@koda-sl/baker-cli 0.466.0 → 0.468.0

package/dist/chunk-63LJAQ4E.js

@@ -1,197 +0,0 @@
-import {
-  mediaTagsCreateRequestSchema,
-  mediaTagsDeleteRequestSchema,
-  mediaTagsUpdateRequestSchema
-} from "./chunk-ZJVHZHYP.js";
-import {
-  ApiError,
-  apiGet,
-  apiPost
-} from "./chunk-P5NYZ236.js";
-import {
-  registerSchema,
-  writeJson
-} from "./chunk-MEBOQXW3.js";
-
-// src/lib/tags-command.ts
-import { defineCommand } from "citty";
-var OUTPUT_ARG = {
-  output: { type: "string", description: "Output format: md|json", required: false, default: "md" }
-};
-var SHARED_POOL_HINT = "Custom tags are one pool shared by images, videos and testimonials \u2014 this change shows up in all three. Already applied: publishing or discarding this chat does not undo it.";
-function fail(err) {
-  const code = err instanceof ApiError ? err.code : "INTERNAL_ERROR";
-  const message = err instanceof ApiError ? err.message : "Unexpected error";
-  writeJson({ ok: false, error: { code, message } });
-  process.exit(1);
-}
-function failInvalid(issue) {
-  writeJson({ ok: false, error: { code: "VALIDATION_ERROR", message: issue?.message ?? "Invalid request" } });
-  process.exit(1);
-}
-function makeTagsCommand(command, label, endpoint) {
-  registerSchema({
-    command: `${command}.tags.list`,
-    description: `List the available ${label} tag taxonomy (built-in defaults + this company's custom tags).`,
-    args: OUTPUT_ARG
-  });
-  const listCommand = defineCommand({
-    meta: {
-      name: "list",
-      description: `List the available ${label} tag names (defaults + company custom tags). Use before filtering with --tags. Example: baker ${command} tags`
-    },
-    args: OUTPUT_ARG,
-    run: async ({ args }) => {
-      try {
-        const { markdown } = await apiGet(endpoint);
-        if (args.output === "json") {
-          writeJson({ ok: true, data: { markdown } });
-          return;
-        }
-        process.stdout.write(`${markdown.trimEnd()}
-`);
-      } catch (err) {
-        const code = err instanceof ApiError ? err.code : "INTERNAL_ERROR";
-        const message = err instanceof ApiError ? err.message : "Unexpected error";
-        if (args.output === "json") {
-          writeJson({ ok: false, error: { code, message } });
-        } else {
-          process.stderr.write(`Error: ${message}
-`);
-        }
-        process.exit(1);
-      }
-    }
-  });
-  const createArgs = {
-    name: { type: "positional", description: "Tag name (stored lowercased, spaces \u2192 hyphens)", required: true },
-    description: {
-      type: "string",
-      description: "What the tag means, so it gets applied consistently",
-      required: false
-    }
-  };
-  registerSchema({
-    command: `${command}.tags.create`,
-    description: "Create a custom media tag in the company's shared pool (images, videos and testimonials). Applies immediately. Use when no built-in or custom tag fits.",
-    args: {
-      name: { type: "string", description: "Tag name (stored lowercased, spaces \u2192 hyphens)", required: true },
-      description: createArgs.description
-    }
-  });
-  const createCommand = defineCommand({
-    meta: {
-      name: "create",
-      description: `Create a custom tag (shared by images, videos and testimonials). Applies immediately.
-
-Example: baker ${command} tags create "summer sale" --description "Assets for the summer sale campaign"`
-    },
-    args: createArgs,
-    run: async ({ args }) => {
-      const parsed = mediaTagsCreateRequestSchema.safeParse({
-        name: String(args.name ?? ""),
-        ...args.description ? { description: String(args.description) } : {}
-      });
-      if (!parsed.success) failInvalid(parsed.error.issues[0]);
-      try {
-        const data = await apiPost("/api/media-tags/create", parsed.data);
-        writeJson({
-          ok: true,
-          data,
-          hints: [
-            SHARED_POOL_HINT,
-            `Use it as \`--tags ${data.name}\`.`,
-            ...data.description ? [] : ["MISSING --description: add one with `tags update` so the tag is applied consistently."]
-          ]
-        });
-      } catch (err) {
-        fail(err);
-      }
-    }
-  });
-  registerSchema({
-    command: `${command}.tags.update`,
-    description: "Change what a custom tag means (its description). Built-in tags cannot be changed. Applies immediately.",
-    args: {
-      slug: { type: "string", description: "Custom tag name, as `tags` lists it", required: true },
-      description: { type: "string", description: "New description", required: true }
-    }
-  });
-  const updateCommand = defineCommand({
-    meta: {
-      name: "update",
-      description: `Change a custom tag's description. Built-in tags cannot be changed. Applies immediately.
