deepline 0.1.24 → 0.1.25

package/dist/cli/index.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/cli/index.ts
-var import_commander = require("commander");
+var import_commander2 = require("commander");
 
 // src/config.ts
 var import_node_fs = require("fs");
@@ -266,7 +266,7 @@ function saveProjectDeeplineEnvValues(baseUrl, values, startDir = projectEnvStar
 }
 
 // src/version.ts
-var SDK_VERSION = "0.1.24";
+var SDK_VERSION = "0.1.25";
 var SDK_API_CONTRACT = "2026-05-runs-v2";
 
 // ../shared_libs/play-runtime/coordinator-headers.ts
@@ -548,7 +548,7 @@ function decodeSseFrame(frame) {
   return parsed;
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 
 // src/client.ts
@@ -556,7 +556,7 @@ var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "ca
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var COMPILE_MANIFEST_RETRY_DELAYS_MS = [250, 1e3];
 function sleep2(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function isTransientCompileManifestError(error) {
   if (error instanceof DeeplineError && typeof error.statusCode === "number") {
@@ -2041,7 +2041,7 @@ function buildCandidateUrls2(url) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function printDeeplineLogo() {
   if (process.stdout.isTTY && (process.stdout.columns ?? 80) >= 70) {
@@ -2415,6 +2415,10 @@ Examples:
 }
 
 // src/cli/commands/billing.ts
+var import_commander = require("commander");
+var import_promises2 = require("fs/promises");
+var import_node_path4 = require("path");
+var import_sync3 = require("csv-stringify/sync");
 function humanize(value) {
   return String(value || "").split("_").filter(Boolean).map((token) => token[0]?.toUpperCase() + token.slice(1)).join(" ") || "Unknown";
 }
@@ -2432,6 +2436,54 @@ function printRecentUsage(entries) {
 `);
   }
 }
+function summarizeLedgerRows(summary, rows) {
+  const netDelta = rows.reduce((sum, row) => {
+    const value = Number.parseFloat(String(row.delta_credits ?? "").trim());
+    return Number.isFinite(value) ? sum + value : sum;
+  }, summary.net_delta_credits);
+  return {
+    row_count: summary.row_count + rows.length,
+    net_delta_credits: Math.round((netDelta + Number.EPSILON) * 100) / 100
+  };
+}
+function ledgerApiEntryToRow(entry) {
+  const metadata = typeof entry.metadata === "object" && entry.metadata !== null ? entry.metadata : {};
+  return {
+    created_at: entry.created_at ?? "",
+    delta_credits: entry.delta ?? "",
+    reason: entry.reason ?? "",
+    provider: metadata.provider ?? "",
+    operation: metadata.operation ?? "",
+    request_id: metadata.requestId ?? metadata.request_id ?? "",
+    run_id: metadata.runId ?? metadata.run_id ?? "",
+    api_key_id: entry.api_key_id ?? "",
+    stripe_session_id: entry.stripe_session_id ?? ""
+  };
+}
+function ledgerRowsToCsv(rows, header) {
+  return (0, import_sync3.stringify)(rows, {
+    header,
+    columns: [
+      "created_at",
+      "delta_credits",
+      "reason",
+      "provider",
+      "operation",
+      "request_id",
+      "run_id",
+      "api_key_id",
+      "stripe_session_id"
+    ]
+  });
+}
+function defaultLedgerExportPath() {
+  return (0, import_node_path4.resolve)(
+    process.cwd(),
+    "deepline",
+    "data",
+    `billing-ledger-all-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.csv`
+  );
+}
 async function handleBalance(options) {
   const { http } = getAuthedHttpClient();
   const payload = await http.get("/api/v2/billing/balance");
@@ -2520,6 +2572,51 @@ async function handleHistory(options) {
   process.stdout.write(`${rows.length} row(s) exported.
 `);
 }
+async function handleLedgerExportAll(options) {
+  const { http } = getAuthedHttpClient();
+  const outputPath = options.output ? (0, import_node_path4.resolve)(String(options.output)) : defaultLedgerExportPath();
+  let summary = { row_count: 0, net_delta_credits: 0 };
+  let cursor = null;
+  let initializedOutput = false;
+  for (; ; ) {
+    const params = new URLSearchParams({ limit: "5000" });
+    if (cursor !== null) params.set("cursor", cursor);
+    const payload = await http.get(
+      `/api/v2/billing/ledger?${params.toString()}`
+    );
+    const entries = Array.isArray(payload.entries) ? payload.entries : [];
+    const rows = entries.map(ledgerApiEntryToRow);
+    if (!initializedOutput) {
+      await (0, import_promises2.mkdir)((0, import_node_path4.dirname)(outputPath), { recursive: true });
+      await (0, import_promises2.writeFile)(outputPath, ledgerRowsToCsv([], true), "utf-8");
+      initializedOutput = true;
+    }
+    if (rows.length > 0) {
+      await (0, import_promises2.appendFile)(outputPath, ledgerRowsToCsv(rows, false), "utf-8");
+      summary = summarizeLedgerRows(summary, rows);
+    }
+    const nextCursor = typeof payload.next_cursor === "string" && payload.next_cursor.length > 0 ? payload.next_cursor : null;
+    if (rows.length === 0 || payload.has_more !== true || nextCursor === null) {
+      break;
+    }
+    if (nextCursor === cursor) break;
+    cursor = nextCursor;
+  }
+  if (shouldEmitJson(options.json)) {
+    return printJson({
+      output_path: outputPath,
+      row_count: summary.row_count,
+      net_delta_credits: summary.net_delta_credits,
+      scope: "current_auth_context"
+    });
+  }
+  process.stdout.write(`Billing ledger written to ${outputPath}
+`);
+  process.stdout.write(`${summary.row_count} row(s) exported for the current auth context.
