@getvitops/cli 8.0.1 → 8.2.0-alpha.0

package/dist/cli.mjs

@@ -14,6 +14,11 @@ import { addSite, backoffSchedule, createApexTxt, findZoneId, formatPlan as form
 import { AD_PLATFORMS, AD_PROVIDER_KEYS, formatPlan as formatPlan$4, formatSummary as formatSummary$1, hasDrift as hasDrift$1, isAdProvider, missingFields, plan as plan$3, renderTag, tagId } from "@getvitops/utils/ads";
 import { PLATFORM_PARAMS } from "@getvitops/utils/tracking";
 import { createInterface } from "node:readline/promises";
+import { zohoAccountsHost, zohoApiHost } from "@getvitops/utils/crm";
+import { backoffSchedule as backoffSchedule$1, blockedDomains, collectFromAddresses, dnsStatus, enableSending, findZoneForHost, formatPlan as formatPlan$5, formatSummary as formatSummary$2, hasDrift as hasDrift$2, listSendingSubdomains, planSendingDomains, resolveTxt, sendingDns } from "@getvitops/utils/email";
+import { normalizeEmailChannel, resolveSender } from "@getvitops/utils/notify";
+import { execFileSync } from "node:child_process";
+import { adminCollaboratorIds, branches, createD1, createDevEnvironment, createProdEnvironment, createR2Bucket, createRepo, defaultBranch, environments, findD1, findR2Bucket, formatPlan as formatPlan$6, formatSummary as formatSummary$3, ghAuthed, mainProtected, originRemote, plan as plan$4, planDomainConsistency, protectMain, pushBranches, repoNwo, secretsPresent, setDefaultBranch, setSecret, wranglerWhoami } from "@getvitops/utils/hosting";
 
 //#region src/args.ts
 /**
@@ -294,6 +299,35 @@ function loadSearchCredential() {
 }
 /** Both spellings, for an error that has to tell you what to actually set. */
 const CREDENTIAL_HINT = "a service account in VITOPS_GSC_SERVICE_ACCOUNT / GOOGLE_APPLICATION_CREDENTIALS, or a user OAuth credential in VITOPS_GOOGLE_CLIENT_ID / VITOPS_GOOGLE_CLIENT_SECRET / VITOPS_GOOGLE_REFRESH_TOKEN";
+/**
+* The HubSpot private-app access token, from the environment. Never the
+* config file — same rule as every other credential here.
+*/
+function loadHubSpotToken() {
+	return process.env.VITOPS_HUBSPOT_ACCESS_TOKEN || void 0;
+}
+/**
+* The Zoho self-client OAuth credential, for Bigin. All-or-nothing, matching
+* `loadGoogleOAuth`'s own rule: a partial set is a misconfiguration worth
+* naming, not a reason to run degraded.
+*/
+function loadZohoOAuth() {
+	const clientId = process.env.VITOPS_ZOHO_CLIENT_ID;
+	const clientSecret = process.env.VITOPS_ZOHO_CLIENT_SECRET;
+	const refreshToken = process.env.VITOPS_ZOHO_REFRESH_TOKEN;
+	if (!clientId && !clientSecret && !refreshToken) return void 0;
+	const missing = [
+		["VITOPS_ZOHO_CLIENT_ID", clientId],
+		["VITOPS_ZOHO_CLIENT_SECRET", clientSecret],
+		["VITOPS_ZOHO_REFRESH_TOKEN", refreshToken]
+	].filter(([, v]) => !v).map(([k]) => k);
+	if (missing.length) fail(`incomplete Zoho OAuth credential — missing ${missing.join(", ")}`);
+	return {
+		clientId,
+		clientSecret,
+		refreshToken
+	};
+}
 
 //#endregion
 //#region src/help.ts
@@ -326,6 +360,8 @@ Usage:
   vitops icons [options]        Report which icons your source uses, and build the sprite
   vitops search <sub> [opts]    Search Console: onboard domains (setup) + notify deploys (notify)
   vitops ads <sub> [opts]       Ad properties: verify domains (setup) + emit pixels (tags) + lint
+  vitops setup <sub> [opts]     Scripted onboarding: repo, hosting, domain, search, ads, all
+  vitops email <sub> [opts]     Sender-domain onboarding: check (setup) + deploy guard (check)
   vitops media [options]       Encode raw video into web-ready WebM + MP4 + poster
 
 Generate options:
@@ -574,6 +610,128 @@ Ads lint options:
   off (every conversion arrives unattributed), and a configured property with no
   tag ID. Exits non-zero on a finding.
 
+Crm check options:
+  -i, --input <path>    Site config carrying site.crm (default: ./site.json)
+      --site-env <env>  Environment to resolve (default: production)
+
+  Fetches the live field/property list (HubSpot: crm/v3/properties/contacts;
+  Bigin: bigin/v2/settings/fields) and reports every fieldMap/trackingFields
+  target that doesn't exist there. HubSpot rejects a submission naming an
+  unrecognised property; Bigin silently ignores it — this is the only way to
+  see a broken mapping before a real submission finds it. Needs
+  VITOPS_HUBSPOT_ACCESS_TOKEN, VITOPS_ZOHO_CLIENT_ID/_CLIENT_SECRET/
+  _REFRESH_TOKEN, or (unused for now) VITOPS_JOBBER_CLIENT_ID/_CLIENT_SECRET/
+  _REFRESH_TOKEN, matching whichever provider site.crm names. Jobber currently
+  renders fieldMap/trackingFields as note-text lines rather than app-configured
+  custom fields, so there is nothing live to check there yet. Exits non-zero
+  on any missing target.
+
+Crm setup options:
+  -i, --input <path>    Site config carrying site.crm (default: ./site.json)
+      --site-env <env>  Environment to resolve (default: production)
+      --dry             Print what would be created and exit. Creates nothing.
+
+  HubSpot: creates missing contact properties named by fieldMap/trackingFields.
+  Bigin: no such API exists, so this always prints a manual reminder listing
+  the fields to add in Zoho Bigin's field editor, then re-run "crm check".
+  Jobber: app-configured custom fields aren't wired up yet, so this prints a
+  reminder instead of creating anything.
+
+Setup repo options:
+      --dry             Print the plan and exit
+      --check           Report drift/blocked steps and exit non-zero, mutating nothing
+      --public          Create the repo public (default: private)
+      --platform <p>    cloudflare (default) | node — shown for parity with the hosting stage's plan
+      --no-dev-resources  Same — this stage never provisions D1/R2 either way
+
+  Creates the GitHub repo (via \`gh\`), pushes main + dev, makes dev the default
+  branch, and requests main branch protection + the production/dev environments.
+  Idempotent — a re-run of a fully set-up repo is all skips. Branch protection and
+  environment reviewers 403 on a private repo without GitHub Pro/Team; that is
+  reported as blocked, with the manual Settings path, never as a failure.
+
+Setup hosting options:
+      --dry             Print the plan and exit
+      --check           Report drift/blocked steps and exit non-zero, mutating nothing
+      --platform <p>    cloudflare (default) | node
+      --no-dev-resources  Skip D1/R2 — a pure static Workers Assets project has
+                        nothing to provision, just the account id + token
+
+  Provisions the isolated dev D1 database + R2 bucket (cloudflare) and sets the
+  DEV_D1_ID / CLOUDFLARE_ACCOUNT_ID repo secrets, once \`vitops setup repo\` has run.
