@koda-sl/baker-cli 0.384.0 → 0.385.0-dev.f7ef4c7e1

package/dist/chunk-6YMHGIHP.js

@@ -0,0 +1,346 @@
+import {
+  handleLinkedinError,
+  resolveAccountIdArg
+} from "./chunk-7GNU3P7X.js";
+import {
+  adCopyHints,
+  booleanWordPositionalError,
+  capabilityFix
+} from "./chunk-WHWNXLTD.js";
+import {
+  withHints
+} from "./chunk-D5FY4FAK.js";
+import {
+  writeJsonEnvelope
+} from "./chunk-EIGXX6KI.js";
+import {
+  LINKEDIN_DRAFT_BATCH_MAX,
+  linkedinDraftOpInputSchema
+} from "./chunk-D46NOXRY.js";
+import {
+  apiPost
+} from "./chunk-CUL3VB4L.js";
+import {
+  requireChatId
+} from "./chunk-I4FTS5EE.js";
+
+// src/commands/ads/linkedin/write-shared.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+var TOTAL_BUDGET_HELP = "Lifetime budget \u2014 on something already running it must exceed spend to date, or LinkedIn rejects it";
+function bareAccountId(args) {
+  const raw = resolveAccountIdArg(args);
+  return raw.replace(/^urn:li:sponsoredAccount:/, "").replace(/^sponsoredAccount:/, "");
+}
+function failWriteValidation(message) {
+  writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
+  process.exit(1);
+}
+function loadJsonFileArg(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      failWriteValidation(`${path} must contain a JSON object`);
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      failWriteValidation(`${path} is not valid JSON: ${err.message}`);
+    }
+    throw err;
+  }
+}
+function mergePayload(file, flags) {
+  const merged = { ...file };
+  for (const [key, value] of Object.entries(flags)) {
+    if (value !== void 0) {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function loadPatchArg(args) {
+  const file = typeof args.file === "string" && args.file.length > 0 ? args.file : void 0;
+  const inline = typeof args.patch === "string" && args.patch.length > 0 ? args.patch : void 0;
+  if (Boolean(file) === Boolean(inline)) {
+    failWriteValidation("pass exactly one of --file <patch.json> or --patch '<json>'");
+  }
+  if (file) {
+    return loadJsonFileArg(file);
+  }
+  try {
+    const parsed = JSON.parse(inline);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      failWriteValidation("--patch must be a JSON object");
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      failWriteValidation(`--patch is not valid JSON: ${err.message}`);
+    }
+    throw err;
+  }
+}
+function parseMoneyFlag(amount, currency, flag) {
+  if (amount === void 0 || amount === null || amount === "") {
+    return void 0;
+  }
+  if (currency === void 0 || currency === null || currency === "") {
+    return { amount: String(amount) };
+  }
+  if (typeof currency !== "string" || currency.length !== 3) {
+    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like EUR)`);
+  }
+  return { amount: String(amount), currencyCode: currency.toUpperCase() };
+}
+function parseDateFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const raw = String(value);
+  if (/^\d{10,}$/.test(raw)) {
+    return Number(raw);
+  }
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed)) {
+    failWriteValidation(`${flag} must be an ISO date (2026-07-10) or epoch milliseconds`);
+  }
+  return parsed;
+}
+function parseOnOffFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const raw = String(value).toLowerCase();
+  if (raw === "on" || raw === "true") {
+    return true;
+  }
+  if (raw === "off" || raw === "false") {
+    return false;
+  }
+  failWriteValidation(`${flag} must be on|off`);
+}
+function parseLocaleFlag(value) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const match = /^([a-z]{2})[_-]([A-Za-z]{2})$/.exec(String(value));
+  if (!match) {
+    failWriteValidation("--locale must look like en_US (language_COUNTRY)");
+  }
+  return { language: match[1], country: match[2].toUpperCase() };
+}
+function loadTargetingFileArg(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return void 0;
+  }
+  const parsed = loadJsonFileArg(path);
+  const criteria = parsed.targetingCriteria ?? parsed;
+  if (!criteria.include) {
+    failWriteValidation(
+      `${path} must contain targeting criteria with an "include" block (see baker schema ads.linkedin.campaigns.create)`
+    );
+  }
+  return criteria;
+}
+function sha256Lower(value) {
+  return createHash("sha256").update(value.trim().toLowerCase()).digest("hex");
+}
+function parseCsvLine(line) {
+  const cells = [];
+  let current = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (inQuotes) {
+      if (char === '"' && line[i + 1] === '"') {
+        current += '"';
+        i++;
+      } else if (char === '"') {
+        inQuotes = false;
+      } else {
+        current += char;
+      }
+    } else if (char === '"') {
