@koda-sl/baker-cli 0.386.0 → 0.387.0-dev.3bafd569e

package/dist/chunk-HDHWIEJJ.js

@@ -0,0 +1,136 @@
+import {
+  coercePathUrlToUrl,
+  looksLikeHttpUrl
+} from "./chunk-U7BBXM67.js";
+
+// src/commands/canvas/resolve-paths.ts
+import path from "path";
+function resolveRelativeCanvasPaths(canvas, baseDir) {
+  if (!canvas || typeof canvas !== "object") return canvas;
+  const c = canvas;
+  if (!Array.isArray(c.nodes)) return canvas;
+  return { ...canvas, nodes: c.nodes.map((n) => resolveNode(n, baseDir)) };
+}
+function localPathParam(node) {
+  if (node.type === "ingest") return node.params?.source === "path" ? "path" : null;
+  if (node.type === "hyperframe_render" || node.type === "hyperframe_snapshot") return "composition";
+  return null;
+}
+function resolveNode(node, baseDir) {
+  if (!node || typeof node !== "object") return node;
+  const n = node;
+  const params = n.params;
+  if (!params || typeof params !== "object") return node;
+  const key = localPathParam(n);
+  if (key && isResolvableRelative(params[key])) {
+    return { ...node, params: { ...params, [key]: path.resolve(baseDir, params[key]) } };
+  }
+  return node;
+}
+function isResolvableRelative(value) {
+  return typeof value === "string" && value.length > 0 && !value.includes("[TODO") && !looksLikeHttpUrl(value) && !path.isAbsolute(value);
+}
+
+// src/commands/canvas/normalize-paths.ts
+import { existsSync, realpathSync } from "fs";
+import { writeFile } from "fs/promises";
+import path2 from "path";
+function findWorkspaceRoot(startDir, exists = existsSync, maxDepth = 12) {
+  let dir = path2.resolve(startDir);
+  for (let i = 0; i < maxDepth; i++) {
+    if (exists(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function canvasOutputsRoot(canvasFile, cwd = process.cwd(), exists = existsSync) {
+  const root = findWorkspaceRoot(path2.dirname(path2.resolve(cwd, canvasFile)), exists) ?? cwd;
+  return path2.join(root, "canvas");
+}
+function canonicalize(target) {
+  const abs = path2.resolve(target);
+  let dir = abs;
+  for (; ; ) {
+    try {
+      const real = realpathSync(dir);
+      return dir === abs ? real : path2.join(real, path2.relative(dir, abs));
+    } catch {
+      const parent = path2.dirname(dir);
+      if (parent === dir) return abs;
+      dir = parent;
+    }
+  }
+}
+function isInside(root, target) {
+  const rel = path2.relative(root, target);
+  return rel !== "" && !rel.startsWith("..") && !path2.isAbsolute(rel);
+}
+function toCanvasRelative(canvasDir, target) {
+  return path2.relative(canvasDir, target).split(path2.sep).join("/");
+}
+var RUNTIME_WORKSPACE_ROOT = "/home/user/repo";
+function rewriteTarget(value, workspaceRoot) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.includes("[TODO") || looksLikeHttpUrl(value) || !path2.isAbsolute(value)) return null;
+  const target = canonicalize(value);
+  if (isInside(workspaceRoot, target)) return target;
+  const fromRuntime = path2.relative(RUNTIME_WORKSPACE_ROOT, path2.normalize(value));
+  if (fromRuntime !== "" && !fromRuntime.startsWith("..") && !path2.isAbsolute(fromRuntime)) {
+    return path2.join(workspaceRoot, fromRuntime);
+  }
+  return null;
+}
+function normalizeCanvasPaths(canvas, canvasDir, workspaceRoot) {
+  if (!canvas || typeof canvas !== "object") return { canvas, rewrites: [] };
+  const c = canvas;
+  if (!Array.isArray(c.nodes)) return { canvas, rewrites: [] };
+  const root = canonicalize(workspaceRoot);
+  const dir = canonicalize(canvasDir);
+  const rewrites = [];
+  const nodes = c.nodes.map((node) => {
+    if (!node || typeof node !== "object") return node;
+    const n = node;
+    const params = n.params;
+    if (!params || typeof params !== "object") return node;
+    const nodeId = typeof n.id === "string" ? n.id : "?";
+    if (n.type === "ingest" && params.source === "path" && looksLikeHttpUrl(params.path)) {
+      rewrites.push({ nodeId, param: "source", from: "path", to: "url" });
+      return { ...node, params: coercePathUrlToUrl(params) };
+    }
+    const key = localPathParam(n);
+    if (!key) return node;
+    const target = rewriteTarget(params[key], root);
+    if (target === null) return node;
+    const to = toCanvasRelative(dir, target);
+    rewrites.push({ nodeId, param: key, from: params[key], to });
+    return { ...node, params: { ...params, [key]: to } };
+  });
+  return rewrites.length === 0 ? { canvas, rewrites } : { canvas: { ...canvas, nodes }, rewrites };
+}
+async function healCanvasPaths(filePath, canvas) {
+  const canvasDir = path2.dirname(filePath);
+  const workspaceRoot = findWorkspaceRoot(canvasDir);
+  if (!workspaceRoot) return { canvas, rewrites: [], text: null };
+  const normalized = normalizeCanvasPaths(canvas, canvasDir, workspaceRoot);
+  if (normalized.rewrites.length === 0) return { ...normalized, text: null };
+  const text = `${JSON.stringify(normalized.canvas, null, 2)}
+`;
+  await writeFile(filePath, text, "utf8");
+  return { ...normalized, text };
+}
+function describeRewrites(rewrites) {
+  return rewrites.map((r) => `  ${r.nodeId}.${r.param}: ${r.from} \u2192 ${r.to}`).join("\n");
+}
+
+export {
+  resolveRelativeCanvasPaths,
+  localPathParam,
+  findWorkspaceRoot,
+  canvasOutputsRoot,
+  normalizeCanvasPaths,
+  healCanvasPaths,
+  describeRewrites
+};
+//# sourceMappingURL=chunk-HDHWIEJJ.js.map

package/dist/chunk-HDHWIEJJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/canvas/resolve-paths.ts","../src/commands/canvas/normalize-paths.ts"],"sourcesContent":["import path from \"node:path\";\nimport { looksLikeHttpUrl } from \"../../engine/lib/url.ts\";\n\n/**\n * Make a scaffolded canvas PORTABLE. The scaffold writes workspace-relative paths\n * for the things it owns — `hyperframe_render`/`hyperframe_snapshot` composition dirs\n * and the blueprint `ingest` — so the on-disk canvas carries no absolute path. At load time (run /\n * validate) those relatives are resolved against the canvas file's own directory,\n * so the canvas works wherever it lives.\n *\n * Without this the scaffold baked `path.resolve(...)` absolutes into the JSON; when\n * a workspace was renamed/copied (e.g. `memphis` → `barkibu-video-ad-v1`) the\n * canvas silently read a sibling workspace's stale composition + assets.