@koda-sl/baker-cli 0.447.0 → 0.448.0-dev.ccc3c9a37

package/dist/map-7SHU5WCJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/flows/map.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport type { HubspotFormsViewResponse } from \"@baker/api\";\nimport {\n  type ActiveCampaignCatalog,\n  type ActiveCampaignFieldsRequest,\n  type ActiveCampaignFieldsResponse,\n  activeCampaignFieldsResponseSchema,\n} from \"@baker/api/activecampaign\";\nimport { defineCommand } from \"citty\";\nimport { apiPost } from \"../../client.ts\";\nimport { repeatedFlagValues } from \"../../lib/repeatedFlags.ts\";\nimport { writeJson } from \"../../output.ts\";\nimport { registerSchema } from \"../../schemas.ts\";\nimport {\n  activeCampaignDestinationFields,\n  activeCampaignMappingHints,\n  activeCampaignUnlistedField,\n  type BuiltMapping,\n  buildFieldMapping,\n  type DestinationField,\n  describeSlots,\n  type MapOptions,\n  MappingError,\n  namesComeFromAccount,\n  otherSlots,\n  shapeFor,\n} from \"./mapping.ts\";\nimport {\n  collectConfigStatus,\n  collectSideEffects,\n  flowDataPath,\n  readFlowTree,\n  requestFlowInputCall,\n  sideEffectNeedsInput,\n  writeFlowTree,\n} from \"./shared.ts\";\n\nregisterSchema({\n  command: \"flows.map\",\n  description:\n    \"Map form fields onto any named value a side effect sends: a CRM fieldMapping, a sheet columnMapping, a webhook payloadKeys, a pixel eventParams, or a platform matching block. Emits the mapping and splices it in with --write. Configure the destination through request_flow_input FIRST — the destination-side names come from the connected account, not from you.\",\n  args: {\n    slug: { type: \"positional\", description: \"Form slug (folder under flows/)\", required: true },\n    map: {\n      type: \"string\",\n      description:\n        '<destField>[:<fieldType>]=<value>, repeatable. Omit both this and --from to be told what the side effect accepts instead. Sheet: A=name. HubSpot with --hubspot-form: firstname=nombre (the type is read off the form). ActiveCampaign: email=email, SECTOR=sector (custom field by id, personalization tag or label; custom.UTM_SOURCE for one only staged so far), tags=\"withbaker-\"+tracking:page_path, lists=\"Newsletter\", automations=\"Welcome\", deal.title=…/deal.pipeline=\"Sales\"/deal.value=budget, account.name=company, note=…, event.name=\"demo_requested\" — every type is read off the connected account. Where a destination cannot be read, state the type on the LEFT — c0ffee:varchar=email — because `:` on the right belongs to the value grammar.',\n      required: false,\n    },\n    from: {\n      type: \"string\",\n      description:\n        'The whole mapping as a JSON file, or `-` for stdin: { \"sideEffect\": \"…\", \"map\": { \"<destField>\": \"<value>\", … } }. Past ~3 fields prefer this over repeated --map.',\n      required: false,\n    },\n    \"side-effect\": { type: \"string\", description: \"Side-effect id, when the form has more than one\", required: false },\n    \"hubspot-form\": {\n      type: \"string\",\n      description:\n        \"HubSpot formGuid of the configured destination. Fills every mapping's fieldType and objectTypeId from the form itself, so you write no types at all. The guid is the `formGuid` in the `destination` request_flow_input returned.\",\n      required: false,\n    },\n    into: {\n      type: \"string\",\n      description:\n        \"Slot to map into when the type has more than one: meta/tiktok/pinterest take eventParams (default) or their matching record; googleAds takes enhancedConversions or value/currency/transactionId.\",\n      required: false,\n    },\n    entity: {\n      type: \"string\",\n      description: \"Destination object (pipedrive: person|organization|lead, …)\",\n      required: false,\n    },\n    custom: { type: \"boolean\", description: \"The destination fields are custom fields\", required: false },\n    standard: { type: \"boolean\", description: \"The destination fields are standard fields\", required: false },\n    \"object-type\": { type: \"string\", description: \"HubSpot objectTypeId (default 0-1, contact)\", required: false },\n    \"prune-missing\": {\n      type: \"boolean\",\n      description:\n        \"Drop the mappings whose destination field no longer exists on the account, and nothing else. The repair for a deleted HubSpot property: HubSpot refuses the WHOLE submission when it names a field it does not have, so one dead mapping loses every lead. Needs --hubspot-form so the live field list can be read. Runs on its own — no --map required. Prefer this to --replace, which drops everything this call does not name.\",\n      required: false,\n    },\n    replace: {\n      type: \"boolean\",\n      description:\n        \"Make the slot exactly what this call passes, dropping every mapping already in it. Without it, mappings MERGE by destination name — re-mapping a name overwrites it, a new name is appended, and the rest are left alone. To REMOVE a dead mapping, reach for --prune-missing instead: this one also deletes every mapping you did not re-state.\",\n      required: false,\n    },\n    write: {\n      type: \"boolean\",\n      description: \"Splice the mapping into the form. Without it, prints and changes nothing\",\n      required: false,\n    },\n  },\n});\n\n/**\n * Every `--map` on the command line.\n *\n * Read from `rawArgs`, not `args.map`: citty collapses a repeated flag to its\n * LAST value, so `--map A=name --map B=email` arrives as the single string\n * `\"B=email\"`. Taken from `args`, this command would map one field, report\n * success, and leave the other silently unmapped — which is the exact\n * failure mode it exists to prevent, one level up.\n */\nexport function mapSpecsFrom(rawArgs: readonly string[]): string[] {\n  return repeatedFlagValues(rawArgs, \"map\");\n}\n\n/**\n * A whole mapping in one file, which is what a real one looks like.\n *\n * A CRM mapping is eight to fifteen fields. As repeated `--map` flags that is a\n * fifteen-flag command line whose shell quoting is its own hazard — an\n * improvement on hand-writing 230 lines of ProseMirror, but not much of one.\n * The JSON form is what the agent is actually holding in its head, and it is one\n * Write plus one command however many fields there are.\n *\n *   {\n *     \"sideEffect\": \"se-hubspotForm-1\",\n *     \"hubspotForm\": \"8b1f…\",\n *     \"map\": {\n *       \"email\":          \"email\",\n *       \"firstname\":      \"nombre\",\n *       \"hs_lead_source\": \"tracking:utm_source\",\n *       \"full_name\":      \"nombre + \\\" \\\" + apellido\"\n *     }\n *   }\n *\n * `\"firstname\": { \"type\": \"…\", \"value\": \"…\" }` is still accepted for a\n * destination this command cannot read, but naming the destination once\n * (`hubspotForm` here, `--hubspot-form` on the command line) is strictly better:\n * the types then come from the account instead of from memory.\n */\ntype MapSpecFile = {\n  sideEffect?: string;\n  into?: string;\n  entity?: string;\n  custom?: boolean;\n  objectType?: string;\n  /**\n   * Treat this file as the WHOLE mapping: anything in the slot it does not name\n   * is dropped. Off by default so a file that lists three fields cannot delete\n   * the five that were mapped before it.\n   */\n  replace?: boolean;\n  /** Drop the mappings the destination no longer has. See `MapOptions.pruneMissing`. */\n  pruneMissing?: boolean;\n  /** HubSpot formGuid of the configured destination, so its field types can be read. */\n  hubspotForm?: string;\n  map?: Record<string, string | { type?: string; value?: string }>;\n};\n\n/** Flatten the JSON form into the same `<dest>[:<type>]=<value>` specs the flags produce. */\nexport function specsFromFile(parsed: MapSpecFile): string[] {\n  return Object.entries(parsed.map ?? {}).map(([destField, entry]) => {\n    if (typeof entry === \"string\") return `${destField}=${entry}`;\n    const type = entry?.type ? `:${entry.type}` : \"\";\n    return `${destField}${type}=${entry?.value ?? \"\"}`;\n  });\n}\n\nfunction readSpecFile(path: string): MapSpecFile {\n  let raw: string;\n  try {\n    raw = path === \"-\" ? readFileSync(0, \"utf-8\") : readFileSync(path, \"utf-8\");\n  } catch (error) {\n    refuse(\n      `Could not read ${path === \"-\" ? \"the mapping from stdin\" : `\"${path}\"`}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    refuse(\n      `${path === \"-\" ? \"stdin\" : `\"${path}\"`} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,\n      'Expected { \"map\": { \"<destField>\": \"<value>\", … } }',\n    );\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    refuse(\"A mapping file must be a JSON object.\", 'Expected { \"map\": { \"<destField>\": \"<value>\", … } }');\n  }\n  const spec = parsed as MapSpecFile;\n  if (!spec.map || typeof spec.map !== \"object\" || Object.keys(spec.map).length === 0) {\n    refuse(\"A mapping file needs a non-empty `map` object.\", 'Expected { \"map\": { \"firstname\": \"nombre\", … } }');\n  }\n  return spec;\n}\n\n/** Refuse with the same envelope shape everywhere, so the agent parses one thing. */\nfunction refuse(message: string, fix?: string): never {\n  writeJson({ ok: false, error: { code: \"VALIDATION_ERROR\", message, ...(fix ? { fix } : {}) } });\n  process.exit(1);\n}\n\n/**\n * The destination's own field catalog, read off the connected account.\n *\n * This is the whole reason a HubSpot mapping no longer needs a type per field.\n * `fieldType` and `objectTypeId` are HubSpot's answers about its own properties,\n * not the agent's — the engine concatenates them into\n * `<objectTypeId>.<fieldType>.<fieldName>`, which is byte-for-byte the key the\n * dashboard's picker writes. Asking the agent to remember them is both more work\n * and less accurate than asking HubSpot, and a plausible-but-wrong one is the\n * silent kind: on a date property the engine skips the YYYY-MM-DD coercion and\n * HubSpot drops the value.\n *\n * One call for the whole mapping, and only when a destination was named. A\n * failure refuses rather than falling back to writing types nobody verified.\n */\nasync function hubspotFieldCatalog(\n  formId: string,\n): Promise<{ fields: Map<string, DestinationField>; captchaEnabled: boolean }> {\n  let response: HubspotFormsViewResponse;\n  try {\n    response = await apiPost<HubspotFormsViewResponse>(\"/api/hubspot/forms/view\", { formId });\n  } catch (error) {\n    refuse(\n      `Could not read HubSpot form \"${formId}\": ${error instanceof Error ? error.message : String(error)}`,\n      \"Check the guid against the `destination` request_flow_input returned, or `baker hubspot forms list`. Drop --hubspot-form and write `<field>:<fieldType>=<value>` per mapping only if HubSpot is unreachable.\",\n    );\n  }\n  const fields = response.data.form?.fields ?? [];\n  if (fields.length === 0) {\n    refuse(\n      `HubSpot form \"${formId}\" reports no fields, so nothing can be mapped against it.`,\n      \"Confirm the guid names the form this side effect submits to: baker hubspot forms list\",\n    );\n  }\n  return {\n    fields: new Map(\n      fields.map((field) => [\n        field.name,\n        { fieldType: field.fieldType, ...(field.objectTypeId ? { objectTypeId: field.objectTypeId } : {}) },\n      ]),\n    ),\n    // Read while the form is already open, because this is the moment a\n    // delivery is being wired: HubSpot refuses every submission sent to a form\n    // with spam prevention on, so a mapping written against one is correct and\n    // will still never arrive. Reported, not refused — the mapping is not the\n    // mistake, and the client can switch it off without the work being redone.\n    captchaEnabled: response.data.form?.captchaEnabled === true,\n  };\n}\n\n/**\n * The connected ActiveCampaign account's fields, read for every\n * `activeCampaignContact` mapping — there is no resource to name, so there is\n * no flag to ask for: the side effect's own connection is the destination.\n *\n * Read rather than remembered for the same reason as HubSpot's: the field type\n * decides how the backend sends each value, and a custom field is stored by an\n * id only the account knows. A failure refuses rather than writing a guess.