+      inQuotes = true;
+    } else if (char === ",") {
+      cells.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  cells.push(current);
+  return cells.map((cell) => cell.trim());
+}
+function parseListFileArg(path, maxRows) {
+  if (typeof path !== "string" || path.length === 0) {
+    return void 0;
+  }
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  if (lines.length < 2) {
+    failWriteValidation(`${path} needs a header row and at least one data row`);
+  }
+  const columns = parseCsvLine(lines[0]).map((column) => column.trim());
+  const rows = [];
+  for (const line of lines.slice(1)) {
+    const cells = parseCsvLine(line);
+    const row = {};
+    columns.forEach((column, index) => {
+      const value = cells[index] ?? "";
+      if (!value) {
+        return;
+      }
+      row[column] = column.toLowerCase() === "email" ? sha256Lower(value) : value;
+    });
+    if (Object.keys(row).length > 0) {
+      rows.push(row);
+    }
+  }
+  if (rows.length > maxRows) {
+    failWriteValidation(`${path} has ${rows.length} rows \u2014 the inline limit is ${maxRows}. Split the list.`);
+  }
+  return { columns, rows };
+}
+function failPreflight(fields) {
+  writeJsonEnvelope({
+    ok: false,
+    error: {
+      code: "VALIDATION_ERROR",
+      message: fields.map((field) => field.path ? `${field.path}: ${field.message}` : field.message).join("; "),
+      fields,
+      fix: capabilityFix("linkedin-ads")
+    }
+  });
+  process.exit(1);
+}
+var BATCH_NUDGE = "This command takes several ids at once \u2014 pass them comma-separated or with --ids-file instead of one call per id.";
+function batchNudge(data) {
+  return data.sameKindStaged === void 0 ? [] : [BATCH_NUDGE];
+}
+async function stageOp(raw, hints) {
+  const preflight = linkedinDraftOpInputSchema.safeParse(raw);
+  if (!preflight.success) {
+    failPreflight(preflight.error.issues.map((issue) => ({ path: issue.path.join("."), message: issue.message })));
+  }
+  try {
+    const chatId = requireChatId();
+    const response = await apiPost("/api/ads/linkedin/draft/stage", {
+      chatId,
+      op: preflight.data
+    });
+    const allHints = [...batchNudge(response.data), ...hints ?? [], ...await adCopyHints(preflight.data)];
+    writeJsonEnvelope(withHints(response, allHints));
+  } catch (err) {
+    handleLinkedinError(err);
+  }
+}
+async function stageLinkedinOps(rawOps, hints) {
+  if (rawOps.length === 1 && rawOps[0]) {
+    await stageOp(rawOps[0], hints);
+    return;
+  }
+  const ops = [];
+  for (const [index, raw] of rawOps.entries()) {
+    const preflight = linkedinDraftOpInputSchema.safeParse(raw);
+    if (!preflight.success) {
+      failPreflight(
+        preflight.error.issues.map((issue) => ({
+          path: `ops[${index}]${issue.path.length > 0 ? `.${issue.path.join(".")}` : ""}`,
+          message: issue.message
+        }))
+      );
+    }
+    ops.push(preflight.data);
+  }
+  try {
+    const chatId = requireChatId();
+    const response = await apiPost("/api/ads/linkedin/draft/stage-batch", { chatId, ops });
+    const allHints = [...hints ?? [], ...await adCopyHints(ops)];
+    writeJsonEnvelope(withHints(response, allHints));
+  } catch (err) {
+    handleLinkedinError(err);
+  }
+}
+async function stageStatusChange(input) {
+  const payload = input.kind === "creative.update" ? { intendedStatus: input.status } : { status: input.status };
+  await stageLinkedinOps(
+    input.targets.map((target) => ({ kind: input.kind, accountId: input.accountId, target, payload }))
+  );
+}
+function requireTarget(args, entity) {
+  const inverted = booleanWordPositionalError(args, entity);
+  if (inverted !== void 0) {
+    failWriteValidation(inverted);
+  }
+  const positionals = readPositionals(args);
+  const target = args.id ?? args.target ?? args.ref ?? positionals[0];
+  if (typeof target !== "string" || target.length === 0) {
+    failWriteValidation(`pass the ${entity} id or URN as the positional argument`);
+  }
+  if (positionals.length > 1 || splitIdList(target).length > 1) {
+    failWriteValidation(
+      `this command takes one ${entity} id \u2014 run it once per id. Only pause/resume/archive and 'creatives update' accept several ids in one call.`
+    );
+  }
+  return target;
+}
+function readPositionals(args) {
+  if (!Array.isArray(args._)) {
+    return [];
+  }
+  return args._.filter((value) => typeof value === "string" && value.length > 0);
+}
+function splitIdList(raw) {
+  return raw.split(",").map((id) => id.trim()).filter(Boolean);
+}
+function idsFileEntries(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return [];
+  }