+  CLOUDFLARE_API_TOKEN is always reported as blocked — no API can create one; see
+  the printed dashboard link. Requires \`npx wrangler login\` first.
+
+Setup domain options:
+  -i, --input <path>    Site config (default: ./site.json)
+      --site-env <env>  Environment to check (default: production)
+      --dry             Print the plan and exit
+      --check           Exit non-zero if the domain state is inconsistent
+      --domain <apex>   Print the manual cutover steps for this apex
+
+  Plans and checks the consistency between wrangler.jsonc's workers.dev/custom-domain
+  state and site.json's environments/domains/robots — it NEVER edits wrangler.jsonc
+  or deploys. Cutover overwrites the zone's DNS record and can take an existing live
+  site down; that step is manual, on purpose. See SETUP.html's "Domain strategy" stage.
+
+Setup search options:
+  Forwards every option to \`vitops search setup\` unchanged — see "Search setup
+  options:" above.
+
+Setup ads options:
+  Forwards every option to \`vitops ads setup\` unchanged — see "Ads setup options:"
+  above.
+
+Setup all options:
+      --dry             Print every stage's plan and exit
+      --check           Report drift across every stage and exit non-zero
+      --public          Create the repo public, for the repo stage
+      --platform <p>    cloudflare (default) | node, for the repo + hosting stages
+      --no-dev-resources  Skip D1/R2 in the hosting stage (repo stage never provisions them)
+
+  Runs repo, hosting, search, ads in order. Stops at the first stage that fails;
+  a blocked step (the API token, GitHub Pro/Team gating) is reported, not fatal.
+
+Email subcommands:
+  vitops email setup [domain]  Onboard a from-address domain, waiting for its DNS to resolve
+  vitops email check [opts]    Non-blocking deploy guard: warn if a from domain isn't onboarded
+
+Email setup options:
+  -i, --input <path>    Site config carrying site.notifications.email (default: ./site.json)
+      --site-env <env>  Environment whose A/B variant applies (default: production)
+  [domain]              Onboard this exact name instead of deriving candidates from
+                        config + a source scan
+      --src <dir>       Source to scan for from: literals as a supplement to config
+                        (default: ./src)
+      --dry             Print the plan and exit. Needs no credential — plans from
+                        scratch and says so.
+      --check           Report drift and exit non-zero. Mutates nothing.
+      --no-prompt       Never ask before enabling a domain (the default when
+                        stdin is not a TTY, e.g. in CI — it just enables)
+      --timeout <s>     Cap on each DNS-propagation poll wait, in seconds (default: 5)
+
+  The onboarded entity is an EXACT name, and it is usually a subdomain
+  (send.example.com), never the apex a from address names. When the exact
+  domain is absent but a sibling in the same zone is already onboarded, this
+  is reported blocked rather than silently enabling the apex too — enabling
+  it rewrites _dmarc.<domain>, which can tighten policy on every OTHER mail
+  sent from that domain. Sending from the onboarded sibling is the
+  recommended fix. Needs CLOUDFLARE_API_TOKEN (Zone:Read + an Email Sending
+  scope — broader than the "Edit zone DNS" template other commands use).
+
+Email check options:
+  -i, --input <path>    Site config carrying site.notifications.email (default: ./site.json)
+      --site-env <env>  Environment whose A/B variant applies (default: production)
+      --src <dir>       Source to scan for from: literals (default: ./src)
+      --strict          Exit non-zero on drift (the default just warns and exits 0)
+      --skip            Skip the check entirely (same as VITOPS_SKIP_EMAIL_CHECK)
+
+  Meant to run before a deploy. With no CLOUDFLARE_API_TOKEN it reports "not
+  checked" and exits 0, so a CI job without the secret never fails on the
+  check itself. Skip per-site with site.notifications.email.verifySender: false
+  when the scan can't see the real from address and the warning would be a
+  false positive.
+
 Media options:
       --raw <dir>       Directory of unprocessed video, walked recursively
                         (default: ./raw)
@@ -615,6 +773,32 @@ const ADS_HELP = `vitops ads — link this site to its ad properties
   vitops ads tags [opts]        Print the consent-gated pixel snippets
   vitops ads lint [opts]        Report ad properties the rest of the config can't see
 
+Run \`vitops --help\` for the full option list for each subcommand.
+`;
+const CRM_HELP = `vitops crm — push form submissions into a client CRM
+
+  vitops crm check [opts]       Compare site.crm's fieldMap/trackingFields against the live CRM
+  vitops crm setup [opts]       Create missing HubSpot properties (Bigin/Jobber have no such API)
+
+Run \`vitops --help\` for the full option list for each subcommand.
+`;
+const EMAIL_HELP = `vitops email — sender-domain onboarding checks
+
+  vitops email setup [domain]  Onboard a from-address domain, waiting for its DNS to resolve
+  vitops email check [opts]    Non-blocking deploy guard: warn if a from domain isn't onboarded
+
+Run \`vitops --help\` for the full option list for each subcommand.
+`;
+const SETUP_HELP$1 = `vitops setup — the scripted path from an empty scaffold to a live site
+
+  vitops setup repo [opts]      GitHub repo + branch policy (main protected, dev open)
+  vitops setup hosting [opts]   Dev D1 + R2 + repo secrets (cloudflare) or a Node target
+  vitops setup domain [opts]    Plan/check the workers.dev-vs-custom-domain consistency
+                                 (never applies the cutover — see SETUP.html)
+  vitops setup search [opts]    Forwards to \`vitops search setup\`
+  vitops setup ads [opts]       Forwards to \`vitops ads setup\`
+  vitops setup all [opts]       Run repo, hosting, search, ads in order
+
 Run \`vitops --help\` for the full option list for each subcommand.
 `;
 /**
@@ -636,6 +820,9 @@ const COMMANDS = [
 	"icons",
 	"search",
 	"ads",
+	"crm",
+	"setup",
+	"email",
 	"media"
 ];
 /**
@@ -665,7 +852,7 @@ const wantsHelp = (argv) => argv.includes("-h") || argv.includes("--help");
 /** The help text to print for `vitops <command> [sub] --help`. */
 function helpFor(command, argv) {
 	const sub = argv[0] && !argv[0].startsWith("-") ? argv[0] : void 0;
-	return (sub ? helpSection(command, sub) : void 0) ?? helpSection(command) ?? (command === "search" ? SEARCH_HELP : command === "ads" ? ADS_HELP : void 0) ?? HELP;
+	return (sub ? helpSection(command, sub) : void 0) ?? helpSection(command) ?? (command === "search" ? SEARCH_HELP : command === "ads" ? ADS_HELP : command === "crm" ? CRM_HELP : command === "setup" ? SETUP_HELP$1 : command === "email" ? EMAIL_HELP : void 0) ?? HELP;
 }
 
 //#endregion
@@ -707,11 +894,12 @@ function toIndexingConfig(cfg, siteEnv) {
 */
 function toSearchConsoleSetup(cfg, domainFilter) {
 	const entries = cfg.site.searchConsole ?? {};
-	return pickOne(Object.entries(entries).map(([domain, e]) => ({
+	const setups = Object.entries(entries).map(([domain, e]) => ({
 		domain,
 		...e.delegatedOwners ? { delegatedOwners: e.delegatedOwners } : {},
 		...e.fullUserGroup ? { fullUserGroup: e.fullUserGroup } : {}
-	})), domainFilter, (s) => s.domain, {
+	}));
+	return pickOne(setups, domainFilter, (s) => s.domain, {
 		flag: "domain",
 		source: "site.searchConsole"
 	});
@@ -744,7 +932,7 @@ function searchAuth(token, credential, cfg, input) {
 		quotaProject: project
 	} : token;
 }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const sleep$1 = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
 * Tell search engines a deploy happened.
