@koda-sl/baker-cli 0.476.0 → 0.477.0

package/dist/chunk-H5CGVMQW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../proxy/src/challenge.ts","../../proxy/src/tiers.ts","../../proxy/src/credentials.ts","../../proxy/src/escalate.ts","../../proxy/src/privateAddress.ts","../../proxy/src/publicAddress.ts","../../proxy/src/route.ts","../../proxy/src/ladder.ts","../src/env.ts","../src/apiKeyFormat.ts"],"sourcesContent":["/**\n * Was that a page, or the wall in front of it?\n *\n * A bot filter answers 200. The body parses, it has a title, and every check\n * downstream — `response.ok`, the status, the content type — says the read\n * succeeded. So a challenge is the one block that cannot be seen from the\n * status line, and the only place it is visible is the bytes.\n *\n * This lives in `@baker/proxy` rather than beside any one caller because the\n * escalation ladder is only coherent if every surface agrees on what \"blocked\"\n * means: the rung that gets climbed is chosen from this answer, and a detector\n * that differs per caller would mean the same wall costs money on one surface\n * and is filed as content on another.\n *\n * Pure and dependency-free, so it stays reachable from Convex's V8 runtime\n * through the package barrel.\n */\n\n/**\n * Phrases that only appear on a block or challenge page.\n *\n * Deliberately specific — \"access denied\" alone would match a page *about*\n * access control, so each phrase is one a real marketing page has no reason to\n * use as its title.\n */\nconst CHALLENGE_PHRASES = [\n  \"just a moment\",\n  \"attention required\",\n  \"verify you are human\",\n  \"checking your browser\",\n  \"enable javascript and cookies to continue\",\n  \"unusual traffic\",\n  \"access denied\",\n  \"you have been blocked\",\n  \"request unsuccessful\",\n  \"are you a robot\",\n  \"security check\",\n  \"ddos protection\",\n  \"captcha\",\n];\n\n/** Vendors whose block pages carry a fingerprint even when the title does not. */\nconst CHALLENGE_MARKERS = [\"cf-browser-verification\", \"cf_chl_\", \"px-captcha\", \"_incapsula_\", \"distil_r_captcha\"];\n\n/**\n * How long a response may be and still be judged by its *wording*.\n *\n * Phrases like \"captcha\" or \"access denied\" are ordinary English that a real\n * article can legitimately contain, so matching them anywhere would refuse\n * pages we read perfectly well. Length is the precision guard: a page that is\n * mostly content is content.\n */\nexport const CHALLENGE_LENGTH_CEILING = 2_000;\n\n/**\n * Whether these bytes are a bot wall rather than the thing that was asked for.\n *\n * Reads only what the caller already paid for. Nothing here issues a request —\n * asking the host again would deepen the very block this is detecting.\n *\n * The two lists are searched differently, and that asymmetry is the point.\n * Phrases are judged only on a short response, for the precision reason above.\n * Vendor markers are fingerprints nothing but the vendor emits, so they are\n * searched at any length — which is what makes a real interstitial detectable\n * at all. Cloudflare's is 5–15 KB of inlined script wrapped around one visible\n * sentence, so gating markers behind the same length ceiling as the phrases put\n * every genuine large wall in a dead band where neither list could reach it.\n */\nexport function isChallengeBody(content: string, title?: string | null): boolean {\n  if (content.length <= CHALLENGE_LENGTH_CEILING) {\n    const haystack = `${title ?? \"\"}\\n${content}`.toLowerCase();\n    if (CHALLENGE_PHRASES.some((phrase) => haystack.includes(phrase))) return true;\n  }\n\n  const whole = content.toLowerCase();\n  return CHALLENGE_MARKERS.some((marker) => whole.includes(marker));\n}\n","/**\n * The two Oxylabs products, and everything that differs between them.\n *\n * They are NOT credential-swappable. Endpoint, username prefix, geo token and\n * sticky-session mechanism all differ, so \"same URL, other username/password\"\n * fails — and it fails as a 407, which Chromium reports as a plain network\n * error. Before this module existed there was no code path that could tell that\n * apart from the site refusing us, so the failure would have been recorded\n * against the page rather than against our own configuration.\n *\n * That asymmetry is the reason this table exists in exactly one place. Every\n * caller builds its route through `buildProxyRoute`; nobody concatenates an\n * Oxylabs URL by hand.\n */\n\nexport type ProxyTier = \"datacenter\" | \"residential\";\n\nexport interface ProxyTierSpec {\n  readonly tier: ProxyTier;\n  readonly host: string;\n  readonly port: number;\n  /** Oxylabs requires this in front of the account name. The two differ. */\n  readonly usernamePrefix: \"user-\" | \"customer-\";\n  /** Country targeting token. `-country-` on datacenter, `-cc-` on residential. */\n  readonly countryKey: \"-country-\" | \"-cc-\";\n  /**\n   * Sticky-session token, or null when the product has none.\n   *\n   * Datacenter does stickiness by *port* (8001 for IP #1, 8002 for #2), not by\n   * username: a capture is a single page load and uses the rotating port. A\n   * download that must reach a site from one IP over several connections asks\n   * for pinned ports instead (route.ts `pinnedDatacenterRoutes`).\n   */\n  readonly sessionKey: \"-sessid-\" | null;\n  /**\n   * How many times a blocked request is retried on this tier before climbing.\n   *\n   * Datacenter's port 8000 hands out a different IP on every new connection\n   * (Oxylabs, \"Datacenter Proxies\": port 8000 rotates, 8001+ pins one IP), and\n   * every attempt opens a fresh agent, browser or process — so a retry is a new\n   * exit IP at datacenter prices. A WAF that blocks one address in a range\n   * often serves its neighbour, so three of those are still far cheaper than\n   * one residential attempt. Residential is billed per GB at a much higher\n   * rate, and gets exactly one.\n   */\n  readonly attempts: number;\n}\n\nexport const PROXY_TIERS: Readonly<Record<ProxyTier, ProxyTierSpec>> = {\n  datacenter: {\n    tier: \"datacenter\",\n    host: \"dc.oxylabs.io\",\n    port: 8000,\n    usernamePrefix: \"user-\",\n    countryKey: \"-country-\",\n    sessionKey: null,\n    attempts: 3,\n  },\n  residential: {\n    tier: \"residential\",\n    host: \"pr.oxylabs.io\",\n    port: 7777,\n    usernamePrefix: \"customer-\",\n    countryKey: \"-cc-\",\n    sessionKey: \"-sessid-\",\n    attempts: 1,\n  },\n};\n\n/**\n * Cheapest useful route first, and the ladder never skips a rung.\n *\n * Residential costs materially more than datacenter, so it is only ever reached\n * because datacenter was tried and refused — never as a first guess and never\n * speculatively.\n */\nexport const ESCALATION_ORDER = [\"datacenter\", \"residential\"] as const satisfies readonly ProxyTier[];\n\n/** Every prefix this module knows, used to spot a credential in the wrong slot. */\nexport const KNOWN_USERNAME_PREFIXES = [\"user-\", \"customer-\"] as const;\n","import type { ProxyTier } from \"./tiers.ts\";\nimport { ESCALATION_ORDER } from \"./tiers.ts\";\n\n/**\n * The four environment variable names, in one place.\n *\n * Convex holds these and hands them to the sandbox; the CLI reads them back\n * out. A typo on either side is a *silent* no-op — the capability appears to\n * ship, every fetch quietly takes the direct route, and nothing fails. That is\n * the worst failure mode available to this feature, so the names are a shared\n * constant with a contract test rather than eight string literals spread across\n * two packages.\n */\nexport const PROXY_ENV_VARS = {\n  datacenter: { username: \"OXYLABS_DATACENTER_USERNAME\", password: \"OXYLABS_DATACENTER_PASSWORD\" },\n  residential: { username: \"OXYLABS_RESIDENTIAL_USERNAME\", password: \"OXYLABS_RESIDENTIAL_PASSWORD\" },\n} as const satisfies Record<ProxyTier, { username: string; password: string }>;\n\nexport interface TierCredentials {\n  readonly username: string;\n  readonly password: string;\n}\n\nexport type ProxyCredentials = Partial<Readonly<Record<ProxyTier, TierCredentials>>>;\n\n/**\n * Read whichever tiers are fully configured.\n *\n * Takes the env record rather than reading `process.env` itself, so the whole\n * package stays pure and the Convex and CLI sides can be tested identically.\n *\n * Half a pair is not a credential. A username with no password would build a\n * route that authenticates as nobody, and Oxylabs answers that with the same\n * 407 as a wrong password — so it would look like a broken proxy rather than an\n * unconfigured one. Dropping it here means `configuredTiers` tells the truth.\n */\nexport function readProxyCredentials(env: Record<string, string | undefined>): ProxyCredentials {\n  const credentials: { -readonly [K in ProxyTier]?: TierCredentials } = {};\n  for (const tier of ESCALATION_ORDER) {\n    const username = env[PROXY_ENV_VARS[tier].username]?.trim();\n    const password = env[PROXY_ENV_VARS[tier].password]?.trim();\n    if (username && password) credentials[tier] = { username, password };\n  }\n  return credentials;\n}\n\n/**\n * The inverse of `readProxyCredentials`: credentials back out as env vars.