+  return readFileSync(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).flatMap(splitIdList);
+}
+function requireTargets(args, entity) {
+  const positionals = readPositionals(args);
+  const named = [args.id, args.target, args.ref].filter(
+    (value) => typeof value === "string" && value.length > 0
+  );
+  const fromArgs = positionals.length > 0 ? positionals : named;
+  const targets = [.../* @__PURE__ */ new Set([...fromArgs.flatMap(splitIdList), ...idsFileEntries(args["ids-file"])])];
+  if (targets.length === 0) {
+    failWriteValidation(
+      `pass the ${entity} id or URN as the positional argument (comma-separated for several), or --ids-file <path>`
+    );
+  }
+  if (targets.length > LINKEDIN_DRAFT_BATCH_MAX) {
+    failWriteValidation(
+      `${targets.length} ids exceeds the batch limit of ${LINKEDIN_DRAFT_BATCH_MAX} \u2014 split the list`
+    );
+  }
+  return targets;
+}
+
+export {
+  TOTAL_BUDGET_HELP,
+  bareAccountId,
+  failWriteValidation,
+  loadJsonFileArg,
+  mergePayload,
+  loadPatchArg,
+  parseMoneyFlag,
+  parseDateFlag,
+  parseOnOffFlag,
+  parseLocaleFlag,
+  loadTargetingFileArg,
+  parseListFileArg,
+  stageOp,
+  stageLinkedinOps,
+  stageStatusChange,
+  requireTarget,
+  requireTargets
+};
+//# sourceMappingURL=chunk-6YMHGIHP.js.map

package/dist/chunk-6YMHGIHP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ads/linkedin/write-shared.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport {\n  LINKEDIN_DRAFT_BATCH_MAX,\n  type LinkedinDraftStageBatchResponse,\n  type LinkedinDraftStageResponse,\n  linkedinDraftOpInputSchema,\n} from \"@baker/api\";\nimport { apiPost } from \"../../../client.ts\";\nimport { requireChatId } from \"../../../env.ts\";\nimport { capabilityFix } from \"../../capabilities/fix.ts\";\nimport { booleanWordPositionalError } from \"../boolean-word-positional.ts\";\nimport { adCopyHints } from \"../copy-hints.ts\";\nimport { withHints } from \"../hints.ts\";\nimport { writeJsonEnvelope } from \"../output.ts\";\nimport { handleLinkedinError, resolveAccountIdArg } from \"./shared.ts\";\n\n/**\n * Shared plumbing for the staged write commands. Writes NEVER hit LinkedIn\n * directly: every command stages an op against this chat's draft\n * (`/api/ads/linkedin/draft/stage`), the dashboard shows it as a pending\n * LinkedIn change, and it applies when the chat is published.\n */\n\n/**\n * LinkedIn rejects a lifetime budget at or below what the entity has already\n * spent, so the flag needs the constraint wherever it is offered — the same\n * text on every surface (`--help` and `baker schema`) so the two can't drift.\n */\nexport const TOTAL_BUDGET_HELP =\n  \"Lifetime budget — on something already running it must exceed spend to date, or LinkedIn rejects it\";\n\nexport function bareAccountId(args: Record<string, unknown>): string {\n  const raw = resolveAccountIdArg(args);\n  return raw.replace(/^urn:li:sponsoredAccount:/, \"\").replace(/^sponsoredAccount:/, \"\");\n}\n\nexport function failWriteValidation(message: string): never {\n  writeJsonEnvelope({ ok: false, error: { code: \"VALIDATION_ERROR\", message } });\n  process.exit(1);\n}\n\nexport function loadJsonFileArg(path: unknown): Record<string, unknown> {\n  if (typeof path !== \"string\" || path.length === 0) {\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as unknown;\n    if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n      failWriteValidation(`${path} must contain a JSON object`);\n    }\n    return parsed as Record<string, unknown>;\n  } catch (err) {\n    if (err instanceof SyntaxError) {\n      failWriteValidation(`${path} is not valid JSON: ${err.message}`);\n    }\n    throw err;\n  }\n}\n\n/** Flags override file keys — the file is the base, flags are the overrides. */\nexport function mergePayload(file: Record<string, unknown>, flags: Record<string, unknown>): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...file };\n  for (const [key, value] of Object.entries(flags)) {\n    if (value !== undefined) {\n      merged[key] = value;\n    }\n  }\n  return merged;\n}\n\n/**\n * The `draft amend` patch: exactly one of `--file <path>` (JSON file) or `--patch '<json>'`\n * (inline string), and it must parse to a JSON object — RFC-7386 merge-patch needs an object to\n * merge, and a stray array/scalar would silently no-op or replace the whole payload.