@koda-sl/baker-cli 0.384.0-dev.4699b7308 → 0.384.0-dev.557795bef

package/dist/chunk-EDLZGTGN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/identity/digest.ts","../../api/src/identity/email.ts","../../api/src/identity/phone.ts","../../api/src/identity/index.ts","../../api/src/event-ingest/matching.ts","../../api/src/event-ingest/vocabulary.ts","../../api/src/event-sources/fields.ts","../../api/src/event-sources/template.ts"],"sourcesContent":["/**\n * The one hash, and the one way to recognise one.\n *\n * Web Crypto, so the same code runs in the Convex runtime, a Worker, Node and a\n * browser — an identity digest that differs by runtime is a digest that matches\n * nothing, and nothing about that failure is visible from either end.\n */\n\n/** SHA-256 in lowercase hex. The form every ad platform documents. */\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst SHA256_HEX = /^[0-9a-fA-F]{64}$/;\n\n/**\n * Whether a value is already a SHA-256 digest — the check that decides whether\n * a field holds plain text to normalize and hash, or a digest someone else\n * computed. Hashing a hash produces a key that matches nothing, forever, with\n * no way to tell afterwards.\n */\nexport function isSha256Hex(value: string): boolean {\n  return SHA256_HEX.test(value);\n}\n\n/** The storable form of a supplied digest, or `null` if it is not one. */\nexport function normalizeSha256Hex(value: string): string | null {\n  const trimmed = value.trim();\n  return SHA256_HEX.test(trimmed) ? trimmed.toLowerCase() : null;\n}\n\n/**\n * The canonical form of a site's own id for a person, before it is hashed.\n *\n * Trim and lowercase, and deliberately nothing else. An `external_id` is an\n * opaque key in somebody else's system — a customer number, a CRM contact id, a\n * membership code — so there is no shape to check and no punctuation that means\n * anything. What matters is only that **both ends canonicalise it the same\n * way**: the browser hashing `Cust-4821` and the CRM hashing `cust-4821` would\n * produce two people out of one, with nothing anywhere to report it.\n *\n * Not part of the versioned normalizer beside it, on purpose. Those versions\n * exist because an address has a *correct* form that we learned late; this has\n * never had one and never will.\n */\nexport function normalizeExternalId(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** The digest a site's own id joins on, or `null` when there is nothing to hash. */\nexport async function externalIdDigest(raw: string): Promise<string | null> {\n  const canonical = normalizeExternalId(raw);\n  return canonical === null ? null : await sha256Hex(canonical);\n}\n","/**\n * Email normalization, one rule per version.\n *\n * A version is not a preference: a digest computed under v1 and stored a year\n * ago can never be recomputed, because the address that produced it was dropped\n * on purpose. So v1 is frozen at whatever the browser did on the day it ran, and\n * a better rule arrives as v2 alongside it rather than in place of it.\n */\n\n/**\n * **v1 — frozen.** Trim and lowercase, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. No shape check:\n * whatever the visitor typed was hashed, and every historical digest was\n * produced this way.\n *\n * `null` only for an empty result, which is the one case the beacon also\n * declines to report.\n */\nexport function normalizeEmailV1(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** No dots-as-separators, no length games: one `@`, a local part, a dotted domain. */\nconst EMAIL = /^[^\\s@]+@[^\\s@.]+(?:\\.[^\\s@.]+)+$/;\n\n/**\n * **v2.** v1 plus a shape check, so an unusable value is declined instead of\n * hashed into a key that can never match.\n */\nexport function normalizeEmailV2(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return EMAIL.test(trimmed) ? trimmed : null;\n}\n\n/**\n * Google's own email canonicalization, applied on top of a normalized address:\n * for `gmail.com` and `googlemail.com`, drop the dots and any `+tag` from the\n * local part.\n *\n * `null` when there is no address left to send — a local part that was nothing\n * but a `+tag`. Google is the only platform that asks for this; Meta and\n * LinkedIn hash the address as written, which is why this is a provider step\n * and not part of the version.\n */\nexport function googleEmail(normalizedEmail: string): string | null {\n  const [localPart, domain, ...extraParts] = normalizedEmail.split(\"@\");\n  if (!localPart || !domain || extraParts.length > 0) return normalizedEmail;\n  if (domain !== \"gmail.com\" && domain !== \"googlemail.com\") return normalizedEmail;\n  const canonicalLocalPart = localPart.split(\"+\", 1)[0]?.replace(/\\./g, \"\") ?? \"\";\n  return canonicalLocalPart ? `${canonicalLocalPart}@${domain}` : null;\n}\n","/**\n * Phone normalization, one rule per version, plus the shape each platform\n * hashes.\n *\n * Three copies of this used to exist — the beacon's, the funnel contract's and\n * `lib/capi.ts` — and they disagreed on the `+`. A digest of `34600111222` and a\n * digest of `+34600111222` are two unrelated keys for one person, and neither\n * end reports anything when they fail to meet.\n */\n\n/**\n * **v1 — frozen.** Digits only, with a `+` in front, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. It guesses no\n * country code and validates nothing: a national number becomes `+600111222`,\n * and that is the digest sitting in the store for every visitor who identified\n * before v2 existed.\n */\nexport function normalizePhoneV1(raw: string): string | null {\n  const digits = raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^0-9]/g, \"\");\n  return digits === \"\" ? null : `+${digits}`;\n}\n\n/** What a CRM writes around the digits and what E.164 does not keep. */\nconst PHONE_PUNCTUATION = /[\\s()./-]/g;\n/** E.164: `+`, a country code that cannot start at 0, up to 15 digits total. */\nconst E164 = /^\\+[1-9]\\d{7,14}$/;\n\n/**\n * **v2 — strict E.164.**\n *\n * A number with no international prefix is refused rather than guessed at. The\n * country code cannot be inferred from the value, and inventing one produces a\n * hash that silently matches nothing — worse than declining the key, because\n * the event still resolves by some other rung and nobody learns the phone was\n * lost. Both `+34…` and the access prefix `0034…` are accepted; a bare\n * `600111222` is not.\n */\nexport function normalizePhoneV2(raw: string): string | null {\n  const compact = raw.replace(PHONE_PUNCTUATION, \"\");\n  const e164 = compact.startsWith(\"00\") ? `+${compact.slice(2)}` : compact;\n  return E164.test(e164) ? e164 : null;\n}\n\n/**\n * E.164 without the `+` — what Meta, LinkedIn and Twitter hash.\n *\n * Google hashes the same number *with* the `+`, and that single character is\n * the whole reason this function has a name.\n */\nexport function phoneWithoutPlus(normalizedPhone: string): string {\n  return normalizedPhone.startsWith(\"+\") ? normalizedPhone.slice(1) : normalizedPhone;\n}\n","/**\n * Versioned identity normalization — one rule set, in one place, for the whole\n * platform.\n *\n * Several copies of \"normalize an email or a phone and hash it\" exist: the\n * browser beacon's, the one every Conversions API dispatcher shares\n * (`convex/lib/capi.ts`), and Google Ads' own on top of it\n * (`convex/sideEffects/googleAdsCapi/utils.ts`). They disagree about the `+` on\n * a phone, about whether a malformed address should be declined, and about\n * Gmail. Each disagreement is the same failure: two digests for one person, no\n * error anywhere, and an attribution that quietly matches nobody.\n *\n * **This module has taken over exactly one of them so far — the beacon's.** The\n * CAPI dispatchers still hold their own, because they sit on live conversion\n * uploads where a changed digest is money mis-attributed, so they move in their\n * own change with their own evidence. What is done instead, and now, is to make\n * the drift *detectable*: `capi.parity.test.ts` in `packages/backend` runs those\n * copies over the same table as these and fails when they stop agreeing. That is\n * the whole problem — the copies are identical today and nothing was watching.\n * One of them, Google Ads' phone rule, is genuinely a third rule and cannot be\n * pinned to either version; the test says so in place of pretending otherwise.\n *\n * Two ideas make that fixable rather than merely fixed:\n *\n * - **The version is data.** A digest cannot be recomputed — the plaintext was\n *   dropped on purpose, which is the point of holding a digest at all. So the\n *   rule that produced it is frozen as v1 and kept, and a better rule ships\n *   beside it as v2. Anything holding plaintext produces both and looks up\n *   both, which is why a normalization change cannot orphan the history.\n * - **The provider form is not the version.** Meta hashes E.164 without the\n *   `+`, Google hashes it with the `+` and canonicalizes Gmail addresses. Those\n *   are three digests of one canonical value, not three normalizations.\n */\n\nimport { sha256Hex } from \"./digest\";\nimport { normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nimport { normalizePhoneV1, normalizePhoneV2 } from \"./phone\";\nimport { providerPlain } from \"./providers\";\nimport type { CanonicalIdentity, IdentityInput, NormalizationVersion } from \"./types\";\n\nexport { externalIdDigest, isSha256Hex, normalizeExternalId, normalizeSha256Hex, sha256Hex } from \"./digest\";\nexport { googleEmail, normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nexport { normalizePhoneV1, normalizePhoneV2, phoneWithoutPlus } from \"./phone\";\nexport { type ProviderPlain, providerPlain } from \"./providers\";\nexport {\n  type CanonicalIdentity,\n  type IdentityInput,\n  type IdentityKind,\n  NORMALIZATION_VERSIONS,\n  type NormalizationVersion,\n} from \"./types\";\nexport { extractDomain, isPublicEmailDomain, workEmailDomain } from \"./workDomain\";\n\n/**\n * Apply one version's rule to plain text, or decline it.\n *\n * `null` means this version has no usable form of this value — not that the\n * person has no phone. Under v2 that happens to any national number, on\n * purpose: see {@link normalizePhoneV2}.\n */\nexport function normalizeIdentity(raw: IdentityInput, version: NormalizationVersion): CanonicalIdentity | null {\n  const value =\n    raw.kind === \"email\"\n      ? version === 1\n        ? normalizeEmailV1(raw.value)\n        : normalizeEmailV2(raw.value)\n      : version === 1\n        ? normalizePhoneV1(raw.value)\n        : normalizePhoneV2(raw.value);\n  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };\n}\n\n/**\n * The digests one canonical value produces, keyed by who asks for them.\n *\n * Snake case because this is a wire shape: it is what the browser sends, what\n * the ingest stores, and what an activation payload reads. `google_sha256` is\n * `null` when Google has no usable form of the value — a Gmail address whose\n * local part was only a `+tag`.\n */\nexport type IdentityDigests = {\n  canonical_sha256: string;\n  meta_sha256: string;\n  google_sha256: string | null;\n  normalization_version: NormalizationVersion;\n};\n\nexport async function providerDigests(canonical: CanonicalIdentity): Promise<IdentityDigests> {\n  const plain = providerPlain(canonical);\n  const [canonicalSha, metaSha, googleSha] = await Promise.all([\n    sha256Hex(plain.canonical),\n    sha256Hex(plain.meta),\n    plain.google === null ? Promise.resolve(null) : sha256Hex(plain.google),\n  ]);\n  return {\n    canonical_sha256: canonicalSha,\n    meta_sha256: metaSha,\n    google_sha256: googleSha,\n    normalization_version: canonical.normalizationVersion,\n  };\n}\n\n/**\n * The compact set a page sends and an ingest reads: one entry per version, plus\n * the two provider digests, for one plaintext value.\n *\n * `meta` and `google` are computed from the best version that produced a value\n * — v2 when it accepted the value, v1 otherwise — because a platform wants one\n * digest, not a history. `v1` and `v2` are both present when both rules\n * accepted the value, and they are equal when the two rules agreed.\n *\n * `null` when no version has a usable form: there is nothing to report, and\n * reporting an empty digest would be reporting the hash of the empty string.