-
-Example: baker ${command} tags update summer-sale --description "Assets for the 2026 summer sale"`
-    },
-    args: {
-      slug: { type: "positional", description: "Custom tag name, as `tags` lists it", required: true },
-      description: { type: "string", description: "New description", required: true }
-    },
-    run: async ({ args }) => {
-      const parsed = mediaTagsUpdateRequestSchema.safeParse({
-        slug: String(args.slug ?? ""),
-        description: String(args.description ?? "")
-      });
-      if (!parsed.success) failInvalid(parsed.error.issues[0]);
-      try {
-        const data = await apiPost("/api/media-tags/update", parsed.data);
-        writeJson({ ok: true, data, hints: [SHARED_POOL_HINT] });
-      } catch (err) {
-        fail(err);
-      }
-    }
-  });
-  registerSchema({
-    command: `${command}.tags.delete`,
-    description: "Delete a custom tag from the company's shared pool. Built-in tags cannot be deleted. Applies immediately. Confirm with the user first.",
-    args: { slug: { type: "string", description: "Custom tag name, as `tags` lists it", required: true } }
-  });
-  const deleteCommand = defineCommand({
-    meta: {
-      name: "delete",
-      description: `Delete a custom tag (shared by images, videos and testimonials). Built-in tags cannot be deleted. Applies immediately \u2014 confirm with the user first.
-
-Example: baker ${command} tags delete summer-sale`
-    },
-    args: { slug: { type: "positional", description: "Custom tag name, as `tags` lists it", required: true } },
-    run: async ({ args }) => {
-      const parsed = mediaTagsDeleteRequestSchema.safeParse({ slug: String(args.slug ?? "") });
-      if (!parsed.success) failInvalid(parsed.error.issues[0]);
-      try {
-        const data = await apiPost("/api/media-tags/delete", parsed.data);
-        writeJson({ ok: true, data, hints: [SHARED_POOL_HINT] });
-      } catch (err) {
-        fail(err);
-      }
-    }
-  });
-  return defineCommand({
-    meta: {
-      name: "tags",
-      description: `The ${label} tag taxonomy: built-in defaults plus the company's custom tags (one pool shared by images, videos and testimonials). Subcommands: list (default), create, update, delete.
-
-Examples:
-  baker ${command} tags                                   # list available tags
-  baker ${command} tags create "summer sale" --description "\u2026"
-  baker ${command} tags update summer-sale --description "\u2026"
-  baker ${command} tags delete summer-sale`
-    },
-    // Declared on the parent too: `default: "list"` dispatches the bare `tags --output json`
-    // form, and citty reads an undeclared flag's value as a subcommand name.
-    args: OUTPUT_ARG,
-    subCommands: {
-      list: listCommand,
-      create: createCommand,
-      update: updateCommand,
-      delete: deleteCommand
-    },
-    // `default`, never `run`: citty falls through to the parent's `run` after a subcommand.
-    default: "list"
-  });
-}
-
-export {
-  makeTagsCommand
-};
-//# sourceMappingURL=chunk-63LJAQ4E.js.map

package/dist/chunk-6B7YNXNH.js

@@ -1,106 +0,0 @@
-import {
-  apiGet
-} from "./chunk-P5NYZ236.js";
-
-// src/commands/testimonials/emptyCorpusHints.ts
-function resolveEmptyReason({
-  resultCount,
-  activeFilters,
-  sourceCount
-}) {
-  if (resultCount > 0) {
-    return null;
-  }
-  if (activeFilters.length > 0) {
-    return "filtered_out";
-  }
-  return sourceCount === 0 ? "no_corpus_connected" : "corpus_empty";
-}
-var NO_CORPUS_EXIT = "Testimonials are ingested from the client's public review pages \u2014 an agent cannot write one \u2014 so no rewording will find quotes. If the user named the client's own review page (Google Maps, Trustpilot, Yelp, Tripadvisor, G2, Capterra, Amazon, App Store, Google Play), add it with `baker testimonials sources add <link>` \u2014 its reviews arrive over the next minutes, not in this turn. Stop searching and source proof another way: a result or case study the client already published, a named-customer logo (`baker images logo`), or a founder claim attributed as a claim. Otherwise ship without a testimonial block and file the gap: `baker actions create --name \"Collect customer quotes for <page>\" --priority medium --tags <slug>`. Never invent, paraphrase-into-existence, or pad with unrelated praise.";
-function emptyReasonDetail(reason, sourceCount, activeFilters) {
-  if (reason === "filtered_out") {
-    return `No rows matched, and ${activeFilters.join(", ")} narrowed this read. The corpus was not checked \u2014 drop every filter to see whether the library itself is empty.`;
-  }
-  if (reason === "no_corpus_connected") {
-    return "This company has no review source connected \u2014 checked against its source list, not inferred from the empty result.";
-  }
-  return `${sourceCount} review source${sourceCount === 1 ? " is" : "s are"} connected but hold no testimonials yet \u2014 the source is there, the rows are not. Ingestion may still be running.`;
-}
-function morePagesHint(resultCount, cursor) {
-  const found = resultCount === 0 ? "This page held no matches" : `This page held ${resultCount}`;
