@getvitops/astro 8.1.0 → 8.2.0

package/dist/middleware.d.mts

@@ -0,0 +1,23 @@
+import { MiddlewareHandler } from "astro";
+export interface AbTestingExperiment {
+  /** The cookie this experiment is assigned/pinned through. */
+  cookieName: string;
+  /** Seconds. Omitted means a session cookie. */
+  cookieMaxAge?: number;
+  /** Fraction of new visitors auto-assigned to `variants[1]` (default 0.5). */
+  splitRatio?: number;
+  /** Exactly two variant names — `variants[0]` is the default/control. */
+  variants: readonly [string, string];
+}
+export interface VitopsAbTestingOptions {
+  /** Keyed the same way as `site.experiments` — pass only the enabled entries. */
+  experiments: Record<string, AbTestingExperiment>;
+}
+/**
+ * Picks `variants[1]` with probability `splitRatio`, else `variants[0]`.
+ * Exported so the assignment policy itself — not just its wiring — is
+ * directly testable without going through a request.
+ */
+export declare function assignVariant(experiment: Pick<AbTestingExperiment, 'splitRatio' | 'variants'>, random?: () => number): string;
+export declare function vitopsAbTesting(opts: VitopsAbTestingOptions): MiddlewareHandler;
+//# sourceMappingURL=middleware.d.mts.map

package/dist/middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.mts","names":[],"sources":["../src/middleware.ts"],"mappings":";iBAqCiB;;EAEf;;EAEA;;EAEA;;EAEA;;iBAGe;;EAEf,aAAa,eAAe;;;;;;;wBAQd,cACd,YAAY,KAAK,iDACjB;wBAOc,gBAAgB,MAAM,yBAAyB"}

package/dist/middleware.mjs

@@ -0,0 +1,34 @@
+// src/middleware.ts
+/**
+* Picks `variants[1]` with probability `splitRatio`, else `variants[0]`.
+* Exported so the assignment policy itself — not just its wiring — is
+* directly testable without going through a request.
+*/
+function assignVariant(experiment, random = Math.random) {
+	return random() < (experiment.splitRatio ?? .5) ? experiment.variants[1] : experiment.variants[0];
+}
+function vitopsAbTesting(opts) {
+	const handler = (context, next) => {
+		const secure = context.url.protocol === "https:";
+		for (const experiment of Object.values(opts.experiments)) {
+			const cookieOpts = {
+				path: "/",
+				sameSite: "lax",
+				secure,
+				...experiment.cookieMaxAge != null ? { maxAge: experiment.cookieMaxAge } : {}
+			};
+			const queryValue = context.url.searchParams.get(experiment.cookieName);
+			if (queryValue && experiment.variants.includes(queryValue)) {
+				context.cookies.set(experiment.cookieName, queryValue, cookieOpts);
+				continue;
+			}
+			if (context.cookies.get(experiment.cookieName)?.value) continue;
+			context.cookies.set(experiment.cookieName, assignVariant(experiment), cookieOpts);
+		}
+		return next();
+	};
+	return handler;
+}
+
+export { assignVariant, vitopsAbTesting };
+//# sourceMappingURL=middleware.mjs.map

package/dist/middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../src/middleware.ts"],"sourcesContent":["/**\n * `vitopsAbTesting()` — the assignment half of runtime A/B experiments (see\n * `site.experiments` in `@getvitops/generator`). A consumer wires this into\n * their own `src/middleware.ts`:\n *\n * ```ts\n * import { defineConfig } from 'astro:config';\n * import { vitopsAbTesting } from '@getvitops/astro/middleware';\n * import config from '../site.json' with { type: 'json' };\n *\n * export const onRequest = vitopsAbTesting({ experiments: config.site.experiments ?? {} });\n * ```\n *\n * The first Astro middleware this toolchain ships, and the first place it\n * calls `Astro.cookies.set()` — every existing cookie write elsewhere is\n * client-side `document.cookie`. Both are deliberate: assigning a visitor a\n * variant, once, before the page renders, is exactly what a middleware is for.\n *\n * **What this does NOT do**: check consent before setting the assignment\n * cookie. Every other demand in this toolchain (`_ac`, the ad-click\n * attribution cookie) is raised by a client-side `require()` call — a\n * concept that doesn't have a server-side equivalent here yet. The\n * *reporting* half (`@getvitops/astro/analytics`'s per-provider bootstrap\n * extensions) already piggybacks on each provider's own existing consent\n * gate, so nothing about this ships ungated data to a third party — but the\n * cookie itself is set unconditionally on first visit. `experiment.category`\n * is validated and carried through the config for when this gets a real\n * answer; treat its absence here as a known, stated gap, not an oversight.