@getvitops/cli 2.1.0 → 4.0.0

package/dist/cli.mjs

@@ -4,10 +4,11 @@ import { parseArgs } from "node:util";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, parse, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { NUMERIC_STEPS, SCHEMA_URL, buildIconSprite, defaultConfig, enabledDocs, expandPalette, functionalRole, generate, generateDocs, generateLegal, isSiteConfig, resolveInput, resolveSiteConfig, resolveTheme, roleColorUtilities, roleHue, roleKind, validate } from "@getvitops/generator";
+import { NUMERIC_STEPS, SCHEMA_URL, buildIconSprite, defaultConfig, enabledDocs, expandPalette, functionalRole, generate, generateDocs, generateLegal, isConfig, resolveConfig, resolveInput, resolveTheme, roleColorUtilities, roleHue, roleKind, validate } from "@getvitops/generator";
 import { collectIconRefs, generateFavicons, generateIconInclude, resolveIcon, scanFiles } from "@getvitops/utils";
-import { SNAPSHOT_PATH, collectEntries, formatPlan, getAccessToken, inspectUrl, keyFileContents, newKey, parseServiceAccount, plan, readSnapshot, resolveKeyLocation, resolveSitemapUrl, submitBatch, submitSitemap, toSnapshot, verifyKeyFile, writeSnapshot } from "@getvitops/utils/indexing";
-import { MEDIA_MANIFEST_PATH, formatPlan as formatPlan$1, processMedia } from "@getvitops/utils/media";
+import { SCOPES, SNAPSHOT_PATH, collectEntries, formatPlan, googleAccessToken, inspectUrl, keyFileContents, newKey, parseServiceAccount, plan, readSnapshot, resolveKeyLocation, resolveSitemapUrl, submitBatch, submitSitemap, toSnapshot, verifyKeyFile, writeSnapshot } from "@getvitops/utils/indexing";
+import { addSite, backoffSchedule, createApexTxt, findZoneId, formatPlan as formatPlan$1, formatSummary, getSite, getVerificationToken, getWebResource, hasDrift, listApexTxt, ownerUnion, plan as plan$1, refreshTokenGrant, siteUrlFor, updateOwners, verifyWebResource } from "@getvitops/utils/onboarding";
+import { MEDIA_MANIFEST_PATH, formatPlan as formatPlan$2, processMedia } from "@getvitops/utils/media";
 
 //#region src/agents.ts
 /**
@@ -30,6 +31,10 @@ const TOPICS = {
 		path: "authoring.md",
 		summary: "every design-system.json field, rendered from the JSON Schema"
 	},
+	config: {
+		path: "config.md",
+		summary: "every field of the three-section config (designSystem / organization / site), rendered from the JSON Schema"
+	},
 	formats: {
 		path: "formats.md",
 		summary: "tailwind vs css vs bricks: what's emitted vs what the platform provides"
@@ -50,6 +55,26 @@ const TOPICS = {
 		path: "concepts/patterns.md",
 		summary: "pattern CSS: token cascade, override hooks, states, role variants"
 	},
+	components: {
+		path: "concepts/components.md",
+		summary: "which of the four tiers provides each pattern, and the call to make"
+	},
+	consent: {
+		path: "concepts/consent.md",
+		summary: "the consent gate: inert gated tags, demand-driven prompting, three-valued choices"
+	},
+	tracking: {
+		path: "concepts/tracking.md",
+		summary: "ad-click attribution, the `_ac` cookie, conversion notifications"
+	},
+	search: {
+		path: "concepts/search.md",
+		summary: "what search engines accept, Search Console onboarding, deploy notification"
+	},
+	legal: {
+		path: "concepts/legal.md",
+		summary: "privacy policy / terms / cookie notice derived from config facts"
+	},
 	elements: {
 		path: "bricks/elements.md",
 		summary: "Bricks Builder custom elements, controls, defaults"
@@ -532,7 +557,7 @@ function lintSource(files, v, format) {
 *   vitops docs      [topic] [--input <json>] [--all]
 *   vitops lint      [--input <json>] [--format <fmt>] [--src <dir>]
 *   vitops legal     [--input <site.json>] [--doc <name>] [--format <md|html|portable-text>] [--out <dir>]
-*   vitops indexing  [--input <site.json>] [--dry] [--all] [--check]
+*   vitops search    setup [--domain <name>] [--dry] [--check]  |  notify [--dry] [--all] [--check]
 *   vitops media     [--raw <dir>] [--out <dir>] [--force] [--dry]
 *
 * Thin wrapper over @getvitops/generator (generation) and @getvitops/utils (favicons).
