feat(cloud): add LinkedIn Ads provider

[lalalune]

Closes #11663. Refs #11361.

What

Adds linkedin as a cloud advertising platform, wired end-to-end into the existing AdProvider contract — same shape as the sibling X/Twitter (#11662) and Reddit (#11661) lanes:

• AdPlatform (DB typing + organization_urn metadata), AdPlatformSchema, spend markup (1.1), provider registry, and the app-promotion route platform enum.
• New packages/cloud/shared/src/lib/services/advertising/providers/linkedin.ts against the versioned LinkedIn Marketing API (api.linkedin.com/rest, LinkedIn-Version + X-Restli-Protocol-Version: 2.0.0, OAuth2 bearer):
  • Account discovery/validation via the adAccounts search finder (Rest.li structured query, raw-query builder so parens/colons stay unencoded).
  • Campaign create = campaign group + paused campaign (x-restli-id extraction), objective mapping, daily/total budget mapping (lifetime requires an end date — validated fail-fast), geo targeting (urn:li:geo URNs pass through, numeric ids wrapped, free-text fails loudly before any platform call, Worldwide default).
  • feat(advertising): add campaign bid controls #11621 bid controls → costType/optimizationTargetType per the documented allowable-combinations table (cpm→CPM, cpc→CPC, cpa→CPM+MAX_CONVERSION; reach/clicks/conversions→MAX_IMPRESSION/MAX_CLICK/MAX_CONVERSION; objective-default auto-bid otherwise; never a manual unitCost).
  • Update/pause/activate via Rest.li PARTIAL_UPDATE patches (budget patch targets whichever of dailyBudget/totalBudget the live campaign uses); delete via PENDING_DELETION for campaign then group.
  • Media upload through the Images/Videos APIs (initializeUpload → byte PUT → finalizeUpload for multipart video), owner resolved from the ad account's organization reference; getMediaStatus maps AVAILABLE→ready.
  • Creative create as an inline dark post (creatives?action=createInline) with CTA label + landing-page mapping; requires a prior provider asset (fail-closed otherwise).
  • Analytics via the adAnalytics analytics finder (CAMPAIGN pivot, explicit fields, costInLocalCurrency/externalWebsiteConversions/oneClickLeads mapping).
  • OAuth2 refresh_token grant (LINKEDIN_ADS_CLIENT_ID/LINKEDIN_ADS_CLIENT_SECRET).

Tests

linkedin.test.ts — 16 pass / 0 fail (78 asserts), fixtures lifted from the Microsoft Learn LinkedIn Marketing API sample responses (account search, ad account fetch, image GET, adAnalytics rows, urn:li:sponsoredCreative:120491345), not invented. Includes a service-integration block that drives advertisingService.createCampaign with the real registered provider (mocked fetch):

• fix(advertising): gate updateCampaign on account approval — close the suspended-account spend leg (#11364) #11619 approval gate applies automatically: a pending LinkedIn account is rejected before content safety, credits, or any LinkedIn call.
• feat(advertising): add campaign bid controls #11621 bid metadata applies automatically: bid_strategy/optimization_goal persist to campaign metadata and the provider payload carries costType: CPC + optimizationTargetType: MAX_CLICK.
• Money path fail-closed: LinkedIn 403 → service throws, persists nothing, refunds the full charge (0.5 + 50×1.1) exactly once.

linkedin.real.test.ts — credential-gated live lane; loud-skips ([LinkedInAdsRealTest] SKIPPED: set LINKEDIN_ADS_ACCESS_TOKEN ...) without credentials.

Verification (local = merge gate)

• bun test .../providers/linkedin.test.ts — 16 pass / 0 fail (re-run green after rebase onto latest develop)
• Existing ad suites: 6 service files — 58 pass / 0 fail; 3 API route files — 14 pass / 0 fail
• bun run --cwd packages/cloud/shared typecheck ✅ · bun run --cwd packages/cloud/api typecheck ✅ · biome clean on touched files
• Evidence: .github/issue-evidence/11663-linkedin-ads-provider.md (docs reviewed, fixture provenance, N/A items with reasons)

Live-credential evidence is deferred until operator LinkedIn Ads API credentials are provisioned (the real lane is in place), matching the issue's post-merge live-lane acceptance criterion.

🤖 Generated with Claude Code

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d85bf889-fc21-4b95-a528-b2409c7d2451

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/11663-linkedin-ads-provider

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lalalune]

Reviewed and validated locally.

What I checked:

• Compared the new LinkedIn provider against the current Microsoft Learn LinkedIn Marketing API docs for versioned Rest.li headers, account discovery, campaign create/update, creative createInline, media status, and adAnalytics request shape.
• Confirmed the issue acceptance explicitly allows live network evidence once operator LinkedIn Ads credentials are provisioned; the branch includes the credential-gated linkedin.real.test.ts lane.

Validation in /home/shaw/eliza-worktrees/pr-11769-linkedin-ads:

• bun test packages/cloud/shared/src/lib/services/advertising/providers/linkedin.test.ts packages/cloud/shared/src/lib/services/advertising/providers/linkedin.real.test.ts - pass (16 provider/service tests, 2 live tests skipped loudly due missing LINKEDIN_ADS_ACCESS_TOKEN)
• bun run --cwd packages/cloud/shared typecheck - pass
• bun run --cwd packages/cloud/api typecheck - pass
• targeted bunx @biomejs/biome check ... - pass
• git diff --check origin/develop...HEAD - pass

Residual: no live LinkedIn account/campaign/creative/media artifact was captured in this environment because approved LinkedIn Ads API credentials are not provisioned. That matches the issue's post-merge live-lane acceptance note.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.