@getvitops/config 0.0.0-stage → 8.2.0

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# @getvitops/config
+
+## 8.2.0
+
+### Minor Changes
+
+- 89265af: **New package: `@getvitops/config`** — the site-config provider blocks (`site.crm`, `site.ads`,
+  `site.reviews`, `site.seo.indexing`, `site.searchConsole`, `site.notifications`, `site.tracking`,
+  `site.security`, `site.deployment`) as zod schemas and inferred types, with the closed provider lists
+  (`AD_PROVIDERS`, `CRM_PROVIDERS`, `BIGIN_DATA_CENTERS`) on a zod-free `./providers` entry. It joins the
+  `fixed` group.
+
+  Why: `@getvitops/utils` holds the provider code but could not import its configuration types — the schema
+  lived in `@getvitops/generator`, a layer above — so it kept a hand-copied mirror beside each module,
+  an adapter converting into it, and a test holding the copy to the schema. The mirrors are gone.
+
+  - **`@getvitops/generator`**: `AD_PROVIDERS`, `CRM_PROVIDERS`, `BIGIN_DATA_CENTERS`, `AdProvider` and
+    `CrmProviderConfig` are re-exported unchanged. No import path changes.
+  - **`@getvitops/utils`**: the config types in `./crm`, `./ads`, `./indexing`, `./onboarding`, `./reviews`,
+    `./tracking` and `./notify` (`CrmConfig`, `HubSpotConfig`, `BiginConfig`, `JobberConfig`,
+    `IndexNowConfig`, `SearchConsoleConfig`, `ReviewsConfig`, `ReviewLocationConfig`, `TrackingConfig`,
+    `NotificationsConfig`, `EmailChannelConfig`, `DomainSetup`, `AdPropertySetup`) are now inferred from the
+    schema. Same names, same fields, but **optional fields now follow zod's inference**, so a hand-written
+    object literal typed against them may need `| undefined` handled. `AdPropertySetup` gains the fields the
+    schema always had (`conversionActionId`, `reporting`).
+  - **`@getvitops/astro`**: `GetvitopsAdProperty` and `GetvitopsTrackingOptions` are aliases of the schema
+    types. `toCrmConfig()` and `toGoogleAdsConfig()` are **deprecated** — they returned their argument's
+    field unchanged; pass `config.site.crm` / `config.site.ads?.google` directly.
+  - **`@getvitops/cli`**: `vitops ads` now passes `conversionActionId` and `reporting` through to the planner;
+    it previously copied a hand-picked subset of the block and dropped them.
+
+  Formats reached: none — no CSS change.
+
+- 7fd5f8f: **`site.seo` is now the single source of site-level SEO defaults** (ADR-0002). Until now `site.seo`
+  declared `titleTemplate`, verification tokens, `openGraph` and `twitter` that nothing read, while
+  `<Seo />` took a second, differently-shaped vocabulary through `vitops({ seo })` that no other stack
+  could see.
+
+  - `SeoSchema` moves to `@getvitops/config` and gains what only the integration had: `siteName`,
+    `defaultTitle`, `defaultDescription`, `openGraph.localeAlternates` and `openGraph.image` as
+    `{ src, alt, width, height, type }`. Text fields are localisable.
+  - `@getvitops/astro` exports `resolveSeoDefaults(config, { locale, env })`. The integration reads
+    `site.seo` from the site config it already loads; `siteName` falls back to `organization.name`, and
+    the environment's `robots` wins over `site.seo.robots`, the same fact `vitops robots` and
+    `search notify` read.
+  - `vitops({ seo })` keeps working unchanged and is now an **override** merged over the config, field by
+    field (`openGraph` and `twitter` merge key by key).
+  - **Removed from the config schema** (nothing read them): `descriptionTemplate` → use
+    `defaultDescription`; `openGraph.siteName`/`title`/`description` and
+    `twitter.title`/`description`/`image` → set per page on `<Seo />`, or the site-wide values above.
+    A config that still carries one now fails `vitops validate` with an unrecognised-key error.
+  - `openGraph.type` is now `website | article | profile`.

package/README.md

@@ -1,3 +1,13 @@
-# Temporary Holding Version
+# @getvitops/config
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The site-config blocks the Vitops toolchain's provider integrations read — CRM, ads, reviews,
+indexing, notifications, tracking — as [`@zod/mini`](https://zod.dev) schemas and inferred types.
+
+```ts
+import { CrmSchema, type CrmConfig } from '@getvitops/config';
+import { AD_PROVIDERS } from '@getvitops/config/providers'; // bare literals, no zod
+```
+
+A leaf package: it imports `@zod/mini` and nothing else in the workspace. The umbrella `Config`
+(`designSystem` / `organization` / `site`) lives in `@getvitops/generator`, which composes these blocks.
+See the repo's `adr/0001-site-config-and-providers-packages.md`.

package/dist/index.d.mts

@@ -0,0 +1,339 @@
+import { AD_PROVIDERS, AdProvider, BIGIN_DATA_CENTERS, CRM_PROVIDERS, CrmProviderConfig } from "./providers.mjs";
+import * as z from "@zod/mini";
+/** Attach a human description to a schema; it becomes the JSON Schema `description` editors show as a hover. */
+export declare const desc: <T extends {
+  check(...checks: never[]): T;
+}>(schema: T, text: string) => T;
+/**
+ * One domain to onboard into Google Search Console via `vitops search setup`.
+ *
+ * The verification token is fetched live from the Site Verification API at run
+ * time and written to DNS — it is never stored here. What the config records is
+ * the *intent*: which domains to onboard, and who should co-own them.
+ */
+export declare const SearchConsoleSetupSchema: z.ZodMiniObject<{
+  delegatedOwners: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniEmail>>;
+  fullUserGroup: z.ZodMiniOptional<z.ZodMiniEmail>;
+}, z.core.$strict>;
+/**
+ * What `vitops search notify` needs to tell search engines a deploy happened.
+ *
+ * Scoped by what search engines actually accept, which is narrower than it looks:
+ * Google exposes **no** "request indexing" API (the Search Console button is not in
+ * its API, and URL Inspection is read-only), and it removed the sitemap ping
+ * endpoint in 2023. So the sanctioned set is: an accurate sitemap, a Search Console
+ * sitemap resubmit, an IndexNow ping — which Google does *not* honour but Bing,
+ * Yandex, Naver, Seznam and Yep do — and a read-only inspection pass to find out
+ * what Google actually did.
+ *
+ * Facts only, the same rule the legal block follows: this records what the site has
+ * (a key, a property, which pages matter), never what to say about it.
+ */
+export declare const IndexNowSchema: z.ZodMiniObject<{
+  key: z.ZodMiniString<string>;
+  keyLocation: z.ZodMiniOptional<z.ZodMiniURL>;
+  endpoint: z.ZodMiniOptional<z.ZodMiniURL>;
+}, z.core.$strict>;
+export declare const SearchConsoleSchema: z.ZodMiniObject<{
+  siteUrl: z.ZodMiniString<string>;
+  resubmitSitemap: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strict>;
+export declare const IndexingSchema: z.ZodMiniObject<{
+  sitemapUrl: z.ZodMiniOptional<z.ZodMiniURL>;
+  indexNow: z.ZodMiniOptional<z.ZodMiniObject<{
+    key: z.ZodMiniString<string>;
+    keyLocation: z.ZodMiniOptional<z.ZodMiniURL>;
+    endpoint: z.ZodMiniOptional<z.ZodMiniURL>;
+  }, z.core.$strict>>;
+  searchConsole: z.ZodMiniOptional<z.ZodMiniObject<{
+    siteUrl: z.ZodMiniString<string>;
+    resubmitSitemap: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  }, z.core.$strict>>;
+  priorityUrls: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniURL>>;
+}, z.core.$strict>;
+export type IndexNowConfig = z.infer<typeof IndexNowSchema>;
+export type SearchConsoleConfig = z.infer<typeof SearchConsoleSchema>;
+export type IndexingConfig = z.infer<typeof IndexingSchema>;
+export type SearchConsoleSetupConfig = z.infer<typeof SearchConsoleSetupSchema>;
+export declare const AdProviderSchema: z.ZodMiniEnum<{
+  google: "google";
+  meta: "meta";
+  linkedin: "linkedin";
+  reddit: "reddit";
+  tiktok: "tiktok";
+  microsoft: "microsoft";
+  pinterest: "pinterest";
+  snapchat: "snapchat";
+}>;
+/**
+ * One ad property this site is linked to.
+ *
+ * Facts, not prose — the same rule the legal block follows. This records *which*
+ * account and *which* tag id, and the platform capability table decides what can be
+ * done about them. It is also what finally lets the rest of the toolchain see an ad
+ * pixel: the generated cookie notice discloses its cookies, `vitops ads lint`
+ * checks its click ID is captured, and the consent gate is handed the cookie names
+ * to clear on revoke. A pixel pasted into a template is invisible to all three.
+ */
+export declare const AdPropertySchema: z.ZodMiniObject<{
+  accountId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  pixelId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  conversionLabel: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniObject<{
+    call: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    email: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    form: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  }, z.core.$strict>]>>;
+  conversionActionId: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniObject<{
+    call: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    email: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    form: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  }, z.core.$strict>]>>;
+  reporting: z.ZodMiniOptional<z.ZodMiniEnum<{
+    client: "client";
+    server: "server";
+  }>>;
+  domain: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  domainVerification: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  category: z.ZodMiniOptional<z.ZodMiniEnum<{
+    marketing: "marketing";
+    analytics: "analytics";
+  }>>;
+  enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strict>;
+export type AdPropertyConfig = z.infer<typeof AdPropertySchema>;
+/**
+ * How one location's Google reviews are selected and ordered for display.
+ *
+ * Keyed by `organization.locations` key, mirroring `site.ads`/`site.searchConsole`
+ * — `vitops reviews` needs to know which physical location a fetched review set
+ * belongs to, and that record already exists.
