@getvitops/utils 7.0.0 → 8.0.0

package/dist/indexing/index.d.mts

@@ -1,4 +1,5 @@
-import { a as SCOPES, c as googleHeaders, i as GoogleOAuth, n as GoogleAuthLike, o as ServiceAccount, r as GoogleCredential, s as googleAccessToken, t as GoogleAuth } from "../token-BlShEM6J.mjs";
+import { a as SCOPES, c as googleHeaders, i as GoogleOAuth, n as GoogleAuthLike, o as ServiceAccount, r as GoogleCredential, s as googleAccessToken, t as GoogleAuth } from "../token-Bz_-igw-.mjs";
+import { n as adcQuotaProject, r as parseAdcUser, t as adcCredentialsPath } from "../adc-BFrzpMHq.mjs";
 
 //#region src/indexing/types.d.ts
 /**
@@ -105,9 +106,7 @@ interface IndexingPlan {
 }
 interface PlanInput {
   config: IndexingConfig;
-  /** The sitemap as it stands now. */
   current: SitemapEntry[];
-  /** The previous run's state, if any. */
   previous?: Snapshot | undefined;
   /** `--urls`: submit exactly these, skipping the diff. */
   explicitUrls?: string[] | undefined;
@@ -270,26 +269,5 @@ interface InspectionResult {
  */
 declare function inspectUrl(auth: GoogleAuthLike, siteUrl: string, inspectionUrl: string, fetchImpl?: typeof fetch): Promise<InspectionResult>;
 //#endregion
-//#region src/google/adc.d.ts
-/** A parsed ADC user credential, or `undefined` if `raw` is not one. */
-declare function parseAdcUser(raw: string): GoogleOAuth | undefined;
-/** The quota project gcloud recorded with an ADC credential, if any. */
-declare function adcQuotaProject(raw: string): string | undefined;
-/**
- * Where gcloud keeps ADC when nothing points at it explicitly.
- *
- * Reading the well-known path is what makes "I'm logged in" mean something, instead
- * of asking the user to export a variable at a file gcloud already wrote.
- * `CLOUDSDK_CONFIG` wins if set, as it does for gcloud itself.
- *
- * Every input is a parameter so the platform branches are testable on one machine.
- */
-declare function adcCredentialsPath(opts: {
-  env: Record<string, string | undefined>;
-  platform: string;
-  home: string | undefined;
-  join: (...parts: string[]) => string;
-}): string | undefined;
-//#endregion
 export { type ChannelPlan, type GoogleAuth, type GoogleAuthLike, type GoogleCredential, type GoogleOAuth, INDEXNOW_BATCH, INDEXNOW_ENDPOINT, type IndexNowConfig, type IndexNowPlan, type IndexingConfig, type IndexingPlan, type InspectionResult, type ParsedSitemap, type PlanInput, SCOPES, SNAPSHOT_PATH, type SearchConsoleConfig, type SearchConsolePlan, type ServiceAccount, type SitemapEntry, type SitemapReader, type Snapshot, type SubmitResult, type UrlReason, adcCredentialsPath, adcQuotaProject, collectEntries, formatPlan, googleAccessToken, googleHeaders, inspectUrl, keyFileContents, newKey, parseAdcUser, parseServiceAccount, parseSitemap, plan, readSnapshot, resolveKeyLocation, resolveSitemapUrl, serviceAccountToken, submitBatch, submitSitemap, toSnapshot, verifyKeyFile, writeSnapshot };
 //# sourceMappingURL=index.d.mts.map

package/dist/indexing/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/indexing/types.ts","../../src/indexing/plan.ts","../../src/indexing/sitemap.ts","../../src/indexing/snapshot.ts","../../src/indexing/indexnow.ts","../../src/indexing/gsc.ts","../../src/google/adc.ts"],"mappings":";;;;;;AAoBA;;;;;;;UAAiB,cAAA;EASP;AAIV;;;EARE,GAAA;EAYe;EAVf,WAAA;EAc6B;EAZ7B,QAAA;AAAA;;UAIe,mBAAA;EAaf;EAXA,OAAA;EAYA;EAVA,eAAe;AAAA;;UAIA,cAAA;EAaT;EAXN,SAAA;EAe2B;EAb3B,UAAA;EACA,QAAA,GAAW,cAAA;EACX,aAAA,GAAgB,mBAAmB;EAiBpB;EAff,YAAA;;;;;EAKA,MAAA;AAAA;;UAIe,YAAA;EACf,GAAA;EACA,OAAO;AAAA;;UAIQ,QAAA;EACf,OAAA;EACA,UAAA;EACA,OAAA;ECpD4B;EDsD5B,OAAA,EAAS,MAAM;AAAA;;;cCtDJ,iBAAA;;ADsBI;AAIjB;;;cCnBa,cAAA;;KAGD,SAAA;;UAGK,WAAA;EACf,OAAA;EDkBgB;EChBhB,IAAI;AAAA;AAAA,UAGW,YAAA,SAAqB,WAAW;EAC/C,QAAA;EACA,WAAA;EACA,GAAA;EACA,IAAA;EDqBA;ECnBA,OAAA;AAAA;AAAA,UAGe,iBAAA,SAA0B,WAAW;EACpD,OAAO;AAAA;AAAA,UAGQ,YAAA;EDmBf;ECjBA,OAAA;EDoBA;EClBA,UAAA;EDkBe;EChBf,IAAA;EACA,MAAA,EAAQ,SAAA;;EAER,IAAA;EACA,QAAA,EAAU,YAAA;EACV,aAAA,EAAe,iBAAA;;EAEf,KAAA;EA7C4B;EA+C5B,KAAA;AAAA;AAAA,UAGe,SAAA;EACf,MAAA,EAAQ,cAAA;EA5CiB;EA8CzB,OAAA,EAAS,YAAA;EA3CU;EA6CnB,QAAA,GAAW,QAAA;EA7CQ;EA+CnB,YAAA;EA5Ce;EA8Cf,GAAA;AAAA;;AA3CI;AAGN;;;;;;iBAoEgB,iBAAA,CAAkB,MAAsB,EAAd,cAAc;;iBAOxC,kBAAA,CAAmB,MAAsB,EAAd,cAAc;;;AArEhD;AAGT;;;;AACS;iBA8FO,IAAA,CAAK,KAAA,EAAO,SAAA,GAAY,YAAY;;iBA6KpC,UAAA,CAAW,CAAe,EAAZ,YAAY;;;AD1RhC;AAAA,UEhBO,aAAA;EFoBmB;EElBlC,OAAA,EAAS,YAAY;EFoBrB;EElBA,QAAA;AAAA;;;;;;;;;iBA6Cc,YAAA,CAAa,GAAA,WAAc,aAAa;;KAoB5C,aAAA,IAAiB,MAAA,aAAmB,OAAO;;AF5B/C;AAIR;;;;AAES;AAIT;iBE4BsB,cAAA,CACpB,MAAA,UACA,IAAA,EAAM,aAAA,GACL,OAAA;EAAU,OAAA,EAAS,YAAA;EAAgB,OAAA;AAAA;;;;cChFzB,aAAA;AHKb;;;;;;;;AAAA,iBGKgB,YAAA,CAAa,IAAA,WAAe,QAAQ;AHQpD;AAAA,iBGKgB,UAAA,CAAW,UAAA,UAAoB,OAAA,EAAS,YAAA,IAAgB,OAAA,WAAkB,QAAQ;;;AHDjF;AAIjB;;;;;iBGWgB,aAAA,CAAc,IAAA,UAAc,QAAA,EAAU,QAAQ;;;;iBCrC9C,MAAA;AJKhB;AAAA,cIAa,eAAA,GAAmB,GAAW;AAAA,UAE1B,YAAA;EACf,EAAA;EACA,MAAA;EACA,IAAA;EJIA;EIFA,OAAA;AAAA;AJMF;;;;AAIiB;AAIjB;;;AARA,iBI6BsB,aAAA,CACpB,WAAA,UACA,GAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAO;EAAG,EAAA;EAAa,MAAA;AAAA;;;;;iBAqBJ,WAAA,CACpB,IAAA,EAAM,YAAA,EACN,IAAA,YACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,YAAA;;;;;;;;;;;iBCtDK,mBAAA,CAAoB,GAAA,WAAc,cAAc;ALiBxD;AAIR;;;;AAJQ,iBKAQ,mBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,UAAkB,KAAA,EAClB,GAAA,YACC,OAAA;ALMH;;;;;;;AAAA,iBKWsB,aAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,UAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,OAAA;AAAA;;UAezB,gBAAA;EACf,GAAA;EJjF4B;EImF5B,OAAA;EJnF4B;EIqF5B,aAAA;EACA,aAAA;EJ/EyB;EIiFzB,OAAA;EACA,KAAA;AAAA;AJ/EF;;;;AAAqB;AAArB,iBIuFsB,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,aAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,gBAAA;;;ALhFM;AAAA,iBMnBD,YAAA,CAAa,GAAA,WAAc,WAAW;;iBAwBtC,eAAA,CAAgB,GAAW;;;;;;;;;;iBAiB3B,kBAAA,CAAmB,IAAA;EACjC,GAAA,EAAK,MAAM;EACX,QAAA;EACA,IAAA;EACA,IAAA,MAAU,KAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/indexing/types.ts","../../src/indexing/plan.ts","../../src/indexing/sitemap.ts","../../src/indexing/snapshot.ts","../../src/indexing/indexnow.ts","../../src/indexing/gsc.ts"],"mappings":";;;;;;;;AAoBA;;;;;;UAAiB,cAAA;EASP;AAAA;AAIV;;EARE,GAAA;EAUA;EARA,WAAA;EAce;EAZf,QAAA;AAAA;;UAIe,mBAAA;EAYf;EAVA,OAAA;EAWW;EATX,eAAe;AAAA;;UAIA,cAAA;EAaT;EAXN,SAAA;EAee;EAbf,UAAA;EACA,QAAA,GAAW,cAAA;EACX,aAAA,GAAgB,mBAAmB;EAa5B;EAXP,YAAA;EAeuB;;;;EAVvB,MAAA;AAAA;;UAIe,YAAA;EACf,GAAA;EACA,OAAO;AAAA;;UAIQ,QAAA;EACf,OAAA;EACA,UAAA;EACA,OAAA;ECpD4B;EDsD5B,OAAA,EAAS,MAAM;AAAA;;;cCtDJ,iBAAA;;;ADsBI;AAIjB;;cCnBa,cAAA;;KAGD,SAAA;;UAGK,WAAA;EACf,OAAA;EDkBA;EChBA,IAAI;AAAA;AAAA,UAGW,YAAA,SAAqB,WAAW;EAC/C,QAAA;EACA,WAAA;EACA,GAAA;EACA,IAAA;;EAEA,OAAA;AAAA;AAAA,UAGe,iBAAA,SAA0B,WAAW;EACpD,OAAO;AAAA;AAAA,UAGQ,YAAA;EDkBf;EChBA,OAAA;EDkBA;EChBA,UAAA;EDkBS;EChBT,IAAA;EACA,MAAA,EAAQ,SAAA;;EAER,IAAA;EACA,QAAA,EAAU,YAAA;EACV,aAAA,EAAe,iBAAA;EA3Ca;EA6C5B,KAAA;EA7C4B;EA+C5B,KAAA;AAAA;AAAA,UAGe,SAAA;EACf,MAAA,EAAQ,cAAA;EACR,OAAA,EAAS,YAAA;EACT,QAAA,GAAW,QAAA;EA3CD;EA6CV,YAAA;;EAEA,GAAA;AAAA;AA5CF;;;;AAGM;AAGN;;;AANA,iBAwEgB,iBAAA,CAAkB,MAAsB,EAAd,cAAc;;iBAOxC,kBAAA,CAAmB,MAAsB,EAAd,cAAc;;;;;;AAnEhD;AAGT;;iBA6FgB,IAAA,CAAK,KAAA,EAAO,SAAA,GAAY,YAAY;;iBA6KpC,UAAA,CAAW,CAAe,EAAZ,YAAY;;;;UCxSzB,aAAA;EFoBA;EElBf,OAAA,EAAS,YAAY;;EAErB,QAAA;AAAA;AFwBF;;;;;;;;AAAA,iBEqBgB,YAAA,CAAa,GAAA,WAAc,aAAa;;KAoB5C,aAAA,IAAiB,MAAA,aAAmB,OAAO;;;AF5B/C;AAIR;;;;AAES;iBEgCa,cAAA,CACpB,MAAA,UACA,IAAA,EAAM,aAAA,GACL,OAAA;EAAU,OAAA,EAAS,YAAA;EAAgB,OAAA;AAAA;;;;cCjFzB,aAAA;AHmBb;;;;AAIiB;AAIjB;;;AARA,iBGTgB,YAAA,CAAa,IAAA,WAAe,QAAQ;;iBAKpC,UAAA,CAAW,UAAA,UAAoB,OAAA,EAAS,YAAA,IAAgB,OAAA,WAAkB,QAAQ;;;;;;;;AHyB1F;iBGXQ,aAAA,CAAc,IAAA,UAAc,QAAA,EAAU,QAAQ;;;;iBC5B9C,MAAA;;cAKH,eAAA,GAAmB,GAAW;AAAA,UAE1B,YAAA;EACf,EAAA;EACA,MAAA;EACA,IAAA;EJEA;EIAA,OAAA;AAAA;AJEQ;AAIV;;;;AAIiB;AAIjB;;AAZU,iBIiCY,aAAA,CACpB,WAAA,UACA,GAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAO;EAAG,EAAA;EAAa,MAAA;AAAA;;;;;iBAqBJ,WAAA,CACpB,IAAA,EAAM,YAAA,EACN,IAAA,YACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,YAAA;;;;;;;;;;;iBCpDK,mBAAA,CAAoB,GAAA,WAAc,cAAc;;ALexD;AAIR;;;iBKFgB,mBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,UAAkB,KAAA,EAClB,GAAA,YACC,OAAA;ALAM;AAIT;;;;;;AAJS,iBKea,aAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,UAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,OAAA;AAAA;;UAgBzB,gBAAA;EACf,GAAA;EJlFW;EIoFX,OAAA;;EAEA,aAAA;EACA,aAAA;EJhFW;EIkFX,OAAA;EACA,KAAA;AAAA;AJnFyB;AAG3B;;;;AAH2B,iBI2FL,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,aAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,gBAAA"}

package/dist/indexing/index.mjs

@@ -1,6 +1,6 @@
-import { n as googleAccessToken, r as googleHeaders, t as SCOPES } from "../token-CuyjDo6I.mjs";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { n as writeVersioned, t as readVersioned } from "../json-store-30CFCbZZ.mjs";
+import { a as googleHeaders, i as googleAccessToken, n as encodeSite, r as errorDetail, t as SCOPES } from "../token-DkKC5m23.mjs";
+import { n as adcQuotaProject, r as parseAdcUser, t as adcCredentialsPath } from "../adc-D6aw2qgq.mjs";
 import { randomBytes } from "node:crypto";
 
 //#region src/indexing/plan.ts
@@ -269,16 +269,6 @@ async function collectEntries(source, read) {
 
 //#endregion
 //#region src/indexing/snapshot.ts
-/**
-* The previous run's sitemap state — what makes "only submit what changed"
-* possible at all.