\n *\n * The writing side used to be a loop inside one Convex function, which is how\n * the ladder came to exist everywhere and work in one place. That loop ran only\n * for `baker landing inspiration scrape`, so every other CLI fetch surface in a\n * Session — `images download`, canvas `ingest`, the two scaffolders, yt-dlp —\n * read four variables nobody had set and went direct, silently, exactly as\n * `PROXY_ENV_VARS` warns.\n *\n * Pairing it with the reader here is the point: the round trip is a test, so the\n * two sides cannot drift into agreeing about three variables out of four.\n */\nexport function proxyCredentialEnvs(credentials: ProxyCredentials): Record<string, string> {\n  const envs: Record<string, string> = {};\n  for (const tier of ESCALATION_ORDER) {\n    const held = credentials[tier];\n    if (!held) continue;\n    envs[PROXY_ENV_VARS[tier].username] = held.username;\n    envs[PROXY_ENV_VARS[tier].password] = held.password;\n  }\n  return envs;\n}\n\n/**\n * Which tiers this process could actually reach, cheapest first.\n *\n * There is no ceiling to apply. A deployment holding both pairs may climb to\n * residential, full stop — the brake is the credential itself. Removing\n * `OXYLABS_RESIDENTIAL_PASSWORD` takes effect on the next restart, needs no\n * deploy, and withholds the tier by the same mechanism a ceiling would have,\n * so the valve that used to sit here only added a second way to say it. It was\n * also never wired into ad-dna's task definition, which is the highest-volume\n * egress in the repo — a control that could not be turned where it mattered\n * most.\n */\nexport function configuredTiers(credentials: ProxyCredentials): ProxyTier[] {\n  return ESCALATION_ORDER.filter((tier) => credentials[tier] !== undefined);\n}\n\n/** Whether there is any proxy to escalate to at all. */\nexport function proxyEscalationConfigured(credentials: ProxyCredentials): boolean {\n  return configuredTiers(credentials).length > 0;\n}\n","/**\n * When is a failure worth spending a more expensive route on?\n *\n * The ladder only ever climbs on evidence that *who we are* was the problem. A\n * page that 404s, a domain that does not resolve, a certificate that will not\n * negotiate and a site that timed out all fail identically from every IP on\n * earth, so retrying them through a metered exit buys a second identical\n * failure and a bill. That asymmetry — cheap to be wrong in one direction,\n * expensive in the other — is why this is a closed allow-list rather than\n * \"escalate unless we recognise the error\".\n *\n * Shared deliberately: the capture engine, the image fetchers and the ad-media\n * downloaders all have to agree on what \"blocked\" means, or the corpus and the\n * bill disagree about the same event.\n */\n\n/** What one attempt observed, normalised across Playwright and `fetch`. */\nexport interface BlockSignal {\n  /** Main-document / response status, when there was one. */\n  readonly status?: number | null;\n  /** Chromium `net::` name or a Node error code, when the attempt threw one. */\n  readonly netError?: string | null;\n  /** A challenge body was detected behind an otherwise successful response. */\n  readonly challenge?: boolean;\n  /** The attempt ran out of time rather than being refused. */\n  readonly timedOut?: boolean;\n}\n\n/** \"We don't like *you*\" — a different exit IP is a different you. */\nconst ESCALATABLE_STATUSES = new Set([403, 429, 451]);\n\n/**\n * A TCP reset on ClientHello is how a WAF null-routes a datacenter range.\n *\n * Today all three of these collapse into one \"site didn't respond\" message and\n * are filed non-retryable, which is precisely why this class of block has been\n * invisible: it looks identical to a site that is genuinely down.\n */\nconst ESCALATABLE_NET_ERRORS = new Set([\"ERR_CONNECTION_RESET\", \"ERR_CONNECTION_CLOSED\", \"ERR_EMPTY_RESPONSE\"]);\n\n/**\n * Failures that belong to our route, not to the site.\n *\n * A 407 cannot come from an origin server — only something speaking proxy\n * produces one — so this needs no \"was this attempt proxied\" flag to be safe.\n */\nconst PROXY_NET_ERRORS = new Set([\n  \"ERR_TUNNEL_CONNECTION_FAILED\",\n  \"ERR_PROXY_CONNECTION_FAILED\",\n  \"ERR_PROXY_AUTH_REQUESTED\",\n  \"ERR_PROXY_CERTIFICATE_INVALID\",\n  \"ERR_UNEXPECTED_PROXY_AUTH\",\n  \"ERR_MANDATORY_PROXY_CONFIGURATION_FAILED\",\n  \"ERR_HTTPS_PROXY_TUNNEL_RESPONSE_REDIRECT\",\n]);\n\nexport function isProxyFailure(signal: BlockSignal): boolean {\n  if (signal.status === 407) return true;\n  return signal.netError ? PROXY_NET_ERRORS.has(signal.netError) : false;\n}\n\nexport function shouldEscalate(signal: BlockSignal): boolean {\n  // Our own broken route never advances the ladder — it degrades it. Climbing\n  // here would spend a more expensive rung reproducing our misconfiguration.\n  if (isProxyFailure(signal)) return false;\n  if (signal.timedOut) return false;\n  if (signal.challenge) return true;\n  if (signal.status != null && ESCALATABLE_STATUSES.has(signal.status)) return true;\n  return signal.netError ? ESCALATABLE_NET_ERRORS.has(signal.netError) : false;\n}\n","/**\n * The same question as `refuseNonPublicUrl`, asked of an address instead of a name.\n *\n * A URL carries a hostname, and a hostname is not an address. `localtest.me`\n * and `127.0.0.1.nip.io` are public names, with public DNS records, that\n * resolve to `127.0.0.1` — and nothing stops an attacker pointing a domain they\n * own at `169.254.169.254`. Proven against a real loopback server: the hostname\n * guard passed `http://localtest.me:4321/secret.txt` straight through, the bytes\n * were downloaded, and only the image parser complained afterwards.\n *\n * IPv6 is parsed rather than pattern-matched, and that is the second lesson\n * here. The first version tested prefixes with regexes and unwrapped an\n * IPv4-mapped address only when it still had a dot in it — but a URL parser\n * normalises `::ffff:127.0.0.1` to `::ffff:7f00:1`, so the dot is gone by the\n * time anyone looks. `[::ffff:169.254.169.254]` therefore read as public and the\n * ladder returned the metadata body with `outcome: \"ok\"`. One address has many\n * spellings; comparing spellings is the wrong operation.\n *\n * Anything unparseable is treated as private. This is a safety gate, and the\n * only safe reading of \"I do not know what this is\" is \"do not fetch it\".\n */\n\n/** Every IPv4 range that is not routable on the public internet. */\nfunction isPrivateIpv4Octets(octets: readonly number[]): boolean {\n  const [a, b] = octets as [number, number, number, number];\n  if (a === 0) return true; // \"this network\" — 0.0.0.0/8\n  if (a === 10) return true; // private\n  if (a === 127) return true; // loopback\n  if (a === 169 && b === 254) return true; // link-local, and the cloud metadata address\n  if (a === 172 && b >= 16 && b <= 31) return true; // private /12 — NOT all of 172.*\n  if (a === 192 && b === 168) return true; // private\n  if (a === 100 && b >= 64 && b <= 127) return true; // carrier-grade NAT\n  if (a >= 224) return true; // multicast and reserved\n  return false;\n}\n\n/** Dotted-quad to octets, or `null` when it is not one. */\nfunction parseIpv4(value: string): number[] | null {\n  const parts = value.split(\".\");\n  if (parts.length !== 4) return null;\n  const octets = parts.map((part) => (/^\\d{1,3}$/.test(part) ? Number(part) : Number.NaN));\n  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;\n  return octets;\n}\n\n/**\n * One side of a `::` to its 16-bit groups, or `null` if any part is not one.\n *\n * A trailing dotted-quad stands for the final two groups and is only legal in\n * last position — that is the spelling `::ffff:127.0.0.1` uses before a URL\n * parser rewrites it to `::ffff:7f00:1`.\n */\nfunction expandGroups(part: string): number[] | null {\n  if (part === \"\") return [];\n  const chunks = part.split(\":\");\n  const groups: number[] = [];\n  for (let index = 0; index < chunks.length; index++) {\n    const chunk = chunks[index] as string;\n    if (chunk.includes(\".\")) {\n      if (index !== chunks.length - 1) return null;\n      const octets = parseIpv4(chunk);\n      if (!octets) return null;\n      groups.push(((octets[0] as number) << 8) | (octets[1] as number));\n      groups.push(((octets[2] as number) << 8) | (octets[3] as number));\n      continue;\n    }\n    if (!/^[0-9a-f]{1,4}$/.test(chunk)) return null;\n    groups.push(Number.parseInt(chunk, 16));\n  }\n  return groups;\n}\n\n/**\n * IPv6 to its eight 16-bit groups, or `null` when it is not one.\n *\n * Handles the `::` elision and a trailing dotted-quad, which together are why\n * one address has so many spellings.\n */\nfunction parseIpv6(value: string): number[] | null {\n  const halves = value.split(\"::\");\n  if (halves.length > 2) return null;\n\n  const head = expandGroups(halves[0] as string);\n  const tail = halves.length === 2 ? expandGroups(halves[1] as string) : [];\n  if (head === null || tail === null) return null;\n\n  if (halves.length === 1) return head.length === 8 ? head : null;\n  const missing = 8 - head.length - tail.length;\n  if (missing < 1) return null;\n  return [...head, ...new Array<number>(missing).fill(0), ...tail];\n}\n\nexport function isPrivateAddress(ip: string): boolean {\n  const address = ip.trim().toLowerCase();\n  if (!address) return true;\n\n  const v4 = parseIpv4(address);\n  if (v4) return isPrivateIpv4Octets(v4);\n\n  const v6 = parseIpv6(address);\n  // Not an address we can read. A safety gate may not guess.