+ */
+export declare const ReviewLocationSchema: z.ZodMiniObject<{
+  accountId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  locationId: z.ZodMiniString<string>;
+  featured: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+  minRating: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+  limit: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+  sort: z.ZodMiniOptional<z.ZodMiniEnum<{
+    recent: "recent";
+    rating: "rating";
+  }>>;
+}, z.core.$strict>;
+export declare const ReviewsSchema: z.ZodMiniObject<{
+  accountId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  locations: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
+    accountId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    locationId: z.ZodMiniString<string>;
+    featured: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+    minRating: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+    limit: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+    sort: z.ZodMiniOptional<z.ZodMiniEnum<{
+      recent: "recent";
+      rating: "rating";
+    }>>;
+  }, z.core.$strict>>;
+  schema: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  avatars: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strict>;
+export type ReviewsConfig = z.infer<typeof ReviewsSchema>;
+export type ReviewLocationConfig = z.infer<typeof ReviewLocationSchema>;
+export declare const CrmProviderSchema: z.ZodMiniEnum<{
+  hubspot: "hubspot";
+  bigin: "bigin";
+  jobber: "jobber";
+}>;
+export declare const HubSpotConfigSchema: z.ZodMiniObject<{
+  portalId: z.ZodMiniString<string>;
+  formGuid: z.ZodMiniString<string>;
+  dataCenter: z.ZodMiniOptional<z.ZodMiniEnum<{
+    eu: "eu";
+    na: "na";
+  }>>;
+}, z.core.$strict>;
+export declare const BiginPipelineConfigSchema: z.ZodMiniObject<{
+  enabled: z.ZodMiniBoolean<boolean>;
+  subPipeline: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  stage: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strict>;
+export declare const BiginConfigSchema: z.ZodMiniObject<{
+  dataCenter: z.ZodMiniEnum<{
+    com: "com";
+    ca: "ca";
+    eu: "eu";
+    in: "in";
+    "com.au": "com.au";
+    jp: "jp";
+  }>;
+  duplicateCheckField: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  pipeline: z.ZodMiniOptional<z.ZodMiniObject<{
+    enabled: z.ZodMiniBoolean<boolean>;
+    subPipeline: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    stage: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const JobberNoteConfigSchema: z.ZodMiniObject<{
+  enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strict>;
+export declare const JobberConfigSchema: z.ZodMiniObject<{
+  apiVersion: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  dedupe: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  note: z.ZodMiniOptional<z.ZodMiniObject<{
+    enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * A client's CRM, wired to the same conversion route `site.notifications`
+ * already reaches — see AGENTS.md's "CRM submissions" section for why this is
+ * server-side-only and hung off `createConversionRoute()` rather than a
+ * client-side embed. Credentials never live here — the toolchain has no
+ * secret store, matching every other integration.
+ */
+export declare const CrmSchema: z.ZodMiniObject<{
+  provider: z.ZodMiniEnum<{
+    hubspot: "hubspot";
+    bigin: "bigin";
+    jobber: "jobber";
+  }>;
+  enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  hubspot: z.ZodMiniOptional<z.ZodMiniObject<{
+    portalId: z.ZodMiniString<string>;
+    formGuid: z.ZodMiniString<string>;
+    dataCenter: z.ZodMiniOptional<z.ZodMiniEnum<{
+      eu: "eu";
+      na: "na";
+    }>>;
+  }, z.core.$strict>>;
+  bigin: z.ZodMiniOptional<z.ZodMiniObject<{
+    dataCenter: z.ZodMiniEnum<{
+      com: "com";
+      ca: "ca";
+      eu: "eu";
+      in: "in";
+      "com.au": "com.au";
+      jp: "jp";
+    }>;
+    duplicateCheckField: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    pipeline: z.ZodMiniOptional<z.ZodMiniObject<{
+      enabled: z.ZodMiniBoolean<boolean>;
+      subPipeline: z.ZodMiniOptional<z.ZodMiniString<string>>;
+      stage: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  jobber: z.ZodMiniOptional<z.ZodMiniObject<{
+    apiVersion: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    dedupe: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+    note: z.ZodMiniOptional<z.ZodMiniObject<{
+      enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  fieldMap: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>>;
+  trackingFields: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>>;
+}, z.core.$strict>;
+export type CrmConfig = z.infer<typeof CrmSchema>;
+export type HubSpotConfig = z.infer<typeof HubSpotConfigSchema>;
+export type BiginConfig = z.infer<typeof BiginConfigSchema>;
+export type BiginPipelineConfig = z.infer<typeof BiginPipelineConfigSchema>;
+export type JobberConfig = z.infer<typeof JobberConfigSchema>;
+/** `site.notifications` */
+export declare const NotificationsSchema: z.ZodMiniOptional<z.ZodMiniObject<{
+  email: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniEmail, z.ZodMiniObject<{
+    provider: z.ZodMiniLiteral<"cloudflare">;
+    to: z.ZodMiniOptional<z.ZodMiniEmail>;
+    from: z.ZodMiniOptional<z.ZodMiniEmail>;
+    fromName: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    replyTo: z.ZodMiniOptional<z.ZodMiniEmail>;
+    binding: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    verifySender: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  }, z.core.$strict>]>>;
+  actionUrl: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strict>>;
+/** `site.tracking` */
+export declare const TrackingSchema: z.ZodMiniOptional<z.ZodMiniObject<{
+  enabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+  category: z.ZodMiniOptional<z.ZodMiniEnum<{
+    marketing: "marketing";
+    analytics: "analytics";
+  }>>;
+  platforms: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+}, z.core.$strict>>;
+/** `site.security` */
+export declare const SecuritySchema: z.ZodMiniOptional<z.ZodMiniObject<{
+  turnstile: z.ZodMiniOptional<z.ZodMiniObject<{
+    siteKey: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>>;
+/** `site.deployment` */
+export declare const DeploymentSchema: z.ZodMiniOptional<z.ZodMiniObject<{
+  platform: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  buildCommand: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  deployCommand: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  outputDirectory: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  type: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  repo: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  branch: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strict>>;
+export type NotificationsConfig = NonNullable<z.infer<typeof NotificationsSchema>>;
+export type TrackingConfig = NonNullable<z.infer<typeof TrackingSchema>>;
+export type SecurityConfig = NonNullable<z.infer<typeof SecuritySchema>>;
+export type DeploymentConfig = NonNullable<z.infer<typeof DeploymentSchema>>;
+/** A string, or a per-locale map of strings (`{ en: "…", fr: "…" }`). */
+export declare const LocalizableSchema: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>]>;
+/**
+ * `site.seo` — the single source of site-level SEO defaults.
+ *
+ * Read by `<Seo />` (through `@getvitops/astro`'s `resolveSeoDefaults`), `vitops robots` and
+ * `vitops search notify`. Every display field here is consumed by `resolveSeoDefaults`;
+ * `seo-defaults.test.ts` fails when a field is added to this schema and not read, which is how
+ * four fields once sat here doing nothing (ADR-0002).
+ */
+export declare const SeoSchema: z.ZodMiniObject<{
+  siteName: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>]>>;
+  titleTemplate: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>]>>;
+  defaultTitle: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>]>>;
+  defaultDescription: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>]>>;
+  robots: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  googleSiteVerification: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  bingSiteVerification: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  openGraph: z.ZodMiniOptional<z.ZodMiniObject<{
+    type: z.ZodMiniOptional<z.ZodMiniEnum<{
+      website: "website";
+      article: "article";
+      profile: "profile";
+    }>>;
+    locale: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    localeAlternates: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+    image: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniObject<{
+      src: z.ZodMiniString<string>;
+      alt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+      width: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+      height: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+      type: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    }, z.core.$strict>]>>;
+  }, z.core.$strict>>;
+  twitter: z.ZodMiniOptional<z.ZodMiniObject<{
+    card: z.ZodMiniOptional<z.ZodMiniEnum<{
+      summary: "summary";
+      summary_large_image: "summary_large_image";
+      app: "app";
+      player: "player";
+    }>>;
+    site: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    creator: z.ZodMiniOptional<z.ZodMiniString<string>>;
+  }, z.core.$strict>>;
+  indexing: z.ZodMiniOptional<z.ZodMiniObject<{
+    sitemapUrl: z.ZodMiniOptional<z.ZodMiniURL>;
+    indexNow: z.ZodMiniOptional<z.ZodMiniObject<{
+      key: z.ZodMiniString<string>;
+      keyLocation: z.ZodMiniOptional<z.ZodMiniURL>;
+      endpoint: z.ZodMiniOptional<z.ZodMiniURL>;
+    }, z.core.$strict>>;
+    searchConsole: z.ZodMiniOptional<z.ZodMiniObject<{
+      siteUrl: z.ZodMiniString<string>;
+      resubmitSitemap: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+    }, z.core.$strict>>;
+    priorityUrls: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniURL>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SeoConfig = z.infer<typeof SeoSchema>;
+export { AD_PROVIDERS, AdProvider, BIGIN_DATA_CENTERS, CRM_PROVIDERS, CrmProviderConfig };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/desc.ts","../src/indexing.ts","../src/ads.ts","../src/reviews.ts","../src/crm.ts","../src/blocks.ts","../src/seo.ts"],"mappings":";;;qBAGa,OAAQ;EAAY,SAAS,kBAAkB;GAAK,QAAQ,GAAG,iBAAe;;;;;;;;qBCO9E,0BAAwB,EAAA;;;GASnC,EAAA,KAAA;;;;;;;;;;;;;;;qBAgBW,gBAAc,EAAA;;;;GAazB,EAAA,KAAA;qBAEW,qBAAmB,EAAA;;;GAS9B,EAAA,KAAA;qBAEW,gBAAc,EAAA;;;;;;;;;;;;GAiBzB,EAAA,KAAA;YAEU,iBAAiB,EAAE,aAAa;YAChC,sBAAsB,EAAE,aAAa;YACrC,iBAAiB,EAAE,aAAa;YAChC,2BAA2B,EAAE,aAAa;qBC/EzC,kBAAgB,EAAA;;;;;;;;;;;;;;;;;;;;qBAYhB,kBAAgB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;GAqE3B,EAAA,KAAA;YAEU,mBAAmB,EAAE,aAAa;;;;;;;;qBC7EjC,sBAAoB,EAAA;;;;;;;;;;GAmB/B,EAAA,KAAA;qBAEW,eAAa,EAAA;;;;;;;;;;;;;;;GAiBxB,EAAA,KAAA;YAEU,gBAAgB,EAAE,aAAa;YAC/B,uBAAuB,EAAE,aAAa;qBC/CrC,mBAAiB,EAAA;;;;;qBAEjB,qBAAmB,EAAA;;;;;;;GAO9B,EAAA,KAAA;qBAEW,2BAAyB,EAAA;;;;GAIpC,EAAA,KAAA;qBAEW,mBAAiB,EAAA;;;;;;;;;;;;;;;GAa5B,EAAA,KAAA;qBAEW,wBAAsB,EAAA;;GAKjC,EAAA,KAAA;qBAEW,oBAAkB,EAAA;;;;;;GAa7B,EAAA,KAAA;;;;;;;;qBASW,WAAS,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiBpB,EAAA,KAAA;YAEU,YAAY,EAAE,aAAa;YAC3B,gBAAgB,EAAE,aAAa;YAC/B,cAAc,EAAE,aAAa;YAC7B,sBAAsB,EAAE,aAAa;YACrC,eAAe,EAAE,aAAa;;qBCpF7B,qBAAmB,EAAA,gBAAA,EAAA;;;;;;;;;;;GA6C/B,EAAA,KAAA;;qBAGY,gBAAc,EAAA,gBAAA,EAAA;;;;;;;GAe1B,EAAA,KAAA;;qBAGY,gBAAc,EAAA,gBAAA,EAAA;;;;GAQ1B,EAAA,KAAA;;qBAGY,kBAAgB,EAAA,gBAAA,EAAA;;;;;;;;GAgB5B,EAAA,KAAA;YAEW,sBAAsB,YAAY,EAAE,aAAa;YACjD,iBAAiB,YAAY,EAAE,aAAa;YAC5C,iBAAiB,YAAY,EAAE,aAAa;YAC5C,mBAAmB,YAAY,EAAE,aAAa;;qBCjG7C,mBAAiB,EAAA,uBAAA,EAAA,uBAAA,EAAA,cAAA,EAAA,uBAAA,EAAA;;;;;;;;;qBA8BjB,WAAS,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DpB,EAAA,KAAA;YAEU,YAAY,EAAE,aAAa"}

package/dist/index.mjs

@@ -0,0 +1,234 @@
+import { AD_PROVIDERS, BIGIN_DATA_CENTERS, CRM_PROVIDERS } from "./providers.mjs";
+import * as z from "@zod/mini";
+
+// src/desc.ts
+/** Attach a human description to a schema; it becomes the JSON Schema `description` editors show as a hover. */
+const desc = (schema, text) => schema.check(z.describe(text));
+
+// src/indexing.ts
+/**
+* One domain to onboard into Google Search Console via `vitops search setup`.
