@koda-sl/baker-cli 0.449.0 → 0.451.0-dev.b2a4eba2b

package/dist/chunk-IFWP3ZDO.js

@@ -1,215 +0,0 @@
-import {
-  debugLogSetting
-} from "./chunk-NAWWC5I3.js";
-
-// src/debugLog.ts
-import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
-var DEFAULT_FILE = "baker-cli-debug.jsonl";
-var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
-var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
-var MAX_BYTES = 64 * 1024 * 1024;
-var REDACTIONS = [
-  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
-  // Authorization headers
-  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
-  // the literal `bk_`, so the company-key rule matched no part of the read-only
-  // credential a Session review runs with.
-  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
-  // Baker API keys
-  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
-  // JWTs / id tokens
-  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
-  // Google OAuth access tokens
-  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
-  // Google refresh tokens
-  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
-  // Meta/Facebook access tokens
-];
-function redactSecrets(input) {
-  let out = input;
-  for (const [pattern, replacement] of REDACTIONS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-var CREDENTIAL_VALUE = "[credential value]";
-var CREDENTIAL_PUT_PATH = "/api/credentials/put";
-function withoutCredentialValue(url, body) {
-  let path;
-  try {
-    path = new URL(url).pathname;
-  } catch {
-    path = url;
-  }
-  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
-    return body;
-  }
-  return { ...body, value: CREDENTIAL_VALUE };
-}
-var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
-function argvWithoutCredentialValue(argv) {
-  if (argv[0] !== "credentials" || argv[1] !== "put") {
-    return argv;
-  }
-  let nameSeen = false;
-  let keepNext = false;
-  let redactNext = false;
-  return argv.map((arg, index) => {
-    if (index < 2) return arg;
-    if (keepNext || redactNext) {
-      const kept = keepNext ? arg : CREDENTIAL_VALUE;
-      keepNext = false;
-      redactNext = false;
-      return kept;
-    }
-    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
-    redactNext = arg === "--value";
-    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
-    if (arg.startsWith("-")) return arg;
-    const isName = !nameSeen;
-    nameSeen = true;
-    return isName ? arg : CREDENTIAL_VALUE;
-  });
-}
-function resolveTarget() {
-  const raw = debugLogSetting();
-  if (!raw) {
-    return void 0;
-  }
-  const lower = raw.toLowerCase();
-  if (BOOLEAN_OFF.has(lower)) {
-    return void 0;
-  }
-  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
-  return isAbsolute(target) ? target : resolve(process.cwd(), target);
-}
-function isDebugLogEnabled() {
-  return resolveTarget() !== void 0;
-}
-var sessionId;
-function getSessionId() {
-  if (!sessionId) {
-    sessionId = `${process.pid}-${Date.now()}`;
-  }
-  return sessionId;
-}
-var trackedPath;
-var bytesInFile = 0;
-function ensureReady(filePath) {
-  if (trackedPath !== filePath) {
-    trackedPath = filePath;
-    mkdirSync(dirname(filePath), { recursive: true });
-    try {
-      bytesInFile = statSync(filePath).size;
-    } catch {
-      bytesInFile = 0;
-    }
-  }
-}
-function append(entry) {
-  const filePath = resolveTarget();
-  if (!filePath) {
-    return;
-  }
-  try {
-    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
-    const line = `${redactSecrets(JSON.stringify(payload))}
-`;
-    ensureReady(filePath);
-    const size = Buffer.byteLength(line);
-    if (bytesInFile + size > MAX_BYTES) {
-      renameSync(filePath, `${filePath}.1`);
-      bytesInFile = 0;
-    }
-    appendFileSync(filePath, line);
-    bytesInFile += size;
-  } catch {
-  }
-}
-function errorToPlain(err) {
-  if (err instanceof Error) {
-    const code = err.code;
-    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
-  }
-  return { message: String(err) };
-}
-var invocationStartedAt;
-function logInvocation(argv) {
