deepline 0.3.90 → 0.3.92

package/dist/cli/index.mjs

@@ -1270,27 +1270,22 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  // 0.3.90 is the first deliberately versioned SDK release for API v3. Play
-  // grep hard-cuts to the single Convex full-text index; it does not retain a
-  // registry/scanner reader for any SDK/API major.
-  version: "0.3.90",
-  updateSummary: "Play grep now uses one source-only Convex full-text index. It no longer scans the registry, pages through the complete indexed match set, and rejects retired grep modes. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
+  // 0.3.90 is the first deliberately versioned SDK release for API v3.
+  version: "0.3.92",
+  updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
   },
   contracts: {
     api: {
       name: "sdk-http-api",
-      // API v3 hard-cuts Play grep to the canonical Convex index. API v2 stays
-      // admitted for the explicit SDK support window, but it selects neither a
-      // registry scanner nor another grep reader: every accepted grep request
-      // uses the same indexed query and retired flags fail at the API boundary.
+      // Concise Play grep has the current wire id. Older ids follow the
+      // standard API support window.
       currentMajor: 3,
       supportedMajors: [3, 2],
-      // The first wire id is emitted by the current SDK. Remaining ids are
-      // accepted only while the API v2 support window is open.
+      // Older ids remain subject to the API support window.
       legacyWireIds: [
-        "2026-09-play-grep-convex-index-hard-cutover",
+        "2026-09-play-grep-concise-results",
         "2026-07-admin-cli-local-cutover",
         "2026-07-native-monitor-launch-hard-cutover"
       ]
@@ -5162,9 +5157,19 @@ var DeeplineClient = class {
       targetStatus: () => this.getTargetBillingStatus(),
       autoRecharge: {
         get: () => this.getTargetAutoRecharge(),
+        trigger: (options2) => this.http.post(
+          "/api/v2/billing/auto-recharge/trigger",
+          {},
+          {
+            "Idempotency-Key": requireTargetBillingIdempotencyKey(
+              options2?.idempotencyKey ?? globalThis.crypto.randomUUID()
+            )
+          }
+        ),
         update: (options2) => this.updateTargetAutoRecharge(options2)
       },
       purchaseCredits: (options2) => this.purchaseTargetBillingCredits(options2),
+      recoverCreditPurchase: (options2) => this.recoverTargetBillingCreditPurchase(options2),
       transitionPlan: (options2) => this.transitionTargetBillingPlan(options2),
       portalSession: () => this.createTargetBillingPortalSession()
     };
@@ -5333,6 +5338,14 @@ var DeeplineClient = class {
     if (options.playName !== void 0) params.set("play", options.playName);
     return this.http.get(`/api/v2/secrets?${params.toString()}`);
   }
+  /** Add, replace, or clear the non-sensitive note attached to one secret. */
+  async updateSecretNote(secretId, note) {
+    const response = await this.http.patch(
+      `/api/v2/secrets/${encodeURIComponent(secretId)}`,
+      { note }
+    );
+    return response.secret;
+  }
   // ——————————————————————————————————————————————————————————
   // Tools
   // ——————————————————————————————————————————————————————————
@@ -7526,7 +7539,8 @@ var DeeplineClient = class {
       options.enabled ? {
         enabled: true,
         threshold_credits: options.thresholdCredits,
-        refill_to_credits: options.refillToCredits
+        refill_to_credits: options.refillToCredits,
+        ...options.purchaseLimitCents !== void 0 ? { purchase_limit_cents: options.purchaseLimitCents } : {}
       } : { enabled: false },
       { "Idempotency-Key": idempotencyKey }
     );
@@ -7547,6 +7561,39 @@ var DeeplineClient = class {
       { maxRetries: 0, exactUrlOnly: true }
     );
   }
+  /** Recover only the original workspace, credit amount, and purchase key; never charge. */
+  async recoverTargetBillingCreditPurchase(options) {
+    if (typeof options.idempotencyKey !== "string") {
+      throw new DeeplineError(
+        "The original billing idempotencyKey is required.",
+        void 0,
+        "INVALID_BILLING_IDEMPOTENCY_KEY"
+      );
+    }
+    const idempotencyKey = requireTargetBillingIdempotencyKey(
+      options.idempotencyKey
+    );
+    if (!Number.isSafeInteger(options.credits) || options.credits <= 0) {
+      throw new DeeplineError(
+        "credits must be a positive safe integer.",
+        void 0,
+        "INVALID_CREDITS"
+      );
+    }
+    if (typeof options.orgId !== "string" || !options.orgId.trim() || options.orgId !== options.orgId.trim()) {
+      throw new DeeplineError(
+        "The original orgId is required without surrounding whitespace.",
+        void 0,
+        "INVALID_ORG_ID"
+      );
+    }
+    return this.http.post(
+      "/api/v2/billing/credit-purchases/recover",
+      { credits: options.credits, org_id: options.orgId },
+      { "Idempotency-Key": idempotencyKey },
+      { maxRetries: 0, exactUrlOnly: true }
+    );
+  }
   /**
    * Start, change, cancel, or restore a target plan through one idempotent
    * commercial operation.
@@ -9986,6 +10033,17 @@ async function handleBalance(options) {
   const needsCredits = status === "no_billing" || status === "zero_balance" || status === "payment_method_only";
   const recovery = needsCredits ? balanceRecoveryForCredits() : null;
   const lines = [`Balance: ${payload.balance ?? "(unknown)"} credits`];
+  const temporaryHolds = payload.temporary_hold_credits;
+  if (typeof temporaryHolds === "number" && temporaryHolds > 0) {
+    lines.push(
+      `Temporarily reserved: ${temporaryHolds} credits \u2014 not charged; unused credits are released after final usage is calculated.`
+    );
+  } else if (temporaryHolds === null) {
+    lines.push("Temporary reservation status is temporarily unavailable.");
+  }
+  if (payload.temporary_hold_credits_truncated === true) {
+    lines.push("Temporary reservation total may be incomplete.");
+  }
   if (status === "no_billing") {
     lines.push(
       "Billing: No billing account or payment method set up for this workspace."
