@koda-sl/baker-cli 0.384.0 → 0.385.0-dev.f7ef4c7e1

package/dist/chunk-EDLZGTGN.js

@@ -0,0 +1,216 @@
+// ../api/src/identity/digest.ts
+var SHA256_HEX = /^[0-9a-fA-F]{64}$/;
+function isSha256Hex(value) {
+  return SHA256_HEX.test(value);
+}
+
+// ../api/src/identity/email.ts
+function normalizeEmailV1(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "" ? null : trimmed;
+}
+var EMAIL = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+function normalizeEmailV2(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return EMAIL.test(trimmed) ? trimmed : null;
+}
+
+// ../api/src/identity/phone.ts
+function normalizePhoneV1(raw) {
+  const digits = raw.trim().toLowerCase().replace(/[^0-9]/g, "");
+  return digits === "" ? null : `+${digits}`;
+}
+var PHONE_PUNCTUATION = /[\s()./-]/g;
+var E164 = /^\+[1-9]\d{7,14}$/;
+function normalizePhoneV2(raw) {
+  const compact = raw.replace(PHONE_PUNCTUATION, "");
+  const e164 = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(e164) ? e164 : null;
+}
+
+// ../api/src/identity/index.ts
+function normalizeIdentity(raw, version) {
+  const value = raw.kind === "email" ? version === 1 ? normalizeEmailV1(raw.value) : normalizeEmailV2(raw.value) : version === 1 ? normalizePhoneV1(raw.value) : normalizePhoneV2(raw.value);
+  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };
+}
+
+// ../api/src/event-ingest/matching.ts
+var MATCH_FIELDS = [
+  "first_name",
+  "last_name",
+  "date_of_birth",
+  "gender",
+  "city",
+  "region",
+  "postal_code",
+  "country"
+];
+var MATCH_COOKIES = ["fbp", "fbc"];
+function tightened(value) {
+  const stripped = value.toLowerCase().replace(/[^\p{L}\p{N}]/gu, "");
+  return stripped === "" ? null : stripped;
+}
+function loosened(value) {
+  const collapsed = value.trim().toLowerCase().replace(/\s+/g, " ");
+  return collapsed === "" ? null : collapsed;
+}
+function birthDate(value) {
+  const digits = value.replace(/\D/g, "");
+  if (!/^\d{8}$/.test(digits)) return null;
+  const month = Number(digits.slice(4, 6));
+  const day = Number(digits.slice(6, 8));
+  if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+  return digits;
+}
+function genderLetter(value) {
+  const first = value.trim().toLowerCase().charAt(0);
+  return first === "f" || first === "m" ? first : null;
+}
+function countryCode(value) {
+  const code = value.trim().toLowerCase();
+  return /^[a-z]{2}$/.test(code) ? code : null;
+}
+var MATCH_SPECS = {
+  first_name: { keep: "hashed", normalize: tightened, meta: "fn", google: "hashed_first_name" },
+  last_name: { keep: "hashed", normalize: tightened, meta: "ln", google: "hashed_last_name" },
+  // Meta only. Google's enhanced conversions have no date of birth, so there is
+  // no destination wanting it in the clear and every reason not to keep one.
+  date_of_birth: { keep: "hashed", normalize: birthDate, meta: "db", google: null },
+  gender: { keep: "plain", normalize: genderLetter, meta: "ge", google: null },
+  city: { keep: "plain", normalize: loosened, meta: "ct", google: "city" },
+  region: { keep: "plain", normalize: loosened, meta: "st", google: "state" },
+  postal_code: { keep: "plain", normalize: loosened, meta: "zp", google: "postal_code" },
+  country: { keep: "plain", normalize: countryCode, meta: "country", google: "country_code" }
+};
+var MATCH_FIELD_FORWARDING = [
+  { field: "email", meta: "em", google: "hashed_email", hashed: true },
+  { field: "phone", meta: "ph", google: "hashed_phone_number", hashed: true },
+  // Kept in the clear — see `resolveOwnId`. The digest is still computed and
+  // still stored beside it, so a Meta forward has one; what changed is that the
+  // sender's own key is now readable, which is the entire reason they sent it.
+  { field: "external_id", meta: "external_id", google: null, hashed: false },
+  ...MATCH_FIELDS.map((field) => ({
+    field,
+    meta: MATCH_SPECS[field].meta,
+    google: MATCH_SPECS[field].google,
+    hashed: MATCH_SPECS[field].keep === "hashed"
+  })),
+  { field: "fbp", meta: "fbp", google: null, hashed: false },
+  { field: "fbc", meta: "fbc", google: null, hashed: false }
+];
+
+// ../api/src/event-ingest/vocabulary.ts
+var INGEST_CLICK_ID_PARAMS = [
+  "gclid",
+  "wbraid",
+  "gbraid",
+  "dclid",
+  "fbclid",
+  "ttclid",
+  "twclid",
+  "li_fat_id",
+  "msclkid",
+  "rdt_cid",
+  "epik",
+  "sccid",
+  "oppref"
+];
+
+// ../api/src/event-sources/fields.ts
+var MATCH_LABELS = {
+  first_name: "First name",
+  last_name: "Last name",
+  date_of_birth: "Date of birth",
+  gender: "Gender",
+  city: "City",
+  region: "Region",
+  postal_code: "Postcode",
+  country: "Country"
+};
+var CLICK_LABELS = {
+  gclid: "Google click id",
+  wbraid: "Google click id (iOS, web to app)",
+  gbraid: "Google click id (iOS, app)",
+  dclid: "Google click id (Display & Video)",
+  fbclid: "Meta click id",
+  ttclid: "TikTok click id",
+  twclid: "X click id",
+  li_fat_id: "LinkedIn click id",
+  msclkid: "Microsoft click id",
+  rdt_cid: "Reddit click id",
+  epik: "Pinterest click id",
+  sccid: "Snapchat click id",
+  oppref: "ChatGPT Ads click id"
+};
+var SOURCE_FIELDS = [
+  { field: "event_name", label: "What happened", group: "event" },
+  { field: "event_time", label: "When it happened", group: "event" },
+  { field: "event_id", label: "Its id", group: "event" },
+  { field: "email", label: "Email", group: "person" },
+  { field: "phone", label: "Phone", group: "person" },
+  { field: "external_id", label: "Your own id for the person", group: "person" },
+  ...MATCH_FIELDS.map((field) => ({ field, label: MATCH_LABELS[field], group: "person" })),
+  { field: "value", label: "Amount", group: "money" },
+  { field: "currency", label: "Currency", group: "money" },
+  ...INGEST_CLICK_ID_PARAMS.map((field) => ({ field, label: CLICK_LABELS[field], group: "click" }))
+];
+var SOURCE_FIELD_NAMES = SOURCE_FIELDS.map((spec) => spec.field);
+var FIELD_SET = new Set(SOURCE_FIELD_NAMES);
+function isSourceField(value) {
+  return FIELD_SET.has(value);
+}
+var PROPERTY_ROW_PREFIX = "properties.";
+var PROPERTY_KEY_MAX = 64;
+var PROPERTY_KEY = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+var RESERVED_PROPERTY_KEYS = ["baker_source", "hubspot_property", "hubspot_value"];
+function isPropertyRow(row) {
+  return row.startsWith(PROPERTY_ROW_PREFIX);
+}
+function propertyKeyOf(row) {
+  return isPropertyRow(row) ? row.slice(PROPERTY_ROW_PREFIX.length) : null;
+}
+function propertyKeyProblem(key) {
+  const trimmed = key.trim();
+  if (trimmed === "") return "A property needs a name.";
+  if (trimmed.length > PROPERTY_KEY_MAX) return `A property name is at most ${PROPERTY_KEY_MAX} characters.`;
+  if (!PROPERTY_KEY.test(trimmed)) {
+    return `"${trimmed}" is not a property name: letters, digits, underscore, dash and dot only, starting with a letter or digit.`;
+  }
+  if (RESERVED_PROPERTY_KEYS.includes(trimmed)) return `"${trimmed}" is written by Baker itself; pick another name.`;
+  return null;
+}
+function mappingRowProblem(row) {
+  if (isSourceField(row)) return null;
+  const key = propertyKeyOf(row);
+  if (key === null) {
+    return `"${row}" is not a field an event can carry. A field is one of ${SOURCE_FIELD_NAMES.join(", ")}; an extra property is spelled properties.<name>.`;
+  }
+  return propertyKeyProblem(key);
+}
+
+// ../api/src/event-sources/template.ts
+var MENTION = /\{\{\s*([^{}]+?)\s*\}\}/g;
+function mentionOf(path) {
+  return `{{${path}}}`;
+}
+function templateMentions(template) {
+  const seen = [];
+  for (const match of template.matchAll(MENTION)) {
+    const path = (match[1] ?? "").trim();
+    if (path !== "" && !seen.includes(path)) seen.push(path);
+  }
+  return seen;
+}
+
+export {
+  isSha256Hex,
+  normalizeIdentity,
+  MATCH_COOKIES,
+  MATCH_FIELD_FORWARDING,
+  INGEST_CLICK_ID_PARAMS,
+  SOURCE_FIELD_NAMES,
+  mappingRowProblem,
+  mentionOf,
+  templateMentions
+};
+//# sourceMappingURL=chunk-EDLZGTGN.js.map

package/dist/chunk-EDLZGTGN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/identity/digest.ts","../../api/src/identity/email.ts","../../api/src/identity/phone.ts","../../api/src/identity/index.ts","../../api/src/event-ingest/matching.ts","../../api/src/event-ingest/vocabulary.ts","../../api/src/event-sources/fields.ts","../../api/src/event-sources/template.ts"],"sourcesContent":["/**\n * The one hash, and the one way to recognise one.\n *\n * Web Crypto, so the same code runs in the Convex runtime, a Worker, Node and a\n * browser — an identity digest that differs by runtime is a digest that matches\n * nothing, and nothing about that failure is visible from either end.\n */\n\n/** SHA-256 in lowercase hex. The form every ad platform documents. */\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst SHA256_HEX = /^[0-9a-fA-F]{64}$/;\n\n/**\n * Whether a value is already a SHA-256 digest — the check that decides whether\n * a field holds plain text to normalize and hash, or a digest someone else\n * computed. Hashing a hash produces a key that matches nothing, forever, with\n * no way to tell afterwards.\n */\nexport function isSha256Hex(value: string): boolean {\n  return SHA256_HEX.test(value);\n}\n\n/** The storable form of a supplied digest, or `null` if it is not one. */\nexport function normalizeSha256Hex(value: string): string | null {\n  const trimmed = value.trim();\n  return SHA256_HEX.test(trimmed) ? trimmed.toLowerCase() : null;\n}\n\n/**\n * The canonical form of a site's own id for a person, before it is hashed.\n *\n * Trim and lowercase, and deliberately nothing else. An `external_id` is an\n * opaque key in somebody else's system — a customer number, a CRM contact id, a\n * membership code — so there is no shape to check and no punctuation that means\n * anything. What matters is only that **both ends canonicalise it the same\n * way**: the browser hashing `Cust-4821` and the CRM hashing `cust-4821` would\n * produce two people out of one, with nothing anywhere to report it.\n *\n * Not part of the versioned normalizer beside it, on purpose. Those versions\n * exist because an address has a *correct* form that we learned late; this has\n * never had one and never will.\n */\nexport function normalizeExternalId(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** The digest a site's own id joins on, or `null` when there is nothing to hash. */\nexport async function externalIdDigest(raw: string): Promise<string | null> {\n  const canonical = normalizeExternalId(raw);\n  return canonical === null ? null : await sha256Hex(canonical);\n}\n","/**\n * Email normalization, one rule per version.\n *\n * A version is not a preference: a digest computed under v1 and stored a year\n * ago can never be recomputed, because the address that produced it was dropped\n * on purpose. So v1 is frozen at whatever the browser did on the day it ran, and\n * a better rule arrives as v2 alongside it rather than in place of it.\n */\n\n/**\n * **v1 — frozen.** Trim and lowercase, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. No shape check:\n * whatever the visitor typed was hashed, and every historical digest was\n * produced this way.\n *\n * `null` only for an empty result, which is the one case the beacon also\n * declines to report.