@koda-sl/baker-cli 0.469.0-dev.42f26270e → 0.470.0-dev.25c8e0099

package/dist/chunk-NR3QPIBE.js

@@ -0,0 +1,228 @@
+import {
+  NUMERIC_ID_REGEX
+} from "./chunk-BP25XR5J.js";
+
+// ../api/src/ads-google/change-history.ts
+var CHANGE_SCOPES = ["detail", "summary"];
+var CHANGE_SCOPE_MAX_DAYS = {
+  detail: 30,
+  summary: 90
+};
+var DEFAULT_CHANGE_DAYS = 7;
+var MAX_CHANGE_DAYS = CHANGE_SCOPE_MAX_DAYS.summary;
+function isChangeLookbackWithinReach(days, scope) {
+  return days <= CHANGE_SCOPE_MAX_DAYS[scope];
+}
+
+// ../api/src/ads-google/keyword-planning.ts
+import { z } from "zod";
+var ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+var micros = z.number().int().positive();
+var FORECAST_MATCH_TYPES = ["EXACT", "PHRASE", "BROAD"];
+var googleForecastBiddingSchema = z.discriminatedUnion("strategy", [
+  z.object({ strategy: z.literal("MANUAL_CPC"), maxCpcBidMicros: micros, dailyBudgetMicros: micros.optional() }),
+  z.object({
+    strategy: z.literal("MAXIMIZE_CLICKS"),
+    dailyTargetSpendMicros: micros,
+    maxCpcBidCeilingMicros: micros.optional()
+  }),
+  z.object({ strategy: z.literal("MAXIMIZE_CONVERSIONS"), dailyTargetSpendMicros: micros })
+]);
+var googleKeywordForecastRequestSchema = z.object({
+  customerId: z.string().regex(NUMERIC_ID_REGEX, "customerId must be the bare numeric customer id"),
+  managerId: z.string().optional(),
+  /** One forecast ad group per entry; most forecasts are a single group. */
+  adGroups: z.array(
+    z.object({
+      keywords: z.array(z.object({ text: z.string().trim().min(1).max(80), matchType: z.enum(FORECAST_MATCH_TYPES) })).min(1)
+    })
+  ).min(1),
+  locationIds: z.array(z.string().regex(NUMERIC_ID_REGEX)).optional(),
+  languageId: z.string().regex(NUMERIC_ID_REGEX).optional(),
+  bidding: googleForecastBiddingSchema,
+  /** Must start in the future and end within a year. Without them Baker forecasts the 30 days from tomorrow. */
+  startDate: z.string().regex(ISO_DATE).optional(),
+  endDate: z.string().regex(ISO_DATE).optional(),
+  currencyCode: z.string().length(3).optional()
+}).refine((body) => body.startDate === void 0 === (body.endDate === void 0), {
+  message: "Give both --start and --end, or neither (the forecast then covers the 30 days from tomorrow)",
+  path: ["endDate"]
+});
+var KEYWORD_FORECAST_SOURCE = "keyword_planner_forecast";
+var googleKeywordForecastResponseSchema = z.object({
+  source: z.literal(KEYWORD_FORECAST_SOURCE),
+  period: z.object({ startDate: z.string(), endDate: z.string() }),
+  forecast_clicks: z.number().nullable(),
+  forecast_cost_micros: z.number().nullable(),
+  forecast_conversions: z.number().nullable(),
+  forecast_average_cpc_micros: z.number().nullable(),
+  forecast_average_cpa_micros: z.number().nullable()
+});
+var googleAdGroupThemesRequestSchema = z.object({
+  customerId: z.string().regex(NUMERIC_ID_REGEX, "customerId must be the bare numeric customer id"),
+  managerId: z.string().optional(),
+  keywords: z.array(z.string().trim().min(1)).min(1),
+  /** Existing ad groups to sort the keywords into: numeric ids or `customers/{cid}/adGroups/{id}`. */
+  adGroups: z.array(z.string().min(1)).min(1)
+});
+var googleAdGroupThemesResponseSchema = z.object({
+  suggestions: z.array(
+    z.object({
+      keyword: z.string(),
+      suggested_keyword: z.string(),
+      match_type: z.string(),
+      ad_group: z.string(),
+      campaign: z.string()
+    })
+  ),
+  unusable_ad_groups: z.array(z.object({ ad_group: z.string(), campaign: z.string() }))
+});
+
+// ../api/src/ads-google/url-options.ts
+import { z as z2 } from "zod";
+var URL_OPTION_LEVELS = ["account", "campaign", "ad_group", "ad"];
+var googleUrlOptionValueSchema = z2.discriminatedUnion("state", [
+  z2.object({ state: z2.literal("set"), value: z2.string() }),
+  z2.object({ state: z2.literal("not_set") }),
+  z2.object({ state: z2.literal("not_read"), reason: z2.string() })
+]);
+var googleUrlOptionsRequestSchema = z2.object({
+  customerId: z2.string().regex(NUMERIC_ID_REGEX, "customerId must be the bare numeric customer id"),
+  managerId: z2.string().optional(),
+  /** Compact by default: only campaigns that actually override the account. `full` lists every campaign. */
