@koda-sl/baker-cli 0.534.0-dev.911a80433 → 0.535.0

package/dist/chunk-6THXOWAP.js

@@ -0,0 +1,476 @@
+import {
+  writeJson
+} from "./chunk-S6WPMD3V.js";
+
+// ../proxy/src/challenge.ts
+var CHALLENGE_PHRASES = [
+  "just a moment",
+  "attention required",
+  "verify you are human",
+  "checking your browser",
+  "enable javascript and cookies to continue",
+  "unusual traffic",
+  "access denied",
+  "you have been blocked",
+  "request unsuccessful",
+  "are you a robot",
+  "security check",
+  "ddos protection",
+  "captcha"
+];
+var CHALLENGE_MARKERS = ["cf-browser-verification", "cf_chl_", "px-captcha", "_incapsula_", "distil_r_captcha"];
+var CHALLENGE_LENGTH_CEILING = 2e3;
+function isChallengeBody(content, title) {
+  if (content.length <= CHALLENGE_LENGTH_CEILING) {
+    const haystack = `${title ?? ""}
+${content}`.toLowerCase();
+    if (CHALLENGE_PHRASES.some((phrase) => haystack.includes(phrase))) return true;
+  }
+  const whole = content.toLowerCase();
+  return CHALLENGE_MARKERS.some((marker) => whole.includes(marker));
+}
+
+// ../proxy/src/tiers.ts
+var PROXY_TIERS = {
+  datacenter: {
+    tier: "datacenter",
+    host: "dc.oxylabs.io",
+    port: 8e3,
+    usernamePrefix: "user-",
+    countryKey: "-country-",
+    sessionKey: null,
+    attempts: 3
+  },
+  residential: {
+    tier: "residential",
+    host: "pr.oxylabs.io",
+    port: 7777,
+    usernamePrefix: "customer-",
+    countryKey: "-cc-",
+    sessionKey: "-sessid-",
+    attempts: 1
+  }
+};
+var ESCALATION_ORDER = ["datacenter", "residential"];
+var KNOWN_USERNAME_PREFIXES = ["user-", "customer-"];
+
+// ../proxy/src/credentials.ts
+var PROXY_ENV_VARS = {
+  datacenter: { username: "OXYLABS_DATACENTER_USERNAME", password: "OXYLABS_DATACENTER_PASSWORD" },
+  residential: { username: "OXYLABS_RESIDENTIAL_USERNAME", password: "OXYLABS_RESIDENTIAL_PASSWORD" }
+};
+function readProxyCredentials(env) {
+  const credentials = {};
+  for (const tier of ESCALATION_ORDER) {
+    const username = env[PROXY_ENV_VARS[tier].username]?.trim();
+    const password = env[PROXY_ENV_VARS[tier].password]?.trim();
+    if (username && password) credentials[tier] = { username, password };
+  }
+  return credentials;
+}
+function configuredTiers(credentials) {
+  return ESCALATION_ORDER.filter((tier) => credentials[tier] !== void 0);
+}
+
+// ../proxy/src/escalate.ts
+var ESCALATABLE_STATUSES = /* @__PURE__ */ new Set([403, 429, 451]);
+var ESCALATABLE_NET_ERRORS = /* @__PURE__ */ new Set(["ERR_CONNECTION_RESET", "ERR_CONNECTION_CLOSED", "ERR_EMPTY_RESPONSE"]);
+var PROXY_NET_ERRORS = /* @__PURE__ */ new Set([
+  "ERR_TUNNEL_CONNECTION_FAILED",
+  "ERR_PROXY_CONNECTION_FAILED",
+  "ERR_PROXY_AUTH_REQUESTED",
+  "ERR_PROXY_CERTIFICATE_INVALID",
+  "ERR_UNEXPECTED_PROXY_AUTH",
+  "ERR_MANDATORY_PROXY_CONFIGURATION_FAILED",
+  "ERR_HTTPS_PROXY_TUNNEL_RESPONSE_REDIRECT"
+]);
+function isProxyFailure(signal) {
+  if (signal.status === 407) return true;
+  return signal.netError ? PROXY_NET_ERRORS.has(signal.netError) : false;
+}
+function shouldEscalate(signal) {
+  if (isProxyFailure(signal)) return false;
+  if (signal.timedOut) return false;
+  if (signal.challenge) return true;
