@koda-sl/baker-cli 0.449.0 → 0.451.0-dev.b2a4eba2b

package/dist/chunk-VSA63D2N.js

@@ -0,0 +1,136 @@
+import {
+  handleConnectionError,
+  needsConnectionFix,
+  writeAdsJson
+} from "./chunk-XNMSJP2X.js";
+import {
+  ApiError
+} from "./chunk-PCKVSSVT.js";
+import {
+  getEnv
+} from "./chunk-UW36KPPH.js";
+
+// src/commands/ads/meta/shared.ts
+var DAY_MS = 864e5;
+function metaForbiddenFix(message) {
+  if (message.includes("has not accepted Meta's Lead Generation Terms")) {
+    return {
+      action: "reject",
+      explanation: `${message}
+
+Meta confirmed the Page's terms status using its Page access. Give the Page owner the terms link in the error and ask them to accept it before trying the form or lead ad set again. Do not suggest reconnecting Meta for this refusal; continue with other work that does not require the form or ad set.`
+    };
+  }
+  return {
+    action: "reject",
+    explanation: [
+      message,
+      "This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.",
+      "If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.",
+      "If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it \u2014 the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources \u2192 Datasets for a pixel).",
+      "Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why \u2014 never present the task as verified when this step was skipped."
+    ].join("\n\n")
+  };
+}
+function handleMetaError(err) {
+  if (err instanceof ApiError) {
+    if (needsConnectionFix(err.code, err.message)) {
+      handleConnectionError("meta_ads", err.message);
+    }
+    const envelope = {
+      ok: false,
+      error: {
+        code: err.code,
+        message: err.message,
+        fix: err.code === "FORBIDDEN" ? metaForbiddenFix(err.message) : { action: "reject", explanation: err.message },
+        retryable: err.code === "RATE_LIMITED" || err.code === "UNAVAILABLE" || err.code === "INTERNAL_ERROR"
+      }
+    };
+    writeAdsJson(envelope);
+    process.exit(1);
+  }
+  const message = err instanceof Error ? err.message : "Unexpected error";
+  writeAdsJson({ ok: false, error: { code: "NETWORK_ERROR", message } });
+  process.exit(1);
+}
+var ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;
+function resolveAccountIdArg(args) {
+  const fromArgs = args["account-id"];
+  const id = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;
+  if (!id) {
+    writeAdsJson({
+      ok: false,
+      error: {
+        code: "MISSING_ACCOUNT_ID",
+        message: "Pass --account-id or set BAKER_META_AD_ACCOUNT_ID. Run `baker ads meta accounts` to find IDs."
+      }
+    });
+    process.exit(1);
+  }
+  if (!ACCOUNT_ID_RE.test(id)) {
+    writeAdsJson({
+      ok: false,
+      error: {
+        code: "INVALID_ACCOUNT_ID",
+        message: `Invalid account ID "${id}". Expected numeric ID, optionally prefixed with "act_".`
+      }
+    });
+    process.exit(1);
+  }
+  return id.startsWith("act_") ? id : `act_${id}`;
+}
+function getDateRange(args) {
+  const datePreset = args["date-preset"];
+  const since = args.since;
+  const until = args.until;
+  if (since && until) return { since, until };
+  return { datePreset: datePreset ?? "last_7d" };
+}
+function todayIso() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function daysAgoIso(days) {
+  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);
+}
+function csvOrJson(args) {
+  return args.output ?? "json";
+}
+var NAME_CONTAINS_ARG = {
+  type: "string",
+  description: "Only rows whose name contains this text, matched by Meta before anything is returned. Start here to find one entity by name: --name-contains octubre --all-statuses"
+};
+function resolveEffectiveStatus(args) {
+  if (args["all-statuses"]) {
+    return void 0;
+  }
+  const explicit = args["effective-status"];
+  if (explicit) {
+    return explicit;
+  }
+  return "ACTIVE";
+}
+function statusFilterHints(rows, effectiveStatus, noun) {
+  if (rows.length > 0 || effectiveStatus === void 0) return [];
+  if (effectiveStatus === "ACTIVE") {
+    return [
+      `No ACTIVE ${noun}. The ACTIVE filter hides paused, archived and in-review ones (under a paused campaign or ad set that is all of them), so this does NOT mean none exist. Re-run with --all-statuses before concluding there are none.`
