@koda-sl/baker-cli 0.173.1 → 0.174.0

package/README.md

@@ -820,7 +820,7 @@ adsets              # filter by --campaign-id
 ads                 # filter by --adset-id or --campaign-id
 creatives           # list per account, or fetch single via --creative-id
 audiences           # custom audiences (incl. lookalikes)
-pixels              # list, or --stats for one --pixel-id
+pixels              # list, or --stats for one --pixel-id (see "Restricted pixel fields")
 activities          # account audit log, ~90d retention
 insights            # see "Smart defaults" above
 preview             # iframe HTML for a creative or ad in a given ad_format
@@ -835,6 +835,12 @@ The HTTP backend exposes more endpoints (catalogs, ad-studies, ad-images, labels
 - All cached actions are keyed per company; two companies that connect to the same Meta account never share cache entries.
 - `--skip-cache` on any command forces a re-fetch.
 
+#### Restricted pixel fields
+
+A Pixel/Dataset is a Business asset assigned separately from the ad account, and Meta refuses the *whole* read with `code 200` if any requested field needs a role in the owning Business — so an agency with partner access used to get nothing back. `pixels` now retries without those fields (`code`, `creator`, `owner_business`, `data_use_setting`, `enable_automatic_matching`, `first_party_cookie_status`) and prints the usual `{ ok: true, data, warnings }` with a `PIXEL_FIELDS_RESTRICTED` warning naming them (the HTTP endpoint carries them as `restrictedFields`). IDs, names, creation and last-fired times are always complete; a missing install code means "not visible to us", not "not configured". As elsewhere in the family, `--output csv|jsonl|md` prints rows only — use the default JSON to see the warning.
+
+A `FORBIDDEN` from any Meta command is a permission refusal on a live connection, not a missing one. Meta uses one code for two causes, so the `error.fix` gives the agent the test rather than a verdict: if other reads on the account also fail the connection is short a scope and only a reconnect widens it; if they work, the asset needs assigning in Business settings and reconnecting cannot help.
+
 #### Notes / gotchas
 
 - `spend` is a decimal string in account currency, not an integer.

package/dist/{chunk-JOPBGFXC.js → chunk-7QMWNMRW.js}

@@ -1,19 +1,32 @@
 import {
   handleConnectionError,
+  needsConnectionFix,
   writeAdsJson
-} from "./chunk-R4PG6VCS.js";
+} from "./chunk-TFPZLUVM.js";
 import {
   ApiError
-} from "./chunk-LVCBCJWF.js";
+} from "./chunk-ZH6ZNYPB.js";
 import {
   getEnv
 } from "./chunk-RK67WL4O.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
+function metaForbiddenFix(message) {
+  return {
+    action: "reject",
+    explanation: [
+      message,
+      "This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.",
+      "If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.",
+      "If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it \u2014 the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources \u2192 Datasets for a pixel).",
+      "Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why \u2014 never present the task as verified when this step was skipped."
+    ].join("\n\n")
+  };
+}
 function handleMetaError(err) {
   if (err instanceof ApiError) {
-    if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+    if (needsConnectionFix(err.code, err.message)) {
       handleConnectionError("meta_ads", err.message);
     }
     const envelope = {
@@ -21,7 +34,7 @@ function handleMetaError(err) {
       error: {
         code: err.code,
         message: err.message,
-        fix: { action: "reject", explanation: err.message },
+        fix: err.code === "FORBIDDEN" ? metaForbiddenFix(err.message) : { action: "reject", explanation: err.message },
         retryable: err.code === "RATE_LIMITED" || err.code === "INTERNAL_ERROR"
       }
     };
@@ -86,6 +99,7 @@ function resolveEffectiveStatus(args) {
 }
 
 export {
+  metaForbiddenFix,
   handleMetaError,
   resolveAccountIdArg,
   getDateRange,
@@ -94,4 +108,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-JOPBGFXC.js.map
+//# sourceMappingURL=chunk-7QMWNMRW.js.map

