@koda-sl/baker-cli 0.525.0 → 0.527.0

package/dist/chunk-BN4TDL5L.js

@@ -0,0 +1,217 @@
+import {
+  termsRefusalFix
+} from "./chunk-QALAJNBG.js";
+import {
+  cacheGet,
+  cacheSet,
+  handleConnectionError,
+  isOrganizationReadRefusal,
+  needsConnectionFix,
+  writeAdsJson,
+  writeJsonEnvelope
+} from "./chunk-HPDGVK6R.js";
+import {
+  ApiError,
+  apiGet
+} from "./chunk-B4UVJCJ4.js";
+import {
+  getEnv
+} from "./chunk-52IYZCRS.js";
+
+// ../api/src/ads-meta/permissionGates.ts
+var META_PERMISSION_NOT_ENABLED_MESSAGE = {
+  catalog: "Catalog changes need the Catalog permission for Meta \u2014 ask a Baker admin to turn it on, then reconnect Meta. Everything else on Meta keeps working: tell the user, and carry on with the rest of the job.",
+  pagePosts: "Facebook Page posts need the Page posts permission for Meta \u2014 ask a Baker admin to turn it on, then reconnect Meta. Everything else on Meta keeps working: tell the user, and carry on with the rest of the job."
+};
+var META_PERMISSION_RECONNECT_MESSAGE = {
+  catalog: "Catalog changes need the Catalog permission for Meta. It is turned on for this company, but this Meta connection was made before, so it does not hold it \u2014 ask the user to reconnect Meta in the dashboard, then try again. Everything else on Meta keeps working meanwhile.",
+  pagePosts: "Facebook Page posts need the Page posts permission for Meta. It is turned on for this company, but this Meta connection was made before, so it does not hold it \u2014 ask the user to reconnect Meta in the dashboard, then try again. Everything else on Meta keeps working meanwhile."
+};
+var META_UNREQUESTED_PERMISSION_MESSAGE = {
+  comments: "Reading and moderating comments on ads needs Meta permissions Baker's Meta connection does not ask for yet (reading people's comments and managing them on the Page). Tell the user that comment moderation happens in Meta Business Suite for now, and carry on with the rest of the job.",
+  instagramMedia: "Listing an Instagram account's posts needs a Meta permission Baker's Meta connection does not ask for yet. Ask the user for the post's link or id instead, or boost it from Meta Business Suite, and carry on."
+};
+var META_PAGE_ADS_PERMISSION_REMEDY = "A Baker admin turns it on with the lead ads switch for this company; then the user reconnects Meta in the dashboard. Tell the user, and carry on with the rest of the job.";
+function isMetaPermissionGateRefusal(message) {
+  return [
+    ...Object.values(META_PERMISSION_NOT_ENABLED_MESSAGE),
+    ...Object.values(META_PERMISSION_RECONNECT_MESSAGE),
+    ...Object.values(META_UNREQUESTED_PERMISSION_MESSAGE),
+    META_PAGE_ADS_PERMISSION_REMEDY
+  ].some((refusal) => message.includes(refusal));
+}
+
+// src/commands/ads/meta/shared.ts
+var DAY_MS = 864e5;
+function metaForbiddenFix(message) {
+  if (isMetaPermissionGateRefusal(message)) {
+    return { action: "reject", explanation: message };
+  }
+  if (message.includes("has not accepted Meta's Lead Generation Terms")) {
+    return {
+      action: "reject",
+      explanation: `${message}
+
+Meta confirmed the Page's terms status using its Page access. Give the Page owner the terms link in the error and ask them to accept it before trying the form or lead ad set again. Do not suggest reconnecting Meta for this refusal; continue with other work that does not require the form or ad set.`
+    };
+  }
+  return {
+    action: "reject",
+    explanation: [
+      message,
+      "This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.",
+      "If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.",
+      "If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it \u2014 the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources \u2192 Datasets for a pixel).",
+      "Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why \u2014 never present the task as verified when this step was skipped."