+    ];
+  }
+  return [
+    `No ${noun} with effective_status ${effectiveStatus}. Re-run with --all-statuses to see every status before concluding there are none.`
+  ];
+}
+
+export {
+  metaForbiddenFix,
+  handleMetaError,
+  resolveAccountIdArg,
+  getDateRange,
+  todayIso,
+  daysAgoIso,
+  csvOrJson,
+  NAME_CONTAINS_ARG,
+  resolveEffectiveStatus,
+  statusFilterHints
+};
+//# sourceMappingURL=chunk-VSA63D2N.js.map

package/dist/chunk-VVS5TLDG.js

@@ -0,0 +1,333 @@
+import {
+  captureProxyCredentials,
+  isChallengeBody,
+  isPrivateAddress,
+  isProxyFailure,
+  nextPlannedRoute,
+  plannedRoutes,
+  refuseNonPublicUrl,
+  shouldEscalate
+} from "./chunk-UW36KPPH.js";
+
+// ../proxy/src/fetch.ts
+import { lookup as dnsLookup } from "dns";
+import { Agent, ProxyAgent, Response, fetch as undiciFetch } from "undici";
+
+// ../proxy/src/fetchDecision.ts
+function classifyFetchOutcome(signal) {
+  if (isProxyFailure(signal)) return "proxy_unavailable";
+  if (shouldEscalate(signal)) return "blocked";
+  if (signal.status != null && signal.status >= 200 && signal.status < 400 && !signal.challenge) return "ok";
+  return "failed";
+}
+function shouldTryNextRoute(outcome) {
+  return outcome === "blocked" || outcome === "proxy_unavailable";
+}
+var TIMEOUT_CODES = /* @__PURE__ */ new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "ETIMEDOUT"
+]);
+var RESET_CODES = /* @__PURE__ */ new Set(["ECONNRESET", "UND_ERR_SOCKET", "EPIPE"]);
+var PROXY_RESPONSE = /Proxy response \((\d+)\)/;
+function errorCode(error) {
+  if (typeof error !== "object" || error === null) return null;
+  const code = error.code;
+  if (typeof code === "string") return code;
+  const name = error.name;
+  return typeof name === "string" ? name : null;
+}
+function errorMessage(error) {
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    if (typeof message === "string") return message;
+  }
+  return String(error);
+}
+function errorBlockSignal(error, proxied) {
+  const proxyResponse = PROXY_RESPONSE.exec(errorMessage(error));
+  if (proxyResponse) {
+    const status = Number(proxyResponse[1]);
+    return status === 407 ? { status: 407 } : { netError: "ERR_TUNNEL_CONNECTION_FAILED" };
+  }
+  const code = errorCode(error);
+  if (code !== null && TIMEOUT_CODES.has(code)) return { timedOut: true };
+  if (code === "AbortError" || code === "TimeoutError") return { timedOut: true };
+  if (proxied) {
+    return { netError: "ERR_PROXY_CONNECTION_FAILED" };
+  }
+  if (code !== null && RESET_CODES.has(code)) return { netError: "ERR_CONNECTION_RESET" };
+  return { netError: code ?? "ERR_FAILED" };
+}
+function shouldSniffChallenge(contentType, contentLength, maxSniffBytes) {
+  if (contentLength !== null && contentLength > maxSniffBytes) return false;
+  if (contentType === null || contentType.trim() === "") return true;
+  const type = contentType.toLowerCase();
+  if (type.startsWith("image/") || type.startsWith("video/") || type.startsWith("audio/")) return false;
+  return type.includes("text/") || type.includes("html") || type.includes("json") || type.includes("xml");
+}
+
+// ../proxy/src/fetch.ts
+var DEFAULT_TIMEOUT_MS = 6e4;
+var MAX_SNIFF_BYTES = 64 * 1024;
+function tierOf(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function agentFor(route) {
+  if (route.kind !== "proxy") return directAgent();
+  const token = Buffer.from(`${route.username}:${route.password}`).toString("base64");
+  return new ProxyAgent({ uri: route.server, token: `Basic ${token}` });
+}
+function directAgent() {
+  return new Agent({
+    connect: {
+      lookup: (hostname, options, callback) => {
+        dnsLookup(hostname, options, (error, address, family) => {
+          if (error) {
+            callback(error, address, family);
+            return;
+          }
+          const found = Array.isArray(address) ? address.map((entry) => entry.address) : [address];
+          const blocked = found.find((entry) => isPrivateAddress(entry));
+          if (blocked !== void 0) {
+            callback(new Error(`${PRIVATE_ADDRESS_CODE}: ${hostname} resolves to ${blocked}`), "", 4);
