@getvitops/utils 2.0.0 → 2.1.0

package/dist/indexing/index.mjs

@@ -0,0 +1,547 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { createSign, randomBytes } from "node:crypto";
+
+//#region src/indexing/plan.ts
+const INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
+/**
+* IndexNow's own cap per submission. Batches larger than this are split rather
+* than truncated — a silently dropped tail is the failure mode this command is
+* meant to eliminate, not reproduce.
+*/
+const INDEXNOW_BATCH = 1e4;
+const trimSlash = (s) => s.replace(/\/+$/, "");
+function hostOf(url) {
+	try {
+		return new URL(url).host;
+	} catch {
+		return;
+	}
+}
+function chunk(items, size) {
+	if (items.length === 0) return [];
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
+/**
+* Resolve the sitemap URL.
+*
+* `sitemap-index.xml` is @astrojs/sitemap's default filename and is what
+* `vitops({ sitemap })` registers, so it is the right default here. It resolves to
+* a flat `<urlset>` on a small site, which `parseSitemap` handles by reading the
+* root element rather than the name.
+*/
+function resolveSitemapUrl(config) {
+	if (config.sitemapUrl) return config.sitemapUrl;
+	if (!config.canonical) return void 0;
+	return `${trimSlash(config.canonical)}/sitemap-index.xml`;
+}
+/** Resolve the IndexNow key file URL. */
+function resolveKeyLocation(config) {
+	const indexNow = config.indexNow;
+	if (!indexNow) return void 0;
+	if (indexNow.keyLocation) return indexNow.keyLocation;
+	if (!config.canonical) return void 0;
+	return `${trimSlash(config.canonical)}/${indexNow.key}.txt`;
+}
+/** Which URLs differ from the snapshot. */
+function diff(current, previous) {
+	const changed = [];
+	for (const e of current) {
+		const before = previous.entries[e.loc];
+		if (before === void 0 || before !== (e.lastmod ?? "")) changed.push(e.loc);
+	}
+	return changed;
+}
+/**
+* Decide what this run should do.
+*
+* Ordering of the URL-selection rules matters and is not arbitrary: an explicit
+* `--urls` is an operator overriding the tool, `--all` is an operator overriding
+* the diff, a cold snapshot is the tool having no basis to narrow, and the diff is
+* the normal path. Each is reported in `reason` so `--dry` explains itself.
+*/
+function plan(input) {
+	const { config, current, previous, explicitUrls, all } = input;
+	const notes = [];
+	const sitemapUrl = resolveSitemapUrl(config);
+	const check = config.priorityUrls ?? [];
+	if (config.robots && /\bnoindex\b/i.test(config.robots)) return {
+		blocked: `environment robots policy is "${config.robots}" — refusing to ask search engines to index an environment marked noindex`,
+		sitemapUrl,
+		urls: [],
+		reason: "diff",
+		cold: false,
+		indexNow: {
+			enabled: false,
+			skip: "blocked",
+			endpoint: INDEXNOW_ENDPOINT,
+			batches: []
+		},
+		searchConsole: {
+			enabled: false,
+			skip: "blocked"
+		},
+		check: [],
+		notes
+	};
+	const cold = !explicitUrls && !all && !previous;
+	let urls;
+	let reason;
+	if (explicitUrls?.length) {
+		urls = explicitUrls;
+		reason = "explicit";
+	} else if (all) {
+		urls = current.map((e) => e.loc);
+		reason = "all";
+	} else if (!previous) {
+		urls = current.map((e) => e.loc);
+		reason = "cold";
+		notes.push(`no previous snapshot — treating all ${urls.length} URLs as changed. Persist \`.vitops/\` between runs (a CI cache) so later runs submit only what moved.`);
+	} else {
+		urls = diff(current, previous);
+		reason = "diff";
+	}
+	if (reason === "diff" || reason === "cold") {
+		const withLastmod = current.filter((e) => e.lastmod).length;
+		if (current.length > 0 && withLastmod === 0) notes.push("no <lastmod> in the sitemap — only added/removed pages can be detected, never an edit. Wire `gitLastmod()` into your sitemap options, or pass --all.");
+		else if (withLastmod < current.length) notes.push(`${current.length - withLastmod} of ${current.length} sitemap entries have no <lastmod> — edits to those pages cannot be detected.`);
+	}
+	const keyLocation = resolveKeyLocation(config);
+	const keyHost = keyLocation ? hostOf(keyLocation) : void 0;
+	let indexNow;
+	if (!config.indexNow) indexNow = {
+		enabled: false,
+		skip: "not configured (seo.indexing.indexNow)",
+		endpoint: INDEXNOW_ENDPOINT,
+		batches: []
+	};
+	else if (!keyLocation) indexNow = {
+		enabled: false,
+		skip: "no keyLocation and no domains.canonical to derive one",
+		endpoint: config.indexNow.endpoint ?? "https://api.indexnow.org/indexnow",
+		key: config.indexNow.key,
+		batches: []
+	};
+	else {
+		const onHost = urls.filter((u) => hostOf(u) === keyHost);
+		const offHost = urls.length - onHost.length;
+		if (offHost > 0) notes.push(`IndexNow: dropped ${offHost} URL(s) not on ${keyHost} — a submission must match its key file's host.`);
+		indexNow = {
+			enabled: onHost.length > 0,
+			...onHost.length === 0 ? { skip: "no URLs to submit" } : {},
+			endpoint: config.indexNow.endpoint ?? "https://api.indexnow.org/indexnow",
+			keyLocation,
+			key: config.indexNow.key,
+			...keyHost ? { host: keyHost } : {},
+			batches: chunk(onHost, INDEXNOW_BATCH)
+		};
+	}
+	let searchConsole;
+	if (!config.searchConsole) searchConsole = {
+		enabled: false,
+		skip: "not configured (seo.indexing.searchConsole)"
+	};
+	else if (config.searchConsole.resubmitSitemap === false) searchConsole = {
+		enabled: false,
+		skip: "resubmitSitemap is false",
+		siteUrl: config.searchConsole.siteUrl
+	};
+	else if (!sitemapUrl) searchConsole = {
+		enabled: false,
+		skip: "no sitemapUrl and no domains.canonical to derive one",
+		siteUrl: config.searchConsole.siteUrl
+	};
+	else searchConsole = {
+		enabled: true,
+		siteUrl: config.searchConsole.siteUrl
+	};
+	return {
+		sitemapUrl,
+		urls,
+		reason,
+		cold,
+		indexNow,
+		searchConsole,
+		check,
+		notes
+	};
+}
+/** Render a plan as the human-readable block `--dry` prints. */
+function formatPlan(p) {
+	const lines = [];
+	if (p.blocked) {
+		lines.push(`✗ blocked — ${p.blocked}`);
+		return lines.join("\n");
+	}
+	lines.push(`sitemap    ${p.sitemapUrl ?? "(none)"}`);
+	lines.push(`urls       ${p.urls.length} (${p.reason})`);
+	lines.push(p.indexNow.enabled ? `IndexNow   ${p.indexNow.batches.reduce((n, b) => n + b.length, 0)} URL(s) → ${p.indexNow.endpoint}` : `IndexNow   skipped — ${p.indexNow.skip}`);
+	lines.push(p.searchConsole.enabled ? `Search Console  resubmit sitemap → ${p.searchConsole.siteUrl}` : `Search Console  skipped — ${p.searchConsole.skip}`);
+	for (const n of p.notes) lines.push(`  ! ${n}`);
+	return lines.join("\n");
+}
+
+//#endregion
+//#region src/indexing/sitemap.ts
+/**
+* The five predefined XML entities, plus numeric character references.
+*
+* Not cosmetic: a sitemap URL carrying a query string is written `?a=1&amp;b=2`,
+* and submitting the un-decoded form means submitting a URL the site does not
+* serve — which IndexNow accepts and then silently fails to crawl.