\n */\nexport function loadPatchArg(args: Record<string, unknown>): Record<string, unknown> {\n  const file = typeof args.file === \"string\" && args.file.length > 0 ? args.file : undefined;\n  const inline = typeof args.patch === \"string\" && args.patch.length > 0 ? args.patch : undefined;\n  if (Boolean(file) === Boolean(inline)) {\n    failWriteValidation(\"pass exactly one of --file <patch.json> or --patch '<json>'\");\n  }\n  if (file) {\n    return loadJsonFileArg(file);\n  }\n  try {\n    const parsed = JSON.parse(inline as string) as unknown;\n    if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n      failWriteValidation(\"--patch must be a JSON object\");\n    }\n    return parsed as Record<string, unknown>;\n  } catch (err) {\n    if (err instanceof SyntaxError) {\n      failWriteValidation(`--patch is not valid JSON: ${err.message}`);\n    }\n    throw err;\n  }\n}\n\nexport function parseMoneyFlag(\n  amount: unknown,\n  currency: unknown,\n  flag: string,\n): { amount: string; currencyCode?: string } | undefined {\n  if (amount === undefined || amount === null || amount === \"\") {\n    return undefined;\n  }\n  if (currency === undefined || currency === null || currency === \"\") {\n    // LinkedIn ad accounts are single-currency — the backend fills it in.\n    return { amount: String(amount) };\n  }\n  if (typeof currency !== \"string\" || currency.length !== 3) {\n    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like EUR)`);\n  }\n  return { amount: String(amount), currencyCode: currency.toUpperCase() };\n}\n\n/** Accepts ISO dates (2026-07-10), ISO datetimes, or epoch millis. */\nexport function parseDateFlag(value: unknown, flag: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") {\n    return undefined;\n  }\n  const raw = String(value);\n  if (/^\\d{10,}$/.test(raw)) {\n    return Number(raw);\n  }\n  const parsed = Date.parse(raw);\n  if (Number.isNaN(parsed)) {\n    failWriteValidation(`${flag} must be an ISO date (2026-07-10) or epoch milliseconds`);\n  }\n  return parsed;\n}\n\nexport function parseOnOffFlag(value: unknown, flag: string): boolean | undefined {\n  if (value === undefined || value === null || value === \"\") {\n    return undefined;\n  }\n  const raw = String(value).toLowerCase();\n  if (raw === \"on\" || raw === \"true\") {\n    return true;\n  }\n  if (raw === \"off\" || raw === \"false\") {\n    return false;\n  }\n  failWriteValidation(`${flag} must be on|off`);\n}\n\nexport function parseLocaleFlag(value: unknown): { country: string; language: string } | undefined {\n  if (value === undefined || value === null || value === \"\") {\n    return undefined;\n  }\n  const match = /^([a-z]{2})[_-]([A-Za-z]{2})$/.exec(String(value));\n  if (!match) {\n    failWriteValidation(\"--locale must look like en_US (language_COUNTRY)\");\n  }\n  return { language: match[1] as string, country: (match[2] as string).toUpperCase() };\n}\n\nexport function loadTargetingFileArg(path: unknown): Record<string, unknown> | undefined {\n  if (typeof path !== \"string\" || path.length === 0) {\n    return undefined;\n  }\n  const parsed = loadJsonFileArg(path);\n  // Accept either the bare criteria object or a { targetingCriteria } wrapper.\n  const criteria = (parsed.targetingCriteria as Record<string, unknown> | undefined) ?? parsed;\n  if (!criteria.include) {\n    failWriteValidation(\n      `${path} must contain targeting criteria with an \"include\" block (see baker schema ads.linkedin.campaigns.create)`,\n    );\n  }\n  return criteria;\n}\n\nfunction sha256Lower(value: string): string {\n  return createHash(\"sha256\").update(value.trim().toLowerCase()).digest(\"hex\");\n}\n\nfunction parseCsvLine(line: string): string[] {\n  const cells: string[] = [];\n  let current = \"\";\n  let inQuotes = false;\n  for (let i = 0; i < line.length; i++) {\n    const char = line[i];\n    if (inQuotes) {\n      if (char === '\"' && line[i + 1] === '\"') {\n        current += '\"';\n        i++;\n      } else if (char === '\"') {\n        inQuotes = false;\n      } else {\n        current += char;\n      }\n    } else if (char === '\"') {\n      inQuotes = true;\n    } else if (char === \",\") {\n      cells.push(current);\n      current = \"\";\n    } else {\n      current += char;\n    }\n  }\n  cells.push(current);\n  return cells.map((cell) => cell.trim());\n}\n\nexport interface ParsedList {\n  columns: string[];\n  rows: Array<Record<string, string>>;\n}\n\n/**\n * Parses a header-first CSV into row objects. Email columns are SHA-256\n * hashed here so raw addresses never leave the machine or sit in the draft.\n */\nexport function parseListFileArg(path: unknown, maxRows: number): ParsedList | undefined {\n  if (typeof path !== \"string\" || path.length === 0) {\n    return undefined;\n  }\n  const raw = readFileSync(path, \"utf8\");\n  const lines = raw.split(/\\r?