\n *\n * Pass-through unchanged: absolute paths, URL ingests, and unfilled `[TODO …]`\n * placeholders (the placeholder gate handles those). A `source:\"path\"` whose value\n * is actually an http(s) URL MUST pass through untouched — `path.resolve` would\n * rewrite it to a garbage local path (`<dir>/https:/host/…`), defeating the ingest\n * schema's URL→path heal downstream.\n */\nexport function resolveRelativeCanvasPaths(canvas: unknown, baseDir: string): unknown {\n  if (!canvas || typeof canvas !== \"object\") return canvas;\n  const c = canvas as { nodes?: unknown };\n  if (!Array.isArray(c.nodes)) return canvas;\n  return { ...(canvas as object), nodes: c.nodes.map((n) => resolveNode(n, baseDir)) };\n}\n\n/**\n * Which param of this node names a local file or directory in the workspace, or null if none does.\n * The one owner of that question: resolving (here), healing absolutes (`normalizeCanvasPaths`) and\n * snapshotting a run's sources (`localPathRefsFromCanvas`) all ask it, so a node kind that carries a\n * path cannot be known to one of them and missed by another. Every such path is read relative to\n * the canvas file, never to the working directory.\n */\nexport function localPathParam(node: { type?: unknown; params?: Record<string, unknown> }): \"path\" | \"composition\" | null {\n  if (node.type === \"ingest\") return node.params?.source === \"path\" ? \"path\" : null;\n  if (node.type === \"hyperframe_render\" || node.type === \"hyperframe_snapshot\") return \"composition\";\n  return null;\n}\n\nfunction resolveNode(node: unknown, baseDir: string): unknown {\n  if (!node || typeof node !== \"object\") return node;\n  const n = node as { type?: unknown; params?: Record<string, unknown> };\n  const params = n.params;\n  if (!params || typeof params !== \"object\") return node;\n\n  const key = localPathParam(n);\n  if (key && isResolvableRelative(params[key])) {\n    return { ...node, params: { ...params, [key]: path.resolve(baseDir, params[key]) } };\n  }\n  return node;\n}\n\nfunction isResolvableRelative(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    !value.includes(\"[TODO\") &&\n    !looksLikeHttpUrl(value) &&\n    !path.isAbsolute(value)\n  );\n}\n","import { existsSync, realpathSync } from \"node:fs\";\nimport { writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { looksLikeHttpUrl } from \"../../engine/lib/url.ts\";\nimport { coercePathUrlToUrl } from \"../../engine/nodes/ingest.ts\";\nimport { localPathParam } from \"./resolve-paths.ts\";\n\n/**\n * The inverse of `resolveRelativeCanvasPaths`, applied to the file on disk.\n *\n * The scaffold writes `[TODO …]` asset slots that say \"relative to this canvas\n * file, never an absolute path\". An agent filling one by hand writes what it\n * sees — `/home/user/repo/src/brand/logos/logo.webp` — and every in-session\n * gate passes: the file exists at that path in the Runtime, `canvas validate`\n * passes absolutes straight through, `canvas run` renders fine. The mistake is\n * invisible until the publish build checks the repo out under a different root\n * and `validate-creatives` fails on a creative nobody is looking at any more.\n *\n * There is nothing to ask the author here: an absolute path INSIDE the\n * workspace has exactly one correct portable form, `path.relative(canvasDir,\n * it)`, which resolves to the same file. So it is rewritten, not reported.\n *\n * The same holds for an ingest written `source:\"path\"` with an http(s) URL in\n * `path`: the ingest schema already runs it as `source:\"url\"`, so that is the\n * only spelling that says what ran. Left on disk it passes validate and run,\n * then the commit hook reads a URL as a missing local file and fails the\n * creative after the render — and the hand edit that follows re-keys the cache.\n *\n * Untouched, because the rewrite would not be provably equivalent: paths\n * OUTSIDE the workspace (a `/tmp` scratch file, a sibling checkout — a relative\n * form would either escape the repo or point at nothing after a clone), URLs,\n * `[TODO …]` slots, and paths that are already relative.\n */\n\nexport type CanvasPathRewrite = {\n  nodeId: string;\n  /**\n   * Which param was rewritten — `ingest.path` or a hyperframe node's `composition`\n   * (absolute → relative), or `ingest.source` (`path` → `url`, the URL moving to `url`).\n   */\n  param: \"path\" | \"composition\" | \"source\";\n  from: string;\n  to: string;\n};\n\nexport type CanvasNormalization = { canvas: unknown; rewrites: CanvasPathRewrite[] };\n\n/**\n * A heal applied to the file on disk. `text` is what was written, or null when\n * nothing changed — callers that identify a canvas by its bytes (`canvasSha`,\n * the run snapshot) MUST use it, or they describe content the file no longer\n * has and a resume can never match it back.\n */\nexport type CanvasHeal = CanvasNormalization & { text: string | null };\n\n/**\n * The workspace a canvas belongs to: the nearest ancestor holding a\n * `package.json`. In a Runtime that is `/home/user/repo`; in the publish build\n * it is the CI checkout root — which is the point, the anchor is discovered at\n * read time instead of baked in at write time. The brand kit is found by\n * `findBrandRoot` (static-copy-projection.ts) instead: it needs `src/brand`, not a package.\n */\nexport function findWorkspaceRoot(\n  startDir: string,\n  exists: (p: string) => boolean = existsSync,\n  maxDepth = 12,\n): string | null {\n  let dir = path.resolve(startDir);\n  for (let i = 0; i < maxDepth; i++) {\n    if (exists(path.join(dir, \"package.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * The `canvas/` directory a run of `canvasFile` writes to by default: the one at the root of the\n * workspace the canvas belongs to, whatever directory the command was started from. Anchored on\n * the working directory, a run started inside `src/creatives/<slug>/` wrote a nested `canvas/`\n * there — a folder the creative gate rejects, and a cache no later run from the root could find.