\n  if (!v6) return true;\n\n  const [g0, g1, g2, g3, g4, g5, g6, g7] = v6 as [number, number, number, number, number, number, number, number];\n\n  // `::` (unspecified) and `::1` (loopback).\n  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0 && g6 === 0) return true;\n\n  // IPv4-mapped (`::ffff:a.b.c.d`) and IPv4-translated (`::ffff:0:a.b.c.d`).\n  // The whole point: by the time this is read the tail is hex, not dotted.\n  const mappedV4 = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0;\n  if (mappedV4 && g4 === 0 && g5 === 0xffff) {\n    return isPrivateIpv4Octets([g6 >> 8, g6 & 0xff, g7 >> 8, g7 & 0xff]);\n  }\n  if (mappedV4 && g4 === 0xffff && g5 === 0) {\n    return isPrivateIpv4Octets([g6 >> 8, g6 & 0xff, g7 >> 8, g7 & 0xff]);\n  }\n\n  if ((g0 & 0xfe00) === 0xfc00) return true; // fc00::/7 unique-local\n  if ((g0 & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local\n  return false;\n}\n","/**\n * Addresses that must never be fetched, and must never be proxied.\n *\n * Lifted from `convex/landingLibrary/utils.ts`, where these three regexes were\n * the only copy in the repo — reachable from Convex and from nowhere else. That\n * was survivable while the capture ran one hop after the check. It is not\n * survivable now: the CLI can be invoked directly, two Convex paths enqueue\n * without re-validating, and a proxy adds a rung where \"which network am I on\"\n * stops being rhetorical.\n *\n * Two distinct reasons live here, and both point the same way:\n *\n * - **There is nothing to read.** A private address only resolves from inside\n *   the network asking, so a capture of one produces a screenshot of an error.\n * - **There is something to read, and we must not.** `169.254.169.254` is the\n *   cloud metadata endpoint that every capture runner has a route to.\n *\n * The rule for the proxy is *refuse*, not *bypass*. Bypassing would leave a\n * request that still happens, just unproxied; refusing means there is no\n * request to route. That is a stronger guarantee and a simpler one to check.\n */\n\nimport { isPrivateAddress } from \"./privateAddress.ts\";\n\n/**\n * Names — not addresses. Anything that looks like an address goes to\n * `isPrivateAddress`, which parses it instead of matching its spelling.\n */\nconst PRIVATE_HOST = /^(localhost|.*\\.localhost|.*\\.local)$/;\n/** Where a Session's own preview is served while the page is being built. */\nconst SANDBOX_HOST = /\\.e2b\\.(app|dev)$/;\n\n/**\n * A bracketed IPv6 literal, unwrapped.\n *\n * `new URL(\"http://[::1]/\").hostname` keeps the brackets, so a hostname check\n * that does not strip them is comparing against a string no address will ever\n * equal. The previous version tried to absorb that with `\\[?::1\\]?` and caught\n * exactly one address out of the whole of IPv6 — `[::ffff:169.254.169.254]`\n * sailed through and the ladder returned the metadata body with `outcome: \"ok\"`.\n */\nfunction unwrapIpLiteral(host: string): string | null {\n  if (host.startsWith(\"[\") && host.endsWith(\"]\")) return host.slice(1, -1);\n  // A bare v4 literal, or a v6 one that arrived without brackets.\n  if (/^[0-9.]+$/.test(host) || host.includes(\":\")) return host;\n  return null;\n}\n\nexport function isPrivateHostname(hostname: string): boolean {\n  const host = hostname.trim().toLowerCase();\n  if (!host) return true;\n  if (PRIVATE_HOST.test(host) || SANDBOX_HOST.test(host)) return true;\n\n  // Every address form — v4, v6, bracketed, mapped, elided — is decided by one\n  // parser. Spelling an address in a regex is what let four of them through.\n  const literal = unwrapIpLiteral(host);\n  return literal === null ? false : isPrivateAddress(literal);\n}\n\n/**\n * The same rule again, in the only notation a browser's proxy settings speak.\n *\n * Chromium — and so Playwright and `agent-browser` — matches a bypass entry\n * against the hostname and understands one wildcard and no CIDR at all. The\n * ranges above therefore cannot be handed over as regexes; `172.16/12` has to\n * become sixteen entries, and there is no way to express \"any private address\".\n *\n * That makes this a second copy of one fact, which is worth stating plainly:\n * the day it disagrees with `isPrivateHostname` is the day a Session's own\n * preview at `localhost:4321` goes out through a metered exit and comes back\n * refused. Its test pins the correspondence.\n *\n * Note the direction reverses here, and deliberately. Everywhere else the rule\n * for a private address is *refuse*, because a request that still happens is\n * not a guarantee. A browser the agent drives has to reach `localhost:4321` —\n * that is its main job — so here the private address is the legitimate traffic\n * and the list says \"go direct\", not \"do not go\".\n */\nexport const BROWSER_PROXY_BYPASS = [\n  \"localhost\",\n  \"*.localhost\",\n  \"127.0.0.1\",\n  \"0.0.0.0\",\n  \"::1\",\n  \"*.local\",\n  // A Session's own preview, which is served from the sandbox's public host —\n  // public in DNS, ours in every sense that matters here.\n  \"*.e2b.app\",\n  \"*.e2b.dev\",\n  \"10.*\",\n  \"192.168.*\",\n  \"169.254.*\",\n  ...Array.from({ length: 16 }, (_, i) => `172.${16 + i}.*`),\n].join(\",\");\n\nexport type NonPublicReason = \"not_public\" | \"unparseable\";\n\n/**\n * `null` when the URL is safe to fetch; a reason when it must be refused.\n *\n * Anything that is not plain http(s) is refused too. A capture is handed URLs\n * from agents and from stored rows, and `file:` reaching a browser we launched\n * is a local file read wearing a URL.\n */\nexport function refuseNonPublicUrl(url: string): NonPublicReason | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return \"unparseable\";\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return \"not_public\";\n  return isPrivateHostname(parsed.hostname) ? \"not_public\" : null;\n}\n","import type { ProxyCredentials } from \"./credentials.ts\";\nimport type { ProxyTier, ProxyTierSpec } from \"./tiers.ts\";\nimport { KNOWN_USERNAME_PREFIXES, PROXY_TIERS } from \"./tiers.ts\";\n\n/**\n * How one attempt reaches the internet.\n *\n * Credentials stay in separate fields instead of being embedded in the URL:\n * Playwright's `proxy` option wants them that way, undici's `ProxyAgent` takes\n * them as a header we build once, and — the real reason — a password that never\n * exists as a substring of a URL cannot be leaked by anything that logs a URL.\n */\nexport type ProxyRoute =\n  | { readonly kind: \"direct\" }\n  | {\n      readonly kind: \"proxy\";\n      readonly tier: ProxyTier;\n      /** e.g. `http://dc.oxylabs.io:8000` */\n      readonly server: string;\n      readonly username: string;\n      readonly password: string;\n    };\n\nexport const DIRECT_ROUTE: ProxyRoute = { kind: \"direct\" };\n\nexport interface RouteOptions {\n  /** ISO-3166 alpha-2, upper-cased here. Omit for \"wherever\" — the default. */\n  readonly country?: string;\n  /** Sticky-session id. Ignored by a tier whose product has no session syntax. */\n  readonly session?: string;\n}\n\nexport type RouteProblem = \"missing\" | \"wrong_prefix\";\n\nexport type RouteResult = { ok: true; route: ProxyRoute } | { ok: false; problem: RouteProblem };\n\n/**\n * Put the account name into the shape this specific product expects.\n *\n * Three cases, and the third is the one worth being strict about:\n *\n * 1. Bare (`acme`) — someone pasted the account name. Prepend the prefix.\n * 2. Already correct (`user-acme` in the datacenter slot) — someone pasted the\n *    full Oxylabs username. Leave it alone.\n * 3. Carrying the OTHER product's prefix (`customer-acme` in the datacenter\n *    slot) — refuse.\n *\n * Case 3 must not be \"helpfully\" rewritten. A `customer-` value in the\n * datacenter slot means the residential credentials were pasted into the wrong\n * variable, and rewriting the prefix would authenticate a residential account\n * against the datacenter endpoint. That either 407s — wasting the cheap rung\n * for no reason — or it works, and bills residential rates from the tier whose\n * entire purpose is to be the cheap one. Refusing is the only answer that\n * cannot silently cost money.\n */\nexport function proxyUsername(\n  spec: ProxyTierSpec,\n  rawUsername: string,\n  options?: RouteOptions,\n): { ok: true; username: string } | { ok: false; problem: \"wrong_prefix\" } {\n  const raw = rawUsername.trim();\n  const foreignPrefix = KNOWN_USERNAME_PREFIXES.find(\n    (prefix) => prefix !== spec.usernamePrefix && raw.startsWith(prefix),\n  );\n  if (foreignPrefix) return { ok: false, problem: \"wrong_prefix\" };\n\n  let username = raw.startsWith(spec.usernamePrefix) ? raw : `${spec.usernamePrefix}${raw}`;\n  // Geo before session — Oxylabs reads the username left to right and rejects\n  // the pair in the other order.