@getvitops/astro 4.1.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,230 @@
 # @getvitops/astro
 
+## 5.0.0
+
+### Major Changes
+
+- **Dangling token references are now a build failure.** `validate()` resolves every `var(--…)` a
+  config authors — in `patterns.defaults` / `radii` / `groups` / `items.*.{base,overrides,states}`,
+  `typography.roles` and `shadows` — against the tokens that config actually emits. A reference to a
+  token that does not exist used to validate, generate, minify and ship, then resolve to nothing in
+  the browser: one downstream config shipped a `.cta` whose `color` fell back to `inherit` on a brand
+  fill (unreadable text on every filled button), and two of its four dead references had been dead for
+  several releases with nothing ever reporting them.
+
+  The check is deliberately anchored to the namespaces the generator owns — `--color-*`, `--shadow-*`,
+  `--z-tier-*`, `--surface-glass`, `--overlay` — the same discipline `vitops lint` follows. A pattern
+  may legitimately reference a framework token from `@getvitops/core` or a hook of your own, and
+  enumerating "every valid token" would make those false positives. A reference carrying a fallback
+  (`var(--x, 0.25rem)`) is never flagged: that is you saying what happens when the token is absent.
+  Errors name the config path and suggest the nearest token that does exist.
+
+  Two related diagnostics ship with it:
+  - **Pre-1.0 colour-grammar references are reported as one rename table**, not as a dozen separate
+    "no such token" errors — the shape the 3.0 flat-config detector uses, applied to the 1.0 colour
+    change. It is built from your own role names, and it says to apply the renames _simultaneously_,
+    because several of them rotate (`--surface-bg` → `--color-bg-surface-muted`,
+    `--surface-bg-bold` → `--color-bg-surface`) and sequential replacement compounds them.
+  - **A surface-shaped role declared chromatic now warns.** A bare hue string is shorthand for
+    `kind: "chromatic"`, which emits no bare `--color-bg-<role>` and no `.bg-<role>` — so writing
+    `"surface": "ink"` silently removed `--color-bg-surface` and the 36 references the framework's own
+    CSS makes to it. Relatedly, `--surface-glass`, `--overlay` and `.glass` are no longer emitted when
+    `surface` is chromatic: they read `--color-bg-surface`, so emitting them pointed at nothing.
+
+  **`vitops lint --fix` is now the migration tool.** It reads `var(--…)` out of CSS and `<style>`
+  blocks (not just `class` attributes) and rewrites pre-1.0 token references in a **single pass**, so
+  the rotating renames cannot compound. Nothing else is rewritten — every other finding it reports is
+  a judgement call. Run it after a major bump.
+
+  **`--help` works on every subcommand.** `vitops lint --help` used to exit non-zero with
+  `Unknown option '--help'`; every leaf subcommand parsed its own argv strictly and none declared the
+  option. It is now answered before dispatch, so no command can forget it, and a drift guard fails the
+  build if a command has no documented options. (`validate`'s options were genuinely undocumented and
+  now are.)
+
+  **The Astro integration reads `site.tracking` and `site.legal.cookieConsent`.** These drive the
+  generated cookie notice, while `vitops({ consent, tracking })` drove the runtime — two hand-synced
+  declarations of the same fact with nothing comparing them, so a site could ship a notice naming
+  categories its banner never offered, or disclosing an `_ac` cookie no capture script ever wrote, and
+  the build was clean. The config blocks are now defaults (as `css` / `fonts` / `favicon` / `ads`
+  already were) and a genuine contradiction — `true` against `false` on the same fact — **fails the
+  build**, naming both sides. An absent option is not a contradiction; it just takes the config's
+  value.
+
+  Also fixed, each from a downstream report:
+  - **`@getvitops/astro/tracking`** re-exports `@getvitops/utils/tracking` (plus `TRACKING_ENDPOINT`),
+    so the documented conversion flow works with one install. Under strict pnpm app code cannot
+    resolve a transitive dependency, and the obvious workaround — importing the same symbols from the
+    package index — is the one that drags the integration's Node builtins toward a Worker bundle. This
+    entry and `./routes` are both clean.
+  - **`createConversionRoute`'s example was broken on every supported Astro.** It read the binding off
+    `locals.runtime.env`, removed in Astro v6, while the package peers on `>= 7` — and because the
+    throw precedes the response, Astro re-reads the request and reports a misleading "Body has already
+    been used". It also called a `toNotifyContext()` helper that does not exist. The example now uses
+    `import { env } from 'cloudflare:workers'` and a plain `NotifyContext`.
+  - **`/api/track` is exported as `TRACKING_ENDPOINT`**, and the integration warns at build when
+    tracking is on and no route answers it. It was a bare literal inside the inlined capture script:
+    name the route file anything else and every `tel:` beacon 404s, conversions vanish, and nothing
+    errors anywhere.
+  - **`describeEvent` no longer reports "from Unknown"** for forms that don't have a field literally
+    named `name`. It now falls back through `first_name`/`last_name`, `full_name`, and finally the
+    email address.
+  - **`sendEmail` takes `timeoutMs` (default 10s).** `binding.send()` had no deadline, so one hung
+    attempt hung the request that produced it — indefinitely, in the one module otherwise built on
+    always saying why. A timeout is retried, like any other transient failure.
+  - **`vitops search notify` warns when the sitemap's URLs aren't on the configured origin.** A 404
+    fails loudly; a well-formed sitemap belonging to someone else did not — a route collision served a
+    valid document listing another site's pages and the run reported a healthy submission. Surfaces at
+    `--dry`.
+  - **`require()` warns when the page has no `<wc-consent>`.** The demand can never be granted, so
+    whatever waited on it never runs — silently. Hit by rendering `<Tracking />` on pages where
+    `<CookieConsent />` wasn't.
+  - **`vitops agents` no longer writes a path it guessed.** It used to warn and then write "tokens
+    live in `design-system.json`" into a project whose tokens are in `company.json`, with the four
+    emitted `vitops generate` commands hard-coded to match — copy-paste-broken in exactly the projects
+    that most need the block to be right. It now finds the config by shape, interpolates the resolved
+    path into every emitted command, and fails rather than guessing when there is nothing to name.
+  - **`vitops search setup --dry` and `vitops ads setup --dry` run without credentials.** A dry run
+    that mutates nothing should not demand the token to mutate; with none set it plans from scratch
+    and says so. (`--check` still needs them — drift is a comparison against live state.) Both now
+    also mention that the Cloudflare token needs `Zone:Read` alongside `Zone:DNS:Edit` — the
+    zone-by-name lookup uses it, and its absence read as "the zone isn't in this account".
+  - **`vitops legal` names the files it wrote and flags new ones.** Enabling `cookieConsent` silently
+    produced a `cookie-notice` document that then needs a page, a route, a link and a `policyUrl`; the
+    command said only "3 files". The review reminder is also printed on the stdout path, where it was
+    missing entirely.