-  return `${found}, and the library continues past it \u2014 so this is one page, not the client's whole set. Do not report it as the corpus and do not conclude anything is missing from it. Read the next page with \`baker testimonials list --cursor ${cursor}\` (same filters), or go straight at the rows you want with \`baker testimonials search <query>\`.`;
-}
-function endOfWalkHint(command) {
-  const noun = command === "search" ? "results" : "rows";
-  return `That was the end of the library \u2014 no more ${noun} past the page before this one. Nothing here says the corpus is empty (the earlier pages held it), so answer from what those pages returned rather than re-reading.`;
-}
-async function measureEmptyCorpus({
-  command,
-  resultCount,
-  activeFilters,
-  nextCursor = null,
-  continued = false
-}) {
-  if (nextCursor) {
-    return { hints: [morePagesHint(resultCount, nextCursor)] };
-  }
-  if (resultCount > 0) {
-    return { hints: [] };
-  }
-  if (continued) {
-    return { hints: [endOfWalkHint(command)] };
-  }
-  if (activeFilters.length > 0) {
-    const reason2 = "filtered_out";
-    return {
-      hints: emptyCorpusHints({ command, reason: reason2, sourceCount: 0, activeFilters }),
-      empty: { reason: reason2, detail: emptyReasonDetail(reason2, 0, activeFilters) }
-    };
-  }
-  let sourceCount;
-  try {
-    const sources = await apiGet("/api/testimonials/sources");
-    sourceCount = Array.isArray(sources) ? sources.length : 0;
-  } catch {
-    return {
-      hints: [
-        "No rows, and the check for connected review sources failed \u2014 so this is NOT evidence that the client has no reviews. Do not record an absence you could not verify. Re-run once; if it fails again, say the library could not be read rather than that it is empty."
-      ]
-    };
-  }
-  const reason = resolveEmptyReason({ resultCount, activeFilters, sourceCount });
-  if (reason === null) {
-    return { hints: [] };
-  }
-  return {
-    hints: emptyCorpusHints({ command, reason, sourceCount, activeFilters }),
-    empty: { reason, detail: emptyReasonDetail(reason, sourceCount, activeFilters) }
-  };
-}
-function emptyCorpusHints({
-  command,
-  reason,
-  sourceCount,
-  activeFilters
-}) {
-  if (reason === null) {
-    return [];
-  }
-  if (reason === "filtered_out") {
-    return [
-      `No rows \u2014 ${activeFilters.join(", ")} narrowed this. Drop every filter and re-run once before touching the query; a filter combination and an empty library look identical from here.`
-    ];
-  }
-  const lead = command === "search" ? "No hits" : "No rows";
-  if (reason === "no_corpus_connected") {
-    return [`${lead}, and this company's source list is empty: there is no review corpus to search. ${NO_CORPUS_EXIT}`];
-  }
-  return [
-    `${lead}. ${sourceCount} review source${sourceCount === 1 ? " is" : "s are"} connected but no testimonials have landed yet \u2014 so this is a timing or ingestion gap, not a missing connection, and re-querying will not change it. Ingestion may still be running: say so rather than reporting the client has no reviews. ${NO_CORPUS_EXIT}`
-  ];
-}
-
-export {
-  measureEmptyCorpus
-};
-//# sourceMappingURL=chunk-6B7YNXNH.js.map

package/dist/chunk-7H6TNG52.js

@@ -1,74 +0,0 @@
-import {
-  cacheGet,
-  cacheSet,
-  handleConnectionError,
-  needsConnectionFix,
-  writeJsonEnvelope
-} from "./chunk-SD5GDVDI.js";
-import {
-  ApiError,
-  apiGet
-} from "./chunk-P5NYZ236.js";
-import {
-  getEnv
-} from "./chunk-XMS5K54U.js";
-
-// src/commands/gsc/resolve.ts
-async function fetchSites(useCache = true) {
-  if (useCache) {
-    const cached = cacheGet("gsc-sites", "list");
-    if (cached) return cached.data;
-  }
-  const params = !useCache ? { "skip-cache": "true" } : void 0;
-  const data = await apiGet("/api/gsc/sites", params);
-  if (useCache) {
-    cacheSet("gsc-sites", "list", data, 60 * 60 * 1e3);
-  }
-  return data;
-}
-async function resolveSiteUrl(args) {
-  const fromArgs = args["site-url"];
-  const fromEnv = getEnv().BAKER_GSC_SITE_URL;
-  const siteUrl = fromArgs || fromEnv;
-  if (siteUrl) return siteUrl;
-  const useCache = !args["no-cache"];
-  try {
-    const sites = await fetchSites(useCache);
-    const [single] = sites;
-    if (sites.length === 1 && single) {
-      process.stderr.write(`Using site "${single.siteUrl}"
-`);
-      return single.siteUrl;
-    }
-    if (sites.length === 0) {
-      handleConnectionError("gsc");
-    }
-    const list = sites.map((s) => `  ${s.siteUrl}  (${s.permissionLevel})`).join("\n");
-    writeJsonEnvelope({
-      ok: false,
-      error: {
-        code: "MULTIPLE_SITES",
-        message: `Multiple sites found. Pass --site-url or set BAKER_GSC_SITE_URL:
-${list}`
-      }
-    });
-    process.exit(1);
-  } catch (err) {
-    if (err instanceof ApiError && needsConnectionFix(err.code, err.message)) {
-      handleConnectionError("gsc", err.message);
-    }
-    writeJsonEnvelope({
-      ok: false,
-      error: {
-        code: "RESOLUTION_ERROR",
-        message: "Could not auto-detect site. Pass --site-url or set BAKER_GSC_SITE_URL."