+*/
+function decodeXml(s) {
+	return s.replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(Number.parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number.parseInt(d, 10))).replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+const tag = (block, name) => {
+	const m = new RegExp(`<${name}(?:\\s[^>]*)?>([\\s\\S]*?)</${name}>`, "i").exec(block);
+	return m ? decodeXml(m[1].trim()) : void 0;
+};
+function blocks(xml, name) {
+	const out = [];
+	const re = new RegExp(`<${name}(?:\\s[^>]*)?>([\\s\\S]*?)</${name}>`, "gi");
+	let m;
+	while (m = re.exec(xml)) out.push(m[1]);
+	return out;
+}
+/**
+* Parse a sitemap or sitemap index.
+*
+* Which one it is comes from the root element, not from the filename — an
+* `sitemap-index.xml` that is actually a flat `<urlset>` is common enough
+* (@astrojs/sitemap emits an index only past `entryLimit`) that keying on the name
+* would misread the single-file case as "no URLs".
+*/
+function parseSitemap(xml) {
+	if (/<sitemapindex[\s>]/i.test(xml)) return {
+		entries: [],
+		sitemaps: blocks(xml, "sitemap").map((b) => tag(b, "loc")).filter((l) => !!l)
+	};
+	const entries = [];
+	for (const b of blocks(xml, "url")) {
+		const loc = tag(b, "loc");
+		if (!loc) continue;
+		const lastmod = tag(b, "lastmod");
+		entries.push(lastmod ? {
+			loc,
+			lastmod
+		} : { loc });
+	}
+	return {
+		entries,
+		sitemaps: []
+	};
+}
+/**
+* Resolve a sitemap to its full entry list, following an index one level down.
+*
+* One level is the whole spec — the sitemaps protocol forbids an index pointing at
+* another index — so recursing further would only chase a malformed document.
+* Child fetches run sequentially: a large site's index can list dozens of files,
+* and hammering the consumer's own origin to save a second is a poor trade.
+*/
+async function collectEntries(source, read) {
+	const root = parseSitemap(await read(source));
+	if (root.sitemaps.length === 0) return {
+		entries: root.entries,
+		sources: [source]
+	};
+	const entries = [];
+	const sources = [];
+	for (const child of root.sitemaps) {
+		const parsed = parseSitemap(await read(child));
+		entries.push(...parsed.entries);
+		sources.push(child);
+	}
+	return {
+		entries,
+		sources
+	};
+}
+
+//#endregion
+//#region src/indexing/snapshot.ts
+/**
+* The previous run's sitemap state — what makes "only submit what changed"
+* possible at all.
+*
+* A plain JSON file rather than anything cleverer, because the thing reading it is
+* usually a CI job restoring a cache directory. It must survive being absent
+* (first run, cold cache) without pretending nothing changed — `readSnapshot`
+* returns `undefined` there and `plan()` treats that as "submit everything, and
+* say so".
+*/
+/** Default location, relative to the consumer's project root. */
+const SNAPSHOT_PATH = ".vitops/sitemap-snapshot.json";
+/**
+* Read a snapshot, or `undefined` when there isn't a usable one.
+*
+* A corrupt or wrong-version file reads as absent, not as empty. The distinction
+* matters: "absent" submits everything, whereas an empty entry map would look like
+* a site that legitimately has no URLs and submit nothing — the silent-success
+* failure this whole command exists to remove.
+*/
+function readSnapshot(path) {
+	if (!existsSync(path)) return void 0;
+	try {
+		const raw = JSON.parse(readFileSync(path, "utf8"));
+		if (raw?.version !== 1 || typeof raw.entries !== "object" || raw.entries === null) return void 0;
+		return raw;
+	} catch {
+		return;
+	}
+}
+/** Build a snapshot from the entries just read. */
+function toSnapshot(sitemapUrl, entries, takenAt) {
+	const map = {};
+	for (const e of entries) map[e.loc] = e.lastmod ?? "";
+	return {
+		version: 1,
+		sitemapUrl,
+		takenAt,
+		entries: map
+	};
+}
+/**
+* Write the snapshot, creating its directory.
+*
+* Call this only after a submission actually succeeded. Writing it eagerly would
+* record URLs as notified that never were, and because the next run diffs against
+* it, those URLs would never be submitted again — a single transient 503 would
+* silently drop a page from every future run.
+*/
+function writeSnapshot(path, snapshot) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(snapshot, null, 2)}\n`);
+}
+
+//#endregion
+//#region src/indexing/indexnow.ts
+/**
+* IndexNow submission.
+*
+* Honoured by Bing, Yandex, Naver, Seznam and Yep — and, through Bing's index, by
+* the AI crawlers built on it. **Not** by Google, which has never adopted the
+* protocol despite testing it; nothing here should be described to a consumer as
+* affecting Google results.
+*
+* Participating engines share submissions with each other, so one endpoint is
+* normally the whole integration.
+*/
+/** Generate a key. 32 hex characters, the conventional shape. */
+function newKey() {
+	return randomBytes(16).toString("hex");
+}
+/** The body of the key file served at `keyLocation`: the key, and nothing else. */
+const keyFileContents = (key) => `${key}\n`;
+/**
+* How the endpoint's status codes actually read.
+*
+* `403` and `422` are the two that matter and they are easy to misdiagnose: both
+* mean the key file is wrong, not that the URLs are.
+*/
+function explain(status) {
+	switch (status) {
+		case 200:
+		case 202: return;
+		case 400: return "bad request — malformed URL list";
+		case 403: return "key file not found or its contents do not match the key";
+		case 422: return "a submitted URL does not belong to the key file host, or the key does not match";
+		case 429: return "rate limited — too many submissions";
+		default: return `unexpected status ${status}`;
+	}
+}
+/**
+* Verify the key file is live and correct before submitting.
+*
+* Worth a request of its own because of how IndexNow fails: a submission with an
+* unreachable key file returns `403`, but one with a *reachable* key file whose
+* contents are stale is accepted with `202` and then silently discarded. Checking
+* first is the only way to tell "submitted" from "submitted and ignored".
+*/
+async function verifyKeyFile(keyLocation, key, fetchImpl = fetch) {
+	let res;
+	try {
+		res = await fetchImpl(keyLocation, { method: "GET" });
+	} catch (e) {
+		return {
+			ok: false,
+			reason: `could not fetch ${keyLocation}: ${e.message}`
+		};
+	}
+	if (!res.ok) return {
+		ok: false,
+		reason: `${keyLocation} returned ${res.status}`
+	};
+	const body = (await res.text()).trim();
+	if (body !== key) return {
+		ok: false,
+		reason: `${keyLocation} does not contain the configured key (found ${body.length} chars)`
+	};
+	return { ok: true };
+}
+/**
+* Submit one batch. Callers iterate `plan.batches` — the split is the planner's
+* job, so that what gets sent is decided in the pure layer and visible in `--dry`.
+*/
+async function submitBatch(plan, urls, fetchImpl = fetch) {
+	const body = {
+		host: plan.host,
+		key: plan.key,
+		keyLocation: plan.keyLocation,
+		urlList: urls
+	};
+	const res = await fetchImpl(plan.endpoint, {
+		method: "POST",
+		headers: { "content-type": "application/json; charset=utf-8" },
+		body: JSON.stringify(body)
+	});
+	const message = explain(res.status);
+	return {
+		ok: res.ok,
+		status: res.status,
+		urls: urls.length,
+		...message ? { message } : {}
+	};
+}
+
+//#endregion
+//#region src/indexing/gsc.ts
+/**
+* Google Search Console — the two things its API will actually do.
+*
+* Worth stating plainly, because the gap between what people expect and what
+* exists is the whole reason this module is small: **there is no "request
+* indexing" endpoint.** The button in the Search Console UI is not exposed in the
+* API or anywhere else, and the sitemap ping endpoint was removed in 2023. What
+* remains is `sitemaps.submit` (write) and `urlInspection` (read).