+*
+* The verification token is fetched live from the Site Verification API at run
+* time and written to DNS — it is never stored here. What the config records is
+* the *intent*: which domains to onboard, and who should co-own them.
+*/
+const SearchConsoleSetupSchema = z.strictObject({
+	delegatedOwners: desc(z.optional(z.array(z.email())), "Emails added as verification owners on the Site Verification web resource. Automated via the API — additive and idempotent, never removes an existing owner."),
+	fullUserGroup: desc(z.optional(z.email()), "A Google Group to grant Full-User access in Search Console. SURFACED AS A REMINDER only: Search Console exposes no user/permission API, so this step stays manual by design.")
+});
+/**
+* What `vitops search notify` needs to tell search engines a deploy happened.
+*
+* Scoped by what search engines actually accept, which is narrower than it looks:
+* Google exposes **no** "request indexing" API (the Search Console button is not in
+* its API, and URL Inspection is read-only), and it removed the sitemap ping
+* endpoint in 2023. So the sanctioned set is: an accurate sitemap, a Search Console
+* sitemap resubmit, an IndexNow ping — which Google does *not* honour but Bing,
+* Yandex, Naver, Seznam and Yep do — and a read-only inspection pass to find out
+* what Google actually did.
+*
+* Facts only, the same rule the legal block follows: this records what the site has
+* (a key, a property, which pages matter), never what to say about it.
+*/
+const IndexNowSchema = z.strictObject({
+	key: desc(z.string().check(z.regex(/^[a-zA-Z0-9-]{8,128}$/)), "IndexNow key (8–128 chars, hex is conventional). NOT a secret — it is served publicly at `keyLocation` so the engine can verify you own the host. Generate one with `vitops search notify --new-key`."),
+	keyLocation: desc(z.optional(z.url()), "Absolute URL of the key file. Defaults to `<canonical>/<key>.txt`; set it only when the file lives elsewhere."),
+	endpoint: desc(z.optional(z.url()), "IndexNow endpoint (default `https://api.indexnow.org/indexnow`). Any participating engine shares submissions with the rest, so one is normally enough.")
+});
+const SearchConsoleSchema = z.strictObject({
+	siteUrl: desc(z.string(), "The property exactly as Search Console identifies it — `sc-domain:acme.ca` for a domain property, or the URL-prefix form `https://acme.ca/`. A mismatch here is a 403, not a \"not found\"."),
+	resubmitSitemap: desc(z.optional(z.boolean()), "Re-submit the sitemap through the Search Console API on each notify (default true when `searchConsole` is set). This is the automated equivalent of the manual resubmit in the UI.")
+});
+const IndexingSchema = z.strictObject({
+	sitemapUrl: desc(z.optional(z.url()), "The sitemap to submit and to diff for changed URLs. Defaults to `<canonical>/sitemap-index.xml`."),
+	indexNow: desc(z.optional(IndexNowSchema), "IndexNow submission (Bing, Yandex, Naver, Seznam, Yep — not Google). Omit to skip the channel."),
+	searchConsole: desc(z.optional(SearchConsoleSchema), "Google Search Console property. Needs a credential at run time — either a service account in `VITOPS_GSC_SERVICE_ACCOUNT` / `GOOGLE_APPLICATION_CREDENTIALS`, or the user OAuth credential `vitops search setup` uses (`VITOPS_GOOGLE_CLIENT_ID` / `_CLIENT_SECRET` / `_REFRESH_TOKEN`). The service account wins when both are set. Never put a key in this file."),
+	priorityUrls: desc(z.optional(z.array(z.url())), "The pages whose indexing actually matters. `vitops search notify --check` inspects these and exits non-zero if Google has not indexed one. Kept explicit because URL Inspection is quota-bound (2000/day), so checking every page is neither affordable nor informative.")
+});
+
+// src/ads.ts
+const AdProviderSchema = z.enum(AD_PROVIDERS);
+/**
+* One ad property this site is linked to.
+*
+* Facts, not prose — the same rule the legal block follows. This records *which*
+* account and *which* tag id, and the platform capability table decides what can be
+* done about them. It is also what finally lets the rest of the toolchain see an ad
+* pixel: the generated cookie notice discloses its cookies, `vitops ads lint`
+* checks its click ID is captured, and the consent gate is handed the cookie names
+* to clear on revoke. A pixel pasted into a template is invisible to all three.
+*/
+const AdPropertySchema = z.strictObject({
+	accountId: desc(z.optional(z.string()), "The advertising account as the platform shows it — Google Ads customer ID, Meta ad account, LinkedIn partner ID, Reddit advertiser ID. For LinkedIn this is also the Insight Tag id; everywhere else the tag id is `pixelId`."),
+	pixelId: desc(z.optional(z.string()), "The tag/pixel ID the browser snippet initialises — Meta pixel, TikTok pixel, Reddit pixel, Microsoft UET tag ID, Pinterest tag ID, Snap pixel, or the Google Ads conversion ID (`AW-…`, which is NOT the customer ID)."),
+	conversionLabel: desc(z.optional(z.union([z.string(), z.strictObject({
+		call: desc(z.optional(z.string()), "Fired on a tel: link click."),
+		email: desc(z.optional(z.string()), "Fired on a mailto: link click."),
+		form: desc(z.optional(z.string()), "Fired client-side by `vitopsFormConversion()` — the consumer's own submit handler calls it once a form POST succeeds.")
+	})])), "Google Ads only: the conversion action label(s) paired with the `AW-…` conversion ID — either one bare label (back-compat, treated as the `call` action) or a map of action → label, so a call, an email click and a form submission each fire their own Google Ads conversion action instead of all three reporting as the same one."),
+	conversionActionId: desc(z.optional(z.union([z.string(), z.strictObject({
+		call: desc(z.optional(z.string()), "Fired on a tel: link click."),
+		email: desc(z.optional(z.string()), "Fired on a mailto: link click."),
+		form: desc(z.optional(z.string()), "Fired on a form submission.")
+	})])), "Google Ads only: the conversion action **resource id(s)** (a numeric id, or a full `customers/…/conversionActions/…` resource name) used for server-side offline conversion upload — NOT the same value as `conversionLabel`, which is the opaque label the web tag uses and which the Ads API's upload endpoint does not accept. Only meaningful when `reporting: \"server\"`."),
+	reporting: desc(z.optional(z.enum(["client", "server"])), "Google Ads only: `\"client\"` (default) fires the conversion via `gtag.js` in the browser at click/submit time; `\"server\"` uploads it via the Ads API from the conversion endpoint instead (see `conversionActionId`). An action with no matching `conversionActionId` keeps firing client-side regardless of this setting, so setting it before `conversionActionId` is filled in never silently drops a conversion."),
+	domain: desc(z.optional(z.string()), "Bare hostname to verify with this platform. Defaults to the host of `domains.canonical` — set it only when the ad account is verified against a different domain."),
+	domainVerification: desc(z.optional(z.string()), "The verification token from the platform UI, for the platforms that verify by DNS TXT (Meta, TikTok, Pinterest, Snapchat). `vitops ads setup` prompts for it and writes it here on first run. NOT a secret — it is published in DNS, and the platform fetching it back is the ownership proof, exactly like the IndexNow key. A value containing `=` is used as the whole record, which is the escape hatch if a platform changes its prefix."),
+	category: desc(z.optional(z.enum(["marketing", "analytics"])), "Consent category the tag waits on (default `marketing`). An ad pixel is advertising by default; `analytics` is for a site using one purely for its own measurement."),
+	enabled: desc(z.optional(z.boolean()), "Set false to keep the property on record without emitting its tag.")
+});
+
+// src/reviews.ts
+/**
+* How one location's Google reviews are selected and ordered for display.
+*
+* Keyed by `organization.locations` key, mirroring `site.ads`/`site.searchConsole`
+* — `vitops reviews` needs to know which physical location a fetched review set
+* belongs to, and that record already exists.
+*/
+const ReviewLocationSchema = z.strictObject({
+	accountId: desc(z.optional(z.string()), "GBP account resource id (`accounts/…`), overriding `site.reviews.accountId` for this location."),
+	locationId: desc(z.string(), "GBP location resource id (`locations/…`) to fetch reviews for."),
+	featured: desc(z.optional(z.array(z.string())), "Review ids to always include, in this order, ahead of everything else automatically selected."),
+	minRating: desc(z.optional(z.number()), "Drop reviews below this star rating (default 4) from the automatic (non-featured) selection."),
+	limit: desc(z.optional(z.number()), "Keep at most this many reviews after filtering."),
+	sort: desc(z.optional(z.enum(["recent", "rating"])), "Ordering for the non-featured remainder (default `recent`).")
+});
+const ReviewsSchema = z.strictObject({
+	accountId: desc(z.optional(z.string()), "Default GBP account resource id (`accounts/…`) for locations that do not override it."),
+	locations: desc(z.record(z.string(), ReviewLocationSchema), "Which `organization.locations` to fetch Google reviews for, and how each one’s reviews are filtered/ordered. `vitops reviews` writes the result to `.vitops/reviews.json`."),
+	schema: desc(z.optional(z.boolean()), "Emit `Review` JSON-LD for these reviews (default false). Off by default: Google’s structured-data policy treats a business marking up reviews of itself as ineligible for review rich results, and risks a manual action."),
+	avatars: desc(z.optional(z.boolean()), "Render the reviewer’s Google-hosted avatar photo (default false). Off by default: every visitor would otherwise issue a third-party request to googleusercontent.com, and the URLs are not guaranteed to stay live.")
