@koda-sl/baker-cli 0.477.0-dev.55c09e3e8 → 0.495.0-dev.c2b64ccca

package/dist/chunk-BDMZRWQI.js

@@ -0,0 +1,433 @@
+import {
+  INGEST_MODES,
+  INGEST_MODE_HEADER
+} from "./chunk-GRQ2AXDX.js";
+import {
+  MATCH_FIELD_FORWARDING
+} from "./chunk-EDLZGTGN.js";
+import {
+  EVENT_INGEST_BATCH_MAX,
+  EVENT_INGEST_BODY_MAX_BYTES,
+  EVENT_INGEST_REQUESTS_PER_MINUTE,
+  FUTURE_TOLERANCE_MS,
+  MAX_EVENT_NAME,
+  REJECTION_CODES,
+  STANDARD_EVENT_NAMES
+} from "./chunk-MV2J73HP.js";
+
+// ../api/src/event-ingest/arrivals.ts
+import { z } from "zod";
+var INGEST_ARRIVALS_MAX = 200;
+var INGEST_ARRIVALS_DEFAULT = 25;
+var ingestArrivalsRequestSchema = z.object({
+  /** `test` shows only rehearsals, `live` only real traffic. Absent shows both. */
+  mode: z.enum(INGEST_MODES).optional(),
+  /** `rejected` is the one worth asking for on its own — it is the whole reason to look. */
+  outcome: z.enum(["accepted", "rejected"]).optional(),
+  /** Narrow to one event name, for a company posting several kinds. */
+  eventName: z.string().max(120).optional(),
+  limit: z.coerce.number().int().positive().max(INGEST_ARRIVALS_MAX).optional().default(INGEST_ARRIVALS_DEFAULT),
+  /** Include the masked raw body and the per-field previews. Off by default — it is most of the bytes. */
+  full: z.boolean().optional()
+});
+
+// ../api/src/event-ingest/endpoint.ts
+var EVENT_INGEST_PATH = "/v1/events";
+function eventIngestUrl(brandedUrl, convexSiteUrl) {
+  if (brandedUrl) return `${brandedUrl.replace(/\/$/, "")}${EVENT_INGEST_PATH}`;
+  return `${convexSiteUrl.replace(/\/$/, "")}${EVENT_INGEST_PATH}`;
+}
+var MODE_HINT = `
+# Rehearse the same request: add -H '${INGEST_MODE_HEADER}: test'
+# It is validated and answered exactly the same way, and nothing is written.`;
+function eventIngestCurl(url, apiKey) {
+  const body = JSON.stringify({
+    events: [
+      {
+        event_name: "deal_won",
+        user_data: { email: "person@example.com" },
+        value: "1200.00",
+        currency: "EUR"
+      }
+    ]
+  });
+  return [
+    `curl -X POST ${url} \\`,
+    `  -H 'Authorization: Bearer ${apiKey}' \\`,
+    `  -H 'Content-Type: application/json' \\`,
+    `  -d '${body}'`
+  ].join("\n") + MODE_HINT;
+}
+function eventSourceCurl(url) {
+  const body = JSON.stringify({
+    events: [
+      {
+        event_name: "deal_won",
+        user_data: { email: "person@example.com" },
+        value: "1200.00",
+        currency: "EUR"
+      }
+    ]
+  });
+  return [`curl -X POST ${url} \\`, `  -H 'Content-Type: application/json' \\`, `  -d '${body}'`].join("\n");
+}
+
+// ../api/src/event-ingest/fields.ts
+var BODY_MAX_MB = EVENT_INGEST_BODY_MAX_BYTES / (1024 * 1024);
+var FUTURE_TOLERANCE_MINUTES = FUTURE_TOLERANCE_MS / 6e4;
+var HEADER_FIELDS = [
+  { name: "Authorization", need: "required", takes: "Bearer <your sending key>" },
+  { name: "Content-Type", need: "required", takes: "application/json" },
+  {
+    name: "X-Baker-Mode",
+    need: "optional",
+    takes: "live (the default) or test.",
+    // Deliberately says what a test send *is* rather than "see step 4". Every
+    // note here is read twice — on this screen, where the step below explains
+    // it in full, and inside the Markdown brief, where there are no steps and
+    // a cross-reference points at nothing.