\n  if (options?.country) username += `${spec.countryKey}${options.country.toUpperCase()}`;\n  if (options?.session && spec.sessionKey) username += `${spec.sessionKey}${options.session}`;\n  return { ok: true, username };\n}\n\n/** Build the route for one tier, or say why there isn't one. */\nexport function buildProxyRoute(tier: ProxyTier, credentials: ProxyCredentials, options?: RouteOptions): RouteResult {\n  const held = credentials[tier];\n  if (!held) return { ok: false, problem: \"missing\" };\n\n  const spec = PROXY_TIERS[tier];\n  const username = proxyUsername(spec, held.username, options);\n  if (!username.ok) return username;\n\n  return {\n    ok: true,\n    route: {\n      kind: \"proxy\",\n      tier,\n      server: `http://${spec.host}:${spec.port}`,\n      username: username.username,\n      password: held.password,\n    },\n  };\n}\n\n/** Oxylabs datacenter: port 8000 rotates per connection, 8001 onwards each pins one IP. */\nconst FIRST_PINNED_DATACENTER_PORT = 8001;\n\n/**\n * Datacenter routes that each keep one exit IP for every connection, for a\n * download whose URL is bound to the IP that resolved it and that opens more\n * than one connection: yt-dlp resolving a YouTube video and handing its cut to\n * ffmpeg, through the rotating port, reaches YouTube from two IPs and gets a\n * 403. Empty without datacenter credentials. Measured 2026-10-11: ports 8001\n * to 8020 each answered from a different IP.\n */\nexport function pinnedDatacenterRoutes(credentials: ProxyCredentials, count: number): ProxyRoute[] {\n  const built = buildProxyRoute(\"datacenter\", credentials);\n  if (!built.ok || built.route.kind !== \"proxy\") return [];\n  const { route } = built;\n  return Array.from({ length: count }, (_, i) => ({\n    ...route,\n    server: `http://${PROXY_TIERS.datacenter.host}:${FIRST_PINNED_DATACENTER_PORT + i}`,\n  }));\n}\n","import type { ProxyCredentials } from \"./credentials.ts\";\nimport { configuredTiers } from \"./credentials.ts\";\nimport { refuseNonPublicUrl } from \"./publicAddress.ts\";\nimport type { ProxyRoute, RouteOptions } from \"./route.ts\";\nimport { buildProxyRoute, DIRECT_ROUTE } from \"./route.ts\";\nimport type { ProxyTier } from \"./tiers.ts\";\nimport { PROXY_TIERS } from \"./tiers.ts\";\n\n/**\n * Every route this URL is allowed to be attempted on, in the order to try them.\n *\n * Direct is always first and always present: an unblocked page must cost\n * nothing, and a deployment with no credentials has to behave exactly as it did\n * before any of this existed.\n *\n * A tier whose credentials are malformed is *skipped*, not fatal. One\n * mis-pasted variable should cost the use of that rung, not the whole ladder —\n * the alternative is that a typo in the cheap tier silently disables the\n * expensive one that would have worked.\n *\n * A tier appears once per `attempts` in its spec, the same route repeated: the\n * rotation happens at Oxylabs' end, per connection, so the route itself has\n * nothing to vary. Callers walking the list must drop a tier's remaining\n * repeats once it fails as a *proxy* failure — a rejected credential is\n * rejected from every IP.\n */\nexport function plannedRoutes(url: string, credentials: ProxyCredentials, options?: RouteOptions): ProxyRoute[] {\n  // A private address is refused upstream; if one reaches here anyway it must\n  // not become a billed request, and there is no exit node on earth from which\n  // `localhost` means us.\n  if (refuseNonPublicUrl(url) !== null) return [DIRECT_ROUTE];\n\n  const routes: ProxyRoute[] = [DIRECT_ROUTE];\n  for (const tier of configuredTiers(credentials)) {\n    const built = buildProxyRoute(tier, credentials, options);\n    if (!built.ok) continue;\n    for (let attempt = 0; attempt < PROXY_TIERS[tier].attempts; attempt++) routes.push(built.route);\n  }\n  return routes;\n}\n\n/** What one finished attempt tells the ladder about where to go next. */\nexport interface TriedRoute {\n  readonly tier: \"direct\" | ProxyTier;\n  /** The route itself failed (407, dead tunnel), rather than the site. */\n  readonly proxyFailure: boolean;\n}\n\nfunction routeTier(route: ProxyRoute): \"direct\" | ProxyTier {\n  return route.kind === \"proxy\" ? route.tier : \"direct\";\n}\n\n/**\n * The next route in `routes` not yet spent by `tried`, or null.\n *\n * Deciding *whether* to move on is the caller's; this only says *where*. Each\n * tier's repeats are consumed in order, and a tier that failed as a proxy\n * failure loses the repeats it has left — its credential is refused from every\n * IP, so retrying it would only spend another timeout proving that again.\n */\nexport function nextPlannedRoute(routes: readonly ProxyRoute[], tried: readonly TriedRoute[]): ProxyRoute | null {\n  const dead = new Set(tried.filter((attempt) => attempt.proxyFailure).map((attempt) => attempt.tier));\n  const spent = new Map<string, number>();\n  for (const attempt of tried) spent.set(attempt.tier, (spent.get(attempt.tier) ?? 0) + 1);\n\n  const offered = new Map<string, number>();\n  for (const route of routes) {\n    const tier = routeTier(route);\n    if (dead.has(tier)) continue;\n    const position = (offered.get(tier) ?? 0) + 1;\n    offered.set(tier, position);\n    if (position > (spent.get(tier) ?? 0)) return route;\n  }\n  return null;\n}\n","import type { ProxyCredentials } from \"@baker/proxy\";\nimport { readProxyCredentials } from \"@baker/proxy\";\nimport { createEnv } from \"@t3-oss/env-core\";\nimport { z } from \"zod\";\nimport { API_KEY_FORMAT_MESSAGE, isBakerApiKey } from \"./apiKeyFormat.ts\";\nimport { writeJson } from \"./output.ts\";\n\ntype Env = {\n  BAKER_API_KEY: string;\n  BAKER_API_URL: string;\n  /**\n   * Baker's own host for the public API — `https://api.withbaker.com` — as\n   * opposed to {@link BAKER_API_URL}, which is the deployment this CLI talks\n   * to. Anything a client's own systems are told to call must use this one; a\n   * `*.convex.site` in somebody else's codebase is a move we can never make.\n   *\n   * Optional, because development publishes no branded host: the domain fronts\n   * one deployment, so there the deployment's own address is the address, and\n   * a contract printed there is still a request that runs.\n   */\n  BAKER_PUBLIC_API_URL?: string;\n  BAKER_CHAT_ID?: string;\n  /** The thread whose turn runs this call; the bridge sets it per turn. */\n  BAKER_THREAD_ID?: string;\n  /**\n   * `report` while the chat preview runs a report's endpoint: Baker holds the\n   * key to what the published report may do (read only), so a report that\n   * writes fails in the preview, not only once it is published.\n   */\n  BAKER_KEY_SCOPE?: \"report\";\n  /** The company a read is about, set by `--company` (`company-flag.ts`). */\n  BAKER_TARGET_COMPANY_ID?: string;\n  BAKER_ACTING_USER_ID?: string;\n  BAKER_GOOGLE_ADS_CUSTOMER_ID?: string;\n  BAKER_GA4_PROPERTY_ID?: string;\n  BAKER_GSC_SITE_URL?: string;\n  BAKER_X_ADS_ACCOUNT_ID?: string;\n  BAKER_META_AD_ACCOUNT_ID?: string;\n  BAKER_LINKEDIN_AD_ACCOUNT_ID?: string;\n};\n\nlet cached: Env | undefined;\n\nconst CONNECTION = {\n  BAKER_API_KEY: z.string().refine(isBakerApiKey, API_KEY_FORMAT_MESSAGE),\n  BAKER_API_URL: z.url(\"BAKER_API_URL must be a valid URL\"),\n};\n\nexport function getEnv(): Env {\n  if (!cached) {\n    cached = createEnv({\n      server: {\n        ...CONNECTION,\n        BAKER_PUBLIC_API_URL: z.url(\"BAKER_PUBLIC_API_URL must be a valid URL\").optional(),\n        BAKER_CHAT_ID: z.string().optional(),\n        BAKER_THREAD_ID: z.string().optional(),\n        BAKER_KEY_SCOPE: z.enum([\"report\"]).optional(),\n        BAKER_TARGET_COMPANY_ID: z.string().optional(),\n        BAKER_ACTING_USER_ID: z.string().optional(),\n        BAKER_GOOGLE_ADS_CUSTOMER_ID: z\n          .string()\n          .regex(/^\\d{10}$/)\n          .optional(),\n        BAKER_GA4_PROPERTY_ID: z.string().optional(),\n        BAKER_GSC_SITE_URL: z.string().optional(),\n        BAKER_X_ADS_ACCOUNT_ID: z\n          .string()\n          .regex(/^[a-z0-9]+$/, \"X Ads account ID must be a base36 string\")\n          .optional(),\n        BAKER_META_AD_ACCOUNT_ID: z.string().optional(),\n        BAKER_LINKEDIN_AD_ACCOUNT_ID: z\n          .string()\n          .regex(/^\\d+$/, \"LinkedIn ad account ID must be the numeric portion of urn:li:sponsoredAccount:N\")\n          .optional(),\n      },\n      runtimeEnv: process.env,\n      onValidationError: refuseInvalidEnv,\n    });\n  }\n  return cached;\n}\n\n/**\n * Only the Baker credentials, refused the same way {@link getEnv} refuses them.\n *\n * For a caller that needs the connection and nothing else — the canvas engine —\n * so an unrelated optional override cannot stop a render.\n */\nexport function requireConnection(): Pick<Env, \"BAKER_API_KEY\" | \"BAKER_API_URL\"> {\n  return createEnv({ server: CONNECTION, runtimeEnv: process.env, onValidationError: refuseInvalidEnv });\n}\n\ntype EnvIssue = { readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { key: PropertyKey }> };\n\nfunction issueVariable(issue: EnvIssue): string {\n  const first = issue.path?.