@koda-sl/baker-cli 0.449.0 → 0.451.0-dev.b2a4eba2b

package/dist/chunk-LSEYIZ5K.js

@@ -0,0 +1,56 @@
+import {
+  ApiError,
+  apiGet
+} from "./chunk-PCKVSSVT.js";
+import {
+  compactImage,
+  compactVideo,
+  writeJson
+} from "./chunk-NU7JSWVA.js";
+
+// src/commands/mediaGroup.ts
+async function runMediaGroupLookup(input) {
+  if (!input.id && !input.groupKey) {
+    writeJson({
+      ok: false,
+      error: { code: "VALIDATION_ERROR", message: `Pass ${input.idLabel} or --group-key` }
+    });
+    process.exit(1);
+  }
+  try {
+    const query = new URLSearchParams();
+    if (input.id) query.set("id", input.id);
+    if (input.groupKey) query.set("groupKey", input.groupKey);
+    const data = await apiGet(`${input.path}?${query.toString()}`);
+    const images = data.images.map((image) => compactImage(image));
+    const videos = (data.videos ?? []).map((video) => compactVideo(video));
+    const count = images.length + videos.length;
+    writeJson({
+      ok: true,
+      data: {
+        groupKey: data.groupKey,
+        groupKind: data.groupKind ?? null,
+        // The caption or page title the whole set shares — often the only
+        // place the campaign is named.
+        groupTitle: data.groupTitle ?? null,
+        groupUrl: data.groupUrl ?? null,
+        count,
+        images,
+        videos
+      },
+      hints: count > 1 ? ["These arrived together and are ordered. Read them in sequence before using any one of them alone."] : void 0
+    });
+  } catch (err) {
+    if (err instanceof ApiError) {
+      writeJson({ ok: false, error: { code: err.code, message: err.message } });
+      process.exit(1);
+    }
+    writeJson({ ok: false, error: { code: "INTERNAL_ERROR", message: "Unexpected error" } });
+    process.exit(1);
+  }
+}
+
+export {
+  runMediaGroupLookup
+};
+//# sourceMappingURL=chunk-LSEYIZ5K.js.map

package/dist/chunk-MCM3HMNZ.js

@@ -0,0 +1,215 @@
+import {
+  debugLogSetting
+} from "./chunk-UW36KPPH.js";
+
+// src/debugLog.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+var DEFAULT_FILE = "baker-cli-debug.jsonl";
+var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
+var MAX_BYTES = 64 * 1024 * 1024;
+var REDACTIONS = [
+  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
+  // Authorization headers
+  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not
+  // contain the literal `bk_`, so the company-key rule matched no part of the
+  // read-only credentials a Session review or a published report runs with.
+  [/\b(bk[rv]?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Baker API keys
+  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
+  // JWTs / id tokens
+  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
+  // Google OAuth access tokens
+  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
+  // Google refresh tokens
+  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
+  // Meta/Facebook access tokens
+];
+function redactSecrets(input) {
+  let out = input;
+  for (const [pattern, replacement] of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
+function resolveTarget() {
+  const raw = debugLogSetting();
+  if (!raw) {
+    return void 0;
+  }
+  const lower = raw.toLowerCase();
+  if (BOOLEAN_OFF.has(lower)) {
+    return void 0;
+  }
+  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
+  return isAbsolute(target) ? target : resolve(process.cwd(), target);
+}
+function isDebugLogEnabled() {
+  return resolveTarget() !== void 0;