\n */\nexport function normalizeEmailV1(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** No dots-as-separators, no length games: one `@`, a local part, a dotted domain. */\nconst EMAIL = /^[^\\s@]+@[^\\s@.]+(?:\\.[^\\s@.]+)+$/;\n\n/**\n * **v2.** v1 plus a shape check, so an unusable value is declined instead of\n * hashed into a key that can never match.\n */\nexport function normalizeEmailV2(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return EMAIL.test(trimmed) ? trimmed : null;\n}\n\n/**\n * Google's own email canonicalization, applied on top of a normalized address:\n * for `gmail.com` and `googlemail.com`, drop the dots and any `+tag` from the\n * local part.\n *\n * `null` when there is no address left to send — a local part that was nothing\n * but a `+tag`. Google is the only platform that asks for this; Meta and\n * LinkedIn hash the address as written, which is why this is a provider step\n * and not part of the version.\n */\nexport function googleEmail(normalizedEmail: string): string | null {\n  const [localPart, domain, ...extraParts] = normalizedEmail.split(\"@\");\n  if (!localPart || !domain || extraParts.length > 0) return normalizedEmail;\n  if (domain !== \"gmail.com\" && domain !== \"googlemail.com\") return normalizedEmail;\n  const canonicalLocalPart = localPart.split(\"+\", 1)[0]?.replace(/\\./g, \"\") ?? \"\";\n  return canonicalLocalPart ? `${canonicalLocalPart}@${domain}` : null;\n}\n","/**\n * Phone normalization, one rule per version, plus the shape each platform\n * hashes.\n *\n * Three copies of this used to exist — the beacon's, the funnel contract's and\n * `lib/capi.ts` — and they disagreed on the `+`. A digest of `34600111222` and a\n * digest of `+34600111222` are two unrelated keys for one person, and neither\n * end reports anything when they fail to meet.\n */\n\n/**\n * **v1 — frozen.** Digits only, with a `+` in front, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. It guesses no\n * country code and validates nothing: a national number becomes `+600111222`,\n * and that is the digest sitting in the store for every visitor who identified\n * before v2 existed.\n */\nexport function normalizePhoneV1(raw: string): string | null {\n  const digits = raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^0-9]/g, \"\");\n  return digits === \"\" ? null : `+${digits}`;\n}\n\n/** What a CRM writes around the digits and what E.164 does not keep. */\nconst PHONE_PUNCTUATION = /[\\s()./-]/g;\n/** E.164: `+`, a country code that cannot start at 0, up to 15 digits total. */\nconst E164 = /^\\+[1-9]\\d{7,14}$/;\n\n/**\n * **v2 — strict E.164.**\n *\n * A number with no international prefix is refused rather than guessed at. The\n * country code cannot be inferred from the value, and inventing one produces a\n * hash that silently matches nothing — worse than declining the key, because\n * the event still resolves by some other rung and nobody learns the phone was\n * lost. Both `+34…` and the access prefix `0034…` are accepted; a bare\n * `600111222` is not.\n */\nexport function normalizePhoneV2(raw: string): string | null {\n  const compact = raw.replace(PHONE_PUNCTUATION, \"\");\n  const e164 = compact.startsWith(\"00\") ? `+${compact.slice(2)}` : compact;\n  return E164.test(e164) ? e164 : null;\n}\n\n/**\n * E.164 without the `+` — what Meta, LinkedIn and Twitter hash.\n *\n * Google hashes the same number *with* the `+`, and that single character is\n * the whole reason this function has a name.\n */\nexport function phoneWithoutPlus(normalizedPhone: string): string {\n  return normalizedPhone.startsWith(\"+\") ? normalizedPhone.slice(1) : normalizedPhone;\n}\n","/**\n * Versioned identity normalization — one rule set, in one place, for the whole\n * platform.\n *\n * Several copies of \"normalize an email or a phone and hash it\" exist: the\n * browser beacon's, the one every Conversions API dispatcher shares\n * (`convex/lib/capi.ts`), and Google Ads' own on top of it\n * (`convex/sideEffects/googleAdsCapi/utils.ts`). They disagree about the `+` on\n * a phone, about whether a malformed address should be declined, and about\n * Gmail. Each disagreement is the same failure: two digests for one person, no\n * error anywhere, and an attribution that quietly matches nobody.\n *\n * **This module has taken over exactly one of them so far — the beacon's.** The\n * CAPI dispatchers still hold their own, because they sit on live conversion\n * uploads where a changed digest is money mis-attributed, so they move in their\n * own change with their own evidence. What is done instead, and now, is to make\n * the drift *detectable*: `capi.parity.test.ts` in `packages/backend` runs those\n * copies over the same table as these and fails when they stop agreeing. That is\n * the whole problem — the copies are identical today and nothing was watching.\n * One of them, Google Ads' phone rule, is genuinely a third rule and cannot be\n * pinned to either version; the test says so in place of pretending otherwise.\n *\n * Two ideas make that fixable rather than merely fixed:\n *\n * - **The version is data.** A digest cannot be recomputed — the plaintext was\n *   dropped on purpose, which is the point of holding a digest at all. So the\n *   rule that produced it is frozen as v1 and kept, and a better rule ships\n *   beside it as v2. Anything holding plaintext produces both and looks up\n *   both, which is why a normalization change cannot orphan the history.\n * - **The provider form is not the version.** Meta hashes E.164 without the\n *   `+`, Google hashes it with the `+` and canonicalizes Gmail addresses. Those\n *   are three digests of one canonical value, not three normalizations.\n */\n\nimport { sha256Hex } from \"./digest\";\nimport { normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nimport { normalizePhoneV1, normalizePhoneV2 } from \"./phone\";\nimport { providerPlain } from \"./providers\";\nimport type { CanonicalIdentity, IdentityInput, NormalizationVersion } from \"./types\";\n\nexport { externalIdDigest, isSha256Hex, normalizeExternalId, normalizeSha256Hex, sha256Hex } from \"./digest\";\nexport { googleEmail, normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nexport { normalizePhoneV1, normalizePhoneV2, phoneWithoutPlus } from \"./phone\";\nexport { type ProviderPlain, providerPlain } from \"./providers\";\nexport {\n  type CanonicalIdentity,\n  type IdentityInput,\n  type IdentityKind,\n  NORMALIZATION_VERSIONS,\n  type NormalizationVersion,\n} from \"./types\";\nexport { extractDomain, isPublicEmailDomain, workEmailDomain } from \"./workDomain\";\n\n/**\n * Apply one version's rule to plain text, or decline it.\n *\n * `null` means this version has no usable form of this value — not that the\n * person has no phone. Under v2 that happens to any national number, on\n * purpose: see {@link normalizePhoneV2}.\n */\nexport function normalizeIdentity(raw: IdentityInput, version: NormalizationVersion): CanonicalIdentity | null {\n  const value =\n    raw.kind === \"email\"\n      ? version === 1\n        ? normalizeEmailV1(raw.value)\n        : normalizeEmailV2(raw.value)\n      : version === 1\n        ? normalizePhoneV1(raw.value)\n        : normalizePhoneV2(raw.value);\n  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };\n}\n\n/**\n * The digests one canonical value produces, keyed by who asks for them.\n *\n * Snake case because this is a wire shape: it is what the browser sends, what\n * the ingest stores, and what an activation payload reads. `google_sha256` is\n * `null` when Google has no usable form of the value — a Gmail address whose\n * local part was only a `+tag`.\n */\nexport type IdentityDigests = {\n  canonical_sha256: string;\n  meta_sha256: string;\n  google_sha256: string | null;\n  normalization_version: NormalizationVersion;\n};\n\nexport async function providerDigests(canonical: CanonicalIdentity): Promise<IdentityDigests> {\n  const plain = providerPlain(canonical);\n  const [canonicalSha, metaSha, googleSha] = await Promise.all([\n    sha256Hex(plain.canonical),\n    sha256Hex(plain.meta),\n    plain.google === null ? Promise.resolve(null) : sha256Hex(plain.google),\n  ]);\n  return {\n    canonical_sha256: canonicalSha,\n    meta_sha256: metaSha,\n    google_sha256: googleSha,\n    normalization_version: canonical.normalizationVersion,\n  };\n}\n\n/**\n * The compact set a page sends and an ingest reads: one entry per version, plus\n * the two provider digests, for one plaintext value.\n *\n * `meta` and `google` are computed from the best version that produced a value\n * — v2 when it accepted the value, v1 otherwise — because a platform wants one\n * digest, not a history. `v1` and `v2` are both present when both rules\n * accepted the value, and they are equal when the two rules agreed.\n *\n * `null` when no version has a usable form: there is nothing to report, and\n * reporting an empty digest would be reporting the hash of the empty string.\n */\nexport type IdentityDigestSet = {\n  v1?: string;\n  v2?: string;\n  meta: string;\n  google?: string;\n};\n\nexport async function identityDigestSet(raw: IdentityInput): Promise<IdentityDigestSet | null> {\n  const v1 = normalizeIdentity(raw, 1);\n  const v2 = normalizeIdentity(raw, 2);\n  const best = v2 ?? v1;\n  if (best === null) return null;\n  const digests = await providerDigests(best);\n  return {\n    ...(v1 === null ? {} : { v1: v1.value === best.value ? digests.canonical_sha256 : await sha256Hex(v1.value) }),\n    ...(v2 === null ? {} : { v2: digests.canonical_sha256 }),\n    meta: digests.meta_sha256,\n    ...(digests.google_sha256 === null ? {} : { google: digests.google_sha256 }),\n  };\n}\n","/**\n * The customer-matching block: one vocabulary for everything Meta calls\n * *advanced matching* and Google calls *enhanced conversions*.\n *\n * ## Why these fields are here at all\n *\n * A server event is worth what it can be joined to. An email is the join that\n * works, and everything in this file is the second-best set for when the join\n * has to happen *outward* instead — Meta and Google both accept an event with\n * no email at all if it carries enough of a person: a name and a postcode, a\n * click id, a browser cookie. They disagree about spelling and about what has\n * to be hashed, and they do not disagree about the set.\n *\n * Two things follow, and they are the whole design:\n *\n * - **One block, one spelling.** A sender maps their CRM once, here, rather\n *   than once per destination. `MATCH_FIELD_FORWARDING` is the table that says\n *   what each field is called on the other side, so the mapping is published\n *   rather than folklore.\n * - **Kept in the form every destination can still be derived from.** That rule\n *   decides, per field, whether it is stored hashed or in the clear, and it is\n *   the only rule here worth remembering: **a digest can be computed later and\n *   never undone.** A city hashed on arrival can never be sent to Google, which\n *   wants `address_info.city` in plain text; a city kept in the clear can be\n *   hashed for Meta at the moment of sending, for free.