@koda-sl/baker-cli 0.132.0-dev.cad5e0bc7 → 0.132.1

package/README.md

@@ -44,6 +44,26 @@ export BAKER_CHAT_ID="<chat-id>"
 - `BAKER_X_ADS_ACCOUNT_ID` — default X Ads account ID (base36). Used when `--account-id` is not passed. If neither is set and exactly one X Ads account is connected, it is auto-selected.
 - `BAKER_CHAT_ID` — chat context for staged Work Action commands and staged Scheduled Action create/update/delete. `scheduled-actions trigger` does not require it.
 
+## Debug logging
+
+Set `BAKER_DEBUG_LOG` to capture a full-fidelity trace of everything a command does — useful when reproducing or reporting an issue.
+
+```bash
+export BAKER_DEBUG_LOG=1                 # append to ./baker-cli-debug.jsonl
+export BAKER_DEBUG_LOG=/tmp/baker.jsonl  # append to a specific file
+export BAKER_DEBUG_LOG=0                  # disabled (also: false / off / no / unset)
+```
+
+When enabled, each run appends JSONL entries for:
+
+- **`http`** — every request/response for both the REST and canvas engine clients (method, URL, request body, status, response body, duration, and any network/timeout error).
+- **`output`** — every chunk written to stdout and stderr.
+- **`invocation`** — the command-line arguments and working directory.
+
+Logging is fail-open — a logging error never affects the command — and has zero overhead when the variable is unset. The file is appended to across runs (delete it to start fresh) and rotates to `<file>.1` once it passes 64 MB so it can't fill the disk.
+
+**Secret redaction is best-effort.** Before a line is written, known secret shapes are scrubbed: `Authorization: Bearer …` headers, `bk_` Baker keys, JWTs / id tokens, and Google/Meta ad-platform tokens. This is not exhaustive — a credential in an unrecognized shape (e.g. a bare API key or cookie with no recognizable prefix) can still be captured. Treat the log as sensitive, and prefer pointing `BAKER_DEBUG_LOG` at a path outside any tracked repo.
+
 ## Output Format
 
 All commands return a JSON envelope:
@@ -223,6 +243,8 @@ baker ads google query --list-presets
 | `keyword-analysis`     | Keyword performance with match type      | LAST_30_DAYS       |
 | `positive-keywords`    | Positive (targeting) keywords only       | ALL_TIME           |
 | `negative-keywords`    | Negative (blocking) keywords only        | ALL_TIME           |
+| `negative-keyword-lists`   | Shared negative lists + their terms  | ALL_TIME           |
+| `negative-list-attachments`| Which campaigns each shared list covers | ALL_TIME        |
 | `search-terms`         | Actual user queries triggering ads       | LAST_7_DAYS        |
 | `ad-copy-performance`  | Ad headline/description effectiveness    | LAST_30_DAYS       |
 | `asset-performance`    | PMax asset performance labels            | LAST_30_DAYS       |
@@ -397,262 +419,6 @@ baker ads google keywords metrics --customer-id 1234567890 --keywords "running s
 
 ---
 
-### Google Ads Library (`baker ads google library`)
-
-Manage and search the Google Ads Transparency Center. Track competitor advertisers, browse their ad creatives, and discover who's bidding on keywords.
-
-**Typical workflow:** `search-advertiser` → `track` → `search-ads`
-
----
-
-### `baker ads google library search-advertiser "query"`
-
-Search for an advertiser on the Google Ads Transparency Center.
-
-> **Recommended:** use the domain running the ads (e.g. `example.com`) for more accurate results.
-
-```bash
-baker ads google library search-advertiser "example.com"
-baker ads google library search-advertiser "Nike"
-```
-
-**Response:**
-
-```json
-{
-  "ok": true,
-  "data": {
-    "results": [
-      { "advertiserId": "AR12345678901234567", "name": "Nike, Inc.", "region": "US", "format": "TEXT_IMAGE_VIDEO" }
-    ]
-  }
-}
-```
-
-**Flags:**
-
-| Flag       | Description                    |
-|------------|--------------------------------|
-| `--output` | Format: `json` \| `csv` \| `md` |
-
----
-
-### `baker ads google library track <id> <name>`
-
-Track a new Google advertiser and wait for the initial ad sync to complete. Polls every 5 seconds with a 10-minute timeout. Progress is written to stderr.