-*
-* A plain JSON file rather than anything cleverer, because the thing reading it is
-* usually a CI job restoring a cache directory. It must survive being absent
-* (first run, cold cache) without pretending nothing changed — `readSnapshot`
-* returns `undefined` there and `plan()` treats that as "submit everything, and
-* say so".
-*/
 /** Default location, relative to the consumer's project root. */
 const SNAPSHOT_PATH = ".vitops/sitemap-snapshot.json";
 /**
@@ -290,14 +280,7 @@ const SNAPSHOT_PATH = ".vitops/sitemap-snapshot.json";
 * failure this whole command exists to remove.
 */
 function readSnapshot(path) {
-	if (!existsSync(path)) return void 0;
-	try {
-		const raw = JSON.parse(readFileSync(path, "utf8"));
-		if (raw?.version !== 1 || typeof raw.entries !== "object" || raw.entries === null) return void 0;
-		return raw;
-	} catch {
-		return;
-	}
+	return readVersioned(path, "entries");
 }
 /** Build a snapshot from the entries just read. */
 function toSnapshot(sitemapUrl, entries, takenAt) {
@@ -319,8 +302,7 @@ function toSnapshot(sitemapUrl, entries, takenAt) {
 * silently drop a page from every future run.
 */
 function writeSnapshot(path, snapshot) {
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(snapshot, null, 2)}\n`);
+	writeVersioned(path, snapshot);
 }
 
 //#endregion
@@ -467,7 +449,6 @@ function serviceAccountToken(account, fetchImpl = fetch, now = Date.now()) {
 		scope: SCOPES.webmasters
 	}, fetchImpl, now);
 }
-const encodeSite = (siteUrl) => encodeURIComponent(siteUrl);
 /**
 * Re-submit a sitemap — the automated form of the manual resubmit in the UI.
 *
@@ -484,11 +465,11 @@ async function submitSitemap(auth, siteUrl, sitemapUrl, fetchImpl = fetch) {
 		ok: true,
 		status: res.status
 	};
-	const detail = res.status === 403 ? `403 — check that siteUrl "${siteUrl}" matches the Search Console property exactly and that the service account is an owner of it` : `${res.status}: ${await res.text()}`;
+	const message = await errorDetail(res, (status) => status === 403 ? `403 — check that siteUrl "${siteUrl}" matches the Search Console property exactly and that the service account is an owner of it` : void 0);
 	return {
 		ok: false,
 		status: res.status,
-		message: detail
+		message
 	};
 }
 /**
@@ -520,49 +501,6 @@ async function inspectUrl(auth, siteUrl, inspectionUrl, fetchImpl = fetch) {
 	};
 }
 
-//#endregion
-//#region src/google/adc.ts
-/** A parsed ADC user credential, or `undefined` if `raw` is not one. */
-function parseAdcUser(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return;
-	}
-	if (parsed.type !== "authorized_user") return void 0;
-	if (!parsed.client_id || !parsed.client_secret || !parsed.refresh_token) return void 0;
-	return {
-		clientId: parsed.client_id,
-		clientSecret: parsed.client_secret,
-		refreshToken: parsed.refresh_token
-	};
-}
-/** The quota project gcloud recorded with an ADC credential, if any. */
-function adcQuotaProject(raw) {
-	try {
-		return JSON.parse(raw).quota_project_id || void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* Where gcloud keeps ADC when nothing points at it explicitly.
-*
-* Reading the well-known path is what makes "I'm logged in" mean something, instead
-* of asking the user to export a variable at a file gcloud already wrote.
-* `CLOUDSDK_CONFIG` wins if set, as it does for gcloud itself.
-*
-* Every input is a parameter so the platform branches are testable on one machine.
-*/
-function adcCredentialsPath(opts) {
-	const { env, platform, home, join } = opts;
-	const sdk = env.CLOUDSDK_CONFIG;
-	if (sdk) return join(sdk, "application_default_credentials.json");
-	if (platform === "win32") return env.APPDATA ? join(env.APPDATA, "gcloud", "application_default_credentials.json") : void 0;
-	return home ? join(home, ".config", "gcloud", "application_default_credentials.json") : void 0;
-}
-
 //#endregion
 export { INDEXNOW_BATCH, INDEXNOW_ENDPOINT, SCOPES, SNAPSHOT_PATH, adcCredentialsPath, adcQuotaProject, collectEntries, formatPlan, googleAccessToken, googleHeaders, inspectUrl, keyFileContents, newKey, parseAdcUser, parseServiceAccount, parseSitemap, plan, readSnapshot, resolveKeyLocation, resolveSitemapUrl, serviceAccountToken, submitBatch, submitSitemap, toSnapshot, verifyKeyFile, writeSnapshot };
 //# sourceMappingURL=index.mjs.map

package/dist/indexing/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/indexing/plan.ts","../../src/indexing/sitemap.ts","../../src/indexing/snapshot.ts","../../src/indexing/indexnow.ts","../../src/indexing/gsc.ts","../../src/google/adc.ts"],"sourcesContent":["/**\n * Every decision `vitops search notify` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock. Everything the\n * command could get wrong — submitting a staging URL, submitting nothing because a\n * cache was cold, submitting a URL IndexNow will reject for the wrong host — is\n * decided here and asserted in `plan.test.ts`. The I/O modules beside this one do\n * what they are told and nothing else.\n *\n * That split is the same one `@getvitops/core`'s consent store makes against its\n * DOM wiring, for the same reason: the consequential logic has to be testable\n * without the environment it runs in.\n */\nimport type { IndexingConfig, SitemapEntry, Snapshot } from './types.ts';\n\nexport const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';\n\n/**\n * IndexNow's own cap per submission. Batches larger than this are split rather\n * than truncated — a silently dropped tail is the failure mode this command is\n * meant to eliminate, not reproduce.\n */\nexport const INDEXNOW_BATCH = 10_000;\n\n/** Why the URL set is what it is. */\nexport type UrlReason = 'explicit' | 'all' | 'cold' | 'diff';\n\n/** A channel's decision: on, or off with a stated reason. */\nexport interface ChannelPlan {\n  enabled: boolean;\n  /** Why it's off. Present iff `enabled` is false. */\n  skip?: string;\n}\n\nexport interface IndexNowPlan extends ChannelPlan {\n  endpoint: string;\n  keyLocation?: string | undefined;\n  key?: string | undefined;\n  host?: string | undefined;\n  /** URL batches, each within `INDEXNOW_BATCH`. */\n  batches: string[][];\n}\n\nexport interface SearchConsolePlan extends ChannelPlan {\n  siteUrl?: string | undefined;\n}\n\nexport interface IndexingPlan {\n  /** Set when the whole run is refused. Nothing is submitted. */\n  blocked?: string;\n  /** Always computed; `undefined` when nothing in the config resolves to one. */\n  sitemapUrl: string | undefined;\n  /** URLs that changed and should be submitted. */\n  urls: string[];\n  reason: UrlReason;\n  /** No usable previous snapshot — `urls` is everything. */\n  cold: boolean;\n  indexNow: IndexNowPlan;\n  searchConsole: SearchConsolePlan;\n  /** URLs `--check` will inspect. */\n  check: string[];\n  /** Things the operator needs to read. Printed by `--dry` and by a real run. */\n  notes: string[];\n}\n\nexport interface PlanInput {\n  config: IndexingConfig;\n  /** The sitemap as it stands now. */\n  current: SitemapEntry[];\n  /** The previous run's state, if any. */\n  previous?: Snapshot | undefined;\n  /** `--urls`: submit exactly these, skipping the diff. */\n  explicitUrls?: string[] | undefined;\n  /** `--all`: submit every URL in the sitemap. */\n  all?: boolean | undefined;\n}\n\nconst trimSlash = (s: string) => s.replace(/\\/+$/, '');\n\nfunction hostOf(url: string): string | undefined {\n  try {\n    return new URL(url).host;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (items.length === 0) return [];\n  const out: T[][] = [];\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));\n  return out;\n}\n\n/**\n * Resolve the sitemap URL.\n *\n * `sitemap-index.xml` is @astrojs/sitemap's default filename and is what\n * `vitops({ sitemap })` registers, so it is the right default here. It resolves to\n * a flat `<urlset>` on a small site, which `parseSitemap` handles by reading the\n * root element rather than the name.\n */\nexport function resolveSitemapUrl(config: IndexingConfig): string | undefined {\n  if (config.sitemapUrl) return config.sitemapUrl;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/sitemap-index.xml`;\n}\n\n/** Resolve the IndexNow key file URL. */\nexport function resolveKeyLocation(config: IndexingConfig): string | undefined {\n  const indexNow = config.indexNow;\n  if (!indexNow) return undefined;\n  if (indexNow.keyLocation) return indexNow.keyLocation;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/${indexNow.key}.txt`;\n}\n\n/** Which URLs differ from the snapshot. */\nfunction diff(current: SitemapEntry[], previous: Snapshot): string[] {\n  const changed: string[] = [];\n  for (const e of current) {\n    const before = previous.entries[e.loc];\n    // Absent from the snapshot → new. Present with a different lastmod → updated.\n    // A removed URL is deliberately not reported: there is nothing to submit for a\n    // page that no longer exists, and IndexNow has no deletion semantics.\n    if (before === undefined || before !== (e.lastmod ?? '')) changed.push(e.loc);\n  }\n  return changed;\n}\n\n/**\n * Decide what this run should do.\n *\n * Ordering of the URL-selection rules matters and is not arbitrary: an explicit\n * `--urls` is an operator overriding the tool, `--all` is an operator overriding\n * the diff, a cold snapshot is the tool having no basis to narrow, and the diff is\n * the normal path. Each is reported in `reason` so `--dry` explains itself.\n */\nexport function plan(input: PlanInput): IndexingPlan {\n  const { config, current, previous, explicitUrls, all } = input;\n  const notes: string[] = [];\n\n  const sitemapUrl = resolveSitemapUrl(config);\n  const check = config.priorityUrls ?? [];\n\n  /*\n   * The robots gate, before anything else.\n   *\n   * `environments.<env>.robots` already states whether a deployment is meant to be\n   * indexed. Submitting a `noindex` environment's URLs to IndexNow is not a\n   * no-op that the directive later undoes — it publishes the staging host to\n   * several search engines and their AI crawlers, and asks them to come look. The\n   * config knows the answer, so the tool must not need to be told twice.\n   */\n  if (config.robots && /\\bnoindex\\b/i.test(config.robots)) {\n    return {\n      blocked: `environment robots policy is \"${config.robots}\" — refusing to ask search engines to index an environment marked noindex`,\n      sitemapUrl,\n      urls: [],\n      reason: 'diff',\n      cold: false,\n      indexNow: { enabled: false, skip: 'blocked', endpoint: INDEXNOW_ENDPOINT, batches: [] },\n      searchConsole: { enabled: false, skip: 'blocked' },\n      check: [],\n      notes,\n    };\n  }\n\n  const cold = !explicitUrls && !all && !previous;\n\n  let urls: string[];\n  let reason: UrlReason;\n  if (explicitUrls?.length) {\n    urls = explicitUrls;\n    reason = 'explicit';\n  } else if (all) {\n    urls = current.map((e) => e.loc);\n    reason = 'all';\n  } else if (!previous) {\n    urls = current.map((e) => e.loc);\n    reason = 'cold';\n    notes.push(\n      `no previous snapshot — treating all ${urls.length} URLs as changed. Persist ${'`.vitops/`'} between runs (a CI cache) so later runs submit only what moved.`,\n    );\n  } else {\n    urls = diff(current, previous);\n    reason = 'diff';\n  }\n\n  /*\n   * The foreign-sitemap check.\n   *\n   * A 404 fails loudly; a sitemap that is well-formed and *someone else's* does\n   * not. A downstream site's sitemap route collided with its CMS's, so the URL\n   * returned 200 with a valid document listing pages that were not theirs, and\n   * the run reported a healthy cold submission. Nothing downstream can catch\n   * this — the URLs parse, the diff works, the submission succeeds.