRecord8(exportCsv) && isRecord8(exportCsv.scope) && exportCsv.scope.kind === "database" && exportCsv.scope.mutability === "current";
+}
 function recoveredReturnPaths(value) {
   if (!Array.isArray(value)) return [];
   return [
@@ -11463,6 +11668,7 @@ function canonicalRowsInfoFromCandidate(input2) {
       datasetId: typeof candidate.value.datasetId === "string" ? candidate.value.datasetId : null,
       tableNamespace: typeof candidate.value.tableNamespace === "string" ? candidate.value.tableNamespace : null,
       ...candidate.value.recovered === true ? { recovered: true } : {},
+      ...hasCurrentTableExport(candidate.value) ? { currentTable: true } : {},
       ...recoveredReturnPaths(candidate.value.recoveredReturnPaths).length ? {
         recoveredReturnPaths: recoveredReturnPaths(
           candidate.value.recoveredReturnPaths
@@ -19777,6 +19983,7 @@ async function startAndWaitForPlayCompletionByStreamOnce(input2) {
             runId: workflowId,
             playName: input2.playName,
             dashboardUrl,
+            inputFieldCount: Object.keys(input2.request.input ?? {}).length,
             jsonOutput: false,
             progress: input2.progress
           });
@@ -20894,11 +21101,15 @@ function formatPackageDatasetActionLines(packaged) {
         `  ${category} dataset ${path}: ${rowCount === null ? "unknown rows" : `${formatInteger(rowCount)} ${rowCount === 1 ? "row" : "rows"}`}`
       );
     }
-    const exportCommand = actionToCommand(actions.exportCsv);
+    const exportAction = readRecord(actions.exportCsv);
+    const exportCommand = actionToCommand(exportAction);
+    const exportScope = readRecord(exportAction?.scope);
     const currentQueryCommand = actionToCommand(actions.queryCurrentTable);
     const legacyQueryCommand = actionToCommand(actions.query);
     if (exportCommand) {
-      lines.push(`    export this run: ${exportCommand}`);
+      lines.push(
+        exportScope?.kind === "database" ? `    export current table (may include other runs): ${exportCommand}` : `    export this run: ${exportCommand}`
+      );
     }
     if (currentQueryCommand) {
       lines.push(`    query current table: ${currentQueryCommand}`);
@@ -21307,33 +21518,29 @@ function sqlSafeExportColumnName(id) {
 async function fetchBackingDatasetRows(input2) {
   const playName = extractRunPlayName(input2.status);
   const tableNamespace = input2.rowsInfo.tableNamespace?.trim();
+  const currentTable = input2.rowsInfo.currentTable === true;
   if (!playName || !tableNamespace) {
     return null;
   }
   const sheetRows = [];
   let offset = 0;
-  let expectedTotal = input2.rowsInfo.totalRows;
   while (true) {
     const page = await input2.client.runs.exportDatasetRows({
       playName,
       tableNamespace,
-      runId: input2.status.runId,
+      ...currentTable ? {} : { runId: input2.status.runId },
       limit: RUN_EXPORT_PAGE_SIZE,
       offset,
       rowMode: "all"
     });
     sheetRows.push(...page.rows);
-    const summaryTotal = page.summary?.stats?.total;
-    if (typeof summaryTotal === "number" && Number.isFinite(summaryTotal)) {
-      expectedTotal = Math.max(expectedTotal, Math.trunc(summaryTotal));
-    }
-    if (page.rows.length < RUN_EXPORT_PAGE_SIZE || sheetRows.length >= expectedTotal) {
+    if (page.rows.length < RUN_EXPORT_PAGE_SIZE) {
       break;
     }
     offset += page.rows.length;
   }
   const rows = sheetRows.map(exportableSheetRow).filter((row) => Boolean(row));
-  if (rows.length < input2.rowsInfo.totalRows) {
+  if (!currentTable && rows.length < input2.rowsInfo.totalRows || currentTable && rows.length === 0 && input2.rowsInfo.totalRows > 0) {
     return null;
   }
   const columns = mergeExportColumns(
@@ -21346,6 +21553,7 @@ async function fetchBackingDatasetRows(input2) {
     columns,
     totalRows: rows.length,
     complete: true,
+    ...currentTable ? { currentTable: true } : {},
     source: `${input2.rowsInfo.source ?? "result.rows"} -> /api/v2/plays/${playName}/sheet?tableNamespace=${tableNamespace}`
   };
 }
@@ -21370,12 +21578,14 @@ function assertDatasetHasExportableRows(input2) {
   if (input2.rowsInfo.rows.length > 0) {
     return input2.rowsInfo;
   }
+  if (input2.rowsInfo.currentTable === true && input2.rowsInfo.totalRows === 0) {
+    return input2.rowsInfo;
+  }
   const datasetLabel = input2.datasetPath ?? input2.rowsInfo.tableNamespace ?? input2.rowsInfo.source ?? "result.rows";
   const available = input2.availableRows.map((info) => info.tableNamespace ?? info.source).filter((name) => typeof name === "string");
   const runStatus = String(input2.status.status ?? "").toLowerCase();
-  const failedBeforePersisting = runStatus !== "completed";
   throw new DeeplineError(
-    `Run ${input2.status.runId} has zero rows to export from dataset '${datasetLabel}'.` + (failedBeforePersisting ? ` The run status is '${runStatus || "unknown"}', so it likely failed before persisting rows to this dataset \u2014 provider calls may have been billed without a durable row. Fix the run's failure cause and re-run to resume.` : " The run completed but this dataset materialized no rows.") + (available.length > 0 ? ` Available datasets: ${available.join(", ")}.` : " No datasets were materialized for this run."),
+    `Run ${input2.status.runId} has zero rows to export from dataset '${datasetLabel}'. The run status is '${runStatus || "unknown"}', so it likely failed before persisting rows to this dataset \u2014 provider calls may have been billed without a durable row. Fix the run's failure cause and re-run to resume.` + (available.length > 0 ? ` Available datasets: ${available.join(", ")}.` : " No datasets were materialized for this run."),
     void 0,
     "RUN_EXPORT_EMPTY",
     {
@@ -21386,23 +21596,6 @@ function assertDatasetHasExportableRows(input2) {
     }
   );
 }
-function assertDatasetExportAvailable(input2) {
-  if (input2.rowsInfo.exportUnavailableReason !== "shared_table_namespace") {
-    return;
-  }
-  throw new DeeplineError(
-    input2.rowsInfo.exportUnavailableMessage ?? "Run CSV export is unavailable because multiple Dataset Handles share one physical table.",
-    void 0,
-    "RUN_EXPORT_UNAVAILABLE",
-    {
-      runId: input2.status.runId,
-      dataset: input2.rowsInfo.source,
-      datasetId: input2.rowsInfo.datasetId ?? null,
-      tableNamespace: input2.rowsInfo.tableNamespace ?? null,
-      reason: input2.rowsInfo.exportUnavailableReason
-    }
-  );
-}
 async function exportPlayStatusRows(client2, status, outPath, options = {}) {
   if (!outPath) {
     return null;
@@ -21481,7 +21674,6 @@ ${commands.join("\n")}`,
       `Run ${status.runId} did not expose a row-shaped final output to export.`
     );
   }
-  assertDatasetExportAvailable({ rowsInfo, status });
   const attempts = Math.max(1, Math.trunc(options.attempts ?? 1));
   const retryDelayMs = Math.max(0, Math.trunc(options.retryDelayMs ?? 0));
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -21496,6 +21688,9 @@ ${commands.join("\n")}`,
       if (error instanceof DeeplineError && error.code === "RUN_EXPORT_SCOPE_MISMATCH") {
         throw error;
       }
+      if (rowsInfo.currentTable) {
+        throw error;
+      }
       if (!rowsInfo.complete) {
         throw error;
       }
@@ -21509,7 +21704,8 @@ ${commands.join("\n")}`,
       });
       return {
         path: RunDataset.from(guarded2).exportCsv(outPath),
-        rowsInfo: guarded2
+        rowsInfo: guarded2,
+        currentTable: fetchedRowsInfo.currentTable === true
       };
     }
     if (rowsInfo.complete) {
@@ -21521,7 +21717,8 @@ ${commands.join("\n")}`,
       });
       return {
         path: RunDataset.from(guarded2).exportCsv(outPath),
-        rowsInfo: guarded2
+        rowsInfo: guarded2,
+        currentTable: false
       };
     }
     if (attempt < attempts && retryDelayMs > 0) {
@@ -21556,7 +21753,8 @@ ${commands.join("\n")}`,
   });
   return {
     path: RunDataset.from(guarded).exportCsv(outPath),
-    rowsInfo: guarded
+    rowsInfo: guarded,
+    currentTable: false
   };
 }
 function extractActiveRunsFromError(error) {
@@ -23420,12 +23618,13 @@ async function handleRunsList(args) {
     return 1;
   }
   const client2 = new DeeplineClient();
-  const runs = (await client2.runs.list({
+  const page = await client2.runs.listPage({
     ...playName ? { play: playName } : {},
     ...statusFilter ? { status: statusFilter } : {},
     ...limit !== void 0 ? { limit } : {},
     ...offset !== void 0 ? { offset } : {}
-  })).map((run) => ({
+  });
+  const runs = page.runs.map((run) => ({
     runId: run.workflowId,
     // `workflowId` is the legacy SDK name for the same public Deepline run
     // identity. Keep it during the compatibility window, but never label the
@@ -23463,11 +23662,24 @@ async function handleRunsList(args) {
     if (run.rootRunId) lines2.push(`  root: ${run.rootRunId}`);
     return lines2.join("\n");
   });
+  const nextOffset = (page.offset ?? offset ?? 0) + runs.length;
+  const nextPage = page.hasMore && playName ? `deepline runs list --play ${shellQuote2(playName)}${statusFilter ? ` --status ${shellQuote2(statusFilter)}` : ""} --limit ${page.limit ?? limit ?? 20} --offset ${nextOffset} --json` : null;
+  if (page.hasMore) {
+    lines.push("List truncated \u2014 more runs match this filter.");
+    lines.push(
+      nextPage ? `Next page: ${nextPage}` : "Narrow with --play <play-name> to page through runs."
+    );
+  }
   printCommandEnvelope(
     {
       runs,
       count: runs.length,
+      ...page.total !== void 0 ? { total: page.total } : {},
+      offset: page.offset ?? offset ?? 0,
+      limit: page.limit ?? limit ?? (playName ? 20 : 100),
+      ...page.hasMore !== void 0 ? { has_more: page.hasMore, is_truncated: page.hasMore } : {},
       next: {
+        page: nextPage,
         get: runs[0]?.runId ? `deepline runs get ${runs[0].runId} --json` : null
       },
       render: { sections: [{ title: "runs", lines }] }
@@ -23893,6 +24105,11 @@ async function handleRunExport(args) {
     datasetPath
   });
   const source = exportResult?.rowsInfo.source ?? datasetPath ?? null;
+  const currentTableNotice = exportResult?.currentTable ? {
+    code: "CURRENT_SHARED_DATASET",
+    message: "This CSV is the current shared dataset and may include writes from another run.",
+    full_run_output_command: `deepline runs get ${status.runId} --full --json`
+  } : null;
   const next = {
     ...buildRunNextCommands(status),
     export: runExportRetryCommand(status.runId, outPath, datasetPath ?? source)
@@ -23904,6 +24121,7 @@ async function handleRunExport(args) {
     source,
     rowCount: exportResult?.rowsInfo.totalRows ?? null,
     columns: exportResult?.rowsInfo.columns ?? [],
+    ...currentTableNotice ? { notice: currentTableNotice } : {},
     ...metadataOutPath ? { metadata_path: metadataOutPath } : {},