+    ].join("\n\n")
+  };
+}
+function handleMetaError(err) {
+  if (err instanceof ApiError) {
+    if (needsConnectionFix(err.code, err.message)) {
+      handleConnectionError("meta_ads", err.message);
+    }
+    const terms = termsRefusalFix(err.code, err.message);
+    if (terms) {
+      writeJsonEnvelope({
+        ok: false,
+        error: { code: terms.code, message: err.message, fix: terms.fix, retryable: false }
+      });
+      process.exit(1);
+    }
+    const envelope = {
+      ok: false,
+      error: {
+        code: err.code,
+        message: err.message,
+        fix: err.code === "FORBIDDEN" && !isOrganizationReadRefusal(err.message) ? metaForbiddenFix(err.message) : { action: "reject", explanation: err.message },
+        retryable: err.code === "RATE_LIMITED" || err.code === "UNAVAILABLE" || err.code === "INTERNAL_ERROR"
+      }
+    };
+    writeAdsJson(envelope);
+    process.exit(1);
+  }
+  const message = err instanceof Error ? err.message : "Unexpected error";
+  writeAdsJson({ ok: false, error: { code: "NETWORK_ERROR", message } });
+  process.exit(1);
+}
+var ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;
+var CONNECTED_ACCOUNTS_TTL_MS = 60 * 60 * 1e3;
+function invalidAccountId(id) {
+  writeAdsJson({
+    ok: false,
+    error: {
+      code: "INVALID_ACCOUNT_ID",
+      message: `Invalid account ID "${id}". Expected numeric ID, optionally prefixed with "act_".`
+    }
+  });
+  process.exit(1);
+}
+function actId(id) {
+  return id.startsWith("act_") ? id : `act_${id}`;
+}
+async function connectedMetaAccounts(useCache) {
+  if (useCache) {
+    const cached = cacheGet("meta-accounts", "list");
+    if (cached) return cached.data;
+  }
+  const accounts = await apiGet(
+    "/api/ads/meta/accounts",
+    useCache ? void 0 : { "skip-cache": "true" }
+  );
+  if (useCache && accounts.length > 0) cacheSet("meta-accounts", "list", accounts, CONNECTED_ACCOUNTS_TTL_MS);
+  return accounts;
+}
+async function resolveAccountIdArg(args) {
+  const fromArgs = args["account-id"];
+  const explicit = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;
+  if (explicit) {
+    if (!ACCOUNT_ID_RE.test(explicit)) invalidAccountId(explicit);
+    return actId(explicit);
+  }
+  let accounts;
+  try {
+    accounts = await connectedMetaAccounts(!args["no-cache"]);
+  } catch (err) {
+    handleMetaError(err);
+  }
+  const ids = accounts.flatMap((account) => {
+    const id = account.externalId ?? account.id;
+    return id && ACCOUNT_ID_RE.test(id) ? [{ id: actId(id), name: account.name }] : [];
+  });
+  const [single] = ids;
+  if (ids.length === 1 && single) {
+    process.stderr.write(`Using account "${single.name ?? single.id}" (${single.id})
+`);
+    return single.id;
+  }
+  const listed = ids.map((account) => account.name ? `${account.id} (${account.name})` : account.id).join("; ");
+  writeAdsJson({
+    ok: false,
+    error: {
+      code: "MISSING_ACCOUNT_ID",
+      message: ids.length === 0 ? "This company has no Meta ad account selected, so there is no account to default to." : `This company connected ${ids.length} Meta ad accounts, so pass --account-id to name one: ${listed}.`,
+      fix: {
+        action: "reject",
+        explanation: ids.length === 0 ? "Ask the user to select a Meta ad account for this company in Baker's Meta connection, or pass --account-id act_<id> for one the login reaches (`baker ads meta accounts --available`)." : `Re-run with --account-id set to one of: ${listed}. A question about the whole business covers all ${ids.length}.`
+      },
+      retryable: false
+    }
+  });
+  process.exit(1);
+}
+function getDateRange(args) {
+  const datePreset = args["date-preset"];
+  const since = args.since;
+  const until = args.until;
+  if (since && until) return { since, until };
+  return { datePreset: datePreset ?? "last_7d" };
+}
+function todayIso() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function daysAgoIso(days) {
+  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);
+}
+function csvOrJson(args) {
+  return args.output ?? "json";
+}
+var NAME_CONTAINS_ARG = {
+  type: "string",
+  description: "Only rows whose name contains this text, matched by Meta before anything is returned. Start here to find one entity by name: --name-contains octubre --all-statuses"
+};
+function resolveEffectiveStatus(args) {
+  if (args["all-statuses"]) {
+    return void 0;
+  }
+  const explicit = args["effective-status"];
+  if (explicit) {
+    return explicit;
+  }
+  return "ACTIVE";
+}
+function statusFilterHints(rows, effectiveStatus, noun) {
+  if (rows.length > 0 || effectiveStatus === void 0) return [];
+  if (effectiveStatus === "ACTIVE") {
+    return [
+      `No ACTIVE ${noun}. The ACTIVE filter hides paused, archived and in-review ones (under a paused campaign or ad set that is all of them), so this does NOT mean none exist. Re-run with --all-statuses before concluding there are none.`
+    ];
+  }
+  return [
+    `No ${noun} with effective_status ${effectiveStatus}. Re-run with --all-statuses to see every status before concluding there are none.`
+  ];
+}
+
+export {