\n */\nasync function activeCampaignFieldCatalog(\n  sideEffect: Record<string, unknown>,\n): Promise<{ fields: Map<string, DestinationField>; catalog: ActiveCampaignCatalog }> {\n  const account = typeof sideEffect.oauthProviderId === \"string\" ? sideEffect.oauthProviderId : undefined;\n  const body: ActiveCampaignFieldsRequest = account ? { account } : {};\n  let response: ActiveCampaignFieldsResponse;\n  try {\n    response = activeCampaignFieldsResponseSchema.parse(\n      await apiPost<ActiveCampaignFieldsResponse>(\"/api/activecampaign/fields\", body),\n    );\n  } catch (error) {\n    refuse(\n      `Could not read the ActiveCampaign account's fields: ${error instanceof Error ? error.message : String(error)}`,\n      'If ActiveCampaign is not connected (or its key stopped working), call request_connection with { platform: \"activecampaign\" } — the user pastes the API URL and key into that card, never into the chat — then run this again.',\n    );\n  }\n  const { account: _account, ...catalog } = response.data;\n  return { fields: new Map(activeCampaignDestinationFields(catalog.fields)), catalog };\n}\n\n/**\n * Answer the bare `baker flows map <slug> --side-effect <id>` probe.\n *\n * The left of a mapping is a different question per slot — a closed platform\n * set, a name the agent picks, or a name that only exists in the connected\n * account — and none of it was readable without guessing wrong first.\n */\nfunction describeDestination(chosen: Located): void {\n  const type = String(chosen.sideEffect.type ?? \"\");\n  const slots = describeSlots(type);\n  if (slots.length === 0) {\n    refuse(\n      `A ${type} side effect has no mappable field.`,\n      `Nothing on it addresses named values. \\`baker flows schema side-effect ${type}\\` shows what it does take.`,\n    );\n  }\n  writeJson({\n    ok: true,\n    data: { sideEffectId: chosen.sideEffect.id, type, mappable: slots },\n    hints: [\n      `Nothing mapped — this is what a ${type} side effect accepts. Add --map <key>=<value> to build one.`,\n      ...slots.map((slot) =>\n        slot.keys\n          ? `${slot.slot}: ${slot.keys.join(\", \")}`\n          : `${slot.slot}: ${slot.keysFrom === \"account\" ? \"keys come from the connected account (request_flow_input returns them)\" : \"keys are yours to choose — whatever the receiving system expects\"}`,\n      ),\n      // Named separately from the key hint above: the key and its field type are\n      // two different questions with two different answers, and the type is the\n      // one an agent does not know it is being asked until a mapping is refused.\n      ...slots.flatMap((slot) => (slot.fieldTypes ? [`${slot.slot} field types — ${slot.fieldTypes}`] : [])),\n      'Values (right of the `=`) are the same for every slot: a form field, tracking:<var>, global:<name>, code:<name>, a \"literal\", or those joined with +. A field may also be written as the file stores it, {{<stepId>.customForm.<field>}}. A value cannot run code (no .split(), .slice(), [0]).',\n    ],\n  });\n}\n\n/**\n * `shapeFor` as a refusal rather than a throw.\n *\n * `assertDestinationReady` is the one place `shapeFor` is reached BEFORE the\n * try/catch around `buildFieldMapping`, so an uncaught error here would escape\n * the `{ ok: false }` envelope every other path emits and reach the agent as a\n * stack trace.\n *\n * In practice the live case is an unrecognised `--into`, because only a type in\n * `FLOW_DELIVERY_SIDE_EFFECT_TYPES` gets this far (everything else returns at the\n * `sideEffectNeedsInput` check above) and every one of those has a slot. So\n * `--into eventParams` on an unconfigured `googleSpreadsheet` is enough to hit\n * it, and the message it would lose — the list of slots that type does have —\n * is exactly the one that answers it.\n */\nfunction shapeOrRefuse(type: string, into: string | undefined): ReturnType<typeof shapeFor> {\n  try {\n    return shapeFor(type, into);\n  } catch (error) {\n    if (error instanceof MappingError) refuse(error.message, error.fix);\n    throw error;\n  }\n}\n\n/**\n * Stop a mapping written against a destination nobody has picked yet.\n *\n * This is the failure the whole command exists to prevent, one level up: the\n * column letters and field keys live in an account only `request_flow_input`\n * can see, so before that call has run they can only be guesses — and a guessed\n * destination is structurally valid, passes every check here, ships, and sends\n * nothing forever. `verify` does catch it later (`flow-schema-unconfigured-oauth`),\n * but by then the mapping is written and the agent has moved on.\n *\n * Only for slots whose names come from the account. A webhook body or a pixel\n * parameter is the agent's to name, so an unset endpoint is a note, not a block.\n */\nfunction assertDestinationReady(\n  slug: string,\n  tree: Record<string, unknown>,\n  chosen: Located,\n  into: string | undefined,\n): void {\n  if (!sideEffectNeedsInput(chosen.sideEffect)) return;\n\n  const type = String(chosen.sideEffect.type ?? \"\");\n  const status = collectConfigStatusFor(tree, slug, String(chosen.sideEffect.id ?? \"\"));\n  const call = status ? requestFlowInputCall(slug, status) : `request_flow_input for the ${type} side effect`;\n\n  if (!namesComeFromAccount(shapeOrRefuse(type, into))) return;\n\n  refuse(\n    `The ${type} destination is not configured yet, so its field names cannot be anything but a guess.`,\n    `Configure it first, then map against the names that call returns: ${call}`,\n  );\n}\n\n/** The config row for one side effect, so the refusal can carry a ready-to-issue call. */\nfunction collectConfigStatusFor(tree: Record<string, unknown>, _slug: string, sideEffectId: string) {\n  const rows: Parameters<typeof requestFlowInputCall>[1][] = [];\n  collectConfigStatus(tree, rows);\n  return rows.find((row) => row.sideEffectId === sideEffectId);\n}\n\n/**\n * Name the slots this side effect has and this call did not use.\n *\n * A `meta` side effect has both `eventParams` and `advancedMatching`, and the\n * one an agent most often needs — advanced matching, which decides whether Meta\n * can attribute the conversion at all — is not the default. Saying so on every\n * response is cheaper than the agent finding out from a reference file it may\n * not open.\n */\nfunction slotHintFor(type: string, into: string | undefined): string[] {\n  const others = otherSlots(type, shapeFor(type, into));\n  if (others.length === 0) return [];\n  return [`This side effect also takes ${others.join(\" and \")} — pass --into <slot> to map into one of those instead.`];\n}\n\n/**\n * What happened to the mappings this call did NOT name.\n *\n * Said out loud in both directions, because a slot whose size moved without\n * being mentioned is exactly how the loss stays silent: \"kept\" answers the\n * question a merge raises (\"did it drop the others?\"), and `--replace` has to\n * state its drop or it is the same bug with a flag on it.\n */\nfunction survivorHint(built: BuiltMapping, replacing: boolean): string[] {\n  if (built.kept > 0) {\n    return [`${built.kept} mapping${built.kept === 1 ? \"\" : \"s\"} already in ${built.key} kept — this merged by name.`];\n  }\n  if (!replacing) return [];\n  return [`--replace: ${built.key} is now exactly these ${built.count}; anything else it held is gone.`];\n}\n\n/**\n * Every mapping `--prune-missing` removed, named one by one.\n *\n * A count would be the same mistake this whole repair exists to undo: the drift\n * Task that nobody could act on said \"an answer HubSpot no longer accepts\" and\n * named none of them, and six Forms were closed as false positives off that\n * sentence. A removal the agent cannot repeat back to the user is a removal\n * nobody can check.\n */\nfunction droppedHint(built: BuiltMapping): string[] {\n  if (built.dropped.length === 0) return [];\n  return [\n    `--prune-missing dropped ${built.dropped.length} mapping${built.dropped.length === 1 ? \"\" : \"s\"} the destination no longer has: ${built.dropped.join(\", \")}. Every other mapping in ${built.key} was left alone.`,\n  ];\n}\n\n/**\n * A note, not a block: these keys are the agent's to choose, but the endpoint\n * they are posted to is still the user's to supply, and nothing later in this\n * command will mention it.\n */\nfunction pendingEndpointHint(slug: string, tree: Record<string, unknown>, chosen: Located): string[] {\n  if (!sideEffectNeedsInput(chosen.sideEffect)) return [];\n  const status = collectConfigStatusFor(tree, slug, String(chosen.sideEffect.id ?? \"\"));\n  if (!status) return [];\n  return [`The mapping is written, but this destination still needs the user: ${requestFlowInputCall(slug, status)}`];\n}\n\ntype Located = { node: Record<string, unknown>; sideEffect: Record<string, unknown> };\n\n/** The side effect to map into: the named one, or the only one. Never a guess between several. */\nfunction pickSideEffect(slug: string, found: Located[], named: string | undefined): Located {\n  if (found.length === 0) {\n    refuse(\n      `\"${slug}\" has no side effects — author the side effect first, then map into it.`,\n      `baker flows add-side-effect ${slug} --node <nodeId> --type <type>`,\n    );\n  }\n  const chosen = named\n    ? found.find((entry) => entry.sideEffect.id === named)\n    : found.length === 1\n      ? found[0]\n      : undefined;\n  if (chosen) return chosen;\n\n  const inventory = found.map((entry) => `${entry.sideEffect.id} (${entry.sideEffect.type})`).join(\", \");\n  refuse(\n    named\n      ? `No side effect with id \"${named}\" in \"${slug}\".`\n      : `\"${slug}\" has ${found.length} side effects — name one with --side-effect <id>.`,\n    `Side effects in this form: ${inventory}`,\n  );\n}\n\n/**\n * `--custom` and `--standard` answer the same question, and the answer decides\n * whether the write lands or is silently dropped. Taking the last flag would\n * pick one of two contradictory instructions at random.\n */\nfunction customFlag(custom: unknown, standard: unknown): boolean | undefined {\n  if (custom === true && standard === true) {\n    refuse(\"--custom and --standard contradict each other. Pass one.\");\n  }\n  if (custom === true) return true;\n  if (standard === true) return false;\n  return undefined;\n}\n\n/**\n * The destination-side options, from the flags and the mapping file together.\n *\n * A flag beats the file, so a saved mapping can be retargeted without editing\n * it. The destination catalog is read HERE, before anything is built, so every\n * mapping's field type is derived from the account rather than remembered —\n * and only when a destination was actually named: without one the build still\n * runs, and refuses per mapping if it turns out a type was needed.\n */\nasync function mapOptions(\n  args: Record<string, unknown>,\n  fromFile: MapSpecFile | undefined,\n  into: string | undefined,\n  sideEffect: Record<string, unknown>,\n): Promise<{ options: MapOptions; hints: string[]; activeCampaign?: ActiveCampaignCatalog | undefined }> {\n  const hubspotForm = args[\"hubspot-form\"] ? String(args[\"hubspot-form\"]) : fromFile?.hubspotForm;\n  const hubspot = hubspotForm ? await hubspotFieldCatalog(hubspotForm) : undefined;\n  const activeCampaign =\n    !hubspot && sideEffect.type === \"activeCampaignContact\" ? await activeCampaignFieldCatalog(sideEffect) : undefined;\n  return {\n    options: {\n      into,\n      entity: args.entity ? String(args.entity) : fromFile?.entity,\n      isCustomField: customFlag(args.custom, args.standard) ?? fromFile?.custom,\n      objectType: args[\"object-type\"] ? String(args[\"object-type\"]) : fromFile?.objectType,\n      replace: args.replace === true || fromFile?.replace === true,\n      pruneMissing: args[\"prune-missing\"] === true || fromFile?.pruneMissing === true,\n      destinationFields: hubspot?.fields ?? activeCampaign?.fields,\n      unlistedField: activeCampaign ? activeCampaignUnlistedField : undefined,\n    },\n    hints: hubspot?.captchaEnabled\n      ? [\n          \"WARNING: this HubSpot form has spam prevention (captcha) on. HubSpot refuses every submission sent to a form with it on, so nothing mapped here will arrive — the mapping is fine, the destination is not. Only the user can switch it off, on the form in HubSpot. Tell them that, and do not swap the destination yourself.