+}
+var sessionId;
+function getSessionId() {
+  if (!sessionId) {
+    sessionId = `${process.pid}-${Date.now()}`;
+  }
+  return sessionId;
+}
+var trackedPath;
+var bytesInFile = 0;
+function ensureReady(filePath) {
+  if (trackedPath !== filePath) {
+    trackedPath = filePath;
+    mkdirSync(dirname(filePath), { recursive: true });
+    try {
+      bytesInFile = statSync(filePath).size;
+    } catch {
+      bytesInFile = 0;
+    }
+  }
+}
+function append(entry) {
+  const filePath = resolveTarget();
+  if (!filePath) {
+    return;
+  }
+  try {
+    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
+    const line = `${redactSecrets(JSON.stringify(payload))}
+`;
+    ensureReady(filePath);
+    const size = Buffer.byteLength(line);
+    if (bytesInFile + size > MAX_BYTES) {
+      renameSync(filePath, `${filePath}.1`);
+      bytesInFile = 0;
+    }
+    appendFileSync(filePath, line);
+    bytesInFile += size;
+  } catch {
+  }
+}
+function errorToPlain(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { message: String(err) };
+}
+var invocationStartedAt;
+function logInvocation(argv) {
+  invocationStartedAt = Date.now();
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
+}
+function logExit(code) {
+  append({
+    kind: "exit",
+    code,
+    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
+  });
+}
+var exitHookInstalled = false;
+function installExitRecord() {
+  if (exitHookInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  exitHookInstalled = true;
+  process.on("exit", (code) => {
+    logExit(typeof code === "number" ? code : 0);
+  });
+}
+function debugLogHttp(entry) {
+  if (!isDebugLogEnabled()) {
+    return;
+  }
+  append({
+    kind: "http",
+    source: entry.source,
+    method: entry.method,
+    url: entry.url,
+    durationMs: entry.durationMs,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
+    status: entry.status,
+    ok: entry.ok,
+    response: entry.responseBody,
+    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
+  });
+}
+async function readBodyForLog(response) {
+  if (!isDebugLogEnabled()) {
+    return void 0;
+  }
+  try {
+    return await response.clone().text();
+  } catch {
+    return void 0;
+  }
+}
+function tapStream(name, stream) {
+  const original = stream.write.bind(stream);
+  const decoder = new TextDecoder("utf-8");
+  stream.write = ((chunk, ...rest) => {
+    try {
+      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
+      append({ kind: "output", stream: name, text });
+    } catch {
+    }
+    return original(chunk, ...rest);
+  });
+}
+var tapsInstalled = false;
+function installStreamTaps() {
+  if (tapsInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  tapsInstalled = true;
+  tapStream("stdout", process.stdout);
+  tapStream("stderr", process.stderr);
+}
+
+export {
+  logInvocation,
+  installExitRecord,
+  debugLogHttp,
+  readBodyForLog,
+  installStreamTaps
+};
+//# sourceMappingURL=chunk-MCM3HMNZ.js.map

package/dist/chunk-MCM3HMNZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not\n  // contain the literal `bk_`, so the company-key rule matched no part of the\n  // read-only credentials a Session review or a published report runs with.\n  [/\\b(bk[rv]?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,6BAA6B,eAAe;AAAA;AAAA,EAC7C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/chunk-NBM3EHRA.js

@@ -0,0 +1,337 @@
+import {
+  holdUnbilledSpend
+} from "./chunk-Z6JUXGJ3.js";