+            return;
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+var PRIVATE_ADDRESS_CODE = "EPRIVATEADDR";
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function refuseRedirect(entry, to) {
+  if (refuseNonPublicUrl(to) === null) return false;
+  const destination = originOf(to);
+  return destination === null || destination !== originOf(entry);
+}
+async function followRedirects(url, init) {
+  let current = url;
+  let request = { ...init, redirect: "manual" };
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await undiciFetch(current, request);
+    const location = response.headers.get("location");
+    if (!REDIRECT_STATUS.has(response.status) || location === null) return response;
+    await response.body?.cancel();
+    const next = new URL(location, current).toString();
+    if (refuseRedirect(url, next)) {
+      throw new Error(`${PRIVATE_ADDRESS_CODE}: redirected to ${next}`);
+    }
+    const method = (request.method ?? "GET").toUpperCase();
+    const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST";
+    request = downgrade ? { ...request, method: "GET", body: void 0 } : request;
+    current = next;
+  }
+  throw new Error(`too many redirects following ${url}`);
+}
+var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function rebuild(response, body) {
+  if (response.status < 200 || response.status > 599 || NULL_BODY_STATUS.has(response.status)) {
+    return new Response(null, { status: response.status, headers: response.headers });
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function declaredLength(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function readOnce(response, sniff, maxBytes) {
+  const declared = declaredLength(response);
+  if (maxBytes !== void 0 && declared !== null && declared > maxBytes) {
+    await response.body?.cancel();
+    return { response: rebuild(response, new ArrayBuffer(0)), challenge: false };
+  }
+  const body = await response.arrayBuffer();
+  const wantsSniff = sniff && shouldSniffChallenge(response.headers.get("content-type"), body.byteLength, MAX_SNIFF_BYTES);
+  const challenge = wantsSniff ? isChallengeBody(new TextDecoder().decode(body)) : false;
+  return { response: rebuild(response, body), challenge };
+}
+async function attemptRoute(url, init, route, options) {
+  const tier = tierOf(route);
+  const agent = agentFor(route);
+  const startedAt = Date.now();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+  try {
+    const raw = await followRedirects(url, { ...init, dispatcher: agent ?? void 0, signal });
+    const read = await readOnce(raw, options.sniffChallenge ?? true, options.maxBytes);
+    const outcome = classifyFetchOutcome({ status: raw.status, challenge: read.challenge });
+    return {
+      attempt: { tier, status: raw.status, ms: Date.now() - startedAt, outcome },
+      response: outcome === "proxy_unavailable" ? null : read.response
+    };
+  } catch (error) {
+    const blockSignal = errorBlockSignal(error, route.kind === "proxy");
+    return {
+      attempt: {
+        tier,
+        status: blockSignal.status ?? void 0,
+        ms: Date.now() - startedAt,
+        outcome: classifyFetchOutcome(blockSignal)
+      },
+      response: null,
+      error
+    };
+  } finally {
+    await agent?.close();
+  }
+}
+async function fetchWithEscalation(url, init, options) {
+  const attempts = [];
+  let originResponse = null;
+  let originTier = "direct";
+  let lastError;
+  const routes = plannedRoutes(url, options.credentials, options.routeOptions);
+  const tried = [];
+  for (let route = routes[0] ?? null; route !== null; route = nextPlannedRoute(routes, tried)) {
+    const rung = await attemptRoute(url, init, route, options);
+    attempts.push(rung.attempt);
+    tried.push({ tier: rung.attempt.tier, proxyFailure: rung.attempt.outcome === "proxy_unavailable" });
+    if (rung.response !== null) {
+      originResponse = rung.response;
+      originTier = rung.attempt.tier;
+    }
+    if (rung.error !== void 0) lastError = rung.error;
+    if (!shouldTryNextRoute(rung.attempt.outcome)) break;
+  }
+  return {
+    response: originResponse,
+    attempts,