+  full: z2.boolean().optional(),
+  skipCache: z2.boolean().optional()
+});
+var googleUrlOptionsCampaignSchema = z2.object({
+  id: z2.string(),
+  name: z2.string(),
+  status: z2.string(),
+  final_url_suffix: googleUrlOptionValueSchema,
+  tracking_url_template: googleUrlOptionValueSchema
+});
+var googleUrlOptionsAdGroupSchema = z2.object({
+  id: z2.string(),
+  name: z2.string(),
+  status: z2.string(),
+  campaign_id: z2.string(),
+  final_url_suffix: googleUrlOptionValueSchema,
+  tracking_url_template: googleUrlOptionValueSchema
+});
+var googleUrlOptionsAdSchema = z2.object({
+  id: z2.string(),
+  status: z2.string(),
+  ad_group_id: z2.string(),
+  campaign_id: z2.string(),
+  final_url_suffix: googleUrlOptionValueSchema,
+  tracking_url_template: googleUrlOptionValueSchema
+});
+var googleUrlOptionsResponseSchema = z2.object({
+  customer_id: z2.string(),
+  account: z2.object({
+    level: z2.literal("account"),
+    read: z2.boolean(),
+    final_url_suffix: googleUrlOptionValueSchema,
+    tracking_url_template: googleUrlOptionValueSchema
+  }),
+  campaigns: z2.object({
+    level: z2.literal("campaign"),
+    read: z2.boolean(),
+    /** Campaigns actually observed. 0 with `read: true` means the account has no non-removed campaigns. */
+    campaigns_read: z2.number().int().nonnegative(),
+    /** Campaigns observed to carry no override of their own — an explicit finding, not an omission. */
+    campaigns_without_override: z2.number().int().nonnegative(),
+    overrides: z2.array(googleUrlOptionsCampaignSchema),
+    /** Compact mode only: campaigns read but not listed because they carry no override. */
+    omitted: z2.number().int().nonnegative()
+  }),
+  /**
+   * Ad groups and ads that carry an override of their own — read by asking Google only for the
+   * entities whose suffix or template IS NOT NULL, so an account of thousands of ads costs one page.
+   * `read: true` with no overrides is a finding: nothing at this level overrides the levels above.
+   * `truncated` means more overriding entities exist than one page listed.
+   */
+  ad_groups: z2.object({
+    level: z2.literal("ad_group"),
+    read: z2.boolean(),
+    overrides: z2.array(googleUrlOptionsAdGroupSchema),
+    truncated: z2.boolean()
+  }),
+  ads: z2.object({
+    level: z2.literal("ad"),
+    read: z2.boolean(),
+    overrides: z2.array(googleUrlOptionsAdSchema),
+    truncated: z2.boolean()
+  }),
+  /** Levels this command could not read. Nothing here may be reported as "not configured". */
+  levels_not_read: z2.array(z2.object({ level: z2.enum(URL_OPTION_LEVELS), reason: z2.string() }))
+});
+var ACCOUNT_URL_OPTIONS_LOCATION = "Google Ads UI \u2192 Admin \u2192 Account settings \u2192 Tracking (account-level tracking template and final URL suffix)";
+var ACCOUNT_URL_OPTIONS_STAGE_COMMAND = 'baker ads google account update --customer-id <id> --final-url-suffix "utm_agency=baker"';
+function isSet(value) {
+  return value.state === "set";
+}
+function entityOverrideHints(label, plural, field, level) {
+  if (!level.read) return [];
+  const hints = [];
+  const overriding = level.overrides.filter((entity) => isSet(entity.final_url_suffix));
+  if (overriding.length > 0) {
+    const named = overriding.slice(0, 5).map((entity) => entity.name || entity.id).join(", ");
+    hints.push(
+      `${overriding.length} ${label}(s) set their own final URL suffix (${named}${overriding.length > 5 ? ", \u2026" : ""}). It REPLACES the campaign and account suffix for every click through it, so an account-wide parameter must be added to theirs too.`
+    );
+  }
+  if (level.truncated) {
+    hints.push(
+      `More ${plural} override the URL options than one page lists \u2014 read them all with \`baker ads google query\` on ${field}.final_url_suffix IS NOT NULL --all before saying which ones do.`
+    );
+  }
+  return hints;
+}
+function urlOptionsHints(report) {
+  const hints = [];
+  const { account, campaigns } = report;
+  if (!account.read) {
+    hints.push(
+      "The account level did NOT read \u2014 its URL options are unknown, not empty. Re-run before telling the user anything about account-wide tagging."