-  invocationStartedAt = Date.now();
-  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
-}
-function logExit(code) {
-  append({
-    kind: "exit",
-    code,
-    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
-  });
-}
-var exitHookInstalled = false;
-function installExitRecord() {
-  if (exitHookInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  exitHookInstalled = true;
-  process.on("exit", (code) => {
-    logExit(typeof code === "number" ? code : 0);
-  });
-}
-function debugLogHttp(entry) {
-  if (!isDebugLogEnabled()) {
-    return;
-  }
-  append({
-    kind: "http",
-    source: entry.source,
-    method: entry.method,
-    url: entry.url,
-    durationMs: entry.durationMs,
-    request: withoutCredentialValue(entry.url, entry.requestBody),
-    status: entry.status,
-    ok: entry.ok,
-    response: entry.responseBody,
-    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
-  });
-}
-async function readBodyForLog(response) {
-  if (!isDebugLogEnabled()) {
-    return void 0;
-  }
-  try {
-    return await response.clone().text();
-  } catch {
-    return void 0;
-  }
-}
-function tapStream(name, stream) {
-  const original = stream.write.bind(stream);
-  const decoder = new TextDecoder("utf-8");
-  stream.write = ((chunk, ...rest) => {
-    try {
-      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
-      append({ kind: "output", stream: name, text });
-    } catch {
-    }
-    return original(chunk, ...rest);
-  });
-}
-var tapsInstalled = false;
-function installStreamTaps() {
-  if (tapsInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  tapsInstalled = true;
-  tapStream("stdout", process.stdout);
-  tapStream("stderr", process.stderr);
-}
-
-export {
-  logInvocation,
-  installExitRecord,
-  debugLogHttp,
-  readBodyForLog,
-  installStreamTaps
-};
-//# sourceMappingURL=chunk-IFWP3ZDO.js.map

package/dist/chunk-IFWP3ZDO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/chunk-IR6D7K4H.js

@@ -1,382 +0,0 @@
-import {
-  AUTO_PUBLISH_REFUSAL,
-  TRIGGER_KINDS,
-  TRIGGER_KIND_IDS,
-  TRIGGER_TARGETS,
-  TRIGGER_TARGET_FIELDS,
-  TRIGGER_TARGET_FIELD_IDS,
-  firstTimes,
-  isTriggerKind,
-  parseConditionsExpression
-} from "./chunk-XF4JUKVF.js";
-import {
-  ApiError,
-  validateConvexId
-} from "./chunk-XBOK23HI.js";
-import {
-  getEnv
-} from "./chunk-NAWWC5I3.js";
-import {
-  writeJson
-} from "./chunk-NU7JSWVA.js";
-
-// src/commands/scheduled-agents/shared.ts
-var TEMP_SCHEDULED_AGENT_PREFIX = "temp_agent_";
-var TEMP_ID_PREFIX = "temp_";
-function writeOk(data, hints) {
-  writeJson({ ok: true, data: data ?? null, ...hints && hints.length > 0 ? { hints } : {} });
-}
-function failValidation(message) {
-  writeJson({ ok: false, error: { code: "VALIDATION_ERROR", message } });
-  process.exit(1);
-}
-function failApi(err) {
-  if (err instanceof ApiError) {
-    writeJson({ ok: false, error: { code: err.code, message: err.message } });
-    process.exit(1);
-  }
-  if (err instanceof Error) {
-    writeJson({ ok: false, error: { code: "INTERNAL_ERROR", message: err.message } });
-    process.exit(1);
-  }
-  writeJson({ ok: false, error: { code: "INTERNAL_ERROR", message: "Unexpected error" } });
-  process.exit(1);
-}
-var AUTO_PUBLISH_ARG = {
-  "auto-publish": {
-    type: "string",
-    description: "Not available to the agent: publishing every run unreviewed is switched on by the user, on the item, after this chat is published. Passing it is refused and tells you what to ask them.",
-    required: false
-  }
-};
-function refuseAutoPublish(args) {
-  if (args["auto-publish"] === void 0) {
-    return;
-  }
-  writeJson({
-    ok: false,
-    error: {
-      code: "FORBIDDEN",
-      message: AUTO_PUBLISH_REFUSAL,
-      fix: {
-        action: "ask_user",
-        explanation: 'Run the command again without --auto-publish. After this chat is published, ask the user to open the item in Scheduled agents and switch on "Publish its work on its own" under "When a run finishes" \u2014 until then each run waits for their review.'
