@koda-sl/baker-cli 0.454.0-dev.67ad219ab → 0.454.0

package/dist/chunk-HTW7FTP4.js

@@ -0,0 +1,45 @@
+import {
+  ANALYTICS_BUSY_FIX,
+  isAnalyticsBusy
+} from "./chunk-SSJK7FEV.js";
+import {
+  ApiError
+} from "./chunk-XBOK23HI.js";
+
+// src/commands/analytics/errorEnvelope.ts
+import { z } from "zod";
+function analyticsErrorEnvelope(err) {
+  if (err instanceof ApiError) {
+    return isAnalyticsBusy(err.message) ? { code: err.code, message: err.message, fix: ANALYTICS_BUSY_FIX } : { code: err.code, message: err.message };
+  }
+  return { code: "NETWORK_ERROR", message: err instanceof Error ? err.message : "Unexpected error" };
+}
+function requestErrorEnvelope(err, correction, correctsLocalInput) {
+  if (err instanceof z.ZodError || err instanceof SyntaxError) {
+    const message = err instanceof z.ZodError ? z.prettifyError(err) : err.message;
+    return { code: "VALIDATION_ERROR", message, ...correctsLocalInput ? { fix: correction } : {} };
+  }
+  const envelope = analyticsErrorEnvelope(err);
+  return envelope.code === "VALIDATION_ERROR" ? { ...envelope, fix: correction } : envelope;
+}
+function questionnaireErrorEnvelope(err) {
+  return requestErrorEnvelope(
+    err,
+    "Check baker analytics plan --full for missing app events. Resolve the named contract issue or narrow the observation window; never infer abandonment from completion totals.",
+    false
+  );
+}
+function trackingPlanErrorEnvelope(err) {
+  return requestErrorEnvelope(
+    err,
+    "Read baker analytics plan --full and baker tag-manager draft list to see what is prepared. Correct the request and repeat; do not publish until every requested installation is staged.",
+    true
+  );
+}
+
+export {
+  analyticsErrorEnvelope,
+  questionnaireErrorEnvelope,
+  trackingPlanErrorEnvelope
+};
+//# sourceMappingURL=chunk-HTW7FTP4.js.map

package/dist/chunk-HTW7FTP4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/analytics/errorEnvelope.ts"],"sourcesContent":["import { ANALYTICS_BUSY_FIX, isAnalyticsBusy } from \"@baker/api/analytics\";\nimport { z } from \"zod\";\nimport { ApiError, type ErrorCode } from \"../../client.ts\";\n\n/**\n * A failed analytics read, as the agent reads it.\n *\n * Separate from `handleError` — which writes it and exits — so the one decision\n * in it can be checked without a process to kill.\n *\n * ## The one decision\n *\n * Whether the failure is worth stopping for. Almost all of them are: a bad\n * preset, an unmapped role, a window outside retention. One is not — the store\n * refusing a read because a burst spent its per-minute compute allowance. That\n * refusal clears in seconds, loses nothing, and is answered correctly by\n * waiting; an agent that treats it like the others abandons a multi-step report\n * over a hiccup, which is the expensive outcome and the reason this carries a\n * `fix` at all.