@koda-sl/baker-cli 0.513.0 → 0.514.0-dev.555f7007e

package/dist/chunk-FKP4ECJY.js

@@ -0,0 +1,19 @@
+import {
+  latestVersion
+} from "./chunk-AN4OEQXE.js";
+import {
+  canvasOutputsRoot
+} from "./chunk-EJGAJHLB.js";
+
+// src/commands/creatives/version-of.ts
+import path from "path";
+async function versionOf(slug, run) {
+  if (typeof run === "string" && run.trim()) return run.trim();
+  const canvas = path.join("src", "creatives", slug, `${slug}.canvas.json`);
+  return await latestVersion(canvasOutputsRoot(canvas), slug) ?? void 0;
+}
+
+export {
+  versionOf
+};
+//# sourceMappingURL=chunk-FKP4ECJY.js.map

package/dist/chunk-G4FG5EQO.js

@@ -0,0 +1,110 @@
+// ../api/src/identity/digest.ts
+var SHA256_HEX = /^[0-9a-fA-F]{64}$/;
+function isSha256Hex(value) {
+  return SHA256_HEX.test(value);
+}
+
+// ../api/src/identity/email.ts
+function normalizeEmailV1(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "" ? null : trimmed;
+}
+var EMAIL = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+function normalizeEmailV2(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return EMAIL.test(trimmed) ? trimmed : null;
+}
+
+// ../api/src/identity/phone.ts
+function normalizePhoneV1(raw) {
+  const digits = raw.trim().toLowerCase().replace(/[^0-9]/g, "");
+  return digits === "" ? null : `+${digits}`;
+}
+var PHONE_PUNCTUATION = /[\s()./-]/g;
+var E164 = /^\+[1-9]\d{7,14}$/;
+function normalizePhoneV2(raw) {
+  const compact = raw.replace(PHONE_PUNCTUATION, "");
+  const e164 = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(e164) ? e164 : null;
+}
+
+// ../api/src/identity/index.ts
+function normalizeIdentity(raw, version) {
+  const value = raw.kind === "email" ? version === 1 ? normalizeEmailV1(raw.value) : normalizeEmailV2(raw.value) : version === 1 ? normalizePhoneV1(raw.value) : normalizePhoneV2(raw.value);
+  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };
+}
+
+// ../api/src/event-ingest/matching.ts
+var MATCH_FIELDS = [
+  "first_name",
+  "last_name",
+  "date_of_birth",
+  "gender",
+  "city",
+  "region",
+  "postal_code",
+  "country"
+];
+var MATCH_COOKIES = ["fbp", "fbc"];
+function tightened(value) {
+  const stripped = value.toLowerCase().replace(/[^\p{L}\p{N}]/gu, "");
+  return stripped === "" ? null : stripped;
+}
+function loosened(value) {
+  const collapsed = value.trim().toLowerCase().replace(/\s+/g, " ");
+  return collapsed === "" ? null : collapsed;
+}
+function birthDate(value) {
+  const digits = value.replace(/\D/g, "");
+  if (!/^\d{8}$/.test(digits)) return null;
+  const month = Number(digits.slice(4, 6));
+  const day = Number(digits.slice(6, 8));
+  if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+  return digits;
+}
+function genderLetter(value) {
+  const first = value.trim().toLowerCase().charAt(0);
+  return first === "f" || first === "m" ? first : null;
+}
+function countryCode(value) {
+  const code = value.trim().toLowerCase();
+  return /^[a-z]{2}$/.test(code) ? code : null;
+}
+var MATCH_SPECS = {
+  first_name: { keep: "hashed", normalize: tightened, meta: "fn", google: "hashed_first_name" },
+  last_name: { keep: "hashed", normalize: tightened, meta: "ln", google: "hashed_last_name" },
+  // Meta only. Google's enhanced conversions have no date of birth, so there is
+  // no destination wanting it in the clear and every reason not to keep one.