+`);
+  process.stdout.write(`Net ledger delta: ${summary.net_delta_credits} Deepline Credits
+`);
+}
 async function handleCheckout(options) {
   const { http } = getAuthedHttpClient();
   const payload = await http.post("/api/v2/billing/checkout", {
@@ -2616,6 +2713,41 @@ Examples:
   deepline billing off --json
 `
   ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleLimitOff);
+  billing.command("ledger").description("Inspect and export billing ledger rows.").addHelpText(
+    "after",
+    `
+Notes:
+  Read-only. Exports ledger rows for the current auth context. API-key auth is
+  scoped by the server to that API key; session auth is scoped to the active
+  workspace.
+
+Examples:
+  deepline billing ledger export all
+  deepline billing ledger export all --output ./ledger.csv
+  deepline billing ledger export all --json
+`
+  ).addCommand(
+    new import_commander.Command("export").description("Export billing ledger rows.").addHelpText(
+      "after",
+      `
+Examples:
+  deepline billing ledger export all
+`
+    ).addCommand(
+      new import_commander.Command("all").description("Export all available billing ledger rows to CSV.").addHelpText(
+        "after",
+        `
+Notes:
+  Pages through the ledger for the current auth context, writes CSV locally,
+  then reports the row count and the net delta computed from delta_credits.
+
+Examples:
+  deepline billing ledger export all
+  deepline billing ledger export all --json
+`
+      ).option("--output <path>", "Write CSV to an explicit path").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleLedgerExportAll)
+    )
+  );
   billing.command("history").description("Export billing ledger history to CSV.").addHelpText(
     "after",
     `
@@ -2657,7 +2789,7 @@ Examples:
 
 // src/cli/dataset-stats.ts
 var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 var CSV_PROJECTED_FIELDS_KEY = "__deeplineCsvProjectedFields";
 function csvProjectedFields(row) {
   const serialized = row[CSV_PROJECTED_FIELDS_KEY];
@@ -2987,7 +3119,7 @@ function writeCanonicalRowsCsv(rowsInfo, outPath) {
     rows: rowsInfo.rows,
     columns: rowsInfo.columns
   });
-  const resolved = (0, import_node_path4.resolve)(outPath);
+  const resolved = (0, import_node_path5.resolve)(outPath);
   (0, import_node_fs4.writeFileSync)(
     resolved,
     csvStringFromRows(sanitized.rows, sanitized.columns),
@@ -3382,19 +3514,19 @@ Examples:
 // src/cli/commands/play.ts
 var import_node_crypto3 = require("crypto");
 var import_node_fs6 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/plays/bundle-play-file.ts
 var import_node_os5 = require("os");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_node_url = require("url");
 var import_node_fs5 = require("fs");
 
 // ../shared_libs/plays/bundling/index.ts
 var import_node_crypto = require("crypto");
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_os4 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var import_node_module = require("module");
 var import_esbuild = require("esbuild");
 
@@ -3455,7 +3587,7 @@ var playArtifactRequire = (0, import_node_module.createRequire)(import_meta.url)
 var PLAY_BUNDLE_CACHE_VERSION = 24;
 var MAX_PLAY_BUNDLE_BYTES = 30 * 1024 * 1024;
 var MAX_ESM_WORKERS_BUNDLE_BYTES = 115e4;
-var PLAY_ARTIFACT_CACHE_DIR = (0, import_node_path5.join)(
+var PLAY_ARTIFACT_CACHE_DIR = (0, import_node_path6.join)(
   (0, import_node_os4.tmpdir)(),
   `deepline-play-artifacts-v${PLAY_BUNDLE_CACHE_VERSION}`
 );
@@ -3486,15 +3618,15 @@ function isLocalSpecifier(specifier) {
 }
 async function normalizeLocalPath(filePath) {
   try {
-    return await (0, import_promises2.realpath)(filePath);
+    return await (0, import_promises3.realpath)(filePath);
   } catch {
-    return (0, import_node_path5.resolve)(filePath);
+    return (0, import_node_path6.resolve)(filePath);
   }
 }
 function createPlayWorkspace(entryFile) {
   return {
     entryFile,
-    rootDir: (0, import_node_path5.dirname)(entryFile)
+    rootDir: (0, import_node_path6.dirname)(entryFile)
   };
 }
 function isPathInsideDirectory(filePath, directory) {
@@ -3648,7 +3780,7 @@ function extractDefinedPlayName(sourceCode, _filePath) {
 function getPackageRequireCandidates(fromFile) {
   const candidates = [
     (0, import_node_module.createRequire)(fromFile),
-    (0, import_node_module.createRequire)((0, import_node_path5.join)(process.cwd(), "package.json")),
+    (0, import_node_module.createRequire)((0, import_node_path6.join)(process.cwd(), "package.json")),
     playArtifactRequire
   ];
   return candidates;
@@ -3695,7 +3827,7 @@ function workersNamedPlayEntryAliasPlugin(playFilePath, exportName) {
           contents: `export { ${exportName} as default } from ${JSON.stringify(playFilePath)};
 `,
           loader: "ts",
-          resolveDir: (0, import_node_path5.dirname)(playFilePath)
+          resolveDir: (0, import_node_path6.dirname)(playFilePath)
         })
       );
     }
@@ -3859,7 +3991,7 @@ function importedPlayProxyPlugin(importedPlayDependencies) {
         return {
           contents: buildImportedPlayProxyModule(dependency.playName),
           loader: "ts",
-          resolveDir: (0, import_node_path5.dirname)(args.path)
+          resolveDir: (0, import_node_path6.dirname)(args.path)
         };
       });
     }
@@ -3867,7 +3999,7 @@ function importedPlayProxyPlugin(importedPlayDependencies) {
 }