\\n/).filter((line) => line.trim().length > 0);\n  if (lines.length < 2) {\n    failWriteValidation(`${path} needs a header row and at least one data row`);\n  }\n  const columns = parseCsvLine(lines[0] as string).map((column) => column.trim());\n  const rows: Array<Record<string, string>> = [];\n  for (const line of lines.slice(1)) {\n    const cells = parseCsvLine(line);\n    const row: Record<string, string> = {};\n    columns.forEach((column, index) => {\n      const value = cells[index] ?? \"\";\n      if (!value) {\n        return;\n      }\n      row[column] = column.toLowerCase() === \"email\" ? sha256Lower(value) : value;\n    });\n    if (Object.keys(row).length > 0) {\n      rows.push(row);\n    }\n  }\n  if (rows.length > maxRows) {\n    failWriteValidation(`${path} has ${rows.length} rows — the inline limit is ${maxRows}. Split the list.`);\n  }\n  return { columns, rows };\n}\n\ninterface StageEnvelope extends Record<string, unknown> {\n  ok: true;\n  data: LinkedinDraftStageResponse;\n}\n\n/** Structured preflight failure — the agent learns WHICH field (and, in a batch, which op) is wrong. */\nfunction failPreflight(fields: Array<{ path: string; message: string }>): never {\n  writeJsonEnvelope({\n    ok: false,\n    error: {\n      code: \"VALIDATION_ERROR\",\n      message: fields.map((field) => (field.path ? `${field.path}: ${field.message}` : field.message)).join(\"; \"),\n      fields,\n      fix: capabilityFix(\"linkedin-ads\"),\n    },\n  });\n  process.exit(1);\n}\n\n/**\n * The agent is staging one id per call for a kind it has already staged in this\n * draft — the exact loop these commands' id lists exist to replace.\n */\nconst BATCH_NUDGE =\n  \"This command takes several ids at once — pass them comma-separated or with --ids-file instead of one call per id.\";\n\nfunction batchNudge(data: LinkedinDraftStageResponse): string[] {\n  return data.sameKindStaged === undefined ? [] : [BATCH_NUDGE];\n}\n\n/**\n * Preflight-validates the op against the shared `@baker/api` contract (same\n * schema the backend enforces), then stages it. Prints the staged envelope —\n * ref, mode (always `live`: publishing reaches the real ad account), summary,\n * warnings.\n */\nexport async function stageOp(raw: Record<string, unknown>, hints?: string[]): Promise<void> {\n  const preflight = linkedinDraftOpInputSchema.safeParse(raw);\n  if (!preflight.success) {\n    failPreflight(preflight.error.issues.map((issue) => ({ path: issue.path.join(\".\"), message: issue.message })));\n  }\n  try {\n    const chatId = requireChatId();\n    const response = await apiPost<StageEnvelope>(\"/api/ads/linkedin/draft/stage\", {\n      chatId,\n      op: preflight.data,\n    });\n    const allHints = [...batchNudge(response.data), ...(hints ?? []), ...(await adCopyHints(preflight.data))];\n    writeJsonEnvelope(withHints(response, allHints));\n  } catch (err) {\n    handleLinkedinError(err);\n  }\n}\n\ninterface StageBatchEnvelope extends Record<string, unknown> {\n  ok: true;\n  data: LinkedinDraftStageBatchResponse;\n}\n\n/**\n * Stage several ops as ONE request (`/stage-batch`) — all-or-nothing on the\n * backend, one rate-limit hit instead of one per id. A single op falls through to\n * the plain stage path so its envelope, its amend behaviour and its hints stay\n * exactly as before.\n */\nexport async function stageLinkedinOps(rawOps: Array<Record<string, unknown>>, hints?: string[]): Promise<void> {\n  if (rawOps.length === 1 && rawOps[0]) {\n    await stageOp(rawOps[0], hints);\n    return;\n  }\n  const ops: unknown[] = [];\n  for (const [index, raw] of rawOps.entries()) {\n    const preflight = linkedinDraftOpInputSchema.safeParse(raw);\n    if (!preflight.success) {\n      failPreflight(\n        preflight.error.issues.map((issue) => ({\n          path: `ops[${index}]${issue.path.length > 0 ? `.${issue.path.join(\".\")}` : \"\"}`,\n          message: issue.message,\n        })),\n      );\n    }\n    ops.push(preflight.data);\n  }\n  try {\n    const chatId = requireChatId();\n    const response = await apiPost<StageBatchEnvelope>(\"/api/ads/linkedin/draft/stage-batch\", { chatId, ops });\n    const allHints = [...(hints ?? []), ...(await adCopyHints(ops))];\n    writeJsonEnvelope(withHints(response, allHints));\n  } catch (err) {\n    handleLinkedinError(err);\n  }\n}\n\nexport async function stageStatusChange(input: {\n  kind: \"campaignGroup.update\" | \"campaign.update\" | \"creative.update\";\n  accountId: string;\n  targets: string[];\n  status: \"ACTIVE\" | \"PAUSED\" | \"ARCHIVED\";\n}): Promise<void> {\n  const payload = input.kind === \"creative.update\" ? { intendedStatus: input.status } : { status: input.status };\n  await stageLinkedinOps(\n    input.targets.map((target) => ({ kind: input.kind, accountId: input.accountId, target, payload })),\n  );\n}\n\n/**\n * Reads the target from whichever positional the command declared. Commands\n * name it `id` (entity writes) or `ref` (draft show/amend), and citty also\n * leaves every positional in `args._` — so we accept all three rather than\n * making the receipt depend on one command's arg name.