@koda-sl/baker-cli 0.451.0-dev.b2a4eba2b → 0.451.0-dev.d9192b76e

package/dist/chunk-IFWP3ZDO.js

@@ -0,0 +1,215 @@
+import {
+  debugLogSetting
+} from "./chunk-NAWWC5I3.js";
+
+// src/debugLog.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+var DEFAULT_FILE = "baker-cli-debug.jsonl";
+var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
+var MAX_BYTES = 64 * 1024 * 1024;
+var REDACTIONS = [
+  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
+  // Authorization headers
+  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
+  // the literal `bk_`, so the company-key rule matched no part of the read-only
+  // credential a Session review runs with.
+  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Baker API keys
+  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
+  // JWTs / id tokens
+  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
+  // Google OAuth access tokens
+  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
+  // Google refresh tokens
+  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
+  // Meta/Facebook access tokens
+];
+function redactSecrets(input) {
+  let out = input;
+  for (const [pattern, replacement] of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
+function resolveTarget() {
+  const raw = debugLogSetting();
+  if (!raw) {
+    return void 0;
+  }
+  const lower = raw.toLowerCase();
+  if (BOOLEAN_OFF.has(lower)) {
+    return void 0;
+  }
+  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
+  return isAbsolute(target) ? target : resolve(process.cwd(), target);
+}
+function isDebugLogEnabled() {
+  return resolveTarget() !== void 0;
+}
+var sessionId;
+function getSessionId() {
+  if (!sessionId) {
+    sessionId = `${process.pid}-${Date.now()}`;
+  }
+  return sessionId;
+}
+var trackedPath;
+var bytesInFile = 0;
+function ensureReady(filePath) {
+  if (trackedPath !== filePath) {
+    trackedPath = filePath;
+    mkdirSync(dirname(filePath), { recursive: true });
+    try {
+      bytesInFile = statSync(filePath).size;
+    } catch {
+      bytesInFile = 0;
+    }
+  }
+}
+function append(entry) {
+  const filePath = resolveTarget();
+  if (!filePath) {
+    return;
+  }
+  try {
+    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
+    const line = `${redactSecrets(JSON.stringify(payload))}
+`;
+    ensureReady(filePath);
+    const size = Buffer.byteLength(line);
+    if (bytesInFile + size > MAX_BYTES) {
+      renameSync(filePath, `${filePath}.1`);
+      bytesInFile = 0;
+    }
+    appendFileSync(filePath, line);
+    bytesInFile += size;
+  } catch {
+  }
+}
+function errorToPlain(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { message: String(err) };
+}
+var invocationStartedAt;
+function logInvocation(argv) {
+  invocationStartedAt = Date.now();
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
+}
+function logExit(code) {
+  append({
+    kind: "exit",
+    code,
+    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
+  });
+}
+var exitHookInstalled = false;
+function installExitRecord() {
+  if (exitHookInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  exitHookInstalled = true;
+  process.on("exit", (code) => {
+    logExit(typeof code === "number" ? code : 0);
+  });
+}
+function debugLogHttp(entry) {
+  if (!isDebugLogEnabled()) {
+    return;
+  }
+  append({
+    kind: "http",
+    source: entry.source,
+    method: entry.method,
+    url: entry.url,
+    durationMs: entry.durationMs,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
+    status: entry.status,
+    ok: entry.ok,
+    response: entry.responseBody,
+    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
+  });
+}
+async function readBodyForLog(response) {
+  if (!isDebugLogEnabled()) {
+    return void 0;
+  }
+  try {
+    return await response.clone().text();
+  } catch {
+    return void 0;
+  }
+}
+function tapStream(name, stream) {
+  const original = stream.write.bind(stream);
+  const decoder = new TextDecoder("utf-8");
+  stream.write = ((chunk, ...rest) => {
+    try {
+      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
+      append({ kind: "output", stream: name, text });
+    } catch {
+    }
+    return original(chunk, ...rest);
+  });
+}
+var tapsInstalled = false;
+function installStreamTaps() {
+  if (tapsInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  tapsInstalled = true;
+  tapStream("stdout", process.stdout);
+  tapStream("stderr", process.stderr);
+}
+
+export {
+  logInvocation,
+  installExitRecord,
+  debugLogHttp,
+  readBodyForLog,
+  installStreamTaps
+};
+//# sourceMappingURL=chunk-IFWP3ZDO.js.map

package/dist/chunk-IFWP3ZDO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/chunk-INK2NCJ6.js