+    note: "A test send is authenticated and validated identically and stores nothing. An unrecognised value is refused rather than assumed."
+  }
+];
+var EVENT_FIELDS = [
+  {
+    name: "event_name",
+    need: "required",
+    takes: `What happened. Up to ${MAX_EVENT_NAME} characters of letters, digits, spaces, . _ and -, starting with a letter or a digit`,
+    note: 'The only required field. Use one of the standard names below wherever one fits \u2014 anything else is yours to invent, in whatever language you name things in: a letter is a letter in any script, and "Matr\xEDcula Realizada" is a name.'
+  },
+  {
+    name: "event_time",
+    need: "optional",
+    takes: "ISO-8601 with an offset (2026-09-08T13:23:41Z), or Unix seconds (1757337821).",
+    note: `Left out, it is the moment we received it. Nothing is refused for being old \u2014 a backfill of last year's history is what this is for. More than ${FUTURE_TOLERANCE_MINUTES} minutes in the future is refused.`
+  },
+  {
+    name: "event_id",
+    need: "optional",
+    takes: "Your own id for this event: 1\u2013128 characters of letters, digits, and . _ : -",
+    note: "Send one only if you want it deduplicated \u2014 the same id twice is counted once. Send none and every post is its own event."
+  },
+  {
+    name: "user_data",
+    need: "required",
+    takes: "Who it was about. At least one field below \u2014 this is the whole of how a server event finds the person who visited a Baker page or your website.",
+    note: "No field is required on its own and the block is: an event naming nobody is refused with missing_identity. The one exception is a page_view carrying a url, because a page serve is a fact about a page."
+  },
+  {
+    name: "email",
+    need: "optional",
+    under: true,
+    takes: "The address, or its SHA-256 digest if you already hash. Either \u2014 we tell them apart.",
+    note: "Send this one if you can. It is the road that cannot silently fail: we normalise and hash it here, so it lands on exactly the person a Baker page or the pixel already recorded."
+  },
+  {
+    name: "phone",
+    need: "optional",
+    under: true,
+    takes: "The number with its country code, or its digest. Same treatment as email."
+  },
+  {
+    name: "external_id",
+    need: "optional",
+    under: true,
+    takes: "Your own id for the person \u2014 a CRM contact key.",
+    note: "Kept exactly as you send it, and hashed alongside so it joins: your own events to each other, and to a browser once one event carries it beside an email or a baker_id."
+  },
+  {
+    name: "baker_id",
+    need: "optional",
+    under: true,
+    takes: "The Baker ID one of our pages already gave this browser, if you kept it.",
+    note: "The strongest of all of them: it names the visit, so the event lands on that person's timeline rather than beside it."
+  },
+  {
+    name: "the ad click ids",
+    need: "optional",
+    under: true,
+    takes: "The click id that brought them, if you kept it, under the name the platform stamps on the link: gclid, wbraid, gbraid, dclid, fbclid, ttclid, twclid, li_fat_id, msclkid, rdt_cid, epik, sccid (Snapchat's ScCid, in any case), oppref (ChatGPT Ads).",
+    note: "A click id names a person too \u2014 it is enough on its own, and it attributes the event to the campaign that earned it."
+  },
+  {
+    name: "fbp, fbc",
+    need: "optional",
+    under: true,
+    takes: "Meta's own browser cookies (_fbp, _fbc), exactly as your site stored them.",
+    note: "Enough on their own, and worth sending: they are what Meta matches a server event on. We read the click id out of an fbc for you."
+  },
+  {
+    name: "the matching fields",
+    need: "optional",
+    under: true,
+    takes: "first_name, last_name, date_of_birth, gender, city, region, postal_code, country \u2014 Meta's advanced matching and Google's enhanced conversions, in one block. Plain or already hashed.",
+    note: "They name nobody here, so they never satisfy user_data on their own. They are kept so this event can be sent on to Meta or Google later without asking you for it all again."