[0];\n  const key = typeof first === \"object\" && first !== null ? first.key : first;\n  return key === undefined ? \"environment\" : String(key);\n}\n\n/** Optional overrides the agent exports itself (the ads docs tell it to); every other variable is set by the platform. */\nconst AGENT_SET_VARIABLES: ReadonlySet<string> = new Set([\n  \"BAKER_GOOGLE_ADS_CUSTOMER_ID\",\n  \"BAKER_LINKEDIN_AD_ACCOUNT_ID\",\n  \"BAKER_X_ADS_ACCOUNT_ID\",\n]);\n\nfunction listVariables(variables: ReadonlyArray<string>): string {\n  return `${variables.join(\", \")} ${variables.length === 1 ? \"is\" : \"are\"}`;\n}\n\n/**\n * The one answer to a Runtime whose environment is missing or malformed.\n *\n * Every networked command reads the env through {@link getEnv}, and ~90 of them\n * end in a catch-all that files any plain `Error` as `INTERNAL_ERROR` — the class\n * that reads as \"a server hiccup, maybe retry\". This is neither, so the answer is\n * settled here, before any caller's catch can misfile it, and the process ends.\n * Who can repair it decides the fix: an ad-account override the agent exported\n * itself is corrected or unset, while a platform-set variable (the credentials)\n * cannot change inside the Runtime. It names the variables and the rule, never\n * their values (the key is a secret), and replaces the validator's stderr dump.\n */\nfunction refuseInvalidEnv(issues: ReadonlyArray<EnvIssue>): never {\n  const problems = issues.map((issue) => `${issueVariable(issue)}: ${issue.message}`).join(\"; \");\n  const variables = [...new Set(issues.map(issueVariable))];\n  if (variables.every((variable) => AGENT_SET_VARIABLES.has(variable))) {\n    writeJson({\n      ok: false,\n      error: {\n        code: \"VALIDATION_ERROR\",\n        message: `An environment variable has the wrong format — ${problems}.`,\n        retryable: false,\n        fix: {\n          action: \"retry_with_changes\",\n          explanation:\n            `${listVariables(variables)} an optional override set in this workspace, not by the platform. ` +\n            `Export it again in the format named above, or unset ${variables.join(\" and \")} and pass the account with ` +\n            \"the command's flag instead, then re-run the command.\",\n        },\n      },\n    });\n    process.exit(1);\n  }\n  writeJson({\n    ok: false,\n    error: {\n      code: \"NOT_CONFIGURED\",\n      message: `This workspace's Baker connection is misconfigured — ${problems}.`,\n      retryable: false,\n      fix: {\n        action: \"continue_without\",\n        explanation:\n          `${listVariables(variables)} set by the platform when this workspace starts, and nothing in this workspace can correct it — ` +\n          \"do not retry, and do not set or edit it yourself. Every command that reads or writes Baker data will fail the same \" +\n          \"way. Carry on with work that does not need Baker's data (files in the repo, local checks), and tell the user \" +\n          \"that reading and saving their Baker data is unavailable in this conversation until the platform fixes it.\",\n      },\n    },\n  });\n  process.exit(1);\n}\n\n/**\n * This chat's id when one is set, without validating the rest of the env.\n *\n * For best-effort attribution only: a caller that can do its job without a chat\n * must not be ended by {@link getEnv} refusing credentials it never needed yet.\n */\nexport function optionalChatId(): string | undefined {\n  return process.env.BAKER_CHAT_ID || undefined;\n}\n\n/**\n * The company this call reads, named with `--company` (`company-flag.ts`), or\n * undefined for the credential's own. Read without validating the rest of the\n * env, for the cache and the error advice that depend on it.\n */\nexport function optionalTargetCompany(): string | undefined {\n  return process.env.BAKER_TARGET_COMPANY_ID || undefined;\n}\n\n/** Back to the credential's own company. */\nexport function clearTargetCompany(): void {\n  delete process.env.BAKER_TARGET_COMPANY_ID;\n}\n\n/** `organization` on the organization workspace's Runtime (`agent-profile.ts`). */\nexport function optionalWorkspaceKind(): string | undefined {\n  return process.env.BAKER_WORKSPACE_KIND || undefined;\n}\n\n/** Name the company this call reads; the client sends it with every request. */\nexport function setTargetCompany(companyId: string): void {\n  process.env.BAKER_TARGET_COMPANY_ID = companyId;\n}\n\n/** The bridge's id for the chat turn running this command (`<thread>:<start ms>`), when there is one. */\nexport function optionalTurnId(): string | undefined {\n  return process.env.BAKER_TURN_ID || undefined;\n}\n\n// Read directly (not via the validated schema): debug logging must work even when\n// the required BAKER_API_KEY/BAKER_API_URL are missing or malformed.\nexport function debugLogSetting(): string | undefined {\n  const raw = process.env.BAKER_DEBUG_LOG?.trim();\n  return raw ? raw : undefined;\n}\n\n/** A staging command run with no chat to stage against — its own failure, never a network one. */\nexport class MissingChatIdError extends Error {\n  readonly code = \"MISSING_CHAT_ID\";\n\n  constructor() {\n    super(\n      \"BAKER_CHAT_ID is not set. This command stages changes against a chat — run it from a chat-attached environment.\",\n    );\n    this.name = \"MissingChatIdError\";\n  }\n}\n\n/** Override for the origins the asset store serves `canvas-assets/` from (comma-separated). */\nexport function canvasAssetOriginsSetting(): string | undefined {\n  const raw = process.env.BAKER_CANVAS_ASSET_ORIGINS?.trim();\n  return raw ? raw : undefined;\n}\n\n/**\n * The Baker connection when one is configured, else null — for a step that can do without it\n * (healing a canvas path) and must not end the command the way {@link requireConnection} does.\n */\nexport function optionalConnection(): { apiKey: string; baseUrl: string } | null {\n  const apiKey = process.env.BAKER_API_KEY;\n  const baseUrl = process.env.BAKER_API_URL;\n  return apiKey && baseUrl ? { apiKey, baseUrl } : null;\n}\n\nexport function requireChatId(): string {\n  const env = getEnv();\n  if (!env.BAKER_CHAT_ID) {\n    throw new MissingChatIdError();\n  }\n  return env.BAKER_CHAT_ID;\n}\n\n/**\n * Which chat a *read* addresses. A `--chat` value names another chat in the same company — how an\n * earlier chat's staged changes are recovered verbatim instead of rebuilt from a summary — and with\n * no flag it is this session's own chat.\n *\n * Read paths only. Staging, amending and discarding keep calling `requireChatId`, so one session can\n * never edit another's draft; the backend enforces the same thing twice over, since every mutating\n * internal requires the draft be `active` and every route checks the chat belongs to the caller's\n * company.\n */\nexport function resolveChatId(chat?: unknown): string {\n  return typeof chat === \"string\" && chat.length > 0 ? chat : requireChatId();\n}\n\n/**\n * Whether the frame-vision pass can run at all.\n *\n * `hyperframes snapshot --describe` reads `GEMINI_API_KEY`, and it is the only\n * check that can tell a rendered frame apart from an empty one. The backend\n * ships the credential Studio already uses for Gemini, by omission — a\n * deployment without one simply gets the plain smoke test.\n *\n * Kept out of `getEnv()` for the same reason as the capture budget: the render\n * engine also runs where none of the chat-attached variables exist.\n */\nexport function hasFrameVisionKey(): boolean {\n  return Boolean(frameVisionKey());\n}\n\n/** The credential itself, for the pass that calls the model directly. */\nexport function frameVisionKey(): string | undefined {\n  return process.env.GEMINI_API_KEY;\n}\n\n/**\n * The gateway credential, for a Runtime pass that calls a model itself.\n *\n * The same per-org OpenRouter key the agent already runs on — the backend puts it in\n * the Runtime twice, under `ANTHROPIC_AUTH_TOKEN` for the Agent SDK and here under its\n * own name. Two names rather than one because reading the SDK's variable for a call\n * that has nothing to do with the SDK is how a rename somewhere else silently breaks\n * something over here.\n *\n * Kept out of `getEnv()` alongside `frameVisionKey`, for the same reason: the render\n * engine also runs where none of the chat-attached variables exist.\n */\nexport function openRouterKey(): string | undefined {\n  return process.env.OPENROUTER_API_KEY;\n}\n\nexport function hasOpenRouterKey(): boolean {\n  return Boolean(openRouterKey());\n}\n\n/**\n * Wall clock the whole capture may spend, when the caller bounded it.\n *\n * Read from the environment rather than taken as a flag, deliberately. A\n * `--budget-ms` argument would land in the command schema, and the schema is\n * what the agent reads — one question away from \"what is the budget for?\", and\n * from there the escalation ladder stops being invisible to it.\n *\n * Kept out of `getEnv()` because that validator is for a chat-attached run; the\n * capture engine also runs where none of those variables exist.