+  - **`vitops init` writes a versioned `$schema`** — `./node_modules/@getvitops/generator/schema.json`,
+    following wrangler — instead of an unpinned unpkg URL that resolved to whatever was newest, so an
+    editor validated a pinned project against a schema it wasn't built with.
+  - **`favicon.backgroundColor` and `favicon.name` are described accurately.** `backgroundColor` is
+    not manifest-only: it fills the opaque `apple-touch-icon.png` and `icon-mask.png`, which are
+    written whether or not a manifest is. `name` documents that it and `themeColor` **together** are
+    what make a site installable. The missing-background warning now also fires for a dark opaque mark,
+    not only a transparent source — `apple-touch-icon` insets the logo and fills the surround either
+    way.
+
+- **The framework now says out loud which patterns are foundational, and reports it when you
+  reach past them.** From repeated downstream reports: sites were inventing a `.wrap` class and
+  using it everywhere instead of `.centered`, and `.subgrid` — the class for any set of cards —
+  was going essentially unused. Neither failure is visible in a build: every class involved is
+  real, nothing errors, and the page renders.
+
+  **`.subgrid` was missing from the generated class reference entirely.** So was `.cluster`, and
+  so was `.region`. `vitops docs classes` is the doc an agent is told to fetch for "which class
+  do I apply", and the framework's answer for a set of cards was not in it — which is most of why
+  it never got used. All three are now documented, along with `grid-auto`, and the reference opens
+  with a **Foundations** section that states the six substitutions as
+  _temptation → what to write instead_ rather than as a vocabulary list. The same table is now in
+  the shipped agent skill and in the `@getvitops/create` template's `AGENTS.md`, because a pointer
+  to a doc only helps someone who already suspects there is something to look up. (`css`/`bricks`
+  and `tailwind` alike — this is documentation and the `TIERS` manifest, not emitted CSS.)
+
+  **`vitops lint` gained three reuse rules and a markup pass.** The existing `.centered` rule only
+  fired when the hand-written CSS already referenced `--width-measure`, which is precisely the
+  author who was never going to hand-roll a container. It now also catches a page-scale
+  `max-width` (≥ 48rem, or a `ch` reading measure) with auto margins, and a
+  container-shaped class name — `wrap`, `wrapper`, `container`, `inner`, `shell`, … — carrying any
+  width cap at all. Reading the cap out of `min()` / `clamp()` too. New rules report a
+  hand-written `repeat()` grid as `.subgrid` (or `.grid-auto`), and a new **markup** pass reports a
+  repeated card set laid out without either — a loop that renders a card, or three or more cards
+  written out. That last one is the only check that can see this drift at all, since a card list
+  built from utility classes contains no bad class and no hand-written CSS.
+
+  All of these are `suggestion` severity, so they do not fail your build unless you pass
+  `--strict`. They found five real instances in this repo's own docs site.
+
+  **`vitops lint [files...]`** now takes explicit paths instead of scanning `--src`, so it can be
+  wired into a pre-commit hook — `vp`'s `staged` key appends the staged files to whatever it runs,
+  and a command that refused positionals could not be put in the one place the feedback lands at
+  the moment the code is written. Unreadable and non-source paths are skipped rather than fatal. The
+  `@getvitops/create` emdash template wires it up with `--strict` and adds a `lint:design` script.
+
+  **Two answers for "the whole card is a link", because one cannot exist.** Reported downstream:
+  agents dislike the `<li>` wrapper when a card is a link and write `<li><a class="card">` instead.
+  That shape is **wrong in a way that renders fine**, which is why it survives review — the `<li>`
+  is the grid item, so the anchor is an ordinary block inside it and the tranches within the anchor
+  never reach the parent's shared row lines. The alignment `.subgrid` exists for silently does not
+  happen, and the anchor does not fill the cell either. Putting the anchor in the grid's place
+  (`<ul><a></ul>`) is invalid HTML, so there was genuinely no correct shape to reach for.
+
+  There are now two, and they trade against each other because **no CSS-only technique can make a
+  whole card clickable and leave its text selectable** — a transparent overlay necessarily receives
+  the pointer-drag:
+
+  | Want                                     | Use                                         |
+  | ---------------------------------------- | ------------------------------------------- |
+  | zero JS, whole card clickable            | `.stretched-link` — **text not selectable** |
+  | selectable text **and** a clickable card | `<Cards>` / `<wc-cards>` — needs JS         |
+
+  `.stretched-link` goes on a link inside the card; its `::after` covers the card.
+  **`<wc-cards>` is a new tier-2 element** that adds no overlay and instead tells a click apart from
+  the end of a drag, so text selection survives. Its fallback is the card's own link, fully usable
+  with no JS, and the pointer cursor is applied by the element — so the affordance never appears
+  without the behaviour. `<Cards>` emits it for you. They are alternatives, never layered: with an
+  overlay present the JS has nothing to do, and `vitops lint` reports the combination. (All formats
+  — pattern partials, deliberately not `utilities.css`, which the tailwind format skips on the
+  invariant that everything left in it is a name Tailwind ships itself.)
+
+  ### Breaking
+  - **`<Subgrid />` renders its slot verbatim — author the `<li>` items yourself.**
+
+    ```diff
+      <Subgrid>
+    -   <article class="card">…</article>
+    +   <li class="card subgrid-card">…</li>
+      </Subgrid>
+    ```
+
+    It used to parse the slotted HTML and rebuild each child as an `<li>`, carrying over only
+    `class` and `style`. That existed solely because a `<ul>` may contain nothing else, and it cost
+    more than it bought: the child's tag was discarded, `id`/`data-*`/`aria-*` were silently
+    dropped, and `href` could not survive at all. Nothing is copied now, so nothing is lost. `as`
+    picks the container (`ul` by default, `ol`, `div`), and all other props are forwarded — they
+    were previously discarded, including `role`.
+
+  - **`<Subgrid />` and `<Tree />` now emit `role="list"`,** as does the Bricks `sitenav` element.
+    `list-style: none` stops Safari + VoiceOver announcing a `<ul>` as a list, so every marker-less
+    framework list was silently losing the semantics its `<ul>` was chosen for. If you hand-write
+    `.subgrid`, `.list`, `.facet-list`, `.nav-items`, `.collapse-menu` or `.tree` markup, add
+    `role="list"` yourself — the framework cannot add it to markup it does not render, and each
+    partial now says so at the `list-style` reset.
+  - **`<Cards />` no longer adds `class="card"` to slotted children,** because it no longer parses
+    them. Write the class on the item. It now emits `<wc-cards>` around a `<Subgrid>`, which is what
+    makes the whole card clickable — and like `<Tree />`, **it emits its own element, so do not wrap
+    it in `<wc-cards>` yourself.** It also previously passed a `role="list"` that `<Subgrid>` silently
+    discarded, so that never took effect.