\n */\nexport function canvasOutputsRoot(\n  canvasFile: string,\n  cwd: string = process.cwd(),\n  exists: (p: string) => boolean = existsSync,\n): string {\n  const root = findWorkspaceRoot(path.dirname(path.resolve(cwd, canvasFile)), exists) ?? cwd;\n  return path.join(root, \"canvas\");\n}\n\n/**\n * `target` with every symlink in its deepest EXISTING ancestor resolved, so the\n * inside-the-workspace test compares like with like. Without it the test is a\n * string prefix match that a symlinked mount defeats: on macOS `/tmp/x` and a\n * cwd of `/private/tmp/x` are the same directory and the check says otherwise,\n * and a path whose file does not exist yet can't be realpath'd at all.\n */\nfunction canonicalize(target: string): string {\n  const abs = path.resolve(target);\n  let dir = abs;\n  for (;;) {\n    try {\n      const real = realpathSync(dir);\n      return dir === abs ? real : path.join(real, path.relative(dir, abs));\n    } catch {\n      const parent = path.dirname(dir);\n      if (parent === dir) return abs;\n      dir = parent;\n    }\n  }\n}\n\nfunction isInside(root: string, target: string): boolean {\n  const rel = path.relative(root, target);\n  return rel !== \"\" && !rel.startsWith(\"..\") && !path.isAbsolute(rel);\n}\n\n/** Portable form of `target` as read from `canvasDir`, always with `/` separators. */\nfunction toCanvasRelative(canvasDir: string, target: string): string {\n  return path.relative(canvasDir, target).split(path.sep).join(\"/\");\n}\n\n/**\n * Every Session's workspace is checked out at this exact path — `REPO_PATH` in\n * `convex/sandbox/constants.ts`. So an absolute path under it names a file in\n * THIS workspace no matter which checkout is reading: remapping it onto the\n * current root is a proof, not the longest-tail-that-exists guess a validator\n * has to fall back on for an unrecognized root. This is what lets a canvas that\n * already escaped a Session heal in the publish build instead of blocking it.\n */\nconst RUNTIME_WORKSPACE_ROOT = \"/home/user/repo\";\n\n/** The in-workspace target this value denotes, else null. */\nfunction rewriteTarget(value: unknown, workspaceRoot: string): string | null {\n  if (typeof value !== \"string\" || value.length === 0) return null;\n  if (value.includes(\"[TODO\") || looksLikeHttpUrl(value) || !path.isAbsolute(value)) return null;\n\n  const target = canonicalize(value);\n  if (isInside(workspaceRoot, target)) return target;\n\n  const fromRuntime = path.relative(RUNTIME_WORKSPACE_ROOT, path.normalize(value));\n  if (fromRuntime !== \"\" && !fromRuntime.startsWith(\"..\") && !path.isAbsolute(fromRuntime)) {\n    return path.join(workspaceRoot, fromRuntime);\n  }\n  return null;\n}\n\nexport function normalizeCanvasPaths(\n  canvas: unknown,\n  canvasDir: string,\n  workspaceRoot: string,\n): CanvasNormalization {\n  if (!canvas || typeof canvas !== \"object\") return { canvas, rewrites: [] };\n  const c = canvas as { nodes?: unknown };\n  if (!Array.isArray(c.nodes)) return { canvas, rewrites: [] };\n\n  const root = canonicalize(workspaceRoot);\n  const dir = canonicalize(canvasDir);\n  const rewrites: CanvasPathRewrite[] = [];\n  const nodes = c.nodes.map((node) => {\n    if (!node || typeof node !== \"object\") return node;\n    const n = node as { id?: unknown; type?: unknown; params?: Record<string, unknown> };\n    const params = n.params;\n    if (!params || typeof params !== \"object\") return node;\n    const nodeId = typeof n.id === \"string\" ? n.id : \"?\";\n    if (n.type === \"ingest\" && params.source === \"path\" && looksLikeHttpUrl(params.path)) {\n      rewrites.push({ nodeId, param: \"source\", from: \"path\", to: \"url\" });\n      return { ...node, params: coercePathUrlToUrl(params) };\n    }\n    const key = localPathParam(n);\n    if (!key) return node;\n\n    const target = rewriteTarget(params[key], root);\n    if (target === null) return node;\n\n    const to = toCanvasRelative(dir, target);\n    rewrites.push({ nodeId, param: key, from: params[key] as string, to });\n    return { ...node, params: { ...params, [key]: to } };\n  });\n\n  return rewrites.length === 0 ? { canvas, rewrites } : { canvas: { ...(canvas as object), nodes }, rewrites };\n}\n\n/**\n * Normalize the canvas AT `filePath` and save it when anything changed, so the\n * healed canvas is what gets committed — not just what this process rendered.\n * Called by `canvas validate` and `canvas run`, the two commands every creative\n * passes through before it can ship.\n */\nexport async function healCanvasPaths(filePath: string, canvas: unknown): Promise<CanvasHeal> {\n  const canvasDir = path.dirname(filePath);\n  const workspaceRoot = findWorkspaceRoot(canvasDir);\n  if (!workspaceRoot) return { canvas, rewrites: [], text: null };\n\n  const normalized = normalizeCanvasPaths(canvas, canvasDir, workspaceRoot);\n  if (normalized.rewrites.length === 0) return { ...normalized, text: null };\n\n  const text = `${JSON.stringify(normalized.canvas, null, 2)}\\n`;\n  await writeFile(filePath, text, \"utf8\");\n  return { ...normalized, text };\n}\n\n/** One line per rewrite, for the agent-facing note. */\nexport function describeRewrites(rewrites: CanvasPathRewrite[]): string {\n  return rewrites.map((r) => `  ${r.nodeId}.${r.param}: ${r.from} → ${r.to}`).join(\"\\n\");\n}\n"],"mappings":";;;;;;AAAA,OAAO,UAAU;AAoBV,SAAS,2BAA2B,QAAiB,SAA0B;AACpF,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,IAAI;AACV,MAAI,CAAC,MAAM,QAAQ,EAAE,KAAK,EAAG,QAAO;AACpC,SAAO,EAAE,GAAI,QAAmB,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE;AACrF;AASO,SAAS,eAAe,MAA2F;AACxH,MAAI,KAAK,SAAS,SAAU,QAAO,KAAK,QAAQ,WAAW,SAAS,SAAS;AAC7E,MAAI,KAAK,SAAS,uBAAuB,KAAK,SAAS,sBAAuB,QAAO;AACrF,SAAO;AACT;AAEA,SAAS,YAAY,MAAe,SAA0B;AAC5D,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,IAAI;AACV,QAAM,SAAS,EAAE;AACjB,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,MAAM,eAAe,CAAC;AAC5B,MAAI,OAAO,qBAAqB,OAAO,GAAG,CAAC,GAAG;AAC5C,WAAO,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAK,QAAQ,SAAS,OAAO,GAAG,CAAC,EAAE,EAAE;AAAA,EACrF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAiC;AAC7D,SACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,SAAS,OAAO,KACvB,CAAC,iBAAiB,KAAK,KACvB,CAAC,KAAK,WAAW,KAAK;AAE1B;;;AC7DA,SAAS,YAAY,oBAAoB;AACzC,SAAS,iBAAiB;AAC1B,OAAOA,WAAU;AA4DV,SAAS,kBACd,UACA,SAAiC,YACjC,WAAW,IACI;AACf,MAAI,MAAMC,MAAK,QAAQ,QAAQ;AAC/B,WAAS,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,QAAI,OAAOA,MAAK,KAAK,KAAK,cAAc,CAAC,EAAG,QAAO;AACnD,UAAM,SAASA,MAAK,QAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAQO,SAAS,kBACd,YACA,MAAc,QAAQ,IAAI,GAC1B,SAAiC,YACzB;AACR,QAAM,OAAO,kBAAkBA,MAAK,QAAQA,MAAK,QAAQ,KAAK,UAAU,CAAC,GAAG,MAAM,KAAK;AACvF,SAAOA,MAAK,KAAK,MAAM,QAAQ;AACjC;AASA,SAAS,aAAa,QAAwB;AAC5C,QAAM,MAAMA,MAAK,QAAQ,MAAM;AAC/B,MAAI,MAAM;AACV,aAAS;AACP,QAAI;AACF,YAAM,OAAO,aAAa,GAAG;AAC7B,aAAO,QAAQ,MAAM,OAAOA,MAAK,KAAK,MAAMA,MAAK,SAAS,KAAK,GAAG,CAAC;AAAA,IACrE,QAAQ;AACN,YAAM,SAASA,MAAK,QAAQ,GAAG;AAC/B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,SAAS,MAAc,QAAyB;AACvD,QAAM,MAAMA,MAAK,SAAS,MAAM,MAAM;AACtC,SAAO,QAAQ,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,CAACA,MAAK,WAAW,GAAG;AACpE;AAGA,SAAS,iBAAiB,WAAmB,QAAwB;AACnE,SAAOA,MAAK,SAAS,WAAW,MAAM,EAAE,MAAMA,MAAK,GAAG,EAAE,KAAK,GAAG;AAClE;AAUA,IAAM,yBAAyB;AAG/B,SAAS,cAAc,OAAgB,eAAsC;AAC3E,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,MAAI,MAAM,SAAS,OAAO,KAAK,iBAAiB,KAAK,KAAK,CAACA,MAAK,WAAW,KAAK,EAAG,QAAO;AAE1F,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,SAAS,eAAe,MAAM,EAAG,QAAO;AAE5C,QAAM,cAAcA,MAAK,SAAS,wBAAwBA,MAAK,UAAU,KAAK,CAAC;AAC/E,MAAI,gBAAgB,MAAM,CAAC,YAAY,WAAW,IAAI,KAAK,CAACA,MAAK,WAAW,WAAW,GAAG;AACxF,WAAOA,MAAK,KAAK,eAAe,WAAW;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,SAAS,qBACd,QACA,WACA,eACqB;AACrB,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,EAAE,QAAQ,UAAU,CAAC,EAAE;AACzE,QAAM,IAAI;AACV,MAAI,CAAC,MAAM,QAAQ,EAAE,KAAK,EAAG,QAAO,EAAE,QAAQ,UAAU,CAAC,EAAE;AAE3D,QAAM,OAAO,aAAa,aAAa;AACvC,QAAM,MAAM,aAAa,SAAS;AAClC,QAAM,WAAgC,CAAC;AACvC,QAAM,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS;AAClC,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,UAAM,IAAI;AACV,UAAM,SAAS,EAAE;AACjB,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,UAAM,SAAS,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AACjD,QAAI,EAAE,SAAS,YAAY,OAAO,WAAW,UAAU,iBAAiB,OAAO,IAAI,GAAG;AACpF,eAAS,KAAK,EAAE,QAAQ,OAAO,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AAClE,aAAO,EAAE,GAAG,MAAM,QAAQ,mBAAmB,MAAM,EAAE;AAAA,IACvD;AACA,UAAM,MAAM,eAAe,CAAC;AAC5B,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,cAAc,OAAO,GAAG,GAAG,IAAI;AAC9C,QAAI,WAAW,KAAM,QAAO;AAE5B,UAAM,KAAK,iBAAiB,KAAK,MAAM;AACvC,aAAS,KAAK,EAAE,QAAQ,OAAO,KAAK,MAAM,OAAO,GAAG,GAAa,GAAG,CAAC;AACrE,WAAO,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,GAAG,EAAE;AAAA,EACrD,CAAC;AAED,SAAO,SAAS,WAAW,IAAI,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAI,QAAmB,MAAM,GAAG,SAAS;AAC7G;AAQA,eAAsB,gBAAgB,UAAkB,QAAsC;AAC5F,QAAM,YAAYA,MAAK,QAAQ,QAAQ;AACvC,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,MAAI,CAAC,cAAe,QAAO,EAAE,QAAQ,UAAU,CAAC,GAAG,MAAM,KAAK;AAE9D,QAAM,aAAa,qBAAqB,QAAQ,WAAW,aAAa;AACxE,MAAI,WAAW,SAAS,WAAW,EAAG,QAAO,EAAE,GAAG,YAAY,MAAM,KAAK;AAEzE,QAAM,OAAO,GAAG,KAAK,UAAU,WAAW,QAAQ,MAAM,CAAC,CAAC;AAAA;AAC1D,QAAM,UAAU,UAAU,MAAM,MAAM;AACtC,SAAO,EAAE,GAAG,YAAY,KAAK;AAC/B;AAGO,SAAS,iBAAiB,UAAuC;AACtE,SAAO,SAAS,IAAI,CAAC,MAAM,KAAK,EAAE,MAAM,IAAI,EAAE,KAAK,KAAK,EAAE,IAAI,WAAM,EAAE,EAAE,EAAE,EAAE,KAAK,IAAI;AACvF;","names":["path","path"]}

package/dist/chunk-HJTIBTF7.js

@@ -0,0 +1,98 @@
+import {
+  isRemoteUrl
+} from "./chunk-EDNX3AOS.js";
+import {
+  detectImageContentType,
+  uploadLocalImage
+} from "./chunk-ZLLJKSNS.js";
+import {
+  IMAGE_GENERATE_MODELS,
+  MODEL_REGISTRY,
+  VIDEO_GENERATE_MODELS
+} from "./chunk-CAMX6OHF.js";
+import {
+  ApiError,
+  apiPost
+} from "./chunk-HREWXNTO.js";
+
+// src/commands/studio/modelOptions.ts
+function unionOfStringEnum(node, models, param) {
+  const values = /* @__PURE__ */ new Set();
+  for (const model of models) {
+    const schema = MODEL_REGISTRY[node][model]?.params[param];
+    if (schema?.kind === "string") for (const value of schema.enum ?? []) values.add(value);
+  }
+  return [...values];
+}
+function unionOfNumberEnum(node, models, param) {
+  const values = /* @__PURE__ */ new Set();
+  for (const model of models) {
+    const schema = MODEL_REGISTRY[node][model]?.params[param];
+    if (schema?.kind === "number") for (const value of schema.enum ?? []) values.add(value);
+  }
+  return [...values].sort((a, b) => a - b);
+}
+var IMAGE_MODEL_IDS = [...IMAGE_GENERATE_MODELS];
+var VIDEO_MODEL_IDS = [...VIDEO_GENERATE_MODELS];
+var IMAGE_SIZES = unionOfStringEnum("image_generate", IMAGE_GENERATE_MODELS, "image_size");
+var IMAGE_QUALITIES = unionOfStringEnum("image_generate", IMAGE_GENERATE_MODELS, "quality");
+var CLIP_RESOLUTIONS = unionOfStringEnum("video_generate", VIDEO_GENERATE_MODELS, "resolution");
+var CLIP_DURATIONS = unionOfNumberEnum("video_generate", VIDEO_GENERATE_MODELS, "duration");
+var CLIP_PERSON_GENERATION = unionOfStringEnum("video_generate", VIDEO_GENERATE_MODELS, "person_generation");
+
+// src/commands/studio/references.ts
+var LIBRARY_ID_RE = /^[a-z0-9]{16,}$/i;
+var FILE_EXTENSION_RE = /\.[a-z0-9]{2,5}$/i;
+var PATH_HINT_RE = /[/\\]/;
+function classify(entry) {
+  if (isRemoteUrl(entry)) return { kind: "url", value: entry };
+  if (PATH_HINT_RE.test(entry) || FILE_EXTENSION_RE.test(entry)) return { kind: "path", value: entry };
+  if (LIBRARY_ID_RE.test(entry)) return { kind: "id", value: entry };
+  throw new ApiError(
+    "VALIDATION_ERROR",
+    `"${entry}" is not a library image id, a file path, or an image URL. Pass a comma-separated mix of those.`
+  );
+}
+function parseImageRefs(spec) {
+  return spec.split(",").map((entry) => entry.trim()).filter(Boolean).map(classify);
+}
+var defaultDeps = {
+  ingest: (url) => apiPost("/api/images/ingest", { url, source: "uploaded" }),
+  upload: (path) => uploadLocalImage({ file: path, contentType: detectImageContentType(path), source: "uploaded" })
+};
+async function resolveLibraryImageIds(spec, limit, deps = defaultDeps) {
+  const refs = parseImageRefs(spec);
+  if (limit && refs.length > limit.max) {
+    throw new ApiError("VALIDATION_ERROR", limit.refuse(refs.length));
+  }
+  const imageIds = [];
+  const added = [];
+  for (const ref of refs) {
+    if (ref.kind === "id") {
+      imageIds.push(ref.value);
+      continue;
+    }
+    const { imageId } = ref.kind === "url" ? await deps.ingest(ref.value) : await deps.upload(ref.value).catch(uploadFailure(ref.value));
+    imageIds.push(imageId);
+    added.push(imageId);
+  }
+  return { imageIds, added };
+}
+function uploadFailure(path) {
+  return (error) => {
+    if (error instanceof ApiError) throw error;