\n */\nexport function captureBudgetMs(): number | null {\n  const raw = Number(process.env.BAKER_CAPTURE_BUDGET_MS);\n  return Number.isFinite(raw) && raw > 0 ? raw : null;\n}\n\n/**\n * Egress-proxy credentials for a capture, or none at all.\n *\n * These arrive as sandbox *command* env, never as arguments — a credential in\n * argv is readable by any `ps` sharing the sandbox. With none set,\n * `plannedRoutes` yields the direct route alone and a capture behaves exactly\n * as it did before the ladder existed.\n *\n * Whichever pairs arrive are the rungs this process may climb; there is nothing\n * to filter. A tier the deployment withholds is simply absent from this env, so\n * a ceiling read on this side could only ever disagree with the one place that\n * decides.\n */\nexport function captureProxyCredentials(): ProxyCredentials {\n  return readProxyCredentials(process.env);\n}\n\n/**\n * The Vimeo session cookie the deployment supplied, or undefined.\n *\n * Absent is the normal, supported state: a deployment that has not configured\n * one gets the same \"download it and upload the file\" refusal Vimeo gave before\n * this existed. Read here with the other env, so nothing else reaches into\n * `process.env` for it.\n */\nexport function captureVimeoCookie(): string | undefined {\n  const raw = process.env.VIMEO_COOKIE?.trim();\n  return raw ? raw : undefined;\n}\n\n/**\n * This process's environment plus `extra`, for handing to a child.\n *\n * Lives here because `process.env` reads belong in this file — but it earns its\n * place beyond the lint rule: `spawn`'s `env` *replaces* the environment rather\n * than extending it, so a caller that passes only its additions silently strips\n * `PATH` and the child fails to start for a reason that looks nothing like the\n * cause.\n */\nexport function childEnvWith(extra: Record<string, string>): NodeJS.ProcessEnv {\n  return { ...process.env, ...extra };\n}\n","/**\n * What a `BAKER_API_KEY` may look like, decided once.\n *\n * Two prefixes reach the CLI, and the backend has always accepted both\n * (`convex/lib/authHelpers.ts` → `requireApiKey`): `bk_` for a company's own key,\n * and `bkr_` for the read-only credential a Session review runs with. The client\n * used to hard-require `bk_` in two places, so every `baker` call inside a review\n * failed on env validation before a request was ever sent — including the\n * session-start hooks, which made the reviewer's first impression of its own\n * Runtime a stack trace.\n *\n * `bkv_` is the read-only credential a published Report's data endpoint runs\n * with on the report runner, outside any Session.\n */\nconst KEY_PREFIXES = [\"bk_\", \"bkr_\", \"bkv_\"] as const;\n\nexport const API_KEY_FORMAT_MESSAGE = \"API key must start with 'bk_', 'bkr_' or 'bkv_'\";\n\nexport function isBakerApiKey(value: string): boolean {\n  return KEY_PREFIXES.some((prefix) => value.startsWith(prefix));\n}\n"],"mappings":";;;;;AAyBA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,oBAAoB,CAAC,2BAA2B,WAAW,cAAc,eAAe,kBAAkB;AAUzG,IAAM,2BAA2B;AAgBjC,SAAS,gBAAgB,SAAiB,OAAgC;AAC/E,MAAI,QAAQ,UAAU,0BAA0B;AAC9C,UAAM,WAAW,GAAG,SAAS,EAAE;AAAA,EAAK,OAAO,GAAG,YAAY;AAC1D,QAAI,kBAAkB,KAAK,CAAC,WAAW,SAAS,SAAS,MAAM,CAAC,EAAG,QAAO;AAAA,EAC5E;AAEA,QAAM,QAAQ,QAAQ,YAAY;AAClC,SAAO,kBAAkB,KAAK,CAAC,WAAW,MAAM,SAAS,MAAM,CAAC;AAClE;;;AC5BO,IAAM,cAA0D;AAAA,EACrE,YAAY;AAAA,IACV,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AAAA,EACA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACF;AASO,IAAM,mBAAmB,CAAC,cAAc,aAAa;AAGrD,IAAM,0BAA0B,CAAC,SAAS,WAAW;;;AClErD,IAAM,iBAAiB;AAAA,EAC5B,YAAY,EAAE,UAAU,+BAA+B,UAAU,8BAA8B;AAAA,EAC/F,aAAa,EAAE,UAAU,gCAAgC,UAAU,+BAA+B;AACpG;AAoBO,SAAS,qBAAqB,KAA2D;AAC9F,QAAM,cAAgE,CAAC;AACvE,aAAW,QAAQ,kBAAkB;AACnC,UAAM,WAAW,IAAI,eAAe,IAAI,EAAE,QAAQ,GAAG,KAAK;AAC1D,UAAM,WAAW,IAAI,eAAe,IAAI,EAAE,QAAQ,GAAG,KAAK;AAC1D,QAAI,YAAY,SAAU,aAAY,IAAI,IAAI,EAAE,UAAU,SAAS;AAAA,EACrE;AACA,SAAO;AACT;AAsCO,SAAS,gBAAgB,aAA4C;AAC1E,SAAO,iBAAiB,OAAO,CAAC,SAAS,YAAY,IAAI,MAAM,MAAS;AAC1E;;;ACvDA,IAAM,uBAAuB,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AASpD,IAAM,yBAAyB,oBAAI,IAAI,CAAC,wBAAwB,yBAAyB,oBAAoB,CAAC;AAQ9G,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,eAAe,QAA8B;AAC3D,MAAI,OAAO,WAAW,IAAK,QAAO;AAClC,SAAO,OAAO,WAAW,iBAAiB,IAAI,OAAO,QAAQ,IAAI;AACnE;AAEO,SAAS,eAAe,QAA8B;AAG3D,MAAI,eAAe,MAAM,EAAG,QAAO;AACnC,MAAI,OAAO,SAAU,QAAO;AAC5B,MAAI,OAAO,UAAW,QAAO;AAC7B,MAAI,OAAO,UAAU,QAAQ,qBAAqB,IAAI,OAAO,MAAM,EAAG,QAAO;AAC7E,SAAO,OAAO,WAAW,uBAAuB,IAAI,OAAO,QAAQ,IAAI;AACzE;;;AC9CA,SAAS,oBAAoB,QAAoC;AAC/D,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM,GAAI,QAAO;AACrB,MAAI,MAAM,IAAK,QAAO;AACtB,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,MAAI,MAAM,OAAO,KAAK,MAAM,KAAK,GAAI,QAAO;AAC5C,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,MAAI,MAAM,OAAO,KAAK,MAAM,KAAK,IAAK,QAAO;AAC7C,MAAI,KAAK,IAAK,QAAO;AACrB,SAAO;AACT;AAGA,SAAS,UAAU,OAAgC;AACjD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,SAAS,MAAM,IAAI,CAAC,SAAU,YAAY,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,OAAO,GAAI;AACvF,MAAI,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAG,QAAO;AACzF,SAAO;AACT;AASA,SAAS,aAAa,MAA+B;AACnD,MAAI,SAAS,GAAI,QAAO,CAAC;AACzB,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAM,SAAmB,CAAC;AAC1B,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AAClD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAI,UAAU,OAAO,SAAS,EAAG,QAAO;AACxC,YAAM,SAAS,UAAU,KAAK;AAC9B,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,KAAO,OAAO,CAAC,KAAgB,IAAM,OAAO,CAAC,CAAY;AAChE,aAAO,KAAO,OAAO,CAAC,KAAgB,IAAM,OAAO,CAAC,CAAY;AAChE;AAAA,IACF;AACA,QAAI,CAAC,kBAAkB,KAAK,KAAK,EAAG,QAAO;AAC3C,WAAO,KAAK,OAAO,SAAS,OAAO,EAAE,CAAC;AAAA,EACxC;AACA,SAAO;AACT;AAQA,SAAS,UAAU,OAAgC;AACjD,QAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,MAAI,OAAO,SAAS,EAAG,QAAO;AAE9B,QAAM,OAAO,aAAa,OAAO,CAAC,CAAW;AAC7C,QAAM,OAAO,OAAO,WAAW,IAAI,aAAa,OAAO,CAAC,CAAW,IAAI,CAAC;AACxE,MAAI,SAAS,QAAQ,SAAS,KAAM,QAAO;AAE3C,MAAI,OAAO,WAAW,EAAG,QAAO,KAAK,WAAW,IAAI,OAAO;AAC3D,QAAM,UAAU,IAAI,KAAK,SAAS,KAAK;AACvC,MAAI,UAAU,EAAG,QAAO;AACxB,SAAO,CAAC,GAAG,MAAM,GAAG,IAAI,MAAc,OAAO,EAAE,KAAK,CAAC,GAAG,GAAG,IAAI;AACjE;AAEO,SAAS,iBAAiB,IAAqB;AACpD,QAAM,UAAU,GAAG,KAAK,EAAE,YAAY;AACtC,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,KAAK,UAAU,OAAO;AAC5B,MAAI,GAAI,QAAO,oBAAoB,EAAE;AAErC,QAAM,KAAK,UAAU,OAAO;AAE5B,MAAI,CAAC,GAAI,QAAO;AAEhB,QAAM,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI;AAGzC,MAAI,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,EAAG,QAAO;AAI7F,QAAM,WAAW,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO;AAC5D,MAAI,YAAY,OAAO,KAAK,OAAO,OAAQ;AACzC,WAAO,oBAAoB,CAAC,MAAM,GAAG,KAAK,KAAM,MAAM,GAAG,KAAK,GAAI,CAAC;AAAA,EACrE;AACA,MAAI,YAAY,OAAO,SAAU,OAAO,GAAG;AACzC,WAAO,oBAAoB,CAAC,MAAM,GAAG,KAAK,KAAM,MAAM,GAAG,KAAK,GAAI,CAAC;AAAA,EACrE;AAEA,OAAK,KAAK,WAAY,MAAQ,QAAO;AACrC,OAAK,KAAK,WAAY,MAAQ,QAAO;AACrC,SAAO;AACT;;;AC7FA,IAAM,eAAe;AAErB,IAAM,eAAe;AAWrB,SAAS,gBAAgB,MAA6B;AACpD,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAEvE,MAAI,YAAY,KAAK,IAAI,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO;AACzD,SAAO;AACT;AAEO,SAAS,kBAAkB,UAA2B;AAC3D,QAAM,OAAO,SAAS,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,aAAa,KAAK,IAAI,KAAK,aAAa,KAAK,IAAI,EAAG,QAAO;AAI/D,QAAM,UAAU,gBAAgB,IAAI;AACpC,SAAO,YAAY,OAAO,QAAQ,iBAAiB,OAAO;AAC5D;AAqBO,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG,MAAM,KAAK,EAAE,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,OAAO,KAAK,CAAC,IAAI;AAC3D,EAAE,KAAK,GAAG;AAWH,SAAS,mBAAmB,KAAqC;AACtE,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AACxE,SAAO,kBAAkB,OAAO,QAAQ,IAAI,eAAe;AAC7D;;;AC1FO,IAAM,eAA2B,EAAE,MAAM,SAAS;AAgClD,SAAS,cACd,MACA,aACA,SACyE;AACzE,QAAM,MAAM,YAAY,KAAK;AAC7B,QAAM,gBAAgB,wBAAwB;AAAA,IAC5C,CAAC,WAAW,WAAW,KAAK,kBAAkB,IAAI,WAAW,MAAM;AAAA,EACrE;AACA,MAAI,cAAe,QAAO,EAAE,IAAI,OAAO,SAAS,eAAe;AAE/D,MAAI,WAAW,IAAI,WAAW,KAAK,cAAc,IAAI,MAAM,GAAG,KAAK,cAAc,GAAG,GAAG;AAGvF,MAAI,SAAS,QAAS,aAAY,GAAG,KAAK,UAAU,GAAG,QAAQ,QAAQ,YAAY,CAAC;AACpF,MAAI,SAAS,WAAW,KAAK,WAAY,aAAY,GAAG,KAAK,UAAU,GAAG,QAAQ,OAAO;AACzF,SAAO,EAAE,IAAI,MAAM,SAAS;AAC9B;AAGO,SAAS,gBAAgB,MAAiB,aAA+B,SAAqC;AACnH,QAAM,OAAO,YAAY,IAAI;AAC7B,MAAI,CAAC,KAAM,QAAO,EAAE,IAAI,OAAO,SAAS,UAAU;AAElD,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,WAAW,cAAc,MAAM,KAAK,UAAU,OAAO;AAC3D,MAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,UAAU,KAAK,IAAI,IAAI,KAAK,IAAI;AAAA,MACxC,UAAU,SAAS;AAAA,MACnB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AACF;;;ACnEO,SAAS,cAAc,KAAa,aAA+B,SAAsC;AAI9G,MAAI,mBAAmB,GAAG,MAAM,KAAM,QAAO,CAAC,YAAY;AAE1D,QAAM,SAAuB,CAAC,YAAY;AAC1C,aAAW,QAAQ,gBAAgB,WAAW,GAAG;AAC/C,UAAM,QAAQ,gBAAgB,MAAM,aAAa,OAAO;AACxD,QAAI,CAAC,MAAM,GAAI;AACf,aAAS,UAAU,GAAG,UAAU,YAAY,IAAI,EAAE,UAAU,UAAW,QAAO,KAAK,MAAM,KAAK;AAAA,EAChG;AACA,SAAO;AACT;AASA,SAAS,UAAU,OAAyC;AAC1D,SAAO,MAAM,SAAS,UAAU,MAAM,OAAO;AAC/C;AAUO,SAAS,iBAAiB,QAA+B,OAAiD;AAC/G,QAAM,OAAO,IAAI,IAAI,MAAM,OAAO,CAAC,YAAY,QAAQ,YAAY,EAAE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC;AACnG,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,WAAW,MAAO,OAAM,IAAI,QAAQ,OAAO,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,CAAC;AAEvF,QAAM,UAAU,oBAAI,IAAoB;AACxC,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAM,YAAY,QAAQ,IAAI,IAAI,KAAK,KAAK;AAC5C,YAAQ,IAAI,MAAM,QAAQ;AAC1B,QAAI,YAAY