+});
+
+// src/crm.ts
+const CrmProviderSchema = z.enum(CRM_PROVIDERS);
+const HubSpotConfigSchema = z.strictObject({
+	portalId: desc(z.string(), "The HubSpot portal (hub) ID the form belongs to."),
+	formGuid: desc(z.string(), "The HubSpot form GUID to submit against."),
+	dataCenter: desc(z.optional(z.enum(["na", "eu"])), "Which regional submissions API to post to (default `na`).")
+});
+const BiginPipelineConfigSchema = z.strictObject({
+	enabled: desc(z.boolean(), "Also open a Pipelines record for the new/updated contact."),
+	subPipeline: desc(z.optional(z.string()), "Sub-pipeline to file the record under."),
+	stage: desc(z.optional(z.string()), "Starting stage for the pipeline record.")
+});
+const BiginConfigSchema = z.strictObject({
+	dataCenter: desc(z.enum(BIGIN_DATA_CENTERS), "The self-client's data centre — determines both the OAuth accounts host and the API host (`www.zohoapis.<dc>`)."),
+	duplicateCheckField: desc(z.optional(z.string()), "Bigin field the upsert dedupes on (default `Email`, Bigin's own unique field)."),
+	pipeline: desc(z.optional(BiginPipelineConfigSchema), "Also open a Pipelines record alongside the Contact.")
+});
+const JobberNoteConfigSchema = z.strictObject({ enabled: desc(z.optional(z.boolean()), "Attach a best-effort note carrying the message and unmapped attribution (default true). A failure here never loses the client record itself.") });
+const JobberConfigSchema = z.strictObject({
+	apiVersion: desc(z.optional(z.string()), "Override the pinned `X-JOBBER-GRAPHQL-VERSION` date this integration is tested against. An escape hatch for an app pinned to a different version — Jobber's schema can change field names between versions."),
+	dedupe: desc(z.optional(z.boolean()), "Look up an existing client by email before creating one (default false pending verification of Jobber's search API against a live schema — see AGENTS.md). Jobber's `clientCreate` has no upsert, so without this a resubmitting visitor creates a second client."),
+	note: desc(z.optional(JobberNoteConfigSchema), "Attach a best-effort note carrying the submitted message and any attribution/extra fields with no dedicated Jobber field.")
+});
+/**
+* A client's CRM, wired to the same conversion route `site.notifications`
+* already reaches — see AGENTS.md's "CRM submissions" section for why this is
+* server-side-only and hung off `createConversionRoute()` rather than a
+* client-side embed. Credentials never live here — the toolchain has no
+* secret store, matching every other integration.
+*/
+const CrmSchema = z.strictObject({
+	provider: desc(CrmProviderSchema, "Which CRM this site pushes form submissions into."),
+	enabled: desc(z.optional(z.boolean()), "Set false to keep the block on record without writing to the CRM."),
+	hubspot: desc(z.optional(HubSpotConfigSchema), "Required when `provider` is `hubspot`."),
+	bigin: desc(z.optional(BiginConfigSchema), "Required when `provider` is `bigin`."),
+	jobber: desc(z.optional(JobberConfigSchema), "Required when `provider` is `jobber`."),
+	fieldMap: desc(z.optional(z.record(z.string(), z.string())), "Submitted form field name → CRM property name. A field with no entry here is dropped, not guessed — an unmapped field never reaches the CRM."),
+	trackingFields: desc(z.optional(z.record(z.string(), z.string())), "`_ac` attribution key (a click-ID param, a UTM param, `landingPage`, `referrer`, or `ab_variant`) → CRM property name. Same drop-if-unmapped rule as `fieldMap`; a visitor with no `_ac` cookie maps to no attribution fields at all, never an error.")
+});
+
+// src/blocks.ts
+/** `site.notifications` */
+const NotificationsSchema = z.optional(z.strictObject({
+	email: desc(z.optional(z.union([z.email(), z.strictObject({
+		provider: desc(z.literal("cloudflare"), "Delivery provider. Only Cloudflare Email Sending is implemented; the field is stated so adding another is additive."),
+		to: desc(z.optional(z.email()), "Recipient. Defaults to the primary location’s `email`, then the first location that has one."),
+		from: desc(z.optional(z.email()), "Sender. Defaults to `noreply@<domains.canonical>`. Its domain must be onboarded (`wrangler email sending enable <domain>`) or every send fails."),
+		fromName: desc(z.optional(z.string()), "Display name on the From header. Defaults to `organization.name`."),
+		replyTo: desc(z.optional(z.email()), "Reply-To header."),
+		binding: desc(z.optional(z.string()), "Workers `send_email` binding name (default `EMAIL`). Set it when using a restricted binding."),
+		verifySender: desc(z.optional(z.boolean()), "Set false to skip `vitops email check`'s deploy-time onboarding warning for this site — for a `from` domain the scan cannot see is correct (e.g. built dynamically), which would otherwise be a false positive.")
+	})])), "Where conversion notifications are e-mailed. A bare address is shorthand for `{ provider: \"cloudflare\", to }`."),
+	actionUrl: desc(z.optional(z.string()), "Optional action-link template added to the conversion email (e.g. a link into your ad platform or your own CRM/portal). `{clickId}` is replaced with the ad click ID captured on `_ac` (gclid, fbclid, …). Omitted from the email when the event carries no click ID to interpolate, rather than rendering a broken link.")
+}));
+/** `site.tracking` */
+const TrackingSchema = z.optional(z.strictObject({
+	enabled: desc(z.optional(z.boolean()), "Capture ad click IDs and UTMs from the landing URL into the `_ac` cookie, for attributing conversions."),
+	category: desc(z.optional(z.enum(["marketing", "analytics"])), "Consent category the `_ac` cookie waits on (default `marketing`). It is a 90-day identifier tying a visitor to the ad that brought them, so it is only written once this category is granted — and asking for it is what raises the banner."),
+	platforms: desc(z.optional(z.array(z.string())), "Informational list of ad platforms in use. Capture recognises every known click-ID parameter regardless.")
+}));
+/** `site.security` */
+const SecuritySchema = z.optional(z.strictObject({ turnstile: z.optional(z.strictObject({ siteKey: desc(z.optional(z.string()), "Cloudflare Turnstile site key (public).") })) }));
+/** `site.deployment` */
+const DeploymentSchema = z.optional(z.strictObject({
+	platform: z.optional(z.string()),
+	buildCommand: z.optional(z.string()),
+	deployCommand: z.optional(z.string()),
+	outputDirectory: z.optional(z.string()),
+	type: z.optional(z.string()),
+	repo: desc(z.optional(z.string()), "`owner/name` of this site's GitHub repository. Read by the EmDash design-system-editor plugin route to auto-commit a client's admin edit back to `branch` — see AGENTS.md's \"EmDash plugin as the design-system editing surface\" section. Absent means that sync is skipped (the live override still applies); nothing else in this toolchain reads it today."),
+	branch: desc(z.optional(z.string()), "Branch the design-system-editor sync commits to. Default `\"dev\"` — never `main`/production directly; a commit here still needs this repo's own `promote` PR + admin approval to reach production, the same gate every other change goes through.")
+}));
+
+// src/seo.ts
+/** A string, or a per-locale map of strings (`{ en: "…", fr: "…" }`). */
+const LocalizableSchema = desc(z.union([z.string(), z.record(z.string(), z.string())]), "A string, or a per-locale map of strings (`{ en: \"…\", fr: \"…\" }`).");
+/**
+* A share image: a bare URL, or the URL with the metadata crawlers read alongside it.
+*
+* Distinct from a content image (`alt` is required there): a site-wide fallback card often has
+* no meaningful alt text, and `<Seo />` already omits `og:image:alt` when none is given.
+*/
+const SeoImageSchema = z.union([z.string(), z.strictObject({
+	src: desc(z.string(), "Absolute, or relative to `site` (resolved at render time)."),
+	alt: z.optional(z.string()),
+	width: z.optional(z.number()),
+	height: z.optional(z.number()),
+	type: desc(z.optional(z.string()), "MIME type, e.g. `image/png`.")
+})]);
+/**
+* `site.seo` — the single source of site-level SEO defaults.
+*
+* Read by `<Seo />` (through `@getvitops/astro`'s `resolveSeoDefaults`), `vitops robots` and
+* `vitops search notify`. Every display field here is consumed by `resolveSeoDefaults`;
+* `seo-defaults.test.ts` fails when a field is added to this schema and not read, which is how
+* four fields once sat here doing nothing (ADR-0002).
+*/
+const SeoSchema = z.strictObject({
+	siteName: desc(z.optional(LocalizableSchema), "`og:site_name`, and the `<title>` when a page passes none. Defaults to `organization.name`, so most sites never state it."),
+	titleTemplate: desc(z.optional(LocalizableSchema), "Page-title pattern; `%s` is the page title (e.g. \"%s · Acme\"). Applies to `<title>` only, never to `og:title`, and is skipped when the page title already equals the site name."),
+	defaultTitle: desc(z.optional(LocalizableSchema), "`<title>` for pages that pass none. Used verbatim — the template is not applied. Defaults to the site name."),
+	defaultDescription: desc(z.optional(LocalizableSchema), "`<meta name=\"description\">` for pages that pass none."),
+	robots: desc(z.optional(z.string()), "Site-wide robots directive (e.g. \"index,follow\" / \"noindex,nofollow\"). `site.environments.<env>.robots` wins over it."),
+	googleSiteVerification: desc(z.optional(z.string()), "Google Search Console verification token (`<meta name=\"google-site-verification\">`)."),
+	bingSiteVerification: desc(z.optional(z.string()), "Bing Webmaster Tools verification token (`<meta name=\"msvalidate.01\">`)."),
+	openGraph: desc(z.optional(z.strictObject({
+		type: desc(z.optional(z.enum([
+			"website",
+			"article",
+			"profile"
+		])), "Default `og:type`. Default `website`."),
+		locale: desc(z.optional(z.string()), "`og:locale`. `en-CA` and `en_CA` both emit `en_CA`."),
+		localeAlternates: desc(z.optional(z.array(z.string())), "Other locales the same content exists in → `og:locale:alternate`."),
+		image: desc(z.optional(SeoImageSchema), "Fallback share image for pages that bring none.")
+	})), "Open Graph defaults. Per-page `<Seo />` props override them."),
+	twitter: desc(z.optional(z.strictObject({
+		card: desc(z.optional(z.enum([
+			"summary",
+			"summary_large_image",
+			"app",
+			"player"
+		])), "Card type when no image resolves (default `summary`)."),
+		site: desc(z.optional(z.string()), "The site's own handle, e.g. \"@acme\"."),
+		creator: desc(z.optional(z.string()), "Default author handle, e.g. \"@ada\".")