-      }
-    }
-  });
-  process.exit(1);
-}
-function isTempScheduledAgentId(id) {
-  return id.startsWith(TEMP_SCHEDULED_AGENT_PREFIX);
-}
-function isOtherTempId(id) {
-  return id.startsWith(TEMP_ID_PREFIX) && !isTempScheduledAgentId(id);
-}
-function validateScheduledAgentRef(ref) {
-  if (isOtherTempId(ref)) {
-    failValidation(`Scheduled agent temp IDs must start with ${TEMP_SCHEDULED_AGENT_PREFIX}.`);
-  }
-  if (!isTempScheduledAgentId(ref)) {
-    validateConvexId(ref);
-  }
-}
-var TRIGGER_ARG_DESCRIPTION = `What makes this run. ${TRIGGER_KIND_IDS.map(
-  (id) => `${id}: ${TRIGGER_KINDS[id].description}`
-).join(" ")} For the two time ones, pass --cron or --run-at instead and the kind is implied.`;
-var TRIGGER_KIND_LIST = [...TRIGGER_KIND_IDS];
-var NARROWING_DESCRIPTIONS = {
-  eventName: "With --trigger event.received: only this event name (a source's name, or one your site sends). Omit it to run on any event.",
-  toolkit: "With --trigger app.event (required): the connected tool, by its slug \u2014 gmail, slack, googlesheets.",
-  account: "With --trigger app.event (required): which connected account of that tool, by id (a tool can be connected more than once).",
-  appEvent: "With --trigger app.event (required): what happens in the tool, by the tool's own id \u2014 GMAIL_NEW_GMAIL_MESSAGE. `targets --field appEvent --app <tool>` lists them with the settings each needs.",
-  provider: "With --trigger connection.created, connection.removed or connection.needs_reconnect: only this tool (google-ads, hubspot, meta, or a connected tool's slug such as slack). Omit it for any tool.",
-  flowId: "With --trigger form.submitted or flow.step.submitted: which Form, by slug. Omit it on form.submitted for any Form.",
-  stepId: "With --trigger flow.step.submitted: which step of that Form, by id \u2014 `targets --field stepId --form <slug>` lists them by name.",
-  page: "With --trigger landing.created or landing.published: only this page, by slug. Omit it for any page.",
-  tag: "With --trigger task.created, task.claimed, task.completed, landing.created or landing.published: only ones carrying this tag. Omit it for any.",
-  experimentId: 'With --trigger experiment.decided, experiment.ended or experiment.concluded: only this test. Omit it for any test. Not for experiment.started \u2014 narrow that with --when "page = <page>".',
-  taskId: "With --trigger task.claimed or task.completed: only this Task, by id (a temp_ id of a Task staged in this chat works too). Omit it for any Task.",
-  agentId: "With --trigger session.published, session.publish_failed or session.publish_incomplete: only the runs of this scheduled agent, by id (a temp_agent_ id staged in this chat works too). Omit it for any agent's work.",
-  platform: "With --trigger session.publish_incomplete: only when this platform's changes did not all land \u2014 google-ads, meta-ads, linkedin-ads, x-ads, tag-manager or ga4. Omit it for any.",
-  collection: "With --trigger knowledge.updated: only this Knowledge collection. Omit it for any of them.",
-  sourceId: "With --trigger review.received: only reviews from this review source, by id. Omit it for any source.",
-  advertiserId: "With --trigger advertiser.new_ads: only this followed advertiser, by id. Omit it for any of them."
