@koda-sl/baker-cli 0.325.1 → 0.327.0

package/dist/{chunk-UWFF6WEV.js → chunk-JWMLQSGK.js}

@@ -2,13 +2,13 @@ import {
   handleConnectionError,
   needsConnectionFix,
   writeAdsJson
-} from "./chunk-MSZSDYOJ.js";
+} from "./chunk-KGDL7F7M.js";
 import {
   ApiError
-} from "./chunk-KAE5M5R7.js";
+} from "./chunk-XPUSSDLR.js";
 import {
   getEnv
-} from "./chunk-GJVXXYCX.js";
+} from "./chunk-4VP5WWPR.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
@@ -108,4 +108,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-UWFF6WEV.js.map
+//# sourceMappingURL=chunk-JWMLQSGK.js.map

package/dist/{chunk-MSZSDYOJ.js → chunk-KGDL7F7M.js}

@@ -1,10 +1,10 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-KAE5M5R7.js";
+} from "./chunk-XPUSSDLR.js";
 import {
   getEnv
-} from "./chunk-GJVXXYCX.js";
+} from "./chunk-4VP5WWPR.js";
 
 // src/error-handler.ts
 var REQUEST_CONNECTION_PLATFORM = {
@@ -294,4 +294,4 @@ export {
   writeAdsOutput,
   resolveCustomerId
 };
-//# sourceMappingURL=chunk-MSZSDYOJ.js.map
+//# sourceMappingURL=chunk-KGDL7F7M.js.map

package/dist/{chunk-6BD32M7K.js → chunk-PWGY347J.js}

@@ -1,6 +1,6 @@
 import {
   debugLogSetting
-} from "./chunk-GJVXXYCX.js";
+} from "./chunk-4VP5WWPR.js";
 
 // src/debugLog.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
@@ -12,7 +12,10 @@ var MAX_BYTES = 64 * 1024 * 1024;
 var REDACTIONS = [
   [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
   // Authorization headers
-  [/bk_[A-Za-z0-9]+/g, "bk_[redacted]"],
+  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
+  // the literal `bk_`, so the company-key rule matched no part of the read-only
+  // credential a Session review runs with.
+  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
   // Baker API keys
   [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
   // JWTs / id tokens
@@ -92,9 +95,28 @@ function errorToPlain(err) {
   }
   return { message: String(err) };
 }
+var invocationStartedAt;
 function logInvocation(argv) {
+  invocationStartedAt = Date.now();
   append({ kind: "invocation", argv, cwd: process.cwd() });
 }
+function logExit(code) {
+  append({
+    kind: "exit",
+    code,
+    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
+  });
+}
+var exitHookInstalled = false;
+function installExitRecord() {
+  if (exitHookInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  exitHookInstalled = true;
+  process.on("exit", (code) => {
+    logExit(typeof code === "number" ? code : 0);
+  });
+}
 function debugLogHttp(entry) {
   if (!isDebugLogEnabled()) {
     return;
@@ -146,8 +168,9 @@ function installStreamTaps() {
 
 export {
   logInvocation,
+  installExitRecord,
   debugLogHttp,
   readBodyForLog,
   installStreamTaps
 };
-//# sourceMappingURL=chunk-6BD32M7K.js.map
+//# sourceMappingURL=chunk-PWGY347J.js.map

package/dist/chunk-PWGY347J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv, cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: entry.requestBody,\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC;AACzD;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/{chunk-KAE5M5R7.js → chunk-XPUSSDLR.js}

@@ -1,10 +1,10 @@
 import {
   debugLogHttp,
   readBodyForLog
-} from "./chunk-6BD32M7K.js";
+} from "./chunk-PWGY347J.js";
 import {
   getEnv
-} from "./chunk-GJVXXYCX.js";
+} from "./chunk-4VP5WWPR.js";
 