\",\n        ]\n      : [],\n    activeCampaign: activeCampaign?.catalog,\n  };\n}\n\nexport const mapCommand = defineCommand({\n  meta: {\n    name: \"map\",\n    description:\n      \"Map form fields onto any value a side effect sends — never hand-write a mapping. Start here: baker flows map contact --from map.json --write\",\n  },\n  args: {\n    slug: { type: \"positional\", description: \"Form slug\", required: true },\n    map: { type: \"string\", description: \"<destField>[:<fieldType>]=<value> (repeatable)\" },\n    from: { type: \"string\", description: \"Read the whole mapping from a JSON file, or `-` for stdin\" },\n    \"side-effect\": { type: \"string\", description: \"Side-effect id, when the form has more than one\" },\n    \"hubspot-form\": {\n      type: \"string\",\n      description: \"HubSpot formGuid — reads every field's type off the form so you write none\",\n    },\n    into: {\n      type: \"string\",\n      description: \"Which slot to map into, for a type with more than one (e.g. meta: eventParams | advancedMatching)\",\n    },\n    entity: { type: \"string\", description: \"Destination object (person, contact, lead, …)\" },\n    custom: { type: \"boolean\", description: \"Destination fields are custom fields\" },\n    standard: { type: \"boolean\", description: \"Destination fields are standard fields\" },\n    \"object-type\": { type: \"string\", description: \"HubSpot objectTypeId (default 0-1)\" },\n    \"prune-missing\": {\n      type: \"boolean\",\n      description: \"Drop only the mappings the destination no longer has — the repair for a deleted HubSpot field\",\n    },\n    replace: {\n      type: \"boolean\",\n      description: \"Drop every mapping already in the slot. Default merges by destination name\",\n    },\n    write: { type: \"boolean\", description: \"Splice the mapping into the form\" },\n  },\n  run: async ({ args, rawArgs }) => {\n    const slug = String(args.slug);\n    const fromFile = args.from ? readSpecFile(String(args.from)) : undefined;\n    const specs = fromFile ? specsFromFile(fromFile) : mapSpecsFrom(rawArgs);\n    const into = args.into ? String(args.into) : fromFile?.into;\n    const replacing = args.replace === true || fromFile?.replace === true;\n    const pruning = args[\"prune-missing\"] === true || fromFile?.pruneMissing === true;\n\n    const tree = readFlowTree(slug);\n    // A flag beats the file, so a saved mapping can be retargeted without editing it.\n    const chosen = pickSideEffect(\n      slug,\n      collectSideEffects(tree),\n      args[\"side-effect\"] ? String(args[\"side-effect\"]) : fromFile?.sideEffect,\n    );\n\n    // No mappings given: answer \"what can I map here, and where do the key names\n    // come from\" rather than printing usage. The command already holds the side\n    // effect, so refusing threw the answer away and left the only discovery path\n    // a wrong guess — name a key outside a closed set and read it off the refusal.\n    // `--prune-missing` is a whole call on its own: the repair for a deleted\n    // destination field is a removal, and requiring a `--map` alongside it would\n    // mean inventing a mapping to make a deletion legal.\n    if (specs.length === 0 && !pruning) {\n      describeDestination(chosen);\n      return;\n    }\n\n    assertDestinationReady(slug, tree, chosen, into);\n\n    const {\n      options,\n      hints: destinationHints,\n      activeCampaign,\n    } = await mapOptions(args, fromFile, into, chosen.sideEffect);\n\n    let built: ReturnType<typeof buildFieldMapping>;\n    try {\n      built = buildFieldMapping(tree, chosen.sideEffect, specs, options);\n    } catch (error) {\n      if (error instanceof MappingError) {\n        refuse(error.message, error.fix);\n      }\n      throw error;\n    }\n\n    const slotHint = [\n      ...destinationHints,\n      ...(activeCampaign && Array.isArray(built.patch.fieldMapping)\n        ? activeCampaignMappingHints(built.patch.fieldMapping as Record<string, unknown>[], activeCampaign)\n        : []),\n      ...droppedHint(built),\n      ...survivorHint(built, replacing),\n      ...slotHintFor(String(chosen.sideEffect.type ?? \"\"), into),\n      ...pendingEndpointHint(slug, tree, chosen),\n    ];\n\n    if (args.write !== true) {\n      emitDryRun(slug, chosen, built, slotHint);\n      return;\n    }\n\n    Object.assign(chosen.sideEffect, built.patch);\n    writeFlowTree(slug, tree);\n    emitWritten(slug, chosen, built, slotHint);\n  },\n});\n\n/**\n * The first line of the answer: what this call did, or would do.\n *\n * It has to survive a call that only REMOVES. `--prune-missing` on its own\n * writes nothing and drops something, and \"Wrote 0 fieldMapping mappings\"\n * describes the opposite of what happened — it reads as a no-op, which is the\n * one reading that sends an agent looking for a different command after the\n * repair has already landed. The drops are named by `droppedHint` two lines\n * further down, and that is not where anybody looks to find out whether a\n * command worked.\n *\n * Exported for its own test, because this sentence is the whole report.\n */\nexport function mapHeadline(built: BuiltMapping, phase: \"written\" | \"dry-run\", slug = \"\"): string {\n  const wrote = `${built.count} ${built.key} mapping${built.count === 1 ? \"\" : \"s\"}`;\n  const drops = `${built.dropped.length} dead mapping${built.dropped.length === 1 ? \"\" : \"s\"}`;\n\n  if (phase === \"dry-run\") {\n    if (built.count === 0 && built.dropped.length > 0) {\n      return `Nothing written. Re-run with --write to drop ${drops} from ${slug}.`;\n    }\n    return `Nothing written. Re-run with --write to splice ${wrote} into ${slug}.`;\n  }\n\n  if (built.dropped.length === 0) return `Wrote ${wrote}.`;\n  if (built.count === 0) return `Dropped ${drops} from ${built.key}; nothing else changed.`;\n  return `Wrote ${wrote} and dropped ${drops}.`;\n}\n\n/** What the call WOULD do, plus the one sentence saying how to make it happen. */\nfunction emitDryRun(slug: string, chosen: Located, built: BuiltMapping, slotHint: string[]): void {\n  writeJson({\n    ok: true,\n    data: {\n      sideEffectId: chosen.sideEffect.id,\n      type: chosen.sideEffect.type,\n      key: built.key,\n      patch: built.patch,\n    },\n    hints: [mapHeadline(built, \"dry-run\", slug), ...slotHint],\n  });\n}\n\nfunction emitWritten(slug: string, chosen: Located, built: BuiltMapping, slotHint: string[]): void {\n  writeJson({\n    ok: true,\n    data: {\n      sideEffectId: chosen.sideEffect.id,\n      type: chosen.sideEffect.type,\n      key: built.key,\n      written: built.count,\n      kept: built.kept,\n      dropped: built.dropped,\n      path: flowDataPath(slug),\n    },\n    hints: [\n      mapHeadline(built, \"written\"),\n      `A mapping is only real once the destination is set — check with: baker flows show ${slug}`,\n      ...slotHint,\n    ],\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB;AAQ7B,SAAS,qBAAqB;AA6B9B,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM;AAAA,IACJ,MAAM,EAAE,MAAM,cAAc,aAAa,mCAAmC,UAAU,KAAK;AAAA,IAC3F,KAAK;AAAA,MACH,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,eAAe,EAAE,MAAM,UAAU,aAAa,mDAAmD,UAAU,MAAM;AAAA,IACjH,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,QAAQ,EAAE,MAAM,WAAW,aAAa,4CAA4C,UAAU,MAAM;AAAA,IACpG,UAAU,EAAE,MAAM,WAAW,aAAa,8CAA8C,UAAU,MAAM;AAAA,IACxG,eAAe,EAAE,MAAM,UAAU,aAAa,+CAA+C,UAAU,MAAM;AAAA,IAC7G,iBAAiB;AAAA,MACf,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AACF,CAAC;AAWM,SAAS,aAAa,SAAsC;AACjE,SAAO,mBAAmB,SAAS,KAAK;AAC1C;AA+CO,SAAS,cAAc,QAA+B;AAC3D,SAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM;AAClE,QAAI,OAAO,UAAU,SAAU,QAAO,GAAG,SAAS,IAAI,KAAK;AAC3D,UAAM,OAAO,OAAO,OAAO,IAAI,MAAM,IAAI,KAAK;AAC9C,WAAO,GAAG,SAAS,GAAG,IAAI,IAAI,OAAO,SAAS,EAAE;AAAA,EAClD,CAAC;AACH;AAEA,SAAS,aAAa,MAA2B;AAC/C,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,GAAG,OAAO,IAAI,aAAa,MAAM,OAAO;AAAA,EAC5E,SAAS,OAAO;AACd;AAAA,MACE,kBAAkB,SAAS,MAAM,2BAA2B,IAAI,IAAI,GAAG,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpI;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd;AAAA,MACE,GAAG,SAAS,MAAM,UAAU,IAAI,IAAI,GAAG,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,WAAO,yCAAyC,0DAAqD;AAAA,EACvG;AACA,QAAM,OAAO;AACb,MAAI,CAAC,KAAK,OAAO,OAAO,KAAK,QAAQ,YAAY,OAAO,KAAK,KAAK,GAAG,EAAE,WAAW,GAAG;AACnF,WAAO,kDAAkD,uDAAkD;AAAA,EAC7G;AACA,SAAO;AACT;AAGA,SAAS,OAAO,SAAiB,KAAqB;AACpD,YAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,oBAAoB,SAAS,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG,EAAE,CAAC;AAC9F,UAAQ,KAAK,CAAC;AAChB;AAiBA,eAAe,oBACb,QAC6E;AAC7E,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAkC,2BAA2B,EAAE,OAAO,CAAC;AAAA,EAC1F,SAAS,OAAO;AACd;AAAA,MACE,gCAAgC,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,SAAS,KAAK,MAAM,UAAU,CAAC;AAC9C,MAAI,OAAO,WAAW,GAAG;AACvB;AAAA,MACE,iBAAiB,MAAM;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,MACV,OAAO,IAAI,CAAC,UAAU;AAAA,QACpB,MAAM;AAAA,QACN,EAAE,WAAW,MAAM,WAAW,GAAI,MAAM,eAAe,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC,EAAG;AAAA,MACpG,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,gBAAgB,SAAS,KAAK,MAAM,mBAAmB;AAAA,EACzD;AACF;AAWA,eAAe,2BACb,YACoF;AACpF,QAAM,UAAU,OAAO,WAAW,oBAAoB,WAAW,WAAW,kBAAkB;AAC9F,QAAM,OAAoC,UAAU,EAAE,QAAQ,IAAI,CAAC;AACnE,MAAI;AACJ,MAAI;AACF,eAAW,mCAAmC;AAAA,MAC5C,MAAM,QAAsC,8BAA8B,IAAI;AAAA,IAChF;AAAA,EACF,SAAS,OAAO;AACd;AAAA,MACE,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACA,QAAM,EAAE,SAAS,UAAU,GAAG,QAAQ,IAAI,SAAS;AACnD,SAAO,EAAE,QAAQ,IAAI,IAAI,gCAAgC,QAAQ,MAAM,CAAC,GAAG,QAAQ;AACrF;AASA,SAAS,oBAAoB,QAAuB;AAClD,QAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,EAAE;AAChD,QAAM,QAAQ,cAAc,IAAI;AAChC,MAAI,MAAM,WAAW,GAAG;AACtB;AAAA,MACE,KAAK,IAAI;AAAA,MACT,0EAA0E,IAAI;AAAA,IAChF;AAAA,EACF;AACA,YAAU;AAAA,IACR,IAAI;AAAA,IACJ,MAAM,EAAE,cAAc,OAAO,WAAW,IAAI,MAAM,UAAU,MAAM;AAAA,IAClE,OAAO;AAAA,MACL,wCAAmC,IAAI;AAAA,MACvC,GAAG,MAAM;AAAA,QAAI,CAAC,SACZ,KAAK,OACD,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,KACrC,GAAG,KAAK,IAAI,KAAK,KAAK,aAAa,YAAY,2EAA2E,uEAAkE;AAAA,MAClM;AAAA;AAAA;AAAA;AAAA,MAIA,GAAG,MAAM,QAAQ,CAAC,SAAU,KAAK,aAAa,CAAC,GAAG,KAAK,IAAI,uBAAkB,KAAK,UAAU,EAAE,IAAI,CAAC,CAAE;AAAA,MACrG;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAiBA,SAAS,cAAc,MAAc,MAAuD;AAC1F,MAAI;AACF,WAAO,SAAS,MAAM,IAAI;AAAA,EAC5B,SAAS,OAAO;AACd,QAAI,iBAAiB,aAAc,QAAO,MAAM,SAAS,MAAM,GAAG;AAClE,UAAM;AAAA,EACR;AACF;AAeA,SAAS,uBACP,MACA,MACA,QACA,MACM;AACN,MAAI,CAAC,qBAAqB,OAAO,UAAU,EAAG;AAE9C,QAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,EAAE;AAChD,QAAM,SAAS,uBAAuB,MAAM,MAAM,OAAO,OAAO,WAAW,MAAM,EAAE,CAAC;AACpF,QAAM,OAAO,SAAS,qBAAqB,MAAM,MAAM,IAAI,8BAA8B,IAAI;AAE7F,MAAI,CAAC,qBAAqB,cAAc,MAAM,IAAI,CAAC,EAAG;AAEtD;AAAA,IACE,OAAO,IAAI;AAAA,IACX,qEAAqE,IAAI;AAAA,EAC3E;AACF;AAGA,SAAS,uBAAuB,MAA+B,OAAe,cAAsB;AAClG,QAAM,OAAqD,CAAC;AAC5D,sBAAoB,MAAM,IAAI;AAC9B,SAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,iBAAiB,YAAY;AAC7D;AAWA,SAAS,YAAY,MAAc,MAAoC;AACrE,QAAM,SAAS,WAAW,MAAM,SAAS,MAAM,IAAI,CAAC;AACpD,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,SAAO,CAAC,+BAA+B,OAAO,KAAK,OAAO,CAAC,8DAAyD;AACtH;AAUA,SAAS,aAAa,OAAqB,WAA8B;AACvE,MAAI,MAAM,OAAO,GAAG;AAClB,WAAO,CAAC,GAAG,MAAM,IAAI,WAAW,MAAM,SAAS,IAAI,KAAK,GAAG,eAAe,MAAM,GAAG,mCAA8B;AAAA,EACnH;AACA,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,SAAO,CAAC,cAAc,MAAM,GAAG,yBAAyB,MAAM,KAAK,kCAAkC;AACvG;AAWA,SAAS,YAAY,OAA+B;AAClD,MAAI,MAAM,QAAQ,WAAW,EAAG,QAAO,CAAC;AACxC,SAAO;AAAA,IACL,2BAA2B,MAAM,QAAQ,MAAM,WAAW,MAAM,QAAQ,WAAW,IAAI,KAAK,GAAG,mCAAmC,MAAM,QAAQ,KAAK,IAAI,CAAC,4BAA4B,MAAM,GAAG;AAAA,EACjM;AACF;AAOA,SAAS,oBAAoB,MAAc,MAA+B,QAA2B;AACnG,MAAI,CAAC,qBAAqB,OAAO,UAAU,EAAG,QAAO,CAAC;AACtD,QAAM,SAAS,uBAAuB,MAAM,MAAM,OAAO,OAAO,WAAW,MAAM,EAAE,CAAC;AACpF,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,SAAO,CAAC,sEAAsE,qBAAqB,MAAM,MAAM,CAAC,EAAE;AACpH;AAKA,SAAS,eAAe,MAAc,OAAkB,OAAoC;AAC1F,MAAI,MAAM,WAAW,GAAG;AACtB;AAAA,MACE,IAAI,IAAI;AAAA,MACR,+BAA+B,IAAI;AAAA,IACrC;AAAA,EACF;AACA,QAAM,SAAS,QACX,MAAM,KAAK,CAAC,UAAU,MAAM,WAAW,OAAO,KAAK,IACnD,MAAM,WAAW,IACf,MAAM,CAAC,IACP;AACN,MAAI,OAAQ,QAAO;AAEnB,QAAM,YAAY,MAAM,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,EAAE,KAAK,MAAM,WAAW,IAAI,GAAG,EAAE,KAAK,IAAI;AACrG;AAAA,IACE,QACI,2BAA2B,KAAK,SAAS,IAAI,OAC7C,IAAI,IAAI,SAAS,MAAM,MAAM;AAAA,IACjC,8BAA8B,SAAS;AAAA,EACzC;AACF;AAOA,SAAS,WAAW,QAAiB,UAAwC;AAC3E,MAAI,WAAW,QAAQ,aAAa,MAAM;AACxC,WAAO,0DAA0D;AAAA,EACnE;AACA,MAAI,WAAW,KAAM,QAAO;AAC5B,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO;AACT;AAWA,eAAe,WACb,MACA,UACA,MACA,YACuG;AACvG,QAAM,cAAc,KAAK,cAAc,IAAI,OAAO,KAAK,cAAc,CAAC,IAAI,UAAU;AACpF,QAAM,UAAU,cAAc,MAAM,oBAAoB,WAAW,IAAI;AACvE,QAAM,iBACJ,CAAC,WAAW,WAAW,SAAS,0BAA0B,MAAM,2BAA2B,UAAU,IAAI;AAC3G,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,MACA,QAAQ,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI,UAAU;AAAA,MACtD,eAAe,WAAW,KAAK,QAAQ,KAAK,QAAQ,KAAK,UAAU;AAAA,MACnE,YAAY,KAAK,aAAa,IAAI,OAAO,KAAK,aAAa,CAAC,IAAI,UAAU;AAAA,MAC1E,SAAS,KAAK,YAAY,QAAQ,UAAU,YAAY;AAAA,MACxD,cAAc,KAAK,eAAe,MAAM,QAAQ,UAAU,iBAAiB;AAAA,MAC3E,mBAAmB,SAAS,UAAU,gBAAgB;AAAA,MACtD,eAAe,iBAAiB,8BAA8B;AAAA,IAChE;AAAA,IACA,OAAO,SAAS,iBACZ;AAAA,MACE;AAAA,IACF,IACA,CAAC;AAAA,IACL,gBAAgB,gBAAgB;AAAA,EAClC;AACF;AAEO,IAAM,aAAa,cAAc;AAAA,EACtC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,EACJ;AAAA,EACA,MAAM;AAAA,IACJ,MAAM,EAAE,MAAM,cAAc,aAAa,aAAa,UAAU,KAAK;AAAA,IACrE,KAAK,EAAE,MAAM,UAAU,aAAa,iDAAiD;AAAA,IACrF,MAAM,EAAE,MAAM,UAAU,aAAa,4DAA4D;AAAA,IACjG,eAAe,EAAE,MAAM,UAAU,aAAa,kDAAkD;AAAA,IAChG,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,QAAQ,EAAE,MAAM,UAAU,aAAa,qDAAgD;AAAA,IACvF,QAAQ,EAAE,MAAM,WAAW,aAAa,uCAAuC;AAAA,IAC/E,UAAU,EAAE,MAAM,WAAW,aAAa,yCAAyC;AAAA,IACnF,eAAe,EAAE,MAAM,UAAU,aAAa,qCAAqC;AAAA,IACnF,iBAAiB;AAAA,MACf,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,OAAO,EAAE,MAAM,WAAW,aAAa,mCAAmC;AAAA,EAC5E;AAAA,EACA,KAAK,OAAO,EAAE,MAAM,QAAQ,MAAM;AAChC,UAAM,OAAO,OAAO,KAAK,IAAI;AAC7B,UAAM,WAAW,KAAK,OAAO,aAAa,OAAO,KAAK,IAAI,CAAC,IAAI;AAC/D,UAAM,QAAQ,WAAW,cAAc,QAAQ,IAAI,aAAa,OAAO;AACvE,UAAM,OAAO,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI,UAAU;AACvD,UAAM,YAAY,KAAK,YAAY,QAAQ,UAAU,YAAY;AACjE,UAAM,UAAU,KAAK,eAAe,MAAM,QAAQ,UAAU,iBAAiB;AAE7E,UAAM,OAAO,aAAa,IAAI;AAE9B,UAAM,SAAS;AAAA,MACb;AAAA,MACA,mBAAmB,IAAI;AAAA,MACvB,KAAK,aAAa,IAAI,OAAO,KAAK,aAAa,CAAC,IAAI,UAAU;AAAA,IAChE;AASA,QAAI,MAAM,WAAW,KAAK,CAAC,SAAS;AAClC,0BAAoB,MAAM;AAC1B;AAAA,IACF;AAEA,2BAAuB,MAAM,MAAM,QAAQ,IAAI;AAE/C,UAAM;AAAA,MACJ;AAAA,MACA,OAAO;AAAA,MACP;AAAA,IACF,IAAI,MAAM,WAAW,MAAM,UAAU,MAAM,OAAO,UAAU;AAE5D,QAAI;AACJ,QAAI;AACF,cAAQ,kBAAkB,MAAM,OAAO,YAAY,OAAO,OAAO;AAAA,IACnE,SAAS,OAAO;AACd,UAAI,iBAAiB,cAAc;AACjC,eAAO,MAAM,SAAS,MAAM,GAAG;AAAA,MACjC;AACA,YAAM;AAAA,IACR;AAEA,UAAM,WAAW;AAAA,MACf,GAAG;AAAA,MACH,GAAI,kBAAkB,MAAM,QAAQ,MAAM,MAAM,YAAY,IACxD,2BAA2B,MAAM,MAAM,cAA2C,cAAc,IAChG,CAAC;AAAA,MACL,GAAG,YAAY,KAAK;AAAA,MACpB,GAAG,aAAa,OAAO,SAAS;AAAA,MAChC,GAAG,YAAY,OAAO,OAAO,WAAW,QAAQ,EAAE,GAAG,IAAI;AAAA,MACzD,GAAG,oBAAoB,MAAM,MAAM,MAAM;AAAA,IAC3C;AAEA,QAAI,KAAK,UAAU,MAAM;AACvB,iBAAW,MAAM,QAAQ,OAAO,QAAQ;AACxC;AAAA,IACF;AAEA,WAAO,OAAO,OAAO,YAAY,MAAM,KAAK;AAC5C,kBAAc,MAAM,IAAI;AACxB,gBAAY,MAAM,QAAQ,OAAO,QAAQ;AAAA,EAC3C;AACF,CAAC;AAeM,SAAS,YAAY,OAAqB,OAA8B,OAAO,IAAY;AAChG,QAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,GAAG,WAAW,MAAM,UAAU,IAAI,KAAK,GAAG;AAChF,QAAM,QAAQ,GAAG,MAAM,QAAQ,MAAM,gBAAgB,MAAM,QAAQ,WAAW,IAAI,KAAK,GAAG;AAE1F,MAAI,UAAU,WAAW;AACvB,QAAI,MAAM,UAAU,KAAK,MAAM,QAAQ,SAAS,GAAG;AACjD,aAAO,gDAAgD,KAAK,SAAS,IAAI;AAAA,IAC3E;AACA,WAAO,kDAAkD,KAAK,SAAS,IAAI;AAAA,EAC7E;AAEA,MAAI,MAAM,QAAQ,WAAW,EAAG,QAAO,SAAS,KAAK;AACrD,MAAI,MAAM,UAAU,EAAG,QAAO,WAAW,KAAK,SAAS,MAAM,GAAG;AAChE,SAAO,SAAS,KAAK,gBAAgB,KAAK;AAC5C;AAGA,SAAS,WAAW,MAAc,QAAiB,OAAqB,UAA0B;AAChG,YAAU;AAAA,IACR,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,cAAc,OAAO,WAAW;AAAA,MAChC,MAAM,OAAO,WAAW;AAAA,MACxB,KAAK,MAAM;AAAA,MACX,OAAO,MAAM;AAAA,IACf;AAAA,IACA,OAAO,CAAC,YAAY,OAAO,WAAW,IAAI,GAAG,GAAG,QAAQ;AAAA,EAC1D,CAAC;AACH;AAEA,SAAS,YAAY,MAAc,QAAiB,OAAqB,UAA0B;AACjG,YAAU;AAAA,IACR,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,cAAc,OAAO,WAAW;AAAA,MAChC,MAAM,OAAO,WAAW;AAAA,MACxB,KAAK,MAAM;AAAA,MACX,SAAS,MAAM;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,MAAM,aAAa,IAAI;AAAA,IACzB;AAAA,IACA,OAAO;AAAA,MACL,YAAY,OAAO,SAAS;AAAA,MAC5B,0FAAqF,IAAI;AAAA,MACzF,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/mcp-GATPHY4D.js

@@ -0,0 +1,463 @@
+import {
+  repeatedValues
+} from "./chunk-ERSX3MKH.js";
+import {
+  customMcpServerNameRequestSchema
+} from "./chunk-MAGSNHYB.js";
+import "./chunk-GXDLWBOY.js";
+import "./chunk-GIWHHCD6.js";
+import "./chunk-XQIOCIDO.js";
+import "./chunk-I2DNBEV6.js";
+import {
+  ApiError,
+  apiGet,
+  apiPost
+} from "./chunk-MMOTJIV6.js";
+import "./chunk-2ZZR2SOF.js";
+import {
+  getEnv
+} from "./chunk-YPCVPDU7.js";
+import {
+  registerSchema,
+  writeJson
+} from "./chunk-D3RTGIT4.js";
+import "./chunk-YQSBHWOI.js";
+
+// ../api/src/mcp-catalog.ts
+import { z } from "zod";
+var MCP_CATALOG_DEFAULT_LIMIT = 8;
+var MCP_CATALOG_DESCRIPTION_MAX = 160;
+var mcpCatalogRequestSchema = z.object({
+  search: z.string().trim().min(1, "Provide --search").max(100),
+  limit: z.coerce.number().int().min(1).max(20).default(MCP_CATALOG_DEFAULT_LIMIT)
+});
+var mcpCatalogConnectSchema = z.enum(["sign-in", "key"]);
+var mcpCatalogEntrySchema = z.object({
+  /** The toolkit slug — what request_connection `{ app }` takes. */
+  app: z.string(),
+  name: z.string(),
+  description: z.string().max(MCP_CATALOG_DESCRIPTION_MAX),
+  connect: mcpCatalogConnectSchema,
+  connected: z.boolean()
+});
+var mcpCatalogResponseSchema = z.object({
+  apps: z.array(mcpCatalogEntrySchema),
+  /** Baker's own connections this search matched — ask for these with `{ platform }`, never a managed copy. */
+  platforms: z.array(z.string()).optional()
+});
+
+// src/commands/mcp/index.ts
+import { defineCommand } from "citty";
+
+// src/commands/mcp/catalog.ts
+var PREFER_VENDOR_HINT = 'The vendor\'s own MCP server comes before any app here. If you have not yet, WebSearch "<vendor> MCP server" and WebFetch its official docs for the remote https address and how it signs in, then ask for it with request_connection `{ server: { name, url, auth, keyHeader } }`. Only when the vendor has none, ask for an app from this catalog with request_connection `{ app: "<slug>", reason }` \u2014 the user connects it in the chat and its tools load right after, in this same turn.';
+var ALREADY_CONNECTED_HINT = "An app marked connected is already reachable \u2014 use its mcp__composio_* tools; do not ask again.";
+var NO_MATCH_HINT = "Nothing in the catalog matches. WebSearch for the vendor's official remote MCP server (its docs, its developer site) before telling the user it can't be connected \u2014 if one exists, ask for it with request_connection `{ server }`. Only when the web shows no official remote server either, say plainly this tool can't be connected yet and offer a Task.";
+function firstPartyHint(platforms) {
+  const asks = platforms.map((p) => `request_connection \`{ platform: "${p}" }\``).join(" or ");
+  return `This is one of Baker's own connections \u2014 ask for it with ${asks}. It is the one Baker's commands, staging and publish work with, so never connect it as a catalog app or as an MCP server, even one the vendor publishes or the user names. If it is already connected, read it with its own baker command family instead.`;
+}
+function catalogHints(apps, { platforms = [] } = {}) {
+  if (platforms.length > 0) {
+    return [firstPartyHint(platforms)];
+  }
+  const hints = [PREFER_VENDOR_HINT];
+  if (apps.some((a) => a.connected)) {
+    hints.push(ALREADY_CONNECTED_HINT);
+  }
+  if (apps.length === 0) {
+    hints.push(NO_MATCH_HINT);
+  }
+  return hints;
+}
+
+// src/commands/mcp/platforms.ts
+function readsKey(label) {
+  const [first = "", ...rest] = label.split(" ");
+  return [first.toLowerCase(), ...rest].join("");
+}
+function platformEntry(platform) {
+  return {
+    platform: platform.label,
+    ...platform.account ? { account: platform.account } : {},
+    ...platform.readsLabel && platform.reads.length > 0 ? { [readsKey(platform.readsLabel)]: platform.reads } : {}
+  };
+}
+
+// src/commands/mcp/index.ts
+var SCOPES = ["user", "user_org", "company", "org"];
+function parseScope(raw) {
+  const scope = raw === void 0 ? "company" : String(raw);
+  if (!SCOPES.includes(scope)) {
+    throw new ApiError("VALIDATION_ERROR", `Invalid --scope "${scope}". Use user | user_org | company | org.`);
+  }
+  return scope;
+}
+function actingUserId() {
+  return getEnv().BAKER_ACTING_USER_ID;
+}
+function customEntry(server) {
+  const failed = server.health && !server.health.ok;
+  const problem = server.health?.message ?? "This server's address is not serving tools.";
+  return {
+    name: server.name,
+    scope: server.scope,
+    enabled: server.enabled,
+    ...failed && !server.health?.transient ? { usable: false, problem } : {},
+    ...failed && server.health?.transient ? { lastCheck: "failed", problem } : {},
+    ...failed && server.health?.suggestedUrl ? { suggestedAddress: server.health.suggestedUrl } : {}
+  };
+}
+var BROKEN_SERVER_HINT = "A server marked usable=false will NOT answer: its tools are absent from this turn. Say plainly that the tool is not working and relay `problem`; never claim its tools are loading, coming next message, or temporarily unavailable. `problem` names what a person has to fix \u2014 the address, the sign-in, or the key the server was added with \u2014 so pass on that fix and no other: never tell the user to reconnect a server whose `problem` is its address or its key. The user makes the fix in the dashboard (Brain \u2192 Integrations \u2192 More apps). If `suggestedAddress` is present, that is the address to use.";
+var LAST_CHECK_FAILED_HINT = "A server with lastCheck=failed was unreachable or erroring when it was last checked \u2014 that may already have passed, and its tools ARE loaded this turn. Try the tool; if it works, say nothing about the check. If it fails, report `problem` as what happened rather than guessing.";
+function parseHeaders(raw, rawArgs) {
+  const list = repeatedValues(rawArgs, "header", raw);
+  const headers = {};
+  for (const entry of list) {
+    const text = String(entry);
+    const sep = text.indexOf(":") >= 0 && (text.indexOf(":") < text.indexOf("=") || text.indexOf("=") < 0) ? ":" : "=";
+    const at = text.indexOf(sep);
+    if (at <= 0) {
+      throw new ApiError("VALIDATION_ERROR", `Invalid header "${text}". Use "Key: Value".`);
+    }
+    headers[text.slice(0, at).trim()] = text.slice(at + 1).trim();
+  }
+  return Object.keys(headers).length > 0 ? headers : void 0;
+}
+function fail(err) {
+  if (err instanceof ApiError) {
+    writeJson({ ok: false, error: { code: err.code, message: err.message } });
+    process.exit(1);
+  }
+  writeJson({ ok: false, error: { code: "NETWORK_ERROR", message: "Unexpected error" } });
+  process.exit(1);
+}
+var PLATFORMS_HINT = "`platforms` are connected accounts you reach through `baker` commands (HubSpot, Google Ads, GA4, Search Console, Tag Manager, \u2026), NOT mcp__* tools \u2014 there is no tool to call for them. A platform listed here IS connected: never tell the user to connect it, and never conclude it is missing because it has no mcp__* entry. Read what it holds with its own command family (`baker hubspot \u2026`, `baker ads google \u2026`, `baker ga4 \u2026`, and so on).";
+registerSchema({
+  command: "mcp.connected",
+  description: "List everything this chat can reach: managed integrations (Attio, Slack, Gmail, Google Sheets, \u2026), custom MCP servers, and the platforms the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager) which you read through their own `baker` commands. Start here when the user mentions an external tool or platform.",
+  args: {}
+});
+var connectedCommand = defineCommand({
+  meta: {
+    name: "connected",
+    description: `Everything this chat can reach \u2014 managed integrations, custom MCP servers, and connected platforms.