 async function fileExists(filePath) {
   try {
-    await (0, import_promises2.stat)(filePath);
+    await (0, import_promises3.stat)(filePath);
     return true;
   } catch {
     return false;
@@ -3877,12 +4009,12 @@ async function resolveLocalImport(fromFile, specifier) {
   if (specifier.startsWith("file:")) {
     return normalizeLocalPath(new URL(specifier).pathname);
   }
-  const base = (0, import_node_path5.isAbsolute)(specifier) ? (0, import_node_path5.resolve)(specifier) : (0, import_node_path5.resolve)((0, import_node_path5.dirname)(fromFile), specifier);
+  const base = (0, import_node_path6.isAbsolute)(specifier) ? (0, import_node_path6.resolve)(specifier) : (0, import_node_path6.resolve)((0, import_node_path6.dirname)(fromFile), specifier);
   const candidates = [base];
-  const explicitExtension = (0, import_node_path5.extname)(base).toLowerCase();
+  const explicitExtension = (0, import_node_path6.extname)(base).toLowerCase();
   if (!explicitExtension) {
     candidates.push(...SOURCE_EXTENSIONS.map((extension) => `${base}${extension}`));
-    candidates.push(...SOURCE_EXTENSIONS.map((extension) => (0, import_node_path5.join)(base, `index${extension}`)));
+    candidates.push(...SOURCE_EXTENSIONS.map((extension) => (0, import_node_path6.join)(base, `index${extension}`)));
   } else if ([".js", ".jsx", ".mjs", ".cjs"].includes(explicitExtension)) {
     const stem = base.slice(0, -explicitExtension.length);
     candidates.push(...SOURCE_EXTENSIONS.map((extension) => `${stem}${extension}`));
@@ -3948,9 +4080,9 @@ async function analyzeSourceGraph(entryFile, adapter) {
       return;
     }
     visited.add(absolutePath);
-    const sourceCode2 = await (0, import_promises2.readFile)(absolutePath, "utf-8");
+    const sourceCode2 = await (0, import_promises3.readFile)(absolutePath, "utf-8");
     localFiles.set(absolutePath, sourceCode2);
-    if ((0, import_node_path5.extname)(absolutePath).toLowerCase() === ".json") {
+    if ((0, import_node_path6.extname)(absolutePath).toLowerCase() === ".json") {
       return;
     }
     const handleSpecifier = async (specifier, line, column, kind) => {
@@ -3974,7 +4106,7 @@ async function analyzeSourceGraph(entryFile, adapter) {
           column
         });
         if (resolved !== absoluteEntryFile && isPlaySourceFile(resolved)) {
-          const importedSource = await (0, import_promises2.readFile)(resolved, "utf-8");
+          const importedSource = await (0, import_promises3.readFile)(resolved, "utf-8");
           const importedPlayName = extractDefinedPlayName(importedSource, resolved);
           if (!importedPlayName) {
             throw new Error(
@@ -4054,20 +4186,20 @@ async function computeWorkersHarnessFingerprintWithAdapter(adapter) {
   const tsFiles = entries.filter((e) => e.isFile() && /\.[cm]?ts$/.test(e.name)).map((e) => e.name).sort();
   const parts = [];
   for (const name of tsFiles) {
-    const contents = await (0, import_promises2.readFile)((0, import_node_path5.join)(adapter.workersHarnessFilesDir, name), "utf-8");
+    const contents = await (0, import_promises3.readFile)((0, import_node_path6.join)(adapter.workersHarnessFilesDir, name), "utf-8");
     parts.push({ name, hash: sha256(contents) });
   }
   return sha256(JSON.stringify(parts));
 }
 function artifactCachePath(graphHash, artifactKind, adapter) {
-  return (0, import_node_path5.join)(
+  return (0, import_node_path6.join)(
     adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR,
     `${graphHash}.${artifactKind}.json`
   );
 }
 async function readArtifactCache(graphHash, artifactKind, adapter) {
   try {
-    const serialized = await (0, import_promises2.readFile)(
+    const serialized = await (0, import_promises3.readFile)(
       artifactCachePath(graphHash, artifactKind, adapter),
       "utf-8"
     );
@@ -4078,8 +4210,8 @@ async function readArtifactCache(graphHash, artifactKind, adapter) {
 }
 async function writeArtifactCache(artifact, adapter) {
   const cacheDir = adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR;
-  await (0, import_promises2.mkdir)(cacheDir, { recursive: true });
-  await (0, import_promises2.writeFile)(
+  await (0, import_promises3.mkdir)(cacheDir, { recursive: true });
+  await (0, import_promises3.writeFile)(
     artifactCachePath(
       artifact.graphHash,
       artifact.artifactKind ?? PLAY_ARTIFACT_KINDS.cjsNode20,
@@ -4095,7 +4227,7 @@ function normalizeSourceMapForRuntime(sourceMapText) {
     if (sourcePath.startsWith("data:") || sourcePath.startsWith("node:") || sourcePath.startsWith("/") || /^[a-zA-Z]+:\/\//.test(sourcePath)) {
       return sourcePath;
     }
-    return (0, import_node_path5.resolve)(process.cwd(), sourcePath);
+    return (0, import_node_path6.resolve)(process.cwd(), sourcePath);
   });
   parsed.sourceRoot = void 0;
   return JSON.stringify(parsed);
@@ -4127,8 +4259,8 @@ async function runEsbuildForCjsNode(entryFile, importedPlayDependencies, adapter
     ...namedExportShim ? {
       stdin: {
         contents: namedExportShim,
-        resolveDir: (0, import_node_path5.dirname)(entryFile),
-        sourcefile: `${(0, import_node_path5.basename)(entryFile)}.${exportName}.entry.ts`,
+        resolveDir: (0, import_node_path6.dirname)(entryFile),
+        sourcefile: `${(0, import_node_path6.basename)(entryFile)}.${exportName}.entry.ts`,
         loader: "ts"
       }
