@koda-sl/baker-cli 0.465.0 → 0.467.0

package/dist/chunk-7KSJUVNK.js

@@ -1,346 +0,0 @@
-import {
-  handleLinkedinError,
-  resolveAccountIdArg
-} from "./chunk-OEWBWKDE.js";
-import {
-  adCopyHints,
-  booleanWordPositionalError,
-  capabilityFix
-} from "./chunk-5LHDRP5F.js";
-import {
-  withHints
-} from "./chunk-D5FY4FAK.js";
-import {
-  writeJsonEnvelope
-} from "./chunk-VAX5ITZ5.js";
-import {
-  LINKEDIN_DRAFT_BATCH_MAX,
-  linkedinDraftOpInputSchema
-} from "./chunk-ZJVHZHYP.js";
-import {
-  apiPost
-} from "./chunk-T2MH5SCT.js";
-import {
-  requireChatId
-} from "./chunk-7DIIZUZO.js";
-
-// src/commands/ads/linkedin/write-shared.ts
-import { createHash } from "crypto";
-import { readFileSync } from "fs";
-var TOTAL_BUDGET_HELP = "Lifetime budget \u2014 on something already running it must exceed spend to date, or LinkedIn rejects it";
-function bareAccountId(args) {
-  const raw = resolveAccountIdArg(args);
-  return raw.replace(/^urn:li:sponsoredAccount:/, "").replace(/^sponsoredAccount:/, "");
-}
-function failWriteValidation(message) {
-  writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
-  process.exit(1);
-}
-function loadJsonFileArg(path) {
-  if (typeof path !== "string" || path.length === 0) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      failWriteValidation(`${path} must contain a JSON object`);
-    }
-    return parsed;
-  } catch (err) {
-    if (err instanceof SyntaxError) {
-      failWriteValidation(`${path} is not valid JSON: ${err.message}`);
-    }
-    throw err;
-  }
-}
-function mergePayload(file, flags) {
-  const merged = { ...file };
-  for (const [key, value] of Object.entries(flags)) {
-    if (value !== void 0) {
-      merged[key] = value;
-    }
-  }
-  return merged;
-}
-function loadPatchArg(args) {
-  const file = typeof args.file === "string" && args.file.length > 0 ? args.file : void 0;
-  const inline = typeof args.patch === "string" && args.patch.length > 0 ? args.patch : void 0;
-  if (Boolean(file) === Boolean(inline)) {
-    failWriteValidation("pass exactly one of --file <patch.json> or --patch '<json>'");
-  }
-  if (file) {
-    return loadJsonFileArg(file);
-  }
-  try {
-    const parsed = JSON.parse(inline);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      failWriteValidation("--patch must be a JSON object");
-    }
-    return parsed;
-  } catch (err) {
-    if (err instanceof SyntaxError) {
-      failWriteValidation(`--patch is not valid JSON: ${err.message}`);
-    }
-    throw err;
-  }
-}
-function parseMoneyFlag(amount, currency, flag) {
-  if (amount === void 0 || amount === null || amount === "") {
-    return void 0;
-  }
-  if (currency === void 0 || currency === null || currency === "") {
-    return { amount: String(amount) };
-  }
-  if (typeof currency !== "string" || currency.length !== 3) {
-    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like EUR)`);
-  }
-  return { amount: String(amount), currencyCode: currency.toUpperCase() };
-}
-function parseDateFlag(value, flag) {
-  if (value === void 0 || value === null || value === "") {
-    return void 0;
-  }
-  const raw = String(value);
-  if (/^\d{10,}$/.test(raw)) {
-    return Number(raw);
-  }
-  const parsed = Date.parse(raw);
-  if (Number.isNaN(parsed)) {
-    failWriteValidation(`${flag} must be an ISO date (2026-07-10) or epoch milliseconds`);
-  }
-  return parsed;
-}
-function parseOnOffFlag(value, flag) {
-  if (value === void 0 || value === null || value === "") {
-    return void 0;
-  }
-  const raw = String(value).toLowerCase();
-  if (raw === "on" || raw === "true") {
-    return true;
-  }
-  if (raw === "off" || raw === "false") {
-    return false;
-  }
-  failWriteValidation(`${flag} must be on|off`);
-}
-function parseLocaleFlag(value) {
-  if (value === void 0 || value === null || value === "") {
-    return void 0;
-  }
-  const match = /^([a-z]{2})[_-]([A-Za-z]{2})$/.exec(String(value));