+  },
+  {
+    name: "url",
+    need: "optional",
+    takes: "The full page URL this happened on.",
+    note: "Its query string is where campaign parameters and ad click ids are read from. Without it the event counts, and belongs to no page."
+  },
+  {
+    name: "value",
+    need: "optional",
+    takes: "What it was worth: a decimal string or a JSON number. No thousands separator, no sign, no exponent.",
+    note: 'Rounded to what the currency holds \u2014 1200.999 EUR is stored as 1201.00. "1,200" is refused.'
+  },
+  {
+    name: "currency",
+    need: "conditional",
+    takes: "An ISO-4217 code, e.g. EUR. Required whenever value is present, and refused on its own."
+  },
+  {
+    name: "properties",
+    need: "optional",
+    takes: "A flat object of strings \u2014 anything you want to break the event down by later."
+  }
+];
+var RESPONSE_FIELDS = [
+  {
+    name: "mode",
+    need: "required",
+    takes: "live or test, echoed back \u2014 so a forgotten header is visible in the reply rather than in a report next week."
+  },
+  { name: "received", need: "required", takes: "How many events we read, so you can detect a truncated body." },
+  { name: "accepted", need: "required", takes: "How many were counted." },
+  {
+    name: "rejected",
+    need: "required",
+    takes: "One entry per refused event: index, event_id, code, message.",
+    note: "index is the position in your own array, and is the one to branch on \u2014 event_id is empty for an event that sent none."
+  }
+];
+var REJECTION_CODE_LIST = REJECTION_CODES;
+var BATCH_LIMITS = {
+  events: EVENT_INGEST_BATCH_MAX,
+  megabytes: BODY_MAX_MB,
+  requestsPerMinute: EVENT_INGEST_REQUESTS_PER_MINUTE
+};
+
+// ../api/src/event-ingest/brief.ts
+var KEY_ENV_VAR = "BAKER_EVENTS_KEY";
+var KEY_PLACEHOLDER = "<your sending key>";
+var NEED_WORD = {
+  required: "required",
+  optional: "optional",
+  conditional: "conditional"
+};
+function cell(text) {
+  return text.replaceAll("<", "\\<").replaceAll("|", "\\|");
+}
+function table(fields) {
+  const rows = fields.map((field) => {
+    const name = field.under === true ? `\u21B3 \`${field.name}\`` : `\`${field.name}\``;
+    const note = field.note === void 0 ? "" : `<br>${cell(field.note)}`;
+    return `| ${name} | ${NEED_WORD[field.need]} | ${cell(field.takes)}${note} |`;
+  });
+  return ["| Field | | What it takes |", "| --- | --- | --- |", ...rows].join("\n");
+}
+function standardNames() {
+  return [
+    "| Name | Means |",
+    "| --- | --- |",
+    ...STANDARD_EVENT_NAMES.map((standard) => `| \`${standard.name}\` | ${standard.means} |`)
+  ].join("\n");
+}
+function forwarding() {
+  return [
+    "| Field | Meta | Google | Held as |",
+    "| --- | --- | --- | --- |",
+    ...MATCH_FIELD_FORWARDING.map(
+      (row) => `| \`${row.field}\` | \`${row.meta}\` | ${row.google === null ? "\u2014" : `\`${row.google}\``} | ${row.hashed ? "SHA-256" : "plain text"} |`
+    )
+  ].join("\n");
+}
+function ingestBrief(endpointUrl) {
+  return brief(endpointUrl, "key");
+}
+function keyRules(door) {
+  if (door === "address") {
+    return `1. **The address is the credential. Never put it in source, and never paste it into a chat.**
+   Read it from \`BAKER_EVENTS_URL\` and ask the person for the value \u2014 they can copy it
+   from Baker \u2192 Measure \u2192 Sources, on the source's own page.
+2. **The first send is a rehearsal.** While the source reads "Waiting for your first event"
+   in Baker, every request is parsed, validated and answered exactly as a live one and
+   **stores nothing**; the person then confirms what to read from it and it counts from
+   there. Nothing about the integration changes when it does.`;
+  }
+  return `1. **Never put the sending key in source, and never paste it into a chat.** It is
+   deliberately not in this document. Read it from \`${KEY_ENV_VAR}\` and ask the person
+   for the value \u2014 they can copy it from Baker \u2192 Measure \u2192 Events \u2192 Sending events.