\n   *\n   * Compared against the resolved environment origin rather than the canonical,\n   * for the same reason `toIndexingConfig` derives the origin that way: on a\n   * staging run the canonical IS the foreign host.\n   */\n  if (config.canonical && urls.length) {\n    const own = hostOf(`${trimSlash(config.canonical)}/`);\n    const foreign = [...new Set(urls.map(hostOf).filter((h): h is string => !!h && h !== own))];\n    if (foreign.length)\n      notes.push(\n        `sitemap contains ${urls.length - urls.filter((u) => hostOf(u) === own).length} URL(s) on ` +\n          `${foreign.join(', ')} rather than ${own} — check that ${sitemapUrl} is this site's own ` +\n          `sitemap and not another route answering that path.`,\n      );\n  }\n\n  /*\n   * The lastmod warning.\n   *\n   * Without per-URL lastmod the diff can still see pages appear and disappear, but\n   * it cannot see one change — so an edited page is never resubmitted and the\n   * command quietly does less than it appears to. Worth a note every run, because\n   * the output otherwise looks identical to the healthy case.\n   */\n  if (reason === 'diff' || reason === 'cold') {\n    const withLastmod = current.filter((e) => e.lastmod).length;\n    if (current.length > 0 && withLastmod === 0)\n      notes.push(\n        'no <lastmod> in the sitemap — only added/removed pages can be detected, never an edit. Wire `gitLastmod()` into your sitemap options, or pass --all.',\n      );\n    else if (withLastmod < current.length)\n      notes.push(\n        `${current.length - withLastmod} of ${current.length} sitemap entries have no <lastmod> — edits to those pages cannot be detected.`,\n      );\n  }\n\n  // ── IndexNow ────────────────────────────────────────────────────────────────\n  const keyLocation = resolveKeyLocation(config);\n  const keyHost = keyLocation ? hostOf(keyLocation) : undefined;\n  let indexNow: IndexNowPlan;\n  if (!config.indexNow) {\n    indexNow = {\n      enabled: false,\n      skip: 'not configured (seo.indexing.indexNow)',\n      endpoint: INDEXNOW_ENDPOINT,\n      batches: [],\n    };\n  } else if (!keyLocation) {\n    indexNow = {\n      enabled: false,\n      skip: 'no keyLocation and no domains.canonical to derive one',\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      key: config.indexNow.key,\n      batches: [],\n    };\n  } else {\n    /*\n     * IndexNow requires every URL in a submission to share the key file's host.\n     * A mixed batch is rejected whole, so the off-host URLs are dropped here and\n     * named — silently sending them would fail the on-host ones too.\n     */\n    const onHost = urls.filter((u) => hostOf(u) === keyHost);\n    const offHost = urls.length - onHost.length;\n    if (offHost > 0)\n      notes.push(\n        `IndexNow: dropped ${offHost} URL(s) not on ${keyHost} — a submission must match its key file's host.`,\n      );\n    indexNow = {\n      enabled: onHost.length > 0,\n      ...(onHost.length === 0 ? { skip: 'no URLs to submit' } : {}),\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      keyLocation,\n      key: config.indexNow.key,\n      ...(keyHost ? { host: keyHost } : {}),\n      batches: chunk(onHost, INDEXNOW_BATCH),\n    };\n  }\n\n  // ── Search Console ──────────────────────────────────────────────────────────\n  // Independent of `urls`: resubmitting the sitemap is what tells Google to\n  // re-read it, and it is worth doing whenever the sitemap was rebuilt — there is\n  // no per-URL submission to gate on, because Google exposes none.\n  let searchConsole: SearchConsolePlan;\n  if (!config.searchConsole) {\n    searchConsole = { enabled: false, skip: 'not configured (seo.indexing.searchConsole)' };\n  } else if (config.searchConsole.resubmitSitemap === false) {\n    searchConsole = {\n      enabled: false,\n      skip: 'resubmitSitemap is false',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else if (!sitemapUrl) {\n    searchConsole = {\n      enabled: false,\n      skip: 'no sitemapUrl and no domains.canonical to derive one',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else {\n    searchConsole = { enabled: true, siteUrl: config.searchConsole.siteUrl };\n  }\n\n  return {\n    sitemapUrl,\n    urls,\n    reason,\n    cold,\n    indexNow,\n    searchConsole,\n    check,\n    notes,\n  };\n}\n\n/** Render a plan as the human-readable block `--dry` prints. */\nexport function formatPlan(p: IndexingPlan): string {\n  const lines: string[] = [];\n  if (p.blocked) {\n    lines.push(`✗ blocked — ${p.blocked}`);\n    return lines.join('\\n');\n  }\n  lines.push(`sitemap    ${p.sitemapUrl ?? '(none)'}`);\n  lines.push(`urls       ${p.urls.length} (${p.reason})`);\n\n  lines.push(\n    p.indexNow.enabled\n      ? `IndexNow   ${p.indexNow.batches.reduce((n, b) => n + b.length, 0)} URL(s) → ${p.indexNow.endpoint}`\n      : `IndexNow   skipped — ${p.indexNow.skip}`,\n  );\n  lines.push(\n    p.searchConsole.enabled\n      ? `Search Console  resubmit sitemap → ${p.searchConsole.siteUrl}`\n      : `Search Console  skipped — ${p.searchConsole.skip}`,\n  );\n  for (const n of p.notes) lines.push(`  ! ${n}`);\n  return lines.join('\\n');\n}\n","/**\n * Sitemap parsing — enough of it, and no more.\n *\n * Hand-rolled rather than pulled from an XML library. A sitemap is a closed,\n * trivially-shaped document (`<urlset>` of `<url>`, or `<sitemapindex>` of\n * `<sitemap>`, each carrying `<loc>` and optionally `<lastmod>`), and this package\n * installs into every consumer project — a parser dependency for two element names\n * is not a trade worth making. The same reasoning the legal renderer applies to its\n * markdown subset: exactly as capable as the documents it has to read.\n */\nimport type { SitemapEntry } from './types.ts';\n\n/** What a sitemap document turned out to be. */\nexport interface ParsedSitemap {\n  /** `<url>` entries, when this was a `<urlset>`. */\n  entries: SitemapEntry[];\n  /** Child sitemap URLs, when this was a `<sitemapindex>`. */\n  sitemaps: string[];\n}\n\n/**\n * The five predefined XML entities, plus numeric character references.\n *\n * Not cosmetic: a sitemap URL carrying a query string is written `?a=1&amp;b=2`,\n * and submitting the un-decoded form means submitting a URL the site does not\n * serve — which IndexNow accepts and then silently fails to crawl.\n */\nfunction decodeXml(s: string): string {\n  return (\n    s\n      .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(Number.parseInt(h, 16)))\n      .replace(/&#(\\d+);/g, (_, d) => String.fromCodePoint(Number.parseInt(d, 10)))\n      .replace(/&lt;/g, '<')\n      .replace(/&gt;/g, '>')\n      .replace(/&quot;/g, '\"')\n      .replace(/&apos;/g, \"'\")\n      // `&amp;` last: decoding it first would let `&amp;lt;` collapse to `<`.\n      .replace(/&amp;/g, '&')\n  );\n}\n\nconst tag = (block: string, name: string): string | undefined => {\n  const m = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'i').exec(block);\n  return m ? decodeXml(m[1]!.trim()) : undefined;\n};\n\nfunction blocks(xml: string, name: string): string[] {\n  const out: string[] = [];\n  const re = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'gi');\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(xml))) out.push(m[1]!);\n  return out;\n}\n\n/**\n * Parse a sitemap or sitemap index.\n *\n * Which one it is comes from the root element, not from the filename — an\n * `sitemap-index.xml` that is actually a flat `<urlset>` is common enough\n * (@astrojs/sitemap emits an index only past `entryLimit`) that keying on the name\n * would misread the single-file case as \"no URLs\".\n */\nexport function parseSitemap(xml: string): ParsedSitemap {\n  if (/<sitemapindex[\\s>]/i.test(xml))\n    return {\n      entries: [],\n      sitemaps: blocks(xml, 'sitemap')\n        .map((b) => tag(b, 'loc'))\n        .filter((l): l is string => !!l),\n    };\n\n  const entries: SitemapEntry[] = [];\n  for (const b of blocks(xml, 'url')) {\n    const loc = tag(b, 'loc');\n    if (!loc) continue; // `<loc>` is required; an entry without one is unusable\n    const lastmod = tag(b, 'lastmod');\n    entries.push(lastmod ? { loc, lastmod } : { loc });\n  }\n  return { entries, sitemaps: [] };\n}\n\n/** Reads a sitemap from a URL or a local path. */\nexport type SitemapReader = (source: string) => Promise<string>;\n\n/**\n * Resolve a sitemap to its full entry list, following an index one level down.\n *\n * One level is the whole spec — the sitemaps protocol forbids an index pointing at\n * another index — so recursing further would only chase a malformed document.\n * Child fetches run sequentially: a large site's index can list dozens of files,\n * and hammering the consumer's own origin to save a second is a poor trade.\n */\nexport async function collectEntries(\n  source: string,\n  read: SitemapReader,\n): Promise<{ entries: SitemapEntry[]; sources: string[] }> {\n  const root = parseSitemap(await read(source));\n  if (root.sitemaps.length === 0) return { entries: root.entries, sources: [source] };\n\n  const entries: SitemapEntry[] = [];\n  const sources: string[] = [];\n  for (const child of root.sitemaps) {\n    const parsed = parseSitemap(await read(child));\n    entries.push(...parsed.entries);\n    sources.push(child);\n  }\n  return { entries, sources };\n}\n","/**\n * The previous run's sitemap state — what makes \"only submit what changed\"\n * possible at all.\n *\n * A plain JSON file rather than anything cleverer, because the thing reading it is\n * usually a CI job restoring a cache directory. It must survive being absent\n * (first run, cold cache) without pretending nothing changed — `readSnapshot`\n * returns `undefined` there and `plan()` treats that as \"submit everything, and\n * say so\".\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport type { SitemapEntry, Snapshot } from './types.ts';\n\n/** Default location, relative to the consumer's project root. */\nexport const SNAPSHOT_PATH = '.vitops/sitemap-snapshot.json';\n\n/**\n * Read a snapshot, or `undefined` when there isn't a usable one.\n *\n * A corrupt or wrong-version file reads as absent, not as empty. The distinction\n * matters: \"absent\" submits everything, whereas an empty entry map would look like\n * a site that legitimately has no URLs and submit nothing — the silent-success\n * failure this whole command exists to remove.\n */\nexport function readSnapshot(path: string): Snapshot | undefined {\n  if (!existsSync(path)) return undefined;\n  try {\n    const raw = JSON.parse(readFileSync(path, 'utf8')) as Snapshot;\n    if (raw?.version !== 1 || typeof raw.entries !== 'object' || raw.entries === null)\n      return undefined;\n    return raw;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Build a snapshot from the entries just read. */\nexport function toSnapshot(sitemapUrl: string, entries: SitemapEntry[], takenAt: string): Snapshot {\n  const map: Record<string, string> = {};\n  for (const e of entries) map[e.loc] = e.lastmod ?? '';\n  return { version: 1, sitemapUrl, takenAt, entries: map };\n}\n\n/**\n * Write the snapshot, creating its directory.\n *\n * Call this only after a submission actually succeeded. Writing it eagerly would\n * record URLs as notified that never were, and because the next run diffs against\n * it, those URLs would never be submitted again — a single transient 503 would\n * silently drop a page from every future run.\n */\nexport function writeSnapshot(path: string, snapshot: Snapshot): void {\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(snapshot, null, 2)}\\n`);\n}\n","/**\n * IndexNow submission.\n *\n * Honoured by Bing, Yandex, Naver, Seznam and Yep — and, through Bing's index, by\n * the AI crawlers built on it. **Not** by Google, which has never adopted the\n * protocol despite testing it; nothing here should be described to a consumer as\n * affecting Google results.