@koda-sl/baker-cli 0.553.0 → 0.555.0

package/dist/chunk-X6U3B6YK.js

@@ -0,0 +1,343 @@
+import {
+  captureProxyCredentials,
+  isChallengeBody,
+  isPrivateAddress,
+  isProxyFailure,
+  nextPlannedRoute,
+  plannedRoutes,
+  refuseNonPublicUrl,
+  shouldEscalate
+} from "./chunk-45D6WRCJ.js";
+
+// ../proxy/src/fetch.ts
+import { lookup as dnsLookup } from "dns";
+import { Agent, ProxyAgent, Response, fetch as undiciFetch } from "undici";
+
+// ../proxy/src/fetchDecision.ts
+function classifyFetchOutcome(signal) {
+  if (isProxyFailure(signal)) return "proxy_unavailable";
+  if (shouldEscalate(signal)) return "blocked";
+  if (signal.status != null && signal.status >= 200 && signal.status < 400 && !signal.challenge) return "ok";
+  return "failed";
+}
+function shouldTryNextRoute(outcome) {
+  return outcome === "blocked" || outcome === "proxy_unavailable";
+}
+var TIMEOUT_CODES = /* @__PURE__ */ new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "ETIMEDOUT"
+]);
+var RESET_CODES = /* @__PURE__ */ new Set(["ECONNRESET", "UND_ERR_SOCKET", "EPIPE"]);
+var PROXY_RESPONSE = /Proxy response \((\d+)\)/;
+function errorCode(error) {
+  if (typeof error !== "object" || error === null) return null;
+  const code = error.code;
+  if (typeof code === "string") return code;
+  const name = error.name;
+  return typeof name === "string" ? name : null;
+}
+function errorMessage(error) {
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    if (typeof message === "string") return message;
+  }
+  return String(error);
+}
+function errorBlockSignal(error, proxied) {
+  const proxyResponse = PROXY_RESPONSE.exec(errorMessage(error));
+  if (proxyResponse) {
+    const status = Number(proxyResponse[1]);
+    return status === 407 ? { status: 407 } : { netError: "ERR_TUNNEL_CONNECTION_FAILED" };
+  }
+  const code = errorCode(error);
+  if (code !== null && TIMEOUT_CODES.has(code)) return { timedOut: true };
+  if (code === "AbortError" || code === "TimeoutError") return { timedOut: true };
+  if (proxied) {
+    return { netError: "ERR_PROXY_CONNECTION_FAILED" };
+  }
+  if (code !== null && RESET_CODES.has(code)) return { netError: "ERR_CONNECTION_RESET" };
+  return { netError: code ?? "ERR_FAILED" };
+}
+function shouldSniffChallenge(contentType, contentLength, maxSniffBytes) {
+  if (contentLength !== null && contentLength > maxSniffBytes) return false;
+  if (contentType === null || contentType.trim() === "") return true;
+  const type = contentType.toLowerCase();
+  if (type.startsWith("image/") || type.startsWith("video/") || type.startsWith("audio/")) return false;
+  return type.includes("text/") || type.includes("html") || type.includes("json") || type.includes("xml");
+}
+
+// ../proxy/src/fetch.ts
+var DEFAULT_TIMEOUT_MS = 6e4;
+var MAX_SNIFF_BYTES = 64 * 1024;
+function tierOf(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function agentFor(route) {
+  if (route.kind !== "proxy") return directAgent();
+  const token = Buffer.from(`${route.username}:${route.password}`).toString("base64");
+  return new ProxyAgent({ uri: route.server, token: `Basic ${token}` });
+}
+function directAgent() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, callback) => {
+        dnsLookup(hostname, options, (error, address, family) => {
+          if (error) {
+            callback(error, address, family);
+            return;
+          }
+          const found = Array.isArray(address) ? address.map((entry) => entry.address) : [address];
+          const blocked = found.find((entry) => isPrivateAddress(entry));
+          if (blocked !== void 0) {
+            callback(new Error(`${PRIVATE_ADDRESS_CODE}: ${hostname} resolves to ${blocked}`), "", 4);
+            return;
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+var PRIVATE_ADDRESS_CODE = "EPRIVATEADDR";
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function refuseRedirect(entry, to) {
+  if (refuseNonPublicUrl(to) === null) return false;
+  const destination = originOf(to);
+  return destination === null || destination !== originOf(entry);
+}
+async function followRedirects(url, init) {
+  let current = url;
+  let request = { ...init, redirect: "manual" };
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await undiciFetch(current, request);
+    const location = response.headers.get("location");
+    if (!REDIRECT_STATUS.has(response.status) || location === null) return response;
+    await response.body?.cancel();
+    const next = new URL(location, current).toString();
+    if (refuseRedirect(url, next)) {
+      throw new Error(`${PRIVATE_ADDRESS_CODE}: redirected to ${next}`);
+    }
+    const method = (request.method ?? "GET").toUpperCase();
+    const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST";
+    request = downgrade ? { ...request, method: "GET", body: void 0 } : request;
+    current = next;
+  }
+  throw new Error(`too many redirects following ${url}`);
+}
+var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function rebuild(response, body) {
+  if (response.status < 200 || response.status > 599 || NULL_BODY_STATUS.has(response.status)) {
+    return new Response(null, { status: response.status, headers: response.headers });
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function declaredLength(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function readOnce(response, sniff, maxBytes) {
+  const declared = declaredLength(response);
+  if (maxBytes !== void 0 && declared !== null && declared > maxBytes) {
+    await response.body?.cancel();
+    return { response: rebuild(response, new ArrayBuffer(0)), challenge: false };
+  }
+  const body = await response.arrayBuffer();
+  const wantsSniff = sniff && shouldSniffChallenge(response.headers.get("content-type"), body.byteLength, MAX_SNIFF_BYTES);
+  const challenge = wantsSniff ? isChallengeBody(new TextDecoder().decode(body)) : false;
+  return { response: rebuild(response, body), challenge };
+}
+async function attemptRoute(url, init, route, options) {
+  const tier = tierOf(route);
+  const agent = agentFor(route);
+  const startedAt = Date.now();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+  try {
+    const raw = await followRedirects(url, { ...init, dispatcher: agent ?? void 0, signal });
+    const read = await readOnce(raw, options.sniffChallenge ?? true, options.maxBytes);
+    const outcome = classifyFetchOutcome({ status: raw.status, challenge: read.challenge });
+    return {
+      attempt: { tier, status: raw.status, ms: Date.now() - startedAt, outcome },
+      response: outcome === "proxy_unavailable" ? null : read.response
+    };
+  } catch (error) {
+    const blockSignal = errorBlockSignal(error, route.kind === "proxy");
+    return {
+      attempt: {
+        tier,
+        status: blockSignal.status ?? void 0,
+        ms: Date.now() - startedAt,
+        outcome: classifyFetchOutcome(blockSignal)
+      },
+      response: null,
+      error
+    };
+  } finally {
+    await agent?.close();
+  }
+}
+async function fetchWithEscalation(url, init, options) {
+  const attempts = [];
+  let originResponse = null;
+  let originTier = "direct";
+  let lastError;
+  const routes = plannedRoutes(url, options.credentials, options.routeOptions);
+  const tried = [];
+  for (let route = routes[0] ?? null; route !== null; route = nextPlannedRoute(routes, tried)) {
+    const rung = await attemptRoute(url, init, route, options);
+    attempts.push(rung.attempt);
+    tried.push({ tier: rung.attempt.tier, proxyFailure: rung.attempt.outcome === "proxy_unavailable" });
+    if (rung.response !== null) {
+      originResponse = rung.response;
+      originTier = rung.attempt.tier;
+    }
+    if (rung.error !== void 0) lastError = rung.error;
+    if (!shouldTryNextRoute(rung.attempt.outcome)) break;
+  }
+  return {
+    response: originResponse,
+    attempts,
+    finalTier: originResponse !== null ? originTier : lastAttempt(attempts)?.tier ?? "direct",
+    ...originResponse === null && lastError !== void 0 ? { error: lastError } : {}
+  };
+}
+function lastAttempt(attempts) {
+  return attempts[attempts.length - 1];
+}
+function describeLadder(result) {
+  const rungs = result.attempts.map((a) => `${a.tier}:${a.outcome}${a.status ? `(${a.status})` : ""}@${a.ms}ms`);
+  return `${rungs.join(" \u2192 ")} | final=${result.finalTier}`;
+}
+function rescued(result) {
+  return result.attempts.some((attempt) => attempt.outcome === "ok");
+}
