@koda-sl/baker-cli 0.513.0 → 0.515.0

package/dist/chunk-G4FG5EQO.js

@@ -0,0 +1,110 @@
+// ../api/src/identity/digest.ts
+var SHA256_HEX = /^[0-9a-fA-F]{64}$/;
+function isSha256Hex(value) {
+  return SHA256_HEX.test(value);
+}
+
+// ../api/src/identity/email.ts
+function normalizeEmailV1(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return trimmed === "" ? null : trimmed;
+}
+var EMAIL = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+function normalizeEmailV2(raw) {
+  const trimmed = raw.trim().toLowerCase();
+  return EMAIL.test(trimmed) ? trimmed : null;
+}
+
+// ../api/src/identity/phone.ts
+function normalizePhoneV1(raw) {
+  const digits = raw.trim().toLowerCase().replace(/[^0-9]/g, "");
+  return digits === "" ? null : `+${digits}`;
+}
+var PHONE_PUNCTUATION = /[\s()./-]/g;
+var E164 = /^\+[1-9]\d{7,14}$/;
+function normalizePhoneV2(raw) {
+  const compact = raw.replace(PHONE_PUNCTUATION, "");
+  const e164 = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(e164) ? e164 : null;
+}
+
+// ../api/src/identity/index.ts
+function normalizeIdentity(raw, version) {
+  const value = raw.kind === "email" ? version === 1 ? normalizeEmailV1(raw.value) : normalizeEmailV2(raw.value) : version === 1 ? normalizePhoneV1(raw.value) : normalizePhoneV2(raw.value);
+  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };
+}
+
+// ../api/src/event-ingest/matching.ts
+var MATCH_FIELDS = [
+  "first_name",
+  "last_name",
+  "date_of_birth",
+  "gender",
+  "city",
+  "region",
+  "postal_code",
+  "country"
+];
+var MATCH_COOKIES = ["fbp", "fbc"];
+function tightened(value) {
+  const stripped = value.toLowerCase().replace(/[^\p{L}\p{N}]/gu, "");
+  return stripped === "" ? null : stripped;
+}
+function loosened(value) {
+  const collapsed = value.trim().toLowerCase().replace(/\s+/g, " ");
+  return collapsed === "" ? null : collapsed;
+}
+function birthDate(value) {
+  const digits = value.replace(/\D/g, "");
+  if (!/^\d{8}$/.test(digits)) return null;
+  const month = Number(digits.slice(4, 6));
+  const day = Number(digits.slice(6, 8));
+  if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+  return digits;
+}
+function genderLetter(value) {
+  const first = value.trim().toLowerCase().charAt(0);
+  return first === "f" || first === "m" ? first : null;
+}
+function countryCode(value) {
+  const code = value.trim().toLowerCase();
+  return /^[a-z]{2}$/.test(code) ? code : null;
+}
+var MATCH_SPECS = {
+  first_name: { keep: "hashed", normalize: tightened, meta: "fn", google: "hashed_first_name" },
+  last_name: { keep: "hashed", normalize: tightened, meta: "ln", google: "hashed_last_name" },
+  // Meta only. Google's enhanced conversions have no date of birth, so there is
+  // no destination wanting it in the clear and every reason not to keep one.
+  date_of_birth: { keep: "hashed", normalize: birthDate, meta: "db", google: null },
+  gender: { keep: "plain", normalize: genderLetter, meta: "ge", google: null },
+  city: { keep: "plain", normalize: loosened, meta: "ct", google: "city" },
+  region: { keep: "plain", normalize: loosened, meta: "st", google: "state" },
+  postal_code: { keep: "plain", normalize: loosened, meta: "zp", google: "postal_code" },
+  country: { keep: "plain", normalize: countryCode, meta: "country", google: "country_code" }
+};
+var MATCH_FIELD_FORWARDING = [
+  { field: "email", meta: "em", google: "hashed_email", hashed: true },
+  { field: "phone", meta: "ph", google: "hashed_phone_number", hashed: true },
+  // Kept in the clear — see `resolveOwnId`. The digest is still computed and
+  // still stored beside it, so a Meta forward has one; what changed is that the
+  // sender's own key is now readable, which is the entire reason they sent it.