\n *\n * Participating engines share submissions with each other, so one endpoint is\n * normally the whole integration.\n */\nimport { randomBytes } from 'node:crypto';\nimport type { IndexNowPlan } from './plan.ts';\n\n/** Generate a key. 32 hex characters, the conventional shape. */\nexport function newKey(): string {\n  return randomBytes(16).toString('hex');\n}\n\n/** The body of the key file served at `keyLocation`: the key, and nothing else. */\nexport const keyFileContents = (key: string): string => `${key}\\n`;\n\nexport interface SubmitResult {\n  ok: boolean;\n  status: number;\n  urls: number;\n  /** The endpoint's own explanation, when it gave one. */\n  message?: string;\n}\n\n/**\n * How the endpoint's status codes actually read.\n *\n * `403` and `422` are the two that matter and they are easy to misdiagnose: both\n * mean the key file is wrong, not that the URLs are.\n */\nfunction explain(status: number): string | undefined {\n  switch (status) {\n    case 200:\n    case 202:\n      return undefined;\n    case 400:\n      return 'bad request — malformed URL list';\n    case 403:\n      return 'key file not found or its contents do not match the key';\n    case 422:\n      return 'a submitted URL does not belong to the key file host, or the key does not match';\n    case 429:\n      return 'rate limited — too many submissions';\n    default:\n      return `unexpected status ${status}`;\n  }\n}\n\n/**\n * Verify the key file is live and correct before submitting.\n *\n * Worth a request of its own because of how IndexNow fails: a submission with an\n * unreachable key file returns `403`, but one with a *reachable* key file whose\n * contents are stale is accepted with `202` and then silently discarded. Checking\n * first is the only way to tell \"submitted\" from \"submitted and ignored\".\n */\nexport async function verifyKeyFile(\n  keyLocation: string,\n  key: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; reason?: string }> {\n  let res: Response;\n  try {\n    res = await fetchImpl(keyLocation, { method: 'GET' });\n  } catch (e) {\n    return { ok: false, reason: `could not fetch ${keyLocation}: ${(e as Error).message}` };\n  }\n  if (!res.ok) return { ok: false, reason: `${keyLocation} returned ${res.status}` };\n  const body = (await res.text()).trim();\n  if (body !== key)\n    return {\n      ok: false,\n      reason: `${keyLocation} does not contain the configured key (found ${body.length} chars)`,\n    };\n  return { ok: true };\n}\n\n/**\n * Submit one batch. Callers iterate `plan.batches` — the split is the planner's\n * job, so that what gets sent is decided in the pure layer and visible in `--dry`.\n */\nexport async function submitBatch(\n  plan: IndexNowPlan,\n  urls: string[],\n  fetchImpl: typeof fetch = fetch,\n): Promise<SubmitResult> {\n  const body = {\n    host: plan.host,\n    key: plan.key,\n    keyLocation: plan.keyLocation,\n    urlList: urls,\n  };\n  const res = await fetchImpl(plan.endpoint, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n    body: JSON.stringify(body),\n  });\n  const message = explain(res.status);\n  return { ok: res.ok, status: res.status, urls: urls.length, ...(message ? { message } : {}) };\n}\n","/**\n * Google Search Console — the two things its API will actually do.\n *\n * Worth stating plainly, because the gap between what people expect and what\n * exists is the whole reason this module is small: **there is no \"request\n * indexing\" endpoint.** The button in the Search Console UI is not exposed in the\n * API or anywhere else, and the sitemap ping endpoint was removed in 2023. What\n * remains is `sitemaps.submit` (write) and `urlInspection` (read).\n *\n * The Indexing API is deliberately not wired here. It is scoped to `JobPosting`\n * and `BroadcastEvent`; it accepts other URLs and discards them, and using it for\n * general pages violates its terms with the consumer's own GCP project on the\n * line. A toolchain should not ship that as a documented path.\n *\n * Auth is minted by hand rather than through `googleapis`, which would be an\n * enormous dependency in a CLI that installs into every consumer project, for two\n * endpoints. The exchange itself lives in `../google/token.ts` — it is shared with\n * the onboarding module, which needs the same token from a different grant.\n */\nimport {\n  googleAccessToken,\n  googleHeaders,\n  SCOPES,\n  type GoogleAuthLike,\n  type ServiceAccount,\n} from '../google/token.ts';\n\nexport type { ServiceAccount } from '../google/token.ts';\n\n/**\n * Parse a service-account credential from its two supported sources.\n *\n * `VITOPS_GSC_SERVICE_ACCOUNT` holds the JSON inline (what a CI secret store\n * gives you); `GOOGLE_APPLICATION_CREDENTIALS` holds a path (Google's own\n * convention, and what a local `gcloud` setup already has). Supporting both means\n * neither environment has to be reshaped to fit the tool.\n */\nexport function parseServiceAccount(raw: string): ServiceAccount {\n  let parsed: Partial<ServiceAccount>;\n  try {\n    parsed = JSON.parse(raw) as Partial<ServiceAccount>;\n  } catch {\n    throw new Error('service account is not valid JSON');\n  }\n  if (!parsed.client_email || !parsed.private_key)\n    throw new Error('service account JSON is missing client_email or private_key');\n  return { client_email: parsed.client_email, private_key: parsed.private_key };\n}\n\n/**\n * Exchange a service-account key for an access token (RS256 JWT bearer flow).\n *\n * `now` is a parameter so this is testable without mocking the clock.\n */\nexport function serviceAccountToken(\n  account: ServiceAccount,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  return googleAccessToken(\n    { kind: 'service-account', account, scope: SCOPES.webmasters },\n    fetchImpl,\n    now,\n  );\n}\n\nconst encodeSite = (siteUrl: string) => encodeURIComponent(siteUrl);\n\n/**\n * Re-submit a sitemap — the automated form of the manual resubmit in the UI.\n *\n * A `403` here almost always means `siteUrl` doesn't match the property exactly\n * (`sc-domain:acme.ca` vs `https://acme.ca/`) or the service account isn't an\n * owner of it, rather than that the sitemap is bad.\n */\nexport async function submitSitemap(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  sitemapUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const url = `https://www.googleapis.com/webmasters/v3/sites/${encodeSite(siteUrl)}/sitemaps/${encodeURIComponent(sitemapUrl)}`;\n  const res = await fetchImpl(url, {\n    method: 'PUT',\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status };\n  const detail =\n    res.status === 403\n      ? `403 — check that siteUrl \"${siteUrl}\" matches the Search Console property exactly and that the service account is an owner of it`\n      : `${res.status}: ${await res.text()}`;\n  return { ok: false, status: res.status, message: detail };\n}\n\n/** What the URL Inspection API said about one page. */\nexport interface InspectionResult {\n  url: string;\n  /** Google's verdict, e.g. `PASS`, `NEUTRAL`, `FAIL`. */\n  verdict?: string;\n  /** e.g. `INDEXING_ALLOWED`, `BLOCKED_BY_ROBOTS_TXT`. */\n  coverageState?: string;\n  lastCrawlTime?: string;\n  /** True when Google reports the page as indexed. */\n  indexed: boolean;\n  error?: string;\n}\n\n/**\n * Inspect one URL. **Read-only** — this reports what Google did, it cannot ask for\n * anything. Quota is 2000 queries/day per property, which is why the caller works\n * from an explicit `priorityUrls` list rather than the whole sitemap.\n */\nexport async function inspectUrl(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  inspectionUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<InspectionResult> {\n  const res = await fetchImpl(\n    'https://searchconsole.googleapis.com/v1/urlInspection/index:inspect',\n    {\n      method: 'POST',\n      headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n      body: JSON.stringify({ inspectionUrl, siteUrl }),\n    },\n  );\n  if (!res.ok)\n    return { url: inspectionUrl, indexed: false, error: `${res.status}: ${await res.text()}` };\n\n  const body = (await res.json()) as {\n    inspectionResult?: {\n      indexStatusResult?: { verdict?: string; coverageState?: string; lastCrawlTime?: string };\n    };\n  };\n  const r = body.inspectionResult?.indexStatusResult ?? {};\n  return {\n    url: inspectionUrl,\n    ...(r.verdict ? { verdict: r.verdict } : {}),\n    ...(r.coverageState ? { coverageState: r.coverageState } : {}),\n    ...(r.lastCrawlTime ? { lastCrawlTime: r.lastCrawlTime } : {}),\n    // `PASS` is the only verdict that means indexed. `NEUTRAL` covers \"discovered,\n    // not indexed\" and \"excluded by canonical\" — both are *not indexed*, and\n    // reading them as success would make --check pass on the exact pages it exists\n    // to catch.\n    indexed: r.verdict === 'PASS',\n  };\n}\n","/**\n * Application Default Credentials — recognising a credential gcloud already wrote.\n *\n * `gcloud auth application-default login` writes\n * `{ client_id, client_secret, refresh_token, type: \"authorized_user\" }`, which maps\n * field-for-field onto the refresh-token grant this package already performs. So the\n * only thing that ever stood between \"I'm logged in to gcloud\" and `vitops search`\n * was recognising the shape.\n *\n * Pure, and here rather than in the CLI, for the reason the consent store and the\n * indexing planner are: the decidable part (is this a user credential? where would\n * gcloud have put it?) is worth asserting without a filesystem, and the CLI keeps\n * only the `readFileSync`. `type` is the discriminator Google's own libraries switch\n * on — never the presence of fields, since a service-account JSON also has a `type`.\n */\nimport type { GoogleOAuth } from './token.ts';\n\n/** A parsed ADC user credential, or `undefined` if `raw` is not one. */\nexport function parseAdcUser(raw: string): GoogleOAuth | undefined {\n  let parsed: {\n    type?: string;\n    client_id?: string;\n    client_secret?: string;\n    refresh_token?: string;\n  };\n  try {\n    parsed = JSON.parse(raw) as typeof parsed;\n  } catch {\n    return undefined;\n  }\n  if (parsed.type !== 'authorized_user') return undefined;\n  // A truncated or half-written file is not a credential. Returning a partial one\n  // would defer the failure to a token exchange whose error names the wrong cause.\n  if (!parsed.client_id || !parsed.client_secret || !parsed.refresh_token) return undefined;\n  return {\n    clientId: parsed.client_id,\n    clientSecret: parsed.client_secret,\n    refreshToken: parsed.refresh_token,\n  };\n}\n\n/** The quota project gcloud recorded with an ADC credential, if any. */\nexport function adcQuotaProject(raw: string): string | undefined {\n  try {\n    return (JSON.parse(raw) as { quota_project_id?: string }).quota_project_id || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Where gcloud keeps ADC when nothing points at it explicitly.\n *\n * Reading the well-known path is what makes \"I'm logged in\" mean something, instead\n * of asking the user to export a variable at a file gcloud already wrote.\n * `CLOUDSDK_CONFIG` wins if set, as it does for gcloud itself.\n *\n * Every input is a parameter so the platform branches are testable on one machine.