@koda-sl/baker-cli 0.469.0-dev.42f26270e → 0.470.0-dev.25c8e0099

package/dist/chunk-7QDVAEB6.js

@@ -0,0 +1,215 @@
+import {
+  debugLogSetting
+} from "./chunk-NVBBZPJP.js";
+
+// src/debugLog.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
+var DEFAULT_FILE = "baker-cli-debug.jsonl";
+var BOOLEAN_ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var BOOLEAN_OFF = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
+var MAX_BYTES = 64 * 1024 * 1024;
+var REDACTIONS = [
+  [/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]"],
+  // Authorization headers
+  // Every prefix, captured rather than listed thrice: `bkr_` and `bkv_` do not
+  // contain the literal `bk_`, so the company-key rule matched no part of the
+  // read-only credentials a Session review or a published report runs with.
+  [/\b(bk[rv]?)_[A-Za-z0-9]+/g, "$1_[redacted]"],
+  // Baker API keys
+  [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]"],
+  // JWTs / id tokens
+  [/ya29\.[A-Za-z0-9._-]+/g, "[redacted-google-token]"],
+  // Google OAuth access tokens
+  [/1\/\/[A-Za-z0-9._-]+/g, "[redacted-google-refresh]"],
+  // Google refresh tokens
+  [/EAA[A-Za-z0-9]{20,}/g, "[redacted-meta-token]"]
+  // Meta/Facebook access tokens
+];
+function redactSecrets(input) {
+  let out = input;
+  for (const [pattern, replacement] of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+var CREDENTIAL_VALUE = "[credential value]";
+var CREDENTIAL_PUT_PATH = "/api/credentials/put";
+function withoutCredentialValue(url, body) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    path = url;
+  }
+  if (path !== CREDENTIAL_PUT_PATH || body === null || typeof body !== "object" || !("value" in body)) {
+    return body;
+  }
+  return { ...body, value: CREDENTIAL_VALUE };
+}
+var PUT_FLAGS_WITH_VALUES = /* @__PURE__ */ new Set(["--host", "--label"]);
+function argvWithoutCredentialValue(argv) {
+  if (argv[0] !== "credentials" || argv[1] !== "put") {
+    return argv;
+  }
+  let nameSeen = false;
+  let keepNext = false;
+  let redactNext = false;
+  return argv.map((arg, index) => {
+    if (index < 2) return arg;
+    if (keepNext || redactNext) {
+      const kept = keepNext ? arg : CREDENTIAL_VALUE;
+      keepNext = false;
+      redactNext = false;
+      return kept;
+    }
+    if (arg.startsWith("--value=")) return `--value=${CREDENTIAL_VALUE}`;
+    redactNext = arg === "--value";
+    keepNext = PUT_FLAGS_WITH_VALUES.has(arg);
+    if (arg.startsWith("-")) return arg;
+    const isName = !nameSeen;
+    nameSeen = true;
+    return isName ? arg : CREDENTIAL_VALUE;
+  });
+}
+function resolveTarget() {
+  const raw = debugLogSetting();
+  if (!raw) {
+    return void 0;
+  }
+  const lower = raw.toLowerCase();
+  if (BOOLEAN_OFF.has(lower)) {
+    return void 0;
+  }
+  const target = BOOLEAN_ON.has(lower) ? DEFAULT_FILE : raw;
+  return isAbsolute(target) ? target : resolve(process.cwd(), target);
+}
+function isDebugLogEnabled() {
+  return resolveTarget() !== void 0;
+}
+var sessionId;
+function getSessionId() {
+  if (!sessionId) {
+    sessionId = `${process.pid}-${Date.now()}`;
+  }
+  return sessionId;
+}
+var trackedPath;
+var bytesInFile = 0;
+function ensureReady(filePath) {
+  if (trackedPath !== filePath) {
+    trackedPath = filePath;
+    mkdirSync(dirname(filePath), { recursive: true });
+    try {
+      bytesInFile = statSync(filePath).size;
+    } catch {
+      bytesInFile = 0;
+    }
+  }
+}
+function append(entry) {
+  const filePath = resolveTarget();
+  if (!filePath) {
+    return;
+  }
+  try {
+    const payload = { ts: (/* @__PURE__ */ new Date()).toISOString(), session: getSessionId(), ...entry };
+    const line = `${redactSecrets(JSON.stringify(payload))}
+`;
+    ensureReady(filePath);
+    const size = Buffer.byteLength(line);
+    if (bytesInFile + size > MAX_BYTES) {
+      renameSync(filePath, `${filePath}.1`);
+      bytesInFile = 0;
+    }
+    appendFileSync(filePath, line);
+    bytesInFile += size;
+  } catch {
+  }
+}
+function errorToPlain(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return { name: err.name, message: err.message, ...typeof code === "string" ? { code } : {} };
