@koda-sl/baker-cli 0.173.1 → 0.174.0-dev.04aff5532

package/README.md

@@ -820,7 +820,7 @@ adsets              # filter by --campaign-id
 ads                 # filter by --adset-id or --campaign-id
 creatives           # list per account, or fetch single via --creative-id
 audiences           # custom audiences (incl. lookalikes)
-pixels              # list, or --stats for one --pixel-id
+pixels              # list, or --stats for one --pixel-id (see "Restricted pixel fields")
 activities          # account audit log, ~90d retention
 insights            # see "Smart defaults" above
 preview             # iframe HTML for a creative or ad in a given ad_format
@@ -835,6 +835,12 @@ The HTTP backend exposes more endpoints (catalogs, ad-studies, ad-images, labels
 - All cached actions are keyed per company; two companies that connect to the same Meta account never share cache entries.
 - `--skip-cache` on any command forces a re-fetch.
 
+#### Restricted pixel fields
+
+A Pixel/Dataset is a Business asset assigned separately from the ad account, and Meta refuses the *whole* read with `code 200` if any requested field needs a role in the owning Business — so an agency with partner access used to get nothing back. `pixels` now retries without those fields (`code`, `creator`, `owner_business`, `data_use_setting`, `enable_automatic_matching`, `first_party_cookie_status`) and prints the usual `{ ok: true, data, warnings }` with a `PIXEL_FIELDS_RESTRICTED` warning naming them (the HTTP endpoint carries them as `restrictedFields`). IDs, names, creation and last-fired times are always complete; a missing install code means "not visible to us", not "not configured". As elsewhere in the family, `--output csv|jsonl|md` prints rows only — use the default JSON to see the warning.
+
+A `FORBIDDEN` from any Meta command is a permission refusal on a live connection, not a missing one. Meta uses one code for two causes, so the `error.fix` gives the agent the test rather than a verdict: if other reads on the account also fail the connection is short a scope and only a reconnect widens it; if they work, the asset needs assigning in Business settings and reconnecting cannot help.
+
 #### Notes / gotchas
 
 - `spend` is a decimal string in account currency, not an integer.

package/dist/{chunk-JOPBGFXC.js → chunk-7QMWNMRW.js}

@@ -1,19 +1,32 @@
 import {
   handleConnectionError,
+  needsConnectionFix,
   writeAdsJson
-} from "./chunk-R4PG6VCS.js";
+} from "./chunk-TFPZLUVM.js";
 import {
   ApiError
-} from "./chunk-LVCBCJWF.js";
+} from "./chunk-ZH6ZNYPB.js";
 import {
   getEnv
 } from "./chunk-RK67WL4O.js";
 
 // src/commands/ads/meta/shared.ts
 var DAY_MS = 864e5;
+function metaForbiddenFix(message) {
+  return {
+    action: "reject",
+    explanation: [
+      message,
+      "This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.",
+      "If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.",
+      "If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it \u2014 the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources \u2192 Datasets for a pixel).",
+      "Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why \u2014 never present the task as verified when this step was skipped."
+    ].join("\n\n")
+  };
+}
 function handleMetaError(err) {
   if (err instanceof ApiError) {
-    if (err.code === "UNAUTHORIZED" || err.code === "NOT_FOUND") {
+    if (needsConnectionFix(err.code, err.message)) {
       handleConnectionError("meta_ads", err.message);
     }
     const envelope = {
@@ -21,7 +34,7 @@ function handleMetaError(err) {
       error: {
         code: err.code,
         message: err.message,
-        fix: { action: "reject", explanation: err.message },
+        fix: err.code === "FORBIDDEN" ? metaForbiddenFix(err.message) : { action: "reject", explanation: err.message },
         retryable: err.code === "RATE_LIMITED" || err.code === "INTERNAL_ERROR"
       }
     };
@@ -86,6 +99,7 @@ function resolveEffectiveStatus(args) {
 }
 
 export {
+  metaForbiddenFix,
   handleMetaError,
   resolveAccountIdArg,
   getDateRange,
@@ -94,4 +108,4 @@ export {
   csvOrJson,
   resolveEffectiveStatus
 };
-//# sourceMappingURL=chunk-JOPBGFXC.js.map
+//# sourceMappingURL=chunk-7QMWNMRW.js.map