\n */\nimport type { MiddlewareHandler } from 'astro';\n\n// `astro:middleware`'s `defineMiddleware()` is an identity helper meant for\n// inference inside a real Astro project's own `src/middleware.ts` — that\n// virtual module isn't resolvable from a library package's own build. Typing\n// the returned function directly against the real `MiddlewareHandler` type\n// (imported from `astro` itself, not the virtual module) does the same job.\n\nexport interface AbTestingExperiment {\n  /** The cookie this experiment is assigned/pinned through. */\n  cookieName: string;\n  /** Seconds. Omitted means a session cookie. */\n  cookieMaxAge?: number;\n  /** Fraction of new visitors auto-assigned to `variants[1]` (default 0.5). */\n  splitRatio?: number;\n  /** Exactly two variant names — `variants[0]` is the default/control. */\n  variants: readonly [string, string];\n}\n\nexport interface VitopsAbTestingOptions {\n  /** Keyed the same way as `site.experiments` — pass only the enabled entries. */\n  experiments: Record<string, AbTestingExperiment>;\n}\n\n/**\n * Picks `variants[1]` with probability `splitRatio`, else `variants[0]`.\n * Exported so the assignment policy itself — not just its wiring — is\n * directly testable without going through a request.\n */\nexport function assignVariant(\n  experiment: Pick<AbTestingExperiment, 'splitRatio' | 'variants'>,\n  random = Math.random,\n): string {\n  return random() < (experiment.splitRatio ?? 0.5)\n    ? experiment.variants[1]\n    : experiment.variants[0];\n}\n\nexport function vitopsAbTesting(opts: VitopsAbTestingOptions): MiddlewareHandler {\n  const handler: MiddlewareHandler = (context, next) => {\n    const secure = context.url.protocol === 'https:';\n\n    for (const experiment of Object.values(opts.experiments)) {\n      const cookieOpts = {\n        path: '/',\n        sameSite: 'lax' as const,\n        secure,\n        ...(experiment.cookieMaxAge != null ? { maxAge: experiment.cookieMaxAge } : {}),\n      };\n\n      // A recognized query param (named after the cookie itself) is checked\n      // FIRST, regardless of whether a cookie already exists — this is what\n      // makes a shared preview link (\"?<cookieName>=<variant>\") reliably force\n      // that variant, even for a visitor already pinned to the other one.\n      // Combined with `splitRatio: 0` (nobody auto-assigned), this is the\n      // blue/green-style \"100% on control, but a manual link reveals the\n      // other variant\" mode with no special-cased logic of its own.\n      const queryValue = context.url.searchParams.get(experiment.cookieName);\n      if (queryValue && (experiment.variants as readonly string[]).includes(queryValue)) {\n        context.cookies.set(experiment.cookieName, queryValue, cookieOpts);\n        continue;\n      }\n\n      // Otherwise: assign only when nothing is set yet. Never inspect or\n      // \"correct\" an existing value against the current splitRatio — that's\n      // what keeps an existing assignment (manual or random) pinned.\n      if (context.cookies.get(experiment.cookieName)?.value) continue;\n      context.cookies.set(experiment.cookieName, assignVariant(experiment), cookieOpts);\n    }\n\n    return next();\n  };\n  return handler;\n}\n"],"mappings":";;;;;;AA0DA,SAAgB,cACd,YACA,SAAS,KAAK,QACN;CACR,OAAO,OAAO,KAAK,WAAW,cAAc,MACxC,WAAW,SAAS,KACpB,WAAW,SAAS;AAC1B;AAEA,SAAgB,gBAAgB,MAAiD;CAC/E,MAAM,WAA8B,SAAS,SAAS;EACpD,MAAM,SAAS,QAAQ,IAAI,aAAa;EAExC,KAAK,MAAM,cAAc,OAAO,OAAO,KAAK,WAAW,GAAG;GACxD,MAAM,aAAa;IACjB,MAAM;IACN,UAAU;IACV;IACA,GAAI,WAAW,gBAAgB,OAAO,EAAE,QAAQ,WAAW,aAAa,IAAI,CAAC;GAC/E;GASA,MAAM,aAAa,QAAQ,IAAI,aAAa,IAAI,WAAW,UAAU;GACrE,IAAI,cAAe,WAAW,SAA+B,SAAS,UAAU,GAAG;IACjF,QAAQ,QAAQ,IAAI,WAAW,YAAY,YAAY,UAAU;IACjE;GACF;GAKA,IAAI,QAAQ,QAAQ,IAAI,WAAW,UAAU,CAAC,EAAE,OAAO;GACvD,QAAQ,QAAQ,IAAI,WAAW,YAAY,cAAc,UAAU,GAAG,UAAU;EAClF;EAEA,OAAO,KAAK;CACd;CACA,OAAO;AACT"}

package/dist/routes/conversion.d.mts

@@ -1,9 +1,74 @@