 *
@@ -870,13 +1058,16 @@ async function cmdSearchNotify(argv) {
 			if (!failed) console.log(`✓ IndexNow: ${sent} URL(s) submitted`);
 		}
 	}
-	if (p.searchConsole.enabled) if (!credential) console.log(`· Search Console: skipped — no credential (${CREDENTIAL_HINT})`);
-	else {
-		const r = await submitSitemap(searchAuth(await googleAccessToken(credential), credential, site, a.str("input")), p.searchConsole.siteUrl, sitemapUrl);
-		if (r.ok) console.log(`✓ Search Console: sitemap resubmitted`);
+	if (p.searchConsole.enabled) {
+		if (!credential) console.log(`· Search Console: skipped — no credential (${CREDENTIAL_HINT})`);
 		else {
-			console.error(`✖ Search Console: ${r.message}`);
-			failed = true;
+			const auth = searchAuth(await googleAccessToken(credential), credential, site, a.str("input"));
+			const r = await submitSitemap(auth, p.searchConsole.siteUrl, sitemapUrl);
+			if (r.ok) console.log(`✓ Search Console: sitemap resubmitted`);
+			else {
+				console.error(`✖ Search Console: ${r.message}`);
+				failed = true;
+			}
 		}
 	}
 	if (failed) process.exit(1);
@@ -1017,7 +1208,7 @@ async function cmdSearchSetup(argv) {
 				if (attempt < delays.length - 1) {
 					const wait = delays[attempt];
 					console.log(`  … ${d.domain}: not verified yet (attempt ${attempt + 1}/${delays.length}); retrying in ${wait / 1e3}s`);
-					await sleep(wait);
+					await sleep$1(wait);
 				}
 			}
 			result.verified = verified ? "yes" : "pending";
@@ -1442,7 +1633,8 @@ async function cmdAdsTags(argv) {
 * with tracking off produces conversions no campaign gets credit for.
 */
 async function cmdAdsLint(argv) {
-	const cfg = await siteConfig(parse$1(argv, SITE_OPTS));
+	const a = parse$1(argv, SITE_OPTS);
+	const cfg = await siteConfig(a);
 	const properties = toAdProperties(cfg, void 0);
 	if (properties.length === 0) {
 		console.log("· no site.ads properties — nothing to check");
@@ -1480,6 +1672,922 @@ async function cmdAds(argv) {
 	}
 }
 
+//#endregion
+//#region src/commands/crm.ts
+/**
+* `vitops crm` — the two things `site.crm` needs a human-in-the-loop for.
+*
+* `check` is the drift guard, and the reason this command exists at all:
+* HubSpot *rejects* a submission naming an unrecognised property, and Bigin
+* silently *ignores* one — so a typo'd `fieldMap`/`trackingFields` entry is
+* invisible in one CRM and fatal in the other, and nothing short of fetching
+* the live field list can tell you which. `setup` creates the missing
+* properties HubSpot's API allows creating; Bigin has no such endpoint, so it
+* always resolves to a manual reminder, matching how `ads setup` handles a
+* platform with no verification API. Jobber currently renders `fieldMap`/
+* `trackingFields` values as note-text lines rather than app-configured
+* custom fields (see `@getvitops/utils/crm`'s `jobber.ts` docblock for why
+* that surface is deferred), so there is nothing live to check yet — both
+* subcommands say so rather than guessing at an unverified API.
+*
+* Modelled on `commands/ads.ts`: read-and-create only, never destructive.
+*/
+/** Every CRM property name this site's config asserts exists, from both maps —
+* `fieldMap`/`trackingFields` values are property names, not the submitted
+* field names on the left. */
+function configuredProperties(crm) {
+	return [...Object.values(crm.fieldMap ?? {}), ...Object.values(crm.trackingFields ?? {})];
+}
+async function hubspotContactProperties(accessToken) {
+	const res = await fetch("https://api.hubapi.com/crm/v3/properties/contacts", { headers: { authorization: `Bearer ${accessToken}` } });
+	if (!res.ok) fail(`HubSpot properties lookup failed (${res.status}): ${await res.text()}`);
+	const json = await res.json();
+	return new Set((json.results ?? []).map((p) => p.name));
+}
+async function biginContactFields(oauth, dataCenter) {
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		client_id: oauth.clientId,
+		client_secret: oauth.clientSecret,
+		refresh_token: oauth.refreshToken
+	});
+	const tokenRes = await fetch(`https://${zohoAccountsHost(dataCenter)}/oauth/v2/token`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: body.toString()
+	});
+	if (!tokenRes.ok) fail(`Zoho token exchange failed (${tokenRes.status}): ${await tokenRes.text()}`);
+	const { access_token } = await tokenRes.json();
+	if (!access_token) fail("Zoho token exchange returned no access_token");
+	const res = await fetch(`https://${zohoApiHost(dataCenter)}/bigin/v2/settings/fields?module=Contacts`, { headers: { authorization: `Zoho-oauthtoken ${access_token}` } });
+	if (!res.ok) fail(`Bigin fields lookup failed (${res.status}): ${await res.text()}`);
+	const json = await res.json();
+	return new Set((json.fields ?? []).map((f) => f.api_name));
+}
+/** What each provider's `check` needs to say when it doesn't fail outright.
+* Kept as a table rather than an `if/else if` chain so a fourth provider is
+* a missing entry (a type error), not a silently-wrong branch. */
+const CHECK_NOUNS = {
+	hubspot: "properties",
+	bigin: "fields",
+	jobber: "fields"
+};
+const CHECK_REJECTION = {
+	hubspot: "HubSpot will reject the whole submission",
+	bigin: "Bigin will silently drop this value",
+	jobber: "Jobber will silently drop this value"
+};
+/**
+* Fetch the live field/property vocabulary and report every `fieldMap`/
+* `trackingFields` target that doesn't exist there.
