@koda-sl/baker-cli 0.538.0-dev.fc2958a1d → 0.539.0

package/dist/creatives-ARJMZYXM.js

@@ -0,0 +1,118 @@
+import {
+  META_LIST_SHAPE_ARGS,
+  registerMetaListSchema,
+  shapeMetaListRows,
+  writeMetaListRows
+} from "./chunk-AGEWPMBR.js";
+import {
+  csvOrJson,
+  handleMetaError,
+  resolveAccountIdArg
+} from "./chunk-KDDHMKTU.js";
+import "./chunk-QALAJNBG.js";
+import "./chunk-EAHBTBVR.js";
+import {
+  NO_CACHE_ARG
+} from "./chunk-3PG7O3ZW.js";
+import "./chunk-65Y3RCWP.js";
+import {
+  apiGet
+} from "./chunk-C35UMKYG.js";
+import "./chunk-ELAYD7O3.js";
+import "./chunk-LBIF6FJY.js";
+import "./chunk-TRXGJZDL.js";
+import "./chunk-YQSBHWOI.js";
+
+// src/commands/ads/meta/creatives.ts
+import { defineCommand } from "citty";
+var listArgs = {
+  "account-id": { type: "string", description: "Meta ad account ID (required if no --creative-id)" },
+  "creative-id": {
+    type: "string",
+    description: "One creative ID, or several comma-separated, read in one call: --creative-id 2394\u2026,2395\u2026"
+  },
+  "name-contains": {
+    type: "string",
+    description: "Only creatives whose name contains this text (any case), matched by Baker while it reads the account; --limit counts the matches. Start here to find a creative by name: --name-contains octubre"
+  },
+  limit: { type: "string", description: "Max rows (default 500)" },
+  "no-cache": NO_CACHE_ARG,
+  ...META_LIST_SHAPE_ARGS
+};
+registerMetaListSchema(
+  "creatives",
+  "List ad creatives, or read some by id, as a table by default: id, name, status, object_type, dynamic (the asset feed's optimization_type), body, title, description, link, cta, url_tags, image_hash, video_id, page_id, instagram_user_id, effective_object_story_id. Copy and assets are read from wherever the creative keeps them (top level, object_story_spec, its carousel cards or asset_feed_spec); a dynamic creative's variants and a carousel's cards come back as lists. Per-placement rules and enhancement toggles are --fields (asset_feed_spec.asset_customization_rules, degrees_of_freedom_spec) or --full. Start here: baker ads meta creatives --creative-id 2394\u2026,2395\u2026 --output json.",
+  listArgs
+);
+async function readCreatives(ids, skipCache) {
+  const rows = [];
+  for (const id of ids) {
+    rows.push(
+      await apiGet("/api/ads/meta/creatives", {
+        "creative-id": id,
+        ...skipCache ? { "skip-cache": "true" } : {}
+      })
+    );
+  }
+  return rows;
+}
+var listCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List ad creatives, or read some by ID. Runs by default when no subcommand is given. Example: baker ads meta creatives --creative-id 2394\u2026,2395\u2026"
+  },
+  args: listArgs,
+  run: async ({ args }) => {
+    try {
+      const ids = (args["creative-id"] ?? "").split(",").map((id) => id.trim()).filter(Boolean);
+      let data;
+      if (ids.length > 0) {
+        data = await readCreatives(ids, Boolean(args["no-cache"]));
+      } else {
+        const params = { "account-id": await resolveAccountIdArg(args) };
+        if (args["name-contains"]) params["name-contains"] = args["name-contains"];
+        if (args.limit) params.limit = args.limit;
+        if (args["no-cache"]) params["skip-cache"] = "true";
+        data = await apiGet("/api/ads/meta/creatives", params);
+      }
+      writeMetaListRows("creatives", shapeMetaListRows("creatives", data, args), csvOrJson(args));
+    } catch (err) {
+      handleMetaError(err);
+    }
+  }
+});
+var creativesCommand = defineCommand({
+  meta: {
+    name: "creatives",
+    description: `List ad creatives, fetch one by ID, or stage writes (create/update). Write subcommands stage ops on this chat's draft.