\n */\nexport type IdentityDigestSet = {\n  v1?: string;\n  v2?: string;\n  meta: string;\n  google?: string;\n};\n\nexport async function identityDigestSet(raw: IdentityInput): Promise<IdentityDigestSet | null> {\n  const v1 = normalizeIdentity(raw, 1);\n  const v2 = normalizeIdentity(raw, 2);\n  const best = v2 ?? v1;\n  if (best === null) return null;\n  const digests = await providerDigests(best);\n  return {\n    ...(v1 === null ? {} : { v1: v1.value === best.value ? digests.canonical_sha256 : await sha256Hex(v1.value) }),\n    ...(v2 === null ? {} : { v2: digests.canonical_sha256 }),\n    meta: digests.meta_sha256,\n    ...(digests.google_sha256 === null ? {} : { google: digests.google_sha256 }),\n  };\n}\n","/**\n * The customer-matching block: one vocabulary for everything Meta calls\n * *advanced matching* and Google calls *enhanced conversions*.\n *\n * ## Why these fields are here at all\n *\n * A server event is worth what it can be joined to. An email is the join that\n * works, and everything in this file is the second-best set for when the join\n * has to happen *outward* instead — Meta and Google both accept an event with\n * no email at all if it carries enough of a person: a name and a postcode, a\n * click id, a browser cookie. They disagree about spelling and about what has\n * to be hashed, and they do not disagree about the set.\n *\n * Two things follow, and they are the whole design:\n *\n * - **One block, one spelling.** A sender maps their CRM once, here, rather\n *   than once per destination. `MATCH_FIELD_FORWARDING` is the table that says\n *   what each field is called on the other side, so the mapping is published\n *   rather than folklore.\n * - **Kept in the form every destination can still be derived from.** That rule\n *   decides, per field, whether it is stored hashed or in the clear, and it is\n *   the only rule here worth remembering: **a digest can be computed later and\n *   never undone.** A city hashed on arrival can never be sent to Google, which\n *   wants `address_info.city` in plain text; a city kept in the clear can be\n *   hashed for Meta at the moment of sending, for free.\n *\n * So: hashed here are the fields **both** destinations want hashed and which\n * identify a person on their own — email, phone, the two names, the date of\n * birth, and the sender's own id. Kept in the clear are the coarse ones that\n * identify nobody by themselves and that Google wants unhashed: city, region,\n * postal code, country, and the gender letter. Hashing that second set would\n * buy no privacy — the digest of `es` is not a secret — and would cost the\n * ability to send them anywhere.\n *\n * ## A value that arrives already hashed\n *\n * Accepted for every field, and detected rather than declared. There is no\n * `email_sha256` beside `email` any more, because two fields for one idea is a\n * choice a sender should never have had to make: a 64-character hex string is\n * unambiguously a digest — no address, phone number, city or name can be one —\n * so the field can hold either and we can tell. What we cannot do is *unhash*,\n * so a digest arriving for a field this module would otherwise keep in the\n * clear is stored under `<field>_sha256`: the key says what is inside it, and a\n * forward that needs the plain value knows it does not have one.\n *\n * ## Normalization is Meta's, and the divergence is stated\n *\n * The hashed fields are normalized under the rule Meta publishes (lower case,\n * trimmed, punctuation and spacing removed) because a digest can only be\n * computed under one rule and Meta's is the stricter of the two. Google's rule\n * for a name is lower-case-and-trim only, so the two agree on every name\n * without punctuation in it and differ on `O'Brien`. Email and phone do not\n * have this problem: they go through `../identity`, which is the platform's one\n * versioned rule and the same one the browser beacon writes with — which is\n * what makes a server event and a Form submission land on one person.\n */\n\nimport { isSha256Hex, sha256Hex } from \"../identity\";\n\n/**\n * A field of `user_data` that describes the person rather than naming a click.\n *\n * `email` and `phone` are deliberately not here: they are resolved by\n * `./identity` into the row's own `identity_hash`, under the platform's\n * versioned rule, and this module reads that result rather than hashing them a\n * second time under a different one.\n */\nexport const MATCH_FIELDS = [\n  \"first_name\",\n  \"last_name\",\n  \"date_of_birth\",\n  \"gender\",\n  \"city\",\n  \"region\",\n  \"postal_code\",\n  \"country\",\n] as const;\nexport type MatchField = (typeof MATCH_FIELDS)[number];\n\n/**\n * The browser cookies Meta's pixel sets, which name a browser rather than a\n * person.\n *\n * `fbp` is the pixel's own first-party cookie and `fbc` is the one it derives\n * from a click. Both are sent to Meta **unhashed and verbatim** — they are\n * opaque strings of Meta's own making, and hashing one destroys it — so they\n * are stored exactly as they arrived.\n *\n * They are not in {@link MATCH_FIELDS} and not in the click-id list either.\n * They are not click ids: a `gclid` is stamped on a URL by the ad platform and\n * has a column of its own here because reports filter on it, while `fbp` is a\n * cookie a script wrote and nothing reports on. But they *do* name somebody,\n * which is why `namesSomebody` counts them — an event carrying only an `fbp` is\n * still an event Meta can attribute, and refusing it would lose exactly the\n * conversions this block exists to make sendable.\n */\nexport const MATCH_COOKIES = [\"fbp\", \"fbc\"] as const;\nexport type MatchCookie = (typeof MATCH_COOKIES)[number];\n\n/** How a field is stored, once it has been normalized. */\ntype Keeping = \"hashed\" | \"plain\";\n\ntype MatchSpec = {\n  keep: Keeping;\n  /** The canonical form, or `null` when the value says nothing usable. */\n  normalize: (value: string) => string | null;\n  /** What Meta and Google call this field, for the published mapping. */\n  meta: string;\n  google: string | null;\n};\n\n/** Lower-cased, trimmed, and stripped of everything that is not a letter or a digit. Meta's rule. */\nfunction tightened(value: string): string | null {\n  const stripped = value.toLowerCase().replace(/[^\\p{L}\\p{N}]/gu, \"\");\n  return stripped === \"\" ? null : stripped;\n}\n\n/** Lower-cased and trimmed, with runs of whitespace collapsed. Nothing else is removed. */\nfunction loosened(value: string): string | null {\n  const collapsed = value.trim().toLowerCase().replace(/\\s+/g, \" \");\n  return collapsed === \"\" ? null : collapsed;\n}\n\n/**\n * `1985-04-09`, `1985/04/09`, `19850409` — eight digits in year-month-day\n * order, however they are punctuated.\n *\n * The order is not guessed. `09/04/1985` is refused rather than read as the\n * ninth of April or the fourth of September: nothing in the value says which,\n * and a birth date hashed under the wrong reading is a digest that matches\n * nobody at Meta, with no error anywhere to say so. A refusal costs one field\n * on one event and is visible in the arrival log; a wrong guess costs the match\n * and is not.\n */\nfunction birthDate(value: string): string | null {\n  const digits = value.replace(/\\D/g, \"\");\n  if (!/^\\d{8}$/.test(digits)) return null;\n  const month = Number(digits.slice(4, 6));\n  const day = Number(digits.slice(6, 8));\n  if (month < 1 || month > 12 || day < 1 || day > 31) return null;\n  return digits;\n}\n\n/** `f` or `m`, from whatever word or letter the sender's system stores. */\nfunction genderLetter(value: string): string | null {\n  const first = value.trim().toLowerCase().charAt(0);\n  return first === \"f\" || first === \"m\" ? first : null;\n}\n\n/** ISO-3166 alpha-2, lower-cased. A country name is refused rather than guessed at. */\nfunction countryCode(value: string): string | null {\n  const code = value.trim().toLowerCase();\n  return /^[a-z]{2}$/.test(code) ? code : null;\n}\n\nexport const MATCH_SPECS: Readonly<Record<MatchField, MatchSpec>> = {\n  first_name: { keep: \"hashed\", normalize: tightened, meta: \"fn\", google: \"hashed_first_name\" },\n  last_name: { keep: \"hashed\", normalize: tightened, meta: \"ln\", google: \"hashed_last_name\" },\n  // Meta only. Google's enhanced conversions have no date of birth, so there is\n  // no destination wanting it in the clear and every reason not to keep one.\n  date_of_birth: { keep: \"hashed\", normalize: birthDate, meta: \"db\", google: null },\n  gender: { keep: \"plain\", normalize: genderLetter, meta: \"ge\", google: null },\n  city: { keep: \"plain\", normalize: loosened, meta: \"ct\", google: \"city\" },\n  region: { keep: \"plain\", normalize: loosened, meta: \"st\", google: \"state\" },\n  postal_code: { keep: \"plain\", normalize: loosened, meta: \"zp\", google: \"postal_code\" },\n  country: { keep: \"plain\", normalize: countryCode, meta: \"country\", google: \"country_code\" },\n};\n\n/** One row of the published mapping: our name, Meta's, Google's, and whether we hold it hashed. */\nexport type MatchFieldForwarding = {\n  field: string;\n  meta: string;\n  google: string | null;\n  hashed: boolean;\n};\n\n/**\n * What each field of the matching block is called at the destinations that\n * accept it — the table the dialog and the docs both read.\n *\n * Published rather than described, because \"it maps onto Meta's user_data\" is\n * a promise a sender cannot check and this is the same promise they can.\n */\nexport const MATCH_FIELD_FORWARDING: readonly MatchFieldForwarding[] = [\n  { field: \"email\", meta: \"em\", google: \"hashed_email\", hashed: true },\n  { field: \"phone\", meta: \"ph\", google: \"hashed_phone_number\", hashed: true },\n  // Kept in the clear — see `resolveOwnId`. The digest is still computed and\n  // still stored beside it, so a Meta forward has one; what changed is that the\n  // sender's own key is now readable, which is the entire reason they sent it.\n  { field: \"external_id\", meta: \"external_id\", google: null, hashed: false },\n  ...MATCH_FIELDS.map((field) => ({\n    field,\n    meta: MATCH_SPECS[field].meta,\n    google: MATCH_SPECS[field].google,\n    hashed: MATCH_SPECS[field].keep === \"hashed\",\n  })),\n  { field: \"fbp\", meta: \"fbp\", google: null, hashed: false },\n  { field: \"fbc\", meta: \"fbc\", google: null, hashed: false },\n];\n\n/** The longest a stored match value may be, matching the width the map's values are held at. */\nconst MAX_MATCH_VALUE = 255;\n\n/**\n * One field, resolved to the key it is stored under and the value stored there.\n *\n * `null` when the field said nothing usable — `gender: \"unknown\"`, a country\n * spelled out in full, a postcode of whitespace. A field that is present and\n * unusable contributes nothing rather than storing something that matches\n * nobody, which is the same rule the identity resolution follows.\n */\nexport async function resolveMatchField(\n  field: MatchField,\n  raw: string,\n): Promise<{ key: string; value: string } | null> {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  const spec = MATCH_SPECS[field];\n  // Already a digest, whatever this field would otherwise keep. Taken at face\n  // value — hashing a hash matches nothing, forever — and keyed so that the\n  // name says what is inside, because a plain-text destination cannot use it.\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  const normalized = spec.normalize(value);\n  if (normalized === null) return null;\n  if (spec.keep === \"plain\") return { key: field, value: normalized.slice(0, MAX_MATCH_VALUE) };\n  return { key: `${field}_sha256`, value: await sha256Hex(normalized) };\n}\n\n/**\n * The two ids that are not facts about a person but *names the sender chose*,\n * kept exactly as they were sent.\n *\n * `external_id` is the client's own key — a HubSpot contact id, a Salesforce\n * record id — and `baker_id` is a cookie value one of our own pages minted.\n * Neither describes anybody: they are pointers, and a pointer is worth only\n * what it can be followed with.\n *\n * ## Why these are the exception to \"identifying fields are hashed\"\n *\n * `external_id` used to be hashed here and nothing else, on the reasoning that\n * it is sometimes an email or a document number in disguise. That reasoning\n * held and the consequence did not: it made the field **useless to the person\n * who sent it**. An integrator posting `external_id: \"hs:contact:12345\"` opened\n * the event and read *Provided, stored hashed* — no way to check we had read\n * the right record, no way to paste the id back into their CRM, and no way to\n * tell a working integration from one silently keyed on the wrong column. The\n * whole point of the field is to be recognised on the way back out.