+*
+* The Indexing API is deliberately not wired here. It is scoped to `JobPosting`
+* and `BroadcastEvent`; it accepts other URLs and discards them, and using it for
+* general pages violates its terms with the consumer's own GCP project on the
+* line. A toolchain should not ship that as a documented path.
+*
+* Auth is minted by hand with `node:crypto` rather than through `googleapis`,
+* which would be an enormous dependency in a CLI that installs into every consumer
+* project, for two endpoints.
+*/
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const SCOPE = "https://www.googleapis.com/auth/webmasters";
+const b64url = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/**
+* Parse a service-account credential from its two supported sources.
+*
+* `VITOPS_GSC_SERVICE_ACCOUNT` holds the JSON inline (what a CI secret store
+* gives you); `GOOGLE_APPLICATION_CREDENTIALS` holds a path (Google's own
+* convention, and what a local `gcloud` setup already has). Supporting both means
+* neither environment has to be reshaped to fit the tool.
+*/
+function parseServiceAccount(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error("service account is not valid JSON");
+	}
+	if (!parsed.client_email || !parsed.private_key) throw new Error("service account JSON is missing client_email or private_key");
+	return {
+		client_email: parsed.client_email,
+		private_key: parsed.private_key
+	};
+}
+/**
+* Exchange a service-account key for an access token (RS256 JWT bearer flow).
+*
+* `now` is a parameter so this is testable without mocking the clock.
+*/
+async function getAccessToken(account, fetchImpl = fetch, now = Date.now()) {
+	const iat = Math.floor(now / 1e3);
+	const header = b64url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}));
+	const claims = b64url(JSON.stringify({
+		iss: account.client_email,
+		scope: SCOPE,
+		aud: TOKEN_URL,
+		iat,
+		exp: iat + 3600
+	}));
+	const signer = createSign("RSA-SHA256");
+	signer.update(`${header}.${claims}`);
+	const pem = account.private_key.replace(/\\n/g, "\n");
+	const assertion = `${header}.${claims}.${b64url(signer.sign(pem))}`;
+	const res = await fetchImpl(TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+			assertion
+		}).toString()
+	});
+	if (!res.ok) throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);
+	const { access_token } = await res.json();
+	if (!access_token) throw new Error("token exchange returned no access_token");
+	return access_token;
+}
+const encodeSite = (siteUrl) => encodeURIComponent(siteUrl);
+/**
+* Re-submit a sitemap — the automated form of the manual resubmit in the UI.
+*
+* A `403` here almost always means `siteUrl` doesn't match the property exactly
+* (`sc-domain:acme.ca` vs `https://acme.ca/`) or the service account isn't an
+* owner of it, rather than that the sitemap is bad.
+*/
+async function submitSitemap(token, siteUrl, sitemapUrl, fetchImpl = fetch) {
+	const res = await fetchImpl(`https://www.googleapis.com/webmasters/v3/sites/${encodeSite(siteUrl)}/sitemaps/${encodeURIComponent(sitemapUrl)}`, {
+		method: "PUT",
+		headers: { authorization: `Bearer ${token}` }
+	});
+	if (res.ok) return {
+		ok: true,
+		status: res.status
+	};
+	const detail = res.status === 403 ? `403 — check that siteUrl "${siteUrl}" matches the Search Console property exactly and that the service account is an owner of it` : `${res.status}: ${await res.text()}`;
+	return {
+		ok: false,
+		status: res.status,
+		message: detail
+	};
+}
+/**
+* Inspect one URL. **Read-only** — this reports what Google did, it cannot ask for
+* anything. Quota is 2000 queries/day per property, which is why the caller works
+* from an explicit `priorityUrls` list rather than the whole sitemap.
+*/
+async function inspectUrl(token, siteUrl, inspectionUrl, fetchImpl = fetch) {
+	const res = await fetchImpl("https://searchconsole.googleapis.com/v1/urlInspection/index:inspect", {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${token}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			inspectionUrl,
+			siteUrl
+		})
+	});
+	if (!res.ok) return {
+		url: inspectionUrl,
+		indexed: false,
+		error: `${res.status}: ${await res.text()}`
+	};
+	const r = (await res.json()).inspectionResult?.indexStatusResult ?? {};
+	return {
+		url: inspectionUrl,
+		...r.verdict ? { verdict: r.verdict } : {},
+		...r.coverageState ? { coverageState: r.coverageState } : {},
+		...r.lastCrawlTime ? { lastCrawlTime: r.lastCrawlTime } : {},
+		indexed: r.verdict === "PASS"
+	};
+}
+
+//#endregion
+export { INDEXNOW_BATCH, INDEXNOW_ENDPOINT, SNAPSHOT_PATH, collectEntries, formatPlan, getAccessToken, inspectUrl, keyFileContents, newKey, parseServiceAccount, parseSitemap, plan, readSnapshot, resolveKeyLocation, resolveSitemapUrl, submitBatch, submitSitemap, toSnapshot, verifyKeyFile, writeSnapshot };
+//# sourceMappingURL=index.mjs.map

package/dist/indexing/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/indexing/plan.ts","../../src/indexing/sitemap.ts","../../src/indexing/snapshot.ts","../../src/indexing/indexnow.ts","../../src/indexing/gsc.ts"],"sourcesContent":["/**\n * Every decision `vitops indexing` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock. Everything the\n * command could get wrong — submitting a staging URL, submitting nothing because a\n * cache was cold, submitting a URL IndexNow will reject for the wrong host — is\n * decided here and asserted in `plan.test.ts`. The I/O modules beside this one do\n * what they are told and nothing else.\n *\n * That split is the same one `@getvitops/core`'s consent store makes against its\n * DOM wiring, for the same reason: the consequential logic has to be testable\n * without the environment it runs in.\n */\nimport type { IndexingConfig, SitemapEntry, Snapshot } from './types.ts';\n\nexport const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';\n\n/**\n * IndexNow's own cap per submission. Batches larger than this are split rather\n * than truncated — a silently dropped tail is the failure mode this command is\n * meant to eliminate, not reproduce.