+  date_of_birth: { keep: "hashed", normalize: birthDate, meta: "db", google: null },
+  gender: { keep: "plain", normalize: genderLetter, meta: "ge", google: null },
+  city: { keep: "plain", normalize: loosened, meta: "ct", google: "city" },
+  region: { keep: "plain", normalize: loosened, meta: "st", google: "state" },
+  postal_code: { keep: "plain", normalize: loosened, meta: "zp", google: "postal_code" },
+  country: { keep: "plain", normalize: countryCode, meta: "country", google: "country_code" }
+};
+var MATCH_FIELD_FORWARDING = [
+  { field: "email", meta: "em", google: "hashed_email", hashed: true },
+  { field: "phone", meta: "ph", google: "hashed_phone_number", hashed: true },
+  // Kept in the clear — see `resolveOwnId`. The digest is still computed and
+  // still stored beside it, so a Meta forward has one; what changed is that the
+  // sender's own key is now readable, which is the entire reason they sent it.
+  { field: "external_id", meta: "external_id", google: null, hashed: false },
+  ...MATCH_FIELDS.map((field) => ({
+    field,
+    meta: MATCH_SPECS[field].meta,
+    google: MATCH_SPECS[field].google,
+    hashed: MATCH_SPECS[field].keep === "hashed"
+  })),
+  { field: "fbp", meta: "fbp", google: null, hashed: false },
+  { field: "fbc", meta: "fbc", google: null, hashed: false }
+];
+
+export {
+  isSha256Hex,
+  normalizeIdentity,
+  MATCH_FIELDS,
+  MATCH_COOKIES,
+  MATCH_SPECS,
+  MATCH_FIELD_FORWARDING
+};
+//# sourceMappingURL=chunk-G4FG5EQO.js.map

package/dist/chunk-G4FG5EQO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/identity/digest.ts","../../api/src/identity/email.ts","../../api/src/identity/phone.ts","../../api/src/identity/index.ts","../../api/src/event-ingest/matching.ts"],"sourcesContent":["/**\n * The one hash, and the one way to recognise one.\n *\n * Web Crypto, so the same code runs in the Convex runtime, a Worker, Node and a\n * browser — an identity digest that differs by runtime is a digest that matches\n * nothing, and nothing about that failure is visible from either end.\n */\n\n/** SHA-256 in lowercase hex. The form every ad platform documents. */\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst SHA256_HEX = /^[0-9a-fA-F]{64}$/;\n\n/**\n * Whether a value is already a SHA-256 digest — the check that decides whether\n * a field holds plain text to normalize and hash, or a digest someone else\n * computed. Hashing a hash produces a key that matches nothing, forever, with\n * no way to tell afterwards.\n */\nexport function isSha256Hex(value: string): boolean {\n  return SHA256_HEX.test(value);\n}\n\n/** The storable form of a supplied digest, or `null` if it is not one. */\nexport function normalizeSha256Hex(value: string): string | null {\n  const trimmed = value.trim();\n  return SHA256_HEX.test(trimmed) ? trimmed.toLowerCase() : null;\n}\n\n/**\n * The canonical form of a site's own id for a person, before it is hashed.\n *\n * Trim and lowercase, and deliberately nothing else. An `external_id` is an\n * opaque key in somebody else's system — a customer number, a CRM contact id, a\n * membership code — so there is no shape to check and no punctuation that means\n * anything. What matters is only that **both ends canonicalise it the same\n * way**: the browser hashing `Cust-4821` and the CRM hashing `cust-4821` would\n * produce two people out of one, with nothing anywhere to report it.\n *\n * Not part of the versioned normalizer beside it, on purpose. Those versions\n * exist because an address has a *correct* form that we learned late; this has\n * never had one and never will.\n */\nexport function normalizeExternalId(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** The digest a site's own id joins on, or `null` when there is nothing to hash. */\nexport async function externalIdDigest(raw: string): Promise<string | null> {\n  const canonical = normalizeExternalId(raw);\n  return canonical === null ? null : await sha256Hex(canonical);\n}\n","/**\n * Email normalization, one rule per version.\n *\n * A version is not a preference: a digest computed under v1 and stored a year\n * ago can never be recomputed, because the address that produced it was dropped\n * on purpose. So v1 is frozen at whatever the browser did on the day it ran, and\n * a better rule arrives as v2 alongside it rather than in place of it.\n */\n\n/**\n * **v1 — frozen.