,MAAM,IAAI,IAAI,KAAK,GAAI,QAAO;AAAA,EAChD;AACA,SAAO;AACT;;;ACxEA,SAAS,iBAAiB;AAC1B,SAAS,SAAS;;;ACWlB,IAAM,eAAe,CAAC,OAAO,QAAQ,MAAM;AAEpC,IAAM,yBAAyB;AAE/B,SAAS,cAAc,OAAwB;AACpD,SAAO,aAAa,KAAK,CAAC,WAAW,MAAM,WAAW,MAAM,CAAC;AAC/D;;;ADqBA,IAAI;AAEJ,IAAM,aAAa;AAAA,EACjB,eAAe,EAAE,OAAO,EAAE,OAAO,eAAe,sBAAsB;AAAA,EACtE,eAAe,EAAE,IAAI,mCAAmC;AAC1D;AAEO,SAAS,SAAc;AAC5B,MAAI,CAAC,QAAQ;AACX,aAAS,UAAU;AAAA,MACjB,QAAQ;AAAA,QACN,GAAG;AAAA,QACH,sBAAsB,EAAE,IAAI,0CAA0C,EAAE,SAAS;AAAA,QACjF,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,QACnC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,QACrC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS;AAAA,QAC7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,QAC7C,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,QAC1C,8BAA8B,EAC3B,OAAO,EACP,MAAM,UAAU,EAChB,SAAS;AAAA,QACZ,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,QAC3C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,QACxC,wBAAwB,EACrB,OAAO,EACP,MAAM,eAAe,0CAA0C,EAC/D,SAAS;AAAA,QACZ,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,QAC9C,8BAA8B,EAC3B,OAAO,EACP,MAAM,SAAS,iFAAiF,EAChG,SAAS;AAAA,MACd;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,mBAAmB;AAAA,IACrB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQO,SAAS,oBAAkE;AAChF,SAAO,UAAU,EAAE,QAAQ,YAAY,YAAY,QAAQ,KAAK,mBAAmB,iBAAiB,CAAC;AACvG;AAIA,SAAS,cAAc,OAAyB;AAC9C,QAAM,QAAQ,MAAM,OAAO,CAAC;AAC5B,QAAM,MAAM,OAAO,UAAU,YAAY,UAAU,OAAO,MAAM,MAAM;AACtE,SAAO,QAAQ,SAAY,gBAAgB,OAAO,GAAG;AACvD;AAGA,IAAM,sBAA2C,oBAAI,IAAI;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,cAAc,WAA0C;AAC/D,SAAO,GAAG,UAAU,KAAK,IAAI,CAAC,IAAI,UAAU,WAAW,IAAI,OAAO,KAAK;AACzE;AAcA,SAAS,iBAAiB,QAAwC;AAChE,QAAM,WAAW,OAAO,IAAI,CAAC,UAAU,GAAG,cAAc,KAAK,CAAC,KAAK,MAAM,OAAO,EAAE,EAAE,KAAK,IAAI;AAC7F,QAAM,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,aAAa,CAAC,CAAC;AACxD,MAAI,UAAU,MAAM,CAAC,aAAa,oBAAoB,IAAI,QAAQ,CAAC,GAAG;AACpE,cAAU;AAAA,MACR,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,uDAAkD,QAAQ;AAAA,QACnE,WAAW;AAAA,QACX,KAAK;AAAA,UACH,QAAQ;AAAA,UACR,aACE,GAAG,cAAc,SAAS,CAAC,yHAC4B,UAAU,KAAK,OAAO,CAAC;AAAA,QAElF;AAAA,MACF;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,YAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,6DAAwD,QAAQ;AAAA,MACzE,WAAW;AAAA,MACX,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,aACE,GAAG,cAAc,SAAS,CAAC;AAAA,MAI/B;AAAA,IACF;AAAA,EACF,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;AAQO,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI,iBAAiB;AACtC;AAOO,SAAS,wBAA4C;AAC1D,SAAO,QAAQ,IAAI,2BAA2B;AAChD;AAGO,SAAS,qBAA2B;AACzC,SAAO,QAAQ,IAAI;AACrB;AAGO,SAAS,wBAA4C;AAC1D,SAAO,QAAQ,IAAI,wBAAwB;AAC7C;AAGO,SAAS,iBAAiB,WAAyB;AACxD,UAAQ,IAAI,0BAA0B;AACxC;AAGO,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI,iBAAiB;AACtC;AAIO,SAAS,kBAAsC;AACpD,QAAM,MAAM,QAAQ,IAAI,iBAAiB,KAAK;AAC9C,SAAO,MAAM,MAAM;AACrB;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC,OAAO;AAAA,EAEhB,cAAc;AACZ;AAAA,MACE;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,4BAAgD;AAC9D,QAAM,MAAM,QAAQ,IAAI,4BAA4B,KAAK;AACzD,SAAO,MAAM,MAAM;AACrB;AAMO,SAAS,qBAAiE;AAC/E,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,UAAU,QAAQ,IAAI;AAC5B,SAAO,UAAU,UAAU,EAAE,QAAQ,QAAQ,IAAI;AACnD;AAEO,SAAS,gBAAwB;AACtC,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AACA,SAAO,IAAI;AACb;AAYO,SAAS,cAAc,MAAwB;AACpD,SAAO,OAAO,SAAS,YAAY,KAAK,SAAS,IAAI,OAAO,cAAc;AAC5E;AAaO,SAAS,oBAA6B;AAC3C,SAAO,QAAQ,eAAe,CAAC;AACjC;AAGO,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI;AACrB;AAcO,SAAS,gBAAoC;AAClD,SAAO,QAAQ,IAAI;AACrB;AAEO,SAAS,mBAA4B;AAC1C,SAAO,QAAQ,cAAc,CAAC;AAChC;AAaO,SAAS,kBAAiC;AAC/C,QAAM,MAAM,OAAO,QAAQ,IAAI,uBAAuB;AACtD,SAAO,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AACjD;AAeO,SAAS,0BAA4C;AAC1D,SAAO,qBAAqB,QAAQ,GAAG;AACzC;AAUO,SAAS,qBAAyC;AACvD,QAAM,MAAM,QAAQ,IAAI,cAAc,KAAK;AAC3C,SAAO,MAAM,MAAM;AACrB;AAWO,SAAS,aAAa,OAAkD;AAC7E,SAAO,EAAE,GAAG,QAAQ,KAAK,GAAG,MAAM;AACpC;","names":[]}

package/dist/chunk-HDQBILJR.js

@@ -0,0 +1,45 @@
+import {
+  ANALYTICS_BUSY_FIX,
+  isAnalyticsBusy
+} from "./chunk-BC2BXRXY.js";
+import {
+  ApiError
+} from "./chunk-7ANWFQEA.js";
+
+// src/commands/analytics/errorEnvelope.ts
+import { z } from "zod";
+function analyticsErrorEnvelope(err) {
+  if (err instanceof ApiError) {
+    return isAnalyticsBusy(err.message) ? { code: err.code, message: err.message, fix: ANALYTICS_BUSY_FIX } : { code: err.code, message: err.message };
+  }
+  return { code: "NETWORK_ERROR", message: err instanceof Error ? err.message : "Unexpected error" };
+}
+function requestErrorEnvelope(err, correction, correctsLocalInput) {
+  if (err instanceof z.ZodError || err instanceof SyntaxError) {
+    const message = err instanceof z.ZodError ? z.prettifyError(err) : err.message;
+    return { code: "VALIDATION_ERROR", message, ...correctsLocalInput ? { fix: correction } : {} };
+  }
+  const envelope = analyticsErrorEnvelope(err);
+  return envelope.code === "VALIDATION_ERROR" ? { ...envelope, fix: correction } : envelope;
+}
+function questionnaireErrorEnvelope(err) {
+  return requestErrorEnvelope(
+    err,
+    "Check baker analytics plan --full for missing app events. Resolve the named contract issue or narrow the observation window; never infer abandonment from completion totals.",
+    false
+  );
+}
+function trackingPlanErrorEnvelope(err) {
+  return requestErrorEnvelope(
+    err,
+    "Read baker analytics plan --full and baker tag-manager draft list to see what is prepared. Correct the request and repeat; do not publish until every requested installation is staged.",
+    true
+  );
+}
+
+export {
+  analyticsErrorEnvelope,
+  questionnaireErrorEnvelope,
+  trackingPlanErrorEnvelope
+};
+//# sourceMappingURL=chunk-HDQBILJR.js.map

package/dist/chunk-HH5PFZ7U.js

@@ -0,0 +1,84 @@
+import {
+  findWorkspaceRoot
+} from "./chunk-ANWV2VTO.js";
+
+// src/commands/canvas/unbilled-spend.ts
+import { randomUUID } from "crypto";
+import { mkdir, readdir, readFile, rename, unlink, writeFile } from "fs/promises";
+import path from "path";
+import { z } from "zod";
+var DIR = "unbilled-spend";
+var Held = z.array(
+  z.object({ model: z.string(), inputTokens: z.number(), outputTokens: z.number(), costUsd: z.number() })
+);
+async function holdUnbilledSpend(cacheDir, usage) {
+  if (usage.length === 0) return;
+  const dir = path.join(cacheDir, DIR);
+  await mkdir(dir, { recursive: true });
+  await writeFile(path.join(dir, `${Date.now()}-${randomUUID()}.json`), JSON.stringify(usage), "utf8");
+}
+async function holdWorkspaceSpend(usage) {
+  const root = findWorkspaceRoot(process.cwd()) ?? process.cwd();
+  await holdUnbilledSpend(path.join(root, "canvas", ".cache"), usage).catch(() => {
+  });
+}
+async function takeUnbilledSpend(cacheDir) {
+  const dir = path.join(cacheDir, DIR);
+  const files = await readdir(dir).catch(() => []);
+  const byModel = /* @__PURE__ */ new Map();
+  for (const file of files.filter((f) => f.endsWith(".json"))) {
+    const claimed = path.join(dir, `${file}.${randomUUID()}.taken`);
+    try {
+      await rename(path.join(dir, file), claimed);
+    } catch {
+      continue;
+    }
+    const parsed = Held.safeParse(await readFile(claimed, "utf8").then(JSON.parse, () => null).catch(() => null));
+    await unlink(claimed).catch(() => {
+    });
+    for (const call of parsed.success ? parsed.data : []) {
+      const sum = byModel.get(call.model);
+      byModel.set(
+        call.model,
+        sum ? {
+          model: call.model,
+          inputTokens: sum.inputTokens + call.inputTokens,
+          outputTokens: sum.outputTokens + call.outputTokens,
+          costUsd: sum.costUsd + call.costUsd
+        } : { ...call }
+      );
+    }
+  }
+  return [...byModel.values()];
+}
+async function sendBillingSpend(cacheDir, usage, send) {
+  try {
+    await send();
+    return null;
+  } catch (e) {
+    await holdUnbilledSpend(cacheDir, usage).catch(() => {
+    });
+    return e instanceof Error ? e.message : String(e);
+  }
+}
+function holdWhenSettled(cacheDir, spendOf) {
+  const pending = [];
+  return {
+    settled: (run, outputs) => {
+      pending.push(holdUnbilledSpend(cacheDir, spendOf(run, outputs)).catch(() => {
+      }));
+    },
+    drained: async () => {
+      await Promise.all(pending);
+    }
+  };
+}
+
+export {
+  holdUnbilledSpend,
+  holdWorkspaceSpend,
+  takeUnbilledSpend,
+  sendBillingSpend,
+  holdWhenSettled
+};
+//# sourceMappingURL=chunk-HH5PFZ7U.js.map

package/dist/chunk-HKR7VCFK.js

@@ -0,0 +1,42 @@
+import {
+  ApiError
+} from "./chunk-7ANWFQEA.js";
+import {
+  writeJson
+} from "./chunk-ANYMWCST.js";
+
+// src/commands/studio/errors.ts
+var CREDIT_HINTS = ["credit", "top up", "billing", "quota"];
+function studioStartFix(message) {
+  const lower = message.toLowerCase();
+  if (CREDIT_HINTS.some((hint) => lower.includes(hint))) {
+    return {
+      action: "Stop generating and finish the task with assets that already exist",
+      explanation: "No generation will run until the plan is topped up, so retrying costs time and changes nothing. Source or reuse an image instead, complete the rest of the work, and tell the user the new artwork could not be produced."