+  metaForbiddenFix,
+  handleMetaError,
+  resolveAccountIdArg,
+  getDateRange,
+  todayIso,
+  daysAgoIso,
+  csvOrJson,
+  NAME_CONTAINS_ARG,
+  resolveEffectiveStatus,
+  statusFilterHints
+};
+//# sourceMappingURL=chunk-BN4TDL5L.js.map

package/dist/chunk-BN4TDL5L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../api/src/ads-meta/permissionGates.ts","../src/commands/ads/meta/shared.ts"],"sourcesContent":["/**\n * The refusals Baker writes for Meta work that needs a permission the baseline\n * connection does not ask for — managing catalogs (`catalog_management`) and\n * posting to a Facebook Page (`pages_manage_posts`). Shared verbatim by the\n * backend that throws them and the CLI that explains them, for the same reason\n * as `leadAds.ts`: these name their own cause and remedy, so the CLI must not\n * append Meta's ambiguous \"maybe reconnect, maybe an unassigned asset\" advice.\n */\n\nexport type MetaPermissionGate = \"catalog\" | \"pagePosts\";\n\n/** Everything a person or the agent can see about one per-company Meta permission. */\nexport interface MetaPermissionState {\n  /** A Baker admin switched it on for this company, so the consent screen asks for it. */\n  enabled: boolean;\n  /** The current Meta connection holds it. */\n  granted: boolean;\n  /** Switched on, but the connection predates it — reconnecting Meta is the fix. */\n  reconnectNeeded: boolean;\n}\n\nexport type MetaPermissionStates = Record<\"leadAds\" | MetaPermissionGate, MetaPermissionState>;\n\nexport const META_PERMISSION_NOT_ENABLED_MESSAGE: Record<MetaPermissionGate, string> = {\n  catalog:\n    \"Catalog changes need the Catalog permission for Meta — ask a Baker admin to turn it on, then reconnect Meta. \" +\n    \"Everything else on Meta keeps working: tell the user, and carry on with the rest of the job.\",\n  pagePosts:\n    \"Facebook Page posts need the Page posts permission for Meta — ask a Baker admin to turn it on, then reconnect \" +\n    \"Meta. Everything else on Meta keeps working: tell the user, and carry on with the rest of the job.\",\n};\n\nexport const META_PERMISSION_RECONNECT_MESSAGE: Record<MetaPermissionGate, string> = {\n  catalog:\n    \"Catalog changes need the Catalog permission for Meta. It is turned on for this company, but this Meta \" +\n    \"connection was made before, so it does not hold it — ask the user to reconnect Meta in the dashboard, then \" +\n    \"try again. Everything else on Meta keeps working meanwhile.\",\n  pagePosts:\n    \"Facebook Page posts need the Page posts permission for Meta. It is turned on for this company, but this Meta \" +\n    \"connection was made before, so it does not hold it — ask the user to reconnect Meta in the dashboard, then \" +\n    \"try again. Everything else on Meta keeps working meanwhile.\",\n};\n\n/**\n * Work that needs a Meta permission Baker's connection does not ask for at all\n * (no switch turns it on): reading and moderating comments on ads\n * (`pages_read_user_content`, `pages_manage_engagement`) and listing an\n * Instagram account's posts (`instagram_basic`). Live on v26.0 (2026-10-15)\n * Meta refused both with code 10.\n */\nexport const META_UNREQUESTED_PERMISSION_MESSAGE = {\n  comments:\n    \"Reading and moderating comments on ads needs Meta permissions Baker's Meta connection does not ask for yet \" +\n    \"(reading people's comments and managing them on the Page). Tell the user that comment moderation happens in \" +\n    \"Meta Business Suite for now, and carry on with the rest of the job.\",\n  instagramMedia:\n    \"Listing an Instagram account's posts needs a Meta permission Baker's Meta connection does not ask for yet. \" +\n    \"Ask the user for the post's link or id instead, or boost it from Meta Business Suite, and carry on.\",\n} as const;\n\nconst META_PAGE_ADS_PERMISSION_REMEDY =\n  \"A Baker admin turns it on with the lead ads switch for this company; then the user reconnects Meta in the dashboard. \" +\n  \"Tell the user, and carry on with the rest of the job.\";\n\n/**\n * Click-to-message ads and Instant Experiences need Meta's Page ads permission\n * (`pages_manage_ads`), which only the lead ads switch adds to the consent\n * screen. `work` names what was refused (\"Click-to-message ads\").\n */\nexport function metaPageAdsPermissionMessage(work: string): string {\n  return `${work} need Meta's Page ads permission, and this Meta connection does not have it. ${META_PAGE_ADS_PERMISSION_REMEDY}`;\n}\n\n/**\n * Whether a `FORBIDDEN` message carries one of these refusals. `includes`, not\n * equality: a stage-time refusal may lead with what the op was trying to do.