@daemonitor/plugins 1.1.51 → 1.1.54

package/dist/plugins/index.js

@@ -19,6 +19,8 @@ import { createNagiosPlugin } from "./monitoring/NagiosPlugin.js";
 import { createTplinkSwitchPlugin } from "./monitoring/TplinkSwitchPlugin.js";
 import { createCostPlugin } from "./monitoring/CostPlugin.js";
 import { createSupabasePlugin } from "./monitoring/SupabasePlugin.js";
+import { createIndexingPlugin } from "./monitoring/IndexingPlugin.js";
+import { createWorkspacePlugin } from "./monitoring/WorkspacePlugin.js";
 // In future, implement other plugin factory functions using the same pattern
 // import { createOSPlugin } from "./monitoring/OSPlugin.js"
 // import { createMongoDBPlugin } from "./monitoring/MongoDBPlugin.js"
@@ -49,6 +51,8 @@ export default {
     TplinkSwitch: createTplinkSwitchPlugin,
     Cost: createCostPlugin,
     Supabase: createSupabasePlugin,
+    Indexing: createIndexingPlugin,
+    Workspace: createWorkspacePlugin,
     // CloudflarePlugin: createCloudflarePlugin,
     // EwelinkPlugin: createEwelinkPlugin,
     // MongoDBPlugin: createMongoDBPlugin,

package/dist/plugins/monitoring/AdsensePlugin.js

@@ -140,11 +140,34 @@ export async function getJson(url, init, timeout) {
     const body = await res.json().catch(() => ({}));
     if (!res.ok) {
         const e = new Error(body?.error_description || body?.error?.message || body?.error || `HTTP ${res.status}`);
+        e.status = res.status;
         e.code = typeof body?.error === "string" ? body.error : body?.error?.status;
         throw e;
     }
     return body;
 }
+/**
+ * Google's side, not ours: an outage (5xx, UNAVAILABLE), a rate limit (429,
+ * RESOURCE_EXHAUSTED), a timeout or a dropped connection. The next poll can fix
+ * it, so the server keeps the last good reading and warns. A bad token, a lost
+ * permission or a property that no longer exists is not transient.
+ */
+export function isTransient(e) {
+    if (e?.name === "TimeoutError" || e?.name === "AbortError")
+        return true;
+    // fetch() itself failed: DNS, reset, refused.
+    if (e instanceof TypeError && /fetch failed|network/i.test(String(e.message)))
+        return true;
+    const status = Number(e?.status) || 0;
+    if (status === 429 || (status >= 500 && status < 600))
+        return true;
+    return ["UNAVAILABLE", "RESOURCE_EXHAUSTED", "DEADLINE_EXCEEDED", "INTERNAL", "ABORTED"].includes(String(e?.code));
+}
+/** The body a Google plugin sends when a poll fails. */
+export const failure = (e) => ({
+    error: String(e?.message || e).slice(0, 160),
+    ...(e?.code === "invalid_grant" ? { authExpired: true } : isTransient(e) ? { transient: true } : {}),
+});
 /** Trade a refresh token for a one-hour access token. Shared with the ga4 plugin. */
 export async function googleAccessToken(cfg, timeout) {
     const tok = await getJson(TOKEN_URL, {
@@ -205,10 +228,7 @@ export function createAdsensePlugin() {
         catch (e) {
             // invalid_grant = the refresh token was revoked or expired. Nothing the
             // next poll can fix, so it is flagged apart from a transient API error.
-            await plugin.send({
-                error: String(e?.message || e).slice(0, 160),
-                ...(e?.code === "invalid_grant" ? { authExpired: true } : {}),
-            });
+            await plugin.send(failure(e));
         }
     };
     const monitorFn = async (plugin) => {

package/dist/plugins/monitoring/CostPlugin.js

@@ -76,6 +76,7 @@ export async function collectCost(p, today = todayUtc()) {
         ...summarizeCost(f, today),
         breakdown: (f.breakdown || []).filter((b) => b.amount).sort((a, b) => b.amount - a.amount).slice(0, 12)
             .map((b) => ({ name: b.name, amount: round2(b.amount) })),
+        ...(f.limits?.length ? { limits: f.limits } : {}),
     };
 }
 export function createCostPlugin() {