@@ -576,7 +601,7 @@ Usage:
   vitops lint [options]         Report framework classes in your source that resolve to nothing
   vitops legal [options]        Render legal documents from a site config
   vitops icons [options]        Report which icons your source uses, and build the sprite
-  vitops indexing [options]    Tell search engines about a deploy (sitemap + IndexNow)
+  vitops search <sub> [opts]    Search Console: onboard domains (setup) + notify deploys (notify)
   vitops media [options]       Encode raw video into web-ready WebM + MP4 + poster
 
 Generate options:
@@ -650,7 +675,29 @@ Legal options:
   Generated from your config — a starting point, not legal advice. Review before
   publishing, and make sure the config describes what your site actually does.
 
-Indexing options:
+Search subcommands:
+  vitops search setup [opts]    Onboard site.searchConsole domains into GSC
+  vitops search notify [opts]   Tell search engines about a deploy (sitemap + IndexNow)
+
+Search setup options:
+  -i, --input <path>    Site config carrying site.searchConsole (default: ./site.json)
+      --site-env <env>  Environment whose A/B variant applies (default: production)
+      --domain <name>   Scope to a single site.searchConsole entry
+      --dry             Print the plan and exit. Changes nothing.
+      --check           Report drift and exit non-zero if any domain is not fully
+                        onboarded. Mutates nothing.
+
+  For each domain it ensures the apex verification TXT in Cloudflare, verifies
+  ownership (DNS_TXT, retried with backoff while DNS propagates — a still-
+  unverified domain is reported PENDING, not failed), adds the sc-domain: property,
+  and adds any delegatedOwners to the web resource. DNS is only ever created,
+  never edited or deleted. Credentials come from the environment:
+  CLOUDFLARE_API_TOKEN (Zone:DNS:Edit), and VITOPS_GOOGLE_CLIENT_ID /
+  VITOPS_GOOGLE_CLIENT_SECRET / VITOPS_GOOGLE_REFRESH_TOKEN (a user OAuth token
+  scoped to siteverification + webmasters). Granting a Google Group Full-User
+  access has no API and is surfaced as a reminder.
+
+Search notify options:
   -i, --input <path>    Site config carrying seo.indexing (default: ./site.json)
       --site-env <env>  Environment to notify for (default: production). An
                         environment whose robots policy says noindex is refused.
@@ -667,13 +714,16 @@ Indexing options:
                         Persist it between runs (a CI cache) or every run submits
                         everything.
 
-  What this can and cannot do: Google exposes no "request indexing" API, and its
+  What notify can and cannot do: Google exposes no "request indexing" API, and its
   sitemap ping endpoint was removed in 2023 — so it resubmits your sitemap
   through the Search Console API and verifies the result with --check. IndexNow
   reaches Bing, Yandex, Naver, Seznam and Yep; Google does not participate.
-  Search Console needs a service account in VITOPS_GSC_SERVICE_ACCOUNT (inline
-  JSON) or GOOGLE_APPLICATION_CREDENTIALS (a path), added as an owner of the
-  property.
+  Search Console takes either credential, whichever you already have, added as an
+  owner of the property: a service account in VITOPS_GSC_SERVICE_ACCOUNT (inline
+  JSON) or GOOGLE_APPLICATION_CREDENTIALS (a path), or the same user OAuth
+  credential "search setup" uses (VITOPS_GOOGLE_CLIENT_ID / _CLIENT_SECRET /
+  _REFRESH_TOKEN). The service account is preferred when both are set — this runs
+  on every deploy, and it does not expire.