+  - **`.subgrid-card` now sets `position: relative`**, so `stretched-link` inside it needs no extra
+    class. If you were absolutely positioning a descendant of a `.subgrid-card` against an ancestor
+    _outside_ that card, it will now resolve against the card. Move the positioning context
+    explicitly. (`css`/`bricks`/`tailwind` — the pattern partial is inlined into all three.) Not
+    reachable by `vitops lint --fix`: the fix depends on which ancestor you meant, which the
+    linter cannot know.
+
+  ### Fixed
+  - **`packages/generator/src/docs.ts` contained a literal NUL byte** (`CODE_SLOT`, written as the
+    raw character rather than an escape). libmagic classified the file as `data` rather than text, so
+    grep and ripgrep treated the largest doc emitter in the repo as **binary and silently skipped
+    it** — every search for a string in it returned nothing, with no error. It is now written as the `\u0000` escape.
+    Behaviour is identical; the file is searchable.
+  - **`.grid-auto` is documented.** It was a real framework class for auto-fit card grids with no
+    entry in the class reference, so the honest alternative to `subgrid` was as invisible as
+    `subgrid` itself.
+  - **`.raised` replaces the advice to use `.relative` above a `stretched-link` overlay**, which
+    could not work: a positioned element at `z-index: auto` does not rise above an explicit
+    `z-index` regardless of DOM order, so a second link or button in the card stayed underneath and
+    unclickable. `.raised` sets both, against the same `--z-tier-raised` token the overlay now uses
+    instead of a hard-coded `1`.
+
+### Patch Changes
+
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+  - @getvitops/generator@5.0.0
+  - @getvitops/utils@5.0.0
+  - @getvitops/core@5.0.0
+  - @getvitops/vite@5.0.0
+
 ## 4.1.0
 
 ### Minor Changes

package/README.md

@@ -45,6 +45,28 @@ import Head from '@getvitops/astro/Head.astro';
 priority. It does **not** emit a stylesheet `<link>` — the integration imports the generated CSS into
 Astro's module graph and Astro emits that link itself.
 
+## Rendering mode
+
+**Prefer `output: 'static'`** (Astro's default). Nothing this integration produces needs a server:
+the CSS, favicons and web-component bundles are all build-time artifacts, and the components
+progressively enhance markup that is already complete in the HTML. A static build also gives the
+sitemap every route, since `@astrojs/sitemap` lists prerendered routes only.
+
+Opt individual routes out with `export const prerender = false` where a page genuinely needs
+per-request work — a form `POST` handler, an auth-gated page, per-visitor content. That needs an
+adapter, but leaves the rest of the site static.
+
+```astro
+---
+// src/pages/account.astro — server-rendered; every other page stays static
+export const prerender = false;
+---
+```
+
+**EmDash sites invert this**, because the CMS admin and API need a server: they run
+`output: 'server'` and opt _into_ prerendering per route. See
+[`@getvitops/emdash`](../emdash/README.md#rendering-mode).
+
 ## Options
 
 | option          | default              | does                                                              |

package/dist/exports/tracking.d.mts

@@ -0,0 +1,3 @@
+import { a as TRACKING_ENDPOINT } from "../tracking-DdEKExlE.mjs";
+export * from "@getvitops/utils/tracking";
+export { TRACKING_ENDPOINT };

package/dist/exports/tracking.mjs

@@ -0,0 +1,5 @@
+import { n as TRACKING_ENDPOINT } from "../tracking-CmSfxWC3.mjs";
+
+export * from "@getvitops/utils/tracking"
+
+export { TRACKING_ENDPOINT };

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import { i as TRACKING_COOKIE, n as ResolveTrackingContext, o as TrackingCategory, r as ResolvedTracking, s as resolveTracking, t as GetvitopsTrackingOptions } from "./tracking-DdEKExlE.mjs";
 import { LegalOutput, SiteFont, StylesheetFormat } from "@getvitops/generator";
 import { generateIconInclude } from "@getvitops/utils";
 import { AdProvider } from "@getvitops/utils/ads";
@@ -342,57 +343,6 @@ interface SeoContext {
  */
 declare function resolveSeo(defaults: GetvitopsSeoOptions, props: SeoProps, ctx: SeoContext): ResolvedSeo;
 //#endregion
-//#region src/tracking.d.ts
-/**
- * The `<Tracking />` resolution layer — tracking config in, what to emit out.
- *
- * Separate from `Tracking.astro` for the same reason `analytics.ts` is separate
- * from `Analytics.astro`: everything decidable is a pure function asserted in
- * `tracking.test.ts`, and the component only renders what this returns.
- *
- * The one decision here is **which consent category the `_ac` cookie waits on**,
- * and it is stated rather than inferred. `_ac` is a 90-day identifier tying a
- * visitor to the ad that brought them, so `marketing` is the default — but a site
- * using click IDs purely for its own campaign reporting may reasonably file it
- * under `analytics`, and that is the consumer's call to make, not ours to guess.
- */
-/** Which consent category the attribution cookie waits on. */
-type TrackingCategory = 'marketing' | 'analytics';
-interface GetvitopsTrackingOptions {
-  /** Capture ad click IDs and UTMs into `_ac`. */
-  enabled?: boolean;
-  /** Default `marketing`. */
-  category?: TrackingCategory;
-  /** Informational; capture recognises every known click-ID parameter regardless. */
-  platforms?: string[];
-}
-/** The cookie the capture script writes. Mirrors `TRACKING_COOKIE` in utils. */
-declare const TRACKING_COOKIE = "_ac";
-interface ResolvedTracking {
-  enabled: boolean;
-  category: TrackingCategory;
-  /** Cookie names to clear on revoke — rides on `data-consent-cookies`. */
-  cookies: string[];
-  /** Configuration problems, as prose. The integration logs these. */
-  warnings: string[];
-}
-interface ResolveTrackingContext {
-  /** Is the consent gate enabled on this site (`vitops({ consent })`)? */
-  consent?: boolean;
-  /** Categories the banner offers, so we can catch a demand with no row. */
-  consentCategories?: readonly string[];
-}
-/**
- * Resolve the tracking config into what the component emits.
- *
- * Two warnings, both about the same failure — a persistent identifier written
- * with no way for the visitor to decline, or a permission asked for with no way
- * to answer. Returned as data rather than logged here so the check is a test
- * rather than a line someone might scroll past, exactly as `resolveAnalytics`
- * does.