@@ -0,0 +1,98 @@
+import {
+  isRemoteUrl
+} from "./chunk-PBA3YCZA.js";
+import {
+  detectImageContentType,
+  uploadLocalImage
+} from "./chunk-75FDTDLH.js";
+import {
+  IMAGE_GENERATE_MODELS,
+  MODEL_REGISTRY,
+  VIDEO_GENERATE_MODELS
+} from "./chunk-SZF65D5I.js";
+import {
+  ApiError,
+  apiPost
+} from "./chunk-XBOK23HI.js";
+
+// src/commands/studio/modelOptions.ts
+function unionOfStringEnum(node, models, param) {
+  const values = /* @__PURE__ */ new Set();
+  for (const model of models) {
+    const schema = MODEL_REGISTRY[node][model]?.params[param];
+    if (schema?.kind === "string") for (const value of schema.enum ?? []) values.add(value);
+  }
+  return [...values];
+}
+function unionOfNumberEnum(node, models, param) {
+  const values = /* @__PURE__ */ new Set();
+  for (const model of models) {
+    const schema = MODEL_REGISTRY[node][model]?.params[param];
+    if (schema?.kind === "number") for (const value of schema.enum ?? []) values.add(value);
+  }
+  return [...values].sort((a, b) => a - b);
+}
+var IMAGE_MODEL_IDS = [...IMAGE_GENERATE_MODELS];
+var VIDEO_MODEL_IDS = [...VIDEO_GENERATE_MODELS];
+var IMAGE_SIZES = unionOfStringEnum("image_generate", IMAGE_GENERATE_MODELS, "image_size");
+var IMAGE_QUALITIES = unionOfStringEnum("image_generate", IMAGE_GENERATE_MODELS, "quality");
+var CLIP_RESOLUTIONS = unionOfStringEnum("video_generate", VIDEO_GENERATE_MODELS, "resolution");
+var CLIP_DURATIONS = unionOfNumberEnum("video_generate", VIDEO_GENERATE_MODELS, "duration");
+var CLIP_PERSON_GENERATION = unionOfStringEnum("video_generate", VIDEO_GENERATE_MODELS, "person_generation");
+
+// src/commands/studio/references.ts
+var LIBRARY_ID_RE = /^[a-z0-9]{16,}$/i;
+var FILE_EXTENSION_RE = /\.[a-z0-9]{2,5}$/i;
+var PATH_HINT_RE = /[/\\]/;
+function classify(entry) {
+  if (isRemoteUrl(entry)) return { kind: "url", value: entry };
+  if (PATH_HINT_RE.test(entry) || FILE_EXTENSION_RE.test(entry)) return { kind: "path", value: entry };
+  if (LIBRARY_ID_RE.test(entry)) return { kind: "id", value: entry };
+  throw new ApiError(
+    "VALIDATION_ERROR",
+    `"${entry}" is not a library image id, a file path, or an image URL. Pass a comma-separated mix of those.`
+  );
+}
+function parseImageRefs(spec) {
+  return spec.split(",").map((entry) => entry.trim()).filter(Boolean).map(classify);
+}
+var defaultDeps = {
+  ingest: (url) => apiPost("/api/images/ingest", { url, source: "uploaded" }),
+  upload: (path) => uploadLocalImage({ file: path, contentType: detectImageContentType(path), source: "uploaded" })
+};
+async function resolveLibraryImageIds(spec, limit, deps = defaultDeps) {
+  const refs = parseImageRefs(spec);
+  if (limit && refs.length > limit.max) {
+    throw new ApiError("VALIDATION_ERROR", limit.refuse(refs.length));
+  }
+  const imageIds = [];
+  const added = [];
+  for (const ref of refs) {
+    if (ref.kind === "id") {
+      imageIds.push(ref.value);
+      continue;
+    }
+    const { imageId } = ref.kind === "url" ? await deps.ingest(ref.value) : await deps.upload(ref.value).catch(uploadFailure(ref.value));
+    imageIds.push(imageId);
+    added.push(imageId);
+  }
+  return { imageIds, added };
+}
+function uploadFailure(path) {
+  return (error) => {
+    if (error instanceof ApiError) throw error;
+    throw new ApiError("VALIDATION_ERROR", `Could not read "${path}" as an image.`);
+  };
+}
+
+export {
+  IMAGE_MODEL_IDS,
+  VIDEO_MODEL_IDS,
+  IMAGE_SIZES,
+  IMAGE_QUALITIES,
+  CLIP_RESOLUTIONS,
+  CLIP_DURATIONS,
+  CLIP_PERSON_GENERATION,
+  resolveLibraryImageIds
+};
+//# sourceMappingURL=chunk-INK2NCJ6.js.map

package/dist/chunk-JERXV5A3.js

@@ -0,0 +1,26 @@
+import {
+  writeJsonEnvelope
+} from "./chunk-VFIOJD5M.js";
+import {
+  apiGet
+} from "./chunk-XBOK23HI.js";
+
+// src/available-accounts.ts
+var AVAILABLE_ARG = {
+  type: "boolean",
+  description: "List everything the connected login reaches, each marked selected: true|false. Use it when the account, property, site or container the user means is not in the plain list.",
+  required: false
+};
+async function writeAvailableAccounts(platform, onError) {
+  try {
+    writeJsonEnvelope(await apiGet("/api/connections/available", { platform }));
+  } catch (err) {
+    onError(err);
+  }
+}
+
+export {
+  AVAILABLE_ARG,
+  writeAvailableAccounts
+};
+//# sourceMappingURL=chunk-JERXV5A3.js.map