+
+Important: Meta creatives are effectively immutable once attached to an ad. Editing copy/image/CTA = create
+a new creative + repoint the ad (baker ads meta ads update <adId> --creative <ref>).
+
+Reads print a table by default: id, name, status, object_type, dynamic, body, title, description, link, cta,
+url_tags, image_hash, video_id, page_id, instagram_user_id, effective_object_story_id \u2014 read from wherever the
+creative keeps them; a dynamic creative's variants and a carousel's cards come back as lists. --fields (dotted paths) or --full for the rest.
+
+Examples:
+  baker ads meta creatives --account-id act_123 --name-contains octubre   \u2014 find creatives by name
+  baker ads meta creatives --creative-id 23842...,23843... --output json   # read several at once
+  baker ads meta creatives --creative-id 23842... --fields id,asset_feed_spec.asset_customization_rules --output json
+  baker ads meta creatives create --page 555 --message "Save now" --link https://x.com --image-hash abc\u2026 --cta SHOP_NOW`
+  },
+  subCommands: {
+    list: listCommand,
+    create: () => import("./write-commands-TPPJHGMT.js").then((m) => m.adCreativesCreateCommand),
+    update: () => import("./write-commands-TPPJHGMT.js").then((m) => m.adCreativesUpdateCommand),
+    delete: () => import("./asset-writes-ZMSJSFTD.js").then((m) => m.creativesDeleteCommand)
+  },
+  // `args` stays even though the parent has no `run`: citty scans rawArgs for the
+  // subcommand name using THIS command's arg defs, so without them `--account-id act_1`
+  // would read `act_1` as a subcommand. `default` (not `run`) dispatches the bare
+  // invocation — citty falls through to `run` after a subcommand, double-executing it.
+  args: listArgs,
+  default: "list"
+});
+export {
+  creativesCommand
+};
+//# sourceMappingURL=creatives-ARJMZYXM.js.map

package/dist/creatives-ARJMZYXM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ads/meta/creatives.ts"],"sourcesContent":["import { defineCommand } from \"citty\";\nimport { NO_CACHE_ARG } from \"../../../cache-flag.ts\";\nimport { apiGet } from \"../../../client.ts\";\nimport { META_LIST_SHAPE_ARGS, registerMetaListSchema, shapeMetaListRows, writeMetaListRows } from \"./list-rows.ts\";\nimport { csvOrJson, handleMetaError, resolveAccountIdArg } from \"./shared.ts\";\n\nconst listArgs = {\n  \"account-id\": { type: \"string\", description: \"Meta ad account ID (required if no --creative-id)\" },\n  \"creative-id\": {\n    type: \"string\",\n    description: \"One creative ID, or several comma-separated, read in one call: --creative-id 2394…,2395…\",\n  },\n  \"name-contains\": {\n    type: \"string\",\n    description:\n      \"Only creatives whose name contains this text (any case), matched by Baker while it reads the account; --limit counts the matches. Start here to find a creative by name: --name-contains octubre\",\n  },\n  limit: { type: \"string\", description: \"Max rows (default 500)\" },\n  \"no-cache\": NO_CACHE_ARG,\n  ...META_LIST_SHAPE_ARGS,\n} as const;\n\nregisterMetaListSchema(\n  \"creatives\",\n  \"List ad creatives, or read some by id, as a table by default: id, name, status, object_type, dynamic (the asset feed's optimization_type), body, title, description, link, cta, url_tags, image_hash, video_id, page_id, instagram_user_id, effective_object_story_id. Copy and assets are read from wherever the creative keeps them (top level, object_story_spec, its carousel cards or asset_feed_spec); a dynamic creative's variants and a carousel's cards come back as lists. Per-placement rules and enhancement toggles are --fields (asset_feed_spec.asset_customization_rules, degrees_of_freedom_spec) or --full. Start here: baker ads meta creatives --creative-id 2394…,2395… --output json.