+function endedBlocked(result) {
+  if (rescued(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "blocked");
+}
+function endedProxyUnavailable(result) {
+  if (rescued(result) || endedBlocked(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "proxy_unavailable");
+}
+function endedPrivateAddress(result) {
+  if (rescued(result)) return false;
+  for (let error = result.error, depth = 0; error instanceof Error && depth < 5; depth++) {
+    if (error.message.includes(PRIVATE_ADDRESS_CODE)) return true;
+    error = error.cause;
+  }
+  return false;
+}
+
+// src/lib/externalFetch.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
+  Accept: "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+  "Accept-Language": "en-US,en;q=0.9"
+};
+var NOT_PUBLIC_MESSAGE = "That address is not reachable from the public web, so there is nothing to read.";
+var NO_ANSWER_MESSAGE = "That address did not answer.";
+var MAX_REMOTE_IMAGE_BYTES = 25e6;
+var ExternalFetchError = class extends Error {
+  /** True when the fault was ours — a route we could not open, not a dead host. */
+  ourFault;
+  /** The HTTP status the host answered with, when it answered at all. */
+  status;
+  constructor(message, ourFault, status = null) {
+    super(message);
+    this.name = "ExternalFetchError";
+    this.ourFault = ourFault;
+    this.status = status;
+  }
+};
+var OversizeFetchError = class extends ExternalFetchError {
+  constructor(message) {
+    super(message, false);
+    this.name = "OversizeFetchError";
+  }
+};
+async function fetchExternal(url, options = {}) {
+  if (refuseNonPublicUrl(url) !== null) {
+    throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+  }
+  const result = await fetchWithEscalation(
+    url,
+    { headers: { ...BROWSER_HEADERS, ...options.headers } },
+    {
+      credentials: captureProxyCredentials(),
+      ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+      ...options.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes },
+      ...options.sniffChallenge === void 0 ? {} : { sniffChallenge: options.sniffChallenge }
+    }
+  );
+  if (result.attempts.length > 1) {
+    process.stderr.write(`fetch ladder ${url} \u2014 ${describeLadder(result)}
+`);
+  }
+  if (result.response === null) {
+    if (endedPrivateAddress(result)) {
+      throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+    }
+    const ourFault = endedProxyUnavailable(result);
+    throw new ExternalFetchError(ourFault ? "Could not open a route to that address." : NO_ANSWER_MESSAGE, ourFault);
+  }
+  return { response: result.response, blocked: endedBlocked(result) };
+}
+function refuseOversize(bytes, maxBytes) {
+  if (bytes === null || bytes <= maxBytes) return null;
+  return `That file is ${humanBytes(bytes)} \u2014 the limit is ${humanBytes(maxBytes)}.`;
+}
+function humanBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.max(1, Math.round(n / 1024))} KB`;
+}
+function declaredBytes(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function fetchExternalBytes(url, options) {
+  const { response, blocked } = await fetchExternal(url, options);
+  if (!response.ok) {
+    throw new ExternalFetchError(`${response.status} ${response.statusText}`, false, response.status);
+  }
+  if (blocked) {
+    throw new ExternalFetchError("That host served a security check instead of the file.", false);
+  }
+  const declared = refuseOversize(declaredBytes(response), options.maxBytes);
+  if (declared !== null) {
+    throw new OversizeFetchError(declared);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const actual = refuseOversize(buffer.byteLength, options.maxBytes);
+  if (actual !== null) {
+    throw new OversizeFetchError(actual);
+  }
+  return { buffer, contentType: response.headers.get("content-type") };
+}
+
+export {
+  NO_ANSWER_MESSAGE,
+  MAX_REMOTE_IMAGE_BYTES,
+  ExternalFetchError,
+  OversizeFetchError,
+  fetchExternalBytes
+};
+//# sourceMappingURL=chunk-X6U3B6YK.js.map

package/dist/chunk-X6U3B6YK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../proxy/src/fetch.ts","../../proxy/src/fetchDecision.ts","../src/lib/externalFetch.ts"],"sourcesContent":["/**\n * `fetch()` that climbs the ladder when — and only when — it is refused.\n *\n * This is the `undici` half of the pair; `preflight.ts` is the Playwright half's\n * safety net. It is a **subpath export** and is deliberately NOT re-exported\n * from `src/index.ts`, for the same reason `./preflight` is not: the barrel is\n * reachable from Convex's V8 runtime through `lib/env.ts`, and `undici` pulls in\n * Node built-ins that fail that bundle outright. Only a `\"use node\"` module may\n * import `@baker/proxy/fetch`.\n *\n * Three properties are worth stating up front, because each is a decision:\n *\n * - **The dispatcher is per request.** Installing a global one would silently\n *   route every unrelated `fetch` in the process — provider APIs included —\n *   through a metered exit, which is both a bill and a good way to trip a WAF\n *   that has never seen us arrive from Brazil before.\n * - **`undici`'s own `fetch` is used, not the global one.** Node's global fetch\n *   is powered by Node's *internal* copy of undici; handing it a `ProxyAgent`\n *   built by the userland copy hands it a dispatcher speaking a different\n *   handler protocol. Same package name, two module registries.\n * - **The body is read here and re-wrapped.** A proxied response is only alive\n *   while its agent is, and the agent has to be closed or the sockets leak; and\n *   a wall page cannot be recognised without reading it. Buffering once solves\n *   both, at the cost of not supporting streaming callers — none of which exist\n *   on the paths this serves, all of which call `arrayBuffer()` immediately.\n */\n\nimport { lookup as dnsLookup } from \"node:dns\";\nimport type { RequestInit } from \"undici\";\nimport { Agent, ProxyAgent, Response, fetch as undiciFetch } from \"undici\";\nimport { isChallengeBody } from \"./challenge.ts\";\nimport type { ProxyCredentials } from \"./credentials.ts\";\nimport type { FetchAttempt } from \"./fetchDecision.ts\";\nimport { classifyFetchOutcome, errorBlockSignal, shouldSniffChallenge, shouldTryNextRoute } from \"./fetchDecision.ts\";\nimport type { TriedRoute } from \"./ladder.ts\";\nimport { nextPlannedRoute, plannedRoutes } from \"./ladder.ts\";\nimport { isPrivateAddress } from \"./privateAddress.ts\";\nimport { refuseNonPublicUrl } from \"./publicAddress.ts\";\nimport type { ProxyRoute, RouteOptions } from \"./route.ts\";\nimport type { ProxyTier } from \"./tiers.ts\";\n\nexport type { FetchAttempt, FetchOutcome } from \"./fetchDecision.ts\";\n\nexport interface EscalatedFetchResult {\n  /** The origin's answer, from whichever rung produced one. */\n  readonly response: Response | null;\n  /** Every rung tried, in order, so the caller can log the whole ladder. */\n  readonly attempts: FetchAttempt[];\n  /** Which rung produced `response`, or the last one attempted. */\n  readonly finalTier: \"direct\" | ProxyTier;\n  /** The last thrown error, when no rung produced a response at all. */\n  readonly error?: unknown;\n}\n\nexport interface EscalatedFetchOptions {\n  readonly credentials: ProxyCredentials;\n  /** Country / sticky-session targeting, passed through to the route builder. */\n  readonly routeOptions?: RouteOptions;\n  /** Per-attempt budget. Each rung gets its own; the ladder is not one clock. */\n  readonly timeoutMs?: number;\n  /**\n   * Read small text bodies looking for a bot wall behind a 200. On by default\n   * because that block is invisible from the status line. Turn it off only\n   * where a 200 is definitionally the payload.\n   */\n  readonly sniffChallenge?: boolean;\n  /**\n   * Refuse to buffer a body that *declares* itself larger than this.\n   *\n   * Because the body is read here, a caller's own size cap would otherwise fire\n   * only after the whole file had already been pulled into memory — the exact\n   * download the cap exists to avoid. The response still carries the original\n   * `content-length`, so the caller's check is the one that reports it.\n   */\n  readonly maxBytes?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 60_000;\n/**\n * Above this, a body is the thing we asked for, not a wall. Generous next to\n * the 2 KB ceiling the detector itself applies, so a padded challenge page is\n * still caught while a real download is never decoded into a string.