package/dist/chunk-7QMWNMRW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ads/meta/shared.ts"],"sourcesContent":["import { ApiError } from \"../../../client.ts\";\nimport { getEnv } from \"../../../env.ts\";\nimport { handleConnectionError, needsConnectionFix } from \"../../../error-handler.ts\";\nimport { writeAdsJson } from \"../output.ts\";\nimport type { AdsErrorEnvelope, QueryFix } from \"../types.ts\";\n\nconst DAY_MS = 86_400_000;\n\n/**\n * Meta answers a permission refusal (Graph codes 200/10/294) with a bare\n * \"Permissions error\" that covers two causes needing opposite remedies: a\n * consent grant the connection never got — nothing validates Meta's granted\n * scopes after connect, unlike HubSpot's `requireCapability` — or a role the\n * user lacks on one asset, since a Pixel/Dataset, Page or catalog lives in a\n * Business and is assigned separately from the ad account. Only the blast radius\n * separates them, so hand the agent that test rather than a verdict: guessing\n * \"reconnect\" wastes the user's time on an unassigned asset, and ruling it out\n * strands a connection that really is short a scope.\n */\nexport function metaForbiddenFix(message: string): QueryFix {\n  return {\n    action: \"reject\",\n    explanation: [\n      message,\n      \"This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.\",\n      \"If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.\",\n      \"If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it — the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources → Datasets for a pixel).\",\n      \"Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why — never present the task as verified when this step was skipped.\",\n    ].join(\"\\n\\n\"),\n  };\n}\n\nexport function handleMetaError(err: unknown): never {\n  if (err instanceof ApiError) {\n    if (needsConnectionFix(err.code, err.message)) {\n      handleConnectionError(\"meta_ads\", err.message);\n    }\n    const envelope: AdsErrorEnvelope = {\n      ok: false,\n      error: {\n        code: err.code,\n        message: err.message,\n        fix: err.code === \"FORBIDDEN\" ? metaForbiddenFix(err.message) : { action: \"reject\", explanation: err.message },\n        retryable: err.code === \"RATE_LIMITED\" || err.code === \"INTERNAL_ERROR\",\n      },\n    };\n    writeAdsJson(envelope);\n    process.exit(1);\n  }\n  const message = err instanceof Error ? err.message : \"Unexpected error\";\n  writeAdsJson({ ok: false, error: { code: \"NETWORK_ERROR\", message } });\n  process.exit(1);\n}\n\nconst ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;\n\n/** Pull the default Meta ad account ID from `--account-id` arg or `BAKER_META_AD_ACCOUNT_ID` env. */\nexport function resolveAccountIdArg(args: Record<string, unknown>): string {\n  const fromArgs = args[\"account-id\"] as string | undefined;\n  const id = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;\n  if (!id) {\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"MISSING_ACCOUNT_ID\",\n        message: \"Pass --account-id or set BAKER_META_AD_ACCOUNT_ID. Run `baker ads meta accounts` to find IDs.\",\n      },\n    });\n    process.exit(1);\n  }\n  if (!ACCOUNT_ID_RE.test(id)) {\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"INVALID_ACCOUNT_ID\",\n        message: `Invalid account ID \"${id}\". Expected numeric ID, optionally prefixed with \"act_\".`,\n      },\n    });\n    process.exit(1);\n  }\n  return id.startsWith(\"act_\") ? id : `act_${id}`;\n}\n\nexport function getDateRange(args: Record<string, unknown>): { datePreset?: string; since?: string; until?: string } {\n  const datePreset = args[\"date-preset\"] as string | undefined;\n  const since = args.since as string | undefined;\n  const until = args.until as string | undefined;\n  if (since && until) return { since, until };\n  return { datePreset: datePreset ?? \"last_7d\" };\n}\n\nexport function todayIso(): string {\n  return new Date().toISOString().slice(0, 10);\n}\n\nexport function daysAgoIso(days: number): string {\n  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);\n}\n\nexport function csvOrJson(args: Record<string, unknown>): string {\n  return (args.output as string | undefined) ?? \"json\";\n}\n\n/**\n * Default to ACTIVE-only on listings — that's almost always what an AI agent or\n * a human glance wants. Pass `--effective-status ACTIVE,PAUSED` to override, or\n * `--all-statuses` to drop the filter entirely.\n */\nexport function resolveEffectiveStatus(args: Record<string, unknown>): string | undefined {\n  if (args[\"all-statuses\"]) {\n    return undefined;\n  }\n  const explicit = args[\"effective-status\"] as string | undefined;\n  if (explicit) {\n    return explicit;\n  }\n  return \"ACTIVE\";\n}\n"],"mappings":";;;;;;;;;;;;;AAMA,IAAM,SAAS;AAaR,SAAS,iBAAiB,SAA2B;AAC1D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,MAAM;AAAA,EACf;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,MAAI,eAAe,UAAU;AAC3B,QAAI,mBAAmB,IAAI,MAAM,IAAI,OAAO,GAAG;AAC7C,4BAAsB,YAAY,IAAI,OAAO;AAAA,IAC/C;AACA,UAAM,WAA6B;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,KAAK,IAAI,SAAS,cAAc,iBAAiB,IAAI,OAAO,IAAI,EAAE,QAAQ,UAAU,aAAa,IAAI,QAAQ;AAAA,QAC7G,WAAW,IAAI,SAAS,kBAAkB,IAAI,SAAS;AAAA,MACzD;AAAA,IACF;AACA,iBAAa,QAAQ;AACrB,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAa,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,iBAAiB,QAAQ,EAAE,CAAC;AACrE,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,gBAAgB;AAGf,SAAS,oBAAoB,MAAuC;AACzE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,KAAK,YAAY,OAAO,EAAE;AAChC,MAAI,CAAC,IAAI;AACP,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,CAAC,cAAc,KAAK,EAAE,GAAG;AAC3B,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,uBAAuB,EAAE;AAAA,MACpC;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO,GAAG,WAAW,MAAM,IAAI,KAAK,OAAO,EAAE;AAC/C;AAEO,SAAS,aAAa,MAAwF;AACnH,QAAM,aAAa,KAAK,aAAa;AACrC,QAAM,QAAQ,KAAK;AACnB,QAAM,QAAQ,KAAK;AACnB,MAAI,SAAS,MAAO,QAAO,EAAE,OAAO,MAAM;AAC1C,SAAO,EAAE,YAAY,cAAc,UAAU;AAC/C;AAEO,SAAS,WAAmB;AACjC,UAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC7C;AAEO,SAAS,WAAW,MAAsB;AAC/C,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACvE;AAEO,SAAS,UAAU,MAAuC;AAC/D,SAAQ,KAAK,UAAiC;AAChD;AAOO,SAAS,uBAAuB,MAAmD;AACxF,MAAI,KAAK,cAAc,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,KAAK,kBAAkB;AACxC,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-R4PG6VCS.js → chunk-TFPZLUVM.js}

@@ -1,7 +1,7 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-LVCBCJWF.js";
+} from "./chunk-ZH6ZNYPB.js";
 import {
   getEnv
 } from "./chunk-RK67WL4O.js";
@@ -63,11 +63,17 @@ function handleConnectionError(platform, originalMessage) {
   process.exit(1);
 }
 function isNotConnectedError(code, message) {
-  if (code !== "NOT_FOUND" && code !== "UNAUTHORIZED") {
+  if (code !== "NOT_FOUND" && code !== "UNAUTHORIZED" && code !== "FORBIDDEN") {
     return false;
   }
   return /no .* connection found|not connected|no .* (selected|picked)|is not in .* connected/i.test(message);
 }
+function needsConnectionFix(code, message) {
+  if (code === "UNAUTHORIZED" || code === "NOT_FOUND") {
+    return true;
+  }
+  return code === "FORBIDDEN" && isNotConnectedError(code, message);
+}
 
 // src/commands/ads/cache.ts
 import { createHash } from "crypto";
@@ -282,10 +288,11 @@ export {
   connectionFixExplanation,
   handleConnectionError,
   isNotConnectedError,
+  needsConnectionFix,
   writeAdsJson,
   writeJsonEnvelope,
   toCsvRow,
   writeAdsOutput,
   resolveCustomerId
 };
-//# sourceMappingURL=chunk-R4PG6VCS.js.map
+//# sourceMappingURL=chunk-TFPZLUVM.js.map