\n *\n * The privacy this bought was also smaller than it looked. The digest is still\n * computed, still what `identity_hash` stores and still what the identity graph\n * joins on — see `./identity` — so nothing about the joining changed. What is\n * new is a second copy in the clear, under the key that says so.\n *\n * A value that arrives *already* a digest still keeps `<field>_sha256`, for the\n * rule that governs every field here: a digest cannot be undone, so the key has\n * to say what is inside it.\n */\nexport function resolveOwnId(field: \"external_id\" | \"baker_id\", raw: string): { key: string; value: string } | null {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  return { key: field, value: value.slice(0, MAX_MATCH_VALUE) };\n}\n\n/** A cookie value, as Meta minted it: bounded, and otherwise untouched. */\nexport function resolveMatchCookie(raw: string): string | null {\n  const value = raw.trim();\n  return value === \"\" ? null : value.slice(0, MAX_MATCH_VALUE);\n}\n\n/**\n * The `fbclid` hiding inside an `fbc`, or `null`.\n *\n * `fbc` is `fb.<subdomain index>.<timestamp>.<fbclid>` — Meta's own encoding of\n * a click id it already saw. A sender whose system stored the cookie has the\n * click id and does not know it, so reading it out costs one split and gives\n * the event the same paid-attribution column a landing page would have written\n * from the URL. Nothing is invented: the value was there.\n */\nexport function fbclidFromFbc(fbc: string): string | null {\n  const parts = fbc.split(\".\");\n  if (parts.length < 4 || parts[0] !== \"fb\") return null;\n  const id = parts.slice(3).join(\".\");\n  return id === \"\" ? null : id;\n}\n","/**\n * The click ids a sender may hand over, named the way their own system stored\n * them.\n *\n * The wire uses the **URL parameter** spelling (`li_fat_id`) rather than the\n * analytics row's field spelling (`liFatId`), because a client's CRM captured\n * these off a landing URL and that is the name it wrote them down under.\n * {@link clickIdsFromWire} is the one place the two vocabularies meet.\n *\n * Mirrored from `CLICK_ID_FIELDS` in `../analytics/normalize.ts`, which is the\n * source of truth for which click ids the store has columns for.\n * `vocabulary.parity.test.ts` reads that file and fails if the two drift — a\n * missing entry here is an attribution a client sent and we dropped.\n */\n\nimport type { ClickIdFields } from \"../analytics/normalize\";\n\nexport const INGEST_CLICK_ID_PARAMS = [\n  \"gclid\",\n  \"wbraid\",\n  \"gbraid\",\n  \"dclid\",\n  \"fbclid\",\n  \"ttclid\",\n  \"twclid\",\n  \"li_fat_id\",\n  \"msclkid\",\n  \"rdt_cid\",\n  \"epik\",\n  \"sccid\",\n  \"oppref\",\n] as const;\nexport type IngestClickIdParam = (typeof INGEST_CLICK_ID_PARAMS)[number];\n\nconst FIELD_FOR_PARAM: Readonly<Record<IngestClickIdParam, keyof ClickIdFields>> = {\n  gclid: \"gclid\",\n  wbraid: \"wbraid\",\n  gbraid: \"gbraid\",\n  dclid: \"dclid\",\n  fbclid: \"fbclid\",\n  ttclid: \"ttclid\",\n  twclid: \"twclid\",\n  li_fat_id: \"liFatId\",\n  msclkid: \"msclkid\",\n  rdt_cid: \"rdtCid\",\n  epik: \"epik\",\n  sccid: \"sccid\",\n  oppref: \"oppref\",\n};\n\n/** The wire's click block as the analytics row builder names its fields. Empty values are dropped. */\nexport function clickIdsFromWire(click: Partial<Record<IngestClickIdParam, string | null>> | null | undefined): {\n  clickIds: ClickIdFields;\n  kinds: IngestClickIdParam[];\n} {\n  const clickIds: ClickIdFields = {};\n  const kinds: IngestClickIdParam[] = [];\n  for (const param of INGEST_CLICK_ID_PARAMS) {\n    const value = click?.[param];\n    if (typeof value !== \"string\" || value === \"\") continue;\n    clickIds[FIELD_FOR_PARAM[param]] = value;\n    kinds.push(param);\n  }\n  return { clickIds, kinds };\n}\n","/**\n * What a source can be read into: the fields of an event, named the way\n * `POST /v1/events` already names them.\n *\n * Assembled from the ingest vocabulary rather than spelled a fourth time. A\n * mapping is `SourceField → dotted path`, and the field half of that pair has\n * to be a name the wire already accepts, because the whole of what a source\n * does is build an `IngestEventInput` and hand it to the same door the\n * client's own server would have used. A field that existed only here would be\n * a field the event could not carry.\n */\n\nimport { MATCH_FIELDS, type MatchField } from \"../event-ingest/matching\";\nimport type { IngestClickIdParam } from \"../event-ingest/vocabulary\";\nimport { INGEST_CLICK_ID_PARAMS } from \"../event-ingest/vocabulary\";\n\n/** Where a field sits on the sheet: one row per group, in this order. */\nexport type SourceFieldGroup = \"event\" | \"person\" | \"money\" | \"click\";\n\nexport type SourceField =\n  | \"event_name\"\n  | \"event_time\"\n  | \"event_id\"\n  | \"email\"\n  | \"phone\"\n  | \"external_id\"\n  | MatchField\n  | \"value\"\n  | \"currency\"\n  | IngestClickIdParam;\n\nexport interface SourceFieldSpec {\n  field: SourceField;\n  /** The product word for it — what the sheet and the CLI show. */\n  label: string;\n  group: SourceFieldGroup;\n}\n\nconst MATCH_LABELS: Readonly<Record<MatchField, string>> = {\n  first_name: \"First name\",\n  last_name: \"Last name\",\n  date_of_birth: \"Date of birth\",\n  gender: \"Gender\",\n  city: \"City\",\n  region: \"Region\",\n  postal_code: \"Postcode\",\n  country: \"Country\",\n};\n\nconst CLICK_LABELS: Readonly<Record<IngestClickIdParam, string>> = {\n  gclid: \"Google click id\",\n  wbraid: \"Google click id (iOS, web to app)\",\n  gbraid: \"Google click id (iOS, app)\",\n  dclid: \"Google click id (Display & Video)\",\n  fbclid: \"Meta click id\",\n  ttclid: \"TikTok click id\",\n  twclid: \"X click id\",\n  li_fat_id: \"LinkedIn click id\",\n  msclkid: \"Microsoft click id\",\n  rdt_cid: \"Reddit click id\",\n  epik: \"Pinterest click id\",\n  sccid: \"Snapchat click id\",\n  oppref: \"ChatGPT Ads click id\",\n};\n\nexport const SOURCE_FIELDS: readonly SourceFieldSpec[] = [\n  { field: \"event_name\", label: \"What happened\", group: \"event\" },\n  { field: \"event_time\", label: \"When it happened\", group: \"event\" },\n  { field: \"event_id\", label: \"Its id\", group: \"event\" },\n  { field: \"email\", label: \"Email\", group: \"person\" },\n  { field: \"phone\", label: \"Phone\", group: \"person\" },\n  { field: \"external_id\", label: \"Your own id for the person\", group: \"person\" },\n  ...MATCH_FIELDS.map((field) => ({ field, label: MATCH_LABELS[field], group: \"person\" as const })),\n  { field: \"value\", label: \"Amount\", group: \"money\" },\n  { field: \"currency\", label: \"Currency\", group: \"money\" },\n  ...INGEST_CLICK_ID_PARAMS.map((field) => ({ field, label: CLICK_LABELS[field], group: \"click\" as const })),\n];\n\nexport const SOURCE_FIELD_NAMES: readonly SourceField[] = SOURCE_FIELDS.map((spec) => spec.field);\n\nconst FIELD_SET: ReadonlySet<string> = new Set(SOURCE_FIELD_NAMES);\n\nexport function isSourceField(value: string): value is SourceField {\n  return FIELD_SET.has(value);\n}\n\nexport const SOURCE_FIELD_GROUPS: readonly { group: SourceFieldGroup; label: string; detail: string }[] = [\n  { group: \"event\", label: \"The event\", detail: \"What it is called, when it happened, and its own id.\" },\n  {\n    group: \"person\",\n    label: \"Who it is about\",\n    detail: \"How the platforms find the person. Email or phone is the one that matters.\",\n  },\n  {\n    group: \"money\",\n    label: \"What it was worth\",\n    detail: \"The amount and its currency, for revenue and for the platforms.\",\n  },\n  {\n    group: \"click\",\n    label: \"The ad click that brought them\",\n    detail: \"When the source keeps the click id, the campaign gets the credit.\",\n  },\n];\n\n/**\n * A row that is not a field of the event but one of its own **properties** —\n * the flat `properties` object every event carries, which Measure → Events\n * breaks an event down by and which a send can forward to a platform as an\n * extra parameter (Meta's `custom_data`, a GA4 event parameter).\n *\n * Spelled `properties.<key>` in the mapping so the row shares the table with\n * the fields and the CLI's `--field` takes it unchanged, while an unknown bare\n * key is still refused: the namespace is what tells a deliberate extra\n * property from a typo that would otherwise silently map nothing.\n */\nexport const PROPERTY_ROW_PREFIX = \"properties.\";\n\n/** The longest a property's key may be. Keys are a shared dictionary in the store, so they are kept short and plain. */\nexport const PROPERTY_KEY_MAX = 64;\n\n/** Letters, digits, underscore, dash and dot — what a property key of `POST /v1/events` may be, and what a platform parameter name may be. */\nconst PROPERTY_KEY = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;\n\n/** Keys a source writes itself; a row naming one would be overwritten in silence. */\nexport const RESERVED_PROPERTY_KEYS: readonly string[] = [\"baker_source\", \"hubspot_property\", \"hubspot_value\"];\n\n/** Whether a mapping row names a property rather than a field. */\nexport function isPropertyRow(row: string): boolean {\n  return row.startsWith(PROPERTY_ROW_PREFIX);\n}\n\n/** The property's own key, for a `properties.<key>` row; null for anything else. */\nexport function propertyKeyOf(row: string): string | null {\n  return isPropertyRow(row) ? row.slice(PROPERTY_ROW_PREFIX.length) : null;\n}\n\n/** The mapping row for a property key. */\nexport function propertyRow(key: string): string {\n  return `${PROPERTY_ROW_PREFIX}${key}`;\n}\n\n/**\n * Why a property key cannot be used, in one sentence, or null when it can.\n * The same rule for a source's extra properties and for a send's parameters.\n */\nexport function propertyKeyProblem(key: string): string | null {\n  const trimmed = key.trim();\n  if (trimmed === \"\") return \"A property needs a name.\";\n  if (trimmed.length > PROPERTY_KEY_MAX) return `A property name is at most ${PROPERTY_KEY_MAX} characters.`;\n  if (!PROPERTY_KEY.test(trimmed)) {\n    return `\"${trimmed}\" is not a property name: letters, digits, underscore, dash and dot only, starting with a letter or digit.`;\n  }\n  if (RESERVED_PROPERTY_KEYS.includes(trimmed)) return `\"${trimmed}\" is written by Baker itself; pick another name.`;\n  return null;\n}\n\n/**\n * Whether a mapping row is one a source can hold: a field of the event, or a\n * well-named property. The reason when it is not.\n */\nexport function mappingRowProblem(row: string): string | null {\n  if (isSourceField(row)) return null;\n  const key = propertyKeyOf(row);\n  if (key === null) {\n    return `\"${row}\" is not a field an event can carry. A field is one of ${SOURCE_FIELD_NAMES.join(\", \")}; an extra property is spelled properties.<name>.`;\n  }\n  return propertyKeyProblem(key);\n}\n\n/** The property rows of a mapping, as `key → template`, in the order stored. */\nexport function propertyRows(mapping: Readonly<Record<string, string>>): { key: string; template: string }[] {\n  return Object.entries(mapping).flatMap(([row, template]) => {\n    const key = propertyKeyOf(row);\n    return key === null ? [] : [{ key, template }];\n  });\n}\n","/**\n * A mapping row is a template: literal text with `{{mentions}}` in it.\n *\n * ## Why a template and not a path\n *\n * A row used to hold one dotted path, and one path answers one question —\n * \"which field of the payload is the email\". It cannot answer the next three:\n * a currency the tool never sends but the company knows (`EUR`), a name split\n * over two fields (`{{firstname}} {{lastname}}`), or an amount a HubSpot\n * contact carries under a property nobody would guess. A template answers all\n * of them with one rule the Forms builder already teaches: type text, insert\n * a variable. The same spelling is what the CLI takes, so an agent and a\n * person write the same thing.\n *\n * ## What a mention points at\n *\n * Whatever the source can read. For an address it is a dotted path into the\n * payload (`contact.email`, `deal.contacts.0.email`); for a HubSpot read it\n * is a contact property's internal name (`hs_google_click_id`), plus `id` for\n * the contact's own id. The template does not know which — the lookup passed\n * to `renderTemplate` does.