package/dist/plugins/monitoring/CostProviders.js

@@ -177,21 +177,73 @@ const fastly = async (cfg, _range, timeout) => {
         breakdown: items.map((i) => ({ name: i.product_name || i.description || "item", amount: Number(i.amount) || 0 })),
     };
 };
+// Vultr: month-to-date only. /account carries the running total (USD), and
+// /billing/pending-charges splits it by line item. No daily data in the API.
+const vultr = async (cfg, _range, timeout) => {
+    need(cfg, "apiKey");
+    const auth = { headers: { Authorization: `Bearer ${cfg.apiKey}` } };
+    const [{ account }, pending] = await Promise.all([
+        json("https://api.vultr.com/v2/account", auth, timeout),
+        json("https://api.vultr.com/v2/billing/pending-charges", auth, timeout),
+    ]);
+    const by = new Map();
+    for (const c of pending.pending_charges || []) {
+        const name = c.product || c.description || "item";
+        by.set(name, (by.get(name) || 0) + (Number(c.total) || 0));
+    }
+    return {
+        currency: "USD",
+        monthToDate: Math.abs(Number(account?.pending_charges) || 0),
+        breakdown: [...by].map(([name, amount]) => ({ name, amount })),
+    };
+};
 // Cloudflare: billable usage (alpha, PayGo usage only, not plan fees). Called
 // with no range: it then returns the current billing period, which sidesteps
 // the rule that a range must include the subscription's billing-anchor day.
 const cloudflare = async (cfg, { end }, timeout) => {
     need(cfg, "token", "accountId");
     const t = tally(end.slice(0, 7));
-    const body = await json(`https://api.cloudflare.com/client/v4/accounts/${cfg.accountId}/billable-usage`, { headers: { Authorization: `Bearer ${cfg.token}` } }, timeout);
+    const acct = `https://api.cloudflare.com/client/v4/accounts/${cfg.accountId}`;
+    const init = { headers: { Authorization: `Bearer ${cfg.token}` } };
+    const [body, limits] = await Promise.all([
+        json(`${acct}/billable-usage`, init, timeout),
+        cloudflareLimits(acct, init, timeout),
+    ]);
     let currency = "USD";
     for (const r of body.result || []) {
         if (r.BillingCurrency)
             currency = r.BillingCurrency;
         t.add(String(r.ChargePeriodStart || "").slice(0, 10), Number(r.BilledCost) || 0, r.ServiceName || r.ChargeDescription || undefined);
     }
-    return { currency, days: t.days(), breakdown: t.breakdown() };
+    return { currency, days: t.days(), breakdown: t.breakdown(), ...(limits.length ? { limits } : {}) };
 };
+// Spend policies (beta, PayGo, Workers and Durable Objects only, 2026-11-13):
+// per-product limits that email (`notification`) or stop the product
+// (`usage_block`). Optional: a token without Billing access or an account with
+// no policies leaves the spend row as it was. Cents converted to dollars here.
+async function cloudflareLimits(acct, init, timeout) {
+    try {
+        const body = await json(`${acct}/billing/spend-policies`, init, timeout);
+        return (body.result || []).filter((p) => p.enabled).map((p) => cfLimit(p));
+    }
+    catch (e) {
+        if (e instanceof HttpError && [403, 404].includes(e.status))
+            return [];
+        throw e;
+    }
+}
+export function cfLimit(p) {
+    const st = p.current_state || {};
+    return {
+        name: p.name || p.product_id,
+        product: String(p.product_id || ""),
+        blocks: p.action === "usage_block",
+        threshold: (Number(p.threshold_cents) || 0) / 100,
+        ...(st.balance_cents != null ? { spent: (Number(st.balance_cents) || 0) / 100 } : {}),
+        status: String(st.status || "unavailable"),
+        ...(st.billing_period_end ? { periodEnd: st.billing_period_end } : {}),
+    };
+}
 // PostHog: daily spend series, personal API key with billing:read. End is INCLUSIVE.
 const posthog = async (cfg, { start, end }, timeout) => {
     need(cfg, "apiKey");
@@ -349,5 +401,5 @@ const workspace = async (cfg, { start, end }, timeout) => {
     };
 };
 export const PROVIDERS = {
-    openai, anthropic, aws, vercel, fastly, cloudflare, posthog, gcp, workspace, "google-ads": googleAds, "meta-ads": metaAds,
+    openai, anthropic, aws, vercel, fastly, vultr, cloudflare, posthog, gcp, workspace, "google-ads": googleAds, "meta-ads": metaAds,
 };

package/dist/plugins/monitoring/Ga4Plugin.js

@@ -1,5 +1,5 @@
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-import { getJson, googleAccessToken, shiftDate, todayIn } from "./AdsensePlugin.js";
+import { failure, getJson, googleAccessToken, shiftDate, todayIn } from "./AdsensePlugin.js";
 // Google Analytics 4 overview across every account and property the Google
 // login can see.
 //
@@ -241,10 +241,7 @@ export function createGa4Plugin() {
             await plugin.send(await collect(cfg));
         }
         catch (e) {
-            await plugin.send({
-                error: String(e?.message || e).slice(0, 160),
-                ...(e?.code === "invalid_grant" ? { authExpired: true } : {}),
-            });
+            await plugin.send(failure(e));
         }
     };
     const monitorFn = async (plugin) => {