 
 Media options:
       --raw <dir>       Directory of unprocessed video, walked recursively
@@ -703,6 +753,13 @@ Media options:
 Common:
   -h, --help            Show this help
 `;
+const SEARCH_HELP = `vitops search — Google Search Console
+
+  vitops search setup [opts]    Onboard site.searchConsole domains as GSC domain properties
+  vitops search notify [opts]   Tell search engines a deploy happened (sitemap + IndexNow)
+
+Run \`vitops --help\` for the full option list for each subcommand.
+`;
 function fail(msg) {
 	console.error(`✖ ${msg}`);
 	process.exit(1);
@@ -804,10 +861,10 @@ function cmdValidate(argv) {
 	} catch (err) {
 		fail(`could not parse JSON: ${err.message}`);
 	}
-	if (isSiteConfig(raw)) {
+	if (isConfig(raw)) {
 		let site;
 		try {
-			site = resolveSiteConfig(raw, values["site-env"]);
+			site = resolveConfig(raw, values["site-env"]);
 		} catch (err) {
 			console.error(`✖ ${path} is invalid as a site config:`);
 			console.error(err.message.replace(/^Invalid site config:\n/, ""));
@@ -882,7 +939,7 @@ const OUTPUT_KINDS = new Set([
 * Flags only, with no config file, following `favicon`: `site.favicon` exists in
 * the schema and `cmdFavicon` still doesn't read it. The same reasoning applies
 * more strongly here — `legal`, `icons` and `indexing` are anchored to a
-* `SiteConfig` because what they emit *describes the site*, and an encoder setting
+* `Config` because what they emit *describes the site*, and an encoder setting
 * describes a build step.
 */
 async function cmdMedia(argv) {
@@ -955,7 +1012,7 @@ async function cmdMedia(argv) {
 			onProgress: (message) => console.error(`  … ${message}`)
 		});
 		if (values.dry) {
-			console.log(formatPlan$1(result.plan));
+			console.log(formatPlan$2(result.plan));
 			return;
 		}
 		console.log(`✓ media → ${values.out} (${result.written.length} written, ${result.skipped} unchanged)`);
@@ -973,7 +1030,7 @@ async function cmdMedia(argv) {
 * `company.json` doesn't have to maintain a second file for the tooling's sake.
 * `resolveInput` tells them apart by shape and resolves the theme.
 */
-function loadConfig(path, theme) {
+function loadDesignSystem(path, theme) {
 	if (!existsSync(path)) fail(`config not found: ${path}`);
 	let raw;
 	try {
@@ -1001,11 +1058,11 @@ function loadConfig(path, theme) {
 * Read + resolve a site config, or exit with a message.
 *
 * Accepts JSON, or a JS/TS module with a default export — deliberately not YAML,
-* which would mean a parser dependency for one command. `resolveSiteConfig` is
+* which would mean a parser dependency for one command. `resolveConfig` is
 * documented as taking an already-parsed object precisely so the loader is the
 * consumer's choice; anyone on YAML can convert it or export from a module.
 */
-async function loadSiteConfig(path, siteEnv) {
+async function loadConfig(path, siteEnv) {
 	if (!existsSync(path)) fail(`site config not found: ${path}`);
 	let raw;
 	if (/\.(json)$/.test(path)) try {
@@ -1022,7 +1079,7 @@ async function loadSiteConfig(path, siteEnv) {
 		if (raw == null) fail(`${path} has no default export`);
 	}
 	try {
-		return resolveSiteConfig(raw, siteEnv);
+		return resolveConfig(raw, siteEnv);
 	} catch (err) {
 		fail(err.message);
 	}
@@ -1040,7 +1097,7 @@ async function loadSiteConfig(path, siteEnv) {
 * sprite from it.
 *
 * A sibling of `legal` rather than a widening of `lint`: `lint` judges classes
-* against a design-system.json, whereas icons are anchored to a SiteConfig.
+* against a design-system.json, whereas icons are anchored to a Config.