+  { field: "external_id", meta: "external_id", google: null, hashed: false },
+  ...MATCH_FIELDS.map((field) => ({
+    field,
+    meta: MATCH_SPECS[field].meta,
+    google: MATCH_SPECS[field].google,
+    hashed: MATCH_SPECS[field].keep === "hashed"
+  })),
+  { field: "fbp", meta: "fbp", google: null, hashed: false },
+  { field: "fbc", meta: "fbc", google: null, hashed: false }
+];
+
+export {
+  isSha256Hex,
+  normalizeIdentity,
+  MATCH_FIELDS,
+  MATCH_COOKIES,
+  MATCH_SPECS,
+  MATCH_FIELD_FORWARDING
+};
+//# sourceMappingURL=chunk-G4FG5EQO.js.map

package/dist/chunk-G4FG5EQO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/identity/digest.ts","../../api/src/identity/email.ts","../../api/src/identity/phone.ts","../../api/src/identity/index.ts","../../api/src/event-ingest/matching.ts"],"sourcesContent":["/**\n * The one hash, and the one way to recognise one.\n *\n * Web Crypto, so the same code runs in the Convex runtime, a Worker, Node and a\n * browser — an identity digest that differs by runtime is a digest that matches\n * nothing, and nothing about that failure is visible from either end.\n */\n\n/** SHA-256 in lowercase hex. The form every ad platform documents. */\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst SHA256_HEX = /^[0-9a-fA-F]{64}$/;\n\n/**\n * Whether a value is already a SHA-256 digest — the check that decides whether\n * a field holds plain text to normalize and hash, or a digest someone else\n * computed. Hashing a hash produces a key that matches nothing, forever, with\n * no way to tell afterwards.\n */\nexport function isSha256Hex(value: string): boolean {\n  return SHA256_HEX.test(value);\n}\n\n/** The storable form of a supplied digest, or `null` if it is not one. */\nexport function normalizeSha256Hex(value: string): string | null {\n  const trimmed = value.trim();\n  return SHA256_HEX.test(trimmed) ? trimmed.toLowerCase() : null;\n}\n\n/**\n * The canonical form of a site's own id for a person, before it is hashed.\n *\n * Trim and lowercase, and deliberately nothing else. An `external_id` is an\n * opaque key in somebody else's system — a customer number, a CRM contact id, a\n * membership code — so there is no shape to check and no punctuation that means\n * anything. What matters is only that **both ends canonicalise it the same\n * way**: the browser hashing `Cust-4821` and the CRM hashing `cust-4821` would\n * produce two people out of one, with nothing anywhere to report it.\n *\n * Not part of the versioned normalizer beside it, on purpose. Those versions\n * exist because an address has a *correct* form that we learned late; this has\n * never had one and never will.\n */\nexport function normalizeExternalId(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** The digest a site's own id joins on, or `null` when there is nothing to hash. */\nexport async function externalIdDigest(raw: string): Promise<string | null> {\n  const canonical = normalizeExternalId(raw);\n  return canonical === null ? null : await sha256Hex(canonical);\n}\n","/**\n * Email normalization, one rule per version.\n *\n * A version is not a preference: a digest computed under v1 and stored a year\n * ago can never be recomputed, because the address that produced it was dropped\n * on purpose. So v1 is frozen at whatever the browser did on the day it ran, and\n * a better rule arrives as v2 alongside it rather than in place of it.\n */\n\n/**\n * **v1 — frozen.** Trim and lowercase, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. No shape check:\n * whatever the visitor typed was hashed, and every historical digest was\n * produced this way.\n *\n * `null` only for an empty result, which is the one case the beacon also\n * declines to report.\n */\nexport function normalizeEmailV1(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** No dots-as-separators, no length games: one `@`, a local part, a dotted domain. */\nconst EMAIL = /^[^\\s@]+@[^\\s@.]+(?:\\.[^\\s@.]+)+$/;\n\n/**\n * **v2.** v1 plus a shape check, so an unusable value is declined instead of\n * hashed into a key that can never match.\n */\nexport function normalizeEmailV2(raw: string): string | null {\n  const trimmed = raw.trim().toLowerCase();\n  return EMAIL.test(trimmed) ? trimmed : null;\n}\n\n/**\n * Google's own email canonicalization, applied on top of a normalized address:\n * for `gmail.com` and `googlemail.com`, drop the dots and any `+tag` from the\n * local part.\n *\n * `null` when there is no address left to send — a local part that was nothing\n * but a `+tag`. Google is the only platform that asks for this; Meta and\n * LinkedIn hash the address as written, which is why this is a provider step\n * and not part of the version.