package/dist/chunk-TFPZLUVM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/error-handler.ts","../src/commands/ads/cache.ts","../src/commands/ads/output.ts"],"sourcesContent":["import { writeJsonEnvelope } from \"./commands/ads/output.ts\";\n\ntype ConnectionPlatform = \"google_ads\" | \"ga4\" | \"gsc\" | \"x_ads\" | \"meta_ads\" | \"linkedin_ads\";\n\n/**\n * Platforms the agent can get connected without the user leaving the chat, via\n * the blocking `request_connection` tool, and the id that tool expects. Meta and\n * X Ads are absent on purpose — they are still coming soon, so the only honest\n * answer there is the dashboard.\n */\nconst REQUEST_CONNECTION_PLATFORM: Partial<Record<ConnectionPlatform, string>> = {\n  google_ads: \"google-ads\",\n  ga4: \"google-analytics\",\n  gsc: \"google-search-console\",\n  linkedin_ads: \"linkedin\",\n};\n\nconst PLATFORM_NAME: Record<ConnectionPlatform, string> = {\n  google_ads: \"Google Ads\",\n  ga4: \"Google Analytics 4\",\n  gsc: \"Google Search Console\",\n  x_ads: \"X Ads\",\n  meta_ads: \"Meta Ads\",\n  linkedin_ads: \"LinkedIn Ads\",\n};\n\n/**\n * How to tell the agent to get a platform connected. Never \"send them to\n * Settings\" for a platform `request_connection` covers — that ends the turn on a\n * wall the agent could have opened itself. The fallback line matters too: a\n * Session booted before the tool shipped does not have it, and the agent must\n * still be able to say where the connect button is instead of stalling.\n */\nexport function connectionFixExplanation(platform: ConnectionPlatform): string {\n  const name = PLATFORM_NAME[platform];\n  const slug = REQUEST_CONNECTION_PLATFORM[platform];\n  if (slug === undefined) {\n    return (\n      `${name} is not connected for this company, and it cannot be connected from the chat yet. Tell the user to ` +\n      `connect it in the dashboard under Brain → Integrations → Tools → ${name}. Do not fail the whole job: say ` +\n      `what stays unavailable and carry on with the rest.`\n    );\n  }\n  return (\n    `${name} is not connected for this company (or no account has been picked). Do NOT send the user to Settings ` +\n    `and do NOT end the turn here — call the \\`request_connection\\` tool with { platform: \"${slug}\", reason } and ` +\n    `they connect and pick their accounts from inside the chat. If that tool is not available to you, tell them ` +\n    `exactly where to do it: dashboard → Brain → Integrations → Tools → ${name}. Either way, carry on with the ` +\n    `rest of the task and say what stays unavailable until it is connected.`\n  );\n}\n\n/**\n * Shared error handler for \"No Connection\" scenarios.\n * Provides a structured error for AI agents with a suggested fix and alternative commands.\n */\nexport function handleConnectionError(platform: ConnectionPlatform, originalMessage?: string): never {\n  const platformName = PLATFORM_NAME[platform];\n\n  const alternative = {\n    google_ads: \"keywords-for-site or research advertisers\",\n    ga4: \"lighthouse for page performance\",\n    gsc: \"keywords-for-site or research keyword-gap\",\n    x_ads: \"research advertisers\",\n    meta_ads: \"research advertisers or research keyword-ideas\",\n    linkedin_ads: \"research advertisers (LinkedIn Ad Library) or research keyword-ideas\",\n  }[platform];\n\n  const code = {\n    google_ads: \"NO_GOOGLE_ADS_CONNECTION\",\n    ga4: \"NO_GA4_CONNECTION\",\n    gsc: \"NO_GSC_CONNECTION\",\n    x_ads: \"NO_X_ADS_CONNECTION\",\n    meta_ads: \"NO_META_ADS_CONNECTION\",\n    linkedin_ads: \"NO_LINKEDIN_ADS_CONNECTION\",\n  }[platform];\n\n  const envelope = {\n    ok: false,\n    error: {\n      code,\n      message: originalMessage || `No ${platformName} connection found for this company.`,\n      fix: {\n        action: REQUEST_CONNECTION_PLATFORM[platform] === undefined ? \"ask_user\" : \"request_connection\",\n        explanation: `${connectionFixExplanation(platform)} (Optional fallback for estimated external insights: 'baker research ${alternative}'.)`,\n      },\n      retryable: false,\n    },\n  };\n\n  writeJsonEnvelope(envelope);\n  process.exit(1);\n}\n\n/**\n * Does this API failure mean \"the platform isn't connected\"? The read commands\n * surface the backend's own 404/403 verbatim, so the connect fix has to be\n * recognised from the code the client mapped it to plus the message.\n */\nexport function isNotConnectedError(code: string, message: string): boolean {\n  if (code !== \"NOT_FOUND\" && code !== \"UNAUTHORIZED\" && code !== \"FORBIDDEN\") {\n    return false;\n  }\n  // The last alternative is the write-path 403 (\"customer X is not in this\n  // company's connected Google Ads accounts\") — a different sentence for the\n  // same remedy: connect, and pick the account.\n  return /no .* connection found|not connected|no .* (selected|picked)|is not in .* connected/i.test(message);\n}\n\n/**\n * Does this failure warrant the connect form? A dead token (401) or a missing\n * connection (404) always does. A 403 only does when the backend says the\n * account was never picked — an asset-level refusal on a live connection must\n * not send the user to reconnect, because reconnecting cannot grant it.\n */\nexport function needsConnectionFix(code: string, message: string): boolean {\n  if (code === \"UNAUTHORIZED\" || code === \"NOT_FOUND\") {\n    return true;\n  }\n  return code === \"FORBIDDEN\" && isNotConnectedError(code, message);\n}\n","import { createHash } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { CacheEntry } from \"./types.ts\";\n\nconst CACHE_DIR = join(homedir(), \".baker\", \"cache\", \"ads\");\n\nfunction ensureDir(dir: string): void {\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n}\n\nfunction hashKey(key: string): string {\n  return createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 16);\n}\n\nfunction cachePath(category: string, key: string): string {\n  const dir = join(CACHE_DIR, category);\n  ensureDir(dir);\n  return join(dir, `${hashKey(key)}.json`);\n}\n\nexport function cacheGet<T>(category: string, key: string): CacheEntry<T> | null {\n  const path = cachePath(category, key);\n  if (!existsSync(path)) {\n    return null;\n  }\n  try {\n    const raw = readFileSync(path, \"utf-8\");\n    const entry = JSON.parse(raw) as CacheEntry<T>;\n    if (entry.expiresAt < Date.now()) {\n      rmSync(path, { force: true });\n      return null;\n    }\n    return entry;\n  } catch {\n    rmSync(path, { force: true });\n    return null;\n  }\n}\n\nexport function cacheSet<T>(\n  category: string,\n  key: string,\n  data: T,\n  ttlMs: number,\n  fields?: Record<string, string>,\n): void {\n  const path = cachePath(category, key);\n  const entry: CacheEntry<T> = {\n    expiresAt: Date.now() + ttlMs,\n    data,\n    fields,\n  };\n  writeFileSync(path, JSON.stringify(entry), \"utf-8\");\n}\n\nconst HOUR = 60 * 60 * 1000;\nconst MINUTE = 60 * 1000;\n\nexport function getQueryTtl(query: string): number {\n  const upper = query.toUpperCase();\n  if (upper.includes(\"TODAY\")) {\n    return 15 * MINUTE;\n  }\n  if (upper.includes(\"LAST_7_DAYS\") || upper.includes(\"LAST_14_DAYS\")) {\n    return 1 * HOUR;\n  }\n  // Historical data (BETWEEN, LAST_30_DAYS, LAST_90_DAYS, etc.)