\n */\nexport const INDEXNOW_BATCH = 10_000;\n\n/** Why the URL set is what it is. */\nexport type UrlReason = 'explicit' | 'all' | 'cold' | 'diff';\n\n/** A channel's decision: on, or off with a stated reason. */\nexport interface ChannelPlan {\n  enabled: boolean;\n  /** Why it's off. Present iff `enabled` is false. */\n  skip?: string;\n}\n\nexport interface IndexNowPlan extends ChannelPlan {\n  endpoint: string;\n  keyLocation?: string | undefined;\n  key?: string | undefined;\n  host?: string | undefined;\n  /** URL batches, each within `INDEXNOW_BATCH`. */\n  batches: string[][];\n}\n\nexport interface SearchConsolePlan extends ChannelPlan {\n  siteUrl?: string | undefined;\n}\n\nexport interface IndexingPlan {\n  /** Set when the whole run is refused. Nothing is submitted. */\n  blocked?: string;\n  /** Always computed; `undefined` when nothing in the config resolves to one. */\n  sitemapUrl: string | undefined;\n  /** URLs that changed and should be submitted. */\n  urls: string[];\n  reason: UrlReason;\n  /** No usable previous snapshot — `urls` is everything. */\n  cold: boolean;\n  indexNow: IndexNowPlan;\n  searchConsole: SearchConsolePlan;\n  /** URLs `--check` will inspect. */\n  check: string[];\n  /** Things the operator needs to read. Printed by `--dry` and by a real run. */\n  notes: string[];\n}\n\nexport interface PlanInput {\n  config: IndexingConfig;\n  /** The sitemap as it stands now. */\n  current: SitemapEntry[];\n  /** The previous run's state, if any. */\n  previous?: Snapshot | undefined;\n  /** `--urls`: submit exactly these, skipping the diff. */\n  explicitUrls?: string[] | undefined;\n  /** `--all`: submit every URL in the sitemap. */\n  all?: boolean | undefined;\n}\n\nconst trimSlash = (s: string) => s.replace(/\\/+$/, '');\n\nfunction hostOf(url: string): string | undefined {\n  try {\n    return new URL(url).host;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (items.length === 0) return [];\n  const out: T[][] = [];\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));\n  return out;\n}\n\n/**\n * Resolve the sitemap URL.\n *\n * `sitemap-index.xml` is @astrojs/sitemap's default filename and is what\n * `vitops({ sitemap })` registers, so it is the right default here. It resolves to\n * a flat `<urlset>` on a small site, which `parseSitemap` handles by reading the\n * root element rather than the name.\n */\nexport function resolveSitemapUrl(config: IndexingConfig): string | undefined {\n  if (config.sitemapUrl) return config.sitemapUrl;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/sitemap-index.xml`;\n}\n\n/** Resolve the IndexNow key file URL. */\nexport function resolveKeyLocation(config: IndexingConfig): string | undefined {\n  const indexNow = config.indexNow;\n  if (!indexNow) return undefined;\n  if (indexNow.keyLocation) return indexNow.keyLocation;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/${indexNow.key}.txt`;\n}\n\n/** Which URLs differ from the snapshot. */\nfunction diff(current: SitemapEntry[], previous: Snapshot): string[] {\n  const changed: string[] = [];\n  for (const e of current) {\n    const before = previous.entries[e.loc];\n    // Absent from the snapshot → new. Present with a different lastmod → updated.\n    // A removed URL is deliberately not reported: there is nothing to submit for a\n    // page that no longer exists, and IndexNow has no deletion semantics.\n    if (before === undefined || before !== (e.lastmod ?? '')) changed.push(e.loc);\n  }\n  return changed;\n}\n\n/**\n * Decide what this run should do.\n *\n * Ordering of the URL-selection rules matters and is not arbitrary: an explicit\n * `--urls` is an operator overriding the tool, `--all` is an operator overriding\n * the diff, a cold snapshot is the tool having no basis to narrow, and the diff is\n * the normal path. Each is reported in `reason` so `--dry` explains itself.\n */\nexport function plan(input: PlanInput): IndexingPlan {\n  const { config, current, previous, explicitUrls, all } = input;\n  const notes: string[] = [];\n\n  const sitemapUrl = resolveSitemapUrl(config);\n  const check = config.priorityUrls ?? [];\n\n  /*\n   * The robots gate, before anything else.\n   *\n   * `environments.<env>.robots` already states whether a deployment is meant to be\n   * indexed. Submitting a `noindex` environment's URLs to IndexNow is not a\n   * no-op that the directive later undoes — it publishes the staging host to\n   * several search engines and their AI crawlers, and asks them to come look. The\n   * config knows the answer, so the tool must not need to be told twice.\n   */\n  if (config.robots && /\\bnoindex\\b/i.test(config.robots)) {\n    return {\n      blocked: `environment robots policy is \"${config.robots}\" — refusing to ask search engines to index an environment marked noindex`,\n      sitemapUrl,\n      urls: [],\n      reason: 'diff',\n      cold: false,\n      indexNow: { enabled: false, skip: 'blocked', endpoint: INDEXNOW_ENDPOINT, batches: [] },\n      searchConsole: { enabled: false, skip: 'blocked' },\n      check: [],\n      notes,\n    };\n  }\n\n  const cold = !explicitUrls && !all && !previous;\n\n  let urls: string[];\n  let reason: UrlReason;\n  if (explicitUrls?.length) {\n    urls = explicitUrls;\n    reason = 'explicit';\n  } else if (all) {\n    urls = current.map((e) => e.loc);\n    reason = 'all';\n  } else if (!previous) {\n    urls = current.map((e) => e.loc);\n    reason = 'cold';\n    notes.push(\n      `no previous snapshot — treating all ${urls.length} URLs as changed. Persist ${'`.vitops/`'} between runs (a CI cache) so later runs submit only what moved.`,\n    );\n  } else {\n    urls = diff(current, previous);\n    reason = 'diff';\n  }\n\n  /*\n   * The lastmod warning.\n   *\n   * Without per-URL lastmod the diff can still see pages appear and disappear, but\n   * it cannot see one change — so an edited page is never resubmitted and the\n   * command quietly does less than it appears to. Worth a note every run, because\n   * the output otherwise looks identical to the healthy case.\n   */\n  if (reason === 'diff' || reason === 'cold') {\n    const withLastmod = current.filter((e) => e.lastmod).length;\n    if (current.length > 0 && withLastmod === 0)\n      notes.push(\n        'no <lastmod> in the sitemap — only added/removed pages can be detected, never an edit. Wire `gitLastmod()` into your sitemap options, or pass --all.',\n      );\n    else if (withLastmod < current.length)\n      notes.push(\n        `${current.length - withLastmod} of ${current.length} sitemap entries have no <lastmod> — edits to those pages cannot be detected.`,\n      );\n  }\n\n  // ── IndexNow ────────────────────────────────────────────────────────────────\n  const keyLocation = resolveKeyLocation(config);\n  const keyHost = keyLocation ? hostOf(keyLocation) : undefined;\n  let indexNow: IndexNowPlan;\n  if (!config.indexNow) {\n    indexNow = {\n      enabled: false,\n      skip: 'not configured (seo.indexing.indexNow)',\n      endpoint: INDEXNOW_ENDPOINT,\n      batches: [],\n    };\n  } else if (!keyLocation) {\n    indexNow = {\n      enabled: false,\n      skip: 'no keyLocation and no domains.canonical to derive one',\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      key: config.indexNow.key,\n      batches: [],\n    };\n  } else {\n    /*\n     * IndexNow requires every URL in a submission to share the key file's host.\n     * A mixed batch is rejected whole, so the off-host URLs are dropped here and\n     * named — silently sending them would fail the on-host ones too.\n     */\n    const onHost = urls.filter((u) => hostOf(u) === keyHost);\n    const offHost = urls.length - onHost.length;\n    if (offHost > 0)\n      notes.push(\n        `IndexNow: dropped ${offHost} URL(s) not on ${keyHost} — a submission must match its key file's host.`,\n      );\n    indexNow = {\n      enabled: onHost.length > 0,\n      ...