\n */\nconst MAX_SNIFF_BYTES = 64 * 1024;\n\nfunction tierOf(route: ProxyRoute): \"direct\" | ProxyTier {\n  return route.kind === \"proxy\" ? route.tier : \"direct\";\n}\n\n/**\n * Credentials go in a header we build once, never into the URL.\n *\n * `new ProxyAgent(\"http://user:pass@host\")` would work and is how most examples\n * write it. It also means the password exists as a substring of a URL that any\n * error, log line or stack frame is free to print.\n */\nfunction agentFor(route: ProxyRoute): ProxyAgent | Agent | null {\n  if (route.kind !== \"proxy\") return directAgent();\n  const token = Buffer.from(`${route.username}:${route.password}`).toString(\"base64\");\n  return new ProxyAgent({ uri: route.server, token: `Basic ${token}` });\n}\n\n/**\n * The direct rung, with DNS held to the same rule as the hostname was.\n *\n * `refuseNonPublicUrl` reads the hostname, and a hostname is not an address:\n * `localtest.me` is a public name with a public DNS record pointing at\n * `127.0.0.1`, and nothing stops anyone pointing a domain they own at\n * `169.254.169.254`. Before this, that walked straight past the guard and\n * fetched from loopback.\n *\n * Doing it in `lookup` rather than by resolving first and re-checking closes the\n * gap between the two: undici connects to the address this callback returned, so\n * there is no window in which the record can change to a private one after being\n * approved.\n *\n * Only the direct rung needs it. A proxied request is resolved by the proxy, at\n * the far end of the tunnel — and a private address never gets a proxy route\n * built for it in the first place.\n */\nfunction directAgent(): Agent {\n  return new Agent({\n    connect: {\n      lookup: (hostname, options, callback) => {\n        dnsLookup(hostname, options, (error, address, family) => {\n          if (error) {\n            callback(error, address as string, family as number);\n            return;\n          }\n          const found = Array.isArray(address) ? address.map((entry) => entry.address) : [address];\n          const blocked = found.find((entry) => isPrivateAddress(entry));\n          if (blocked !== undefined) {\n            callback(new Error(`${PRIVATE_ADDRESS_CODE}: ${hostname} resolves to ${blocked}`), \"\", 4);\n            return;\n          }\n          callback(null, address as string, family as number);\n        });\n      },\n    },\n  });\n}\n\n/**\n * Marker in the thrown message, so a refusal is not read as a dead host.\n *\n * It travels as text because undici surfaces a `lookup` failure as an ordinary\n * connection error, and there is no field on it we own.\n */\nexport const PRIVATE_ADDRESS_CODE = \"EPRIVATEADDR\";\n\n/** Hops to allow before calling it a loop. Matches what browsers do. */\nconst MAX_REDIRECTS = 20;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nfunction originOf(url: string): string | null {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Whether this hop is a host walking us somewhere we would not have gone.\n *\n * The rule is: a redirect may not land anywhere we would have refused to start,\n * with one exception — the origin we deliberately chose. `entry` is the URL the\n * caller handed in, not the previous hop, so a chain cannot launder itself one\n * step at a time.\n *\n * The previous version compared each hop against the one before it and refused\n * only the *public → private* transition. That is sound as an induction and it\n * was still the wrong rule, for a reason worth keeping: every socket test in\n * this package serves from `127.0.0.1`, so the clause that asks whether we\n * started public was false in all of them and the guard could not fire once. The\n * two fixtures written for it sat in the file unreferenced. A guard whose only\n * possible test cannot reach it is indistinguishable from no guard, and this one\n * had already shipped once returning the metadata body with `outcome: \"ok\"`.\n *\n * Anchoring on the entry origin costs nothing in production — all four consumers\n * refuse a private entry URL, so the two rules never disagree there — and it\n * buys the loopback harness the ability to prove the refusal end to end.\n */\nexport function refuseRedirect(entry: string, to: string): boolean {\n  if (refuseNonPublicUrl(to) === null) return false;\n  const destination = originOf(to);\n  return destination === null || destination !== originOf(entry);\n}\n\n/**\n * Follow redirects ourselves, so every hop is checked and not just the first.\n *\n * `undici` follows them for us by default, and that is the problem: the callers\n * validate the URL they were handed and have no way to see where it went. A\n * public origin answering `302 Location: http://127.0.0.1:…` therefore produced\n * `outcome: \"ok\"` and the loopback body — confirmed against a real public\n * redirector. This is also the hole the `lookup` guard cannot cover, since a\n * hop to an address *literal* never asks DNS anything.\n *\n * Per the fetch spec, 303 becomes a GET, and so does a 301/302 that was a POST.\n */\nasync function followRedirects(url: string, init: RequestInit): Promise<Response> {\n  let current = url;\n  let request: RequestInit = { ...init, redirect: \"manual\" };\n\n  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {\n    const response = await undiciFetch(current, request);\n    const location = response.headers.get(\"location\");\n    if (!REDIRECT_STATUS.has(response.status) || location === null) return response;\n\n    // Nobody will ever read this body, but it is still on the wire, and the\n    // dispatcher is not done with the connection until it is drained. The cost\n    // lands somewhere unobvious: the response arrives and is correct, and then\n    // `agent.close()` in `attemptRoute`'s `finally` sits on the undrained socket\n    // until the rung's own AbortSignal fires and releases it. Measured through\n    // `fetchWithEscalation` with a 3 s budget — a 64 KB redirect body took\n    // 3007 ms, and 5 ms once cancelled. With the 60 s default that is a minute\n    // of an image fetch spent inside a Convex action on a body we discarded.\n    //\n    // Cancel before the refusal check below, so a refused hop releases it too.\n    await response.body?.cancel();\n\n    // Resolved against the URL that issued it, so a relative `Location` works.\n    const next = new URL(location, current).toString();\n    if (refuseRedirect(url, next)) {\n      throw new Error(`${PRIVATE_ADDRESS_CODE}: redirected to ${next}`);\n    }\n    const method = (request.method ?? \"GET\").toUpperCase();\n    const downgrade =\n      response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\");\n    request = downgrade ? { ...request, method: \"GET\", body: undefined } : request;\n    current = next;\n  }\n  throw new Error(`too many redirects following ${url}`);\n}\n\n/** Statuses the `Response` constructor refuses to attach a body to. */\nconst NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);\n\nfunction rebuild(response: Response, body: ArrayBuffer): Response {\n  if (response.status < 200 || response.status > 599 || NULL_BODY_STATUS.has(response.status)) {\n    return new Response(null, { status: response.status, headers: response.headers });\n  }\n  return new Response(body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n}\n\nfunction declaredLength(response: Response): number | null {\n  const raw = response.headers.get(\"content-length\");\n  if (raw === null) return null;\n  const value = Number(raw);\n  return Number.isFinite(value) ? value : null;\n}\n\nasync function readOnce(\n  response: Response,\n  sniff: boolean,\n  maxBytes: number | undefined,\n): Promise<{ response: Response; challenge: boolean }> {\n  const declared = declaredLength(response);\n  if (maxBytes !== undefined && declared !== null && declared > maxBytes) {\n    await response.body?.cancel();\n    return { response: rebuild(response, new ArrayBuffer(0)), challenge: false };\n  }\n  const body = await response.arrayBuffer();\n  const wantsSniff =\n    sniff && shouldSniffChallenge(response.headers.get(\"content-type\"), body.byteLength, MAX_SNIFF_BYTES);\n  const challenge = wantsSniff ? isChallengeBody(new TextDecoder().decode(body)) : false;\n  return { response: rebuild(response, body), challenge };\n}\n\ninterface RungResult {\n  readonly attempt: FetchAttempt;\n  /** Present only when the origin answered — a proxy's own 407 never is. */\n  readonly response: Response | null;\n  readonly error?: unknown;\n}\n\n/** One rung: open it, read it, close it. Never throws — a rung is a verdict. */\nasync function attemptRoute(\n  url: string,\n  init: RequestInit,\n  route: ProxyRoute,\n  options: EscalatedFetchOptions,\n): Promise<RungResult> {\n  const tier = tierOf(route);\n  const agent = agentFor(route);\n  const startedAt = Date.now();\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  // Each rung gets its own budget, and the caller's own signal still cancels\n  // the whole thing — a ladder that ignored it would keep paying for a job\n  // that has already been abandoned.