\n */\nexport function analyticsErrorEnvelope(err: unknown): { code: ErrorCode; message: string; fix?: string } {\n  if (err instanceof ApiError) {\n    return isAnalyticsBusy(err.message)\n      ? { code: err.code, message: err.message, fix: ANALYTICS_BUSY_FIX }\n      : { code: err.code, message: err.message };\n  }\n  return { code: \"NETWORK_ERROR\", message: err instanceof Error ? err.message : \"Unexpected error\" };\n}\n\ntype CommandErrorEnvelope = { code: ErrorCode; message: string; fix?: string };\n\n/**\n * A refused request, with `fix` only where it applies: a rejected request gets\n * the command's correction, and anything else (busy, unavailable, unreachable)\n * keeps its own code, so an agent waits rather than rewriting a valid request.\n */\nfunction requestErrorEnvelope(err: unknown, correction: string, correctsLocalInput: boolean): CommandErrorEnvelope {\n  if (err instanceof z.ZodError || err instanceof SyntaxError) {\n    const message = err instanceof z.ZodError ? z.prettifyError(err) : err.message;\n    return { code: \"VALIDATION_ERROR\", message, ...(correctsLocalInput ? { fix: correction } : {}) };\n  }\n  const envelope = analyticsErrorEnvelope(err);\n  return envelope.code === \"VALIDATION_ERROR\" ? { ...envelope, fix: correction } : envelope;\n}\n\n/** A failed question report: the contract remedy only when the events themselves were refused. */\nexport function questionnaireErrorEnvelope(err: unknown): CommandErrorEnvelope {\n  return requestErrorEnvelope(\n    err,\n    \"Check baker analytics plan --full for missing app events. Resolve the named contract issue or narrow the observation window; never infer abandonment from completion totals.\",\n    false,\n  );\n}\n\n/** A failed plan read or preparation. */\nexport function trackingPlanErrorEnvelope(err: unknown): CommandErrorEnvelope {\n  return requestErrorEnvelope(\n    err,\n    \"Read baker analytics plan --full and baker tag-manager draft list to see what is prepared. Correct the request and repeat; do not publish until every requested installation is staged.\",\n    true,\n  );\n}\n"],"mappings":";;;;;;;;;AACA,SAAS,SAAS;AAmBX,SAAS,uBAAuB,KAAkE;AACvG,MAAI,eAAe,UAAU;AAC3B,WAAO,gBAAgB,IAAI,OAAO,IAC9B,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,KAAK,mBAAmB,IAChE,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ;AAAA,EAC7C;AACA,SAAO,EAAE,MAAM,iBAAiB,SAAS,eAAe,QAAQ,IAAI,UAAU,mBAAmB;AACnG;AASA,SAAS,qBAAqB,KAAc,YAAoB,oBAAmD;AACjH,MAAI,eAAe,EAAE,YAAY,eAAe,aAAa;AAC3D,UAAM,UAAU,eAAe,EAAE,WAAW,EAAE,cAAc,GAAG,IAAI,IAAI;AACvE,WAAO,EAAE,MAAM,oBAAoB,SAAS,GAAI,qBAAqB,EAAE,KAAK,WAAW,IAAI,CAAC,EAAG;AAAA,EACjG;AACA,QAAM,WAAW,uBAAuB,GAAG;AAC3C,SAAO,SAAS,SAAS,qBAAqB,EAAE,GAAG,UAAU,KAAK,WAAW,IAAI;AACnF;AAGO,SAAS,2BAA2B,KAAoC;AAC7E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGO,SAAS,0BAA0B,KAAoC;AAC5E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-IFWP3ZDO.js

@@ -0,0 +1,215 @@
+import {
+  debugLogSetting
+} from "./chunk-NAWWC5I3.js";
+
+// src/debugLog.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+var DEFAULT_FILE = "baker-cli-debug.jsonl";
+var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
+var MAX_BYTES = 64 * 1024 * 1024;
+var REDACTIONS = [
+  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
+  // Authorization headers
+  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
+  // the literal `bk_`, so the company-key rule matched no part of the read-only
+  // credential a Session review runs with.