+
+Managed tools ride the composio servers (mcp__composio_<scope>__*); custom servers expose mcp__<name>__*.
+Platforms (HubSpot, Google Ads, GA4, \u2026) have no mcp__* tools at all \u2014 you read them with their own
+\`baker\` command family, and one listed here is connected and ready to use.
+A tool or platform the user names that is NOT listed anywhere here is simply not connected yet.`
+  },
+  run: async () => {
+    try {
+      const user = actingUserId();
+      const data = await apiGet("/api/mcp/connected", user ? { actingUserId: user } : void 0);
+      const managed = data.managed.map((c) => ({
+        toolkit: c.toolkitSlug,
+        scope: c.scope,
+        ...c.status !== "ACTIVE" ? { status: c.status } : {},
+        ...c.accountLabel ? { account: c.accountLabel } : {},
+        ...c.readOnly ? { readOnly: true } : {}
+      }));
+      const custom = data.custom.map(customEntry);
+      const platforms = (data.platforms ?? []).map(platformEntry);
+      const hints = [];
+      if (platforms.length > 0) {
+        hints.push(PLATFORMS_HINT);
+      }
+      if (data.custom.some((s) => s.health && !s.health.ok && !s.health.transient)) {
+        hints.push(BROKEN_SERVER_HINT);
+      }
+      if (data.custom.some((s) => s.health && !s.health.ok && s.health.transient)) {
+        hints.push(LAST_CHECK_FAILED_HINT);
+      }
+      if ([...data.managed, ...data.custom].some((e) => e.scope === "user" || e.scope === "user_org")) {
+        hints.push(
+          "user/user_org entries are personal: they belong to the current message sender and load only in their turns \u2014 other users in this chat won't have them."
+        );
+      }
+      hints.push(
+        "Not listed anywhere = not connected \u2014 connect it from the chat with request_connection, never by sending the user to the dashboard: a Baker platform (HubSpot, Google Ads, GA4, \u2026) \u2192 { platform }; anything else \u2192 the vendor's own MCP server FIRST: use the address the user gave you, or WebSearch '<vendor> MCP server' and WebFetch its official docs for the remote https address and how it signs in, then { server: { name, url, auth, keyHeader } }; only when the vendor has none \u2192 `baker mcp catalog --search <name>`, then { app }. Research before you ask the user anything. What they connect loads into this same turn."
+      );
+      writeJson({
+        ok: true,
+        data: { managed, custom, platforms },
+        hints
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+var catalogArgs = {
+  search: { type: "string", description: "App or vendor name, e.g. notion, clarity, pipedrive", required: true },
+  limit: { type: "string", description: "Max apps to return, 1-20 (default 8)", required: false }
+};
+registerSchema({
+  command: "mcp.catalog",
+  description: "Search the managed apps you can ask the user to connect when a vendor has no MCP server of its own. Each app says how the user connects it (sign-in | key) and whether this chat already reaches it. Example: baker mcp catalog --search notion",
+  args: catalogArgs
+});
+var catalogCommand = defineCommand({
+  meta: {
+    name: "catalog",
+    description: `Managed apps you can ask the user to connect when a vendor has no MCP server of its own.
+
+For a tool \`baker mcp connected\` does not list whose vendor has no official remote MCP server:
+  baker mcp catalog --search notion
+  baker mcp catalog --search "microsoft clarity" --limit 3
+
+Each app: app (slug for request_connection), name, description, connect (sign-in | key), connected.
+Prefer the vendor's own MCP server when it publishes one; a catalog app is the fallback.`
+  },
+  args: catalogArgs,
+  run: async ({ args }) => {
+    const parsed = mcpCatalogRequestSchema.safeParse({ search: args.search, limit: args.limit });
+    if (!parsed.success) {
+      writeJson({
+        ok: false,
+        error: { code: "VALIDATION_ERROR", message: parsed.error.issues[0]?.message ?? "Invalid arguments" }
+      });
+      process.exit(1);
+    }
+    try {
+      const user = actingUserId();
+      const data = await apiGet("/api/mcp/catalog", {
+        search: parsed.data.search,
+        limit: String(parsed.data.limit),
+        ...user ? { actingUserId: user } : {}
+      });
+      writeJson({
+        ok: true,
+        data: {
+          apps: data.apps,
+          ...data.platforms?.length ? { platforms: data.platforms } : {}
+        },
+        hints: catalogHints(data.apps, { platforms: data.platforms ?? [] })
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+registerSchema({
+  command: "mcp.list",
+  description: "List the custom MCP servers this company's chats see (org + company + your own user scope).",
+  args: {}
+});
+var listCommand = defineCommand({
+  meta: { name: "list", description: "List custom MCP servers visible to this company's chats." },
+  run: async () => {
+    try {
+      const user = actingUserId();
+      const data = await apiGet(
+        "/api/mcp/custom",
+        user ? { actingUserId: user } : void 0
+      );
+      writeJson({
+        ok: true,
+        // Detail view: the full row (address included) plus the usability verdict.
+        // `health` itself is folded into `usable`/`problem` by `customEntry`.
+        data: data.servers.map((server) => ({ ...server, health: void 0, ...customEntry(server) })),
+        ...data.servers.some((s) => s.health && !s.health.ok) ? {
+          hints: data.servers.some((s) => s.health && !s.health.ok && !s.health.transient) ? [BROKEN_SERVER_HINT] : [LAST_CHECK_FAILED_HINT]
+        } : {}
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+registerSchema({
+  command: "mcp.add",
+  description: "Register a custom MCP server. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
+  args: {
+    name: { type: "string", description: "Server name \u2192 tools appear as mcp__<name>__*", required: true },
+    url: {
+      type: "string",
+      description: "Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)",
+      required: true
+    },
+    scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
+    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
+  }
+});
+var addCommand = defineCommand({
+  meta: {
+    name: "add",
+    description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.
+For a server the USER asks for, use request_connection { server } instead: they confirm who can use it,
+type any key into the card (never the chat), and its tools load in this same turn.
+
+Scope: company (default \u2014 every chat in the company) | org (all companies in the org; needs an admin key) | user (only the current message sender).
+
+Examples:
+  baker mcp add --name weather --url https://mcp.example.com/mcp
+  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
+  baker mcp add --name mine --url https://my.dev/mcp --scope user`
+  },
+  args: {
+    name: { type: "string", description: "Server name (mcp__<name>__*)", required: true },
+    url: {
+      type: "string",
+      description: "Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)",
+      required: true
+    },
+    scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
+    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
+  },
+  run: async ({ args, rawArgs }) => {
+    try {
+      const scope = parseScope(args.scope);
+      const user = actingUserId();
+      const headers = parseHeaders(args.header, rawArgs);
+      const data = await apiPost("/api/mcp/custom", {
+        name: args.name,
+        url: args.url,
+        scope,
+        ...user ? { actingUserId: user } : {},
+        ...headers ? { headers } : {}
+      });
+      writeJson({
+        ok: true,
+        data,
+        hints: [
+          "The address must be the full MCP endpoint (commonly ending in /mcp), not just the domain \u2014 a domain on its own usually answers sign-in and then serves no tools.",
+          "The address is checked in the background. Run `baker mcp connected` on the next message to confirm it serves tools before promising the user anything."
+        ]
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+registerSchema({
+  command: "mcp.remove",
+  description: "Remove a company custom MCP server by name.",
+  args: { name: { type: "string", description: "Server name to remove", required: true } }
+});
+var removeCommand = defineCommand({
+  meta: {
+    name: "remove",
+    description: `Remove a company custom MCP server by name.
+
+Example:
+  baker mcp remove --name weather`
+  },
+  args: { name: { type: "string", description: "Server name to remove", required: true } },
+  run: async ({ args }) => {
+    try {
+      const user = actingUserId();
+      const data = await apiPost("/api/mcp/custom/remove", {
+        name: args.name,
+        ...user ? { actingUserId: user } : {}
+      });
+      writeJson({ ok: true, data });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+var serverNameArgs = {
+  name: { type: "string", description: "Custom server name, as `baker mcp list` shows it", required: true }
+};
+registerSchema({
+  command: "mcp.verify",
+  description: "Check a custom MCP server now (the dashboard's 'Check now') and store the result. Use after the user fixed its address or sign-in, or when its tools failed this turn.",
+  args: serverNameArgs
+});
+var verifyCommand = defineCommand({
+  meta: {
+    name: "verify",
+    description: `Check a custom MCP server now and store the result.
+
+Example:
+  baker mcp verify --name weather`
+  },
+  args: serverNameArgs,
+  run: async ({ args }) => {
+    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });
+    if (!parsed.success) {
+      fail(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
+    }
+    try {
+      const data = await apiPost("/api/mcp/custom/verify", parsed.data);
+      writeJson({
+        ok: true,
+        data,
+        hints: [
+          data.ok ? "The server answers and serves tools. Its tools load on the next message." : data.transient ? LAST_CHECK_FAILED_HINT : BROKEN_SERVER_HINT
+        ]
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+registerSchema({
+  command: "mcp.disable",
+  description: "Switch a custom MCP server off so its tools stop loading; its address and sign-in are kept. Turning it back on is done by a person in the dashboard, never by the agent.",
+  args: serverNameArgs
+});
+var disableCommand = defineCommand({
+  meta: {
+    name: "disable",
+    description: `Switch a custom MCP server off (its tools stop loading). Only a person can turn it back on, in the dashboard.
+
+Example:
+  baker mcp disable --name weather`
+  },
+  args: serverNameArgs,
+  run: async ({ args }) => {
+    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });
+    if (!parsed.success) {
+      fail(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
+    }
+    try {
+      const data = await apiPost("/api/mcp/custom/disable", parsed.data);
+      writeJson({
+        ok: true,
+        data,
+        hints: [
+          "Its tools stop loading from the next message, and this applies right away \u2014 publishing or discarding this chat does not undo it. Tell the user they can turn it back on in Brain \u2192 Integrations \u2192 More apps."