-  if (!match) {
-    failWriteValidation("--locale must look like en_US (language_COUNTRY)");
-  }
-  return { language: match[1], country: match[2].toUpperCase() };
-}
-function loadTargetingFileArg(path) {
-  if (typeof path !== "string" || path.length === 0) {
-    return void 0;
-  }
-  const parsed = loadJsonFileArg(path);
-  const criteria = parsed.targetingCriteria ?? parsed;
-  if (!criteria.include) {
-    failWriteValidation(
-      `${path} must contain targeting criteria with an "include" block (see baker schema ads.linkedin.campaigns.create)`
-    );
-  }
-  return criteria;
-}
-function sha256Lower(value) {
-  return createHash("sha256").update(value.trim().toLowerCase()).digest("hex");
-}
-function parseCsvLine(line) {
-  const cells = [];
-  let current = "";
-  let inQuotes = false;
-  for (let i = 0; i < line.length; i++) {
-    const char = line[i];
-    if (inQuotes) {
-      if (char === '"' && line[i + 1] === '"') {
-        current += '"';
-        i++;
-      } else if (char === '"') {
-        inQuotes = false;
-      } else {
-        current += char;
-      }
-    } else if (char === '"') {
-      inQuotes = true;
-    } else if (char === ",") {
-      cells.push(current);
-      current = "";
-    } else {
-      current += char;
-    }
-  }
-  cells.push(current);
-  return cells.map((cell) => cell.trim());
-}
-function parseListFileArg(path, maxRows) {
-  if (typeof path !== "string" || path.length === 0) {
-    return void 0;
-  }
-  const raw = readFileSync(path, "utf8");
-  const lines = raw.split(/\r?\n/).filter((line) => line.trim().length > 0);
-  if (lines.length < 2) {
-    failWriteValidation(`${path} needs a header row and at least one data row`);
-  }
-  const columns = parseCsvLine(lines[0]).map((column) => column.trim());
-  const rows = [];
-  for (const line of lines.slice(1)) {
-    const cells = parseCsvLine(line);
-    const row = {};
-    columns.forEach((column, index) => {
-      const value = cells[index] ?? "";
-      if (!value) {
-        return;
-      }
-      row[column] = column.toLowerCase() === "email" ? sha256Lower(value) : value;
-    });
-    if (Object.keys(row).length > 0) {
-      rows.push(row);
-    }
-  }
-  if (rows.length > maxRows) {
-    failWriteValidation(`${path} has ${rows.length} rows \u2014 the inline limit is ${maxRows}. Split the list.`);
-  }
-  return { columns, rows };
-}
-function failPreflight(fields) {
-  writeJsonEnvelope({
-    ok: false,
-    error: {
-      code: "VALIDATION_ERROR",
-      message: fields.map((field) => field.path ? `${field.path}: ${field.message}` : field.message).join("; "),
-      fields,
-      fix: capabilityFix("linkedin-ads")
-    }
-  });
-  process.exit(1);
-}
-var BATCH_NUDGE = "This command takes several ids at once \u2014 pass them comma-separated or with --ids-file instead of one call per id.";
-function batchNudge(data) {
-  return data.sameKindStaged === void 0 ? [] : [BATCH_NUDGE];
-}
-async function stageOp(raw, hints) {
-  const preflight = linkedinDraftOpInputSchema.safeParse(raw);
-  if (!preflight.success) {
-    failPreflight(preflight.error.issues.map((issue) => ({ path: issue.path.join("."), message: issue.message })));
-  }
-  try {
-    const chatId = requireChatId();
-    const response = await apiPost("/api/ads/linkedin/draft/stage", {
-      chatId,
-      op: preflight.data
-    });
-    const allHints = [...batchNudge(response.data), ...hints ?? [], ...await adCopyHints(preflight.data)];
-    writeJsonEnvelope(withHints(response, allHints));
-  } catch (err) {
-    handleLinkedinError(err);
-  }
-}
-async function stageLinkedinOps(rawOps, hints) {
-  if (rawOps.length === 1 && rawOps[0]) {
-    await stageOp(rawOps[0], hints);
-    return;
-  }
-  const ops = [];
-  for (const [index, raw] of rawOps.entries()) {
-    const preflight = linkedinDraftOpInputSchema.safeParse(raw);
-    if (!preflight.success) {
-      failPreflight(