+    finalTier: originResponse !== null ? originTier : lastAttempt(attempts)?.tier ?? "direct",
+    ...originResponse === null && lastError !== void 0 ? { error: lastError } : {}
+  };
+}
+function lastAttempt(attempts) {
+  return attempts[attempts.length - 1];
+}
+function describeLadder(result) {
+  const rungs = result.attempts.map((a) => `${a.tier}:${a.outcome}${a.status ? `(${a.status})` : ""}@${a.ms}ms`);
+  return `${rungs.join(" \u2192 ")} | final=${result.finalTier}`;
+}
+function rescued(result) {
+  return result.attempts.some((attempt) => attempt.outcome === "ok");
+}
+function endedBlocked(result) {
+  if (rescued(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "blocked");
+}
+function endedProxyUnavailable(result) {
+  if (rescued(result) || endedBlocked(result)) return false;
+  return result.attempts.some((attempt) => attempt.outcome === "proxy_unavailable");
+}
+function endedPrivateAddress(result) {
+  if (rescued(result)) return false;
+  for (let error = result.error, depth = 0; error instanceof Error && depth < 5; depth++) {
+    if (error.message.includes(PRIVATE_ADDRESS_CODE)) return true;
+    error = error.cause;
+  }
+  return false;
+}
+
+// src/lib/externalFetch.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
+  Accept: "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+  "Accept-Language": "en-US,en;q=0.9"
+};
+var NOT_PUBLIC_MESSAGE = "That address is not reachable from the public web, so there is nothing to read.";
+var MAX_REMOTE_IMAGE_BYTES = 25e6;
+var ExternalFetchError = class extends Error {
+  /** True when the fault was ours — a route we could not open, not a dead host. */
+  ourFault;
+  constructor(message, ourFault) {
+    super(message);
+    this.name = "ExternalFetchError";
+    this.ourFault = ourFault;
+  }
+};
+async function fetchExternal(url, options = {}) {
+  if (refuseNonPublicUrl(url) !== null) {
+    throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+  }
+  const result = await fetchWithEscalation(
+    url,
+    { headers: { ...BROWSER_HEADERS, ...options.headers } },
+    {
+      credentials: captureProxyCredentials(),
+      ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+      ...options.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes },
+      ...options.sniffChallenge === void 0 ? {} : { sniffChallenge: options.sniffChallenge }
+    }
+  );
+  if (result.attempts.length > 1) {
+    process.stderr.write(`fetch ladder ${url} \u2014 ${describeLadder(result)}
+`);
+  }
+  if (result.response === null) {
+    if (endedPrivateAddress(result)) {
+      throw new ExternalFetchError(NOT_PUBLIC_MESSAGE, false);
+    }
+    const ourFault = endedProxyUnavailable(result);
+    throw new ExternalFetchError(
+      ourFault ? "Could not open a route to that address." : "That address did not answer.",
+      ourFault
+    );
+  }
+  return { response: result.response, blocked: endedBlocked(result) };
+}
+function refuseOversize(bytes, maxBytes) {
+  if (bytes === null || bytes <= maxBytes) return null;
+  return `That file is ${humanBytes(bytes)} \u2014 the limit is ${humanBytes(maxBytes)}.`;
+}
+function humanBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.max(1, Math.round(n / 1024))} KB`;
+}
+function declaredBytes(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+async function fetchExternalBytes(url, options) {
+  const { response, blocked } = await fetchExternal(url, options);
+  if (!response.ok) {
+    throw new ExternalFetchError(`${response.status} ${response.statusText}`, false);
+  }
+  if (blocked) {
+    throw new ExternalFetchError("That host served a security check instead of the file.", false);
+  }
+  const declared = refuseOversize(declaredBytes(response), options.maxBytes);
+  if (declared !== null) {
+    throw new ExternalFetchError(declared, false);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const actual = refuseOversize(buffer.byteLength, options.maxBytes);
+  if (actual !== null) {
+    throw new ExternalFetchError(actual, false);
+  }
+  return { buffer, contentType: response.headers.get("content-type") };
+}
+
+export {
+  MAX_REMOTE_IMAGE_BYTES,
+  fetchExternalBytes
+};
+//# sourceMappingURL=chunk-VVS5TLDG.js.map