     local: { csv_path: exportResult?.path ?? null },
     next,
@@ -23913,6 +24131,10 @@ async function handleRunExport(args) {
           title: "run export",
           lines: [
             `Exported ${status.runId} to ${exportResult?.path ?? outPath}`,
+            ...currentTableNotice ? [
+              "Current shared dataset: this CSV may include writes from another run.",
+              `This run's full returned output: ${currentTableNotice.full_run_output_command}`
+            ] : [],
             ...source ? [`source=${source}`] : []
           ]
         }
@@ -24115,23 +24337,47 @@ async function handlePlayVersions(args) {
   }
   return 0;
 }
+function formatPlayCostEstimate(estimate) {
+  if (!estimate || estimate.status === "unavailable") {
+    return `unavailable${estimate ? `: ${estimate.message}` : ""}`;
+  }
+  const formatCredits = (value) => value.toLocaleString("en-US", {
+    maximumFractionDigits: value < 1 ? 4 : 2
+  });
+  const credits = estimate.lowCredits === estimate.highCredits ? `${estimate.source === "observed" ? "~" : ""}${formatCredits(estimate.lowCredits)}` : `${formatCredits(estimate.lowCredits)}\u2013${formatCredits(estimate.highCredits)}`;
+  const unit = estimate.unit === "row" ? "output row" : "run";
+  const source = estimate.source === "observed" ? `observed from ${estimate.sampleRunCount} ${estimate.sampleRunCount === 1 ? "run" : "runs"}` : "static estimate";
+  return `${credits} Deepline credits per ${unit} (${source})`;
+}
 async function handlePlayList(args) {
   const jsonOutput = argsWantJson(args);
+  const showCost = args.includes("--show-cost");
   const client2 = new DeeplineClient();
   const categoriesIndex = args.indexOf("--categories");
   const categories = categoriesIndex >= 0 ? args[categoriesIndex + 1]?.trim() : void 0;
-  const plays = await client2.listPlays({
+  const limitIndex = args.indexOf("--limit");
+  const cursorIndex = args.indexOf("--cursor");
+  const limit = limitIndex >= 0 ? Number(args[limitIndex + 1]) : void 0;
+  const cursor = cursorIndex >= 0 ? args[cursorIndex + 1] : void 0;
+  if (limitIndex >= 0 && (!Number.isSafeInteger(limit) || limit < 1) || cursorIndex >= 0 && !cursor?.trim()) {
+    console.error("Pass a positive --limit and a non-empty --cursor.");
+    return 2;
+  }
+  const page = await client2.listPlaysPage({
     categories,
-    includeToolCategories: true
-  });
-  if (jsonOutput) {
-    process.stdout.write(`${JSON.stringify(plays)}
-`);
-    return 0;
+    includeToolCategories: true,
+    ...showCost ? { includeCostEstimates: true } : {},
+    limit,
+    cursor
+  });
+  const plays = page.plays;
+  const nextPage = page.hasMore && page.cursor ? `deepline plays list${categories ? ` --categories ${shellQuote2(categories)}` : ""}${limit ? ` --limit ${limit}` : ""}${showCost ? " --show-cost" : ""} --cursor ${shellQuote2(page.cursor)} --json` : null;
+  if (page.hasMore && !nextPage) {
+    throw new Error(
+      "Play list reported more results without a continuation cursor"
+    );
   }
-  process.stdout.write(`${plays.length} plays available:
-
-`);
+  const lines = [`${plays.length} plays in this page:`];
   for (const play of plays) {
     const flags = [
       play.pinned ? "pinned" : null,
@@ -24141,32 +24387,48 @@ async function handlePlayList(args) {
       play.isDraftDirty ? "draft-dirty" : null
     ].filter(Boolean).join(", ");
     const reference = formatPlayListReference(play);
-    process.stdout.write(`  ${reference}${flags ? ` [${flags}]` : ""}
-`);
+    lines.push(`  ${reference}${flags ? ` [${flags}]` : ""}`);
     if (play.inputSchema || play.hasInputSchema) {
-      process.stdout.write("    inputSchema: yes\n");
+      lines.push("    inputSchema: yes");
     }
     if (play.triggerStatus?.cron) {
-      process.stdout.write(
-        `    scheduled execution: ${cronExecutionLabel(play.triggerStatus.cron)}
-`
+      lines.push(
+        `    scheduled execution: ${cronExecutionLabel(play.triggerStatus.cron)}`
       );
       if (play.triggerStatus.blockedReason) {
-        process.stdout.write(
-          `    schedule issue: ${play.triggerStatus.blockedReason}
-`
-        );
+        lines.push(`    schedule issue: ${play.triggerStatus.blockedReason}`);
       }
     } else {
-      process.stdout.write("    scheduled execution: not configured\n");
+      lines.push("    scheduled execution: not configured");
     }
     if (play.triggerStatus?.webhook) {
-      process.stdout.write(`    webhook: ${play.triggerStatus.webhook}
-`);
+      lines.push(`    webhook: ${play.triggerStatus.webhook}`);
     }
-    process.stdout.write(`    run: deepline plays run ${reference} --watch
-`);
+    if (showCost) {
+      lines.push(
+        `    cost estimate: ${formatPlayCostEstimate(play.costEstimate)}`
+      );
+    }
+    lines.push(`    run: deepline plays run ${reference} --watch`);
+  }
+  if (page.hasMore) {
+    lines.push("List truncated \u2014 more plays are available.");
+    lines.push(`Next page: ${nextPage}`);
   }
+  printCommandEnvelope(
+    {
+      plays,
+      count: plays.length,
+      has_more: page.hasMore,
+      is_truncated: page.hasMore,
+      next_cursor: page.cursor,
+      next: { page: nextPage },
+      render: {
+        sections: [{ title: "plays", lines }]
+      }
+    },
+    { json: jsonOutput }
+  );
   return 0;
 }
 async function handlePlayPin(args, pinned) {
@@ -24330,51 +24592,18 @@ function compactPlaySchema(schema) {
   ).filter((field) => Boolean(field?.name)) : [];
   return fields.length > 0 ? { fields } : schema;
 }
-function playSchemaMetadata(schema, key) {
-  if (!schema || typeof schema !== "object" || Array.isArray(schema))
-    return null;
-  const value = schema[key];
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function playRunCommand(play, options) {
-  const target = play.reference || play.name;
-  if (options?.csvInput) {
-    const inputField = typeof options.csvInput.inputField === "string" && options.csvInput.inputField.trim() ? options.csvInput.inputField.trim() : "csv";
-    return `deepline plays run ${target} --input '${JSON.stringify({ [inputField]: "leads.csv" })}' --watch`;
-  }
-  return `deepline plays run ${target} --input '{...}' --watch`;
-}
-function summarizePlayListItemForCli(play, options) {
-  const aliases = play.aliases ?? [];
-  const csvInput = playSchemaMetadata(play.inputSchema, "csvInput");
-  const rowOutputSchema = playSchemaMetadata(
-    play.outputSchema,
-    "rowOutputSchema"
-  );
-  const runCommand2 = playRunCommand(play, { csvInput });
-  const cloneEditStarter = buildCloneEditStarter(play);
+function summarizePlayGrepResult(play) {
+  const reference = formatPlayListReference(play);
   return {
-    name: play.name,
-    ...play.reference ? { reference: play.reference } : {},
-    ...play.displayName ? { displayName: play.displayName } : {},
-    pinned: Boolean(play.pinned),
-    toolCategories: play.toolCategories ?? [],
-    origin: play.origin,
-    ownerType: play.ownerType,
-    canEdit: play.canEdit,
-    canClone: play.canClone,
-    aliases,
-    inputSchema: options?.compact ? compactPlaySchema(play.inputSchema) : play.inputSchema ?? null,
-    outputSchema: options?.compact ? compactPlaySchema(play.outputSchema) : play.outputSchema ?? null,
-    ...csvInput ? { csvInput } : {},
-    ...rowOutputSchema ? { rowOutputSchema } : {},
-    runCommand: runCommand2,
-    examples: [runCommand2],
-    ...cloneEditStarter ? { cloneEditStarter } : {},
-    currentPublishedVersion: play.currentPublishedVersion ?? null,
-    isDraftDirty: play.isDraftDirty
+    name: play.displayName?.trim() || play.name,
+    reference,
+    matches: play.matches ?? [],
+    describe: `deepline plays describe ${reference} --json`
   };
 }
+function formatPlayGrepMatches(matches) {
+  return matches.map((match) => `${match.field}: ${match.terms.join(", ")}`).join("; ");
+}
 async function handlePlaySearch(args) {
   let options;
   try {
@@ -24430,84 +24659,35 @@ async function handlePlaySearch(args) {
   }
   return 0;
 }
-function normalizePlayGrepText(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "string") return value.toLowerCase();
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value).toLowerCase();
-  }
-  if (Array.isArray(value)) return value.map(normalizePlayGrepText).join(" ");
-  if (typeof value === "object") {
-    return Object.values(value).map(normalizePlayGrepText).join(" ");
-  }
-  return "";
-}
-function parsePlayGrepTerms(query, mode) {
-  const trimmed = query.trim().toLowerCase();
-  if (!trimmed) return [];
-  if (mode === "phrase") return [trimmed];
-  const matches = trimmed.match(/"([^"]+)"|'([^']+)'|\S+/g) ?? [];
-  return matches.map((term) => term.replace(/^["']|["']$/g, "").trim()).filter(Boolean);
-}
-function matchesPlayGrepQuery(value, query, mode) {
-  const terms = parsePlayGrepTerms(query, mode);
-  if (terms.length === 0) return true;
-  const haystack = normalizePlayGrepText(value);
-  if (mode === "any") return terms.some((term) => haystack.includes(term));
-  return terms.every((term) => haystack.includes(term));
-}
 async function handlePlayGrep(args) {
   const query = args[0]?.trim();
   if (!query) {
-    console.error(
-      "Usage: deepline plays grep <query> [--mode all|any|phrase] [--compact] [--json]"
-    );
+    console.error("Usage: deepline plays grep <query> [--json]");
     return 1;
   }
-  let mode = "all";
-  for (let index = 1; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--mode" && args[index + 1]) {
-      const rawMode = args[++index].trim().toLowerCase();
-      mode = rawMode === "any" || rawMode === "phrase" ? rawMode : "all";
-    }
-  }
-  const compact = args.includes("--compact");
   const client2 = new DeeplineClient();
-  const plays = (await client2.listPlays({
-    grep: query,
-    grepMode: mode
-  })).filter(
-    (play) => matchesPlayGrepQuery(
-      {
-        name: play.name,
-        reference: play.reference,
-        displayName: play.displayName,
-        origin: play.origin,
-        ownerType: play.ownerType,
-        aliases: play.aliases,
-        toolCategories: play.toolCategories,
-        inputSchema: play.inputSchema,
-        outputSchema: play.outputSchema
-      },
-      query,
-      mode
-    )
-  ).map((play) => summarizePlayListItemForCli(play, { compact }));
+  const results = (await client2.listPlays({ grep: query })).map(
+    summarizePlayGrepResult
+  );
   if (argsWantJson(args)) {
     printCompactJson({
-      plays,
-      count: plays.length,
+      plays: results,
+      count: results.length,
       query,
-      grep: { mode, terms: parsePlayGrepTerms(query, mode) }
+      grep: { query }
     });
     return 0;
   }
-  process.stdout.write(`${plays.length} plays found:
+  process.stdout.write(
+    `${results.length} results for ${JSON.stringify(query)}:
 