+    throw new ApiError("VALIDATION_ERROR", `Could not read "${path}" as an image.`);
+  };
+}
+
+export {
+  IMAGE_MODEL_IDS,
+  VIDEO_MODEL_IDS,
+  IMAGE_SIZES,
+  IMAGE_QUALITIES,
+  CLIP_RESOLUTIONS,
+  CLIP_DURATIONS,
+  CLIP_PERSON_GENERATION,
+  resolveLibraryImageIds
+};
+//# sourceMappingURL=chunk-HJTIBTF7.js.map

package/dist/chunk-HJTIBTF7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/studio/modelOptions.ts","../src/commands/studio/references.ts"],"sourcesContent":["import { IMAGE_GENERATE_MODELS, MODEL_REGISTRY, VIDEO_GENERATE_MODELS } from \"@baker/canvas-contract\";\n\n/**\n * What the curated roster accepts for one param, across every model that has it.\n *\n * Derived, never hand-copied: the contract registry is the source of truth for\n * which model takes which value, and a hand-written list in the CLI is a second\n * copy that goes stale the first time a model is added. `baker schema` reads\n * these, so the agent's picture of what is allowed comes from the same place the\n * backend's refusal does.\n *\n * The union is deliberately WIDER than any single model: `--quality 4k` is valid\n * on Seedance and `4K` on Veo (different providers, different casing), and both\n * belong in the advertised set. Whether the chosen model accepts the value the\n * caller picked is settled server-side, per model, with a message that names it.\n */\nfunction unionOfStringEnum(\n  node: \"image_generate\" | \"video_generate\",\n  models: readonly string[],\n  param: string,\n): string[] {\n  const values = new Set<string>();\n  for (const model of models) {\n    const schema = MODEL_REGISTRY[node][model]?.params[param];\n    if (schema?.kind === \"string\") for (const value of schema.enum ?? []) values.add(value);\n  }\n  return [...values];\n}\n\n/** Every number the roster accepts for a param, ascending. */\nfunction unionOfNumberEnum(\n  node: \"image_generate\" | \"video_generate\",\n  models: readonly string[],\n  param: string,\n): number[] {\n  const values = new Set<number>();\n  for (const model of models) {\n    const schema = MODEL_REGISTRY[node][model]?.params[param];\n    if (schema?.kind === \"number\") for (const value of schema.enum ?? []) values.add(value);\n  }\n  return [...values].sort((a, b) => a - b);\n}\n\nexport const IMAGE_MODEL_IDS = [...IMAGE_GENERATE_MODELS];\nexport const VIDEO_MODEL_IDS = [...VIDEO_GENERATE_MODELS];\n\nexport const IMAGE_SIZES = unionOfStringEnum(\"image_generate\", IMAGE_GENERATE_MODELS, \"image_size\");\nexport const IMAGE_QUALITIES = unionOfStringEnum(\"image_generate\", IMAGE_GENERATE_MODELS, \"quality\");\n\nexport const CLIP_RESOLUTIONS = unionOfStringEnum(\"video_generate\", VIDEO_GENERATE_MODELS, \"resolution\");\nexport const CLIP_DURATIONS = unionOfNumberEnum(\"video_generate\", VIDEO_GENERATE_MODELS, \"duration\");\nexport const CLIP_PERSON_GENERATION = unionOfStringEnum(\"video_generate\", VIDEO_GENERATE_MODELS, \"person_generation\");\n","import type { ImagesIngestResponse } from \"@baker/api\";\nimport { ApiError, apiPost } from \"../../client.ts\";\nimport { isRemoteUrl } from \"../../lib/image/io.ts\";\nimport { detectImageContentType, uploadLocalImage } from \"../images/api.ts\";\n\n/**\n * One entry of a `--reference` / `--image` spec, after classification.\n *\n * The studio takes LIBRARY image ids and nothing else: a reference has to be an\n * asset the dashboard can show next to the batch that used it, and inlined bytes\n * would put megabytes of base64 on a row the live feed reads. So the CLI accepts\n * the three things an agent actually has — an id it already knows, a file it just\n * wrote in the workspace, a URL it just found — and turns the last two into\n * library images before starting the batch. That also makes the reference\n * reusable: the next prompt can name the id.\n */\nexport type ImageRef = { kind: \"id\" | \"url\" | \"path\"; value: string };\n\n// Convex ids are long, unpadded alphanumerics with no separators and no\n// extension — distinguishable from both a filename and a prose fragment.\nconst LIBRARY_ID_RE = /^[a-z0-9]{16,}$/i;\nconst FILE_EXTENSION_RE = /\\.[a-z0-9]{2,5}$/i;\nconst PATH_HINT_RE = /[/\\\\]/;\n\nfunction classify(entry: string): ImageRef {\n  if (isRemoteUrl(entry)) return { kind: \"url\", value: entry };\n  if (PATH_HINT_RE.test(entry) || FILE_EXTENSION_RE.test(entry)) return { kind: \"path\", value: entry };\n  if (LIBRARY_ID_RE.test(entry)) return { kind: \"id\", value: entry };\n  throw new ApiError(\n    \"VALIDATION_ERROR\",\n    `\"${entry}\" is not a library image id, a file path, or an image URL. Pass a comma-separated mix of those.`,\n  );\n}\n\n/**\n * Split a comma-separated spec and classify each entry. Order is preserved —\n * models read references positionally, and the first image is the frame a clip\n * starts from.\n */\nexport function parseImageRefs(spec: string): ImageRef[] {\n  return spec\n    .split(\",\")\n    .map((entry) => entry.trim())\n    .filter(Boolean)\n    .map(classify);\n}\n\nexport type ResolveLibraryImageDeps = {\n  ingest: (url: string) => Promise<ImagesIngestResponse>;\n  upload: (path: string) => Promise<{ imageId: string }>;\n};\n\nconst defaultDeps: ResolveLibraryImageDeps = {\n  ingest: (url) => apiPost<ImagesIngestResponse>(\"/api/images/ingest\", { url, source: \"uploaded\" }),\n  upload: (path) => uploadLocalImage({ file: path, contentType: detectImageContentType(path), source: \"uploaded\" }),\n};\n\n/** How many images the chosen model will take, and what to call them when it won't. */\nexport type ReferenceLimit = { max: number; refuse: (count: number) => string };\n\n/**\n * Turn a `--reference` / `--image` spec into the library image ids the studio\n * takes, adding anything that isn't already in the library.\n *\n * The batch is not started until every entry resolves: half a reference set is\n * a different brief, and paying for it is worse than failing the call.\n *\n * The count is checked FIRST, before a single upload or ingest. The backend\n * checks it too, but by the time it does the CLI has already downloaded and\n * described every image in a set it was always going to refuse — work the\n * caller pays for and then throws away.