\n  const signal = init.signal\n    ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)])\n    : AbortSignal.timeout(timeoutMs);\n\n  try {\n    const raw = await followRedirects(url, { ...init, dispatcher: agent ?? undefined, signal });\n    const read = await readOnce(raw, options.sniffChallenge ?? true, options.maxBytes);\n    const outcome = classifyFetchOutcome({ status: raw.status, challenge: read.challenge });\n    return {\n      attempt: { tier, status: raw.status, ms: Date.now() - startedAt, outcome },\n      response: outcome === \"proxy_unavailable\" ? null : read.response,\n    };\n  } catch (error) {\n    const blockSignal = errorBlockSignal(error, route.kind === \"proxy\");\n    return {\n      attempt: {\n        tier,\n        status: blockSignal.status ?? undefined,\n        ms: Date.now() - startedAt,\n        outcome: classifyFetchOutcome(blockSignal),\n      },\n      response: null,\n      error,\n    };\n  } finally {\n    await agent?.close();\n  }\n}\n\n/**\n * Fetch `url`, escalating through the configured proxy tiers on a classified\n * block and on nothing else.\n *\n * The returned `response` is the origin's, from whichever rung answered — never\n * a proxy's 407, which would read as the site refusing us. When every rung\n * failed for our own reasons, `response` is null and `attempts` says so, which\n * is the difference between \"this page is unreachable\" and \"our credentials\n * are wrong\" that every caller downstream needs.\n */\nexport async function fetchWithEscalation(\n  url: string,\n  init: RequestInit,\n  options: EscalatedFetchOptions,\n): Promise<EscalatedFetchResult> {\n  const attempts: FetchAttempt[] = [];\n  let originResponse: Response | null = null;\n  let originTier: \"direct\" | ProxyTier = \"direct\";\n  let lastError: unknown;\n\n  const routes = plannedRoutes(url, options.credentials, options.routeOptions);\n  const tried: TriedRoute[] = [];\n  for (let route: ProxyRoute | null = routes[0] ?? null; route !== null; route = nextPlannedRoute(routes, tried)) {\n    const rung = await attemptRoute(url, init, route, options);\n    attempts.push(rung.attempt);\n    tried.push({ tier: rung.attempt.tier, proxyFailure: rung.attempt.outcome === \"proxy_unavailable\" });\n    if (rung.response !== null) {\n      originResponse = rung.response;\n      originTier = rung.attempt.tier;\n    }\n    if (rung.error !== undefined) lastError = rung.error;\n    if (!shouldTryNextRoute(rung.attempt.outcome)) break;\n  }\n\n  return {\n    response: originResponse,\n    attempts,\n    finalTier: originResponse !== null ? originTier : (lastAttempt(attempts)?.tier ?? \"direct\"),\n    ...(originResponse === null && lastError !== undefined ? { error: lastError } : {}),\n  };\n}\n\n/** `Array.prototype.at` is past the lib Convex's own tsconfig compiles against. */\nfunction lastAttempt(attempts: readonly FetchAttempt[]): FetchAttempt | undefined {\n  return attempts[attempts.length - 1];\n}\n\n/** One line per operation, with no credential anywhere in it. */\nexport function describeLadder(result: EscalatedFetchResult): string {\n  const rungs = result.attempts.map((a) => `${a.tier}:${a.outcome}${a.status ? `(${a.status})` : \"\"}@${a.ms}ms`);\n  return `${rungs.join(\" → \")} | final=${result.finalTier}`;\n}\n\n/** A rung that answered cleanly settles the question; no earlier rung outvotes it. */\nfunction rescued(result: EscalatedFetchResult): boolean {\n  return result.attempts.some((attempt) => attempt.outcome === \"ok\");\n}\n\n/**\n * Whether the ladder ran out of rungs while the site was still refusing us.\n *\n * Two mistakes are available here and this function has made both. Reading only\n * the *last* rung reports \"not blocked\" for `[blocked, proxy_unavailable]` — the\n * state a rotated password puts every deployment into — and hands the caller the\n * wall page from rung one as if it were the payload, which `mediaCache` then\n * writes into the S3 cache permanently. Reading *any* rung reports \"blocked\" for\n * `[blocked, ok]`, which is the success case: the caller pays for the paid rung,\n * receives the bytes, and throws them away. That one makes the whole ladder cost\n * money for nothing.\n *\n * So: a clean answer wins outright, and only in its absence does a refusal count.\n */\nexport function endedBlocked(result: EscalatedFetchResult): boolean {\n  if (rescued(result)) return false;\n  return result.attempts.some((attempt) => attempt.outcome === \"blocked\");\n}\n\n/**\n * Whether the ladder ended on our own fault with no site verdict to report.\n *\n * Narrower than \"a rung was a proxy failure\" twice over: a rung that answered\n * makes the dead rung irrelevant, and a rung that saw the site refuse us gives\n * `endedBlocked` the honest verdict. This is only for the case where we never\n * got far enough to learn anything about the page — which must never be charged\n * to it.\n */\nexport function endedProxyUnavailable(result: EscalatedFetchResult): boolean {\n  if (rescued(result) || endedBlocked(result)) return false;\n  return result.attempts.some((attempt) => attempt.outcome === \"proxy_unavailable\");\n}\n\n/**\n * The host resolved to an address inside our own network, so we refused it.\n *\n * Worth telling apart from \"that address did not answer\": one is a dead site\n * and the other is a decision we made, and only the second is worth saying\n * plainly to whoever handed us the URL.\n */\nexport function endedPrivateAddress(result: EscalatedFetchResult): boolean {\n  if (rescued(result)) return false;\n  // The chain, not the top: undici reports this as a bare `TypeError: fetch\n  // failed` and hangs the real reason off `cause`. Reading only the outer\n  // message found nothing and reported a refusal as a dead host.\n  for (let error: unknown = result.error, depth = 0; error instanceof Error && depth < 5; depth++) {\n    if (error.message.includes(PRIVATE_ADDRESS_CODE)) return true;\n    // Read rather than dereferenced: `Error.cause` is ES2022, and this module is\n    // also typechecked by Convex's bundler against an older lib, where the\n    // property does not exist on the type even though it does at runtime.\n    error = (error as { cause?: unknown }).cause;\n  }\n  return false;\n}\n","/**\n * Every judgement the escalating fetch makes, with no socket in sight.\n *\n * `fetch.ts` is deliberately thin: it opens connections and hands what came\n * back to the functions here. Everything that decides *money* — is this a\n * block, is this our own broken route, is it worth another rung — lives in this\n * file so it can be pinned by tests rather than by a live request to a site\n * that happens to be refusing us today.\n */\n\nimport type { BlockSignal } from \"./escalate.ts\";\nimport { isProxyFailure, shouldEscalate } from \"./escalate.ts\";\nimport type { ProxyTier } from \"./tiers.ts\";\n\n/** What one rung of the ladder did. */\nexport type FetchOutcome = \"ok\" | \"blocked\" | \"proxy_unavailable\" | \"failed\";\n\n/** One rung, as it happened. Returned to the caller so the ladder is loggable. */\nexport interface FetchAttempt {\n  readonly tier: \"direct\" | ProxyTier;\n  readonly status?: number;\n  readonly ms: number;\n  readonly outcome: FetchOutcome;\n}\n\n/**\n * Name what happened, from the signal alone.\n *\n * The order matters and is the whole point:\n *\n * 1. **Our route first.** A 407 or a tunnel that would not open is a fault in\n *    the credentials we sent, never the site's opinion of us. Reading it as a\n *    block would spend the expensive rung reproducing our own misconfiguration\n *    and — worse — would file a perfectly readable page as refused.\n * 2. **Then the block**, delegated to `shouldEscalate`, which is the single\n *    closed allow-list every surface shares.\n * 3. **Then success**, which a challenge body can veto even on a 200.