\n */\nexport function isMetaPermissionGateRefusal(message: string): boolean {\n  return [\n    ...Object.values(META_PERMISSION_NOT_ENABLED_MESSAGE),\n    ...Object.values(META_PERMISSION_RECONNECT_MESSAGE),\n    ...Object.values(META_UNREQUESTED_PERMISSION_MESSAGE),\n    META_PAGE_ADS_PERMISSION_REMEDY,\n  ].some((refusal) => message.includes(refusal));\n}\n","import { isMetaPermissionGateRefusal } from \"@baker/api/ads-meta/permissionGates\";\nimport { ApiError, apiGet } from \"../../../client.ts\";\nimport { getEnv } from \"../../../env.ts\";\nimport { handleConnectionError, isOrganizationReadRefusal, needsConnectionFix } from \"../../../error-handler.ts\";\nimport { cacheGet, cacheSet } from \"../cache.ts\";\nimport { writeAdsJson, writeJsonEnvelope } from \"../output.ts\";\nimport { termsRefusalFix } from \"../terms-output.ts\";\nimport type { AdsErrorEnvelope, QueryFix } from \"../types.ts\";\n\nconst DAY_MS = 86_400_000;\n\n/**\n * Meta answers a permission refusal (Graph codes 200/10/294) with a bare\n * \"Permissions error\" that covers two causes needing opposite remedies: a\n * consent grant the connection never got — nothing validates Meta's granted\n * scopes after connect, unlike HubSpot's `requireCapability` — or a role the\n * user lacks on one asset, since a Pixel/Dataset, Page or catalog lives in a\n * Business and is assigned separately from the ad account. Only the blast radius\n * separates them, so hand the agent that test rather than a verdict: guessing\n * \"reconnect\" wastes the user's time on an unassigned asset, and ruling it out\n * strands a connection that really is short a scope.\n */\nexport function metaForbiddenFix(message: string): QueryFix {\n  // Baker's own refusal already names the switch or the reconnect; Meta's\n  // two-cause advice under it would contradict it.\n  if (isMetaPermissionGateRefusal(message)) {\n    return { action: \"reject\", explanation: message };\n  }\n  if (message.includes(\"has not accepted Meta's Lead Generation Terms\")) {\n    return {\n      action: \"reject\",\n      explanation: `${message}\\n\\nMeta confirmed the Page's terms status using its Page access. Give the Page owner the terms link in the error and ask them to accept it before trying the form or lead ad set again. Do not suggest reconnecting Meta for this refusal; continue with other work that does not require the form or ad set.`,\n    };\n  }\n  return {\n    action: \"reject\",\n    explanation: [\n      message,\n      \"This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.\",\n      \"If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.\",\n      \"If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it — the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources → Datasets for a pixel).\",\n      \"Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why — never present the task as verified when this step was skipped.\",\n    ].join(\"\\n\\n\"),\n  };\n}\n\nexport function handleMetaError(err: unknown): never {\n  if (err instanceof ApiError) {\n    if (needsConnectionFix(err.code, err.message)) {\n      handleConnectionError(\"meta_ads\", err.message);\n    }\n    const terms = termsRefusalFix(err.code, err.message);\n    if (terms) {\n      writeJsonEnvelope({\n        ok: false,\n        error: { code: terms.code, message: err.message, fix: terms.fix, retryable: false },\n      });\n      process.exit(1);\n    }\n    const envelope: AdsErrorEnvelope = {\n      ok: false,\n      error: {\n        code: err.code,\n        message: err.message,\n        fix:\n          err.code === \"FORBIDDEN\" && !isOrganizationReadRefusal(err.message)\n            ? metaForbiddenFix(err.message)\n            : { action: \"reject\", explanation: err.message },\n        retryable: err.code === \"RATE_LIMITED\" || err.code === \"UNAVAILABLE\" || err.code === \"INTERNAL_ERROR\",\n      },\n    };\n    writeAdsJson(envelope);\n    process.exit(1);\n  }\n  const message = err instanceof Error ? err.message : \"Unexpected error\";\n  writeAdsJson({ ok: false, error: { code: \"NETWORK_ERROR\", message } });\n  process.exit(1);\n}\n\nconst ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;\nconst CONNECTED_ACCOUNTS_TTL_MS = 60 * 60 * 1000;\n\ninterface ConnectedMetaAccount {\n  externalId?: string;\n  id?: string;\n  name?: string;\n}\n\nfunction invalidAccountId(id: string): never {\n  writeAdsJson({\n    ok: false,\n    error: {\n      code: \"INVALID_ACCOUNT_ID\",\n      message: `Invalid account ID \"${id}\". Expected numeric ID, optionally prefixed with \"act_\".`,\n    },\n  });\n  process.exit(1);\n}\n\nfunction actId(id: string): string {\n  return id.startsWith(\"act_\") ? id : `act_${id}`;\n}\n\nasync function connectedMetaAccounts(useCache: boolean): Promise<ConnectedMetaAccount[]> {\n  if (useCache) {\n    const cached = cacheGet<ConnectedMetaAccount[]>(\"meta-accounts\", \"list\");\n    if (cached) return cached.data;\n  }\n  const accounts = await apiGet<ConnectedMetaAccount[]>(\n    \"/api/ads/meta/accounts\",\n    useCache ? undefined : { \"skip-cache\": \"true\" },\n  );\n  // An empty list is never kept: the refusal asks the user to select an account, and the retry must see it.\n  if (useCache && accounts.length > 0) cacheSet(\"meta-accounts\", \"list\", accounts, CONNECTED_ACCOUNTS_TTL_MS);\n  return accounts;\n}\n\n/**\n * The Meta ad account a command works on: `--account-id`, then\n * `BAKER_META_AD_ACCOUNT_ID`, then the company's only connected account — the\n * default `baker ads meta accounts` promises. With several connected, nothing is\n * picked: the refusal lists them so the next call can name one.