+  if (signal.status != null && ESCALATABLE_STATUSES.has(signal.status)) return true;
+  return signal.netError ? ESCALATABLE_NET_ERRORS.has(signal.netError) : false;
+}
+
+// ../proxy/src/privateAddress.ts
+function isPrivateIpv4Octets(octets) {
+  const [a, b] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function parseIpv4(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => /^\d{1,3}$/.test(part) ? Number(part) : Number.NaN);
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
+  return octets;
+}
+function expandGroups(part) {
+  if (part === "") return [];
+  const chunks = part.split(":");
+  const groups = [];
+  for (let index = 0; index < chunks.length; index++) {
+    const chunk = chunks[index];
+    if (chunk.includes(".")) {
+      if (index !== chunks.length - 1) return null;
+      const octets = parseIpv4(chunk);
+      if (!octets) return null;
+      groups.push(octets[0] << 8 | octets[1]);
+      groups.push(octets[2] << 8 | octets[3]);
+      continue;
+    }
+    if (!/^[0-9a-f]{1,4}$/.test(chunk)) return null;
+    groups.push(Number.parseInt(chunk, 16));
+  }
+  return groups;
+}
+function parseIpv6(value) {
+  const halves = value.split("::");
+  if (halves.length > 2) return null;
+  const head = expandGroups(halves[0]);
+  const tail = halves.length === 2 ? expandGroups(halves[1]) : [];
+  if (head === null || tail === null) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 1) return null;
+  return [...head, ...new Array(missing).fill(0), ...tail];
+}
+function isPrivateAddress(ip) {
+  const address = ip.trim().toLowerCase();
+  if (!address) return true;
+  const v4 = parseIpv4(address);
+  if (v4) return isPrivateIpv4Octets(v4);
+  const v6 = parseIpv6(address);
+  if (!v6) return true;
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = v6;
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0 && g6 === 0) return true;
+  const mappedV4 = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0;
+  if (mappedV4 && g4 === 0 && g5 === 65535) {
+    return isPrivateIpv4Octets([g6 >> 8, g6 & 255, g7 >> 8, g7 & 255]);
+  }
+  if (mappedV4 && g4 === 65535 && g5 === 0) {
+    return isPrivateIpv4Octets([g6 >> 8, g6 & 255, g7 >> 8, g7 & 255]);
+  }
+  if ((g0 & 65024) === 64512) return true;
+  if ((g0 & 65472) === 65152) return true;
+  return false;
+}
+
+// ../proxy/src/publicAddress.ts
+var PRIVATE_HOST = /^(localhost|.*\.localhost|.*\.local)$/;
+var SANDBOX_HOST = /\.e2b\.(app|dev)$/;
+function unwrapIpLiteral(host) {
+  if (host.startsWith("[") && host.endsWith("]")) return host.slice(1, -1);
+  if (/^[0-9.]+$/.test(host) || host.includes(":")) return host;
+  return null;
+}
+function isPrivateHostname(hostname) {
+  const host = hostname.trim().toLowerCase();
+  if (!host) return true;
+  if (PRIVATE_HOST.test(host) || SANDBOX_HOST.test(host)) return true;
+  const literal = unwrapIpLiteral(host);
+  return literal === null ? false : isPrivateAddress(literal);
+}
+var BROWSER_PROXY_BYPASS = [
+  "localhost",
+  "*.localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "*.local",
+  // A Session's own preview, which is served from the sandbox's public host —
+  // public in DNS, ours in every sense that matters here.