\n */\nexport function adcCredentialsPath(opts: {\n  env: Record<string, string | undefined>;\n  platform: string;\n  home: string | undefined;\n  join: (...parts: string[]) => string;\n}): string | undefined {\n  const { env, platform, home, join } = opts;\n  const sdk = env.CLOUDSDK_CONFIG;\n  if (sdk) return join(sdk, 'application_default_credentials.json');\n  if (platform === 'win32') {\n    return env.APPDATA\n      ? join(env.APPDATA, 'gcloud', 'application_default_credentials.json')\n      : undefined;\n  }\n  return home ? join(home, '.config', 'gcloud', 'application_default_credentials.json') : undefined;\n}\n"],"mappings":";;;;;;AAeA,MAAa,oBAAoB;;;;;;AAOjC,MAAa,iBAAiB;AAuD9B,MAAM,aAAa,MAAc,EAAE,QAAQ,QAAQ,EAAE;AAErD,SAAS,OAAO,KAAiC;CAC/C,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN;CACF;AACF;AAEA,SAAS,MAAS,OAAY,MAAqB;CACjD,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAChC,MAAM,MAAa,CAAC;CACpB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;CAC9E,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBAAkB,QAA4C;CAC5E,IAAI,OAAO,YAAY,OAAO,OAAO;CACrC,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE;AACxC;;AAGA,SAAgB,mBAAmB,QAA4C;CAC7E,MAAM,WAAW,OAAO;CACxB,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI,SAAS,aAAa,OAAO,SAAS;CAC1C,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE,GAAG,SAAS,IAAI;AACxD;;AAGA,SAAS,KAAK,SAAyB,UAA8B;CACnE,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,SAAS,SAAS,QAAQ,EAAE;EAIlC,IAAI,WAAW,UAAa,YAAY,EAAE,WAAW,KAAK,QAAQ,KAAK,EAAE,GAAG;CAC9E;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,KAAK,OAAgC;CACnD,MAAM,EAAE,QAAQ,SAAS,UAAU,cAAc,QAAQ;CACzD,MAAM,QAAkB,CAAC;CAEzB,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,QAAQ,OAAO,gBAAgB,CAAC;CAWtC,IAAI,OAAO,UAAU,eAAe,KAAK,OAAO,MAAM,GACpD,OAAO;EACL,SAAS,iCAAiC,OAAO,OAAO;EACxD;EACA,MAAM,CAAC;EACP,QAAQ;EACR,MAAM;EACN,UAAU;GAAE,SAAS;GAAO,MAAM;GAAW,UAAU;GAAmB,SAAS,CAAC;EAAE;EACtF,eAAe;GAAE,SAAS;GAAO,MAAM;EAAU;EACjD,OAAO,CAAC;EACR;CACF;CAGF,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;CAEvC,IAAI;CACJ,IAAI;CACJ,IAAI,cAAc,QAAQ;EACxB,OAAO;EACP,SAAS;CACX,OAAO,IAAI,KAAK;EACd,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;CACX,OAAO,IAAI,CAAC,UAAU;EACpB,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;EACT,MAAM,KACJ,uCAAuC,KAAK,OAAO,uGACrD;CACF,OAAO;EACL,OAAO,KAAK,SAAS,QAAQ;EAC7B,SAAS;CACX;CAeA,IAAI,OAAO,aAAa,KAAK,QAAQ;EACnC,MAAM,MAAM,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE,EAAE;EACpD,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC;EAC1F,IAAI,QAAQ,QACV,MAAM,KACJ,oBAAoB,KAAK,SAAS,KAAK,QAAQ,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,aAC1E,QAAQ,KAAK,IAAI,EAAE,eAAe,IAAI,gBAAgB,WAAW,uEAExE;CACJ;CAUA,IAAI,WAAW,UAAU,WAAW,QAAQ;EAC1C,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,CAAC;EACrD,IAAI,QAAQ,SAAS,KAAK,gBAAgB,GACxC,MAAM,KACJ,sJACF;OACG,IAAI,cAAc,QAAQ,QAC7B,MAAM,KACJ,GAAG,QAAQ,SAAS,YAAY,MAAM,QAAQ,OAAO,8EACvD;CACJ;CAGA,MAAM,cAAc,mBAAmB,MAAM;CAC7C,MAAM,UAAU,cAAc,OAAO,WAAW,IAAI;CACpD,IAAI;CACJ,IAAI,CAAC,OAAO,UACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU;EACV,SAAS,CAAC;CACZ;MACK,IAAI,CAAC,aACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU,OAAO,SAAS;EAC1B,KAAK,OAAO,SAAS;EACrB,SAAS,CAAC;CACZ;MACK;EAML,MAAM,SAAS,KAAK,QAAQ,MAAM,OAAO,CAAC,MAAM,OAAO;EACvD,MAAM,UAAU,KAAK,SAAS,OAAO;EACrC,IAAI,UAAU,GACZ,MAAM,KACJ,qBAAqB,QAAQ,iBAAiB,QAAQ,gDACxD;EACF,WAAW;GACT,SAAS,OAAO,SAAS;GACzB,GAAI,OAAO,WAAW,IAAI,EAAE,MAAM,oBAAoB,IAAI,CAAC;GAC3D,UAAU,OAAO,SAAS;GAC1B;GACA,KAAK,OAAO,SAAS;GACrB,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;GACnC,SAAS,MAAM,QAAQ,cAAc;EACvC;CACF;CAMA,IAAI;CACJ,IAAI,CAAC,OAAO,eACV,gBAAgB;EAAE,SAAS;EAAO,MAAM;CAA8C;MACjF,IAAI,OAAO,cAAc,oBAAoB,OAClD,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MACK,IAAI,CAAC,YACV,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MAEA,gBAAgB;EAAE,SAAS;EAAM,SAAS,OAAO,cAAc;CAAQ;CAGzE,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,SAAgB,WAAW,GAAyB;CAClD,MAAM,QAAkB,CAAC;CACzB,IAAI,EAAE,SAAS;EACb,MAAM,KAAK,eAAe,EAAE,SAAS;EACrC,OAAO,MAAM,KAAK,IAAI;CACxB;CACA,MAAM,KAAK,cAAc,EAAE,cAAc,UAAU;CACnD,MAAM,KAAK,cAAc,EAAE,KAAK,OAAO,IAAI,EAAE,OAAO,EAAE;CAEtD,MAAM,KACJ,EAAE,SAAS,UACP,cAAc,EAAE,SAAS,QAAQ,QAAQ,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,aAC1F,wBAAwB,EAAE,SAAS,MACzC;CACA,MAAM,KACJ,EAAE,cAAc,UACZ,sCAAsC,EAAE,cAAc,YACtD,6BAA6B,EAAE,cAAc,MACnD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,OAAO,GAAG;CAC9C,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;;;;;;ACjTA,SAAS,UAAU,GAAmB;CACpC,OACE,EACG,QAAQ,wBAAwB,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CACtF,QAAQ,cAAc,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAC5E,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,WAAW,IAAG,CAAC,CACvB,QAAQ,WAAW,GAAG,CAAC,CAEvB,QAAQ,UAAU,GAAG;AAE5B;AAEA,MAAM,OAAO,OAAe,SAAqC;CAC/D,MAAM,IAAI,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK;CACpF,OAAO,IAAI,UAAU,EAAE,EAAE,CAAE,KAAK,CAAC,IAAI;AACvC;AAEA,SAAS,OAAO,KAAa,MAAwB;CACnD,MAAM,MAAgB,CAAC;CACvB,MAAM,KAAK,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,IAAI;CAC1E,IAAI;CACJ,OAAQ,IAAI,GAAG,KAAK,GAAG,GAAI,IAAI,KAAK,EAAE,EAAG;CACzC,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aAAa,KAA4B;CACvD,IAAI,sBAAsB,KAAK,GAAG,GAChC,OAAO;EACL,SAAS,CAAC;EACV,UAAU,OAAO,KAAK,SAAS,CAAC,CAC7B,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CACzB,QAAQ,MAAmB,CAAC,CAAC,CAAC;CACnC;CAEF,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,KAAK,OAAO,KAAK,KAAK,GAAG;EAClC,MAAM,MAAM,IAAI,GAAG,KAAK;EACxB,IAAI,CAAC,KAAK;EACV,MAAM,UAAU,IAAI,GAAG,SAAS;EAChC,QAAQ,KAAK,UAAU;GAAE;GAAK;EAAQ,IAAI,EAAE,IAAI,CAAC;CACnD;CACA,OAAO;EAAE;EAAS,UAAU,CAAC;CAAE;AACjC;;;;;;;;;AAaA,eAAsB,eACpB,QACA,MACyD;CACzD,MAAM,OAAO,aAAa,MAAM,KAAK,MAAM,CAAC;CAC5C,IAAI,KAAK,SAAS,WAAW,GAAG,OAAO;EAAE,SAAS,KAAK;EAAS,SAAS,CAAC,MAAM;CAAE;CAElF,MAAM,UAA0B,CAAC;CACjC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,KAAK,UAAU;EACjC,MAAM,SAAS,aAAa,MAAM,KAAK,KAAK,CAAC;EAC7C,QAAQ,KAAK,GAAG,OAAO,OAAO;EAC9B,QAAQ,KAAK,KAAK;CACpB;CACA,OAAO;EAAE;EAAS;CAAQ;AAC5B;;;;;;;;;;;;;;;AC5FA,MAAa,gBAAgB;;;;;;;;;AAU7B,SAAgB,aAAa,MAAoC;CAC/D,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;EACjD,IAAI,KAAK,YAAY,KAAK,OAAO,IAAI,YAAY,YAAY,IAAI,YAAY,MAC3E,OAAO;EACT,OAAO;CACT,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,WAAW,YAAoB,SAAyB,SAA2B;CACjG,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW;CACnD,OAAO;EAAE,SAAS;EAAG;EAAY;EAAS,SAAS;CAAI;AACzD;;;;;;;;;AAUA,SAAgB,cAAc,MAAc,UAA0B;CACpE,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,cAAc,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,GAAG;AAC9D;;;;;;;;;;;;;;;;ACxCA,SAAgB,SAAiB;CAC/B,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;AACvC;;AAGA,MAAa,mBAAmB,QAAwB,GAAG,IAAI;;;;;;;AAgB/D,SAAS,QAAQ,QAAoC;CACnD,QAAQ,QAAR;EACE,KAAK;EACL,KAAK,KACH;EACF,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,SACE,OAAO,qBAAqB;CAChC;AACF;;;;;;;;;AAUA,eAAsB,cACpB,aACA,KACA,YAA0B,OACiB;CAC3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,UAAU,aAAa,EAAE,QAAQ,MAAM,CAAC;CACtD,SAAS,GAAG;EACV,OAAO;GAAE,IAAI;GAAO,QAAQ,mBAAmB,YAAY,IAAK,EAAY;EAAU;CACxF;CACA,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,GAAG,YAAY,YAAY,IAAI;CAAS;CACjF,MAAM,QAAQ,MAAM,IAAI,KAAK,EAAC,CAAE,KAAK;CACrC,IAAI,SAAS,KACX,OAAO;EACL,IAAI;EACJ,QAAQ,GAAG,YAAY,8CAA8C,KAAK,OAAO;CACnF;CACF,OAAO,EAAE,IAAI,KAAK;AACpB;;;;;AAMA,eAAsB,YACpB,MACA,MACA,YAA0B,OACH;CACvB,MAAM,OAAO;EACX,MAAM,KAAK;EACX,KAAK,KAAK;EACV,aAAa,KAAK;EAClB,SAAS;CACX;CACA,MAAM,MAAM,MAAM,UAAU,KAAK,UAAU;EACzC,QAAQ;EACR,SAAS,EAAE,gBAAgB,kCAAkC;EAC7D,MAAM,KAAK,UAAU,IAAI;CAC3B,CAAC;CACD,MAAM,UAAU,QAAQ,IAAI,MAAM;CAClC,OAAO;EAAE,IAAI,IAAI;EAAI,QAAQ,IAAI;EAAQ,MAAM,KAAK;EAAQ,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;CAAG;AAC9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACpEA,SAAgB,oBAAoB,KAA6B;CAC/D,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,mCAAmC;CACrD;CACA,IAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,aAClC,MAAM,IAAI,MAAM,6DAA6D;CAC/E,OAAO;EAAE,cAAc,OAAO;EAAc,aAAa,OAAO;CAAY;AAC9E;;;;;;AAOA,SAAgB,oBACd,SACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CACjB,OAAO,kBACL;EAAE,MAAM;EAAmB;EAAS,OAAO,OAAO;CAAW,GAC7D,WACA,GACF;AACF;AAEA,MAAM,cAAc,YAAoB,mBAAmB,OAAO;;;;;;;;AASlE,eAAsB,cACpB,MACA,SACA,YACA,YAA0B,OACkC;CAE5D,MAAM,MAAM,MAAM,UAAU,kDADkC,WAAW,OAAO,EAAE,YAAY,mBAAmB,UAAU,KAC1F;EAC/B,QAAQ;EACR,SAAS,cAAc,IAAI;CAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;CAClD,MAAM,SACJ,IAAI,WAAW,MACX,6BAA6B,QAAQ,gGACrC,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;CACvC,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS;CAAO;AAC1D;;;;;;AAoBA,eAAsB,WACpB,MACA,SACA,eACA,YAA0B,OACC;CAC3B,MAAM,MAAM,MAAM,UAChB,uEACA;EACE,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE;GAAe;EAAQ,CAAC;CACjD,CACF;CACA,IAAI,CAAC,IAAI,IACP,OAAO;EAAE,KAAK;EAAe,SAAS;EAAO,OAAO,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;CAAI;CAO3F,MAAM,KAAI,MALU,IAAI,KAAK,EAKf,CAAC,kBAAkB,qBAAqB,CAAC;CACvD,OAAO;EACL,KAAK;EACL,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;EAC1C,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAC5D,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAK5D,SAAS,EAAE,YAAY;CACzB;AACF;;;;;AChIA,SAAgB,aAAa,KAAsC;CACjE,IAAI;CAMJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN;CACF;CACA,IAAI,OAAO,SAAS,mBAAmB,OAAO;CAG9C,IAAI,CAAC,OAAO,aAAa,CAAC,OAAO,iBAAiB,CAAC,OAAO,eAAe,OAAO;CAChF,OAAO;EACL,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,cAAc,OAAO;CACvB;AACF;;AAGA,SAAgB,gBAAgB,KAAiC;CAC/D,IAAI;EACF,OAAQ,KAAK,MAAM,GAAG,CAAC,CAAmC,oBAAoB;CAChF,QAAQ;EACN;CACF;AACF;;;;;;;;;;AAWA,SAAgB,mBAAmB,MAKZ;CACrB,MAAM,EAAE,KAAK,UAAU,MAAM,SAAS;CACtC,MAAM,MAAM,IAAI;CAChB,IAAI,KAAK,OAAO,KAAK,KAAK,sCAAsC;CAChE,IAAI,aAAa,SACf,OAAO,IAAI,UACP,KAAK,IAAI,SAAS,UAAU,sCAAsC,IAClE;CAEN,OAAO,OAAO,KAAK,MAAM,WAAW,UAAU,sCAAsC,IAAI;AAC1F"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/indexing/plan.ts","../../src/indexing/sitemap.ts","../../src/indexing/snapshot.ts","../../src/indexing/indexnow.ts","../../src/indexing/gsc.ts"],"sourcesContent":["/**\n * Every decision `vitops search notify` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock. Everything the\n * command could get wrong — submitting a staging URL, submitting nothing because a\n * cache was cold, submitting a URL IndexNow will reject for the wrong host — is\n * decided here and asserted in `plan.test.ts`. The I/O modules beside this one do\n * what they are told and nothing else.\n *\n * That split is the same one `@getvitops/core`'s consent store makes against its\n * DOM wiring, for the same reason: the consequential logic has to be testable\n * without the environment it runs in.\n */\nimport type { IndexingConfig, SitemapEntry, Snapshot } from './types.ts';\n\nexport const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';\n\n/**\n * IndexNow's own cap per submission. Batches larger than this are split rather\n * than truncated — a silently dropped tail is the failure mode this command is\n * meant to eliminate, not reproduce.\n */\nexport const INDEXNOW_BATCH = 10_000;\n\n/** Why the URL set is what it is. */\nexport type UrlReason = 'explicit' | 'all' | 'cold' | 'diff';\n\n/** A channel's decision: on, or off with a stated reason. */\nexport interface ChannelPlan {\n  enabled: boolean;\n  /** Why it's off. Present iff `enabled` is false. */\n  skip?: string;\n}\n\nexport interface IndexNowPlan extends ChannelPlan {\n  endpoint: string;\n  keyLocation?: string | undefined;\n  key?: string | undefined;\n  host?: string | undefined;\n  /** URL batches, each within `INDEXNOW_BATCH`. */\n  batches: string[][];\n}\n\nexport interface SearchConsolePlan extends ChannelPlan {\n  siteUrl?: string | undefined;\n}\n\nexport interface IndexingPlan {\n  /** Set when the whole run is refused. Nothing is submitted. */\n  blocked?: string;\n  /** Always computed; `undefined` when nothing in the config resolves to one. */\n  sitemapUrl: string | undefined;\n  /** URLs that changed and should be submitted. */\n  urls: string[];\n  reason: UrlReason;\n  /** No usable previous snapshot — `urls` is everything. */\n  cold: boolean;\n  indexNow: IndexNowPlan;\n  searchConsole: SearchConsolePlan;\n  /** URLs `--check` will inspect. */\n  check: string[];\n  /** Things the operator needs to read. Printed by `--dry` and by a real run. */\n  notes: string[];\n}\n\nexport interface PlanInput {\n  config: IndexingConfig;\n  current: SitemapEntry[];\n  previous?: Snapshot | undefined;\n  /** `--urls`: submit exactly these, skipping the diff. */\n  explicitUrls?: string[] | undefined;\n  /** `--all`: submit every URL in the sitemap. */\n  all?: boolean | undefined;\n}\n\nconst trimSlash = (s: string) => s.replace(/\\/+$/, '');\n\nfunction hostOf(url: string): string | undefined {\n  try {\n    return new URL(url).host;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (items.length === 0) return [];\n  const out: T[][] = [];\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));\n  return out;\n}\n\n/**\n * Resolve the sitemap URL.