(onHost.length === 0 ? { skip: 'no URLs to submit' } : {}),\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      keyLocation,\n      key: config.indexNow.key,\n      ...(keyHost ? { host: keyHost } : {}),\n      batches: chunk(onHost, INDEXNOW_BATCH),\n    };\n  }\n\n  // ── Search Console ──────────────────────────────────────────────────────────\n  // Independent of `urls`: resubmitting the sitemap is what tells Google to\n  // re-read it, and it is worth doing whenever the sitemap was rebuilt — there is\n  // no per-URL submission to gate on, because Google exposes none.\n  let searchConsole: SearchConsolePlan;\n  if (!config.searchConsole) {\n    searchConsole = { enabled: false, skip: 'not configured (seo.indexing.searchConsole)' };\n  } else if (config.searchConsole.resubmitSitemap === false) {\n    searchConsole = {\n      enabled: false,\n      skip: 'resubmitSitemap is false',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else if (!sitemapUrl) {\n    searchConsole = {\n      enabled: false,\n      skip: 'no sitemapUrl and no domains.canonical to derive one',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else {\n    searchConsole = { enabled: true, siteUrl: config.searchConsole.siteUrl };\n  }\n\n  return {\n    sitemapUrl,\n    urls,\n    reason,\n    cold,\n    indexNow,\n    searchConsole,\n    check,\n    notes,\n  };\n}\n\n/** Render a plan as the human-readable block `--dry` prints. */\nexport function formatPlan(p: IndexingPlan): string {\n  const lines: string[] = [];\n  if (p.blocked) {\n    lines.push(`✗ blocked — ${p.blocked}`);\n    return lines.join('\\n');\n  }\n  lines.push(`sitemap    ${p.sitemapUrl ?? '(none)'}`);\n  lines.push(`urls       ${p.urls.length} (${p.reason})`);\n\n  lines.push(\n    p.indexNow.enabled\n      ? `IndexNow   ${p.indexNow.batches.reduce((n, b) => n + b.length, 0)} URL(s) → ${p.indexNow.endpoint}`\n      : `IndexNow   skipped — ${p.indexNow.skip}`,\n  );\n  lines.push(\n    p.searchConsole.enabled\n      ? `Search Console  resubmit sitemap → ${p.searchConsole.siteUrl}`\n      : `Search Console  skipped — ${p.searchConsole.skip}`,\n  );\n  for (const n of p.notes) lines.push(`  ! ${n}`);\n  return lines.join('\\n');\n}\n","/**\n * Sitemap parsing — enough of it, and no more.\n *\n * Hand-rolled rather than pulled from an XML library. A sitemap is a closed,\n * trivially-shaped document (`<urlset>` of `<url>`, or `<sitemapindex>` of\n * `<sitemap>`, each carrying `<loc>` and optionally `<lastmod>`), and this package\n * installs into every consumer project — a parser dependency for two element names\n * is not a trade worth making. The same reasoning the legal renderer applies to its\n * markdown subset: exactly as capable as the documents it has to read.\n */\nimport type { SitemapEntry } from './types.ts';\n\n/** What a sitemap document turned out to be. */\nexport interface ParsedSitemap {\n  /** `<url>` entries, when this was a `<urlset>`. */\n  entries: SitemapEntry[];\n  /** Child sitemap URLs, when this was a `<sitemapindex>`. */\n  sitemaps: string[];\n}\n\n/**\n * The five predefined XML entities, plus numeric character references.\n *\n * Not cosmetic: a sitemap URL carrying a query string is written `?a=1&amp;b=2`,\n * and submitting the un-decoded form means submitting a URL the site does not\n * serve — which IndexNow accepts and then silently fails to crawl.\n */\nfunction decodeXml(s: string): string {\n  return (\n    s\n      .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(Number.parseInt(h, 16)))\n      .replace(/&#(\\d+);/g, (_, d) => String.fromCodePoint(Number.parseInt(d, 10)))\n      .replace(/&lt;/g, '<')\n      .replace(/&gt;/g, '>')\n      .replace(/&quot;/g, '\"')\n      .replace(/&apos;/g, \"'\")\n      // `&amp;` last: decoding it first would let `&amp;lt;` collapse to `<`.\n      .replace(/&amp;/g, '&')\n  );\n}\n\nconst tag = (block: string, name: string): string | undefined => {\n  const m = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'i').exec(block);\n  return m ? decodeXml(m[1]!.trim()) : undefined;\n};\n\nfunction blocks(xml: string, name: string): string[] {\n  const out: string[] = [];\n  const re = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'gi');\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(xml))) out.push(m[1]!);\n  return out;\n}\n\n/**\n * Parse a sitemap or sitemap index.\n *\n * Which one it is comes from the root element, not from the filename — an\n * `sitemap-index.xml` that is actually a flat `<urlset>` is common enough\n * (@astrojs/sitemap emits an index only past `entryLimit`) that keying on the name\n * would misread the single-file case as \"no URLs\".\n */\nexport function parseSitemap(xml: string): ParsedSitemap {\n  if (/<sitemapindex[\\s>]/i.test(xml))\n    return {\n      entries: [],\n      sitemaps: blocks(xml, 'sitemap')\n        .map((b) => tag(b, 'loc'))\n        .filter((l): l is string => !!l),\n    };\n\n  const entries: SitemapEntry[] = [];\n  for (const b of blocks(xml, 'url')) {\n    const loc = tag(b, 'loc');\n    if (!loc) continue; // `<loc>` is required; an entry without one is unusable\n    const lastmod = tag(b, 'lastmod');\n    entries.push(lastmod ? { loc, lastmod } : { loc });\n  }\n  return { entries, sitemaps: [] };\n}\n\n/** Reads a sitemap from a URL or a local path. */\nexport type SitemapReader = (source: string) => Promise<string>;\n\n/**\n * Resolve a sitemap to its full entry list, following an index one level down.\n *\n * One level is the whole spec — the sitemaps protocol forbids an index pointing at\n * another index — so recursing further would only chase a malformed document.\n * Child fetches run sequentially: a large site's index can list dozens of files,\n * and hammering the consumer's own origin to save a second is a poor trade.\n */\nexport async function collectEntries(\n  source: string,\n  read: SitemapReader,\n): Promise<{ entries: SitemapEntry[]; sources: string[] }> {\n  const root = parseSitemap(await read(source));\n  if (root.sitemaps.length === 0) return { entries: root.entries, sources: [source] };\n\n  const entries: SitemapEntry[] = [];\n  const sources: string[] = [];\n  for (const child of root.sitemaps) {\n    const parsed = parseSitemap(await read(child));\n    entries.push(...parsed.entries);\n    sources.push(child);\n  }\n  return { entries, sources };\n}\n","/**\n * The previous run's sitemap state — what makes \"only submit what changed\"\n * possible at all.\n *\n * A plain JSON file rather than anything cleverer, because the thing reading it is\n * usually a CI job restoring a cache directory. It must survive being absent\n * (first run, cold cache) without pretending nothing changed — `readSnapshot`\n * returns `undefined` there and `plan()` treats that as \"submit everything, and\n * say so\".