package/dist/plugins/monitoring/IndexingPlugin.js

@@ -0,0 +1,152 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+import { isTransient } from "./AdsensePlugin.js";
+import { SCOPES, accessToken, inspectUrl, isStuck, parseKey, parseSitemap, parseSitemapIndex, urlMetadata, } from "./googleIndexing.js";
+async function loadState(file) {
+    try {
+        return JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+const slug = (s) => s.toLowerCase().replace(/^https?:\/\//, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
+export function createIndexingPlugin() {
+    let refreshTimer = null;
+    const sitesOf = (cfg, plugin) => cfg.sites?.length
+        ? cfg.sites.map((s) => ({ ...s, uniqueId: s.uniqueId || `indexing-${slug(s.name || String([].concat(s.sitemap || s.urls || "site")[0]))}` }))
+        : [{ ...cfg, name: cfg.name || plugin.instanceName, uniqueId: plugin.uniqueId }];
+    const collectSite = async (cfg, s, state, seen) => {
+        const timeout = cfg.timeout || 20000;
+        const f = (u, init) => fetch(u, { ...init, signal: AbortSignal.timeout(timeout) });
+        const getText = async (u) => {
+            const res = await fetch(u, { signal: AbortSignal.timeout(timeout), ...(s.insecureTls ? { tls: { rejectUnauthorized: false } } : {}) });
+            if (!res.ok)
+                throw new Error(`sitemap ${u}: HTTP ${res.status}`);
+            return res.text();
+        };
+        const key = parseKey(await readFile(cfg.keyFile, "utf8"));
+        const listed = new Map();
+        for (const u of s.urls || [])
+            listed.set(u, undefined);
+        for (const sm of [].concat(s.sitemap || [])) {
+            const xml = await getText(sm);
+            const children = parseSitemapIndex(xml).filter((c) => !s.sitemapMatch || new RegExp(s.sitemapMatch).test(c.url)).slice(0, s.sitemapChildren || 3);
+            const entries = children.length
+                ? (await Promise.all(children.map((c) => getText(c.url)))).flatMap(parseSitemap)
+                : parseSitemap(xml);
+            entries.sort((a, b) => (Date.parse(b.lastmod || "") || 0) - (Date.parse(a.lastmod || "") || 0));
+            for (const e of entries.slice(0, s.sitemapLimit || 25))
+                listed.set(e.url, e.lastmod);
+        }
+        const now = new Date().toISOString();
+        for (const [u, lastmod] of listed) {
+            const first = seen[u] || now;
+            state[u] = lastmod && Date.parse(lastmod) < Date.parse(first) ? new Date(lastmod).toISOString() : first;
+        }
+        const [inspectTok, indexTok] = await Promise.all([
+            accessToken(key, [SCOPES.inspect], f),
+            accessToken(key, [SCOPES.indexing], f),
+        ]);
+        const urls = [];
+        // One at a time: a few dozen URLs every few hours needs no concurrency.
+        for (const u of listed.keys()) {
+            try {
+                const [i, notify] = await Promise.all([
+                    inspectUrl(inspectTok, u, cfg.site, f),
+                    urlMetadata(indexTok, u, f).catch(() => undefined),
+                ]);
+                urls.push({ ...i, since: state[u], stuck: isStuck(i.coverageState), ...(notify !== undefined ? { notify } : {}) });
+            }
+            catch (e) {
+                // A 403 or 429 will say the same for every URL: stop and report it once.
+                if (e?.status === 401 || e?.status === 403 || e?.status === 429)
+                    throw e;
+                urls.push({ url: u, verdict: "", coverageState: "", since: state[u], stuck: false, error: String(e?.message || e).slice(0, 160) });
+            }
+        }
+        return {
+            ...(s.name ? { name: s.name } : {}),
+            site: cfg.site,
+            staleHours: s.staleHours || cfg.staleHours || 72,
+            intervalMs: cfg.refreshInterval || 21_600_000,
+            checked: urls.length,
+            indexed: urls.filter((u) => u.verdict === "PASS").length,
+            stuck: urls.filter((u) => u.stuck).length,
+            urls,
+        };
+    };
+    const sender = async (cfg, plugin) => {
+        if (!cfg.report)
+            return (data, uid) => plugin.send(data, uid);
+        let key = "";
+        try {
+            key = (await readFile(cfg.report.systemKeyFile, "utf8")).trim();
+        }
+        catch { }
+        // No key, no own system: report through the agent so the failure shows somewhere.
+        if (!key) {
+            console.error(`indexing: can't read ${cfg.report.systemKeyFile}, reporting through the agent instead`);
+            return (data, uid) => plugin.send(data, uid);
+        }
+        return async (data, uid) => {
+            try {
+                const res = await fetch(cfg.report.apiUrl, {
+                    method: "PUT",
+                    headers: { "Content-Type": "application/json", "X-System-Key": key, "X-Unique-Id": uid || plugin.uniqueId, "X-Type": "indexing" },
+                    body: JSON.stringify({ name: plugin.instanceName, ...data }),
+                    signal: AbortSignal.timeout(15000),
+                });
+                if (!res.ok)
+                    console.error(`indexing: report rejected, HTTP ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`);
+            }
+            catch (e) {
+                console.error("indexing: report failed:", e?.message || e);
+            }
+        };
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const sites = sitesOf(cfg, plugin);
+        const send = await sender(cfg, plugin);
+        if (!cfg.keyFile || !cfg.site) {
+            for (const s of sites)
+                await send({ ...(s.name ? { name: s.name } : {}), error: "indexing plugin needs keyFile and site" }, s.uniqueId);
+            return;
+        }
+        const stateFile = cfg.stateFile || `${process.env.HOME || "."}/.config/daemonitor/indexing-state.json`;
+        const seen = await loadState(stateFile);
+        // Only URLs some site still lists are kept, so a page that leaves a sitemap drops out.
+        const state = {};
+        for (const s of sites) {
+            try {
+                await send(await collectSite(cfg, s, state, seen), s.uniqueId);
+            }
+            catch (e) {
+                // Keep the failed site's clocks: its URLs didn't leave, the fetch did.
+                for (const [u, t] of Object.entries(seen))
+                    if (!(u in state))
+                        state[u] = t;
+                await send({
+                    ...(s.name ? { name: s.name } : {}),
+                    site: cfg.site,
+                    intervalMs: cfg.refreshInterval || 21_600_000,
+                    error: String(e?.message || e).slice(0, 160),
+                    ...(e?.status === 401 || e?.status === 403 || e?.code === "invalid_grant" ? { authExpired: true } : isTransient(e) ? { transient: true } : {}),
+                }, s.uniqueId);
+            }
+        }
+        await writeFile(stateFile, JSON.stringify(state)).catch(() => { });
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 21_600_000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("indexing", "indexing", "Google indexing of a list of URLs (Search Console URL Inspection, Indexing API notify history)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createIndexingPlugin;