+        ]
+      });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+var mcpCommand = defineCommand({
+  meta: {
+    name: "mcp",
+    description: `Third-party tools for this company \u2014 see what's connected, register custom HTTPS MCP endpoints.
+
+Tools from a registered server appear as mcp__<name>__* on the next message.
+Managed here are **company-scoped** servers; user- and org-scoped servers are managed in the dashboard.
+
+Start here:
+  baker mcp connected   # everything this chat can reach: managed integrations, custom servers, connected platforms
+  baker mcp catalog --search notion   # managed apps you can connect when a vendor has no MCP server of its own
+
+Examples:
+  baker mcp add --name weather --url https://mcp.example.com/mcp
+  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
+  baker mcp remove --name weather
+  baker mcp verify --name weather    # check it now after the user fixed it
+  baker mcp disable --name weather   # stop its tools loading (only a person turns it back on)
+Full guide: __tooling__/docs/tools/baker/mcp.md`
+  },
+  subCommands: {
+    connected: connectedCommand,
+    catalog: catalogCommand,
+    list: listCommand,
+    add: addCommand,
+    remove: removeCommand,
+    verify: verifyCommand,
+    disable: disableCommand
+  }
+});
+export {
+  mcpCommand
+};
+//# sourceMappingURL=mcp-GATPHY4D.js.map

package/dist/mcp-GATPHY4D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/mcp-catalog.ts","../src/commands/mcp/index.ts","../src/commands/mcp/catalog.ts","../src/commands/mcp/platforms.ts"],"sourcesContent":["/**\n * Contract for `GET /api/mcp/catalog` — searching the managed-app catalog the\n * sandbox agent can ask the user to connect when a vendor publishes no MCP\n * server of its own.\n *\n * `connect` mirrors `ToolkitConnectMode` in `convex/composio/types.ts`, folded\n * to what the user will be asked for: a sign-in or a key. Apps that need no\n * sign-in are left out — Composio refuses to connect them.\n */\nimport { z } from \"zod\";\n\nexport const MCP_CATALOG_DEFAULT_LIMIT = 8;\nexport const MCP_CATALOG_DESCRIPTION_MAX = 160;\n\nexport const mcpCatalogRequestSchema = z.object({\n  search: z.string().trim().min(1, \"Provide --search\").max(100),\n  limit: z.coerce.number().int().min(1).max(20).default(MCP_CATALOG_DEFAULT_LIMIT),\n});\nexport type McpCatalogRequest = z.infer<typeof mcpCatalogRequestSchema>;\n\nexport const mcpCatalogConnectSchema = z.enum([\"sign-in\", \"key\"]);\nexport type McpCatalogConnect = z.infer<typeof mcpCatalogConnectSchema>;\n\nexport const mcpCatalogEntrySchema = z.object({\n  /** The toolkit slug — what request_connection `{ app }` takes. */\n  app: z.string(),\n  name: z.string(),\n  description: z.string().max(MCP_CATALOG_DESCRIPTION_MAX),\n  connect: mcpCatalogConnectSchema,\n  connected: z.boolean(),\n});\nexport type McpCatalogEntry = z.infer<typeof mcpCatalogEntrySchema>;\n\nexport const mcpCatalogResponseSchema = z.object({\n  apps: z.array(mcpCatalogEntrySchema),\n  /** Baker's own connections this search matched — ask for these with `{ platform }`, never a managed copy. */\n  platforms: z.array(z.string()).optional(),\n});\nexport type McpCatalogResponse = z.infer<typeof mcpCatalogResponseSchema>;\n","import {\n  type CustomMcpDisableResponse,\n  type CustomMcpVerifyResponse,\n  customMcpServerNameRequestSchema,\n} from \"@baker/api\";\nimport { type McpCatalogResponse, mcpCatalogRequestSchema } from \"@baker/api/mcp-catalog\";\nimport { defineCommand } from \"citty\";\nimport { ApiError, apiGet, apiPost } from \"../../client.ts\";\nimport { getEnv } from \"../../env.ts\";\nimport { repeatedValues } from \"../../lib/repeatedFlags.ts\";\nimport { writeJson } from \"../../output.ts\";\nimport { registerSchema } from \"../../schemas.ts\";\nimport { catalogHints } from \"./catalog.ts\";\nimport { type ConnectedPlatform, platformEntry } from \"./platforms.ts\";\n\nconst SCOPES = [\"user\", \"user_org\", \"company\", \"org\"] as const;\ntype Scope = (typeof SCOPES)[number];\n\nfunction parseScope(raw: unknown): Scope {\n  const scope = raw === undefined ? \"company\" : String(raw);\n  if (!(SCOPES as readonly string[]).includes(scope)) {\n    throw new ApiError(\"VALIDATION_ERROR\", `Invalid --scope \"${scope}\". Use user | user_org | company | org.`);\n  }\n  return scope as Scope;\n}\n\n/** The turn's message sender, injected by the bridge — required only for user scope. */\nfunction actingUserId(): string | undefined {\n  return getEnv().BAKER_ACTING_USER_ID;\n}\n\ntype CustomMcpServer = {\n  _id: string;\n  scope: \"user\" | \"user_org\" | \"company\" | \"org\";\n  name: string;\n  url: string;\n  headerKeys: string[];\n  enabled: boolean;\n  /** Absent until the address has been checked; `ok: false` means it serves no tools. */\n  health?: { ok: boolean; message?: string; suggestedUrl?: string; transient?: boolean; checkedAt: number };\n  createdAt: number;\n};\n\n/**\n * What to report for one custom server. `problem` is the whole point: a server can\n * be signed in, enabled and still serve nothing (wrong address), and reporting it\n * as plain \"connected\" is how an agent ends up promising tools it does not have.\n * A `transient` failure is reported separately — the tool may well answer, so\n * declaring it broken would be its own kind of lie.\n */\nfunction customEntry(server: CustomMcpServer): Record<string, unknown> {\n  const failed = server.health && !server.health.ok;\n  const problem = server.health?.message ?? \"This server's address is not serving tools.\";\n  return {\n    name: server.name,\n    scope: server.scope,\n    enabled: server.enabled,\n    ...(failed && !server.health?.transient ? { usable: false, problem } : {}),\n    ...(failed && server.health?.transient ? { lastCheck: \"failed\", problem } : {}),\n    ...(failed && server.health?.suggestedUrl ? { suggestedAddress: server.health.suggestedUrl } : {}),\n  };\n}\n\n/** The hint an unusable server earns — the agent must not offer its tools or invent a reason. */\nconst BROKEN_SERVER_HINT =\n  \"A server marked usable=false will NOT answer: its tools are absent from this turn. Say plainly that the tool is not working and relay `problem`; never claim its tools are loading, coming next message, or temporarily unavailable. `problem` names what a person has to fix — the address, the sign-in, or the key the server was added with — so pass on that fix and no other: never tell the user to reconnect a server whose `problem` is its address or its key. The user makes the fix in the dashboard (Brain → Integrations → More apps). If `suggestedAddress` is present, that is the address to use.\";\n\n/** The hint for a server whose last check failed for a reason that may already have passed. */\nconst LAST_CHECK_FAILED_HINT =\n  \"A server with lastCheck=failed was unreachable or erroring when it was last checked — that may already have passed, and its tools ARE loaded this turn. Try the tool; if it works, say nothing about the check. If it fails, report `problem` as what happened rather than guessing.\";\n\n/** Turn repeated `--header \"K: V\"` (or `K=V`) flags into a headers record. */\n/** `--header` is repeatable, so its values come off the command line — citty keeps only the last. */\nfunction parseHeaders(raw: unknown, rawArgs?: readonly string[]): Record<string, string> | undefined {\n  const list = repeatedValues(rawArgs, \"header\", raw);\n  const headers: Record<string, string> = {};\n  for (const entry of list) {\n    const text = String(entry);\n    const sep = text.indexOf(\":\") >= 0 && (text.indexOf(\":\") < text.indexOf(\"=\") || text.indexOf(\"=\") < 0) ? \":\" : \"=\";\n    const at = text.indexOf(sep);\n    if (at <= 0) {\n      throw new ApiError(\"VALIDATION_ERROR\", `Invalid header \"${text}\". Use \"Key: Value\".`);\n    }\n    headers[text.slice(0, at).trim()] = text.slice(at + 1).trim();\n  }\n  return Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nfunction fail(err: unknown): never {\n  if (err instanceof ApiError) {\n    writeJson({ ok: false, error: { code: err.code, message: err.message } });\n    process.exit(1);\n  }\n  writeJson({ ok: false, error: { code: \"NETWORK_ERROR\", message: \"Unexpected error\" } });\n  process.exit(1);\n}\n\ntype ManagedConnection = {\n  toolkitSlug: string;\n  scope: \"user\" | \"user_org\" | \"company\" | \"org\";\n  status: string;\n  accountLabel: string | null;\n  readOnly: boolean;\n};\n\ntype ConnectedResponse = {\n  managed: ManagedConnection[];\n  custom: CustomMcpServer[];\n  platforms: ConnectedPlatform[];\n};\n\n/** The one thing an agent must not do with this list: infer a platform's state from the MCP half. */\nconst PLATFORMS_HINT =\n  \"`platforms` are connected accounts you reach through `baker` commands (HubSpot, Google Ads, GA4, Search Console, Tag Manager, …), NOT mcp__* tools — there is no tool to call for them. A platform listed here IS connected: never tell the user to connect it, and never conclude it is missing because it has no mcp__* entry. Read what it holds with its own command family (`baker hubspot …`, `baker ads google …`, `baker ga4 …`, and so on).\";\n\nregisterSchema({\n  command: \"mcp.connected\",\n  description:\n    \"List everything this chat can reach: managed integrations (Attio, Slack, Gmail, Google Sheets, …), custom MCP servers, and the platforms the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager) which you read through their own `baker` commands. Start here when the user mentions an external tool or platform.\",\n  args: {},\n});\n\nconst connectedCommand = defineCommand({\n  meta: {\n    name: \"connected\",\n    description: `Everything this chat can reach — managed integrations, custom MCP servers, and connected platforms.\n\nManaged tools ride the composio servers (mcp__composio_<scope>__*); custom servers expose mcp__<name>__*.\nPlatforms (HubSpot, Google Ads, GA4, …) have no mcp__* tools at all — you read them with their own\n\\`baker\\` command family, and one listed here is connected and ready to use.\nA tool or platform the user names that is NOT listed anywhere here is simply not connected yet.`,\n  },\n  run: async () => {\n    try {\n      const user = actingUserId();\n      const data = await apiGet<ConnectedResponse>(\"/api/mcp/connected\", user ? { actingUserId: user } : undefined);\n      const managed = data.managed.map((c) => ({\n        toolkit: c.toolkitSlug,\n        scope: c.scope,\n        ...(c.status !== \"ACTIVE\" ? { status: c.status } : {}),\n        ...(c.accountLabel ? { account: c.accountLabel } : {}),\n        ...(c.readOnly ? { readOnly: true } : {}),\n      }));\n      const custom = data.custom.map(customEntry);\n      const platforms = (data.platforms ?? []).map(platformEntry);\n      const hints: string[] = [];\n      if (platforms.length > 0) {\n        hints.push(PLATFORMS_HINT);\n      }\n      if (data.custom.some((s) => s.health && !s.health.ok && !s.health.transient)) {\n        hints.push(BROKEN_SERVER_HINT);\n      }\n      if (data.custom.some((s) => s.health && !s.health.ok && s.health.transient)) {\n        hints.push(LAST_CHECK_FAILED_HINT);\n      }\n      if ([...data.managed, ...data.custom].some((e) => e.scope === \"user\" || e.scope === \"user_org\")) {\n        hints.push(\n          \"user/user_org entries are personal: they belong to the current message sender and load only in their turns — other users in this chat won't have them.\",\n        );\n      }\n      hints.push(\n        \"Not listed anywhere = not connected — connect it from the chat with request_connection, never by sending the user to the dashboard: a Baker platform (HubSpot, Google Ads, GA4, …) → { platform }; anything else → the vendor's own MCP server FIRST: use the address the user gave you, or WebSearch '<vendor> MCP server' and WebFetch its official docs for the remote https address and how it signs in, then { server: { name, url, auth, keyHeader } }; only when the vendor has none → `baker mcp catalog --search <name>`, then { app }. Research before you ask the user anything. What they connect loads into this same turn.