package/dist/chunk-7QMWNMRW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ads/meta/shared.ts"],"sourcesContent":["import { ApiError } from \"../../../client.ts\";\nimport { getEnv } from \"../../../env.ts\";\nimport { handleConnectionError, needsConnectionFix } from \"../../../error-handler.ts\";\nimport { writeAdsJson } from \"../output.ts\";\nimport type { AdsErrorEnvelope, QueryFix } from \"../types.ts\";\n\nconst DAY_MS = 86_400_000;\n\n/**\n * Meta answers a permission refusal (Graph codes 200/10/294) with a bare\n * \"Permissions error\" that covers two causes needing opposite remedies: a\n * consent grant the connection never got — nothing validates Meta's granted\n * scopes after connect, unlike HubSpot's `requireCapability` — or a role the\n * user lacks on one asset, since a Pixel/Dataset, Page or catalog lives in a\n * Business and is assigned separately from the ad account. Only the blast radius\n * separates them, so hand the agent that test rather than a verdict: guessing\n * \"reconnect\" wastes the user's time on an unassigned asset, and ruling it out\n * strands a connection that really is short a scope.\n */\nexport function metaForbiddenFix(message: string): QueryFix {\n  return {\n    action: \"reject\",\n    explanation: [\n      message,\n      \"This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.\",\n      \"If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.\",\n      \"If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it — the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources → Datasets for a pixel).\",\n      \"Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why — never present the task as verified when this step was skipped.\",\n    ].join(\"\\n\\n\"),\n  };\n}\n\nexport function handleMetaError(err: unknown): never {\n  if (err instanceof ApiError) {\n    if (needsConnectionFix(err.code, err.message)) {\n      handleConnectionError(\"meta_ads\", err.message);\n    }\n    const envelope: AdsErrorEnvelope = {\n      ok: false,\n      error: {\n        code: err.code,\n        message: err.message,\n        fix: err.code === \"FORBIDDEN\" ? metaForbiddenFix(err.message) : { action: \"reject\", explanation: err.message },\n        retryable: err.code === \"RATE_LIMITED\" || err.code === \"INTERNAL_ERROR\",\n      },\n    };\n    writeAdsJson(envelope);\n    process.exit(1);\n  }\n  const message = err instanceof Error ? err.message : \"Unexpected error\";\n  writeAdsJson({ ok: false, error: { code: \"NETWORK_ERROR\", message } });\n  process.exit(1);\n}\n\nconst ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;\n\n/** Pull the default Meta ad account ID from `--account-id` arg or `BAKER_META_AD_ACCOUNT_ID` env. */\nexport function resolveAccountIdArg(args: Record<string, unknown>): string {\n  const fromArgs = args[\"account-id\"] as string | undefined;\n  const id = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;\n  if (!id) {\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"MISSING_ACCOUNT_ID\",\n        message: \"Pass --account-id or set BAKER_META_AD_ACCOUNT_ID. Run `baker ads meta accounts` to find IDs.\",\n      },\n    });\n    process.exit(1);\n  }\n  if (!ACCOUNT_ID_RE.test(id)) {\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"INVALID_ACCOUNT_ID\",\n        message: `Invalid account ID \"${id}\". Expected numeric ID, optionally prefixed with \"act_\".`,\n      },\n    });\n    process.exit(1);\n  }\n  return id.startsWith(\"act_\") ? id : `act_${id}`;\n}\n\nexport function getDateRange(args: Record<string, unknown>): { datePreset?: string; since?: string; until?: string } {\n  const datePreset = args[\"date-preset\"] as string | undefined;\n  const since = args.since as string | undefined;\n  const until = args.until as string | undefined;\n  if (since && until) return { since, until };\n  return { datePreset: datePreset ?? \"last_7d\" };\n}\n\nexport function todayIso(): string {\n  return new Date().toISOString().slice(0, 10);\n}\n\nexport function daysAgoIso(days: number): string {\n  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);\n}\n\nexport function csvOrJson(args: Record<string, unknown>): string {\n  return (args.output as string | undefined) ?? \"json\";\n}\n\n/**\n * Default to ACTIVE-only on listings — that's almost always what an AI agent or\n * a human glance wants. Pass `--effective-status ACTIVE,PAUSED` to override, or\n * `--all-statuses` to drop the filter entirely.\n */\nexport function resolveEffectiveStatus(args: Record<string, unknown>): string | undefined {\n  if (args[\"all-statuses\"]) {\n    return undefined;\n  }\n  const explicit = args[\"effective-status\"] as string | undefined;\n  if (explicit) {\n    return explicit;\n  }\n  return \"ACTIVE\";\n}\n"],"mappings":";;;;;;;;;;;;;AAMA,IAAM,SAAS;AAaR,SAAS,iBAAiB,SAA2B;AAC1D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,MAAM;AAAA,EACf;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,MAAI,eAAe,UAAU;AAC3B,QAAI,mBAAmB,IAAI,MAAM,IAAI,OAAO,GAAG;AAC7C,4BAAsB,YAAY,IAAI,OAAO;AAAA,IAC/C;AACA,UAAM,WAA6B;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,KAAK,IAAI,SAAS,cAAc,iBAAiB,IAAI,OAAO,IAAI,EAAE,QAAQ,UAAU,aAAa,IAAI,QAAQ;AAAA,QAC7G,WAAW,IAAI,SAAS,kBAAkB,IAAI,SAAS;AAAA,MACzD;AAAA,IACF;AACA,iBAAa,QAAQ;AACrB,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAa,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,iBAAiB,QAAQ,EAAE,CAAC;AACrE,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,gBAAgB;AAGf,SAAS,oBAAoB,MAAuC;AACzE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,KAAK,YAAY,OAAO,EAAE;AAChC,MAAI,CAAC,IAAI;AACP,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,CAAC,cAAc,KAAK,EAAE,GAAG;AAC3B,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,uBAAuB,EAAE;AAAA,MACpC;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO,GAAG,WAAW,MAAM,IAAI,KAAK,OAAO,EAAE;AAC/C;AAEO,SAAS,aAAa,MAAwF;AACnH,QAAM,aAAa,KAAK,aAAa;AACrC,QAAM,QAAQ,KAAK;AACnB,QAAM,QAAQ,KAAK;AACnB,MAAI,SAAS,MAAO,QAAO,EAAE,OAAO,MAAM;AAC1C,SAAO,EAAE,YAAY,cAAc,UAAU;AAC/C;AAEO,SAAS,WAAmB;AACjC,UAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC7C;AAEO,SAAS,WAAW,MAAsB;AAC/C,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACvE;AAEO,SAAS,UAAU,MAAuC;AAC/D,SAAQ,KAAK,UAAiC;AAChD;AAOO,SAAS,uBAAuB,MAAmD;AACxF,MAAI,KAAK,cAAc,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,KAAK,kBAAkB;AACxC,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-CG6OTNUU.js → chunk-K424D3CY.js}