** Trim and lowercase, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. No shape check:\n * whatever the visitor typed was hashed, and every historical digest was\n * produced this way.\n *\n * `null` only for an empty result, which is the one case the beacon also\n * declines to report.\n */\nexport function normalizeEmailV1(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** No dots-as-separators, no length games: one `@`, a local part, a dotted domain. */\nconst EMAIL = /^[^\\s@]+@[^\\s@.]+(?:\\.[^\\s@.]+)+$/;\n\n/**\n * **v2.** v1 plus a shape check, so an unusable value is declined instead of\n * hashed into a key that can never match.\n */\nexport function normalizeEmailV2(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return EMAIL.test(trimmed) ? trimmed : null;\n}\n\n/**\n * Google's own email canonicalization, applied on top of a normalized address:\n * for `gmail.com` and `googlemail.com`, drop the dots and any `+tag` from the\n * local part.\n *\n * `null` when there is no address left to send — a local part that was nothing\n * but a `+tag`. Google is the only platform that asks for this; Meta and\n * LinkedIn hash the address as written, which is why this is a provider step\n * and not part of the version.\n */\nexport function googleEmail(normalizedEmail: string): string | null {\n  const [localPart, domain, ...extraParts] = normalizedEmail.split(\"@\");\n  if (!localPart || !domain || extraParts.length > 0) return normalizedEmail;\n  if (domain !== \"gmail.com\" && domain !== \"googlemail.com\") return normalizedEmail;\n  const canonicalLocalPart = localPart.split(\"+\", 1)[0]?.replace(/\\./g, \"\") ?? \"\";\n  return canonicalLocalPart ? `${canonicalLocalPart}@${domain}` : null;\n}\n","/**\n * Phone normalization, one rule per version, plus the shape each platform\n * hashes.\n *\n * Three copies of this used to exist — the beacon's, the funnel contract's and\n * `lib/capi.ts` — and they disagreed on the `+`. A digest of `34600111222` and a\n * digest of `+34600111222` are two unrelated keys for one person, and neither\n * end reports anything when they fail to meet.\n */\n\n/**\n * **v1 — frozen.** Digits only, with a `+` in front, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. It guesses no\n * country code and validates nothing: a national number becomes `+600111222`,\n * and that is the digest sitting in the store for every visitor who identified\n * before v2 existed.\n */\nexport function normalizePhoneV1(raw: string): string | null {\n  const digits = raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^0-9]/g, \"\");\n  return digits === \"\" ? null : `+${digits}`;\n}\n\n/** What a CRM writes around the digits and what E.164 does not keep. */\nconst PHONE_PUNCTUATION = /[\\s()./-]/g;\n/** E.164: `+`, a country code that cannot start at 0, up to 15 digits total. */\nconst E164 = /^\\+[1-9]\\d{7,14}$/;\n\n/**\n * **v2 — strict E.164.**\n *\n * A number with no international prefix is refused rather than guessed at. The\n * country code cannot be inferred from the value, and inventing one produces a\n * hash that silently matches nothing — worse than declining the key, because\n * the event still resolves by some other rung and nobody learns the phone was\n * lost. Both `+34…` and the access prefix `0034…` are accepted; a bare\n * `600111222` is not.\n */\nexport function normalizePhoneV2(raw: string): string | null {\n  const compact = raw.replace(PHONE_PUNCTUATION, \"\");\n  const e164 = compact.startsWith(\"00\") ? `+${compact.slice(2)}` : compact;\n  return E164.test(e164) ? e164 : null;\n}\n\n/**\n * E.164 without the `+` — what Meta, LinkedIn and Twitter hash.\n *\n * Google hashes the same number *with* the `+`, and that single character is\n * the whole reason this function has a name.\n */\nexport function phoneWithoutPlus(normalizedPhone: string): string {\n  return normalizedPhone.startsWith(\"+\") ? normalizedPhone.slice(1) : normalizedPhone;\n}\n","/**\n * Versioned identity normalization — one rule set, in one place, for the whole\n * platform.\n *\n * Several copies of \"normalize an email or a phone and hash it\" exist: the\n * browser beacon's, the one every Conversions API dispatcher shares\n * (`convex/lib/capi.ts`), and Google Ads' own on top of it\n * (`convex/sideEffects/googleAdsCapi/utils.ts`). They disagree about the `+` on\n * a phone, about whether a malformed address should be declined, and about\n * Gmail. Each disagreement is the same failure: two digests for one person, no\n * error anywhere, and an attribution that quietly matches nobody.