\n  return 6 * HOUR;\n}\n\nexport function buildQueryCacheKey(customerId: string, query: string): string {\n  const today = new Date().toISOString().slice(0, 10);\n  return `${customerId}:${today}:${query.trim().replace(/\\s+/g, \" \")}`;\n}\n\ninterface CachedAccount {\n  id: string;\n  access_type: \"direct\" | \"managed\";\n  manager_id?: string;\n}\n\nexport function getManagerIdForCustomer(customerId: string): string | undefined {\n  const cached = cacheGet<CachedAccount[]>(\"accounts\", \"list\");\n  if (!cached) return undefined;\n  const account = cached.data.find((a) => a.id === customerId);\n  if (account?.access_type === \"managed\") return account.manager_id;\n  return undefined;\n}\n","import { ApiError, apiGet } from \"../../client.ts\";\nimport { getEnv } from \"../../env.ts\";\nimport { handleConnectionError, isNotConnectedError } from \"../../error-handler.ts\";\nimport type { QueryContext } from \"../../geo-context.ts\";\nimport { cacheGet, cacheSet } from \"./cache.ts\";\nimport type { AdsErrorEnvelope, AdsFileSummary, AdsSuccessEnvelope } from \"./types.ts\";\n\ntype AdsOutput =\n  | AdsSuccessEnvelope<unknown>\n  | AdsErrorEnvelope\n  | AdsFileSummary\n  | { ok: true; data: unknown; query_context?: QueryContext; cached?: true; fields?: Record<string, string> }\n  | { ok: false; error: { code: string; message: string } };\n\nexport function writeAdsJson(envelope: AdsOutput): void {\n  process.stdout.write(`${JSON.stringify(envelope, null, 2)}\\n`);\n}\n\nexport function writeJsonEnvelope(envelope: Record<string, unknown>): void {\n  process.stdout.write(`${JSON.stringify(envelope, null, 2)}\\n`);\n}\n\nexport function toCsvRow(values: string[]): string {\n  return values\n    .map((v) => {\n      if (v.includes(\",\") || v.includes('\"') || v.includes(\"\\n\")) {\n        return `\"${v.replace(/\"/g, '\"\"')}\"`;\n      }\n      return v;\n    })\n    .join(\",\");\n}\n\nfunction flattenRow(row: Record<string, unknown>): Record<string, string> {\n  const flat: Record<string, string> = {};\n  for (const [key, val] of Object.entries(row)) {\n    flat[key] = typeof val === \"object\" && val !== null ? JSON.stringify(val) : String(val ?? \"\");\n  }\n  return flat;\n}\n\nfunction writeAdsCsv(data: Array<Record<string, unknown>>, fields?: string[]): void {\n  if (data.length === 0) return;\n  const cols = fields ?? Object.keys(data[0] ?? {});\n  process.stdout.write(`${toCsvRow(cols)}\\n`);\n  for (const row of data) {\n    const flat = flattenRow(row);\n    process.stdout.write(`${toCsvRow(cols.map((f) => flat[f] ?? \"\"))}\\n`);\n  }\n}\n\nfunction writeAdsJsonl(data: Array<Record<string, unknown>>): void {\n  for (const row of data) {\n    process.stdout.write(`${JSON.stringify(row)}\\n`);\n  }\n}\n\nfunction writeAdsMd(data: Array<Record<string, unknown>>, fields?: string[]): void {\n  if (data.length === 0) return;\n  const cols = fields ?? Object.keys(data[0] ?? {});\n  process.stdout.write(`| ${cols.join(\" | \")} |\\n`);\n  process.stdout.write(`| ${cols.map(() => \"---\").join(\" | \")} |\\n`);\n  for (const row of data) {\n    const flat = flattenRow(row);\n    process.stdout.write(`| ${cols.map((f) => flat[f] ?? \"\").join(\" | \")} |\\n`);\n  }\n}\n\nexport function writeAdsOutput(data: Array<Record<string, unknown>>, format: string, fields?: string[]): void {\n  switch (format) {\n    case \"csv\":\n      writeAdsCsv(data, fields);\n      break;\n    case \"jsonl\":\n      writeAdsJsonl(data);\n      break;\n    case \"md\":\n      writeAdsMd(data, fields);\n      break;\n    default:\n      writeAdsJson({ ok: true, data });\n  }\n}\n\ninterface AccountInfo {\n  id: string;\n  name: string;\n  access_type: \"direct\" | \"managed\";\n  level: number;\n  manager_id?: string;\n}\n\nasync function fetchAccounts(useCache = true): Promise<AccountInfo[]> {\n  if (useCache) {\n    const cached = cacheGet<AccountInfo[]>(\"accounts\", \"list\");\n    if (cached) return cached.data;\n  }\n  const params = !useCache ? { \"skip-cache\": \"true\" } : undefined;\n  const data = await apiGet<AccountInfo[]>(\"/api/ads/google/accounts\", params);\n  if (useCache) {\n    cacheSet(\"accounts\", \"list\", data, 60 * 60 * 1000);\n  }\n  return data;\n}\n\nexport async function resolveCustomerId(args: Record<string, unknown>): Promise<string> {\n  const fromArgs = args[\"customer-id\"] as string | undefined;\n  const customerId = fromArgs || getEnv().BAKER_GOOGLE_ADS_CUSTOMER_ID;\n\n  if (customerId) {\n    if (!/^\\d{10}$/.test(customerId)) {\n      writeAdsJson({\n        ok: false,\n        error: {\n          code: \"INVALID_CUSTOMER_ID\",\n          message:\n            \"Customer ID must be exactly 10 digits without dashes. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID.\",\n        },\n      });\n      process.exit(1);\n    }\n    return customerId;\n  }\n\n  const useCache = !args[\"no-cache\"];\n\n  try {\n    const accounts = await fetchAccounts(useCache);\n    const [single] = accounts;\n    if (accounts.length === 1 && single) {\n      process.stderr.write(`Using account \"${single.name}\" (${single.id})\\n`);\n      return single.id;\n    }\n    if (accounts.length === 0) {\n      handleConnectionError(\"google_ads\");\n    }\n    const list = accounts.map((a) => `  ${a.id}  ${a.name}`).join(\"\\n\");\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"MULTIPLE_ACCOUNTS\",\n        message: `Multiple accounts found. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID:\\n${list}`,\n      },\n    });\n    process.exit(1);\n  } catch (err) {\n    // \"No connection\" reaches here as a 404/403 from the accounts lookup. Reporting it as\n    // an unusable customer id sends the agent hunting for an id that cannot exist yet.