\n */\nexport function classifyFetchOutcome(signal: BlockSignal): FetchOutcome {\n  if (isProxyFailure(signal)) return \"proxy_unavailable\";\n  if (shouldEscalate(signal)) return \"blocked\";\n  if (signal.status != null && signal.status >= 200 && signal.status < 400 && !signal.challenge) return \"ok\";\n  return \"failed\";\n}\n\n/**\n * Whether a failed rung earns another one.\n *\n * Both reasons move to the next route, and they are not the same reason:\n *\n * - `blocked` climbs — the site refused *us*, and a different exit IP is a\n *   different us.\n * - `proxy_unavailable` does not climb, it *degrades*: this rung is unusable,\n *   so it is dropped and the ladder carries on without it. A mis-pasted\n *   datacenter password must cost the use of the datacenter rung, never the\n *   residential one that would have worked.\n *\n * Everything else stops: a 404, a dead domain, a certificate that will not\n * negotiate and a timeout all fail identically from every IP on earth, so a\n * second attempt buys a second identical failure and a bill.\n */\nexport function shouldTryNextRoute(outcome: FetchOutcome): boolean {\n  return outcome === \"blocked\" || outcome === \"proxy_unavailable\";\n}\n\n/** Node/undici error codes that mean the attempt ran out of time. */\nconst TIMEOUT_CODES = new Set([\n  \"UND_ERR_CONNECT_TIMEOUT\",\n  \"UND_ERR_HEADERS_TIMEOUT\",\n  \"UND_ERR_BODY_TIMEOUT\",\n  \"ETIMEDOUT\",\n]);\n\n/**\n * Node codes that mean the peer hung up mid-conversation.\n *\n * Mapped onto the Chromium names the shared classifier speaks, because a WAF\n * null-routing a datacenter range looks like this from `undici` and like\n * `net::ERR_CONNECTION_RESET` from Playwright, and they have to reach the same\n * verdict.\n */\nconst RESET_CODES = new Set([\"ECONNRESET\", \"UND_ERR_SOCKET\", \"EPIPE\"]);\n\n/**\n * Anything speaking proxy answered the CONNECT with something other than 200.\n *\n * Kept, but do not rely on it: measured against undici 7.29 and a local proxy\n * that answers every CONNECT with 407, `fetch` surfaces only\n * `Error(\"Request was cancelled.\")` with `code: 0` — the status never reaches\n * the caller. The `proxied` fallback below is what actually carries that case,\n * which is why it is a fallback and not a last resort.\n */\nconst PROXY_RESPONSE = /Proxy response \\((\\d+)\\)/;\n\nfunction errorCode(error: unknown): string | null {\n  if (typeof error !== \"object\" || error === null) return null;\n  const code = (error as { code?: unknown }).code;\n  if (typeof code === \"string\") return code;\n  const name = (error as { name?: unknown }).name;\n  return typeof name === \"string\" ? name : null;\n}\n\nfunction errorMessage(error: unknown): string {\n  if (typeof error === \"object\" && error !== null) {\n    const message = (error as { message?: unknown }).message;\n    if (typeof message === \"string\") return message;\n  }\n  return String(error);\n}\n\n/**\n * Turn a thrown `fetch` error into the signal the shared classifier reads.\n *\n * `proxied` is not a nicety. Through a tunnel, the target's DNS is resolved at\n * the far end and every connect-level failure we can see belongs to the proxy —\n * so the same `ENOTFOUND` means \"your domain is a typo\" on the direct rung and\n * \"our exit node is down\" on a paid one. Collapsing the two would let one bad\n * credential mark healthy pages as unreachable, which is precisely the failure\n * this ladder exists to avoid.\n */\nexport function errorBlockSignal(error: unknown, proxied: boolean): BlockSignal {\n  const proxyResponse = PROXY_RESPONSE.exec(errorMessage(error));\n  if (proxyResponse) {\n    const status = Number(proxyResponse[1]);\n    // Only something speaking proxy produces these, so they are always ours.\n    return status === 407 ? { status: 407 } : { netError: \"ERR_TUNNEL_CONNECTION_FAILED\" };\n  }\n\n  const code = errorCode(error);\n  if (code !== null && TIMEOUT_CODES.has(code)) return { timedOut: true };\n  // `AbortError` is what a caller's own signal and `AbortSignal.timeout` both\n  // raise; either way the attempt ran out of time rather than being refused.\n  if (code === \"AbortError\" || code === \"TimeoutError\") return { timedOut: true };\n\n  if (proxied) {\n    // The tunnel never carried us. Whatever the code says about hostnames, the\n    // only host we spoke to was the proxy.\n    return { netError: \"ERR_PROXY_CONNECTION_FAILED\" };\n  }\n\n  if (code !== null && RESET_CODES.has(code)) return { netError: \"ERR_CONNECTION_RESET\" };\n  return { netError: code ?? \"ERR_FAILED\" };\n}\n\n/**\n * Is this response worth reading as text to look for a wall behind a 200?\n *\n * Two guards, both about not paying for the check. A CDN handing back the JPEG\n * we asked for is never a challenge, so a body that declares an image, a video\n * or any other binary type is not read. And a wall page is small — a body that\n * announces megabytes is the thing we wanted, so it is left as bytes rather\n * than decoded into a string that would be thrown away.\n */\nexport function shouldSniffChallenge(\n  contentType: string | null,\n  contentLength: number | null,\n  maxSniffBytes: number,\n): boolean {\n  if (contentLength !== null && contentLength > maxSniffBytes) return false;\n  if (contentType === null || contentType.trim() === \"\") return true;\n  const type = contentType.toLowerCase();\n  // Media is never a wall, and `image/svg+xml` would otherwise be dragged in by\n  // the `xml` test below — refusing an SVG because it says \"captcha\" is a worse\n  // failure than missing the wall that never arrives dressed as an image.\n  if (type.startsWith(\"image/\") || type.startsWith(\"video/\") || type.startsWith(\"audio/\")) return false;\n  return type.includes(\"text/\") || type.includes(\"html\") || type.includes(\"json\") || type.includes(\"xml\");\n}\n","/**\n * Fetching bytes from somebody else's server, with the escalation ladder on.\n *\n * Six commands download from an arbitrary host — canvas ingest, `images\n * download`, the shared image reader, and the two canvas scaffolders — and every\n * one of them was a bare `fetch(url)`. That is the request shape a CDN hotlink\n * filter is tuned to refuse first: no User-Agent, no Referer, and an exit IP\n * that belongs to a datacenter. The agent's instruction for the resulting 403\n * was to give up and re-source the asset.\n *\n * This is where that stops being the answer. One place reads the credentials,\n * one place decides what a refusal looks like, and one place writes the ladder\n * to stderr — so a command that gains a download later inherits all three\n * instead of growing a seventh copy of the mistake.\n *\n * **Nothing here reaches the model.** No hint, no error message and no command\n * description mentions a proxy; an agent that learned it could ask for one would\n * start asking. The escalation is ours to decide and its bill is ours to carry.\n */\n\nimport { refuseNonPublicUrl } from \"@baker/proxy\";\nimport {\n  describeLadder,\n  endedBlocked,\n  endedPrivateAddress,\n  endedProxyUnavailable,\n  fetchWithEscalation,\n} from \"@baker/proxy/fetch\";\nimport type { Response } from \"undici\";\nimport { captureProxyCredentials } from \"../env.ts\";\n\n/**\n * Browser-shaped headers — the *first* answer to a hotlink filter, and the free\n * one. The ladder is the second, for hosts that refuse the address rather than\n * the request. Mirrors `convex/lib/imageFetch.ts`, which learned it the same way.\n */\nconst BROWSER_HEADERS: Record<string, string> = {\n  \"User-Agent\":\n    \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\",\n  Accept: \"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\n  \"Accept-Language\": \"en-US,en;q=0.9\",\n};\n\n/** One sentence for both halves of the rule — the name and the address it resolves to. */\nconst NOT_PUBLIC_MESSAGE = \"That address is not reachable from the public web, so there is nothing to read.\";\n/** The one null-status failure that is the host's outage, not a refusal: worth one retry. */\nexport const NO_ANSWER_MESSAGE = \"That address did not answer.\";\n\n/**\n * The ceiling for anything that is an image rather than a video.\n *\n * The same number the Convex side uses (`MAX_INGEST_BYTES`), and deliberately so\n * — the dashboard and the agent should not disagree about how big an image is\n * allowed to be, and a URL handed to `images download` is frequently the same\n * URL the backend will be asked to ingest afterwards.