\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport type { SitemapEntry, Snapshot } from './types.ts';\n\n/** Default location, relative to the consumer's project root. */\nexport const SNAPSHOT_PATH = '.vitops/sitemap-snapshot.json';\n\n/**\n * Read a snapshot, or `undefined` when there isn't a usable one.\n *\n * A corrupt or wrong-version file reads as absent, not as empty. The distinction\n * matters: \"absent\" submits everything, whereas an empty entry map would look like\n * a site that legitimately has no URLs and submit nothing — the silent-success\n * failure this whole command exists to remove.\n */\nexport function readSnapshot(path: string): Snapshot | undefined {\n  if (!existsSync(path)) return undefined;\n  try {\n    const raw = JSON.parse(readFileSync(path, 'utf8')) as Snapshot;\n    if (raw?.version !== 1 || typeof raw.entries !== 'object' || raw.entries === null)\n      return undefined;\n    return raw;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Build a snapshot from the entries just read. */\nexport function toSnapshot(sitemapUrl: string, entries: SitemapEntry[], takenAt: string): Snapshot {\n  const map: Record<string, string> = {};\n  for (const e of entries) map[e.loc] = e.lastmod ?? '';\n  return { version: 1, sitemapUrl, takenAt, entries: map };\n}\n\n/**\n * Write the snapshot, creating its directory.\n *\n * Call this only after a submission actually succeeded. Writing it eagerly would\n * record URLs as notified that never were, and because the next run diffs against\n * it, those URLs would never be submitted again — a single transient 503 would\n * silently drop a page from every future run.\n */\nexport function writeSnapshot(path: string, snapshot: Snapshot): void {\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(snapshot, null, 2)}\\n`);\n}\n","/**\n * IndexNow submission.\n *\n * Honoured by Bing, Yandex, Naver, Seznam and Yep — and, through Bing's index, by\n * the AI crawlers built on it. **Not** by Google, which has never adopted the\n * protocol despite testing it; nothing here should be described to a consumer as\n * affecting Google results.\n *\n * Participating engines share submissions with each other, so one endpoint is\n * normally the whole integration.\n */\nimport { randomBytes } from 'node:crypto';\nimport type { IndexNowPlan } from './plan.ts';\n\n/** Generate a key. 32 hex characters, the conventional shape. */\nexport function newKey(): string {\n  return randomBytes(16).toString('hex');\n}\n\n/** The body of the key file served at `keyLocation`: the key, and nothing else. */\nexport const keyFileContents = (key: string): string => `${key}\\n`;\n\nexport interface SubmitResult {\n  ok: boolean;\n  status: number;\n  urls: number;\n  /** The endpoint's own explanation, when it gave one. */\n  message?: string;\n}\n\n/**\n * How the endpoint's status codes actually read.\n *\n * `403` and `422` are the two that matter and they are easy to misdiagnose: both\n * mean the key file is wrong, not that the URLs are.\n */\nfunction explain(status: number): string | undefined {\n  switch (status) {\n    case 200:\n    case 202:\n      return undefined;\n    case 400:\n      return 'bad request — malformed URL list';\n    case 403:\n      return 'key file not found or its contents do not match the key';\n    case 422:\n      return 'a submitted URL does not belong to the key file host, or the key does not match';\n    case 429:\n      return 'rate limited — too many submissions';\n    default:\n      return `unexpected status ${status}`;\n  }\n}\n\n/**\n * Verify the key file is live and correct before submitting.\n *\n * Worth a request of its own because of how IndexNow fails: a submission with an\n * unreachable key file returns `403`, but one with a *reachable* key file whose\n * contents are stale is accepted with `202` and then silently discarded. Checking\n * first is the only way to tell \"submitted\" from \"submitted and ignored\".\n */\nexport async function verifyKeyFile(\n  keyLocation: string,\n  key: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; reason?: string }> {\n  let res: Response;\n  try {\n    res = await fetchImpl(keyLocation, { method: 'GET' });\n  } catch (e) {\n    return { ok: false, reason: `could not fetch ${keyLocation}: ${(e as Error).message}` };\n  }\n  if (!res.ok) return { ok: false, reason: `${keyLocation} returned ${res.status}` };\n  const body = (await res.text()).trim();\n  if (body !== key)\n    return {\n      ok: false,\n      reason: `${keyLocation} does not contain the configured key (found ${body.length} chars)`,\n    };\n  return { ok: true };\n}\n\n/**\n * Submit one batch. Callers iterate `plan.batches` — the split is the planner's\n * job, so that what gets sent is decided in the pure layer and visible in `--dry`.\n */\nexport async function submitBatch(\n  plan: IndexNowPlan,\n  urls: string[],\n  fetchImpl: typeof fetch = fetch,\n): Promise<SubmitResult> {\n  const body = {\n    host: plan.host,\n    key: plan.key,\n    keyLocation: plan.keyLocation,\n    urlList: urls,\n  };\n  const res = await fetchImpl(plan.endpoint, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n    body: JSON.stringify(body),\n  });\n  const message = explain(res.status);\n  return { ok: res.ok, status: res.status, urls: urls.length, ...(message ? { message } : {}) };\n}\n","/**\n * Google Search Console — the two things its API will actually do.\n *\n * Worth stating plainly, because the gap between what people expect and what\n * exists is the whole reason this module is small: **there is no \"request\n * indexing\" endpoint.** The button in the Search Console UI is not exposed in the\n * API or anywhere else, and the sitemap ping endpoint was removed in 2023. What\n * remains is `sitemaps.submit` (write) and `urlInspection` (read).\n *\n * The Indexing API is deliberately not wired here. It is scoped to `JobPosting`\n * and `BroadcastEvent`; it accepts other URLs and discards them, and using it for\n * general pages violates its terms with the consumer's own GCP project on the\n * line. A toolchain should not ship that as a documented path.\n *\n * Auth is minted by hand with `node:crypto` rather than through `googleapis`,\n * which would be an enormous dependency in a CLI that installs into every consumer\n * project, for two endpoints.\n */\nimport { createSign } from 'node:crypto';\n\nconst TOKEN_URL = 'https://oauth2.googleapis.com/token';\nconst SCOPE = 'https://www.googleapis.com/auth/webmasters';\n\n/** The fields this module needs from a service-account JSON key. */\nexport interface ServiceAccount {\n  client_email: string;\n  private_key: string;\n}\n\nconst b64url = (input: Buffer | string): string =>\n  Buffer.from(input).toString('base64').replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n\n/**\n * Parse a service-account credential from its two supported sources.\n *\n * `VITOPS_GSC_SERVICE_ACCOUNT` holds the JSON inline (what a CI secret store\n * gives you); `GOOGLE_APPLICATION_CREDENTIALS` holds a path (Google's own\n * convention, and what a local `gcloud` setup already has). Supporting both means\n * neither environment has to be reshaped to fit the tool.