\n */\nexport async function resolveAccountIdArg(args: Record<string, unknown>): Promise<string> {\n  const fromArgs = args[\"account-id\"] as string | undefined;\n  const explicit = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;\n  if (explicit) {\n    if (!ACCOUNT_ID_RE.test(explicit)) invalidAccountId(explicit);\n    return actId(explicit);\n  }\n  let accounts: ConnectedMetaAccount[];\n  try {\n    accounts = await connectedMetaAccounts(!args[\"no-cache\"]);\n  } catch (err) {\n    handleMetaError(err);\n  }\n  const ids = accounts.flatMap((account) => {\n    const id = account.externalId ?? account.id;\n    return id && ACCOUNT_ID_RE.test(id) ? [{ id: actId(id), name: account.name }] : [];\n  });\n  const [single] = ids;\n  if (ids.length === 1 && single) {\n    process.stderr.write(`Using account \"${single.name ?? single.id}\" (${single.id})\\n`);\n    return single.id;\n  }\n  const listed = ids.map((account) => (account.name ? `${account.id} (${account.name})` : account.id)).join(\"; \");\n  writeAdsJson({\n    ok: false,\n    error: {\n      code: \"MISSING_ACCOUNT_ID\",\n      message:\n        ids.length === 0\n          ? \"This company has no Meta ad account selected, so there is no account to default to.\"\n          : `This company connected ${ids.length} Meta ad accounts, so pass --account-id to name one: ${listed}.`,\n      fix: {\n        action: \"reject\",\n        explanation:\n          ids.length === 0\n            ? \"Ask the user to select a Meta ad account for this company in Baker's Meta connection, or pass --account-id act_<id> for one the login reaches (`baker ads meta accounts --available`).\"\n            : `Re-run with --account-id set to one of: ${listed}. A question about the whole business covers all ${ids.length}.`,\n      },\n      retryable: false,\n    },\n  });\n  process.exit(1);\n}\n\nexport function getDateRange(args: Record<string, unknown>): { datePreset?: string; since?: string; until?: string } {\n  const datePreset = args[\"date-preset\"] as string | undefined;\n  const since = args.since as string | undefined;\n  const until = args.until as string | undefined;\n  if (since && until) return { since, until };\n  return { datePreset: datePreset ?? \"last_7d\" };\n}\n\nexport function todayIso(): string {\n  return new Date().toISOString().slice(0, 10);\n}\n\nexport function daysAgoIso(days: number): string {\n  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);\n}\n\nexport function csvOrJson(args: Record<string, unknown>): string {\n  return (args.output as string | undefined) ?? \"json\";\n}\n\n/**\n * Matched by Meta itself, so finding one entity by name reads only the rows that\n * match instead of the whole account.\n */\nexport const NAME_CONTAINS_ARG = {\n  type: \"string\",\n  description:\n    \"Only rows whose name contains this text, matched by Meta before anything is returned. Start here to find one entity by name: --name-contains octubre --all-statuses\",\n} as const;\n\n/**\n * Default to ACTIVE-only on listings — that's almost always what an AI agent or\n * a human glance wants. Pass `--effective-status ACTIVE,PAUSED` to override, or\n * `--all-statuses` to drop the filter entirely.\n */\nexport function resolveEffectiveStatus(args: Record<string, unknown>): string | undefined {\n  if (args[\"all-statuses\"]) {\n    return undefined;\n  }\n  const explicit = args[\"effective-status\"] as string | undefined;\n  if (explicit) {\n    return explicit;\n  }\n  return \"ACTIVE\";\n}\n\n/**\n * An empty listing under a status filter reads exactly like \"nothing exists\":\n * a paused campaign's ad sets are CAMPAIGN_PAUSED, so the ACTIVE default hides\n * every one of them. Say which filter produced the empty list and how to widen it.\n */\nexport function statusFilterHints(\n  rows: ReadonlyArray<unknown>,\n  effectiveStatus: string | undefined,\n  noun: string,\n): string[] {\n  if (rows.length > 0 || effectiveStatus === undefined) return [];\n  if (effectiveStatus === \"ACTIVE\") {\n    return [\n      `No ACTIVE ${noun}. The ACTIVE filter hides paused, archived and in-review ones (under a paused campaign or ad set that is all of them), so this does NOT mean none exist. Re-run with --all-statuses before concluding there are none.`,\n    ];\n  }\n  return [\n    `No ${noun} with effective_status ${effectiveStatus}. Re-run with --all-statuses to see every status before concluding there are none.