+  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Baker API keys
+  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
+  // JWTs / id tokens
+  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
+  // Google OAuth access tokens
+  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
+  // Google refresh tokens
+  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
+  // Meta/Facebook access tokens
+];
+function redactSecrets(input) {
+  let out = input;
+  for (const [pattern, replacement] of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
+function resolveTarget() {
+  const raw = debugLogSetting();
+  if (!raw) {
+    return void 0;
+  }
+  const lower = raw.toLowerCase();
+  if (BOOLEAN_OFF.has(lower)) {
+    return void 0;
+  }
+  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
+  return isAbsolute(target) ? target : resolve(process.cwd(), target);
+}
+function isDebugLogEnabled() {
+  return resolveTarget() !== void 0;
+}
+var sessionId;
+function getSessionId() {
+  if (!sessionId) {
+    sessionId = `${process.pid}-${Date.now()}`;
+  }
+  return sessionId;
+}
+var trackedPath;
+var bytesInFile = 0;
+function ensureReady(filePath) {
+  if (trackedPath !== filePath) {
+    trackedPath = filePath;
+    mkdirSync(dirname(filePath), { recursive: true });
+    try {
+      bytesInFile = statSync(filePath).size;
+    } catch {
+      bytesInFile = 0;
+    }
+  }
+}
+function append(entry) {
+  const filePath = resolveTarget();
+  if (!filePath) {
+    return;
+  }
+  try {
+    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
+    const line = `${redactSecrets(JSON.stringify(payload))}
+`;
+    ensureReady(filePath);
+    const size = Buffer.byteLength(line);
+    if (bytesInFile + size > MAX_BYTES) {
+      renameSync(filePath, `${filePath}.1`);
+      bytesInFile = 0;
+    }
+    appendFileSync(filePath, line);
+    bytesInFile += size;
+  } catch {
+  }
+}
+function errorToPlain(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { message: String(err) };
+}
+var invocationStartedAt;
+function logInvocation(argv) {
+  invocationStartedAt = Date.now();
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
+}
+function logExit(code) {
+  append({
+    kind: "exit",
+    code,
+    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
+  });
+}
+var exitHookInstalled = false;
+function installExitRecord() {
+  if (exitHookInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  exitHookInstalled = true;
+  process.on("exit", (code) => {
+    logExit(typeof code === "number" ? code : 0);
+  });
+}
+function debugLogHttp(entry) {
+  if (!isDebugLogEnabled()) {
+    return;
+  }
+  append({
+    kind: "http",
+    source: entry.source,
+    method: entry.method,
+    url: entry.url,
+    durationMs: entry.durationMs,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
+    status: entry.status,
+    ok: entry.ok,
+    response: entry.responseBody,
+    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
+  });
+}
+async function readBodyForLog(response) {
+  if (!isDebugLogEnabled()) {
+    return void 0;
+  }
+  try {
+    return await response.clone().text();
+  } catch {
+    return void 0;
+  }
+}
+function tapStream(name, stream) {
+  const original = stream.write.bind(stream);
+  const decoder = new TextDecoder("utf-8");
+  stream.write = ((chunk, ...rest) => {
+    try {
+      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
+      append({ kind: "output", stream: name, text });
+    } catch {
+    }
+    return original(chunk, ...rest);
+  });
+}
+var tapsInstalled = false;
+function installStreamTaps() {
+  if (tapsInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  tapsInstalled = true;
+  tapStream("stdout", process.stdout);
+  tapStream("stderr", process.stderr);
+}
+
+export {
+  logInvocation,
+  installExitRecord,
+  debugLogHttp,
+  readBodyForLog,
+  installStreamTaps
+};
+//# sourceMappingURL=chunk-IFWP3ZDO.js.map

package/dist/chunk-IFWP3ZDO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/chunk-JERXV5A3.js

@@ -0,0 +1,26 @@
+import {
+  writeJsonEnvelope
+} from "./chunk-VFIOJD5M.js";
+import {
+  apiGet
+} from "./chunk-XBOK23HI.js";
+
+// src/available-accounts.ts
+var AVAILABLE_ARG = {
+  type: "boolean",