@@ -10036,7 +10094,7 @@ async function handleUsage(options) {
     `Balance: ${payload.balance ?? "(unknown)"}`,
     `Last 30 days usage: ${last30Usage ?? "(unknown)"}`,
     ...Number.isFinite(temporaryHolds) && temporaryHolds > 0 ? [`Temporary holds: ${temporaryHolds}`] : [],
-    `Monthly limit: ${quota.enabled ? quota.monthly_credits_limit ?? "(unknown)" : "off"}`,
+    `Monthly spend guidance: ${quota.enabled ? quota.monthly_credits_limit ?? "(unknown)" : "off"}`,
     ...options.runId && recent.run_id ? [
       `Run spend: ${(payload.run ?? {}).spent_credits ?? "(unknown)"} Deepline Credits`
     ] : [],
@@ -10068,9 +10126,9 @@ async function handleLimit(options) {
     "/api/v2/billing/limit"
   );
   const lines = payload.enabled ? [
-    `Monthly limit: ${payload.monthly_credits_limit ?? "(unknown)"}`,
-    `Remaining before cap: ${payload.remaining_credits ?? "(unknown)"}`
-  ] : ["Monthly limit: off"];
+    `Monthly spend guidance: ${payload.monthly_credits_limit ?? "(unknown)"}`,
+    "Enforcement: advisory; available balance remains the exact admission control."
+  ] : ["Monthly spend guidance: off"];
   printCommandEnvelope(
     {
       ...payload,
@@ -10092,7 +10150,7 @@ async function handleSetLimit(credits, options) {
         sections: [
           {
             title: "billing limit",
-            lines: [`Monthly billing limit set to ${credits} credits.`]
+            lines: [`Monthly spend guidance set to ${credits} credits.`]
           }
         ]
       }
@@ -10112,7 +10170,7 @@ async function handleLimitOff(options) {
         sections: [
           {
             title: "billing limit",
-            lines: ["Monthly billing limit is now off."]
+            lines: ["Monthly spend guidance is now off."]
           }
         ]
       }
@@ -10248,42 +10306,28 @@ function planPriceText(priceUsd, priceInterval) {
   }
   return `$${priceUsd}${priceInterval ? `/${priceInterval}` : ""}`;
 }
-function planRolloverText(rollover) {
-  const mode = rollover?.mode ?? "none";
-  if (mode === "none") return "no rollover";
-  if (mode === "bounded") {
-    return `rollover up to ${rollover?.max_credits ?? "(unknown)"} credits`;
-  }
-  return `rollover ${mode}`;
+function targetPlanLine(plan) {
+  return `${plan.name} (${plan.sku}) | ${planPriceText(plan.recurring_price_usd, plan.interval)} | ${plan.included_credits} included credits/month | $${plan.purchased_credit_price_usd}/purchased credit | ${plan.acquisition_enabled ? "available" : "unavailable"}`;
 }
 async function handlePlans(options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get(
-    "/api/v2/billing/catalog/current"
+  const client2 = new DeeplineClient();
+  const payload = await client2.billing.targetPlans();
+  const listedCurrentPlan = payload.plans.find(
+    (plan) => plan.sku === payload.current_plan_sku
   );
-  const activePlan = payload.active_plan ?? {};
-  const plans = Array.isArray(payload.plans) ? payload.plans : [];
-  const meters = Array.isArray(payload.meters) ? payload.meters : Array.isArray(payload.metrics) ? payload.metrics : [];
+  const currentPlan = listedCurrentPlan ?? (await client2.billing.targetStatus()).plan;
   const lines = [
-    `Catalog: ${payload.catalog_id ?? "(unknown)"} (version ${payload.catalog_version ?? "(unknown)"})`,
-    `Active plan: ${activePlan.public_name ?? "(unknown)"} (${activePlan.plan_version_id ?? "(unknown)"})`,
-    `Assigned by: ${activePlan.assigned_by ?? "default"} | subscription: ${activePlan.has_subscription ? "yes" : "no"}`,
-    ...plans.length === 0 ? ["Plans: none published"] : [
-      "Plans:",
-      ...plans.map(
-        (plan) => `${plan.public_name ?? "(unknown)"} (${plan.plan_version_id ?? "(unknown)"}) | ${planPriceText(plan.price_usd, plan.price_interval)} | ${plan.monthly_grant_credits ?? 0} credits/cycle | ${planRolloverText(plan.rollover)} | ${plan.acquirable ? "acquirable" : "not acquirable"}`
-      )
-    ],
-    ...meters.length === 0 ? ["Metrics: none"] : [
-      "Metrics:",
-      ...meters.map(
-        (meter) => `${meter.id ?? "(unknown)"} | ${meter.name ?? "(unknown)"}`
-      )
-    ]
+    `Current plan: ${currentPlan.name} (${currentPlan.sku}) | ${planPriceText(currentPlan.recurring_price_usd, currentPlan.interval)} | ${currentPlan.included_credits ?? "(unknown)"} included credits/month`,
+    `Pending plan: ${payload.pending_plan_sku ?? "none"}`,
+    `Plan changes: ${payload.acquisition_enabled ? "enabled" : "disabled"}`,
+    ...payload.plans.length === 0 ? ["Plans: none available"] : ["Plans:", ...payload.plans.map(targetPlanLine)],
+    "Change plan: deepline billing change-plan <plan_sku> --json"
   ];
+  const legacyPayload = shouldEmitJson(options.json) ? await client2.billing.plans() : null;
   printCommandEnvelope(
     {
-      ...payload,
+      ...legacyPayload ?? payload,
+      ...legacyPayload ? { target_billing: payload } : {},
       render: { sections: [{ title: "billing plans", lines }] }
     },
     { json: options.json }