\n */\nexport function googleEmail(normalizedEmail: string): string | null {\n  const [localPart, domain, ...extraParts] = normalizedEmail.split(\"@\");\n  if (!localPart || !domain || extraParts.length > 0) return normalizedEmail;\n  if (domain !== \"gmail.com\" && domain !== \"googlemail.com\") return normalizedEmail;\n  const canonicalLocalPart = localPart.split(\"+\", 1)[0]?.replace(/\\./g, \"\") ?? \"\";\n  return canonicalLocalPart ? `${canonicalLocalPart}@${domain}` : null;\n}\n","/**\n * Phone normalization, one rule per version, plus the shape each platform\n * hashes.\n *\n * Three copies of this used to exist — the beacon's, the funnel contract's and\n * `lib/capi.ts` — and they disagreed on the `+`. A digest of `34600111222` and a\n * digest of `+34600111222` are two unrelated keys for one person, and neither\n * end reports anything when they fail to meet.\n */\n\n/**\n * **v1 — frozen.** Digits only, with a `+` in front, exactly what\n * the beacon's own rule (now `src/lib/tracking/identity-normalize.ts`) has always done. It guesses no\n * country code and validates nothing: a national number becomes `+600111222`,\n * and that is the digest sitting in the store for every visitor who identified\n * before v2 existed.\n */\nexport function normalizePhoneV1(raw: string): string | null {\n  const digits = raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^0-9]/g, \"\");\n  return digits === \"\" ? null : `+${digits}`;\n}\n\n/** What a CRM writes around the digits and what E.164 does not keep. */\nconst PHONE_PUNCTUATION = /[\\s()./-]/g;\n/** E.164: `+`, a country code that cannot start at 0, up to 15 digits total. */\nconst E164 = /^\\+[1-9]\\d{7,14}$/;\n\n/**\n * **v2 — strict E.164.**\n *\n * A number with no international prefix is refused rather than guessed at. The\n * country code cannot be inferred from the value, and inventing one produces a\n * hash that silently matches nothing — worse than declining the key, because\n * the event still resolves by some other rung and nobody learns the phone was\n * lost. Both `+34…` and the access prefix `0034…` are accepted; a bare\n * `600111222` is not.\n */\nexport function normalizePhoneV2(raw: string): string | null {\n  const compact = raw.replace(PHONE_PUNCTUATION, \"\");\n  const e164 = compact.startsWith(\"00\") ? `+${compact.slice(2)}` : compact;\n  return E164.test(e164) ? e164 : null;\n}\n\n/**\n * E.164 without the `+` — what Meta, LinkedIn and Twitter hash.\n *\n * Google hashes the same number *with* the `+`, and that single character is\n * the whole reason this function has a name.\n */\nexport function phoneWithoutPlus(normalizedPhone: string): string {\n  return normalizedPhone.startsWith(\"+\") ? normalizedPhone.slice(1) : normalizedPhone;\n}\n","/**\n * Versioned identity normalization — one rule set, in one place, for the whole\n * platform.\n *\n * Several copies of \"normalize an email or a phone and hash it\" exist: the\n * browser beacon's, the one every Conversions API dispatcher shares\n * (`convex/lib/capi.ts`), and Google Ads' own on top of it\n * (`convex/sideEffects/googleAdsCapi/utils.ts`). They disagree about the `+` on\n * a phone, about whether a malformed address should be declined, and about\n * Gmail. Each disagreement is the same failure: two digests for one person, no\n * error anywhere, and an attribution that quietly matches nobody.\n *\n * **This module has taken over exactly one of them so far — the beacon's.** The\n * CAPI dispatchers still hold their own, because they sit on live conversion\n * uploads where a changed digest is money mis-attributed, so they move in their\n * own change with their own evidence. What is done instead, and now, is to make\n * the drift *detectable*: `capi.parity.test.ts` in `packages/backend` runs those\n * copies over the same table as these and fails when they stop agreeing. That is\n * the whole problem — the copies are identical today and nothing was watching.\n * One of them, Google Ads' phone rule, is genuinely a third rule and cannot be\n * pinned to either version; the test says so in place of pretending otherwise.\n *\n * Two ideas make that fixable rather than merely fixed:\n *\n * - **The version is data.** A digest cannot be recomputed — the plaintext was\n *   dropped on purpose, which is the point of holding a digest at all. So the\n *   rule that produced it is frozen as v1 and kept, and a better rule ships\n *   beside it as v2. Anything holding plaintext produces both and looks up\n *   both, which is why a normalization change cannot orphan the history.\n * - **The provider form is not the version.