 *
 * Exit codes carry the same distinction the Astro integration makes. A name the
 * config DECLARES but that doesn't resolve is a config error and fails the
@@ -1082,7 +1139,7 @@ async function cmdIcons(argv) {
 		allowPositionals: false
 	});
 	const sitePath = resolve(values.site);
-	const icons = existsSync(sitePath) ? (await loadSiteConfig(sitePath, values["site-env"])).icons ?? {} : {};
+	const icons = existsSync(sitePath) ? (await loadConfig(sitePath, values["site-env"])).site.icons ?? {} : {};
 	const ui = icons.ui ?? "fa7-solid";
 	const brand = icons.brand ?? "simple-icons";
 	const weight = icons.weight;
@@ -1191,9 +1248,9 @@ async function cmdLegal(argv) {
 	if (!LEGAL_OUTPUTS.has(output)) fail(`unknown format "${output}" (expected: ${[...LEGAL_OUTPUTS].join(" | ")})`);
 	const requested = values.doc ?? [];
 	for (const d of requested) if (!LEGAL_DOCS.has(d)) fail(`unknown doc "${d}" (expected: ${[...LEGAL_DOCS].join(" | ")})`);
-	const site = await loadSiteConfig(resolve(values.input), values["site-env"]);
+	const site = await loadConfig(resolve(values.input), values["site-env"]);
 	const docs = requested.length ? requested : enabledDocs(site);
-	if (docs.length === 0) fail("no legal documents are enabled — set legal.privacyPolicy.enabled (or termsOfService / cookieConsent) in your site config, or name one with --doc");
+	if (docs.length === 0) fail("no legal documents are enabled — set site.legal.privacyPolicy.enabled (or termsOfService / cookieConsent) in your config, or name one with --doc");
 	const files = generateLegal(site, {
 		docs,
 		output
@@ -1209,14 +1266,15 @@ async function cmdLegal(argv) {
 	console.log("  These are generated from your config and are not legal advice — review them before publishing.");
 }
 /**
-* Adapt a `SiteConfig` to the indexing module's own option shape.
+* Adapt a `Config` to the indexing module's own option shape.
 *
 * A flat field map, as intended: `@getvitops/utils` cannot import from the
 * generator (the generator already depends on it), so `IndexingConfig` mirrors the
 * `seo.indexing` block rather than being it. The one piece of judgment here is the
 * origin — see below.
 */
-function toIndexingConfig(site, siteEnv) {
+function toIndexingConfig(cfg, siteEnv) {
+	const site = cfg.site;
 	const indexing = site.seo?.indexing ?? {};
 	const env = site.environments?.[siteEnv];
 	const canonical = env?.url ?? site.domains?.canonical;
@@ -1270,7 +1328,7 @@ const readSitemap = async (source) => {
 * The Indexing API is deliberately absent — see `@getvitops/utils/indexing`'s
 * `gsc.ts`.
 */
-async function cmdIndexing(argv) {
+async function cmdSearchNotify(argv) {
 	const { values } = parseArgs({
 		args: argv,
 		options: {
@@ -1313,13 +1371,13 @@ async function cmdIndexing(argv) {
 		const key = newKey();
 		console.log(key);
 		console.log(`\n  Add to your site config:\n    "seo": { "indexing": { "indexNow": { "key": "${key}" } } }`);
-		console.log(`  Then serve it at /${key}.txt — \`vitops indexing --write-key public\`.`);
+		console.log(`  Then serve it at /${key}.txt — \`vitops search notify --write-key public\`.`);
 		return;
 	}
-	const config = toIndexingConfig(await loadSiteConfig(resolve(values.input), values["site-env"]), values["site-env"]);
+	const config = toIndexingConfig(await loadConfig(resolve(values.input), values["site-env"]), values["site-env"]);
 	if (values["write-key"] !== void 0) {
 		const key = config.indexNow?.key;
-		if (!key) fail("no seo.indexing.indexNow.key in the config — generate one with --new-key");
+		if (!key) fail("no site.seo.indexing.indexNow.key in the config — generate one with --new-key");
 		const dir = resolve(values["write-key"]);
 		mkdirSync(dir, { recursive: true });
 		const file = join(dir, `${key}.txt`);