+  "*.e2b.app",
+  "*.e2b.dev",
+  "10.*",
+  "192.168.*",
+  "169.254.*",
+  ...Array.from({ length: 16 }, (_, i) => `172.${16 + i}.*`)
+].join(",");
+function refuseNonPublicUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "unparseable";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "not_public";
+  return isPrivateHostname(parsed.hostname) ? "not_public" : null;
+}
+
+// ../proxy/src/route.ts
+var DIRECT_ROUTE = { kind: "direct" };
+function proxyUsername(spec, rawUsername, options) {
+  const raw = rawUsername.trim();
+  const foreignPrefix = KNOWN_USERNAME_PREFIXES.find(
+    (prefix) => prefix !== spec.usernamePrefix && raw.startsWith(prefix)
+  );
+  if (foreignPrefix) return { ok: false, problem: "wrong_prefix" };
+  let username = raw.startsWith(spec.usernamePrefix) ? raw : `${spec.usernamePrefix}${raw}`;
+  if (options?.country) username += `${spec.countryKey}${options.country.toUpperCase()}`;
+  if (options?.session && spec.sessionKey) username += `${spec.sessionKey}${options.session}`;
+  return { ok: true, username };
+}
+function buildProxyRoute(tier, credentials, options) {
+  const held = credentials[tier];
+  if (!held) return { ok: false, problem: "missing" };
+  const spec = PROXY_TIERS[tier];
+  const username = proxyUsername(spec, held.username, options);
+  if (!username.ok) return username;
+  return {
+    ok: true,
+    route: {
+      kind: "proxy",
+      tier,
+      server: `http://${spec.host}:${spec.port}`,
+      username: username.username,
+      password: held.password
+    }
+  };
+}
+
+// ../proxy/src/ladder.ts
+function plannedRoutes(url, credentials, options) {
+  if (refuseNonPublicUrl(url) !== null) return [DIRECT_ROUTE];
+  const routes = [DIRECT_ROUTE];
+  for (const tier of configuredTiers(credentials)) {
+    const built = buildProxyRoute(tier, credentials, options);
+    if (!built.ok) continue;
+    for (let attempt = 0; attempt < PROXY_TIERS[tier].attempts; attempt++) routes.push(built.route);
+  }
+  return routes;
+}
+function routeTier(route) {
+  return route.kind === "proxy" ? route.tier : "direct";
+}
+function nextPlannedRoute(routes, tried) {
+  const dead = new Set(tried.filter((attempt) => attempt.proxyFailure).map((attempt) => attempt.tier));
+  const spent = /* @__PURE__ */ new Map();
+  for (const attempt of tried) spent.set(attempt.tier, (spent.get(attempt.tier) ?? 0) + 1);
+  const offered = /* @__PURE__ */ new Map();
+  for (const route of routes) {
+    const tier = routeTier(route);
+    if (dead.has(tier)) continue;
+    const position = (offered.get(tier) ?? 0) + 1;
+    offered.set(tier, position);
+    if (position > (spent.get(tier) ?? 0)) return route;
+  }
+  return null;
+}
+
+// src/env.ts
+import { createEnv } from "@t3-oss/env-core";
+import { z } from "zod";
+
+// src/apiKeyFormat.ts
+var KEY_PREFIXES = ["bk_", "bkr_", "bkv_"];
+var API_KEY_FORMAT_MESSAGE = "API key must start with 'bk_', 'bkr_' or 'bkv_'";
+function isBakerApiKey(value) {
+  return KEY_PREFIXES.some((prefix) => value.startsWith(prefix));
+}
+
+// src/env.ts
+var cached;
+var CONNECTION = {
+  BAKER_API_KEY: z.string().refine(isBakerApiKey, API_KEY_FORMAT_MESSAGE),
+  BAKER_API_URL: z.url("BAKER_API_URL must be a valid URL")
+};
+function getEnv() {
+  if (!cached) {
+    cached = createEnv({
+      server: {
+        ...CONNECTION,
+        BAKER_PUBLIC_API_URL: z.url("BAKER_PUBLIC_API_URL must be a valid URL").optional(),
+        BAKER_CHAT_ID: z.string().optional(),
+        BAKER_THREAD_ID: z.string().optional(),
+        BAKER_KEY_SCOPE: z.enum(["report"]).optional(),
+        BAKER_TARGET_COMPANY_ID: z.string().optional(),
+        BAKER_ACTING_USER_ID: z.string().optional(),
+        BAKER_GOOGLE_ADS_CUSTOMER_ID: z.string().regex(/^\d{10}$/).optional(),