+*/
+async function cmdCrmCheck(argv) {
+	const a = parse$1(argv, SITE_OPTS);
+	const crm = (await siteConfig(a)).site.crm;
+	if (!crm) {
+		console.log("· no site.crm — nothing to check");
+		return;
+	}
+	if (crm.enabled === false) {
+		console.log("· site.crm.enabled is false — nothing to check");
+		return;
+	}
+	const wanted = configuredProperties(crm);
+	if (wanted.length === 0) {
+		console.log("· site.crm has no fieldMap/trackingFields entries — nothing to check");
+		return;
+	}
+	if (crm.provider === "jobber") {
+		console.log("· no live check for Jobber yet — fieldMap/trackingFields values currently render as note-text lines, not app-configured custom fields, so nothing there can silently mismatch (see @getvitops/utils/crm jobber.ts docblock).");
+		return;
+	}
+	let known;
+	if (crm.provider === "hubspot") {
+		const token = loadHubSpotToken();
+		if (!token) fail("set VITOPS_HUBSPOT_ACCESS_TOKEN to check the live property list");
+		known = await hubspotContactProperties(token);
+	} else {
+		const oauth = loadZohoOAuth();
+		if (!oauth) fail("set VITOPS_ZOHO_CLIENT_ID / VITOPS_ZOHO_CLIENT_SECRET / VITOPS_ZOHO_REFRESH_TOKEN to check the live field list");
+		known = await biginContactFields(oauth, crm.bigin.dataCenter);
+	}
+	const missing = wanted.filter((p) => !known.has(p));
+	if (missing.length === 0) {
+		console.log(`✓ ${wanted.length} mapped ${CHECK_NOUNS[crm.provider]} exist`);
+		return;
+	}
+	for (const p of missing) console.error(`✖ "${p}" is not a ${crm.provider === "hubspot" ? "HubSpot contact property" : "Bigin Contacts field"} — ${CHECK_REJECTION[crm.provider]}`);
+	process.exit(1);
+}
+/**
+* Create the HubSpot properties `fieldMap`/`trackingFields` name but don't
+* exist yet. Bigin has no property-creation API and Jobber's app-configured
+* custom fields aren't wired up yet (see the module docblock) — both resolve
+* to `blocked`/a manual reminder, matching `ads setup`'s handling of a
+* platform with no verification API.
+*/
+async function cmdCrmSetup(argv) {
+	const a = parse$1(argv, {
+		...SITE_OPTS,
+		dry: {
+			type: "boolean",
+			default: false
+		}
+	});
+	const crm = (await siteConfig(a)).site.crm;
+	if (!crm) fail("no site.crm configured — nothing to set up");
+	const wanted = configuredProperties(crm);
+	if (crm.provider === "jobber") {
+		console.log("· Jobber app-configured custom fields are not wired up yet — fieldMap/trackingFields values render as note-text lines instead, which need no setup. If you do want them as real Jobber custom fields, create them manually in Jobber's Developer Center first.");
+		return;
+	}
+	if (crm.provider === "bigin") {
+		if (wanted.length === 0) {
+			console.log("· no fieldMap/trackingFields entries to check against Bigin");
+			return;
+		}
+		console.log("? Bigin has no API to create Contacts fields. Create these manually in Zoho Bigin's field editor, then re-run `vitops crm check`:\n" + wanted.map((p) => `    - ${p}`).join("\n"));
+		return;
+	}
+	const token = loadHubSpotToken();
+	if (!token) fail("set VITOPS_HUBSPOT_ACCESS_TOKEN to create HubSpot properties");
+	const known = await hubspotContactProperties(token);
+	const missing = wanted.filter((p) => !known.has(p));
+	if (missing.length === 0) {
+		console.log("✓ every mapped property already exists");
+		return;
+	}
+	if (a.flag("dry")) {
+		console.log(`would create ${missing.length} HubSpot contact propert${missing.length === 1 ? "y" : "ies"}:`);
+		for (const p of missing) console.log(`  + ${p}`);
+		return;
+	}
+	for (const p of missing) {
+		const res = await fetch("https://api.hubapi.com/crm/v3/properties/contacts", {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				name: p,
+				label: p,
+				type: "string",
+				fieldType: "text",
+				groupName: "contactinformation"
+			})
+		});
+		if (!res.ok) {
+			console.error(`✖ ${p}: ${res.status} ${await res.text()}`);
+			process.exit(1);
+		}
+		console.log(`✓ created ${p}`);
+	}
+}
+async function cmdCrm(argv) {
+	const [sub, ...rest] = argv;
+	switch (sub) {
+		case "check": return cmdCrmCheck(rest);
+		case "setup": return cmdCrmSetup(rest);
+		case void 0:
+		case "-h":
+		case "--help":
+			console.log(CRM_HELP);
+			return;
+		default: fail(`unknown "crm" subcommand "${sub}" (expected: check | setup). Try: vitops --help`);
+	}
+}
+
+//#endregion
+//#region src/commands/email.ts
+/**
+* `vitops email` — connect `site.notifications.email.from` to whether its domain
+* is actually onboarded onto an outbound email provider.
+*
+* The silent failure this exists to catch: `EMAIL.send()` throws
+* `E_SENDER_NOT_VERIFIED` at runtime with nothing at build or deploy time saying
+* a word, because nothing previously checked the `from` domain against Cloudflare
+* Email Sending's actual onboarding state. Two subcommands, split by what they
+* do: `setup` onboards a domain and waits for its DNS to resolve; `check` is the
+* non-blocking deploy guard.
+*/
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+* Every `from` domain worth checking: the explicit config value first, its
+* derived `noreply@<canonical>` default second, and a best-effort scan of
+* `--src` as a supplement — never the primary source, since a computed value in
+* source is reported as dynamic rather than guessed at (see `email/scan.ts`).
+*/
+function gatherCandidates(cfg, srcDir) {
+	const candidates = [];
+	const dynamicNotes = [];
+	const channel = normalizeEmailChannel(cfg.site.notifications?.email);
+	const canonical = cfg.site.domains?.canonical;
+	const address = resolveSender(channel ?? { provider: "cloudflare" }, { canonical });
+	if (address) {
+		const domain = address.split("@")[1];
+		if (domain) candidates.push({
+			address,
+			domain,
+			source: channel?.from ? "config" : "derived"
+		});
+	}
+	if (existsSync(srcDir)) {
+		const { addresses, dynamic } = collectFromAddresses(scanFiles(srcDir));
+		for (const a of addresses) {
+			const domain = a.split("@")[1];
+			if (domain && !candidates.some((c) => c.address === a)) candidates.push({
+				address: a,
+				domain,
+				source: "scan"
+			});
+		}
+		for (const d of dynamic) dynamicNotes.push(`! ${d.file}:${d.line}: from is computed (\`${d.expr}\`) — not checked`);
+	}
+	return {
+		candidates,
+		dynamicNotes
+	};
+}
+/** Observe each candidate domain's zone, keyed by the domain itself (not the zone name). */
+async function observeZones(token, domains) {
+	const states = /* @__PURE__ */ new Map();
+	const failures = [];
+	if (!token) return {
+		states,
+		failures
+	};
+	for (const domain of domains) {
+		const zone = await findZoneForHost(token, domain);
+		if (!zone.ok || !zone.zoneId) {
+			failures.push(`${domain}: ${zone.message}`);
+			continue;
+		}
+		const res = await listSendingSubdomains(token, zone.zoneId);
+		if (!res.ok) {
+			failures.push(`${domain}: ${res.message}`);
+			continue;
+		}
+		states.set(domain, {
+			zoneId: zone.zoneId,
+			subdomains: res.subdomains
+		});
+	}
+	return {
+		states,
+		failures
+	};
+}
+async function confirm(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
+		return answer === "y" || answer === "yes";
+	} finally {
+		rl.close();
+	}
+}
+/**
+* Onboard a `from` domain and wait for its DNS to resolve.
+*
+* Idempotent by construction — a re-run of a fully-onboarded domain is all
+* skips. `--dry` prints the plan and mutates nothing (and needs no credential,
+* planning from scratch); `--check` reports drift and exits non-zero.