\n */\nexport async function resolveLibraryImageIds(\n  spec: string,\n  limit?: ReferenceLimit,\n  deps: ResolveLibraryImageDeps = defaultDeps,\n): Promise<{ imageIds: string[]; added: string[] }> {\n  const refs = parseImageRefs(spec);\n  if (limit && refs.length > limit.max) {\n    throw new ApiError(\"VALIDATION_ERROR\", limit.refuse(refs.length));\n  }\n  const imageIds: string[] = [];\n  const added: string[] = [];\n  for (const ref of refs) {\n    if (ref.kind === \"id\") {\n      imageIds.push(ref.value);\n      continue;\n    }\n    const { imageId } =\n      ref.kind === \"url\" ? await deps.ingest(ref.value) : await deps.upload(ref.value).catch(uploadFailure(ref.value));\n    imageIds.push(imageId);\n    added.push(imageId);\n  }\n  return { imageIds, added };\n}\n\nfunction uploadFailure(path: string): (error: unknown) => never {\n  return (error) => {\n    if (error instanceof ApiError) throw error;\n    throw new ApiError(\"VALIDATION_ERROR\", `Could not read \"${path}\" as an image.`);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,SAAS,kBACP,MACA,QACA,OACU;AACV,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,eAAe,IAAI,EAAE,KAAK,GAAG,OAAO,KAAK;AACxD,QAAI,QAAQ,SAAS,SAAU,YAAW,SAAS,OAAO,QAAQ,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EACxF;AACA,SAAO,CAAC,GAAG,MAAM;AACnB;AAGA,SAAS,kBACP,MACA,QACA,OACU;AACV,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,eAAe,IAAI,EAAE,KAAK,GAAG,OAAO,KAAK;AACxD,QAAI,QAAQ,SAAS,SAAU,YAAW,SAAS,OAAO,QAAQ,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EACxF;AACA,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AACzC;AAEO,IAAM,kBAAkB,CAAC,GAAG,qBAAqB;AACjD,IAAM,kBAAkB,CAAC,GAAG,qBAAqB;AAEjD,IAAM,cAAc,kBAAkB,kBAAkB,uBAAuB,YAAY;AAC3F,IAAM,kBAAkB,kBAAkB,kBAAkB,uBAAuB,SAAS;AAE5F,IAAM,mBAAmB,kBAAkB,kBAAkB,uBAAuB,YAAY;AAChG,IAAM,iBAAiB,kBAAkB,kBAAkB,uBAAuB,UAAU;AAC5F,IAAM,yBAAyB,kBAAkB,kBAAkB,uBAAuB,mBAAmB;;;AC/BpH,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAC1B,IAAM,eAAe;AAErB,SAAS,SAAS,OAAyB;AACzC,MAAI,YAAY,KAAK,EAAG,QAAO,EAAE,MAAM,OAAO,OAAO,MAAM;AAC3D,MAAI,aAAa,KAAK,KAAK,KAAK,kBAAkB,KAAK,KAAK,EAAG,QAAO,EAAE,MAAM,QAAQ,OAAO,MAAM;AACnG,MAAI,cAAc,KAAK,KAAK,EAAG,QAAO,EAAE,MAAM,MAAM,OAAO,MAAM;AACjE,QAAM,IAAI;AAAA,IACR;AAAA,IACA,IAAI,KAAK;AAAA,EACX;AACF;AAOO,SAAS,eAAe,MAA0B;AACvD,SAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO,EACd,IAAI,QAAQ;AACjB;AAOA,IAAM,cAAuC;AAAA,EAC3C,QAAQ,CAAC,QAAQ,QAA8B,sBAAsB,EAAE,KAAK,QAAQ,WAAW,CAAC;AAAA,EAChG,QAAQ,CAAC,SAAS,iBAAiB,EAAE,MAAM,MAAM,aAAa,uBAAuB,IAAI,GAAG,QAAQ,WAAW,CAAC;AAClH;AAiBA,eAAsB,uBACpB,MACA,OACA,OAAgC,aACkB;AAClD,QAAM,OAAO,eAAe,IAAI;AAChC,MAAI,SAAS,KAAK,SAAS,MAAM,KAAK;AACpC,UAAM,IAAI,SAAS,oBAAoB,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,EAClE;AACA,QAAM,WAAqB,CAAC;AAC5B,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,SAAS,MAAM;AACrB,eAAS,KAAK,IAAI,KAAK;AACvB;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,IACd,IAAI,SAAS,QAAQ,MAAM,KAAK,OAAO,IAAI,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,KAAK,EAAE,MAAM,cAAc,IAAI,KAAK,CAAC;AACjH,aAAS,KAAK,OAAO;AACrB,UAAM,KAAK,OAAO;AAAA,EACpB;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAEA,SAAS,cAAc,MAAyC;AAC9D,SAAO,CAAC,UAAU;AAChB,QAAI,iBAAiB,SAAU,OAAM;AACrC,UAAM,IAAI,SAAS,oBAAoB,mBAAmB,IAAI,gBAAgB;AAAA,EAChF;AACF;","names":[]}

package/dist/{chunk-VZEDAFAR.js → chunk-HLXWKMTK.js}

@@ -1,6 +1,6 @@
 import {
   debugLogSetting
-} from "./chunk-HJEMOSPH.js";
+} from "./chunk-O6QKCJE4.js";
 
 // src/debugLog.ts
 import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
@@ -12,10 +12,10 @@ var MAX_BYTES = 64 * 1024 * 1024;
 var REDACTIONS = [
   [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
   // Authorization headers
-  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
-  // the literal `bk_`, so the company-key rule matched no part of the read-only
-  // credential a Session review runs with.
-  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not
+  // contain the literal `bk_`, so the company-key rule matched no part of the
+  // read-only credentials a Session review or a published report runs with.
+  [/\b(bk[rv]?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
   // Baker API keys
   [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
   // JWTs / id tokens
@@ -33,6 +33,45 @@ function redactSecrets(input) {
   }
   return out;
 }
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
 function resolveTarget() {
   const raw = debugLogSetting();
   if (!raw) {
@@ -98,7 +137,7 @@ function errorToPlain(err) {
 var invocationStartedAt;
 function logInvocation(argv) {
   invocationStartedAt = Date.now();
-  append({ kind: "invocation", argv, cwd: process.cwd() });
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
 }
 function logExit(code) {
   append({
@@ -127,7 +166,7 @@ function debugLogHttp(entry) {
     method: entry.method,
     url: entry.url,
     durationMs: entry.durationMs,
-    request: entry.requestBody,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
     status: entry.status,
     ok: entry.ok,
     response: entry.responseBody,
@@ -173,4 +212,4 @@ export {
   readBodyForLog,
   installStreamTaps
 };
-//# sourceMappingURL=chunk-VZEDAFAR.js.map
+//# sourceMappingURL=chunk-HLXWKMTK.js.map

package/dist/chunk-HLXWKMTK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not\n  // contain the literal `bk_`, so the company-key rule matched no part of the\n  // read-only credentials a Session review or a published report runs with.\n  [/\\b(bk[rv]?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,6BAA6B,eAAe;AAAA;AAAA,EAC7C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/{chunk-MF7YA62W.js → chunk-HREWXNTO.js}

@@ -1,10 +1,10 @@
 import {
   debugLogHttp,
   readBodyForLog
-} from "./chunk-VZEDAFAR.js";
+} from "./chunk-HLXWKMTK.js";
 import {
   getEnv
-} from "./chunk-HJEMOSPH.js";
+} from "./chunk-O6QKCJE4.js";
 
 // src/client.ts
 var MAX_RATE_LIMIT_RETRIES = 3;
@@ -63,8 +63,13 @@ function sanitizeParams(params) {
   return sanitized;
 }
 function chatHeader() {
-  const chatId = getEnv().BAKER_CHAT_ID;
-  return chatId ? { "x-baker-chat-id": chatId } : {};
+  const { BAKER_CHAT_ID: chatId, BAKER_THREAD_ID: threadId, BAKER_KEY_SCOPE: keyScope } = getEnv();
+  return {
+    ...chatId ? { "x-baker-chat-id": chatId } : {},
+    ...threadId ? { "x-baker-thread-id": threadId } : {},
+    // Only ever narrows the key (`KEY_SCOPE_HEADER` in the backend).