\n */\nexport const MAX_REMOTE_IMAGE_BYTES = 25_000_000;\n\nexport interface ExternalFetchOptions {\n  /** Per-rung budget. The ladder is not one clock; each rung gets its own. */\n  readonly timeoutMs?: number;\n  /** Refuse to buffer a body that declares itself larger than this. */\n  readonly maxBytes?: number;\n  /** Extra or overriding request headers. */\n  readonly headers?: Record<string, string>;\n  /**\n   * Off for a download that is definitionally bytes. A challenge sniff decodes\n   * a small body as text looking for a wall behind a 200; a video file is not\n   * that, and reading one as a string is waste rather than a mistake.\n   */\n  readonly sniffChallenge?: boolean;\n}\n\nexport interface ExternalFetchResult {\n  /** The origin's answer, from whichever rung produced one. */\n  readonly response: Response;\n  /**\n   * Every rung refused us and none produced a clean answer.\n   *\n   * Distinct from `!response.ok`: a bot wall answers **200** with a page, so the\n   * status line alone cannot tell a payload from a refusal.\n   */\n  readonly blocked: boolean;\n}\n\n/** No rung reached the origin. Named so a caller can tell it from a 404. */\nexport class ExternalFetchError extends Error {\n  /** True when the fault was ours — a route we could not open, not a dead host. */\n  readonly ourFault: boolean;\n  /** The HTTP status the host answered with, when it answered at all. */\n  readonly status: number | null;\n\n  constructor(message: string, ourFault: boolean, status: number | null = null) {\n    super(message);\n    this.name = \"ExternalFetchError\";\n    this.ourFault = ourFault;\n    this.status = status;\n  }\n}\n\n/** The host answered, but with more bytes than the caller's ceiling. */\nexport class OversizeFetchError extends ExternalFetchError {\n  constructor(message: string) {\n    super(message, false);\n    this.name = \"OversizeFetchError\";\n  }\n}\n\n/**\n * Fetch `url`, climbing to a paid exit only if the host refuses this one.\n *\n * Dormant on the happy path by construction: a 200 costs one request, and so do\n * a 404, a dead domain and a certificate that will not negotiate — none of which\n * a different IP would change. Only a classified refusal opens a rung.\n */\nexport async function fetchExternal(url: string, options: ExternalFetchOptions = {}): Promise<ExternalFetchResult> {\n  // The ladder refuses to *bill* a private address, and its comment says one is\n  // \"refused upstream\" — which was true of the landing capture, the only caller\n  // it had when it was written. It is not true here: every command that reaches\n  // the web through this function takes a URL straight from an agent or a\n  // stored row, and the direct rung would still go out. In a Runtime that means\n  // `169.254.169.254` answers with cloud credentials, and a caller writes them\n  // to a file it then reads back. The refusal has to happen before the request,\n  // and this is the only place all six download surfaces pass through.\n  if (refuseNonPublicUrl(url) !== null) {\n    throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);\n  }\n\n  const result = await fetchWithEscalation(\n    url,\n    { headers: { ...BROWSER_HEADERS, ...options.headers } },\n    {\n      credentials: captureProxyCredentials(),\n      ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),\n      ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),\n      ...(options.sniffChallenge === undefined ? {} : { sniffChallenge: options.sniffChallenge }),\n    },\n  );\n\n  // stderr, and only when it actually climbed. stdout is the JSON envelope the\n  // agent parses, and a ladder line on the happy path would be noise on every\n  // download in the repo.\n  if (result.attempts.length > 1) {\n    process.stderr.write(`fetch ladder ${url} — ${describeLadder(result)}\\n`);\n  }\n\n  if (result.response === null) {\n    // A name that resolved into our own network is a refusal, not an outage.\n    // The hostname guard above cannot catch it — `localtest.me` is a public name\n    // with a public record pointing at `127.0.0.1` — so it is caught at the\n    // resolved address, and reported as the decision it is.\n    if (endedPrivateAddress(result)) {\n      throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);\n    }\n    const ourFault = endedProxyUnavailable(result);\n    throw new ExternalFetchError(ourFault ? \"Could not open a route to that address.\" : NO_ANSWER_MESSAGE, ourFault);\n  }\n\n  return { response: result.response, blocked: endedBlocked(result) };\n}\n\n/**\n * Whether `bytes` busts the ceiling, as the sentence to say about it.\n *\n * `null` bytes means the host never said, which must not read as zero — a\n * chunked response has no `content-length` and is not thereby empty.\n *\n * A file, not an image: `scaffold-video` downloads through here too, and it is\n * the surface most likely to meet a limit.\n */\nexport function refuseOversize(bytes: number | null, maxBytes: number): string | null {\n  if (bytes === null || bytes <= maxBytes) return null;\n  return `That file is ${humanBytes(bytes)} — the limit is ${humanBytes(maxBytes)}.`;\n}\n\n/**\n * A size a person can read, at whatever scale it happens to be.\n *\n * Fixed `MB` looked fine against the two real ceilings and fell over the moment\n * it met anything else: a 13 KB file refused by a 1 KB cap read \"That file is\n * 0.0 MB — the limit is 0.0 MB\", which names no problem at all. The ceilings\n * here span 25 MB to 2 GB, so no single unit was ever going to carry them.\n */\nfunction humanBytes(n: number): string {\n  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;\n  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;\n  return `${Math.max(1, Math.round(n / 1024))} KB`;\n}\n\n/** What the response says it weighs, or `null` when it did not say. */\nfunction declaredBytes(response: Response): number | null {\n  const raw = response.headers.get(\"content-length\");\n  if (raw === null) return null;\n  const value = Number(raw);\n  return Number.isFinite(value) ? value : null;\n}\n\n/**\n * The common case: fetch and hand back the bytes.\n *\n * Throws on a refusal rather than returning a wall page, because every caller\n * writes what it gets to disk or uploads it — and an HTML \"just a moment\" page\n * saved as `logo.png` is the failure nothing downstream can detect.\n *\n * `maxBytes` is **required**, and that is the point of it. Four of the five\n * callers here passed nothing, so `images download`, `readImageBuffer` and the\n * static-ad scaffolder would each buffer whatever a URL from agent argv pointed\n * at, with no ceiling anywhere — while every neighbouring surface in the repo\n * caps (`MAX_ASSET_BYTES` streaming in `asset-store`, a required `maxBytes` in\n * `fetchImageBytes`). A default would have closed it today and reopened it for\n * the next caller; a required argument makes each surface say its own number.\n */\nexport async function fetchExternalBytes(\n  url: string,\n  options: ExternalFetchOptions & { readonly maxBytes: number },\n): Promise<{ buffer: Buffer; contentType: string | null }> {\n  const { response, blocked } = await fetchExternal(url, options);\n  if (!response.ok) {\n    throw new ExternalFetchError(`${response.status} ${response.statusText}`, false, response.status);\n  }\n  if (blocked) {\n    throw new ExternalFetchError(\"That host served a security check instead of the file.\", false);\n  }\n\n  // The declared size first, and it is not belt-and-braces. `@baker/proxy`\n  // answers an oversize body by cancelling it and handing back a 200 with an\n  // *empty* buffer, keeping `content-length` so the caller can see what\n  // happened. Without this read, that arrives as a successful download of\n  // nothing — and the caller's own byte-length check passes, because zero is\n  // not too large.\n  const declared = refuseOversize(declaredBytes(response), options.maxBytes);\n  if (declared !== null) {\n    throw new OversizeFetchError(declared);\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n  // And again on what actually arrived, for the host that said nothing or lied.\n  const actual = refuseOversize(buffer.byteLength, options.maxBytes);\n  if (actual !