@@ -10658,7 +10702,10 @@ async function handleAutoRechargeStatus(options) {
   const lines = [
     `State: ${state}`,
     ...payload.threshold_credits !== null ? [`Threshold: ${payload.threshold_credits} credits`] : [],
-    ...payload.refill_to_credits !== null ? [`Refill balance to: ${payload.refill_to_credits} credits`] : []
+    ...payload.refill_to_credits !== null ? [`Refill balance to: ${payload.refill_to_credits} credits`] : [],
+    ...payload.purchase_limit_cents !== void 0 ? [
+      payload.purchase_limit_cents === null ? "Automatic purchase cap: none" : `Automatic purchase cap: $${(payload.purchase_limit_cents / 100).toFixed(2)} per rolling 30 days`
+    ] : []
   ];
   printCommandEnvelope(
     {
@@ -10672,6 +10719,18 @@ async function handleAutoRechargeStatus(options) {
 async function handleAutoRechargeSet(options) {
   const thresholdCredits = parseTopUpCredits(options.thresholdCredits);
   const refillToCredits = parseTopUpCredits(options.refillToCredits);
+  const rollingLimitCents = options.purchaseLimitCents === void 0 ? void 0 : options.purchaseLimitCents === "none" ? null : Number(options.purchaseLimitCents);
+  if (rollingLimitCents !== void 0 && rollingLimitCents !== null && (!Number.isSafeInteger(rollingLimitCents) || rollingLimitCents <= 0)) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        code: "INVALID_AUTO_RECHARGE_CONFIGURATION",
+        message: "--purchase-limit-cents must be a positive whole number of USD cents or none."
+      },
+      options
+    );
+    return;
+  }
   if (thresholdCredits === null || refillToCredits === null || refillToCredits <= thresholdCredits) {
     reportBillingFailure(
       {
@@ -10696,7 +10755,8 @@ async function handleAutoRechargeSet(options) {
           body: {
             enabled: true,
             threshold_credits: thresholdCredits,
-            refill_to_credits: refillToCredits
+            refill_to_credits: refillToCredits,
+            ...rollingLimitCents !== void 0 ? { purchase_limit_cents: rollingLimitCents } : {}
           }
         }
       },
@@ -10708,6 +10768,7 @@ async function handleAutoRechargeSet(options) {
     enabled: true,
     thresholdCredits,
     refillToCredits,
+    ...rollingLimitCents !== void 0 ? { purchaseLimitCents: rollingLimitCents } : {},
     idempotencyKey
   });
   printCommandEnvelope(
@@ -10765,6 +10826,60 @@ async function handleBuyCredits(creditsRaw, options) {
     { json: options.json }
   );
 }
+async function handleTopUpRecover(creditsRaw, options) {
+  const credits = parseTopUpCredits(creditsRaw);
+  if (credits === null) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        code: "INVALID_CREDITS",
+        message: "<credits> must be a positive integer."
+      },
+      options
+    );
+    return;
+  }
+  const failure = !options.orgId?.trim() || options.orgId !== options.orgId.trim() ? {
+    code: "INVALID_ORG_ID",
+    message: "--org-id must be the original workspace ID without surrounding whitespace."
+  } : !options.idempotencyKey || options.idempotencyKey.length > 200 || options.idempotencyKey !== options.idempotencyKey.trim() ? {
+    code: "INVALID_BILLING_IDEMPOTENCY_KEY",
+    message: "--idempotency-key must be the original key (1\u2013200 characters without surrounding whitespace)."
+  } : null;
+  if (failure) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        ...failure
+      },
+      options
+    );
+    return;
+  }
+  if (options.dryRun) {
+    printCommandEnvelope(
+      {
+        ok: true,
+        dry_run: true,
+        method: "POST",
+        path: "/api/v2/billing/credit-purchases/recover",
+        idempotency_key: options.idempotencyKey,
+        body: { credits, org_id: options.orgId }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const payload = await new DeeplineClient().billing.recoverCreditPurchase({
+    credits,
+    orgId: options.orgId,
+    idempotencyKey: options.idempotencyKey
+  });
+  printCommandEnvelope(
+    { ok: true, idempotency_key: options.idempotencyKey, ...payload },
+    { json: options.json }
+  );
+}
 async function handleTargetPlan(planSku, options) {
   if (planSku !== "payg-v1" && planSku !== "builder-v1" && planSku !== "growth-v1" && planSku !== "growth-canary-v1" && planSku !== "team-v1") {
     reportBillingFailure(
@@ -10882,35 +10997,36 @@ Examples:
     "--cursor <cursor>",
     "Recent-call cursor from the previous response"
   ).option("--run-id <run_id>", "Show recent usage for one play run").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleUsage);
-  billing.command("limit").description("Show configured monthly limit state.").addHelpText(
+  billing.command("limit").description("Show configured monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
-  Read-only. Shows whether the monthly workspace cap is enabled and how many
-  Deepline credits remain before the cap.
+  Read-only. Shows whether monthly workspace spend guidance is enabled.
+  Guidance does not reject funded work; available balance remains exact.