     } : { entryPoints: [entryFile] },
@@ -4304,10 +4436,10 @@ workers-harness:${harnessFingerprint}`
     }
     const { bundledCode, sourceMapText, outputExtension } = buildOutcome;
     const normalizedSourceMap = normalizeSourceMapForRuntime(sourceMapText);
-    const virtualBaseName = exportName === "default" ? (0, import_node_path5.basename)(absolutePath).replace(/\.[^.]+$/, "") : `${(0, import_node_path5.basename)(absolutePath).replace(/\.[^.]+$/, "")}.${exportName}`;
+    const virtualBaseName = exportName === "default" ? (0, import_node_path6.basename)(absolutePath).replace(/\.[^.]+$/, "") : `${(0, import_node_path6.basename)(absolutePath).replace(/\.[^.]+$/, "")}.${exportName}`;
     const virtualFilename = `/virtual/deepline-plays/${analysis.graphHash}/${virtualBaseName}.${outputExtension}`;
     const executableCode = `${bundledCode}
-//# sourceMappingURL=${(0, import_node_path5.basename)(virtualFilename)}.map
+//# sourceMappingURL=${(0, import_node_path6.basename)(virtualFilename)}.map
 `;
     const bundleSizeError = getBundleSizeError(
       absolutePath,
@@ -4416,14 +4548,14 @@ function resolveExecutionProfile(override) {
 
 // src/plays/local-file-discovery.ts
 var import_node_crypto2 = require("crypto");
-var import_promises3 = require("fs/promises");
-var import_node_path6 = require("path");
+var import_promises4 = require("fs/promises");
+var import_node_path7 = require("path");
 var SOURCE_EXTENSIONS2 = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".json"];
 function sha2562(buffer) {
   return (0, import_node_crypto2.createHash)("sha256").update(buffer).digest("hex");
 }
 function contentTypeForFile(filePath) {
-  const extension = (0, import_node_path6.extname)(filePath).toLowerCase();
+  const extension = (0, import_node_path7.extname)(filePath).toLowerCase();
   if (extension === ".csv") return "text/csv";
   if (extension === ".json") return "application/json";
   if (extension === ".txt") return "text/plain";
@@ -4607,23 +4739,23 @@ function localImportSpecifiers(sourceCode) {
 }
 async function fileExists2(filePath) {
   try {
-    await (0, import_promises3.stat)(filePath);
+    await (0, import_promises4.stat)(filePath);
     return true;
   } catch {
     return false;
   }
 }
 function isPathInsideDirectory2(filePath, directory) {
-  const relativePath = (0, import_node_path6.relative)(directory, filePath);
-  return relativePath === "" || !relativePath.startsWith("..") && !(0, import_node_path6.isAbsolute)(relativePath);
+  const relativePath = (0, import_node_path7.relative)(directory, filePath);
+  return relativePath === "" || !relativePath.startsWith("..") && !(0, import_node_path7.isAbsolute)(relativePath);
 }
 async function resolveLocalImport2(fromFile, specifier) {
-  const base = (0, import_node_path6.isAbsolute)(specifier) ? (0, import_node_path6.resolve)(specifier) : (0, import_node_path6.resolve)((0, import_node_path6.dirname)(fromFile), specifier);
+  const base = (0, import_node_path7.isAbsolute)(specifier) ? (0, import_node_path7.resolve)(specifier) : (0, import_node_path7.resolve)((0, import_node_path7.dirname)(fromFile), specifier);
   const candidates = [base];
-  const explicitExtension = (0, import_node_path6.extname)(base).toLowerCase();
+  const explicitExtension = (0, import_node_path7.extname)(base).toLowerCase();
   if (!explicitExtension) {
     candidates.push(...SOURCE_EXTENSIONS2.map((extension) => `${base}${extension}`));
-    candidates.push(...SOURCE_EXTENSIONS2.map((extension) => (0, import_node_path6.join)(base, `index${extension}`)));
+    candidates.push(...SOURCE_EXTENSIONS2.map((extension) => (0, import_node_path7.join)(base, `index${extension}`)));
   } else if ([".js", ".jsx", ".mjs", ".cjs"].includes(explicitExtension)) {
     const stem = base.slice(0, -explicitExtension.length);
     candidates.push(...SOURCE_EXTENSIONS2.map((extension) => `${stem}${extension}`));
@@ -4636,18 +4768,18 @@ async function resolveLocalImport2(fromFile, specifier) {
   throw new Error(`Could not resolve local import "${specifier}" from ${fromFile}`);
 }
 async function discoverPackagedLocalFiles(entryFile) {
-  const absoluteEntryFile = (0, import_node_path6.resolve)(entryFile);
-  const packagingRoot = (0, import_node_path6.dirname)(absoluteEntryFile);
+  const absoluteEntryFile = (0, import_node_path7.resolve)(entryFile);
+  const packagingRoot = (0, import_node_path7.dirname)(absoluteEntryFile);
   const files = /* @__PURE__ */ new Map();
   const unresolved = [];
   const visitedFiles = /* @__PURE__ */ new Set();
   const visitSourceFile = async (filePath) => {
-    const absolutePath = (0, import_node_path6.resolve)(filePath);
+    const absolutePath = (0, import_node_path7.resolve)(filePath);
     if (visitedFiles.has(absolutePath)) {
       return;
     }
     visitedFiles.add(absolutePath);
-    const sourceCode = await (0, import_promises3.readFile)(absolutePath, "utf-8");
+    const sourceCode = await (0, import_promises4.readFile)(absolutePath, "utf-8");
     const scanSource = stripCommentsToSpaces2(sourceCode);
     const constants = collectTopLevelStringConstants(sourceCode);
     const childVisits = [];
@@ -4674,16 +4806,16 @@ async function discoverPackagedLocalFiles(entryFile) {
             message: "Could not resolve this ctx.csv(...) path at submit time. Use a string literal, a top-level const string, or pass a runtime input like input.file."