-        preflight.error.issues.map((issue) => ({
-          path: `ops[${index}]${issue.path.length > 0 ? `.${issue.path.join(".")}` : ""}`,
-          message: issue.message
-        }))
-      );
-    }
-    ops.push(preflight.data);
-  }
-  try {
-    const chatId = requireChatId();
-    const response = await apiPost("/api/ads/linkedin/draft/stage-batch", { chatId, ops });
-    const allHints = [...hints ?? [], ...await adCopyHints(ops)];
-    writeJsonEnvelope(withHints(response, allHints));
-  } catch (err) {
-    handleLinkedinError(err);
-  }
-}
-async function stageStatusChange(input) {
-  const payload = input.kind === "creative.update" ? { intendedStatus: input.status } : { status: input.status };
-  await stageLinkedinOps(
-    input.targets.map((target) => ({ kind: input.kind, accountId: input.accountId, target, payload }))
-  );
-}
-function requireTarget(args, entity) {
-  const inverted = booleanWordPositionalError(args, entity);
-  if (inverted !== void 0) {
-    failWriteValidation(inverted);
-  }
-  const positionals = readPositionals(args);
-  const target = args.id ?? args.target ?? args.ref ?? positionals[0];
-  if (typeof target !== "string" || target.length === 0) {
-    failWriteValidation(`pass the ${entity} id or URN as the positional argument`);
-  }
-  if (positionals.length > 1 || splitIdList(target).length > 1) {
-    failWriteValidation(
-      `this command takes one ${entity} id \u2014 run it once per id. Only pause/resume/archive and 'creatives update' accept several ids in one call.`
-    );
-  }
-  return target;
-}
-function readPositionals(args) {
-  if (!Array.isArray(args._)) {
-    return [];
-  }
-  return args._.filter((value) => typeof value === "string" && value.length > 0);
-}
-function splitIdList(raw) {
-  return raw.split(",").map((id) => id.trim()).filter(Boolean);
-}
-function idsFileEntries(path) {
-  if (typeof path !== "string" || path.length === 0) {
-    return [];
-  }
-  return readFileSync(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).flatMap(splitIdList);
-}
-function requireTargets(args, entity) {
-  const positionals = readPositionals(args);
-  const named = [args.id, args.target, args.ref].filter(
-    (value) => typeof value === "string" && value.length > 0
-  );
-  const fromArgs = positionals.length > 0 ? positionals : named;
-  const targets = [.../* @__PURE__ */ new Set([...fromArgs.flatMap(splitIdList), ...idsFileEntries(args["ids-file"])])];
-  if (targets.length === 0) {
-    failWriteValidation(
-      `pass the ${entity} id or URN as the positional argument (comma-separated for several), or --ids-file <path>`
-    );
-  }
-  if (targets.length > LINKEDIN_DRAFT_BATCH_MAX) {
-    failWriteValidation(
-      `${targets.length} ids exceeds the batch limit of ${LINKEDIN_DRAFT_BATCH_MAX} \u2014 split the list`
-    );
-  }
-  return targets;
-}
-
-export {
-  TOTAL_BUDGET_HELP,
-  bareAccountId,
-  failWriteValidation,
-  loadJsonFileArg,
-  mergePayload,
-  loadPatchArg,
-  parseMoneyFlag,
-  parseDateFlag,
-  parseOnOffFlag,
-  parseLocaleFlag,
-  loadTargetingFileArg,
-  parseListFileArg,
-  stageOp,
-  stageLinkedinOps,
-  stageStatusChange,
-  requireTarget,
-  requireTargets
-};
-//# sourceMappingURL=chunk-7KSJUVNK.js.map

package/dist/chunk-7LWVWFIV.js

@@ -1,215 +0,0 @@
-import {
-  debugLogSetting
-} from "./chunk-7DIIZUZO.js";
-
-// src/debugLog.ts
-import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
-var DEFAULT_FILE = "baker-cli-debug.jsonl";
-var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
-var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
-var MAX_BYTES = 64 * 1024 * 1024;
-var REDACTIONS = [
-  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
-  // Authorization headers
-  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
-  // the literal `bk_`, so the company-key rule matched no part of the read-only
-  // credential a Session review runs with.