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -278,7 +278,7 @@ export function createLogWatchPlugin() {
             if (!source?.path)
                 continue;
             const label = source.name || path.basename(source.path);
-            const uid = `log-${slug(source.name || source.path)}`;
+            const uid = `log-${slug(source.id || source.name || source.path)}`;
             let st = states.get(source.path);
             if (!st) {
                 st = { offset: 0, remainder: "", inited: false };

package/dist/plugins/monitoring/LxcPlugin.js

@@ -2,6 +2,7 @@ import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 import { exec } from "child_process";
 import { promisify } from "util";
 import { hostname } from "os";
+import { parseProcesses, PS_CMD } from "../../lib/processes.js";
 const execAsync = promisify(exec);
 const EXEC_OPTS = { maxBuffer: 32 * 1024 * 1024 };
 /** Parse LXD memory-limit strings like "1GB", "512MiB", "2GiB" to bytes. */
@@ -22,6 +23,8 @@ export function createLxcPlugin() {
     let lxcBin = "lxc";
     // cumulative CPU usage (ns) + wall clock (ms) per instance, for %-of-core calc
     const prevCpu = new Map();
+    // cumulative net bytes per instance, for a per-second rate (same shape as the os plugin)
+    const prevNet = new Map();
     const setupFn = async (plugin) => {
         lxcBin = plugin.config?.lxcBin || plugin.config?.bin || "lxc";
         try {
@@ -65,12 +68,31 @@ export function createLxcPlugin() {
                         cpu = Math.round((dUsage / dWallNs) * 1000) / 10;
                 }
                 prevCpu.set(name, { usage, t: now });
+                // Network: sum every non-loopback interface's counters from `lxc list`.
+                // No rate on the first poll or after a counter reset (restart).
+                let rx = 0, tx = 0;
+                for (const n of Object.values(st.network || {})) {
+                    if (n?.type === "loopback")
+                        continue;
+                    rx += Number(n?.counters?.bytes_received) || 0;
+                    tx += Number(n?.counters?.bytes_sent) || 0;
+                }
+                let network;
+                const pn = prevNet.get(name);
+                if (running && pn && now > pn.t && rx >= pn.rx && tx >= pn.tx) {
+                    const dt = (now - pn.t) / 1000;
+                    network = { rxBytes: rx, txBytes: tx, rxRate: Math.round((rx - pn.rx) / dt), txRate: Math.round((tx - pn.tx) / dt) };
+                }
+                prevNet.set(name, { rx, tx, t: now });
                 const mem = Number(st.memory?.usage) || 0;
                 const memLimit = limitToBytes(inst.config?.["limits.memory"] || inst.expanded_config?.["limits.memory"]);
                 const memPercent = memLimit ? Math.round((mem / memLimit) * 1000) / 10 : 0;
+                // Display name: a user.daemonitor.name config key, else the instance name.
+                // The id stays the instance name, so renaming keeps the service and its history.
+                const label = inst.config?.["user.daemonitor.name"] || inst.expanded_config?.["user.daemonitor.name"] || name;
                 const container = {
                     id: name,
-                    name,
+                    name: label,
                     service: "",
                     image: inst.config?.["image.description"] || inst.type || "lxc",
                     state: String(inst.status || "").toLowerCase(),
@@ -83,7 +105,19 @@ export function createLxcPlugin() {
                     memPercent,
                     restarts: 0,
                     exitCode: 0,
+                    network,
                 };
+                // Named service processes inside the container (nginx / php-fpm / db …),
+                // sampled from the host via `lxc exec` — no agent needed in the container.
+                if (running) {
+                    try {
+                        const { stdout: pout } = await execAsync(`${lxcBin} exec ${name} -- ${PS_CMD}`, { ...EXEC_OPTS, timeout: 8000 });
+                        container.processes = parseProcesses(pout);
+                    }
+                    catch {
+                        container.processes = [];
+                    }
+                }
                 // Grouping: a user.daemonitor.group config key, else the host.
                 const group = inst.config?.["user.daemonitor.group"] ||
                     inst.expanded_config?.["user.daemonitor.group"] || host;