\n *\n * **This module has taken over exactly one of them so far — the beacon's.** The\n * CAPI dispatchers still hold their own, because they sit on live conversion\n * uploads where a changed digest is money mis-attributed, so they move in their\n * own change with their own evidence. What is done instead, and now, is to make\n * the drift *detectable*: `capi.parity.test.ts` in `packages/backend` runs those\n * copies over the same table as these and fails when they stop agreeing. That is\n * the whole problem — the copies are identical today and nothing was watching.\n * One of them, Google Ads' phone rule, is genuinely a third rule and cannot be\n * pinned to either version; the test says so in place of pretending otherwise.\n *\n * Two ideas make that fixable rather than merely fixed:\n *\n * - **The version is data.** A digest cannot be recomputed — the plaintext was\n *   dropped on purpose, which is the point of holding a digest at all. So the\n *   rule that produced it is frozen as v1 and kept, and a better rule ships\n *   beside it as v2. Anything holding plaintext produces both and looks up\n *   both, which is why a normalization change cannot orphan the history.\n * - **The provider form is not the version.** Meta hashes E.164 without the\n *   `+`, Google hashes it with the `+` and canonicalizes Gmail addresses. Those\n *   are three digests of one canonical value, not three normalizations.\n */\n\nimport { sha256Hex } from \"./digest\";\nimport { normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nimport { normalizePhoneV1, normalizePhoneV2 } from \"./phone\";\nimport { providerPlain } from \"./providers\";\nimport type { CanonicalIdentity, IdentityInput, NormalizationVersion } from \"./types\";\n\nexport { externalIdDigest, isSha256Hex, normalizeExternalId, normalizeSha256Hex, sha256Hex } from \"./digest\";\nexport { googleEmail, normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nexport { normalizePhoneV1, normalizePhoneV2, phoneWithoutPlus } from \"./phone\";\nexport { type ProviderPlain, providerPlain } from \"./providers\";\nexport {\n  type CanonicalIdentity,\n  type IdentityInput,\n  type IdentityKind,\n  NORMALIZATION_VERSIONS,\n  type NormalizationVersion,\n} from \"./types\";\nexport { extractDomain, isPublicEmailDomain, workEmailDomain } from \"./workDomain\";\n\n/**\n * Apply one version's rule to plain text, or decline it.\n *\n * `null` means this version has no usable form of this value — not that the\n * person has no phone. Under v2 that happens to any national number, on\n * purpose: see {@link normalizePhoneV2}.\n */\nexport function normalizeIdentity(raw: IdentityInput, version: NormalizationVersion): CanonicalIdentity | null {\n  const value =\n    raw.kind === \"email\"\n      ? version === 1\n        ? normalizeEmailV1(raw.value)\n        : normalizeEmailV2(raw.value)\n      : version === 1\n        ? normalizePhoneV1(raw.value)\n        : normalizePhoneV2(raw.value);\n  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };\n}\n\n/**\n * The digests one canonical value produces, keyed by who asks for them.\n *\n * Snake case because this is a wire shape: it is what the browser sends, what\n * the ingest stores, and what an activation payload reads. `google_sha256` is\n * `null` when Google has no usable form of the value — a Gmail address whose\n * local part was only a `+tag`.\n */\nexport type IdentityDigests = {\n  canonical_sha256: string;\n  meta_sha256: string;\n  google_sha256: string | null;\n  normalization_version: NormalizationVersion;\n};\n\nexport async function providerDigests(canonical: CanonicalIdentity): Promise<IdentityDigests> {\n  const plain = providerPlain(canonical);\n  const [canonicalSha, metaSha, googleSha] = await Promise.all([\n    sha256Hex(plain.canonical),\n    sha256Hex(plain.meta),\n    plain.google === null ? Promise.resolve(null) : sha256Hex(plain.google),\n  ]);\n  return {\n    canonical_sha256: canonicalSha,\n    meta_sha256: metaSha,\n    google_sha256: googleSha,\n    normalization_version: canonical.normalizationVersion,\n  };\n}\n\n/**\n * The compact set a page sends and an ingest reads: one entry per version, plus\n * the two provider digests, for one plaintext value.\n *\n * `meta` and `google` are computed from the best version that produced a value\n * — v2 when it accepted the value, v1 otherwise — because a platform wants one\n * digest, not a history. `v1` and `v2` are both present when both rules\n * accepted the value, and they are equal when the two rules agreed.