+        BAKER_GA4_PROPERTY_ID: z.string().optional(),
+        BAKER_GSC_SITE_URL: z.string().optional(),
+        BAKER_X_ADS_ACCOUNT_ID: z.string().regex(/^[a-z0-9]+$/, "X Ads account ID must be a base36 string").optional(),
+        BAKER_META_AD_ACCOUNT_ID: z.string().optional(),
+        BAKER_LINKEDIN_AD_ACCOUNT_ID: z.string().regex(/^\d+$/, "LinkedIn ad account ID must be the numeric portion of urn:li:sponsoredAccount:N").optional()
+      },
+      runtimeEnv: process.env,
+      onValidationError: refuseInvalidEnv
+    });
+  }
+  return cached;
+}
+function requireConnection() {
+  return createEnv({ server: CONNECTION, runtimeEnv: process.env, onValidationError: refuseInvalidEnv });
+}
+function issueVariable(issue) {
+  const first = issue.path?.[0];
+  const key = typeof first === "object" && first !== null ? first.key : first;
+  return key === void 0 ? "environment" : String(key);
+}
+var AGENT_SET_VARIABLES = /* @__PURE__ */ new Set([
+  "BAKER_GOOGLE_ADS_CUSTOMER_ID",
+  "BAKER_LINKEDIN_AD_ACCOUNT_ID",
+  "BAKER_X_ADS_ACCOUNT_ID"
+]);
+function listVariables(variables) {
+  return `${variables.join(", ")} ${variables.length === 1 ? "is" : "are"}`;
+}
+function refuseInvalidEnv(issues) {
+  const problems = issues.map((issue) => `${issueVariable(issue)}: ${issue.message}`).join("; ");
+  const variables = [...new Set(issues.map(issueVariable))];
+  if (variables.every((variable) => AGENT_SET_VARIABLES.has(variable))) {
+    writeJson({
+      ok: false,
+      error: {
+        code: "VALIDATION_ERROR",
+        message: `An environment variable has the wrong format \u2014 ${problems}.`,
+        retryable: false,
+        fix: {
+          action: "retry_with_changes",
+          explanation: `${listVariables(variables)} an optional override set in this workspace, not by the platform. Export it again in the format named above, or unset ${variables.join(" and ")} and pass the account with the command's flag instead, then re-run the command.`
+        }
+      }
+    });
+    process.exit(1);
+  }
+  writeJson({
+    ok: false,
+    error: {
+      code: "NOT_CONFIGURED",
+      message: `This workspace's Baker connection is misconfigured \u2014 ${problems}.`,
+      retryable: false,
+      fix: {
+        action: "continue_without",
+        explanation: `${listVariables(variables)} set by the platform when this workspace starts, and nothing in this workspace can correct it \u2014 do not retry, and do not set or edit it yourself. Every command that reads or writes Baker data will fail the same way. Carry on with work that does not need Baker's data (files in the repo, local checks), and tell the user that reading and saving their Baker data is unavailable in this conversation until the platform fixes it.`
+      }
+    }
+  });
+  process.exit(1);
+}
+function optionalChatId() {
+  return process.env.BAKER_CHAT_ID || void 0;
+}
+function optionalTargetCompany() {
+  return process.env.BAKER_TARGET_COMPANY_ID || void 0;
+}
+function optionalOwnChatId() {
+  return optionalTargetCompany() ? void 0 : optionalChatId();
+}
+function clearTargetCompany() {
+  delete process.env.BAKER_TARGET_COMPANY_ID;
+}
+function optionalWorkspaceKind() {
+  return process.env.BAKER_WORKSPACE_KIND || void 0;
+}
+function setTargetCompany(companyId) {
+  process.env.BAKER_TARGET_COMPANY_ID = companyId;
+}
+function optionalTurnId() {
+  return process.env.BAKER_TURN_ID || void 0;
+}
+function debugLogSetting() {
+  const raw = process.env.BAKER_DEBUG_LOG?.trim();
+  return raw ? raw : void 0;
+}
+var MissingChatIdError = class extends Error {
+  code = "MISSING_CHAT_ID";
+  constructor() {
+    super(
+      "BAKER_CHAT_ID is not set. This command stages changes against a chat \u2014 run it from a chat-attached environment."