+  }
+  return { message: String(err) };
+}
+var invocationStartedAt;
+function logInvocation(argv) {
+  invocationStartedAt = Date.now();
+  append({ kind: "invocation", argv: argvWithoutCredentialValue(argv), cwd: process.cwd() });
+}
+function logExit(code) {
+  append({
+    kind: "exit",
+    code,
+    ...invocationStartedAt === void 0 ? {} : { durationMs: Date.now() - invocationStartedAt }
+  });
+}
+var exitHookInstalled = false;
+function installExitRecord() {
+  if (exitHookInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  exitHookInstalled = true;
+  process.on("exit", (code) => {
+    logExit(typeof code === "number" ? code : 0);
+  });
+}
+function debugLogHttp(entry) {
+  if (!isDebugLogEnabled()) {
+    return;
+  }
+  append({
+    kind: "http",
+    source: entry.source,
+    method: entry.method,
+    url: entry.url,
+    durationMs: entry.durationMs,
+    request: withoutCredentialValue(entry.url, entry.requestBody),
+    status: entry.status,
+    ok: entry.ok,
+    response: entry.responseBody,
+    error: entry.error === void 0 ? void 0 : errorToPlain(entry.error)
+  });
+}
+async function readBodyForLog(response) {
+  if (!isDebugLogEnabled()) {
+    return void 0;
+  }
+  try {
+    return await response.clone().text();
+  } catch {
+    return void 0;
+  }
+}
+function tapStream(name, stream) {
+  const original = stream.write.bind(stream);
+  const decoder = new TextDecoder("utf-8");
+  stream.write = ((chunk, ...rest) => {
+    try {
+      const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : String(chunk);
+      append({ kind: "output", stream: name, text });
+    } catch {
+    }
+    return original(chunk, ...rest);
+  });
+}
+var tapsInstalled = false;
+function installStreamTaps() {
+  if (tapsInstalled || !isDebugLogEnabled()) {
+    return;
+  }
+  tapsInstalled = true;
+  tapStream("stdout", process.stdout);
+  tapStream("stderr", process.stderr);
+}
+
+export {
+  logInvocation,
+  installExitRecord,
+  debugLogHttp,
+  readBodyForLog,
+  installStreamTaps
+};
+//# sourceMappingURL=chunk-7QDVAEB6.js.map

package/dist/chunk-A3B42U2Z.js

@@ -0,0 +1,74 @@
+import {
+  cacheGet,
+  cacheSet,
+  handleConnectionError,
+  needsConnectionFix,
+  writeJsonEnvelope
+} from "./chunk-JM7C6OHU.js";
+import {
+  ApiError,
+  apiGet
+} from "./chunk-CK5ZNZ3I.js";
+import {
+  getEnv
+} from "./chunk-NVBBZPJP.js";
+
+// src/commands/ga4/resolve.ts
+async function fetchProperties(useCache = true) {
+  if (useCache) {
+    const cached = cacheGet("ga4-properties", "list");
+    if (cached) return cached.data;
+  }
+  const params = !useCache ? { "skip-cache": "true" } : void 0;
+  const data = await apiGet("/api/ga4/properties", params);
+  if (useCache) {
+    cacheSet("ga4-properties", "list", data, 60 * 60 * 1e3);
+  }
+  return data;
+}
+async function resolvePropertyId(args) {
+  const fromArgs = args["property-id"];
+  const fromEnv = getEnv().BAKER_GA4_PROPERTY_ID;
+  const propertyId = fromArgs || fromEnv;
+  if (propertyId) return propertyId;
+  const useCache = !args["no-cache"];
+  try {
+    const properties = await fetchProperties(useCache);
+    const [single] = properties;
+    if (properties.length === 1 && single) {
+      process.stderr.write(`Using property "${single.name}" (${single.externalId})
+`);
+      return single.externalId;
+    }
+    if (properties.length === 0) {
+      handleConnectionError("ga4");
+    }
+    const list = properties.map((p) => `  ${p.externalId}  ${p.name}`).join("\n");
+    writeJsonEnvelope({
+      ok: false,
+      error: {
+        code: "MULTIPLE_PROPERTIES",
+        message: `Multiple properties found. Pass --property-id or set BAKER_GA4_PROPERTY_ID:
+${list}`
+      }
+    });
+    process.exit(1);
+  } catch (err) {
+    if (err instanceof ApiError && needsConnectionFix(err.code, err.message)) {
+      handleConnectionError("ga4", err.message);
+    }
+    writeJsonEnvelope({
+      ok: false,
+      error: {
+        code: "RESOLUTION_ERROR",
+        message: "Could not auto-detect property. Pass --property-id or set BAKER_GA4_PROPERTY_ID."