+  description: "List everything the connected login reaches, each marked selected: true|false. Use it when the account, property, site or container the user means is not in the plain list.",
+  required: false
+};
+async function writeAvailableAccounts(platform, onError) {
+  try {
+    writeJsonEnvelope(await apiGet("/api/connections/available", { platform }));
+  } catch (err) {
+    onError(err);
+  }
+}
+
+export {
+  AVAILABLE_ARG,
+  writeAvailableAccounts
+};
+//# sourceMappingURL=chunk-JERXV5A3.js.map

package/dist/chunk-JYWZRDLZ.js

@@ -0,0 +1,297 @@
+import {
+  REDDIT_LINK_REJECTED,
+  redditSearchHints,
+  redditSubredditsHints,
+  redditThreadHints
+} from "./chunk-QZOS6FXW.js";
+import {
+  handleResearchError,
+  writeResearchJson
+} from "./chunk-WNFIJAUO.js";
+import {
+  repeatedValues
+} from "./chunk-ERSX3MKH.js";
+import {
+  RESEARCH_REDDIT_THREAD_DEFAULT_COMMENTS
+} from "./chunk-EUFCY63X.js";
+import {
+  apiPost
+} from "./chunk-XBOK23HI.js";
+import {
+  registerSchema
+} from "./chunk-NU7JSWVA.js";
+
+// src/commands/research/reddit.ts
+import { defineCommand } from "citty";
+var TIMEOUT_MS = 18e4;
+var TEXT_PREVIEW_CHARS = 1500;
+var ITEM_FIELDS = {
+  kind: "post or comment",
+  subreddit: "Where it was said",
+  title: "The post's title (on a comment: the post it answers)",
+  text: "Verbatim \u2014 quote this, exactly",
+  text_truncated: "The text was cut; re-run with --full before quoting the end of it",
+  author: "Reddit username, or null once the account is deleted",
+  score: "Points",
+  comment_count: "Posts only",
+  created: "Date written (UTC)",
+  permalink: "Cite THIS link \u2014 it is built from where the words actually are",
+  depth: "Thread comments: 0 answers the post, 1 answers a comment",
+  source: "reddit_api / reddit_web = live Reddit; archive = the Arctic Shift archive of Reddit"
+};
+registerSchema({
+  command: "research.reddit.search",
+  description: "Search Reddit posts or comments for the audience's own words. Returns verbatim text with a real permalink for each hit. Start here for voice-of-customer work on Reddit.",
+  args: {
+    query: {
+      type: "string",
+      description: "Words to match \u2014 the audience's phrasing, not a description of it",
+      required: true
+    },
+    subreddit: {
+      type: "string",
+      description: "Subreddits to search (up to 10): comma-separated (couriersofreddit,AmazonFlexUK) or the flag repeated. Needed for --kind comments",
+      required: false
+    },
+    kind: {
+      type: "string",
+      description: "posts (default) or comments \u2014 the replies are where most of the voice is",
+      required: false,
+      enum: ["posts", "comments"]
+    },
+    since: { type: "string", description: "Only things written on or after this day, YYYY-MM-DD", required: false },
+    limit: { type: "number", description: "Results to return (1-50, default 25)", required: false },
+    full: {
+      type: "boolean",
+      description: "Return every text whole instead of a preview",
+      required: false,
+      default: false
+    }
+  }
+});
+registerSchema({
+  command: "research.reddit.thread",
+  description: "Read one Reddit thread verbatim: the post and its best comments, each with its own permalink. Use it on any Reddit link before quoting it \u2014 it also exposes links that point somewhere other than they claim.",
+  args: {
+    target: {
+      type: "string",
+      description: "The thread's link (any Reddit form, including share links) or post id",
+      required: true
+    },
+    comments: { type: "number", description: "Comments to return, best first (0-200, default 40)", required: false },
+    full: {
+      type: "boolean",
+      description: "Return every text whole instead of a preview",
+      required: false,
+      default: false
+    }
+  }
+});
+registerSchema({
+  command: "research.reddit.subreddits",
+  description: "Find the subreddits where an audience talks about a topic, with member counts and whether they can be read. Run it before searching, instead of guessing subreddit names.",
+  args: {
+    query: { type: "string", description: 'The audience or topic, e.g. "amazon flex uk", "deliveroo"', required: true },