+    );
+    this.name = "MissingChatIdError";
+  }
+};
+function canvasAssetOriginsSetting() {
+  const raw = process.env.BAKER_CANVAS_ASSET_ORIGINS?.trim();
+  return raw ? raw : void 0;
+}
+function optionalConnection() {
+  const apiKey = process.env.BAKER_API_KEY;
+  const baseUrl = process.env.BAKER_API_URL;
+  return apiKey && baseUrl ? { apiKey, baseUrl } : null;
+}
+function requireChatId() {
+  const env = getEnv();
+  if (!env.BAKER_CHAT_ID) {
+    throw new MissingChatIdError();
+  }
+  return env.BAKER_CHAT_ID;
+}
+function resolveChatId(chat) {
+  return typeof chat === "string" && chat.length > 0 ? chat : requireChatId();
+}
+function hasFrameVisionKey() {
+  return Boolean(frameVisionKey());
+}
+function frameVisionKey() {
+  return process.env.GEMINI_API_KEY;
+}
+function openRouterKey() {
+  return process.env.OPENROUTER_API_KEY;
+}
+function hasOpenRouterKey() {
+  return Boolean(openRouterKey());
+}
+function captureBudgetMs() {
+  const raw = Number(process.env.BAKER_CAPTURE_BUDGET_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : null;
+}
+function captureProxyCredentials() {
+  return readProxyCredentials(process.env);
+}
+function captureVimeoCookie() {
+  const raw = process.env.VIMEO_COOKIE?.trim();
+  return raw ? raw : void 0;
+}
+function childEnvWith(extra) {
+  return { ...process.env, ...extra };
+}
+
+export {
+  isChallengeBody,
+  isProxyFailure,
+  shouldEscalate,
+  isPrivateAddress,
+  refuseNonPublicUrl,
+  DIRECT_ROUTE,
+  plannedRoutes,
+  nextPlannedRoute,
+  API_KEY_FORMAT_MESSAGE,
+  isBakerApiKey,
+  getEnv,
+  requireConnection,
+  optionalChatId,
+  optionalTargetCompany,
+  optionalOwnChatId,
+  clearTargetCompany,
+  optionalWorkspaceKind,
+  setTargetCompany,
+  optionalTurnId,
+  debugLogSetting,
+  MissingChatIdError,
+  canvasAssetOriginsSetting,
+  optionalConnection,
+  requireChatId,
+  resolveChatId,
+  hasFrameVisionKey,
+  frameVisionKey,
+  openRouterKey,
+  hasOpenRouterKey,
+  captureBudgetMs,
+  captureProxyCredentials,
+  captureVimeoCookie,
+  childEnvWith
+};
+//# sourceMappingURL=chunk-6THXOWAP.js.map

package/dist/chunk-6ZX3Q4X7.js

@@ -0,0 +1,217 @@
+import {
+  termsRefusalFix
+} from "./chunk-QALAJNBG.js";
+import {
+  cacheGet,
+  cacheSet,
+  handleConnectionError,
+  isOrganizationReadRefusal,
+  needsConnectionFix,
+  writeAdsJson,
+  writeJsonEnvelope
+} from "./chunk-SBFNGJ4C.js";
+import {
+  ApiError,
+  apiGet
+} from "./chunk-X6AHLUC7.js";
+import {
+  getEnv
+} from "./chunk-6THXOWAP.js";
+
+// ../api/src/ads-meta/permissionGates.ts
+var META_PERMISSION_NOT_ENABLED_MESSAGE = {
+  catalog: "Catalog changes need the Catalog permission for Meta \u2014 ask a Baker admin to turn it on, then reconnect Meta. Everything else on Meta keeps working: tell the user, and carry on with the rest of the job.",
+  pagePosts: "Facebook Page posts need the Page posts permission for Meta \u2014 ask a Baker admin to turn it on, then reconnect Meta. Everything else on Meta keeps working: tell the user, and carry on with the rest of the job."
+};
+var META_PERMISSION_RECONNECT_MESSAGE = {
+  catalog: "Catalog changes need the Catalog permission for Meta. It is turned on for this company, but this Meta connection was made before, so it does not hold it \u2014 ask the user to reconnect Meta in the dashboard, then try again. Everything else on Meta keeps working meanwhile.",
+  pagePosts: "Facebook Page posts need the Page posts permission for Meta. It is turned on for this company, but this Meta connection was made before, so it does not hold it \u2014 ask the user to reconnect Meta in the dashboard, then try again. Everything else on Meta keeps working meanwhile."