 // src/client.ts
 var MAX_RATE_LIMIT_RETRIES = 3;
@@ -205,4 +205,4 @@ export {
   apiGet,
   apiPost
 };
-//# sourceMappingURL=chunk-KAE5M5R7.js.map
+//# sourceMappingURL=chunk-XPUSSDLR.js.map

package/dist/cli.js

@@ -67,7 +67,7 @@ import {
   validateCanvasDeep,
   withoutCastName,
   ytDlpBlockSignal
-} from "./chunk-HPRKO6P2.js";
+} from "./chunk-FFOURYP5.js";
 import {
   csvOrJson,
   daysAgoIso,
@@ -76,7 +76,7 @@ import {
   resolveAccountIdArg,
   resolveEffectiveStatus,
   todayIso
-} from "./chunk-UWFF6WEV.js";
+} from "./chunk-JWMLQSGK.js";
 import {
   buildQueryCacheKey,
   cacheGet,
@@ -92,18 +92,19 @@ import {
   writeAdsJson,
   writeAdsOutput,
   writeJsonEnvelope
-} from "./chunk-MSZSDYOJ.js";
+} from "./chunk-KGDL7F7M.js";
 import {
   ApiError,
   apiGet,
   apiGetWithHeaders,
   apiPost,
   validateConvexId
-} from "./chunk-KAE5M5R7.js";
+} from "./chunk-XPUSSDLR.js";
 import {
+  installExitRecord,
   installStreamTaps,
   logInvocation
-} from "./chunk-6BD32M7K.js";
+} from "./chunk-PWGY347J.js";
 import {
   captureBudgetMs,
   captureProxyCredentials,
@@ -117,7 +118,7 @@ import {
   requireChatId,
   resolveChatId,
   shouldEscalate
-} from "./chunk-GJVXXYCX.js";
+} from "./chunk-4VP5WWPR.js";
 