\n *\n * So: hashed here are the fields **both** destinations want hashed and which\n * identify a person on their own — email, phone, the two names, the date of\n * birth, and the sender's own id. Kept in the clear are the coarse ones that\n * identify nobody by themselves and that Google wants unhashed: city, region,\n * postal code, country, and the gender letter. Hashing that second set would\n * buy no privacy — the digest of `es` is not a secret — and would cost the\n * ability to send them anywhere.\n *\n * ## A value that arrives already hashed\n *\n * Accepted for every field, and detected rather than declared. There is no\n * `email_sha256` beside `email` any more, because two fields for one idea is a\n * choice a sender should never have had to make: a 64-character hex string is\n * unambiguously a digest — no address, phone number, city or name can be one —\n * so the field can hold either and we can tell. What we cannot do is *unhash*,\n * so a digest arriving for a field this module would otherwise keep in the\n * clear is stored under `<field>_sha256`: the key says what is inside it, and a\n * forward that needs the plain value knows it does not have one.\n *\n * ## Normalization is Meta's, and the divergence is stated\n *\n * The hashed fields are normalized under the rule Meta publishes (lower case,\n * trimmed, punctuation and spacing removed) because a digest can only be\n * computed under one rule and Meta's is the stricter of the two. Google's rule\n * for a name is lower-case-and-trim only, so the two agree on every name\n * without punctuation in it and differ on `O'Brien`. Email and phone do not\n * have this problem: they go through `../identity`, which is the platform's one\n * versioned rule and the same one the browser beacon writes with — which is\n * what makes a server event and a Form submission land on one person.\n */\n\nimport { isSha256Hex, sha256Hex } from \"../identity\";\n\n/**\n * A field of `user_data` that describes the person rather than naming a click.\n *\n * `email` and `phone` are deliberately not here: they are resolved by\n * `./identity` into the row's own `identity_hash`, under the platform's\n * versioned rule, and this module reads that result rather than hashing them a\n * second time under a different one.\n */\nexport const MATCH_FIELDS = [\n  \"first_name\",\n  \"last_name\",\n  \"date_of_birth\",\n  \"gender\",\n  \"city\",\n  \"region\",\n  \"postal_code\",\n  \"country\",\n] as const;\nexport type MatchField = (typeof MATCH_FIELDS)[number];\n\n/**\n * The browser cookies Meta's pixel sets, which name a browser rather than a\n * person.\n *\n * `fbp` is the pixel's own first-party cookie and `fbc` is the one it derives\n * from a click. Both are sent to Meta **unhashed and verbatim** — they are\n * opaque strings of Meta's own making, and hashing one destroys it — so they\n * are stored exactly as they arrived.\n *\n * They are not in {@link MATCH_FIELDS} and not in the click-id list either.\n * They are not click ids: a `gclid` is stamped on a URL by the ad platform and\n * has a column of its own here because reports filter on it, while `fbp` is a\n * cookie a script wrote and nothing reports on. But they *do* name somebody,\n * which is why `namesSomebody` counts them — an event carrying only an `fbp` is\n * still an event Meta can attribute, and refusing it would lose exactly the\n * conversions this block exists to make sendable.\n */\nexport const MATCH_COOKIES = [\"fbp\", \"fbc\"] as const;\nexport type MatchCookie = (typeof MATCH_COOKIES)[number];\n\n/** How a field is stored, once it has been normalized. */\ntype Keeping = \"hashed\" | \"plain\";\n\ntype MatchSpec = {\n  keep: Keeping;\n  /** The canonical form, or `null` when the value says nothing usable. */\n  normalize: (value: string) => string | null;\n  /** What Meta and Google call this field, for the published mapping. */\n  meta: string;\n  google: string | null;\n};\n\n/** Lower-cased, trimmed, and stripped of everything that is not a letter or a digit. Meta's rule. */\nfunction tightened(value: string): string | null {\n  const stripped = value.toLowerCase().replace(/[^\\p{L}\\p{N}]/gu, \"\");\n  return stripped === \"\" ? null : stripped;\n}\n\n/** Lower-cased and trimmed, with runs of whitespace collapsed. Nothing else is removed. */\nfunction loosened(value: string): string | null {\n  const collapsed = value.trim().toLowerCase().replace(/\\s+/g, \" \");\n  return collapsed === \"\" ? null : collapsed;\n}\n\n/**\n * `1985-04-09`, `1985/04/09`, `19850409` — eight digits in year-month-day\n * order, however they are punctuated.\n *\n * The order is not guessed. `09/04/1985` is refused rather than read as the\n * ninth of April or the fourth of September: nothing in the value says which,\n * and a birth date hashed under the wrong reading is a digest that matches\n * nobody at Meta, with no error anywhere to say so. A refusal costs one field\n * on one event and is visible in the arrival log; a wrong guess costs the match\n * and is not.\n */\nfunction birthDate(value: string): string | null {\n  const digits = value.replace(/\\D/g, \"\");\n  if (!/^\\d{8}$/.test(digits)) return null;\n  const month = Number(digits.slice(4, 6));\n  const day = Number(digits.slice(6, 8));\n  if (month < 1 || month > 12 || day < 1 || day > 31) return null;\n  return digits;\n}\n\n/** `f` or `m`, from whatever word or letter the sender's system stores. */\nfunction genderLetter(value: string): string | null {\n  const first = value.trim().toLowerCase().charAt(0);\n  return first === \"f\" || first === \"m\" ? first : null;\n}\n\n/** ISO-3166 alpha-2, lower-cased. A country name is refused rather than guessed at. */\nfunction countryCode(value: string): string | null {\n  const code = value.trim().toLowerCase();\n  return /^[a-z]{2}$/.test(code) ? code : null;\n}\n\nexport const MATCH_SPECS: Readonly<Record<MatchField, MatchSpec>> = {\n  first_name: { keep: \"hashed\", normalize: tightened, meta: \"fn\", google: \"hashed_first_name\" },\n  last_name: { keep: \"hashed\", normalize: tightened, meta: \"ln\", google: \"hashed_last_name\" },\n  // Meta only. Google's enhanced conversions have no date of birth, so there is\n  // no destination wanting it in the clear and every reason not to keep one.\n  date_of_birth: { keep: \"hashed\", normalize: birthDate, meta: \"db\", google: null },\n  gender: { keep: \"plain\", normalize: genderLetter, meta: \"ge\", google: null },\n  city: { keep: \"plain\", normalize: loosened, meta: \"ct\", google: \"city\" },\n  region: { keep: \"plain\", normalize: loosened, meta: \"st\", google: \"state\" },\n  postal_code: { keep: \"plain\", normalize: loosened, meta: \"zp\", google: \"postal_code\" },\n  country: { keep: \"plain\", normalize: countryCode, meta: \"country\", google: \"country_code\" },\n};\n\n/** One row of the published mapping: our name, Meta's, Google's, and whether we hold it hashed. */\nexport type MatchFieldForwarding = {\n  field: string;\n  meta: string;\n  google: string | null;\n  hashed: boolean;\n};\n\n/**\n * What each field of the matching block is called at the destinations that\n * accept it — the table the dialog and the docs both read.\n *\n * Published rather than described, because \"it maps onto Meta's user_data\" is\n * a promise a sender cannot check and this is the same promise they can.\n */\nexport const MATCH_FIELD_FORWARDING: readonly MatchFieldForwarding[] = [\n  { field: \"email\", meta: \"em\", google: \"hashed_email\", hashed: true },\n  { field: \"phone\", meta: \"ph\", google: \"hashed_phone_number\", hashed: true },\n  // Kept in the clear — see `resolveOwnId`. The digest is still computed and\n  // still stored beside it, so a Meta forward has one; what changed is that the\n  // sender's own key is now readable, which is the entire reason they sent it.\n  { field: \"external_id\", meta: \"external_id\", google: null, hashed: false },\n  ...MATCH_FIELDS.map((field) => ({\n    field,\n    meta: MATCH_SPECS[field].meta,\n    google: MATCH_SPECS[field].google,\n    hashed: MATCH_SPECS[field].keep === \"hashed\",\n  })),\n  { field: \"fbp\", meta: \"fbp\", google: null, hashed: false },\n  { field: \"fbc\", meta: \"fbc\", google: null, hashed: false },\n];\n\n/** The longest a stored match value may be, matching the width the map's values are held at. */\nconst MAX_MATCH_VALUE = 255;\n\n/**\n * One field, resolved to the key it is stored under and the value stored there.\n *\n * `null` when the field said nothing usable — `gender: \"unknown\"`, a country\n * spelled out in full, a postcode of whitespace. A field that is present and\n * unusable contributes nothing rather than storing something that matches\n * nobody, which is the same rule the identity resolution follows.\n */\nexport async function resolveMatchField(\n  field: MatchField,\n  raw: string,\n): Promise<{ key: string; value: string } | null> {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  const spec = MATCH_SPECS[field];\n  // Already a digest, whatever this field would otherwise keep. Taken at face\n  // value — hashing a hash matches nothing, forever — and keyed so that the\n  // name says what is inside, because a plain-text destination cannot use it.\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  const normalized = spec.normalize(value);\n  if (normalized === null) return null;\n  if (spec.keep === \"plain\") return { key: field, value: normalized.slice(0, MAX_MATCH_VALUE) };\n  return { key: `${field}_sha256`, value: await sha256Hex(normalized) };\n}\n\n/**\n * The two ids that are not facts about a person but *names the sender chose*,\n * kept exactly as they were sent.\n *\n * `external_id` is the client's own key — a HubSpot contact id, a Salesforce\n * record id — and `baker_id` is a cookie value one of our own pages minted.\n * Neither describes anybody: they are pointers, and a pointer is worth only\n * what it can be followed with.\n *\n * ## Why these are the exception to \"identifying fields are hashed\"\n *\n * `external_id` used to be hashed here and nothing else, on the reasoning that\n * it is sometimes an email or a document number in disguise. That reasoning\n * held and the consequence did not: it made the field **useless to the person\n * who sent it**. An integrator posting `external_id: \"hs:contact:12345\"` opened\n * the event and read *Provided, stored hashed* — no way to check we had read\n * the right record, no way to paste the id back into their CRM, and no way to\n * tell a working integration from one silently keyed on the wrong column. The\n * whole point of the field is to be recognised on the way back out.\n *\n * The privacy this bought was also smaller than it looked. The digest is still\n * computed, still what `identity_hash` stores and still what the identity graph\n * joins on — see `./identity` — so nothing about the joining changed. What is\n * new is a second copy in the clear, under the key that says so.\n *\n * A value that arrives *already* a digest still keeps `<field>_sha256`, for the\n * rule that governs every field here: a digest cannot be undone, so the key has\n * to say what is inside it.