 
 Examples:
   deepline billing limit
   deepline billing limit --json
 `
   ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleLimit);
-  billing.command("set-limit").description("Set monthly credit cap.").addHelpText(
+  billing.command("set-limit").description("Set monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
   Mutates workspace billing settings. The argument is a Deepline credit amount,
-  not dollars and not provider credits.
+  not dollars and not provider credits. Guidance is advisory; it does not
+  replace the exact available-balance admission check.
 
 Examples:
   deepline billing set-limit 500
   deepline billing set-limit 500 --json
 `
   ).argument("<credits>", "Monthly credits limit").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSetLimit);
-  billing.command("off").description("Disable monthly credit cap.").addHelpText(
+  billing.command("off").description("Disable monthly spend guidance.").addHelpText(
     "after",
     `
 Notes:
-  Mutates workspace billing settings by removing the monthly Deepline credit cap.
+  Mutates workspace billing settings by removing monthly Deepline spend guidance.
 
 Examples:
   deepline billing off
@@ -11008,6 +11124,18 @@ Examples:
     "Stable retry key for the same intended top-up"
   ).option("--dry-run", "Print the planned top-up without charging").option("--compact", "Keep only high-signal fields in JSON output").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleTopUp);
   billing.command("buy").description("Buy credits through the target billing contract.").argument("<credits>", "Positive integer Deepline credit amount").option("--idempotency-key <key>", "Stable retry key").option("--json", "Emit JSON output").action(handleBuyCredits);
+  billing.command("top-up-recover").description(
+    "Inspect or retire an original top-up intent without starting a payment."
+  ).argument("<credits>", "Original positive integer Deepline credit amount").requiredOption(
+    "--org-id <original-org>",
+    "Original workspace ID (must match the authenticated workspace)"
+  ).requiredOption(
+    "--idempotency-key <original-key>",
+    "Original purchase key; never generates a new key"
+  ).option("--dry-run", "Print the recovery request without changing state").option("--json", "Emit JSON output. Also automatic when stdout is piped").addHelpText(
+    "after",
+    "\nAn absent intent is durably retired; an existing operation is returned unchanged.\nThis command never starts a payment. Use the original amount, workspace, and key.\nExample:\n  deepline billing top-up-recover 1000 --org-id org_original --idempotency-key original-purchase-key --json\n"
+  ).action(handleTopUpRecover);
   billing.command("status").description("Show normalized target billing state.").option("--json", "Emit JSON output").action(handleTargetStatus);
   billing.command("auto-recharge").description("Inspect and manage automatic Deepline credit recharge.").addHelpText(
     "after",
@@ -11028,11 +11156,21 @@ Examples:
     ).requiredOption(
       "--refill-to-credits <credits>",
       "Recharge the balance to this amount"
+    ).option(
+      "--purchase-limit-cents <cents>",
+      "Limit automatic purchases over rolling 30 days (USD cents)"
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeSet)
   ).addCommand(
     new Command("off").description(
       "Disable automatic recharge without clearing saved amounts."
     ).option("--idempotency-key <key>", "Stable retry key").option("--dry-run", "Print the planned update without applying it").option("--json", "Emit JSON output").action(handleAutoRechargeOff)
+  ).addCommand(
+    new Command("trigger").description(
+      "Evaluate capped automatic recharge and resume any pending purchase."
+    ).option("--json", "Emit JSON output").action(async (options) => {
+      const result = await new DeeplineClient().billing.autoRecharge.trigger();
+      printCommandEnvelope({ ok: true, ...result }, { json: options.json });
+    })
   );
   billing.command("change-plan").description("Start or change the target billing plan.").argument(
     "<plan_sku>",
@@ -11044,11 +11182,11 @@ Examples:
     "after",
     `
 Notes:
-  Read-only. Answers "what plans exist and what am I on": each plan's price,
-  monthly grant credits, rollover policy, and whether it is open for
-  subscription, plus the catalog's usage metrics. All amounts are Deepline
-  credits and Deepline-facing USD, never raw provider spend. Subscribe to a
-  listed plan with: deepline billing subscribe <plan_version_id>
+  Read-only. Shows the current target billing plan, pending plan, and every
+  visible plan's recurring price, included credits, purchased-credit price,
+  and current acquisition availability. All amounts are Deepline credits and
+  Deepline-facing USD, never raw provider spend. Change to an available plan
+  with: deepline billing change-plan <plan_sku>
 
 Examples:
   deepline billing plans
@@ -11070,7 +11208,7 @@ Examples:
   deepline billing subscribe runtime-395-2026-07-v1
   deepline billing subscribe runtime-395-2026-07-v1 --no-open --json
 `
-  ).argument("<plan_version_id>", "Plan version id from `billing plans`").option("--no-open", "Print the checkout URL without opening a browser").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSubscribe);
+  ).argument("<plan_version_id>", "Legacy billing plan version id").option("--no-open", "Print the checkout URL without opening a browser").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleSubscribe);