+	})), "Twitter/X card defaults."),
+	indexing: desc(z.optional(IndexingSchema), "How `vitops search notify` tells search engines about a deploy: which sitemap, IndexNow key, Search Console property, and which pages to verify afterwards.")
+});
+
+export { AD_PROVIDERS, AdPropertySchema, AdProviderSchema, BIGIN_DATA_CENTERS, BiginConfigSchema, BiginPipelineConfigSchema, CRM_PROVIDERS, CrmProviderSchema, CrmSchema, DeploymentSchema, HubSpotConfigSchema, IndexNowSchema, IndexingSchema, JobberConfigSchema, JobberNoteConfigSchema, LocalizableSchema, NotificationsSchema, ReviewLocationSchema, ReviewsSchema, SearchConsoleSchema, SearchConsoleSetupSchema, SecuritySchema, SeoSchema, TrackingSchema, desc };
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/desc.ts","../src/indexing.ts","../src/ads.ts","../src/reviews.ts","../src/crm.ts","../src/blocks.ts","../src/seo.ts"],"sourcesContent":["import * as z from '@zod/mini';\n\n/** Attach a human description to a schema; it becomes the JSON Schema `description` editors show as a hover. */\nexport const desc = <T extends { check(...checks: never[]): T }>(schema: T, text: string): T =>\n  schema.check(z.describe(text) as never);\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\n\n/**\n * One domain to onboard into Google Search Console via `vitops search setup`.\n *\n * The verification token is fetched live from the Site Verification API at run\n * time and written to DNS — it is never stored here. What the config records is\n * the *intent*: which domains to onboard, and who should co-own them.\n */\nexport const SearchConsoleSetupSchema = z.strictObject({\n  delegatedOwners: desc(\n    z.optional(z.array(z.email())),\n    'Emails added as verification owners on the Site Verification web resource. Automated via the API — additive and idempotent, never removes an existing owner.',\n  ),\n  fullUserGroup: desc(\n    z.optional(z.email()),\n    'A Google Group to grant Full-User access in Search Console. SURFACED AS A REMINDER only: Search Console exposes no user/permission API, so this step stays manual by design.',\n  ),\n});\n\n/**\n * What `vitops search notify` needs to tell search engines a deploy happened.\n *\n * Scoped by what search engines actually accept, which is narrower than it looks:\n * Google exposes **no** \"request indexing\" API (the Search Console button is not in\n * its API, and URL Inspection is read-only), and it removed the sitemap ping\n * endpoint in 2023. So the sanctioned set is: an accurate sitemap, a Search Console\n * sitemap resubmit, an IndexNow ping — which Google does *not* honour but Bing,\n * Yandex, Naver, Seznam and Yep do — and a read-only inspection pass to find out\n * what Google actually did.\n *\n * Facts only, the same rule the legal block follows: this records what the site has\n * (a key, a property, which pages matter), never what to say about it.\n */\nexport const IndexNowSchema = z.strictObject({\n  key: desc(\n    z.string().check(z.regex(/^[a-zA-Z0-9-]{8,128}$/)),\n    'IndexNow key (8–128 chars, hex is conventional). NOT a secret — it is served publicly at `keyLocation` so the engine can verify you own the host. Generate one with `vitops search notify --new-key`.',\n  ),\n  keyLocation: desc(\n    z.optional(z.url()),\n    'Absolute URL of the key file. Defaults to `<canonical>/<key>.txt`; set it only when the file lives elsewhere.',\n  ),\n  endpoint: desc(\n    z.optional(z.url()),\n    'IndexNow endpoint (default `https://api.indexnow.org/indexnow`). Any participating engine shares submissions with the rest, so one is normally enough.',\n  ),\n});\n\nexport const SearchConsoleSchema = z.strictObject({\n  siteUrl: desc(\n    z.string(),\n    'The property exactly as Search Console identifies it — `sc-domain:acme.ca` for a domain property, or the URL-prefix form `https://acme.ca/`. A mismatch here is a 403, not a \"not found\".',\n  ),\n  resubmitSitemap: desc(\n    z.optional(z.boolean()),\n    'Re-submit the sitemap through the Search Console API on each notify (default true when `searchConsole` is set). This is the automated equivalent of the manual resubmit in the UI.',\n  ),\n});\n\nexport const IndexingSchema = z.strictObject({\n  sitemapUrl: desc(\n    z.optional(z.url()),\n    'The sitemap to submit and to diff for changed URLs. Defaults to `<canonical>/sitemap-index.xml`.',\n  ),\n  indexNow: desc(\n    z.optional(IndexNowSchema),\n    'IndexNow submission (Bing, Yandex, Naver, Seznam, Yep — not Google). Omit to skip the channel.',\n  ),\n  searchConsole: desc(\n    z.optional(SearchConsoleSchema),\n    'Google Search Console property. Needs a credential at run time — either a service account in `VITOPS_GSC_SERVICE_ACCOUNT` / `GOOGLE_APPLICATION_CREDENTIALS`, or the user OAuth credential `vitops search setup` uses (`VITOPS_GOOGLE_CLIENT_ID` / `_CLIENT_SECRET` / `_REFRESH_TOKEN`). The service account wins when both are set. Never put a key in this file.',\n  ),\n  priorityUrls: desc(\n    z.optional(z.array(z.url())),\n    'The pages whose indexing actually matters. `vitops search notify --check` inspects these and exits non-zero if Google has not indexed one. Kept explicit because URL Inspection is quota-bound (2000/day), so checking every page is neither affordable nor informative.',\n  ),\n});\n\nexport type IndexNowConfig = z.infer<typeof IndexNowSchema>;\nexport type SearchConsoleConfig = z.infer<typeof SearchConsoleSchema>;\nexport type IndexingConfig = z.infer<typeof IndexingSchema>;\nexport type SearchConsoleSetupConfig = z.infer<typeof SearchConsoleSetupSchema>;\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\nimport { AD_PROVIDERS } from './providers.ts';\n\nexport const AdProviderSchema = z.enum(AD_PROVIDERS);\n\n/**\n * One ad property this site is linked to.\n *\n * Facts, not prose — the same rule the legal block follows. This records *which*\n * account and *which* tag id, and the platform capability table decides what can be\n * done about them. It is also what finally lets the rest of the toolchain see an ad\n * pixel: the generated cookie notice discloses its cookies, `vitops ads lint`\n * checks its click ID is captured, and the consent gate is handed the cookie names\n * to clear on revoke. A pixel pasted into a template is invisible to all three.\n */\nexport const AdPropertySchema = z.strictObject({\n  accountId: desc(\n    z.optional(z.string()),\n    'The advertising account as the platform shows it — Google Ads customer ID, Meta ad account, LinkedIn partner ID, Reddit advertiser ID. For LinkedIn this is also the Insight Tag id; everywhere else the tag id is `pixelId`.',\n  ),\n  pixelId: desc(\n    z.optional(z.string()),\n    'The tag/pixel ID the browser snippet initialises — Meta pixel, TikTok pixel, Reddit pixel, Microsoft UET tag ID, Pinterest tag ID, Snap pixel, or the Google Ads conversion ID (`AW-…`, which is NOT the customer ID).',\n  ),\n  conversionLabel: desc(\n    z.optional(\n      z.union([\n        z.string(),\n        z.strictObject({\n          call: desc(z.optional(z.string()), 'Fired on a tel: link click.'),\n          email: desc(z.optional(z.string()), 'Fired on a mailto: link click.'),\n          form: desc(\n            z.optional(z.string()),\n            \"Fired client-side by `vitopsFormConversion()` — the consumer's own submit handler calls it once a form POST succeeds.\",\n          ),\n        }),\n      ]),\n    ),\n    'Google Ads only: the conversion action label(s) paired with the `AW-…` conversion ID — ' +\n      'either one bare label (back-compat, treated as the `call` action) or a map of ' +\n      'action → label, so a call, an email click and a form submission each fire their own ' +\n      'Google Ads conversion action instead of all three reporting as the same one.',\n  ),\n  conversionActionId: desc(\n    z.optional(\n      z.union([\n        z.string(),\n        z.strictObject({\n          call: desc(z.optional(z.string()), 'Fired on a tel: link click.'),\n          email: desc(z.optional(z.string()), 'Fired on a mailto: link click.'),\n          form: desc(z.optional(z.string()), 'Fired on a form submission.'),\n        }),\n      ]),\n    ),\n    'Google Ads only: the conversion action **resource id(s)** (a numeric id, or a full ' +\n      '`customers/…/conversionActions/…` resource name) used for server-side offline ' +\n      'conversion upload — NOT the same value as `conversionLabel`, which is the opaque ' +\n      \"label the web tag uses and which the Ads API's upload endpoint does not accept. \" +\n      'Only meaningful when `reporting: \"server\"`.',\n  ),\n  reporting: desc(\n    z.optional(z.enum(['client', 'server'])),\n    'Google Ads only: `\"client\"` (default) fires the conversion via `gtag.js` in the ' +\n      'browser at click/submit time; `\"server\"` uploads it via the Ads API from the ' +\n      'conversion endpoint instead (see `conversionActionId`). An action with no matching ' +\n      '`conversionActionId` keeps firing client-side regardless of this setting, so setting ' +\n      'it before `conversionActionId` is filled in never silently drops a conversion.',\n  ),\n  domain: desc(\n    z.optional(z.string()),\n    'Bare hostname to verify with this platform. Defaults to the host of `domains.canonical` — set it only when the ad account is verified against a different domain.',\n  ),\n  domainVerification: desc(\n    z.optional(z.string()),\n    'The verification token from the platform UI, for the platforms that verify by DNS TXT (Meta, TikTok, Pinterest, Snapchat). `vitops ads setup` prompts for it and writes it here on first run. NOT a secret — it is published in DNS, and the platform fetching it back is the ownership proof, exactly like the IndexNow key. A value containing `=` is used as the whole record, which is the escape hatch if a platform changes its prefix.',\n  ),\n  category: desc(\n    z.optional(z.enum(['marketing', 'analytics'])),\n    'Consent category the tag waits on (default `marketing`). An ad pixel is advertising by default; `analytics` is for a site using one purely for its own measurement.',\n  ),\n  enabled: desc(\n    z.optional(z.boolean()),\n    'Set false to keep the property on record without emitting its tag.',\n  ),\n});\n\nexport type AdPropertyConfig = z.infer<typeof AdPropertySchema>;\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\n\n/**\n * How one location's Google reviews are selected and ordered for display.