\",\n      );\n      writeJson({\n        ok: true,\n        data: { managed, custom, platforms },\n        hints,\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nconst catalogArgs = {\n  search: { type: \"string\", description: \"App or vendor name, e.g. notion, clarity, pipedrive\", required: true },\n  limit: { type: \"string\", description: \"Max apps to return, 1-20 (default 8)\", required: false },\n} as const;\n\nregisterSchema({\n  command: \"mcp.catalog\",\n  description:\n    \"Search the managed apps you can ask the user to connect when a vendor has no MCP server of its own. Each app says how the user connects it (sign-in | key) and whether this chat already reaches it. Example: baker mcp catalog --search notion\",\n  args: catalogArgs,\n});\n\nconst catalogCommand = defineCommand({\n  meta: {\n    name: \"catalog\",\n    description: `Managed apps you can ask the user to connect when a vendor has no MCP server of its own.\n\nFor a tool \\`baker mcp connected\\` does not list whose vendor has no official remote MCP server:\n  baker mcp catalog --search notion\n  baker mcp catalog --search \"microsoft clarity\" --limit 3\n\nEach app: app (slug for request_connection), name, description, connect (sign-in | key), connected.\nPrefer the vendor's own MCP server when it publishes one; a catalog app is the fallback.`,\n  },\n  args: catalogArgs,\n  run: async ({ args }) => {\n    const parsed = mcpCatalogRequestSchema.safeParse({ search: args.search, limit: args.limit });\n    if (!parsed.success) {\n      writeJson({\n        ok: false,\n        error: { code: \"VALIDATION_ERROR\", message: parsed.error.issues[0]?.message ?? \"Invalid arguments\" },\n      });\n      process.exit(1);\n    }\n    try {\n      const user = actingUserId();\n      const data = await apiGet<McpCatalogResponse>(\"/api/mcp/catalog\", {\n        search: parsed.data.search,\n        limit: String(parsed.data.limit),\n        ...(user ? { actingUserId: user } : {}),\n      });\n      writeJson({\n        ok: true,\n        data: {\n          apps: data.apps,\n          ...(data.platforms?.length ? { platforms: data.platforms } : {}),\n        },\n        hints: catalogHints(data.apps, { platforms: data.platforms ?? [] }),\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nregisterSchema({\n  command: \"mcp.list\",\n  description: \"List the custom MCP servers this company's chats see (org + company + your own user scope).\",\n  args: {},\n});\n\nconst listCommand = defineCommand({\n  meta: { name: \"list\", description: \"List custom MCP servers visible to this company's chats.\" },\n  run: async () => {\n    try {\n      const user = actingUserId();\n      const data = await apiGet<{ servers: CustomMcpServer[] }>(\n        \"/api/mcp/custom\",\n        user ? { actingUserId: user } : undefined,\n      );\n      writeJson({\n        ok: true,\n        // Detail view: the full row (address included) plus the usability verdict.\n        // `health` itself is folded into `usable`/`problem` by `customEntry`.\n        data: data.servers.map((server) => ({ ...server, health: undefined, ...customEntry(server) })),\n        ...(data.servers.some((s) => s.health && !s.health.ok)\n          ? {\n              hints: data.servers.some((s) => s.health && !s.health.ok && !s.health.transient)\n                ? [BROKEN_SERVER_HINT]\n                : [LAST_CHECK_FAILED_HINT],\n            }\n          : {}),\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nregisterSchema({\n  command: \"mcp.add\",\n  description:\n    \"Register a custom MCP server. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).\",\n  args: {\n    name: { type: \"string\", description: \"Server name → tools appear as mcp__<name>__*\", required: true },\n    url: {\n      type: \"string\",\n      description: \"Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)\",\n      required: true,\n    },\n    scope: { type: \"string\", description: \"user | user_org | company | org (default company)\", required: false },\n    header: { type: \"string\", description: 'Auth header \"Key: Value\" (repeatable)', required: false },\n  },\n});\n\nconst addCommand = defineCommand({\n  meta: {\n    name: \"add\",\n    description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.\nFor a server the USER asks for, use request_connection { server } instead: they confirm who can use it,\ntype any key into the card (never the chat), and its tools load in this same turn.\n\nScope: company (default — every chat in the company) | org (all companies in the org; needs an admin key) | user (only the current message sender).\n\nExamples:\n  baker mcp add --name weather --url https://mcp.example.com/mcp\n  baker mcp add --name acme --url https://acme.dev/mcp --header \"Authorization: Bearer sk-…\"\n  baker mcp add --name mine --url https://my.dev/mcp --scope user`,\n  },\n  args: {\n    name: { type: \"string\", description: \"Server name (mcp__<name>__*)\", required: true },\n    url: {\n      type: \"string\",\n      description: \"Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)\",\n      required: true,\n    },\n    scope: { type: \"string\", description: \"user | user_org | company | org (default company)\", required: false },\n    header: { type: \"string\", description: 'Auth header \"Key: Value\" (repeatable)', required: false },\n  },\n  run: async ({ args, rawArgs }) => {\n    try {\n      const scope = parseScope(args.scope);\n      const user = actingUserId();\n      const headers = parseHeaders(args.header, rawArgs);\n      const data = await apiPost<{ name: string }>(\"/api/mcp/custom\", {\n        name: args.name as string,\n        url: args.url as string,\n        scope,\n        ...(user ? { actingUserId: user } : {}),\n        ...(headers ? { headers } : {}),\n      });\n      writeJson({\n        ok: true,\n        data,\n        hints: [\n          \"The address must be the full MCP endpoint (commonly ending in /mcp), not just the domain — a domain on its own usually answers sign-in and then serves no tools.\",\n          \"The address is checked in the background. Run `baker mcp connected` on the next message to confirm it serves tools before promising the user anything.\",\n        ],\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nregisterSchema({\n  command: \"mcp.remove\",\n  description: \"Remove a company custom MCP server by name.\",\n  args: { name: { type: \"string\", description: \"Server name to remove\", required: true } },\n});\n\nconst removeCommand = defineCommand({\n  meta: {\n    name: \"remove\",\n    description: `Remove a company custom MCP server by name.\n\nExample:\n  baker mcp remove --name weather`,\n  },\n  args: { name: { type: \"string\", description: \"Server name to remove\", required: true } },\n  run: async ({ args }) => {\n    try {\n      const user = actingUserId();\n      const data = await apiPost<{ removed: boolean }>(\"/api/mcp/custom/remove\", {\n        name: args.name as string,\n        ...(user ? { actingUserId: user } : {}),\n      });\n      writeJson({ ok: true, data });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nconst serverNameArgs = {\n  name: { type: \"string\", description: \"Custom server name, as `baker mcp list` shows it\", required: true },\n} as const;\n\nregisterSchema({\n  command: \"mcp.verify\",\n  description:\n    \"Check a custom MCP server now (the dashboard's 'Check now') and store the result. Use after the user fixed its address or sign-in, or when its tools failed this turn.\",\n  args: serverNameArgs,\n});\n\nconst verifyCommand = defineCommand({\n  meta: {\n    name: \"verify\",\n    description: `Check a custom MCP server now and store the result.\n\nExample:\n  baker mcp verify --name weather`,\n  },\n  args: serverNameArgs,\n  run: async ({ args }) => {\n    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });\n    if (!parsed.success) {\n      fail(new ApiError(\"VALIDATION_ERROR\", parsed.error.issues[0]?.message ?? \"Invalid arguments\"));\n    }\n    try {\n      const data = await apiPost<CustomMcpVerifyResponse>(\"/api/mcp/custom/verify\", parsed.data);\n      writeJson({\n        ok: true,\n        data,\n        hints: [\n          data.ok\n            ? \"The server answers and serves tools. Its tools load on the next message.\"\n            : data.transient\n              ? LAST_CHECK_FAILED_HINT\n              : BROKEN_SERVER_HINT,\n        ],\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nregisterSchema({\n  command: \"mcp.disable\",\n  description:\n    \"Switch a custom MCP server off so its tools stop loading; its address and sign-in are kept. Turning it back on is done by a person in the dashboard, never by the agent.\",\n  args: serverNameArgs,\n});\n\nconst disableCommand = defineCommand({\n  meta: {\n    name: \"disable\",\n    description: `Switch a custom MCP server off (its tools stop loading). Only a person can turn it back on, in the dashboard.\n\nExample:\n  baker mcp disable --name weather`,\n  },\n  args: serverNameArgs,\n  run: async ({ args }) => {\n    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });\n    if (!parsed.success) {\n      fail(new ApiError(\"VALIDATION_ERROR\", parsed.error.issues[0]?.message ?? \"Invalid arguments\"));\n    }\n    try {\n      const data = await apiPost<CustomMcpDisableResponse>(\"/api/mcp/custom/disable\", parsed.data);\n      writeJson({\n        ok: true,\n        data,\n        hints: [\n          \"Its tools stop loading from the next message, and this applies right away — publishing or discarding this chat does not undo it. Tell the user they can turn it back on in Brain → Integrations → More apps.\",\n        ],\n      });\n    } catch (err) {\n      fail(err);\n    }\n  },\n});\n\nexport const mcpCommand = defineCommand({\n  meta: {\n    name: \"mcp\",\n    description: `Third-party tools for this company — see what's connected, register custom HTTPS MCP endpoints.\n\nTools from a registered server appear as mcp__<name>__* on the next message.\nManaged here are **company-scoped** servers; user- and org-scoped servers are managed in the dashboard.\n\nStart here:\n  baker mcp connected   # everything this chat can reach: managed integrations, custom servers, connected platforms\n  baker mcp catalog --search notion   # managed apps you can connect when a vendor has no MCP server of its own\n\nExamples:\n  baker mcp add --name weather --url https://mcp.example.com/mcp\n  baker mcp add --name acme --url https://acme.dev/mcp --header \"Authorization: Bearer sk-…\"\n  baker mcp remove --name weather\n  baker mcp verify --name weather    # check it now after the user fixed it\n  baker mcp disable --name weather   # stop its tools loading (only a person turns it back on)\nFull guide: __tooling__/docs/tools/baker/mcp.md`,\n  },\n  subCommands: {\n    connected: connectedCommand,\n    catalog: catalogCommand,\n    list: listCommand,\n    add: addCommand,\n    remove: removeCommand,\n    verify: verifyCommand,\n    disable: disableCommand,\n  },\n});\n","/**\n * What `baker mcp catalog` tells the agent to do next with the managed apps it\n * found — the fallback when a vendor publishes no MCP server of its own.\n */\nimport type { McpCatalogEntry } from \"@baker/api/mcp-catalog\";\n\nconst PREFER_VENDOR_HINT =\n  'The vendor\\'s own MCP server comes before any app here. If you have not yet, WebSearch \"<vendor> MCP server\" and WebFetch its official docs for the remote https address and how it signs in, then ask for it with request_connection `{ server: { name, url, auth, keyHeader } }`. Only when the vendor has none, ask for an app from this catalog with request_connection `{ app: \"<slug>\", reason }` — the user connects it in the chat and its tools load right after, in this same turn.';\n\nconst ALREADY_CONNECTED_HINT =\n  \"An app marked connected is already reachable — use its mcp__composio_* tools; do not ask again.