   billing.command("subscription").description("Inspect and manage subscription state for the workspace.").addHelpText(
     "after",
     `
@@ -11337,6 +11475,7 @@ function mergeCanonicalRowsInfo(left, right) {
       ...right.recoveredReturnPaths ?? []
     ])
   ];
+  const currentTable = left.currentTable || right.currentTable;
   return {
     ...fallback,
     ...preferred,
@@ -11350,6 +11489,7 @@ function mergeCanonicalRowsInfo(left, right) {
     tableNamespace: preferred.tableNamespace ?? fallback.tableNamespace,
     ...left.recovered || right.recovered ? { recovered: true } : {},
     ...recoveredReturnPaths2.length ? { recoveredReturnPaths: recoveredReturnPaths2 } : {},
+    ...currentTable ? { currentTable: true } : {},
     ...exportUnavailableReason ? {
       exportUnavailableReason,
       ...unavailableSource?.exportUnavailableMessage ? {
@@ -11410,6 +11550,11 @@ function isSerializedDataset(value) {
 function isPackagedDatasetOutput(value) {
   return isRecord8(value) && value.kind === "dataset" && isRecord8(value.preview) && Array.isArray(value.preview.rows);
 }
+function hasCurrentTableExport(value) {
+  if (!isRecord8(value) || !isRecord8(value.actions)) return false;
+  const exportCsv = value.actions.exportCsv;
+  return isRecord8(exportCsv) && isRecord8(exportCsv.scope) && exportCsv.scope.kind === "database" && exportCsv.scope.mutability === "current";
+}
 function recoveredReturnPaths(value) {
   if (!Array.isArray(value)) return [];
   return [
@@ -11516,6 +11661,7 @@ function canonicalRowsInfoFromCandidate(input2) {
       datasetId: typeof candidate.value.datasetId === "string" ? candidate.value.datasetId : null,
       tableNamespace: typeof candidate.value.tableNamespace === "string" ? candidate.value.tableNamespace : null,
       ...candidate.value.recovered === true ? { recovered: true } : {},
+      ...hasCurrentTableExport(candidate.value) ? { currentTable: true } : {},
       ...recoveredReturnPaths(candidate.value.recoveredReturnPaths).length ? {
         recoveredReturnPaths: recoveredReturnPaths(
           candidate.value.recoveredReturnPaths
@@ -21005,11 +21151,15 @@ function formatPackageDatasetActionLines(packaged) {
         `  ${category} dataset ${path}: ${rowCount === null ? "unknown rows" : `${formatInteger(rowCount)} ${rowCount === 1 ? "row" : "rows"}`}`
       );
     }
-    const exportCommand = actionToCommand(actions.exportCsv);
+    const exportAction = readRecord(actions.exportCsv);
+    const exportCommand = actionToCommand(exportAction);
+    const exportScope = readRecord(exportAction?.scope);
     const currentQueryCommand = actionToCommand(actions.queryCurrentTable);
     const legacyQueryCommand = actionToCommand(actions.query);
     if (exportCommand) {
-      lines.push(`    export this run: ${exportCommand}`);
+      lines.push(
+        exportScope?.kind === "database" ? `    export current table (may include other runs): ${exportCommand}` : `    export this run: ${exportCommand}`
+      );
     }
     if (currentQueryCommand) {
       lines.push(`    query current table: ${currentQueryCommand}`);
@@ -21418,33 +21568,29 @@ function sqlSafeExportColumnName(id) {
 async function fetchBackingDatasetRows(input2) {
   const playName = extractRunPlayName(input2.status);
   const tableNamespace = input2.rowsInfo.tableNamespace?.trim();
+  const currentTable = input2.rowsInfo.currentTable === true;
   if (!playName || !tableNamespace) {
     return null;
   }
   const sheetRows = [];
   let offset = 0;
-  let expectedTotal = input2.rowsInfo.totalRows;
   while (true) {
     const page = await input2.client.runs.exportDatasetRows({
       playName,
       tableNamespace,
-      runId: input2.status.runId,
+      ...currentTable ? {} : { runId: input2.status.runId },
       limit: RUN_EXPORT_PAGE_SIZE,
       offset,
       rowMode: "all"
     });
     sheetRows.push(...page.rows);
-    const summaryTotal = page.summary?.stats?.total;
-    if (typeof summaryTotal === "number" && Number.isFinite(summaryTotal)) {
-      expectedTotal = Math.max(expectedTotal, Math.trunc(summaryTotal));
-    }
-    if (page.rows.length < RUN_EXPORT_PAGE_SIZE || sheetRows.length >= expectedTotal) {
+    if (page.rows.length < RUN_EXPORT_PAGE_SIZE) {
       break;
     }
     offset += page.rows.length;
   }
   const rows = sheetRows.map(exportableSheetRow).filter((row) => Boolean(row));
-  if (rows.length < input2.rowsInfo.totalRows) {
+  if (!currentTable && rows.length < input2.rowsInfo.totalRows || currentTable && rows.length === 0 && input2.rowsInfo.totalRows > 0) {
     return null;
   }
   const columns = mergeExportColumns(
@@ -21457,6 +21603,7 @@ async function fetchBackingDatasetRows(input2) {
     columns,
     totalRows: rows.length,
     complete: true,
+    ...currentTable ? { currentTable: true } : {},
     source: `${input2.rowsInfo.source ?? "result.rows"} -> /api/v2/plays/${playName}/sheet?tableNamespace=${tableNamespace}`
   };
 }
@@ -21481,12 +21628,14 @@ function assertDatasetHasExportableRows(input2) {
   if (input2.rowsInfo.rows.length > 0) {
     return input2.rowsInfo;
   }
+  if (input2.rowsInfo.currentTable === true && input2.rowsInfo.totalRows === 0) {
+    return input2.rowsInfo;
+  }
   const datasetLabel = input2.datasetPath ?? input2.rowsInfo.tableNamespace ?? input2.rowsInfo.source ?? "result.rows";
   const available = input2.availableRows.map((info) => info.tableNamespace ?? info.source).filter((name) => typeof name === "string");
   const runStatus = String(input2.status.status ?? "").toLowerCase();
-  const failedBeforePersisting = runStatus !== "completed";
   throw new DeeplineError(