\n */\nexport function resolveOwnId(field: \"external_id\" | \"baker_id\", raw: string): { key: string; value: string } | null {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  return { key: field, value: value.slice(0, MAX_MATCH_VALUE) };\n}\n\n/** A cookie value, as Meta minted it: bounded, and otherwise untouched. */\nexport function resolveMatchCookie(raw: string): string | null {\n  const value = raw.trim();\n  return value === \"\" ? null : value.slice(0, MAX_MATCH_VALUE);\n}\n\n/**\n * The `fbclid` hiding inside an `fbc`, or `null`.\n *\n * `fbc` is `fb.<subdomain index>.<timestamp>.<fbclid>` — Meta's own encoding of\n * a click id it already saw. A sender whose system stored the cookie has the\n * click id and does not know it, so reading it out costs one split and gives\n * the event the same paid-attribution column a landing page would have written\n * from the URL. Nothing is invented: the value was there.\n */\nexport function fbclidFromFbc(fbc: string): string | null {\n  const parts = fbc.split(\".\");\n  if (parts.length < 4 || parts[0] !== \"fb\") return null;\n  const id = parts.slice(3).join(\".\");\n  return id === \"\" ? null : id;\n}\n","/**\n * The click ids a sender may hand over, named the way their own system stored\n * them.\n *\n * The wire uses the **URL parameter** spelling (`li_fat_id`) rather than the\n * analytics row's field spelling (`liFatId`), because a client's CRM captured\n * these off a landing URL and that is the name it wrote them down under.\n * {@link clickIdsFromWire} is the one place the two vocabularies meet.\n *\n * Mirrored from `CLICK_ID_FIELDS` in `../analytics/normalize.ts`, which is the\n * source of truth for which click ids the store has columns for.\n * `vocabulary.parity.test.ts` reads that file and fails if the two drift — a\n * missing entry here is an attribution a client sent and we dropped.\n */\n\nimport type { ClickIdFields } from \"../analytics/normalize\";\n\nexport const INGEST_CLICK_ID_PARAMS = [\n  \"gclid\",\n  \"wbraid\",\n  \"gbraid\",\n  \"dclid\",\n  \"fbclid\",\n  \"ttclid\",\n  \"twclid\",\n  \"li_fat_id\",\n  \"msclkid\",\n  \"rdt_cid\",\n  \"epik\",\n  \"sccid\",\n  \"oppref\",\n] as const;\nexport type IngestClickIdParam = (typeof INGEST_CLICK_ID_PARAMS)[number];\n\nconst FIELD_FOR_PARAM: Readonly<Record<IngestClickIdParam, keyof ClickIdFields>> = {\n  gclid: \"gclid\",\n  wbraid: \"wbraid\",\n  gbraid: \"gbraid\",\n  dclid: \"dclid\",\n  fbclid: \"fbclid\",\n  ttclid: \"ttclid\",\n  twclid: \"twclid\",\n  li_fat_id: \"liFatId\",\n  msclkid: \"msclkid\",\n  rdt_cid: \"rdtCid\",\n  epik: \"epik\",\n  sccid: \"sccid\",\n  oppref: \"oppref\",\n};\n\n/** The wire's click block as the analytics row builder names its fields. Empty values are dropped. */\nexport function clickIdsFromWire(click: Partial<Record<IngestClickIdParam, string | null>> | null | undefined): {\n  clickIds: ClickIdFields;\n  kinds: IngestClickIdParam[];\n} {\n  const clickIds: ClickIdFields = {};\n  const kinds: IngestClickIdParam[] = [];\n  for (const param of INGEST_CLICK_ID_PARAMS) {\n    const value = click?.[param];\n    if (typeof value !== \"string\" || value === \"\") continue;\n    clickIds[FIELD_FOR_PARAM[param]] = value;\n    kinds.push(param);\n  }\n  return { clickIds, kinds };\n}\n","/**\n * What a source can be read into: the fields of an event, named the way\n * `POST /v1/events` already names them.\n *\n * Assembled from the ingest vocabulary rather than spelled a fourth time. A\n * mapping is `SourceField → dotted path`, and the field half of that pair has\n * to be a name the wire already accepts, because the whole of what a source\n * does is build an `IngestEventInput` and hand it to the same door the\n * client's own server would have used. A field that existed only here would be\n * a field the event could not carry.\n */\n\nimport { MATCH_FIELDS, type MatchField } from \"../event-ingest/matching\";\nimport type { IngestClickIdParam } from \"../event-ingest/vocabulary\";\nimport { INGEST_CLICK_ID_PARAMS } from \"../event-ingest/vocabulary\";\n\n/** Where a field sits on the sheet: one row per group, in this order. */\nexport type SourceFieldGroup = \"event\" | \"person\" | \"money\" | \"click\";\n\nexport type SourceField =\n  | \"event_name\"\n  | \"event_time\"\n  | \"event_id\"\n  | \"email\"\n  | \"phone\"\n  | \"external_id\"\n  | MatchField\n  | \"value\"\n  | \"currency\"\n  | IngestClickIdParam;\n\nexport interface SourceFieldSpec {\n  field: SourceField;\n  /** The product word for it — what the sheet and the CLI show. */\n  label: string;\n  group: SourceFieldGroup;\n}\n\nconst MATCH_LABELS: Readonly<Record<MatchField, string>> = {\n  first_name: \"First name\",\n  last_name: \"Last name\",\n  date_of_birth: \"Date of birth\",\n  gender: \"Gender\",\n  city: \"City\",\n  region: \"Region\",\n  postal_code: \"Postcode\",\n  country: \"Country\",\n};\n\nconst CLICK_LABELS: Readonly<Record<IngestClickIdParam, string>> = {\n  gclid: \"Google click id\",\n  wbraid: \"Google click id (iOS, web to app)\",\n  gbraid: \"Google click id (iOS, app)\",\n  dclid: \"Google click id (Display & Video)\",\n  fbclid: \"Meta click id\",\n  ttclid: \"TikTok click id\",\n  twclid: \"X click id\",\n  li_fat_id: \"LinkedIn click id\",\n  msclkid: \"Microsoft click id\",\n  rdt_cid: \"Reddit click id\",\n  epik: \"Pinterest click id\",\n  sccid: \"Snapchat click id\",\n  oppref: \"ChatGPT Ads click id\",\n};\n\nexport const SOURCE_FIELDS: readonly SourceFieldSpec[] = [\n  { field: \"event_name\", label: \"What happened\", group: \"event\" },\n  { field: \"event_time\", label: \"When it happened\", group: \"event\" },\n  { field: \"event_id\", label: \"Its id\", group: \"event\" },\n  { field: \"email\", label: \"Email\", group: \"person\" },\n  { field: \"phone\", label: \"Phone\", group: \"person\" },\n  { field: \"external_id\", label: \"Your own id for the person\", group: \"person\" },\n  ...MATCH_FIELDS.map((field) => ({ field, label: MATCH_LABELS[field], group: \"person\" as const })),\n  { field: \"value\", label: \"Amount\", group: \"money\" },\n  { field: \"currency\", label: \"Currency\", group: \"money\" },\n  ...INGEST_CLICK_ID_PARAMS.map((field) => ({ field, label: CLICK_LABELS[field], group: \"click\" as const })),\n];\n\nexport const SOURCE_FIELD_NAMES: readonly SourceField[] = SOURCE_FIELDS.map((spec) => spec.field);\n\nconst FIELD_SET: ReadonlySet<string> = new Set(SOURCE_FIELD_NAMES);\n\nexport function isSourceField(value: string): value is SourceField {\n  return FIELD_SET.has(value);\n}\n\nexport const SOURCE_FIELD_GROUPS: readonly { group: SourceFieldGroup; label: string; detail: string }[] = [\n  { group: \"event\", label: \"The event\", detail: \"What it is called, when it happened, and its own id.\" },\n  {\n    group: \"person\",\n    label: \"Who it is about\",\n    detail: \"How the platforms find the person. Email or phone is the one that matters.\",\n  },\n  {\n    group: \"money\",\n    label: \"What it was worth\",\n    detail: \"The amount and its currency, for revenue and for the platforms.\",\n  },\n  {\n    group: \"click\",\n    label: \"The ad click that brought them\",\n    detail: \"When the source keeps the click id, the campaign gets the credit.\",\n  },\n];\n\n/**\n * A row that is not a field of the event but one of its own **properties** —\n * the flat `properties` object every event carries, which Measure → Events\n * breaks an event down by and which a send can forward to a platform as an\n * extra parameter (Meta's `custom_data`, a GA4 event parameter).\n *\n * Spelled `properties.<key>` in the mapping so the row shares the table with\n * the fields and the CLI's `--field` takes it unchanged, while an unknown bare\n * key is still refused: the namespace is what tells a deliberate extra\n * property from a typo that would otherwise silently map nothing.\n */\nexport const PROPERTY_ROW_PREFIX = \"properties.\";\n\n/** The longest a property's key may be. Keys are a shared dictionary in the store, so they are kept short and plain. */\nexport const PROPERTY_KEY_MAX = 64;\n\n/** Letters, digits, underscore, dash and dot — what a property key of `POST /v1/events` may be, and what a platform parameter name may be. */\nconst PROPERTY_KEY = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;\n\n/** Keys a source writes itself; a row naming one would be overwritten in silence. */\nexport const RESERVED_PROPERTY_KEYS: readonly string[] = [\"baker_source\", \"hubspot_property\", \"hubspot_value\"];\n\n/** Whether a mapping row names a property rather than a field. */\nexport function isPropertyRow(row: string): boolean {\n  return row.startsWith(PROPERTY_ROW_PREFIX);\n}\n\n/** The property's own key, for a `properties.<key>` row; null for anything else. */\nexport function propertyKeyOf(row: string): string | null {\n  return isPropertyRow(row) ? row.slice(PROPERTY_ROW_PREFIX.length) : null;\n}\n\n/** The mapping row for a property key. */\nexport function propertyRow(key: string): string {\n  return `${PROPERTY_ROW_PREFIX}${key}`;\n}\n\n/**\n * Why a property key cannot be used, in one sentence, or null when it can.\n * The same rule for a source's extra properties and for a send's parameters.\n */\nexport function propertyKeyProblem(key: string): string | null {\n  const trimmed = key.trim();\n  if (trimmed === \"\") return \"A property needs a name.\";\n  if (trimmed.length > PROPERTY_KEY_MAX) return `A property name is at most ${PROPERTY_KEY_MAX} characters.`;\n  if (!PROPERTY_KEY.test(trimmed)) {\n    return `\"${trimmed}\" is not a property name: letters, digits, underscore, dash and dot only, starting with a letter or digit.`;\n  }\n  if (RESERVED_PROPERTY_KEYS.includes(trimmed)) return `\"${trimmed}\" is written by Baker itself; pick another name.`;\n  return null;\n}\n\n/**\n * Whether a mapping row is one a source can hold: a field of the event, or a\n * well-named property. The reason when it is not.\n */\nexport function mappingRowProblem(row: string): string | null {\n  if (isSourceField(row)) return null;\n  const key = propertyKeyOf(row);\n  if (key === null) {\n    return `\"${row}\" is not a field an event can carry. A field is one of ${SOURCE_FIELD_NAMES.join(\", \")}; an extra property is spelled properties.<name>.`;\n  }\n  return propertyKeyProblem(key);\n}\n\n/** The property rows of a mapping, as `key → template`, in the order stored. */\nexport function propertyRows(mapping: Readonly<Record<string, string>>): { key: string; template: string }[] {\n  return Object.entries(mapping).flatMap(([row, template]) => {\n    const key = propertyKeyOf(row);\n    return key === null ? [] : [{ key, template }];\n  });\n}\n","/**\n * A mapping row is a template: literal text with `{{mentions}}` in it.\n *\n * ## Why a template and not a path\n *\n * A row used to hold one dotted path, and one path answers one question —\n * \"which field of the payload is the email\". It cannot answer the next three:\n * a currency the tool never sends but the company knows (`EUR`), a name split\n * over two fields (`{{firstname}} {{lastname}}`), or an amount a HubSpot\n * contact carries under a property nobody would guess. A template answers all\n * of them with one rule the Forms builder already teaches: type text, insert\n * a variable. The same spelling is what the CLI takes, so an agent and a\n * person write the same thing.