-import { EmailBinding, NotifyContext, notify } from "@getvitops/utils/notify";
-
-//#region src/routes/conversion.d.ts
+import { Config } from "@getvitops/generator";
+import { AdPropertySetup } from "@getvitops/utils/ads";
+import { Localizable } from "@getvitops/utils/content";
+import { CrmConfig, CrmCredentials, CrmResult } from "@getvitops/utils/crm";
+import { EmailBinding, GoogleAdsCredentials, GoogleAdsUploadResult, NotifyContext, notify } from "@getvitops/utils/notify";
+/**
+ * The slice of a `Config` that `resolveOrganizationName` reads. Structural on
+ * purpose: `import config from './site.json'` types its literals widened
+ * (`colors.utilities` becomes `string[]`, not the schema's union), so it is not
+ * assignable to the full `Config`, and every scaffolded site calls this with
+ * exactly such an import. A resolved `Config` still satisfies it.
+ */
+interface OrganizationNameSource {
+  organization?: {
+    name?: Localizable | undefined;
+    legalName?: string | undefined;
+  } | undefined;
+  site: {
+    defaultLocale: string;
+  };
+}
+/**
+ * Resolves the one display name for a site's organization — `organization.name`
+ * (localizable; `locale` picks which one, defaulting to `site.defaultLocale`,
+ * which is also the fallback if the pick has no entry), falling back to
+ * `legalName` when `name` isn't set at all, and to `undefined` (never `''`)
+ * when neither resolves to anything — `t()` returns `''` for a genuinely
+ * missing translation, and an empty name is worse than none.
+ *
+ * This is the one place that fallback chain is written. An EmDash site's own
+ * `getSiteSettings().title` is a separate, runtime-only fact (EmDash's
+ * settings aren't readable at Astro build/config time at all — see
+ * AGENTS.md's "EmDash plugin as the design-system editing surface") and stays
+ * authoritative for what it drives (the rendered page chrome); this helper is
+ * for the build-time-only consumers that can't reach EmDash at all — favicon
+ * generation, generated legal documents, notification emails — so a scaffold
+ * needing a name in `astro.config.mjs` has one real source instead of a third
+ * hardcoded string.
+ */
+export declare function resolveOrganizationName(config: OrganizationNameSource, locale?: string): string | undefined;
+/**
+ * Builds the `context` option `createConversionRoute()` expects, straight from a
+ * resolved `Config` — instead of every consumer hand-writing a `NotifyContext`
+ * literal.
+ *
+ * `locationEmails` is primary-first, then every other location with an `email`,
+ * in `organization.locations`' own key order — `planNotifications` picks the
+ * first that's set, so order here is the whole precedence.
+ */
+export declare function toNotifyContext(config: Config, locale?: string): NotifyContext;
+/**
+ * `site.crm` IS `CrmConfig` — both are the schema's inferred type from `@getvitops/config` — so
+ * this returns its argument's field unchanged.
+ *
+ * @deprecated Pass `config.site.crm` directly. Kept so existing callers keep compiling; it
+ * stopped being an adapter when the type stopped being a copy.
+ */
+export declare function toCrmConfig(config: Config): CrmConfig | undefined;
+/**
+ * `site.ads.google`'s three server-side-relevant fields, for
+ * `createConversionRoute`'s `googleAdsOffline.config`. Undefined when the site has no Google Ads
+ * property configured at all, which `createConversionRoute` reads the same way `crm` being
+ * omitted does: the upload never runs.
+ *
+ * @deprecated Pass `config.site.ads?.google` directly — it is already assignable. Kept so existing
+ * callers keep compiling.
+ */
+export declare function toGoogleAdsConfig(config: Config): Pick<AdPropertySetup, 'accountId' | 'conversionActionId' | 'reporting'> | undefined;
 /** The subset of Astro's `APIContext` this needs — typed structurally so the
  * factory does not pin an Astro version. */
-interface ConversionRequestContext {
+export interface ConversionRequestContext {
   request: Request;
   locals?: unknown;
 }
@@ -12,10 +77,10 @@ interface ConversionRequestContext {
  * hit for that `id`, or `null` if this is the first. Pure interface — a store
  * decides nothing, it only remembers.