\n *\n * A mention names exactly one thing. There was a `{{phone|mobilephone}}`\n * spelling for \"the first that holds anything\"; it is gone, because it was a\n * rule the Forms builder's variables do not have, and a row that reads\n * differently from every other variable field in the product is a row nobody\n * can predict. A person who wants the mobile picks the mobile.\n */\n\nconst MENTION = /\\{\\{\\s*([^{}]+?)\\s*\\}\\}/g;\n\n/** The path a mention names, with the braces on. */\nexport function mentionOf(path: string): string {\n  return `{{${path}}}`;\n}\n\n/** Every path a template reads, in order, once each. */\nexport function templateMentions(template: string): string[] {\n  const seen: string[] = [];\n  for (const match of template.matchAll(MENTION)) {\n    const path = (match[1] ?? \"\").trim();\n    if (path !== \"\" && !seen.includes(path)) seen.push(path);\n  }\n  return seen;\n}\n\n/**\n * The template with every mention replaced by what it points at, trimmed —\n * or nothing, when what is left is empty. An empty mention reads as empty\n * text rather than as its own spelling, so a template made only of mentions\n * the payload did not fill is \"not sent\", not the literal `{{phone}}`.\n */\nexport function renderTemplate(template: string, lookup: (path: string) => string | undefined): string | undefined {\n  const rendered = template.replace(MENTION, (_whole, path: string) => lookup(path.trim()) ?? \"\").trim();\n  return rendered === \"\" ? undefined : rendered;\n}\n\n/** The one path a template is, when it is exactly one mention and nothing else. */\nexport function isBareMention(template: string): string | null {\n  const match = /^\\{\\{\\s*([^{}]+?)\\s*\\}\\}$/.exec(template.trim());\n  return match === null ? null : (match[1] ?? null);\n}\n"],"mappings":";AAcA,IAAM,aAAa;AAQZ,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK,KAAK;AAC9B;;;ACNO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,YAAY,KAAK,OAAO;AACjC;AAGA,IAAM,QAAQ;AAMP,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,MAAM,KAAK,OAAO,IAAI,UAAU;AACzC;;;AChBO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,SAAS,IACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,EAAE;AACxB,SAAO,WAAW,KAAK,OAAO,IAAI,MAAM;AAC1C;AAGA,IAAM,oBAAoB;AAE1B,IAAM,OAAO;AAYN,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,QAAQ,mBAAmB,EAAE;AACjD,QAAM,OAAO,QAAQ,WAAW,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,KAAK;AACjE,SAAO,KAAK,KAAK,IAAI,IAAI,OAAO;AAClC;;;ACgBO,SAAS,kBAAkB,KAAoB,SAAyD;AAC7G,QAAM,QACJ,IAAI,SAAS,UACT,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK,IAC5B,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK;AAClC,SAAO,UAAU,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,OAAO,sBAAsB,QAAQ;AACxF;;;ACHO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAgB,CAAC,OAAO,KAAK;AAgB1C,SAAS,UAAU,OAA8B;AAC/C,QAAM,WAAW,MAAM,YAAY,EAAE,QAAQ,mBAAmB,EAAE;AAClE,SAAO,aAAa,KAAK,OAAO;AAClC;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AAChE,SAAO,cAAc,KAAK,OAAO;AACnC;AAaA,SAAS,UAAU,OAA8B;AAC/C,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,MAAI,CAAC,UAAU,KAAK,MAAM,EAAG,QAAO;AACpC,QAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACvC,QAAM,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACrC,MAAI,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK,MAAM,GAAI,QAAO;AAC3D,SAAO;AACT;AAGA,SAAS,aAAa,OAA8B;AAClD,QAAM,QAAQ,MAAM,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;AACjD,SAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAClD;AAGA,SAAS,YAAY,OAA8B;AACjD,QAAM,OAAO,MAAM,KAAK,EAAE,YAAY;AACtC,SAAO,aAAa,KAAK,IAAI,IAAI,OAAO;AAC1C;AAEO,IAAM,cAAuD;AAAA,EAClE,YAAY,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,oBAAoB;AAAA,EAC5F,WAAW,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,mBAAmB;AAAA;AAAA;AAAA,EAG1F,eAAe,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,KAAK;AAAA,EAChF,QAAQ,EAAE,MAAM,SAAS,WAAW,cAAc,MAAM,MAAM,QAAQ,KAAK;AAAA,EAC3E,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,OAAO;AAAA,EACvE,QAAQ,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,QAAQ;AAAA,EAC1E,aAAa,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,cAAc;AAAA,EACrF,SAAS,EAAE,MAAM,SAAS,WAAW,aAAa,MAAM,WAAW,QAAQ,eAAe;AAC5F;AAiBO,IAAM,yBAA0D;AAAA,EACrE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,gBAAgB,QAAQ,KAAK;AAAA,EACnE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,uBAAuB,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI1E,EAAE,OAAO,eAAe,MAAM,eAAe,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzE,GAAG,aAAa,IAAI,CAAC,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,KAAK,EAAE;AAAA,IACzB,QAAQ,YAAY,KAAK,EAAE;AAAA,IAC3B,QAAQ,YAAY,KAAK,EAAE,SAAS;AAAA,EACtC,EAAE;AAAA,EACF,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzD,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAC3D;;;ACrLO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACOA,IAAM,eAAqD;AAAA,EACzD,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,eAA6D;AAAA,EACjE,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,gBAA4C;AAAA,EACvD,EAAE,OAAO,cAAc,OAAO,iBAAiB,OAAO,QAAQ;AAAA,EAC9D,EAAE,OAAO,cAAc,OAAO,oBAAoB,OAAO,QAAQ;AAAA,EACjE,EAAE,OAAO,YAAY,OAAO,UAAU,OAAO,QAAQ;AAAA,EACrD,EAAE,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;AAAA,EAClD,EAAE,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;AAAA,EAClD,EAAE,OAAO,eAAe,OAAO,8BAA8B,OAAO,SAAS;AAAA,EAC7E,GAAG,aAAa,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,aAAa,KAAK,GAAG,OAAO,SAAkB,EAAE;AAAA,EAChG,EAAE,OAAO,SAAS,OAAO,UAAU,OAAO,QAAQ;AAAA,EAClD,EAAE,OAAO,YAAY,OAAO,YAAY,OAAO,QAAQ;AAAA,EACvD,GAAG,uBAAuB,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,aAAa,KAAK,GAAG,OAAO,QAAiB,EAAE;AAC3G;AAEO,IAAM,qBAA6C,cAAc,IAAI,CAAC,SAAS,KAAK,KAAK;AAEhG,IAAM,YAAiC,IAAI,IAAI,kBAAkB;AAE1D,SAAS,cAAc,OAAqC;AACjE,SAAO,UAAU,IAAI,KAAK;AAC5B;AAgCO,IAAM,sBAAsB;AAG5B,IAAM,mBAAmB;AAGhC,IAAM,eAAe;AAGd,IAAM,yBAA4C,CAAC,gBAAgB,oBAAoB,eAAe;AAGtG,SAAS,cAAc,KAAsB;AAClD,SAAO,IAAI,WAAW,mBAAmB;AAC3C;AAGO,SAAS,cAAc,KAA4B;AACxD,SAAO,cAAc,GAAG,IAAI,IAAI,MAAM,oBAAoB,MAAM,IAAI;AACtE;AAWO,SAAS,mBAAmB,KAA4B;AAC7D,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,YAAY,GAAI,QAAO;AAC3B,MAAI,QAAQ,SAAS,iBAAkB,QAAO,8BAA8B,gBAAgB;AAC5F,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,WAAO,IAAI,OAAO;AAAA,EACpB;AACA,MAAI,uBAAuB,SAAS,OAAO,EAAG,QAAO,IAAI,OAAO;AAChE,SAAO;AACT;AAMO,SAAS,kBAAkB,KAA4B;AAC5D,MAAI,cAAc,GAAG,EAAG,QAAO;AAC/B,QAAM,MAAM,cAAc,GAAG;AAC7B,MAAI,QAAQ,MAAM;AAChB,WAAO,IAAI,GAAG,0DAA0D,mBAAmB,KAAK,IAAI,CAAC;AAAA,EACvG;AACA,SAAO,mBAAmB,GAAG;AAC/B;;;AC3IA,IAAM,UAAU;AAGT,SAAS,UAAU,MAAsB;AAC9C,SAAO,KAAK,IAAI;AAClB;AAGO,SAAS,iBAAiB,UAA4B;AAC3D,QAAM,OAAiB,CAAC;AACxB,aAAW,SAAS,SAAS,SAAS,OAAO,GAAG;AAC9C,UAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,KAAK;AACnC,QAAI,SAAS,MAAM,CAAC,KAAK,SAAS,IAAI,EAAG,MAAK,KAAK,IAAI;AAAA,EACzD;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-EI5QN4UO.js

@@ -0,0 +1,363 @@
+import {
+  MAX_VIDEO_INGEST_BYTES,
+  MAX_VIDEO_INGEST_SECONDS,
+  directDedupeKey,
+  downloadTimeoutMs,
+  isDirectMediaUrl,
+  isDrmProtected,
+  isRegionBlocked,
+  isToolingOrBlockFailure,
+  refuseByDuration,
+  resolveIngestSource,
+  worthDownloadingInstead
+} from "./chunk-FKOECEVC.js";
+import {
+  YtDlpError,
+  canonicalUrl,
+  durationSeconds,
+  isAudioOnly,
+  isVimeoAuthFailure,
+  probeYtDlp,
+  runYtDlp,
+  ytDlpBlockSignal
+} from "./chunk-W4SA4CMR.js";
+import {
+  videosIngestRequestSchema
+} from "./chunk-O6XZIQXZ.js";
+import {
+  ApiError,
+  apiPost
+} from "./chunk-CUL3VB4L.js";
+import {
+  captureVimeoCookie,
+  isProxyFailure
+} from "./chunk-I4FTS5EE.js";
+import {
+  registerSchema,
+  writeJson
+} from "./chunk-MYTDK3AL.js";
+
+// src/commands/videos/ingest.ts
+import { mkdtemp, rm, stat } from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+import { defineCommand } from "citty";
+
+// src/lib/streamUpload.ts
+import { createHash } from "crypto";
+import { createReadStream } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+async function hashFile(filePath) {
+  const hash = createHash("sha256");
+  await pipeline(createReadStream(filePath), hash);
+  return hash.digest("hex");
+}
+async function putFileStreamed(args) {
+  const body = Readable.toWeb(createReadStream(args.filePath));
+  return await fetch(args.putUrl, {
+    method: "PUT",
+    body,
+    headers: {
+      "Content-Type": args.contentType,
+      "Content-Length": String(args.sizeBytes)
+    },
+    duplex: "half"
+  });
+}
+
+// src/commands/videos/ingest.ts
+registerSchema({
+  command: "videos.ingest",
+  description: "Add a video to the library from a URL \u2014 a direct file, or a YouTube/TikTok/Vimeo page.",
+  args: {
+    url: { type: "string", description: "Video URL (direct file or a watch/post page)", required: true },
+    source: { type: "string", description: "Provenance: url | youtube", required: false },
+    "external-id": { type: "string", description: "Provider asset id (deduped on)", required: false },
+    "external-url": { type: "string", description: "Canonical page URL", required: false },
+    download: {
+      type: "boolean",
+      description: "Force the download path instead of letting Baker fetch the URL directly",
+      required: false,
+      default: false
+    },
+    country: {
+      type: "string",
+      description: "Two-letter country to fetch from (e.g. US, DE, JP) \u2014 use when a video is blocked in your region",
+      required: false
+    },
+    context: {
+      type: "string",
+      description: "What you know that the video cannot show \u2014 the campaign, whether the person on camera is a real customer, what it is for. Highest-leverage flag here: it is what makes the clip findable later.",
+      required: false
+    },
+    "dry-run": { type: "boolean", description: "Preview the operation without executing", required: false }
+  }
+});
+var ingestCommand = defineCommand({
+  meta: {
+    name: "ingest",
+    description: "Add a video to the library from a URL. A direct file URL is handed straight to Baker, which fetches it. A page URL (YouTube, TikTok, Vimeo, Instagram) is downloaded here first, then uploaded \u2014 and a direct URL that Baker cannot fetch falls back to that same path automatically.\n\nExample: baker videos ingest https://www.youtube.com/watch?v=abc123"
+  },
+  args: {
+    url: { type: "positional", description: "Video URL", required: false },
+    source: { type: "string", description: "Provenance: url | youtube", required: false },
+    "external-id": { type: "string", description: "Provider asset id", required: false },
+    "external-url": { type: "string", description: "Canonical page URL", required: false },
+    download: { type: "boolean", description: "Force the download path", required: false, default: false },
+    country: { type: "string", description: "Two-letter country to fetch from, e.g. US", required: false },
+    context: {
+      type: "string",
+      description: "Context for the analysis \u2014 campaign, who is on camera, intended use",
+      required: false
+    },
+    "dry-run": { type: "boolean", description: "Preview without executing", required: false, default: false }
+  },
+  run: ({ args }) => runVideoIngest({
+    url: args.url,
+    source: args.source,
+    externalId: args["external-id"],
+    externalUrl: args["external-url"],
+    forceDownload: args.download === true,
+    country: args.country,
+    context: args.context,
+    dryRun: args["dry-run"] === true
+  })
+});
+async function runVideoIngest(opts) {
+  const url = opts.url;
+  if (!url) {
+    writeJson({ ok: false, error: { code: "VALIDATION_ERROR", message: "URL is required" } });
+    process.exit(1);
+  }
+  const direct = !opts.forceDownload && isDirectMediaUrl(url);
+  const country = opts.country?.trim() || void 0;
+  const args = {
+    url,
+    source: resolveIngestSource(opts.source, url),
+    externalId: opts.externalId,
+    // Deliberately NOT pre-filled with the pasted URL. Doing so shadowed the
+    // canonical URL the probe resolves (`?? canonicalUrl(...)` below could never
+    // run), so the same video filed under a different `externalUrl` depending on
+    // whether the link was copied from a share sheet, a shorts page or the
+    // address bar. `downloadThenIngest` falls back to `args.url` when the probe
+    // resolves nothing, which is the value this used to hard-code.