+      }
+    });
+    process.exit(1);
+  }
+}
+
+export {
+  resolvePropertyId
+};
+//# sourceMappingURL=chunk-A3B42U2Z.js.map

package/dist/chunk-A7VSSDMJ.js

@@ -0,0 +1,333 @@
+import {
+  captureProxyCredentials,
+  isChallengeBody,
+  isPrivateAddress,
+  isProxyFailure,
+  nextPlannedRoute,
+  plannedRoutes,
+  refuseNonPublicUrl,
+  shouldEscalate
+} from "./chunk-NVBBZPJP.js";
+
+// ../proxy/src/fetch.ts
+import { lookup as dnsLookup } from "dns";
+import { Agent, ProxyAgent, Response, fetch as undiciFetch } from "undici";
+
+// ../proxy/src/fetchDecision.ts
+function classifyFetchOutcome(signal) {
+  if (isProxyFailure(signal)) return "proxy_unavailable";
+  if (shouldEscalate(signal)) return "blocked";
+  if (signal.status != null && signal.status >= 200 && signal.status < 400 && !signal.challenge) return "ok";
+  return "failed";
+}
+function shouldTryNextRoute(outcome) {
+  return outcome === "blocked" || outcome === "proxy_unavailable";
+}
+var TIMEOUT_CODES = /* @__PURE__ */ new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "ETIMEDOUT"
+]);
+var RESET_CODES = /* @__PURE__ */ new Set(["ECONNRESET", "UND_ERR_SOCKET", "EPIPE"]);
+var PROXY_RESPONSE = /Proxy response \((\d+)\)/;
+function errorCode(error) {
+  if (typeof error !== "object" || error === null) return null;
+  const code = error.code;
+  if (typeof code === "string") return code;
+  const name = error.name;
+  return typeof name === "string" ? name : null;
+}
+function errorMessage(error) {
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    if (typeof message === "string") return message;
+  }
+  return String(error);
+}
+function errorBlockSignal(error, proxied) {
+  const proxyResponse = PROXY_RESPONSE.exec(errorMessage(error));
+  if (proxyResponse) {
+    const status = Number(proxyResponse[1]);
+    return status === 407 ? { status: 407 } : { netError: "ERR_TUNNEL_CONNECTION_FAILED" };
+  }
+  const code = errorCode(error);
+  if (code !== null && TIMEOUT_CODES.has(code)) return { timedOut: true };
+  if (code === "AbortError" || code === "TimeoutError") return { timedOut: true };
+  if (proxied) {
+    return { netError: "ERR_PROXY_CONNECTION_FAILED" };
+  }
+  if (code !== null && RESET_CODES.has(code)) return { netError: "ERR_CONNECTION_RESET" };
+  return { netError: code ?? "ERR_FAILED" };
+}
+function shouldSniffChallenge(contentType, contentLength, maxSniffBytes) {
+  if (contentLength !== null && contentLength > maxSniffBytes) return false;
+  if (contentType === null || contentType.trim() === "") return true;
+  const type = contentType.toLowerCase();
+  if (type.startsWith("image/") || type.startsWith("video/") || type.startsWith("audio/")) return false;
+  return type.includes("text/") || type.includes("html") || type.includes("json") || type.includes("xml");
+}
+
+// ../proxy/src/fetch.ts
+var DEFAULT_TIMEOUT_MS = 6e4;
+var MAX_SNIFF_BYTES = 64 * 1024;
+function tierOf(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function agentFor(route) {
+  if (route.kind !== "proxy") return directAgent();
+  const token = Buffer.from(`${route.username}:${route.password}`).toString("base64");
+  return new ProxyAgent({ uri: route.server, token: `Basic ${token}` });
+}
+function directAgent() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, callback) => {
+        dnsLookup(hostname, options, (error, address, family) => {
+          if (error) {
+            callback(error, address, family);
+            return;
+          }
+          const found = Array.isArray(address) ? address.map((entry) => entry.address) : [address];
+          const blocked = found.find((entry) => isPrivateAddress(entry));
+          if (blocked !== void 0) {
+            callback(new Error(`${PRIVATE_ADDRESS_CODE}: ${hostname} resolves to ${blocked}`), "", 4);
+            return;
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+var PRIVATE_ADDRESS_CODE = "EPRIVATEADDR";
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function refuseRedirect(entry, to) {
+  if (refuseNonPublicUrl(to) === null) return false;