-`);
-  for (const play of plays) {
-    printPlayDescription(play);
+`
+  );
+  for (const result of results) {
+    console.log(result.name);
+    const matches = formatPlayGrepMatches(result.matches);
+    if (matches) console.log(`  Matched: ${matches}`);
+    console.log(`  Describe: ${result.describe}`);
     console.log("");
   }
   return 0;
@@ -25207,7 +25387,7 @@ Pass-through input flags:
     if (effectiveTarget && passthroughArgs[0] === effectiveTarget) {
       passthroughArgs.shift();
     }
-    process.exitCode = await handlePlayRun([
+    const exitCode = await handlePlayRun([
       ...effectiveTarget ? [effectiveTarget] : [],
       ...options.file ? ["--file", options.file] : [],
       ...options.name ? ["--name", options.name] : [],
@@ -25237,6 +25417,11 @@ Pass-through input flags:
       ...options.full ? ["--full"] : [],
       ...passthroughArgs
     ]);
+    recordCliTrace({
+      phase: "cli.play_command_exit",
+      exitCode
+    });
+    process.exitCode = exitCode;
   });
   registerPlayBootstrapCommand(play);
   play.command("get <target>").description(
@@ -25278,17 +25463,22 @@ Examples:
     `
 Notes:
   Inventory command for saved org plays and prebuilt plays. Use search for
-  ranked discovery by task or schema.
+  ranked discovery by task or schema. Returns one bounded page with has_more,
+  is_truncated, next_cursor, and a next-page command. Use --limit to choose
+  the page size and --cursor to continue with the same filters.
 