-
-```bash
-baker ads google library track AR12345678901234567 "Nike, Inc."
-baker ads google library track AR12345678901234567 "Nike, Inc." --json
-```
-
-**Response (with `--json`):**
-
-```json
-{
-  "ok": true,
-  "data": {
-    "advertiserId": "ar_abc123",
-    "accountId": "acc_def456",
-    "totalAdCount": 342,
-    "activeAdCount": 89
-  }
-}
-```
-
-**Flags:**
-
-| Flag     | Description          |
-|----------|----------------------|
-| `--json` | Output in JSON format |
-
----
-
-### `baker ads google library list-advertisers`
-
-List all tracked Google advertisers and their accounts.
-
-```bash
-baker ads google library list-advertisers
-baker ads google library list-advertisers --output md
-```
-
-**Flags:**
-
-| Flag       | Description                    |
-|------------|--------------------------------|
-| `--output` | Format: `json` \| `csv` \| `md` |
-
----
-
-### `baker ads google library sync-status <accountId>`
-
-Check the sync status and ad counts of a tracked account.
-
-```bash
-baker ads google library sync-status acc_def456
-```
-
-**Response:**
-
-```json
-{
-  "ok": true,
-  "data": {
-    "syncStatus": null,
-    "totalAdCount": 342,
-    "activeAdCount": 89
-  }
-}
-```
-
-`syncStatus` is `null` when idle, `"syncing"` during a sync, or `"error"` if the last sync failed.
-
----
-
-### `baker ads google library search-ads <accountId>`
-
-Search and filter ads for a tracked account. Supports pagination.
-
-```bash
-baker ads google library search-ads acc_def456
-baker ads google library search-ads acc_def456 --search "summer sale" --isActive --mediaType image
-baker ads google library search-ads acc_def456 --sort newest --limit 50
-baker ads google library search-ads acc_def456 --cursor "eyJwYWdl..."
-```
-
-**Response:**
-
-```json
-{
-  "ok": true,
-  "data": {
-    "page": [
-      {
-        "_id": "abc123",
-        "platform": "google",
-        "externalId": "CR_1234567890",
-        "isActive": true,
-        "mediaType": "image",
-        "headline": "Summer Sale — 50% Off Everything",
-        "description": "Shop our biggest sale of the year. Free shipping on all orders.",
-        "destinationUrl": "https://example.com/summer-sale",
-        "bodyText": "Summer Sale — 50% Off Everything",
-        "pageName": "Example Store",
-        "impressionsMin": 100000,
-        "impressionsMax": 200000,
-        "startDate": "2025-06-01",
-        "endDate": "2025-06-30",
-        "firstSeenAt": 1717200000000,
-        "lastSeenAt": 1719792000000,
-        "publisherPlatforms": ["GOOGLE_ADS"],
-        "regionCodes": ["US", "GB"],
-        "variations": [
-          {
-            "headline": "Summer Sale — 50% Off",
-            "description": "Shop our biggest sale of the year.",
-            "destinationUrl": "https://example.com/summer-sale",
-            "imageUrl": "https://...",
-            "visibleUrl": "example.com"
-          }
-        ],
-        "regions": [
-          { "code": "US", "name": "United States" }
-        ],
-        "analysisStatus": "completed",
-        "aiAnalysis": {
-          "aiSummary": "Promotional display ad for a seasonal sale with urgency-driven CTA",
-          "hookAngle": "Discount/Price",
-          "offerType": "Percentage Discount",
-          "ctaStrategy": "Shop Now",
-          "funnelStage": "Bottom",
-          "targetAudience": "Price-sensitive shoppers",
-          "adFormat": "responsive_display",
-          "tags": ["sale", "discount", "ecommerce"],
-          "trustSignals": ["Free shipping"],
-          "keyMessages": ["50% off", "Free shipping"],
-          "competitiveAngle": "Price leadership",
-          "dominantColors": ["#FF5733", "#FFFFFF"],
-          "analyzedAt": 1719792000000
-        }
-      }
-    ],
-    "continueCursor": "eyJwYWdl...",
-    "isDone": false
-  }
-}
-```
-
-**Key response fields:**
-
-| Field | Description |
-|-------|-------------|
-| `headline`, `description` | Top-level ad copy (first variation) |
-| `variations[]` | All ad variations with copy, images, videos, and URLs |
-| `regions[]` | Geographic targeting regions |
-| `impressionsMin/Max` | Estimated impression range (Google Ads Transparency data) |