           });
         } else {
-          const absoluteCsvPath = (0, import_node_path6.resolve)((0, import_node_path6.dirname)(absolutePath), resolvedPath);
-          if ((0, import_node_path6.isAbsolute)(resolvedPath) || !isPathInsideDirectory2(absoluteCsvPath, packagingRoot)) {
+          const absoluteCsvPath = (0, import_node_path7.resolve)((0, import_node_path7.dirname)(absolutePath), resolvedPath);
+          if ((0, import_node_path7.isAbsolute)(resolvedPath) || !isPathInsideDirectory2(absoluteCsvPath, packagingRoot)) {
             unresolved.push({
               sourceFragment: sourceCode.slice(argument.start, argument.end).trim(),
               message: "ctx.csv(...) packaged file paths must be relative paths inside the play directory. Pass external files at runtime with input.file instead."
             });
             continue;
           }
-          const buffer = await (0, import_promises3.readFile)(absoluteCsvPath);
-          const stats = await (0, import_promises3.stat)(absoluteCsvPath);
+          const buffer = await (0, import_promises4.readFile)(absoluteCsvPath);
+          const stats = await (0, import_promises4.stat)(absoluteCsvPath);
           files.set(absoluteCsvPath, {
             sourceFragment: sourceCode.slice(argument.start, argument.end).trim(),
             logicalPath: resolvedPath,
@@ -4714,24 +4846,24 @@ async function discoverPackagedLocalFiles(entryFile) {
 // src/plays/bundle-play-file.ts
 var import_meta2 = {};
 var PLAY_BUNDLE_CACHE_VERSION2 = 26;
-var MODULE_DIR = (0, import_node_path7.dirname)((0, import_node_url.fileURLToPath)(import_meta2.url));
-var SDK_PACKAGE_ROOT = (0, import_node_path7.resolve)(MODULE_DIR, "..", "..");
-var SOURCE_REPO_ROOT = (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "..");
+var MODULE_DIR = (0, import_node_path8.dirname)((0, import_node_url.fileURLToPath)(import_meta2.url));
+var SDK_PACKAGE_ROOT = (0, import_node_path8.resolve)(MODULE_DIR, "..", "..");
+var SOURCE_REPO_ROOT = (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "..");
 var HAS_SOURCE_BUNDLING_SOURCES = (0, import_node_fs5.existsSync)(
-  (0, import_node_path7.resolve)(SOURCE_REPO_ROOT, "apps", "play-runner-workers", "src", "entry.ts")
+  (0, import_node_path8.resolve)(SOURCE_REPO_ROOT, "apps", "play-runner-workers", "src", "entry.ts")
 );
-var PACKAGED_REPO_ROOT = (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "dist", "repo");
+var PACKAGED_REPO_ROOT = (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "dist", "repo");
 var HAS_PACKAGED_BUNDLING_SOURCES = (0, import_node_fs5.existsSync)(
-  (0, import_node_path7.resolve)(PACKAGED_REPO_ROOT, "apps", "play-runner-workers", "src", "entry.ts")
+  (0, import_node_path8.resolve)(PACKAGED_REPO_ROOT, "apps", "play-runner-workers", "src", "entry.ts")
 );
-var PROJECT_ROOT = HAS_SOURCE_BUNDLING_SOURCES ? SOURCE_REPO_ROOT : HAS_PACKAGED_BUNDLING_SOURCES ? PACKAGED_REPO_ROOT : (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "..");
-var SDK_SOURCE_ROOT = HAS_SOURCE_BUNDLING_SOURCES ? (0, import_node_path7.resolve)(SOURCE_REPO_ROOT, "sdk", "src") : HAS_PACKAGED_BUNDLING_SOURCES ? (0, import_node_path7.resolve)(PACKAGED_REPO_ROOT, "sdk", "src") : (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "src");
-var SDK_PACKAGE_JSON = (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "package.json");
-var SDK_ENTRY_FILE = (0, import_node_path7.resolve)(SDK_SOURCE_ROOT, "index.ts");
-var SDK_TYPES_ENTRY_FILE = HAS_SOURCE_BUNDLING_SOURCES ? SDK_ENTRY_FILE : (0, import_node_path7.resolve)(SDK_PACKAGE_ROOT, "dist", "index.d.ts");
-var SDK_WORKERS_ENTRY_FILE = (0, import_node_path7.resolve)(SDK_SOURCE_ROOT, "worker-play-entry.ts");
-var WORKERS_HARNESS_ENTRY_FILE = (0, import_node_path7.resolve)(PROJECT_ROOT, "apps", "play-runner-workers", "src", "entry.ts");
-var WORKERS_HARNESS_FILES_DIR = (0, import_node_path7.resolve)(PROJECT_ROOT, "apps", "play-runner-workers", "src");
+var PROJECT_ROOT = HAS_SOURCE_BUNDLING_SOURCES ? SOURCE_REPO_ROOT : HAS_PACKAGED_BUNDLING_SOURCES ? PACKAGED_REPO_ROOT : (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "..");
+var SDK_SOURCE_ROOT = HAS_SOURCE_BUNDLING_SOURCES ? (0, import_node_path8.resolve)(SOURCE_REPO_ROOT, "sdk", "src") : HAS_PACKAGED_BUNDLING_SOURCES ? (0, import_node_path8.resolve)(PACKAGED_REPO_ROOT, "sdk", "src") : (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "src");
+var SDK_PACKAGE_JSON = (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "package.json");
+var SDK_ENTRY_FILE = (0, import_node_path8.resolve)(SDK_SOURCE_ROOT, "index.ts");
+var SDK_TYPES_ENTRY_FILE = HAS_SOURCE_BUNDLING_SOURCES ? SDK_ENTRY_FILE : (0, import_node_path8.resolve)(SDK_PACKAGE_ROOT, "dist", "index.d.ts");
+var SDK_WORKERS_ENTRY_FILE = (0, import_node_path8.resolve)(SDK_SOURCE_ROOT, "worker-play-entry.ts");