@@ -1349,13 +1407,13 @@ async function cmdIndexing(argv) {
 		console.log("\n(--dry: nothing was submitted)");
 		return;
 	}
-	const account = loadServiceAccount();
+	const credential = loadSearchCredential();
 	let failed = false;
 	if (values.check) {
 		if (!p.searchConsole.siteUrl) fail("--check needs seo.indexing.searchConsole.siteUrl (the Search Console property)");
-		if (!account) fail("--check needs a Search Console service account in VITOPS_GSC_SERVICE_ACCOUNT or GOOGLE_APPLICATION_CREDENTIALS");
+		if (!credential) fail(`--check needs a Search Console credential — ${CREDENTIAL_HINT}`);
 		if (p.check.length === 0) fail("--check needs seo.indexing.priorityUrls — the pages whose indexing matters");
-		const token = await getAccessToken(account);
+		const token = await googleAccessToken(credential);
 		console.log(`\nInspecting ${p.check.length} priority URL(s):`);
 		for (const url of p.check) {
 			const r = await inspectUrl(token, p.searchConsole.siteUrl, url);
@@ -1379,7 +1437,7 @@ async function cmdIndexing(argv) {
 		const check = await verifyKeyFile(keyLocation, key);
 		if (!check.ok) {
 			console.error(`✖ IndexNow key file check failed — ${check.reason}`);
-			console.error(`  Write it with: vitops indexing --write-key <public dir>`);
+			console.error(`  Write it with: vitops search notify --write-key <public dir>`);
 			failed = true;
 		} else {
 			let sent = 0;
@@ -1395,9 +1453,9 @@ async function cmdIndexing(argv) {
 			if (!failed) console.log(`✓ IndexNow: ${sent} URL(s) submitted`);
 		}
 	}
-	if (p.searchConsole.enabled) if (!account) console.log("· Search Console: skipped — no VITOPS_GSC_SERVICE_ACCOUNT / GOOGLE_APPLICATION_CREDENTIALS");
+	if (p.searchConsole.enabled) if (!credential) console.log(`· Search Console: skipped — no credential (${CREDENTIAL_HINT})`);
 	else {
-		const r = await submitSitemap(await getAccessToken(account), p.searchConsole.siteUrl, sitemapUrl);
+		const r = await submitSitemap(await googleAccessToken(credential), p.searchConsole.siteUrl, sitemapUrl);
 		if (r.ok) console.log(`✓ Search Console: sitemap resubmitted`);
 		else {
 			console.error(`✖ Search Console: ${r.message}`);
@@ -1409,7 +1467,267 @@ async function cmdIndexing(argv) {
 		writeSnapshot(snapshotPath, toSnapshot(sitemapUrl, current, (/* @__PURE__ */ new Date()).toISOString()));
 		console.log(`  state → ${relative(process.cwd(), snapshotPath)}`);
 	}
-	if (p.check.length > 0) console.log(`\n  Indexing is not instant. Run \`vitops indexing --check\` in a day or two to see what Google actually did.`);
+	if (p.check.length > 0) console.log(`\n  Indexing is not instant. Run \`vitops search notify --check\` in a day or two to see what Google actually did.`);
+}
+/**
+* Adapt a `Config` to the onboarding module's own option shape.
+*
+* The same flat field map as `toIndexingConfig`, and for the same reason — utils
+* cannot import the generator. `--domain` scopes to a single `site.searchConsole`
+* entry, and a name that isn't there is an error, not an empty run.
+*/
+function toSearchConsoleSetup(cfg, domainFilter) {
+	const entries = cfg.site.searchConsole ?? {};
+	const setups = Object.entries(entries).map(([domain, e]) => ({
+		domain,
+		...e.delegatedOwners ? { delegatedOwners: e.delegatedOwners } : {},
+		...e.fullUserGroup ? { fullUserGroup: e.fullUserGroup } : {}
+	}));
+	if (domainFilter) {
+		const one = setups.find((s) => s.domain === domainFilter);
+		if (!one) fail(`--domain "${domainFilter}" is not in site.searchConsole (have: ${setups.map((s) => s.domain).join(", ") || "none"})`);
+		return [one];
+	}
+	return setups;
+}
+/**
+* The Cloudflare DNS credential. From the environment only — a `site.json` is
+* committed, and this is a real secret. A `Zone:DNS:Edit` token (the standard
+* "Edit zone DNS" template, which also carries `Zone:Read`).