  */
-interface RateLimitStore {
+export interface RateLimitStore {
   hit(id: string, at: number): Promise<number | null> | number | null;
 }
-interface ConversionRouteOptions {
+export interface ConversionRouteOptions {
   /** Where notifications go. Build it from your site config. */
   context: NotifyContext;
   /**
@@ -27,13 +92,50 @@ interface ConversionRouteOptions {
    * in v6, and this package peers on `>= 7`.
    */
   binding?: (locals: unknown) => EmailBinding | undefined;
+  /**
+   * Push the submission into a CRM (HubSpot, Zoho Bigin or Jobber) before notifying.
+   * Credentials arrive as a function of `locals`, exactly like `binding` above
+   * — the consumer reads them from `import { env } from 'cloudflare:workers'`.
+   * Credentials are never config; that rule is absolute in this toolchain.
+   *
+   * A failed CRM write never fails the request and never blocks the honeypot/
+   * Turnstile gates above it — those run first, so a bot never reaches the
+   * CRM. The outcome is folded into the notification email's "Delivery"
+   * section (via `describeCrmResult`) so a failed write is never silent.
+   */
+  crm?: {
+    config: CrmConfig;
+    credentials?: (locals: unknown) => CrmCredentials | undefined;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+  };
+  /**
+   * Upload the conversion to Google Ads server-side instead of relying on the
+   * visitor's browser to fire `gtag.js` — see `site.ads.google.reporting` and
+   * `conversionActionId`. Credentials arrive as a function of `locals`, same
+   * shape as `crm.credentials` and `binding` above.
+   *
+   * Only fires for an action whose `conversionActionId` is actually set (via
+   * `toGoogleAdsConfig(config)`, or hand-built the same shape) **and** whose
+   * event carries a Google click id (`gclid`/`gbraid`/`wbraid` on `_ac`) —
+   * an organic conversion has nothing for the Ads API to attribute, so it's
+   * silently skipped rather than reported as a failure. A failed upload never
+   * fails the request, matching `crm` above; the outcome folds into the same
+   * "Delivery" section via `describeGoogleAdsOfflineResult`.
+   */
+  googleAdsOffline?: {
+    config: Pick<AdPropertySetup, 'accountId' | 'conversionActionId' | 'reporting'>;
+    credentials?: (locals: unknown) => GoogleAdsCredentials | undefined;
+    fetch?: typeof fetch;
+  };
   /**
    * Reject a submission before anything is sent. Return a message to refuse.
    * This is where a consumer puts required-field checks.
    */
   validate?: (body: Record<string, unknown>) => string | null;
-  /** Called with every channel outcome, delivered or not. Defaults to console. */
-  onResult?: (result: Awaited<ReturnType<typeof notify>>) => void;
+  /** Called with every channel outcome, delivered or not, plus the CRM
+   * outcome when `crm` is configured. Defaults to console. */
+  onResult?: (result: ConversionResult) => void;
   /** Injected in tests. */
   now?: () => number;
   /**
@@ -62,10 +164,19 @@ interface ConversionRouteOptions {
   /**
    * Reject a submission whose `Content-Length` exceeds this many bytes. Default
    * 25_000 — generous for a contact form with no file upload, tiny for anything
-   * meant to relay large payloads. Best-effort: `Content-Length` can be absent
-   * or spoofed, same caveat as the origin check below.
+   * meant to relay large payloads. The header is only a fast path: a chunked
+   * request carries none, so the body is also read through a byte-capped
+   * reader and refused the moment it passes the cap.
    */
   maxBodyBytes?: number;
+  /**
+   * Fall back to the first `X-Forwarded-For` hop as the client IP when
+   * `CF-Connecting-IP` is absent. Default `false`: off Cloudflare the header is
+   * whatever the client sent, so honouring it lets a script mint a fresh
+   * rate-limit bucket per request. Turn on only behind a proxy that overwrites
+   * it. With neither header trusted there is no IP, and rate limiting is skipped.
+   */
+  trustForwardedFor?: boolean;
   /**
    * Reject a submission whose `Origin` header doesn't match this origin.
    * Defaults to `context.canonical`'s origin. Pass `false` to disable.