+*/
+async function cmdEmailSetup(argv) {
+	const a = parse$1(argv, {
+		...SITE_OPTS,
+		src: {
+			type: "string",
+			default: "src"
+		},
+		dry: {
+			type: "boolean",
+			default: false
+		},
+		check: {
+			type: "boolean",
+			default: false
+		},
+		"no-prompt": {
+			type: "boolean",
+			default: false
+		},
+		timeout: {
+			type: "string",
+			default: "5"
+		}
+	}, true);
+	const cfg = await loadConfig(a.path("input"), a.str("site-env"));
+	const explicitDomain = a.positionals[0];
+	const dry = a.flag("dry");
+	const check = a.flag("check");
+	const { candidates, dynamicNotes } = explicitDomain ? {
+		candidates: [{
+			address: `noreply@${explicitDomain}`,
+			domain: explicitDomain,
+			source: "config"
+		}],
+		dynamicNotes: []
+	} : gatherCandidates(cfg, a.path("src"));
+	if (candidates.length === 0) fail("no from domain to check — set site.notifications.email.from or site.domains.canonical, or pass a domain: vitops email setup <domain>");
+	const cfToken = loadCloudflareToken();
+	if (!cfToken && !dry) fail(CLOUDFLARE_TOKEN_HINT);
+	const { states, failures } = await observeZones(cfToken, [...new Set(candidates.map((c) => c.domain))]);
+	const emailPlan = planSendingDomains({
+		candidates,
+		provider: "cloudflare"
+	}, states);
+	if (dry || check) {
+		console.log(formatPlan$5(emailPlan));
+		for (const n of dynamicNotes) console.log(n);
+		for (const f of failures) console.error(`! ${f}`);
+		if (check && hasDrift$2(emailPlan)) {
+			console.error("\n✖ a from domain is not fully onboarded");
+			process.exit(1);
+		}
+		return;
+	}
+	const interactive = !a.flag("no-prompt") && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+	const timeoutMs = Number(a.str("timeout")) * 1e3;
+	const results = [];
+	let failed = false;
+	for (const d of emailPlan.domains) {
+		if (d.onboard.action === "skip") {
+			results.push({
+				domain: d.domain,
+				onboard: "present",
+				reminders: []
+			});
+			continue;
+		}
+		if (d.onboard.action === "blocked") {
+			console.error(`? ${d.domain}: ${d.onboard.detail}`);
+			results.push({
+				domain: d.domain,
+				onboard: "blocked",
+				reminders: []
+			});
+			failed = true;
+			continue;
+		}
+		console.log(`\n${d.domain}: ${d.onboard.detail}`);
+		if (interactive && !await confirm(`Enable Email Sending for "${d.domain}"?`)) {
+			results.push({
+				domain: d.domain,
+				onboard: "blocked",
+				reminders: ["skipped by operator"]
+			});
+			continue;
+		}
+		const zone = await findZoneForHost(cfToken, d.domain);
+		if (!zone.ok || !zone.zoneId) {
+			console.error(`✖ ${d.domain}: ${zone.message}`);
+			results.push({
+				domain: d.domain,
+				onboard: "failed",
+				reminders: []
+			});
+			failed = true;
+			continue;
+		}
+		const enabled = await enableSending(cfToken, zone.zoneId, d.domain);
+		if (!enabled.ok) {
+			console.error(`✖ ${d.domain}: ${enabled.message}`);
+			results.push({
+				domain: d.domain,
+				onboard: "failed",
+				reminders: []
+			});
+			failed = true;
+			continue;
+		}
+		console.log(`✓ ${d.domain}: enabled`);
+		const reminders = [];
+		if (enabled.tag) {
+			const dns = await sendingDns(cfToken, zone.zoneId, enabled.tag);
+			const expected = dns.records.filter((r) => r.type === "TXT");
+			if (dns.ok && expected.length) {
+				const schedule = backoffSchedule$1();
+				let pending = expected;
+				for (let attempt = 0; attempt < schedule.length && pending.length; attempt++) {
+					await sleep(Math.min(schedule[attempt], timeoutMs));
+					const resolved = /* @__PURE__ */ new Map();
+					for (const name of new Set(pending.map((r) => r.name))) {
+						const r = await resolveTxt(name);
+						if (r.ok) resolved.set(name, r.contents);
+					}
+					pending = dnsStatus(pending, resolved).filter((s) => !s.present).map((s) => s.record);
+					console.log(`  DNS: ${expected.length - pending.length}/${expected.length} records resolving (attempt ${attempt + 1}/${schedule.length})`);
+				}
+				if (pending.length) reminders.push(`${pending.length} DNS record(s) not yet resolving — check again shortly.`);
+			}
+		}
+		results.push({
+			domain: d.domain,
+			onboard: "created",
+			reminders
+		});
+	}
+	console.log(`\n${formatSummary$2(results)}`);
+	for (const n of dynamicNotes) console.log(n);
+	for (const f of failures) console.error(`! ${f}`);
+	if (failed) process.exit(1);
+}
+/**
+* The non-blocking deploy guard: warn when a `from` domain isn't onboarded,
+* exit 0 by default. `--strict` makes it a real gate.
+*
+* Runs with no credential too — it then reports "not checked", exits 0, and a
+* CI job with no CLOUDFLARE_API_TOKEN never fails on the check itself.
+*/
+async function cmdEmailCheck(argv) {
+	const a = parse$1(argv, {
+		...SITE_OPTS,
+		src: {
+			type: "string",
+			default: "src"
+		},
+		strict: {
+			type: "boolean",
+			default: false
+		},
+		skip: {
+			type: "boolean",
+			default: false
+		}
+	});
+	if (a.flag("skip") || process.env["VITOPS_SKIP_EMAIL_CHECK"]) {
+		console.log("· vitops email check: skipped (--skip / VITOPS_SKIP_EMAIL_CHECK)");
+		return;
+	}
+	const cfg = await siteConfig(a);
+	const emailCfg = cfg.site.notifications?.email;
+	if (typeof emailCfg === "object" && emailCfg.verifySender === false) {
+		console.log("· vitops email check: skipped (site.notifications.email.verifySender is false)");
+		return;
+	}
+	const { candidates, dynamicNotes } = gatherCandidates(cfg, a.path("src"));
+	if (candidates.length === 0) {
+		console.log("· no from domain configured — nothing to check");
+		return;
+	}
+	const cfToken = loadCloudflareToken();
+	if (!cfToken) {
+		console.log("· vitops email check: not checked — no CLOUDFLARE_API_TOKEN");
+		return;
+	}
+	const { states, failures } = await observeZones(cfToken, [...new Set(candidates.map((c) => c.domain))]);
+	const emailPlan = planSendingDomains({
+		candidates,
+		provider: "cloudflare"
+	}, states);
+	for (const n of dynamicNotes) console.log(n);
+	for (const f of failures) console.error(`! ${f}`);
+	const blocked = blockedDomains(emailPlan);
+	if (blocked.length === 0) {
+		console.log(`✓ every from domain is onboarded`);
+		return;
+	}
+	for (const b of blocked) console.error(`! ${b.domain}: ${b.onboard.detail}`);
+	if (a.flag("strict")) {
+		console.error("\n✖ a from domain is not onboarded (--strict)");
+		process.exit(1);
+	}
+}
+async function cmdEmail(argv) {
+	const [sub, ...rest] = argv;
+	switch (sub) {
+		case "setup": return cmdEmailSetup(rest);
+		case "check": return cmdEmailCheck(rest);
+		case void 0:
+		case "-h":
+		case "--help":
+			console.log(EMAIL_HELP);
+			return;
+		default: fail(`unknown "email" subcommand "${sub}" (expected: setup | check). Try: vitops --help`);
+	}
+}
+
+//#endregion
+//#region src/commands/setup.ts
+/**
+* `vitops setup` — the scripted path from an empty scaffold to a live site.