+    externalUrl: opts.externalUrl,
+    descriptionContext: opts.context?.trim() || void 0
+  };
+  const validation = videosIngestRequestSchema.safeParse({ ...args, url });
+  if (!validation.success) {
+    const problem = validation.error.issues[0];
+    writeJson({
+      ok: false,
+      error: {
+        code: "VALIDATION_ERROR",
+        message: problem ? `${problem.path.join(".") || "request"}: ${problem.message}` : "Invalid request"
+      }
+    });
+    process.exit(1);
+  }
+  if (opts.dryRun) {
+    reportDryRun(args, direct, country);
+    return;
+  }
+  try {
+    const data = await ingestByRoute(args, direct, country);
+    writeJson({ ok: true, data, hints: ingestHints(data) });
+  } catch (err) {
+    reportIngestFailure(err);
+  }
+}
+function ingestHints(data) {
+  if (data.reducedQuality !== true) return void 0;
+  return [
+    "Added, but at standard quality (360p): the site refused to release the full-quality file and this was the best it would hand over. Tell the user \u2014 the clip is in the library and usable, it is just not high-resolution. If they need the crisp version, ask them for the original file and use `baker videos upload <file>`."
+  ];
+}
+function reportDryRun(args, direct, country) {
+  writeJson({
+    ok: true,
+    dryRun: true,
+    operation: "videos.ingest",
+    params: {
+      url: args.url,
+      source: args.source,
+      // Known up front on the direct route, because it is derived from the URL
+      // alone. The download route's key comes from the probe, which a dry run
+      // does not perform, so there it stays null rather than becoming a guess.
+      externalId: args.externalId ?? (direct ? directDedupeKey(args.source, args.url) : null),
+      // A page URL's canonical form is only known after the probe, which a dry
+      // run does not perform — so this is null rather than a guess.
+      externalUrl: args.externalUrl ?? null,
+      direct,
+      country: country ?? null,
+      descriptionContext: args.descriptionContext ?? null
+    }
+  });
+}
+async function ingestByRoute(args, direct, country) {
+  if (!direct) {
+    return { ...await downloadThenIngest(args, country), via: "download" };
+  }
+  try {
+    const externalId = args.externalId ?? directDedupeKey(args.source, args.url);
+    return { ...await ingestUrl({ ...args, externalId }), via: "direct" };
+  } catch (err) {
+    if (!(err instanceof ApiError) || !worthDownloadingInstead(err.code)) throw err;
+    return { ...await downloadThenIngest(args, country), via: "download", fallbackFrom: err.message };
+  }
+}
+function reportYtDlpFailure(err) {
+  const detail = `${err.stderrTail} ${err.message}`;
+  if (isProxyFailure(ytDlpBlockSignal(detail))) {
+    fail(
+      "Couldn't download that video: our connection to the internet was refused.",
+      "This is Baker's egress proxy, not the link \u2014 its credentials look wrong or expired. The link is probably fine. Report it; retrying won't help until the proxy is fixed."
+    );
+  }
+  if (isDrmProtected(detail)) {
+    fail(
+      "That video is copy-protected, so it can't be added to the library.",
+      "The publisher encrypted this one against downloading. Nothing will change that \u2014 not retrying, not a different region. Ask whoever owns the video for the original file and add it with `baker videos upload <file>`."
+    );
+  }
+  if (isVimeoAuthFailure(detail)) {
+    fail(
+      "Vimeo wouldn't hand over that video \u2014 Baker isn't signed in to Vimeo.",
+      "Vimeo now refuses anonymous downloads entirely, so this needs a signed-in session and the one Baker holds has either expired or was never set. Nothing is wrong with the link. Report it so the Vimeo cookie can be refreshed; meanwhile download the file and use `baker videos upload <file>`."
+    );
+  }
+  if (isRegionBlocked(detail)) {
+    fail(
+      `That video isn't available in the region we're fetching from. ${err.stderrTail || err.message}`,
+      "Re-run with `--country <two-letter code>` for a country where the video plays \u2014 e.g. `--country US`. Pick the one the video belongs to (the uploader's country is the usual answer); each attempt costs a paid connection, so choose rather than work through the list."
+    );
+  }
+  fail(
+    `Couldn't download that video. ${err.stderrTail || err.message}`,
+    isToolingOrBlockFailure(detail) ? "The site wouldn't hand over the video \u2014 usually the downloader being out of date against a site that changed, or the request being blocked. Retrying won't help, and the link is probably fine. Report it so the tool can be updated; meanwhile download the file and use `baker videos upload <file>`." : "Check the link is public and playable. Private or age-restricted videos can't be downloaded \u2014 download the file yourself and use `baker videos upload <file>`."
+  );
+}
+function fail(message, fix, code = "INGEST_FAILED") {
+  writeJson({ ok: false, error: { code, message, fix } });
+  process.exit(1);
+}
+function reportIngestFailure(err) {
+  if (err instanceof ApiError) {
+    writeJson({ ok: false, error: { code: err.code, message: err.message } });
+    process.exit(1);
+  }
+  if (err instanceof YtDlpError) reportYtDlpFailure(err);
+  const detail = err instanceof Error ? err.message : String(err);
+  if (detail.includes("timed out after")) {
+    fail(
+      "That video took too long to download and was stopped part-way.",
+      "Long or slow-serving videos can outrun the download window. Try a shorter clip, or download this one yourself and use `baker videos upload <file>`.",
+      "INTERNAL_ERROR"
+    );
+  }
+  fail(
+    `Couldn't add that video. ${detail}`,
+    "This is a fault on Baker's side, not a problem with the link. Report it.",
+    "INTERNAL_ERROR"
+  );
+}
+function dedupeKey(args, info) {
+  const id = typeof info.id === "string" ? info.id : void 0;
+  if (!id) return void 0;
+  if (info.extractor === "generic") return `${args.source}:${canonicalUrl(info) ?? args.url}`;
+  return `${args.source}:${id}`;
+}
+function ingestUrl(args) {
+  const body = {
+    url: args.url,
+    source: args.source
+  };
+  if (args.externalId) body.externalId = args.externalId;
+  if (args.externalUrl) body.externalUrl = args.externalUrl;
+  if (args.descriptionContext) body.descriptionContext = args.descriptionContext;
+  return apiPost("/api/videos/ingest", body);
+}
+async function downloadThenIngest(args, country) {
+  const vimeoCookie = captureVimeoCookie();
+  const workDir = await mkdtemp(path.join(tmpdir(), "videos-ingest-"));
+  try {
+    const probe = await probeYtDlp({ url: args.url, country, vimeoCookie, cookieDir: workDir });
+    if (isAudioOnly(probe.info)) {
+      throw new ApiError(
+        "VALIDATION_ERROR",
+        "That link is audio, not video, so it can't go in the video library. Music and podcast links have no picture to store."
+      );
+    }
+    const tooLong = refuseByDuration(durationSeconds(probe.info), MAX_VIDEO_INGEST_SECONDS);
+    if (tooLong) {
+      throw new ApiError("VALIDATION_ERROR", tooLong);
+    }
+    const externalId = args.externalId ?? dedupeKey(args, probe.info);
+    const { filePath, tier, reducedQuality } = await runYtDlp({
+      url: args.url,
+      audioOnly: false,
+      workDir,
+      // Deliberately uncapped: take the best the site will release and let Mux
+      // decide what to serve. The 1080p ceiling this replaces was reasoning
+      // about the wrong cost — it saved download bytes by throwing away source
+      // pixels *before* the one system that can make renditions from them ever
+      // saw them, so a 4K master became a 1080p master permanently, for
+      // everything the library is ever asked to do with that clip afterwards.
+      // Downscaling is Mux's job and it is cheap; re-acquiring a master is not.
+      country,
+      vimeoCookie,
+      // Budgeted from the probed length, so the duration we accept and the time
+      // we allow to fetch it cannot drift apart.
+      timeoutMs: downloadTimeoutMs(durationSeconds(probe.info))
+    });
+    const stats = await stat(filePath);
+    if (stats.size > MAX_VIDEO_INGEST_BYTES) {
+      throw new ApiError(
+        "VALIDATION_ERROR",
+        `That video is ${(stats.size / 1024 ** 3).toFixed(1)} GB, over the ${Math.round(MAX_VIDEO_INGEST_BYTES / 1024 ** 3)} GB limit for this route.`
+      );
+    }
+    const publicUrl = await uploadToAssetStore(filePath, stats.size);
+    return {
+      ...await ingestUrl({
+        ...args,
+        url: publicUrl,
+        externalId,
+        externalUrl: args.externalUrl ?? canonicalUrl(probe.info) ?? args.url
+      }),
+      egress: tier,
+      // Named in the result for the same reason `egress` is: a geo-targeted exit
+      // is a deliberate, billable choice and must not be invisible afterwards.
+      ...country ? { country } : {},
+      // Third member of the same family. The site refused the good formats and
+      // the download quietly took the one it would release, which is the right
+      // call — but a clip that is 360p because of that must say so here, or the
+      // only way to find out is to watch it.