\n *\n * `--flag false` is refused BEFORE the one-id check below, which would otherwise\n * blame the stray word on a second id: on `campaigns url-params 123456 --clear\n * false` that sends the agent back with `--clear` alone, which is TRUE again and\n * wipes every tracking parameter on a live ad set.\n */\nexport function requireTarget(args: Record<string, unknown>, entity: string): string {\n  const inverted = booleanWordPositionalError(args, entity);\n  if (inverted !== undefined) {\n    failWriteValidation(inverted);\n  }\n  const positionals = readPositionals(args);\n  const target = args.id ?? args.target ?? args.ref ?? positionals[0];\n  if (typeof target !== \"string\" || target.length === 0) {\n    failWriteValidation(`pass the ${entity} id or URN as the positional argument`);\n  }\n  // This command applies one payload to one id. Accepting the first of several and\n  // dropping the rest would report success for work it never staged, so say so.\n  if (positionals.length > 1 || splitIdList(target).length > 1) {\n    failWriteValidation(\n      `this command takes one ${entity} id — run it once per id. Only pause/resume/archive and 'creatives update' accept several ids in one call.`,\n    );\n  }\n  return target;\n}\n\n/** Every positional citty left in `_`, as strings. Numeric ids arrive as strings via `node:util parseArgs`. */\nfunction readPositionals(args: Record<string, unknown>): string[] {\n  if (!Array.isArray(args._)) {\n    return [];\n  }\n  return args._.filter((value): value is string => typeof value === \"string\" && value.length > 0);\n}\n\n/** Ids in the positional: `123,456` or `urn:li:sponsoredCreative:1, urn:…:2` (URNs never contain commas). */\nfunction splitIdList(raw: string): string[] {\n  return raw\n    .split(\",\")\n    .map((id) => id.trim())\n    .filter(Boolean);\n}\n\n/**\n * `--ids-file` lines: one id per line, or comma-separated on a line — the agent\n * writes whichever is convenient. Blank lines and `#` comments are skipped.\n */\nfunction idsFileEntries(path: unknown): string[] {\n  if (typeof path !== \"string\" || path.length === 0) {\n    return [];\n  }\n  return readFileSync(path, \"utf8\")\n    .split(/\\r?\\n/)\n    .map((line) => line.trim())\n    .filter((line) => line.length > 0 && !line.startsWith(\"#\"))\n    .flatMap(splitIdList);\n}\n\n/**\n * Every id a write command was invoked with: **all** positionals (each of which may\n * itself be comma-separated) plus `--ids-file` lines, deduped in first-seen order.\n * One id stages exactly as before; several stage as one batch.\n *\n * All positionals, not just the first: an agent writing `creatives pause 111 222 333`\n * — space-separated, as most CLIs accept — used to stage one op and be told `ok: true`,\n * so it believed three ads were paused.\n */\nexport function requireTargets(args: Record<string, unknown>, entity: string): string[] {\n  // `args._` is the superset: citty copies the FIRST positional into the declared\n  // arg (`id`/`ref`) but leaves every positional in `_`. Reading the named arg alone\n  // is what dropped ids 2..n. The named arg is the fallback for a command that ever\n  // declares its id as a flag instead, where `_` would be empty.\n  const positionals = readPositionals(args);\n  const named = [args.id, args.target, args.ref].filter(\n    (value): value is string => typeof value === \"string\" && value.length > 0,\n  );\n  const fromArgs = positionals.length > 0 ? positionals : named;\n  const targets = [...new Set([...fromArgs.flatMap(splitIdList), ...idsFileEntries(args[\"ids-file\"])])];\n  if (targets.length === 0) {\n    failWriteValidation(\n      `pass the ${entity} id or URN as the positional argument (comma-separated for several), or --ids-file <path>`,\n    );\n  }\n  if (targets.length > LINKEDIN_DRAFT_BATCH_MAX) {\n    failWriteValidation(\n      `${targets.length} ids exceeds the batch limit of ${LINKEDIN_DRAFT_BATCH_MAX} — split the list`,\n    );\n  }\n  return