+    );
+  } else if (account.final_url_suffix.state === "not_set") {
+    hints.push(
+      `No account-level final URL suffix is set. An account-wide parameter (agency/partner tagging such as utm_agency=\u2026) belongs at the account level so it reaches every ad \u2014 stage it with \`${ACCOUNT_URL_OPTIONS_STAGE_COMMAND}\` (applies at Publish; the user sees it under ${ACCOUNT_URL_OPTIONS_LOCATION}).`
+    );
+  }
+  if (!campaigns.read) {
+    hints.push(
+      "Campaign-level URL options did NOT read \u2014 do not report that no campaign overrides exist. Re-run before concluding."
+    );
+  } else {
+    const overriding = campaigns.overrides.filter((c) => isSet(c.final_url_suffix));
+    if (overriding.length > 0) {
+      const named = overriding.slice(0, 5).map((c) => c.name || c.id).join(", ");
+      hints.push(
+        `A campaign's final URL suffix REPLACES the account-level one for that campaign \u2014 it does not merge. ${overriding.length} campaign(s) set their own (${named}${overriding.length > 5 ? ", \u2026" : ""}) and will not pick up an account-wide parameter until their own suffix carries it too. Every other campaign read here inherits the account level normally.`
+      );
+    }
+  }
+  hints.push(...entityOverrideHints("ad group", "ad groups", "ad_group", report.ad_groups));
+  hints.push(...entityOverrideHints("ad", "ads", "ad_group_ad.ad", report.ads));
+  const overridingLevelsNotRead = report.levels_not_read.filter((level) => level.level !== "account");
+  if (overridingLevelsNotRead.length > 0) {
+    hints.push(
+      `Not read at this level: ${overridingLevelsNotRead.map((l) => l.level).join(", ")}. A suffix set there still wins over the levels above it.`
+    );
+  }
+  if (campaigns.omitted > 0) {
+    hints.push(`${campaigns.omitted} campaign(s) read with no override of their own are not listed \u2014 pass --full.`);
+  }
+  return hints;
+}
+
+export {
+  CHANGE_SCOPES,
+  CHANGE_SCOPE_MAX_DAYS,
+  DEFAULT_CHANGE_DAYS,
+  isChangeLookbackWithinReach,
+  googleKeywordForecastRequestSchema,
+  urlOptionsHints
+};
+//# sourceMappingURL=chunk-NR3QPIBE.js.map

package/dist/chunk-NVBBZPJP.js

@@ -0,0 +1,455 @@
+import {
+  writeJson
+} from "./chunk-KCA5CDCU.js";
+
+// ../proxy/src/challenge.ts
+var CHALLENGE_PHRASES = [
+  "just a moment",
+  "attention required",
+  "verify you are human",
+  "checking your browser",
+  "enable javascript and cookies to continue",
+  "unusual traffic",
+  "access denied",
+  "you have been blocked",
+  "request unsuccessful",
+  "are you a robot",
+  "security check",
+  "ddos protection",
+  "captcha"
+];
+var CHALLENGE_MARKERS = ["cf-browser-verification", "cf_chl_", "px-captcha", "_incapsula_", "distil_r_captcha"];
+var CHALLENGE_LENGTH_CEILING = 2e3;
+function isChallengeBody(content, title) {
+  if (content.length <= CHALLENGE_LENGTH_CEILING) {
+    const haystack = `${title ?? ""}
+${content}`.toLowerCase();
+    if (CHALLENGE_PHRASES.some((phrase) => haystack.includes(phrase))) return true;
+  }
+  const whole = content.toLowerCase();
+  return CHALLENGE_MARKERS.some((marker) => whole.includes(marker));
+}
+
+// ../proxy/src/tiers.ts
+var PROXY_TIERS = {
+  datacenter: {
+    tier: "datacenter",
+    host: "dc.oxylabs.io",
+    port: 8e3,
+    usernamePrefix: "user-",
+    countryKey: "-country-",
+    sessionKey: null,
+    attempts: 3
+  },
+  residential: {
+    tier: "residential",
+    host: "pr.oxylabs.io",
+    port: 7777,
+    usernamePrefix: "customer-",