+* Subcommands: `repo | hosting | domain | search | ads | all`.
+*
+* Absorbs what each template's `scripts/init-{github,hosting}.mjs` used to do
+* template-locally, so the capability reaches every consumer, not just a fresh
+* `vp create` scaffold. `repo`/`hosting` follow the pure-planner/executor split in
+* `@getvitops/utils/hosting` — see that module's docblock. `search`/`ads` are not
+* reimplemented: this shells out to the CLI's own `search setup`/`ads setup`
+* subcommands as child processes, so their behaviour (prompting, `--dry`,
+* `--check`, writing the config patch back) stays exactly what it already is,
+* with no risk of the two copies drifting.
+*
+* `domain` only ever plans and checks the workers.dev-vs-custom-domain
+* consistency — it never touches `wrangler.jsonc` or deploys anything. Cutover
+* overwrites the zone's DNS record and can take an existing live site down; that
+* is a human's call, made in `SETUP.html`, not a step this command applies.
+*/
+const SETUP_HELP = `vitops setup <sub> [options]
+
+  vitops setup repo    [--dry] [--check] [--public]
+  vitops setup hosting [--dry] [--check] [--platform cloudflare|node]
+  vitops setup domain  [--dry] [--check] [--domain <apex>]
+  vitops setup search  [options]   (forwards to \`vitops search setup\`)
+  vitops setup ads     [options]   (forwards to \`vitops ads setup\`)
+  vitops setup all     [--dry] [--check] [--public] [--platform <p>]
+
+--dry prints the plan and stops. --check reports drift/blocked steps and exits
+non-zero, mutating nothing. Neither creates the Cloudflare API token or performs
+a custom-domain cutover — both are named as manual steps; see SETUP.html.`;
+function projectName() {
+	const path = resolve("package.json");
+	if (!existsSync(path)) fail("package.json not found — run this from the project root");
+	const pkg = JSON.parse(readFileSync(path, "utf8"));
+	if (!pkg.name) fail("package.json has no \"name\" field");
+	return pkg.name.replace(/^@[^/]+\//, "");
+}
+async function gatherHostingState(name, platform) {
+	const [wrangler, gh, origin] = await Promise.all([
+		platform === "cloudflare" ? wranglerWhoami() : Promise.resolve({ authed: false }),
+		ghAuthed(),
+		originRemote()
+	]);
+	const nwo = origin ? await repoNwo() : void 0;
+	const [branchesList, def, protectedMain, envs, secrets, d1Id, r2] = await Promise.all([
+		branches(),
+		nwo ? defaultBranch(nwo) : Promise.resolve(void 0),
+		nwo ? mainProtected(nwo) : Promise.resolve(false),
+		nwo ? environments(nwo) : Promise.resolve([]),
+		nwo ? secretsPresent(nwo) : Promise.resolve([]),
+		platform === "cloudflare" ? findD1(`${name}-dev`) : Promise.resolve(void 0),
+		platform === "cloudflare" ? findR2Bucket(`${name}-media-dev`) : Promise.resolve(false)
+	]);
+	return {
+		wranglerAuthed: wrangler.authed,
+		..."accountId" in wrangler && wrangler.accountId ? { accountId: wrangler.accountId } : {},
+		d1Present: Boolean(d1Id),
+		...d1Id ? { d1Id } : {},
+		r2Present: r2,
+		ghAuthed: gh,
+		...origin ? { originRemote: origin } : {},
+		...nwo ? { repoNwo: nwo } : {},
+		branches: branchesList,
+		...def ? { defaultBranch: def } : {},
+		mainProtected: protectedMain,
+		environments: envs,
+		secretsPresent: secrets
+	};
+}
+async function cmdSetupRepo(argv) {
+	const a = parse$1(argv, {
+		dry: {
+			type: "boolean",
+			default: false
+		},
+		check: {
+			type: "boolean",
+			default: false
+		},
+		public: {
+			type: "boolean",
+			default: false
+		},
+		platform: {
+			type: "string",
+			default: "cloudflare"
+		},
+		"no-dev-resources": {
+			type: "boolean",
+			default: false
+		}
+	});
+	const platform = a.str("platform");
+	if (platform !== "cloudflare" && platform !== "node") fail(`--platform "${platform}" must be cloudflare or node`);
+	const name = projectName();
+	const setup = {
+		platform,
+		projectName: name,
+		repoVisibility: a.flag("public") ? "public" : "private",
+		devResources: !a.flag("no-dev-resources")
+	};
+	const state = await gatherHostingState(name, setup.platform);
+	const p = plan$4(setup, state);
+	const dry = a.flag("dry");
+	const check = a.flag("check");
+	if (dry || check) {
+		console.log(formatPlan$6(p));
+		if (check && (p.repo.action !== "skip" || p.branches.action !== "skip" || p.defaultBranch.action !== "skip")) {
+			console.error("\n✖ repo/branch setup is not complete");
+			process.exit(1);
+		}
+		return;
+	}
+	const results = [];
+	if (p.repo.action === "create") {
+		const r = await createRepo(name, setup.repoVisibility);
+		results.push({
+			step: "repo",
+			status: r.ok ? "created" : "failed",
+			detail: r.ok ? name : r.message ?? "failed"
+		});
+		if (r.ok) {
+			const push = await pushBranches();
+			results.push({
+				step: "branches",
+				status: push.ok ? "created" : "failed",
+				detail: push.ok ? "main + dev pushed" : push.message ?? "failed"
+			});
+		}
+	} else results.push({
+		step: "repo",
+		status: "present",
+		detail: p.repo.detail
+	});
+	const nwo = state.repoNwo ?? await repoNwo();
+	if (nwo) {
+		if (p.defaultBranch.action !== "skip") {
+			const r = await setDefaultBranch(nwo, "dev");
+			results.push({
+				step: "default branch",
+				status: r.ok ? "updated" : "failed",
+				detail: r.ok ? "dev" : r.message ?? "failed"
+			});
+		} else results.push({
+			step: "default branch",
+			status: "present",
+			detail: "dev"
+		});
+		if (p.mainProtection.action === "blocked") {
+			const r = await protectMain(nwo);
+			results.push({
+				step: "main protection",
+				status: r.ok ? "created" : "blocked",
+				detail: r.ok ? "protected" : r.message ?? p.mainProtection.detail
+			});
+		} else results.push({
+			step: "main protection",
+			status: "present",
+			detail: p.mainProtection.detail
+		});
+		if (p.prodEnvironment.action === "blocked") {
+			const ids = await adminCollaboratorIds(nwo);
+			const r = await createProdEnvironment(nwo, ids);
+			results.push({
+				step: "production env",
+				status: r.ok ? "created" : "blocked",