+    limit: { type: "number", description: "Subreddits to return (1-25, default 10)", required: false }
+  }
+});
+function searchReddit(body) {
+  return apiPost("/api/research/reddit/search", body, { timeoutMs: TIMEOUT_MS });
+}
+function findSubreddits(body) {
+  return apiPost("/api/research/reddit/subreddits", body, { timeoutMs: TIMEOUT_MS });
+}
+function row(item, full) {
+  const cut = !full && item.text.length > TEXT_PREVIEW_CHARS;
+  return {
+    kind: item.kind,
+    subreddit: item.subreddit,
+    title: item.title,
+    text: cut ? `${item.text.slice(0, TEXT_PREVIEW_CHARS)}\u2026` : item.text,
+    ...cut ? { text_truncated: true } : {},
+    author: item.author,
+    score: item.score,
+    ...item.kind === "post" ? { comment_count: item.commentCount } : {},
+    created: item.createdAt.slice(0, 10),
+    permalink: item.permalink,
+    ...item.depth !== null ? { depth: item.depth } : {}
+  };
+}
+function redditFix(code) {
+  if (code === "NOT_FOUND") return REDDIT_LINK_REJECTED;
+  if (code === "BAD_REQUEST" || code === "VALIDATION_ERROR") {
+    return { action: "retry_with_changes", explanation: "Follow the message above and run the command again." };
+  }
+  return {
+    action: "continue_without",
+    explanation: "Don't loop on it. Finish the job with the other sources, say plainly that Reddit is a gap in this research, and never stand in a summary's paraphrase for a Reddit quote."
+  };
+}
+function failValidation(message) {
+  writeResearchJson({ ok: false, error: { code: "VALIDATION_ERROR", message, fix: redditFix("VALIDATION_ERROR") } });
+  process.exit(1);
+}
+function subredditsFromArgs(rawArgs, parsed) {
+  return repeatedValues(rawArgs, "subreddit", parsed).flatMap((value) => value.split(",")).map((name) => name.trim()).filter(Boolean);
+}
+var searchCommand = defineCommand({
+  meta: {
+    name: "search",
+    description: `Search Reddit for the audience's own words, verbatim, each with a permalink you can cite.
+
+Start here for Reddit voice-of-customer. Matches words, not meaning \u2014 search the way the audience writes, and quote a phrase to keep it together ('"right to work"').
+
+Examples:
+  baker research reddit search "agency never paid" --subreddit couriersofreddit,AmazonFlexUK
+  baker research reddit search '"right to work"' --subreddit UKJobs,AmazonFlexUK
+  baker research reddit search "visa" --subreddit UberEATS --kind comments --since 2025-01-01
+  baker research reddit search "side hustle student deliveries"`
+  },
+  args: {
+    query: { type: "positional", description: "Words to match", required: false },
+    subreddit: {
+      type: "string",
+      description: "Subreddits (up to 10): comma-separated, or repeat the flag",
+      required: false
+    },
+    kind: { type: "string", description: "posts (default) or comments", required: false },
+    since: { type: "string", description: "YYYY-MM-DD", required: false },
+    limit: { type: "string", description: "1-50, default 25", required: false },
+    full: { type: "boolean", description: "Whole texts, not previews", required: false }
+  },
+  run: async ({ args, rawArgs }) => {
+    const query = args.query?.trim();
+    if (!query) failValidation('Say what to search for: baker research reddit search "<words>"');
+    const kind = args.kind ?? "posts";
+    if (kind !== "posts" && kind !== "comments") failValidation("--kind must be posts or comments");
+    const body = {
+      query,
+      kind,
+      subreddits: subredditsFromArgs(rawArgs, args.subreddit)
+    };
+    if (args.since) body.since = args.since;
+    if (args.limit) body.limit = Number(args.limit);
+    try {
+      const data = await searchReddit(body);
+      writeResearchJson({
+        ok: true,
+        data: data.results.map((item) => row(item, Boolean(args.full))),
+        source: data.source,
+        fields: ITEM_FIELDS,
+        hints: redditSearchHints({ resultCount: data.results.length, kind, source: data.source })
+      });
+    } catch (err) {
+      handleResearchError(err, redditFix);
+    }
+  }
+});
+var threadCommand = defineCommand({
+  meta: {
+    name: "thread",
+    description: `Read one Reddit thread verbatim \u2014 the post and its best comments, each with its own permalink.