-| `publisherPlatforms` | Where the ad ran (GOOGLE_ADS, YOUTUBE, etc.) |
-| `analysisStatus` | AI analysis state: `pending`, `processing`, `completed`, `failed` |
-| `aiAnalysis` | AI-generated creative analysis (only present when `analysisStatus` is `completed`) |
-| `aiAnalysis.aiSummary` | One-line AI summary of the ad |
-| `aiAnalysis.hookAngle` | Creative hook (Discount, Fear, Social Proof, etc.) |
-| `aiAnalysis.funnelStage` | Funnel position: Top, Middle, Bottom |
-| `aiAnalysis.tags` | AI-generated tags for filtering |
-
-**Flags:**
-
-| Flag          | Description                                    |
-|---------------|------------------------------------------------|
-| `--search`    | Search term for ad text                        |
-| `--isActive`  | Filter by active ads only                      |
-| `--mediaType` | Filter by media type: `image`, `video`, `text` |
-| `--sort`      | Sort: `newest` or `oldest`                     |
-| `--limit`     | Max results per page (default 20, max 100)     |
-| `--cursor`    | Pagination cursor from previous response       |
-| `--output`    | Format: `json` \| `csv` \| `md`               |
-
----
-
-### `baker ads google library sync <accountId>`
-
-Trigger an immediate re-sync for a tracked account. Polls every 5 seconds until complete (10-minute timeout). Progress is written to stderr.
-
-```bash
-baker ads google library sync acc_def456
-```
-
-**Response:**
-
-```json
-{
-  "ok": true,
-  "data": {
-    "totalAdCount": 350,
-    "activeAdCount": 92
-  }
-}
-```
-
----
-
-### `baker ads google library search-competitors "keyword"`
-
-Search for competitors running Google ads for a keyword. Uses DataForSEO (same data as `baker research advertisers`).
-
-```bash
-baker ads google library search-competitors "running shoes"
-baker ads google library search-competitors "crm software" --location uk
-```
-
-**Flags:**
-
-| Flag         | Description                |
-|--------------|----------------------------|
-| `--location` | Location name or code      |
-| `--json`     | Output in JSON format      |
-
----
-
 ### Staged writes (`baker ads google budgets|campaigns|...`)
 
 Write commands **never touch the Google Ads API at stage time**. Each command stages a create/update/pause/resume/remove op against the current chat's draft (`BAKER_CHAT_ID`); the dashboard shows it as a pending "Google Ads" change, and the whole draft applies as one atomic `GoogleAdsService.Mutate` when the chat is published. Feature-flagged per company (`companies.googleAdsWriteEnabled`) — off by default = a fully simulated publish with zero real API calls.
@@ -1944,14 +1710,14 @@ baker images generate "flat geometric mascot, brand palette" \
   --model recraft/recraft-v4.1-pro-vector --rgb-colors "[[10,10,10],[255,80,0]]" --bg-rgb "[255,255,255]"
 ```
 
-**Models** (`--model`, default `openai/gpt-5.4-image-2`):
+**Models** (`--model`, default `google/gemini-3.1-flash-image-preview`):
 
 | Model | Best for | Aspect ratios | Sizes |
 |---|---|---|---|
-| `openai/gpt-5.4-image-2` **(default)** | Photoreal + cleanest in-image text — ad/landing reproduction | standard set | `1K` `2K` `4K` |
-| `google/gemini-3-pro-image-preview` | Highest fidelity (Nano Banana Pro) | standard set | `1K` `2K` `4K` |
+| `google/gemini-3.1-flash-image-preview` **(default)** | Fast iteration, reference editing, extreme aspect ratios (Nano Banana flash) | standard **+** `1:4` `4:1` `1:8` `8:1` | `0.5K`–`4K` |
 | `google/gemini-3.5-flash` | Fast; extreme aspect ratios | standard **+** `1:4` `4:1` `1:8` `8:1` | `0.5K`–`4K` |
-| `google/gemini-3.1-flash-image-preview` | Same as 3.5 flash (preview) | extreme set | `0.5K`–`4K` |
+| `google/gemini-3-pro-image-preview` | Highest fidelity (Nano Banana Pro) — strong prompt adherence and reference grounding | standard set | `1K` `2K` `4K` |
+| `openai/gpt-5.4-image-2` | Photoreal + cleanest in-image text — ad/landing reproduction | standard set | `1K` `2K` `4K` |
 | `recraft/recraft-v4.1-pro-vector` | Vector/flat/SVG-style with palette control | standard set | `1K` `2K` `4K` |
 
 Standard aspect ratios: `1:1` `2:3` `3:2` `3:4` `4:3` `4:5` `5:4` `9:16` `16:9` `21:9`.