-};
-var NARROWING_ARGS = {
-  ...Object.fromEntries(
-    TRIGGER_TARGET_FIELD_IDS.map((field) => [
-      TRIGGER_TARGET_FIELDS[field].flag,
-      {
-        type: "string",
-        description: `${NARROWING_DESCRIPTIONS[field]} \`baker scheduled-agents targets --trigger <kind> --field ${field}\` lists the values.`,
-        required: false
-      }
-    ])
-  ),
-  config: {
-    type: "string",
-    description: `With --trigger app.event: the event's own settings as a JSON object \u2014 they filter inside the tool, before anything is sent. A Gmail search ('{"query":"from:ana@acme.com"}'), a label, a Slack channel, a GitHub repository ('{"owner":"acme","repo":"site"}'). \`targets --field appEvent --app <tool> --event <id>\` lists each setting with its examples.`,
-    required: false
-  }
-};
-function validateRunAt(runAt) {
-  if (!runAt.endsWith("Z")) {
-    failValidation("--run-at must be an ISO UTC timestamp ending in Z.");
-  }
-  const parsed = Date.parse(runAt);
-  if (!Number.isFinite(parsed)) {
-    failValidation("--run-at must be a valid ISO timestamp.");
-  }
-  if (parsed <= Date.now()) {
-    failValidation(
-      `--run-at ${runAt} has already passed. A one-off item only runs at a time still to come \u2014 pass a later ISO UTC timestamp, and check which timezone you converted from if you worked it out from a local time.`
-    );
-  }
-}
-function buildTriggerBody(args, options) {
-  const cron = args.cron;
-  const runAt = args["run-at"];
-  const timezone = args.timezone;
-  const kind = args.trigger;
-  const given = [cron, runAt, kind].filter(Boolean).length;
-  if (given > 1) {
-    failValidation("--cron, --run-at and --trigger are mutually exclusive.");
-  }
-  refuseNarrowingWithoutKind(args, kind, given);
-  if (runAt) {
-    validateRunAt(runAt);
-    return { runAt, ...timezone ? { timezone } : {} };
-  }
-  if (cron) {
-    return { cron, ...timezone ? { timezone } : {} };
-  }
-  if (kind) {
-    return { trigger: triggerFromFlags(kind, args), ...timezone ? { timezone } : {} };
-  }
-  if (timezone && !options.required) {
-    return { timezone };
-  }
-  if (options.required) {
-    failValidation(
-      `A trigger is required. Pass --cron or --run-at for a time-based one, or --trigger with one of: ${TRIGGER_KIND_IDS.join(", ")}.`
-    );
-  }
-  return void 0;
-}
-function flagText(args, key) {
-  const value = args[key];
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function refuseMisusedKinds(kind, args) {
-  if (kind === "time.once") {
-    failValidation("Use --run-at for a one-off, rather than --trigger time.once.");
-  }
-  if (kind === "time.cron") {
-    failValidation("Use --cron for a repeating schedule, rather than --trigger time.cron.");
-  }
-  if (kind === "experiment.started" && flagText(args, "experiment")) {
-    failValidation(
-      'A test that exists has already started, so --experiment never fires on experiment.started. Leave it off and add --when "page = <page>" to watch one page.'