+import {
+  askAboutText
+} from "./chunk-FMMXUEDL.js";
+import {
+  brandTokensSchema
+} from "./chunk-BAUSWB7O.js";
+
+// src/engine/landing/lib/brand-tokens.ts
+import { readFile as readFile2 } from "fs/promises";
+import path2 from "path";
+
+// src/engine/brand/brand-doc.ts
+import { createHash } from "crypto";
+import { mkdir, readdir, readFile, writeFile } from "fs/promises";
+import path from "path";
+import { z } from "zod";
+var BRAND_DOC_MODEL = "google/gemini-2.5-flash-lite";
+var REQUEST = {
+  provider: { order: ["google-vertex"], allow_fallbacks: false },
+  temperature: 0,
+  response_format: { type: "json_object" }
+};
+var PROMPT_VERSION = 2;
+var TIMEOUT_MS = 3e4;
+var BRAND_MD_CHARS = 32e3;
+var COMPANY_MD_CHARS = 4e3;
+var Font = z.object({
+  family: z.string().trim().min(1).max(60),
+  role: z.enum(["heading", "body", "any"]).catch("any"),
+  use: z.boolean()
+});
+var Color = z.object({
+  hex: z.string().trim().regex(/^#?[0-9a-fA-F]{6}$/).transform((h) => `#${h.replace(/^#/, "").toLowerCase()}`),
+  use: z.boolean()
+});
+var Reading = z.object({
+  name: z.string().trim().min(1).max(80).nullable().catch(null),
+  wordmark: z.array(z.string().trim().min(1).max(40)).catch([]),
+  logoNames: z.array(z.string().trim().min(1).max(40)).catch([]),
+  fonts: z.array(z.unknown()).catch([]),
+  colors: z.array(z.unknown()).catch([])
+});
+function brandDocPrompt(docs) {
+  return [
+    "You read a company's brand guidelines (BRAND.md), the start of its company profile (COMPANY.md) and the file names of its logos. They may be written in any language, or several. Extract only what they state; never invent a value.",
+    "",
+    "Return JSON only, in this shape:",
+    '{"name": string | null, "wordmark": string[], "logoNames": string[], "fonts": [{"family": string, "role": "heading" | "body" | "any", "use": boolean}], "colors": [{"hex": "#rrggbb", "use": boolean}]}',
+    "",
+    `- name: the brand's name exactly as written ("# Zernio Brand Guidelines" names Zernio). null when neither document states one, as in an unfilled template ("# Brand Guidelines", "# Company", TODO).`,
+    `- wordmark: every word the documents say the logo prints, as they quote it ("Wordmark: \\"permut\\"" gives "permut"; 'symbol plus "Cubbo" wordmark' gives "Cubbo"), even when it is also the name. [] when they quote none.`,
+    '- logoNames: a product or brand name a logo file name carries ("logo-engage-blue.png" gives "Engage"). Colours, variants, sizes and formats (dark, white, icon, isotype, png) are not names. [] when none.',
+    `- fonts: every typeface the guidelines name, by its family name exactly, the banned ones included. role is heading, body, or any when they do not say. use is false when the guidelines ban it, forbid it or say to avoid it or never use it, in any wording or language; true when the brand uses it. Only a named typeface counts: a generic family (sans-serif, serif, monospace, system-ui) or the operating system's own fonts ("system stack", "system fonts") is not one, so leave it out.`,
+    "- colors: every hex colour the guidelines give. use is false when they ban it or say to avoid it, true when it is a brand colour.",
+    "",
+    "<brand_md>",
+    (docs.brandMd ?? "").slice(0, BRAND_MD_CHARS),
+    "</brand_md>",
+    "<company_md>",
+    (docs.companyMd ?? "").slice(0, COMPANY_MD_CHARS),
+    "</company_md>",
+    "<logo_files>",
+    (docs.logoFiles ?? []).join("\n"),