+      ...reducedQuality ? { reducedQuality: true } : {}
+    };
+  } finally {
+    await rm(workDir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function uploadToAssetStore(filePath, sizeBytes) {
+  const sha256 = await hashFile(filePath);
+  const { putUrl, publicUrl } = await apiPost("/api/canvas/assets/presign", {
+    sha256,
+    mime: "video/mp4",
+    purpose: "source"
+  });
+  const putRes = await putFileStreamed({ putUrl, filePath, contentType: "video/mp4", sizeBytes });
+  if (!putRes.ok) {
+    throw new ApiError("INTERNAL_ERROR", `Storing the downloaded video failed: HTTP ${putRes.status}`);
+  }
+  return publicUrl;
+}
+
+export {
+  ingestCommand,
+  runVideoIngest,
+  ingestHints
+};
+//# sourceMappingURL=chunk-EI5QN4UO.js.map

package/dist/chunk-EI5QN4UO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/videos/ingest.ts","../src/lib/streamUpload.ts"],"sourcesContent":["import { mkdtemp, rm, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { type VideosIngestRequest, type VideosIngestResponse, videosIngestRequestSchema } from \"@baker/api\";\nimport { isProxyFailure } from \"@baker/proxy\";\nimport { defineCommand } from \"citty\";\nimport { ApiError, apiPost } from \"../../client.ts\";\nimport { captureVimeoCookie } from \"../../env.ts\";\nimport { hashFile, putFileStreamed } from \"../../lib/streamUpload.ts\";\nimport { isVimeoAuthFailure } from \"../../lib/vimeoCookie.ts\";\nimport {\n  canonicalUrl,\n  durationSeconds,\n  isAudioOnly,\n  probeYtDlp,\n  runYtDlp,\n  YtDlpError,\n  type YtDlpInfo,\n} from \"../../lib/ytDlp.ts\";\nimport { ytDlpBlockSignal } from \"../../lib/ytDlpSignal.ts\";\nimport { writeJson } from \"../../output.ts\";\nimport { registerSchema } from \"../../schemas.ts\";\nimport {\n  directDedupeKey,\n  downloadTimeoutMs,\n  isDirectMediaUrl,\n  isDrmProtected,\n  isRegionBlocked,\n  isToolingOrBlockFailure,\n  MAX_VIDEO_INGEST_BYTES,\n  MAX_VIDEO_INGEST_SECONDS,\n  refuseByDuration,\n  resolveIngestSource,\n  worthDownloadingInstead,\n} from \"./ingestUrl.ts\";\n\nregisterSchema({\n  command: \"videos.ingest\",\n  description: \"Add a video to the library from a URL — a direct file, or a YouTube/TikTok/Vimeo page.\",\n  args: {\n    url: { type: \"string\", description: \"Video URL (direct file or a watch/post page)\", required: true },\n    source: { type: \"string\", description: \"Provenance: url | youtube\", required: false },\n    \"external-id\": { type: \"string\", description: \"Provider asset id (deduped on)\", required: false },\n    \"external-url\": { type: \"string\", description: \"Canonical page URL\", required: false },\n    download: {\n      type: \"boolean\",\n      description: \"Force the download path instead of letting Baker fetch the URL directly\",\n      required: false,\n      default: false,\n    },\n    country: {\n      type: \"string\",\n      description: \"Two-letter country to fetch from (e.g. US, DE, JP) — use when a video is blocked in your region\",\n      required: false,\n    },\n    context: {\n      type: \"string\",\n      description:\n        \"What you know that the video cannot show — the campaign, whether the person on camera is a real customer, what it is for. Highest-leverage flag here: it is what makes the clip findable later.\",\n      required: false,\n    },\n    \"dry-run\": { type: \"boolean\", description: \"Preview the operation without executing\", required: false },\n  },\n});\n\nexport const ingestCommand = defineCommand({\n  meta: {\n    name: \"ingest\",\n    description:\n      \"Add a video to the library from a URL. A direct file URL is handed straight to Baker, which fetches it. A page URL (YouTube, TikTok, Vimeo, Instagram) is downloaded here first, then uploaded — and a direct URL that Baker cannot fetch falls back to that same path automatically.\\n\\nExample: baker videos ingest https://www.youtube.com/watch?v=abc123\",\n  },\n  args: {\n    url: { type: \"positional\", description: \"Video URL\", required: false },\n    source: { type: \"string\", description: \"Provenance: url | youtube\", required: false },\n    \"external-id\": { type: \"string\", description: \"Provider asset id\", required: false },\n    \"external-url\": { type: \"string\", description: \"Canonical page URL\", required: false },\n    download: { type: \"boolean\", description: \"Force the download path\", required: false, default: false },\n    country: { type: \"string\", description: \"Two-letter country to fetch from, e.g. US\", required: false },\n    context: {\n      type: \"string\",\n      description: \"Context for the analysis — campaign, who is on camera, intended use\",\n      required: false,\n    },\n    \"dry-run\": { type: \"boolean\", description: \"Preview without executing\", required: false, default: false },\n  },\n  run: ({ args }) =>\n    runVideoIngest({\n      url: args.url as string | undefined,\n      source: args.source as string | undefined,\n      externalId: args[\"external-id\"] as string | undefined,\n      externalUrl: args[\"external-url\"] as string | undefined,\n      forceDownload: args.download === true,\n      country: args.country as string | undefined,\n      context: args.context as string | undefined,\n      dryRun: args[\"dry-run\"] === true,\n    }),\n});\n\nexport type VideoIngestOptions = {\n  url: string | undefined;\n  source?: string;\n  externalId?: string;\n  externalUrl?: string;\n  forceDownload?: boolean;\n  country?: string;\n  /** What the adder knew that the frames cannot show. Feeds the analysis. */\n  context?: string;\n  dryRun?: boolean;\n};\n\n/**\n * The ingest flow itself, callable from `videos ingest` and from the URL branch\n * of `videos upload` — one implementation, so the two verbs cannot drift.\n */\nexport async function runVideoIngest(opts: VideoIngestOptions): Promise<void> {\n  const url = opts.url;\n  if (!url) {\n    writeJson({ ok: false, error: { code: \"VALIDATION_ERROR\", message: \"URL is required\" } });\n    process.exit(1);\n  }\n\n  const direct = !opts.forceDownload && isDirectMediaUrl(url);\n  const country = opts.country?.trim() || undefined;\n  const args: IngestArgs = {\n    url,\n    source: resolveIngestSource(opts.source, url),\n    externalId: opts.externalId,\n    // Deliberately NOT pre-filled with the pasted URL. Doing so shadowed the\n    // canonical URL the probe resolves (`?? canonicalUrl(...)` below could never\n    // run), so the same video filed under a different `externalUrl` depending on\n    // whether the link was copied from a share sheet, a shorts page or the\n    // address bar. `downloadThenIngest` falls back to `args.url` when the probe\n    // resolves nothing, which is the value this used to hard-code.\n    externalUrl: opts.externalUrl,\n    descriptionContext: opts.context?.trim() || undefined,\n  };\n\n  // Checked here as well as at the route, because the download path ends by\n  // posting this same body: a bad `--source` caught only server-side would\n  // otherwise be discovered twice, the second time after downloading the video.\n  const validation = videosIngestRequestSchema.safeParse({ ...args, url });\n  if (!validation.success) {\n    const problem = validation.error.issues[0];\n    writeJson({\n      ok: false,\n      error: {\n        code: \"VALIDATION_ERROR\",\n        message: problem ? `${problem.path.join(\".\") || \"request\"}: ${problem.message}` : \"Invalid request\",\n      },\n    });\n    process.exit(1);\n  }\n\n  if (opts.dryRun) {\n    reportDryRun(args, direct, country);\n    return;\n  }\n\n  try {\n    const data = await ingestByRoute(args, direct, country);\n    writeJson({ ok: true, data, hints: ingestHints(data) });\n  } catch (err) {\n    reportIngestFailure(err);\n  }\n}\n\n/**\n * The successful ingest as the caller receives it.\n *\n * Named rather than left as a `Record<string, unknown>` so the fields that only\n * *sometimes* appear are still a checked contract. `reducedQuality` is the one\n * that needs it: nothing else reads it, `ingestHints` is the only thing that\n * acts on it, and an untyped bag would let either side be renamed with the\n * tests still green and the hint silently never firing again.\n */\nexport type IngestReport = VideosIngestResponse & {\n  via: \"direct\" | \"download\";\n  egress?: string;\n  country?: string;\n  reducedQuality?: true;\n  fallbackFrom?: string;\n};\n\n/**\n * What the caller has to be told about a download that already succeeded.\n *\n * The recovery itself is deliberately invisible — nobody asks for a retry, and\n * a video that arrives is a video that arrived. What must not be invisible is\n * the price the recovery paid, because it is the one thing looking at the\n * result cannot reveal: a 360p clip and a 1080p clip are the same successful\n * envelope. Written for whoever reads the JSON to repeat to a marketer, so it\n * says \"standard quality\", not which player answered.\n */\nexport function ingestHints(data: IngestReport): string[] | undefined {\n  if (data.reducedQuality !== true) return undefined;\n  return [\n    \"Added, but at standard quality (360p): the site refused to release the full-quality file and this was the best it would hand over. Tell the user — the clip is in the library and usable, it is just not high-resolution. If they need the crisp version, ask them for the original file and use `baker videos upload <file>`.\",\n  ];\n}\n\nfunction reportDryRun(args: IngestArgs, direct: boolean, country?: string): void {\n  writeJson({\n    ok: true,\n    dryRun: true,\n    operation: \"videos.ingest\",\n    params: {\n      url: args.url,\n      source: args.source,\n      // Known up front on the direct route, because it is derived from the URL\n      // alone. The download route's key comes from the probe, which a dry run\n      // does not perform, so there it stays null rather than becoming a guess.\n      externalId: args.externalId ?? (direct ? directDedupeKey(args.source, args.url) : null),\n      // A page URL's canonical form is only known after the probe, which a dry\n      // run does not perform — so this is null rather than a guess.\n      externalUrl: args.externalUrl ?? null,\n      direct,\n      country: country ?? null,\n      descriptionContext: args.descriptionContext ?? null,\n    },\n  });\n}\n\n/**\n * A direct media URL is handed straight over: Baker asks Mux to pull it, so no\n * bytes cross this machine and there is no size ceiling to hit. Only when that\n * is refused do we pay to download and re-upload the file ourselves.\n */\nasync function ingestByRoute(args: IngestArgs, direct: boolean, country?: string): Promise<IngestReport> {\n  if (!direct) {\n    return { ...(await downloadThenIngest(args, country)), via: \"download\" };\n  }\n  try {\n    // Defaulted here rather than on `args`, so that the fallback below still\n    // derives its key from the probe: a URL that turns out to be a page carries\n    // a real provider id, which dedupes better than the link it was pasted as.\n    const externalId = args.externalId ?? directDedupeKey(args.source, args.url);\n    return { ...(await ingestUrl({ ...args, externalId })), via: \"direct\" };\n  } catch (err) {\n    if (!(err instanceof ApiError) || !worthDownloadingInstead(err.code)) throw err;\n    return { ...(await downloadThenIngest(args, country)), via: \"download\", fallbackFrom: err.message };\n  }\n}\n\n/**\n * Turn a yt-dlp failure into the one sentence that names its actual cause.