-  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
-  // Baker API keys
-  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
-  // JWTs / id tokens
-  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
-  // Google OAuth access tokens
-  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
-  // Google refresh tokens
-  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
-  // Meta/Facebook access tokens
-];
-function redactSecrets(input) {
-  let out = input;
-  for (const [pattern, replacement] of REDACTIONS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-var CREDENTIAL_VALUE = "[credential value]";
-var CREDENTIAL_PUT_PATH = "/api/credentials/put";
-function withoutCredentialValue(url, body) {
-  let path;
-  try {
-    path = new URL(url).pathname;
-  } catch {
-    path = url;
-  }
-  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
-    return body;
-  }
-  return { ...body, value: CREDENTIAL_VALUE };
-}
-var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
-function argvWithoutCredentialValue(argv) {
-  if (argv[0] !== "credentials" || argv[1] !== "put") {
-    return argv;
-  }
-  let nameSeen = false;
-  let keepNext = false;
-  let redactNext = false;
-  return argv.map((arg, index) => {
-    if (index < 2) return arg;
-    if (keepNext || redactNext) {
-      const kept = keepNext ? arg : CREDENTIAL_VALUE;
-      keepNext = false;
-      redactNext = false;
-      return kept;
-    }
-    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
-    redactNext = arg === "--value";
-    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
-    if (arg.startsWith("-")) return arg;
-    const isName = !nameSeen;
-    nameSeen = true;
-    return isName ? arg : CREDENTIAL_VALUE;
-  });
-}
-function resolveTarget() {
-  const raw = debugLogSetting();
-  if (!raw) {
-    return void 0;
-  }
-  const lower = raw.toLowerCase();
-  if (BOOLEAN_OFF.has(lower)) {
-    return void 0;
-  }
-  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
-  return isAbsolute(target) ? target : resolve(process.cwd(), target);
-}
-function isDebugLogEnabled() {
-  return resolveTarget() !== void 0;
-}
-var sessionId;
-function getSessionId() {
-  if (!sessionId) {
-    sessionId = `${process.pid}-${Date.now()}`;
-  }
-  return sessionId;
-}
-var trackedPath;
-var bytesInFile = 0;
-function ensureReady(filePath) {
-  if (trackedPath !== filePath) {
-    trackedPath = filePath;
-    mkdirSync(dirname(filePath), { recursive: true });
-    try {
-      bytesInFile = statSync(filePath).size;
-    } catch {
-      bytesInFile = 0;
-    }
-  }
-}
-function append(entry) {
-  const filePath = resolveTarget();
-  if (!filePath) {
-    return;
-  }
-  try {
-    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
-    const line = `${redactSecrets(JSON.stringify(payload))}
-`;
-    ensureReady(filePath);
-    const size = Buffer.byteLength(line);
-    if (bytesInFile + size > MAX_BYTES) {
-      renameSync(filePath, `${filePath}.1`);
-      bytesInFile = 0;
-    }
-    appendFileSync(filePath, line);
-    bytesInFile += size;
-  } catch {
-  }
-}
-function errorToPlain(err) {
-  if (err instanceof Error) {
-    const code = err.code;
-    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
-  }
-  return { message: String(err) };
-}
-var invocationStartedAt;
-function logInvocation(argv) {
-  invocationStartedAt = Date.now();
-  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
-}
-function logExit(code) {
-  append({
-    kind: "exit",
-    code,
-    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