+2. **Send \`X-Baker-Mode: test\` while you build.** A test request is authenticated,
+   parsed and validated in exactly the same way and answers in exactly the same shape,
+   and **stores nothing**. Remove the header to go live. There is no separate test key
+   and no separate endpoint, so nothing about the integration changes when it does.`;
+}
+function brief(endpointUrl, door) {
+  const { events, megabytes, requestsPerMinute } = BATCH_LIMITS;
+  const headers = door === "address" ? HEADER_FIELDS.filter((field) => field.name === "Content-Type") : HEADER_FIELDS;
+  const credentialRow = door === "address" ? "| `404` | Nothing is listening at this address: it is wrong, or the source was removed. | Fix the address. Do not retry. |" : "| `401` | The key is missing, wrong, or not a sending key. | Fix the credential. Do not retry. |";
+  const request = door === "address" ? eventSourceCurl(endpointUrl) : eventIngestCurl(endpointUrl, KEY_PLACEHOLDER);
+  return `# Send events to Baker's API from your server
+
+You are being handed this by somebody who wants an integration built against it. It is
+the complete contract for ${door === "address" ? "a Baker source's address" : "`POST /v1/events`"} on **their own Baker endpoint**, taken from
+the code that enforces it. Build from this document; you should not need to look
+anything else up.
+
+Baker measures what happens on the pages it publishes. This endpoint is how everything
+that happens *away* from those pages \u2014 a deal closing in a CRM, a subscription starting,
+an order shipping \u2014 reaches the same reports, joined to the same person.
+
+## Read this before you write anything
+
+${keyRules(door)}
+3. **A \`200\` does not mean it counted.** The body carries \`rejected[]\`, one entry per
+   refused event. Read it and log it on every response. Throwing it away is the single
+   most common way an integration against this endpoint is wrong and looks right.
+4. **Batch.** Up to ${events} events and ${megabytes} MB per request, and at most
+   ${requestsPerMinute} requests per minute for the whole company. One event per request
+   works and will exhaust that budget on any real backfill. Every event is judged on its
+   own, so one bad row is refused and the rest of the batch still counts.
+5. **Retry \`5xx\` and \`429\`, never \`4xx\`.** A \`4xx\` means the request is wrong and
+   will be wrong again. If you retry, send the same \`event_id\` \u2014 that is what makes the
+   retry count once.
+6. **A refund is its own event, not a negative amount.** \`value\` may not be negative.
+   Send an event with its own name and let the reports subtract.
+7. **You cannot declare a conversion.** Whether an event counts as one is a decision the
+   client makes in Baker, against the event's name, and it applies retroactively to
+   everything already sent under that name. Nothing in the payload can assert it.
+8. **Ask, do not guess.** Which events matter and where the person's email lives in their
+   system are things this document cannot tell you. Ask.
+
+## Endpoint
+
+\`\`\`
+POST ${endpointUrl}
+\`\`\`
+
+### Headers
+
+${table(headers)}
+
+### Body
+
+\`\`\`json
+{ "events": [ { "event_name": "..." } ] }
+\`\`\`
+
+Up to ${events} events and ${megabytes} MB per request.
+
+## The event
+
+The field names are Meta's. If you have written an integration against Meta's Conversions
+API or Google Ads' offline conversion upload, this is the same payload: \`event_name\`,
+\`event_time\`, \`event_id\`, \`user_data\`, \`value\`, \`currency\`.
+
+${table(EVENT_FIELDS)}
+
+### Naming the person is the part that matters
+
+\`user_data\` is required and every field in it is optional, which is not a contradiction:
+the event has to name **somebody**, and there are several ways to do it. An event that
+names nobody is refused with \`missing_identity\`.
+
+Ranked by how well each works, best first:
+
+1. \`baker_id\` \u2014 the id a Baker page already gave that browser. It names the *visit*, so
+   the event lands on a real session's timeline. Send it if the client's system kept it.