\n *\n * Keyed by `organization.locations` key, mirroring `site.ads`/`site.searchConsole`\n * — `vitops reviews` needs to know which physical location a fetched review set\n * belongs to, and that record already exists.\n */\nexport const ReviewLocationSchema = z.strictObject({\n  accountId: desc(\n    z.optional(z.string()),\n    'GBP account resource id (`accounts/…`), overriding `site.reviews.accountId` for this location.',\n  ),\n  locationId: desc(z.string(), 'GBP location resource id (`locations/…`) to fetch reviews for.'),\n  featured: desc(\n    z.optional(z.array(z.string())),\n    'Review ids to always include, in this order, ahead of everything else automatically selected.',\n  ),\n  minRating: desc(\n    z.optional(z.number()),\n    'Drop reviews below this star rating (default 4) from the automatic (non-featured) selection.',\n  ),\n  limit: desc(z.optional(z.number()), 'Keep at most this many reviews after filtering.'),\n  sort: desc(\n    z.optional(z.enum(['recent', 'rating'])),\n    'Ordering for the non-featured remainder (default `recent`).',\n  ),\n});\n\nexport const ReviewsSchema = z.strictObject({\n  accountId: desc(\n    z.optional(z.string()),\n    'Default GBP account resource id (`accounts/…`) for locations that do not override it.',\n  ),\n  locations: desc(\n    z.record(z.string(), ReviewLocationSchema),\n    'Which `organization.locations` to fetch Google reviews for, and how each one’s reviews are filtered/ordered. `vitops reviews` writes the result to `.vitops/reviews.json`.',\n  ),\n  schema: desc(\n    z.optional(z.boolean()),\n    'Emit `Review` JSON-LD for these reviews (default false). Off by default: Google’s structured-data policy treats a business marking up reviews of itself as ineligible for review rich results, and risks a manual action.',\n  ),\n  avatars: desc(\n    z.optional(z.boolean()),\n    'Render the reviewer’s Google-hosted avatar photo (default false). Off by default: every visitor would otherwise issue a third-party request to googleusercontent.com, and the URLs are not guaranteed to stay live.',\n  ),\n});\n\nexport type ReviewsConfig = z.infer<typeof ReviewsSchema>;\nexport type ReviewLocationConfig = z.infer<typeof ReviewLocationSchema>;\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\nimport { BIGIN_DATA_CENTERS, CRM_PROVIDERS } from './providers.ts';\n\nexport const CrmProviderSchema = z.enum(CRM_PROVIDERS);\n\nexport const HubSpotConfigSchema = z.strictObject({\n  portalId: desc(z.string(), 'The HubSpot portal (hub) ID the form belongs to.'),\n  formGuid: desc(z.string(), 'The HubSpot form GUID to submit against.'),\n  dataCenter: desc(\n    z.optional(z.enum(['na', 'eu'])),\n    'Which regional submissions API to post to (default `na`).',\n  ),\n});\n\nexport const BiginPipelineConfigSchema = z.strictObject({\n  enabled: desc(z.boolean(), 'Also open a Pipelines record for the new/updated contact.'),\n  subPipeline: desc(z.optional(z.string()), 'Sub-pipeline to file the record under.'),\n  stage: desc(z.optional(z.string()), 'Starting stage for the pipeline record.'),\n});\n\nexport const BiginConfigSchema = z.strictObject({\n  dataCenter: desc(\n    z.enum(BIGIN_DATA_CENTERS),\n    \"The self-client's data centre — determines both the OAuth accounts host and the API host (`www.zohoapis.<dc>`).\",\n  ),\n  duplicateCheckField: desc(\n    z.optional(z.string()),\n    \"Bigin field the upsert dedupes on (default `Email`, Bigin's own unique field).\",\n  ),\n  pipeline: desc(\n    z.optional(BiginPipelineConfigSchema),\n    'Also open a Pipelines record alongside the Contact.',\n  ),\n});\n\nexport const JobberNoteConfigSchema = z.strictObject({\n  enabled: desc(\n    z.optional(z.boolean()),\n    'Attach a best-effort note carrying the message and unmapped attribution (default true). A failure here never loses the client record itself.',\n  ),\n});\n\nexport const JobberConfigSchema = z.strictObject({\n  apiVersion: desc(\n    z.optional(z.string()),\n    \"Override the pinned `X-JOBBER-GRAPHQL-VERSION` date this integration is tested against. An escape hatch for an app pinned to a different version — Jobber's schema can change field names between versions.\",\n  ),\n  dedupe: desc(\n    z.optional(z.boolean()),\n    \"Look up an existing client by email before creating one (default false pending verification of Jobber's search API against a live schema — see AGENTS.md). Jobber's `clientCreate` has no upsert, so without this a resubmitting visitor creates a second client.\",\n  ),\n  note: desc(\n    z.optional(JobberNoteConfigSchema),\n    'Attach a best-effort note carrying the submitted message and any attribution/extra fields with no dedicated Jobber field.',\n  ),\n});\n\n/**\n * A client's CRM, wired to the same conversion route `site.notifications`\n * already reaches — see AGENTS.md's \"CRM submissions\" section for why this is\n * server-side-only and hung off `createConversionRoute()` rather than a\n * client-side embed. Credentials never live here — the toolchain has no\n * secret store, matching every other integration.\n */\nexport const CrmSchema = z.strictObject({\n  provider: desc(CrmProviderSchema, 'Which CRM this site pushes form submissions into.'),\n  enabled: desc(\n    z.optional(z.boolean()),\n    'Set false to keep the block on record without writing to the CRM.',\n  ),\n  hubspot: desc(z.optional(HubSpotConfigSchema), 'Required when `provider` is `hubspot`.'),\n  bigin: desc(z.optional(BiginConfigSchema), 'Required when `provider` is `bigin`.'),\n  jobber: desc(z.optional(JobberConfigSchema), 'Required when `provider` is `jobber`.'),\n  fieldMap: desc(\n    z.optional(z.record(z.string(), z.string())),\n    'Submitted form field name → CRM property name. A field with no entry here is dropped, not guessed — an unmapped field never reaches the CRM.',\n  ),\n  trackingFields: desc(\n    z.optional(z.record(z.string(), z.string())),\n    '`_ac` attribution key (a click-ID param, a UTM param, `landingPage`, `referrer`, or `ab_variant`) → CRM property name. Same drop-if-unmapped rule as `fieldMap`; a visitor with no `_ac` cookie maps to no attribution fields at all, never an error.',\n  ),\n});\n\nexport type CrmConfig = z.infer<typeof CrmSchema>;\nexport type HubSpotConfig = z.infer<typeof HubSpotConfigSchema>;\nexport type BiginConfig = z.infer<typeof BiginConfigSchema>;\nexport type BiginPipelineConfig = z.infer<typeof BiginPipelineConfigSchema>;\nexport type JobberConfig = z.infer<typeof JobberConfigSchema>;\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\n\n/** `site.notifications` */\nexport const NotificationsSchema = z.optional(\n  z.strictObject({\n    email: desc(\n      z.optional(\n        z.union([\n          z.email(),\n          z.strictObject({\n            provider: desc(\n              z.literal('cloudflare'),\n              'Delivery provider. Only Cloudflare Email Sending is implemented; the field is stated so adding another is additive.',\n            ),\n            to: desc(\n              z.optional(z.email()),\n              'Recipient. Defaults to the primary location’s `email`, then the first location that has one.',\n            ),\n            from: desc(\n              z.optional(z.email()),\n              'Sender. Defaults to `noreply@<domains.canonical>`. Its domain must be onboarded (`wrangler email sending enable <domain>`) or every send fails.',\n            ),\n            fromName: desc(\n              z.optional(z.string()),\n              'Display name on the From header. Defaults to `organization.name`.',\n            ),\n            replyTo: desc(z.optional(z.email()), 'Reply-To header.'),\n            binding: desc(\n              z.optional(z.string()),\n              'Workers `send_email` binding name (default `EMAIL`). Set it when using a restricted binding.',\n            ),\n            verifySender: desc(\n              z.optional(z.boolean()),\n              \"Set false to skip `vitops email check`'s deploy-time onboarding warning for this site — for a `from` domain the scan cannot see is correct (e.g. built dynamically), which would otherwise be a false positive.