- */
-declare function resolveTracking(opts: GetvitopsTrackingOptions | undefined, ctx?: ResolveTrackingContext): ResolvedTracking;
-//#endregion
 //#region src/integration.d.ts
 interface GetvitopsFaviconOptions {
   /** Source SVG or PNG. */

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/analytics.ts","../src/seo.ts","../src/tracking.ts","../src/integration.ts","../src/ads.ts","../src/lastmod.ts"],"mappings":";;;;;;;;;;;;;;;;;AA2BA;;;;AAA6B;AAQ7B;;;;AAA2B;AAE3B;;;;AAA6D;AAE7D;;KAZY,iBAAA;;;;;;;KAQA,eAAA;AAAA,KAEA,uBAAA,GAA0B,OAAO,CAAC,eAAA;AAAA,UAE7B,sBAAA;EAYc;EAV7B,EAAA;EAakC;;;;EARlC,QAAA,GAAW,uBAAA;EAQuB;EANlC,MAAA,GAAS,MAAM;AAAA;AAAA,UAGA,cAAA;EAMa;EAJ5B,EAAA;EACA,QAAA,GAAW,uBAAuB;AAAA;AAAA,UAGnB,aAAA;EAaR;EAXP,GAAA;EAc+B;EAZ/B,MAAA;EAcA;AAEG;AAGL;;;;;;EAVE,OAAA;AAAA;AAAA,UAGe,gBAAA;EAaa;EAX5B,MAAA;EAM2B;EAJ3B,GAAG;AAAA;AAAA,UAGY,yBAAA;EACf,eAAA,YAA2B,sBAAA;EAC3B,OAAA,YAAmB,cAAA;EACnB,MAAA,GAAS,aAAA;EACT,SAAA,YAAqB,gBAAA;EAEV;EAAX,QAAA,GAAW,iBAAA;AAAA;AAWb;;;;;;;;AAAA,UAAiB,uBAAA;EAyBA;;;;EApBf,UAAA,GAAa,uBAAuB;EAqC7B;EAnCP,SAAA;AAAA;;;;;;;;;;;;;;AAmCa;AAIf;UArBiB,QAAA;;EAEf,QAAA;EACA,QAAA,EAAU,eAAA;EACV,WAAA;EAqBgC;EAnBhC,OAAA;EACA,QAAA,EAAU,iBAAA;EAmBV;;;;;EAbA,KAAA;EAoBe;EAlBf,MAAA;EACA,GAAA;EACA,KAAA,EAAO,MAAA;AAAA;AA0JT;AAAA,UAtJiB,WAAA,SAAoB,QAAQ;EAC3C,GAAG;AAAA;AAAA,UAGY,iBAAA;EACf,IAAA,EAAM,WAAW;EAoJC;EAlJlB,YAAA;EAgJM;EA9IN,QAAA;AAAA;AAAA,UAGe,uBAAA;EA6Id;EA3ID,OAAO;AAAA;AAmLT;;;;;;;AAAA,iBA3CgB,gBAAA,CACd,IAAA,EAAM,yBAAA,cACN,GAAA,GAAK,uBAAA,GACJ,iBAAA;AAwCyE;AAAA,iBAA5D,iBAAA,CAAkB,IAAA,EAAM,QAAA,KAAa,uBAAuB;;;;;;;;;;;;AArT5E;;;KCdY,cAAA;ADciB;AAAA,KCXjB,SAAA;;;;ADmBe;AAE3B;;;;AAA6D;AAE7D;UCXiB,mBAAA;;EAEf,QAAA;EDWA;;;;;;AAOe;AAGjB;;;;ECTE,aAAA;EDYA;ECVA,YAAA;EDUkC;ECRlC,kBAAA;EDWe;ECTf,MAAA;;EAEA,sBAAA;EDSA;ECPA,oBAAA;EACA,SAAA;IDiBO,+CCfL,IAAA,GAAO,SAAA,EDkBM;IChBb,MAAA,WDgB6B;ICd7B,gBAAA,aDkBC;IChBD,KAAA;MAAU,GAAA;MAAa,GAAA;MAAc,KAAA;MAAgB,MAAA;MAAiB,IAAA;IAAA;EAAA;EAExE,OAAA;IDuB4B,8DCrB1B,IAAA,GAAO,cAAc,EDgBI;ICdzB,IAAA,WDeiB;ICbjB,OAAA;EAAA;AAAA;;UAKa,QAAA;EDYJ;ECVX,KAAA;EDU4B;AAW9B;;;;ECfE,OAAA;EACA,WAAA;EDqBA;ECnBA,SAAA;EDmBS;ECjBT,QAAA;EDmCuB;ECjCvB,KAAA;EACA,QAAA;EACA,UAAA;EACA,WAAA;ED+Ca;EC7Cb,SAAA;EACA,OAAA;EACA,QAAA;EACA,SAAA;EACA,OAAA;ED8BA;EC5BA,YAAA;ED6BU;EC3BV,MAAA;EDmCA;ECjCA,IAAA,GAAO,SAAS;EDmChB;ECjCA,OAAA;IACE,aAAA;IACA,YAAA;IACA,cAAA;IACA,OAAA;IACA,OAAA;IACA,IAAA;EAAA;EDmCa;EChCf,MAAA;;EAEA,cAAA;ED+BA;;;;;AAIQ;AAGV;;;EC5BE,UAAA;IAAe,QAAA;IAAkB,IAAA;EAAA;AAAA;;UAIlB,cAAA;EACf,QAAA;EACA,OAAO;AAAA;;UAIQ,UAAA;EACf,IAAA;EACA,OAAO;AAAA;;UAIQ,WAAA;EACf,KAAA;EDgM+B;EC9L/B,WAAA;EACA,WAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA,EAAW,cAAA;EACX,OAAA,EAAS,UAAA;EACT,YAAA,EAAc,UAAA;EACd,UAAA;IAAc,QAAA;IAAkB,IAAA;EAAA;AAAA;;UAIjB,UAAA;EAhJS;AAG1B;;;;AAAqB;AAYrB;;EA0IE,IAAA,GAAO,GAAG;EArGa;EAuGvB,QAAA;EA9HA;EAgIA,MAAA;AAAA;;;;;;;;iBA8Cc,UAAA,CACd,QAAA,EAAU,mBAAA,EACV,KAAA,EAAO,QAAA,EACP,GAAA,EAAK,UAAA,GACJ,WAAA;;;;;;;;;;;;ADjMH;;;;AAA6B;AAAA,KEZjB,gBAAA;AAAA,UAEK,wBAAA;;EAEf,OAAA;EFgByB;EEdzB,QAAA,GAAW,gBAAgB;EFgBM;EEdjC,SAAA;AAAA;AFc2D;AAAA,cEVhD,eAAA;AAAA,UAEI,gBAAA;EACf,OAAA;EACA,QAAA,EAAU,gBAAgB;EFU1B;EERA,OAAA;EFaW;EEXX,QAAA;AAAA;AAAA,UAGe,sBAAA;EFUA;EERf,OAAA;EFW6B;EET7B,iBAAiB;AAAA;;;;;AFYiB;AAGpC;;;;iBEHgB,eAAA,CACd,IAAA,EAAM,wBAAA,cACN,GAAA,GAAK,sBAAA,GACJ,gBAAA;;;UCfc,uBAAA;;EAEf,MAAA;EACA,YAAA;;EAEA,IAAA;EHpB2B;EGsB3B,UAAA;EACA,eAAA;AAAA;;AHfyB;AAE3B;;;;UGsBiB,qBAAA;EHpBA;EGsBf,GAAA;;EAEA,GAAA;EHtBA;EGwBA,QAAA;EHnBW;EGqBX,GAAA;EHnBS;EGqBT,UAAA;EHrBe;EGuBf,KAAA;EHpB6B;EGsB7B,UAAA;EHnBkC;EGqBlC,OAAA,GAAU,UAAe;EHrBzB;EGuBA,QAAA;AAAA;AAAA,UAGe,mBAAA;EHvBA;;;;;;;;AAaR;EGoBP,KAAA;EHjB+B;;;AAI5B;EGkBH,KAAA;EHfwC;;;;;;EGsBxC,MAAA,GAAS,gBAAgB;EHhBG;EGkB5B,GAAA;EHvBA;;;;;;;EG+BA,MAAA;EH1BA;;;AAA4B;AAW9B;;;;;;;;AAOW;AAkBX;;EGME,iBAAA;AAAA;AAAA,UAGe,oBAAA;EHQR;EGNP,KAAA;EHMa;EGJb,OAAO;AAAA;AAAA,UAGQ,qBAAA;EHZf;;;;;EGkBA,KAAA;EHNA;;;;AACa;AAIf;EGQE,GAAA;;EAEA,MAAA,GAAS,WAAW;EHTjB;EGWH,OAAA;AAAA;;KAIU,0BAAA;;UAUK,qBAAA;EACf,GAAA;EACA,OAAA;EACA,UAAA,GAAa,0BAA0B;EACvC,QAAA;EHlBe;EGoBf,KAAA;IAAU,IAAA;IAAc,QAAA;IAAmB,GAAA;EAAA;AAAA;;;;;;;;;;;;;UAe5B,uBAAA;EHkJD;EGhJd,MAAA,IAAU,IAAA;;EAEV,WAAA;EH8IsC;EG5ItC,cAAA;EH4ImD;EG1InD,UAAA;EH0I0E;EGxI1E,YAAA;EACA,UAAA,GAAa,0BAAA;EACb,OAAA,GAAU,IAAA;EACV,QAAA;EF9LwB;EEgMxB,SAAA,IACE,IAAA,EAAM,qBAAA,KACH,qBAAA,GAAwB,OAAA,CAAQ,qBAAA;EFlMb;EEoMxB,IAAA;IAAS,aAAA;IAAuB,OAAA,EAAS,MAAA;EAAA;EFjMtB;EEmMnB,MAAA;EFvLe;EEyLf,UAAA;IAAe,IAAA;IAAgB,KAAA;IAAiB,KAAA;IAAiB,KAAA;EAAA;AAAA;AAAA,UAGlD,gBAAA;EFtKf;;;;;;;;;;;;EEmLA,IAAA,GAAO,oBAAA;EACP,OAAA,GAAU,uBAAA;EFrKR;;;;;AAIO;AAKX;;;;;;;;;;;;;;;;;EEoLE,KAAA,GAAQ,qBAAA;EF1JR;EE4JA,aAAA;EFxJA;EE0JA,GAAA,GAAM,mBAAA;EFxJN;;;;;;;;;;;EEoKA,MAAA;EF/IqC;AAAA;AAIvC;;;;AAES;AAIT;;EE+IE,KAAA,GAAQ,qBAAA;EF9IR;AACO;AAIT;;;;;;;;;;;;;;;;;;;;;;;AAUsC;AAItC;;;;EE0JE,KAAA,sBAA2B,QAAA,KAAa,qBAAA;EFjJjC;;;;AAID;AA8CR;;;;;;;EE4GE,OAAA,aAAoB,uBAAA;EFxGR;;;;;;;;;AAAA;;;EEqHZ,GAAA,GAAM,mBAAA;EDlUI;;;;AAAgB;AAE5B;;;;;;;;;AAMW;AAIX;;;;AAA4B;AAE5B;EC0UE,KAAA,aAAkB,qBAAA;;;;;;;;;ADpUV;AAGV;;EC6UE,SAAA,GAAY,yBAAA;ED3UZ;AAEiB;AAYnB;;;;;;;;;;EC0UE,OAAA,aAAoB,uBAAA;EDxUpB;;;AACiB;;;;ACfnB;;;;;;;EAqWE,QAAA,aAAqB,wBAAA;AAAA;AAAA,UAGN,qBAAA;EAhWA;EAkWf,KAAA;EAzVoC;EA2VpC,QAAA,GAAW,QAAQ;EA3UM;EA6UzB,OAAA;AAAA;AAAA,UAGe,qBAAA;EAxVf;EA0VA,EAAA;EAtVA;EAwVA,KAAA;EApVA;;;;EAyVA,MAAA;EApVe;;;;;;;;EA6Vf,OAAA,GAAU,UAAA,QAAkB,mBAAA;EA7T5B;;;AAgBiB;AAGnB;;;;AAIS;AAGT;;EA+SE,MAAA;EAhSoB;;;;;EAsSpB,QAAA;EApSO;EAsSP,IAAA;EAlSU;EAoSV,MAAA;;EAEA,SAAA,GAAY,MAAA;AAAA;AAAA,iBAmOU,MAAA,CAAO,IAAA,GAAM,gBAAA,GAAwB,gBAAgB;;;;;;;;AHxnB5D;AAGjB;UIdiB,mBAAA;EACf,SAAA;EACA,OAAA;EACA,eAAA;EJcA;EIZA,QAAA;EJYkC;EIVlC,OAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY,mBAAA;;UAG5C,aAAA,SAAsB,QAAQ;EAC7C,GAAA,EAAK,UAAA;AAAA;AAAA,UAGU,WAAA;EACf,IAAA,EAAM,aAAa;EJeZ;EIbP,YAAA;EJgB+B;EId/B,QAAA;AAAA;AAAA,UAGe,iBAAA;EJkBA;EIhBf,OAAA;;EAEA,iBAAA;EJgBmB;EIdnB,OAAA;EJgBqB;EIdrB,QAAA,GAAW,iBAAiB;AAAA;;iBAYd,UAAA,CACd,GAAA,EAAK,mBAAA,cACL,GAAA,GAAK,iBAAA,GACJ,WAAA;;;UC9Cc,iBAAA;;EAEf,IAAA;;EAEA,GAAA;;EAEA,MAAA,IAAU,OAAA;AAAA;ALlBZ;;;;AAA6B;AAQ7B;;AARA,iBK4BgB,aAAA,CAAc,IAAY;;iBAa1B,eAAA,CAAgB,IAAY;AL/B5C;;;;AAA6D;AAE7D;;;AAFA,iBKmFsB,UAAA,CACpB,OAAA,GAAS,iBAAA,GACR,OAAA,EAAS,IAAA,EAAM,qBAAA,KAA0B,qBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/analytics.ts","../src/seo.ts","../src/integration.ts","../src/ads.ts","../src/lastmod.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AA2BA;;;;AAA6B;AAQ7B;;;;AAA2B;AAE3B;;;;AAA6D;AAE7D;KAZY,iBAAA;;;;;;;KAQA,eAAA;AAAA,KAEA,uBAAA,GAA0B,OAAO,CAAC,eAAA;AAAA,UAE7B,sBAAA;EAYA;EAVf,EAAA;;;;;EAKA,QAAA,GAAW,uBAAA;EAQuB;EANlC,MAAA,GAAS,MAAM;AAAA;AAAA,UAGA,cAAA;;EAEf,EAAA;EACA,QAAA,GAAW,uBAAuB;AAAA;AAAA,UAGnB,aAAA;EAaR;EAXP,GAAA;EAce;EAZf,MAAA;;;AAgBG;AAGL;;;;;EAVE,OAAA;AAAA;AAAA,UAGe,gBAAA;EAaa;EAX5B,MAAA;EAMA;EAJA,GAAG;AAAA;AAAA,UAGY,yBAAA;EACf,eAAA,YAA2B,sBAAA;EAC3B,OAAA,YAAmB,cAAA;EACnB,MAAA,GAAS,aAAA;EACT,SAAA,YAAqB,gBAAA;EAErB;EAAA,QAAA,GAAW,iBAAA;AAAA;AAAiB;AAW9B;;;;;;;AAX8B,UAWb,uBAAA;EAON;AAkBX;;;EApBE,UAAA,GAAa,uBAAuB;EA2B1B;EAzBV,SAAA;AAAA;;;;;;;;;;;;;;;AAmCa;UAjBE,QAAA;EAqBY;EAnB3B,QAAA;EACA,QAAA,EAAU,eAAA;EACV,WAAA;EAqBe;EAnBf,OAAA;EACA,QAAA,EAAU,iBAAA;EAmBO;;;;;EAbjB,KAAA;EAiBQ;EAfR,MAAA;EACA,GAAA;EACA,KAAA,EAAO,MAAA;AAAA;AAkBA;AAAA,UAdQ,WAAA,SAAoB,QAAQ;EAC3C,GAAG;AAAA;AAAA,UAGY,iBAAA;EACf,IAAA,EAAM,WAAW;EAoJhB;EAlJD,YAAA;EAkJkB;EAhJlB,QAAA;AAAA;AAAA,UAGe,uBAAA;EA4If;EA1IA,OAAO;AAAA;AA2IW;AAwCpB;;;;;;AAxCoB,iBAHJ,gBAAA,CACd,IAAA,EAAM,yBAAA,cACN,GAAA,GAAK,uBAAA,GACJ,iBAAA;;iBAwCa,iBAAA,CAAkB,IAAA,EAAM,QAAA,KAAa,uBAAuB;;;;;;;;;;;;;AArT5E;;KCdY,cAAA;;KAGA,SAAA;ADmBZ;;;;AAA2B;AAE3B;;;;AAA6D;AAF7D,UCPiB,mBAAA;EDWsB;ECTrC,QAAA;EDkBe;;;;;;;AAAA;AAGjB;;;ECTE,aAAA;EDWA;ECTA,YAAA;EDUW;ECRX,kBAAA;EDQkC;ECNlC,MAAA;EDS4B;ECP5B,sBAAA;EDO4B;ECL5B,oBAAA;EACA,SAAA;IDiBA,+CCfE,IAAA,GAAO,SAAA,EDeF;ICbL,MAAA,WDgB6B;ICd7B,gBAAA,aDkBC;IChBD,KAAA;MAAU,GAAA;MAAa,GAAA;MAAc,KAAA;MAAgB,MAAA;MAAiB,IAAA;IAAA;EAAA;EAExE,OAAA;IDuB4B,8DCrB1B,IAAA,GAAO,cAAc,EDgBvB;ICdE,IAAA,WDeF;ICbE,OAAA;EAAA;AAAA;;UAKa,QAAA;EDYf;ECVA,KAAA;EDU4B;AAAA;AAW9B;;;ECfE,OAAA;EACA,WAAA;EDmBa;ECjBb,SAAA;EDmBS;ECjBT,QAAA;EDmCe;ECjCf,KAAA;EACA,QAAA;EACA,UAAA;EACA,WAAA;ED+CO;EC7CP,SAAA;EACA,OAAA;EACA,QAAA;EACA,SAAA;EACA,OAAA;ED4BA;EC1BA,YAAA;ED6BA;EC3BA,MAAA;EDiCA;EC/BA,IAAA,GAAO,SAAS;EDkChB;EChCA,OAAA;IACE,aAAA;IACA,YAAA;IACA,cAAA;IACA,OAAA;IACA,OAAA;IACA,IAAA;EAAA;EDgCC;EC7BH,MAAA;EDgCgC;EC9BhC,cAAA;ED+BiB;;;;;;AAIT;AAGV;;EC5BE,UAAA;IAAe,QAAA;IAAkB,IAAA;EAAA;AAAA;;UAIlB,cAAA;EACf,QAAA;EACA,OAAO;AAAA;;UAIQ,UAAA;EACf,IAAA;EACA,OAAO;AAAA;;UAIQ,WAAA;EACf,KAAA;EDgMc;EC9Ld,WAAA;EACA,WAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA,EAAW,cAAA;EACX,OAAA,EAAS,UAAA;EACT,YAAA,EAAc,UAAA;EACd,UAAA;IAAc,QAAA;IAAkB,IAAA;EAAA;AAAA;;UAIjB,UAAA;EAhJS;AAAA;AAG1B;;;;AAAqB;AAYrB;EA0IE,IAAA,GAAO,GAAG;;EAEV,QAAA;EA1IA;EA4IA,MAAA;AAAA;;;;;;;;iBA8Cc,UAAA,CACd,QAAA,EAAU,mBAAA,EACV,KAAA,EAAO,QAAA,EACP,GAAA,EAAK,UAAA,GACJ,WAAA;;;UClLc,uBAAA;;EAEf,MAAA;EACA,YAAA;EFlB2B;EEoB3B,IAAA;EFpB2B;EEsB3B,UAAA;EACA,eAAA;AAAA;;;AFfyB;AAE3B;;;UEsBiB,qBAAA;EFtB4C;EEwB3D,GAAA;EFtBqC;EEwBrC,GAAA;EFfe;EEiBf,QAAA;EFnBA;EEqBA,GAAA;EFnBA;EEqBA,UAAA;EFrBe;EEuBf,KAAA;EFpBe;EEsBf,UAAA;;EAEA,OAAA,GAAU,UAAe;EFtBzB;EEwBA,QAAA;AAAA;AAAA,UAGe,mBAAA;EF1BmB;AAGpC;;;;;;;;EEiCE,KAAA;EFjBe;;;;EEsBf,KAAA;EFfe;;;;;;EEsBf,MAAA,GAAS,gBAAgB;EFhBd;EEkBX,GAAA;EFlB4B;;;;;;;EE0B5B,MAAA;EF5BqB;;;;AAEO;AAW9B;;;;;;;;AAOW;AAkBX;EEME,iBAAA;AAAA;AAAA,UAGe,oBAAA;EFFL;EEIV,KAAA;EFMa;EEJb,OAAO;AAAA;AAAA,UAGQ,qBAAA;EFbL;;;;;EEmBV,KAAA;EFPA;;;;;AAEa;EEYb,GAAA;EFR2B;EEU3B,MAAA,GAAS,WAAW;EFVe;EEYnC,OAAA;AAAA;;KAIU,0BAAA;;UAUK,qBAAA;EACf,GAAA;EACA,OAAA;EACA,UAAA,GAAa,0BAA0B;EACvC,QAAA;EFrBQ;EEuBR,KAAA;IAAU,IAAA;IAAc,QAAA;IAAmB,GAAA;EAAA;AAAA;;;;;;;;;;;;;UAe5B,uBAAA;EF0GG;EExGlB,MAAA,IAAU,IAAA;EFgJqB;EE9I/B,WAAA;EF8I0E;EE5I1E,cAAA;EF4IgC;EE1IhC,UAAA;EF0I0E;EExI1E,YAAA;EACA,UAAA,GAAa,0BAAA;EACb,OAAA,GAAU,IAAA;EACV,QAAA;ED9LU;ECgMV,SAAA,IACE,IAAA,EAAM,qBAAA,KACH,qBAAA,GAAwB,OAAA,CAAQ,qBAAA;;EAErC,IAAA;IAAS,aAAA;IAAuB,OAAA,EAAS,MAAA;EAAA;;EAEzC,MAAA;EDnMmB;ECqMnB,UAAA;IAAe,IAAA;IAAgB,KAAA;IAAiB,KAAA;IAAiB,KAAA;EAAA;AAAA;AAAA,UAGlD,gBAAA;EDxKf;;;;;;;;;;;;ECqLA,IAAA,GAAO,oBAAA;EACP,OAAA,GAAU,uBAAA;EDvKV;;;;;;AAMS;AAKX;;;;;;;;;;;;;;;;ECoLE,KAAA,GAAQ,qBAAA;ED5JR;EC8JA,aAAA;ED1JA;EC4JA,GAAA,GAAM,mBAAA;ED1JC;;;;;;;;;;;ECsKP,MAAA;ED/IiC;;AAAI;AAIvC;;;;AAES;AAIT;EC+IE,KAAA