+    ...keyScope ? { "x-baker-key-scope": keyScope } : {}
+  };
 }
 function mapHttpError(status) {
   if (status === 401) {
@@ -208,4 +213,4 @@ export {
   apiGet,
   apiPost
 };
-//# sourceMappingURL=chunk-MF7YA62W.js.map
+//# sourceMappingURL=chunk-HREWXNTO.js.map

package/dist/chunk-HREWXNTO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { debugLogHttp, readBodyForLog } from \"./debugLog.ts\";\nimport { getEnv } from \"./env.ts\";\n\nconst MAX_RATE_LIMIT_RETRIES = 3;\nconst MAX_TOTAL_WAIT_MS = 2 * 60 * 1000;\n\nasync function fetchWithRateLimitRetry(url: string, init: RequestInit): Promise<Response> {\n  let totalWaited = 0;\n\n  for (let attempt = 0; attempt <= MAX_RATE_LIMIT_RETRIES; attempt++) {\n    const response = await fetch(url, init);\n\n    if (response.status !== 429 || attempt >= MAX_RATE_LIMIT_RETRIES) {\n      return response;\n    }\n\n    const retryAfterHeader = response.headers.get(\"Retry-After\");\n    const waitMs = retryAfterHeader ? Number(retryAfterHeader) * 1000 : 2000 * 2 ** attempt;\n\n    if (totalWaited + waitMs > MAX_TOTAL_WAIT_MS) {\n      return response;\n    }\n\n    totalWaited += waitMs;\n    await new Promise((resolve) => setTimeout(resolve, waitMs));\n  }\n\n  return fetch(url, init);\n}\n\nexport type ErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"FORBIDDEN\"\n  | \"NOT_FOUND\"\n  | \"CONFLICT\"\n  | \"VALIDATION_ERROR\"\n  | \"RATE_LIMITED\"\n  | \"UNAVAILABLE\"\n  | \"INTERNAL_ERROR\"\n  | \"NETWORK_ERROR\"\n  | \"TIMEOUT\"\n  | \"IMAGE_PROCESSING_ERROR\";\n\nexport class ApiError extends Error {\n  code: ErrorCode;\n\n  constructor(code: ErrorCode, message: string) {\n    super(message);\n    this.name = \"ApiError\";\n    this.code = code;\n  }\n}\n\nconst CONVEX_ID_RE = /^[a-zA-Z0-9_]+$/;\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    // Allow tab (9), newline (10), carriage return (13)\n    if (code < 32 && code !== 9 && code !== 10 && code !== 13) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction validateStringValue(value: string): void {\n  if (hasControlCharacters(value)) {\n    throw new ApiError(\"VALIDATION_ERROR\", \"String value contains invalid control characters\");\n  }\n}\n\nexport function validateConvexId(id: string): void {\n  if (!CONVEX_ID_RE.test(id)) {\n    throw new ApiError(\"VALIDATION_ERROR\", `Invalid ID format: \"${id}\". Expected alphanumeric string.`);\n  }\n}\n\nfunction sanitizeParams(params: Record<string, string>): Record<string, string> {\n  const sanitized: Record<string, string> = {};\n  for (const [key, value] of Object.entries(params)) {\n    validateStringValue(value);\n    sanitized[key] = value;\n  }\n  return sanitized;\n}\n\n/**\n * Sent on every call so the backend can attribute immediately-applied writes\n * (library images and videos, followed advertisers) to the Session they were\n * made from, and vouch for the acting user against the sender of the turn's own\n * thread. Absent outside a chat-attached environment.\n */\nfunction chatHeader(): Record<string, string> {\n  const { BAKER_CHAT_ID: chatId, BAKER_THREAD_ID: threadId, BAKER_KEY_SCOPE: keyScope } = getEnv();\n  return {\n    ...(chatId ? { \"x-baker-chat-id\": chatId } : {}),\n    ...(threadId ? { \"x-baker-thread-id\": threadId } : {}),\n    // Only ever narrows the key (`KEY_SCOPE_HEADER` in the backend).\n    ...(keyScope ? { \"x-baker-key-scope\": keyScope } : {}),\n  };\n}\n\nfunction mapHttpError(status: number): ErrorCode {\n  if (status === 401) {\n    return \"UNAUTHORIZED\";\n  }\n  // 403 is never \"not connected\" — every backend `FORBIDDEN` means connected but\n  // not allowed (an asset outside the granted scope, a capability the account\n  // lacks). Folding it into UNAUTHORIZED sent agents down the reconnect path,\n  // which cannot fix a permission gap and wastes the user's time.\n  if (status === 403) {\n    return \"FORBIDDEN\";\n  }\n  if (status === 404) {\n    return \"NOT_FOUND\";\n  }\n  if (status === 422 || status === 400) {\n    return \"VALIDATION_ERROR\";\n  }\n  // 409 is a state the caller has to change, never a fault to sit out. It is\n  // what the backend returns for \"this workspace has not switched analytics on\n  // yet\" and its siblings — folded into INTERNAL_ERROR, that reaches an agent\n  // as a transient failure worth retrying, which it never is.\n  if (status === 409) {\n    return \"CONFLICT\";\n  }\n  if (status === 429) {\n    return \"RATE_LIMITED\";\n  }\n  // 503 is the backend's `UNAVAILABLE`: a system it depends on did not answer\n  // just now, and asking again is the fix. Folded into INTERNAL_ERROR, it reads\n  // exactly like a fault of ours, and the agent cannot tell which one waits out.\n  if (status === 503) {\n    return \"UNAVAILABLE\";\n  }\n  return \"INTERNAL_ERROR\";\n}\n\nasync function handleResponse<T>(response: Response): Promise<T> {\n  const body = await response.text();\n\n  if (!response.ok) {\n    let message = `HTTP ${response.status}: ${response.statusText}`;\n    try {\n      const parsed = JSON.parse(body) as { error?: string | { message?: string }; message?: string };\n      if (typeof parsed.error === \"string\") {\n        message = parsed.error;\n      } else if (parsed.error?.message) {\n        message = parsed.error.message;\n      } else if (parsed.message) {\n        message = parsed.message;\n      }\n    } catch {\n      // Use default message\n    }\n    throw new ApiError(mapHttpError(response.status), message);\n  }\n\n  try {\n    return JSON.parse(body) as T;\n  } catch {\n    throw new ApiError(\"INTERNAL_ERROR\", \"Failed to parse API response as JSON\");\n  }\n}\n\n/**\n * A GET that also hands back the response headers.\n *\n * Some endpoints have to say something *about* the answer that the answer has\n * no room for — `GET /api/testimonials` returns a bare array and sets\n * `X-Baker-Next-Cursor` when rows past this page remain unexamined, so the rows\n * alone cannot tell one page of a library from the whole of it.