targets;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AA4BtB,IAAM,oBACX;AAEK,SAAS,cAAc,MAAuC;AACnE,QAAM,MAAM,oBAAoB,IAAI;AACpC,SAAO,IAAI,QAAQ,6BAA6B,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AACtF;AAEO,SAAS,oBAAoB,SAAwB;AAC1D,oBAAkB,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,oBAAoB,QAAQ,EAAE,CAAC;AAC7E,UAAQ,KAAK,CAAC;AAChB;AAEO,SAAS,gBAAgB,MAAwC;AACtE,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,QAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,0BAAoB,GAAG,IAAI,6BAA6B;AAAA,IAC1D;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,aAAa;AAC9B,0BAAoB,GAAG,IAAI,uBAAuB,IAAI,OAAO,EAAE;AAAA,IACjE;AACA,UAAM;AAAA,EACR;AACF;AAGO,SAAS,aAAa,MAA+B,OAAyD;AACnH,QAAM,SAAkC,EAAE,GAAG,KAAK;AAClD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,QAAW;AACvB,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,aAAa,MAAwD;AACnF,QAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACjF,QAAM,SAAS,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IAAI,KAAK,QAAQ;AACtF,MAAI,QAAQ,IAAI,MAAM,QAAQ,MAAM,GAAG;AACrC,wBAAoB,6DAA6D;AAAA,EACnF;AACA,MAAI,MAAM;AACR,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,MAAgB;AAC1C,QAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,0BAAoB,+BAA+B;AAAA,IACrD;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,aAAa;AAC9B,0BAAoB,8BAA8B,IAAI,OAAO,EAAE;AAAA,IACjE;AACA,UAAM;AAAA,EACR;AACF;AAEO,SAAS,eACd,QACA,UACA,MACuD;AACvD,MAAI,WAAW,UAAa,WAAW,QAAQ,WAAW,IAAI;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,QAAQ,aAAa,IAAI;AAElE,WAAO,EAAE,QAAQ,OAAO,MAAM,EAAE;AAAA,EAClC;AACA,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,wBAAoB,GAAG,IAAI,gEAAgE;AAAA,EAC7F;AACA,SAAO,EAAE,QAAQ,OAAO,MAAM,GAAG,cAAc,SAAS,YAAY,EAAE;AACxE;AAGO,SAAS,cAAc,OAAgB,MAAkC;AAC9E,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,YAAY,KAAK,GAAG,GAAG;AACzB,WAAO,OAAO,GAAG;AAAA,EACnB;AACA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,wBAAoB,GAAG,IAAI,yDAAyD;AAAA,EACtF;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAgB,MAAmC;AAChF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK,EAAE,YAAY;AACtC,MAAI,QAAQ,QAAQ,QAAQ,QAAQ;AAClC,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS,QAAQ,SAAS;AACpC,WAAO;AAAA,EACT;AACA,sBAAoB,GAAG,IAAI,iBAAiB;AAC9C;AAEO,SAAS,gBAAgB,OAAmE;AACjG,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,gCAAgC,KAAK,OAAO,KAAK,CAAC;AAChE,MAAI,CAAC,OAAO;AACV,wBAAoB,kDAAkD;AAAA,EACxE;AACA,SAAO,EAAE,UAAU,MAAM,CAAC,GAAa,SAAU,MAAM,CAAC,EAAa,YAAY,EAAE;AACrF;AAEO,SAAS,qBAAqB,MAAoD;AACvF,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,gBAAgB,IAAI;AAEnC,QAAM,WAAY,OAAO,qBAA6D;AACtF,MAAI,CAAC,SAAS,SAAS;AACrB;AAAA,MACE,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK;AAC7E;AAEA,SAAS,aAAa,MAAwB;AAC5C,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,UAAU;AACZ,UAAI,SAAS,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACvC,mBAAW;AACX;AAAA,MACF,WAAW,SAAS,KAAK;AACvB,mBAAW;AAAA,MACb,OAAO;AACL,mBAAW;AAAA,MACb;AAAA,IACF,WAAW,SAAS,KAAK;AACvB,iBAAW;AAAA,IACb,WAAW,SAAS,KAAK;AACvB,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,QAAM,KAAK,OAAO;AAClB,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACxC;AAWO,SAAS,iBAAiB,MAAe,SAAyC;AACvF,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa,MAAM,MAAM;AACrC,QAAM,QAAQ,IAAI,MAAM,OAAO,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,SAAS,CAAC;AACxE,MAAI,MAAM,SAAS,GAAG;AACpB,wBAAoB,GAAG,IAAI,+CAA+C;AAAA,EAC5E;AACA,QAAM,UAAU,aAAa,MAAM,CAAC,CAAW,EAAE,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC;AAC9E,QAAM,OAAsC,CAAC;AAC7C,aAAW,QAAQ,MAAM,MAAM,CAAC,GAAG;AACjC,UAAM,QAAQ,aAAa,IAAI;AAC/B,UAAM,MAA8B,CAAC;AACrC,YAAQ,QAAQ,CAAC,QAAQ,UAAU;AACjC,YAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAI,CAAC,OAAO;AACV;AAAA,MACF;AACA,UAAI,MAAM,IAAI,OAAO,YAAY,MAAM,UAAU,YAAY,KAAK,IAAI;AAAA,IACxE,CAAC;AACD,QAAI,OAAO,KAAK,GAAG,EAAE,SAAS,GAAG;AAC/B,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AACA,MAAI,KAAK,SAAS,SAAS;AACzB,wBAAoB,GAAG,IAAI,QAAQ,KAAK,MAAM,oCAA+B,OAAO,mBAAmB;AAAA,EACzG;AACA,SAAO,EAAE,SAAS,KAAK;AACzB;AAQA,SAAS,cAAc,QAAyD;AAC9E,oBAAkB;AAAA,IAChB,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,OAAO,IAAI,CAAC,UAAW,MAAM,OAAO,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,OAAQ,EAAE,KAAK,IAAI;AAAA,MAC1G;AAAA,MACA,KAAK,cAAc,cAAc;AAAA,IACnC;AAAA,EACF,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;AAMA,IAAM,cACJ;AAEF,SAAS,WAAW,MAA4C;AAC9D,SAAO,KAAK,mBAAmB,SAAY,CAAC,IAAI,CAAC,WAAW;AAC9D;AAQA,eAAsB,QAAQ,KAA8B,OAAiC;AAC3F,QAAM,YAAY,2BAA2B,UAAU,GAAG;AAC1D,MAAI,CAAC,UAAU,SAAS;AACtB,kBAAc,UAAU,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,KAAK,KAAK,GAAG,GAAG,SAAS,MAAM,QAAQ,EAAE,CAAC;AAAA,EAC/G;AACA,MAAI;AACF,UAAM,SAAS,cAAc;AAC7B,UAAM,WAAW,MAAM,QAAuB,iCAAiC;AAAA,MAC7E;AAAA,MACA,IAAI,UAAU;AAAA,IAChB,CAAC;AACD,UAAM,WAAW,CAAC,GAAG,WAAW,SAAS,IAAI,GAAG,GAAI,SAAS,CAAC,GAAI,GAAI,MAAM,YAAY,UAAU,IAAI,CAAE;AACxG,sBAAkB,UAAU,UAAU,QAAQ,CAAC;AAAA,EACjD,SAAS,KAAK;AACZ,wBAAoB,GAAG;AAAA,EACzB;AACF;AAaA,eAAsB,iBAAiB,QAAwC,OAAiC;AAC9G,MAAI,OAAO,WAAW,KAAK,OAAO,CAAC,GAAG;AACpC,UAAM,QAAQ,OAAO,CAAC,GAAG,KAAK;AAC9B;AAAA,EACF;AACA,QAAM,MAAiB,CAAC;AACxB,aAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