@@ -1960,7 +1726,7 @@ Standard aspect ratios: `1:1` `2:3` `3:2` `3:4` `4:3` `4:5` `5:4` `9:16` `16:9`
 
 | Flag | Description |
 |---|---|
-| `--model` | Model id (default `openai/gpt-5.4-image-2`) |
+| `--model` | Model id (default `google/gemini-3.1-flash-image-preview`) |
 | `--aspect-ratio` | Output aspect ratio (default `1:1`) |
 | `--image-size` | Resolution: `1K` (default) `2K` `4K` (Gemini flash also `0.5K`) |
 | `--reference` | Comma-separated visual references, each either a **public image URL** (Pinterest / stock / library `imageUrl`) **or a local file path** (a sandbox image — brand logo, product shot, cropped photo, screenshot). Local files are downscaled (≤1536px) and inlined automatically — no manual upload. Applied in order; the biggest quality lever for photographed, on-brand output. Split is on `,`, so a URL containing a literal comma in its query string would be torn in two (rare for image CDNs — pass it alone if it occurs); a single `data:` URL is taken whole. |
@@ -2419,13 +2185,17 @@ baker testimonials tags
 
 ### Winning Ads (`baker winning-ads`)
 
-Search the **ad-dna** corpus of scored "winning" competitor ads for reference creatives to reproduce (e.g. with `baker canvas`). Each result carries a presigned media URL (~1h TTL), the ad's DNA summary, and scores. The CLI authenticates with the normal `BAKER_API_KEY`; the Baker backend proxies the request to the ad-dna service with a server-held token — no extra credential in the sandbox.
+Search the **ad-dna** corpus of scored "winning" competitor ads for reference creatives to reproduce (e.g. with `baker canvas`), and manage the brands your library tracks (`follow` / `following` / `unfollow`). Each result carries a presigned media URL (~1h TTL), the ad's DNA summary, and scores. The CLI authenticates with the normal `BAKER_API_KEY`; the Baker backend proxies the request to the ad-dna service with a server-held token — no extra credential in the sandbox.
+
+> The corpus has **Meta + LinkedIn** connectors, so `--platform` inputs are limited to `meta,linkedin`. (Older result rows may still carry a legacy platform string.)
 
 > Backend env: the Convex deployment must have `AD_DNA_API_TOKEN` set (`npx convex env set AD_DNA_API_TOKEN …`). `AD_DNA_API_URL` is optional and defaults to `https://ads.withbaker.com`.
 
+> Replaces the old `baker ads google library` tree, which has been removed. Competitor-by-keyword discovery still lives at `baker research advertisers`.
+
 ### `baker winning-ads search <query>`
 
-Semantic search (dense recall + BM25 + rerank). The CLI projects each result to a **lean, decision-focused** shape so the agent's context stays small — default fields: `advertiser`, `advertiser_id`, `platform`, `format`, `relevance`, `winner_score`, `summary` (what the ad is about), `media_url`; plus top-level `pool_size` and `match_confidence`. `--full` adds DNA detail (`angle`, `target_persona`, `hook_archetype`, `awareness_stage`, `industry`) + longevity (`days_active`, `reach`, `active`, `winner_category`, `media_kind`). `--output json` (default) returns the lean objects; `--output md` prints a table.