\n */\nexport async function apiGetWithHeaders<T>(\n  path: string,\n  params?: Record<string, string>,\n): Promise<{ data: T; headers: Headers }> {\n  const env = getEnv();\n  const url = new URL(path, env.BAKER_API_URL);\n  if (params) {\n    const clean = sanitizeParams(params);\n    for (const [key, value] of Object.entries(clean)) {\n      url.searchParams.set(key, value);\n    }\n  }\n\n  const urlStr = url.toString();\n  const startedAt = Date.now();\n  let response: Response;\n  try {\n    response = await fetchWithRateLimitRetry(urlStr, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${env.BAKER_API_KEY}`,\n        Accept: \"application/json\",\n        ...chatHeader(),\n      },\n      signal: AbortSignal.timeout(60_000),\n    });\n  } catch (err) {\n    debugLogHttp({ source: \"cli\", method: \"GET\", url: urlStr, durationMs: Date.now() - startedAt, error: err });\n    if (err instanceof Error && (err.name === \"TimeoutError\" || err.name === \"AbortError\")) {\n      throw new ApiError(\"TIMEOUT\", \"Request timed out after 60 seconds\");\n    }\n    throw new ApiError(\"NETWORK_ERROR\", `Request failed: ${err instanceof Error ? err.message : \"Unknown error\"}`);\n  }\n\n  debugLogHttp({\n    source: \"cli\",\n    method: \"GET\",\n    url: urlStr,\n    status: response.status,\n    ok: response.ok,\n    responseBody: await readBodyForLog(response),\n    durationMs: Date.now() - startedAt,\n  });\n  return { data: await handleResponse<T>(response), headers: response.headers };\n}\n\nexport async function apiGet<T>(path: string, params?: Record<string, string>): Promise<T> {\n  return (await apiGetWithHeaders<T>(path, params)).data;\n}\n\nexport async function apiPost<T>(path: string, body: unknown, opts?: { timeoutMs?: number }): Promise<T> {\n  const env = getEnv();\n  const timeoutMs = opts?.timeoutMs ?? 60_000;\n  const urlStr = new URL(path, env.BAKER_API_URL).toString();\n  const startedAt = Date.now();\n  let response: Response;\n  try {\n    response = await fetchWithRateLimitRetry(urlStr, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${env.BAKER_API_KEY}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        ...chatHeader(),\n      },\n      body: JSON.stringify(body),\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n  } catch (err) {\n    debugLogHttp({\n      source: \"cli\",\n      method: \"POST\",\n      url: urlStr,\n      requestBody: body,\n      durationMs: Date.now() - startedAt,\n      error: err,\n    });\n    if (err instanceof Error && (err.name === \"TimeoutError\" || err.name === \"AbortError\")) {\n      throw new ApiError(\"TIMEOUT\", `Request timed out after ${Math.round(timeoutMs / 1000)} seconds`);\n    }\n    throw new ApiError(\"NETWORK_ERROR\", `Request failed: ${err instanceof Error ? err.message : \"Unknown error\"}`);\n  }\n\n  debugLogHttp({\n    source: \"cli\",\n    method: \"POST\",\n    url: urlStr,\n    requestBody: body,\n    status: response.status,\n    ok: response.ok,\n    responseBody: await readBodyForLog(response),\n    durationMs: Date.now() - startedAt,\n  });\n  return handleResponse<T>(response);\n}\n"],"mappings":";;;;;;;;;AAGA,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB,IAAI,KAAK;AAEnC,eAAe,wBAAwB,KAAa,MAAsC;AACxF,MAAI,cAAc;AAElB,WAAS,UAAU,GAAG,WAAW,wBAAwB,WAAW;AAClE,UAAM,WAAW,MAAM,MAAM,KAAK,IAAI;AAEtC,QAAI,SAAS,WAAW,OAAO,WAAW,wBAAwB;AAChE,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,SAAS,QAAQ,IAAI,aAAa;AAC3D,UAAM,SAAS,mBAAmB,OAAO,gBAAgB,IAAI,MAAO,MAAO,KAAK;AAEhF,QAAI,cAAc,SAAS,mBAAmB;AAC5C,aAAO;AAAA,IACT;AAEA,mBAAe;AACf,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM,CAAC;AAAA,EAC5D;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAeO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC;AAAA,EAEA,YAAY,MAAiB,SAAiB;AAC5C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,eAAe;AAErB,SAAS,qBAAqB,OAAwB;AACpD,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,MAAM,WAAW,CAAC;AAE/B,QAAI,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,IAAI;AACzD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAqB;AAChD,MAAI,qBAAqB,KAAK,GAAG;AAC/B,UAAM,IAAI,SAAS,oBAAoB,kDAAkD;AAAA,EAC3F;AACF;AAEO,SAAS,iBAAiB,IAAkB;AACjD,MAAI,CAAC,aAAa,KAAK,EAAE,GAAG;AAC1B,UAAM,IAAI,SAAS,oBAAoB,uBAAuB,EAAE,kCAAkC;AAAA,EACpG;AACF;AAEA,SAAS,eAAe,QAAwD;AAC9E,QAAM,YAAoC,CAAC;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,wBAAoB,KAAK;AACzB,cAAU,GAAG,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAQA,SAAS,aAAqC;AAC5C,QAAM,EAAE,eAAe,QAAQ,iBAAiB,UAAU,iBAAiB,SAAS,IAAI,OAAO;AAC/F,SAAO;AAAA,IACL,GAAI,SAAS,EAAE,mBAAmB,OAAO,IAAI,CAAC;AAAA,IAC9C,GAAI,WAAW,EAAE,qBAAqB,SAAS,IAAI,CAAC;AAAA;AAAA,IAEpD,GAAI,WAAW,EAAE,qBAAqB,SAAS,IAAI,CAAC;AAAA,EACtD;AACF;AAEA,SAAS,aAAa,QAA2B;AAC/C,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AAKA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AAKA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AAIA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,eAAe,eAAkB,UAAgC;AAC/D,QAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,UAAU,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAC7D,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,OAAO,OAAO,UAAU,UAAU;AACpC,kBAAU,OAAO;AAAA,MACnB,WAAW,OAAO,OAAO,SAAS;AAChC,kBAAU,OAAO,MAAM;AAAA,MACzB,WAAW,OAAO,SAAS;AACzB,kBAAU,OAAO;AAAA,MACnB;AAAA,IACF,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,SAAS,aAAa,SAAS,MAAM,GAAG,OAAO;AAAA,EAC3D;AAEA,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,SAAS,kBAAkB,sCAAsC;AAAA,EAC7E;AACF;AAUA,eAAsB,kBACpB,MACA,QACwC;AACxC,QAAM,MAAM,OAAO;AACnB,QAAM,MAAM,IAAI,IAAI,MAAM,IAAI,aAAa;AAC3C,MAAI,QAAQ;AACV,UAAM,QAAQ,eAAe,MAAM;AACnC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,SAAS;AAC5B,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wBAAwB,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,IAAI,aAAa;AAAA,QAC1C,QAAQ;AAAA,QACR,GAAG,WAAW;AAAA,MAChB;AAAA,MACA,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,iBAAa,EAAE,QAAQ,OAAO,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,IAAI,WAAW,OAAO,IAAI,CAAC;AAC1G,QAAI,eAAe,UAAU,IAAI,SAAS,kBAAkB,IAAI,SAAS,eAAe;AACtF,YAAM,IAAI,SAAS,WAAW,oCAAoC;AAAA,IACpE;AACA,UAAM,IAAI,SAAS,iBAAiB,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe,EAAE;AAAA,EAC/G;AAEA,eAAa;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,IAAI,SAAS;AAAA,IACb,cAAc,MAAM,eAAe,QAAQ;AAAA,IAC3C,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACD,SAAO,EAAE,MAAM,MAAM,eAAkB,QAAQ,GAAG,SAAS,SAAS,QAAQ;AAC9E;AAEA,eAAsB,OAAU,MAAc,QAA6C;AACzF,UAAQ,MAAM,kBAAqB,MAAM,MAAM,GAAG;AACpD;AAEA,eAAsB,QAAW,MAAc,MAAe,MAA2C;AACvG,QAAM,MAAM,OAAO;AACnB,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,SAAS,IAAI,IAAI,MAAM,IAAI,aAAa,EAAE,SAAS;AACzD,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wBAAwB,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,IAAI,aAAa;AAAA,QAC1C,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,GAAG,WAAW;AAAA,MAChB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,iBAAa;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,aAAa;AAAA,MACb,YAAY,KAAK,IAAI,IAAI;AAAA,MACzB,OAAO;AAAA,IACT,CAAC;AACD,QAAI,eAAe,UAAU,IAAI,SAAS,kBAAkB,IAAI,SAAS,eAAe;AACtF,YAAM,IAAI,SAAS,WAAW,2BAA2B,KAAK,MAAM,YAAY,GAAI,CAAC,UAAU;AAAA,IACjG;AACA,UAAM,IAAI,SAAS,iBAAiB,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe,EAAE;AAAA,EAC/G;AAEA,eAAa;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ,SAAS;AAAA,IACjB,IAAI,SAAS;AAAA,IACb,cAAc,MAAM,eAAe,QAAQ;AAAA,IAC3C,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACD,SAAO,eAAkB,QAAQ;AACnC;","names":[]}