\n *\n * Split out from `reportIngestFailure` because the list of distinguishable\n * causes kept growing — proxy, DRM, Vimeo login, region, stale extractor — and\n * each one exists because the generic message sent the reader somewhere useless.\n * Order matters and is not alphabetical: DRM and region both also emit phrases\n * the stale-extractor branch would match, so the specific cases are asked first.\n */\nfunction reportYtDlpFailure(err: YtDlpError): never {\n  const detail = `${err.stderrTail} ${err.message}`;\n\n  // Our own egress failing is not the site's fault and not the link's. Saying\n  // otherwise sends whoever reads this to check a video that was never the\n  // problem, while the real cause — a rotated proxy credential — stays hidden.\n  if (isProxyFailure(ytDlpBlockSignal(detail))) {\n    fail(\n      \"Couldn't download that video: our connection to the internet was refused.\",\n      \"This is Baker's egress proxy, not the link — its credentials look wrong or expired. The link is probably fine. Report it; retrying won't help until the proxy is fixed.\",\n    );\n  }\n  if (isDrmProtected(detail)) {\n    fail(\n      \"That video is copy-protected, so it can't be added to the library.\",\n      \"The publisher encrypted this one against downloading. Nothing will change that — not retrying, not a different region. Ask whoever owns the video for the original file and add it with `baker videos upload <file>`.\",\n    );\n  }\n  if (isVimeoAuthFailure(detail)) {\n    fail(\n      \"Vimeo wouldn't hand over that video — Baker isn't signed in to Vimeo.\",\n      \"Vimeo now refuses anonymous downloads entirely, so this needs a signed-in session and the one Baker holds has either expired or was never set. Nothing is wrong with the link. Report it so the Vimeo cookie can be refreshed; meanwhile download the file and use `baker videos upload <file>`.\",\n    );\n  }\n  if (isRegionBlocked(detail)) {\n    fail(\n      `That video isn't available in the region we're fetching from. ${err.stderrTail || err.message}`,\n      \"Re-run with `--country <two-letter code>` for a country where the video plays — e.g. `--country US`. Pick the one the video belongs to (the uploader's country is the usual answer); each attempt costs a paid connection, so choose rather than work through the list.\",\n    );\n  }\n  fail(\n    `Couldn't download that video. ${err.stderrTail || err.message}`,\n    isToolingOrBlockFailure(detail)\n      ? \"The site wouldn't hand over the video — usually the downloader being out of date against a site that changed, or the request being blocked. Retrying won't help, and the link is probably fine. Report it so the tool can be updated; meanwhile download the file and use `baker videos upload <file>`.\"\n      : \"Check the link is public and playable. Private or age-restricted videos can't be downloaded — download the file yourself and use `baker videos upload <file>`.\",\n  );\n}\n\n/** Emit an ingest failure envelope and stop. */\nfunction fail(message: string, fix: string, code = \"INGEST_FAILED\"): never {\n  writeJson({ ok: false, error: { code, message, fix } });\n  process.exit(1);\n}\n\nfunction reportIngestFailure(err: unknown): never {\n  if (err instanceof ApiError) {\n    writeJson({ ok: false, error: { code: err.code, message: err.message } });\n    process.exit(1);\n  }\n  if (err instanceof YtDlpError) reportYtDlpFailure(err);\n\n  // Say what actually went wrong. \"Unexpected error\" was worse than unhelpful:\n  // a download that outran its leash throws a plain `Error`, lands here, and had\n  // its only diagnostic thrown away — so a predictable timeout on a long video\n  // was indistinguishable from a genuine crash.\n  const detail = err instanceof Error ? err.message : String(err);\n  if (detail.includes(\"timed out after\")) {\n    fail(\n      \"That video took too long to download and was stopped part-way.\",\n      \"Long or slow-serving videos can outrun the download window. Try a shorter clip, or download this one yourself and use `baker videos upload <file>`.\",\n      \"INTERNAL_ERROR\",\n    );\n  }\n  fail(\n    `Couldn't add that video. ${detail}`,\n    \"This is a fault on Baker's side, not a problem with the link. Report it.\",\n    \"INTERNAL_ERROR\",\n  );\n}\n\ntype IngestArgs = {\n  url: string;\n  source: string;\n  externalId?: string;\n  externalUrl?: string;\n  descriptionContext?: string;\n};\n\n/**\n * A dedupe key that identifies this exact video and nothing else.\n *\n * yt-dlp's per-platform extractors return a real provider id, which is what we\n * want: the same YouTube clip pasted three ways dedupes to one row. Its\n * *generic* extractor does not — it returns the URL's basename, so two unrelated\n * files both named `demo.mp4` would produce `url:demo` and the second ingest\n * would \"succeed\" by handing back the first one's clip. A wrong hit is worse\n * than a missed one here: a duplicate costs a transcode, while a collision\n * silently returns the wrong video under a successful-looking response.\n *\n * So the generic case is keyed on the canonical URL, which is unique by\n * construction and still dedupes re-pastes of the same link exactly as intended.\n */\nfunction dedupeKey(args: IngestArgs, info: YtDlpInfo): string | undefined {\n  const id = typeof info.id === \"string\" ? info.id : undefined;\n  if (!id) return undefined;\n  if (info.extractor === \"generic\") return `${args.source}:${canonicalUrl(info) ?? args.url}`;\n  return `${args.source}:${id}`;\n}\n\nfunction ingestUrl(args: IngestArgs): Promise<VideosIngestResponse> {\n  const body: VideosIngestRequest = {\n    url: args.url,\n    source: args.source as VideosIngestRequest[\"source\"],\n  };\n  if (args.externalId) body.externalId = args.externalId;\n  if (args.externalUrl) body.externalUrl = args.externalUrl;\n  if (args.descriptionContext) body.descriptionContext = args.descriptionContext;\n  return apiPost<VideosIngestResponse>(\"/api/videos/ingest\", body);\n}\n\n/**\n * Download the media with yt-dlp, park it in R2, then ingest that URL.\n *\n * The extra hop is what makes a page URL work at all: Mux can only pull a media\n * file, and a watch page is not one. It is also the only route for a CDN that\n * serves us but refuses Mux — YouTube's file URLs, for instance, are bound to\n * the IP that requested them, so handing one to Mux would 403.\n */\nasync function downloadThenIngest(\n  args: IngestArgs,\n  country?: string,\n): Promise<VideosIngestResponse & { egress: string; country?: string; reducedQuality?: true }> {\n  const vimeoCookie = captureVimeoCookie();\n  // The work dir is created before the probe, not after, because the probe needs\n  // somewhere to put the cookie jar — Vimeo refuses metadata anonymously too.\n  const workDir = await mkdtemp(path.join(tmpdir(), \"videos-ingest-\"));\n\n  try {\n    // Metadata first, because both of the decisions it settles are decisions we\n    // used to make only after paying for the download.\n    const probe = await probeYtDlp({ url: args.url, country, vimeoCookie, cookieDir: workDir });\n\n    if (isAudioOnly(probe.info)) {\n      throw new ApiError(\n        \"VALIDATION_ERROR\",\n        \"That link is audio, not video, so it can't go in the video library. Music and podcast links have no picture to store.\",\n      );\n    }\n\n    const tooLong = refuseByDuration(durationSeconds(probe.info), MAX_VIDEO_INGEST_SECONDS);\n    if (tooLong) {\n      throw new ApiError(\"VALIDATION_ERROR\", tooLong);\n    }\n\n    // Prefer yt-dlp's own id: re-pasting the same link then dedupes instead of\n    // paying Mux to transcode and transcribe the same video twice. Read from the\n    // probe rather than from the download's info.json only because the probe has\n    // already run — the dedupe itself still happens at the route, after the file\n    // has been fetched. Skipping the download on a known id needs a lookup the\n    // API does not expose yet; `ingestFromUrlInternal` short-circuits on\n    // `externalId` before calling Mux, so the hook for it exists.\n    const externalId = args.externalId ?? dedupeKey(args, probe.info);\n\n    const { filePath, tier, reducedQuality } = await runYtDlp({\n      url: args.url,\n      audioOnly: false,\n      workDir,\n      // Deliberately uncapped: take the best the site will release and let Mux\n      // decide what to serve. The 1080p ceiling this replaces was reasoning\n      // about the wrong cost — it saved download bytes by throwing away source\n      // pixels *before* the one system that can make renditions from them ever\n      // saw them, so a 4K master became a 1080p master permanently, for\n      // everything the library is ever asked to do with that clip afterwards.\n      // Downscaling is Mux's job and it is cheap; re-acquiring a master is not.\n      country,\n      vimeoCookie,\n      // Budgeted from the probed length, so the duration we accept and the time\n      // we allow to fetch it cannot drift apart.\n      timeoutMs: downloadTimeoutMs(durationSeconds(probe.info)),\n    });\n\n    const stats = await stat(filePath);\n    if (stats.size > MAX_VIDEO_INGEST_BYTES) {\n      throw new ApiError(\n        \"VALIDATION_ERROR\",\n        `That video is ${(stats.size / 1024 ** 3).toFixed(1)} GB, over the ${Math.round(MAX_VIDEO_INGEST_BYTES / 1024 ** 3)} GB limit for this route.`,\n      );\n    }\n\n    const publicUrl = await uploadToAssetStore(filePath, stats.size);\n\n    // `url` becomes the stored copy, so the original has to survive as\n    // `externalUrl` — otherwise a direct link that fell back to this route\n    // leaves the library with no record of where the clip came from.\n    // `egress` names the rung that produced the bytes. A paid exit costing real\n    // money must never be spent invisibly — without this the only difference\n    // between a free download and a residential one is the wall clock.\n    return {\n      ...(await ingestUrl({\n        ...args,\n        url: publicUrl,\n        externalId,\n        externalUrl: args.externalUrl ?? canonicalUrl(probe.info) ?? args.url,\n      })),\n      egress: tier,\n      // Named in the result for the same reason `egress` is: a geo-targeted exit\n      // is a deliberate, billable choice and must not be invisible afterwards.\n      ...(country ? { country } : {}),\n      // Third member of the same family. The site refused the good formats and\n      // the download quietly took the one it would release, which is the right\n      // call — but a clip that is 360p because of that must say so here, or the\n      // only way to find out is to watch it.\n      ...(reducedQuality ? { reducedQuality: true } : {}),\n    };\n  } finally {\n    await rm(workDir, { recursive: true, force: true }).catch(() => {\n      // best-effort cleanup — the sandbox is disposable\n    });\n  }\n}\n\n/**\n * Park a downloaded file in R2 via the canvas asset presign route and return the\n * public URL.\n *\n * Streamed from disk in both passes — hashing and uploading — so a long video\n * costs one buffer rather than twice its own length in RAM. It reads the file\n * twice because the presign needs the sha before the PUT can start, which is a\n * cheap trade against holding gigabytes in memory to avoid the second read.