+2. \`email\` or \`phone\` \u2014 the road that cannot silently fail. Send the plain value if you
+   can: we normalise and hash it here under the same rule the browser uses, so it lands
+   on exactly the person the pages already recorded. If policy forbids sending it plain,
+   send the SHA-256 digest **in the same field** \u2014 we detect which it is. Hash the
+   trimmed, lower-cased address; for a phone, digits with a leading \`+\`.
+3. \`external_id\` \u2014 the client's own key for the person, a CRM contact id. Stored as sent,
+   and hashed alongside so it joins.
+   On its own it joins that system's events to each other; send it **once** alongside an
+   email or a \`baker_id\` and every later event carrying only the contact id joins the
+   person too. That link is retroactive: it reaches back to everything already sent.
+4. A click id, \`fbp\` or \`fbc\` \u2014 names the click or the browser that brought them, which
+   is what a report attributes the event to.
+
+Send every one you have, not just the best. They cost nothing extra and each is a
+separate chance to match.
+
+### The matching fields, and where they go afterwards
+
+\`first_name\` \u2026 \`country\` never satisfy \`user_data\` on their own \u2014 they describe a
+person and name nobody. They are worth sending anyway: they are exactly what Meta's
+advanced matching and Google's enhanced conversions match on, and keeping them means the
+event can be forwarded later without going back to the client's CRM for it.
+
+${forwarding()}
+
+## Standard event names
+
+Nothing is refused for being absent from this list \u2014 send whatever the business calls a
+thing. These are the spellings Baker publishes so that two companies measuring the same
+thing measure it under the same word. \`page_view\` is the one with behaviour: it becomes
+a page view rather than a named event, and it is the only event that may arrive without a
+person as long as it carries a \`url\`.
+
+${standardNames()}
+
+## The response
+
+\`\`\`json
+{ "ok": true, "data": { "mode": "live", "received": 2, "accepted": 1,
+  "rejected": [ { "index": 1, "event_id": "", "code": "invalid_value",
+    "message": "value and currency go together: a non-negative decimal and an ISO-4217 code" } ] } }
+\`\`\`
+
+${table(RESPONSE_FIELDS)}
+
+\`code\` is a closed set \u2014 branch on it, not on \`message\`:
+
+${REJECTION_CODE_LIST.map((code) => `- \`${code}\``).join("\n")}
+
+There is no duplicate count, on purpose. A repeated \`event_id\` is accepted like any other
+event and counted **once** \u2014 one conversion, one event, its value added once \u2014 so a retry
+is safe and needs no branch of its own. Both requests are shown in Baker, with the later
+one marked "Already counted", so a retry is visible without being counted.
+
+The same holds **across connections**, which is the reason to use it. If the page also
+reports this outcome with Baker's website tag, pass one string as \`event_id\` here and as
+\`eventId\` in \`window.baker.track(name, { eventId })\`: the browser event and the
+server event are then one event and count once, whichever arrives first and whether or not
+the other ever does. Report an important outcome from both \u2014 a browser can be blocked, a
+server cannot \u2014 and always pair them with an id. Send no id and the two are two conversions,
+with nothing anywhere reporting an error.
+
+### HTTP statuses
+
+| Status | Means | Do |
+| --- | --- | --- |
+| \`200\` | The request was read. Individual events may still have been refused. | Read \`rejected[]\`. |
+| \`400\` | The body is not the shape above \u2014 an unknown field, or the wrong JSON type. | Fix the payload. Do not retry. |
+${credentialRow}
+| \`413\` | Over ${events} events or ${megabytes} MB. | Split the batch and re-post. |
+| \`429\` | Over ${requestsPerMinute} requests a minute for this company. | Back off and retry. |
+| \`5xx\` | Nothing was written. | Retry with the same \`event_id\`s. |
+
+## A request that works
+
+\`\`\`bash
+${request}
+\`\`\`
+
+## Once it is sending
+
+Every accepted event appears in Baker under **Measure \u2192 Events**, live, with what was
+sent. Test sends and refusals appear there too, filed separately and marked, with the
+payload \u2014 so "did my request arrive and what did it say" is answered on the screen rather
+than in the client's own logs. To make an event count as a conversion, the client marks
+it by name under **Conversions**.