 Examples:
   deepline plays list
   deepline plays search email --json
 `
-  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
+  ).option("--limit <count>", "Page size").option("--cursor <cursor>", "Continue a previous page").option("--show-cost", "Include the per-row or per-run cost estimate").option("--json", "Emit JSON output. Also automatic when stdout is piped").option(
     "--categories <categories>",
     "Filter by comma-separated canonical tool categories"
   ).action(async (options) => {
     process.exitCode = await handlePlayList([
+      ...options.limit ? ["--limit", options.limit] : [],
+      ...options.cursor ? ["--cursor", options.cursor] : [],
+      ...options.showCost ? ["--show-cost"] : [],
       ...options.categories ? ["--categories", options.categories] : [],
       ...options.json ? ["--json"] : []
     ]);
@@ -25327,13 +25517,13 @@ Notes:
   because they are trusted, robust plays with maintained contracts. Use describe
   on a result before running it.
   Add --all only when you are specifically looking for a play you created.
-  The grep alias is the same ranked retrieval surface with a more literal name
-  for agents that are filtering the play registry.
+  Use plays grep to search active org-owned Plays through Convex's indexed
+  authored corpus. It does not search prebuilt or archived Plays.
 
 Examples:
   deepline plays search email
   deepline plays search email --all
-  deepline plays grep "linkedin to email" --compact --json
+  deepline plays grep "linkedin to email" --json
   deepline plays describe prebuilt/person-linkedin-to-email --json
 `
   ).option("--compact", "Emit compact schemas").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
@@ -25346,25 +25536,22 @@ Examples:
     ]);
   });
   addPlaySearchCommand(play.command("search <query>"));
-  play.command("grep <query>").description("Literal grep over play names, schemas, and descriptions.").addHelpText(
+  play.command("grep <query>").description(
+    "Search active org-owned Plays through Convex full-text search."
+  ).addHelpText(
     "after",
     `
 Notes:
-  Literal registry filtering. Terms are matched case-insensitively against play
-  names, references, display names, ownership, and schemas. Use
-  --mode phrase for exact phrase matching, --mode any for OR, and the default
-  --mode all for AND.
+  Queries use Convex token semantics over the indexed authored Play corpus.
+  Prebuilt and archived Plays are not part of this index.
 
 Examples:
   deepline plays grep email --json
-  deepline plays grep "company contact" --mode all --json
   deepline plays describe prebuilt/company-to-contact --json
 `
-  ).option("--compact", "Emit compact schemas").option("--mode <mode>", "Grep matching mode: all, any, or phrase").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
     process.exitCode = await handlePlayGrep([
       query,
-      ...options.compact ? ["--compact"] : [],
-      ...options.mode ? ["--mode", options.mode] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
@@ -30962,7 +31149,7 @@ async function compileConfig(input2) {
   })).config;
 }
 function registerEnrichCommand(program) {
-  program.command("enrich").allowUnknownOption(true).description("Run v1-style CSV enrichment through the V2 play runner.").configureHelp({
+  program.command("enrich", { hidden: true }).allowUnknownOption(true).description("Run v1-style CSV enrichment through the V2 play runner.").configureHelp({
     optionTerm(option) {
       return option.long === "--timeout" ? "--timeout SECONDS" : option.flags;
     }
@@ -32018,7 +32205,7 @@ function loadViewerAssets() {
         "viewer"
       )
     ] : [],
-    (0, import_node_path16.join)(process.cwd(), "src", "lib", "cli", "viewer")
+    (0, import_node_path16.join)(process.cwd(), "packages", "sdk", "assets", "viewer")
   ];
   for (const root of candidateRoots2) {
     try {
@@ -32235,7 +32422,7 @@ function addDeprecatedSubcommand(parent, family, subcommand, description) {
   });
 }
 function registerDeprecatedCommands(program) {
-  const session = program.command("session").description("Deprecated legacy session command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
+  const session = program.command("session", { hidden: true }).description("Deprecated legacy session command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
     "after",
     `
 Notes:
@@ -32267,7 +32454,7 @@ Examples:
       `Deprecated legacy "deepline session ${subcommand}" command.`
     );
   }
-  const backend = program.command("backend").description("Deprecated legacy local backend command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
+  const backend = program.command("backend", { hidden: true }).description("Deprecated legacy local backend command namespace.").allowUnknownOption(true).allowExcessArguments(true).option("--json", "Emit JSON output").argument("[args...]").addHelpText(
     "after",
     `
 Notes:
@@ -32303,7 +32490,7 @@ var import_node_fs15 = require("fs");
 var import_node_path17 = require("path");
 var import_promises8 = require("readline/promises");
 
-// src/monitor-fleet-contract.ts
+// ../integration-contracts/monitor-fleet-contract.ts
 var MONITOR_FLEET_MAX_MEMBERS = 1e3;
 var MONITOR_FLEET_AUTHORING_CONTRACT_EDITION = 1;
 var SUPPORTED_MONITOR_FLEET_AUTHORING_CONTRACT_EDITIONS = [
@@ -32989,9 +33176,35 @@ function renderMonitorDeployPlan(payload) {
       "  Inspect: deepline monitors get <key> --json"
     );
   }
+  const identityConflict = asRecord2(payload.identity_conflict);
+  const identityOwner = identityConflict ? asRecord2(identityConflict.existing_monitor) : null;
+  const identityOwnerKey = identityOwner ? asString(identityOwner.key) : void 0;
+  const identityOwnerStatus = identityOwner ? asString(identityOwner.status) : void 0;
+  if (identityConflict) {
+    if (identityOwnerStatus === "provisioning") {
+      lines.push(
+        "",
+        "An in-progress provider operation owns this upstream identity.",
+        "Do not deploy this key yet. Wait, then rerun this dry run."
+      );
+    } else if (identityOwnerKey) {
+      lines.push(
+        "",
+        `An existing monitor owns this upstream identity: ${identityOwnerKey}.`,
+        `Inspect: deepline monitors get ${identityOwnerKey} --json`,
+        "Do not deploy this key unless that conflict is resolved."
+      );
+    } else {
+      lines.push(
+        "",
+        "An existing monitor owns this upstream identity.",
+        "Do not deploy this key until that conflict is resolved."
+      );
+    }
+  }
   lines.push(
     "",
-    valid ? "Deploy for real: re-run this command without --dry-run." : "Fix the definition, then re-run this command."
+    identityConflict ? "Do not deploy for real until this identity conflict clears." : valid ? "Deploy for real: re-run this command without --dry-run." : "Fix the definition, then re-run this command."
   );
   return `${lines.join("\n")}
 `;
@@ -33243,11 +33456,12 @@ async function handleMonitorsDeploy(definition, options) {
       dryRun: true
     });
     const valid = payload2.valid !== false;
+    const hasIdentityConflict = Boolean(asRecord2(payload2)?.identity_conflict);
     printCommandEnvelope(
       { dry_run: true, ...payload2 },
       { json: options.json, text: renderMonitorDeployPlan(payload2) }
     );
-    if (!valid) {
+    if (!valid || hasIdentityConflict) {
       process.exitCode = 7;
     }
     return;
@@ -34278,11 +34492,13 @@ function monitorHealthLine(health) {
   if (health.refresh?.state === "running") {
     return `refreshing whole scope \xB7 scanned ${health.scanned} so far`;
   }
+  const alignmentRequired = health.alignment_required ?? 0;
   return [
     `converged ${health.converged}/${health.scanned}`,
     `needs_repair ${health.needs_repair}`,
     `missing ${health.observed.missing}`,
     `unaudited ${health.observed.unknown + health.observed.unset}`,
+    ...alignmentRequired > 0 ? [`needs_alignment ${alignmentRequired}`] : [],
     `silent ${health.silent}`
   ].join(" \xB7 ");
 }
@@ -34316,7 +34532,9 @@ async function watchMonitorHealth(input2) {
   let last = await input2.client.monitors.health(scope);
   input2.onProgress(last);
   while (Date.now() < deadlineAt) {
-    if (last.refresh?.state !== "running" && last.needs_repair === 0 && last.observed.unknown === 0) {
+    const unresolved = last.observed.unknown + last.observed.unset;
+    const alignmentRequired = last.alignment_required ?? 0;
+    if (last.refresh?.state !== "running" && !last.truncated && last.needs_repair === 0 && (unresolved === 0 || alignmentRequired === unresolved)) {
       return last;
     }
     await new Promise(
@@ -34329,6 +34547,7 @@ async function watchMonitorHealth(input2) {
 }
 function monitorHealthText(health) {
   const partial = health.refresh?.state === "running" ? " (refreshing \u2014 counts below are not final)" : health.truncated ? " (partial \u2014 scope larger than one read)" : "";
+  const unauditedMonitors = health.unaudited_monitors ?? [];
   const lines = [
     `scope: ${health.scope.fleet_id ?? "workspace"}${partial}`,
     monitorHealthLine(health)
@@ -34351,6 +34570,29 @@ function monitorHealthText(health) {
       lines.push(`  ${entry.reason} (${entry.count})${how}`);
     }
   }
+  if (unauditedMonitors.length > 0) {
+    const reason = {
+      not_yet_audited: "has not been observed yet",
+      missing_provider_resource_id: "has no stored upstream resource id",
+      provider_observation_unknown: "the provider observation is still unknown"
+    };
+    lines.push("");
+    lines.push("unresolved monitor observations:");
+    for (const entry of unauditedMonitors) {
+      lines.push(
+        `  ${entry.monitor_key}  ${entry.tool}  \u2014 ${reason[entry.reason]}`
+      );
+    }
+  }
+  if ((health.alignment_required ?? 0) > 0) {
+    lines.push("");
+    lines.push(
+      `${health.alignment_required} monitor(s) need provider identity alignment; normal repair intentionally will not guess or create a paid replacement.`
+    );
+    lines.push(
+      `Run the exact inventory audit, then review one safe adoption candidate: deepline-admin monitors reconcile ${health.scope.org_id} --monitor <monitor-key> --environment production --json`
+    );
+  }
   if (health.worst_offenders.length > 0) {
     lines.push("");
     lines.push(
@@ -34575,9 +34817,8 @@ Exit codes:
 