-      }
-    });
-    process.exit(1);
-  }
-}
-
-export {
-  resolveSiteUrl
-};
-//# sourceMappingURL=chunk-7H6TNG52.js.map

package/dist/chunk-7JB56IVP.js

@@ -1,215 +0,0 @@
-import {
-  debugLogSetting
-} from "./chunk-XMS5K54U.js";
-
-// src/debugLog.ts
-import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
-var DEFAULT_FILE = "baker-cli-debug.jsonl";
-var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
-var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
-var MAX_BYTES = 64 * 1024 * 1024;
-var REDACTIONS = [
-  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
-  // Authorization headers
-  // Both prefixes, captured rather than listed twice: `bkr_` does not contain
-  // the literal `bk_`, so the company-key rule matched no part of the read-only
-  // credential a Session review runs with.
-  [/\b(bkr?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
-  // Baker API keys
-  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
-  // JWTs / id tokens
-  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
-  // Google OAuth access tokens
-  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
-  // Google refresh tokens
-  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
-  // Meta/Facebook access tokens
-];
-function redactSecrets(input) {
-  let out = input;
-  for (const [pattern, replacement] of REDACTIONS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-var CREDENTIAL_VALUE = "[credential value]";
-var CREDENTIAL_PUT_PATH = "/api/credentials/put";
-function withoutCredentialValue(url, body) {
-  let path;
-  try {
-    path = new URL(url).pathname;
-  } catch {
-    path = url;
-  }
-  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
-    return body;
-  }
-  return { ...body, value: CREDENTIAL_VALUE };
-}
-var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
-function argvWithoutCredentialValue(argv) {
-  if (argv[0] !== "credentials" || argv[1] !== "put") {
-    return argv;
-  }
-  let nameSeen = false;
-  let keepNext = false;
-  let redactNext = false;
-  return argv.map((arg, index) => {
-    if (index < 2) return arg;
-    if (keepNext || redactNext) {
-      const kept = keepNext ? arg : CREDENTIAL_VALUE;
-      keepNext = false;
-      redactNext = false;
-      return kept;
-    }
-    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
-    redactNext = arg === "--value";
-    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
-    if (arg.startsWith("-")) return arg;
-    const isName = !nameSeen;
-    nameSeen = true;
-    return isName ? arg : CREDENTIAL_VALUE;
-  });
-}
-function resolveTarget() {
-  const raw = debugLogSetting();
-  if (!raw) {
-    return void 0;
-  }
-  const lower = raw.toLowerCase();
-  if (BOOLEAN_OFF.has(lower)) {
-    return void 0;
-  }
-  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
-  return isAbsolute(target) ? target : resolve(process.cwd(), target);
-}
-function isDebugLogEnabled() {
-  return resolveTarget() !== void 0;
-}
-var sessionId;
-function getSessionId() {
-  if (!sessionId) {
-    sessionId = `${process.pid}-${Date.now()}`;
-  }
-  return sessionId;
-}
-var trackedPath;
-var bytesInFile = 0;
-function ensureReady(filePath) {
-  if (trackedPath !== filePath) {
-    trackedPath = filePath;
-    mkdirSync(dirname(filePath), { recursive: true });
-    try {
-      bytesInFile = statSync(filePath).size;
-    } catch {
-      bytesInFile = 0;
-    }
-  }
-}
-function append(entry) {
-  const filePath = resolveTarget();
-  if (!filePath) {
-    return;
-  }
-  try {
-    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
-    const line = `${redactSecrets(JSON.stringify(payload))}
-`;
-    ensureReady(filePath);
-    const size = Buffer.byteLength(line);
-    if (bytesInFile + size > MAX_BYTES) {
-      renameSync(filePath, `${filePath}.1`);
-      bytesInFile = 0;
-    }
-    appendFileSync(filePath, line);
-    bytesInFile += size;
-  } catch {
-  }
-}
-function errorToPlain(err) {
-  if (err instanceof Error) {
-    const code = err.code;
-    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
-  }
-  return { message: String(err) };
-}
-var invocationStartedAt;
-function logInvocation(argv) {
-  invocationStartedAt = Date.now();