@@ -109,6 +220,14 @@ interface ConversionRouteOptions {
     required?: boolean;
   };
 }
+/** `notify()`'s own result, plus the CRM and Google Ads offline-upload
+ * outcomes when those are configured. Additive over
+ * `Awaited<ReturnType<typeof notify>>` — a consumer's existing `onResult`
+ * reading `.results`/`.delivered` keeps compiling unchanged. */
+export interface ConversionResult extends Awaited<ReturnType<typeof notify>> {
+  crm?: CrmResult | undefined;
+  googleAds?: GoogleAdsUploadResult | undefined;
+}
 /**
  * Build a POST handler for conversions.
  *
@@ -122,10 +241,6 @@ interface ConversionRouteOptions {
  * submitted; refusing them because our mail did not go out turns a lost
  * notification into a lost conversion. Failures are reported through `onResult`.
  */
-declare function createConversionRoute(options: ConversionRouteOptions): ({
-  request,
-  locals
-}: ConversionRequestContext) => Promise<Response>;
-//#endregion
-export { ConversionRequestContext, ConversionRouteOptions, RateLimitStore, createConversionRoute };
+export declare function createConversionRoute(options: ConversionRouteOptions): ({ request, locals }: ConversionRequestContext) => Promise<Response>;
+export {};
 //# sourceMappingURL=conversion.d.mts.map

package/dist/routes/conversion.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"conversion.d.mts","names":[],"sources":["../../src/routes/conversion.ts"],"mappings":";;;AAsPA;;AAAA,UAjLiB,wBAAA;EACf,OAAA,EAAS,OAAO;EAChB,MAAA;AAAA;;;;;;UAQe,cAAA;EACf,GAAA,CAAI,EAAA,UAAY,EAAA,WAAa,OAAO;AAAA;AAAA,UAkBrB,sBAAA;EA4KD;EA1Kd,OAAA,EAAS,aAAA;EA0K0B;;;;AAA2C;;;;EAjK9E,OAAA,IAAW,MAAA,cAAoB,YAAA;;;;;EAK/B,QAAA,IAAY,IAAA,EAAM,MAAA;;EAElB,QAAA,IAAY,MAAA,EAAQ,OAAA,CAAQ,UAAA,QAAkB,MAAA;;EAE9C,GAAA;;;;;;;EAOA,UAAA;;;;;;EAMA,eAAA;;;;;;;;;;EAUA,cAAA;;;;;;;EAOA,YAAA;;;;;;;;;;;EAWA,aAAA;;;;;;;EAOA,SAAA;IAAc,QAAA;IAAmB,KAAA,GAAQ,cAAA;EAAA;;;;;;;EAOzC,SAAA;IACE,SAAA;;;IAGA,SAAA;;;;;;;;;IASA,QAAA;EAAA;AAAA;;;;;;;;;;;;;;iBA4DY,qBAAA,CAAsB,OAAA,EAAS,sBAAA;EAwB/B,OAAA;EAAA;AAAA,GAAqB,wBAAA,KAA2B,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"conversion.d.mts","names":[],"sources":["../../src/routes/config-adapters.ts","../../src/routes/conversion.ts"],"mappings":";;;;;;;;;;;;UA6BiB;EACf;IAAiB,OAAO;IAAyB;;EACjD;IAAQ;;;;;;;;;;;;;;;;;;;;;wBAqBM,wBACd,QAAQ,wBACR;;;;;;;;;;wBAoBc,gBAAgB,QAAQ,QAAQ,kBAAkB;;;;;;;;wBAuBlD,YAAY,QAAQ,SAAS;;;;;;;;;;wBAa7B,kBACd,QAAQ,SACP,KAAK;;;iBCVS;EACf,SAAS;EACT;;;;;;;iBAQe;EACf,IAAI,YAAY,aAAa;;iBAkBd;;EAEf,SAAS;;;;;;;;;EAST,WAAW,oBAAoB;;;;;;;;;;;;EAY/B;IACE,QAAQ;IACR,eAAe,oBAAoB;IACnC,eAAe;IACf;;;;;;;;;;;;;;;;EAgBF;IACE,QAAQ,KAAK;IACb,eAAe,oBAAoB;IACnC,eAAe;;;;;;EAMjB,YAAY,MAAM;;;EAGlB,YAAY,QAAQ;;EAEpB;;;;;;;EAOA;;;;;;EAMA;;;;;;;;;;EAUA;;;;;;;;EAQA;;;;;;;;EAQA;;;;;;;;;;;EAWA;;;;;;;EAOA;IAAc;IAAmB,QAAQ;;;;;;;;EAOzC;IACE;;;IAGA;;;;;;;;;IASA;;;;;;;iBAQa,yBAAyB,QAAQ,kBAAkB;EAClE,MAAM;EACN,YAAY;;;;;;;;;;;;;;;wBA2GE,sBAAsB,SAAS,4BAyB/B,SAAA,UAAqB,6BAA2B,QAAQ"}

package/dist/routes/conversion.mjs

@@ -1,15 +1,19 @@
-import { notify } from "@getvitops/utils/notify";
+import { i as toNotifyContext, n as toCrmConfig, r as toGoogleAdsConfig, t as resolveOrganizationName } from "../config-adapters-CbTywgEY.mjs";
+import { AD_PLATFORMS, normalizeConversionActionIds } from "@getvitops/utils/ads";
+import { deliverToCrm, describeCrmResult } from "@getvitops/utils/crm";
+import { describeGoogleAdsOfflineResult, notify, uploadClickConversion } from "@getvitops/utils/notify";
 import { verifyTurnstileToken } from "@getvitops/utils/security";
-import { parseTrackingCookie } from "@getvitops/utils/tracking";
+import { parseTrackingCookie, readCookie } from "@getvitops/utils/tracking";
 
-//#region src/routes/conversion.ts
+// src/routes/conversion.ts
 /**
 * The conversion endpoint, as a factory.