** Meta hashes E.164 without the\n *   `+`, Google hashes it with the `+` and canonicalizes Gmail addresses. Those\n *   are three digests of one canonical value, not three normalizations.\n */\n\nimport { sha256Hex } from \"./digest\";\nimport { normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nimport { normalizePhoneV1, normalizePhoneV2 } from \"./phone\";\nimport { providerPlain } from \"./providers\";\nimport type { CanonicalIdentity, IdentityInput, NormalizationVersion } from \"./types\";\n\nexport { externalIdDigest, isSha256Hex, normalizeExternalId, normalizeSha256Hex, sha256Hex } from \"./digest\";\nexport { googleEmail, normalizeEmailV1, normalizeEmailV2 } from \"./email\";\nexport { normalizePhoneV1, normalizePhoneV2, phoneWithoutPlus } from \"./phone\";\nexport { type ProviderPlain, providerPlain } from \"./providers\";\nexport {\n  type CanonicalIdentity,\n  type IdentityInput,\n  type IdentityKind,\n  NORMALIZATION_VERSIONS,\n  type NormalizationVersion,\n} from \"./types\";\nexport { extractDomain, isPublicEmailDomain, workEmailDomain } from \"./workDomain\";\n\n/**\n * Apply one version's rule to plain text, or decline it.\n *\n * `null` means this version has no usable form of this value — not that the\n * person has no phone. Under v2 that happens to any national number, on\n * purpose: see {@link normalizePhoneV2}.\n */\nexport function normalizeIdentity(raw: IdentityInput, version: NormalizationVersion): CanonicalIdentity | null {\n  const value =\n    raw.kind === \"email\"\n      ? version === 1\n        ? normalizeEmailV1(raw.value)\n        : normalizeEmailV2(raw.value)\n      : version === 1\n        ? normalizePhoneV1(raw.value)\n        : normalizePhoneV2(raw.value);\n  return value === null ? null : { kind: raw.kind, value, normalizationVersion: version };\n}\n\n/**\n * The digests one canonical value produces, keyed by who asks for them.\n *\n * Snake case because this is a wire shape: it is what the browser sends, what\n * the ingest stores, and what an activation payload reads. `google_sha256` is\n * `null` when Google has no usable form of the value — a Gmail address whose\n * local part was only a `+tag`.\n */\nexport type IdentityDigests = {\n  canonical_sha256: string;\n  meta_sha256: string;\n  google_sha256: string | null;\n  normalization_version: NormalizationVersion;\n};\n\nexport async function providerDigests(canonical: CanonicalIdentity): Promise<IdentityDigests> {\n  const plain = providerPlain(canonical);\n  const [canonicalSha, metaSha, googleSha] = await Promise.all([\n    sha256Hex(plain.canonical),\n    sha256Hex(plain.meta),\n    plain.google === null ? Promise.resolve(null) : sha256Hex(plain.google),\n  ]);\n  return {\n    canonical_sha256: canonicalSha,\n    meta_sha256: metaSha,\n    google_sha256: googleSha,\n    normalization_version: canonical.normalizationVersion,\n  };\n}\n\n/**\n * The compact set a page sends and an ingest reads: one entry per version, plus\n * the two provider digests, for one plaintext value.\n *\n * `meta` and `google` are computed from the best version that produced a value\n * — v2 when it accepted the value, v1 otherwise — because a platform wants one\n * digest, not a history. `v1` and `v2` are both present when both rules\n * accepted the value, and they are equal when the two rules agreed.\n *\n * `null` when no version has a usable form: there is nothing to report, and\n * reporting an empty digest would be reporting the hash of the empty string.\n */\nexport type IdentityDigestSet = {\n  v1?: string;\n  v2?: string;\n  meta: string;\n  google?: string;\n};\n\nexport async function identityDigestSet(raw: IdentityInput): Promise<IdentityDigestSet | null> {\n  const v1 = normalizeIdentity(raw, 1);\n  const v2 = normalizeIdentity(raw, 2);\n  const best = v2 ?? v1;\n  if (best === null) return null;\n  const digests = await providerDigests(best);\n  return {\n    ...(v1 === null ? {} : { v1: v1.value === best.value ? digests.canonical_sha256 : await sha256Hex(v1.value) }),\n    ...(v2 === null ? {} : { v2: digests.canonical_sha256 }),\n    meta: digests.meta_sha256,\n    ...(digests.google_sha256 === null ? {} : { google: digests.google_sha256 }),\n  };\n}\n","/**\n * The customer-matching block: one vocabulary for everything Meta calls\n * *advanced matching* and Google calls *enhanced conversions*.\n *\n * ## Why these fields are here at all\n *\n * A server event is worth what it can be joined to. An email is the join that\n * works, and everything in this file is the second-best set for when the join\n * has to happen *outward* instead — Meta and Google both accept an event with\n * no email at all if it carries enough of a person: a name and a postcode, a\n * click id, a browser cookie. They disagree about spelling and about what has\n * to be hashed, and they do not disagree about the set.