-    );
-  }
-}
-function refuseStrayFlags(kind, args) {
-  const allowed = new Set(TRIGGER_TARGETS[kind].map((target) => TRIGGER_TARGET_FIELDS[target.field].flag));
-  const stray = TRIGGER_TARGET_FIELD_IDS.map((field) => TRIGGER_TARGET_FIELDS[field].flag).filter(
-    (flag) => !allowed.has(flag) && flagText(args, flag) !== void 0 && !(kind === "experiment.started" && flag === "experiment")
-  );
-  if (stray.length === 0) {
-    return;
-  }
-  failValidation(
-    `${stray.map((flag) => `--${flag}`).join(", ")} does not narrow ${kind}. ${allowed.size > 0 ? `It can be pointed with ${[...allowed].map((flag) => `--${flag}`).join(", ")}.` : "It runs every time it happens \u2014 narrow it with --when rules over its payload instead."}`
-  );
-}
-var NARROWING_FLAGS = [...TRIGGER_TARGET_FIELD_IDS.map((field) => TRIGGER_TARGET_FIELDS[field].flag), "config"];
-function refuseNarrowingWithoutKind(args, kind, given) {
-  if (kind) {
-    return;
-  }
-  const stray = NARROWING_FLAGS.filter((flag) => flagText(args, flag) !== void 0);
-  if (stray.length === 0) {
-    return;
-  }
-  const flags = stray.map((flag) => `--${flag}`).join(", ");
-  failValidation(
-    given > 0 ? `${flags} does not narrow --cron or --run-at: a time trigger runs every time it comes round. Use --trigger <kind> with ${flags} instead, or leave ${flags} off.` : `${flags} narrows a trigger, and no trigger was given. Pass --trigger <kind> too \u2014 the item's whole trigger, with ${flags} \u2014 or leave ${flags} off.`
-  );
-}
-function configFromFlag(kind, args) {
-  const config = flagText(args, "config");
-  if (!config) {
-    return {};
-  }
-  if (kind !== "app.event") {
-    failValidation("--config is only for --trigger app.event: the settings of what happens in the tool.");
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(config);
-  } catch {
-    parsed = null;
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    failValidation(`--config must be a JSON object, e.g. '{"labelIds":"INBOX"}'.`);
-  }
-  return { configJson: config };
-}
-function triggerFromFlags(kind, args) {
-  if (!isTriggerKind(kind)) {
-    failValidation(`--trigger must be one of: ${TRIGGER_KIND_IDS.join(", ")}.`);
-  }
-  refuseMisusedKinds(kind, args);
-  refuseStrayFlags(kind, args);
-  const narrowings = {};
-  for (const { field, required } of TRIGGER_TARGETS[kind]) {
-    const value = flagText(args, TRIGGER_TARGET_FIELDS[field].flag);
-    if (value) {
-      narrowings[field] = value;
-    } else if (required) {
-      failValidation(
-        `--trigger ${kind} needs --${TRIGGER_TARGET_FIELDS[field].flag}. \`baker scheduled-agents targets --trigger ${kind} --field ${field}\` lists what it can be.`
-      );
-    }
-  }
-  return { kind, ...narrowings, ...configFromFlag(kind, args) };
-}
-function parseOccurrences(raw) {
-  if (raw === void 0) {
-    return void 0;
-  }
-  if (typeof raw !== "string") {
-    failValidation("--occurrences must be a comma-separated list of whole numbers, e.g. 1 or 1,3.");
-  }
-  const parts = raw.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
-  const numbers = parts.map((part) => Number(part));
-  if (numbers.length === 0 || numbers.some((n) => !Number.isInteger(n) || n <= 0)) {
-    failValidation("--occurrences must be a comma-separated list of whole numbers above zero, e.g. 1 or 1,3.");
-  }
-  return numbers;
-}
-function parseBooleanFlag(raw, flagName) {
-  if (raw === void 0) {
-    return void 0;
-  }
-  if (raw === true || raw === "true") {
-    return true;
-  }
-  if (raw === false || raw === "false") {
-    return false;
-  }
-  failValidation(`${flagName} must be true or false.`);
-}
-var REACTION_ARGS = {
-  when: {
-    type: "string",