+    "</logo_files>"
+  ].join("\n");
+}
+function parseBrandDoc(answer) {
+  const parsed = Reading.safeParse(answer);
+  if (!parsed.success) return null;
+  const fonts = parsed.data.fonts.flatMap((f) => {
+    const font = Font.safeParse(f);
+    return font.success ? [font.data] : [];
+  });
+  const colors = parsed.data.colors.flatMap((c) => {
+    const color = Color.safeParse(c);
+    return color.success ? [color.data] : [];
+  });
+  return {
+    ...parsed.data.name ? { name: parsed.data.name } : {},
+    wordmark: [.../* @__PURE__ */ new Set([...parsed.data.wordmark, ...parsed.data.logoNames])],
+    fonts,
+    colors
+  };
+}
+function brandDocReader(cacheDir, onSpend) {
+  return async (docs) => {
+    const prompt = brandDocPrompt(docs);
+    const key = createHash("sha256").update(JSON.stringify([PROMPT_VERSION, BRAND_DOC_MODEL, prompt])).digest("hex");
+    const file = path.join(cacheDir, "brand-doc", `${key}.json`);
+    const cached = parseBrandDoc(await readFile(file, "utf8").then(JSON.parse, () => null));
+    if (cached) return cached;
+    const spent = [];
+    const answer = await askAboutText(BRAND_DOC_MODEL, prompt, (u) => onSpend ? onSpend(u) : spent.push(u), {
+      timeoutMs: TIMEOUT_MS,
+      request: REQUEST
+    }).catch(() => null);
+    await holdUnbilledSpend(cacheDir, spent).catch(() => void 0);
+    const reading = parseBrandDoc(answer);
+    if (reading) {
+      await mkdir(path.dirname(file), { recursive: true }).catch(() => void 0);
+      await writeFile(file, JSON.stringify(reading), "utf8").catch(() => void 0);
+    }
+    return reading;
+  };
+}
+var LOGO_FILE = /logo|lockup|wordmark|isotype|isologo/i;
+async function workspaceBrandDocs(root) {
+  const read = (rel) => readFile(path.join(root, rel), "utf8").catch(() => null);
+  const logoFiles = (await readdir(path.join(root, "src", "brand", "logos")).catch(() => [])).filter((f) => /\.(png|jpe?g|webp|svg)$/i.test(f) && LOGO_FILE.test(f)).sort();
+  return { brandMd: await read("src/brand/BRAND.md"), companyMd: await read("COMPANY.md"), logoFiles };
+}
+async function readWorkspaceBrandDoc(root, opts = {}) {
+  const docs = await workspaceBrandDocs(root);
+  if (!docs.brandMd?.trim() && !docs.companyMd?.trim()) return null;
+  const read = opts.read ?? brandDocReader(path.join(root, "canvas", ".cache"), opts.onSpend);
+  return await read(docs).catch(() => null);
+}
+
+// src/engine/landing/lib/color.ts
+var NEUTRAL_COLOR_KEYWORDS = /* @__PURE__ */ new Set([
+  "transparent",
+  "currentcolor",
+  "black",
+  "white",
+  "gray",
+  "grey",
+  "silver",
+  "dimgray",
+  "dimgrey",
+  "darkgray",
+  "darkgrey",
+  "lightgray",
+  "lightgrey",
+  "gainsboro",
+  "whitesmoke"
+]);
+function hexChannels(color) {
+  const long = color.match(/^#([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})(?:[0-9a-f]{2})?$/i);
+  if (long)
+    return [
+      Number.parseInt(long[1] ?? "0", 16),
+      Number.parseInt(long[2] ?? "0", 16),
+      Number.parseInt(long[3] ?? "0", 16)
+    ];
+  const short = color.match(/^#([0-9a-f])([0-9a-f])([0-9a-f])(?:[0-9a-f])?$/i);
+  if (short) {
+    const dup = (s) => Number.parseInt(`${s ?? "0"}${s ?? "0"}`, 16);
+    return [dup(short[1]), dup(short[2]), dup(short[3])];
+  }
+  return null;
+}
+function parseColor(raw) {
+  const c = String(raw || "").trim().toLowerCase();
+  if (!c || c === "transparent") return null;
+  const rgb = c.match(/rgba?\(\s*([\d.]+)[\s,]+([\d.]+)[\s,]+([\d.]+)(?:[\s,/]+([\d.]+%?))?\s*\)/i);