-    `Run ${input2.status.runId} has zero rows to export from dataset '${datasetLabel}'.` + (failedBeforePersisting ? ` The run status is '${runStatus || "unknown"}', so it likely failed before persisting rows to this dataset \u2014 provider calls may have been billed without a durable row. Fix the run's failure cause and re-run to resume.` : " The run completed but this dataset materialized no rows.") + (available.length > 0 ? ` Available datasets: ${available.join(", ")}.` : " No datasets were materialized for this run."),
+    `Run ${input2.status.runId} has zero rows to export from dataset '${datasetLabel}'. The run status is '${runStatus || "unknown"}', so it likely failed before persisting rows to this dataset \u2014 provider calls may have been billed without a durable row. Fix the run's failure cause and re-run to resume.` + (available.length > 0 ? ` Available datasets: ${available.join(", ")}.` : " No datasets were materialized for this run."),
     void 0,
     "RUN_EXPORT_EMPTY",
     {
@@ -21497,23 +21646,6 @@ function assertDatasetHasExportableRows(input2) {
     }
   );
 }
-function assertDatasetExportAvailable(input2) {
-  if (input2.rowsInfo.exportUnavailableReason !== "shared_table_namespace") {
-    return;
-  }
-  throw new DeeplineError(
-    input2.rowsInfo.exportUnavailableMessage ?? "Run CSV export is unavailable because multiple Dataset Handles share one physical table.",
-    void 0,
-    "RUN_EXPORT_UNAVAILABLE",
-    {
-      runId: input2.status.runId,
-      dataset: input2.rowsInfo.source,
-      datasetId: input2.rowsInfo.datasetId ?? null,
-      tableNamespace: input2.rowsInfo.tableNamespace ?? null,
-      reason: input2.rowsInfo.exportUnavailableReason
-    }
-  );
-}
 async function exportPlayStatusRows(client2, status, outPath, options = {}) {
   if (!outPath) {
     return null;
@@ -21592,7 +21724,6 @@ ${commands.join("\n")}`,
       `Run ${status.runId} did not expose a row-shaped final output to export.`
     );
   }
-  assertDatasetExportAvailable({ rowsInfo, status });
   const attempts = Math.max(1, Math.trunc(options.attempts ?? 1));
   const retryDelayMs = Math.max(0, Math.trunc(options.retryDelayMs ?? 0));
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -21607,6 +21738,9 @@ ${commands.join("\n")}`,
       if (error instanceof DeeplineError && error.code === "RUN_EXPORT_SCOPE_MISMATCH") {
         throw error;
       }
+      if (rowsInfo.currentTable) {
+        throw error;
+      }
       if (!rowsInfo.complete) {
         throw error;
       }
@@ -21620,7 +21754,8 @@ ${commands.join("\n")}`,
       });
       return {
         path: RunDataset.from(guarded2).exportCsv(outPath),
-        rowsInfo: guarded2
+        rowsInfo: guarded2,
+        currentTable: fetchedRowsInfo.currentTable === true
       };
     }
     if (rowsInfo.complete) {
@@ -21632,7 +21767,8 @@ ${commands.join("\n")}`,
       });
       return {
         path: RunDataset.from(guarded2).exportCsv(outPath),
-        rowsInfo: guarded2
+        rowsInfo: guarded2,
+        currentTable: false
       };
     }
     if (attempt < attempts && retryDelayMs > 0) {
@@ -21667,7 +21803,8 @@ ${commands.join("\n")}`,
   });
   return {
     path: RunDataset.from(guarded).exportCsv(outPath),
-    rowsInfo: guarded
+    rowsInfo: guarded,
+    currentTable: false
   };
 }
 function extractActiveRunsFromError(error) {
@@ -24018,6 +24155,11 @@ async function handleRunExport(args) {
     datasetPath
   });
   const source = exportResult?.rowsInfo.source ?? datasetPath ?? null;
+  const currentTableNotice = exportResult?.currentTable ? {
+    code: "CURRENT_SHARED_DATASET",
+    message: "This CSV is the current shared dataset and may include writes from another run.",
+    full_run_output_command: `deepline runs get ${status.runId} --full --json`
+  } : null;
   const next = {
     ...buildRunNextCommands(status),
     export: runExportRetryCommand(status.runId, outPath, datasetPath ?? source)
@@ -24029,6 +24171,7 @@ async function handleRunExport(args) {
     source,
     rowCount: exportResult?.rowsInfo.totalRows ?? null,
     columns: exportResult?.rowsInfo.columns ?? [],
+    ...currentTableNotice ? { notice: currentTableNotice } : {},
     ...metadataOutPath ? { metadata_path: metadataOutPath } : {},
     local: { csv_path: exportResult?.path ?? null },
     next,
@@ -24038,6 +24181,10 @@ async function handleRunExport(args) {
           title: "run export",
           lines: [
             `Exported ${status.runId} to ${exportResult?.path ?? outPath}`,
+            ...currentTableNotice ? [
+              "Current shared dataset: this CSV may include writes from another run.",
+              `This run's full returned output: ${currentTableNotice.full_run_output_command}`
+            ] : [],
             ...source ? [`source=${source}`] : []
           ]
         }
@@ -24495,51 +24642,18 @@ function compactPlaySchema(schema) {
   ).filter((field) => Boolean(field?.name)) : [];
   return fields.length > 0 ? { fields } : schema;
 }
-function playSchemaMetadata(schema, key) {
-  if (!schema || typeof schema !== "object" || Array.isArray(schema))
-    return null;
-  const value = schema[key];
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function playRunCommand(play, options) {
-  const target = play.reference || play.name;
-  if (options?.csvInput) {
-    const inputField = typeof options.csvInput.inputField === "string" && options.csvInput.inputField.trim() ? options.csvInput.inputField.trim() : "csv";
-    return `deepline plays run ${target} --input '${JSON.stringify({ [inputField]: "leads.csv" })}' --watch`;