\n *\n * `null` when no version has a usable form: there is nothing to report, and\n * reporting an empty digest would be reporting the hash of the empty string.\n */\nexport type IdentityDigestSet = {\n  v1?: string;\n  v2?: string;\n  meta: string;\n  google?: string;\n};\n\nexport async function identityDigestSet(raw: IdentityInput): Promise<IdentityDigestSet | null> {\n  const v1 = normalizeIdentity(raw, 1);\n  const v2 = normalizeIdentity(raw, 2);\n  const best = v2 ?? v1;\n  if (best === null) return null;\n  const digests = await providerDigests(best);\n  return {\n    ...(v1 === null ? {} : { v1: v1.value === best.value ? digests.canonical_sha256 : await sha256Hex(v1.value) }),\n    ...(v2 === null ? {} : { v2: digests.canonical_sha256 }),\n    meta: digests.meta_sha256,\n    ...(digests.google_sha256 === null ? {} : { google: digests.google_sha256 }),\n  };\n}\n","/**\n * The customer-matching block: one vocabulary for everything Meta calls\n * *advanced matching* and Google calls *enhanced conversions*.\n *\n * ## Why these fields are here at all\n *\n * A server event is worth what it can be joined to. An email is the join that\n * works, and everything in this file is the second-best set for when the join\n * has to happen *outward* instead — Meta and Google both accept an event with\n * no email at all if it carries enough of a person: a name and a postcode, a\n * click id, a browser cookie. They disagree about spelling and about what has\n * to be hashed, and they do not disagree about the set.\n *\n * Two things follow, and they are the whole design:\n *\n * - **One block, one spelling.** A sender maps their CRM once, here, rather\n *   than once per destination. `MATCH_FIELD_FORWARDING` is the table that says\n *   what each field is called on the other side, so the mapping is published\n *   rather than folklore.\n * - **Kept in the form every destination can still be derived from.** That rule\n *   decides, per field, whether it is stored hashed or in the clear, and it is\n *   the only rule here worth remembering: **a digest can be computed later and\n *   never undone.** A city hashed on arrival can never be sent to Google, which\n *   wants `address_info.city` in plain text; a city kept in the clear can be\n *   hashed for Meta at the moment of sending, for free.\n *\n * So: hashed here are the fields **both** destinations want hashed and which\n * identify a person on their own — email, phone, the two names, the date of\n * birth, and the sender's own id. Kept in the clear are the coarse ones that\n * identify nobody by themselves and that Google wants unhashed: city, region,\n * postal code, country, and the gender letter. Hashing that second set would\n * buy no privacy — the digest of `es` is not a secret — and would cost the\n * ability to send them anywhere.\n *\n * ## A value that arrives already hashed\n *\n * Accepted for every field, and detected rather than declared. There is no\n * `email_sha256` beside `email` any more, because two fields for one idea is a\n * choice a sender should never have had to make: a 64-character hex string is\n * unambiguously a digest — no address, phone number, city or name can be one —\n * so the field can hold either and we can tell. What we cannot do is *unhash*,\n * so a digest arriving for a field this module would otherwise keep in the\n * clear is stored under `<field>_sha256`: the key says what is inside it, and a\n * forward that needs the plain value knows it does not have one.\n *\n * ## Normalization is Meta's, and the divergence is stated\n *\n * The hashed fields are normalized under the rule Meta publishes (lower case,\n * trimmed, punctuation and spacing removed) because a digest can only be\n * computed under one rule and Meta's is the stricter of the two. Google's rule\n * for a name is lower-case-and-trim only, so the two agree on every name\n * without punctuation in it and differ on `O'Brien`. Email and phone do not\n * have this problem: they go through `../identity`, which is the platform's one\n * versioned rule and the same one the browser beacon writes with — which is\n * what makes a server event and a Form submission land on one person.\n */\n\nimport { isSha256Hex, sha256Hex } from \"../identity\";\n\n/**\n * A field of `user_data` that describes the person rather than naming a click.