`,\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBO,IAAM,sCAA0E;AAAA,EACrF,SACE;AAAA,EAEF,WACE;AAEJ;AAEO,IAAM,oCAAwE;AAAA,EACnF,SACE;AAAA,EAGF,WACE;AAGJ;AASO,IAAM,sCAAsC;AAAA,EACjD,UACE;AAAA,EAGF,gBACE;AAEJ;AAEA,IAAM,kCACJ;AAgBK,SAAS,4BAA4B,SAA0B;AACpE,SAAO;AAAA,IACL,GAAG,OAAO,OAAO,mCAAmC;AAAA,IACpD,GAAG,OAAO,OAAO,iCAAiC;AAAA,IAClD,GAAG,OAAO,OAAO,mCAAmC;AAAA,IACpD;AAAA,EACF,EAAE,KAAK,CAAC,YAAY,QAAQ,SAAS,OAAO,CAAC;AAC/C;;;AC3EA,IAAM,SAAS;AAaR,SAAS,iBAAiB,SAA2B;AAG1D,MAAI,4BAA4B,OAAO,GAAG;AACxC,WAAO,EAAE,QAAQ,UAAU,aAAa,QAAQ;AAAA,EAClD;AACA,MAAI,QAAQ,SAAS,+CAA+C,GAAG;AACrE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,aAAa,GAAG,OAAO;AAAA;AAAA;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,MAAM;AAAA,EACf;AACF;AAEO,SAAS,gBAAgB,KAAqB;AACnD,MAAI,eAAe,UAAU;AAC3B,QAAI,mBAAmB,IAAI,MAAM,IAAI,OAAO,GAAG;AAC7C,4BAAsB,YAAY,IAAI,OAAO;AAAA,IAC/C;AACA,UAAM,QAAQ,gBAAgB,IAAI,MAAM,IAAI,OAAO;AACnD,QAAI,OAAO;AACT,wBAAkB;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,EAAE,MAAM,MAAM,MAAM,SAAS,IAAI,SAAS,KAAK,MAAM,KAAK,WAAW,MAAM;AAAA,MACpF,CAAC;AACD,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,WAA6B;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,KACE,IAAI,SAAS,eAAe,CAAC,0BAA0B,IAAI,OAAO,IAC9D,iBAAiB,IAAI,OAAO,IAC5B,EAAE,QAAQ,UAAU,aAAa,IAAI,QAAQ;AAAA,QACnD,WAAW,IAAI,SAAS,kBAAkB,IAAI,SAAS,iBAAiB,IAAI,SAAS;AAAA,MACvF;AAAA,IACF;AACA,iBAAa,QAAQ;AACrB,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAa,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,iBAAiB,QAAQ,EAAE,CAAC;AACrE,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,gBAAgB;AACtB,IAAM,4BAA4B,KAAK,KAAK;AAQ5C,SAAS,iBAAiB,IAAmB;AAC3C,eAAa;AAAA,IACX,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,uBAAuB,EAAE;AAAA,IACpC;AAAA,EACF,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,MAAM,IAAoB;AACjC,SAAO,GAAG,WAAW,MAAM,IAAI,KAAK,OAAO,EAAE;AAC/C;AAEA,eAAe,sBAAsB,UAAoD;AACvF,MAAI,UAAU;AACZ,UAAM,SAAS,SAAiC,iBAAiB,MAAM;AACvE,QAAI,OAAQ,QAAO,OAAO;AAAA,EAC5B;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,WAAW,SAAY,EAAE,cAAc,OAAO;AAAA,EAChD;AAEA,MAAI,YAAY,SAAS,SAAS,EAAG,UAAS,iBAAiB,QAAQ,UAAU,yBAAyB;AAC1G,SAAO;AACT;AAQA,eAAsB,oBAAoB,MAAgD;AACxF,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,YAAY,OAAO,EAAE;AACtC,MAAI,UAAU;AACZ,QAAI,CAAC,cAAc,KAAK,QAAQ,EAAG,kBAAiB,QAAQ;AAC5D,WAAO,MAAM,QAAQ;AAAA,EACvB;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,sBAAsB,CAAC,KAAK,UAAU,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,oBAAgB,GAAG;AAAA,EACrB;AACA,QAAM,MAAM,SAAS,QAAQ,CAAC,YAAY;AACxC,UAAM,KAAK,QAAQ,cAAc,QAAQ;AACzC,WAAO,MAAM,cAAc,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,MAAM,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC;AAAA,EACnF,CAAC;AACD,QAAM,CAAC,MAAM,IAAI;AACjB,MAAI,IAAI,WAAW,KAAK,QAAQ;AAC9B,YAAQ,OAAO,MAAM,kBAAkB,OAAO,QAAQ,OAAO,EAAE,MAAM,OAAO,EAAE;AAAA,CAAK;AACnF,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,IAAI,IAAI,CAAC,YAAa,QAAQ,OAAO,GAAG,QAAQ,EAAE,KAAK,QAAQ,IAAI,MAAM,QAAQ,EAAG,EAAE,KAAK,IAAI;AAC9G,eAAa;AAAA,IACX,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SACE,IAAI,WAAW,IACX,wFACA,0BAA0B,IAAI,MAAM,wDAAwD,MAAM;AAAA,MACxG,KAAK;AAAA,QACH,QAAQ;AAAA,QACR,aACE,IAAI,WAAW,IACX,2LACA,2CAA2C,MAAM,oDAAoD,IAAI,MAAM;AAAA,MACvH;AAAA,MACA,WAAW;AAAA,IACb;AAAA,EACF,CAAC;AACD,UAAQ,KAAK,CAAC;AAChB;AAEO,SAAS,aAAa,MAAwF;AACnH,QAAM,aAAa,KAAK,aAAa;AACrC,QAAM,QAAQ,KAAK;AACnB,QAAM,QAAQ,KAAK;AACnB,MAAI,SAAS,MAAO,QAAO,EAAE,OAAO,MAAM;AAC1C,SAAO,EAAE,YAAY,cAAc,UAAU;AAC/C;AAEO,SAAS,WAAmB;AACjC,UAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC7C;AAEO,SAAS,WAAW,MAAsB;AAC/C,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACvE;AAEO,SAAS,UAAU,MAAuC;AAC/D,SAAQ,KAAK,UAAiC;AAChD;AAMO,IAAM,oBAAoB;AAAA,EAC/B,MAAM;AAAA,EACN,aACE;AACJ;AAOO,SAAS,uBAAuB,MAAmD;AACxF,MAAI,KAAK,cAAc,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,KAAK,kBAAkB;AACxC,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,kBACd,MACA,iBACA,MACU;AACV,MAAI,KAAK,SAAS,KAAK,oBAAoB,OAAW,QAAO,CAAC;AAC9D,MAAI,oBAAoB,UAAU;AAChC,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,IAAI,0BAA0B,eAAe;AAAA,EACrD;AACF;","names":[]}

package/dist/chunk-C5UFKDAX.js

@@ -0,0 +1,377 @@
+import {
+  handleLinkedinError,
+  resolveAccountIdArg
+} from "./chunk-364TCROV.js";
+import {
+  adCopyHints,
+  booleanWordPositionalError,
+  capabilityFix
+} from "./chunk-WPAW6EVY.js";
+import {
+  withHints
+} from "./chunk-D5FY4FAK.js";
+import {
+  writeJsonEnvelope
+} from "./chunk-HPDGVK6R.js";
+import {
+  LINKEDIN_DRAFT_BATCH_MAX,
+  linkedinDraftOpInputSchema,
+  listColumnField
+} from "./chunk-HVJJEQDQ.js";
+import {
+  maskPersonValue
+} from "./chunk-SOPVIIUW.js";
+import {
+  apiPost
+} from "./chunk-B4UVJCJ4.js";
+import {
+  requireChatId
+} from "./chunk-52IYZCRS.js";
+
+// src/commands/ads/linkedin/write-shared.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+
+// src/commands/ads/linkedin/approval-hint.ts
+function approvalHints(op, staged) {
+  if (!staged.authorApprovalPending) return [];
+  const postId = staged.sponsoredPostId ?? op.payload.content?.bakerPostId ?? "<post id>";
+  return [
+    `If the user says the author already approved this post for this ad account, record it \u2014 \`baker posts approved ${postId} --account-id ${op.accountId}\` \u2014 and the reminder stops. Don't record it on a guess.`
+  ];
+}
+
+// src/commands/ads/linkedin/write-shared.ts
+var TOTAL_BUDGET_HELP = "Lifetime budget \u2014 on something already running it must exceed spend to date, or LinkedIn rejects it";
+function bareAccountId(args) {
+  const raw = resolveAccountIdArg(args);
+  return raw.replace(/^urn:li:sponsoredAccount:/, "").replace(/^sponsoredAccount:/, "");
+}
+function failWriteValidation(message) {
+  writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
+  process.exit(1);
+}