,GAAQ,qBAAA;;;AD7ID;AAIT;;;;;;;;;;;;;;;;;;;;;;;AAUsC;AAItC;;;EC0JE,KAAA,sBAA2B,QAAA,KAAa,qBAAA;EDjJxC;;;;;AAIM;AA8CR;;;;;;EC4GE,OAAA,aAAoB,uBAAA;EDxGR;;;;;;;;;;AAAA;;ECqHZ,GAAA,GAAM,mBAAA;;AAvSR;;;;;;;;;;AAQiB;AASjB;;;;;;;;;EA4SE,KAAA,aAAkB,qBAAA;EA9RlB;;;;;AAIQ;AAGV;;;;;EAmSE,SAAA,GAAY,yBAAA;EA7QZ;;;;;;AA0BiB;AAGnB;;;;AAIS;EAyPP,OAAA,aAAoB,uBAAA;EAtPgB;;;;;;;;;AAiB7B;AAIT;;;;EAgPE,QAAA,aAAqB,wBAAA;AAAA;AAAA,UAGN,qBAAA;;EAEf,KAAA;EA1OA;EA4OA,QAAA,GAAW,QAAQ;EA1OnB;EA4OA,OAAA;AAAA;AAAA,UAGe,qBAAA;EA5OL;EA8OV,EAAA;EA9O2C;EAgP3C,KAAA;EAhP8C;AAehD;;;EAsOE,MAAA;EA1NU;;;;;;;;EAmOV,OAAA,GAAU,UAAA,QAAkB,mBAAA;EA7OlB;;;;;;;;;;;EAyPV,MAAA;EA3OE;;;;;EAiPF,QAAA;EA9OgC;EAgPhC,IAAA;EA9OA;EAgPA,MAAA;EA9Oe;EAgPf,SAAA,GAAY,MAAA;AAAA;AAAA,iBAwUU,MAAA,CAAO,IAAA,GAAM,gBAAA,GAAwB,gBAAgB;;;;;;;;;AF7tB5D;UGXA,mBAAA;EACf,SAAA;EACA,OAAA;EACA,eAAA;EHaA;EGXA,QAAA;EHYW;EGVX,OAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY,mBAAA;;UAG5C,aAAA,SAAsB,QAAQ;EAC7C,GAAA,EAAK,UAAA;AAAA;AAAA,UAGU,WAAA;EACf,IAAA,EAAM,aAAa;EHeZ;EGbP,YAAA;EHgBe;EGdf,QAAA;AAAA;AAAA,UAGe,iBAAA;EHeZ;EGbH,OAAA;EHgBwC;EGdxC,iBAAA;EHe2B;EGb3B,OAAA;EHeS;EGbT,QAAA,GAAW,iBAAiB;AAAA;;iBAYd,UAAA,CACd,GAAA,EAAK,mBAAA,cACL,GAAA,GAAK,iBAAA,GACJ,WAAA;;;UC9Cc,iBAAA;;EAEf,IAAA;;EAEA,GAAA;;EAEA,MAAA,IAAU,OAAA;AAAA;;AJlBZ;;;;AAA6B;AAQ7B;iBIoBgB,aAAA,CAAc,IAAY;;iBAa1B,eAAA,CAAgB,IAAY;AJjCjB;AAE3B;;;;AAA6D;AAE7D;;AAJ2B,iBIqFL,UAAA,CACpB,OAAA,GAAS,iBAAA,GACR,OAAA,EAAS,IAAA,EAAM,qBAAA,KAA0B,qBAAA"}

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { n as TRACKING_ENDPOINT, r as resolveTracking, t as TRACKING_COOKIE } from "./tracking-CmSfxWC3.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -325,39 +326,6 @@ function resolveFonts(decls) {
 	};
 }
 
-//#endregion
-//#region src/tracking.ts
-/** The cookie the capture script writes. Mirrors `TRACKING_COOKIE` in utils. */
-const TRACKING_COOKIE = "_ac";
-/**
-* Resolve the tracking config into what the component emits.
-*
-* Two warnings, both about the same failure — a persistent identifier written
-* with no way for the visitor to decline, or a permission asked for with no way
-* to answer. Returned as data rather than logged here so the check is a test
-* rather than a line someone might scroll past, exactly as `resolveAnalytics`
-* does.
-*/
-function resolveTracking(opts, ctx = {}) {
-	const warnings = [];
-	const category = opts?.category ?? "marketing";
-	const enabled = opts?.enabled === true;
-	if (!enabled) return {
-		enabled: false,
-		category,
-		cookies: [],
-		warnings
-	};
-	if (!ctx.consent) warnings.push(`tracking is on, so this site writes the \`${"_ac"}\` cookie — a 90-day identifier tying a visitor to the ad that brought them — and \`consent\` is off, so it is written for every visitor with no way to decline. Set \`consent: true\`.`);
-	else if (ctx.consentCategories && !ctx.consentCategories.includes(category)) warnings.push(`tracking demands the \`${category}\` consent category, but the banner offers ${ctx.consentCategories.join(", ") || "nothing"}. Add \`${category}\` to \`consent.categories\`, or the visitor is asked about something the banner never names.`);
-	return {
-		enabled,
-		category,
-		cookies: ["_ac"],
-		warnings
-	};
-}
-
 //#endregion
 //#region src/integration.ts
 /**
@@ -426,6 +394,73 @@ function readSiteAds(configPath, siteEnv) {
 		return null;
 	}
 }
+/**
+* The consent + tracking facts a site config already states.