@@ -7,9 +7,9 @@ import {
   __toESM
 } from "./chunk-RK67WL4O.js";
 
-// ../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/index.js
+// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/810146e81bae4e3a061fe487864f2fde80c4b03b886877dc0f1fffbc6480b67e/node_modules/safe-stable-stringify/index.js
 var require_safe_stable_stringify = __commonJS({
-  "../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/index.js"(exports, module) {
+  "../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/810146e81bae4e3a061fe487864f2fde80c4b03b886877dc0f1fffbc6480b67e/node_modules/safe-stable-stringify/index.js"(exports, module) {
     "use strict";
     var { hasOwnProperty } = Object.prototype;
     var stringify = configure2();
@@ -1075,7 +1075,7 @@ function resolveAdaptFormats(params) {
   return params.formats ?? [];
 }
 
-// ../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/esm/wrapper.js
+// ../../.pnpm-store/v10/links/@/safe-stable-stringify/2.5.0/810146e81bae4e3a061fe487864f2fde80c4b03b886877dc0f1fffbc6480b67e/node_modules/safe-stable-stringify/esm/wrapper.js
 var import__ = __toESM(require_safe_stable_stringify(), 1);
 var configure = import__.default.configure;
 var wrapper_default = import__.default;
@@ -8028,4 +8028,4 @@ export {
   defaultRegistry,
   createEngineFromEnv
 };
-//# sourceMappingURL=chunk-CG6OTNUU.js.map
+//# sourceMappingURL=chunk-K424D3CY.js.map