+				detail: r.ok ? `${ids.length} reviewer(s)` : r.message ?? p.prodEnvironment.detail
+			});
+		} else results.push({
+			step: "production env",
+			status: "present",
+			detail: p.prodEnvironment.detail
+		});
+		if (p.devEnvironment.action === "create") {
+			const r = await createDevEnvironment(nwo);
+			results.push({
+				step: "dev env",
+				status: r.ok ? "created" : "failed",
+				detail: r.ok ? "no required reviewers" : r.message ?? "failed"
+			});
+		} else results.push({
+			step: "dev env",
+			status: "present",
+			detail: p.devEnvironment.detail
+		});
+	} else results.push({
+		step: "branch policy",
+		status: "blocked",
+		detail: "no GitHub repo yet — run this again once \"repo\" succeeds"
+	});
+	console.log(formatSummary$3(results));
+	if (results.some((r) => r.status === "failed")) process.exit(1);
+}
+async function cmdSetupHosting(argv) {
+	const a = parse$1(argv, {
+		dry: {
+			type: "boolean",
+			default: false
+		},
+		check: {
+			type: "boolean",
+			default: false
+		},
+		platform: {
+			type: "string",
+			default: "cloudflare"
+		},
+		"no-dev-resources": {
+			type: "boolean",
+			default: false
+		}
+	});
+	const platform = a.str("platform");
+	if (platform !== "cloudflare" && platform !== "node") fail(`--platform "${platform}" must be cloudflare or node`);
+	const name = projectName();
+	const setup = {
+		platform,
+		projectName: name,
+		repoVisibility: "private",
+		devResources: !a.flag("no-dev-resources")
+	};
+	const state = await gatherHostingState(name, platform);
+	const p = plan$4(setup, state);
+	const dry = a.flag("dry");
+	const check = a.flag("check");
+	if (platform === "node") {
+		console.log("Hosting target \"node\" has no cloud resources to provision — see the template README's \"Hosting\" section.");
+		return;
+	}
+	if (!state.wranglerAuthed && !dry) fail("wrangler is not logged in — run `npx wrangler login` first");
+	if (dry || check) {
+		console.log(formatPlan$6(p));
+		if (check && (p.d1.action !== "skip" || p.r2.action !== "skip")) {
+			console.error("\n✖ hosting resources are not fully provisioned");
+			process.exit(1);
+		}
+		return;
+	}
+	const results = [];
+	let d1Id = state.d1Id;
+	if (p.d1.action === "create") {
+		const r = await createD1(`${name}-dev`);
+		results.push({
+			step: "dev D1",
+			status: r.ok ? "created" : "failed",
+			detail: r.ok ? r.id ?? "" : r.message ?? "failed"
+		});
+		if (r.ok) d1Id = r.id;
+	} else results.push({
+		step: "dev D1",
+		status: "present",
+		detail: p.d1.detail
+	});
+	if (p.r2.action === "create") {
+		const r = await createR2Bucket(`${name}-media-dev`);
+		results.push({
+			step: "dev R2",
+			status: r.ok ? "created" : "failed",
+			detail: r.ok ? `${name}-media-dev` : r.message ?? "failed"
+		});
+	} else results.push({
+		step: "dev R2",
+		status: "present",
+		detail: p.r2.detail
+	});
+	if ((state.repoNwo ?? await repoNwo()) && state.ghAuthed) {
+		if (d1Id && !state.secretsPresent.includes("DEV_D1_ID")) {
+			const r = await setSecret("DEV_D1_ID", d1Id);
+			results.push({
+				step: "secret DEV_D1_ID",
+				status: r.ok ? "created" : "failed",
+				detail: r.ok ? "set" : r.message ?? "failed"
+			});
+		} else results.push({
+			step: "secret DEV_D1_ID",
+			status: state.secretsPresent.includes("DEV_D1_ID") ? "present" : "blocked",
+			detail: d1Id ?? "D1 id unknown"
+		});
+		if (state.accountId && !state.secretsPresent.includes("CLOUDFLARE_ACCOUNT_ID")) {
+			const r = await setSecret("CLOUDFLARE_ACCOUNT_ID", state.accountId);
+			results.push({
+				step: "secret CLOUDFLARE_ACCOUNT_ID",
+				status: r.ok ? "created" : "failed",
+				detail: r.ok ? "set" : r.message ?? "failed"
+			});
+		} else results.push({
+			step: "secret CLOUDFLARE_ACCOUNT_ID",
+			status: state.secretsPresent.includes("CLOUDFLARE_ACCOUNT_ID") ? "present" : "blocked",
+			detail: state.accountId ?? "unknown"
+		});
+	} else results.push({
+		step: "secrets",
+		status: "blocked",
+		detail: "no GitHub repo wired up yet — run `vitops setup repo` first"
+	});
+	results.push({
+		step: "secret CLOUDFLARE_API_TOKEN",
+		status: "blocked",
+		detail: p.secrets["CLOUDFLARE_API_TOKEN"]?.detail ?? "create it by hand"
+	});
+	console.log(formatSummary$3(results));
+	for (const n of p.notes) console.log(`! ${n}`);
+	if (results.some((r) => r.status === "failed")) process.exit(1);
+}
+async function cmdSetupDomain(argv) {
+	const a = parse$1(argv, {
+		...SITE_OPTS,
+		dry: {
+			type: "boolean",
+			default: false
+		},
+		check: {
+			type: "boolean",
+			default: false
+		},
+		domain: { type: "string" }
+	});
+	const wranglerPath = resolve("wrangler.jsonc");
+	if (!existsSync(wranglerPath)) fail("wrangler.jsonc not found — run this from the project root");
+	const raw = readFileSync(wranglerPath, "utf8");
+	const customDomainMatch = /^\s*"routes":\s*\[\s*\{\s*"pattern":\s*"([^"]+)"/m.exec(raw.split("\n").filter((l) => !l.trim().startsWith("//")).join("\n"));
+	const customDomain = customDomainMatch?.[1] ?? (a.opt("domain") ? void 0 : void 0);
+	const cfg = await loadConfig(a.path("input"), a.str("site-env"));
+	const env = cfg.site.environments[a.str("site-env")] ?? cfg.site.environments["production"];
+	const state = {
+		wranglerDev: !raw.includes("\"routes\"") || Boolean(customDomainMatch) === false,
+		...customDomain ? { customDomain } : {},
+		...env?.url ? { configuredUrl: env.url } : {},
+		...cfg.site.domains?.canonical ? { canonical: cfg.site.domains.canonical } : {},
+		...env?.robots ? { robots: env.robots } : {}
+	};
+	const step = planDomainConsistency(state);
+	console.log(`${step.action === "skip" ? "·" : "?"} domain consistency  ${step.detail}`);
+	if (a.opt("domain")) console.log(`\nCutover is never applied by this command — see SETUP.html stage 4b. To cut over: uncomment routes in wrangler.jsonc with "pattern": "${a.opt("domain")}", deploy, then update site.domains.canonical and site.environments.${a.str("site-env")}.url to match.`);
+	if (a.flag("check") && step.action !== "skip") process.exit(1);