 Examples:
   deepline monitors status --json
-  deepline monitors available --json          # compact list by default
-  deepline monitors available --full --json   # complete catalog
-  deepline monitors available deepline_native.company_radar --json
+  deepline tools list --categories monitors --json
+  deepline tools get deepline_native.company_radar --json
   deepline monitors check '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'
   deepline monitors deploy --dry-run --file monitor.json
   deepline monitors deploy --file monitor.json
@@ -34747,7 +34988,7 @@ Examples:
     )
   ).action(monitorsAction(handleMonitorsStatus));
   withJsonOption(
-    monitors.command("available [tool-id]").alias("tools").description(
+    monitors.command("available [tool-id]", { hidden: true }).alias("tools").description(
       "List the monitor types you can deploy, or describe one by tool id."
     ).addHelpText(
       "after",
@@ -34864,7 +35105,7 @@ Notes:
   Play delivery. The JSON response reports this validation scope explicitly.
   Provider-specific grammar, precedence, enum applicability, examples, and
   update semantics are returned by the live monitor contract. Inspect it with
-  \`deepline monitors available deepline_native.company_radar --json\`.
+  \`deepline tools get deepline_native.company_radar --json\`.
   For a bounded urgent Deepline Native preview, use
   controls.execution_type="priority". Deepline injects the upstream marker;
   do not author custom_fields yourself. Priority is capped at ten upstream or
@@ -34902,6 +35143,10 @@ Notes:
   no separate repair command or retry queue: rerun the same deploy/update.
   Scheduled reconciliation can also finish that exact saved cleanup; it never
   creates another monitor.
+  For TamRadar, deliberately changing payload.updates_since is an explicit
+  historical replay request, including when redeploying a disabled monitor.
+  Deepline preserves that selected boundary; filter-only deploys and ordinary
+  reactivation start from a fresh future-only source boundary instead.
   For a bounded urgent Deepline Native preview, set
   controls.execution_type="priority". Deepline injects the provider custom
   field and enforces a ten-slot per-org cap; do not use it for regular or bulk
@@ -34931,6 +35176,11 @@ positionally, via --file <path>, or from stdin with --file -.
 When <patch> includes payload, its top-level fields are merged with the stored
 payload before validation. This lets you change one filter without resending
 domain or radar_type; nested values and arrays replace atomically.
+For TamRadar, changing payload.updates_since is an explicit historical replay
+request. Deepline passes that requested boundary upstream, but previously
+delivered canonical findings are deduplicated before dispatch and billing; only
+previously unseen historical findings are chargeable. Filter-only updates,
+repair, and reactivation instead use a fresh future-only source boundary.
 Use {"controls":{"execution_type":"priority"}} only for a bounded urgent
 Deepline Native preview. The ten-radar priority cap applies on update too.
 Use {"controls":{"execution_type":null}} to release priority without
@@ -35017,7 +35267,7 @@ ${MONITOR_FLEET_HELP_EPILOG}`
 Creates a ready-to-review JSON definition. Fleets always sync ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.cadence} and retain
 a missing member for ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.removalGrace} before it is ${MONITOR_FLEET_DOCUMENTATION.fixedPolicy.onRemoved}d; those
 policies are not authored in the file. ${MONITOR_FLEET_DOCUMENTATION.stickyMembership} The payload remains the actual monitor payload for the chosen tool, so use
-\`deepline monitors available\` to discover a tool first.
+\`deepline tools list --categories monitors\` to discover a tool first.
 
 Example:
   deepline monitors fleets init account-job-openings \\
@@ -36004,7 +36254,7 @@ Examples:
     )
   ).action(handleOrgSwitch);
   addOrgSetOptions(
-    org.command("switch [selection]").description(
+    org.command("switch [selection]", { hidden: true }).description(
       "Deprecated alias for org set. Set the organization for the selected auth scope."
     ).addHelpText(
       "after",
@@ -36031,6 +36281,9 @@ Examples:
 