+    countryKey: "-cc-",
+    sessionKey: "-sessid-",
+    attempts: 1
+  }
+};
+var ESCALATION_ORDER = ["datacenter", "residential"];
+var KNOWN_USERNAME_PREFIXES = ["user-", "customer-"];
+
+// ../proxy/src/credentials.ts
+var PROXY_ENV_VARS = {
+  datacenter: { username: "OXYLABS_DATACENTER_USERNAME", password: "OXYLABS_DATACENTER_PASSWORD" },
+  residential: { username: "OXYLABS_RESIDENTIAL_USERNAME", password: "OXYLABS_RESIDENTIAL_PASSWORD" }
+};
+function readProxyCredentials(env) {
+  const credentials = {};
+  for (const tier of ESCALATION_ORDER) {
+    const username = env[PROXY_ENV_VARS[tier].username]?.trim();
+    const password = env[PROXY_ENV_VARS[tier].password]?.trim();
+    if (username && password) credentials[tier] = { username, password };
+  }
+  return credentials;
+}
+function configuredTiers(credentials) {
+  return ESCALATION_ORDER.filter((tier) => credentials[tier] !== void 0);
+}
+
+// ../proxy/src/escalate.ts
+var ESCALATABLE_STATUSES = /* @__PURE__ */ new Set([403, 429, 451]);
+var ESCALATABLE_NET_ERRORS = /* @__PURE__ */ new Set(["ERR_CONNECTION_RESET", "ERR_CONNECTION_CLOSED", "ERR_EMPTY_RESPONSE"]);
+var PROXY_NET_ERRORS = /* @__PURE__ */ new Set([
+  "ERR_TUNNEL_CONNECTION_FAILED",
+  "ERR_PROXY_CONNECTION_FAILED",
+  "ERR_PROXY_AUTH_REQUESTED",
+  "ERR_PROXY_CERTIFICATE_INVALID",
+  "ERR_UNEXPECTED_PROXY_AUTH",
+  "ERR_MANDATORY_PROXY_CONFIGURATION_FAILED",
+  "ERR_HTTPS_PROXY_TUNNEL_RESPONSE_REDIRECT"
+]);
+function isProxyFailure(signal) {
+  if (signal.status === 407) return true;
+  return signal.netError ? PROXY_NET_ERRORS.has(signal.netError) : false;
+}
+function shouldEscalate(signal) {
+  if (isProxyFailure(signal)) return false;
+  if (signal.timedOut) return false;
+  if (signal.challenge) return true;
+  if (signal.status != null && ESCALATABLE_STATUSES.has(signal.status)) return true;
+  return signal.netError ? ESCALATABLE_NET_ERRORS.has(signal.netError) : false;
+}
+
+// ../proxy/src/privateAddress.ts
+function isPrivateIpv4Octets(octets) {
+  const [a, b] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function parseIpv4(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => /^\d{1,3}$/.test(part) ? Number(part) : Number.NaN);
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
+  return octets;
+}
+function expandGroups(part) {
+  if (part === "") return [];
+  const chunks = part.split(":");
+  const groups = [];
+  for (let index = 0; index < chunks.length; index++) {
+    const chunk = chunks[index];
+    if (chunk.includes(".")) {
+      if (index !== chunks.length - 1) return null;
+      const octets = parseIpv4(chunk);
+      if (!octets) return null;
+      groups.push(octets[0] << 8 | octets[1]);
+      groups.push(octets[2] << 8 | octets[3]);
+      continue;
+    }
+    if (!/^[0-9a-f]{1,4}$/.test(chunk)) return null;
+    groups.push(Number.parseInt(chunk, 16));
+  }
+  return groups;
+}
+function parseIpv6(value) {
+  const halves = value.split("::");
+  if (halves.length > 2) return null;
+  const head = expandGroups(halves[0]);
+  const tail = halves.length === 2 ? expandGroups(halves[1]) : [];
+  if (head === null || tail === null) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 1) return null;
+  return [...head, ...new Array(missing).fill(0), ...tail];
+}
+function isPrivateAddress(ip) {
+  const address = ip.trim().toLowerCase();
+  if (!address) return true;
+  const v4 = parseIpv4(address);
+  if (v4) return isPrivateIpv4Octets(v4);
+  const v6 = parseIpv6(address);