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -283,11 +283,11 @@ export function createWordpressPlugin() {
                 continue;
             try {
                 const data = await collectSite(site);
-                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                const uid = `wp-${slug(site.id || site.name || site.url || site.path)}`;
                 await plugin.send(data, uid);
             }
             catch (e) {
-                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                const uid = `wp-${slug(site.id || site.name || site.url || site.path)}`;
                 await plugin.send({ name: site.name || site.path, error: String(e?.message || e).slice(0, 160) }, uid);
             }
         }

package/dist/plugins/monitoring/WorkspacePlugin.js

@@ -0,0 +1,180 @@
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+import { failure, getJson, googleAccessToken, shiftDate } from "./AdsensePlugin.js";
+// Google Workspace pooled storage: used against the domain's shared quota,
+// split by Drive, Gmail and Photos, from the Admin SDK customer usage report.
+//
+// Runs on the same `workspace` config block the cost plugin's workspace
+// provider uses (clientId, clientSecret, refreshToken, customerId), minted by
+// client/etc/google-auth.mjs --source=workspace with the reports scope.
+//
+// Google publishes the report a day or more late, so each poll walks back from
+// yesterday to the newest date that has data. `asOf` says which day it is.
+// The same day's users report lists each account's share, biggest first.
+//
+// The pool comes from the licenses assigned right now (seats x storage per
+// seat), not from the report, so a licence change shows within one poll. The
+// report's pool is days old: on 2026-11-05 it said 3.45 TB while the Admin
+// console already counted 19 TB. A SKU with no known size falls back to the
+// report's figure; `storagePerSeatGiB` sets one by SKU id.
+const API = "https://admin.googleapis.com/admin/reports/v1/usage/dates";
+const USERS_API = "https://admin.googleapis.com/admin/reports/v1/usage/users/all/dates";
+const USER_PARAMS = ["used_quota_in_mb", "drive_used_quota_in_mb", "gmail_used_quota_in_mb", "gplus_photos_used_quota_in_mb"];
+const LICENSES = "https://licensing.googleapis.com/apps/licensing/v1/product/Google-Apps/users";
+const LOOKBACK = 7;
+const GiB = 1024 ** 3;
+// Pooled storage each seat adds, in GiB (Google sells it in binary units).
+export const STORAGE_PER_SEAT = {
+    "1010020027": 30, // Business Starter
+    "1010020028": 2048, // Business Standard
+    "1010020025": 5120, // Business Plus
+    "1010020026": 5120, // Enterprise Standard
+    "1010020020": 5120, // Enterprise Plus
+};
+// ponytail: the biggest accounts only, so a large domain's report stays small.
+const MAX_USERS = 200;
+/** A customer usage report -> MB figures by parameter name. Null when the day has no data yet. */
+export function parseUsage(body) {
+    const params = body?.usageReports?.[0]?.parameters || [];
+    const out = {};
+    for (const p of params) {
+        const name = String(p?.name || "");
+        if (name.startsWith("accounts:") && p.intValue != null)
+            out[name.slice(9)] = Number(p.intValue);
+    }
+    return out.used_quota_in_mb != null ? out : null;
+}
+const MB = 1024 * 1024;
+/** A users usage report page -> each user's storage in bytes. */
+export function parseUsers(body) {
+    return (body?.usageReports || []).flatMap((r) => {
+        const email = String(r?.entity?.userEmail || "");
+        if (!email)
+            return [];
+        const v = {};
+        for (const p of r?.parameters || [])
+            v[String(p?.name || "").replace(/^accounts:/, "")] = Number(p?.intValue) || 0;
+        return [{ email, bytes: (v.used_quota_in_mb || 0) * MB, drive: (v.drive_used_quota_in_mb || 0) * MB, gmail: (v.gmail_used_quota_in_mb || 0) * MB, photos: (v.gplus_photos_used_quota_in_mb || 0) * MB }];
+    });
+}
+/** MB figures -> what the report carries. A total of 0 or less means Google reports no pooled cap. */
+export function summarize(u, asOf) {
+    const total = u.total_quota_in_mb > 0 ? u.total_quota_in_mb * MB : null;
+    const used = u.used_quota_in_mb * MB;
+    return {
+        asOf,
+        usedBytes: used,
+        totalBytes: total,
+        usedPct: total ? Math.round((used / total) * 1000) / 10 : null,
+        breakdown: [
+            { name: "Drive", bytes: (u.drive_used_quota_in_mb || 0) * MB },
+            { name: "Gmail", bytes: (u.gmail_used_quota_in_mb || 0) * MB },
+            { name: "Photos", bytes: (u.gplus_photos_used_quota_in_mb || 0) * MB },