\",\n  listArgs,\n);\n\n/**\n * Each id is its own scope-checked, cached read, so several ids cost one call of the agent's, not one each.\n * They run one after another: the company's request budget (a burst of 4, then 2 a second) refuses a\n * parallel batch past ~10 ids, and the client's retries then wait each refused read back in turn.\n */\nasync function readCreatives(ids: string[], skipCache: boolean): Promise<Array<Record<string, unknown>>> {\n  const rows: Array<Record<string, unknown>> = [];\n  for (const id of ids) {\n    rows.push(\n      await apiGet<Record<string, unknown>>(\"/api/ads/meta/creatives\", {\n        \"creative-id\": id,\n        ...(skipCache ? { \"skip-cache\": \"true\" } : {}),\n      }),\n    );\n  }\n  return rows;\n}\n\nconst listCommand = defineCommand({\n  meta: {\n    name: \"list\",\n    description:\n      \"List ad creatives, or read some by ID. Runs by default when no subcommand is given. Example: baker ads meta creatives --creative-id 2394…,2395…\",\n  },\n  args: listArgs,\n  run: async ({ args }) => {\n    try {\n      const ids = ((args[\"creative-id\"] as string | undefined) ?? \"\")\n        .split(\",\")\n        .map((id) => id.trim())\n        .filter(Boolean);\n      let data: Array<Record<string, unknown>>;\n      if (ids.length > 0) {\n        data = await readCreatives(ids, Boolean(args[\"no-cache\"]));\n      } else {\n        const params: Record<string, string> = { \"account-id\": await resolveAccountIdArg(args) };\n        if (args[\"name-contains\"]) params[\"name-contains\"] = args[\"name-contains\"] as string;\n        if (args.limit) params.limit = args.limit as string;\n        if (args[\"no-cache\"]) params[\"skip-cache\"] = \"true\";\n        data = await apiGet<Array<Record<string, unknown>>>(\"/api/ads/meta/creatives\", params);\n      }\n      writeMetaListRows(\"creatives\", shapeMetaListRows(\"creatives\", data, args), csvOrJson(args));\n    } catch (err) {\n      handleMetaError(err);\n    }\n  },\n});\n\nexport const creativesCommand = defineCommand({\n  meta: {\n    name: \"creatives\",\n    description: `List ad creatives, fetch one by ID, or stage writes (create/update). Write subcommands stage ops on this chat's draft.\n\nImportant: Meta creatives are effectively immutable once attached to an ad. Editing copy/image/CTA = create\na new creative + repoint the ad (baker ads meta ads update <adId> --creative <ref>).\n\nReads print a table by default: id, name, status, object_type, dynamic, body, title, description, link, cta,\nurl_tags, image_hash, video_id, page_id, instagram_user_id, effective_object_story_id — read from wherever the\ncreative keeps them; a dynamic creative's variants and a carousel's cards come back as lists. --fields (dotted paths) or --full for the rest.