\n *\n * ## What a mention points at\n *\n * Whatever the source can read. For an address it is a dotted path into the\n * payload (`contact.email`, `deal.contacts.0.email`); for a HubSpot read it\n * is a contact property's internal name (`hs_google_click_id`), plus `id` for\n * the contact's own id. The template does not know which — the lookup passed\n * to `renderTemplate` does.\n *\n * A mention names exactly one thing. There was a `{{phone|mobilephone}}`\n * spelling for \"the first that holds anything\"; it is gone, because it was a\n * rule the Forms builder's variables do not have, and a row that reads\n * differently from every other variable field in the product is a row nobody\n * can predict. A person who wants the mobile picks the mobile.\n */\n\nconst MENTION = /\\{\\{\\s*([^{}]+?)\\s*\\}\\}/g;\n\n/** The path a mention names, with the braces on. */\nexport function mentionOf(path: string): string {\n  return `{{${path}}}`;\n}\n\n/** Every path a template reads, in order, once each. */\nexport function templateMentions(template: string): string[] {\n  const seen: string[] = [];\n  for (const match of template.matchAll(MENTION)) {\n    const path = (match[1] ?? \"\").trim();\n    if (path !== \"\" && !seen.includes(path)) seen.push(path);\n  }\n  return seen;\n}\n\n/**\n * The template with every mention replaced by what it points at, trimmed —\n * or nothing, when what is left is empty. An empty mention reads as empty\n * text rather than as its own spelling, so a template made only of mentions\n * the payload did not fill is \"not sent\", not the literal `{{phone}}`.\n */\nexport function renderTemplate(template: string, lookup: (path: string) => string | undefined): string | undefined {\n  const rendered = template.replace(MENTION, (_whole, path: string) => lookup(path.trim()) ?? \"\").trim();\n  return rendered === \"\" ? undefined : rendered;\n}\n\n/** The one path a template is, when it is exactly one mention and nothing else. */\nexport function isBareMention(template: string): string | null {\n  const match = /^\\{\\{\\s*([^{}]+?)\\s*\\}\\}$/.exec(template.trim());\n  return match === null ? null : (match[1] ?? null);\n}\n"],"mappings":";AAcA,IAAM,aAAa;AAQZ,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK,KAAK;AAC9B;;;ACNO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,YAAY,KAAK,OAAO;AACjC;AAGA,IAAM,QAAQ;AAMP,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,MAAM,KAAK,OAAO,IAAI,UAAU;AACzC;;;AChBO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,SAAS,IACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,EAAE;AACxB,SAAO,WAAW,KAAK,OAAO,IAAI,MAAM;AAC1C;AAGA,IAAM,oBAAoB;AAE1B,IAAM,OAAO;AAYN,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,QAAQ,mBAAmB,EAAE;AACjD,QAAM,OAAO,QAAQ,WAAW,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,KAAK;AACjE,SAAO,KAAK,KAAK,IAAI,IAAI,OAAO;AAClC;;;ACgBO,SAAS,kBAAkB,KAAoB,SAAyD;AAC7G,QAAM,QACJ,IAAI,SAAS,UACT,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK,IAC5B,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK;AAClC,SAAO,UAAU,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,OAAO,sBAAsB,QAAQ;AACxF;;;ACHO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAgB,CAAC,OAAO,KAAK;AAgB1C,SAAS,UAAU,OAA8B;AAC/C,QAAM,WAAW,MAAM,YAAY,EAAE,QAAQ,mBAAmB,EAAE;AAClE,SAAO,aAAa,KAAK,OAAO;AAClC;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AAChE,SAAO,cAAc,KAAK,OAAO;AACnC;AAaA,SAAS,UAAU,OAA8B;AAC/C,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,MAAI,CAAC,UAAU,KAAK,MAAM,EAAG,QAAO;AACpC,QAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACvC,QAAM,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACrC,MAAI,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK,MAAM,GAAI,QAAO;AAC3D,SAAO;AACT;AAGA,SAAS,aAAa,OAA8B;AAClD,QAAM,QAAQ,MAAM,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;AACjD,SAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAClD;AAGA,SAAS,YAAY,OAA8B;AACjD,QAAM,OAAO,MAAM,KAAK,EAAE,YAAY;AACtC,SAAO,aAAa,KAAK,IAAI,IAAI,OAAO;AAC1C;AAEO,IAAM,cAAuD;AAAA,EAClE,YAAY,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,oBAAoB;AAAA,EAC5F,WAAW,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,mBAAmB;AAAA;AAAA;AAAA,EAG1F,eAAe,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,KAAK;AAAA,EAChF,QAAQ,EAAE,MAAM,SAAS,WAAW,cAAc,MAAM,MAAM,QAAQ,KAAK;AAAA,EAC3E,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,OAAO;AAAA,EACvE,QAAQ,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,QAAQ;AAAA,EAC1E,aAAa,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,cAAc;AAAA,EACrF,SAAS,EAAE,MAAM,SAAS,WAAW,aAAa,MAAM,WAAW,QAAQ,eAAe;AAC5F;AAiBO,IAAM,yBAA0D;AAAA,EACrE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,gBAAgB,QAAQ,KAAK;AAAA,EACnE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,uBAAuB,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI1E,EAAE,OAAO,eAAe,MAAM,eAAe,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzE,GAAG,aAAa,IAAI,CAAC,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,KAAK,EAAE;AAAA,IACzB,QAAQ,YAAY,KAAK,EAAE;AAAA,IAC3B,QAAQ,YAAY,KAAK,EAAE,SAAS;AAAA,EACtC,EAAE;AAAA,EACF,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzD,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAC3D;;;ACrLO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACOA,IAAM,eAAqD;AAAA,EACzD,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,eAA6D;AAAA,EACjE,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,gBAA4C;AAAA,EACvD,EAAE,OAAO,cAAc,OAAO,iBAAiB,OAAO,QAAQ;AAAA,EAC9D,EAAE,OAAO,cAAc,OAAO,oBAAoB,OAAO,QAAQ;AAAA,EACjE,EAAE,OAAO,YAAY,OAAO,UAAU,OAAO,QAAQ;AAAA,EACrD,EAAE,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;AAAA,EAClD,EAAE,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;AAAA,EAClD,EAAE,OAAO,eAAe,OAAO,8BAA8B,OAAO,SAAS;AAAA,EAC7E,GAAG,aAAa,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,aAAa,KAAK,GAAG,OAAO,SAAkB,EAAE;AAAA,EAChG,EAAE,OAAO,SAAS,OAAO,UAAU,OAAO,QAAQ;AAAA,EAClD,EAAE,OAAO,YAAY,OAAO,YAAY,OAAO,QAAQ;AAAA,EACvD,GAAG,uBAAuB,IAAI,CAAC,WAAW,EAAE,OAAO,OAAO,aAAa,KAAK,GAAG,OAAO,QAAiB,EAAE;AAC3G;AAEO,IAAM,qBAA6C,cAAc,IAAI,CAAC,SAAS,KAAK,KAAK;AAEhG,IAAM,YAAiC,IAAI,IAAI,kBAAkB;AAE1D,SAAS,cAAc,OAAqC;AACjE,SAAO,UAAU,IAAI,KAAK;AAC5B;AAgCO,IAAM,sBAAsB;AAG5B,IAAM,mBAAmB;AAGhC,IAAM,eAAe;AAGd,IAAM,yBAA4C,CAAC,gBAAgB,oBAAoB,eAAe;AAGtG,SAAS,cAAc,KAAsB;AAClD,SAAO,IAAI,WAAW,mBAAmB;AAC3C;AAGO,SAAS,cAAc,KAA4B;AACxD,SAAO,cAAc,GAAG,IAAI,IAAI,MAAM,oBAAoB,MAAM,IAAI;AACtE;AAWO,SAAS,mBAAmB,KAA4B;AAC7D,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,YAAY,GAAI,QAAO;AAC3B,MAAI,QAAQ,SAAS,iBAAkB,QAAO,8BAA8B,gBAAgB;AAC5F,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,WAAO,IAAI,OAAO;AAAA,EACpB;AACA,MAAI,uBAAuB,SAAS,OAAO,EAAG,QAAO,IAAI,OAAO;AAChE,SAAO;AACT;AAMO,SAAS,kBAAkB,KAA4B;AAC5D,MAAI,cAAc,GAAG,EAAG,QAAO;AAC/B,QAAM,MAAM,cAAc,GAAG;AAC7B,MAAI,QAAQ,MAAM;AAChB,WAAO,IAAI,GAAG,0DAA0D,mBAAmB,KAAK,IAAI,CAAC;AAAA,EACvG;AACA,SAAO,mBAAmB,GAAG;AAC/B;;;AC3IA,IAAM,UAAU;AAGT,SAAS,UAAU,MAAsB;AAC9C,SAAO,KAAK,IAAI;AAClB;AAGO,SAAS,iBAAiB,UAA4B;AAC3D,QAAM,OAAiB,CAAC;AACxB,aAAW,SAAS,SAAS,SAAS,OAAO,GAAG;AAC9C,UAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,KAAK;AACnC,QAAI,SAAS,MAAM,CAAC,KAAK,SAAS,IAAI,EAAG,MAAK,KAAK,IAAI;AAAA,EACzD;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-XHC4LMK4.js → chunk-EIGXX6KI.js}

@@ -1,10 +1,10 @@
 import {
   ApiError,
   apiGet
-} from "./chunk-MF7YA62W.js";
+} from "./chunk-CUL3VB4L.js";
 import {
   getEnv
-} from "./chunk-HJEMOSPH.js";
+} from "./chunk-I4FTS5EE.js";
 
 // src/error-handler.ts
 var REQUEST_CONNECTION_PLATFORM = {
@@ -153,6 +153,12 @@ function writeJsonEnvelope(envelope) {
   process.stdout.write(`${JSON.stringify(envelope, null, 2)}
 `);
 }
+var TABLE_OUTPUT_FORMATS = ["json", "csv", "jsonl", "md"];
+function outputFormatRefusal(format, supported) {
+  if (supported.includes(format)) return null;
+  const list = supported.length > 1 ? `${supported.slice(0, -1).join(", ")} or ${supported.at(-1)}` : supported.join("");
+  return `--output ${format} is not supported \u2014 use ${list}`;
+}
 function toCsvRow(values) {
   return values.map((v) => {
     if (v.includes(",") || v.includes('"') || v.includes("\n")) {
@@ -288,14 +294,16 @@ export {
   getQueryTtl,
   buildQueryCacheKey,
   getManagerIdForCustomer,
-  connectionFixExplanation,
-  handleConnectionError,
-  isNotConnectedError,
-  needsConnectionFix,
   writeAdsJson,
   writeJsonEnvelope,
+  TABLE_OUTPUT_FORMATS,
+  outputFormatRefusal,
   toCsvRow,
   writeAdsOutput,
-  resolveCustomerId
+  resolveCustomerId,
+  connectionFixExplanation,
+  handleConnectionError,
+  isNotConnectedError,
+  needsConnectionFix
 };
-//# sourceMappingURL=chunk-XHC4LMK4.js.map
+//# sourceMappingURL=chunk-EIGXX6KI.js.map

package/dist/chunk-EIGXX6KI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/error-handler.ts","../src/commands/ads/cache.ts","../src/commands/ads/output.ts"],"sourcesContent":["import { writeJsonEnvelope } from \"./commands/ads/output.ts\";\n\ntype ConnectionPlatform = \"google_ads\" | \"ga4\" | \"gsc\" | \"x_ads\" | \"meta_ads\" | \"linkedin_ads\";\n\n/**\n * Platforms the agent can get connected without the user leaving the chat, via\n * the blocking `request_connection` tool, and the id that tool expects. Every\n * platform this CLI can talk to is here — keep it in step with\n * `CONNECTION_PLATFORMS` in `packages/bridge/src/hono/connection-input.ts`: a\n * platform the tool accepts but this map omits sends the user to Settings for a\n * door the agent could have opened itself.\n */\nconst REQUEST_CONNECTION_PLATFORM: Record<ConnectionPlatform, string> = {\n  google_ads: \"google-ads\",\n  ga4: \"google-analytics\",\n  gsc: \"google-search-console\",\n  linkedin_ads: \"linkedin\",\n  meta_ads: \"meta\",\n  x_ads: \"x-ads\",\n};\n\nconst PLATFORM_NAME: Record<ConnectionPlatform, string> = {\n  google_ads: \"Google Ads\",\n  ga4: \"Google Analytics 4\",\n  gsc: \"Google Search Console\",\n  x_ads: \"X Ads\",\n  meta_ads: \"Meta Ads\",\n  linkedin_ads: \"LinkedIn Ads\",\n};\n\n/**\n * How to tell the agent to get a platform connected. Never \"send them to\n * Settings\" for a platform `request_connection` covers — that ends the turn on a\n * wall the agent could have opened itself, and it now covers every platform this\n * CLI talks to. The fallback line matters too: if the `request_connection` call\n * fails, the agent must still be able to say where the connect button is instead\n * of stalling.\n */\nexport function connectionFixExplanation(platform: ConnectionPlatform): string {\n  const name = PLATFORM_NAME[platform];\n  const slug = REQUEST_CONNECTION_PLATFORM[platform];\n  return (\n    `${name} is not connected for this company (or no account has been picked). Don't send the user to Settings ` +\n    `or end the turn here — call the \\`request_connection\\` tool with { platform: \"${slug}\", reason } and ` +\n    `they connect and pick their accounts from inside the chat. If the \\`request_connection\\` call fails, say so ` +\n    `plainly and give the exact route: dashboard → Brain → Integrations → Platforms → ${name}. Then carry on with the ` +\n    `rest of the task and say what stays unavailable until it is connected.`\n  );\n}\n\n/**\n * Shared error handler for \"No Connection\" scenarios.\n * Provides a structured error for AI agents with a suggested fix and alternative commands.