+  if (!v6) return true;
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = v6;
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0 && g6 === 0) return true;
+  const mappedV4 = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0;
+  if (mappedV4 && g4 === 0 && g5 === 65535) {
+    return isPrivateIpv4Octets([g6 >> 8, g6 & 255, g7 >> 8, g7 & 255]);
+  }
+  if (mappedV4 && g4 === 65535 && g5 === 0) {
+    return isPrivateIpv4Octets([g6 >> 8, g6 & 255, g7 >> 8, g7 & 255]);
+  }
+  if ((g0 & 65024) === 64512) return true;
+  if ((g0 & 65472) === 65152) return true;
+  return false;
+}
+
+// ../proxy/src/publicAddress.ts
+var PRIVATE_HOST = /^(localhost|.*\.localhost|.*\.local)$/;
+var SANDBOX_HOST = /\.e2b\.(app|dev)$/;
+function unwrapIpLiteral(host) {
+  if (host.startsWith("[") && host.endsWith("]")) return host.slice(1, -1);
+  if (/^[0-9.]+$/.test(host) || host.includes(":")) return host;
+  return null;
+}
+function isPrivateHostname(hostname) {
+  const host = hostname.trim().toLowerCase();
+  if (!host) return true;
+  if (PRIVATE_HOST.test(host) || SANDBOX_HOST.test(host)) return true;
+  const literal = unwrapIpLiteral(host);
+  return literal === null ? false : isPrivateAddress(literal);
+}
+var BROWSER_PROXY_BYPASS = [
+  "localhost",
+  "*.localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "*.local",
+  // A Session's own preview, which is served from the sandbox's public host —
+  // public in DNS, ours in every sense that matters here.
+  "*.e2b.app",
+  "*.e2b.dev",
+  "10.*",
+  "192.168.*",
+  "169.254.*",
+  ...Array.from({ length: 16 }, (_, i) => `172.${16 + i}.*`)
+].join(",");
+function refuseNonPublicUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "unparseable";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "not_public";
+  return isPrivateHostname(parsed.hostname) ? "not_public" : null;
+}
+
+// ../proxy/src/route.ts
+var DIRECT_ROUTE = { kind: "direct" };
+function proxyUsername(spec, rawUsername, options) {
+  const raw = rawUsername.trim();
+  const foreignPrefix = KNOWN_USERNAME_PREFIXES.find(
+    (prefix) => prefix !== spec.usernamePrefix && raw.startsWith(prefix)
+  );
+  if (foreignPrefix) return { ok: false, problem: "wrong_prefix" };
+  let username = raw.startsWith(spec.usernamePrefix) ? raw : `${spec.usernamePrefix}${raw}`;
+  if (options?.country) username += `${spec.countryKey}${options.country.toUpperCase()}`;
+  if (options?.session && spec.sessionKey) username += `${spec.sessionKey}${options.session}`;
+  return { ok: true, username };
+}
+function buildProxyRoute(tier, credentials, options) {
+  const held = credentials[tier];
+  if (!held) return { ok: false, problem: "missing" };
+  const spec = PROXY_TIERS[tier];
+  const username = proxyUsername(spec, held.username, options);
+  if (!username.ok) return username;
+  return {
+    ok: true,
+    route: {
+      kind: "proxy",
+      tier,
+      server: `http://${spec.host}:${spec.port}`,
+      username: username.username,
+      password: held.password
+    }
+  };
+}
+
+// ../proxy/src/ladder.ts
+function plannedRoutes(url, credentials, options) {
+  if (refuseNonPublicUrl(url) !== null) return [DIRECT_ROUTE];
+  const routes = [DIRECT_ROUTE];
+  for (const tier of configuredTiers(credentials)) {
+    const built = buildProxyRoute(tier, credentials, options);
+    if (!built.ok) continue;
+    for (let attempt = 0; attempt < PROXY_TIERS[tier].attempts; attempt++) routes.push(built.route);
+  }
+  return routes;
+}