+Semantic search (dense recall + BM25 + rerank) → `POST /api/ad-library/winners/search`. The CLI projects each result to a **lean, decision-focused** shape so the agent's context stays small — default fields: `advertiser`, `advertiser_id`, `platform`, `format`, `relevance`, `winner_score`, `summary` (what the ad is about), `media_url`; plus top-level `pool_size`, `match_confidence` (`high|medium|low`), and `below_floor_count` (matches dropped under the relevance floor). `--full` adds DNA detail (`angle`, `target_persona`, `hook_archetype`, `awareness_stage`, `industry`) + longevity (`days_active`, `reach`, `active`, `winner_category`, `media_kind`). `--output json` (default) returns the lean objects; `--output md` prints a table.
 
 > `media_url` is the creative itself: for `static` it's the image, for `video` it's the video file. ad-dna stores **no separate poster** for videos, so a video result has only the video URL.
 
@@ -2447,7 +2217,7 @@ baker winning-ads search --ref-ad-id a_12345 --first-seen-after 2026-01-01T00:00
 | `--limit <n>` | Max results 1–100 (**default 10** — shortlist size) |
 | `--max-per-advertiser <n>` | Cap results per advertiser 1–50 (default 3) |
 | `--min-relevance <0-1>` | Relevance floor; trims weak matches |
-| `--platform <list>` | One or many of `meta,tiktok,linkedin,google_search,google_display,youtube,reddit,x,pinterest,snapchat` — pass a single value to search **only** that platform |
+| `--platform <list>` | `meta,linkedin` — pass a single value to search **only** that platform |
 | `--format <list>` | `video,static,carousel` |
 | `--winner-category <list>` | `winner,scaled_winner,evergreen,rising,untested,dud,…` (default: all) |
 | `--awareness <list>` | `unaware,problem_aware,solution_aware,product_aware,most_aware` |
@@ -2461,20 +2231,21 @@ baker winning-ads search --ref-ad-id a_12345 --first-seen-after 2026-01-01T00:00
 
 Reading the scores: **`relevance`** (0–1) = match of the creative to your query; **`winner_score`** = how proven the ad is in-market. Pick references that are both relevant *and* proven.
 
-### `baker winning-ads hooks|mechanisms|patterns`
+### `baker winning-ads hooks|mechanisms|formats`
 
-Read the **winner-weighted rollup** of the ad-dna corpus — the hook / mechanism / static-format patterns that
-actually win, ranked by `winner_score`, keyed on the closed seeds/enums the extractor emits (no clustering).
-Ground a creative in a **proven** pattern for the exact segment instead of guessing.
+Read the **winner-weighted rollup** of the ad-dna corpus → `GET /api/ad-library/seed-catalog` — the hook /
+mechanism / static-format patterns that actually win, ranked by `winner_score`, keyed on the closed seeds/enums
+the extractor emits (no clustering). Ground a creative in a **proven** pattern for the exact segment instead of
+guessing. (Distinct from `winning-ads patterns`, which contrasts two ad cohorts.)
 
 ```bash
 # Top winning hook seeds for problem-aware SaaS on Meta:
 baker winning-ads hooks --platform meta --awareness problem_aware --industry saas --output md
 # Then narrow a reference search to that proven hook:
 baker winning-ads search "onboarding demo" --hook-archetype callout --output md
-# Also: mechanisms (persuasion), patterns (static ad layouts):
+# Also: mechanisms (persuasion), formats (static ad layouts):
 baker winning-ads mechanisms --platform linkedin --output md
-baker winning-ads patterns --awareness solution_aware --output md
+baker winning-ads formats --awareness solution_aware --output md
 ```
 
 | Flag | Purpose |
@@ -2490,13 +2261,66 @@ proven grand-slam pattern floats to the top and a measured dud is floored.
 
 ### `baker winning-ads advertisers <brand>`
 
-Resolve a brand name → `advertiser_id`(s) in the corpus. Use it to find **your own** advertiser (to `--exclude-advertiser`) or a **competitor** (to `--advertiser-id`). Returns `advertiser_id`, `label`, `active_ads`, `total_ads`.
+List corpus brands by name or domain → `GET /api/ad-library/advertisers`. Use it to find **your own** advertiser (to `--exclude-advertiser`) or a **competitor** (to `--advertiser-id` / `winners`). Lean default fields: `advertiser_id`, `label`, `platform_count`, `family_count`, `active_ad_count`, `total_ad_count`; `--full` adds `scraped_name`, `image_url`, `platforms`, `total_reach`, `last_synced_at`. Supports `--platform meta|linkedin`, `--limit`, `--offset`.