+  if (rgb) {
+    const alpha = rgb[4];
+    const a = alpha === void 0 ? 1 : alpha.endsWith("%") ? Number.parseFloat(alpha) / 100 : Number.parseFloat(alpha);
+    return { r: Number(rgb[1]), g: Number(rgb[2]), b: Number(rgb[3]), a };
+  }
+  const oklch = parseOklch(c);
+  if (oklch) return oklch;
+  const hex = hexChannels(c);
+  if (hex) return { r: hex[0], g: hex[1], b: hex[2], a: 1 };
+  return null;
+}
+function parseOklch(c) {
+  const m = c.match(/oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)/i);
+  if (!m) return null;
+  const pct = (s, scale) => s.endsWith("%") ? Number.parseFloat(s) / 100 * scale : Number.parseFloat(s);
+  const alpha = m[4];
+  const a = alpha === void 0 ? 1 : pct(alpha, 1);
+  return { ...oklchToRgb(pct(m[1] ?? "0", 1), pct(m[2] ?? "0", 0.4), Number.parseFloat(m[3] ?? "0")), a };
+}
+function oklchToRgb(L, C, H) {
+  const hRad = H * Math.PI / 180;
+  const a = C * Math.cos(hRad);
+  const b = C * Math.sin(hRad);
+  const l = (L + 0.3963377774 * a + 0.2158037573 * b) ** 3;
+  const m = (L - 0.1055613458 * a - 0.0638541728 * b) ** 3;
+  const s = (L - 0.0894841775 * a - 1.291485548 * b) ** 3;
+  const lin = [
+    4.0767416621 * l - 3.3077115913 * m + 0.2309699292 * s,
+    -1.2684380046 * l + 2.6097574011 * m - 0.3413193965 * s,
+    -0.0041960863 * l - 0.7034186147 * m + 1.707614701 * s
+  ].map((v) => {
+    const g = v <= 31308e-7 ? 12.92 * v : 1.055 * Math.sign(v) * Math.abs(v) ** (1 / 2.4) - 0.055;
+    return Math.round(Math.max(0, Math.min(1, g)) * 255);
+  });
+  return { r: lin[0] ?? 0, g: lin[1] ?? 0, b: lin[2] ?? 0 };
+}
+function isNeutralAuthoredColor(rawColor) {
+  const c = String(rawColor || "").trim().toLowerCase();
+  if (!c) return false;
+  if (NEUTRAL_COLOR_KEYWORDS.has(c)) return true;
+  if (/^rgba?\(/i.test(c)) {
+    const channels2 = c.match(/^rgba?\(\s*([\d.]+)[\s,]+([\d.]+)[\s,]+([\d.]+)/i);
+    if (channels2) {
+      const values = [1, 2, 3].map((i) => Number(channels2[i]));
+      return Math.max(...values) - Math.min(...values) < 30;
+    }
+    return false;
+  }
+  const oklch = c.match(/oklch\(\s*[\d.]+%?\s+([\d.-]+)/i);
+  if (oklch) return Number.parseFloat(oklch[1] ?? "0") < 0.02;
+  const lch = c.match(/lch\(\s*[\d.]+%?\s+([\d.-]+)/i);
+  if (lch) return Number.parseFloat(lch[1] ?? "0") < 3;
+  const hsl = c.match(/hsla?\(\s*[\d.-]+\s*,?\s*([\d.]+)%/i);
+  if (hsl) return Number.parseFloat(hsl[1] ?? "0") < 10;
+  const channels = hexChannels(c);
+  if (channels) return Math.max(...channels) - Math.min(...channels) < 30;
+  return false;
+}
+function hasChroma(c, threshold = 30) {
+  if (!c) return false;
+  return Math.max(c.r, c.g, c.b) - Math.min(c.r, c.g, c.b) >= threshold;
+}
+function getHue(c) {
+  if (!c) return 0;
+  const r = c.r / 255;
+  const g = c.g / 255;
+  const b = c.b / 255;
+  const max = Math.max(r, g, b);
+  const min = Math.min(r, g, b);
+  if (max === min) return 0;
+  const d = max - min;
+  let h;
+  if (max === r) h = ((g - b) / d + (g < b ? 6 : 0)) / 6;
+  else if (max === g) h = ((b - r) / d + 2) / 6;
+  else h = ((r - g) / d + 4) / 6;
+  return Math.round(h * 360);
+}
+function isAiPurpleHue(hue) {
+  return hue >= 225 && hue <= 310;
+}
+function isCreamColor(c) {
+  if (Math.min(c.r, c.g, c.b) < 209) return false;
+  if (!(c.r >= c.g && c.g >= c.b)) return false;
+  const warmth = c.r - c.b;
+  return warmth >= 6 && warmth <= 48;
+}
+
+// src/engine/landing/lib/brand-tokens.ts