+  const destination = originOf(to);
+  return destination === null || destination !== originOf(entry);
+}
+async function followRedirects(url, init) {
+  let current = url;
+  let request = { ...init, redirect: "manual" };
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await undiciFetch(current, request);
+    const location = response.headers.get("location");
+    if (!REDIRECT_STATUS.has(response.status) || location === null) return response;
+    await response.body?.cancel();
+    const next = new URL(location, current).toString();
+    if (refuseRedirect(url, next)) {
+      throw new Error(`${PRIVATE_ADDRESS_CODE}: redirected to ${next}`);
+    }
+    const method = (request.method ?? "GET").toUpperCase();
+    const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST";
+    request = downgrade ? { ...request, method: "GET", body: void 0 } : request;
+    current = next;
+  }
+  throw new Error(`too many redirects following ${url}`);
+}
+var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function rebuild(response, body) {
+  if (response.status < 200 || response.status > 599 || NULL_BODY_STATUS.has(response.status)) {
+    return new Response(null, { status: response.status, headers: response.headers });
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function declaredLength(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function readOnce(response, sniff, maxBytes) {
+  const declared = declaredLength(response);
+  if (maxBytes !== void 0 && declared !== null && declared > maxBytes) {
+    await response.body?.cancel();
+    return { response: rebuild(response, new ArrayBuffer(0)), challenge: false };
+  }
+  const body = await response.arrayBuffer();
+  const wantsSniff = sniff && shouldSniffChallenge(response.headers.get("content-type"), body.byteLength, MAX_SNIFF_BYTES);
+  const challenge = wantsSniff ? isChallengeBody(new TextDecoder().decode(body)) : false;
+  return { response: rebuild(response, body), challenge };
+}
+async function attemptRoute(url, init, route, options) {
+  const tier = tierOf(route);
+  const agent = agentFor(route);
+  const startedAt = Date.now();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+  try {
+    const raw = await followRedirects(url, { ...init, dispatcher: agent ?? void 0, signal });
+    const read = await readOnce(raw, options.sniffChallenge ?? true, options.maxBytes);
+    const outcome = classifyFetchOutcome({ status: raw.status, challenge: read.challenge });
+    return {
+      attempt: { tier, status: raw.status, ms: Date.now() - startedAt, outcome },
+      response: outcome === "proxy_unavailable" ? null : read.response
+    };
+  } catch (error) {
+    const blockSignal = errorBlockSignal(error, route.kind === "proxy");
+    return {
+      attempt: {
+        tier,
+        status: blockSignal.status ?? void 0,
+        ms: Date.now() - startedAt,
+        outcome: classifyFetchOutcome(blockSignal)
+      },
+      response: null,
+      error
+    };
+  } finally {
+    await agent?.close();
+  }
+}
+async function fetchWithEscalation(url, init, options) {
+  const attempts = [];
+  let originResponse = null;
+  let originTier = "direct";
+  let lastError;
+  const routes = plannedRoutes(url, options.credentials, options.routeOptions);
+  const tried = [];
+  for (let route = routes[0] ?? null; route !== null; route = nextPlannedRoute(routes, tried)) {
+    const rung = await attemptRoute(url, init, route, options);
+    attempts.push(rung.attempt);
+    tried.push({ tier: rung.attempt.tier, proxyFailure: rung.attempt.outcome === "proxy_unavailable" });
+    if (rung.response !== null) {
+      originResponse = rung.response;
+      originTier = rung.attempt.tier;
+    }
+    if (rung.error !== void 0) lastError = rung.error;
+    if (!shouldTryNextRoute(rung.attempt.outcome)) break;
+  }
+  return {
+    response: originResponse,
+    attempts,
+    finalTier: originResponse !== null ? originTier : lastAttempt(attempts)?.tier ?? "direct",