+*/
+function loadCloudflareToken() {
+	return process.env.CLOUDFLARE_API_TOKEN || void 0;
+}
+/**
+* The Google user-OAuth credential (refresh-token flow), from the environment.
+*
+* A user token, not a service account: onboarding acts *as a person* who can own
+* the sites. All-or-nothing — a partial set is a misconfiguration worth naming
+* rather than a reason to run degraded.
+*/
+function loadGoogleOAuth() {
+	const clientId = process.env.VITOPS_GOOGLE_CLIENT_ID;
+	const clientSecret = process.env.VITOPS_GOOGLE_CLIENT_SECRET;
+	const refreshToken = process.env.VITOPS_GOOGLE_REFRESH_TOKEN;
+	if (!clientId && !clientSecret && !refreshToken) return void 0;
+	const missing = [
+		["VITOPS_GOOGLE_CLIENT_ID", clientId],
+		["VITOPS_GOOGLE_CLIENT_SECRET", clientSecret],
+		["VITOPS_GOOGLE_REFRESH_TOKEN", refreshToken]
+	].filter(([, v]) => !v).map(([k]) => k);
+	if (missing.length) fail(`incomplete Google OAuth credential — missing ${missing.join(", ")}`);
+	return {
+		clientId,
+		clientSecret,
+		refreshToken
+	};
+}
+/**
+* The Google identity for `search notify`, preferring a service account.
+*
+* Search Console accepts either, and the preference is about *where this command
+* runs*: it fires on every deploy, in CI, and a service account has no expiry,
+* while a refresh token can be revoked — and for an OAuth client still in
+* *Testing* publishing status Google expires it after 7 days, which is a bad
+* property for a deploy step. So the robot wins when it is available.
+*
+* The fallback is the point, though. `search setup` needs user OAuth (verifying
+* a site makes the caller an owner, which should be a person), so a consumer who
+* ran setup already has a Google credential. Demanding a second, unrelated one
+* for the other half of the same command bought nothing.
+*/
+function loadSearchCredential() {
+	const account = loadServiceAccount();
+	if (account) return {
+		kind: "service-account",
+		account,
+		scope: SCOPES.webmasters
+	};
+	const oauth = loadGoogleOAuth();
+	return oauth ? {
+		kind: "oauth",
+		oauth
+	} : void 0;
+}
+/** Both spellings, for an error that has to tell you what to actually set. */
+const CREDENTIAL_HINT = "a service account in VITOPS_GSC_SERVICE_ACCOUNT / GOOGLE_APPLICATION_CREDENTIALS, or a user OAuth credential in VITOPS_GOOGLE_CLIENT_ID / VITOPS_GOOGLE_CLIENT_SECRET / VITOPS_GOOGLE_REFRESH_TOKEN";
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+* `vitops search` — everything that talks to search engines.
+*
+* Two subcommands, split by what they touch: `setup` onboards a domain into
+* Search Console (DNS + verification + property), `notify` tells the engines a
+* deploy happened (sitemap + IndexNow). `notify` is the former top-level
+* `vitops indexing`.
+*/
+async function cmdSearch(argv) {
+	const [sub, ...rest] = argv;
+	switch (sub) {
+		case "setup": return cmdSearchSetup(rest);
+		case "notify": return cmdSearchNotify(rest);
+		case void 0:
+		case "-h":
+		case "--help":
+			console.log(SEARCH_HELP);
+			return;
+		default: fail(`unknown "search" subcommand "${sub}" (expected: setup | notify). Try: vitops --help`);
+	}
+}
+/**
+* Onboard domains into Google Search Console as domain properties.
+*
+* Idempotent by construction: the planner decides each step from the domain's live
+* state, so a re-run of a fully-onboarded domain is all skips. `--check` reports
+* drift and exits non-zero without mutating; `--dry` prints the plan and stops.
+* DNS is only ever *created* — the verification TXT — never edited or removed.
+*
+* Search Console has no user/permission API, so granting a Google Group Full-User
+* access stays manual and is surfaced as a reminder, not attempted.