+        ],
+    };
+}
+/** Licence assignments -> seat counts per SKU. */
+export function countSeats(items) {
+    const by = new Map();
+    for (const a of items) {
+        const sku = String(a?.skuId || "");
+        const s = by.get(sku) || { sku, name: String(a?.skuName || sku).replace(/^Google Workspace /, ""), count: 0 };
+        s.count++;
+        by.set(sku, s);
+    }
+    return [...by.values()].sort((a, b) => b.count - a.count);
+}
+/** Seats -> pooled storage in bytes, or null when a SKU's size is unknown. */
+export function poolBytes(seats, overrides = {}) {
+    let total = 0;
+    for (const s of seats) {
+        const gib = overrides[s.sku] ?? STORAGE_PER_SEAT[s.sku];
+        if (gib == null)
+            return null;
+        total += s.count * gib * GiB;
+    }
+    return seats.length ? total : null;
+}
+export function createWorkspacePlugin() {
+    let refreshTimer = null;
+    const collect = async (cfg) => {
+        const timeout = cfg.timeout || 20000;
+        const auth = { headers: { Authorization: `Bearer ${await googleAccessToken(cfg, timeout)}` } };
+        const today = new Date().toISOString().slice(0, 10);
+        // The pool as licensed right now. If this fails, the report's pool stands in.
+        let seats;
+        try {
+            const items = [];
+            let page = "";
+            do {
+                const q = new URLSearchParams({ customerId: cfg.customerId, maxResults: "1000", ...(page ? { pageToken: page } : {}) });
+                const r = await getJson(`${LICENSES}?${q}`, auth, timeout);
+                items.push(...(r?.items || []));
+                page = r?.nextPageToken || "";
+            } while (page);
+            seats = countSeats(items);
+        }
+        catch { /* report pool */ }
+        const licensed = seats ? poolBytes(seats, cfg.storagePerSeatGiB) : null;
+        for (let back = 1; back <= LOOKBACK; back++) {
+            const date = shiftDate(today, -back);
+            // No `parameters` filter: one misspelt name fails the whole call.
+            // A day Google hasn't published is a 400 ("Data for dates later than X is not yet available").
+            const body = await getJson(`${API}/${date}?customerId=${encodeURIComponent(cfg.customerId)}`, auth, timeout)
+                .catch((e) => { if (/not yet available/i.test(String(e?.message)))
+                return null; throw e; });
+            const u = parseUsage(body);
+            if (!u)
+                continue;
+            // Per-user storage is extra: if it fails, the domain totals still report.
+            let users;
+            try {
+                const all = [];
+                let page = "";
+                do {
+                    const q = new URLSearchParams({
+                        customerId: cfg.customerId, maxResults: "1000",
+                        parameters: USER_PARAMS.map((p) => `accounts:${p}`).join(","),
+                        ...(page ? { pageToken: page } : {}),
+                    });
+                    const r = await getJson(`${USERS_API}/${date}?${q}`, auth, timeout);
+                    all.push(...parseUsers(r));
+                    page = r?.nextPageToken || "";
+                } while (page);
+                users = all.sort((a, b) => b.bytes - a.bytes).slice(0, MAX_USERS);
+            }
+            catch { /* totals only */ }
+            const s = summarize(u, date);
+            if (licensed)
+                Object.assign(s, { totalBytes: licensed, usedPct: Math.round((s.usedBytes / licensed) * 1000) / 10 });
+            return {
+                name: "Workspace storage", warnPct: cfg.warnPct ?? 85, critPct: cfg.critPct ?? 95, ...s,
+                poolFrom: licensed ? "licenses" : "report", seats, users,
+            };
+        }
+        throw new Error(`no usage report in the last ${LOOKBACK} days`);
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        if (!cfg.clientId || !cfg.clientSecret || !cfg.refreshToken || !cfg.customerId) {
+            await plugin.send({ error: "workspace plugin needs clientId, clientSecret, refreshToken and customerId" });
+            return;
+        }
+        try {
+            await plugin.send(await collect(cfg));
+        }
+        catch (e) {
+            await plugin.send(failure(e));
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 900000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("workspace", "workspace", "Google Workspace pooled storage (used of shared quota, by Drive, Gmail, Photos)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createWorkspacePlugin;