\n */\nexport function handleConnectionError(platform: ConnectionPlatform, originalMessage?: string): never {\n  const platformName = PLATFORM_NAME[platform];\n\n  const alternative = {\n    google_ads: \"keywords-for-site or research advertisers\",\n    ga4: \"lighthouse for page performance\",\n    gsc: \"keywords-for-site or research keyword-gap\",\n    x_ads: \"research advertisers\",\n    meta_ads: \"research advertisers or research keyword-ideas\",\n    linkedin_ads: \"research advertisers (LinkedIn Ad Library) or research keyword-ideas\",\n  }[platform];\n\n  const code = {\n    google_ads: \"NO_GOOGLE_ADS_CONNECTION\",\n    ga4: \"NO_GA4_CONNECTION\",\n    gsc: \"NO_GSC_CONNECTION\",\n    x_ads: \"NO_X_ADS_CONNECTION\",\n    meta_ads: \"NO_META_ADS_CONNECTION\",\n    linkedin_ads: \"NO_LINKEDIN_ADS_CONNECTION\",\n  }[platform];\n\n  const envelope = {\n    ok: false,\n    error: {\n      code,\n      message: originalMessage || `No ${platformName} connection found for this company.`,\n      fix: {\n        action: \"request_connection\",\n        explanation: `${connectionFixExplanation(platform)} (Optional fallback for estimated external insights: 'baker research ${alternative}'.)`,\n      },\n      retryable: false,\n    },\n  };\n\n  writeJsonEnvelope(envelope);\n  process.exit(1);\n}\n\n/**\n * Does this API failure mean \"the platform isn't connected\"? The read commands\n * surface the backend's own 404/403 verbatim, so the connect fix has to be\n * recognised from the code the client mapped it to plus the message.\n */\nexport function isNotConnectedError(code: string, message: string): boolean {\n  if (code !== \"NOT_FOUND\" && code !== \"UNAUTHORIZED\" && code !== \"FORBIDDEN\") {\n    return false;\n  }\n  // The last alternative is the write-path 403 (\"customer X is not in this\n  // company's connected Google Ads accounts\") — a different sentence for the\n  // same remedy: connect, and pick the account.\n  return /no .* connection found|not connected|no .* (selected|picked)|is not in .* connected/i.test(message);\n}\n\n/**\n * Does this failure warrant the connect form? A dead token (401) always does —\n * whatever the wording, the remedy is to sign in again.\n *\n * A 404 or 403 only does when the backend says so. Both codes are overloaded:\n * 403 is also an asset-level refusal on a live connection (reconnecting cannot\n * grant it), and 404 is also how \"no staged op <ref> in this draft\" and a\n * mistyped `--chat` come back. Answering either with \"ask the user to connect\n * Meta Ads\" sends the agent to fix something that was never broken, and the\n * real missing-connection 404 says \"No <platform> connection found\" anyway.\n */\nexport function needsConnectionFix(code: string, message: string): boolean {\n  if (code === \"UNAUTHORIZED\") {\n    return true;\n  }\n  return isNotConnectedError(code, message);\n}\n","import { createHash } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { CacheEntry } from \"./types.ts\";\n\nconst CACHE_DIR = join(homedir(), \".baker\", \"cache\", \"ads\");\n\nfunction ensureDir(dir: string): void {\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n}\n\nfunction hashKey(key: string): string {\n  return createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 16);\n}\n\nfunction cachePath(category: string, key: string): string {\n  const dir = join(CACHE_DIR, category);\n  ensureDir(dir);\n  return join(dir, `${hashKey(key)}.json`);\n}\n\nexport function cacheGet<T>(category: string, key: string): CacheEntry<T> | null {\n  const path = cachePath(category, key);\n  if (!existsSync(path)) {\n    return null;\n  }\n  try {\n    const raw = readFileSync(path, \"utf-8\");\n    const entry = JSON.parse(raw) as CacheEntry<T>;\n    if (entry.expiresAt < Date.now()) {\n      rmSync(path, { force: true });\n      return null;\n    }\n    return entry;\n  } catch {\n    rmSync(path, { force: true });\n    return null;\n  }\n}\n\nexport function cacheSet<T>(\n  category: string,\n  key: string,\n  data: T,\n  ttlMs: number,\n  fields?: Record<string, string>,\n): void {\n  const path = cachePath(category, key);\n  const entry: CacheEntry<T> = {\n    expiresAt: Date.now() + ttlMs,\n    data,\n    fields,\n  };\n  writeFileSync(path, JSON.stringify(entry), \"utf-8\");\n}\n\nconst HOUR = 60 * 60 * 1000;\nconst MINUTE = 60 * 1000;\n\nexport function getQueryTtl(query: string): number {\n  const upper = query.toUpperCase();\n  if (upper.includes(\"TODAY\")) {\n    return 15 * MINUTE;\n  }\n  if (upper.includes(\"LAST_7_DAYS\") || upper.includes(\"LAST_14_DAYS\")) {\n    return 1 * HOUR;\n  }\n  // Historical data (BETWEEN, LAST_30_DAYS, LAST_90_DAYS, etc.)\n  return 6 * HOUR;\n}\n\nexport function buildQueryCacheKey(customerId: string, query: string): string {\n  const today = new Date().toISOString().slice(0, 10);\n  return `${customerId}:${today}:${query.trim().replace(/\\s+/g, \" \")}`;\n}\n\ninterface CachedAccount {\n  id: string;\n  access_type: \"direct\" | \"managed\";\n  manager_id?: string;\n}\n\nexport function getManagerIdForCustomer(customerId: string): string | undefined {\n  const cached = cacheGet<CachedAccount[]>(\"accounts\", \"list\");\n  if (!cached) return undefined;\n  const account = cached.data.find((a) => a.id === customerId);\n  if (account?.access_type === \"managed\") return account.manager_id;\n  return undefined;\n}\n","import { ApiError, apiGet } from \"../../client.ts\";\nimport { getEnv } from \"../../env.ts\";\nimport { handleConnectionError, isNotConnectedError } from \"../../error-handler.ts\";\nimport type { QueryContext } from \"../../geo-context.ts\";\nimport { cacheGet, cacheSet } from \"./cache.ts\";\nimport type { AdsErrorEnvelope, AdsFileSummary, AdsSuccessEnvelope } from \"./types.ts\";\n\ntype AdsOutput =\n  | AdsSuccessEnvelope<unknown>\n  | AdsErrorEnvelope\n  | AdsFileSummary\n  | { ok: true; data: unknown; query_context?: QueryContext; cached?: true; fields?: Record<string, string> }\n  | { ok: false; error: { code: string; message: string } };\n\nexport function writeAdsJson(envelope: AdsOutput): void {\n  process.stdout.write(`${JSON.stringify(envelope, null, 2)}\\n`);\n}\n\nexport function writeJsonEnvelope(envelope: Record<string, unknown>): void {\n  process.stdout.write(`${JSON.stringify(envelope, null, 2)}\\n`);\n}\n\n/** The formats `writeAdsOutput` prints. */\nexport const TABLE_OUTPUT_FORMATS = [\"json\", \"csv\", \"jsonl\", \"md\"] as const;\n\n/** Why `--output <format>` cannot be printed, or null — rather than quietly falling back to JSON. */\nexport function outputFormatRefusal(format: string, supported: readonly string[]): string | null {\n  if (supported.includes(format)) return null;\n  const list =\n    supported.length > 1 ? `${supported.slice(0, -1).join(\", \")} or ${supported.at(-1)}` : supported.join(\"\");\n  return `--output ${format} is not supported — use ${list}`;\n}\n\nexport function toCsvRow(values: string[]): string {\n  return values\n    .map((v) => {\n      if (v.includes(\",\") || v.includes('\"') || v.includes(\"\\n\")) {\n        return `\"${v.replace(/\"/g, '\"\"')}\"`;\n      }\n      return v;\n    })\n    .join(\",\");\n}\n\nfunction flattenRow(row: Record<string, unknown>): Record<string, string> {\n  const flat: Record<string, string> = {};\n  for (const [key, val] of Object.entries(row)) {\n    flat[key] = typeof val === \"object\" && val !== null ? JSON.stringify(val) : String(val ?? \"\");\n  }\n  return flat;\n}\n\n/**\n * One write per table: a line-by-line write piped into `head` hits a closed pipe on\n * the next line and crashes with EPIPE, where a single write lands in the pipe buffer.\n */\nfunction writeWhole(lines: string[]): void {\n  process.stdout.write(`${lines.join(\"\\n\")}\\n`);\n}\n\nfunction writeAdsCsv(data: Array<Record<string, unknown>>, fields?: string[]): void {\n  if (data.length === 0) return;\n  const cols = fields ?? Object.keys(data[0] ?? {});\n  const lines = [toCsvRow(cols)];\n  for (const row of data) {\n    const flat = flattenRow(row);\n    lines.push(toCsvRow(cols.map((f) => flat[f] ?? \"\")));\n  }\n  writeWhole(lines);\n}\n\nfunction writeAdsJsonl(data: Array<Record<string, unknown>>): void {\n  if (data.length === 0) return;\n  writeWhole(data.map((row) => JSON.stringify(row)));\n}\n\n/** A `|` or line break in a name would split its cell and shift every later column. */\nfunction mdCell(value: string): string {\n  return value.replace(/\\|/g, \"\\\\|\").replace(/\\r?\\n/g, \" \");\n}\n\nfunction writeAdsMd(data: Array<Record<string, unknown>>, fields?: string[]): void {\n  if (data.length === 0) return;\n  const cols = fields ?? Object.keys(data[0] ?? {});\n  const lines = [`| ${cols.join(\" | \")} |`, `| ${cols.map(() => \"---\").join(\" | \")} |`];\n  for (const row of data) {\n    const flat = flattenRow(row);\n    lines.push(`| ${cols.map((f) => mdCell(flat[f] ?? \"\")).join(\" | \")} |`);\n  }\n  writeWhole(lines);\n}\n\n/**\n * `hints` ride in the JSON envelope; csv/jsonl/md stdout has no room for them,\n * and an empty result is exactly when the hint matters, so they go to stderr.\n */\nexport function writeAdsOutput(\n  data: Array<Record<string, unknown>>,\n  format: string,\n  fields?: string[],\n  hints: string[] = [],\n): void {\n  switch (format) {\n    case \"csv\":\n      writeAdsCsv(data, fields);\n      break;\n    case \"jsonl\":\n      writeAdsJsonl(data);\n      break;\n    case \"md\":\n      writeAdsMd(data, fields);\n      break;\n    default:\n      writeJsonEnvelope(hints.length > 0 ? { ok: true, data, hints } : { ok: true, data });\n      return;\n  }\n  for (const hint of hints) process.stderr.write(`${hint}\\n`);\n}\n\ninterface AccountInfo {\n  id: string;\n  name: string;\n  access_type: \"direct\" | \"managed\";\n  level: number;\n  manager_id?: string;\n}\n\nasync function fetchAccounts(useCache = true): Promise<AccountInfo[]> {\n  if (useCache) {\n    const cached = cacheGet<AccountInfo[]>(\"accounts\", \"list\");\n    if (cached) return cached.data;\n  }\n  const params = !useCache ? { \"skip-cache\": \"true\" } : undefined;\n  const data = await apiGet<AccountInfo[]>(\"/api/ads/google/accounts\", params);\n  if (useCache) {\n    cacheSet(\"accounts\", \"list\", data, 60 * 60 * 1000);\n  }\n  return data;\n}\n\nexport async function resolveCustomerId(args: Record<string, unknown>): Promise<string> {\n  const fromArgs = args[\"customer-id\"] as string | undefined;\n  const customerId = fromArgs || getEnv().BAKER_GOOGLE_ADS_CUSTOMER_ID;\n\n  if (customerId) {\n    if (!/^\\d{10}$/.test(customerId)) {\n      writeAdsJson({\n        ok: false,\n        error: {\n          code: \"INVALID_CUSTOMER_ID\",\n          message:\n            \"Customer ID must be exactly 10 digits without dashes. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID.\",\n        },\n      });\n      process.exit(1);\n    }\n    return customerId;\n  }\n\n  const useCache = !args[\"no-cache\"];\n\n  try {\n    const accounts = await fetchAccounts(useCache);\n    const [single] = accounts;\n    if (accounts.length === 1 && single) {\n      process.stderr.write(`Using account \"${single.name}\" (${single.id})\\n`);\n      return single.id;\n    }\n    if (accounts.length === 0) {\n      handleConnectionError(\"google_ads\");\n    }\n    const list = accounts.map((a) => `  ${a.id}  ${a.name}`).join(\"\\n\");\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"MULTIPLE_ACCOUNTS\",\n        message: `Multiple accounts found. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID:\\n${list}`,\n      },\n    });\n    process.exit(1);\n  } catch (err) {\n    // \"No connection\" reaches here as a 404/403 from the accounts lookup. Reporting it as\n    // an unusable customer id sends the agent hunting for an id that cannot exist yet.\n    if (err instanceof ApiError && isNotConnectedError(err.code, err.message)) {\n      handleConnectionError(\"google_ads\", err.message);\n    }\n    writeAdsJson({\n      ok: false,\n      error: {\n        code: \"INVALID_CUSTOMER_ID\",\n        message: \"Could not auto-detect account. Pass --customer-id or set BAKER_GOOGLE_ADS_CUSTOMER_ID.\",\n      },\n    });\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,IAAM,8BAAkE;AAAA,EACtE,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,cAAc;AAAA,EACd,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAM,gBAAoD;AAAA,EACxD,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,OAAO;AAAA,EACP,UAAU;AAAA,EACV,cAAc;AAChB;AAUO,SAAS,yBAAyB,UAAsC;AAC7E,QAAM,OAAO,cAAc,QAAQ;AACnC,QAAM,OAAO,4BAA4B,QAAQ;AACjD,SACE,GAAG,IAAI,0LAC0E,IAAI,oOAED,IAAI;AAG5F;AAMO,SAAS,sBAAsB,UAA8B,iBAAiC;AACnG,QAAM,eAAe,cAAc,QAAQ;AAE3C,QAAM,cAAc;AAAA,IAClB,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,IACP,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,EAAE,QAAQ;AAEV,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,OAAO;AAAA,IACP,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,EAAE,QAAQ;AAEV,QAAM,WAAW;AAAA,IACf,IAAI;AAAA,IACJ,OAAO;AAAA,MACL;AAAA,MACA,SAAS,mBAAmB,MAAM,YAAY;AAAA,MAC9C,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,aAAa,GAAG,yBAAyB,QAAQ,CAAC,wEAAwE,WAAW;AAAA,MACvI;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF;AAEA,oBAAkB,QAAQ;AAC1B,UAAQ,KAAK,CAAC;AAChB;AAOO,SAAS,oBAAoB,MAAc,SAA0B;AAC1E,MAAI,SAAS,eAAe,SAAS,kBAAkB,SAAS,aAAa;AAC3E,WAAO;AAAA,EACT;AAIA,SAAO,uFAAuF,KAAK,OAAO;AAC5G;AAaO,SAAS,mBAAmB,MAAc,SAA0B;AACzE,MAAI,SAAS,gBAAgB;AAC3B,WAAO;AAAA,EACT;AACA,SAAO,oBAAoB,MAAM,OAAO;AAC1C;;;AC3HA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,WAAW,cAAc,QAAQ,qBAAqB;AAC3E,SAAS,eAAe;AACxB,SAAS,YAAY;AAGrB,IAAM,YAAY,KAAK,QAAQ,GAAG,UAAU,SAAS,KAAK;AAE1D,SAAS,UAAU,KAAmB;AACpC,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACpC;AACF;AAEA,SAAS,QAAQ,KAAqB;AACpC,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACnE;AAEA,SAAS,UAAU,UAAkB,KAAqB;AACxD,QAAM,MAAM,KAAK,WAAW,QAAQ;AACpC,YAAU,GAAG;AACb,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,CAAC,OAAO;AACzC;AAEO,SAAS,SAAY,UAAkB,KAAmC;AAC/E,QAAM,OAAO,UAAU,UAAU,GAAG;AACpC,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,MAAM,aAAa,MAAM,OAAO;AACtC,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,YAAY,KAAK,IAAI,GAAG;AAChC,aAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SACd,UACA,KACA,MACA,OACA,QACM;AACN,QAAM,OAAO,UAAU,UAAU,GAAG;AACpC,QAAM,QAAuB;AAAA,IAC3B,WAAW,KAAK,IAAI,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,gBAAc,MAAM,KAAK,UAAU,KAAK,GAAG,OAAO;AACpD;AAEA,IAAM,OAAO,KAAK,KAAK;AACvB,IAAM,SAAS,KAAK;AAEb,SAAS,YAAY,OAAuB;AACjD,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,MAAM,SAAS,OAAO,GAAG;AAC3B,WAAO,KAAK;AAAA,EACd;AACA,MAAI,MAAM,SAAS,aAAa,KAAK,MAAM,SAAS,cAAc,GAAG;AACnE,WAAO,IAAI;AAAA,EACb;AAEA,SAAO,IAAI;AACb;AAEO,SAAS,mBAAmB,YAAoB,OAAuB;AAC5E,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAClD,SAAO,GAAG,UAAU,IAAI,KAAK,IAAI,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,CAAC;AACpE;AAQO,SAAS,wBAAwB,YAAwC;AAC9E,QAAM,SAAS,SAA0B,YAAY,MAAM;AAC3D,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,UAAU;AAC3D,MAAI,SAAS,gBAAgB,UAAW,QAAO,QAAQ;AACvD,SAAO;AACT;;;AC7EO,SAAS,aAAa,UAA2B;AACtD,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC/D;AAEO,SAAS,kBAAkB,UAAyC;AACzE,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC/D;AAGO,IAAM,uBAAuB,CAAC,QAAQ,OAAO,SAAS,IAAI;AAG1D,SAAS,oBAAoB,QAAgB,WAA6C;AAC/F,MAAI,UAAU,SAAS,MAAM,EAAG,QAAO;AACvC,QAAM,OACJ,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,UAAU,GAAG,EAAE,CAAC,KAAK,UAAU,KAAK,EAAE;AAC1G,SAAO,YAAY,MAAM,gCAA2B,IAAI;AAC1D;AAEO,SAAS,SAAS,QAA0B;AACjD,SAAO,OACJ,IAAI,CAAC,MAAM;AACV,QAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,GAAG;AAC1D,aAAO,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACT,CAAC,EACA,KAAK,GAAG;AACb;AAEA,SAAS,WAAW,KAAsD;AACxE,QAAM,OAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC5C,SAAK,GAAG,IAAI,OAAO,QAAQ,YAAY,QAAQ,OAAO,KAAK,UAAU,GAAG,IAAI,OAAO,OAAO,EAAE;AAAA,EAC9F;AACA,SAAO;AACT;AAMA,SAAS,WAAW,OAAuB;AACzC,UAAQ,OAAO,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AAC9C;AAEA,SAAS,YAAY,MAAsC,QAAyB;AAClF,MAAI,KAAK,WAAW,EAAG;AACvB,QAAM,OAAO,UAAU,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,QAAM,QAAQ,CAAC,SAAS,IAAI,CAAC;AAC7B,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,WAAW,GAAG;AAC3B,UAAM,KAAK,SAAS,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAAA,EACrD;AACA,aAAW,KAAK;AAClB;AAEA,SAAS,cAAc,MAA4C;AACjE,MAAI,KAAK,WAAW,EAAG;AACvB,aAAW,KAAK,IAAI,CAAC,QAAQ,KAAK,UAAU,GAAG,CAAC,CAAC;AACnD;AAGA,SAAS,OAAO,OAAuB;AACrC,SAAO,MAAM,QAAQ,OAAO,KAAK,EAAE,QAAQ,UAAU,GAAG;AAC1D;AAEA,SAAS,WAAW,MAAsC,QAAyB;AACjF,MAAI,KAAK,WAAW,EAAG;AACvB,QAAM,OAAO,UAAU,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,QAAM,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,KAAK,KAAK,CAAC,IAAI;AACpF,aAAW,OAAO,MAAM;AACtB,UAAM,OAAO,WAAW,GAAG;AAC3B,UAAM,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI;AAAA,EACxE;AACA,aAAW,KAAK;AAClB;AAMO,SAAS,eACd,MACA,QACA,QACA,QAAkB,CAAC,GACb;AACN,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,kBAAY,MAAM,MAAM;AACxB;AAAA,IACF,KAAK;AACH,oBAAc,IAAI;AAClB;AAAA,IACF,KAAK;AACH,iBAAW,MAAM,MAAM;AACvB;AAAA,IACF;AACE,wBAAkB,MAAM,SAAS,IAAI,EAAE,IAAI,MAAM,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM,KAAK,CAAC;AACnF;AAAA,EACJ;AACA,aAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAC5D;AAUA,eAAe,cAAc,WAAW,MAA8B;AACpE,MAAI,UAAU;AACZ,UAAM,SAAS,SAAwB,YAAY,MAAM;AACzD,QAAI,OAAQ,QAAO,OAAO;AAAA,EAC5B;AACA,QAAM,SAAS,CAAC,WAAW,EAAE,cAAc,OAAO,IAAI;AACtD,QAAM,OAAO,MAAM,OAAsB,4BAA4B,MAAM;AAC3E,MAAI,UAAU;AACZ,aAAS,YAAY,QAAQ,MAAM,KAAK,KAAK,GAAI;AAAA,EACnD;AACA,SAAO;AACT;AAEA,eAAsB,kBAAkB,MAAgD;AACtF,QAAM,WAAW,KAAK,aAAa;AACnC,QAAM,aAAa,YAAY,OAAO,EAAE;AAExC,MAAI,YAAY;AACd,QAAI,CAAC,WAAW,KAAK,UAAU,GAAG;AAChC,mBAAa;AAAA,QACX,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SACE;AAAA,QACJ;AAAA,MACF,CAAC;AACD,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,CAAC,KAAK,UAAU;AAEjC,MAAI;AACF,UAAM,WAAW,MAAM,cAAc,QAAQ;AAC7C,UAAM,CAAC,MAAM,IAAI;AACjB,QAAI,SAAS,WAAW,KAAK,QAAQ;AACnC,cAAQ,OAAO,MAAM,kBAAkB,OAAO,IAAI,MAAM,OAAO,EAAE;AAAA,CAAK;AACtE,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,SAAS,WAAW,GAAG;AACzB,4BAAsB,YAAY;AAAA,IACpC;AACA,UAAM,OAAO,SAAS,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AAClE,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,EAAqF,IAAI;AAAA,MACpG;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AAGZ,QAAI,eAAe,YAAY,oBAAoB,IAAI,MAAM,IAAI,OAAO,GAAG;AACzE,4BAAsB,cAAc,IAAI,OAAO;AAAA,IACjD;AACA,iBAAa;AAAA,MACX,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/chunk-EPDE7ZRU.js

@@ -0,0 +1,174 @@
+import {
+  metaDraftOpInputSchema
+} from "./chunk-GOJXKIFQ.js";
+import {
+  handleMetaError,
+  resolveAccountIdArg
+} from "./chunk-2UFRHW3T.js";
+import {
+  adCopyHints,
+  booleanWordPositionalError,
+  capabilityFix
+} from "./chunk-WHWNXLTD.js";
+import {
+  withHints
+} from "./chunk-D5FY4FAK.js";
+import {
+  writeJsonEnvelope
+} from "./chunk-EIGXX6KI.js";
+import {
+  apiPost
+} from "./chunk-CUL3VB4L.js";
+import {
+  requireChatId
+} from "./chunk-I4FTS5EE.js";
+
+// src/commands/ads/meta/write-shared.ts
+import { readFileSync } from "fs";
+function bareAccountId(args) {
+  return resolveAccountIdArg(args).replace(/^act_/, "");
+}
+function failWriteValidation(message) {
+  writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
+  process.exit(1);
+}
+function refuseDeleteByUpdate(payload, group) {
+  if (payload.status === "DELETED") {
+    failWriteValidation(
+      `update does not delete \u2014 deleting is permanent. Use \`baker ads meta ${group} delete <id>\` if the user asked to delete; otherwise pause or archive.`
+    );
+  }
+}
+function loadJsonFileArg(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      failWriteValidation(`${path} must contain a JSON object`);
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      failWriteValidation(`${path} is not valid JSON: ${err.message}`);
+    }
+    throw err;
+  }
+}
+function mergePayload(file, flags) {
+  const merged = { ...file };
+  for (const [key, value] of Object.entries(flags)) {
+    if (value !== void 0) {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function parseMoneyFlag(amount, currency, flag) {
+  if (amount === void 0 || amount === null || amount === "") {
+    return void 0;
+  }
+  if (currency === void 0 || currency === null || currency === "") {
+    return { amount: String(amount) };
+  }
+  if (typeof currency !== "string" || currency.length !== 3) {
+    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like USD)`);
+  }
+  return { amount: String(amount), currencyCode: currency.toUpperCase() };
+}
+function parseDateFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const raw = String(value);
+  if (/^\d{10,}$/.test(raw)) {
+    return Number(raw);
+  }
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed)) {
+    failWriteValidation(`${flag} must be an ISO date (2026-07-10) or epoch milliseconds`);
+  }
+  return parsed;
+}
+function listFlag(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return void 0;
+  }
+  const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+  return items.length > 0 ? items : void 0;
+}
+function upper(value) {
+  return typeof value === "string" && value.length > 0 ? value.toUpperCase() : void 0;
+}
+function numberFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const n = Number(value);
+  if (!Number.isFinite(n)) {
+    failWriteValidation(`${flag} must be a number`);
+  }
+  return n;
+}
+function requireTarget(args, entity) {
+  const inverted = booleanWordPositionalError(args, entity);
+  if (inverted !== void 0) {
+    failWriteValidation(inverted);
+  }
+  const positional = Array.isArray(args._) ? args._[0] : void 0;
+  const target = args.id ?? args.target ?? args.ref ?? positional;
+  if (typeof target !== "string" || target.length === 0) {
+    failWriteValidation(`pass the ${entity} id as the positional argument`);
+  }
+  return target;
+}
+async function stageOp(raw) {
+  const preflight = metaDraftOpInputSchema.safeParse(raw);
+  if (!preflight.success) {
+    const fields = preflight.error.issues.map((issue) => ({ path: issue.path.join("."), message: issue.message }));
+    writeJsonEnvelope({
+      ok: false,
+      error: {
+        code: "VALIDATION_ERROR",
+        message: fields.map((field) => field.path ? `${field.path}: ${field.message}` : field.message).join("; "),
+        fields,
+        fix: capabilityFix("meta-ads")
+      }
+    });
+    process.exit(1);
+  }
+  try {
+    const chatId = requireChatId();