\n */\nasync function uploadToAssetStore(filePath: string, sizeBytes: number): Promise<string> {\n  const sha256 = await hashFile(filePath);\n  const { putUrl, publicUrl } = await apiPost<{ putUrl: string; publicUrl: string }>(\"/api/canvas/assets/presign\", {\n    sha256,\n    mime: \"video/mp4\",\n    purpose: \"source\",\n  });\n\n  const putRes = await putFileStreamed({ putUrl, filePath, contentType: \"video/mp4\", sizeBytes });\n  if (!putRes.ok) {\n    throw new ApiError(\"INTERNAL_ERROR\", `Storing the downloaded video failed: HTTP ${putRes.status}`);\n  }\n  return publicUrl;\n}\n","import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { Readable } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\n\n/**\n * Move a file to object storage without ever holding it in memory.\n *\n * The reason this exists rather than `readFile` + `fetch`: a video is the one\n * asset whose size is set by someone else. Reading it into a Buffer costs its\n * full length in RAM, and handing that Buffer to `new Uint8Array(...)` copies it\n * again — measured, not assumed: `new Uint8Array(buf)` does not alias, so peak\n * usage was twice the file. On an 8 GB Runtime that puts the real ceiling near\n * 3-4 GB of *video*, well under the size a 4K master or a long recording\n * reaches, and the failure mode is an OOM kill with no error to report.\n *\n * Streaming makes peak memory a fixed chunk regardless of length, which is what\n * lets the size limit be a policy decision instead of a memory one.\n */\n\n/** sha256 of a file's contents, read in chunks. */\nexport async function hashFile(filePath: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  await pipeline(createReadStream(filePath), hash);\n  return hash.digest(\"hex\");\n}\n\n/**\n * PUT a file to a presigned URL, streaming from disk.\n *\n * `content-length` is mandatory and comes from the caller's `stat`: a stream\n * body would otherwise be sent chunked, which S3-compatible presigned PUTs\n * reject. `duplex: \"half\"` is required by undici whenever the body is a stream.\n */\nexport async function putFileStreamed(args: {\n  putUrl: string;\n  filePath: string;\n  contentType: string;\n  sizeBytes: number;\n}): Promise<Response> {\n  // `toWeb` rather than handing `fetch` the Node stream directly: undici accepts\n  // both, but only the web stream is a `BodyInit`, so this stays type-safe\n  // instead of needing a cast that would hide a real mistake later.\n  const body = Readable.toWeb(createReadStream(args.filePath)) as ReadableStream<Uint8Array>;\n\n  return await fetch(args.putUrl, {\n    method: \"PUT\",\n    body,\n    headers: {\n      \"Content-Type\": args.contentType,\n      \"Content-Length\": String(args.sizeBytes),\n    },\n    duplex: \"half\",\n  } as RequestInit & { duplex: \"half\" });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,IAAI,YAAY;AAClC,SAAS,cAAc;AACvB,OAAO,UAAU;AAGjB,SAAS,qBAAqB;;;ACL9B,SAAS,kBAAkB;AAC3B,SAAS,wBAAwB;AACjC,SAAS,gBAAgB;AACzB,SAAS,gBAAgB;AAkBzB,eAAsB,SAAS,UAAmC;AAChE,QAAM,OAAO,WAAW,QAAQ;AAChC,QAAM,SAAS,iBAAiB,QAAQ,GAAG,IAAI;AAC/C,SAAO,KAAK,OAAO,KAAK;AAC1B;AASA,eAAsB,gBAAgB,MAKhB;AAIpB,QAAM,OAAO,SAAS,MAAM,iBAAiB,KAAK,QAAQ,CAAC;AAE3D,SAAO,MAAM,MAAM,KAAK,QAAQ;AAAA,IAC9B,QAAQ;AAAA,IACR;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB,KAAK;AAAA,MACrB,kBAAkB,OAAO,KAAK,SAAS;AAAA,IACzC;AAAA,IACA,QAAQ;AAAA,EACV,CAAqC;AACvC;;;ADlBA,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM;AAAA,IACJ,KAAK,EAAE,MAAM,UAAU,aAAa,gDAAgD,UAAU,KAAK;AAAA,IACnG,QAAQ,EAAE,MAAM,UAAU,aAAa,6BAA6B,UAAU,MAAM;AAAA,IACpF,eAAe,EAAE,MAAM,UAAU,aAAa,kCAAkC,UAAU,MAAM;AAAA,IAChG,gBAAgB,EAAE,MAAM,UAAU,aAAa,sBAAsB,UAAU,MAAM;AAAA,IACrF,UAAU;AAAA,MACR,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,WAAW,EAAE,MAAM,WAAW,aAAa,2CAA2C,UAAU,MAAM;AAAA,EACxG;AACF,CAAC;AAEM,IAAM,gBAAgB,cAAc;AAAA,EACzC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,IACJ,KAAK,EAAE,MAAM,cAAc,aAAa,aAAa,UAAU,MAAM;AAAA,IACrE,QAAQ,EAAE,MAAM,UAAU,aAAa,6BAA6B,UAAU,MAAM;AAAA,IACpF,eAAe,EAAE,MAAM,UAAU,aAAa,qBAAqB,UAAU,MAAM;AAAA,IACnF,gBAAgB,EAAE,MAAM,UAAU,aAAa,sBAAsB,UAAU,MAAM;AAAA,IACrF,UAAU,EAAE,MAAM,WAAW,aAAa,2BAA2B,UAAU,OAAO,SAAS,MAAM;AAAA,IACrG,SAAS,EAAE,MAAM,UAAU,aAAa,6CAA6C,UAAU,MAAM;AAAA,IACrG,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,WAAW,EAAE,MAAM,WAAW,aAAa,6BAA6B,UAAU,OAAO,SAAS,MAAM;AAAA,EAC1G;AAAA,EACA,KAAK,CAAC,EAAE,KAAK,MACX,eAAe;AAAA,IACb,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK,aAAa;AAAA,IAC9B,aAAa,KAAK,cAAc;AAAA,IAChC,eAAe,KAAK,aAAa;AAAA,IACjC,SAAS,KAAK;AAAA,IACd,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK,SAAS,MAAM;AAAA,EAC9B,CAAC;AACL,CAAC;AAkBD,eAAsB,eAAe,MAAyC;AAC5E,QAAM,MAAM,KAAK;AACjB,MAAI,CAAC,KAAK;AACR,cAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,oBAAoB,SAAS,kBAAkB,EAAE,CAAC;AACxF,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,SAAS,CAAC,KAAK,iBAAiB,iBAAiB,GAAG;AAC1D,QAAM,UAAU,KAAK,SAAS,KAAK,KAAK;AACxC,QAAM,OAAmB;AAAA,IACvB;AAAA,IACA,QAAQ,oBAAoB,KAAK,QAAQ,GAAG;AAAA,IAC5C,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOjB,aAAa,KAAK;AAAA,IAClB,oBAAoB,KAAK,SAAS,KAAK,KAAK;AAAA,EAC9C;AAKA,QAAM,aAAa,0BAA0B,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC;AACvE,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,UAAU,WAAW,MAAM,OAAO,CAAC;AACzC,cAAU;AAAA,MACR,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,UAAU,GAAG,QAAQ,KAAK,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,OAAO,KAAK;AAAA,MACpF;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,KAAK,QAAQ;AACf,iBAAa,MAAM,QAAQ,OAAO;AAClC;AAAA,EACF;AAEA,MAAI;AACF,UAAM,OAAO,MAAM,cAAc,MAAM,QAAQ,OAAO;AACtD,cAAU,EAAE,IAAI,MAAM,MAAM,OAAO,YAAY,IAAI,EAAE,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,wBAAoB,GAAG;AAAA,EACzB;AACF;AA6BO,SAAS,YAAY,MAA0C;AACpE,MAAI,KAAK,mBAAmB,KAAM,QAAO;AACzC,SAAO;AAAA,IACL;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAkB,QAAiB,SAAwB;AAC/E,YAAU;AAAA,IACR,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,QAAQ;AAAA,MACN,KAAK,KAAK;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,MAIb,YAAY,KAAK,eAAe,SAAS,gBAAgB,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA;AAAA;AAAA,MAGlF,aAAa,KAAK,eAAe;AAAA,MACjC;AAAA,MACA,SAAS,WAAW;AAAA,MACpB,oBAAoB,KAAK,sBAAsB;AAAA,IACjD;AAAA,EACF,CAAC;AACH;AAOA,eAAe,cAAc,MAAkB,QAAiB,SAAyC;AACvG,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,GAAI,MAAM,mBAAmB,MAAM,OAAO,GAAI,KAAK,WAAW;AAAA,EACzE;AACA,MAAI;AAIF,UAAM,aAAa,KAAK,cAAc,gBAAgB,KAAK,QAAQ,KAAK,GAAG;AAC3E,WAAO,EAAE,GAAI,MAAM,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,GAAI,KAAK,SAAS;AAAA,EACxE,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,aAAa,CAAC,wBAAwB,IAAI,IAAI,EAAG,OAAM;AAC5E,WAAO,EAAE,GAAI,MAAM,mBAAmB,MAAM,OAAO,GAAI,KAAK,YAAY,cAAc,IAAI,QAAQ;AAAA,EACpG;AACF;AAWA,SAAS,mBAAmB,KAAwB;AAClD,QAAM,SAAS,GAAG,IAAI,UAAU,IAAI,IAAI,OAAO;AAK/C,MAAI,eAAe,iBAAiB,MAAM,CAAC,GAAG;AAC5C;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,MAAM,GAAG;AAC1B;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,mBAAmB,MAAM,GAAG;AAC9B;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,MAAM,GAAG;AAC3B;AAAA,MACE,iEAAiE,IAAI,cAAc,IAAI,OAAO;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AACA;AAAA,IACE,iCAAiC,IAAI,cAAc,IAAI,OAAO;AAAA,IAC9D,wBAAwB,MAAM,IAC1B,iTACA;AAAA,EACN;AACF;AAGA,SAAS,KAAK,SAAiB,KAAa,OAAO,iBAAwB;AACzE,YAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,SAAS,IAAI,EAAE,CAAC;AACtD,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,eAAe,UAAU;AAC3B,cAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;AACxE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,eAAe,WAAY,oBAAmB,GAAG;AAMrD,QAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,MAAI,OAAO,SAAS,iBAAiB,GAAG;AACtC;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA;AAAA,IACE,4BAA4B,MAAM;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AACF;AAwBA,SAAS,UAAU,MAAkB,MAAqC;AACxE,QAAM,KAAK,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK;AACnD,MAAI,CAAC,GAAI,QAAO;AAChB,MAAI,KAAK,cAAc,UAAW,QAAO,GAAG,KAAK,MAAM,IAAI,aAAa,IAAI,KAAK,KAAK,GAAG;AACzF,SAAO,GAAG,KAAK,MAAM,IAAI,EAAE;AAC7B;AAEA,SAAS,UAAU,MAAiD;AAClE,QAAM,OAA4B;AAAA,IAChC,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK;AAAA,EACf;AACA,MAAI,KAAK,WAAY,MAAK,aAAa,KAAK;AAC5C,MAAI,KAAK,YAAa,MAAK,cAAc,KAAK;AAC9C,MAAI,KAAK,mBAAoB,MAAK,qBAAqB,KAAK;AAC5D,SAAO,QAA8B,sBAAsB,IAAI;AACjE;AAUA,eAAe,mBACb,MACA,SAC6F;AAC7F,QAAM,cAAc,mBAAmB;AAGvC,QAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,OAAO,GAAG,gBAAgB,CAAC;AAEnE,MAAI;AAGF,UAAM,QAAQ,MAAM,WAAW,EAAE,KAAK,KAAK,KAAK,SAAS,aAAa,WAAW,QAAQ,CAAC;AAE1F,QAAI,YAAY,MAAM,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,iBAAiB,gBAAgB,MAAM,IAAI,GAAG,wBAAwB;AACtF,QAAI,SAAS;AACX,YAAM,IAAI,SAAS,oBAAoB,OAAO;AAAA,IAChD;AASA,UAAM,aAAa,KAAK,cAAc,UAAU,MAAM,MAAM,IAAI;AAEhE,UAAM,EAAE,UAAU,MAAM,eAAe,IAAI,MAAM,SAAS;AAAA,MACxD,KAAK,KAAK;AAAA,MACV,WAAW;AAAA,MACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,kBAAkB,gBAAgB,MAAM,IAAI,CAAC;AAAA,IAC1D,CAAC;AAED,UAAM,QAAQ,MAAM,KAAK,QAAQ;AACjC,QAAI,MAAM,OAAO,wBAAwB;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,kBAAkB,MAAM,OAAO,QAAQ,GAAG,QAAQ,CAAC,CAAC,iBAAiB,KAAK,MAAM,yBAAyB,QAAQ,CAAC,CAAC;AAAA,MACrH;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,mBAAmB,UAAU,MAAM,IAAI;AAQ/D,WAAO;AAAA,MACL,GAAI,MAAM,UAAU;AAAA,QAClB,GAAG;AAAA,QACH,KAAK;AAAA,QACL;AAAA,QACA,aAAa,KAAK,eAAe,aAAa,MAAM,IAAI,KAAK,KAAK;AAAA,MACpE,CAAC;AAAA,MACD,QAAQ;AAAA;AAAA;AAAA,MAGR,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAK7B,GAAI,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAAA,IACnD;AAAA,EACF,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAEhE,CAAC;AAAA,EACH;AACF;AAWA,eAAe,mBAAmB,UAAkB,WAAoC;AACtF,QAAM,SAAS,MAAM,SAAS,QAAQ;AACtC,QAAM,EAAE,QAAQ,UAAU,IAAI,MAAM,QAA+C,8BAA8B;AAAA,IAC/G;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AAED,QAAM,SAAS,MAAM,gBAAgB,EAAE,QAAQ,UAAU,aAAa,aAAa,UAAU,CAAC;AAC9F,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,SAAS,kBAAkB,6CAA6C,OAAO,MAAM,EAAE;AAAA,EACnG;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-XHC4LMK4.js → chunk-EIGXX6KI.js}

@@ -1,10 +1,10 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-MF7YA62W.js";
+} from "./chunk-CUL3VB4L.js";
 import {
   getEnv
-} from "./chunk-HJEMOSPH.js";
+} from "./chunk-I4FTS5EE.js";
 
 // src/error-handler.ts
 var REQUEST_CONNECTION_PLATFORM = {
@@ -153,6 +153,12 @@ function writeJsonEnvelope(envelope) {
   process.stdout.write(`${JSON.stringify(envelope, null, 2)}
 `);
 }
+var TABLE_OUTPUT_FORMATS = ["json", "csv", "jsonl", "md"];
+function outputFormatRefusal(format, supported) {
+  if (supported.includes(format)) return null;
+  const list = supported.length > 1 ? `${supported.slice(0, -1).join(", ")} or ${supported.at(-1)}` : supported.join("");
+  return `--output ${format} is not supported \u2014 use ${list}`;
+}
 function toCsvRow(values) {
   return values.map((v) => {
     if (v.includes(",") || v.includes('"') || v.includes("\n")) {
@@ -288,14 +294,16 @@ export {
   getQueryTtl,
   buildQueryCacheKey,
   getManagerIdForCustomer,
-  connectionFixExplanation,
-  handleConnectionError,
-  isNotConnectedError,
-  needsConnectionFix,
   writeAdsJson,
   writeJsonEnvelope,
+  TABLE_OUTPUT_FORMATS,
+  outputFormatRefusal,
   toCsvRow,
   writeAdsOutput,
-  resolveCustomerId
+  resolveCustomerId,
+  connectionFixExplanation,
+  handleConnectionError,
+  isNotConnectedError,
+  needsConnectionFix
 };
-//# sourceMappingURL=chunk-XHC4LMK4.js.map
+//# sourceMappingURL=chunk-EIGXX6KI.js.map