 // src/cli.ts
 import { defineCommand as defineCommand244, runMain } from "citty";
@@ -955,7 +956,11 @@ var winnersSearchResponseSchema = z2.object({
   // the dashboard then falls back to a single non-paged page.
   offset: z2.number().nullable(),
   total: z2.number().nullable(),
-  has_more: z2.boolean().nullable()
+  has_more: z2.boolean().nullable(),
+  // Ads the corpus holds for each requested `country`; null when the search did
+  // not filter by country. Tells "no winners matched" apart from "unsupported"
+  // (an unknown code is refused outright).
+  country_coverage: z2.array(z2.object({ code: z2.string(), ads: z2.number() })).nullable()
 });
 var advertiserPlatformSchema = z2.object({
   platform: z2.string(),
@@ -4928,7 +4933,33 @@ var adEffectSchema = z13.object({
    */
   outcome: z13.enum(["applied", "simulated", "failed", "skipped"]).nullable(),
   /** Why it failed, verbatim from the platform. Null unless the op failed. */
-  error: z13.string().nullable()
+  error: z13.string().nullable(),
+  /**
+   * Why the publish never attempted it — a dependency that failed first, a
+   * connection that went read-only. Distinct from `error`, which is the
+   * provider's refusal of an op that was actually sent: a reader that cannot
+   * tell the two apart reads "we never tried" as "the platform said no".
+   */
+  skippedBecause: z13.string().nullable().optional()
+});
+var configEffectSchema = z13.object({
+  op: effectOpSchema,
+  staged: z13.boolean(),
+  /** The full stored op kind, e.g. `tagManager.tag.create`, `ga4.keyEvent.update`. */
+  operation: z13.string(),
+  /** The entity class the op acts on, e.g. `tag`, `customDimension`. */
+  entity: z13.string().nullable(),
+  summary: z13.string(),
+  ref: z13.string(),
+  outcome: z13.enum(["applied", "failed", "skipped"]).nullable(),
+  error: z13.string().nullable(),
+  skippedBecause: z13.string().nullable(),
+  /**
+   * The post-publish read-back, when one ran. Annotation only — Tag Manager can
+   * answer 200 to a write it silently dropped, so a fresh read is the only
+   * thing that distinguishes "applied" from "accepted and discarded".
+   */
+  verified: z13.boolean().nullable()
 });
 var creativeEffectSchema = z13.object({
   op: effectOpSchema,
@@ -4948,7 +4979,51 @@ var chatEffectsSchema = z13.object({
     linkedin: z13.array(adEffectSchema),
     x: z13.array(adEffectSchema)
   }),
-  creatives: z13.array(creativeEffectSchema)
+  creatives: z13.array(creativeEffectSchema),
+  tagManager: z13.array(configEffectSchema),
+  ga4: z13.array(configEffectSchema)
+});
+var publishSurfaceFailureSchema = z13.object({
+  summary: z13.string(),
+  /** The provider's own words, trimmed. Empty when it said nothing. */
+  error: z13.string()
+});
+var publishSurfaceOutcomeSchema = z13.object({
+  surface: z13.string(),
+  label: z13.string(),
+  total: z13.number(),
+  landed: z13.number(),
+  failed: z13.number(),
+  /** True while this surface is still applying — not yet a verdict either way. */
+  running: z13.boolean(),
+  failures: z13.array(publishSurfaceFailureSchema)
+});
+var chatPublishSummarySchema = z13.object({
+  complete: z13.boolean(),
+  running: z13.boolean(),
+  failedTotal: z13.number(),
+  surfaces: z13.array(publishSurfaceOutcomeSchema)
+});
+var chatActivityEntrySchema = z13.object({
+  action: z13.string(),
+  actorType: z13.string(),
+  createdAt: z13.number(),
+  threadId: z13.string().nullable(),
+  /** Compact truncates this; `--full` returns it whole. */