+}
+/** Forward to the CLI's own `search setup` / `ads setup` as a child process — see
+* this module's docblock for why (their behaviour must not be re-derived). */
+function forward(sub, argv) {
+	try {
+		execFileSync(process.execPath, [
+			process.argv[1],
+			sub,
+			"setup",
+			...argv
+		], { stdio: "inherit" });
+		return true;
+	} catch (err) {
+		if (err.status != null) return false;
+		fail(msg(err));
+	}
+}
+async function cmdSetup(argv) {
+	const [sub, ...rest] = argv;
+	switch (sub) {
+		case "repo": return cmdSetupRepo(rest);
+		case "hosting": return cmdSetupHosting(rest);
+		case "domain": return cmdSetupDomain(rest);
+		case "search":
+			if (!forward("search", rest)) process.exit(1);
+			return;
+		case "ads":
+			if (!forward("ads", rest)) process.exit(1);
+			return;
+		case "all": {
+			const a = parse$1(rest, {
+				dry: {
+					type: "boolean",
+					default: false
+				},
+				check: {
+					type: "boolean",
+					default: false
+				},
+				public: {
+					type: "boolean",
+					default: false
+				},
+				platform: {
+					type: "string",
+					default: "cloudflare"
+				},
+				"no-dev-resources": {
+					type: "boolean",
+					default: false
+				}
+			});
+			const dryCheckFlags = [...a.flag("dry") ? ["--dry"] : [], ...a.flag("check") ? ["--check"] : []];
+			const hostingFlags = [
+				...dryCheckFlags,
+				"--platform",
+				a.str("platform"),
+				...a.flag("no-dev-resources") ? ["--no-dev-resources"] : []
+			];
+			console.log("── repo ──");
+			await cmdSetupRepo([...hostingFlags, ...a.flag("public") ? ["--public"] : []]);
+			console.log("\n── hosting ──");
+			await cmdSetupHosting(hostingFlags);
+			console.log("\n── search ──");
+			const searchOk = forward("search", dryCheckFlags);
+			console.log("\n── ads ──");
+			const adsOk = forward("ads", dryCheckFlags);
+			if (!searchOk || !adsOk) process.exit(1);
+			return;
+		}
+		case void 0:
+		case "-h":
+		case "--help":
+			console.log(SETUP_HELP);
+			return;
+		default: fail(`unknown "setup" subcommand "${sub}" (expected: repo | hosting | domain | search | ads | all). Try: vitops --help`);
+	}
+}
+
 //#endregion
 //#region src/agents.ts
 /**
@@ -1951,7 +3059,7 @@ function lintCss(files, format) {
 * A consumer's markdown content can hold real markup, so this does give up a
 * little coverage; that is the right side to err on for a heuristic.
 */
-const MARKUP_EXT = new Set([
+const MARKUP_EXT = /* @__PURE__ */ new Set([
 	".astro",
 	".html",
 	".htm",
@@ -2397,6 +3505,8 @@ function lintSource(files, v, format) {
 *   vitops reviews   [--input <site.json>] [--location <key>] [--dry] [--check] [--out <dir>]
 *   vitops search    setup [--domain <name>] [--dry] [--check]  |  notify [--dry] [--all] [--check]
 *   vitops ads       setup [--provider <name>] [--dry] [--check]  |  tags  |  lint
+*   vitops setup     repo | hosting | domain | search | ads | all [--dry] [--check]
+*   vitops email     setup [domain] [--dry] [--check]  |  check [--strict] [--skip]
 *   vitops media     [--raw <dir>] [--out <dir>] [--force] [--dry]
 *
 * Thin wrapper over @getvitops/generator (generation) and @getvitops/utils (favicons).
@@ -2406,23 +3516,23 @@ function lintSource(files, v, format) {
 * command groups big enough, and self-contained enough, to earn their own file.
 * Everything else stays here.
 */
-const FORMATS = new Set([
+const FORMATS = /* @__PURE__ */ new Set([
 	"bricks",
 	"css",
 	"tailwind",
 	"design"
 ]);
-const LINT_FORMATS = new Set([
+const LINT_FORMATS = /* @__PURE__ */ new Set([
 	"bricks",
 	"css",
 	"tailwind"
 ]);
-const LEGAL_DOCS = new Set([
+const LEGAL_DOCS = /* @__PURE__ */ new Set([
 	"privacy",
 	"terms",
 	"cookies"
 ]);
-const LEGAL_OUTPUTS = new Set([
+const LEGAL_OUTPUTS = /* @__PURE__ */ new Set([
 	"md",
 	"html",
 	"portable-text"
@@ -2611,7 +3721,7 @@ async function cmdFavicon(argv) {
 		fail(msg(err));
 	}
 }
-const OUTPUT_KINDS = new Set([
+const OUTPUT_KINDS = /* @__PURE__ */ new Set([
 	"webm",
 	"mp4",
 	"poster"
@@ -2908,7 +4018,8 @@ async function cmdRobots(argv) {
 		}
 	});
 	const siteEnv = a.str("site-env");
-	const content = renderRobotsTxt(await loadConfig(a.path("input"), siteEnv), { env: siteEnv });
+	const site = await loadConfig(a.path("input"), siteEnv);
+	const content = renderRobotsTxt(site, { env: siteEnv });
 	if (!a.opt("out")) {
 		process.stdout.write(content);
 		return;
@@ -3040,7 +4151,8 @@ function cliVersion() {
 	}
 }
 function generatorAssetsDir() {
-	return join(dirname(createRequire(import.meta.url).resolve("@getvitops/generator/package.json")), "assets");
+	const pkg = createRequire(import.meta.url).resolve("@getvitops/generator/package.json");
+	return join(dirname(pkg), "assets");
 }
 const AGENTS_START = "<!-- vitops:start -->";
 const AGENTS_END = "<!-- vitops:end -->";
@@ -3069,7 +4181,8 @@ function cmdDocs(argv) {
 		return;
 	}
 	if (topic && !TOPICS[topic]) fail(`unknown topic "${topic}". Valid topics:\n${topicList()}`);
-	const docs = generateDocs(loadDesignSystem(resolve(values.input), values.theme), generatorAssetsDir());
+	const ds = loadDesignSystem(resolve(values.input), values.theme);
+	const docs = generateDocs(ds, generatorAssetsDir());
 	const paths = values.all ? Object.values(TOPICS).map((t) => t.path) : [TOPICS[topic].path];
 	process.stdout.write(paths.map((p) => docs[p]).join("\n"));
 }
@@ -3116,7 +4229,7 @@ function cmdLint(argv) {
 		"icon",
 		"border"
 	]).map((u) => u.cls);
-	const LINTABLE = new Set([
+	const LINTABLE = /* @__PURE__ */ new Set([
 		".astro",
 		".html",
 		".js",
@@ -3349,6 +4462,9 @@ async function main() {
 		case "icons": return cmdIcons(rest);
 		case "search": return cmdSearch(rest);
 		case "ads": return cmdAds(rest);
+		case "crm": return cmdCrm(rest);
+		case "email": return cmdEmail(rest);
+		case "setup": return cmdSetup(rest);
 		case "media": return cmdMedia(rest);
 		default: fail(`unknown command "${command}" (expected: ${COMMANDS.join(" | ")}). Try: vitops --help`);
 	}