\n    if (err instanceof ApiError && isNotConnectedError(err.code, err.message)) {\n      handleConnectionError(\"google_ads\", err.message);\n    }\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"INVALID_CUSTOMER_ID\",\n        message: \"Could not auto-detect account. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID.\",\n      },\n    });\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;AAUA,IAAM,8BAA2E;AAAA,EAC/E,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,cAAc;AAChB;AAEA,IAAM,gBAAoD;AAAA,EACxD,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,OAAO;AAAA,EACP,UAAU;AAAA,EACV,cAAc;AAChB;AASO,SAAS,yBAAyB,UAAsC;AAC7E,QAAM,OAAO,cAAc,QAAQ;AACnC,QAAM,OAAO,4BAA4B,QAAQ;AACjD,MAAI,SAAS,QAAW;AACtB,WACE,GAAG,IAAI,sLAC6D,IAAI;AAAA,EAG5E;AACA,SACE,GAAG,IAAI,mMACkF,IAAI,qNAEvB,IAAI;AAG9E;AAMO,SAAS,sBAAsB,UAA8B,iBAAiC;AACnG,QAAM,eAAe,cAAc,QAAQ;AAE3C,QAAM,cAAc;AAAA,IAClB,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,IACP,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,EAAE,QAAQ;AAEV,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,IACP,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,EAAE,QAAQ;AAEV,QAAM,WAAW;AAAA,IACf,IAAI;AAAA,IACJ,OAAO;AAAA,MACL;AAAA,MACA,SAAS,mBAAmB,MAAM,YAAY;AAAA,MAC9C,KAAK;AAAA,QACH,QAAQ,4BAA4B,QAAQ,MAAM,SAAY,aAAa;AAAA,QAC3E,aAAa,GAAG,yBAAyB,QAAQ,CAAC,wEAAwE,WAAW;AAAA,MACvI;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AAEA,oBAAkB,QAAQ;AAC1B,UAAQ,KAAK,CAAC;AAChB;AAOO,SAAS,oBAAoB,MAAc,SAA0B;AAC1E,MAAI,SAAS,eAAe,SAAS,kBAAkB,SAAS,aAAa;AAC3E,WAAO;AAAA,EACT;AAIA,SAAO,uFAAuF,KAAK,OAAO;AAC5G;AAQO,SAAS,mBAAmB,MAAc,SAA0B;AACzE,MAAI,SAAS,kBAAkB,SAAS,aAAa;AACnD,WAAO;AAAA,EACT;AACA,SAAO,SAAS,eAAe,oBAAoB,MAAM,OAAO;AAClE;;;ACxHA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,WAAW,cAAc,QAAQ,qBAAqB;AAC3E,SAAS,eAAe;AACxB,SAAS,YAAY;AAGrB,IAAM,YAAY,KAAK,QAAQ,GAAG,UAAU,SAAS,KAAK;AAE1D,SAAS,UAAU,KAAmB;AACpC,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACpC;AACF;AAEA,SAAS,QAAQ,KAAqB;AACpC,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACnE;AAEA,SAAS,UAAU,UAAkB,KAAqB;AACxD,QAAM,MAAM,KAAK,WAAW,QAAQ;AACpC,YAAU,GAAG;AACb,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,CAAC,OAAO;AACzC;AAEO,SAAS,SAAY,UAAkB,KAAmC;AAC/E,QAAM,OAAO,UAAU,UAAU,GAAG;AACpC,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,MAAM,aAAa,MAAM,OAAO;AACtC,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,YAAY,KAAK,IAAI,GAAG;AAChC,aAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SACd,UACA,KACA,MACA,OACA,QACM;AACN,QAAM,OAAO,UAAU,UAAU,GAAG;AACpC,QAAM,QAAuB;AAAA,IAC3B,WAAW,KAAK,IAAI,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,gBAAc,MAAM,KAAK,UAAU,KAAK,GAAG,OAAO;AACpD;AAEA,IAAM,OAAO,KAAK,KAAK;AACvB,IAAM,SAAS,KAAK;AAEb,SAAS,YAAY,OAAuB;AACjD,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,MAAM,SAAS,OAAO,GAAG;AAC3B,WAAO,KAAK;AAAA,EACd;AACA,MAAI,MAAM,SAAS,aAAa,KAAK,MAAM,SAAS,cAAc,GAAG;AACnE,WAAO,IAAI;AAAA,EACb;AAEA,SAAO,IAAI;AACb;AAEO,SAAS,mBAAmB,YAAoB,OAAuB;AAC5E,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAClD,SAAO,GAAG,UAAU,IAAI,KAAK,IAAI,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,CAAC;AACpE;AAQO,SAAS,wBAAwB,YAAwC;AAC9E,QAAM,SAAS,SAA0B,YAAY,MAAM;AAC3D,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,UAAU;AAC3D,MAAI,SAAS,gBAAgB,UAAW,QAAO,QAAQ;AACvD,SAAO;AACT;;;AC7EO,SAAS,aAAa,UAA2B;AACtD,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC/D;AAEO,SAAS,kBAAkB,UAAyC;AACzE,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC/D;AAEO,SAAS,SAAS,QAA0B;AACjD,SAAO,OACJ,IAAI,CAAC,MAAM;AACV,QAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,GAAG;AAC1D,aAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACT,CAAC,EACA,KAAK,GAAG;AACb;AAEA,SAAS,WAAW,KAAsD;AACxE,QAAM,OAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC5C,SAAK,GAAG,IAAI,OAAO,QAAQ,YAAY,QAAQ,OAAO,KAAK,UAAU,GAAG,IAAI,OAAO,OAAO,EAAE;AAAA,EAC9F;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAsC,QAAyB;AAClF,MAAI,KAAK,WAAW,EAAG;AACvB,QAAM,OAAO,UAAU,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,UAAQ,OAAO,MAAM,GAAG,SAAS,IAAI,CAAC;AAAA,CAAI;AAC1C,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,WAAW,GAAG;AAC3B,YAAQ,OAAO,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAAA,CAAI;AAAA,EACtE;AACF;AAEA,SAAS,cAAc,MAA4C;AACjE,aAAW,OAAO,MAAM;AACtB,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC;AAAA,CAAI;AAAA,EACjD;AACF;AAEA,SAAS,WAAW,MAAsC,QAAyB;AACjF,MAAI,KAAK,WAAW,EAAG;AACvB,QAAM,OAAO,UAAU,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,UAAQ,OAAO,MAAM,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,CAAM;AAChD,UAAQ,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,KAAK,KAAK,CAAC;AAAA,CAAM;AACjE,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,WAAW,GAAG;AAC3B,YAAQ,OAAO,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,KAAK,CAAC;AAAA,CAAM;AAAA,EAC5E;AACF;AAEO,SAAS,eAAe,MAAsC,QAAgB,QAAyB;AAC5G,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,kBAAY,MAAM,MAAM;AACxB;AAAA,IACF,KAAK;AACH,oBAAc,IAAI;AAClB;AAAA,IACF,KAAK;AACH,iBAAW,MAAM,MAAM;AACvB;AAAA,IACF;AACE,mBAAa,EAAE,IAAI,MAAM,KAAK,CAAC;AAAA,EACnC;AACF;AAUA,eAAe,cAAc,WAAW,MAA8B;AACpE,MAAI,UAAU;AACZ,UAAM,SAAS,SAAwB,YAAY,MAAM;AACzD,QAAI,OAAQ,QAAO,OAAO;AAAA,EAC5B;AACA,QAAM,SAAS,CAAC,WAAW,EAAE,cAAc,OAAO,IAAI;AACtD,QAAM,OAAO,MAAM,OAAsB,4BAA4B,MAAM;AAC3E,MAAI,UAAU;AACZ,aAAS,YAAY,QAAQ,MAAM,KAAK,KAAK,GAAI;AAAA,EACnD;AACA,SAAO;AACT;AAEA,eAAsB,kBAAkB,MAAgD;AACtF,QAAM,WAAW,KAAK,aAAa;AACnC,QAAM,aAAa,YAAY,OAAO,EAAE;AAExC,MAAI,YAAY;AACd,QAAI,CAAC,WAAW,KAAK,UAAU,GAAG;AAChC,mBAAa;AAAA,QACX,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SACE;AAAA,QACJ;AAAA,MACF,CAAC;AACD,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,CAAC,KAAK,UAAU;AAEjC,MAAI;AACF,UAAM,WAAW,MAAM,cAAc,QAAQ;AAC7C,UAAM,CAAC,MAAM,IAAI;AACjB,QAAI,SAAS,WAAW,KAAK,QAAQ;AACnC,cAAQ,OAAO,MAAM,kBAAkB,OAAO,IAAI,MAAM,OAAO,EAAE;AAAA,CAAK;AACtE,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,SAAS,WAAW,GAAG;AACzB,4BAAsB,YAAY;AAAA,IACpC;AACA,UAAM,OAAO,SAAS,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AAClE,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,EAAqF,IAAI;AAAA,MACpG;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AAGZ,QAAI,eAAe,YAAY,oBAAoB,IAAI,MAAM,IAAI,OAAO,GAAG;AACzE,4BAAsB,cAAc,IAAI,OAAO;AAAA,IACjD;AACA,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-LVCBCJWF.js → chunk-ZH6ZNYPB.js}