+  metadata: z13.unknown().optional()
+});
+var chatThreadUsageSchema = z13.object({
+  threadId: z13.string(),
+  costUsd: z13.number(),
+  model: z13.string().nullable()
+});
+var chatUsageSchema = z13.object({
+  threads: z13.array(chatThreadUsageSchema),
+  totalCostUsd: z13.number(),
+  inputTokens: z13.number(),
+  outputTokens: z13.number(),
+  cacheReadTokens: z13.number(),
+  cacheWriteTokens: z13.number()
 });
 var chatDetailSchema = z13.object({
   id: z13.string(),
@@ -4967,7 +5042,15 @@ var chatDetailSchema = z13.object({
   threads: z13.array(chatThreadSummarySchema),
   commits: z13.array(chatCommitSummarySchema),
   /** True when a real file-level diff is available via `baker chats diff`. */
-  diffAvailable: z13.boolean()
+  diffAvailable: z13.boolean(),
+  /** What the Publish did on each external surface. Absent when nothing was ever published. */
+  publish: chatPublishSummarySchema.optional(),
+  /** Why the Publish itself failed, as the backend recorded it. */
+  publishFailureReason: z13.string().nullable().optional(),
+  /** The chat's own timeline: status changes, publish start/fail, sandbox recoveries, timeouts. */
+  activity: z13.array(chatActivityEntrySchema).optional(),
+  /** What the Session cost, per thread and in total. */
+  usage: chatUsageSchema.optional()
 });
 var chatsViewResponseSchema = z13.object({
   ok: z13.literal(true),
@@ -24823,10 +24906,10 @@ Example: baker ads meta ads retag 120252158038400247 --url-tags "utm_source={{si
     }
   },
   run: async ({ args: args4 }) => {
-    const { apiPost: apiPost2 } = await import("./client-XUSSAB6O.js");
-    const { requireChatId: requireChatId2 } = await import("./env-VIA5U56G.js");
-    const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-ZPACGSH2.js");
-    const { handleMetaError: handleMetaError2 } = await import("./shared-OHOCOE2L.js");
+    const { apiPost: apiPost2 } = await import("./client-PWRZOA3Q.js");
+    const { requireChatId: requireChatId2 } = await import("./env-TQTHWLBN.js");
+    const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-HD63GTWI.js");
+    const { handleMetaError: handleMetaError2 } = await import("./shared-5662SBDW.js");
     try {
       const accountId = bareAccountId2(args4);
       const urlTags = typeof args4["url-tags"] === "string" ? args4["url-tags"] : void 0;
@@ -24971,10 +25054,10 @@ function duplicateCommand2(entity, label) {
       replace: { type: "boolean", description: "Pause the original once the copy publishes" }
     },
     run: async ({ args: args4 }) => {
-      const { apiPost: apiPost2 } = await import("./client-XUSSAB6O.js");
-      const { requireChatId: requireChatId2 } = await import("./env-VIA5U56G.js");
-      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-ZPACGSH2.js");
-      const { handleMetaError: handleMetaError2 } = await import("./shared-OHOCOE2L.js");
+      const { apiPost: apiPost2 } = await import("./client-PWRZOA3Q.js");
+      const { requireChatId: requireChatId2 } = await import("./env-TQTHWLBN.js");
+      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-HD63GTWI.js");
+      const { handleMetaError: handleMetaError2 } = await import("./shared-5662SBDW.js");
       try {
         const accountId = bareAccountId2(args4);
         const chatId = requireChatId2();
@@ -43909,7 +43992,7 @@ var canvasCommand = defineCommand118({
     name: "canvas",
     description: `Run Baker creative canvas JSON files locally. Local nodes execute in-process; remote nodes POST to the Convex backend gateway.
 