\n *\n * `sitemap-index.xml` is @astrojs/sitemap's default filename and is what\n * `vitops({ sitemap })` registers, so it is the right default here. It resolves to\n * a flat `<urlset>` on a small site, which `parseSitemap` handles by reading the\n * root element rather than the name.\n */\nexport function resolveSitemapUrl(config: IndexingConfig): string | undefined {\n  if (config.sitemapUrl) return config.sitemapUrl;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/sitemap-index.xml`;\n}\n\n/** Resolve the IndexNow key file URL. */\nexport function resolveKeyLocation(config: IndexingConfig): string | undefined {\n  const indexNow = config.indexNow;\n  if (!indexNow) return undefined;\n  if (indexNow.keyLocation) return indexNow.keyLocation;\n  if (!config.canonical) return undefined;\n  return `${trimSlash(config.canonical)}/${indexNow.key}.txt`;\n}\n\n/** Which URLs differ from the snapshot. */\nfunction diff(current: SitemapEntry[], previous: Snapshot): string[] {\n  const changed: string[] = [];\n  for (const e of current) {\n    const before = previous.entries[e.loc];\n    // Absent from the snapshot → new. Present with a different lastmod → updated.\n    // A removed URL is deliberately not reported: there is nothing to submit for a\n    // page that no longer exists, and IndexNow has no deletion semantics.\n    if (before === undefined || before !== (e.lastmod ?? '')) changed.push(e.loc);\n  }\n  return changed;\n}\n\n/**\n * Decide what this run should do.\n *\n * Ordering of the URL-selection rules matters and is not arbitrary: an explicit\n * `--urls` is an operator overriding the tool, `--all` is an operator overriding\n * the diff, a cold snapshot is the tool having no basis to narrow, and the diff is\n * the normal path. Each is reported in `reason` so `--dry` explains itself.\n */\nexport function plan(input: PlanInput): IndexingPlan {\n  const { config, current, previous, explicitUrls, all } = input;\n  const notes: string[] = [];\n\n  const sitemapUrl = resolveSitemapUrl(config);\n  const check = config.priorityUrls ?? [];\n\n  /*\n   * The robots gate, before anything else.\n   *\n   * `environments.<env>.robots` already states whether a deployment is meant to be\n   * indexed. Submitting a `noindex` environment's URLs to IndexNow is not a\n   * no-op that the directive later undoes — it publishes the staging host to\n   * several search engines and their AI crawlers, and asks them to come look. The\n   * config knows the answer, so the tool must not need to be told twice.\n   */\n  if (config.robots && /\\bnoindex\\b/i.test(config.robots)) {\n    return {\n      blocked: `environment robots policy is \"${config.robots}\" — refusing to ask search engines to index an environment marked noindex`,\n      sitemapUrl,\n      urls: [],\n      reason: 'diff',\n      cold: false,\n      indexNow: { enabled: false, skip: 'blocked', endpoint: INDEXNOW_ENDPOINT, batches: [] },\n      searchConsole: { enabled: false, skip: 'blocked' },\n      check: [],\n      notes,\n    };\n  }\n\n  const cold = !explicitUrls && !all && !previous;\n\n  let urls: string[];\n  let reason: UrlReason;\n  if (explicitUrls?.length) {\n    urls = explicitUrls;\n    reason = 'explicit';\n  } else if (all) {\n    urls = current.map((e) => e.loc);\n    reason = 'all';\n  } else if (!previous) {\n    urls = current.map((e) => e.loc);\n    reason = 'cold';\n    notes.push(\n      `no previous snapshot — treating all ${urls.length} URLs as changed. Persist ${'`.vitops/`'} between runs (a CI cache) so later runs submit only what moved.`,\n    );\n  } else {\n    urls = diff(current, previous);\n    reason = 'diff';\n  }\n\n  /*\n   * The foreign-sitemap check.\n   *\n   * A 404 fails loudly; a sitemap that is well-formed and *someone else's* does\n   * not. A downstream site's sitemap route collided with its CMS's, so the URL\n   * returned 200 with a valid document listing pages that were not theirs, and\n   * the run reported a healthy cold submission. Nothing downstream can catch\n   * this — the URLs parse, the diff works, the submission succeeds.\n   *\n   * Compared against the resolved environment origin rather than the canonical,\n   * for the same reason `toIndexingConfig` derives the origin that way: on a\n   * staging run the canonical IS the foreign host.\n   */\n  if (config.canonical && urls.length) {\n    const own = hostOf(`${trimSlash(config.canonical)}/`);\n    const foreign = [...new Set(urls.map(hostOf).filter((h): h is string => !!h && h !== own))];\n    if (foreign.length)\n      notes.push(\n        `sitemap contains ${urls.length - urls.filter((u) => hostOf(u) === own).length} URL(s) on ` +\n          `${foreign.join(', ')} rather than ${own} — check that ${sitemapUrl} is this site's own ` +\n          `sitemap and not another route answering that path.`,\n      );\n  }\n\n  /*\n   * The lastmod warning.\n   *\n   * Without per-URL lastmod the diff can still see pages appear and disappear, but\n   * it cannot see one change — so an edited page is never resubmitted and the\n   * command quietly does less than it appears to. Worth a note every run, because\n   * the output otherwise looks identical to the healthy case.\n   */\n  if (reason === 'diff' || reason === 'cold') {\n    const withLastmod = current.filter((e) => e.lastmod).length;\n    if (current.length > 0 && withLastmod === 0)\n      notes.push(\n        'no <lastmod> in the sitemap — only added/removed pages can be detected, never an edit. Wire `gitLastmod()` into your sitemap options, or pass --all.',\n      );\n    else if (withLastmod < current.length)\n      notes.push(\n        `${current.length - withLastmod} of ${current.length} sitemap entries have no <lastmod> — edits to those pages cannot be detected.`,\n      );\n  }\n\n  // ── IndexNow ────────────────────────────────────────────────────────────────\n  const keyLocation = resolveKeyLocation(config);\n  const keyHost = keyLocation ? hostOf(keyLocation) : undefined;\n  let indexNow: IndexNowPlan;\n  if (!config.indexNow) {\n    indexNow = {\n      enabled: false,\n      skip: 'not configured (seo.indexing.indexNow)',\n      endpoint: INDEXNOW_ENDPOINT,\n      batches: [],\n    };\n  } else if (!keyLocation) {\n    indexNow = {\n      enabled: false,\n      skip: 'no keyLocation and no domains.canonical to derive one',\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      key: config.indexNow.key,\n      batches: [],\n    };\n  } else {\n    /*\n     * IndexNow requires every URL in a submission to share the key file's host.\n     * A mixed batch is rejected whole, so the off-host URLs are dropped here and\n     * named — silently sending them would fail the on-host ones too.\n     */\n    const onHost = urls.filter((u) => hostOf(u) === keyHost);\n    const offHost = urls.length - onHost.length;\n    if (offHost > 0)\n      notes.push(\n        `IndexNow: dropped ${offHost} URL(s) not on ${keyHost} — a submission must match its key file's host.`,\n      );\n    indexNow = {\n      enabled: onHost.length > 0,\n      ...(onHost.length === 0 ? { skip: 'no URLs to submit' } : {}),\n      endpoint: config.indexNow.endpoint ?? INDEXNOW_ENDPOINT,\n      keyLocation,\n      key: config.indexNow.key,\n      ...(keyHost ? { host: keyHost } : {}),\n      batches: chunk(onHost, INDEXNOW_BATCH),\n    };\n  }\n\n  // ── Search Console ──────────────────────────────────────────────────────────\n  // Independent of `urls`: resubmitting the sitemap is what tells Google to\n  // re-read it, and it is worth doing whenever the sitemap was rebuilt — there is\n  // no per-URL submission to gate on, because Google exposes none.\n  let searchConsole: SearchConsolePlan;\n  if (!config.searchConsole) {\n    searchConsole = { enabled: false, skip: 'not configured (seo.indexing.searchConsole)' };\n  } else if (config.searchConsole.resubmitSitemap === false) {\n    searchConsole = {\n      enabled: false,\n      skip: 'resubmitSitemap is false',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else if (!sitemapUrl) {\n    searchConsole = {\n      enabled: false,\n      skip: 'no sitemapUrl and no domains.canonical to derive one',\n      siteUrl: config.searchConsole.siteUrl,\n    };\n  } else {\n    searchConsole = { enabled: true, siteUrl: config.searchConsole.siteUrl };\n  }\n\n  return {\n    sitemapUrl,\n    urls,\n    reason,\n    cold,\n    indexNow,\n    searchConsole,\n    check,\n    notes,\n  };\n}\n\n/** Render a plan as the human-readable block `--dry` prints. */\nexport function formatPlan(p: IndexingPlan): string {\n  const lines: string[] = [];\n  if (p.blocked) {\n    lines.push(`✗ blocked — ${p.blocked}`);\n    return lines.join('\\n');\n  }\n  lines.push(`sitemap    ${p.sitemapUrl ?? '(none)'}`);\n  lines.push(`urls       ${p.urls.length} (${p.reason})`);\n\n  lines.push(\n    p.indexNow.enabled\n      ? `IndexNow   ${p.indexNow.batches.reduce((n, b) => n + b.length, 0)} URL(s) → ${p.indexNow.endpoint}`\n      : `IndexNow   skipped — ${p.indexNow.skip}`,\n  );\n  lines.push(\n    p.searchConsole.enabled\n      ? `Search Console  resubmit sitemap → ${p.searchConsole.siteUrl}`\n      : `Search Console  skipped — ${p.searchConsole.skip}`,\n  );\n  for (const n of p.notes) lines.push(`  ! ${n}`);\n  return lines.join('\\n');\n}\n","/**\n * Sitemap parsing — enough of it, and no more.\n *\n * Hand-rolled rather than pulled from an XML library. A sitemap is a closed,\n * trivially-shaped document (`<urlset>` of `<url>`, or `<sitemapindex>` of\n * `<sitemap>`, each carrying `<loc>` and optionally `<lastmod>`), and this package\n * installs into every consumer project — a parser dependency for two element names\n * is not a trade worth making. The same reasoning the legal renderer applies to its\n * markdown subset: exactly as capable as the documents it has to read.\n */\nimport type { SitemapEntry } from './types.ts';\n\n/** What a sitemap document turned out to be. */\nexport interface ParsedSitemap {\n  /** `<url>` entries, when this was a `<urlset>`. */\n  entries: SitemapEntry[];\n  /** Child sitemap URLs, when this was a `<sitemapindex>`. */\n  sitemaps: string[];\n}\n\n/**\n * The five predefined XML entities, plus numeric character references.\n *\n * Not cosmetic: a sitemap URL carrying a query string is written `?a=1&amp;b=2`,\n * and submitting the un-decoded form means submitting a URL the site does not\n * serve — which IndexNow accepts and then silently fails to crawl.\n */\nfunction decodeXml(s: string): string {\n  return (\n    s\n      .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(Number.parseInt(h, 16)))\n      .replace(/&#(\\d+);/g, (_, d) => String.fromCodePoint(Number.parseInt(d, 10)))\n      .replace(/&lt;/g, '<')\n      .replace(/&gt;/g, '>')\n      .replace(/&quot;/g, '\"')\n      .replace(/&apos;/g, \"'\")\n      // `&amp;` last: decoding it first would let `&amp;lt;` collapse to `<`.\n      .replace(/&amp;/g, '&')\n  );\n}\n\nconst tag = (block: string, name: string): string | undefined => {\n  const m = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'i').exec(block);\n  return m ? decodeXml(m[1]!.trim()) : undefined;\n};\n\nfunction blocks(xml: string, name: string): string[] {\n  const out: string[] = [];\n  const re = new RegExp(`<${name}(?:\\\\s[^>]*)?