\n *\n * `email` and `phone` are deliberately not here: they are resolved by\n * `./identity` into the row's own `identity_hash`, under the platform's\n * versioned rule, and this module reads that result rather than hashing them a\n * second time under a different one.\n */\nexport const MATCH_FIELDS = [\n  \"first_name\",\n  \"last_name\",\n  \"date_of_birth\",\n  \"gender\",\n  \"city\",\n  \"region\",\n  \"postal_code\",\n  \"country\",\n] as const;\nexport type MatchField = (typeof MATCH_FIELDS)[number];\n\n/**\n * The browser cookies Meta's pixel sets, which name a browser rather than a\n * person.\n *\n * `fbp` is the pixel's own first-party cookie and `fbc` is the one it derives\n * from a click. Both are sent to Meta **unhashed and verbatim** — they are\n * opaque strings of Meta's own making, and hashing one destroys it — so they\n * are stored exactly as they arrived.\n *\n * They are not in {@link MATCH_FIELDS} and not in the click-id list either.\n * They are not click ids: a `gclid` is stamped on a URL by the ad platform and\n * has a column of its own here because reports filter on it, while `fbp` is a\n * cookie a script wrote and nothing reports on. But they *do* name somebody,\n * which is why `namesSomebody` counts them — an event carrying only an `fbp` is\n * still an event Meta can attribute, and refusing it would lose exactly the\n * conversions this block exists to make sendable.\n */\nexport const MATCH_COOKIES = [\"fbp\", \"fbc\"] as const;\nexport type MatchCookie = (typeof MATCH_COOKIES)[number];\n\n/** How a field is stored, once it has been normalized. */\ntype Keeping = \"hashed\" | \"plain\";\n\ntype MatchSpec = {\n  keep: Keeping;\n  /** The canonical form, or `null` when the value says nothing usable. */\n  normalize: (value: string) => string | null;\n  /** What Meta and Google call this field, for the published mapping. */\n  meta: string;\n  google: string | null;\n};\n\n/** Lower-cased, trimmed, and stripped of everything that is not a letter or a digit. Meta's rule. */\nfunction tightened(value: string): string | null {\n  const stripped = value.toLowerCase().replace(/[^\\p{L}\\p{N}]/gu, \"\");\n  return stripped === \"\" ? null : stripped;\n}\n\n/** Lower-cased and trimmed, with runs of whitespace collapsed. Nothing else is removed. */\nfunction loosened(value: string): string | null {\n  const collapsed = value.trim().toLowerCase().replace(/\\s+/g, \" \");\n  return collapsed === \"\" ? null : collapsed;\n}\n\n/**\n * `1985-04-09`, `1985/04/09`, `19850409` — eight digits in year-month-day\n * order, however they are punctuated.\n *\n * The order is not guessed. `09/04/1985` is refused rather than read as the\n * ninth of April or the fourth of September: nothing in the value says which,\n * and a birth date hashed under the wrong reading is a digest that matches\n * nobody at Meta, with no error anywhere to say so. A refusal costs one field\n * on one event and is visible in the arrival log; a wrong guess costs the match\n * and is not.\n */\nfunction birthDate(value: string): string | null {\n  const digits = value.replace(/\\D/g, \"\");\n  if (!/^\\d{8}$/.test(digits)) return null;\n  const month = Number(digits.slice(4, 6));\n  const day = Number(digits.slice(6, 8));\n  if (month < 1 || month > 12 || day < 1 || day > 31) return null;\n  return digits;\n}\n\n/** `f` or `m`, from whatever word or letter the sender's system stores. */\nfunction genderLetter(value: string): string | null {\n  const first = value.trim().toLowerCase().charAt(0);\n  return first === \"f\" || first === \"m\" ? first : null;\n}\n\n/** ISO-3166 alpha-2, lower-cased. A country name is refused rather than guessed at. */\nfunction countryCode(value: string): string | null {\n  const code = value.trim().toLowerCase();\n  return /^[a-z]{2}$/.test(code) ? code : null;\n}\n\nexport const MATCH_SPECS: Readonly<Record<MatchField, MatchSpec>> = {\n  first_name: { keep: \"hashed\", normalize: tightened, meta: \"fn\", google: \"hashed_first_name\" },\n  last_name: { keep: \"hashed\", normalize: tightened, meta: \"ln\", google: \"hashed_last_name\" },\n  // Meta only. Google's enhanced conversions have no date of birth, so there is\n  // no destination wanting it in the clear and every reason not to keep one.