-  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
-}
-function logExit(code) {
-  append({
-    kind: "exit",
-    code,
-    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
-  });
-}
-var exitHookInstalled = false;
-function installExitRecord() {
-  if (exitHookInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  exitHookInstalled = true;
-  process.on("exit", (code) => {
-    logExit(typeof code === "number" ? code : 0);
-  });
-}
-function debugLogHttp(entry) {
-  if (!isDebugLogEnabled()) {
-    return;
-  }
-  append({
-    kind: "http",
-    source: entry.source,
-    method: entry.method,
-    url: entry.url,
-    durationMs: entry.durationMs,
-    request: withoutCredentialValue(entry.url, entry.requestBody),
-    status: entry.status,
-    ok: entry.ok,
-    response: entry.responseBody,
-    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
-  });
-}
-async function readBodyForLog(response) {
-  if (!isDebugLogEnabled()) {
-    return void 0;
-  }
-  try {
-    return await response.clone().text();
-  } catch {
-    return void 0;
-  }
-}
-function tapStream(name, stream) {
-  const original = stream.write.bind(stream);
-  const decoder = new TextDecoder("utf-8");
-  stream.write = ((chunk, ...rest) => {
-    try {
-      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
-      append({ kind: "output", stream: name, text });
-    } catch {
-    }
-    return original(chunk, ...rest);
-  });
-}
-var tapsInstalled = false;
-function installStreamTaps() {
-  if (tapsInstalled || !isDebugLogEnabled()) {
-    return;
-  }
-  tapsInstalled = true;
-  tapStream("stdout", process.stdout);
-  tapStream("stderr", process.stderr);
-}
-
-export {
-  logInvocation,
-  installExitRecord,
-  debugLogHttp,
-  readBodyForLog,
-  installStreamTaps
-};
-//# sourceMappingURL=chunk-7JB56IVP.js.map

package/dist/chunk-7JB56IVP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/debugLog.ts"],"sourcesContent":["// Full-fidelity debug capture for the whole CLI.\n//\n// Set BAKER_DEBUG_LOG to turn it on:\n//   BAKER_DEBUG_LOG=1                -> appends to ./baker-cli-debug.jsonl\n//   BAKER_DEBUG_LOG=/tmp/baker.jsonl -> appends to that file\n//   BAKER_DEBUG_LOG=0|false|off|no   -> disabled (same as unset)\n//\n// When enabled, every HTTP request/response (both the REST client and the\n// canvas engine client), every byte written to stdout/stderr, and the command\n// invocation are appended as JSONL entries. Known secret shapes are redacted\n// before anything is written (best-effort — see redactSecrets). Logging is\n// always fail-open: a logging error is swallowed so it can never break a\n// command. The file rotates once past MAX_BYTES so an always-on capture cannot\n// fill the disk.\n\nimport { appendFileSync, mkdirSync, renameSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { debugLogSetting } from \"./env.ts\";\n\nconst DEFAULT_FILE = \"baker-cli-debug.jsonl\";\nconst BOOLEAN_ON = new Set([\"1\", \"true\", \"on\", \"yes\"]);\nconst BOOLEAN_OFF = new Set([\"0\", \"false\", \"off\", \"no\"]);\n\n// Rotate once the active file passes this size (one older generation, `<file>.1`,\n// is kept). Bounds growth for the always-on sandbox capture without a per-write stat.\nconst MAX_BYTES = 64 * 1024 * 1024;\n\n// Best-effort redaction. Response/request bodies are stored as escaped strings, so\n// key/value matching is unreliable there; instead we scrub the token *values*\n// themselves (quote-agnostic) plus the auth header and Baker keys. This is not\n// exhaustive — a secret in an unrecognized shape can still be written. See README.\nconst REDACTIONS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/Bearer\\s+[A-Za-z0-9._-]+/g, \"Bearer [redacted]\"], // Authorization headers\n  // Both prefixes, captured rather than listed twice: `bkr_` does not contain\n  // the literal `bk_`, so the company-key rule matched no part of the read-only\n  // credential a Session review runs with.\n  [/\\b(bkr?)_[A-Za-z0-9]+/g, \"$1_[redacted]\"], // Baker API keys\n  [/eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/g, \"[redacted-jwt]\"], // JWTs / id tokens\n  [/ya29\\.