+var EMPTY = { fonts: /* @__PURE__ */ new Set(), colors: [], hasTokens: false };
+function isNotAFamily(value) {
+  return /^[1-9]00$/.test(value) || /^\d+(?:\.\d+)?(?:px|rem|em|%|pt|vw|vh|ch|ex)$/i.test(value) || /^(?:normal|bold|bolder|lighter|italic|oblique|none|auto|inherit|initial|unset)$/i.test(value);
+}
+function parseBrandTokens(globalCss, brandDoc) {
+  const fonts = /* @__PURE__ */ new Set();
+  const colors = [];
+  parseGlobalCss(globalCss, fonts, colors);
+  for (const font of brandDoc?.fonts ?? []) if (font.use) fonts.add(font.family.toLowerCase());
+  for (const color of brandDoc?.colors ?? []) {
+    const parsed = color.use ? parseColor(color.hex) : null;
+    if (parsed) colors.push(parsed);
+  }
+  return { fonts, colors, hasTokens: fonts.size > 0 || colors.length > 0 };
+}
+function parseGlobalCss(rawCss, fonts, colors) {
+  const globalCss = rawCss.replace(/\/\*[\s\S]*?\*\//g, (block) => block.replace(/[^\n]/g, " "));
+  for (const m of globalCss.matchAll(/(?<![\w-])--font-([\w-]*)\s*:\s*([^;]+);/gi)) {
+    const slug = m[1] ?? "";
+    if (slug.includes("--") || /^weight(?:$|[-\s])/i.test(slug)) continue;
+    const first = (m[2] ?? "").split(",")[0]?.trim().replace(/^['"]|['"]$/g, "").toLowerCase();
+    if (!first || isNotAFamily(first)) continue;
+    fonts.add(first);
+  }
+  for (const m of globalCss.matchAll(
+    /--color-[\w-]*\s*:\s*(#[0-9a-f]{3,8}\b|rgba?\([^)]+\)|oklch\([^)]+\)|hsla?\([^)]+\))/gi
+  )) {
+    const c = parseColor(m[1] ?? "");
+    if (c) colors.push(c);
+  }
+}
+function brandTokensFromCanonical(tokens) {
+  const fonts = new Set(tokens.fonts.map((f) => f.family.toLowerCase()));
+  const colors = [];
+  for (const color of tokens.colors) {
+    const parsed = parseColor(color.value);
+    if (parsed) colors.push(parsed);
+  }
+  return { fonts, colors, hasTokens: fonts.size > 0 || colors.length > 0 };
+}
+async function loadBrandTokens(projectRoot, opts = {}) {
+  const tokensRaw = await safeRead(path2.join(projectRoot, "src", "brand", "tokens.json"));
+  if (tokensRaw) {
+    try {
+      const canonical = brandTokensSchema.safeParse(JSON.parse(tokensRaw));
+      if (canonical.success) return brandTokensFromCanonical(canonical.data);
+    } catch {
+    }
+  }
+  const globalCss = await safeRead(path2.join(projectRoot, "src", "styles", "global.css"));
+  const brandDoc = await readWorkspaceBrandDoc(projectRoot, {
+    ...opts.readBrandDoc ? { read: opts.readBrandDoc } : {},
+    ...opts.onSpend ? { onSpend: opts.onSpend } : {}
+  });
+  if (!globalCss && !brandDoc) return EMPTY;
+  return parseBrandTokens(globalCss, brandDoc);
+}
+async function safeRead(file) {
+  try {
+    return await readFile2(file, "utf8");
+  } catch {
+    return "";
+  }
+}
+function brandCommitsFont(brand, snippet) {
+  if (brand.fonts.size === 0) return false;
+  const lower = snippet.toLowerCase();
+  for (const f of brand.fonts) if (f.length >= 3 && lower.includes(f)) return true;
+  return false;
+}
+function brandCommitsAiHue(brand) {
+  return brand.colors.some((c) => hasChroma(c, 40) && isAiPurpleHue(getHue(c)));
+}
+function brandCommitsCream(brand) {
+  return brand.colors.some((c) => isCreamColor(c));
+}
+
+export {
+  LOGO_FILE,
+  readWorkspaceBrandDoc,
+  parseColor,
+  isNeutralAuthoredColor,
+  hasChroma,
+  isCreamColor,
+  parseBrandTokens,
+  loadBrandTokens,
+  brandCommitsFont,
+  brandCommitsAiHue,
+  brandCommitsCream
+};
+//# sourceMappingURL=chunk-NBM3EHRA.js.map