== null) {\n    throw new OversizeFetchError(actual);\n  }\n\n  return { buffer, contentType: response.headers.get(\"content-type\") };\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,SAAS,UAAU,iBAAiB;AAEpC,SAAS,OAAO,YAAY,UAAU,SAAS,mBAAmB;;;ACS3D,SAAS,qBAAqB,QAAmC;AACtE,MAAI,eAAe,MAAM,EAAG,QAAO;AACnC,MAAI,eAAe,MAAM,EAAG,QAAO;AACnC,MAAI,OAAO,UAAU,QAAQ,OAAO,UAAU,OAAO,OAAO,SAAS,OAAO,CAAC,OAAO,UAAW,QAAO;AACtG,SAAO;AACT;AAkBO,SAAS,mBAAmB,SAAgC;AACjE,SAAO,YAAY,aAAa,YAAY;AAC9C;AAGA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUD,IAAM,cAAc,oBAAI,IAAI,CAAC,cAAc,kBAAkB,OAAO,CAAC;AAWrE,IAAM,iBAAiB;AAEvB,SAAS,UAAU,OAA+B;AAChD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,OAAQ,MAA6B;AAC3C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,OAAQ,MAA6B;AAC3C,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,UAAW,MAAgC;AACjD,QAAI,OAAO,YAAY,SAAU,QAAO;AAAA,EAC1C;AACA,SAAO,OAAO,KAAK;AACrB;AAYO,SAAS,iBAAiB,OAAgB,SAA+B;AAC9E,QAAM,gBAAgB,eAAe,KAAK,aAAa,KAAK,CAAC;AAC7D,MAAI,eAAe;AACjB,UAAM,SAAS,OAAO,cAAc,CAAC,CAAC;AAEtC,WAAO,WAAW,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,UAAU,+BAA+B;AAAA,EACvF;AAEA,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,SAAS,QAAQ,cAAc,IAAI,IAAI,EAAG,QAAO,EAAE,UAAU,KAAK;AAGtE,MAAI,SAAS,gBAAgB,SAAS,eAAgB,QAAO,EAAE,UAAU,KAAK;AAE9E,MAAI,SAAS;AAGX,WAAO,EAAE,UAAU,8BAA8B;AAAA,EACnD;AAEA,MAAI,SAAS,QAAQ,YAAY,IAAI,IAAI,EAAG,QAAO,EAAE,UAAU,uBAAuB;AACtF,SAAO,EAAE,UAAU,QAAQ,aAAa;AAC1C;AAWO,SAAS,qBACd,aACA,eACA,eACS;AACT,MAAI,kBAAkB,QAAQ,gBAAgB,cAAe,QAAO;AACpE,MAAI,gBAAgB,QAAQ,YAAY,KAAK,MAAM,GAAI,QAAO;AAC9D,QAAM,OAAO,YAAY,YAAY;AAIrC,MAAI,KAAK,WAAW,QAAQ,KAAK,KAAK,WAAW,QAAQ,KAAK,KAAK,WAAW,QAAQ,EAAG,QAAO;AAChG,SAAO,KAAK,SAAS,OAAO,KAAK,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,KAAK;AACxG;;;ADzFA,IAAM,qBAAqB;AAM3B,IAAM,kBAAkB,KAAK;AAE7B,SAAS,OAAO,OAAyC;AACvD,SAAO,MAAM,SAAS,UAAU,MAAM,OAAO;AAC/C;AASA,SAAS,SAAS,OAA8C;AAC9D,MAAI,MAAM,SAAS,QAAS,QAAO,YAAY;AAC/C,QAAM,QAAQ,OAAO,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,QAAQ,EAAE,EAAE,SAAS,QAAQ;AAClF,SAAO,IAAI,WAAW,EAAE,KAAK,MAAM,QAAQ,OAAO,SAAS,KAAK,GAAG,CAAC;AACtE;AAoBA,SAAS,cAAqB;AAC5B,SAAO,IAAI,MAAM;AAAA,IACf,SAAS;AAAA,MACP,QAAQ,CAAC,UAAU,SAAS,aAAa;AACvC,kBAAU,UAAU,SAAS,CAAC,OAAO,SAAS,WAAW;AACvD,cAAI,OAAO;AACT,qBAAS,OAAO,SAAmB,MAAgB;AACnD;AAAA,UACF;AACA,gBAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,OAAO,IAAI,CAAC,OAAO;AACvF,gBAAM,UAAU,MAAM,KAAK,CAAC,UAAU,iBAAiB,KAAK,CAAC;AAC7D,cAAI,YAAY,QAAW;AACzB,qBAAS,IAAI,MAAM,GAAG,oBAAoB,KAAK,QAAQ,gBAAgB,OAAO,EAAE,GAAG,IAAI,CAAC;AACxF;AAAA,UACF;AACA,mBAAS,MAAM,SAAmB,MAAgB;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQO,IAAM,uBAAuB;AAGpC,IAAM,gBAAgB;AACtB,IAAM,kBAAkB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAEzD,SAAS,SAAS,KAA4B;AAC5C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuBO,SAAS,eAAe,OAAe,IAAqB;AACjE,MAAI,mBAAmB,EAAE,MAAM,KAAM,QAAO;AAC5C,QAAM,cAAc,SAAS,EAAE;AAC/B,SAAO,gBAAgB,QAAQ,gBAAgB,SAAS,KAAK;AAC/D;AAcA,eAAe,gBAAgB,KAAa,MAAsC;AAChF,MAAI,UAAU;AACd,MAAI,UAAuB,EAAE,GAAG,MAAM,UAAU,SAAS;AAEzD,WAAS,MAAM,GAAG,OAAO,eAAe,OAAO;AAC7C,UAAM,WAAW,MAAM,YAAY,SAAS,OAAO;AACnD,UAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,QAAI,CAAC,gBAAgB,IAAI,SAAS,MAAM,KAAK,aAAa,KAAM,QAAO;AAYvE,UAAM,SAAS,MAAM,OAAO;AAG5B,UAAM,OAAO,IAAI,IAAI,UAAU,OAAO,EAAE,SAAS;AACjD,QAAI,eAAe,KAAK,IAAI,GAAG;AAC7B,YAAM,IAAI,MAAM,GAAG,oBAAoB,mBAAmB,IAAI,EAAE;AAAA,IAClE;AACA,UAAM,UAAU,QAAQ,UAAU,OAAO,YAAY;AACrD,UAAM,YACJ,SAAS,WAAW,QAAS,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,WAAW;AACjG,cAAU,YAAY,EAAE,GAAG,SAAS,QAAQ,OAAO,MAAM,OAAU,IAAI;AACvE,cAAU;AAAA,EACZ;AACA,QAAM,IAAI,MAAM,gCAAgC,GAAG,EAAE;AACvD;AAGA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAE1D,SAAS,QAAQ,UAAoB,MAA6B;AAChE,MAAI,SAAS,SAAS,OAAO,SAAS,SAAS,OAAO,iBAAiB,IAAI,SAAS,MAAM,GAAG;AAC3F,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAAA,EAClF;AACA,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACH;AAEA,SAAS,eAAe,UAAmC;AACzD,QAAM,MAAM,SAAS,QAAQ,IAAI,gBAAgB;AACjD,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;AAEA,eAAe,SACb,UACA,OACA,UACqD;AACrD,QAAM,WAAW,eAAe,QAAQ;AACxC,MAAI,aAAa,UAAa,aAAa,QAAQ,WAAW,UAAU;AACtE,UAAM,SAAS,MAAM,OAAO;AAC5B,WAAO,EAAE,UAAU,QAAQ,UAAU,IAAI,YAAY,CAAC,CAAC,GAAG,WAAW,MAAM;AAAA,EAC7E;AACA,QAAM,OAAO,MAAM,SAAS,YAAY;AACxC,QAAM,aACJ,SAAS,qBAAqB,SAAS,QAAQ,IAAI,cAAc,GAAG,KAAK,YAAY,eAAe;AACtG,QAAM,YAAY,aAAa,gBAAgB,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC,IAAI;AACjF,SAAO,EAAE,UAAU,QAAQ,UAAU,IAAI,GAAG,UAAU;AACxD;AAUA,eAAe,aACb,KACA,MACA,OACA,SACqB;AACrB,QAAM,OAAO,OAAO,KAAK;AACzB,QAAM,QAAQ,SAAS,KAAK;AAC5B,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,YAAY,QAAQ,aAAa;AAIvC,QAAM,SAAS,KAAK,SAChB,YAAY,IAAI,CAAC,KAAK,QAAQ,YAAY,QAAQ,SAAS,CAAC,CAAC,IAC7D,YAAY,QAAQ,SAAS;AAEjC,MAAI;AACF,UAAM,MAAM,MAAM,gBAAgB,KAAK,EAAE,GAAG,MAAM,YAAY,SAAS,QAAW,OAAO,CAAC;AAC1F,UAAM,OAAO,MAAM,SAAS,KAAK,QAAQ,kBAAkB,MAAM,QAAQ,QAAQ;AACjF,UAAM,UAAU,qBAAqB,EAAE,QAAQ,IAAI,QAAQ,WAAW,KAAK,UAAU,CAAC;AACtF,WAAO;AAAA,MACL,SAAS,EAAE,MAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI,WAAW,QAAQ;AAAA,MACzE,UAAU,YAAY,sBAAsB,OAAO,KAAK;AAAA,IAC1D;AAAA,EACF,SAAS,OAAO;AACd,UAAM,cAAc,iBAAiB,OAAO,MAAM,SAAS,OAAO;AAClE,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,QACA,QAAQ,YAAY,UAAU;AAAA,QAC9B,IAAI,KAAK,IAAI,IAAI;AAAA,QACjB,SAAS,qBAAqB,WAAW;AAAA,MAC3C;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAYA,eAAsB,oBACpB,KACA,MACA,SAC+B;AAC/B,QAAM,WAA2B,CAAC;AAClC,MAAI,iBAAkC;AACtC,MAAI,aAAmC;AACvC,MAAI;AAEJ,QAAM,SAAS,cAAc,KAAK,QAAQ,aAAa,QAAQ,YAAY;AAC3E,QAAM,QAAsB,CAAC;AAC7B,WAAS,QAA2B,OAAO,CAAC,KAAK,MAAM,UAAU,MAAM,QAAQ,iBAAiB,QAAQ,KAAK,GAAG;AAC9G,UAAM,OAAO,MAAM,aAAa,KAAK,MAAM,OAAO,OAAO;AACzD,aAAS,KAAK,KAAK,OAAO;AAC1B,UAAM,KAAK,EAAE,MAAM,KAAK,QAAQ,MAAM,cAAc,KAAK,QAAQ,YAAY,oBAAoB,CAAC;AAClG,QAAI,KAAK,aAAa,MAAM;AAC1B,uBAAiB,KAAK;AACtB,mBAAa,KAAK,QAAQ;AAAA,IAC5B;AACA,QAAI,KAAK,UAAU,OAAW,aAAY,KAAK;AAC/C,QAAI,CAAC,mBAAmB,KAAK,QAAQ,OAAO,EAAG;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,WAAW,mBAAmB,OAAO,aAAc,YAAY,QAAQ,GAAG,QAAQ;AAAA,IAClF,GAAI,mBAAmB,QAAQ,cAAc,SAAY,EAAE,OAAO,UAAU,IAAI,CAAC;AAAA,EACnF;AACF;AAGA,SAAS,YAAY,UAA6D;AAChF,SAAO,SAAS,SAAS,SAAS,CAAC;AACrC;AAGO,SAAS,eAAe,QAAsC;AACnE,QAAM,QAAQ,OAAO,SAAS,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,OAAO,GAAG,EAAE,SAAS,IAAI,EAAE,MAAM,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;AAC7G,SAAO,GAAG,MAAM,KAAK,UAAK,CAAC,YAAY,OAAO,SAAS;AACzD;AAGA,SAAS,QAAQ,QAAuC;AACtD,SAAO,OAAO,SAAS,KAAK,CAAC,YAAY,QAAQ,YAAY,IAAI;AACnE;AAgBO,SAAS,aAAa,QAAuC;AAClE,MAAI,QAAQ,MAAM,EAAG,QAAO;AAC5B,SAAO,OAAO,SAAS,KAAK,CAAC,YAAY,QAAQ,YAAY,SAAS;AACxE;AAWO,SAAS,sBAAsB,QAAuC;AAC3E,MAAI,QAAQ,MAAM,KAAK,aAAa,MAAM,EAAG,QAAO;AACpD,SAAO,OAAO,SAAS,KAAK,CAAC,YAAY,QAAQ,YAAY,mBAAmB;AAClF;AASO,SAAS,oBAAoB,QAAuC;AACzE,MAAI,QAAQ,MAAM,EAAG,QAAO;AAI5B,WAAS,QAAiB,OAAO,OAAO,QAAQ,GAAG,iBAAiB,SAAS,QAAQ,GAAG,SAAS;AAC/F,QAAI,MAAM,QAAQ,SAAS,oBAAoB,EAAG,QAAO;AAIzD,YAAS,MAA8B;AAAA,EACzC;AACA,SAAO;AACT;;;AE/YA,IAAM,kBAA0C;AAAA,EAC9C,cACE;AAAA,EACF,QAAQ;AAAA,EACR,mBAAmB;AACrB;AAGA,IAAM,qBAAqB;AAEpB,IAAM,oBAAoB;AAU1B,IAAM,yBAAyB;AA8B/B,IAAM,qBAAN,cAAiC,MAAM;AAAA;AAAA,EAEnC;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,SAAiB,UAAmB,SAAwB,MAAM;AAC5E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS;AAAA,EAChB;AACF;AAGO,IAAM,qBAAN,cAAiC,mBAAmB;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,KAAK;AACpB,SAAK,OAAO;AAAA,EACd;AACF;AASA,eAAsB,cAAc,KAAa,UAAgC,CAAC,GAAiC;AASjH,MAAI,mBAAmB,GAAG,MAAM,MAAM;AACpC,UAAM,IAAI,mBAAmB,oBAAoB,KAAK;AAAA,EACxD;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,SAAS,EAAE,GAAG,iBAAiB,GAAG,QAAQ,QAAQ,EAAE;AAAA,IACtD;AAAA,MACE,aAAa,wBAAwB;AAAA,MACrC,GAAI,QAAQ,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;AAAA,MAC1E,GAAI,QAAQ,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,SAAS;AAAA,MACvE,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,IAC3F;AAAA,EACF;AAKA,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,YAAQ,OAAO,MAAM,gBAAgB,GAAG,WAAM,eAAe,MAAM,CAAC;AAAA,CAAI;AAAA,EAC1E;AAEA,MAAI,OAAO,aAAa,MAAM;AAK5B,QAAI,oBAAoB,MAAM,GAAG;AAC/B,YAAM,IAAI,mBAAmB,oBAAoB,KAAK;AAAA,IACxD;AACA,UAAM,WAAW,sBAAsB,MAAM;AAC7C,UAAM,IAAI,mBAAmB,WAAW,4CAA4C,mBAAmB,QAAQ;AAAA,EACjH;AAEA,SAAO,EAAE,UAAU,OAAO,UAAU,SAAS,aAAa,MAAM,EAAE;AACpE;AAWO,SAAS,eAAe,OAAsB,UAAiC;AACpF,MAAI,UAAU,QAAQ,SAAS,SAAU,QAAO;AAChD,SAAO,gBAAgB,WAAW,KAAK,CAAC,wBAAmB,WAAW,QAAQ,CAAC;AACjF;AAUA,SAAS,WAAW,GAAmB;AACrC,MAAI,KAAK,QAAQ,EAAG,QAAO,IAAI,IAAI,QAAQ,GAAG,QAAQ,CAAC,CAAC;AACxD,MAAI,KAAK,QAAQ,EAAG,QAAO,IAAI,IAAI,QAAQ,GAAG,QAAQ,CAAC,CAAC;AACxD,SAAO,GAAG,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC;AAC7C;AAGA,SAAS,cAAc,UAAmC;AACxD,QAAM,MAAM,SAAS,QAAQ,IAAI,gBAAgB;AACjD,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;AAiBA,eAAsB,mBACpB,KACA,SACyD;AACzD,QAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,cAAc,KAAK,OAAO;AAC9D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,mBAAmB,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,IAAI,OAAO,SAAS,MAAM;AAAA,EAClG;AACA,MAAI,SAAS;AACX,UAAM,IAAI,mBAAmB,0DAA0D,KAAK;AAAA,EAC9F;AAQA,QAAM,WAAW,eAAe,cAAc,QAAQ,GAAG,QAAQ,QAAQ;AACzE,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI,mBAAmB,QAAQ;AAAA,EACvC;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAEvD,QAAM,SAAS,eAAe,OAAO,YAAY,QAAQ,QAAQ;AACjE,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI,mBAAmB,MAAM;AAAA,EACrC;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc,EAAE;AACrE;","names":[]}