>([\\\\s\\\\S]*?)</${name}>`, 'gi');\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(xml))) out.push(m[1]!);\n  return out;\n}\n\n/**\n * Parse a sitemap or sitemap index.\n *\n * Which one it is comes from the root element, not from the filename — an\n * `sitemap-index.xml` that is actually a flat `<urlset>` is common enough\n * (@astrojs/sitemap emits an index only past `entryLimit`) that keying on the name\n * would misread the single-file case as \"no URLs\".\n */\nexport function parseSitemap(xml: string): ParsedSitemap {\n  if (/<sitemapindex[\\s>]/i.test(xml))\n    return {\n      entries: [],\n      sitemaps: blocks(xml, 'sitemap')\n        .map((b) => tag(b, 'loc'))\n        .filter((l): l is string => !!l),\n    };\n\n  const entries: SitemapEntry[] = [];\n  for (const b of blocks(xml, 'url')) {\n    const loc = tag(b, 'loc');\n    if (!loc) continue; // `<loc>` is required; an entry without one is unusable\n    const lastmod = tag(b, 'lastmod');\n    entries.push(lastmod ? { loc, lastmod } : { loc });\n  }\n  return { entries, sitemaps: [] };\n}\n\n/** Reads a sitemap from a URL or a local path. */\nexport type SitemapReader = (source: string) => Promise<string>;\n\n/**\n * Resolve a sitemap to its full entry list, following an index one level down.\n *\n * One level is the whole spec — the sitemaps protocol forbids an index pointing at\n * another index — so recursing further would only chase a malformed document.\n * Child fetches run sequentially: a large site's index can list dozens of files,\n * and hammering the consumer's own origin to save a second is a poor trade.\n */\nexport async function collectEntries(\n  source: string,\n  read: SitemapReader,\n): Promise<{ entries: SitemapEntry[]; sources: string[] }> {\n  const root = parseSitemap(await read(source));\n  if (root.sitemaps.length === 0) return { entries: root.entries, sources: [source] };\n\n  const entries: SitemapEntry[] = [];\n  const sources: string[] = [];\n  for (const child of root.sitemaps) {\n    const parsed = parseSitemap(await read(child));\n    entries.push(...parsed.entries);\n    sources.push(child);\n  }\n  return { entries, sources };\n}\n","/**\n * The previous run's sitemap state — what makes \"only submit what changed\"\n * possible at all.\n *\n * A plain JSON file rather than anything cleverer, because the thing reading it is\n * usually a CI job restoring a cache directory. It must survive being absent\n * (first run, cold cache) without pretending nothing changed — `readSnapshot`\n * returns `undefined` there and `plan()` treats that as \"submit everything, and\n * say so\".\n */\nimport type { SitemapEntry, Snapshot } from './types.ts';\nimport { readVersioned, writeVersioned } from '../json-store.ts';\n\n/** Default location, relative to the consumer's project root. */\nexport const SNAPSHOT_PATH = '.vitops/sitemap-snapshot.json';\n\n/**\n * Read a snapshot, or `undefined` when there isn't a usable one.\n *\n * A corrupt or wrong-version file reads as absent, not as empty. The distinction\n * matters: \"absent\" submits everything, whereas an empty entry map would look like\n * a site that legitimately has no URLs and submit nothing — the silent-success\n * failure this whole command exists to remove.\n */\nexport function readSnapshot(path: string): Snapshot | undefined {\n  return readVersioned<Snapshot, 'entries'>(path, 'entries');\n}\n\n/** Build a snapshot from the entries just read. */\nexport function toSnapshot(sitemapUrl: string, entries: SitemapEntry[], takenAt: string): Snapshot {\n  const map: Record<string, string> = {};\n  for (const e of entries) map[e.loc] = e.lastmod ?? '';\n  return { version: 1, sitemapUrl, takenAt, entries: map };\n}\n\n/**\n * Write the snapshot, creating its directory.\n *\n * Call this only after a submission actually succeeded. Writing it eagerly would\n * record URLs as notified that never were, and because the next run diffs against\n * it, those URLs would never be submitted again — a single transient 503 would\n * silently drop a page from every future run.\n */\nexport function writeSnapshot(path: string, snapshot: Snapshot): void {\n  writeVersioned(path, snapshot);\n}\n","/**\n * IndexNow submission.\n *\n * Honoured by Bing, Yandex, Naver, Seznam and Yep — and, through Bing's index, by\n * the AI crawlers built on it. **Not** by Google, which has never adopted the\n * protocol despite testing it; nothing here should be described to a consumer as\n * affecting Google results.\n *\n * Participating engines share submissions with each other, so one endpoint is\n * normally the whole integration.\n */\nimport { randomBytes } from 'node:crypto';\nimport type { IndexNowPlan } from './plan.ts';\n\n/** Generate a key. 32 hex characters, the conventional shape. */\nexport function newKey(): string {\n  return randomBytes(16).toString('hex');\n}\n\n/** The body of the key file served at `keyLocation`: the key, and nothing else. */\nexport const keyFileContents = (key: string): string => `${key}\\n`;\n\nexport interface SubmitResult {\n  ok: boolean;\n  status: number;\n  urls: number;\n  /** The endpoint's own explanation, when it gave one. */\n  message?: string;\n}\n\n/**\n * How the endpoint's status codes actually read.\n *\n * `403` and `422` are the two that matter and they are easy to misdiagnose: both\n * mean the key file is wrong, not that the URLs are.\n */\nfunction explain(status: number): string | undefined {\n  switch (status) {\n    case 200:\n    case 202:\n      return undefined;\n    case 400:\n      return 'bad request — malformed URL list';\n    case 403:\n      return 'key file not found or its contents do not match the key';\n    case 422:\n      return 'a submitted URL does not belong to the key file host, or the key does not match';\n    case 429:\n      return 'rate limited — too many submissions';\n    default:\n      return `unexpected status ${status}`;\n  }\n}\n\n/**\n * Verify the key file is live and correct before submitting.\n *\n * Worth a request of its own because of how IndexNow fails: a submission with an\n * unreachable key file returns `403`, but one with a *reachable* key file whose\n * contents are stale is accepted with `202` and then silently discarded. Checking\n * first is the only way to tell \"submitted\" from \"submitted and ignored\".\n */\nexport async function verifyKeyFile(\n  keyLocation: string,\n  key: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; reason?: string }> {\n  let res: Response;\n  try {\n    res = await fetchImpl(keyLocation, { method: 'GET' });\n  } catch (e) {\n    return { ok: false, reason: `could not fetch ${keyLocation}: ${(e as Error).message}` };\n  }\n  if (!res.ok) return { ok: false, reason: `${keyLocation} returned ${res.status}` };\n  const body = (await res.text()).trim();\n  if (body !== key)\n    return {\n      ok: false,\n      reason: `${keyLocation} does not contain the configured key (found ${body.length} chars)`,\n    };\n  return { ok: true };\n}\n\n/**\n * Submit one batch. Callers iterate `plan.batches` — the split is the planner's\n * job, so that what gets sent is decided in the pure layer and visible in `--dry`.\n */\nexport async function submitBatch(\n  plan: IndexNowPlan,\n  urls: string[],\n  fetchImpl: typeof fetch = fetch,\n): Promise<SubmitResult> {\n  const body = {\n    host: plan.host,\n    key: plan.key,\n    keyLocation: plan.keyLocation,\n    urlList: urls,\n  };\n  const res = await fetchImpl(plan.endpoint, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n    body: JSON.stringify(body),\n  });\n  const message = explain(res.status);\n  return { ok: res.ok, status: res.status, urls: urls.length, ...(message ? { message } : {}) };\n}\n","/**\n * Google Search Console — the two things its API will actually do.\n *\n * Worth stating plainly, because the gap between what people expect and what\n * exists is the whole reason this module is small: **there is no \"request\n * indexing\" endpoint.** The button in the Search Console UI is not exposed in the\n * API or anywhere else, and the sitemap ping endpoint was removed in 2023. What\n * remains is `sitemaps.submit` (write) and `urlInspection` (read).\n *\n * The Indexing API is deliberately not wired here. It is scoped to `JobPosting`\n * and `BroadcastEvent`; it accepts other URLs and discards them, and using it for\n * general pages violates its terms with the consumer's own GCP project on the\n * line. A toolchain should not ship that as a documented path.\n *\n * Auth is minted by hand rather than through `googleapis`, which would be an\n * enormous dependency in a CLI that installs into every consumer project, for two\n * endpoints. The exchange itself lives in `../google/token.ts` — it is shared with\n * the onboarding module, which needs the same token from a different grant.\n */\nimport {\n  encodeSite,\n  errorDetail,\n  googleAccessToken,\n  googleHeaders,\n  SCOPES,\n  type GoogleAuthLike,\n  type ServiceAccount,\n} from '../google/token.ts';\n\nexport type { ServiceAccount } from '../google/token.ts';\n\n/**\n * Parse a service-account credential from its two supported sources.\n *\n * `VITOPS_GSC_SERVICE_ACCOUNT` holds the JSON inline (what a CI secret store\n * gives you); `GOOGLE_APPLICATION_CREDENTIALS` holds a path (Google's own\n * convention, and what a local `gcloud` setup already has). Supporting both means\n * neither environment has to be reshaped to fit the tool.\n */\nexport function parseServiceAccount(raw: string): ServiceAccount {\n  let parsed: Partial<ServiceAccount>;\n  try {\n    parsed = JSON.parse(raw) as Partial<ServiceAccount>;\n  } catch {\n    throw new Error('service account is not valid JSON');\n  }\n  if (!parsed.client_email || !parsed.private_key)\n    throw new Error('service account JSON is missing client_email or private_key');\n  return { client_email: parsed.client_email, private_key: parsed.private_key };\n}\n\n/**\n * Exchange a service-account key for an access token (RS256 JWT bearer flow).\n *\n * `now` is a parameter so this is testable without mocking the clock.\n */\nexport function serviceAccountToken(\n  account: ServiceAccount,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  return googleAccessToken(\n    { kind: 'service-account', account, scope: SCOPES.webmasters },\n    fetchImpl,\n    now,\n  );\n}\n\n/**\n * Re-submit a sitemap — the automated form of the manual resubmit in the UI.\n *\n * A `403` here almost always means `siteUrl` doesn't match the property exactly\n * (`sc-domain:acme.ca` vs `https://acme.ca/`) or the service account isn't an\n * owner of it, rather than that the sitemap is bad.\n */\nexport async function submitSitemap(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  sitemapUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const url = `https://www.googleapis.com/webmasters/v3/sites/${encodeSite(siteUrl)}/sitemaps/${encodeURIComponent(sitemapUrl)}`;\n  const res = await fetchImpl(url, {\n    method: 'PUT',\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status };\n  const message = await errorDetail(res, (status) =>\n    status === 403\n      ? `403 — check that siteUrl \"${siteUrl}\" matches the Search Console property exactly and that the service account is an owner of it`\n      : undefined,\n  );\n  return { ok: false, status: res.status, message };\n}\n\n/** What the URL Inspection API said about one page. */\nexport interface InspectionResult {\n  url: string;\n  /** Google's verdict, e.g. `PASS`, `NEUTRAL`, `FAIL`. */\n  verdict?: string;\n  /** e.g. `INDEXING_ALLOWED`, `BLOCKED_BY_ROBOTS_TXT`. */\n  coverageState?: string;\n  lastCrawlTime?: string;\n  /** True when Google reports the page as indexed. */\n  indexed: boolean;\n  error?: string;\n}\n\n/**\n * Inspect one URL. **Read-only** — this reports what Google did, it cannot ask for\n * anything. Quota is 2000 queries/day per property, which is why the caller works\n * from an explicit `priorityUrls` list rather than the whole sitemap.