 // src/cli/commands/git.ts
 var GIT_DEPLOY_FEATURE = "github-deploy";
+function shellQuote3(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function renderProject(project) {
   const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
   const flags = [
@@ -36069,6 +36322,98 @@ async function handleList(options) {
     { json: options.json }
   );
 }
+function describeInstallationStatus(installation) {
+  switch (installation.status) {
+    case "active":
+      return [
+        `Connected to ${installation.accountLogin} (installation ${installation.installationId}).`
+      ];
+    case "uninstalled":
+      return [
+        `The Deepline GitHub App was uninstalled from ${installation.accountLogin}${installation.uninstalledAt ? ` at ${new Date(installation.uninstalledAt).toISOString()}` : ""}.`,
+        "Deploys are paused for every linked repository. Run `deepline git connect`, then `deepline git link <owner/repo>` again for each repository; links from the old installation cannot be resumed."
+      ];
+    case "suspended":
+      return [
+        `GitHub suspended the Deepline App on ${installation.accountLogin}${installation.suspendedAt ? ` at ${new Date(installation.suspendedAt).toISOString()}` : ""}.`,
+        "Pushes are not delivered while it is suspended; unsuspend it in GitHub settings."
+      ];
+  }
+}
+async function handleStatus2(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get("/api/v2/github/installation");
+  const installation = payload.installation;
+  const others = (payload.installations ?? []).filter(
+    (row) => row.installationId !== installation?.installationId
+  );
+  const lines = installation ? describeInstallationStatus(installation) : [
+    "No GitHub installation is connected to this workspace. Run `deepline git connect`."
+  ];
+  for (const other of others) {
+    lines.push(
+      `Also: ${other.accountLogin} (installation ${other.installationId}) is ${other.status}.`
+    );
+  }
+  const byId = new Map(
+    (payload.installations ?? []).map((row) => [row.installationId, row])
+  );
+  const { projects } = await http.get(
+    "/api/v2/play-projects?includeDisabled=1"
+  );
+  const affected_links = projects.map((project) => {
+    const own = byId.get(project.installationId);
+    const verdict = !own ? "unknown" : own.status === "active" ? null : own.status;
+    return verdict ? {
+      id: project.id,
+      repoId: project.repoId,
+      repoFullName: project.repoFullName,
+      rootDirectory: project.rootDirectory,
+      productionBranch: project.productionBranch,
+      manifestPath: project.manifestPath,
+      checkOnPullRequest: project.checkOnPullRequest,
+      disabled: project.disabled,
+      installationId: project.installationId,
+      installationStatus: verdict
+    } : null;
+  }).filter((row) => row !== null);
+  const activeInstallations = (payload.installations ?? []).filter(
+    (row) => row.status === "active"
+  );
+  const relinkCommand = (link2) => [
+    // The numeric repo id, not the name: a repository renamed while the
+    // App was gone keeps a stale name here, and `git link` accepts the id.
+    `deepline git link ${link2.repoId}`,
+    // Stored values are admin-controlled text and this line is
+    // copy-pasted into a shell by whoever reads it, so every
+    // interpolated value below is quoted.
+    `--branch ${shellQuote3(link2.productionBranch)}`,
+    link2.rootDirectory ? `--root-dir ${shellQuote3(link2.rootDirectory)}` : "",
+    link2.manifestPath && link2.manifestPath !== "deepline.json" ? `--manifest ${shellQuote3(link2.manifestPath)}` : "",
+    link2.checkOnPullRequest ? "" : "--no-pr-checks",
+    // With several active installations no id is guessed: the reader picks.
+    activeInstallations.length > 1 ? "--installation <id>" : ""
+  ].filter(Boolean).join(" ");
+  for (const link2 of affected_links) {
+    const label = `${link2.repoFullName}${link2.rootDirectory ? ` (${link2.rootDirectory})` : ""}`;
+    lines.push(
+      link2.installationStatus !== "suspended" ? `Link again: ${label} \u2014 its installation ${link2.installationId} is ${link2.installationStatus}; run \`${relinkCommand(link2)}\`${activeInstallations.length > 1 ? ` with <id> being the installation that reaches this repo: ${activeInstallations.map((row) => `${row.installationId} (${row.accountLogin})`).join(", ")}` : ""}.` : (
+        // A link disabled during the suspension stays disabled; only an
+        // enabled one picks up again on its own when GitHub unsuspends.
+        link2.disabled ? `Paused and disabled: ${label} \u2014 its installation is suspended, and the link stays disabled after GitHub unsuspends it until you run \`deepline git set ${link2.id} --enabled\`.` : `Paused: ${label} \u2014 its installation is suspended; pushes resume when GitHub unsuspends it.`
+      )
+    );
+  }
+  printCommandEnvelope(
+    {
+      installation,
+      installations: payload.installations ?? [],
+      affected_links,
+      render: { sections: [{ title: "github installation", lines }] }
+    },
+    { json: options.json }
+  );
+}
 async function handleRepos(options) {
   const { http } = getAuthedHttpClient();
   const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
@@ -36299,6 +36644,9 @@ Examples:
 `
   );
   git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
+  git.command("status").description(
+    "Show the workspace's GitHub installation and whether it is still usable."
+  ).option("--json", "Emit JSON output").action(async (options) => handleStatus2(options));
   git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
     "--installation <id>",
     "GitHub installation id (required when several are connected)"
@@ -36409,7 +36757,7 @@ async function handleQuickstart(options) {
   return 0;
 }
 function registerQuickstartCommands(program) {
-  program.command("quickstart").description(
+  program.command("quickstart", { hidden: true }).description(
     "Deprecated compatibility command. Use /deepline-gtm in your agent."
   ).addHelpText(
     "after",
@@ -36441,7 +36789,8 @@ function renderSecret(secret) {
   const added = new Date(secret.createdAt).toISOString();
   const updated = new Date(secret.updatedAt).toISOString();
   const lastUsed = secret.lastUsedAt ? `, last used ${new Date(secret.lastUsedAt).toISOString()}` : ", never used";
-  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
+  const note = secret.note ? `, note ${JSON.stringify(secret.note)}` : "";
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}${note}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
 }
 async function readHiddenLine(prompt, streams = {}) {
   const inputStream = streams.input ?? import_node_process.stdin;
@@ -36648,7 +36997,8 @@ async function handleSet2(nameInput, forbidden, options) {
       name,
       value,
       scope,
-      ...playName ? { playName } : {}
+      ...playName ? { playName } : {},
+      ...options.note !== void 0 ? { note: options.note } : {}
     }
   );
   const secret = response.secret;
@@ -36671,6 +37021,57 @@ async function handleSet2(nameInput, forbidden, options) {
     { json: options.json }
   );
 }
+async function handleNote(secretId, noteInput, options) {
+  if (options.clear && noteInput !== void 0) {
+    throw new Error("Pass either a note or --clear, not both.");
+  }
+  if (!options.clear && noteInput === void 0) {
+    throw new Error("Provide a note or use --clear.");
+  }
+  const note = options.clear ? "" : noteInput;
+  if (options.dryRun) {
+    printCommandEnvelope(
+      {
+        ok: true,
+        dryRun: true,
+        secretId,
+        note,
+        render: {
+          sections: [
+            {
+              title: "secret note",
+              lines: [
+                options.clear ? `Would clear the note on secret ${secretId}.` : `Would save a note on secret ${secretId}.`
+              ]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const client2 = new DeeplineClient();
+  const secret = await client2.updateSecretNote(secretId, note);
+  printCommandEnvelope(
+    {
+      ok: true,
+      secret,
+      render: {
+        sections: [
+          {
+            title: "secret note saved",
+            lines: [
+              secret.note ? `${secret.name}: note saved.` : `${secret.name}: note cleared.`,
+              renderSecret(secret)
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
 function registerSecretsCommands(program) {
   const secrets = program.command("secrets").description("Manage play secrets without revealing values.").addHelpText(
     "after",
@@ -36678,8 +37079,8 @@ function registerSecretsCommands(program) {
 Notes:
   Secret values are never accepted as command arguments. Use the hidden prompt,
   or one explicit non-argv source: --value-stdin, --from-env NAME, or
-  --from-file PATH. Values are never printed. secrets list shows only status,
-  added, updated, and last-used metadata.
+  --from-file PATH. Values are never printed. secrets list shows only metadata,
+  including any note you intentionally added.
 