[A-Za-z0-9._-]+/g, \"[redacted-google-token]\"], // Google OAuth access tokens\n  [/1\\/\\/[A-Za-z0-9._-]+/g, \"[redacted-google-refresh]\"], // Google refresh tokens\n  [/EAA[A-Za-z0-9]{20,}/g, \"[redacted-meta-token]\"], // Meta/Facebook access tokens\n];\n\nexport function redactSecrets(input: string): string {\n  let out = input;\n  for (const [pattern, replacement] of REDACTIONS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\nconst CREDENTIAL_VALUE = \"[credential value]\";\nconst CREDENTIAL_PUT_PATH = \"/api/credentials/put\";\n\n/**\n * `baker credentials put` carries a credential's value, the one payload this\n * log must never hold whatever its shape: the Session review reads this file.\n * Keyed on the route, not on a secret pattern, so a value no rule recognises\n * is still dropped.\n */\nfunction withoutCredentialValue(url: string, body: unknown): unknown {\n  let path: string;\n  try {\n    path = new URL(url).pathname;\n  } catch {\n    path = url;\n  }\n  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== \"object\" || !(\"value\" in body)) {\n    return body;\n  }\n  return { ...body, value: CREDENTIAL_VALUE };\n}\n\nconst PUT_FLAGS_WITH_VALUES = new Set([\"--host\", \"--label\"]);\n\n/** A value typed after `credentials put` (refused by the command, but already in argv) never reaches the log. */\nfunction argvWithoutCredentialValue(argv: string[]): string[] {\n  if (argv[0] !== \"credentials\" || argv[1] !== \"put\") {\n    return argv;\n  }\n  let nameSeen = false;\n  let keepNext = false;\n  let redactNext = false;\n  return argv.map((arg, index) => {\n    if (index < 2) return arg;\n    if (keepNext || redactNext) {\n      const kept = keepNext ? arg : CREDENTIAL_VALUE;\n      keepNext = false;\n      redactNext = false;\n      return kept;\n    }\n    if (arg.startsWith(\"--value=\")) return `--value=${CREDENTIAL_VALUE}`;\n    redactNext = arg === \"--value\";\n    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);\n    if (arg.startsWith(\"-\")) return arg;\n    const isName = !nameSeen;\n    nameSeen = true;\n    return isName ? arg : CREDENTIAL_VALUE;\n  });\n}\n\nfunction resolveTarget(): string | undefined {\n  const raw = debugLogSetting();\n  if (!raw) {\n    return undefined;\n  }\n  const lower = raw.toLowerCase();\n  if (BOOLEAN_OFF.has(lower)) {\n    return undefined;\n  }\n  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;\n  return isAbsolute(target) ? target : resolve(process.cwd(), target);\n}\n\nexport function isDebugLogEnabled(): boolean {\n  return resolveTarget() !== undefined;\n}\n\nlet sessionId: string | undefined;\nfunction getSessionId(): string {\n  if (!sessionId) {\n    sessionId = `${process.pid}-${Date.now()}`;\n  }\n  return sessionId;\n}\n\n// Per-resolved-path bookkeeping so the hot path skips redundant syscalls: the\n// directory is ensured once and the current size is read once (via statSync),\n// then tracked in-process. Resets when the resolved path changes.\nlet trackedPath: string | undefined;\nlet bytesInFile = 0;\n\nfunction ensureReady(filePath: string): void {\n  if (trackedPath !== filePath) {\n    trackedPath = filePath;\n    mkdirSync(dirname(filePath), { recursive: true });\n    try {\n      bytesInFile = statSync(filePath).size;\n    } catch {\n      bytesInFile = 0;\n    }\n  }\n}\n\nfunction append(entry: Record<string, unknown>): void {\n  const filePath = resolveTarget();\n  if (!filePath) {\n    return;\n  }\n  try {\n    const payload = { ts: new Date().toISOString(), session: getSessionId(), ...entry };\n    const line = `${redactSecrets(JSON.stringify(payload))}\\n`;\n    ensureReady(filePath);\n    const size = Buffer.byteLength(line);\n    if (bytesInFile + size > MAX_BYTES) {\n      renameSync(filePath, `${filePath}.1`);\n      bytesInFile = 0;\n    }\n    appendFileSync(filePath, line);\n    bytesInFile += size;\n  } catch {\n    // Fail-open: debug logging must never break a command.\n  }\n}\n\nfunction errorToPlain(err: unknown): Record<string, unknown> {\n  if (err instanceof Error) {\n    const code = (err as { code?: unknown }).code;\n    return { name: err.name, message: err.message, ...