+};
+var META_UNREQUESTED_PERMISSION_MESSAGE = {
+  comments: "Reading and moderating comments on ads needs Meta permissions Baker's Meta connection does not ask for yet (reading people's comments and managing them on the Page). Tell the user that comment moderation happens in Meta Business Suite for now, and carry on with the rest of the job.",
+  instagramMedia: "Listing an Instagram account's posts needs a Meta permission Baker's Meta connection does not ask for yet. Ask the user for the post's link or id instead, or boost it from Meta Business Suite, and carry on."
+};
+var META_PAGE_ADS_PERMISSION_REMEDY = "A Baker admin turns it on with the lead ads switch for this company; then the user reconnects Meta in the dashboard. Tell the user, and carry on with the rest of the job.";
+function isMetaPermissionGateRefusal(message) {
+  return [
+    ...Object.values(META_PERMISSION_NOT_ENABLED_MESSAGE),
+    ...Object.values(META_PERMISSION_RECONNECT_MESSAGE),
+    ...Object.values(META_UNREQUESTED_PERMISSION_MESSAGE),
+    META_PAGE_ADS_PERMISSION_REMEDY
+  ].some((refusal) => message.includes(refusal));
+}
+
+// src/commands/ads/meta/shared.ts
+var DAY_MS = 864e5;
+function metaForbiddenFix(message) {
+  if (isMetaPermissionGateRefusal(message)) {
+    return { action: "reject", explanation: message };
+  }
+  if (message.includes("has not accepted Meta's Lead Generation Terms")) {
+    return {
+      action: "reject",
+      explanation: `${message}
+
+Meta confirmed the Page's terms status using its Page access. Give the Page owner the terms link in the error and ask them to accept it before trying the form or lead ad set again. Do not suggest reconnecting Meta for this refusal; continue with other work that does not require the form or ad set.`
+    };
+  }
+  return {
+    action: "reject",
+    explanation: [
+      message,
+      "This is a permission refusal, not a dead connection, and Meta returns the same code for two causes with opposite remedies. Tell them apart by how much else works before you answer.",
+      "If other reads on this account are ALSO refused (campaigns, ad sets, insights), the connection is short a permission it was never granted. Only the user can widen it, by reconnecting Meta from the dashboard.",
+      "If those reads work and only this object is refused, the asset (pixel/dataset, Page, or catalog) belongs to a Business the connected user holds no role in. Ad-account access does not carry asset access and reconnecting cannot grant it \u2014 the client assigns that asset to the connected user or partner in Meta Business settings, under the asset's own section (Data sources \u2192 Datasets for a pixel).",
+      "Either way do not retry the same call, and do not abort the wider job. Continue with what you can read, and state in your answer that this specific check could not run and why \u2014 never present the task as verified when this step was skipped."
+    ].join("\n\n")
+  };
+}
+function handleMetaError(err) {
+  if (err instanceof ApiError) {
+    if (needsConnectionFix(err.code, err.message)) {
+      handleConnectionError("meta_ads", err.message);
+    }
+    const terms = termsRefusalFix(err.code, err.message);
+    if (terms) {
+      writeJsonEnvelope({
+        ok: false,
+        error: { code: terms.code, message: err.message, fix: terms.fix, retryable: false }
+      });
+      process.exit(1);
+    }
+    const envelope = {
+      ok: false,
+      error: {
+        code: err.code,
+        message: err.message,
+        fix: err.code === "FORBIDDEN" && !isOrganizationReadRefusal(err.message) ? metaForbiddenFix(err.message) : { action: "reject", explanation: err.message },
+        retryable: err.code === "RATE_LIMITED" || err.code === "UNAVAILABLE" || err.code === "INTERNAL_ERROR"
+      }
+    };
+    writeAdsJson(envelope);
+    process.exit(1);
+  }
+  const message = err instanceof Error ? err.message : "Unexpected error";
+  writeAdsJson({ ok: false, error: { code: "NETWORK_ERROR", message } });
+  process.exit(1);
+}
+var ACCOUNT_ID_RE = /^(act_)?[0-9]+$/;
+var CONNECTED_ACCOUNTS_TTL_MS = 60 * 60 * 1e3;
+function invalidAccountId(id) {