+`;
+}
+
+export {
+  INGEST_ARRIVALS_MAX,
+  eventIngestUrl,
+  ingestBrief
+};
+//# sourceMappingURL=chunk-BDMZRWQI.js.map

package/dist/chunk-BITS62MF.js

@@ -0,0 +1,77 @@
+import {
+  classifyAudience
+} from "./chunk-KPYDTIAI.js";
+
+// src/audience-names.ts
+var BUYERS_QUESTION = `\`name\` is the name an advertiser gave a custom audience in their Meta ad account, in any language. Is it made of people who have already bought from the brand: purchasers, paying customers, clients, a customer list? People who only visited, engaged, signed up, started a checkout or are leads or prospects have not bought. A lookalike of buyers is not buyers.`;
+var BUYERS_HELD = 0.42;
+var LOOKALIKE_QUESTION = `\`name\` is the name an advertiser gave a custom audience in their Meta ad account, in any language. Is it a lookalike audience: new people Meta finds because they resemble a seed audience (often named "Lookalike (GB, 1%)", "LAL 3%", "Similar to\u2026")?`;
+var LOOKALIKE_HELD = 0.4;
+async function readAudienceNames(names, ask) {
+  const distinct = [...new Set(names.map((n) => n.trim()).filter(Boolean))];
+  if (distinct.length === 0) return () => void 0;
+  const answers = await ask(
+    distinct.flatMap((name) => [
+      { instructions: { name, question: BUYERS_QUESTION } },
+      { instructions: { name, question: LOOKALIKE_QUESTION } }
+    ])
+  );
+  if (answers === null) return () => void 0;
+  const read = new Map(
+    distinct.map((name, i) => [
+      name,
+      { buyers: (answers[2 * i] ?? 0) >= BUYERS_HELD, lookalike: (answers[2 * i + 1] ?? 0) >= LOOKALIKE_HELD }
+    ])
+  );
+  return (name) => read.get(name.trim());
+}
+
+// src/commands/ads/meta/adset-viewers.ts
+function adSetViewerRows(adSets, audiences, campaigns, readName) {
+  const campaignById = new Map(campaigns.map((campaign) => [campaign.id, campaign]));
+  return adSets.map((adSet) => ({
+    id: adSet.id,
+    name: adSet.name,
+    campaign_id: adSet.campaign_id,
+    effective_status: adSet.effective_status,
+    viewer: classifyAudience(adSet, audiences, campaignById.get(adSet.campaign_id), readName)
+  }));
+}
+var VIEWER_TABLE_COLUMNS = [
+  "id",
+  "name",
+  "effective_status",
+  "temperature",
+  "knows",
+  "placements",
+  "why"
+];
+function flattenViewerRows(rows) {
+  return rows.map(({ viewer, ...row }) => ({
+    id: row.id,
+    name: row.name,
+    effective_status: row.effective_status,
+    temperature: viewer.temperature,
+    knows: viewer.knows.length > 0 ? viewer.knows.join(", ") : "nothing yet",
+    placements: viewer.placements.join(", "),
+    why: viewer.reasons.join(" ")
+  }));
+}
+function audienceNamesOf(adSets, audiences) {
+  const refs = adSets.flatMap((adSet) => {
+    const targeting = adSet.targeting ?? {};
+    return [targeting.custom_audiences, targeting.excluded_custom_audiences].flatMap(
+      (list) => Array.isArray(list) ? list.map((ref) => ref?.name) : []
+    );
+  });
+  return [...refs, ...audiences.map((a) => a.name)].filter((n) => typeof n === "string" && n.length > 0);
+}
+
+export {
+  readAudienceNames,
+  adSetViewerRows,
+  VIEWER_TABLE_COLUMNS,
+  flattenViewerRows,
+  audienceNamesOf
+};
+//# sourceMappingURL=chunk-BITS62MF.js.map

package/dist/chunk-BVMXTD4B.js

@@ -0,0 +1,169 @@
+import {
+  readAvatars
+} from "./chunk-AN7CMLYY.js";
+import {
+  readCreativeContext,
+  workspaceOfCreative
+} from "./chunk-7XH4UQWS.js";
+import {
+  frontmatterOf,
+  ruleTells
+} from "./chunk-S4ROJTDY.js";
+import {
+  findWorkspaceRoot