+
+Run it on every Reddit link before you quote from it, including links a research summary gave you: it refuses a link whose post is somewhere other than the link claims.
+
+Examples:
+  baker research reddit thread "https://www.reddit.com/r/AmazonFlexUK/comments/1abc2de/agency_still_hasnt_paid_me/"
+  baker research reddit thread "https://www.reddit.com/r/UberEATS/s/3TzXiyxaMD" --comments 100
+  baker research reddit thread 1abc2de --full`
+  },
+  args: {
+    target: { type: "positional", description: "Thread link or post id", required: false },
+    comments: { type: "string", description: "0-200, default 40", required: false },
+    full: { type: "boolean", description: "Whole texts, not previews", required: false }
+  },
+  run: async ({ args }) => {
+    const target = args.target?.trim();
+    if (!target) failValidation("Pass the thread's link or post id: baker research reddit thread <url>");
+    const commentsAsked = args.comments ? Number(args.comments) : RESEARCH_REDDIT_THREAD_DEFAULT_COMMENTS;
+    const body = { target, comments: commentsAsked };
+    try {
+      const data = await apiPost("/api/research/reddit/thread", body, {
+        timeoutMs: TIMEOUT_MS
+      });
+      const full = Boolean(args.full);
+      writeResearchJson({
+        ok: true,
+        data: { post: row(data.post, full), comments: data.comments.map((item) => row(item, full)) },
+        source: data.source,
+        fields: ITEM_FIELDS,
+        hints: redditThreadHints({
+          commentsShown: data.comments.length,
+          commentsAsked,
+          commentCount: data.post.commentCount,
+          source: data.source
+        })
+      });
+    } catch (err) {
+      handleResearchError(err, redditFix);
+    }
+  }
+});
+var subredditsCommand = defineCommand({
+  meta: {
+    name: "subreddits",
+    description: `Find the subreddits where an audience talks \u2014 name, members, and whether it can be read.
+
+Run it before \`reddit search\` instead of guessing names: a plausible-sounding subreddit can be dead (r/CouriersUK has one post), while the conversation sits in r/AmazonFlexUK or r/deliveroos.
+
+Examples:
+  baker research reddit subreddits "amazon flex uk"
+  baker research reddit subreddits "deliveroo" --limit 5`
+  },
+  args: {
+    query: { type: "positional", description: "Audience or topic", required: false },
+    limit: { type: "string", description: "1-25, default 10", required: false }
+  },
+  run: async ({ args }) => {
+    const query = args.query?.trim();
+    if (!query) failValidation('Say what to look for: baker research reddit subreddits "<audience or topic>"');
+    const body = { query };
+    if (args.limit) body.limit = Number(args.limit);
+    try {
+      const data = await findSubreddits(body);
+      writeResearchJson({
+        ok: true,
+        data: data.results,
+        source: data.source,
+        fields: {
+          name: "Pass this to --subreddit",
+          subscribers: "Members \u2014 size, not activity",
+          access: "public / restricted (readable, members post) / private (unreadable) / null when the source doesn't say",
+          description: "The subreddit's own summary",
+          url: "The subreddit"
+        },
+        hints: redditSubredditsHints({ resultCount: data.results.length })
+      });
+    } catch (err) {
+      handleResearchError(err, redditFix);
+    }
+  }
+});
+var redditCommand = defineCommand({
+  meta: {
+    name: "reddit",
+    description: `Read Reddit verbatim \u2014 the one site no page reader will open for us.