@@ -67,9 +67,12 @@ function chatHeader() {
   return chatId ? { "x-baker-chat-id": chatId } : {};
 }
 function mapHttpError(status) {
-  if (status === 401 || status === 403) {
+  if (status === 401) {
     return "UNAUTHORIZED";
   }
+  if (status === 403) {
+    return "FORBIDDEN";
+  }
   if (status === 404) {
     return "NOT_FOUND";
   }
@@ -195,4 +198,4 @@ export {
   apiGet,
   apiPost
 };
-//# sourceMappingURL=chunk-LVCBCJWF.js.map
+//# sourceMappingURL=chunk-ZH6ZNYPB.js.map

package/dist/chunk-ZH6ZNYPB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { debugLogHttp, readBodyForLog } from \"./debugLog.ts\";\nimport { getEnv } from \"./env.ts\";\n\nconst MAX_RATE_LIMIT_RETRIES = 3;\nconst MAX_TOTAL_WAIT_MS = 2 * 60 * 1000;\n\nasync function fetchWithRateLimitRetry(url: string, init: RequestInit): Promise<Response> {\n  let totalWaited = 0;\n\n  for (let attempt = 0; attempt <= MAX_RATE_LIMIT_RETRIES; attempt++) {\n    const response = await fetch(url, init);\n\n    if (response.status !== 429 || attempt >= MAX_RATE_LIMIT_RETRIES) {\n      return response;\n    }\n\n    const retryAfterHeader = response.headers.get(\"Retry-After\");\n    const waitMs = retryAfterHeader ? Number(retryAfterHeader) * 1000 : 2000 * 2 ** attempt;\n\n    if (totalWaited + waitMs > MAX_TOTAL_WAIT_MS) {\n      return response;\n    }\n\n    totalWaited += waitMs;\n    await new Promise((resolve) => setTimeout(resolve, waitMs));\n  }\n\n  return fetch(url, init);\n}\n\ntype ErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"FORBIDDEN\"\n  | \"NOT_FOUND\"\n  | \"VALIDATION_ERROR\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_ERROR\"\n  | \"NETWORK_ERROR\"\n  | \"TIMEOUT\"\n  | \"IMAGE_PROCESSING_ERROR\";\n\nexport class ApiError extends Error {\n  code: ErrorCode;\n\n  constructor(code: ErrorCode, message: string) {\n    super(message);\n    this.name = \"ApiError\";\n    this.code = code;\n  }\n}\n\nconst CONVEX_ID_RE = /^[a-zA-Z0-9_]+$/;\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    // Allow tab (9), newline (10), carriage return (13)\n    if (code < 32 && code !== 9 && code !== 10 && code !== 13) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction validateStringValue(value: string): void {\n  if (hasControlCharacters(value)) {\n    throw new ApiError(\"VALIDATION_ERROR\", \"String value contains invalid control characters\");\n  }\n}\n\nexport function validateConvexId(id: string): void {\n  if (!CONVEX_ID_RE.test(id)) {\n    throw new ApiError(\"VALIDATION_ERROR\", `Invalid ID format: \"${id}\". Expected alphanumeric string.`);\n  }\n}\n\nfunction sanitizeParams(params: Record<string, string>): Record<string, string> {\n  const sanitized: Record<string, string> = {};\n  for (const [key, value] of Object.entries(params)) {\n    validateStringValue(value);\n    sanitized[key] = value;\n  }\n  return sanitized;\n}\n\n/**\n * Sent on every call so the backend can attribute immediately-applied writes\n * (library images and videos, followed advertisers) to the Session they were\n * made from. Absent outside a chat-attached environment.\n */\nfunction chatHeader(): Record<string, string> {\n  const chatId = getEnv().BAKER_CHAT_ID;\n  return chatId ? { \"x-baker-chat-id\": chatId } : {};\n}\n\nfunction mapHttpError(status: number): ErrorCode {\n  if (status === 401) {\n    return \"UNAUTHORIZED\";\n  }\n  // 403 is never \"not connected\" — every backend `FORBIDDEN` means connected but\n  // not allowed (an asset outside the granted scope, a capability the account\n  // lacks). Folding it into UNAUTHORIZED sent agents down the reconnect path,\n  // which cannot fix a permission gap and wastes the user's time.\n  if (status === 403) {\n    return \"FORBIDDEN\";\n  }\n  if (status === 404) {\n    return \"NOT_FOUND\";\n  }\n  if (status === 422 || status === 400) {\n    return \"VALIDATION_ERROR\";\n  }\n  if (status === 429) {\n    return \"RATE_LIMITED\";\n  }\n  return \"INTERNAL_ERROR\";\n}\n\nasync function handleResponse<T>(response: Response): Promise<T> {\n  const body = await response.text();\n\n  if (!response.ok) {\n    let message = `HTTP ${response.status}: ${response.statusText}`;\n    try {\n      const parsed = JSON.parse(body) as { error?: string | { message?: string }; message?: string };\n      if (typeof parsed.error === \"string\") {\n        message = parsed.error;\n      } else if (parsed.error?.message) {\n        message = parsed.error.message;\n      } else if (parsed.message) {\n        message = parsed.message;\n      }\n    } catch {\n      // Use default message\n    }\n    throw new ApiError(mapHttpError(response.status), message);\n  }\n\n  try {\n    return JSON.parse(body) as T;\n  } catch {\n    throw new ApiError(\"INTERNAL_ERROR\", \"Failed to parse API response as JSON\");\n  }\n}\n\nexport async function apiGet<T>(path: string, params?: Record<string, string>): Promise<T> {\n  const env = getEnv();\n  const url = new URL(path, env.BAKER_API_URL);\n  if (params) {\n    const clean = sanitizeParams(params);\n    for (const [key, value] of Object.entries(clean)) {\n      url.searchParams.set(key, value);\n    }\n  }\n\n  const urlStr = url.toString();\n  const startedAt = Date.now();\n  let response: Response;\n  try {\n    response = await fetchWithRateLimitRetry(urlStr, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${env.BAKER_API_KEY}`,\n        Accept: \"application/json\",\n        ...chatHeader(),\n      },\n      signal: AbortSignal.timeout(60_000),\n    });\n  } catch (err) {\n    debugLogHttp({ source: \"cli\", method: \"GET\", url: urlStr, durationMs: Date.now() - startedAt, error: err });\n    if (err instanceof Error && (err.name === \"TimeoutError\" || err.name === \"AbortError\")) {\n      throw new ApiError(\"TIMEOUT\", \"Request timed out after 60 seconds\");\n    }\n    throw new ApiError(\"NETWORK_ERROR\", `Request failed: ${err instanceof Error ? err.message : \"Unknown error\"}`);\n  }\n\n  debugLogHttp({\n    source: \"cli\",\n    method: \"GET\",\n    url: urlStr,\n    status: response.status,\n    ok: response.ok,\n    responseBody: await readBodyForLog(response),\n    durationMs: Date.now() - startedAt,\n  });\n  return handleResponse<T>(response);\n}\n\nexport async function apiPost<T>(path: string, body: unknown, opts?: { timeoutMs?: number }): Promise<T> {\n  const env = getEnv();\n  const timeoutMs = opts?.timeoutMs ?? 