+var WORKERS_HARNESS_ENTRY_FILE = (0, import_node_path8.resolve)(PROJECT_ROOT, "apps", "play-runner-workers", "src", "entry.ts");
+var WORKERS_HARNESS_FILES_DIR = (0, import_node_path8.resolve)(PROJECT_ROOT, "apps", "play-runner-workers", "src");
 var hasWarnedAboutNonDevelopmentBundling = false;
 function warnAboutNonDevelopmentBundling(filePath) {
   if (hasWarnedAboutNonDevelopmentBundling) {
@@ -4755,8 +4887,8 @@ function defaultPlayBundleTarget() {
 function createSdkPlayBundlingAdapter() {
   return {
     projectRoot: PROJECT_ROOT,
-    nodeModulesDir: (0, import_node_path7.resolve)(PROJECT_ROOT, "node_modules"),
-    cacheDir: (0, import_node_path7.join)((0, import_node_os5.tmpdir)(), `deepline-play-artifacts-v${PLAY_BUNDLE_CACHE_VERSION2}`),
+    nodeModulesDir: (0, import_node_path8.resolve)(PROJECT_ROOT, "node_modules"),
+    cacheDir: (0, import_node_path8.join)((0, import_node_os5.tmpdir)(), `deepline-play-artifacts-v${PLAY_BUNDLE_CACHE_VERSION2}`),
     sdkSourceRoot: SDK_SOURCE_ROOT,
     sdkPackageJson: SDK_PACKAGE_JSON,
     sdkEntryFile: SDK_ENTRY_FILE,
@@ -5036,7 +5168,7 @@ function formatPlayListReference(play) {
 function defaultMaterializedPlayPath(reference) {
   const playName = parseReferencedPlayTarget(reference).unqualifiedPlayName;
   const safeName = playName.trim().toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-  return (0, import_node_path8.resolve)(`${safeName || "play"}.play.ts`);
+  return (0, import_node_path9.resolve)(`${safeName || "play"}.play.ts`);
 }
 function materializeRemotePlaySource(input) {
   if (isFileTarget(input.target)) {
@@ -5099,7 +5231,7 @@ function extractPlayName(code, filePath) {
   throw buildMissingDefinePlayError(filePath);
 }
 function isFileTarget(target) {
-  return (0, import_node_fs6.existsSync)((0, import_node_path8.resolve)(target));
+  return (0, import_node_fs6.existsSync)((0, import_node_path9.resolve)(target));
 }
 function looksLikeFilePath(target) {
   if (target.trim().toLowerCase().startsWith("prebuilt/")) {
@@ -5118,7 +5250,7 @@ function parsePositiveInteger2(value, flagName) {
   return parsed;
 }
 function parseJsonInput(raw) {
-  const source = raw.startsWith("@") ? (0, import_node_fs6.readFileSync)((0, import_node_path8.resolve)(raw.slice(1)), "utf-8") : raw;
+  const source = raw.startsWith("@") ? (0, import_node_fs6.readFileSync)((0, import_node_path9.resolve)(raw.slice(1)), "utf-8") : raw;
   const parsed = JSON.parse(source);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("--input must be a JSON object.");
@@ -5228,7 +5360,7 @@ function applyCsvShortcutInput(input) {
 function isLocalFilePathValue(value) {
   if (typeof value !== "string" || !value.trim()) return false;
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value.trim())) return false;
-  return (0, import_node_fs6.existsSync)((0, import_node_path8.resolve)(value));
+  return (0, import_node_fs6.existsSync)((0, import_node_path9.resolve)(value));
 }
 function inputContainsLocalFilePath(value) {
   if (isLocalFilePathValue(value)) {
@@ -5254,8 +5386,8 @@ async function stageFileInputArgs(input) {
   const localFiles = uniqueBindings.flatMap((binding) => {
     const value = getDottedInputValue(input.runtimeInput, binding.inputPath);
     if (!isLocalFilePathValue(value)) return [];
-    const absolutePath = (0, import_node_path8.resolve)(value);
-    return [{ binding, absolutePath, logicalPath: (0, import_node_path8.basename)(absolutePath) }];
+    const absolutePath = (0, import_node_path9.resolve)(value);
+    return [{ binding, absolutePath, logicalPath: (0, import_node_path9.basename)(absolutePath) }];
   });
   if (localFiles.length === 0) {
     return { inputFile: null, packagedFiles: [] };
@@ -5290,9 +5422,9 @@ function stageFile(logicalPath, absolutePath) {
 }
 function normalizePlayPath(filePath) {
   try {
-    return import_node_fs6.realpathSync.native((0, import_node_path8.resolve)(filePath));
+    return import_node_fs6.realpathSync.native((0, import_node_path9.resolve)(filePath));
   } catch {
-    return (0, import_node_path8.resolve)(filePath);
+    return (0, import_node_path9.resolve)(filePath);
   }
 }
 function formatBundlingErrors(filePath, errors) {
@@ -6352,7 +6484,7 @@ function parsePlayRunOptions(args) {
       continue;
     }
     if (arg === "--out" && args[index + 1]) {
-      outPath = (0, import_node_path8.resolve)(args[++index]);
+      outPath = (0, import_node_path9.resolve)(args[++index]);
       continue;
     }
     if (arg === "--poll-interval-ms" || arg === "--interval-ms") {
@@ -6452,11 +6584,11 @@ function shouldUseLocalOnlyPlayCheck() {
 async function handlePlayCheck(args) {
   const options = parsePlayCheckOptions(args);
   if (!isFileTarget(options.target)) {
-    const resolved = (0, import_node_path8.resolve)(options.target);
+    const resolved = (0, import_node_path9.resolve)(options.target);
     console.error(`File not found: ${resolved}`);
     return 1;
   }
-  const absolutePlayPath = (0, import_node_path8.resolve)(options.target);
+  const absolutePlayPath = (0, import_node_path9.resolve)(options.target);
   const sourceCode = (0, import_node_fs6.readFileSync)(absolutePlayPath, "utf-8");
   let graph;
   try {
@@ -6520,7 +6652,7 @@ async function handleFileBackedRun(options) {
   }
   const client = new DeeplineClient();
   const progress = getActiveCliProgress() ?? createCliProgress(!options.jsonOutput);
-  const absolutePlayPath = (0, import_node_path8.resolve)(options.target.path);
+  const absolutePlayPath = (0, import_node_path9.resolve)(options.target.path);
   progress.phase("compiling play");
   const sourceCode = traceCliSync(
     "cli.play_file_read_source",
@@ -6809,11 +6941,11 @@ async function handlePlayRun(args) {
     if (isFileTarget(options.target.path)) {
       return handleFileBackedRun(options);
     }
-    const resolved = (0, import_node_path8.resolve)(options.target.path);
+    const resolved = (0, import_node_path9.resolve)(options.target.path);
     console.error(`File not found: ${resolved}`);
-    const dir = (0, import_node_path8.dirname)(resolved);
+    const dir = (0, import_node_path9.dirname)(resolved);
     if ((0, import_node_fs6.existsSync)(dir)) {
-      const base = (0, import_node_path8.basename)(resolved);
+      const base = (0, import_node_path9.basename)(resolved);
       try {
         const siblings = (0, import_node_fs6.readdirSync)(dir).filter(
           (f) => f.includes(base.replace(/\.(play\.)?ts$/, "")) || f.endsWith(".play.ts")
@@ -6821,7 +6953,7 @@ async function handlePlayRun(args) {
         if (siblings.length > 0) {
           console.error(`Did you mean one of these?`);
           for (const s of siblings.slice(0, 5)) {
-            console.error(`  ${(0, import_node_path8.join)(dir, s)}`);
+            console.error(`  ${(0, import_node_path9.join)(dir, s)}`);
           }
         }
       } catch {
@@ -6967,7 +7099,7 @@ async function handleRunLogs(args) {
       continue;
     }
     if (arg === "--out" && args[index + 1]) {
-      outPath = (0, import_node_path8.resolve)(args[++index]);
+      outPath = (0, import_node_path9.resolve)(args[++index]);
     }
   }
   const client = new DeeplineClient();
@@ -7054,7 +7186,7 @@ async function handleRunExport(args) {
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--out" && args[index + 1]) {
-      outPath = (0, import_node_path8.resolve)(args[++index]);
+      outPath = (0, import_node_path9.resolve)(args[++index]);
     }
   }
   if (!outPath) {
@@ -7094,10 +7226,10 @@ async function handlePlayGet(args) {
   for (let index = 1; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--out" && args[index + 1]) {
-      outPath = (0, import_node_path8.resolve)(args[++index]);
+      outPath = (0, import_node_path9.resolve)(args[++index]);
     }
   }
-  const playName = isFileTarget(target) ? extractPlayName((0, import_node_fs6.readFileSync)((0, import_node_path8.resolve)(target), "utf-8"), (0, import_node_path8.resolve)(target)) : parseReferencedPlayTarget(target).playName;
+  const playName = isFileTarget(target) ? extractPlayName((0, import_node_fs6.readFileSync)((0, import_node_path9.resolve)(target), "utf-8"), (0, import_node_path9.resolve)(target)) : parseReferencedPlayTarget(target).playName;
   const detail = isFileTarget(target) ? await client.getPlay(playName) : await assertCanonicalNamedPlayReference(client, target);
   const resolvedSource = detail.play.workingRevision?.sourceCode ?? detail.play.liveRevision?.sourceCode ?? detail.play.currentRevision?.sourceCode ?? detail.play.sourceCode ?? "";
   const materializedFile = outPath ? materializeRemotePlaySource({
@@ -7389,7 +7521,7 @@ async function handlePlayPublish(args) {
     }
     let graph;
     try {
-      graph = await collectBundledPlayGraph((0, import_node_path8.resolve)(playName));
+      graph = await collectBundledPlayGraph((0, import_node_path9.resolve)(playName));
       await compileBundledPlayGraphManifests(client, graph);
       await publishImportedPlayDependencies(client, graph);
     } catch (error) {
@@ -7885,12 +8017,12 @@ Examples:
 // src/cli/commands/tools.ts
 var import_node_fs8 = require("fs");
 var import_node_os7 = require("os");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 
 // src/tool-output.ts
 var import_node_fs7 = require("fs");
 var import_node_os6 = require("os");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -7965,19 +8097,19 @@ function tryConvertToList(payload, options) {
   return null;
 }
 function ensureOutputDir() {