+
+Commands:
+  subreddits \u2014 Find where the audience talks (start here)
+  search     \u2014 Find posts or comments in the audience's own words
+  thread     \u2014 Read one thread: the post and its best comments
+
+Examples:
+  baker research reddit subreddits "amazon flex uk"
+  baker research reddit search "agency never paid" --subreddit couriersofreddit,AmazonFlexUK --kind comments
+  baker research reddit thread "https://www.reddit.com/r/AmazonFlexUK/comments/1abc2de/"
+Full guide: __tooling__/docs/tools/baker/research.md`
+  },
+  subCommands: { subreddits: subredditsCommand, search: searchCommand, thread: threadCommand }
+});
+
+export {
+  searchReddit,
+  findSubreddits,
+  subredditsFromArgs,
+  redditCommand
+};
+//# sourceMappingURL=chunk-JYWZRDLZ.js.map

package/dist/chunk-K46X77UI.js

@@ -0,0 +1,51 @@
+import {
+  failApi
+} from "./chunk-4JHUG6Y3.js";
+import {
+  HUBSPOT_MISSING_GRANT_MARKER,
+  HUBSPOT_NOT_CONNECTED_MESSAGE
+} from "./chunk-EUFCY63X.js";
+import {
+  ApiError
+} from "./chunk-XBOK23HI.js";
+import {
+  writeJson
+} from "./chunk-NU7JSWVA.js";
+
+// src/commands/hubspot/refusal.ts
+var CONTINUE = "Keep going with the wider task: say which part you could not read, skip it, and finish everything else. If the `request_connection` call fails, say so plainly and give the exact route: dashboard \u2192 Brain \u2192 Integrations \u2192 Platforms \u2192 HubSpot.";
+function hubspotRefusal(code, message, reason = "so I can count a contact becoming a customer") {
+  if (code === "NOT_FOUND" && message.includes(HUBSPOT_NOT_CONNECTED_MESSAGE)) {
+    return {
+      code: "NO_HUBSPOT_CONNECTION",
+      fix: {
+        action: "request_connection",
+        explanation: `AGENT INSTRUCTION: HubSpot is not connected, and only the user can connect it. Call the \`request_connection\` tool with { platform: "hubspot", reason } \u2014 reason in their words, e.g. "${reason}" \u2014 and they connect it inside the chat; then run this command again. ` + CONTINUE
+      }
+    };
+  }
+  if (code === "FORBIDDEN" && message.includes(HUBSPOT_MISSING_GRANT_MARKER)) {
+    return {
+      code: "HUBSPOT_RECONNECT_REQUIRED",
+      fix: {
+        action: "request_connection",
+        explanation: 'AGENT INSTRUCTION: HubSpot is connected \u2014 do not tell the user it is missing, and do not retry. Its access does not cover this read (it was connected before Baker asked for it, or the access was withdrawn), and only the user can widen it. Call the `request_connection` tool with { platform: "hubspot", reason } naming what you need to read; the card offers them a Reconnect button. Run this command again once they have. ' + CONTINUE
+      }
+    };
+  }
+  return null;
+}
+function failNotConnected(err, reason) {
+  const refusal = err instanceof ApiError ? hubspotRefusal(err.code, err.message, reason) : null;
+  if (err instanceof ApiError && refusal !== null) {
+    writeJson({ ok: false, error: { code: refusal.code, message: err.message, fix: refusal.fix } });
+    process.exit(1);
+  }
+  failApi(err);
+}
+
+export {
+  hubspotRefusal,
+  failNotConnected
+};
+//# sourceMappingURL=chunk-K46X77UI.js.map