 
 ```bash
 baker winning-ads advertisers "Acme" --output md          # find our own advertiser id
 baker winning-ads advertisers "Deel" --platform meta --output md
 ```
 
+### `baker winning-ads follow "<domain | profile URL | brand>" --platform meta|linkedin`
+
+Add **all** of a brand's ads to your library — every platform (Meta + LinkedIn) and every country → `POST /api/ad-library/follow`. `--platform` is **required**, but it only tells us how to read your `input` (Facebook vs LinkedIn URL); it does **not** limit what we track. A bare domain is best: we resolve both the Meta page and the LinkedIn company from it and track both. Discovery is never region-scoped. The result `status` is one of:
+
+- `following` — the brand is already in the corpus; you're now subscribed (no wait).
+- `added` — a new brand was queued for ingestion; its ads appear as discovery completes (a `hints[]` note flags this).
+- `ambiguous` — the input mapped to multiple brands; pick one from `candidates` and re-run with a more specific domain/URL.
+
+```bash
+baker winning-ads follow "deel.com" --platform meta
+baker winning-ads follow "https://www.linkedin.com/company/acme" --platform linkedin --label "Acme (competitor)"
+```
+
+### `baker winning-ads following`
+
+List the brands you follow → `GET /api/ad-library/following`. Each row shows `status` (`ready` vs `adding…`) plus cached counts (`active_ad_count`, `total_ad_count`, `family_count`) and discovery progress (`adding_discovered`, `adding_enqueued`). `--full` adds `image_url` + `platforms`.
+
+```bash
+baker winning-ads following --output md
+```
+
+### `baker winning-ads winners <advertiser>`
+
+Top winning ads for one advertiser id → `GET /api/ad-library/advertiser-winners`. Same lean winner cards as `search` (add `--full` for DNA + longevity). Supports `--top N` and `--platform meta|linkedin`.
+
+```bash
+baker winning-ads winners adv_123 --top 15 --output md
+```
+
+### `baker winning-ads unfollow <advertiser>`
+
+Stop following a brand by advertiser id → `POST /api/ad-library/unfollow`. Returns `{ removed }`.
+
+```bash
+baker winning-ads unfollow adv_123
+```
+
+### `baker winning-ads brief`
+
+Generate a creative brief grounded in strategically-similar winners → `POST /api/ad-library/brief`. Optionally describe the target creative with `--dna` (a JSON object), steer with `--notes`, and cap references with `--k`. Returns `brief_markdown` + `reference_ad_ids`.
+
+```bash
+baker winning-ads brief --dna '{"angle":"cost savings","awareness_stage":"solution_aware"}' --notes "B2B, LinkedIn video" --k 8
+```
+
+### `baker winning-ads patterns --winners <adIds> --duds <adIds>`
+
+Mine what separates two cohorts of ads → `POST /api/ad-library/patterns`. Pass a comma-list of winning ad ids (`--winners`, cohort A) and weaker/dud ad ids (`--duds`, cohort B), plus optional `--top-n`. Returns each discriminating DNA field with the cohort it `favors` (`winners`/`duds`), a `score`, and the top values on each side.