 Examples:
   deepline secrets list
@@ -36689,6 +37090,9 @@ Examples:
   printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
   deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
   deepline secrets set HUBSPOT_TOKEN --from-file ./hubspot-token.txt
+  deepline secrets set HUBSPOT_TOKEN --note "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> --clear
 `
   );
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
@@ -36702,11 +37106,19 @@ Examples:
   ).option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
-  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
+  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option(
+    "--note <note>",
+    "Optional non-sensitive memo (maximum 500 characters)"
+  ).option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
     async (name, forbidden, options) => {
       await handleSet2(name, forbidden ?? [], options);
     }
   );
+  secrets.command("note").description("Add, replace, or clear a non-sensitive note on one secret.").argument("<secret-id>", "Secret ID from `deepline secrets list --json`").argument("[note]", "Note text (maximum 500 characters)").option("--clear", "Clear the existing note").option("--dry-run", "Show the note change without saving it").option("--json", "Emit JSON output").action(
+    async (secretId, note, options) => {
+      await handleNote(secretId, note, options);
+    }
+  );
 }
 
 // src/cli/commands/setup.ts
@@ -36843,7 +37255,7 @@ var import_node_fs19 = require("fs");
 var import_node_os12 = require("os");
 var import_node_path21 = require("path");
 
-// ../../shared_libs/cli/install-commands.json
+// contracts/install-commands.json
 var install_commands_default = {
   skills: {
     index_path: "/.well-known/skills/index.json",
@@ -36951,6 +37363,7 @@ function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
 
 // src/cli/skills-sync.ts
 var import_node_child_process2 = require("child_process");
+var import_node_crypto10 = require("crypto");
 var import_node_fs18 = require("fs");
 var import_node_path20 = require("path");
 
@@ -37307,6 +37720,7 @@ async function maybeReportSdkCliFailure(input2) {
 
 // src/cli/skills-sync.ts
 var CHECK_TIMEOUT_MS2 = 3e3;
+var SKILLS_SYNC_CLAIM_MAX_AGE_MS = 60 * 60 * 1e3;
 function shouldSkipSkillsSync() {
   if (detectAgentRuntime() === "claude_cowork") {
     return true;
@@ -37323,6 +37737,60 @@ function failedSkillsSyncPath(baseUrl, agents) {
     `skills-sync-failed-${agents.join("-")}-version`
   );
 }
+function inProgressSkillsSyncPath(baseUrl, agents) {
+  return (0, import_node_path20.join)(
+    sdkCliStateDirPath(baseUrl),
+    `skills-sync-in-progress-${agents.join("-")}`
+  );
+}
+function removeSkillsSyncClaim(path, token) {
+  try {
+    (0, import_node_fs18.unlinkSync)((0, import_node_path20.join)(path, token));
+    (0, import_node_fs18.rmdirSync)(path);
+  } catch {
+  }
+}
+function claimSkillsSync(baseUrl, agents) {
+  const path = inProgressSkillsSyncPath(baseUrl, agents);
+  try {
+    (0, import_node_fs18.mkdirSync)((0, import_node_path20.dirname)(path), { recursive: true });
+  } catch {
+    return { status: "unavailable" };
+  }
+  const token = (0, import_node_crypto10.randomUUID)();
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const pendingPath = `${path}-pending-${token}`;
+    try {
+      (0, import_node_fs18.mkdirSync)(pendingPath);
+      (0, import_node_fs18.writeFileSync)((0, import_node_path20.join)(pendingPath, token), "", { flag: "wx" });
+      (0, import_node_fs18.renameSync)(pendingPath, path);
+      return { status: "claimed", token };
+    } catch {
+      removeSkillsSyncClaim(pendingPath, token);
+      if (!(0, import_node_fs18.existsSync)(path)) continue;
+    }
+    if (attempt > 0) return { status: "held" };
+    try {
+      if (Date.now() - (0, import_node_fs18.statSync)(path).mtimeMs <= SKILLS_SYNC_CLAIM_MAX_AGE_MS) {
+        return { status: "held" };
+      }
+      const owners = (0, import_node_fs18.readdirSync)(path);
+      if (owners.length === 0) {
+        (0, import_node_fs18.rmdirSync)(path);
+        continue;
+      }
+      if (owners.length !== 1) return { status: "held" };
+      (0, import_node_fs18.renameSync)(path, `${path}-stale-${owners[0]}`);
+    } catch {
+      return { status: "held" };
+    }
+  }
+  return { status: "held" };
+}
+function clearSkillsSyncClaim(baseUrl, agents, token) {
+  const path = inProgressSkillsSyncPath(baseUrl, agents);
+  removeSkillsSyncClaim(path, token);
+}
 function hasMarkedSkillsSyncVersion(path, version) {
   return Boolean(version) && readMarkedSkillsSyncVersion(path) === version;
 }
@@ -37458,7 +37926,7 @@ function hasCommand(command) {
   });
   return result.status === 0;
 }
-function shellQuote3(arg) {
+function shellQuote4(arg) {
   return `'${arg.replace(/'/g, `'\\''`)}'`;
 }
 function temporarySkillsSyncSkipCommand() {
@@ -37477,7 +37945,7 @@ function resolveSkillsInstallCommands(baseUrl, skillNames = DEFAULT_SDK_SKILL_NA
     commands.push({
       command: "bunx",
       args: bunxArgs,
-      manualCommand: `bunx ${bunxArgs.map(shellQuote3).join(" ")}`
+      manualCommand: `bunx ${bunxArgs.map(shellQuote4).join(" ")}`
     });
   }
   if (hasCommand("npx")) {
@@ -37485,7 +37953,7 @@ function resolveSkillsInstallCommands(baseUrl, skillNames = DEFAULT_SDK_SKILL_NA
     commands.push({
       command: "npx",
       args: npxArgs,
-      manualCommand: `npx ${npxArgs.map(shellQuote3).join(" ")}`
+      manualCommand: `npx ${npxArgs.map(shellQuote4).join(" ")}`
     });
   }
   return commands;
@@ -37652,30 +38120,43 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
     writeUnavailableSkillsNotice(baseUrl, update.remoteVersion, skillNames);
     return;
   }
-  writeSdkSkillsStatusLine("Deepline skills changed; syncing agent skills...");
-  const installResult = await runSkillsInstall(installs, agents);
-  if (!installResult.installed) {
-    const markerWritten = markFailedSkillsSync(
-      baseUrl,
-      update.remoteVersion,
-      agents
+  const claim = claimSkillsSync(baseUrl, agents);
+  if (claim.status === "held") return;
+  try {
+    if (hasFailedSkillsSync(baseUrl, update.remoteVersion, agents) || readSdkSkillsLocalVersion(baseUrl) === update.remoteVersion) {
+      return;
+    }
+    writeSdkSkillsStatusLine(
+      "Deepline skills changed; syncing agent skills..."
     );
-    void maybeReportAutomaticSkillsSyncFailure({
-      baseUrl,
-      remoteSkillsVersion: update.remoteVersion,
-      agents,
-      skillsPackage: SKILLS_NPX_PACKAGE,
-      targetSkillCount: skillNames.length,
-      markerWritten,
-      attempts: installResult.attempts
-    });
-    return;
+    const installResult = await runSkillsInstall(installs, agents);
+    if (!installResult.installed) {
+      const markerWritten = markFailedSkillsSync(
+        baseUrl,
+        update.remoteVersion,
+        agents
+      );
+      void maybeReportAutomaticSkillsSyncFailure({
+        baseUrl,
+        remoteSkillsVersion: update.remoteVersion,
+        agents,
+        skillsPackage: SKILLS_NPX_PACKAGE,
+        targetSkillCount: skillNames.length,
+        markerWritten,
+        attempts: installResult.attempts
+      });
+      return;
+    }
+    runLegacySkillsCleanup(agents);
+    writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents);
+    clearUnavailableSkillsNotice(baseUrl);
+    clearFailedSkillsSync(baseUrl, agents);
+    writeSdkSkillsStatusLine("Deepline agent skills are up to date.");
+  } finally {
+    if (claim.status === "claimed") {
+      clearSkillsSyncClaim(baseUrl, agents, claim.token);
+    }
   }
-  runLegacySkillsCleanup(agents);
-  writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents);
-  clearUnavailableSkillsNotice(baseUrl);
-  clearFailedSkillsSync(baseUrl, agents);
-  writeSdkSkillsStatusLine("Deepline agent skills are up to date.");
 }
 