\n  date_of_birth: { keep: \"hashed\", normalize: birthDate, meta: \"db\", google: null },\n  gender: { keep: \"plain\", normalize: genderLetter, meta: \"ge\", google: null },\n  city: { keep: \"plain\", normalize: loosened, meta: \"ct\", google: \"city\" },\n  region: { keep: \"plain\", normalize: loosened, meta: \"st\", google: \"state\" },\n  postal_code: { keep: \"plain\", normalize: loosened, meta: \"zp\", google: \"postal_code\" },\n  country: { keep: \"plain\", normalize: countryCode, meta: \"country\", google: \"country_code\" },\n};\n\n/** One row of the published mapping: our name, Meta's, Google's, and whether we hold it hashed. */\nexport type MatchFieldForwarding = {\n  field: string;\n  meta: string;\n  google: string | null;\n  hashed: boolean;\n};\n\n/**\n * What each field of the matching block is called at the destinations that\n * accept it — the table the dialog and the docs both read.\n *\n * Published rather than described, because \"it maps onto Meta's user_data\" is\n * a promise a sender cannot check and this is the same promise they can.\n */\nexport const MATCH_FIELD_FORWARDING: readonly MatchFieldForwarding[] = [\n  { field: \"email\", meta: \"em\", google: \"hashed_email\", hashed: true },\n  { field: \"phone\", meta: \"ph\", google: \"hashed_phone_number\", hashed: true },\n  // Kept in the clear — see `resolveOwnId`. The digest is still computed and\n  // still stored beside it, so a Meta forward has one; what changed is that the\n  // sender's own key is now readable, which is the entire reason they sent it.\n  { field: \"external_id\", meta: \"external_id\", google: null, hashed: false },\n  ...MATCH_FIELDS.map((field) => ({\n    field,\n    meta: MATCH_SPECS[field].meta,\n    google: MATCH_SPECS[field].google,\n    hashed: MATCH_SPECS[field].keep === \"hashed\",\n  })),\n  { field: \"fbp\", meta: \"fbp\", google: null, hashed: false },\n  { field: \"fbc\", meta: \"fbc\", google: null, hashed: false },\n];\n\n/** The longest a stored match value may be, matching the width the map's values are held at. */\nconst MAX_MATCH_VALUE = 255;\n\n/**\n * One field, resolved to the key it is stored under and the value stored there.\n *\n * `null` when the field said nothing usable — `gender: \"unknown\"`, a country\n * spelled out in full, a postcode of whitespace. A field that is present and\n * unusable contributes nothing rather than storing something that matches\n * nobody, which is the same rule the identity resolution follows.\n */\nexport async function resolveMatchField(\n  field: MatchField,\n  raw: string,\n): Promise<{ key: string; value: string } | null> {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  const spec = MATCH_SPECS[field];\n  // Already a digest, whatever this field would otherwise keep. Taken at face\n  // value — hashing a hash matches nothing, forever — and keyed so that the\n  // name says what is inside, because a plain-text destination cannot use it.\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  const normalized = spec.normalize(value);\n  if (normalized === null) return null;\n  if (spec.keep === \"plain\") return { key: field, value: normalized.slice(0, MAX_MATCH_VALUE) };\n  return { key: `${field}_sha256`, value: await sha256Hex(normalized) };\n}\n\n/**\n * The two ids that are not facts about a person but *names the sender chose*,\n * kept exactly as they were sent.\n *\n * `external_id` is the client's own key — a HubSpot contact id, a Salesforce\n * record id — and `baker_id` is a cookie value one of our own pages minted.\n * Neither describes anybody: they are pointers, and a pointer is worth only\n * what it can be followed with.\n *\n * ## Why these are the exception to \"identifying fields are hashed\"\n *\n * `external_id` used to be hashed here and nothing else, on the reasoning that\n * it is sometimes an email or a document number in disguise. That reasoning\n * held and the consequence did not: it made the field **useless to the person\n * who sent it**. An integrator posting `external_id: \"hs:contact:12345\"` opened\n * the event and read *Provided, stored hashed* — no way to check we had read\n * the right record, no way to paste the id back into their CRM, and no way to\n * tell a working integration from one silently keyed on the wrong column. The\n * whole point of the field is to be recognised on the way back out.\n *\n * The privacy this bought was also smaller than it looked. The digest is still\n * computed, still what `identity_hash` stores and still what the identity graph\n * joins on — see `./identity` — so nothing about the joining changed. What is\n * new is a second copy in the clear, under the key that says so.