\";\n\nconst NO_MATCH_HINT =\n  \"Nothing in the catalog matches. WebSearch for the vendor's official remote MCP server (its docs, its developer site) before telling the user it can't be connected — if one exists, ask for it with request_connection `{ server }`. Only when the web shows no official remote server either, say plainly this tool can't be connected yet and offer a Task.\";\n\n/** Baker's own connection always wins over a catalog app or anyone's MCP server for the same tool. */\nfunction firstPartyHint(platforms: readonly string[]): string {\n  const asks = platforms.map((p) => `request_connection \\`{ platform: \"${p}\" }\\``).join(\" or \");\n  return `This is one of Baker's own connections — ask for it with ${asks}. It is the one Baker's commands, staging and publish work with, so never connect it as a catalog app or as an MCP server, even one the vendor publishes or the user names. If it is already connected, read it with its own baker command family instead.`;\n}\n\n/** What the agent should do next with a catalog answer. */\nexport function catalogHints(\n  apps: readonly McpCatalogEntry[],\n  { platforms = [] }: { platforms?: readonly string[] } = {},\n): string[] {\n  if (platforms.length > 0) {\n    return [firstPartyHint(platforms)];\n  }\n  const hints = [PREFER_VENDOR_HINT];\n  if (apps.some((a) => a.connected)) {\n    hints.push(ALREADY_CONNECTED_HINT);\n  }\n  if (apps.length === 0) {\n    hints.push(NO_MATCH_HINT);\n  }\n  return hints;\n}\n","/**\n * How a connected platform reads back to the agent.\n *\n * A platform (HubSpot, Google Ads, GA4, …) is an account the company signed in\n * to, reached through its own `baker` command family rather than an `mcp__*`\n * tool. It rides `mcp connected` because that is the one answer to \"what can\n * this chat reach\" — and because an agent that only saw the tool half had no\n * way to tell a working HubSpot connection from a missing one.\n */\n\nexport interface ConnectedPlatform {\n  type: string;\n  label: string;\n  account: string | null;\n  reads: string[];\n  readsLabel: string | null;\n}\n\n/** \"Ad Accounts\" -> `adAccounts`, \"Properties\" -> `properties`. */\nfunction readsKey(label: string): string {\n  const [first = \"\", ...rest] = label.split(\" \");\n  return [first.toLowerCase(), ...rest].join(\"\");\n}\n\n/**\n * One platform as the agent sees it. The resources are keyed by the platform's\n * own word for them — `properties` for GA4, `containers` for Tag Manager,\n * `adAccounts` for the ad platforms — so what the agent reads back matches what\n * the user sees in the dashboard.\n */\nexport function platformEntry(platform: ConnectedPlatform): Record<string, unknown> {\n  return {\n    platform: platform.label,\n    ...(platform.account ? { account: platform.account } : {}),\n    ...(platform.readsLabel && platform.reads.length > 0 ? { [readsKey(platform.readsLabel)]: platform.reads } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASA,SAAS,SAAS;AAEX,IAAM,4BAA4B;AAClC,IAAM,8BAA8B;AAEpC,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kBAAkB,EAAE,IAAI,GAAG;AAAA,EAC5D,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,yBAAyB;AACjF,CAAC;AAGM,IAAM,0BAA0B,EAAE,KAAK,CAAC,WAAW,KAAK,CAAC;AAGzD,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,IAAI,2BAA2B;AAAA,EACvD,SAAS;AAAA,EACT,WAAW,EAAE,QAAQ;AACvB,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,MAAM,qBAAqB;AAAA;AAAA,EAEnC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC1C,CAAC;;;AC/BD,SAAS,qBAAqB;;;ACA9B,IAAM,qBACJ;AAEF,IAAM,yBACJ;AAEF,IAAM,gBACJ;AAGF,SAAS,eAAe,WAAsC;AAC5D,QAAM,OAAO,UAAU,IAAI,CAAC,MAAM,qCAAqC,CAAC,OAAO,EAAE,KAAK,MAAM;AAC5F,SAAO,iEAA4D,IAAI;AACzE;AAGO,SAAS,aACd,MACA,EAAE,YAAY,CAAC,EAAE,IAAuC,CAAC,GAC/C;AACV,MAAI,UAAU,SAAS,GAAG;AACxB,WAAO,CAAC,eAAe,SAAS,CAAC;AAAA,EACnC;AACA,QAAM,QAAQ,CAAC,kBAAkB;AACjC,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG;AACjC,UAAM,KAAK,sBAAsB;AAAA,EACnC;AACA,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,KAAK,aAAa;AAAA,EAC1B;AACA,SAAO;AACT;;;AClBA,SAAS,SAAS,OAAuB;AACvC,QAAM,CAAC,QAAQ,IAAI,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG;AAC7C,SAAO,CAAC,MAAM,YAAY,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE;AAC/C;AAQO,SAAS,cAAc,UAAsD;AAClF,SAAO;AAAA,IACL,UAAU,SAAS;AAAA,IACnB,GAAI,SAAS,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,IACxD,GAAI,SAAS,cAAc,SAAS,MAAM,SAAS,IAAI,EAAE,CAAC,SAAS,SAAS,UAAU,CAAC,GAAG,SAAS,MAAM,IAAI,CAAC;AAAA,EAChH;AACF;;;AFrBA,IAAM,SAAS,CAAC,QAAQ,YAAY,WAAW,KAAK;AAGpD,SAAS,WAAW,KAAqB;AACvC,QAAM,QAAQ,QAAQ,SAAY,YAAY,OAAO,GAAG;AACxD,MAAI,CAAE,OAA6B,SAAS,KAAK,GAAG;AAClD,UAAM,IAAI,SAAS,oBAAoB,oBAAoB,KAAK,yCAAyC;AAAA,EAC3G;AACA,SAAO;AACT;AAGA,SAAS,eAAmC;AAC1C,SAAO,OAAO,EAAE;AAClB;AAqBA,SAAS,YAAY,QAAkD;AACrE,QAAM,SAAS,OAAO,UAAU,CAAC,OAAO,OAAO;AAC/C,QAAM,UAAU,OAAO,QAAQ,WAAW;AAC1C,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,OAAO,OAAO;AAAA,IACd,SAAS,OAAO;AAAA,IAChB,GAAI,UAAU,CAAC,OAAO,QAAQ,YAAY,EAAE,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAAA,IACxE,GAAI,UAAU,OAAO,QAAQ,YAAY,EAAE,WAAW,UAAU,QAAQ,IAAI,CAAC;AAAA,IAC7E,GAAI,UAAU,OAAO,QAAQ,eAAe,EAAE,kBAAkB,OAAO,OAAO,aAAa,IAAI,CAAC;AAAA,EAClG;AACF;AAGA,IAAM,qBACJ;AAGF,IAAM,yBACJ;AAIF,SAAS,aAAa,KAAc,SAAiE;AACnG,QAAM,OAAO,eAAe,SAAS,UAAU,GAAG;AAClD,QAAM,UAAkC,CAAC;AACzC,aAAW,SAAS,MAAM;AACxB,UAAM,OAAO,OAAO,KAAK;AACzB,UAAM,MAAM,KAAK,QAAQ,GAAG,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI,KAAK,QAAQ,GAAG,KAAK,KAAK,QAAQ,GAAG,IAAI,KAAK,MAAM;AAC/G,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,MAAM,GAAG;AACX,YAAM,IAAI,SAAS,oBAAoB,mBAAmB,IAAI,sBAAsB;AAAA,IACtF;AACA,YAAQ,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EAC9D;AACA,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAAS,KAAK,KAAqB;AACjC,MAAI,eAAe,UAAU;AAC3B,cAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;AACxE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,YAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,iBAAiB,SAAS,mBAAmB,EAAE,CAAC;AACtF,UAAQ,KAAK,CAAC;AAChB;AAiBA,IAAM,iBACJ;AAEF,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC;AACT,CAAC;AAED,IAAM,mBAAmB,cAAc;AAAA,EACrC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMf;AAAA,EACA,KAAK,YAAY;AACf,QAAI;AACF,YAAM,OAAO,aAAa;AAC1B,YAAM,OAAO,MAAM,OAA0B,sBAAsB,OAAO,EAAE,cAAc,KAAK,IAAI,MAAS;AAC5G,YAAM,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO;AAAA,QACvC,SAAS,EAAE;AAAA,QACX,OAAO,EAAE;AAAA,QACT,GAAI,EAAE,WAAW,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,QACpD,GAAI,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC;AAAA,QACpD,GAAI,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,MACzC,EAAE;AACF,YAAM,SAAS,KAAK,OAAO,IAAI,WAAW;AAC1C,YAAM,aAAa,KAAK,aAAa,CAAC,GAAG,IAAI,aAAa;AAC1D,YAAM,QAAkB,CAAC;AACzB,UAAI,UAAU,SAAS,GAAG;AACxB,cAAM,KAAK,cAAc;AAAA,MAC3B;AACA,UAAI,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,MAAM,CAAC,EAAE,OAAO,SAAS,GAAG;AAC5E,cAAM,KAAK,kBAAkB;AAAA,MAC/B;AACA,UAAI,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,MAAM,EAAE,OAAO,SAAS,GAAG;AAC3E,cAAM,KAAK,sBAAsB;AAAA,MACnC;AACA,UAAI,CAAC,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU,EAAE,UAAU,UAAU,GAAG;AAC/F,cAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,QACJ;AAAA,MACF;AACA,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ,MAAM,EAAE,SAAS,QAAQ,UAAU;AAAA,QACnC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,IAAM,cAAc;AAAA,EAClB,QAAQ,EAAE,MAAM,UAAU,aAAa,uDAAuD,UAAU,KAAK;AAAA,EAC7G,OAAO,EAAE,MAAM,UAAU,aAAa,wCAAwC,UAAU,MAAM;AAChG;AAEA,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM;AACR,CAAC;AAED,IAAM,iBAAiB,cAAc;AAAA,EACnC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQf;AAAA,EACA,MAAM;AAAA,EACN,KAAK,OAAO,EAAE,KAAK,MAAM;AACvB,UAAM,SAAS,wBAAwB,UAAU,EAAE,QAAQ,KAAK,QAAQ,OAAO,KAAK,MAAM,CAAC;AAC3F,QAAI,CAAC,OAAO,SAAS;AACnB,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ,OAAO,EAAE,MAAM,oBAAoB,SAAS,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,oBAAoB;AAAA,MACrG,CAAC;AACD,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI;AACF,YAAM,OAAO,aAAa;AAC1B,YAAM,OAAO,MAAM,OAA2B,oBAAoB;AAAA,QAChE,QAAQ,OAAO,KAAK;AAAA,QACpB,OAAO,OAAO,OAAO,KAAK,KAAK;AAAA,QAC/B,GAAI,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,MACvC,CAAC;AACD,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,MAAM,KAAK;AAAA,UACX,GAAI,KAAK,WAAW,SAAS,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,QAChE;AAAA,QACA,OAAO,aAAa,KAAK,MAAM,EAAE,WAAW,KAAK,aAAa,CAAC,EAAE,CAAC;AAAA,MACpE,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC;AACT,CAAC;AAED,IAAM,cAAc,cAAc;AAAA,EAChC,MAAM,EAAE,MAAM,QAAQ,aAAa,2DAA2D;AAAA,EAC9F,KAAK,YAAY;AACf,QAAI;AACF,YAAM,OAAO,aAAa;AAC1B,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA,OAAO,EAAE,cAAc,KAAK,IAAI;AAAA,MAClC;AACA,gBAAU;AAAA,QACR,IAAI;AAAA;AAAA;AAAA,QAGJ,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,GAAG,QAAQ,QAAQ,QAAW,GAAG,YAAY,MAAM,EAAE,EAAE;AAAA,QAC7F,GAAI,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,IACjD;AAAA,UACE,OAAO,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,MAAM,CAAC,EAAE,OAAO,SAAS,IAC3E,CAAC,kBAAkB,IACnB,CAAC,sBAAsB;AAAA,QAC7B,IACA,CAAC;AAAA,MACP,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM;AAAA,IACJ,MAAM,EAAE,MAAM,UAAU,aAAa,qDAAgD,UAAU,KAAK;AAAA,IACpG,KAAK;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,OAAO,EAAE,MAAM,UAAU,aAAa,qDAAqD,UAAU,MAAM;AAAA,IAC3G,QAAQ,EAAE,MAAM,UAAU,aAAa,yCAAyC,UAAU,MAAM;AAAA,EAClG;AACF,CAAC;AAED,IAAM,aAAa,cAAc;AAAA,EAC/B,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUf;AAAA,EACA,MAAM;AAAA,IACJ,MAAM,EAAE,MAAM,UAAU,aAAa,gCAAgC,UAAU,KAAK;AAAA,IACpF,KAAK;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,IACA,OAAO,EAAE,MAAM,UAAU,aAAa,qDAAqD,UAAU,MAAM;AAAA,IAC3G,QAAQ,EAAE,MAAM,UAAU,aAAa,yCAAyC,UAAU,MAAM;AAAA,EAClG;AAAA,EACA,KAAK,OAAO,EAAE,MAAM,QAAQ,MAAM;AAChC,QAAI;AACF,YAAM,QAAQ,WAAW,KAAK,KAAK;AACnC,YAAM,OAAO,aAAa;AAC1B,YAAM,UAAU,aAAa,KAAK,QAAQ,OAAO;AACjD,YAAM,OAAO,MAAM,QAA0B,mBAAmB;AAAA,QAC9D,MAAM,KAAK;AAAA,QACX,KAAK,KAAK;AAAA,QACV;AAAA,QACA,GAAI,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,QACrC,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC/B,CAAC;AACD,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ;AAAA,QACA,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,aAAa,yBAAyB,UAAU,KAAK,EAAE;AACzF,CAAC;AAED,IAAM,gBAAgB,cAAc;AAAA,EAClC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIf;AAAA,EACA,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,aAAa,yBAAyB,UAAU,KAAK,EAAE;AAAA,EACvF,KAAK,OAAO,EAAE,KAAK,MAAM;AACvB,QAAI;AACF,YAAM,OAAO,aAAa;AAC1B,YAAM,OAAO,MAAM,QAA8B,0BAA0B;AAAA,QACzE,MAAM,KAAK;AAAA,QACX,GAAI,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,MACvC,CAAC;AACD,gBAAU,EAAE,IAAI,MAAM,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,IAAM,iBAAiB;AAAA,EACrB,MAAM,EAAE,MAAM,UAAU,aAAa,oDAAoD,UAAU,KAAK;AAC1G;AAEA,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM;AACR,CAAC;AAED,IAAM,gBAAgB,cAAc;AAAA,EAClC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIf;AAAA,EACA,MAAM;AAAA,EACN,KAAK,OAAO,EAAE,KAAK,MAAM;AACvB,UAAM,SAAS,iCAAiC,UAAU,EAAE,MAAM,KAAK,MAAM,cAAc,aAAa,EAAE,CAAC;AAC3G,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,IAAI,SAAS,oBAAoB,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,mBAAmB,CAAC;AAAA,IAC/F;AACA,QAAI;AACF,YAAM,OAAO,MAAM,QAAiC,0BAA0B,OAAO,IAAI;AACzF,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ;AAAA,QACA,OAAO;AAAA,UACL,KAAK,KACD,6EACA,KAAK,YACH,yBACA;AAAA,QACR;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,eAAe;AAAA,EACb,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM;AACR,CAAC;AAED,IAAM,iBAAiB,cAAc;AAAA,EACnC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIf;AAAA,EACA,MAAM;AAAA,EACN,KAAK,OAAO,EAAE,KAAK,MAAM;AACvB,UAAM,SAAS,iCAAiC,UAAU,EAAE,MAAM,KAAK,MAAM,cAAc,aAAa,EAAE,CAAC;AAC3G,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,IAAI,SAAS,oBAAoB,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,mBAAmB,CAAC;AAAA,IAC/F;AACA,QAAI;AACF,YAAM,OAAO,MAAM,QAAkC,2BAA2B,OAAO,IAAI;AAC3F,gBAAU;AAAA,QACR,IAAI;AAAA,QACJ;AAAA,QACA,OAAO;AAAA,UACL;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,GAAG;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAEM,IAAM,aAAa,cAAc;AAAA,EACtC,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBf;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF,CAAC;","names":[]}