package/dist/plugins/monitoring/googleIndexing.js

@@ -0,0 +1,178 @@
+// Google Indexing API and Search Console URL Inspection on a service account.
+//
+// Pure on purpose: WebCrypto and fetch only, no Node imports, so the agent
+// plugin (IndexingPlugin) and the tenant Worker (MCP tools) share this file.
+// The tenant vendors it through scripts/sync-shared.sh.
+//
+// The service account must be an Owner of the Search Console property for
+// publish to count, and a user of it (any level) for inspection.
+export const SCOPES = {
+    indexing: "https://www.googleapis.com/auth/indexing",
+    inspect: "https://www.googleapis.com/auth/webmasters.readonly",
+};
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const INDEXING = "https://indexing.googleapis.com/v3/urlNotifications";
+const INSPECT = "https://searchconsole.googleapis.com/v1/urlInspection/index:inspect";
+const b64url = (bytes) => {
+    const s = typeof bytes === "string" ? bytes : String.fromCharCode(...bytes);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+const utf8 = (s) => new TextEncoder().encode(s);
+export function parseKey(json) {
+    const k = typeof json === "string" ? JSON.parse(json) : json;
+    if (!k?.client_email || !k?.private_key)
+        throw new Error("service account key needs client_email and private_key");
+    return k;
+}
+/** A signed RS256 JWT asking Google's token endpoint for these scopes. */
+export async function signAssertion(key, scopes, now = Math.floor(Date.now() / 1000)) {
+    const der = Uint8Array.from(atob(key.private_key.replace(/-----[^-]+-----|\s/g, "")), (c) => c.charCodeAt(0));
+    const pk = await crypto.subtle.importKey("pkcs8", der, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["sign"]);
+    const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const claims = b64url(JSON.stringify({
+        iss: key.client_email,
+        scope: scopes.join(" "),
+        aud: key.token_uri || TOKEN_URL,
+        iat: now,
+        exp: now + 3600,
+    }));
+    const sig = new Uint8Array(await crypto.subtle.sign("RSASSA-PKCS1-v1_5", pk, utf8(`${head}.${claims}`)));
+    return `${head}.${claims}.${b64url(sig)}`;
+}
+async function json(res) {
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        const e = new Error(body?.error_description || body?.error?.message || (typeof body?.error === "string" ? body.error : "") || `HTTP ${res.status}`);
+        e.status = res.status;
+        e.code = typeof body?.error === "string" ? body.error : body?.error?.status;
+        throw e;
+    }
+    return body;
+}
+// One token per key and scope set, reused until five minutes before it ends.
+const tokens = new Map();
+export async function accessToken(key, scopes, f = fetch) {
+    const id = `${key.client_email} ${scopes.join(" ")}`;
+    const had = tokens.get(id);
+    if (had && had.until > Date.now())
+        return had.token;
+    const r = await json(await f(key.token_uri || TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            assertion: await signAssertion(key, scopes),
+        }).toString(),
+    }));
+    tokens.set(id, { token: r.access_token, until: Date.now() + (Number(r.expires_in) || 3600) * 1000 - 300_000 });
+    return r.access_token;
+}
+/** Coverage states that mean Google knows of the page, or should, and hasn't indexed it. */
+export const NOT_INDEXED = [
+    "Discovered - currently not indexed",
+    "URL is unknown to Google",
+    "Crawled - currently not indexed",
+];
+export const isStuck = (coverageState) => !!coverageState && NOT_INDEXED.some((s) => s.toLowerCase() === coverageState.toLowerCase());
+export function parseInspection(url, r) {
+    const idx = r?.inspectionResult?.indexStatusResult || {};
+    const out = {
+        url,
+        verdict: String(idx.verdict || "VERDICT_UNSPECIFIED"),
+        coverageState: String(idx.coverageState || ""),
+    };
+    const opt = {