+function loadJsonFileArg(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      failWriteValidation(`${path} must contain a JSON object`);
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      failWriteValidation(`${path} is not valid JSON: ${err.message}`);
+    }
+    throw err;
+  }
+}
+function mergePayload(file, flags) {
+  const merged = { ...file };
+  for (const [key, value] of Object.entries(flags)) {
+    if (value !== void 0) {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function loadPatchArg(args) {
+  const file = typeof args.file === "string" && args.file.length > 0 ? args.file : void 0;
+  const inline = typeof args.patch === "string" && args.patch.length > 0 ? args.patch : void 0;
+  if (Boolean(file) === Boolean(inline)) {
+    failWriteValidation("pass exactly one of --file <patch.json> or --patch '<json>'");
+  }
+  if (file) {
+    return loadJsonFileArg(file);
+  }
+  try {
+    const parsed = JSON.parse(inline);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      failWriteValidation("--patch must be a JSON object");
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      failWriteValidation(`--patch is not valid JSON: ${err.message}`);
+    }
+    throw err;
+  }
+}
+function parseMoneyFlag(amount, currency, flag) {
+  if (amount === void 0 || amount === null || amount === "") {
+    return void 0;
+  }
+  if (currency === void 0 || currency === null || currency === "") {
+    return { amount: String(amount) };
+  }
+  if (typeof currency !== "string" || currency.length !== 3) {
+    failWriteValidation(`${flag} got an invalid --currency (expected a 3-letter code like EUR)`);
+  }
+  return { amount: String(amount), currencyCode: currency.toUpperCase() };
+}
+function parseDateFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const raw = String(value);
+  if (raw.toLowerCase() === "now") {
+    return Date.now();
+  }
+  if (/^\d{10,}$/.test(raw)) {
+    return Number(raw);
+  }
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed)) {
+    failWriteValidation(`${flag} must be now, an ISO date (2026-07-10) or epoch milliseconds`);
+  }
+  return parsed;
+}
+function parseOnOffFlag(value, flag) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const raw = String(value).toLowerCase();
+  if (raw === "on" || raw === "true") {
+    return true;
+  }
+  if (raw === "off" || raw === "false") {
+    return false;
+  }
+  failWriteValidation(`${flag} must be on|off`);
+}
+function parseLocaleFlag(value) {
+  if (value === void 0 || value === null || value === "") {
+    return void 0;
+  }
+  const match = /^([a-z]{2})[_-]([A-Za-z]{2})$/.exec(String(value));
+  if (!match) {
+    failWriteValidation("--locale must look like en_US (language_COUNTRY)");
+  }
+  return { language: match[1], country: match[2].toUpperCase() };
+}
+function loadTargetingFileArg(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return void 0;
+  }
+  const parsed = loadJsonFileArg(path);
+  const criteria = parsed.targetingCriteria ?? parsed;
+  if (!criteria.include) {
+    failWriteValidation(
+      `${path} must contain targeting criteria with an "include" block (see baker schema ads.linkedin.campaigns.create)`
+    );
+  }
+  return criteria;
+}
+var SHA256_HEX = /^[0-9a-f]{64}$/i;
+function sha256Lower(value) {
+  const email = value.trim().toLowerCase();
+  return SHA256_HEX.test(email) ? email : createHash("sha256").update(email).digest("hex");
+}
+function emailPreview(email) {
+  return email === "" || SHA256_HEX.test(email.trim()) ? "" : maskPersonValue("email", email);
+}
+function parseCsvLine(line) {
+  const cells = [];
+  let current = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (inQuotes) {
+      if (char === '"' && line[i + 1] === '"') {
+        current += '"';
+        i++;
+      } else if (char === '"') {
+        inQuotes = false;
+      } else {
+        current += char;
+      }
+    } else if (char === '"') {
+      inQuotes = true;
+    } else if (char === ",") {
+      cells.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  cells.push(current);
+  return cells.map((cell) => cell.trim());
+}
+function parseListFileArg(path, maxRows) {
+  if (typeof path !== "string" || path.length === 0) {
+    return void 0;
+  }
+  const raw = readFileSync(path, "utf8");
+  const lines = raw.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  if (lines.length < 2) {
+    failWriteValidation(`${path} needs a header row and at least one data row`);
+  }
+  const columns = parseCsvLine(lines[0]).map((column) => column.trim());
+  const rows = [];
+  const emailPreviews = [];
+  const emailColumn = columns.findIndex((column) => listColumnField(column) === "email");
+  for (const line of lines.slice(1)) {
+    const cells = parseCsvLine(line);
+    const row = {};
+    columns.forEach((column, index) => {
+      const value = cells[index] ?? "";
+      if (!value) {
+        return;
+      }
+      row[column] = listColumnField(column) === "email" ? sha256Lower(value) : value;
+    });
+    if (Object.keys(row).length > 0) {
+      rows.push(row);
+      emailPreviews.push(emailPreview(emailColumn >= 0 ? cells[emailColumn] ?? "" : ""));