+*/
+async function cmdSearchSetup(argv) {
+	const { values } = parseArgs({
+		args: argv,
+		options: {
+			input: {
+				type: "string",
+				short: "i",
+				default: "site.json"
+			},
+			"site-env": {
+				type: "string",
+				default: "production"
+			},
+			domain: { type: "string" },
+			check: {
+				type: "boolean",
+				default: false
+			},
+			dry: {
+				type: "boolean",
+				default: false
+			}
+		},
+		allowPositionals: false
+	});
+	const domains = toSearchConsoleSetup(await loadConfig(resolve(values.input), values["site-env"]), values.domain);
+	if (domains.length === 0) fail("no domains in site.searchConsole — add domains to onboard (keyed by bare hostname)");
+	const cfToken = loadCloudflareToken();
+	const oauth = loadGoogleOAuth();
+	if (!cfToken) fail("set CLOUDFLARE_API_TOKEN (a Zone:DNS:Edit token) — reading and writing DNS needs it");
+	if (!oauth) fail("set VITOPS_GOOGLE_CLIENT_ID / VITOPS_GOOGLE_CLIENT_SECRET / VITOPS_GOOGLE_REFRESH_TOKEN — a user OAuth token scoped to siteverification + webmasters");
+	const token = await refreshTokenGrant(oauth);
+	const states = /* @__PURE__ */ new Map();
+	const verifyTokens = /* @__PURE__ */ new Map();
+	const webIds = /* @__PURE__ */ new Map();
+	for (const d of domains) {
+		const zone = await findZoneId(cfToken, d.domain);
+		if (!zone.ok || !zone.zoneId) fail(`${d.domain}: ${zone.message}`);
+		const vt = await getVerificationToken(token, d.domain);
+		if (!vt.ok || !vt.token) fail(`${d.domain}: could not obtain a verification token — ${vt.message}`);
+		verifyTokens.set(d.domain, vt.token);
+		const txt = await listApexTxt(cfToken, zone.zoneId, d.domain);
+		if (!txt.ok) fail(`${d.domain}: ${txt.message}`);
+		const wr = await getWebResource(token, d.domain);
+		if (!wr.ok) fail(`${d.domain}: ${wr.message}`);
+		if (wr.id) webIds.set(d.domain, wr.id);
+		const site = await getSite(token, siteUrlFor(d.domain));
+		if (!site.ok) fail(`${d.domain}: ${site.message}`);
+		states.set(d.domain, {
+			zoneId: zone.zoneId,
+			txtPresent: txt.contents.includes(vt.token),
+			verified: wr.exists,
+			currentOwners: wr.owners,
+			propertyExists: site.exists
+		});
+	}
+	const p = plan$1({ domains }, states);
+	console.log(formatPlan$1(p));
+	if (values.check) {
+		if (hasDrift(p)) {
+			console.error("\n✖ drift — one or more domains are not fully onboarded");
+			process.exit(1);
+		}
+		console.log("\n✓ every domain is onboarded");
+		return;
+	}
+	if (values.dry) {
+		console.log("\n(--dry: nothing was changed)");
+		return;
+	}
+	const results = [];
+	let failed = false;
+	const delays = backoffSchedule();
+	for (const d of domains) {
+		const dp = p.domains.find((x) => x.domain === d.domain);
+		const state = states.get(d.domain);
+		const result = {
+			domain: d.domain,
+			txt: "—",
+			verified: "—",
+			property: "—",
+			reminders: dp.reminders
+		};
+		if (dp.txt.action === "skip") result.txt = "present";
+		else {
+			const r = await createApexTxt(cfToken, state.zoneId, d.domain, verifyTokens.get(d.domain));
+			if (!r.ok) {
+				console.error(`✖ ${d.domain} TXT: ${r.message}`);
+				result.txt = "failed";
+				failed = true;
+				results.push(result);
+				continue;
+			}
+			result.txt = "created";
+		}
+		let verified = state.verified;
+		if (verified) result.verified = "yes";
+		else {
+			for (let attempt = 0; attempt < delays.length; attempt++) {
+				const v = await verifyWebResource(token, d.domain);
+				if (v.ok) {
+					verified = true;
+					if (v.id) webIds.set(d.domain, v.id);