(typeof code === \"string\" ? { code } : {}) };\n  }\n  return { message: String(err) };\n}\n\nlet invocationStartedAt: number | undefined;\n\nexport function logInvocation(argv: string[]): void {\n  invocationStartedAt = Date.now();\n  append({ kind: \"invocation\", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });\n}\n\n/**\n * Close an invocation with its outcome and its wall time.\n *\n * Until this existed the log could say what was called and what every HTTP hop\n * cost, and nothing at all about whether the command succeeded or how long the\n * whole thing took — so \"this verb is slow\" and \"this verb fails half the time\"\n * were both unanswerable from the one record that sees every call. `durationMs`\n * is measured from `logInvocation`, which runs before any command does.\n */\nexport function logExit(code: number): void {\n  append({\n    kind: \"exit\",\n    code,\n    ...(invocationStartedAt === undefined ? {} : { durationMs: Date.now() - invocationStartedAt }),\n  });\n}\n\nlet exitHookInstalled = false;\n\n/**\n * Write the exit record however the process ends.\n *\n * `process.on(\"exit\")` is the only hook that sees all of them — a clean return, a\n * `process.exit` from the error handler, an unhandled rejection — and it is\n * synchronous-only, which is exactly what `appendFileSync` needs. Installed once,\n * and only when logging is on, so the disabled path adds no listener at all.\n */\nexport function installExitRecord(): void {\n  if (exitHookInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  exitHookInstalled = true;\n  process.on(\"exit\", (code) => {\n    logExit(typeof code === \"number\" ? code : 0);\n  });\n}\n\nexport type HttpLogEntry = {\n  source: \"cli\" | \"canvas\";\n  method: string;\n  url: string;\n  requestBody?: unknown;\n  status?: number;\n  ok?: boolean;\n  responseBody?: string;\n  durationMs?: number;\n  error?: unknown;\n};\n\nexport function debugLogHttp(entry: HttpLogEntry): void {\n  if (!isDebugLogEnabled()) {\n    return;\n  }\n  append({\n    kind: \"http\",\n    source: entry.source,\n    method: entry.method,\n    url: entry.url,\n    durationMs: entry.durationMs,\n    request: withoutCredentialValue(entry.url, entry.requestBody),\n    status: entry.status,\n    ok: entry.ok,\n    response: entry.responseBody,\n    error: entry.error === undefined ? undefined : errorToPlain(entry.error),\n  });\n}\n\n// Reads a response body for logging without consuming it for the real caller.\nexport async function readBodyForLog(response: Response): Promise<string | undefined> {\n  if (!isDebugLogEnabled()) {\n    return undefined;\n  }\n  try {\n    return await response.clone().text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Method syntax (bivariant) so a real `process.stdout`/`stderr` and a plain\n// test double both satisfy it.\ntype Writable = { write(...args: unknown[]): boolean };\n\n// Wraps a stream's `write` so every chunk is mirrored into the debug log while\n// the original write semantics (args + return value) are preserved. A single\n// streaming TextDecoder per stream decodes byte chunks so a multi-byte character\n// split across two writes is reassembled instead of garbled.\nexport function tapStream(name: string, stream: Writable): void {\n  const original = stream.write.bind(stream) as (...args: unknown[]) => boolean;\n  const decoder = new TextDecoder(\"utf-8\");\n  stream.write = ((chunk: unknown, ...rest: unknown[]): boolean => {\n    try {\n      const text =\n        typeof chunk === \"string\"\n          ? chunk\n          : chunk instanceof Uint8Array\n            ? decoder.decode(chunk, { stream: true })\n            : String(chunk);\n      append({ kind: \"output\", stream: name, text });\n    } catch {\n      // ignore capture failures\n    }\n    return original(chunk, ...rest);\n  }) as typeof stream.write;\n}\n\nlet tapsInstalled = false;\n\n// Mirrors everything written to stdout/stderr into the debug log. Installed once,\n// only when enabled, so the common (disabled) path leaves the streams untouched.