+    };
+  }
+  return {
+    action: "Drop or correct the setting the message names, then run the command once more",
+    explanation: "The message says which model was chosen and what it accepts. If the setting is not essential to the brief, leave it out rather than switching model. Do not abort the wider job over one refused setting."
+  };
+}
+function failStudioCommand(error, opts = {}) {
+  if (error instanceof ApiError) {
+    writeJson({
+      ok: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        ...opts.withFix ? { fix: studioStartFix(error.message) } : {}
+      }
+    });
+    process.exit(1);
+  }
+  writeJson({ ok: false, error: { code: "INTERNAL_ERROR", message: "Unexpected error" } });
+  process.exit(1);
+}
+
+export {
+  failStudioCommand
+};
+//# sourceMappingURL=chunk-HKR7VCFK.js.map

package/dist/chunk-JQ4PQ2H6.js

@@ -0,0 +1,197 @@
+import {
+  mediaTagsCreateRequestSchema,
+  mediaTagsDeleteRequestSchema,
+  mediaTagsUpdateRequestSchema
+} from "./chunk-GAJQPQWS.js";
+import {
+  ApiError,
+  apiGet,
+  apiPost
+} from "./chunk-7ANWFQEA.js";
+import {
+  registerSchema,
+  writeJson
+} from "./chunk-ANYMWCST.js";
+
+// src/lib/tags-command.ts
+import { defineCommand } from "citty";
+var OUTPUT_ARG = {
+  output: { type: "string", description: "Output format: md|json", required: false, default: "md" }
+};
+var SHARED_POOL_HINT = "Custom tags are one pool shared by images, videos and testimonials \u2014 this change shows up in all three. Already applied: publishing or discarding this chat does not undo it.";
+function fail(err) {
+  const code = err instanceof ApiError ? err.code : "INTERNAL_ERROR";
+  const message = err instanceof ApiError ? err.message : "Unexpected error";
+  writeJson({ ok: false, error: { code, message } });
+  process.exit(1);
+}
+function failInvalid(issue) {
+  writeJson({ ok: false, error: { code: "VALIDATION_ERROR", message: issue?.message ?? "Invalid request" } });
+  process.exit(1);
+}
+function makeTagsCommand(command, label, endpoint) {
+  registerSchema({
+    command: `${command}.tags.list`,
+    description: `List the available ${label} tag taxonomy (built-in defaults + this company's custom tags).`,
+    args: OUTPUT_ARG
+  });
+  const listCommand = defineCommand({
+    meta: {
+      name: "list",
+      description: `List the available ${label} tag names (defaults + company custom tags). Use before filtering with --tags. Example: baker ${command} tags`
+    },
+    args: OUTPUT_ARG,
+    run: async ({ args }) => {
+      try {
+        const { markdown } = await apiGet(endpoint);
+        if (args.output === "json") {
+          writeJson({ ok: true, data: { markdown } });
+          return;
+        }
+        process.stdout.write(`${markdown.trimEnd()}
+`);
+      } catch (err) {
+        const code = err instanceof ApiError ? err.code : "INTERNAL_ERROR";
+        const message = err instanceof ApiError ? err.message : "Unexpected error";
+        if (args.output === "json") {
+          writeJson({ ok: false, error: { code, message } });
+        } else {
+          process.stderr.write(`Error: ${message}
+`);
+        }
+        process.exit(1);
+      }
+    }
+  });
+  const createArgs = {
+    name: { type: "positional", description: "Tag name (stored lowercased, spaces \u2192 hyphens)", required: true },
+    description: {
+      type: "string",
+      description: "What the tag means, so it gets applied consistently",
+      required: false
+    }
+  };
+  registerSchema({
+    command: `${command}.tags.create`,
+    description: "Create a custom media tag in the company's shared pool (images, videos and testimonials). Applies immediately. Use when no built-in or custom tag fits.",
+    args: {
+      name: { type: "string", description: "Tag name (stored lowercased, spaces \u2192 hyphens)", required: true },
+      description: createArgs.description
+    }
+  });
+  const createCommand = defineCommand({
+    meta: {
+      name: "create",
+      description: `Create a custom tag (shared by images, videos and testimonials). Applies immediately.
+
+Example: baker ${command} tags create "summer sale" --description "Assets for the summer sale campaign"`
+    },
+    args: createArgs,
+    run: async ({ args }) => {
+      const parsed = mediaTagsCreateRequestSchema.safeParse({
+        name: String(args.name ?? ""),
+        ...args.description ? { description: String(args.description) } : {}
+      });
+      if (!parsed.success) failInvalid(parsed.error.issues[0]);
+      try {
+        const data = await apiPost("/api/media-tags/create", parsed.data);
+        writeJson({
+          ok: true,
+          data,
+          hints: [
+            SHARED_POOL_HINT,
+            `Use it as \`--tags ${data.name}\`.`,
+            ...data.description ? [] : ["MISSING --description: add one with `tags update` so the tag is applied consistently."]
+          ]
+        });
+      } catch (err) {
+        fail(err);
+      }
+    }
+  });
+  registerSchema({
+    command: `${command}.tags.update`,
+    description: "Change what a custom tag means (its description). Built-in tags cannot be changed. Applies immediately.",
+    args: {
+      slug: { type: "string", description: "Custom tag name, as `tags` lists it", required: true },
+      description: { type: "string", description: "New description", required: true }
+    }
+  });
+  const updateCommand = defineCommand({
+    meta: {
+      name: "update",
+      description: `Change a custom tag's description. Built-in tags cannot be changed. Applies immediately.
+
+Example: baker ${command} tags update summer-sale --description "Assets for the 2026 summer sale"`
+    },
+    args: {
+      slug: { type: "positional", description: "Custom tag name, as `tags` lists it", required: true },
+      description: { type: "string", description: "New description", required: true }
+    },
+    run: async ({ args }) => {
+      const parsed = mediaTagsUpdateRequestSchema.safeParse({
+        slug: String(args.slug ?? ""),
+        description: String(args.description ?? "")
+      });
+      if (!parsed.success) failInvalid(parsed.error.issues[0]);
+      try {
+        const data = await apiPost("/api/media-tags/update", parsed.data);
+        writeJson({ ok: true, data, hints: [SHARED_POOL_HINT] });
+      } catch (err) {
+        fail(err);
+      }
+    }
+  });
+  registerSchema({
+    command: `${command}.tags.delete`,
+    description: "Delete a custom tag from the company's shared pool. Built-in tags cannot be deleted. Applies immediately. Confirm with the user first.",
+    args: { slug: { type: "string", description: "Custom tag name, as `tags` lists it", required: true } }
+  });
+  const deleteCommand = defineCommand({
+    meta: {
+      name: "delete",
+      description: `Delete a custom tag (shared by images, videos and testimonials). Built-in tags cannot be deleted. Applies immediately \u2014 confirm with the user first.
+
+Example: baker ${command} tags delete summer-sale`
+    },
+    args: { slug: { type: "positional", description: "Custom tag name, as `tags` lists it", required: true } },
+    run: async ({ args }) => {
+      const parsed = mediaTagsDeleteRequestSchema.safeParse({ slug: String(args.slug ?? "") });
+      if (!parsed.success) failInvalid(parsed.error.issues[0]);
+      try {
+        const data = await apiPost("/api/media-tags/delete", parsed.data);
+        writeJson({ ok: true, data, hints: [SHARED_POOL_HINT] });
+      } catch (err) {
+        fail(err);
+      }
+    }
+  });
+  return defineCommand({
+    meta: {
+      name: "tags",
+      description: `The ${label} tag taxonomy: built-in defaults plus the company's custom tags (one pool shared by images, videos and testimonials). Subcommands: list (default), create, update, delete.
+
+Examples:
+  baker ${command} tags                                   # list available tags
+  baker ${command} tags create "summer sale" --description "\u2026"
+  baker ${command} tags update summer-sale --description "\u2026"
+  baker ${command} tags delete summer-sale`
+    },
+    // Declared on the parent too: `default: "list"` dispatches the bare `tags --output json`
+    // form, and citty reads an undeclared flag's value as a subcommand name.
+    args: OUTPUT_ARG,
+    subCommands: {
+      list: listCommand,
+      create: createCommand,
+      update: updateCommand,
+      delete: deleteCommand
+    },
+    // `default`, never `run`: citty falls through to the parent's `run` after a subcommand.
+    default: "list"
+  });
+}
+
+export {
+  makeTagsCommand
+};
+//# sourceMappingURL=chunk-JQ4PQ2H6.js.map