60_000;\n  const urlStr = new URL(path, env.BAKER_API_URL).toString();\n  const startedAt = Date.now();\n  let response: Response;\n  try {\n    response = await fetchWithRateLimitRetry(urlStr, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${env.BAKER_API_KEY}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n        ...chatHeader(),\n      },\n      body: JSON.stringify(body),\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n  } catch (err) {\n    debugLogHttp({\n      source: \"cli\",\n      method: \"POST\",\n      url: urlStr,\n      requestBody: body,\n      durationMs: Date.now() - startedAt,\n      error: err,\n    });\n    if (err instanceof Error && (err.name === \"TimeoutError\" || err.name === \"AbortError\")) {\n      throw new ApiError(\"TIMEOUT\", `Request timed out after ${Math.round(timeoutMs / 1000)} seconds`);\n    }\n    throw new ApiError(\"NETWORK_ERROR\", `Request failed: ${err instanceof Error ? err.message : \"Unknown error\"}`);\n  }\n\n  debugLogHttp({\n    source: \"cli\",\n    method: \"POST\",\n    url: urlStr,\n    requestBody: body,\n    status: response.status,\n    ok: response.ok,\n    responseBody: await readBodyForLog(response),\n    durationMs: Date.now() - startedAt,\n  });\n  return handleResponse<T>(response);\n}\n"],"mappings":";;;;;;;;;AAGA,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB,IAAI,KAAK;AAEnC,eAAe,wBAAwB,KAAa,MAAsC;AACxF,MAAI,cAAc;AAElB,WAAS,UAAU,GAAG,WAAW,wBAAwB,WAAW;AAClE,UAAM,WAAW,MAAM,MAAM,KAAK,IAAI;AAEtC,QAAI,SAAS,WAAW,OAAO,WAAW,wBAAwB;AAChE,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,SAAS,QAAQ,IAAI,aAAa;AAC3D,UAAM,SAAS,mBAAmB,OAAO,gBAAgB,IAAI,MAAO,MAAO,KAAK;AAEhF,QAAI,cAAc,SAAS,mBAAmB;AAC5C,aAAO;AAAA,IACT;AAEA,mBAAe;AACf,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,MAAM,CAAC;AAAA,EAC5D;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAaO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC;AAAA,EAEA,YAAY,MAAiB,SAAiB;AAC5C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,eAAe;AAErB,SAAS,qBAAqB,OAAwB;AACpD,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,MAAM,WAAW,CAAC;AAE/B,QAAI,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,IAAI;AACzD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAqB;AAChD,MAAI,qBAAqB,KAAK,GAAG;AAC/B,UAAM,IAAI,SAAS,oBAAoB,kDAAkD;AAAA,EAC3F;AACF;AAEO,SAAS,iBAAiB,IAAkB;AACjD,MAAI,CAAC,aAAa,KAAK,EAAE,GAAG;AAC1B,UAAM,IAAI,SAAS,oBAAoB,uBAAuB,EAAE,kCAAkC;AAAA,EACpG;AACF;AAEA,SAAS,eAAe,QAAwD;AAC9E,QAAM,YAAoC,CAAC;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,wBAAoB,KAAK;AACzB,cAAU,GAAG,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAOA,SAAS,aAAqC;AAC5C,QAAM,SAAS,OAAO,EAAE;AACxB,SAAO,SAAS,EAAE,mBAAmB,OAAO,IAAI,CAAC;AACnD;AAEA,SAAS,aAAa,QAA2B;AAC/C,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AAKA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,eAAe,eAAkB,UAAgC;AAC/D,QAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,UAAU,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAC7D,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,OAAO,OAAO,UAAU,UAAU;AACpC,kBAAU,OAAO;AAAA,MACnB,WAAW,OAAO,OAAO,SAAS;AAChC,kBAAU,OAAO,MAAM;AAAA,MACzB,WAAW,OAAO,SAAS;AACzB,kBAAU,OAAO;AAAA,MACnB;AAAA,IACF,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,SAAS,aAAa,SAAS,MAAM,GAAG,OAAO;AAAA,EAC3D;AAEA,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,SAAS,kBAAkB,sCAAsC;AAAA,EAC7E;AACF;AAEA,eAAsB,OAAU,MAAc,QAA6C;AACzF,QAAM,MAAM,OAAO;AACnB,QAAM,MAAM,IAAI,IAAI,MAAM,IAAI,aAAa;AAC3C,MAAI,QAAQ;AACV,UAAM,QAAQ,eAAe,MAAM;AACnC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,SAAS;AAC5B,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wBAAwB,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,IAAI,aAAa;AAAA,QAC1C,QAAQ;AAAA,QACR,GAAG,WAAW;AAAA,MAChB;AAAA,MACA,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,iBAAa,EAAE,QAAQ,OAAO,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,IAAI,WAAW,OAAO,IAAI,CAAC;AAC1G,QAAI,eAAe,UAAU,IAAI,SAAS,kBAAkB,IAAI,SAAS,eAAe;AACtF,YAAM,IAAI,SAAS,WAAW,oCAAoC;AAAA,IACpE;AACA,UAAM,IAAI,SAAS,iBAAiB,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe,EAAE;AAAA,EAC/G;AAEA,eAAa;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,IAAI,SAAS;AAAA,IACb,cAAc,MAAM,eAAe,QAAQ;AAAA,IAC3C,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACD,SAAO,eAAkB,QAAQ;AACnC;AAEA,eAAsB,QAAW,MAAc,MAAe,MAA2C;AACvG,QAAM,MAAM,OAAO;AACnB,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,SAAS,IAAI,IAAI,MAAM,IAAI,aAAa,EAAE,SAAS;AACzD,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wBAAwB,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,IAAI,aAAa;AAAA,QAC1C,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,GAAG,WAAW;AAAA,MAChB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,iBAAa;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,aAAa;AAAA,MACb,YAAY,KAAK,IAAI,IAAI;AAAA,MACzB,OAAO;AAAA,IACT,CAAC;AACD,QAAI,eAAe,UAAU,IAAI,SAAS,kBAAkB,IAAI,SAAS,eAAe;AACtF,YAAM,IAAI,SAAS,WAAW,2BAA2B,KAAK,MAAM,YAAY,GAAI,CAAC,UAAU;AAAA,IACjG;AACA,UAAM,IAAI,SAAS,iBAAiB,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe,EAAE;AAAA,EAC/G;AAEA,eAAa;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ,SAAS;AAAA,IACjB,IAAI,SAAS;AAAA,IACb,cAAc,MAAM,eAAe,QAAQ;AAAA,IAC3C,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACD,SAAO,eAAkB,QAAQ;AACnC;","names":[]}