+        indexingState: idx.indexingState, lastCrawlTime: idx.lastCrawlTime, pageFetchState: idx.pageFetchState,
+        robotsTxtState: idx.robotsTxtState, googleCanonical: idx.googleCanonical, userCanonical: idx.userCanonical,
+        crawledAs: idx.crawledAs, link: r?.inspectionResult?.inspectionResultLink,
+    };
+    for (const [k, v] of Object.entries(opt))
+        if (v)
+            out[k] = String(v);
+    return out;
+}
+export async function inspectUrl(token, url, siteUrl, f = fetch) {
+    const r = await json(await f(INSPECT, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ inspectionUrl: url, siteUrl, languageCode: "en-US" }),
+    }));
+    return parseInspection(url, r);
+}
+/**
+ * urlNotificationMetadata -> the notify times. Google often answers a publish
+ * with only `{ url }` and no latestUpdate, and metadata for that URL then 404s:
+ * the call was accepted (it counts against quota) but nothing was recorded.
+ */
+export function parseMetadata(url, r) {
+    const m = r?.urlNotificationMetadata || r || {};
+    const out = { url: String(m.url || url) };
+    if (m.latestUpdate?.notifyTime)
+        out.updated = String(m.latestUpdate.notifyTime);
+    if (m.latestRemove?.notifyTime)
+        out.deleted = String(m.latestRemove.notifyTime);
+    return out;
+}
+export async function publishUrl(token, url, type = "URL_UPDATED", f = fetch) {
+    const r = await json(await f(`${INDEXING}:publish`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ url, type }),
+    }));
+    const m = parseMetadata(url, r);
+    return { ...m, recorded: !!(m.updated || m.deleted) };
+}
+/** Notify history for one URL, or null when Google has none on record (404). */
+export async function urlMetadata(token, url, f = fetch) {
+    try {
+        return parseMetadata(url, await json(await f(`${INDEXING}/metadata?url=${encodeURIComponent(url)}`, {
+            headers: { Authorization: `Bearer ${token}` },
+        })));
+    }
+    catch (e) {
+        if (e?.status === 404)
+            return null;
+        throw e;
+    }
+}
+/** Is this URL inside the Search Console property? sc-domain:x covers x and its subdomains. */
+export function inProperty(url, siteUrl) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (siteUrl.startsWith("sc-domain:")) {
+        const d = siteUrl.slice(10).toLowerCase();
+        const h = u.hostname.toLowerCase();
+        return h === d || h.endsWith(`.${d}`);
+    }
+    return url.startsWith(siteUrl);
+}
+// ---- sitemaps ---------------------------------------------------------------
+/** A urlset sitemap -> its URLs with lastmod, newest first. */
+export function parseSitemap(xml) {
+    const out = [];
+    for (const m of xml.matchAll(/<url>([\s\S]*?)<\/url>/g)) {
+        const loc = /<loc>\s*([^<]+?)\s*<\/loc>/.exec(m[1])?.[1];
+        const lastmod = /<lastmod>\s*([^<]+?)\s*<\/lastmod>/.exec(m[1])?.[1];
+        if (loc)
+            out.push({ url: loc.replace(/&amp;/g, "&"), ...(lastmod ? { lastmod } : {}) });
+    }
+    return out.sort((a, b) => (Date.parse(b.lastmod || "") || 0) - (Date.parse(a.lastmod || "") || 0));
+}
+/** A sitemap index -> its child sitemaps, most recently changed first. */
+export function parseSitemapIndex(xml) {
+    if (!/<sitemapindex[\s>]/.test(xml))
+        return [];
+    const out = [];
+    for (const m of xml.matchAll(/<sitemap>([\s\S]*?)<\/sitemap>/g)) {
+        const loc = /<loc>\s*([^<]+?)\s*<\/loc>/.exec(m[1])?.[1];
+        const lastmod = /<lastmod>\s*([^<]+?)\s*<\/lastmod>/.exec(m[1])?.[1];
+        if (loc)
+            out.push({ url: loc.replace(/&amp;/g, "&"), ...(lastmod ? { lastmod } : {}) });
+    }
+    return out.sort((a, b) => (Date.parse(b.lastmod || "") || 0) - (Date.parse(a.lastmod || "") || 0));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.51",
+  "version": "1.1.54",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",