 *
-* A site's contact form and its `tel:` beacon both mean the same thing — someone
-* got in touch — and both want the same treatment: read the attribution cookie
-* off the request, build the event, notify whoever the config says. That is the
-* same three lines in every project, so it ships here.
+* A site's contact form and its `tel:`/`mailto:` beacons all mean the same
+* thing — someone got in touch — and all want the same treatment: read the
+* attribution cookie off the request, build the event, notify whoever the
+* config says. That is the same three lines in every project, so it ships
+* here.
 *
 * What deliberately does **not** ship here is field-level validation and business
 * rules — a consumer's form has its own required fields and its own response
@@ -20,7 +24,7 @@ import { parseTrackingCookie } from "@getvitops/utils/tracking";
 * unauthenticated endpoint that sends email, so leaving it wide open makes it a
 * relay and a cost amplifier regardless of whose form is behind it.
 *
-* The path matters: the capture script beacons `tel:` conversions at
+* The path matters: the capture script beacons `tel:`/`mailto:` conversions at
 * `TRACKING_ENDPOINT` (`/api/track`, exported from `@getvitops/astro/tracking`),
 * and the integration warns at build if no route answers it.
 *
@@ -62,8 +66,22 @@ import { parseTrackingCookie } from "@getvitops/utils/tracking";
 * request and reports a misleading "Body has already been used" instead of the
 * actual error. This package peers on `astro >= 7`, so that form could not work
 * for any supported consumer; `import { env } from 'cloudflare:workers'` is the
-* current one. It also called a `toNotifyContext(config)` helper that does not
-* exist — `context` is a plain `NotifyContext`, built however you like.
+* current one. It also called a `toNotifyContext(config)` helper that used to
+* not exist — `context` can now be built with `toNotifyContext(config)` (also
+* exported from this module), rather than every consumer hand-writing a
+* `NotifyContext` literal:
+*
+* ```ts
+* import config from '../../site.json' with { type: 'json' };
+* import { createConversionRoute, toNotifyContext, toCrmConfig } from '@getvitops/astro/routes';
+*
+* export const POST = createConversionRoute({
+*   context: toNotifyContext(config),
+*   crm: toCrmConfig(config) && { config: toCrmConfig(config)!, credentials: () => ({ ... }) },
+*   binding: () => env.EMAIL,
+*   redirectTo: '/thanks',
+* });
+* ```
 */
 /**
 * Per-isolate, in-memory default. Good enough for a single Worker instance
@@ -79,20 +97,68 @@ var MemoryRateLimitStore = class {
 		return prev === void 0 ? null : at - prev;
 	}
 };
+/** The click id to report to Google Ads, checked in the same order as
+* `AD_PLATFORMS.google.clickIdParams` rather than `getPrimaryClickId()` —
+* that helper returns whichever platform's click id happens to appear first
+* in the *cross-platform* precedence table, which may not be Google's even
+* when a `gclid` is present. */
+function googleClickId(tracking) {
+	if (!tracking) return null;
+	for (const param of AD_PLATFORMS.google.clickIdParams) {
+		const value = tracking[param];
+		if (value) return {
+			param,
+			value: String(value)
+		};
+	}
+	return null;
+}
 /** Fields that are never part of a submission's meaning. `cf-turnstile-response`
 * is excluded unconditionally, matching `render.ts`'s `OMIT_FIELDS` — the field
 * carries a verification token, not something the visitor wrote. */
-const CONTROL_FIELDS = new Set([
+const CONTROL_FIELDS = /* @__PURE__ */ new Set([
 	"event",
 	"phone",
 	"cf-turnstile-response"
 ]);
+/** The capture script sends `link.href` as-is: `tel:` + digits and the punctuation people type
+* (a space arrives as `%20`). Not free text. */
+const PHONE_RE = /^(?:tel:)?\+?[\d\s().%-]{3,40}$/i;
+/** `mailto:` + an address, with an optional `?subject=…` query. A shape check, not deliverability. */
+const EMAIL_RE = /^(?:mailto:)?[^\s@<>"?]{1,64}@[^\s@<>"?]{1,255}(?:\?[^\s<>"]{0,256})?$/i;
 const DEFAULT_HONEYPOT_FIELDS = [
 	"website",
 	"_honeypot",
 	"honeypot"
 ];
 const DEFAULT_MAX_BODY_BYTES = 25e3;
+/**
+* Read a request body, giving up as soon as it exceeds `max` bytes. Returns `null` when over
+* the cap. `Content-Length` is optional on chunked requests, so it cannot be the only guard.