+} from "./chunk-DS2ZRTAL.js";
+import {
+  isAdSpec,
+  nativeCopy,
+  readAdSpec
+} from "./chunk-5IGQ6IQO.js";
+import {
+  marketFromCompanyDoc
+} from "./chunk-KPYDTIAI.js";
+import {
+  apiPost
+} from "./chunk-OSWCEDFE.js";
+
+// src/engine/creative-context/ad-words.ts
+import { readdir, readFile } from "fs/promises";
+import path from "path";
+var json = (file) => readFile(file, "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
+var text = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+function waivedOf(spec) {
+  const waive = spec?.waive;
+  return Array.isArray(waive) ? waive.flatMap((w) => text(w?.rule) ?? []) : [];
+}
+function sceneWords(scene) {
+  const s = scene ?? {};
+  const spoken = Array.isArray(s.dialogue) ? s.dialogue.flatMap((d) => text(d?.line) ?? []) : [];
+  const shown = Array.isArray(s.overlays) ? s.overlays.flatMap((o) => text(o?.text) ?? []) : [];
+  return [...spoken, ...shown];
+}
+async function sceneFiles(creativeDir) {
+  const dir = path.join(creativeDir, "scenes");
+  const files = (await readdir(dir).catch(() => [])).filter((f) => f.endsWith(".json")).sort();
+  return await Promise.all(files.map((f) => json(path.join(dir, f))));
+}
+async function videoLanguage(creativeDir) {
+  const definition = frontmatterOf(await readFile(path.join(creativeDir, "_definition.md"), "utf8").catch(() => ""));
+  const beats = await json(path.join(creativeDir, "ad.spec.json"));
+  return text(definition?.language) ?? text(beats?.voice?.language);
+}
+async function videoWords(raw, creativeDir) {
+  const global = raw.global ?? {};
+  const transcript = text(global.transcript);
+  const scenes = [...Array.isArray(raw.scenes) ? raw.scenes : [], ...await sceneFiles(creativeDir)];
+  const lines = [.../* @__PURE__ */ new Set([...transcript ? [transcript] : [], ...scenes.flatMap(sceneWords)])];
+  const language = await videoLanguage(creativeDir);
+  return { kind: "video", lines, ...language ? { language } : {} };
+}
+function staticWords(raw) {
+  try {
+    const spec = readAdSpec(raw);
+    const lines = spec.native ? nativeCopy(spec.native) : spec.copy.map((l) => l.text);
+    const language = spec.viewer?.market?.language;
+    return { kind: "static", lines, ...language ? { language } : {} };
+  } catch {
+    return null;
+  }
+}
+async function readAdWords(creativeDir) {
+  const raw = await json(path.join(creativeDir, "prompt.json"));
+  if (!raw || typeof raw !== "object") return null;
+  const video = !isAdSpec(raw) && ("global" in raw || "scenes" in raw);
+  const words = video ? await videoWords(raw, creativeDir) : staticWords(raw);
+  if (!words) return null;
+  const product = text(raw.product);
+  const definition = frontmatterOf(await readFile(path.join(creativeDir, "_definition.md"), "utf8").catch(() => ""));
+  const platform = text(definition?.platform);
+  return { ...words, ...product ? { product } : {}, ...platform ? { platform } : {}, waived: waivedOf(raw) };
+}
+
+// src/commands/creatives/cast-inventory.ts
+import { readdir as readdir2 } from "fs/promises";
+import path2 from "path";
+var short = (text2, max) => text2.length > max ? `${text2.slice(0, max - 1).trimEnd()}\u2026` : text2;
+function avatarsOf(response) {
+  return response.avatars.filter((a) => a.status === "ready").map((a) => {
+    const real = a.likeness === "licensed" || Boolean(a.person);
+    const role = [a.person?.role, a.person?.company].filter(Boolean).join(" at ");
+    return { handle: a.handle, real, who: short(role || a.subjectDescription || a.name, 90) };