\n *\n * A value that arrives *already* a digest still keeps `<field>_sha256`, for the\n * rule that governs every field here: a digest cannot be undone, so the key has\n * to say what is inside it.\n */\nexport function resolveOwnId(field: \"external_id\" | \"baker_id\", raw: string): { key: string; value: string } | null {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  return { key: field, value: value.slice(0, MAX_MATCH_VALUE) };\n}\n\n/** A cookie value, as Meta minted it: bounded, and otherwise untouched. */\nexport function resolveMatchCookie(raw: string): string | null {\n  const value = raw.trim();\n  return value === \"\" ? null : value.slice(0, MAX_MATCH_VALUE);\n}\n\n/**\n * The `fbclid` hiding inside an `fbc`, or `null`.\n *\n * `fbc` is `fb.<subdomain index>.<timestamp>.<fbclid>` — Meta's own encoding of\n * a click id it already saw. A sender whose system stored the cookie has the\n * click id and does not know it, so reading it out costs one split and gives\n * the event the same paid-attribution column a landing page would have written\n * from the URL. Nothing is invented: the value was there.\n */\nexport function fbclidFromFbc(fbc: string): string | null {\n  const parts = fbc.split(\".\");\n  if (parts.length < 4 || parts[0] !== \"fb\") return null;\n  const id = parts.slice(3).join(\".\");\n  return id === \"\" ? null : id;\n}\n"],"mappings":";AAcA,IAAM,aAAa;AAQZ,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK,KAAK;AAC9B;;;ACNO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,YAAY,KAAK,OAAO;AACjC;AAGA,IAAM,QAAQ;AAMP,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,MAAM,KAAK,OAAO,IAAI,UAAU;AACzC;;;AChBO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,SAAS,IACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,EAAE;AACxB,SAAO,WAAW,KAAK,OAAO,IAAI,MAAM;AAC1C;AAGA,IAAM,oBAAoB;AAE1B,IAAM,OAAO;AAYN,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,QAAQ,mBAAmB,EAAE;AACjD,QAAM,OAAO,QAAQ,WAAW,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,KAAK;AACjE,SAAO,KAAK,KAAK,IAAI,IAAI,OAAO;AAClC;;;ACgBO,SAAS,kBAAkB,KAAoB,SAAyD;AAC7G,QAAM,QACJ,IAAI,SAAS,UACT,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK,IAC5B,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK;AAClC,SAAO,UAAU,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,OAAO,sBAAsB,QAAQ;AACxF;;;ACHO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAgB,CAAC,OAAO,KAAK;AAgB1C,SAAS,UAAU,OAA8B;AAC/C,QAAM,WAAW,MAAM,YAAY,EAAE,QAAQ,mBAAmB,EAAE;AAClE,SAAO,aAAa,KAAK,OAAO;AAClC;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AAChE,SAAO,cAAc,KAAK,OAAO;AACnC;AAaA,SAAS,UAAU,OAA8B;AAC/C,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,MAAI,CAAC,UAAU,KAAK,MAAM,EAAG,QAAO;AACpC,QAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACvC,QAAM,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACrC,MAAI,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK,MAAM,GAAI,QAAO;AAC3D,SAAO;AACT;AAGA,SAAS,aAAa,OAA8B;AAClD,QAAM,QAAQ,MAAM,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;AACjD,SAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAClD;AAGA,SAAS,YAAY,OAA8B;AACjD,QAAM,OAAO,MAAM,KAAK,EAAE,YAAY;AACtC,SAAO,aAAa,KAAK,IAAI,IAAI,OAAO;AAC1C;AAEO,IAAM,cAAuD;AAAA,EAClE,YAAY,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,oBAAoB;AAAA,EAC5F,WAAW,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,mBAAmB;AAAA;AAAA;AAAA,EAG1F,eAAe,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,KAAK;AAAA,EAChF,QAAQ,EAAE,MAAM,SAAS,WAAW,cAAc,MAAM,MAAM,QAAQ,KAAK;AAAA,EAC3E,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,OAAO;AAAA,EACvE,QAAQ,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,QAAQ;AAAA,EAC1E,aAAa,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,cAAc;AAAA,EACrF,SAAS,EAAE,MAAM,SAAS,WAAW,aAAa,MAAM,WAAW,QAAQ,eAAe;AAC5F;AAiBO,IAAM,yBAA0D;AAAA,EACrE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,gBAAgB,QAAQ,KAAK;AAAA,EACnE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,uBAAuB,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI1E,EAAE,OAAO,eAAe,MAAM,eAAe,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzE,GAAG,aAAa,IAAI,CAAC,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,KAAK,EAAE;AAAA,IACzB,QAAQ,YAAY,KAAK,EAAE;AAAA,IAC3B,QAAQ,YAAY,KAAK,EAAE,SAAS;AAAA,EACtC,EAAE;AAAA,EACF,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzD,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAC3D;","names":[]}