+
+```bash
+baker winning-ads patterns --winners a_1,a_2,a_3 --duds a_9,a_8 --top-n 10 --output md
+```
+
 ---
 
 ### Scheduled Actions (`baker scheduled-actions`)

package/dist/chunk-7I2POXSJ.js

@@ -0,0 +1,153 @@
+import {
+  debugLogSetting
+} from "./chunk-RK67WL4O.js";
+
+// src/debugLog.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+var DEFAULT_FILE = "baker-cli-debug.jsonl";
+var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
+var MAX_BYTES = 64 * 1024 * 1024;
+var REDACTIONS = [
+  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
+  // Authorization headers
+  [/bk_[A-Za-z0-9]+/g, "bk_[redacted]"],
+  // Baker API keys
+  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
+  // JWTs / id tokens
+  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
+  // Google OAuth access tokens
+  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
+  // Google refresh tokens
+  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
+  // Meta/Facebook access tokens
+];
+function redactSecrets(input) {
+  let out = input;
+  for (const [pattern, replacement] of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+function resolveTarget() {
+  const raw = debugLogSetting();
+  if (!raw) {
+    return void 0;
+  }
+  const lower = raw.toLowerCase();
+  if (BOOLEAN_OFF.has(lower)) {
+    return void 0;
+  }
+  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
+  return isAbsolute(target) ? target : resolve(process.cwd(), target);
+}
+function isDebugLogEnabled() {
+  return resolveTarget() !== void 0;
+}
+var sessionId;
+function getSessionId() {
+  if (!sessionId) {
+    sessionId = `${process.pid}-${Date.now()}`;
+  }
+  return sessionId;
+}
+var trackedPath;
+var bytesInFile = 0;
+function ensureReady(filePath) {
+  if (trackedPath !== filePath) {
+    trackedPath = filePath;
+    mkdirSync(dirname(filePath), { recursive: true });
+    try {
+      bytesInFile = statSync(filePath).size;
+    } catch {
+      bytesInFile = 0;
+    }
+  }
+}
+function append(entry) {
+  const filePath = resolveTarget();
+  if (!filePath) {
+    return;
+  }
+  try {
+    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
+    const line = `${redactSecrets(JSON.stringify(payload))}
+`;
+    ensureReady(filePath);
+    const size = Buffer.byteLength(line);
+    if (bytesInFile + size > MAX_BYTES) {
+      renameSync(filePath, `${filePath}.1`);
+      bytesInFile = 0;
+    }
+    appendFileSync(filePath, line);
+    bytesInFile += size;
+  } catch {
+  }
+}
+function errorToPlain(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { message: String(err) };
+}
+function logInvocation(argv) {
+  append({ kind: "invocation", argv, cwd: process.cwd() });
+}
+function debugLogHttp(entry) {
+  if (!isDebugLogEnabled()) {
+    return;
+  }
+  append({
+    kind: "http",
+    source: entry.source,
+    method: entry.method,
+    url: entry.url,
+    durationMs: entry.durationMs,
+    request: entry.requestBody,
+    status: entry.status,
+    ok: entry.ok,
+    response: entry.responseBody,
+    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
+  });
+}
+async function readBodyForLog(response) {
+  if (!isDebugLogEnabled()) {
+    return void 0;
+  }
+  try {
+    return await response.clone().text();
+  } catch {
+    return void 0;
+  }
+}
+function tapStream(name, stream) {
+  const original = stream.write.bind(stream);
+  const decoder = new TextDecoder("utf-8");
+  stream.write = ((chunk, ...rest) => {
+    try {
+      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
+      append({ kind: "output", stream: name, text });
+    } catch {
+    }
+    return original(chunk, ...rest);
+  });
+}
+var tapsInstalled = false;
+function installStreamTaps() {
+  if (tapsInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  tapsInstalled = true;
+  tapStream("stdout", process.stdout);
+  tapStream("stderr", process.stderr);
+}
+
+export {
+  logInvocation,
+  debugLogHttp,
+  readBodyForLog,
+  installStreamTaps
+};
+//# sourceMappingURL=chunk-7I2POXSJ.js.map

package/dist/chunk-7I2POXSJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  [/bk_[A-Za-z0-9]+/g, \"bk_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nexport function logInvocation(argv: string[]): void {\n  append({ kind: \"invocation\", argv, cwd: process.cwd() });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: entry.requestBody,\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA,EACjD,CAAC,oBAAoB,eAAe;AAAA;AAAA,EACpC,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEO,SAAS,cAAc,MAAsB;AAClD,SAAO,EAAE,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC;AACzD;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/{chunk-AVJ3B6LC.js → chunk-BFZELBTE.js}

@@ -1,13 +1,13 @@
 import {
   handleConnectionError,
   writeAdsJson
-} from "./chunk-ISFSUDEQ.js";
+} from "./chunk-PEBP6G74.js";
 import {
   ApiError
-} from "./chunk-K47Q73CK.js";
+} from "./chunk-SCI57ZZ6.js";
 import {
   getEnv
-} from "./chunk-YTEAWSEM.js";
+} from "./chunk-RK67WL4O.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
@@ -94,4 +94,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-AVJ3B6LC.js.map
+//# sourceMappingURL=chunk-BFZELBTE.js.map