+    }
+  }
+  if (rows.length > maxRows) {
+    failWriteValidation(`${path} has ${rows.length} rows \u2014 the inline limit is ${maxRows}. Split the list.`);
+  }
+  return { columns, rows, ...emailColumn >= 0 ? { emailPreviews } : {} };
+}
+function failPreflight(fields) {
+  writeJsonEnvelope({
+    ok: false,
+    error: {
+      code: "VALIDATION_ERROR",
+      message: fields.map((field) => field.path ? `${field.path}: ${field.message}` : field.message).join("; "),
+      fields,
+      fix: capabilityFix("linkedin-ads")
+    }
+  });
+  process.exit(1);
+}
+var BATCH_NUDGE = "This command takes several ids at once \u2014 pass them comma-separated or with --ids-file instead of one call per id.";
+function batchNudge(data) {
+  return data.sameKindStaged === void 0 ? [] : [BATCH_NUDGE];
+}
+async function stageOp(raw, hints) {
+  const preflight = linkedinDraftOpInputSchema.safeParse(raw);
+  if (!preflight.success) {
+    failPreflight(preflight.error.issues.map((issue) => ({ path: issue.path.join("."), message: issue.message })));
+  }
+  try {
+    const chatId = requireChatId();
+    const response = await apiPost("/api/ads/linkedin/draft/stage", {
+      chatId,
+      op: preflight.data
+    });
+    const allHints = [
+      ...batchNudge(response.data),
+      ...hints ?? [],
+      ...approvalHints(preflight.data, response.data),
+      ...await adCopyHints(preflight.data)
+    ];
+    writeJsonEnvelope(withHints(response, allHints));
+  } catch (err) {
+    handleLinkedinError(err);
+  }
+}
+async function stageLinkedinOps(rawOps, hints) {
+  if (rawOps.length === 1 && rawOps[0]) {
+    await stageOp(rawOps[0], hints);
+    return;
+  }
+  const ops = [];
+  for (const [index, raw] of rawOps.entries()) {
+    const preflight = linkedinDraftOpInputSchema.safeParse(raw);
+    if (!preflight.success) {
+      failPreflight(
+        preflight.error.issues.map((issue) => ({
+          path: `ops[${index}]${issue.path.length > 0 ? `.${issue.path.join(".")}` : ""}`,
+          message: issue.message
+        }))
+      );
+    }
+    ops.push(preflight.data);
+  }
+  try {
+    const chatId = requireChatId();
+    const response = await apiPost("/api/ads/linkedin/draft/stage-batch", { chatId, ops });
+    const allHints = [...hints ?? [], ...await adCopyHints(ops)];
+    writeJsonEnvelope(withHints(response, allHints));
+  } catch (err) {
+    handleLinkedinError(err);
+  }
+}
+async function stageStatusChange(input) {
+  const payload = input.kind === "creative.update" ? { intendedStatus: input.status } : { status: input.status };
+  await stageLinkedinOps(
+    input.targets.map((target) => ({ kind: input.kind, accountId: input.accountId, target, payload }))
+  );
+}
+function requireTarget(args, entity) {
+  const inverted = booleanWordPositionalError(args, entity);
+  if (inverted !== void 0) {
+    failWriteValidation(inverted);
+  }
+  const positionals = readPositionals(args);
+  const target = args.id ?? args.target ?? args.ref ?? positionals[0];
+  if (typeof target !== "string" || target.length === 0) {
+    failWriteValidation(`pass the ${entity} id or URN as the positional argument`);
+  }
+  if (positionals.length > 1 || splitIdList(target).length > 1) {
+    failWriteValidation(
+      `this command takes one ${entity} id \u2014 run it once per id. Only pause/resume/archive/delete and 'creatives update' accept several ids in one call.`
+    );
+  }
+  return target;
+}
+function readPositionals(args) {
+  if (!Array.isArray(args._)) {
+    return [];
+  }
+  return args._.filter((value) => typeof value === "string" && value.length > 0);
+}
+function splitIdList(raw) {
+  return raw.split(",").map((id) => id.trim()).filter(Boolean);
+}
+function idsFileEntries(path) {
+  if (typeof path !== "string" || path.length === 0) {
+    return [];
+  }
+  return readFileSync(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).flatMap(splitIdList);
+}
+function requireTargets(args, entity) {
+  const positionals = readPositionals(args);
+  const named = [args.id, args.target, args.ref].filter(
+    (value) => typeof value === "string" && value.length > 0
+  );
+  const fromArgs = positionals.length > 0 ? positionals : named;
+  const targets = [.../* @__PURE__ */ new Set([...fromArgs.flatMap(splitIdList), ...idsFileEntries(args["ids-file"])])];
+  if (targets.length === 0) {
+    failWriteValidation(
+      `pass the ${entity} id or URN as the positional argument (comma-separated for several), or --ids-file <path>`
+    );
+  }
+  if (targets.length > LINKEDIN_DRAFT_BATCH_MAX) {
+    failWriteValidation(
+      `${targets.length} ids exceeds the batch limit of ${LINKEDIN_DRAFT_BATCH_MAX} \u2014 split the list`
+    );
+  }
+  return targets;
+}
+
+export {
+  TOTAL_BUDGET_HELP,
+  bareAccountId,
+  failWriteValidation,
+  loadJsonFileArg,
+  mergePayload,
+  loadPatchArg,
+  parseMoneyFlag,
+  parseDateFlag,
+  parseOnOffFlag,
+  parseLocaleFlag,
+  loadTargetingFileArg,
+  parseListFileArg,
+  stageOp,
+  stageLinkedinOps,
+  stageStatusChange,
+  requireTarget,
+  requireTargets
+};
+//# sourceMappingURL=chunk-C5UFKDAX.js.map