\n\nExamples:\n  baker ads meta creatives --account-id act_123 --name-contains octubre   — find creatives by name\n  baker ads meta creatives --creative-id 23842...,23843... --output json   # read several at once\n  baker ads meta creatives --creative-id 23842... --fields id,asset_feed_spec.asset_customization_rules --output json\n  baker ads meta creatives create --page 555 --message \"Save now\" --link https://x.com --image-hash abc… --cta SHOP_NOW`,\n  },\n  subCommands: {\n    list: listCommand,\n    create: () => import(\"./write-commands.ts\").then((m) => m.adCreativesCreateCommand),\n    update: () => import(\"./write-commands.ts\").then((m) => m.adCreativesUpdateCommand),\n    delete: () => import(\"./asset-writes.ts\").then((m) => m.creativesDeleteCommand),\n  },\n  // `args` stays even though the parent has no `run`: citty scans rawArgs for the\n  // subcommand name using THIS command's arg defs, so without them `--account-id act_1`\n  // would read `act_1` as a subcommand. `default` (not `run`) dispatches the bare\n  // invocation — citty falls through to `run` after a subcommand, double-executing it.\n  args: listArgs,\n  default: \"list\",\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAM9B,IAAM,WAAW;AAAA,EACf,cAAc,EAAE,MAAM,UAAU,aAAa,oDAAoD;AAAA,EACjG,eAAe;AAAA,IACb,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,aACE;AAAA,EACJ;AAAA,EACA,OAAO,EAAE,MAAM,UAAU,aAAa,yBAAyB;AAAA,EAC/D,YAAY;AAAA,EACZ,GAAG;AACL;AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AACF;AAOA,eAAe,cAAc,KAAe,WAA6D;AACvG,QAAM,OAAuC,CAAC;AAC9C,aAAW,MAAM,KAAK;AACpB,SAAK;AAAA,MACH,MAAM,OAAgC,2BAA2B;AAAA,QAC/D,eAAe;AAAA,QACf,GAAI,YAAY,EAAE,cAAc,OAAO,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,cAAc,cAAc;AAAA,EAChC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,EACN,KAAK,OAAO,EAAE,KAAK,MAAM;AACvB,QAAI;AACF,YAAM,OAAQ,KAAK,aAAa,KAA4B,IACzD,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AACjB,UAAI;AACJ,UAAI,IAAI,SAAS,GAAG;AAClB,eAAO,MAAM,cAAc,KAAK,QAAQ,KAAK,UAAU,CAAC,CAAC;AAAA,MAC3D,OAAO;AACL,cAAM,SAAiC,EAAE,cAAc,MAAM,oBAAoB,IAAI,EAAE;AACvF,YAAI,KAAK,eAAe,EAAG,QAAO,eAAe,IAAI,KAAK,eAAe;AACzE,YAAI,KAAK,MAAO,QAAO,QAAQ,KAAK;AACpC,YAAI,KAAK,UAAU,EAAG,QAAO,YAAY,IAAI;AAC7C,eAAO,MAAM,OAAuC,2BAA2B,MAAM;AAAA,MACvF;AACA,wBAAkB,aAAa,kBAAkB,aAAa,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC;AAAA,IAC5F,SAAS,KAAK;AACZ,sBAAgB,GAAG;AAAA,IACrB;AAAA,EACF;AACF,CAAC;AAEM,IAAM,mBAAmB,cAAc;AAAA,EAC5C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcf;AAAA,EACA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,QAAQ,MAAM,OAAO,8BAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,wBAAwB;AAAA,IAClF,QAAQ,MAAM,OAAO,8BAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,wBAAwB;AAAA,IAClF,QAAQ,MAAM,OAAO,4BAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,sBAAsB;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM;AAAA,EACN,SAAS;AACX,CAAC;","names":[]}

package/dist/creatives-HUDKBUDS.js

@@ -0,0 +1,58 @@
+import "./chunk-YQSBHWOI.js";
+
+// src/commands/creatives/index.ts
+import { defineCommand } from "citty";
+var creativesCommand = defineCommand({
+  meta: {
+    name: "creatives",
+    description: `Make ads from what customers said, read and record what the user thinks of each version, and save the approved ones.