-  });
-}
-var exitHookInstalled = false;
-function installExitRecord() {
-  if (exitHookInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  exitHookInstalled = true;
-  process.on("exit", (code) => {
-    logExit(typeof code === "number" ? code : 0);
-  });
-}
-function debugLogHttp(entry) {
-  if (!isDebugLogEnabled()) {
-    return;
-  }
-  append({
-    kind: "http",
-    source: entry.source,
-    method: entry.method,
-    url: entry.url,
-    durationMs: entry.durationMs,
-    request: withoutCredentialValue(entry.url, entry.requestBody),
-    status: entry.status,
-    ok: entry.ok,
-    response: entry.responseBody,
-    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
-  });
-}
-async function readBodyForLog(response) {
-  if (!isDebugLogEnabled()) {
-    return void 0;
-  }
-  try {
-    return await response.clone().text();
-  } catch {
-    return void 0;
-  }
-}
-function tapStream(name, stream) {
-  const original = stream.write.bind(stream);
-  const decoder = new TextDecoder("utf-8");
-  stream.write = ((chunk, ...rest) => {
-    try {
-      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
-      append({ kind: "output", stream: name, text });
-    } catch {
-    }
-    return original(chunk, ...rest);
-  });
-}
-var tapsInstalled = false;
-function installStreamTaps() {
-  if (tapsInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  tapsInstalled = true;
-  tapStream("stdout", process.stdout);
-  tapStream("stderr", process.stderr);
-}
-
-export {
-  logInvocation,
-  installExitRecord,
-  debugLogHttp,
-  readBodyForLog,
-  installStreamTaps
-};
-//# sourceMappingURL=chunk-7LWVWFIV.js.map

package/dist/chunk-7LWVWFIV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}

package/dist/chunk-7V2FDO3O.js

@@ -1,56 +0,0 @@
-import {
-  ApiError,
-  apiGet
-} from "./chunk-T2MH5SCT.js";
-import {
-  compactImage,
-  compactVideo,
-  writeJson
-} from "./chunk-SHVQFDNY.js";
-
-// src/commands/mediaGroup.ts
-async function runMediaGroupLookup(input) {
-  if (!input.id && !input.groupKey) {
-    writeJson({
-      ok: false,
-      error: { code: "VALIDATION_ERROR", message: `Pass ${input.idLabel} or --group-key` }
-    });
-    process.exit(1);
-  }
-  try {
-    const query = new URLSearchParams();
-    if (input.id) query.set("id", input.id);
-    if (input.groupKey) query.set("groupKey", input.groupKey);
-    const data = await apiGet(`${input.path}?${query.toString()}`);
-    const images = data.images.map((image) => compactImage(image));
-    const videos = (data.videos ?? []).map((video) => compactVideo(video));
-    const count = images.length + videos.length;
-    writeJson({
-      ok: true,
-      data: {
-        groupKey: data.groupKey,
-        groupKind: data.groupKind ?? null,
-        // The caption or page title the whole set shares — often the only
-        // place the campaign is named.
-        groupTitle: data.groupTitle ?? null,
-        groupUrl: data.groupUrl ?? null,
-        count,
-        images,
-        videos
-      },
-      hints: count > 1 ? ["These arrived together and are ordered. Read them in sequence before using any one of them alone."] : void 0
-    });
-  } catch (err) {
-    if (err instanceof ApiError) {
-      writeJson({ ok: false, error: { code: err.code, message: err.message } });
-      process.exit(1);
-    }
-    writeJson({ ok: false, error: { code: "INTERNAL_ERROR", message: "Unexpected error" } });
-    process.exit(1);
-  }
-}
-
-export {
-  runMediaGroupLookup
-};
-//# sourceMappingURL=chunk-7V2FDO3O.js.map