-  }
-  return `deepline plays run ${target} --input '{...}' --watch`;
-}
-function summarizePlayListItemForCli(play, options) {
-  const aliases = play.aliases ?? [];
-  const csvInput = playSchemaMetadata(play.inputSchema, "csvInput");
-  const rowOutputSchema = playSchemaMetadata(
-    play.outputSchema,
-    "rowOutputSchema"
-  );
-  const runCommand2 = playRunCommand(play, { csvInput });
-  const cloneEditStarter = buildCloneEditStarter(play);
+function summarizePlayGrepResult(play) {
+  const reference = formatPlayListReference(play);
   return {
-    name: play.name,
-    ...play.reference ? { reference: play.reference } : {},
-    ...play.displayName ? { displayName: play.displayName } : {},
-    pinned: Boolean(play.pinned),
-    toolCategories: play.toolCategories ?? [],
-    origin: play.origin,
-    ownerType: play.ownerType,
-    canEdit: play.canEdit,
-    canClone: play.canClone,
-    aliases,
-    inputSchema: options?.compact ? compactPlaySchema(play.inputSchema) : play.inputSchema ?? null,
-    outputSchema: options?.compact ? compactPlaySchema(play.outputSchema) : play.outputSchema ?? null,
-    ...csvInput ? { csvInput } : {},
-    ...rowOutputSchema ? { rowOutputSchema } : {},
-    runCommand: runCommand2,
-    examples: [runCommand2],
-    ...cloneEditStarter ? { cloneEditStarter } : {},
-    currentPublishedVersion: play.currentPublishedVersion ?? null,
-    isDraftDirty: play.isDraftDirty
+    name: play.displayName?.trim() || play.name,
+    reference,
+    matches: play.matches ?? [],
+    describe: `deepline plays describe ${reference} --json`
   };
 }
+function formatPlayGrepMatches(matches) {
+  return matches.map((match) => `${match.field}: ${match.terms.join(", ")}`).join("; ");
+}
 async function handlePlaySearch(args) {
   let options;
   try {
@@ -24598,28 +24712,32 @@ async function handlePlaySearch(args) {
 async function handlePlayGrep(args) {
   const query = args[0]?.trim();
   if (!query) {
-    console.error("Usage: deepline plays grep <query> [--compact] [--json]");
+    console.error("Usage: deepline plays grep <query> [--json]");
     return 1;
   }
-  const compact = args.includes("--compact");
   const client2 = new DeeplineClient();
-  const plays = (await client2.listPlays({ grep: query })).map(
-    (play) => summarizePlayListItemForCli(play, { compact })
+  const results = (await client2.listPlays({ grep: query })).map(
+    summarizePlayGrepResult
   );
   if (argsWantJson(args)) {
     printCompactJson({
-      plays,
-      count: plays.length,
+      plays: results,
+      count: results.length,
       query,
-      grep: { engine: "convex_full_text" }
+      grep: { query }
     });
     return 0;
   }
-  process.stdout.write(`${plays.length} plays found:
+  process.stdout.write(
+    `${results.length} results for ${JSON.stringify(query)}:
 
-`);
-  for (const play of plays) {
-    printPlayDescription(play);
+`
+  );
+  for (const result of results) {
+    console.log(result.name);
+    const matches = formatPlayGrepMatches(result.matches);
+    if (matches) console.log(`  Matched: ${matches}`);
+    console.log(`  Describe: ${result.describe}`);
     console.log("");
   }
   return 0;
@@ -25455,7 +25573,7 @@ Notes:
 Examples:
   deepline plays search email
   deepline plays search email --all
-  deepline plays grep "linkedin to email" --compact --json
+  deepline plays grep "linkedin to email" --json
   deepline plays describe prebuilt/person-linkedin-to-email --json
 `
   ).option("--compact", "Emit compact schemas").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
@@ -25479,13 +25597,11 @@ Notes:
 
 Examples:
   deepline plays grep email --json
-  deepline plays grep "company contact" --compact --json
   deepline plays describe prebuilt/company-to-contact --json
 `
-  ).option("--compact", "Emit compact schemas").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (query, options) => {
     process.exitCode = await handlePlayGrep([
       query,
-      ...options.compact ? ["--compact"] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
@@ -32146,7 +32262,7 @@ function loadViewerAssets() {
         "viewer"
       )
     ] : [],
-    join12(process.cwd(), "apps", "deepline-api", "src", "lib", "cli", "viewer")
+    join12(process.cwd(), "packages", "sdk", "assets", "viewer")
   ];
   for (const root of candidateRoots2) {
     try {
@@ -32431,7 +32547,7 @@ import { readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from
 import { resolve as resolve14 } from "path";
 import { createInterface } from "readline/promises";
 
-// src/monitor-fleet-contract.ts
+// ../integration-contracts/monitor-fleet-contract.ts
 var MONITOR_FLEET_MAX_MEMBERS = 1e3;
 var MONITOR_FLEET_AUTHORING_CONTRACT_EDITION = 1;
 var SUPPORTED_MONITOR_FLEET_AUTHORING_CONTRACT_EDITIONS = [
@@ -33117,9 +33233,35 @@ function renderMonitorDeployPlan(payload) {
       "  Inspect: deepline monitors get <key> --json"
     );
   }
+  const identityConflict = asRecord2(payload.identity_conflict);
+  const identityOwner = identityConflict ? asRecord2(identityConflict.existing_monitor) : null;
+  const identityOwnerKey = identityOwner ? asString(identityOwner.key) : void 0;
+  const identityOwnerStatus = identityOwner ? asString(identityOwner.status) : void 0;
+  if (identityConflict) {
+    if (identityOwnerStatus === "provisioning") {
+      lines.push(
+        "",
+        "An in-progress provider operation owns this upstream identity.",
+        "Do not deploy this key yet. Wait, then rerun this dry run."