\n *\n * Two things follow, and they are the whole design:\n *\n * - **One block, one spelling.** A sender maps their CRM once, here, rather\n *   than once per destination. `MATCH_FIELD_FORWARDING` is the table that says\n *   what each field is called on the other side, so the mapping is published\n *   rather than folklore.\n * - **Kept in the form every destination can still be derived from.** That rule\n *   decides, per field, whether it is stored hashed or in the clear, and it is\n *   the only rule here worth remembering: **a digest can be computed later and\n *   never undone.** A city hashed on arrival can never be sent to Google, which\n *   wants `address_info.city` in plain text; a city kept in the clear can be\n *   hashed for Meta at the moment of sending, for free.\n *\n * So: hashed here are the fields **both** destinations want hashed and which\n * identify a person on their own — email, phone, the two names, the date of\n * birth, and the sender's own id. Kept in the clear are the coarse ones that\n * identify nobody by themselves and that Google wants unhashed: city, region,\n * postal code, country, and the gender letter. Hashing that second set would\n * buy no privacy — the digest of `es` is not a secret — and would cost the\n * ability to send them anywhere.\n *\n * ## A value that arrives already hashed\n *\n * Accepted for every field, and detected rather than declared. There is no\n * `email_sha256` beside `email` any more, because two fields for one idea is a\n * choice a sender should never have had to make: a 64-character hex string is\n * unambiguously a digest — no address, phone number, city or name can be one —\n * so the field can hold either and we can tell. What we cannot do is *unhash*,\n * so a digest arriving for a field this module would otherwise keep in the\n * clear is stored under `<field>_sha256`: the key says what is inside it, and a\n * forward that needs the plain value knows it does not have one.\n *\n * ## Normalization is Meta's, and the divergence is stated\n *\n * The hashed fields are normalized under the rule Meta publishes (lower case,\n * trimmed, punctuation and spacing removed) because a digest can only be\n * computed under one rule and Meta's is the stricter of the two. Google's rule\n * for a name is lower-case-and-trim only, so the two agree on every name\n * without punctuation in it and differ on `O'Brien`. Email and phone do not\n * have this problem: they go through `../identity`, which is the platform's one\n * versioned rule and the same one the browser beacon writes with — which is\n * what makes a server event and a Form submission land on one person.\n */\n\nimport { isSha256Hex, sha256Hex } from \"../identity\";\n\n/**\n * A field of `user_data` that describes the person rather than naming a click.\n *\n * `email` and `phone` are deliberately not here: they are resolved by\n * `./identity` into the row's own `identity_hash`, under the platform's\n * versioned rule, and this module reads that result rather than hashing them a\n * second time under a different one.\n */\nexport const MATCH_FIELDS = [\n  \"first_name\",\n  \"last_name\",\n  \"date_of_birth\",\n  \"gender\",\n  \"city\",\n  \"region\",\n  \"postal_code\",\n  \"country\",\n] as const;\nexport type MatchField = (typeof MATCH_FIELDS)[number];\n\n/**\n * The browser cookies Meta's pixel sets, which name a browser rather than a\n * person.\n *\n * `fbp` is the pixel's own first-party cookie and `fbc` is the one it derives\n * from a click. Both are sent to Meta **unhashed and verbatim** — they are\n * opaque strings of Meta's own making, and hashing one destroys it — so they\n * are stored exactly as they arrived.\n *\n * They are not in {@link MATCH_FIELDS} and not in the click-id list either.\n * They are not click ids: a `gclid` is stamped on a URL by the ad platform and\n * has a column of its own here because reports filter on it, while `fbp` is a\n * cookie a script wrote and nothing reports on. But they *do* name somebody,\n * which is why `namesSomebody` counts them — an event carrying only an `fbp` is\n * still an event Meta can attribute, and refusing it would lose exactly the\n * conversions this block exists to make sendable.