+  writeAdsJson({
+    ok: false,
+    error: {
+      code: "INVALID_ACCOUNT_ID",
+      message: `Invalid account ID "${id}". Expected numeric ID, optionally prefixed with "act_".`
+    }
+  });
+  process.exit(1);
+}
+function actId(id) {
+  return id.startsWith("act_") ? id : `act_${id}`;
+}
+async function connectedMetaAccounts(useCache) {
+  if (useCache) {
+    const cached = cacheGet("meta-accounts", "list");
+    if (cached) return cached.data;
+  }
+  const accounts = await apiGet(
+    "/api/ads/meta/accounts",
+    useCache ? void 0 : { "skip-cache": "true" }
+  );
+  if (useCache && accounts.length > 0) cacheSet("meta-accounts", "list", accounts, CONNECTED_ACCOUNTS_TTL_MS);
+  return accounts;
+}
+async function resolveAccountIdArg(args) {
+  const fromArgs = args["account-id"];
+  const explicit = fromArgs || getEnv().BAKER_META_AD_ACCOUNT_ID;
+  if (explicit) {
+    if (!ACCOUNT_ID_RE.test(explicit)) invalidAccountId(explicit);
+    return actId(explicit);
+  }
+  let accounts;
+  try {
+    accounts = await connectedMetaAccounts(!args["no-cache"]);
+  } catch (err) {
+    handleMetaError(err);
+  }
+  const ids = accounts.flatMap((account) => {
+    const id = account.externalId ?? account.id;
+    return id && ACCOUNT_ID_RE.test(id) ? [{ id: actId(id), name: account.name }] : [];
+  });
+  const [single] = ids;
+  if (ids.length === 1 && single) {
+    process.stderr.write(`Using account "${single.name ?? single.id}" (${single.id})
+`);
+    return single.id;
+  }
+  const listed = ids.map((account) => account.name ? `${account.id} (${account.name})` : account.id).join("; ");
+  writeAdsJson({
+    ok: false,
+    error: {
+      code: "MISSING_ACCOUNT_ID",
+      message: ids.length === 0 ? "This company has no Meta ad account selected, so there is no account to default to." : `This company connected ${ids.length} Meta ad accounts, so pass --account-id to name one: ${listed}.`,
+      fix: {
+        action: "reject",
+        explanation: ids.length === 0 ? "Ask the user to select a Meta ad account for this company in Baker's Meta connection, or pass --account-id act_<id> for one the login reaches (`baker ads meta accounts --available`)." : `Re-run with --account-id set to one of: ${listed}. A question about the whole business covers all ${ids.length}.`
+      },
+      retryable: false
+    }
+  });
+  process.exit(1);
+}
+function getDateRange(args) {
+  const datePreset = args["date-preset"];
+  const since = args.since;
+  const until = args.until;
+  if (since && until) return { since, until };
+  return { datePreset: datePreset ?? "last_7d" };
+}
+function todayIso() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function daysAgoIso(days) {
+  return new Date(Date.now() - days * DAY_MS).toISOString().slice(0, 10);
+}
+function csvOrJson(args) {
+  return args.output ?? "json";
+}
+var NAME_CONTAINS_ARG = {
+  type: "string",
+  description: "Only rows whose name contains this text, matched by Meta before anything is returned. Start here to find one entity by name: --name-contains octubre --all-statuses"
+};
+function resolveEffectiveStatus(args) {
+  if (args["all-statuses"]) {
+    return void 0;
+  }
+  const explicit = args["effective-status"];
+  if (explicit) {
+    return explicit;
+  }
+  return "ACTIVE";
+}
+function statusFilterHints(rows, effectiveStatus, noun) {
+  if (rows.length > 0 || effectiveStatus === void 0) return [];
+  if (effectiveStatus === "ACTIVE") {
+    return [
+      `No ACTIVE ${noun}. The ACTIVE filter hides paused, archived and in-review ones (under a paused campaign or ad set that is all of them), so this does NOT mean none exist. Re-run with --all-statuses before concluding there are none.`
+    ];
+  }
+  return [
+    `No ${noun} with effective_status ${effectiveStatus}. Re-run with --all-statuses to see every status before concluding there are none.`
+  ];
+}
+
+export {
+  metaForbiddenFix,
+  handleMetaError,
+  resolveAccountIdArg,
+  getDateRange,
+  todayIso,
+  daysAgoIso,
+  csvOrJson,
+  NAME_CONTAINS_ARG,
+  resolveEffectiveStatus,
+  statusFilterHints
+};
+//# sourceMappingURL=chunk-6ZX3Q4X7.js.map