+    const response = await apiPost("/api/ads/meta/draft/stage", { chatId, op: preflight.data });
+    const copyHints = await adCopyHints(preflight.data);
+    writeJsonEnvelope(withHints(response, copyHints));
+  } catch (err) {
+    handleMetaError(err);
+  }
+}
+async function stageStatusChange(input) {
+  await stageOp({
+    kind: input.kind,
+    accountId: input.accountId,
+    target: input.target,
+    payload: { status: input.status }
+  });
+}
+
+export {
+  bareAccountId,
+  failWriteValidation,
+  refuseDeleteByUpdate,
+  loadJsonFileArg,
+  mergePayload,
+  parseMoneyFlag,
+  parseDateFlag,
+  listFlag,
+  upper,
+  numberFlag,
+  requireTarget,
+  stageOp,
+  stageStatusChange
+};
+//# sourceMappingURL=chunk-EPDE7ZRU.js.map

package/dist/chunk-EPDE7ZRU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ads/meta/write-shared.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { type MetaDraftStageResponse, metaDraftOpInputSchema } from \"@baker/api/ads-meta\";\nimport { apiPost } from \"../../../client.ts\";\nimport { requireChatId } from \"../../../env.ts\";\nimport { capabilityFix } from \"../../capabilities/fix.ts\";\nimport { booleanWordPositionalError } from \"../boolean-word-positional.ts\";\nimport { adCopyHints } from \"../copy-hints.ts\";\nimport { withHints } from \"../hints.ts\";\nimport { writeJsonEnvelope } from \"../output.ts\";\nimport { handleMetaError, resolveAccountIdArg } from \"./shared.ts\";\n\n/**\n * Shared plumbing for the staged Meta write commands. Writes NEVER hit Meta\n * directly: every command stages an op against this chat's draft\n * (`/api/ads/meta/draft/stage`), the dashboard shows it as a pending Meta\n * change, and it applies when the chat is published.\n */\n\n/** Backend account ids are bare numeric — strip the `act_` prefix resolveAccountIdArg adds. */\nexport function bareAccountId(args: Record<string, unknown>): string {\n  return resolveAccountIdArg(args).replace(/^act_/, \"\");\n}\n\nexport function failWriteValidation(message: string): never {\n  writeJsonEnvelope({ ok: false, error: { code: \"VALIDATION_ERROR\", message } });\n  process.exit(1);\n}\n\n/** Deleting is permanent, so it only stages through `delete`, whose description carries that warning. */\nexport function refuseDeleteByUpdate(payload: Record<string, unknown>, group: \"campaigns\" | \"adsets\" | \"ads\"): void {\n  if (payload.status === \"DELETED\") {\n    failWriteValidation(\n      `update does not delete — deleting is permanent. Use \\`baker ads meta ${group} delete <id>\\` if the user asked to delete; otherwise pause or archive.`,\n    );\n  }\n}\n\nexport function loadJsonFileArg(path: unknown): Record<string, unknown> {\n  if (typeof path !== \"string\" || path.length === 0) {\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as unknown;\n    if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n      failWriteValidation(`${path} must contain a JSON object`);\n    }\n    return parsed as Record<string, unknown>;\n  } catch (err) {\n    if (err instanceof SyntaxError) {\n      failWriteValidation(`${path} is not valid JSON: ${err.message}`);\n    }\n    throw err;\n  }\n}\n\n/** Flags override file keys — the file is the base, flags are the overrides. */\nexport function mergePayload(file: Record<string, unknown>, flags: Record<string, unknown>): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...file };\n  for (const [key, value] of Object.entries(flags)) {\n    if (value !== undefined) {\n      merged[key] = value;\n    }\n  }\n  return merged;\n}\n\nexport function parseMoneyFlag(\n  amount: unknown,\n  currency: unknown,\n  flag: string,\n): { amount: string; currencyCode?: string } | undefined {\n  if (amount === undefined || amount === null || amount === \"\") {\n    return undefined;\n  }\n  if (currency === undefined || currency === null || currency === \"\") {\n    // Meta ad accounts are single-currency — the backend fills it in.\n    return { amount: String(amount) };\n  }\n  if (typeof currency !== \"string\" || currency.length !== 3) {\n    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like USD)`);\n  }\n  return { amount: String(amount), currencyCode: currency.toUpperCase() };\n}\n\n/** Accepts ISO dates (2026-07-10), ISO datetimes, or epoch millis. */\nexport function parseDateFlag(value: unknown, flag: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") {\n    return undefined;\n  }\n  const raw = String(value);\n  if (/^\\d{10,}$/.test(raw)) {\n    return Number(raw);\n  }\n  const parsed = Date.parse(raw);\n  if (Number.isNaN(parsed)) {\n    failWriteValidation(`${flag} must be an ISO date (2026-07-10) or epoch milliseconds`);\n  }\n  return parsed;\n}\n\n/** Split a comma-separated flag into a trimmed, non-empty array. */\nexport function listFlag(value: unknown): string[] | undefined {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    return undefined;\n  }\n  const items = value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n  return items.length > 0 ? items : undefined;\n}\n\nexport function upper(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.length > 0 ? value.toUpperCase() : undefined;\n}\n\nexport function numberFlag(value: unknown, flag: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") {\n    return undefined;\n  }\n  const n = Number(value);\n  if (!Number.isFinite(n)) {\n    failWriteValidation(`${flag} must be a number`);\n  }\n  return n;\n}\n\n/**\n * Accepts whichever positional the command declared (`id`, `target`, `ref`) or the raw positional.\n *\n * `--flag false` is refused first: citty turns it into the flag set to TRUE plus a stray positional,\n * so on `campaigns duplicate 6123 --replace false` the copy stages AND the live original is staged\n * for pause — the opposite of what was typed, with an \"ok\" receipt. This is the only place on this\n * surface that reads positionals, and every target-taking command goes through it.\n */\nexport function requireTarget(args: Record<string, unknown>, entity: string): string {\n  const inverted = booleanWordPositionalError(args, entity);\n  if (inverted !== undefined) {\n    failWriteValidation(inverted);\n  }\n  const positional = Array.isArray(args._) ? args._[0] : undefined;\n  const target = args.id ?? args.target ?? args.ref ?? positional;\n  if (typeof target !== \"string\" || target.length === 0) {\n    failWriteValidation(`pass the ${entity} id as the positional argument`);\n  }\n  return target;\n}\n\ninterface StageEnvelope extends Record<string, unknown> {\n  ok: true;\n  data: MetaDraftStageResponse;\n}\n\n/**\n * Preflight-validates the op against the shared `@baker/api/ads-meta` contract\n * (same schema the backend enforces), then stages it. Prints the staged\n * envelope — ref, mode (always `live`: publishing reaches the real ad account),\n * summary, warnings.\n */\nexport async function stageOp(raw: Record<string, unknown>): Promise<void> {\n  const preflight = metaDraftOpInputSchema.safeParse(raw);\n  if (!preflight.success) {\n    const fields = preflight.error.issues.map((issue) => ({ path: issue.path.join(\".\"), message: issue.message }));\n    writeJsonEnvelope({\n      ok: false,\n      error: {\n        code: \"VALIDATION_ERROR\",\n        message: fields.map((field) => (field.path ? `${field.path}: ${field.message}` : field.message)).join(\"; \"),\n        fields,\n        fix: capabilityFix(\"meta-ads\"),\n      },\n    });\n    process.exit(1);\n  }\n  try {\n    const chatId = requireChatId();\n    const response = await apiPost<StageEnvelope>(\"/api/ads/meta/draft/stage\", { chatId, op: preflight.data });\n    const copyHints = await adCopyHints(preflight.data);\n    writeJsonEnvelope(withHints(response, copyHints));\n  } catch (err) {\n    handleMetaError(err);\n  }\n}\n\nexport async function stageStatusChange(input: {\n  kind: \"campaign.update\" | \"adSet.update\" | \"adCreative.update\" | \"ad.update\" | \"customAudience.update\";\n  accountId: string;\n  target: string;\n  status: \"ACTIVE\" | \"PAUSED\" | \"ARCHIVED\" | \"DELETED\";\n}): Promise<void> {\n  await stageOp({\n    kind: input.kind,\n    accountId: input.accountId,\n    target: input.target,\n    payload: { status: input.status },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB;AAmBtB,SAAS,cAAc,MAAuC;AACnE,SAAO,oBAAoB,IAAI,EAAE,QAAQ,SAAS,EAAE;AACtD;AAEO,SAAS,oBAAoB,SAAwB;AAC1D,oBAAkB,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,oBAAoB,QAAQ,EAAE,CAAC;AAC7E,UAAQ,KAAK,CAAC;AAChB;AAGO,SAAS,qBAAqB,SAAkC,OAA6C;AAClH,MAAI,QAAQ,WAAW,WAAW;AAChC;AAAA,MACE,6EAAwE,KAAK;AAAA,IAC/E;AAAA,EACF;AACF;AAEO,SAAS,gBAAgB,MAAwC;AACtE,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,QAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,0BAAoB,GAAG,IAAI,6BAA6B;AAAA,IAC1D;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,eAAe,aAAa;AAC9B,0BAAoB,GAAG,IAAI,uBAAuB,IAAI,OAAO,EAAE;AAAA,IACjE;AACA,UAAM;AAAA,EACR;AACF;AAGO,SAAS,aAAa,MAA+B,OAAyD;AACnH,QAAM,SAAkC,EAAE,GAAG,KAAK;AAClD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,QAAW;AACvB,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,eACd,QACA,UACA,MACuD;AACvD,MAAI,WAAW,UAAa,WAAW,QAAQ,WAAW,IAAI;AAC5D,WAAO;AAAA,EACT;AACA,MAAI,aAAa,UAAa,aAAa,QAAQ,aAAa,IAAI;AAElE,WAAO,EAAE,QAAQ,OAAO,MAAM,EAAE;AAAA,EAClC;AACA,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,wBAAoB,GAAG,IAAI,gEAAgE;AAAA,EAC7F;AACA,SAAO,EAAE,QAAQ,OAAO,MAAM,GAAG,cAAc,SAAS,YAAY,EAAE;AACxE;AAGO,SAAS,cAAc,OAAgB,MAAkC;AAC9E,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,YAAY,KAAK,GAAG,GAAG;AACzB,WAAO,OAAO,GAAG;AAAA,EACnB;AACA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,OAAO,MAAM,MAAM,GAAG;AACxB,wBAAoB,GAAG,IAAI,yDAAyD;AAAA,EACtF;AACA,SAAO;AACT;AAGO,SAAS,SAAS,OAAsC;AAC7D,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MACX,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACjB,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEO,SAAS,MAAM,OAAoC;AACxD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI;AAC/E;AAEO,SAAS,WAAW,OAAgB,MAAkC;AAC3E,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,GAAG;AACvB,wBAAoB,GAAG,IAAI,mBAAmB;AAAA,EAChD;AACA,SAAO;AACT;AAUO,SAAS,cAAc,MAA+B,QAAwB;AACnF,QAAM,WAAW,2BAA2B,MAAM,MAAM;AACxD,MAAI,aAAa,QAAW;AAC1B,wBAAoB,QAAQ;AAAA,EAC9B;AACA,QAAM,aAAa,MAAM,QAAQ,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI;AACvD,QAAM,SAAS,KAAK,MAAM,KAAK,UAAU,KAAK,OAAO;AACrD,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,wBAAoB,YAAY,MAAM,gCAAgC;AAAA,EACxE;AACA,SAAO;AACT;AAaA,eAAsB,QAAQ,KAA6C;AACzE,QAAM,YAAY,uBAAuB,UAAU,GAAG;AACtD,MAAI,CAAC,UAAU,SAAS;AACtB,UAAM,SAAS,UAAU,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,KAAK,KAAK,GAAG,GAAG,SAAS,MAAM,QAAQ,EAAE;AAC7G,sBAAkB;AAAA,MAChB,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,OAAO,IAAI,CAAC,UAAW,MAAM,OAAO,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,OAAQ,EAAE,KAAK,IAAI;AAAA,QAC1G;AAAA,QACA,KAAK,cAAc,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI;AACF,UAAM,SAAS,cAAc;AAC7B,UAAM,WAAW,MAAM,QAAuB,6BAA6B,EAAE,QAAQ,IAAI,UAAU,KAAK,CAAC;AACzG,UAAM,YAAY,MAAM,YAAY,UAAU,IAAI;AAClD,sBAAkB,UAAU,UAAU,SAAS,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,oBAAgB,GAAG;AAAA,EACrB;AACF;AAEA,eAAsB,kBAAkB,OAKtB;AAChB,QAAM,QAAQ;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,SAAS,EAAE,QAAQ,MAAM,OAAO;AAAA,EAClC,CAAC;AACH;","names":[]}