-  const outputDir = (0, import_node_path9.join)((0, import_node_os6.homedir)(), ".local", "share", "deepline", "data");
+  const outputDir = (0, import_node_path10.join)((0, import_node_os6.homedir)(), ".local", "share", "deepline", "data");
   (0, import_node_fs7.mkdirSync)(outputDir, { recursive: true });
   return outputDir;
 }
 function writeJsonOutputFile(payload, stem) {
   const outputDir = ensureOutputDir();
-  const outputPath = (0, import_node_path9.join)(outputDir, `${stem}_${Date.now()}.json`);
+  const outputPath = (0, import_node_path10.join)(outputDir, `${stem}_${Date.now()}.json`);
   (0, import_node_fs7.writeFileSync)(outputPath, JSON.stringify(payload, null, 2), "utf-8");
   return outputPath;
 }
 function writeCsvOutputFile(rows, stem) {
   const outputDir = ensureOutputDir();
-  const outputPath = (0, import_node_path9.join)(outputDir, `${stem}_${Date.now()}.csv`);
+  const outputPath = (0, import_node_path10.join)(outputDir, `${stem}_${Date.now()}.csv`);
   const seen = /* @__PURE__ */ new Set();
   const columns = [];
   for (const row of rows) {
@@ -8537,9 +8669,9 @@ function powerShellQuote(value) {
 function seedToolListScript(input) {
   const stem = safeFileStem(input.toolId);
   const fileName = `${stem}-workflow-seed-${Date.now()}.play.ts`;
-  const scriptDir = (0, import_node_fs8.mkdtempSync)((0, import_node_path10.join)((0, import_node_os7.tmpdir)(), "deepline-workflow-seed-"));
+  const scriptDir = (0, import_node_fs8.mkdtempSync)((0, import_node_path11.join)((0, import_node_os7.tmpdir)(), "deepline-workflow-seed-"));
   (0, import_node_fs8.chmodSync)(scriptDir, 448);
-  const scriptPath = (0, import_node_path10.join)(scriptDir, fileName);
+  const scriptPath = (0, import_node_path11.join)(scriptDir, fileName);
   const projectDir = `deepline/projects/${stem}-workflow`;
   const playName = `${stem}-workflow`;
   const sampleRows = input.rows.length > 0 ? `${JSON.stringify(input.rows.slice(0, 2)).replace(/\]$/, "")}, ...]` : "[]";
@@ -8682,7 +8814,7 @@ async function executeTool(args) {
 var import_node_child_process2 = require("child_process");
 var import_node_fs9 = require("fs");
 var import_node_os8 = require("os");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var CHECK_TIMEOUT_MS2 = 3e3;
 var SDK_SKILL_NAME = "deepline-sdk";
 var SKILL_AGENTS = ["codex", "claude-code", "cursor"];
@@ -8693,7 +8825,7 @@ function shouldSkipSkillsSync() {
 }
 function sdkSkillsVersionPath(baseUrl) {
   const home = process.env.HOME?.trim() || (0, import_node_os8.homedir)();
-  return (0, import_node_path11.join)(home, ".local", "deepline", baseUrlSlug(baseUrl), "sdk-skills", ".version");
+  return (0, import_node_path12.join)(home, ".local", "deepline", baseUrlSlug(baseUrl), "sdk-skills", ".version");
 }
 function readLocalSkillsVersion(baseUrl) {
   const path = sdkSkillsVersionPath(baseUrl);
@@ -8706,7 +8838,7 @@ function readLocalSkillsVersion(baseUrl) {
 }
 function writeLocalSkillsVersion(baseUrl, version) {
   const path = sdkSkillsVersionPath(baseUrl);
-  (0, import_node_fs9.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path12.dirname)(path), { recursive: true });
   (0, import_node_fs9.writeFileSync)(path, `${version}
 `, "utf-8");
 }
@@ -8801,7 +8933,7 @@ function resolveSkillsInstallCommands(baseUrl) {
   return [npxInstall];
 }
 function runOneSkillsInstall(install) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = (0, import_node_child_process2.spawn)(install.command, install.args, {
       stdio: ["ignore", "ignore", "pipe"],
       env: process.env
@@ -8811,7 +8943,7 @@ function runOneSkillsInstall(install) {
       stderr += chunk.toString("utf-8");
     });
     child.on("error", (error) => {
-      resolve8({
+      resolve9({
         ok: false,
         detail: `failed to start ${install.command}: ${error.message}`,
         manualCommand: install.manualCommand
@@ -8819,11 +8951,11 @@ function runOneSkillsInstall(install) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve8({ ok: true, detail: "", manualCommand: install.manualCommand });
+        resolve9({ ok: true, detail: "", manualCommand: install.manualCommand });
         return;
       }
       const detail = stderr.trim();
-      resolve8({
+      resolve9({
         ok: false,
         detail: detail ? `${install.command}: ${detail}` : `${install.command} exited ${code}`,
         manualCommand: install.manualCommand
@@ -8900,7 +9032,7 @@ async function main() {
   if (printStartupPhase) {
     progress?.phase("loading deepline cli");
   }
-  const program = new import_commander.Command();
+  const program = new import_commander2.Command();
   program.name("deepline").description("Deepline CLI (TypeScript SDK)").version(SDK_VERSION, "-v, --version", "Show version").showHelpAfterError().showSuggestionAfterError(true).addHelpText(
     "after",
     `