,GAAG;AAC3C,UAAM,YAAY,2BAA2B,UAAU,GAAG;AAC1D,QAAI,CAAC,UAAU,SAAS;AACtB;AAAA,QACE,UAAU,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,UACrC,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,MAAM,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE;AAAA,UAC7E,SAAS,MAAM;AAAA,QACjB,EAAE;AAAA,MACJ;AAAA,IACF;AACA,QAAI,KAAK,UAAU,IAAI;AAAA,EACzB;AACA,MAAI;AACF,UAAM,SAAS,cAAc;AAC7B,UAAM,WAAW,MAAM,QAA4B,uCAAuC,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,WAAW,CAAC,GAAI,SAAS,CAAC,GAAI,GAAI,MAAM,YAAY,GAAG,CAAE;AAC/D,sBAAkB,UAAU,UAAU,QAAQ,CAAC;AAAA,EACjD,SAAS,KAAK;AACZ,wBAAoB,GAAG;AAAA,EACzB;AACF;AAEA,eAAsB,kBAAkB,OAKtB;AAChB,QAAM,UAAU,MAAM,SAAS,oBAAoB,EAAE,gBAAgB,MAAM,OAAO,IAAI,EAAE,QAAQ,MAAM,OAAO;AAC7G,QAAM;AAAA,IACJ,MAAM,QAAQ,IAAI,CAAC,YAAY,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,QAAQ,QAAQ,EAAE;AAAA,EACnG;AACF;AAaO,SAAS,cAAc,MAA+B,QAAwB;AACnF,QAAM,WAAW,2BAA2B,MAAM,MAAM;AACxD,MAAI,aAAa,QAAW;AAC1B,wBAAoB,QAAQ;AAAA,EAC9B;AACA,QAAM,cAAc,gBAAgB,IAAI;AACxC,QAAM,SAAS,KAAK,MAAM,KAAK,UAAU,KAAK,OAAO,YAAY,CAAC;AAClE,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,wBAAoB,YAAY,MAAM,uCAAuC;AAAA,EAC/E;AAGA,MAAI,YAAY,SAAS,KAAK,YAAY,MAAM,EAAE,SAAS,GAAG;AAC5D;AAAA,MACE,0BAA0B,MAAM;AAAA,IAClC;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,gBAAgB,MAAyC;AAChE,MAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,GAAG;AAC1B,WAAO,CAAC;AAAA,EACV;AACA,SAAO,KAAK,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAChG;AAGA,SAAS,YAAY,KAAuB;AAC1C,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AACnB;AAMA,SAAS,eAAe,MAAyB;AAC/C,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,WAAO,CAAC;AAAA,EACV;AACA,SAAO,aAAa,MAAM,MAAM,EAC7B,MAAM,OAAO,EACb,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,KAAK,CAAC,KAAK,WAAW,GAAG,CAAC,EACzD,QAAQ,WAAW;AACxB;AAWO,SAAS,eAAe,MAA+B,QAA0B;AAKtF,QAAM,cAAc,gBAAgB,IAAI;AACxC,QAAM,QAAQ,CAAC,KAAK,IAAI,KAAK,QAAQ,KAAK,GAAG,EAAE;AAAA,IAC7C,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,EAC1E;AACA,QAAM,WAAW,YAAY,SAAS,IAAI,cAAc;AACxD,QAAM,UAAU,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,SAAS,QAAQ,WAAW,GAAG,GAAG,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;AACpG,MAAI,QAAQ,WAAW,GAAG;AACxB;AAAA,MACE,YAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,0BAA0B;AAC7C;AAAA,MACE,GAAG,QAAQ,MAAM,mCAAmC,wBAAwB;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-VZEDAFAR.js → chunk-6YYSUISH.js}

@@ -1,6 +1,6 @@
 import {
   debugLogSetting
-} from "./chunk-HJEMOSPH.js";
+} from "./chunk-I4FTS5EE.js";
 
 // src/debugLog.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
@@ -12,10 +12,10 @@ var MAX_BYTES = 64 * 1024 * 1024;
 var REDACTIONS = [
   [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
   // Authorization headers
-  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
-  // the literal `bk_`, so the company-key rule matched no part of the read-only
-  // credential a Session review runs with.
-  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not
+  // contain the literal `bk_`, so the company-key rule matched no part of the
+  // read-only credentials a Session review or a published report runs with.
+  [/\b(bk[rv]?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
   // Baker API keys
   [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
   // JWTs / id tokens
@@ -33,6 +33,45 @@ function redactSecrets(input) {
   }
   return out;
 }
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
 function resolveTarget() {
   const raw = debugLogSetting();
   if (!raw) {
@@ -98,7 +137,7 @@ function errorToPlain(err) {
 var invocationStartedAt;
 function logInvocation(argv) {
   invocationStartedAt = Date.now();
-  append({ kind: "invocation", argv, cwd: process.cwd() });
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
 }
 function logExit(code) {
   append({
@@ -127,7 +166,7 @@ function debugLogHttp(entry) {
     method: entry.method,
     url: entry.url,
     durationMs: entry.durationMs,
-    request: entry.requestBody,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
     status: entry.status,
     ok: entry.ok,
     response: entry.responseBody,
@@ -173,4 +212,4 @@ export {
   readBodyForLog,
   installStreamTaps
 };
-//# sourceMappingURL=chunk-VZEDAFAR.js.map
+//# sourceMappingURL=chunk-6YYSUISH.js.map

package/dist/chunk-6YYSUISH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not\n  // contain the literal `bk_`, so the company-key rule matched no part of the\n  // read-only credentials a Session review or a published report runs with.\n  [/\\b(bk[rv]?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,6BAA6B,eAAe;AAAA;AAAA,EAC7C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}