+function routeTier(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function nextPlannedRoute(routes, tried) {
+  const dead = new Set(tried.filter((attempt) => attempt.proxyFailure).map((attempt) => attempt.tier));
+  const spent = /* @__PURE__ */ new Map();
+  for (const attempt of tried) spent.set(attempt.tier, (spent.get(attempt.tier) ?? 0) + 1);
+  const offered = /* @__PURE__ */ new Map();
+  for (const route of routes) {
+    const tier = routeTier(route);
+    if (dead.has(tier)) continue;
+    const position = (offered.get(tier) ?? 0) + 1;
+    offered.set(tier, position);
+    if (position > (spent.get(tier) ?? 0)) return route;
+  }
+  return null;
+}
+
+// src/env.ts
+import { createEnv } from "@t3-oss/env-core";
+import { z } from "zod";
+
+// src/apiKeyFormat.ts
+var KEY_PREFIXES = ["bk_", "bkr_", "bkv_"];
+var API_KEY_FORMAT_MESSAGE = "API key must start with 'bk_', 'bkr_' or 'bkv_'";
+function isBakerApiKey(value) {
+  return KEY_PREFIXES.some((prefix) => value.startsWith(prefix));
+}
+
+// src/env.ts
+var cached;
+var CONNECTION = {
+  BAKER_API_KEY: z.string().refine(isBakerApiKey, API_KEY_FORMAT_MESSAGE),
+  BAKER_API_URL: z.url("BAKER_API_URL must be a valid URL")
+};
+function getEnv() {
+  if (!cached) {
+    cached = createEnv({
+      server: {
+        ...CONNECTION,
+        BAKER_PUBLIC_API_URL: z.url("BAKER_PUBLIC_API_URL must be a valid URL").optional(),
+        BAKER_CHAT_ID: z.string().optional(),
+        BAKER_THREAD_ID: z.string().optional(),
+        BAKER_KEY_SCOPE: z.enum(["report"]).optional(),
+        BAKER_ACTING_USER_ID: z.string().optional(),
+        BAKER_GOOGLE_ADS_CUSTOMER_ID: z.string().regex(/^\d{10}$/).optional(),
+        BAKER_GA4_PROPERTY_ID: z.string().optional(),
+        BAKER_GSC_SITE_URL: z.string().optional(),
+        BAKER_X_ADS_ACCOUNT_ID: z.string().regex(/^[a-z0-9]+$/, "X Ads account ID must be a base36 string").optional(),
+        BAKER_META_AD_ACCOUNT_ID: z.string().optional(),
+        BAKER_LINKEDIN_AD_ACCOUNT_ID: z.string().regex(/^\d+$/, "LinkedIn ad account ID must be the numeric portion of urn:li:sponsoredAccount:N").optional()
+      },
+      runtimeEnv: process.env,
+      onValidationError: refuseInvalidEnv
+    });
+  }
+  return cached;
+}
+function requireConnection() {
+  return createEnv({ server: CONNECTION, runtimeEnv: process.env, onValidationError: refuseInvalidEnv });
+}
+function issueVariable(issue) {
+  const first = issue.path?.[0];
+  const key = typeof first === "object" && first !== null ? first.key : first;
+  return key === void 0 ? "environment" : String(key);
+}
+var AGENT_SET_VARIABLES = /* @__PURE__ */ new Set([
+  "BAKER_GOOGLE_ADS_CUSTOMER_ID",
+  "BAKER_LINKEDIN_AD_ACCOUNT_ID",
+  "BAKER_X_ADS_ACCOUNT_ID"
+]);
+function listVariables(variables) {
+  return `${variables.join(", ")} ${variables.length === 1 ? "is" : "are"}`;
+}
+function refuseInvalidEnv(issues) {
+  const problems = issues.map((issue) => `${issueVariable(issue)}: ${issue.message}`).join("; ");
+  const variables = [...new Set(issues.map(issueVariable))];
+  if (variables.every((variable) => AGENT_SET_VARIABLES.has(variable))) {
+    writeJson({
+      ok: false,
+      error: {
+        code: "VALIDATION_ERROR",
+        message: `An environment variable has the wrong format \u2014 ${problems}.`,
+        retryable: false,
+        fix: {
+          action: "retry_with_changes",