-    description: "Only run when what arrived passes these rules: `<field> <operator> <value>` joined by AND or by OR (either case). Fields are the trigger's payload fields (`baker scheduled-agents triggers --trigger <kind>` lists them; a webhook's are whatever was posted; an app.event's are what `targets --field appEvent --app <tool> --event <id>` says it sends). Operators: =, !=, contains, does not contain, starts with, ends with, >, <, >=, <=, in (comma list), exists, missing. Example: --when \"deal.stage = won AND amount > 10000\". A payload that fails is not counted and starts nothing. `none` clears the rules.",
-    required: false
-  },
-  times: {
-    type: "string",
-    description: "Only the first N times it fires (and its --when rules pass), then never again. `--times 1` is only the first time. Shorthand for --occurrences 1,2,\u2026,N.",
-    required: false
-  },
-  payload: {
-    type: "string",
-    description: "include (default) or omit. Whether the run's first message carries what arrived \u2014 the posted body, the event's properties, the Form's answers (emails and phones masked). Place single values in --prompt with {{payload.<field>}} instead; those are filled either way.",
-    required: false
-  },
-  cooldown: {
-    type: "string",
-    description: "At most one run per this many minutes, however often it fires. 0 removes it.",
-    required: false
-  }
-};
-var SLACK_ARG = {
-  slack: {
-    type: "string",
-    description: "Tell each run in Slack: `here` (the Slack conversation this chat came from), `me` (a direct message to the person in this chat), `#channel` (a channel linked to this company), or `off`. Each run opens its own thread there and Baker reports on it: what it found, what it needs, whether to publish.",
-    required: false
-  }
-};
-function slackBody(args) {
-  return typeof args.slack === "string" && args.slack.trim().length > 0 ? { slack: args.slack.trim() } : {};
-}
-function wholeNumber(raw, flag, { min }) {
-  if (raw === void 0) {
-    return void 0;
-  }
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value < min) {
-    failValidation(`${flag} must be a whole number of at least ${min}.`);
-  }
-  return value;
-}
-function reactionBody(args) {
-  const occurrences = occurrencesFromFlags(args);
-  const when = whenFromFlag(args.when);
-  const includePayload = payloadFromFlag(args.payload);
-  const cooldownMinutes = wholeNumber(args.cooldown, "--cooldown", { min: 0 });
-  return {
-    ...occurrences !== void 0 ? { occurrences } : {},
-    ...when !== void 0 ? { when } : {},
-    ...includePayload !== void 0 ? { includePayload } : {},
-    ...cooldownMinutes !== void 0 ? { cooldownMinutes } : {}
-  };
-}
-function occurrencesFromFlags(args) {
-  const times = wholeNumber(args.times, "--times", { min: 1 });
-  const occurrences = parseOccurrences(args.occurrences);
-  if (times !== void 0 && occurrences !== void 0) {
-    failValidation("Pass --times or --occurrences, not both \u2014 --times 3 is --occurrences 1,2,3.");
-  }
-  return times !== void 0 ? firstTimes(times) : occurrences;
-}
-function whenFromFlag(raw) {
-  if (typeof raw !== "string") {
-    return void 0;
-  }
-  const text = raw.trim();
-  if (text.length === 0 || text.toLowerCase() === "none") {
-    return "none";
-  }
-  const parsed = parseConditionsExpression(text);
-  if (!parsed.ok) {
-    failValidation(parsed.error);
-  }
-  return text;
-}
-function payloadFromFlag(raw) {
-  if (raw === void 0) {
-    return void 0;
-  }
-  if (raw !== "include" && raw !== "omit") {
-    failValidation("--payload must be include or omit.");
-  }
-  return raw === "include";
-}
-function chatBody() {
-  const id = getEnv().BAKER_CHAT_ID;
-  return id ? { chatId: id } : {};
-}
-
-export {
-  writeOk,
-  failValidation,
-  failApi,
-  AUTO_PUBLISH_ARG,
-  refuseAutoPublish,
-  isTempScheduledAgentId,
-  validateScheduledAgentRef,
-  TRIGGER_ARG_DESCRIPTION,
-  TRIGGER_KIND_LIST,
-  NARROWING_ARGS,
-  buildTriggerBody,
-  parseBooleanFlag,
-  REACTION_ARGS,
-  SLACK_ARG,
-  slackBody,
-  reactionBody,
-  chatBody
-};
-//# sourceMappingURL=chunk-IR6D7K4H.js.map