+*/
+async function readCapped(request, max) {
+	if (!request.body) return /* @__PURE__ */ new Uint8Array();
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > max) {
+			await reader.cancel();
+			return null;
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
 const DEFAULT_RATE_LIMIT_WINDOW_MS = 1e4;
 function toFormData(body, honeypotFields) {
 	const out = {};
@@ -139,7 +205,7 @@ function redirectTo(location, status = 303) {
 * notification into a lost conversion. Failures are reported through `onResult`.
 */
 function createConversionRoute(options) {
-	const { context, binding, validate, onResult, now = Date.now, redirectTo: successRedirect, errorRedirectTo = successRedirect, honeypotFields = DEFAULT_HONEYPOT_FIELDS, maxBodyBytes = DEFAULT_MAX_BODY_BYTES } = options;
+	const { context, binding, validate, onResult, now = Date.now, redirectTo: successRedirect, errorRedirectTo = successRedirect, honeypotFields = DEFAULT_HONEYPOT_FIELDS, maxBodyBytes = DEFAULT_MAX_BODY_BYTES, trustForwardedFor = false } = options;
 	const allowedOrigin = options.allowedOrigin === false ? null : options.allowedOrigin ?? originOf(context.canonical);
 	const rateLimit = options.rateLimit === false ? null : {
 		windowMs: options.rateLimit?.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS,
@@ -157,29 +223,35 @@ function createConversionRoute(options) {
 			const requestOrigin = request.headers.get("origin");
 			if (requestOrigin && requestOrigin !== allowedOrigin) return respondError("Origin not allowed.", 403);
 		}
+		const bytes = await readCapped(request, maxBodyBytes);
+		if (!bytes) return respondError("Request too large.", 413);
 		let body;
 		try {
 			if (isFormPost) {
-				const formData = await request.formData();
+				const formData = await new Response(bytes, { headers: { "content-type": contentType } }).formData();
 				body = {};
 				for (const [key, value] of formData.entries()) if (typeof value === "string") body[key] = value;
 			} else {
-				const parsed = await request.json();
+				const parsed = JSON.parse(new TextDecoder().decode(bytes));
 				if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return respondError("Malformed request.", 400);
 				body = parsed;
 			}
 		} catch {
 			return respondError("Malformed request.", 400);
 		}
-		const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? void 0;
+		const ip = request.headers.get("cf-connecting-ip") ?? (trustForwardedFor ? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() : null) ?? void 0;
+		const isCall = body["event"] === "call";
+		const isEmailClick = body["event"] === "email";
 		if (rateLimit && ip) {
-			const sinceLastHit = await rateLimit.store.hit(ip, now());
+			const rlKey = `${ip}:${isCall ? "call" : isEmailClick ? "email" : "form"}`;
+			const sinceLastHit = await rateLimit.store.hit(rlKey, now());
 			if (sinceLastHit !== null && sinceLastHit < rateLimit.windowMs) return respondError("Too many requests.", 429);
 		}
-		const isCall = body["event"] === "call";
-		if (isCall && typeof body["phone"] !== "string") return respondError("Missing phone.", 400);
-		const spam = !isCall && hasHoneypot(body, honeypotFields);
-		if (!isCall && !spam && options.turnstile) {
+		if (isCall && !(typeof body["phone"] === "string" && PHONE_RE.test(body["phone"]))) return respondError("Missing phone.", 400);
+		if (isEmailClick && !(typeof body["email"] === "string" && EMAIL_RE.test(body["email"]))) return respondError("Missing email.", 400);
+		const isBeacon = isCall || isEmailClick;
+		const spam = !isBeacon && hasHoneypot(body, honeypotFields);
+		if (!isBeacon && !spam && options.turnstile) {
 			const { secretKey, fieldName = "cf-turnstile-response", required = false } = options.turnstile;