\",\n            ),\n          }),\n        ]),\n      ),\n      'Where conversion notifications are e-mailed. A bare address is shorthand for `{ provider: \"cloudflare\", to }`.',\n    ),\n    actionUrl: desc(\n      z.optional(z.string()),\n      'Optional action-link template added to the conversion email (e.g. a link into your ' +\n        'ad platform or your own CRM/portal). `{clickId}` is replaced with the ad click ID ' +\n        'captured on `_ac` (gclid, fbclid, …). Omitted from the email when the event carries ' +\n        'no click ID to interpolate, rather than rendering a broken link.',\n    ),\n  }),\n);\n\n/** `site.tracking` */\nexport const TrackingSchema = z.optional(\n  z.strictObject({\n    enabled: desc(\n      z.optional(z.boolean()),\n      'Capture ad click IDs and UTMs from the landing URL into the `_ac` cookie, for attributing conversions.',\n    ),\n    category: desc(\n      z.optional(z.enum(['marketing', 'analytics'])),\n      'Consent category the `_ac` cookie waits on (default `marketing`). It is a 90-day identifier tying a visitor to the ad that brought them, so it is only written once this category is granted — and asking for it is what raises the banner.',\n    ),\n    platforms: desc(\n      z.optional(z.array(z.string())),\n      'Informational list of ad platforms in use. Capture recognises every known click-ID parameter regardless.',\n    ),\n  }),\n);\n\n/** `site.security` */\nexport const SecuritySchema = z.optional(\n  z.strictObject({\n    turnstile: z.optional(\n      z.strictObject({\n        siteKey: desc(z.optional(z.string()), 'Cloudflare Turnstile site key (public).'),\n      }),\n    ),\n  }),\n);\n\n/** `site.deployment` */\nexport const DeploymentSchema = z.optional(\n  z.strictObject({\n    platform: z.optional(z.string()),\n    buildCommand: z.optional(z.string()),\n    deployCommand: z.optional(z.string()),\n    outputDirectory: z.optional(z.string()),\n    type: z.optional(z.string()),\n    repo: desc(\n      z.optional(z.string()),\n      \"`owner/name` of this site's GitHub repository. Read by the EmDash design-system-editor plugin route to auto-commit a client's admin edit back to `branch` — see AGENTS.md's \\\"EmDash plugin as the design-system editing surface\\\" section. Absent means that sync is skipped (the live override still applies); nothing else in this toolchain reads it today.\",\n    ),\n    branch: desc(\n      z.optional(z.string()),\n      'Branch the design-system-editor sync commits to. Default `\"dev\"` — never `main`/production directly; a commit here still needs this repo\\'s own `promote` PR + admin approval to reach production, the same gate every other change goes through.',\n    ),\n  }),\n);\n\nexport type NotificationsConfig = NonNullable<z.infer<typeof NotificationsSchema>>;\nexport type TrackingConfig = NonNullable<z.infer<typeof TrackingSchema>>;\nexport type SecurityConfig = NonNullable<z.infer<typeof SecuritySchema>>;\nexport type DeploymentConfig = NonNullable<z.infer<typeof DeploymentSchema>>;\n","import * as z from '@zod/mini';\nimport { desc } from './desc.ts';\nimport { IndexingSchema } from './indexing.ts';\n\n/** A string, or a per-locale map of strings (`{ en: \"…\", fr: \"…\" }`). */\nexport const LocalizableSchema = desc(\n  z.union([z.string(), z.record(z.string(), z.string())]),\n  'A string, or a per-locale map of strings (`{ en: \"…\", fr: \"…\" }`).',\n);\n\n/**\n * A share image: a bare URL, or the URL with the metadata crawlers read alongside it.\n *\n * Distinct from a content image (`alt` is required there): a site-wide fallback card often has\n * no meaningful alt text, and `<Seo />` already omits `og:image:alt` when none is given.\n */\nconst SeoImageSchema = z.union([\n  z.string(),\n  z.strictObject({\n    src: desc(z.string(), 'Absolute, or relative to `site` (resolved at render time).'),\n    alt: z.optional(z.string()),\n    width: z.optional(z.number()),\n    height: z.optional(z.number()),\n    type: desc(z.optional(z.string()), 'MIME type, e.g. `image/png`.'),\n  }),\n]);\n\n/**\n * `site.seo` — the single source of site-level SEO defaults.\n *\n * Read by `<Seo />` (through `@getvitops/astro`'s `resolveSeoDefaults`), `vitops robots` and\n * `vitops search notify`. Every display field here is consumed by `resolveSeoDefaults`;\n * `seo-defaults.test.ts` fails when a field is added to this schema and not read, which is how\n * four fields once sat here doing nothing (ADR-0002).\n */\nexport const SeoSchema = z.strictObject({\n  siteName: desc(\n    z.optional(LocalizableSchema),\n    '`og:site_name`, and the `<title>` when a page passes none. Defaults to `organization.name`, so most sites never state it.',\n  ),\n  titleTemplate: desc(\n    z.optional(LocalizableSchema),\n    'Page-title pattern; `%s` is the page title (e.g. \"%s · Acme\"). Applies to `<title>` only, never to `og:title`, and is skipped when the page title already equals the site name.',\n  ),\n  defaultTitle: desc(\n    z.optional(LocalizableSchema),\n    '`<title>` for pages that pass none. Used verbatim — the template is not applied. Defaults to the site name.',\n  ),\n  defaultDescription: desc(\n    z.optional(LocalizableSchema),\n    '`<meta name=\"description\">` for pages that pass none.',\n  ),\n  robots: desc(\n    z.optional(z.string()),\n    'Site-wide robots directive (e.g. \"index,follow\" / \"noindex,nofollow\"). `site.environments.<env>.robots` wins over it.',\n  ),\n  googleSiteVerification: desc(\n    z.optional(z.string()),\n    'Google Search Console verification token (`<meta name=\"google-site-verification\">`).',\n  ),\n  bingSiteVerification: desc(\n    z.optional(z.string()),\n    'Bing Webmaster Tools verification token (`<meta name=\"msvalidate.01\">`).',\n  ),\n  openGraph: desc(\n    z.optional(\n      z.strictObject({\n        type: desc(\n          z.optional(z.enum(['website', 'article', 'profile'])),\n          'Default `og:type`. Default `website`.',\n        ),\n        locale: desc(z.optional(z.string()), '`og:locale`. `en-CA` and `en_CA` both emit `en_CA`.'),\n        localeAlternates: desc(\n          z.optional(z.array(z.string())),\n          'Other locales the same content exists in → `og:locale:alternate`.',\n        ),\n        image: desc(z.optional(SeoImageSchema), 'Fallback share image for pages that bring none.'),\n      }),\n    ),\n    'Open Graph defaults. Per-page `<Seo />` props override them.',\n  ),\n  twitter: desc(\n    z.optional(\n      z.strictObject({\n        card: desc(\n          z.optional(z.enum(['summary', 'summary_large_image', 'app', 'player'])),\n          'Card type when no image resolves (default `summary`).',\n        ),\n        site: desc(z.optional(z.string()), 'The site\\'s own handle, e.g. \"@acme\".'),\n        creator: desc(z.optional(z.string()), 'Default author handle, e.g. \"@ada\".'),\n      }),\n    ),\n    'Twitter/X card defaults.',\n  ),\n  indexing: desc(\n    z.optional(IndexingSchema),\n    'How `vitops search notify` tells search engines about a deploy: which sitemap, IndexNow key, Search Console property, and which pages to verify afterwards.',\n  ),\n});\n\nexport type SeoConfig = z.infer<typeof SeoSchema>;\n"],"mappings":";;;;;AAGA,MAAa,QAAoD,QAAW,SAC1E,OAAO,MAAM,EAAE,SAAS,IAAI,CAAU;;;;;;;;;;ACMxC,MAAa,2BAA2B,EAAE,aAAa;CACrD,iBAAiB,KACf,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,GAC7B,8JACF;CACA,eAAe,KACb,EAAE,SAAS,EAAE,MAAM,CAAC,GACpB,8KACF;AACF,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,iBAAiB,EAAE,aAAa;CAC3C,KAAK,KACH,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,uBAAuB,CAAC,GACjD,uMACF;CACA,aAAa,KACX,EAAE,SAAS,EAAE,IAAI,CAAC,GAClB,+GACF;CACA,UAAU,KACR,EAAE,SAAS,EAAE,IAAI,CAAC,GAClB,wJACF;AACF,CAAC;AAED,MAAa,sBAAsB,EAAE,aAAa;CAChD,SAAS,KACP,EAAE,OAAO,GACT,6LACF;CACA,iBAAiB,KACf,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,oLACF;AACF,CAAC;AAED,MAAa,iBAAiB,EAAE,aAAa;CAC3C,YAAY,KACV,EAAE,SAAS,EAAE,IAAI,CAAC,GAClB,kGACF;CACA,UAAU,KACR,EAAE,SAAS,cAAc,GACzB,gGACF;CACA,eAAe,KACb,EAAE,SAAS,mBAAmB,GAC9B,oWACF;CACA,cAAc,KACZ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,GAC3B,0QACF;AACF,CAAC;;;AC1ED,MAAa,mBAAmB,EAAE,KAAK,YAAY;;;;;;;;;;;AAYnD,MAAa,mBAAmB,EAAE,aAAa;CAC7C,WAAW,KACT,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,+NACF;CACA,SAAS,KACP,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,wNACF;CACA,iBAAiB,KACf,EAAE,SACA,EAAE,MAAM,CACN,EAAE,OAAO,GACT,EAAE,aAAa;EACb,MAAM,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,6BAA6B;EAChE,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,gCAAgC;EACpE,MAAM,KACJ,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,uHACF;CACF,CAAC,CACH,CAAC,CACH,GACA,uUAIF;CACA,oBAAoB,KAClB,EAAE,SACA,EAAE,MAAM,CACN,EAAE,OAAO,GACT,EAAE,aAAa;EACb,MAAM,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,6BAA6B;EAChE,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,gCAAgC;EACpE,MAAM,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,6BAA6B;CAClE,CAAC,CACH,CAAC,CACH,GACA,iXAKF;CACA,WAAW,KACT,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,CAAC,GACvC,yZAKF;CACA,QAAQ,KACN,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,mKACF;CACA,oBAAoB,KAClB,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,+aACF;CACA,UAAU,KACR,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,WAAW,CAAC,CAAC,GAC7C,qKACF;CACA,SAAS,KACP,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,oEACF;AACF,CAAC;;;;;;;;;;AC3ED,MAAa,uBAAuB,EAAE,aAAa;CACjD,WAAW,KACT,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,gGACF;CACA,YAAY,KAAK,EAAE,OAAO,GAAG,gEAAgE;CAC7F,UAAU,KACR,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAC9B,+FACF;CACA,WAAW,KACT,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,8FACF;CACA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,iDAAiD;CACrF,MAAM,KACJ,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,CAAC,GACvC,6DACF;AACF,CAAC;AAED,MAAa,gBAAgB,EAAE,aAAa;CAC1C,WAAW,KACT,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,uFACF;CACA,WAAW,KACT,EAAE,OAAO,EAAE,OAAO,GAAG,oBAAoB,GACzC,4KACF;CACA,QAAQ,KACN,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,2NACF;CACA,SAAS,KACP,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,qNACF;AACF,CAAC;;;AC5CD,MAAa,oBAAoB,EAAE,KAAK,aAAa;AAErD,MAAa,sBAAsB,EAAE,aAAa;CAChD,UAAU,KAAK,EAAE,OAAO,GAAG,kDAAkD;CAC7E,UAAU,KAAK,EAAE,OAAO,GAAG,0CAA0C;CACrE,YAAY,KACV,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAC/B,2DACF;AACF,CAAC;AAED,MAAa,4BAA4B,EAAE,aAAa;CACtD,SAAS,KAAK,EAAE,QAAQ,GAAG,2DAA2D;CACtF,aAAa,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,wCAAwC;CAClF,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,yCAAyC;AAC/E,CAAC;AAED,MAAa,oBAAoB,EAAE,aAAa;CAC9C,YAAY,KACV,EAAE,KAAK,kBAAkB,GACzB,iHACF;CACA,qBAAqB,KACnB,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,gFACF;CACA,UAAU,KACR,EAAE,SAAS,yBAAyB,GACpC,qDACF;AACF,CAAC;AAED,MAAa,yBAAyB,EAAE,aAAa,EACnD,SAAS,KACP,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,