+      );
+    } else if (identityOwnerKey) {
+      lines.push(
+        "",
+        `An existing monitor owns this upstream identity: ${identityOwnerKey}.`,
+        `Inspect: deepline monitors get ${identityOwnerKey} --json`,
+        "Do not deploy this key unless that conflict is resolved."
+      );
+    } else {
+      lines.push(
+        "",
+        "An existing monitor owns this upstream identity.",
+        "Do not deploy this key until that conflict is resolved."
+      );
+    }
+  }
   lines.push(
     "",
-    valid ? "Deploy for real: re-run this command without --dry-run." : "Fix the definition, then re-run this command."
+    identityConflict ? "Do not deploy for real until this identity conflict clears." : valid ? "Deploy for real: re-run this command without --dry-run." : "Fix the definition, then re-run this command."
   );
   return `${lines.join("\n")}
 `;
@@ -33371,11 +33513,12 @@ async function handleMonitorsDeploy(definition, options) {
       dryRun: true
     });
     const valid = payload2.valid !== false;
+    const hasIdentityConflict = Boolean(asRecord2(payload2)?.identity_conflict);
     printCommandEnvelope(
       { dry_run: true, ...payload2 },
       { json: options.json, text: renderMonitorDeployPlan(payload2) }
     );
-    if (!valid) {
+    if (!valid || hasIdentityConflict) {
       process.exitCode = 7;
     }
     return;
@@ -36709,7 +36852,8 @@ function renderSecret(secret) {
   const added = new Date(secret.createdAt).toISOString();
   const updated = new Date(secret.updatedAt).toISOString();
   const lastUsed = secret.lastUsedAt ? `, last used ${new Date(secret.lastUsedAt).toISOString()}` : ", never used";
-  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
+  const note = secret.note ? `, note ${JSON.stringify(secret.note)}` : "";
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}${note}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
 }
 async function readHiddenLine(prompt, streams = {}) {
   const inputStream = streams.input ?? input;
@@ -36916,7 +37060,8 @@ async function handleSet2(nameInput, forbidden, options) {
       name,
       value,
       scope,
-      ...playName ? { playName } : {}
+      ...playName ? { playName } : {},
+      ...options.note !== void 0 ? { note: options.note } : {}
     }
   );
   const secret = response.secret;
@@ -36939,6 +37084,57 @@ async function handleSet2(nameInput, forbidden, options) {
     { json: options.json }
   );
 }
+async function handleNote(secretId, noteInput, options) {
+  if (options.clear && noteInput !== void 0) {
+    throw new Error("Pass either a note or --clear, not both.");
+  }
+  if (!options.clear && noteInput === void 0) {
+    throw new Error("Provide a note or use --clear.");
+  }
+  const note = options.clear ? "" : noteInput;
+  if (options.dryRun) {
+    printCommandEnvelope(
+      {
+        ok: true,
+        dryRun: true,
+        secretId,
+        note,
+        render: {
+          sections: [
+            {
+              title: "secret note",
+              lines: [
+                options.clear ? `Would clear the note on secret ${secretId}.` : `Would save a note on secret ${secretId}.`
+              ]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const client2 = new DeeplineClient();
+  const secret = await client2.updateSecretNote(secretId, note);
+  printCommandEnvelope(
+    {
+      ok: true,
+      secret,
+      render: {
+        sections: [
+          {
+            title: "secret note saved",
+            lines: [
+              secret.note ? `${secret.name}: note saved.` : `${secret.name}: note cleared.`,
+              renderSecret(secret)
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
 function registerSecretsCommands(program) {
   const secrets = program.command("secrets").description("Manage play secrets without revealing values.").addHelpText(
     "after",
@@ -36946,8 +37142,8 @@ function registerSecretsCommands(program) {
 Notes:
   Secret values are never accepted as command arguments. Use the hidden prompt,
   or one explicit non-argv source: --value-stdin, --from-env NAME, or
-  --from-file PATH. Values are never printed. secrets list shows only status,
-  added, updated, and last-used metadata.
+  --from-file PATH. Values are never printed. secrets list shows only metadata,
+  including any note you intentionally added.
 
 Examples:
   deepline secrets list
@@ -36957,6 +37153,9 @@ Examples:
   printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
   deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
   deepline secrets set HUBSPOT_TOKEN --from-file ./hubspot-token.txt
+  deepline secrets set HUBSPOT_TOKEN --note "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> --clear
 `
   );
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
@@ -36970,11 +37169,19 @@ Examples:
   ).option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
-  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
+  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option(
+    "--note <note>",
+    "Optional non-sensitive memo (maximum 500 characters)"
+  ).option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
     async (name, forbidden, options) => {
       await handleSet2(name, forbidden ?? [], options);
     }
   );
+  secrets.command("note").description("Add, replace, or clear a non-sensitive note on one secret.").argument("<secret-id>", "Secret ID from `deepline secrets list --json`").argument("[note]", "Note text (maximum 500 characters)").option("--clear", "Clear the existing note").option("--dry-run", "Show the note change without saving it").option("--json", "Emit JSON output").action(
+    async (secretId, note, options) => {
+      await handleNote(secretId, note, options);
+    }
+  );
 }
 
 // src/cli/commands/setup.ts