+
+Making ads, in order:
+  baker creatives brief                 # one read: who sees the ads, what works, taste, customer quotes, ideas on file
+  baker creatives ideas                 # check and rank the ideas in src/creatives/_ideas/
+  baker creatives make <idea>           # one idea \u2192 one creative (reference picked and checked for you)
+  baker creatives translate --slug <ad> --to es-MX,pt-BR   # the same ad in other languages, one design
+  baker creatives learn                 # what each idea's ads did, written back onto the idea
+
+Before making or changing a creative, read the company's taste:
+  baker creatives feedback [--slug <slug>]
+
+The company's standing rules for every ad (BRAND.md's and the ones a person taught):
+  baker creatives rules list
+  baker creatives rules add --candidate <rc-\u2026>   # only after the person agreed it is a rule for every ad
+  baker creatives check                 # after a rule changes: which ads already made break it
+
+When the user reacts to a version in the chat (likes it, rejects it, asks for changes), record it:
+  baker creatives feedback record --slug <slug> --run <r_\u2026> --verdict approved|rejected [--reasons a,b] [--note "<their words>"]
+
+When they pick a version (or options inside it) to keep:
+  baker creatives select --slug <slug> --run <r_\u2026> [--options <label,\u2026>]
+
+Creative handoff:
+  baker creatives publish --title "Spring Offer Static Ad" --slug <slug> --run-id <r_\u2026> [--output 4:5]
+  baker creatives publish ./canvas/run/final.mp4 --title "Spring Offer Reel" --slug spring-offer --run-id <r_\u2026>
+
+Publishing an image uploads it to the Company image library, applies the official creative tag, and returns an image reference for chat previews. Publishing a video uploads it to the video library, waits until it plays, saves it on the creative (--slug required) and returns a video reference.
+
+How published creatives are doing in live Meta ads (results, fatigue, angle; hook and hold rate for videos):
+  baker creatives performance [--slug <slug>] [--days 30] [--full]
+Full guide: __tooling__/docs/tools/baker/creatives.md`
+  },
+  subCommands: {
+    brief: () => import("./brief-NMACLLA2.js").then((m) => m.briefCommand),
+    ideas: () => import("./ideas-RVK4RNKN.js").then((m) => m.ideasCommand),
+    make: () => import("./make-VCAS2M2W.js").then((m) => m.makeCommand),
+    translate: () => import("./translate-YGUYVOGA.js").then((m) => m.translateCommand),
+    learn: () => import("./learn-4LGNFGWH.js").then((m) => m.learnCommand),
+    feedback: () => import("./feedback-WPV2RKJS.js").then((m) => m.feedbackCommand),
+    rules: () => import("./rules-4ENXG5XW.js").then((m) => m.rulesCommand),
+    check: () => import("./check-RRHOCY2U.js").then((m) => m.checkCommand),
+    select: () => import("./select-WVNPJDXP.js").then((m) => m.selectCommand),
+    publish: () => import("./publish-Q4W7MI7P.js").then((m) => m.publishCommand),
+    performance: () => import("./performance-C4M3GJPC.js").then((m) => m.performanceCommand)
+  }
+});
+export {
+  creativesCommand
+};
+//# sourceMappingURL=creatives-HUDKBUDS.js.map

package/dist/credentials-WCD4F225.js

@@ -0,0 +1,290 @@
+import {
+  repeatedValues
+} from "./chunk-ERSX3MKH.js";
+import {
+  failApi,
+  failValidation
+} from "./chunk-THV7SMY6.js";
+import "./chunk-3LH5ANM4.js";
+import "./chunk-QV6AST5T.js";
+import "./chunk-WCU362Z6.js";
+import "./chunk-GIWHHCD6.js";
+import "./chunk-SOPVIIUW.js";
+import "./chunk-G4FG5EQO.js";
+import "./chunk-NSBNIPIW.js";
+import {
+  getPublicSuffix,
+  parse
+} from "./chunk-TI4UL56R.js";
+import {
+  apiPost
+} from "./chunk-C35UMKYG.js";
+import "./chunk-ELAYD7O3.js";
+import "./chunk-LBIF6FJY.js";
+import {