 // src/cli/commands/skills.ts
@@ -39299,14 +39780,14 @@ function posixShellQuote(value) {
 function windowsCmdQuote(value) {
   return `"${value.replace(/"/g, '""')}"`;
 }
-function shellQuote4(value) {
+function shellQuote5(value) {
   if (process.platform === "win32") {
     return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : windowsCmdQuote(value);
   }
   return posixShellQuote(value);
 }
 function buildSourceUpdateCommand(sourceRoot) {
-  const quotedRoot = shellQuote4(sourceRoot);
+  const quotedRoot = shellQuote5(sourceRoot);
   const cdCommand = process.platform === "win32" ? `cd /d ${quotedRoot}` : `cd ${quotedRoot}`;
   return `${cdCommand} && git fetch origin main --tags && git merge --ff-only origin/main`;
 }
@@ -39318,7 +39799,7 @@ function buildSidecarProjectConfigCommand(versionDir, nodeBin) {
     "fs.mkdirSync(dir,{recursive:true});",
     `fs.writeFileSync(path.join(dir,'package.json'),${JSON.stringify(NPM_SDK_SIDECAR_PACKAGE_JSON)});`
   ].join("");
-  return `${shellQuote4(nodeBin)} -e ${shellQuote4(script)} ${shellQuote4(versionDir)}`;
+  return `${shellQuote5(nodeBin)} -e ${shellQuote5(script)} ${shellQuote5(versionDir)}`;
 }
 function sidecarStateDir(input2) {
   const scope = input2.env.DEEPLINE_CONFIG_SCOPE?.trim();
@@ -39381,7 +39862,7 @@ function resolvePythonSidecarUpdatePlan(options) {
   const npmCommand = "npm";
   const registryUrl = sidecarRegistryUrl(hostUrl);
   const versionDir = (0, import_node_path25.join)(stateDir, "versions", "<version>");
-  const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote4(versionDir)} --registry ${shellQuote4(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote4).join(" ")} ${shellQuote4(packageSpec)}`;
+  const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote5(versionDir)} --registry ${shellQuote5(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote5).join(" ")} ${shellQuote5(packageSpec)}`;
   return {
     kind: "python-sidecar",
     stateDir,
@@ -39528,7 +40009,7 @@ function resolveUpdatePlan(options = {}) {
     args,
     ...installPrefix ? { installPrefix } : {},
     ...fallbackRegistryUrl ? { fallbackRegistryUrl } : {},
-    manualCommand: `${command} ${args.map(shellQuote4).join(" ")}`
+    manualCommand: `${command} ${args.map(shellQuote5).join(" ")}`
   };
 }
 var AUTO_UPDATE_FAILURE_FILE = ".auto-update-failure.json";
@@ -39796,23 +40277,23 @@ function writeSidecarLauncher(input2) {
     input2.path,
     [
       "#!/usr/bin/env sh",
-      `export DEEPLINE_HOST_URL=${shellQuote4(input2.hostUrl)}`,
-      `export DEEPLINE_CONFIG_SCOPE=${shellQuote4(input2.scope)}`,
-      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote4(path)} ]`).join(" || ")}; then`,
+      `export DEEPLINE_HOST_URL=${shellQuote5(input2.hostUrl)}`,
+      `export DEEPLINE_CONFIG_SCOPE=${shellQuote5(input2.scope)}`,
+      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote5(path)} ]`).join(" || ")}; then`,
       '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
       '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
       "  fi",
       '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
       "  exit 1",
       "fi",
-      `if ! ${shellQuote4(input2.nodeBin)} -e ${shellQuote4(esbuildProbe)} ${shellQuote4(versionDir)} >/dev/null 2>&1; then`,
+      `if ! ${shellQuote5(input2.nodeBin)} -e ${shellQuote5(esbuildProbe)} ${shellQuote5(versionDir)} >/dev/null 2>&1; then`,
       '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
       '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
       "  fi",
       '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
       "  exit 1",
       "fi",
-      `exec ${shellQuote4(input2.nodeBin)} ${shellQuote4(input2.entryPath)} "$@"`,
+      `exec ${shellQuote5(input2.nodeBin)} ${shellQuote5(input2.entryPath)} "$@"`,
       ""
     ].join("\n"),
     { encoding: "utf8", mode: 493 }
@@ -43070,9 +43551,9 @@ function apifySyncRecoveryNext(rawResponse) {
   const getDatasetItemsTool = stringField2(getDatasetItems, "tool");
   const getDatasetItemsPayload = recordField2(getDatasetItems, "payload");
   return {
-    getActorRun: `deepline tools execute ${getActorRunTool} --input ${shellQuote5(JSON.stringify(getActorRunPayload))} --json`,
+    getActorRun: `deepline tools execute ${getActorRunTool} --input ${shellQuote6(JSON.stringify(getActorRunPayload))} --json`,
     ...getDatasetItemsTool && Object.keys(getDatasetItemsPayload).length > 0 ? {
-      getDatasetItems: `deepline tools execute ${getDatasetItemsTool} --input ${shellQuote5(JSON.stringify(getDatasetItemsPayload))} --json`
+      getDatasetItems: `deepline tools execute ${getDatasetItemsTool} --input ${shellQuote6(JSON.stringify(getDatasetItemsPayload))} --json`
     } : {}
   };
 }
@@ -43245,7 +43726,7 @@ function parseExecuteOptions(args) {
 function safeFileStem(value) {
   return value.trim().replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || "tool";
 }
-function shellQuote5(value) {
+function shellQuote6(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function powerShellQuote(value) {
@@ -43315,7 +43796,7 @@ export default definePlay(${JSON.stringify(playName)}, async (ctx) => {
     path: scriptPath,
     sourceCode: script,
     projectDir,
-    macCopyCommand: `mkdir -p ${shellQuote5(projectDir)} && cp ${shellQuote5(scriptPath)} ${shellQuote5(`${projectDir}/${fileName}`)}`,
+    macCopyCommand: `mkdir -p ${shellQuote6(projectDir)} && cp ${shellQuote6(scriptPath)} ${shellQuote6(`${projectDir}/${fileName}`)}`,
     windowsCopyCommand: `New-Item -ItemType Directory -Force -Path ${powerShellQuote(projectDir.replace(/\//g, "\\"))} | Out-Null; Copy-Item -LiteralPath ${powerShellQuote(scriptPath)} -Destination ${powerShellQuote(`${projectDir.replace(/\//g, "\\")}\\${fileName}`)}`
   };
 }
@@ -43342,7 +43823,7 @@ function buildToolExecuteBaseEnvelope(input2) {
     envelope,
     "output"
   );
-  const inspectCommand = `deepline tools execute ${input2.toolId} --input ${shellQuote5(JSON.stringify(input2.params))} --json`;
+  const inspectCommand = `deepline tools execute ${input2.toolId} --input ${shellQuote6(JSON.stringify(input2.params))} --json`;
   const actions = input2.listConversion ? [
     {
       label: "next",
@@ -43738,7 +44219,7 @@ var import_promises10 = require("fs/promises");
 var import_node_path28 = require("path");
 
 // src/cli/workflow-to-play.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var HITL_WAIT_FOR_SIGNAL_TOOL = "deepline_workflow_wait_for_signal";
 var HITL_SLACK_TOOL = "slack_message_with_hitl";
 var SUB_WORKFLOW_TOOL_PREFIX = "deepline_workflow_";
@@ -43844,7 +44325,7 @@ function sanitizePlayNameSegment(value) {
 }
 function deriveWorkflowPlayName(workflowName) {
   const base = sanitizePlayNameSegment(workflowName) || "workflow";
-  const suffix = (0, import_node_crypto10.createHash)("sha256").update(workflowName).digest("hex").slice(0, 8);
+  const suffix = (0, import_node_crypto11.createHash)("sha256").update(workflowName).digest("hex").slice(0, 8);
   const reserved = suffix.length + 1;
   const allowedBase = Math.max(1, MAX_PLAY_NAME_LENGTH - reserved);
   let name = `${base.slice(0, allowedBase)}_${suffix}`;
@@ -44162,7 +44643,7 @@ async function handleTail(id, runId, options) {
   }
 }
 function registerWorkflowCommands(program) {
-  const workflows = program.command("workflows").description(
+  const workflows = program.command("workflows", { hidden: true }).description(
     "Legacy cloud workflows (now becoming plays). Commands still work; use `workflows transform` to migrate one to a play. " + TRIGGER_REDIRECT
   ).addHelpText(
     "after",
@@ -44982,4 +45463,11 @@ Examples:
   }
   process.exitCode = process.exitCode ?? 0;
 }
-main();
+var DEV_CLI_AWAIT_MAIN = Symbol.for("@deepline/sdk/dev-cli-await-main");
+if (globalThis[DEV_CLI_AWAIT_MAIN] !== true) {
+  void main();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main
+});