+*
+* These were the one pair the integration did not read. `site.tracking` and
+* `site.legal.cookieConsent` drive the **generated cookie notice**, while
+* `vitops({ consent, tracking })` drove the **runtime** — two hand-synced
+* declarations of the same fact with nothing checking them against each other.
+* The failure that produces is precisely the one the rest of the toolchain is
+* fastidious about avoiding: a site can ship a cookie notice naming categories
+* its banner never offers, or promising attribution that no capture script
+* implements, and the build is clean. That is a compliance defect, not a
+* documentation gap.
+*
+* Read as DEFAULTS, the same as `css` / `fonts` / `favicon` / `ads` — the
+* config is where a site's facts live, and an integration option is how you
+* override one. A genuine contradiction is an error rather than a warning; see
+* `consentTrackingConflicts`.
+*/
+function readSiteConsentTracking(configPath, siteEnv) {
+	try {
+		const cfg = resolveConfig(JSON.parse(readFileSync(configPath, "utf8")), siteEnv);
+		const t = cfg.site.tracking;
+		const cc = cfg.site.legal?.cookieConsent;
+		if (!t && !cc) return null;
+		return {
+			...t ? { tracking: t } : {},
+			...cc ? { consentEnabled: cc.enabled } : {},
+			...cc?.categories ? { categories: cc.categories } : {}
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Contradictions between the config and an explicit integration option.
+*
+* Absent-vs-present is a default and resolves silently. `true` vs `false` on the
+* same fact is not resolvable — one of the two documents is wrong, and picking
+* either quietly is how a notice and a banner get out of step. The message names
+* both sides so the fix does not require guessing which one won.
+*/
+function consentTrackingConflicts(site, opts, configPath) {
+	const out = [];
+	const optConsent = opts.consent === void 0 ? void 0 : !!opts.consent;
+	if (site.consentEnabled !== void 0 && optConsent !== void 0 && site.consentEnabled !== optConsent) out.push(`consent: ${configPath} sets site.legal.cookieConsent.enabled: ${site.consentEnabled}, but vitops({ consent: ${optConsent} }) says the opposite. The generated cookie notice follows the config and the banner follows the option, so one of them would describe a site that does not exist. Set them the same, or drop the option and let the config decide.`);
+	const optTracking = opts.tracking === void 0 ? void 0 : opts.tracking === true ? true : opts.tracking === false ? false : opts.tracking.enabled ?? true;
+	if (site.tracking?.enabled !== void 0 && optTracking !== void 0 && site.tracking.enabled !== optTracking) out.push(`tracking: ${configPath} sets site.tracking.enabled: ${site.tracking.enabled}, but vitops({ tracking: ${optTracking} }) says the opposite. The cookie notice discloses \`_ac\` from the config while the capture script ships from the option — so the site would either disclose a cookie it never sets, or set one it never discloses.`);
+	return out;
+}
+/**
+* Does a route answer `TRACKING_ENDPOINT`?
+*
+* Checked by filename rather than through Astro's route manifest, because this
+* runs in `astro:config:setup` — before routes are collected. The extension set
+* covers the ways a consumer can author the same endpoint; a false negative
+* costs a warning, a false positive costs the whole point of the check, so this
+* errs toward looking in more places.
+*/
+function hasConversionRoute(root) {
+	const base = resolve(root, "src/pages", TRACKING_ENDPOINT.replace(/^\//, ""));
+	return [
+		".ts",
+		".js",
+		".mjs",
+		".astro"
+	].some((ext) => existsSync(`${base}${ext}`) || existsSync(join(base, `index${ext}`)));
+}
 const VIRTUAL_ID = "virtual:getvitops/head";
 const RESOLVED_ID = `\0${VIRTUAL_ID}`;
 function virtualHeadPlugin(data) {
@@ -516,10 +551,15 @@ function vitops(opts = {}) {
 				if (!config.site) logger.warn("seo: needs the `site` astro.config option (your deployed URL) — without it <Seo /> omits canonical, og:url and any relative og:image rather than guessing an origin.");
 				if (config.integrations.some((i) => i.name === "emdash")) logger.warn("seo: emdash() is registered, and its <EmDashHead> emits the same title/description/canonical/og tags from the CMS. Use one or the other — rendering both duplicates every tag.");
 			}
-			const consentEnabled = !!opts.consent;
-			const consentOpts = typeof opts.consent === "object" ? opts.consent : {};
+			const siteConsent = siteInput ? readSiteConsentTracking(resolve(root, siteInput), opts.site?.siteEnv ?? "production") : null;
+			if (siteConsent) {
+				const conflicts = consentTrackingConflicts(siteConsent, opts, siteInput);
+				if (conflicts.length) throw new Error(`vitops: the site config and the integration options disagree about consent.\n\n` + conflicts.map((c) => `  • ${c}`).join("\n\n"));
+			}
+			const consentEnabled = opts.consent !== void 0 ? !!opts.consent : !!siteConsent?.consentEnabled;
+			const consentOpts = typeof opts.consent === "object" ? opts.consent : siteConsent?.categories ? { categories: siteConsent.categories } : {};
 			const analytics = resolveAnalytics(opts.analytics, { consent: consentEnabled });
-			const trackingOpts = opts.tracking === true ? { enabled: true } : opts.tracking || void 0;
+			const trackingOpts = opts.tracking === true ? { enabled: true } : opts.tracking || (siteConsent?.tracking?.enabled ? siteConsent.tracking : void 0);
 			const adsConfig = siteInput ? readSiteAds(resolve(root, siteInput), opts.site?.siteEnv ?? "production") : null;
 			const detectedCategories = consentCategories([...analytics.tags, ...resolveAds(adsConfig?.properties, {
 				consent: consentEnabled,
@@ -535,6 +575,7 @@ function vitops(opts = {}) {
 				consentCategories: offeredCategories
 			});
 			for (const warning of tracking.warnings) logger.warn(warning);
+			if (tracking.enabled && !hasConversionRoute(root)) logger.warn(`tracking is on, so the capture script beacons \`tel:\` conversions to ${TRACKING_ENDPOINT}, but no route answers that path. Add \`src/pages/api/track.ts\` exporting \`createConversionRoute(...)\` from \`@getvitops/astro/routes\` — otherwise every call conversion is silently lost.`);
 			const ads = resolveAds(adsConfig?.properties, {
 				consent: consentEnabled,
 				consentCategories: offeredCategories,