+  registerSchema,
+  writeJson
+} from "./chunk-TRXGJZDL.js";
+import "./chunk-YQSBHWOI.js";
+
+// ../api/src/credentials/contract.ts
+import { z } from "zod";
+
+// ../api/src/credentials/hosts.ts
+function normaliseHost(host) {
+  return host.trim().toLowerCase().replace(/\.$/, "");
+}
+function asciiHost(host) {
+  if (!/[\u0080-\u{10FFFF}]/u.test(host) || /[/?#@:\\%[\]\s]/.test(host)) return host;
+  const url = `http://${host}`;
+  return URL.canParse(url) ? new URL(url).hostname : host;
+}
+function validateHostPattern(raw) {
+  const typed = normaliseHost(raw);
+  const wildcard = typed.startsWith("*.");
+  const host = asciiHost(wildcard ? typed.slice(2) : typed);
+  const pattern = wildcard ? `*.${host}` : host;
+  if (host === "" || host.includes("*")) {
+    return { ok: false, reason: "Use a website address like api.example.com or *.example.com." };
+  }
+  const parsed = parse(host);
+  if (parsed.isIp || host.startsWith("[")) {
+    return { ok: false, reason: "Use a website address, not an IP address." };
+  }
+  if (parsed.hostname !== host || parsed.domain === null) {
+    return { ok: false, reason: "Use only the website address, like api.example.com." };
+  }
+  if (wildcard && !wildcardSafe(host)) {
+    return { ok: false, reason: `*.${host} would allow any website. Name the company's own address.` };
+  }
+  return { ok: true, pattern };
+}
+var OPEN_HOSTING_DOMAINS = ["amazonaws.com", "cloudfront.net", "googleapis.com", "on.aws"];
+var WITH_PRIVATE = { allowPrivateDomains: true };
+function wildcardSafe(host) {
+  if (OPEN_HOSTING_DOMAINS.some((domain) => host === domain || host.endsWith(`.${domain}`))) return false;
+  const suffix = getPublicSuffix(host, WITH_PRIVATE);
+  return suffix !== host && getPublicSuffix(`zz.${host}`, WITH_PRIVATE) === suffix;
+}
+
+// ../api/src/credentials/placeholder.ts
+var CREDENTIAL_NAME_PATTERN = "[a-z0-9][a-z0-9_-]{0,63}";
+var CREDENTIAL_NAME_RE = new RegExp(`^${CREDENTIAL_NAME_PATTERN}$`);
+var PLACEHOLDER_SOURCE = `\\{\\{credential:(${CREDENTIAL_NAME_PATTERN})\\}\\}`;
+var WHOLE_PLACEHOLDER_RE = new RegExp(`^${PLACEHOLDER_SOURCE}$`);
+
+// ../api/src/credentials/contract.ts
+var MAX_CREDENTIAL_VALUE_LENGTH = 16384;
+var MAX_CREDENTIAL_HOSTS = 20;
+var credentialNameSchema = z.string().regex(new RegExp(`^${CREDENTIAL_NAME_PATTERN}$`), "Use lowercase letters, digits, - and _ (max 64).");
+var credentialHostsSchema = z.array(z.string()).max(MAX_CREDENTIAL_HOSTS).transform((hosts, ctx) => {
+  const patterns = [];
+  for (const host of hosts) {
+    const result = validateHostPattern(host);
+    if (result.ok) patterns.push(result.pattern);
+    else ctx.addIssue({ code: "custom", message: `${host}: ${result.reason}` });
+  }
+  return [...new Set(patterns)];
+});
+var credentialSourceSchema = z.enum(["user", "agent", "chat-detected", "requested"]);
+var credentialSummarySchema = z.object({
+  name: z.string(),
+  label: z.string(),
+  placeholder: z.string(),
+  allowedHosts: z.array(z.string()),
+  source: credentialSourceSchema,
+  lastUsedAt: z.number().nullable()
+});
+var credentialsListResponseSchema = z.object({ credentials: z.array(credentialSummarySchema) });
+var credentialsPutRequestSchema = z.object({
+  name: credentialNameSchema,
+  label: z.string().trim().min(1).max(80).optional(),
+  value: z.string().min(1).max(MAX_CREDENTIAL_VALUE_LENGTH),
+  allowedHosts: credentialHostsSchema
+});
+var credentialsPutResponseSchema = z.object({
+  name: z.string(),
+  placeholder: z.string(),
+  replaced: z.boolean()
+});
+var credentialsDeleteRequestSchema = z.object({ name: credentialNameSchema });
+var credentialsDeleteResponseSchema = z.object({ name: z.string(), deleted: z.literal(true) });
+var brokerResolveResponseSchema = z.object({