-Auth: BAKER_API_KEY (must start with bk_) + BAKER_API_URL (your Convex .convex.site URL).
+Auth: BAKER_API_KEY (bk_ or bkr_) + BAKER_API_URL (your Convex .convex.site URL).
 
 Subcommands:
   baker canvas validate <file.json>   \u2014 schema/registry check + composition-meta deep check + cost preview
@@ -44119,12 +44202,12 @@ var listCommand13 = defineCommand120({
 });
 registerSchema({
   command: "chats.view",
-  description: "Inspect one Session's FULL picture of what it changed \u2014 the unified `effects`: git content (landings, creatives, flows, knowledge, brand), plus DB-only effects that never touch the repo \u2014 Actions, Scheduled Actions, Tags, and ad-platform writes \u2014 each resolved to real detail (names, descriptions, priorities, tag types, ad operations). Also the kickoff (how it was asked), threads, and commits. Effects are `staged` (in-progress draft) or applied. Use after `baker chats list` to decide whether to reuse it. Read-only.",
+  description: "Inspect one Session's FULL picture of what it changed \u2014 the unified `effects`: git content (landings, creatives, flows, knowledge, brand), plus DB-only effects that never touch the repo \u2014 Actions, Scheduled Actions, Tags, Tag Manager, Google Analytics, and ad-platform writes \u2014 each resolved to real detail (names, descriptions, priorities, tag types, ad operations). Also `publish` (what each external surface actually did, with the provider's own error), `activity` (the chat's own timeline: status changes, publish start/fail, workspace recoveries, timeouts), `usage` (per-thread cost and the Session's token totals), the kickoff (how it was asked), threads, and commits. Effects are `staged` (in-progress draft) or applied. A completed Session is NOT proof its external changes landed \u2014 read `publish`. Use after `baker chats list` to decide whether to reuse it. Read-only.",
   args: {
     id: { type: "positional", description: "The Session id (from `baker chats list`)", required: true },
     full: {
       type: "boolean",
-      description: "No-op today; view already returns full effect detail",
+      description: "Untruncated effect lists and full activity metadata (compact caps each list at 25)",
       required: false,
       default: false
     }
@@ -44146,6 +44229,12 @@ var viewCommand = defineCommand120({
         ...args4.full ? { full: true } : {}
       });
       const hints2 = [];
+      if (response.data.publish && !response.data.publish.complete) {
+        const failed = response.data.publish.failedTotal;
+        hints2.push(
+          `This Session's publish left ${failed} change${failed === 1 ? "" : "s"} behind \u2014 see \`publish.surfaces\` for the platform's own words. Do not report those changes as live.`
+        );
+      }
       if (response.data.diffAvailable) {
         hints2.push("See the real file-level diff of the git content with `baker chats diff <id> --full`.");
       } else if (response.data.status === "in_progress" || response.data.status === "publishing") {
@@ -66301,7 +66390,11 @@ registerSchema({
       description: "Comma list: unaware,problem_aware,solution_aware,product_aware,most_aware",
       required: false
     },
-    country: { type: "string", description: "Comma list of country codes", required: false },
+    country: {
+      type: "string",
+      description: "Comma list of ISO country codes (US,GB) \u2014 an unknown code is refused with the codes that have ads",
+      required: false
+    },
     language: { type: "string", description: "Comma list of language codes", required: false },
     "advertiser-id": {
       type: "string",
@@ -66374,6 +66467,32 @@ function buildSearchBody2(args4) {
   }
   return body;
 }
+var UNKNOWN_COUNTRY_RE = /Unknown country code\(s\): ([^.]+)\. Countries with ads: ([^.]+)\./;
+function unknownCountryFix(message) {
+  const match = UNKNOWN_COUNTRY_RE.exec(message);
+  if (!match) {
+    return null;
+  }
+  const unknownCountries = splitList2(match[1]);
+  const validCountries = splitList2(match[2]);
+  if (unknownCountries.length === 0 || validCountries.length === 0) {
+    return null;
+  }
+  return {
+    action: "retry_with_a_valid_country",
+    explanation: `${unknownCountries.join(", ")} is not a country the winning-ads library holds ads for. Re-run with codes from \`validCountries\`, or drop --country to search every market.`,
+    unknownCountries,
+    validCountries
+  };
+}
+function reportSearchError(err) {
+  const fix = err instanceof ApiError ? unknownCountryFix(err.message) : null;
+  if (err instanceof ApiError && fix) {
+    writeJson({ ok: false, error: { code: err.code, message: err.message, fix } });
+    process.exit(1);
+  }
+  reportError2(err);
+}
 var searchCommand5 = defineCommand239({
   meta: {
     name: "search",
@@ -66406,7 +66525,11 @@ var searchCommand5 = defineCommand239({
       required: false
     },
     awareness: { type: "string", description: "Comma list of awareness stages", required: false },
-    country: { type: "string", description: "Comma list of country codes", required: false },
+    country: {
+      type: "string",
+      description: "Comma list of ISO country codes (US,GB) \u2014 an unknown code is refused with the codes that have ads",
+      required: false
+    },
     language: { type: "string", description: "Comma list of language codes", required: false },
     "advertiser-id": { type: "string", description: "Restrict to these advertiser ids", required: false },
     "exclude-advertiser": {
@@ -66470,7 +66593,8 @@ var searchCommand5 = defineCommand239({
             results,
             pool_size: data?.pool_size ?? null,
             match_confidence: data?.match_confidence ?? null,
-            below_floor_count: data?.below_floor_count ?? null
+            below_floor_count: data?.below_floor_count ?? null,
+            country_coverage: data?.country_coverage ?? null
           }
         });
         return;
@@ -66483,7 +66607,7 @@ var searchCommand5 = defineCommand239({
         winningAdNormalizer
       );
     } catch (err) {
-      reportError2(err);
+      reportSearchError(err);
     }
   }
 });
@@ -66660,7 +66784,7 @@ var winningAdsCommand = defineCommand243({
     name: "winning-ads",
     description: `Search the ad-dna corpus of scored "winning" ads for reference creatives to reproduce, and manage the brands your library tracks. Proxied through the Baker backend (BAKER_API_KEY) \u2014 no separate token needed.
 
-Auth: BAKER_API_KEY (must start with bk_) + BAKER_API_URL (your Convex .convex.site URL).
+Auth: BAKER_API_KEY (bk_ or bkr_) + BAKER_API_URL (your Convex .convex.site URL).
 
 Subcommands:
   baker winning-ads search "<free text>"      \u2014 semantic search across the corpus; lean shortlist (advertiser, summary, scores, media_url)
@@ -66939,6 +67063,7 @@ Introspection: Run 'baker schema <command>' to inspect argument schemas.`
 process.argv = [...process.argv.slice(0, 2), ...normalizeCacheFlag(process.argv.slice(2))];
 installStreamTaps();
 logInvocation(process.argv.slice(2));
+installExitRecord();
 refuseUnknownFlags(main, process.argv.slice(2));
 process.argv = [...process.argv.slice(0, 2), ...cacheFlagForParser(process.argv.slice(2))];
 runMain(main);