+					state.currentOwners = v.owners;
+					break;
+				}
+				if (attempt < delays.length - 1) {
+					const wait = delays[attempt];
+					console.log(`  … ${d.domain}: not verified yet (attempt ${attempt + 1}/${delays.length}); retrying in ${wait / 1e3}s`);
+					await sleep(wait);
+				}
+			}
+			result.verified = verified ? "yes" : "pending";
+		}
+		if (!verified) {
+			results.push(result);
+			continue;
+		}
+		if (dp.property.action === "skip") result.property = "present";
+		else {
+			const r = await addSite(token, dp.siteUrl);
+			if (!r.ok) {
+				console.error(`✖ ${d.domain} property: ${r.message}`);
+				result.property = "failed";
+				failed = true;
+			} else result.property = "added";
+		}
+		if (dp.owners.action === "update" && dp.ownersToAdd.length) {
+			const id = webIds.get(d.domain);
+			if (!id) {
+				console.error(`✖ ${d.domain} owners: no web-resource id (verify may be too fresh)`);
+				failed = true;
+			} else {
+				const r = await updateOwners(token, id, d.domain, ownerUnion(state.currentOwners, dp.ownersToAdd));
+				if (!r.ok) {
+					console.error(`✖ ${d.domain} owners: ${r.message}`);
+					failed = true;
+				} else console.log(`✓ ${d.domain}: added ${dp.ownersToAdd.length} owner(s)`);
+			}
+		}
+		results.push(result);
+	}
+	console.log(`\n${formatSummary(results)}`);
+	if (failed) process.exit(1);
 }
 function cliVersion() {
 	try {
@@ -1448,7 +1766,7 @@ function cmdDocs(argv) {
 		return;
 	}
 	if (topic && !TOPICS[topic]) fail(`unknown topic "${topic}". Valid topics:\n${topicList()}`);
-	const docs = generateDocs(loadConfig(resolve(values.input), values.theme), generatorAssetsDir());
+	const docs = generateDocs(loadDesignSystem(resolve(values.input), values.theme), generatorAssetsDir());
 	const paths = values.all ? Object.values(TOPICS).map((t) => t.path) : [TOPICS[topic].path];
 	process.stdout.write(paths.map((p) => docs[p]).join("\n"));
 }
@@ -1481,7 +1799,7 @@ function cmdLint(argv) {
 	});
 	const format = values.format;
 	if (!LINT_FORMATS.has(format)) fail(`unknown format "${format}" (expected: bricks | css | tailwind)`);
-	const ds = loadConfig(resolve(values.input), values.theme);
+	const ds = loadDesignSystem(resolve(values.input), values.theme);
 	const srcDir = resolve(values.src);
 	if (!existsSync(srcDir)) fail(`source directory not found: ${srcDir}`);
 	const palette = expandPalette(ds.colors.palette);
@@ -1534,7 +1852,7 @@ function cmdAgents(argv) {
 	});
 	const inputRel = values.input;
 	let ds = null;
-	if (existsSync(resolve(inputRel))) ds = loadConfig(resolve(inputRel), values.theme);
+	if (existsSync(resolve(inputRel))) ds = loadDesignSystem(resolve(inputRel), values.theme);
 	else console.warn(`  ⚠ ${inputRel} not found — run \`vitops init\` to scaffold one`);
 	const legacyDocsDir = values["docs-dir"];
 	let summary;
@@ -1636,9 +1954,9 @@ async function main() {
 		case "lint": return cmdLint(rest);
 		case "legal": return cmdLegal(rest);
 		case "icons": return cmdIcons(rest);
-		case "indexing": return cmdIndexing(rest);
+		case "search": return cmdSearch(rest);
 		case "media": return cmdMedia(rest);
-		default: fail(`unknown command "${command}" (expected: generate | init | validate | favicon | agents | docs | lint | legal | icons | indexing | media). Try: vitops --help`);
+		default: fail(`unknown command "${command}" (expected: generate | init | validate | favicon | agents | docs | lint | legal | icons | search | media). Try: vitops --help`);
 	}
 }
 main().catch((err) => fail(err.message));