package/dist/chunk-XYKODRQR.js

@@ -0,0 +1,191 @@
+import {
+  readRenderState,
+  recordSeen
+} from "./chunk-OBQ5YUOZ.js";
+import {
+  GLOBAL_PROMPT_FILE,
+  ideaBaseline,
+  isVideoBlueprint,
+  readIdeaAnchor,
+  recordedChanges
+} from "./chunk-6WVYBY2G.js";
+import {
+  loadCompositionMeta
+} from "./chunk-DWPOAU4Z.js";
+import {
+  parseRefExpr
+} from "./chunk-X3GWGFZP.js";
+import {
+  resolveAdaptFormats
+} from "./chunk-MCJ5I5LR.js";
+import {
+  apiPost
+} from "./chunk-GFWWHCBF.js";
+
+// src/commands/canvas/output-ratio.ts
+import { readFile } from "fs/promises";
+import path from "path";
+function definitionFormats(markdown) {
+  const front = markdown.match(/^---\n([\s\S]*?)\n---/)?.[1];
+  if (!front) return [];
+  const clean = (s) => s.trim().replace(/^["']|["']$/g, "");
+  const flow = front.match(/^formats:\s*\[([^\]]*)\]/m);
+  if (flow) return (flow[1] ?? "").split(",").map(clean).filter(Boolean);
+  const block = front.match(/^formats:\s*\n((?:\s+-\s+.*\n?)+)/m);
+  if (!block) return [];
+  return (block[1] ?? "").split("\n").map((l) => l.replace(/^\s+-\s+/, "")).map(clean).filter(Boolean);
+}
+function reduce(width, height) {
+  const gcd = (a, b) => b === 0 ? a : gcd(b, a % b);
+  const d = gcd(width, height);
+  return `${width / d}:${height / d}`;
+}
+async function ratiosOf(nodes, id, seen) {
+  const node = nodes.get(id);
+  if (!node || seen.has(id)) return null;
+  seen.add(id);
+  const p = node.params ?? {};
+  switch (node.type) {
+    case "image_generate":
+      return typeof p.aspect_ratio === "string" ? [p.aspect_ratio] : null;
+    case "image_aspect_adapt":
+      return [...resolveAdaptFormats(p)];
+    case "hyperframe_snapshot": {
+      if (typeof p.composition !== "string") return null;
+      const meta = await loadCompositionMeta(p.composition).catch(() => null);
+      return meta ? [reduce(meta.width, meta.height)] : null;
+    }
+    case "collect": {
+      const images = node.inputs?.images;
+      if (!Array.isArray(images)) return null;
+      const out = [];
+      for (const entry of images) {
+        const ref = typeof entry === "string" ? parseRefExpr(entry) : null;
+        if (!ref || ref.kind !== "ref") return null;
+        const upstream = await ratiosOf(nodes, ref.nodeId, seen);
+        if (!upstream) return null;
+        out.push(ref.index !== void 0 && upstream.length > 1 ? upstream[ref.index] ?? "" : upstream[0] ?? "");
+      }
+      return out.filter(Boolean);
+    }
+    default:
+      return null;
+  }
+}
+async function producedRatios(canvas) {
+  const c = canvas;
+  if (!Array.isArray(c?.nodes) || typeof c?.output?.node !== "string") return null;
+  const nodes = new Map(c.nodes.flatMap((n) => typeof n.id === "string" ? [[n.id, n]] : []));
+  return ratiosOf(nodes, c.output.node, /* @__PURE__ */ new Set());
+}
+function value(ratio) {
+  const [w, h] = ratio.split(":").map(Number);
+  return w && h ? w / h : null;
+}
+function outputRatioWarnings(declared, produced) {
+  if (!produced || produced.length === 0) return [];
+  const shapes = produced.flatMap((r) => value(r) ?? []);
+  return declared.flatMap((format) => {
+    const want = value(format);
+    if (want === null || shapes.some((s) => Math.abs(s / want - 1) <= 0.02)) return [];
+    return [
+      {
+        path: "output",
+        code: "OUTPUT_RATIO_MISMATCH",
+        severity: "warning",
+        message: `_definition.md declares ${format}, but this canvas delivers ${produced.join(", ")}. A ${format} placement would get the wrong shape: re-scaffold with that format, or fix the formats the creative declares.`
+      }
+    ];
+  });
+}
+async function outputRatioWarningsFor(canvas, canvasPath) {
+  const definition = await readFile(path.join(path.dirname(canvasPath), "_definition.md"), "utf8").catch(() => null);
+  if (!definition) return [];
+  return outputRatioWarnings(definitionFormats(definition), await producedRatios(canvas));
+}
+
+// src/commands/canvas/shown-version.ts
+import { z } from "zod";
+var ShownResponse = z.object({
+  data: z.object({
+    runId: z.string(),
+    sourceSha: z.string().optional(),
+    createdAt: z.number(),
+    canvasSnapshotUrl: z.string().optional()
+  })
+});
+var SnapshotEntry = z.object({ path: z.string(), url: z.string() });
+var SnapshotFiles = z.object({ canvas: SnapshotEntry.optional(), files: z.array(SnapshotEntry) });
+var HISTORY = {
+  shown: async (slug) => ShownResponse.parse(await apiPost("/api/creatives/run", { slug })).data,
+  file: async (url) => {
+    const res = await fetch(url);
+    return res.ok ? res.json() : null;
+  },
+  text: async (url) => {
+    const res = await fetch(url);
+    return res.ok ? res.text() : null;
+  }
+};
+async function shownVersion(canvasRoot, slug, sources = HISTORY) {
+  const here = await readRenderState(canvasRoot, slug);
+  if (here.rendered) return here;
+  const run = await sources.shown(slug).catch(() => null);
+  if (!run) return here;
+  const drawn = run.canvasSnapshotUrl ? await drawnFiles(run.canvasSnapshotUrl, sources) : {};
+  return {
+    ...here,
+    rendered: { sourceSha: run.sourceSha ?? "", runId: run.runId, at: run.createdAt },
+    ...drawn.prompt !== void 0 ? { prompt: drawn.prompt } : {},
+    ...drawn.definition !== void 0 ? { definition: drawn.definition } : {},
+    ...drawn.video ? { video: drawn.video } : {}
+  };
+}
+async function drawnFiles(manifestUrl, sources) {
+  const manifest = SnapshotFiles.safeParse(await sources.file(manifestUrl).catch(() => null));
+  const files = manifest.success ? manifest.data.files : [];
+  const urlOf = (file) => files.find((f) => f.path === file)?.url;
+  const promptUrl = urlOf(GLOBAL_PROMPT_FILE);
+  const definitionUrl = urlOf("_definition.md");
+  const read = (url) => url ? sources.file(url).catch(() => null) : Promise.resolve(null);
+  const sceneEntries = files.filter((f) => /^scenes\/[^/]+\.json$/.test(f.path)).sort((a, b) => a.path.localeCompare(b.path));
+  const [prompt, definition, scenes, canvas, adSpec] = await Promise.all([
+    read(promptUrl),
+    definitionUrl ? sources.text(definitionUrl).catch(() => null) : null,
+    Promise.all(sceneEntries.map((f) => read(f.url))),
+    read(manifest.success ? manifest.data.canvas?.url : void 0),
+    read(urlOf("ad.spec.json"))
+  ]);
+  return {
+    ...prompt !== null && prompt !== void 0 ? { prompt } : {},
+    ...typeof definition === "string" ? { definition } : {},
+    video: { scenes: scenes.filter((s) => s !== null), canvas, adSpec }
+  };
+}
+
+// src/commands/canvas/shown-anchor.ts
+async function shownBaseline(opts) {
+  const state = await readRenderState(opts.canvasRoot, opts.slug);
+  const known = opts.turnId !== void 0 && state.seen?.turnId === opts.turnId;
+  let fallback;
+  if (!known && !state.anchor) {
+    const shown = opts.shown ?? await shownVersion(opts.canvasRoot, opts.slug, opts.sources);
+    if (shown.rendered && shown.prompt !== void 0) {
+      const video = typeof shown.prompt === "object" && shown.prompt !== null && isVideoBlueprint(shown.prompt);
+      const recorded = shown.video;
+      const unrecorded = video && (!recorded || recorded.canvas === null || recorded.canvas === void 0);
+      const anchor = unrecorded ? void 0 : (await readIdeaAnchor(opts.creativeDir, { spec: shown.prompt, ...video && recorded ? { recorded } : {} }))?.anchor;
+      if (anchor) fallback = { ...anchor, changes: shown.definition ? recordedChanges(shown.definition) : [] };
+    }
+  }
+  const { baseline, seen } = ideaBaseline(state, opts.turnId, fallback);
+  if (seen && opts.record) await recordSeen(opts.canvasRoot, opts.slug, seen);
+  return baseline ? { baseline } : {};
+}
+
+export {
+  outputRatioWarningsFor,
+  shownVersion,
+  shownBaseline
+};
+//# sourceMappingURL=chunk-XYKODRQR.js.map