+          explanation: `${listVariables(variables)} an optional override set in this workspace, not by the platform. Export it again in the format named above, or unset ${variables.join(" and ")} and pass the account with the command's flag instead, then re-run the command.`
+        }
+      }
+    });
+    process.exit(1);
+  }
+  writeJson({
+    ok: false,
+    error: {
+      code: "NOT_CONFIGURED",
+      message: `This workspace's Baker connection is misconfigured \u2014 ${problems}.`,
+      retryable: false,
+      fix: {
+        action: "continue_without",
+        explanation: `${listVariables(variables)} set by the platform when this workspace starts, and nothing in this workspace can correct it \u2014 do not retry, and do not set or edit it yourself. Every command that reads or writes Baker data will fail the same way. Carry on with work that does not need Baker's data (files in the repo, local checks), and tell the user that reading and saving their Baker data is unavailable in this conversation until the platform fixes it.`
+      }
+    }
+  });
+  process.exit(1);
+}
+function optionalChatId() {
+  return process.env.BAKER_CHAT_ID || void 0;
+}
+function optionalTurnId() {
+  return process.env.BAKER_TURN_ID || void 0;
+}
+function debugLogSetting() {
+  const raw = process.env.BAKER_DEBUG_LOG?.trim();
+  return raw ? raw : void 0;
+}
+var MissingChatIdError = class extends Error {
+  code = "MISSING_CHAT_ID";
+  constructor() {
+    super(
+      "BAKER_CHAT_ID is not set. This command stages changes against a chat \u2014 run it from a chat-attached environment."
+    );
+    this.name = "MissingChatIdError";
+  }
+};
+function canvasAssetOriginsSetting() {
+  const raw = process.env.BAKER_CANVAS_ASSET_ORIGINS?.trim();
+  return raw ? raw : void 0;
+}
+function optionalConnection() {
+  const apiKey = process.env.BAKER_API_KEY;
+  const baseUrl = process.env.BAKER_API_URL;
+  return apiKey && baseUrl ? { apiKey, baseUrl } : null;
+}
+function requireChatId() {
+  const env = getEnv();
+  if (!env.BAKER_CHAT_ID) {
+    throw new MissingChatIdError();
+  }
+  return env.BAKER_CHAT_ID;
+}
+function resolveChatId(chat) {
+  return typeof chat === "string" && chat.length > 0 ? chat : requireChatId();
+}
+function hasFrameVisionKey() {
+  return Boolean(frameVisionKey());
+}
+function frameVisionKey() {
+  return process.env.GEMINI_API_KEY;
+}
+function openRouterKey() {
+  return process.env.OPENROUTER_API_KEY;
+}
+function hasOpenRouterKey() {
+  return Boolean(openRouterKey());
+}
+function captureBudgetMs() {
+  const raw = Number(process.env.BAKER_CAPTURE_BUDGET_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : null;
+}
+function captureProxyCredentials() {
+  return readProxyCredentials(process.env);
+}
+function captureVimeoCookie() {
+  const raw = process.env.VIMEO_COOKIE?.trim();
+  return raw ? raw : void 0;
+}
+function childEnvWith(extra) {
+  return { ...process.env, ...extra };
+}
+
+export {
+  isChallengeBody,
+  isProxyFailure,
+  shouldEscalate,
+  isPrivateAddress,
+  refuseNonPublicUrl,
+  DIRECT_ROUTE,
+  plannedRoutes,
+  nextPlannedRoute,
+  API_KEY_FORMAT_MESSAGE,
+  isBakerApiKey,
+  getEnv,
+  requireConnection,
+  optionalChatId,
+  optionalTurnId,
+  debugLogSetting,
+  MissingChatIdError,
+  canvasAssetOriginsSetting,
+  optionalConnection,
+  requireChatId,
+  resolveChatId,
+  hasFrameVisionKey,
+  frameVisionKey,
+  openRouterKey,
+  hasOpenRouterKey,
+  captureBudgetMs,
+  captureProxyCredentials,
+  captureVimeoCookie,
+  childEnvWith
+};
+//# sourceMappingURL=chunk-NVBBZPJP.js.map