\nexport function installStreamTaps(): void {\n  if (tapsInstalled || !isDebugLogEnabled()) {\n    return;\n  }\n  tapsInstalled = true;\n  tapStream(\"stdout\", process.stdout);\n  tapStream(\"stderr\", process.stderr);\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,WAAW,YAAY,gBAAgB;AAChE,SAAS,SAAS,YAAY,eAAe;AAG7C,IAAM,eAAe;AACrB,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,KAAK,CAAC;AACrD,IAAM,cAAc,oBAAI,IAAI,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC;AAIvD,IAAM,YAAY,KAAK,OAAO;AAM9B,IAAM,aAAuD;AAAA,EAC3D,CAAC,6BAA6B,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjD,CAAC,0BAA0B,eAAe;AAAA;AAAA,EAC1C,CAAC,sDAAsD,gBAAgB;AAAA;AAAA,EACvE,CAAC,0BAA0B,yBAAyB;AAAA;AAAA,EACpD,CAAC,yBAAyB,2BAA2B;AAAA;AAAA,EACrD,CAAC,wBAAwB,uBAAuB;AAAA;AAClD;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,MAAM;AACV,aAAW,CAAC,SAAS,WAAW,KAAK,YAAY;AAC/C,UAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAQ5B,SAAS,uBAAuB,KAAa,MAAwB;AACnE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,SAAS,uBAAuB,SAAS,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,OAAO;AACnG,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,OAAO,iBAAiB;AAC5C;AAEA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAG3D,SAAS,2BAA2B,MAA0B;AAC5D,MAAI,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,OAAO;AAClD,WAAO;AAAA,EACT;AACA,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,aAAa;AACjB,SAAO,KAAK,IAAI,CAAC,KAAK,UAAU;AAC9B,QAAI,QAAQ,EAAG,QAAO;AACtB,QAAI,YAAY,YAAY;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,iBAAW;AACX,mBAAa;AACb,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,UAAU,EAAG,QAAO,WAAW,gBAAgB;AAClE,iBAAa,QAAQ;AACrB,eAAW,sBAAsB,IAAI,GAAG;AACxC,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,UAAM,SAAS,CAAC;AAChB,eAAW;AACX,WAAO,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAoC;AAC3C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,YAAY,IAAI,KAAK,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,IAAI,KAAK,IAAI,eAAe;AACtD,SAAO,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACpE;AAEO,SAAS,oBAA6B;AAC3C,SAAO,cAAc,MAAM;AAC7B;AAEA,IAAI;AACJ,SAAS,eAAuB;AAC9B,MAAI,CAAC,WAAW;AACd,gBAAY,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAKA,IAAI;AACJ,IAAI,cAAc;AAElB,SAAS,YAAY,UAAwB;AAC3C,MAAI,gBAAgB,UAAU;AAC5B,kBAAc;AACd,cAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAI;AACF,oBAAc,SAAS,QAAQ,EAAE;AAAA,IACnC,QAAQ;AACN,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,OAAO,OAAsC;AACpD,QAAM,WAAW,cAAc;AAC/B,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,aAAa,GAAG,GAAG,MAAM;AAClF,UAAM,OAAO,GAAG,cAAc,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA;AACtD,gBAAY,QAAQ;AACpB,UAAM,OAAO,OAAO,WAAW,IAAI;AACnC,QAAI,cAAc,OAAO,WAAW;AAClC,iBAAW,UAAU,GAAG,QAAQ,IAAI;AACpC,oBAAc;AAAA,IAChB;AACA,mBAAe,UAAU,IAAI;AAC7B,mBAAe;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,MAAI,eAAe,OAAO;AACxB,UAAM,OAAQ,IAA2B;AACzC,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC,EAAG;AAAA,EAC/F;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,IAAI;AAEG,SAAS,cAAc,MAAsB;AAClD,wBAAsB,KAAK,IAAI;AAC/B,SAAO,EAAE,MAAM,cAAc,MAAM,2BAA2B,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC3F;AAWO,SAAS,QAAQ,MAAoB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,IAAI,oBAAoB;AAAA,EAC9F,CAAC;AACH;AAEA,IAAI,oBAAoB;AAUjB,SAAS,oBAA0B;AACxC,MAAI,qBAAqB,CAAC,kBAAkB,GAAG;AAC7C;AAAA,EACF;AACA,sBAAoB;AACpB,UAAQ,GAAG,QAAQ,CAAC,SAAS;AAC3B,YAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAAA,EAC7C,CAAC;AACH;AAcO,SAAS,aAAa,OAA2B;AACtD,MAAI,CAAC,kBAAkB,GAAG;AACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,YAAY,MAAM;AAAA,IAClB,SAAS,uBAAuB,MAAM,KAAK,MAAM,WAAW;AAAA,IAC5D,QAAQ,MAAM;AAAA,IACd,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM,UAAU,SAAY,SAAY,aAAa,MAAM,KAAK;AAAA,EACzE,CAAC;AACH;AAGA,eAAsB,eAAe,UAAiD;AACpF,MAAI,CAAC,kBAAkB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,UAAU,MAAc,QAAwB;AAC9D,QAAM,WAAW,OAAO,MAAM,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,SAAS,CAAC,UAAmB,SAA6B;AAC/D,QAAI;AACF,YAAM,OACJ,OAAO,UAAU,WACb,QACA,iBAAiB,aACf,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,IACtC,OAAO,KAAK;AACpB,aAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,KAAK,CAAC;AAAA,IAC/C,QAAQ;AAAA,IAER;AACA,WAAO,SAAS,OAAO,GAAG,IAAI;AAAA,EAChC;AACF;AAEA,IAAI,gBAAgB;AAIb,SAAS,oBAA0B;AACxC,MAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACzC;AAAA,EACF;AACA,kBAAgB;AAChB,YAAU,UAAU,QAAQ,MAAM;AAClC,YAAU,UAAU,QAAQ,MAAM;AACpC;","names":[]}