package/dist/cli.js

@@ -45,7 +45,7 @@ import {
   resolveAccountIdArg,
   resolveEffectiveStatus,
   todayIso
-} from "./chunk-JOPBGFXC.js";
+} from "./chunk-7QMWNMRW.js";
 import {
   buildQueryCacheKey,
   cacheGet,
@@ -55,18 +55,19 @@ import {
   getQueryTtl,
   handleConnectionError,
   isNotConnectedError,
+  needsConnectionFix,
   resolveCustomerId,
   toCsvRow,
   writeAdsJson,
   writeAdsOutput,
   writeJsonEnvelope
-} from "./chunk-R4PG6VCS.js";
+} from "./chunk-TFPZLUVM.js";
 import {
   ApiError,
   apiGet,
   apiPost,
   validateConvexId
-} from "./chunk-LVCBCJWF.js";
+} from "./chunk-ZH6ZNYPB.js";
 import {
   installStreamTaps,
   logInvocation
@@ -4601,7 +4602,7 @@ function accountHints(accounts) {
 }
 function handleAccountsError(err) {
   if (err instanceof ApiError) {
-    if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+    if (needsConnectionFix(err.code, err.message)) {
       handleConnectionError("google_ads", err.message);
     }
     const envelope = {
@@ -10207,10 +10208,7 @@ import { readFileSync as readFileSync4 } from "fs";
 var DAY_MS2 = 864e5;
 function handleLinkedinError(err) {
   if (err instanceof ApiError) {
-    if (err.code === "UNAUTHORIZED") {
-      handleConnectionError("linkedin_ads", err.message);
-    }
-    if (err.code === "NOT_FOUND") {
+    if (needsConnectionFix(err.code, err.message)) {
       handleConnectionError("linkedin_ads", err.message);
     }
     if (isNoAccountsSelectedError(err.code, err.message)) {
@@ -15600,10 +15598,10 @@ function duplicateCommand2(entity, label) {
       replace: { type: "boolean", description: "Pause the original once the copy publishes" }
     },
     run: async ({ args }) => {
-      const { apiPost: apiPost2 } = await import("./client-R5ZSVIK3.js");
+      const { apiPost: apiPost2 } = await import("./client-XRQWOADV.js");
       const { requireChatId: requireChatId2 } = await import("./env-3JMYIH25.js");
-      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-KLK2GZXR.js");
-      const { handleMetaError: handleMetaError2 } = await import("./shared-AXAXNKGE.js");
+      const { writeJsonEnvelope: writeJsonEnvelope2 } = await import("./output-FL7WRIJF.js");
+      const { handleMetaError: handleMetaError2 } = await import("./shared-OIYLDW3G.js");
       try {
         const accountId = bareAccountId2(args);
         const chatId = requireChatId2();
@@ -16482,16 +16480,27 @@ async function runList(args) {
   const accountId = resolveAccountIdArg(args);
   const params = { "account-id": accountId };
   if (args["skip-cache"]) params["skip-cache"] = "true";
-  const data = await apiGet("/api/ads/meta/pixels", params);
-  emit(data, args);
+  const { pixels, restrictedFields } = await apiGet("/api/ads/meta/pixels", params);
+  emit(pixels, args, pixelWarnings(restrictedFields));
 }
-function emit(data, args) {
+function pixelWarnings(restrictedFields) {
+  if (restrictedFields.length === 0) {
+    return [];
+  }
+  return [
+    {
+      code: "PIXEL_FIELDS_RESTRICTED",
+      message: `Meta withheld ${restrictedFields.join(", ")} for these pixels \u2014 the connected user holds no role in the Business that owns them. IDs, names, creation and last-fired times are complete; install code and setup details are not. To get them, the client assigns the pixel to the connected user in Meta Business settings \u2192 Data sources \u2192 Datasets.`
+    }
+  ];
+}
+function emit(data, args, warnings = []) {
   const fmt = csvOrJson(args);
   if (fmt !== "json") {
     writeAdsOutput(data, fmt);
     return;
   }
-  writeAdsJson({ ok: true, data });
+  writeAdsJson({ ok: true, data, ...warnings.length > 0 ? { warnings } : {} });
 }
 
 // src/commands/ads/meta/preview.ts
@@ -16656,7 +16665,7 @@ function accountHints4(accounts) {
 }
 function handleAccountsError2(err) {
   if (err instanceof ApiError) {
-    if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+    if (needsConnectionFix(err.code, err.message)) {
       handleConnectionError("x_ads", err.message);
     }
     const envelope = {
@@ -16831,7 +16840,7 @@ ${list}`
     });
     process.exit(1);
   } catch (err) {
-    if (err instanceof ApiError && (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND")) {
+    if (err instanceof ApiError && needsConnectionFix(err.code, err.message)) {
       handleConnectionError("x_ads", err.message);
     }
     writeAdsJson({
@@ -26013,7 +26022,7 @@ ${list}`
     });
     process.exit(1);
   } catch (err) {
-    if (err instanceof ApiError && (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND")) {
+    if (err instanceof ApiError && needsConnectionFix(err.code, err.message)) {
       handleConnectionError("ga4", err.message);
     }
     writeJsonEnvelope({
@@ -26142,7 +26151,7 @@ Examples:
       writeJsonEnvelope({ ok: true, data, hints: propertyHints(data) });
     } catch (err) {
       if (err instanceof ApiError) {
-        if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+        if (needsConnectionFix(err.code, err.message)) {
           handleConnectionError("ga4", err.message);
         }
         writeJsonEnvelope({ ok: false, error: { code: err.code, message: err.message } });
@@ -26470,7 +26479,7 @@ ${list}`
     });
     process.exit(1);
   } catch (err) {
-    if (err instanceof ApiError && (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND")) {
+    if (err instanceof ApiError && needsConnectionFix(err.code, err.message)) {
       handleConnectionError("gsc", err.message);
     }
     writeJsonEnvelope({
@@ -26777,7 +26786,7 @@ Examples:
       writeJsonEnvelope({ ok: true, data, hints: siteHints(data) });
     } catch (err) {
       if (err instanceof ApiError) {
-        if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+        if (needsConnectionFix(err.code, err.message)) {
           handleConnectionError("gsc", err.message);
         }
         writeJsonEnvelope({ ok: false, error: { code: err.code, message: err.message } });
@@ -26928,7 +26937,7 @@ Full guide: __tooling__/docs/tools/baker/history.md`
 import { defineCommand as defineCommand114 } from "citty";
 var EMBED_TYPES = ["legacy", "v4", "unknown"];
 function failNotConnected(err) {
-  if (err instanceof ApiError && err.code === "UNAUTHORIZED" && err.message.includes(HUBSPOT_MISSING_GRANT_MARKER)) {
+  if (err instanceof ApiError && err.code === "FORBIDDEN" && err.message.includes(HUBSPOT_MISSING_GRANT_MARKER)) {
     writeJson({
       ok: false,
       error: {
@@ -33267,7 +33276,7 @@ function handleError3(err) {
       error: {
         code: err.code,
         message: err.message,
-        ...err.code === "UNAUTHORIZED" ? {
+        ...err.code === "UNAUTHORIZED" || err.code === "FORBIDDEN" && isNotConnectedError(err.code, err.message) ? {
           fix: {
             action: "request_connection",
             explanation: 'Tag Manager is not connected for this company yet, or no container has been picked. Do NOT send the user to Settings \u2014 call the `request_connection` tool with { platform: "google-tag-manager", reason } and they connect and pick their containers (they can pick more than one) from inside the chat. `request_tag_input` is NOT the route: that form manages the container snippet on the site, not what runs inside the container, and it cannot pick a container. If `request_connection` is not available to you, say so plainly and point them at dashboard \u2192 Brain \u2192 Integrations \u2192 Tools \u2192 Google Tag Manager, where they also pick the container. Carry on with the rest of the task meanwhile.'