+    ...originResponse === null && lastError !== void 0 ? { error: lastError } : {}
+  };
+}
+function lastAttempt(attempts) {
+  return attempts[attempts.length - 1];
+}
+function describeLadder(result) {
+  const rungs = result.attempts.map((a) => `${a.tier}:${a.outcome}${a.status ? `(${a.status})` : ""}@${a.ms}ms`);
+  return `${rungs.join(" \u2192 ")} | final=${result.finalTier}`;
+}
+function rescued(result) {
+  return result.attempts.some((attempt) => attempt.outcome === "ok");
+}
+function endedBlocked(result) {
+  if (rescued(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "blocked");
+}
+function endedProxyUnavailable(result) {
+  if (rescued(result) || endedBlocked(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "proxy_unavailable");
+}
+function endedPrivateAddress(result) {
+  if (rescued(result)) return false;
+  for (let error = result.error, depth = 0; error instanceof Error && depth < 5; depth++) {
+    if (error.message.includes(PRIVATE_ADDRESS_CODE)) return true;
+    error = error.cause;
+  }
+  return false;
+}
+
+// src/lib/externalFetch.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
+  Accept: "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+  "Accept-Language": "en-US,en;q=0.9"
+};
+var NOT_PUBLIC_MESSAGE = "That address is not reachable from the public web, so there is nothing to read.";
+var MAX_REMOTE_IMAGE_BYTES = 25e6;
+var ExternalFetchError = class extends Error {
+  /** True when the fault was ours — a route we could not open, not a dead host. */
+  ourFault;
+  constructor(message, ourFault) {
+    super(message);
+    this.name = "ExternalFetchError";
+    this.ourFault = ourFault;
+  }
+};
+async function fetchExternal(url, options = {}) {
+  if (refuseNonPublicUrl(url) !== null) {
+    throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+  }
+  const result = await fetchWithEscalation(
+    url,
+    { headers: { ...BROWSER_HEADERS, ...options.headers } },
+    {
+      credentials: captureProxyCredentials(),
+      ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+      ...options.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes },
+      ...options.sniffChallenge === void 0 ? {} : { sniffChallenge: options.sniffChallenge }
+    }
+  );
+  if (result.attempts.length > 1) {
+    process.stderr.write(`fetch ladder ${url} \u2014 ${describeLadder(result)}
+`);
+  }
+  if (result.response === null) {
+    if (endedPrivateAddress(result)) {
+      throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+    }
+    const ourFault = endedProxyUnavailable(result);
+    throw new ExternalFetchError(
+      ourFault ? "Could not open a route to that address." : "That address did not answer.",
+      ourFault
+    );
+  }
+  return { response: result.response, blocked: endedBlocked(result) };
+}
+function refuseOversize(bytes, maxBytes) {
+  if (bytes === null || bytes <= maxBytes) return null;
+  return `That file is ${humanBytes(bytes)} \u2014 the limit is ${humanBytes(maxBytes)}.`;
+}
+function humanBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.max(1, Math.round(n / 1024))} KB`;
+}
+function declaredBytes(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function fetchExternalBytes(url, options) {
+  const { response, blocked } = await fetchExternal(url, options);
+  if (!response.ok) {
+    throw new ExternalFetchError(`${response.status} ${response.statusText}`, false);
+  }
+  if (blocked) {
+    throw new ExternalFetchError("That host served a security check instead of the file.", false);
+  }
+  const declared = refuseOversize(declaredBytes(response), options.maxBytes);
+  if (declared !== null) {
+    throw new ExternalFetchError(declared, false);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const actual = refuseOversize(buffer.byteLength, options.maxBytes);
+  if (actual !== null) {
+    throw new ExternalFetchError(actual, false);
+  }
+  return { buffer, contentType: response.headers.get("content-type") };
+}
+
+export {
+  MAX_REMOTE_IMAGE_BYTES,
+  fetchExternalBytes
+};
+//# sourceMappingURL=chunk-A7VSSDMJ.js.map