\n */\nexport function parseServiceAccount(raw: string): ServiceAccount {\n  let parsed: Partial<ServiceAccount>;\n  try {\n    parsed = JSON.parse(raw) as Partial<ServiceAccount>;\n  } catch {\n    throw new Error('service account is not valid JSON');\n  }\n  if (!parsed.client_email || !parsed.private_key)\n    throw new Error('service account JSON is missing client_email or private_key');\n  return { client_email: parsed.client_email, private_key: parsed.private_key };\n}\n\n/**\n * Exchange a service-account key for an access token (RS256 JWT bearer flow).\n *\n * `now` is a parameter so this is testable without mocking the clock.\n */\nexport async function getAccessToken(\n  account: ServiceAccount,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  const iat = Math.floor(now / 1000);\n  const header = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = b64url(\n    JSON.stringify({\n      iss: account.client_email,\n      scope: SCOPE,\n      aud: TOKEN_URL,\n      iat,\n      exp: iat + 3600,\n    }),\n  );\n  const signer = createSign('RSA-SHA256');\n  signer.update(`${header}.${claims}`);\n  // `\\n` survives most secret stores as a literal; normalise so a pasted key works.\n  const pem = account.private_key.replace(/\\\\n/g, '\\n');\n  const assertion = `${header}.${claims}.${b64url(signer.sign(pem))}`;\n\n  const res = await fetchImpl(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n      assertion,\n    }).toString(),\n  });\n  if (!res.ok) {\n    // The body names the cause (clock skew, wrong audience, revoked key) and\n    // contains no secret — the assertion is in the request, not the response.\n    throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);\n  }\n  const { access_token } = (await res.json()) as { access_token?: string };\n  if (!access_token) throw new Error('token exchange returned no access_token');\n  return access_token;\n}\n\nconst encodeSite = (siteUrl: string) => encodeURIComponent(siteUrl);\n\n/**\n * Re-submit a sitemap — the automated form of the manual resubmit in the UI.\n *\n * A `403` here almost always means `siteUrl` doesn't match the property exactly\n * (`sc-domain:acme.ca` vs `https://acme.ca/`) or the service account isn't an\n * owner of it, rather than that the sitemap is bad.\n */\nexport async function submitSitemap(\n  token: string,\n  siteUrl: string,\n  sitemapUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const url = `https://www.googleapis.com/webmasters/v3/sites/${encodeSite(siteUrl)}/sitemaps/${encodeURIComponent(sitemapUrl)}`;\n  const res = await fetchImpl(url, {\n    method: 'PUT',\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (res.ok) return { ok: true, status: res.status };\n  const detail =\n    res.status === 403\n      ? `403 — check that siteUrl \"${siteUrl}\" matches the Search Console property exactly and that the service account is an owner of it`\n      : `${res.status}: ${await res.text()}`;\n  return { ok: false, status: res.status, message: detail };\n}\n\n/** What the URL Inspection API said about one page. */\nexport interface InspectionResult {\n  url: string;\n  /** Google's verdict, e.g. `PASS`, `NEUTRAL`, `FAIL`. */\n  verdict?: string;\n  /** e.g. `INDEXING_ALLOWED`, `BLOCKED_BY_ROBOTS_TXT`. */\n  coverageState?: string;\n  lastCrawlTime?: string;\n  /** True when Google reports the page as indexed. */\n  indexed: boolean;\n  error?: string;\n}\n\n/**\n * Inspect one URL. **Read-only** — this reports what Google did, it cannot ask for\n * anything. Quota is 2000 queries/day per property, which is why the caller works\n * from an explicit `priorityUrls` list rather than the whole sitemap.\n */\nexport async function inspectUrl(\n  token: string,\n  siteUrl: string,\n  inspectionUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<InspectionResult> {\n  const res = await fetchImpl(\n    'https://searchconsole.googleapis.com/v1/urlInspection/index:inspect',\n    {\n      method: 'POST',\n      headers: {\n        authorization: `Bearer ${token}`,\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify({ inspectionUrl, siteUrl }),\n    },\n  );\n  if (!res.ok)\n    return { url: inspectionUrl, indexed: false, error: `${res.status}: ${await res.text()}` };\n\n  const body = (await res.json()) as {\n    inspectionResult?: {\n      indexStatusResult?: { verdict?: string; coverageState?: string; lastCrawlTime?: string };\n    };\n  };\n  const r = body.inspectionResult?.indexStatusResult ?? {};\n  return {\n    url: inspectionUrl,\n    ...(r.verdict ? { verdict: r.verdict } : {}),\n    ...(r.coverageState ? { coverageState: r.coverageState } : {}),\n    ...(r.lastCrawlTime ? { lastCrawlTime: r.lastCrawlTime } : {}),\n    // `PASS` is the only verdict that means indexed. `NEUTRAL` covers \"discovered,\n    // not indexed\" and \"excluded by canonical\" — both are *not indexed*, and\n    // reading them as success would make --check pass on the exact pages it exists\n    // to catch.\n    indexed: r.verdict === 'PASS',\n  };\n}\n"],"mappings":";;;;;AAeA,MAAa,oBAAoB;;;;;;AAOjC,MAAa,iBAAiB;AAuD9B,MAAM,aAAa,MAAc,EAAE,QAAQ,QAAQ,EAAE;AAErD,SAAS,OAAO,KAAiC;CAC/C,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN;CACF;AACF;AAEA,SAAS,MAAS,OAAY,MAAqB;CACjD,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAChC,MAAM,MAAa,CAAC;CACpB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;CAC9E,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBAAkB,QAA4C;CAC5E,IAAI,OAAO,YAAY,OAAO,OAAO;CACrC,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE;AACxC;;AAGA,SAAgB,mBAAmB,QAA4C;CAC7E,MAAM,WAAW,OAAO;CACxB,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI,SAAS,aAAa,OAAO,SAAS;CAC1C,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE,GAAG,SAAS,IAAI;AACxD;;AAGA,SAAS,KAAK,SAAyB,UAA8B;CACnE,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,SAAS,SAAS,QAAQ,EAAE;EAIlC,IAAI,WAAW,UAAa,YAAY,EAAE,WAAW,KAAK,QAAQ,KAAK,EAAE,GAAG;CAC9E;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,KAAK,OAAgC;CACnD,MAAM,EAAE,QAAQ,SAAS,UAAU,cAAc,QAAQ;CACzD,MAAM,QAAkB,CAAC;CAEzB,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,QAAQ,OAAO,gBAAgB,CAAC;CAWtC,IAAI,OAAO,UAAU,eAAe,KAAK,OAAO,MAAM,GACpD,OAAO;EACL,SAAS,iCAAiC,OAAO,OAAO;EACxD;EACA,MAAM,CAAC;EACP,QAAQ;EACR,MAAM;EACN,UAAU;GAAE,SAAS;GAAO,MAAM;GAAW,UAAU;GAAmB,SAAS,CAAC;EAAE;EACtF,eAAe;GAAE,SAAS;GAAO,MAAM;EAAU;EACjD,OAAO,CAAC;EACR;CACF;CAGF,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;CAEvC,IAAI;CACJ,IAAI;CACJ,IAAI,cAAc,QAAQ;EACxB,OAAO;EACP,SAAS;CACX,OAAO,IAAI,KAAK;EACd,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;CACX,OAAO,IAAI,CAAC,UAAU;EACpB,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;EACT,MAAM,KACJ,uCAAuC,KAAK,OAAO,uGACrD;CACF,OAAO;EACL,OAAO,KAAK,SAAS,QAAQ;EAC7B,SAAS;CACX;CAUA,IAAI,WAAW,UAAU,WAAW,QAAQ;EAC1C,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,CAAC;EACrD,IAAI,QAAQ,SAAS,KAAK,gBAAgB,GACxC,MAAM,KACJ,sJACF;OACG,IAAI,cAAc,QAAQ,QAC7B,MAAM,KACJ,GAAG,QAAQ,SAAS,YAAY,MAAM,QAAQ,OAAO,8EACvD;CACJ;CAGA,MAAM,cAAc,mBAAmB,MAAM;CAC7C,MAAM,UAAU,cAAc,OAAO,WAAW,IAAI;CACpD,IAAI;CACJ,IAAI,CAAC,OAAO,UACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU;EACV,SAAS,CAAC;CACZ;MACK,IAAI,CAAC,aACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU,OAAO,SAAS;EAC1B,KAAK,OAAO,SAAS;EACrB,SAAS,CAAC;CACZ;MACK;EAML,MAAM,SAAS,KAAK,QAAQ,MAAM,OAAO,CAAC,MAAM,OAAO;EACvD,MAAM,UAAU,KAAK,SAAS,OAAO;EACrC,IAAI,UAAU,GACZ,MAAM,KACJ,qBAAqB,QAAQ,iBAAiB,QAAQ,gDACxD;EACF,WAAW;GACT,SAAS,OAAO,SAAS;GACzB,GAAI,OAAO,WAAW,IAAI,EAAE,MAAM,oBAAoB,IAAI,CAAC;GAC3D,UAAU,OAAO,SAAS;GAC1B;GACA,KAAK,OAAO,SAAS;GACrB,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;GACnC,SAAS,MAAM,QAAQ,cAAc;EACvC;CACF;CAMA,IAAI;CACJ,IAAI,CAAC,OAAO,eACV,gBAAgB;EAAE,SAAS;EAAO,MAAM;CAA8C;MACjF,IAAI,OAAO,cAAc,oBAAoB,OAClD,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MACK,IAAI,CAAC,YACV,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MAEA,gBAAgB;EAAE,SAAS;EAAM,SAAS,OAAO,cAAc;CAAQ;CAGzE,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,SAAgB,WAAW,GAAyB;CAClD,MAAM,QAAkB,CAAC;CACzB,IAAI,EAAE,SAAS;EACb,MAAM,KAAK,eAAe,EAAE,SAAS;EACrC,OAAO,MAAM,KAAK,IAAI;CACxB;CACA,MAAM,KAAK,cAAc,EAAE,cAAc,UAAU;CACnD,MAAM,KAAK,cAAc,EAAE,KAAK,OAAO,IAAI,EAAE,OAAO,EAAE;CAEtD,MAAM,KACJ,EAAE,SAAS,UACP,cAAc,EAAE,SAAS,QAAQ,QAAQ,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,aAC1F,wBAAwB,EAAE,SAAS,MACzC;CACA,MAAM,KACJ,EAAE,cAAc,UACZ,sCAAsC,EAAE,cAAc,YACtD,6BAA6B,EAAE,cAAc,MACnD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,OAAO,GAAG;CAC9C,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;;;;;;ACzRA,SAAS,UAAU,GAAmB;CACpC,OACE,EACG,QAAQ,wBAAwB,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CACtF,QAAQ,cAAc,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAC5E,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,WAAW,IAAG,CAAC,CACvB,QAAQ,WAAW,GAAG,CAAC,CAEvB,QAAQ,UAAU,GAAG;AAE5B;AAEA,MAAM,OAAO,OAAe,SAAqC;CAC/D,MAAM,IAAI,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK;CACpF,OAAO,IAAI,UAAU,EAAE,EAAE,CAAE,KAAK,CAAC,IAAI;AACvC;AAEA,SAAS,OAAO,KAAa,MAAwB;CACnD,MAAM,MAAgB,CAAC;CACvB,MAAM,KAAK,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,IAAI;CAC1E,IAAI;CACJ,OAAQ,IAAI,GAAG,KAAK,GAAG,GAAI,IAAI,KAAK,EAAE,EAAG;CACzC,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aAAa,KAA4B;CACvD,IAAI,sBAAsB,KAAK,GAAG,GAChC,OAAO;EACL,SAAS,CAAC;EACV,UAAU,OAAO,KAAK,SAAS,CAAC,CAC7B,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CACzB,QAAQ,MAAmB,CAAC,CAAC,CAAC;CACnC;CAEF,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,KAAK,OAAO,KAAK,KAAK,GAAG;EAClC,MAAM,MAAM,IAAI,GAAG,KAAK;EACxB,IAAI,CAAC,KAAK;EACV,MAAM,UAAU,IAAI,GAAG,SAAS;EAChC,QAAQ,KAAK,UAAU;GAAE;GAAK;EAAQ,IAAI,EAAE,IAAI,CAAC;CACnD;CACA,OAAO;EAAE;EAAS,UAAU,CAAC;CAAE;AACjC;;;;;;;;;AAaA,eAAsB,eACpB,QACA,MACyD;CACzD,MAAM,OAAO,aAAa,MAAM,KAAK,MAAM,CAAC;CAC5C,IAAI,KAAK,SAAS,WAAW,GAAG,OAAO;EAAE,SAAS,KAAK;EAAS,SAAS,CAAC,MAAM;CAAE;CAElF,MAAM,UAA0B,CAAC;CACjC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,KAAK,UAAU;EACjC,MAAM,SAAS,aAAa,MAAM,KAAK,KAAK,CAAC;EAC7C,QAAQ,KAAK,GAAG,OAAO,OAAO;EAC9B,QAAQ,KAAK,KAAK;CACpB;CACA,OAAO;EAAE;EAAS;CAAQ;AAC5B;;;;;;;;;;;;;;;AC5FA,MAAa,gBAAgB;;;;;;;;;AAU7B,SAAgB,aAAa,MAAoC;CAC/D,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;EACjD,IAAI,KAAK,YAAY,KAAK,OAAO,IAAI,YAAY,YAAY,IAAI,YAAY,MAC3E,OAAO;EACT,OAAO;CACT,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,WAAW,YAAoB,SAAyB,SAA2B;CACjG,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW;CACnD,OAAO;EAAE,SAAS;EAAG;EAAY;EAAS,SAAS;CAAI;AACzD;;;;;;;;;AAUA,SAAgB,cAAc,MAAc,UAA0B;CACpE,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,cAAc,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,GAAG;AAC9D;;;;;;;;;;;;;;;;ACxCA,SAAgB,SAAiB;CAC/B,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;AACvC;;AAGA,MAAa,mBAAmB,QAAwB,GAAG,IAAI;;;;;;;AAgB/D,SAAS,QAAQ,QAAoC;CACnD,QAAQ,QAAR;EACE,KAAK;EACL,KAAK,KACH;EACF,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,SACE,OAAO,qBAAqB;CAChC;AACF;;;;;;;;;AAUA,eAAsB,cACpB,aACA,KACA,YAA0B,OACiB;CAC3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,UAAU,aAAa,EAAE,QAAQ,MAAM,CAAC;CACtD,SAAS,GAAG;EACV,OAAO;GAAE,IAAI;GAAO,QAAQ,mBAAmB,YAAY,IAAK,EAAY;EAAU;CACxF;CACA,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,GAAG,YAAY,YAAY,IAAI;CAAS;CACjF,MAAM,QAAQ,MAAM,IAAI,KAAK,EAAC,CAAE,KAAK;CACrC,IAAI,SAAS,KACX,OAAO;EACL,IAAI;EACJ,QAAQ,GAAG,YAAY,8CAA8C,KAAK,OAAO;CACnF;CACF,OAAO,EAAE,IAAI,KAAK;AACpB;;;;;AAMA,eAAsB,YACpB,MACA,MACA,YAA0B,OACH;CACvB,MAAM,OAAO;EACX,MAAM,KAAK;EACX,KAAK,KAAK;EACV,aAAa,KAAK;EAClB,SAAS;CACX;CACA,MAAM,MAAM,MAAM,UAAU,KAAK,UAAU;EACzC,QAAQ;EACR,SAAS,EAAE,gBAAgB,kCAAkC;EAC7D,MAAM,KAAK,UAAU,IAAI;CAC3B,CAAC;CACD,MAAM,UAAU,QAAQ,IAAI,MAAM;CAClC,OAAO;EAAE,IAAI,IAAI;EAAI,QAAQ,IAAI;EAAQ,MAAM,KAAK;EAAQ,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;CAAG;AAC9F;;;;;;;;;;;;;;;;;;;;;;ACrFA,MAAM,YAAY;AAClB,MAAM,QAAQ;AAQd,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;;;;;;;;;AAUjG,SAAgB,oBAAoB,KAA6B;CAC/D,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,mCAAmC;CACrD;CACA,IAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,aAClC,MAAM,IAAI,MAAM,6DAA6D;CAC/E,OAAO;EAAE,cAAc,OAAO;EAAc,aAAa,OAAO;CAAY;AAC9E;;;;;;AAOA,eAAsB,eACpB,SACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CACjB,MAAM,MAAM,KAAK,MAAM,MAAM,GAAI;CACjC,MAAM,SAAS,OAAO,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CAClE,MAAM,SAAS,OACb,KAAK,UAAU;EACb,KAAK,QAAQ;EACb,OAAO;EACP,KAAK;EACL;EACA,KAAK,MAAM;CACb,CAAC,CACH;CACA,MAAM,SAAS,WAAW,YAAY;CACtC,OAAO,OAAO,GAAG,OAAO,GAAG,QAAQ;CAEnC,MAAM,MAAM,QAAQ,YAAY,QAAQ,QAAQ,IAAI;CACpD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG,CAAC;CAEhE,MAAM,MAAM,MAAM,UAAU,WAAW;EACrC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GACxB,YAAY;GACZ;EACF,CAAC,CAAC,CAAC,SAAS;CACd,CAAC;CACD,IAAI,CAAC,IAAI,IAGP,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;CAE9E,MAAM,EAAE,iBAAkB,MAAM,IAAI,KAAK;CACzC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;CAC5E,OAAO;AACT;AAEA,MAAM,cAAc,YAAoB,mBAAmB,OAAO;;;;;;;;AASlE,eAAsB,cACpB,OACA,SACA,YACA,YAA0B,OACkC;CAE5D,MAAM,MAAM,MAAM,UAAU,kDADkC,WAAW,OAAO,EAAE,YAAY,mBAAmB,UAAU,KAC1F;EAC/B,QAAQ;EACR,SAAS,EAAE,eAAe,UAAU,QAAQ;CAC9C,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;CAClD,MAAM,SACJ,IAAI,WAAW,MACX,6BAA6B,QAAQ,gGACrC,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;CACvC,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS;CAAO;AAC1D;;;;;;AAoBA,eAAsB,WACpB,OACA,SACA,eACA,YAA0B,OACC;CAC3B,MAAM,MAAM,MAAM,UAChB,uEACA;EACE,QAAQ;EACR,SAAS;GACP,eAAe,UAAU;GACzB,gBAAgB;EAClB;EACA,MAAM,KAAK,UAAU;GAAE;GAAe;EAAQ,CAAC;CACjD,CACF;CACA,IAAI,CAAC,IAAI,IACP,OAAO;EAAE,KAAK;EAAe,SAAS;EAAO,OAAO,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;CAAI;CAO3F,MAAM,KAAI,MALU,IAAI,KAAK,EAKf,CAAC,kBAAkB,qBAAqB,CAAC;CACvD,OAAO;EACL,KAAK;EACL,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;EAC1C,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAC5D,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAK5D,SAAS,EAAE,YAAY;CACzB;AACF"}