+  credentials: z.array(z.object({ name: z.string(), value: z.string(), allowedHosts: z.array(z.string()) }))
+});
+var brokerUsageRequestSchema = z.object({
+  uses: z.array(z.object({ name: credentialNameSchema, host: z.string().max(253) })).max(100)
+});
+
+// src/commands/credentials/index.ts
+import { defineCommand } from "citty";
+var DOC = "__tooling__/docs/tools/baker/credentials.md";
+var STDIN_ONLY = 'The value is read from stdin only, never from the command line (argv is visible to other processes and lands in logs). Pipe it: printf %s "$VALUE" | baker credentials put <name> --host <host>. For a credential the user owns, call request_credential instead.';
+registerSchema({
+  command: "credentials.list",
+  description: "Start here: the credentials (API keys, tokens, passwords) this company stored, by name \u2014 never their values. Write the `placeholder` ({{credential:NAME}}) into an HTTPS request (curl header, URL, SDK config, JSON body) and the sandbox proxy sends the real value, only to the credential's allowedHosts. Nothing listed? Ask the user with the request_credential tool. Compact by default; --full adds source and lastUsedAt.",
+  args: {
+    full: { type: "boolean", description: "Add source and lastUsedAt per credential", required: false, default: false }
+  }
+});
+registerSchema({
+  command: "credentials.put",
+  description: `Store a credential YOU created on the user's behalf (e.g. a key you just generated through an API), so later requests can use {{credential:NAME}}. Example: printf %s "$KEY" | baker credentials put stripe-key --host api.stripe.com --label "Stripe key". The value comes from stdin ONLY. For a credential the user owns, call request_credential instead \u2014 never ask for it in chat. Replacing is allowed only for credentials the agent created.`,
+  args: {
+    name: { type: "positional", description: "Lowercase name: letters, digits, - and _ (max 64)", required: true },
+    host: {
+      type: "string",
+      description: "Website the value may be sent to (repeatable, or comma-separated): api.stripe.com, acme-store.myshopify.com",
+      required: true
+    },
+    label: { type: "string", description: "Human-readable label shown in Settings \u2192 Credentials", required: false }
+  }
+});
+registerSchema({
+  command: "credentials.delete",
+  description: "Delete a credential the agent created (e.g. a key it rotated out). Credentials the user added can only be removed by the user, in Settings \u2192 Credentials.",
+  args: {
+    name: { type: "positional", description: "Credential name", required: true }
+  }
+});
+async function readPipedValue() {
+  const stdin = process.stdin;
+  if (stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+function parseName(raw) {
+  const parsed = credentialNameSchema.safeParse(raw);
+  if (!parsed.success) {
+    failValidation(`Invalid credential name "${String(raw)}": use lowercase letters, digits, - and _ (max 64).`);
+  }
+  return parsed.data;
+}
+function parseHosts(rawArgs, parsed) {
+  const hosts = repeatedValues(rawArgs, "host", parsed).flatMap((value) => value.split(",")).map((host) => host.trim()).filter((host) => host !== "");
+  if (hosts.length === 0) {
+    failValidation("Name at least one website the value may be sent to: --host api.example.com (repeatable).");
+  }
+  const result = credentialHostsSchema.safeParse(hosts);
+  if (!result.success) {
+    failValidation(`Invalid --host: ${result.error.issues.map((issue) => issue.message).join("; ")}`);
+  }
+  return result.data;
+}
+var listCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "Start here: stored credentials by name with their {{credential:NAME}} placeholder and allowed websites. Never shows values."