 			const token = body[fieldName];
 			if (typeof token === "string" && token) {
@@ -188,7 +260,7 @@ function createConversionRoute(options) {
 		}
 		const refusal = !spam && validate?.(body);
 		if (refusal) return respondError(refusal, 400);
-		const respondSuccess = () => isCall ? new Response(null, { status: 204 }) : isFormPost && successRedirect ? redirectTo(successRedirect) : Response.json({ success: true });
+		const respondSuccess = () => isBeacon ? new Response(null, { status: 204 }) : isFormPost && successRedirect ? redirectTo(successRedirect) : Response.json({ success: true });
 		if (spam) {
 			onResult?.({
 				results: [{
@@ -202,20 +274,53 @@ function createConversionRoute(options) {
 		}
 		const turnstileFieldName = options.turnstile?.fieldName;
 		const excludedFields = turnstileFieldName ? [...honeypotFields, turnstileFieldName] : honeypotFields;
-		const result = await notify({
-			type: isCall ? "call" : "form",
-			...isCall ? { phone: String(body["phone"]).replace(/^tel:/, "") } : { formData: toFormData(body, excludedFields) },
+		const event = {
+			type: isCall ? "call" : isEmailClick ? "email" : "form",
+			...isCall ? { phone: String(body["phone"]).replace(/^tel:/, "") } : isEmailClick ? { email: String(body["email"]).replace(/^mailto:/, "") } : { formData: toFormData(body, excludedFields) },
 			tracking: parseTrackingCookie(request.headers.get("cookie")),
 			userAgent: request.headers.get("user-agent") ?? void 0,
 			ip,
 			at: now()
-		}, context, { email: binding?.(locals) });
+		};
+		let crmResult = null;
+		if (!isBeacon && options.crm) crmResult = await deliverToCrm(event, options.crm.config, {
+			credentials: options.crm.credentials?.(locals),
+			fetch: options.crm.fetch,
+			timeoutMs: options.crm.timeoutMs,
+			pageContext: {
+				hutk: readCookie(request.headers.get("cookie"), "hubspotutk") ?? void 0,
+				pageUri: request.headers.get("referer") ?? void 0
+			}
+		});
+		const crmNote = describeCrmResult(crmResult);
+		let googleAdsResult = null;
+		const adsCfg = options.googleAdsOffline?.config;
+		if (adsCfg?.reporting === "server" && adsCfg.accountId) {
+			const actionId = normalizeConversionActionIds(adsCfg.conversionActionId)[event.type];
+			const clickId = googleClickId(event.tracking);
+			const credentials = options.googleAdsOffline?.credentials?.(locals);
+			if (actionId && clickId && credentials) googleAdsResult = await uploadClickConversion({
+				customerId: adsCfg.accountId,
+				conversionActionId: actionId,
+				clickId,
+				at: event.at
+			}, credentials, options.googleAdsOffline?.fetch);
+		}
+		const googleAdsNote = describeGoogleAdsOfflineResult(googleAdsResult);
+		const result = {
+			...await notify(event, context, { email: binding?.(locals) }, { notes: [crmNote, googleAdsNote].filter((n) => n != null) }),
+			...crmResult ? { crm: crmResult } : {},
+			...googleAdsResult ? { googleAds: googleAdsResult } : {}
+		};
 		if (onResult) onResult(result);
-		else for (const r of result.results) if (!r.sent) console.warn(`[vitops] notification not sent (${r.channel}): ${r.reason}`);
+		else {
+			for (const r of result.results) if (!r.sent) console.warn(`[vitops] notification not sent (${r.channel}): ${r.reason}`);
+			if (crmResult && !crmResult.ok) console.warn(`[vitops] CRM write not delivered (${crmResult.provider}): ${crmResult.reason}`);
+			if (googleAdsResult && !googleAdsResult.ok) console.warn(`[vitops] Google Ads offline upload not delivered: ${googleAdsResult.reason}`);
+		}
 		return respondSuccess();
 	};
 }
 
-//#endregion
-export { createConversionRoute };
+export { createConversionRoute, resolveOrganizationName, toCrmConfig, toGoogleAdsConfig, toNotifyContext };
 //# sourceMappingURL=conversion.mjs.map