8IACF,EACF,CAAC;AAED,MAAa,qBAAqB,EAAE,aAAa;CAC/C,YAAY,KACV,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,6MACF;CACA,QAAQ,KACN,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,mQACF;CACA,MAAM,KACJ,EAAE,SAAS,sBAAsB,GACjC,2HACF;AACF,CAAC;;;;;;;;AASD,MAAa,YAAY,EAAE,aAAa;CACtC,UAAU,KAAK,mBAAmB,mDAAmD;CACrF,SAAS,KACP,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,mEACF;CACA,SAAS,KAAK,EAAE,SAAS,mBAAmB,GAAG,wCAAwC;CACvF,OAAO,KAAK,EAAE,SAAS,iBAAiB,GAAG,sCAAsC;CACjF,QAAQ,KAAK,EAAE,SAAS,kBAAkB,GAAG,uCAAuC;CACpF,UAAU,KACR,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,GAC3C,8IACF;CACA,gBAAgB,KACd,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,GAC3C,uPACF;AACF,CAAC;;;;AC9ED,MAAa,sBAAsB,EAAE,SACnC,EAAE,aAAa;CACb,OAAO,KACL,EAAE,SACA,EAAE,MAAM,CACN,EAAE,MAAM,GACR,EAAE,aAAa;EACb,UAAU,KACR,EAAE,QAAQ,YAAY,GACtB,qHACF;EACA,IAAI,KACF,EAAE,SAAS,EAAE,MAAM,CAAC,GACpB,8FACF;EACA,MAAM,KACJ,EAAE,SAAS,EAAE,MAAM,CAAC,GACpB,iJACF;EACA,UAAU,KACR,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,mEACF;EACA,SAAS,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,kBAAkB;EACvD,SAAS,KACP,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,8FACF;EACA,cAAc,KACZ,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,iNACF;CACF,CAAC,CACH,CAAC,CACH,GACA,kHACF;CACA,WAAW,KACT,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,2TAIF;AACF,CAAC,CACH;;AAGA,MAAa,iBAAiB,EAAE,SAC9B,EAAE,aAAa;CACb,SAAS,KACP,EAAE,SAAS,EAAE,QAAQ,CAAC,GACtB,wGACF;CACA,UAAU,KACR,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,WAAW,CAAC,CAAC,GAC7C,6OACF;CACA,WAAW,KACT,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAC9B,0GACF;AACF,CAAC,CACH;;AAGA,MAAa,iBAAiB,EAAE,SAC9B,EAAE,aAAa,EACb,WAAW,EAAE,SACX,EAAE,aAAa,EACb,SAAS,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,yCAAyC,EACjF,CAAC,CACH,EACF,CAAC,CACH;;AAGA,MAAa,mBAAmB,EAAE,SAChC,EAAE,aAAa;CACb,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC;CACnC,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC;CACpC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC;CACtC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;CAC3B,MAAM,KACJ,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,iWACF;CACA,QAAQ,KACN,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,oPACF;AACF,CAAC,CACH;;;;AC5FA,MAAa,oBAAoB,KAC/B,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GACtD,wEACF;;;;;;;AAQA,MAAM,iBAAiB,EAAE,MAAM,CAC7B,EAAE,OAAO,GACT,EAAE,aAAa;CACb,KAAK,KAAK,EAAE,OAAO,GAAG,4DAA4D;CAClF,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;CAC1B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC5B,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;CAC7B,MAAM,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,8BAA8B;AACnE,CAAC,CACH,CAAC;;;;;;;;;AAUD,MAAa,YAAY,EAAE,aAAa;CACtC,UAAU,KACR,EAAE,SAAS,iBAAiB,GAC5B,2HACF;CACA,eAAe,KACb,EAAE,SAAS,iBAAiB,GAC5B,mLACF;CACA,cAAc,KACZ,EAAE,SAAS,iBAAiB,GAC5B,6GACF;CACA,oBAAoB,KAClB,EAAE,SAAS,iBAAiB,GAC5B,yDACF;CACA,QAAQ,KACN,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,2HACF;CACA,wBAAwB,KACtB,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,wFACF;CACA,sBAAsB,KACpB,EAAE,SAAS,EAAE,OAAO,CAAC,GACrB,4EACF;CACA,WAAW,KACT,EAAE,SACA,EAAE,aAAa;EACb,MAAM,KACJ,EAAE,SAAS,EAAE,KAAK;GAAC;GAAW;GAAW;EAAS,CAAC,CAAC,GACpD,uCACF;EACA,QAAQ,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,qDAAqD;EAC1F,kBAAkB,KAChB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAC9B,mEACF;EACA,OAAO,KAAK,EAAE,SAAS,cAAc,GAAG,iDAAiD;CAC3F,CAAC,CACH,GACA,8DACF;CACA,SAAS,KACP,EAAE,SACA,EAAE,aAAa;EACb,MAAM,KACJ,EAAE,SAAS,EAAE,KAAK;GAAC;GAAW;GAAuB;GAAO;EAAQ,CAAC,CAAC,GACtE,uDACF;EACA,MAAM,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,wCAAuC;EAC1E,SAAS,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,uCAAqC;CAC7E,CAAC,CACH,GACA,0BACF;CACA,UAAU,KACR,EAAE,SAAS,cAAc,GACzB,6JACF;AACF,CAAC"}

package/dist/providers.d.mts

@@ -0,0 +1,28 @@
+/**
+ * Closed provider lists, as bare literals. No zod import — see vite.config.ts for why this is its own entry.
+ */
+/**
+ * The ad platforms `vitops ads` can link a site to.
+ *
+ * A closed enum, mirroring `AD_PROVIDER_KEYS` in `@getvitops/utils/ads` — that
+ * module owns what each platform *can do* (whether it verifies a domain, what its
+ * tag is, which click ID it stamps), this owns what a config may *say*. Mirrored
+ * rather than derived because a `z.enum` needs literals to reach the published JSON
+ * Schema; `config.test.ts` asserts the two lists are the same set, so a provider
+ * added to one and not the other fails the build rather than silently getting no
+ * verification step and no tag.
+ */
+export declare const AD_PROVIDERS: readonly ["google", "meta", "linkedin", "reddit", "tiktok", "microsoft", "pinterest", "snapchat"];
+export type AdProvider = (typeof AD_PROVIDERS)[number];
+/**
+ * The CRMs this toolchain can push a form submission into.
+ *
+ * A closed enum, mirroring `CrmProvider` in `@getvitops/utils/crm` — that module
+ * owns what each provider's API needs, this owns what a config may say.
+ * Mirrored rather than derived for the same reason `AD_PROVIDERS` is: a
+ * `z.enum` needs literals to reach the published JSON Schema.
+ */
+export declare const CRM_PROVIDERS: readonly ["hubspot", "bigin", "jobber"];
+export type CrmProviderConfig = (typeof CRM_PROVIDERS)[number];
+export declare const BIGIN_DATA_CENTERS: readonly ["com", "ca", "eu", "in", "com.au", "jp"];
+//# sourceMappingURL=providers.d.mts.map

package/dist/providers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../src/providers.ts"],"mappings":";;;;;;;;;;;;;;qBAea;YAWD,qBAAqB;;;;;;;;;qBAUpB;YAED,4BAA4B;qBAE3B"}

package/dist/providers.mjs

@@ -0,0 +1,49 @@
+// src/providers.ts
+/**
+* Closed provider lists, as bare literals. No zod import — see vite.config.ts for why this is its own entry.
+*/
+/**
+* The ad platforms `vitops ads` can link a site to.
+*
+* A closed enum, mirroring `AD_PROVIDER_KEYS` in `@getvitops/utils/ads` — that
+* module owns what each platform *can do* (whether it verifies a domain, what its
+* tag is, which click ID it stamps), this owns what a config may *say*. Mirrored
+* rather than derived because a `z.enum` needs literals to reach the published JSON
+* Schema; `config.test.ts` asserts the two lists are the same set, so a provider
+* added to one and not the other fails the build rather than silently getting no
+* verification step and no tag.
+*/
+const AD_PROVIDERS = [
+	"google",
+	"meta",
+	"linkedin",
+	"reddit",
+	"tiktok",
+	"microsoft",
+	"pinterest",
+	"snapchat"
+];
+/**
+* The CRMs this toolchain can push a form submission into.
+*
+* A closed enum, mirroring `CrmProvider` in `@getvitops/utils/crm` — that module
+* owns what each provider's API needs, this owns what a config may say.
+* Mirrored rather than derived for the same reason `AD_PROVIDERS` is: a
+* `z.enum` needs literals to reach the published JSON Schema.
+*/
+const CRM_PROVIDERS = [
+	"hubspot",
+	"bigin",
+	"jobber"
+];
+const BIGIN_DATA_CENTERS = [
+	"com",
+	"ca",
+	"eu",
+	"in",
+	"com.au",
+	"jp"
+];
+
+export { AD_PROVIDERS, BIGIN_DATA_CENTERS, CRM_PROVIDERS };
+//# sourceMappingURL=providers.mjs.map

package/dist/providers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.mjs","names":[],"sources":["../src/providers.ts"],"sourcesContent":["/**\n * Closed provider lists, as bare literals. No zod import — see vite.config.ts for why this is its own entry.\n */\n\n/**\n * The ad platforms `vitops ads` can link a site to.\n *\n * A closed enum, mirroring `AD_PROVIDER_KEYS` in `@getvitops/utils/ads` — that\n * module owns what each platform *can do* (whether it verifies a domain, what its\n * tag is, which click ID it stamps), this owns what a config may *say*. Mirrored\n * rather than derived because a `z.enum` needs literals to reach the published JSON\n * Schema; `config.test.ts` asserts the two lists are the same set, so a provider\n * added to one and not the other fails the build rather than silently getting no\n * verification step and no tag.\n */\nexport const AD_PROVIDERS = [\n  'google',\n  'meta',\n  'linkedin',\n  'reddit',\n  'tiktok',\n  'microsoft',\n  'pinterest',\n  'snapchat',\n] as const;\n\nexport type AdProvider = (typeof AD_PROVIDERS)[number];\n\n/**\n * The CRMs this toolchain can push a form submission into.\n *\n * A closed enum, mirroring `CrmProvider` in `@getvitops/utils/crm` — that module\n * owns what each provider's API needs, this owns what a config may say.\n * Mirrored rather than derived for the same reason `AD_PROVIDERS` is: a\n * `z.enum` needs literals to reach the published JSON Schema.\n */\nexport const CRM_PROVIDERS = ['hubspot', 'bigin', 'jobber'] as const;\n\nexport type CrmProviderConfig = (typeof CRM_PROVIDERS)[number];\n\nexport const BIGIN_DATA_CENTERS = ['com', 'ca', 'eu', 'in', 'com.au', 'jp'] as const;\n"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;AAYA,MAAa,gBAAgB;CAAC;CAAW;CAAS;AAAQ;AAI1D,MAAa,qBAAqB;CAAC;CAAO;CAAM;CAAM;CAAM;CAAU;AAAI"}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@getvitops/config",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "8.2.0",
+  "description": "The site-config schema blocks the Vitops toolchain's provider integrations read — CRM, ads, reviews, indexing, notifications, tracking — as zod schemas and inferred types. A leaf package: it imports nothing else in the toolchain.",
+  "homepage": "https://docs.vitops.ca",
+  "bugs": "https://github.com/getvitops/design-system/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvitops/design-system.git",
+    "directory": "packages/config"
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./providers": {
+      "types": "./dist/providers.d.mts",
+      "import": "./dist/providers.mjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@zod/mini": "^4.6.5",
+    "zod": "^4.6.7"
+  },
+  "engines": {
+    "node": ">=24"
+  }
 }