+  },
+  args: {
+    full: { type: "boolean", description: "Add source and lastUsedAt", required: false, default: false }
+  },
+  run: async ({ args }) => {
+    try {
+      const response = await apiPost("/api/credentials/list", {});
+      const credentials = response.data.credentials.map(
+        (credential) => args.full ? credential : {
+          name: credential.name,
+          placeholder: credential.placeholder,
+          allowedHosts: credential.allowedHosts,
+          label: credential.label
+        }
+      );
+      writeJson({
+        ok: true,
+        data: { credentials },
+        meta: { count: credentials.length },
+        ...credentials.length === 0 ? {
+          hints: [
+            "No credentials stored. When the task needs one the user owns, call the request_credential tool (label, reason, allowedHosts) \u2014 never ask them to paste it in chat."
+          ]
+        } : {}
+      });
+    } catch (err) {
+      failApi(err);
+    }
+  }
+});
+var putCommand = defineCommand({
+  meta: {
+    name: "put",
+    description: `Store a credential you created on the user's behalf; the value is read from stdin only.
+Start here: printf %s "$KEY" | baker credentials put stripe-key --host api.stripe.com
+For a credential the user owns, call request_credential instead.`
+  },
+  args: {
+    name: { type: "positional", description: "Lowercase name: letters, digits, - and _ (max 64)", required: true },
+    host: {
+      type: "string",
+      description: "Website the value may be sent to (repeatable, or comma-separated)",
+      required: false
+    },
+    label: { type: "string", description: "Label shown in Settings \u2192 Credentials", required: false },
+    value: {
+      type: "string",
+      description: "Refused \u2014 never put a value on the command line. Pipe it on stdin.",
+      required: false
+    }
+  },
+  run: async ({ args, rawArgs }) => {
+    if (args.value !== void 0 || args._.length > 1) {
+      failValidation(STDIN_ONLY);
+    }
+    const name = parseName(args.name);
+    const allowedHosts = parseHosts(rawArgs, args.host);
+    const value = await readPipedValue();
+    if (value === "") {
+      failValidation(`Nothing was piped on stdin. ${STDIN_ONLY}`);
+    }
+    if (value.length > MAX_CREDENTIAL_VALUE_LENGTH) {
+      failValidation(`The value is longer than ${MAX_CREDENTIAL_VALUE_LENGTH} characters.`);
+    }
+    const body = { name, value, allowedHosts, ...args.label ? { label: args.label } : {} };
+    try {
+      const response = await apiPost("/api/credentials/put", body);
+      writeJson({
+        ok: true,
+        data: { name: response.data.name, placeholder: response.data.placeholder },
+        hints: [
+          `Use ${response.data.placeholder} in the request; the value is sent only to: ${allowedHosts.join(", ")}.`,
+          "Never echo, print or write the value anywhere \u2014 unset the shell variable that held it."
+        ]
+      });
+    } catch (err) {
+      failApi(err);
+    }
+  }
+});
+var deleteCommand = defineCommand({
+  meta: {
+    name: "delete",
+    description: "Delete a credential the agent created. User-added credentials are removed by the user in Settings \u2192 Credentials."
+  },
+  args: {
+    name: { type: "positional", description: "Credential name", required: true }
+  },
+  run: async ({ args }) => {
+    const name = parseName(args.name);
+    try {
+      const response = await apiPost("/api/credentials/delete", { name });
+      writeJson({ ok: true, data: response.data });
+    } catch (err) {
+      failApi(err);
+    }
+  }
+});
+var credentialsCommand = defineCommand({
+  meta: {
+    name: "credentials",
+    description: `Credentials (API keys, tokens, passwords) by name: write {{credential:NAME}} in an HTTPS request and the value is sent only to the websites it is bound to. You never see values.
+Full guide: ${DOC}`
+  },
+  subCommands: { list: listCommand, put: putCommand, delete: deleteCommand }
+});
+export {
+  credentialsCommand
+};
+//# sourceMappingURL=credentials-WCD4F225.js.map