\n */\nexport const MATCH_COOKIES = [\"fbp\", \"fbc\"] as const;\nexport type MatchCookie = (typeof MATCH_COOKIES)[number];\n\n/** How a field is stored, once it has been normalized. */\ntype Keeping = \"hashed\" | \"plain\";\n\ntype MatchSpec = {\n  keep: Keeping;\n  /** The canonical form, or `null` when the value says nothing usable. */\n  normalize: (value: string) => string | null;\n  /** What Meta and Google call this field, for the published mapping. */\n  meta: string;\n  google: string | null;\n};\n\n/** Lower-cased, trimmed, and stripped of everything that is not a letter or a digit. Meta's rule. */\nfunction tightened(value: string): string | null {\n  const stripped = value.toLowerCase().replace(/[^\\p{L}\\p{N}]/gu, \"\");\n  return stripped === \"\" ? null : stripped;\n}\n\n/** Lower-cased and trimmed, with runs of whitespace collapsed. Nothing else is removed. */\nfunction loosened(value: string): string | null {\n  const collapsed = value.trim().toLowerCase().replace(/\\s+/g, \" \");\n  return collapsed === \"\" ? null : collapsed;\n}\n\n/**\n * `1985-04-09`, `1985/04/09`, `19850409` — eight digits in year-month-day\n * order, however they are punctuated.\n *\n * The order is not guessed. `09/04/1985` is refused rather than read as the\n * ninth of April or the fourth of September: nothing in the value says which,\n * and a birth date hashed under the wrong reading is a digest that matches\n * nobody at Meta, with no error anywhere to say so. A refusal costs one field\n * on one event and is visible in the arrival log; a wrong guess costs the match\n * and is not.\n */\nfunction birthDate(value: string): string | null {\n  const digits = value.replace(/\\D/g, \"\");\n  if (!/^\\d{8}$/.test(digits)) return null;\n  const month = Number(digits.slice(4, 6));\n  const day = Number(digits.slice(6, 8));\n  if (month < 1 || month > 12 || day < 1 || day > 31) return null;\n  return digits;\n}\n\n/** `f` or `m`, from whatever word or letter the sender's system stores. */\nfunction genderLetter(value: string): string | null {\n  const first = value.trim().toLowerCase().charAt(0);\n  return first === \"f\" || first === \"m\" ? first : null;\n}\n\n/** ISO-3166 alpha-2, lower-cased. A country name is refused rather than guessed at. */\nfunction countryCode(value: string): string | null {\n  const code = value.trim().toLowerCase();\n  return /^[a-z]{2}$/.test(code) ? code : null;\n}\n\nexport const MATCH_SPECS: Readonly<Record<MatchField, MatchSpec>> = {\n  first_name: { keep: \"hashed\", normalize: tightened, meta: \"fn\", google: \"hashed_first_name\" },\n  last_name: { keep: \"hashed\", normalize: tightened, meta: \"ln\", google: \"hashed_last_name\" },\n  // Meta only. Google's enhanced conversions have no date of birth, so there is\n  // no destination wanting it in the clear and every reason not to keep one.\n  date_of_birth: { keep: \"hashed\", normalize: birthDate, meta: \"db\", google: null },\n  gender: { keep: \"plain\", normalize: genderLetter, meta: \"ge\", google: null },\n  city: { keep: \"plain\", normalize: loosened, meta: \"ct\", google: \"city\" },\n  region: { keep: \"plain\", normalize: loosened, meta: \"st\", google: \"state\" },\n  postal_code: { keep: \"plain\", normalize: loosened, meta: \"zp\", google: \"postal_code\" },\n  country: { keep: \"plain\", normalize: countryCode, meta: \"country\", google: \"country_code\" },\n};\n\n/** One row of the published mapping: our name, Meta's, Google's, and whether we hold it hashed. */\nexport type MatchFieldForwarding = {\n  field: string;\n  meta: string;\n  google: string | null;\n  hashed: boolean;\n};\n\n/**\n * What each field of the matching block is called at the destinations that\n * accept it — the table the dialog and the docs both read.\n *\n * Published rather than described, because \"it maps onto Meta's user_data\" is\n * a promise a sender cannot check and this is the same promise they can.\n */\nexport const MATCH_FIELD_FORWARDING: readonly MatchFieldForwarding[] = [\n  { field: \"email\", meta: \"em\", google: \"hashed_email\", hashed: true },\n  { field: \"phone\", meta: \"ph\", google: \"hashed_phone_number\", hashed: true },\n  // Kept in the clear — see `resolveOwnId`. The digest is still computed and\n  // still stored beside it, so a Meta forward has one; what changed is that the\n  // sender's own key is now readable, which is the entire reason they sent it.\n  { field: \"external_id\", meta: \"external_id\", google: null, hashed: false },\n  ...MATCH_FIELDS.map((field) => ({\n    field,\n    meta: MATCH_SPECS[field].meta,\n    google: MATCH_SPECS[field].google,\n    hashed: MATCH_SPECS[field].keep === \"hashed\",\n  })),\n  { field: \"fbp\", meta: \"fbp\", google: null, hashed: false },\n  { field: \"fbc\", meta: \"fbc\", google: null, hashed: false },\n];\n\n/** The longest a stored match value may be, matching the width the map's values are held at. */\nconst MAX_MATCH_VALUE = 255;\n\n/**\n * One field, resolved to the key it is stored under and the value stored there.