+  });
+}
+function customersOf(found) {
+  return found.filter((t) => t.sentiment !== "negative" && (t.highlight || t.reviewText).trim()).slice(0, 3).map((t) => ({
+    ...t.reviewerName ? { name: t.reviewerName } : {},
+    words: short((t.highlight || t.reviewText).trim().replace(/\s+/g, " "), 140),
+    source: t.sourceType,
+    photo: Boolean(t.reviewerImageUrl || t.reviewerImageId || t.imageIds?.length || t.videoIds?.length)
+  }));
+}
+var LOGO_FILE = /\.(svg|png|webp|jpe?g)$/i;
+async function castInventory(root, message, company) {
+  const [avatars, customers, logos] = await Promise.all([
+    readAvatars("/api/avatars", { status: "ready" }).then(avatarsOf, () => []),
+    apiPost("/api/testimonials/search", { query: message, limit: 6 }).then(
+      customersOf,
+      () => []
+    ),
+    readdir2(path2.join(root, "src", "brand", "logos")).then(
+      (files) => files.filter((f) => LOGO_FILE.test(f)).map((f) => `src/brand/logos/${f}`),
+      () => []
+    )
+  ]);
+  return { avatars, customers, logos, ...company ? { company } : {} };
+}
+
+// src/commands/canvas/rule-gate.ts
+import { readFile as readFile2 } from "fs/promises";
+import path3 from "path";
+function tellLine(tell) {
+  const where = tell.kind === "forbidden" ? `"${tell.line ?? ""}" says "${tell.phrase}"` : `No line says "${tell.phrase}"`;
+  const words = tell.quote ? ` Their words: ${tell.quote}` : "";
+  return `${where}: ${tell.rule} (${tell.strength}) \u2014 ${tell.text}${words}`;
+}
+function ruleRefusal(tells) {
+  if (tells.length === 0) return null;
+  return {
+    problems: tells.map(tellLine),
+    fix: 'Rewrite each line named above within its rule (a static: its `copy` in prompt.json; a video: its scene files and ad.spec.json), then re-run. Only when the person explicitly asked for these words in this ad, keep them and add to prompt.json `"waive": [{"rule": "<id>", "why": "<their ask>"}]`.'
+  };
+}
+var liveRoster = () => readAvatars("/api/avatars", { status: "ready" }).then(avatarsOf, () => null);
+async function heldRules(creativeDir, ad) {
+  const words = ad === void 0 ? await readAdWords(creativeDir) : ad;
+  const root = findWorkspaceRoot(creativeDir) ?? workspaceOfCreative(creativeDir);
+  const context = await readCreativeContext(
+    root,
+    {
+      ...words ? { kind: words.kind } : {},
+      ...words?.product ? { product: words.product } : {},
+      ...words?.platform ? { platform: words.platform } : {}
+    },
+    { waived: words?.waived ?? [] }
+  );
+  const language = words?.language ?? marketFromCompanyDoc(await readFile2(path3.join(root, "COMPANY.md"), "utf8").catch(() => null))?.language;
+  return { rules: context.rules, ...language ? { language } : {} };
+}
+async function ruleGate(creativeDir, roster = liveRoster) {
+  const ad = await readAdWords(creativeDir);
+  if (!ad) return { broken: null, realOnly: null };
+  const { rules, language } = await heldRules(creativeDir, ad);
+  const people = rules.find((r) => r.check?.people === "real" && r.strength !== "prefer");
+  return {
+    broken: ruleRefusal(ruleTells(ad.lines, rules, language)),
+    realOnly: people ? {
+      rule: { id: people.id, text: people.text, ...people.source.quote ? { quote: people.source.quote } : {} },
+      avatars: await roster().catch(() => null)
+    } : null
+  };
+}
+
+export {
+  readAdWords,
+  castInventory,
+  ruleRefusal,
+  heldRules,
+  ruleGate
+};
+//# sourceMappingURL=chunk-BVMXTD4B.js.map