\n *\n * `null` when the field said nothing usable — `gender: \"unknown\"`, a country\n * spelled out in full, a postcode of whitespace. A field that is present and\n * unusable contributes nothing rather than storing something that matches\n * nobody, which is the same rule the identity resolution follows.\n */\nexport async function resolveMatchField(\n  field: MatchField,\n  raw: string,\n): Promise<{ key: string; value: string } | null> {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  const spec = MATCH_SPECS[field];\n  // Already a digest, whatever this field would otherwise keep. Taken at face\n  // value — hashing a hash matches nothing, forever — and keyed so that the\n  // name says what is inside, because a plain-text destination cannot use it.\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  const normalized = spec.normalize(value);\n  if (normalized === null) return null;\n  if (spec.keep === \"plain\") return { key: field, value: normalized.slice(0, MAX_MATCH_VALUE) };\n  return { key: `${field}_sha256`, value: await sha256Hex(normalized) };\n}\n\n/**\n * The two ids that are not facts about a person but *names the sender chose*,\n * kept exactly as they were sent.\n *\n * `external_id` is the client's own key — a HubSpot contact id, a Salesforce\n * record id — and `baker_id` is a cookie value one of our own pages minted.\n * Neither describes anybody: they are pointers, and a pointer is worth only\n * what it can be followed with.\n *\n * ## Why these are the exception to \"identifying fields are hashed\"\n *\n * `external_id` used to be hashed here and nothing else, on the reasoning that\n * it is sometimes an email or a document number in disguise. That reasoning\n * held and the consequence did not: it made the field **useless to the person\n * who sent it**. An integrator posting `external_id: \"hs:contact:12345\"` opened\n * the event and read *Provided, stored hashed* — no way to check we had read\n * the right record, no way to paste the id back into their CRM, and no way to\n * tell a working integration from one silently keyed on the wrong column. The\n * whole point of the field is to be recognised on the way back out.\n *\n * The privacy this bought was also smaller than it looked. The digest is still\n * computed, still what `identity_hash` stores and still what the identity graph\n * joins on — see `./identity` — so nothing about the joining changed. What is\n * new is a second copy in the clear, under the key that says so.\n *\n * A value that arrives *already* a digest still keeps `<field>_sha256`, for the\n * rule that governs every field here: a digest cannot be undone, so the key has\n * to say what is inside it.\n */\nexport function resolveOwnId(field: \"external_id\" | \"baker_id\", raw: string): { key: string; value: string } | null {\n  const value = raw.trim();\n  if (value === \"\") return null;\n  if (isSha256Hex(value)) return { key: `${field}_sha256`, value: value.toLowerCase() };\n  return { key: field, value: value.slice(0, MAX_MATCH_VALUE) };\n}\n\n/** A cookie value, as Meta minted it: bounded, and otherwise untouched. */\nexport function resolveMatchCookie(raw: string): string | null {\n  const value = raw.trim();\n  return value === \"\" ? null : value.slice(0, MAX_MATCH_VALUE);\n}\n\n/**\n * The `fbclid` hiding inside an `fbc`, or `null`.\n *\n * `fbc` is `fb.<subdomain index>.<timestamp>.<fbclid>` — Meta's own encoding of\n * a click id it already saw. A sender whose system stored the cookie has the\n * click id and does not know it, so reading it out costs one split and gives\n * the event the same paid-attribution column a landing page would have written\n * from the URL. Nothing is invented: the value was there.\n */\nexport function fbclidFromFbc(fbc: string): string | null {\n  const parts = fbc.split(\".\");\n  if (parts.length < 4 || parts[0] !== \"fb\") return null;\n  const id = parts.slice(3).join(\".\");\n  return id === \"\" ? null : id;\n}\n"],"mappings":";AAcA,IAAM,aAAa;AAQZ,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK,KAAK;AAC9B;;;ACNO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,YAAY,KAAK,OAAO;AACjC;AAGA,IAAM,QAAQ;AAMP,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,SAAO,MAAM,KAAK,OAAO,IAAI,UAAU;AACzC;;;AChBO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,SAAS,IACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,EAAE;AACxB,SAAO,WAAW,KAAK,OAAO,IAAI,MAAM;AAC1C;AAGA,IAAM,oBAAoB;AAE1B,IAAM,OAAO;AAYN,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,UAAU,IAAI,QAAQ,mBAAmB,EAAE;AACjD,QAAM,OAAO,QAAQ,WAAW,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,KAAK;AACjE,SAAO,KAAK,KAAK,IAAI,IAAI,OAAO;AAClC;;;ACgBO,SAAS,kBAAkB,KAAoB,SAAyD;AAC7G,QAAM,QACJ,IAAI,SAAS,UACT,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK,IAC5B,YAAY,IACV,iBAAiB,IAAI,KAAK,IAC1B,iBAAiB,IAAI,KAAK;AAClC,SAAO,UAAU,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,OAAO,sBAAsB,QAAQ;AACxF;;;ACHO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAgB,CAAC,OAAO,KAAK;AAgB1C,SAAS,UAAU,OAA8B;AAC/C,QAAM,WAAW,MAAM,YAAY,EAAE,QAAQ,mBAAmB,EAAE;AAClE,SAAO,aAAa,KAAK,OAAO;AAClC;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AAChE,SAAO,cAAc,KAAK,OAAO;AACnC;AAaA,SAAS,UAAU,OAA8B;AAC/C,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,MAAI,CAAC,UAAU,KAAK,MAAM,EAAG,QAAO;AACpC,QAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACvC,QAAM,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AACrC,MAAI,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK,MAAM,GAAI,QAAO;AAC3D,SAAO;AACT;AAGA,SAAS,aAAa,OAA8B;AAClD,QAAM,QAAQ,MAAM,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;AACjD,SAAO,UAAU,OAAO,UAAU,MAAM,QAAQ;AAClD;AAGA,SAAS,YAAY,OAA8B;AACjD,QAAM,OAAO,MAAM,KAAK,EAAE,YAAY;AACtC,SAAO,aAAa,KAAK,IAAI,IAAI,OAAO;AAC1C;AAEO,IAAM,cAAuD;AAAA,EAClE,YAAY,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,oBAAoB;AAAA,EAC5F,WAAW,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,mBAAmB;AAAA;AAAA;AAAA,EAG1F,eAAe,EAAE,MAAM,UAAU,WAAW,WAAW,MAAM,MAAM,QAAQ,KAAK;AAAA,EAChF,QAAQ,EAAE,MAAM,SAAS,WAAW,cAAc,MAAM,MAAM,QAAQ,KAAK;AAAA,EAC3E,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,OAAO;AAAA,EACvE,QAAQ,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,QAAQ;AAAA,EAC1E,aAAa,EAAE,MAAM,SAAS,WAAW,UAAU,MAAM,MAAM,QAAQ,cAAc;AAAA,EACrF,SAAS,EAAE,MAAM,SAAS,WAAW,aAAa,MAAM,WAAW,QAAQ,eAAe;AAC5F;AAiBO,IAAM,yBAA0D;AAAA,EACrE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,gBAAgB,QAAQ,KAAK;AAAA,EACnE,EAAE,OAAO,SAAS,MAAM,MAAM,QAAQ,uBAAuB,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI1E,EAAE,OAAO,eAAe,MAAM,eAAe,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzE,GAAG,aAAa,IAAI,CAAC,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,KAAK,EAAE;AAAA,IACzB,QAAQ,YAAY,KAAK,EAAE;AAAA,IAC3B,QAAQ,YAAY,KAAK,EAAE,SAAS;AAAA,EACtC,EAAE;AAAA,EACF,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACzD,EAAE,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ,MAAM;AAC3D;","names":[]}

package/dist/chunk-GE3VT3CA.js

@@ -0,0 +1,51 @@
+import {
+  failApi
+} from "./chunk-UDIEKCIR.js";
+import {
+  HUBSPOT_MISSING_GRANT_MARKER,
+  HUBSPOT_NOT_CONNECTED_MESSAGE
+} from "./chunk-PC3FJEZH.js";
+import {
+  ApiError
+} from "./chunk-X7VQFLHI.js";
+import {
+  writeJson
+} from "./chunk-Q7US4OOA.js";
+
+// src/commands/hubspot/refusal.ts
+var CONTINUE = "Keep going with the wider task: say which part you could not read, skip it, and finish everything else. If the `request_connection` call fails, say so plainly and give the exact route: dashboard \u2192 Brain \u2192 Integrations \u2192 Platforms \u2192 HubSpot.";
+function hubspotRefusal(code, message, reason = "so I can count a contact becoming a customer") {
+  if (code === "NOT_FOUND" && message.includes(HUBSPOT_NOT_CONNECTED_MESSAGE)) {
+    return {
+      code: "NO_HUBSPOT_CONNECTION",
+      fix: {
+        action: "request_connection",
+        explanation: `AGENT INSTRUCTION: HubSpot is not connected, and only the user can connect it. Call the \`request_connection\` tool with { platform: "hubspot", reason } \u2014 reason in their words, e.g. "${reason}" \u2014 and they connect it inside the chat; then run this command again. ` + CONTINUE
+      }
+    };
+  }
+  if (code === "FORBIDDEN" && message.includes(HUBSPOT_MISSING_GRANT_MARKER)) {
+    return {
+      code: "HUBSPOT_RECONNECT_REQUIRED",
+      fix: {
+        action: "request_connection",
+        explanation: 'AGENT INSTRUCTION: HubSpot is connected \u2014 do not tell the user it is missing, and do not retry. Its access does not cover this read (it was connected before Baker asked for it, or the access was withdrawn), and only the user can widen it. Call the `request_connection` tool with { platform: "hubspot", reason } naming what you need to read; the card offers them a Reconnect button. Run this command again once they have. ' + CONTINUE
+      }
+    };
+  }
+  return null;
+}
+function failNotConnected(err, reason) {
+  const refusal = err instanceof ApiError ? hubspotRefusal(err.code, err.message, reason) : null;
+  if (err instanceof ApiError && refusal !== null) {
+    writeJson({ ok: false, error: { code: refusal.code, message: err.message, fix: refusal.fix } });
+    process.exit(1);
+  }
+  failApi(err);
+}
+
+export {
+  hubspotRefusal,
+  failNotConnected
+};
+//# sourceMappingURL=chunk-GE3VT3CA.js.map