\n */\nexport async function inspectUrl(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  inspectionUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<InspectionResult> {\n  const res = await fetchImpl(\n    'https://searchconsole.googleapis.com/v1/urlInspection/index:inspect',\n    {\n      method: 'POST',\n      headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n      body: JSON.stringify({ inspectionUrl, siteUrl }),\n    },\n  );\n  if (!res.ok)\n    return { url: inspectionUrl, indexed: false, error: `${res.status}: ${await res.text()}` };\n\n  const body = (await res.json()) as {\n    inspectionResult?: {\n      indexStatusResult?: { verdict?: string; coverageState?: string; lastCrawlTime?: string };\n    };\n  };\n  const r = body.inspectionResult?.indexStatusResult ?? {};\n  return {\n    url: inspectionUrl,\n    ...(r.verdict ? { verdict: r.verdict } : {}),\n    ...(r.coverageState ? { coverageState: r.coverageState } : {}),\n    ...(r.lastCrawlTime ? { lastCrawlTime: r.lastCrawlTime } : {}),\n    // `PASS` is the only verdict that means indexed. `NEUTRAL` covers \"discovered,\n    // not indexed\" and \"excluded by canonical\" — both are *not indexed*, and\n    // reading them as success would make --check pass on the exact pages it exists\n    // to catch.\n    indexed: r.verdict === 'PASS',\n  };\n}\n"],"mappings":";;;;;;AAeA,MAAa,oBAAoB;;;;;;AAOjC,MAAa,iBAAiB;AAqD9B,MAAM,aAAa,MAAc,EAAE,QAAQ,QAAQ,EAAE;AAErD,SAAS,OAAO,KAAiC;CAC/C,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN;CACF;AACF;AAEA,SAAS,MAAS,OAAY,MAAqB;CACjD,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAChC,MAAM,MAAa,CAAC;CACpB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;CAC9E,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBAAkB,QAA4C;CAC5E,IAAI,OAAO,YAAY,OAAO,OAAO;CACrC,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE;AACxC;;AAGA,SAAgB,mBAAmB,QAA4C;CAC7E,MAAM,WAAW,OAAO;CACxB,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI,SAAS,aAAa,OAAO,SAAS;CAC1C,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE,GAAG,SAAS,IAAI;AACxD;;AAGA,SAAS,KAAK,SAAyB,UAA8B;CACnE,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,SAAS,SAAS,QAAQ,EAAE;EAIlC,IAAI,WAAW,UAAa,YAAY,EAAE,WAAW,KAAK,QAAQ,KAAK,EAAE,GAAG;CAC9E;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,KAAK,OAAgC;CACnD,MAAM,EAAE,QAAQ,SAAS,UAAU,cAAc,QAAQ;CACzD,MAAM,QAAkB,CAAC;CAEzB,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,QAAQ,OAAO,gBAAgB,CAAC;CAWtC,IAAI,OAAO,UAAU,eAAe,KAAK,OAAO,MAAM,GACpD,OAAO;EACL,SAAS,iCAAiC,OAAO,OAAO;EACxD;EACA,MAAM,CAAC;EACP,QAAQ;EACR,MAAM;EACN,UAAU;GAAE,SAAS;GAAO,MAAM;GAAW,UAAU;GAAmB,SAAS,CAAC;EAAE;EACtF,eAAe;GAAE,SAAS;GAAO,MAAM;EAAU;EACjD,OAAO,CAAC;EACR;CACF;CAGF,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;CAEvC,IAAI;CACJ,IAAI;CACJ,IAAI,cAAc,QAAQ;EACxB,OAAO;EACP,SAAS;CACX,OAAO,IAAI,KAAK;EACd,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;CACX,OAAO,IAAI,CAAC,UAAU;EACpB,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EAC/B,SAAS;EACT,MAAM,KACJ,uCAAuC,KAAK,OAAO,uGACrD;CACF,OAAO;EACL,OAAO,KAAK,SAAS,QAAQ;EAC7B,SAAS;CACX;CAeA,IAAI,OAAO,aAAa,KAAK,QAAQ;EACnC,MAAM,MAAM,OAAO,GAAG,UAAU,OAAO,SAAS,EAAE,EAAE;EACpD,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC;EAC1F,IAAI,QAAQ,QACV,MAAM,KACJ,oBAAoB,KAAK,SAAS,KAAK,QAAQ,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,aAC1E,QAAQ,KAAK,IAAI,EAAE,eAAe,IAAI,gBAAgB,WAAW,uEAExE;CACJ;CAUA,IAAI,WAAW,UAAU,WAAW,QAAQ;EAC1C,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,CAAC;EACrD,IAAI,QAAQ,SAAS,KAAK,gBAAgB,GACxC,MAAM,KACJ,sJACF;OACG,IAAI,cAAc,QAAQ,QAC7B,MAAM,KACJ,GAAG,QAAQ,SAAS,YAAY,MAAM,QAAQ,OAAO,8EACvD;CACJ;CAGA,MAAM,cAAc,mBAAmB,MAAM;CAC7C,MAAM,UAAU,cAAc,OAAO,WAAW,IAAI;CACpD,IAAI;CACJ,IAAI,CAAC,OAAO,UACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU;EACV,SAAS,CAAC;CACZ;MACK,IAAI,CAAC,aACV,WAAW;EACT,SAAS;EACT,MAAM;EACN,UAAU,OAAO,SAAS;EAC1B,KAAK,OAAO,SAAS;EACrB,SAAS,CAAC;CACZ;MACK;EAML,MAAM,SAAS,KAAK,QAAQ,MAAM,OAAO,CAAC,MAAM,OAAO;EACvD,MAAM,UAAU,KAAK,SAAS,OAAO;EACrC,IAAI,UAAU,GACZ,MAAM,KACJ,qBAAqB,QAAQ,iBAAiB,QAAQ,gDACxD;EACF,WAAW;GACT,SAAS,OAAO,SAAS;GACzB,GAAI,OAAO,WAAW,IAAI,EAAE,MAAM,oBAAoB,IAAI,CAAC;GAC3D,UAAU,OAAO,SAAS;GAC1B;GACA,KAAK,OAAO,SAAS;GACrB,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;GACnC,SAAS,MAAM,QAAQ,cAAc;EACvC;CACF;CAMA,IAAI;CACJ,IAAI,CAAC,OAAO,eACV,gBAAgB;EAAE,SAAS;EAAO,MAAM;CAA8C;MACjF,IAAI,OAAO,cAAc,oBAAoB,OAClD,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MACK,IAAI,CAAC,YACV,gBAAgB;EACd,SAAS;EACT,MAAM;EACN,SAAS,OAAO,cAAc;CAChC;MAEA,gBAAgB;EAAE,SAAS;EAAM,SAAS,OAAO,cAAc;CAAQ;CAGzE,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,SAAgB,WAAW,GAAyB;CAClD,MAAM,QAAkB,CAAC;CACzB,IAAI,EAAE,SAAS;EACb,MAAM,KAAK,eAAe,EAAE,SAAS;EACrC,OAAO,MAAM,KAAK,IAAI;CACxB;CACA,MAAM,KAAK,cAAc,EAAE,cAAc,UAAU;CACnD,MAAM,KAAK,cAAc,EAAE,KAAK,OAAO,IAAI,EAAE,OAAO,EAAE;CAEtD,MAAM,KACJ,EAAE,SAAS,UACP,cAAc,EAAE,SAAS,QAAQ,QAAQ,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,aAC1F,wBAAwB,EAAE,SAAS,MACzC;CACA,MAAM,KACJ,EAAE,cAAc,UACZ,sCAAsC,EAAE,cAAc,YACtD,6BAA6B,EAAE,cAAc,MACnD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,OAAO,GAAG;CAC9C,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;;;;;;AC/SA,SAAS,UAAU,GAAmB;CACpC,OACE,EACG,QAAQ,wBAAwB,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CACtF,QAAQ,cAAc,GAAG,MAAM,OAAO,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAC5E,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,WAAW,IAAG,CAAC,CACvB,QAAQ,WAAW,GAAG,CAAC,CAEvB,QAAQ,UAAU,GAAG;AAE5B;AAEA,MAAM,OAAO,OAAe,SAAqC;CAC/D,MAAM,IAAI,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK;CACpF,OAAO,IAAI,UAAU,EAAE,EAAE,CAAE,KAAK,CAAC,IAAI;AACvC;AAEA,SAAS,OAAO,KAAa,MAAwB;CACnD,MAAM,MAAgB,CAAC;CACvB,MAAM,KAAK,IAAI,OAAO,IAAI,KAAK,8BAA8B,KAAK,IAAI,IAAI;CAC1E,IAAI;CACJ,OAAQ,IAAI,GAAG,KAAK,GAAG,GAAI,IAAI,KAAK,EAAE,EAAG;CACzC,OAAO;AACT;;;;;;;;;AAUA,SAAgB,aAAa,KAA4B;CACvD,IAAI,sBAAsB,KAAK,GAAG,GAChC,OAAO;EACL,SAAS,CAAC;EACV,UAAU,OAAO,KAAK,SAAS,CAAC,CAC7B,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CACzB,QAAQ,MAAmB,CAAC,CAAC,CAAC;CACnC;CAEF,MAAM,UAA0B,CAAC;CACjC,KAAK,MAAM,KAAK,OAAO,KAAK,KAAK,GAAG;EAClC,MAAM,MAAM,IAAI,GAAG,KAAK;EACxB,IAAI,CAAC,KAAK;EACV,MAAM,UAAU,IAAI,GAAG,SAAS;EAChC,QAAQ,KAAK,UAAU;GAAE;GAAK;EAAQ,IAAI,EAAE,IAAI,CAAC;CACnD;CACA,OAAO;EAAE;EAAS,UAAU,CAAC;CAAE;AACjC;;;;;;;;;AAaA,eAAsB,eACpB,QACA,MACyD;CACzD,MAAM,OAAO,aAAa,MAAM,KAAK,MAAM,CAAC;CAC5C,IAAI,KAAK,SAAS,WAAW,GAAG,OAAO;EAAE,SAAS,KAAK;EAAS,SAAS,CAAC,MAAM;CAAE;CAElF,MAAM,UAA0B,CAAC;CACjC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,KAAK,UAAU;EACjC,MAAM,SAAS,aAAa,MAAM,KAAK,KAAK,CAAC;EAC7C,QAAQ,KAAK,GAAG,OAAO,OAAO;EAC9B,QAAQ,KAAK,KAAK;CACpB;CACA,OAAO;EAAE;EAAS;CAAQ;AAC5B;;;;;AC7FA,MAAa,gBAAgB;;;;;;;;;AAU7B,SAAgB,aAAa,MAAoC;CAC/D,OAAO,cAAmC,MAAM,SAAS;AAC3D;;AAGA,SAAgB,WAAW,YAAoB,SAAyB,SAA2B;CACjG,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW;CACnD,OAAO;EAAE,SAAS;EAAG;EAAY;EAAS,SAAS;CAAI;AACzD;;;;;;;;;AAUA,SAAgB,cAAc,MAAc,UAA0B;CACpE,eAAe,MAAM,QAAQ;AAC/B;;;;;;;;;;;;;;;;AC9BA,SAAgB,SAAiB;CAC/B,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;AACvC;;AAGA,MAAa,mBAAmB,QAAwB,GAAG,IAAI;;;;;;;AAgB/D,SAAS,QAAQ,QAAoC;CACnD,QAAQ,QAAR;EACE,KAAK;EACL,KAAK,KACH;EACF,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,KAAK,KACH,OAAO;EACT,SACE,OAAO,qBAAqB;CAChC;AACF;;;;;;;;;AAUA,eAAsB,cACpB,aACA,KACA,YAA0B,OACiB;CAC3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,UAAU,aAAa,EAAE,QAAQ,MAAM,CAAC;CACtD,SAAS,GAAG;EACV,OAAO;GAAE,IAAI;GAAO,QAAQ,mBAAmB,YAAY,IAAK,EAAY;EAAU;CACxF;CACA,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,GAAG,YAAY,YAAY,IAAI;CAAS;CACjF,MAAM,QAAQ,MAAM,IAAI,KAAK,EAAC,CAAE,KAAK;CACrC,IAAI,SAAS,KACX,OAAO;EACL,IAAI;EACJ,QAAQ,GAAG,YAAY,8CAA8C,KAAK,OAAO;CACnF;CACF,OAAO,EAAE,IAAI,KAAK;AACpB;;;;;AAMA,eAAsB,YACpB,MACA,MACA,YAA0B,OACH;CACvB,MAAM,OAAO;EACX,MAAM,KAAK;EACX,KAAK,KAAK;EACV,aAAa,KAAK;EAClB,SAAS;CACX;CACA,MAAM,MAAM,MAAM,UAAU,KAAK,UAAU;EACzC,QAAQ;EACR,SAAS,EAAE,gBAAgB,kCAAkC;EAC7D,MAAM,KAAK,UAAU,IAAI;CAC3B,CAAC;CACD,MAAM,UAAU,QAAQ,IAAI,MAAM;CAClC,OAAO;EAAE,IAAI,IAAI;EAAI,QAAQ,IAAI;EAAQ,MAAM,KAAK;EAAQ,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;CAAG;AAC9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AClEA,SAAgB,oBAAoB,KAA6B;CAC/D,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,mCAAmC;CACrD;CACA,IAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,aAClC,MAAM,IAAI,MAAM,6DAA6D;CAC/E,OAAO;EAAE,cAAc,OAAO;EAAc,aAAa,OAAO;CAAY;AAC9E;;;;;;AAOA,SAAgB,oBACd,SACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CACjB,OAAO,kBACL;EAAE,MAAM;EAAmB;EAAS,OAAO,OAAO;CAAW,GAC7D,WACA,GACF;AACF;;;;;;;;AASA,eAAsB,cACpB,MACA,SACA,YACA,YAA0B,OACkC;CAE5D,MAAM,MAAM,MAAM,UAAU,kDADkC,WAAW,OAAO,EAAE,YAAY,mBAAmB,UAAU,KAC1F;EAC/B,QAAQ;EACR,SAAS,cAAc,IAAI;CAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;CAClD,MAAM,UAAU,MAAM,YAAY,MAAM,WACtC,WAAW,MACP,6BAA6B,QAAQ,gGACrC,MACN;CACA,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ;CAAQ;AAClD;;;;;;AAoBA,eAAsB,WACpB,MACA,SACA,eACA,YAA0B,OACC;CAC3B,MAAM,MAAM,MAAM,UAChB,uEACA;EACE,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE;GAAe;EAAQ,CAAC;CACjD,CACF;CACA,IAAI,CAAC,IAAI,IACP,OAAO;EAAE,KAAK;EAAe,SAAS;EAAO,OAAO,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;CAAI;CAO3F,MAAM,KAAI,MALU,IAAI,KAAK,EAKf,CAAC,kBAAkB,qBAAqB,CAAC;CACvD,OAAO;EACL,KAAK;EACL,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;EAC1C,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAC5D,GAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;EAK5D,SAAS,EAAE,YAAY;CACzB;AACF"}

package/dist/json-store-30CFCbZZ.mjs

@@ -0,0 +1,38 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+//#region src/json-store.ts
+/**
+* Read/write helpers shared by every `.vitops/*.json` cache
+* (`indexing/snapshot.ts`, `reviews/cache.ts`, `media/manifest.ts`).
+*
+* All three follow the same rule: a corrupt or wrong-version file reads as
+* absent, never as an empty-but-valid record — the alternative is
+* indistinguishable from "there is genuinely nothing here" and silently ships
+* an empty result. Each module keeps its own `toX` sorter (they differ in
+* which field holds the record and how its entries are ordered); only the
+* read/write mechanics are shared here.
+*/
+/**
+* Read a versioned cache file, or `undefined` when there isn't a usable one
+* (missing, unparsable, wrong version, or `key`'s field isn't an object).
+*/
+function readVersioned(path, key) {
+	if (!existsSync(path)) return void 0;
+	try {
+		const raw = JSON.parse(readFileSync(path, "utf8"));
+		if (raw?.version !== 1 || typeof raw[key] !== "object" || raw[key] === null) return void 0;
+		return raw;
+	} catch {
+		return;
+	}
+}
+/** Write a cache file, creating its directory. Call only once the value is final. */
+function writeVersioned(path, value) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+//#endregion
+export { writeVersioned as n, readVersioned as t };
+//# sourceMappingURL=json-store-30CFCbZZ.mjs.map

package/dist/json-store-30CFCbZZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-store-30CFCbZZ.mjs","names":[],"sources":["../src/json-store.ts"],"sourcesContent":["/**\n * Read/write helpers shared by every `.vitops/*.json` cache\n * (`indexing/snapshot.ts`, `reviews/cache.ts`, `media/manifest.ts`).\n *\n * All three follow the same rule: a corrupt or wrong-version file reads as\n * absent, never as an empty-but-valid record — the alternative is\n * indistinguishable from \"there is genuinely nothing here\" and silently ships\n * an empty result. Each module keeps its own `toX` sorter (they differ in\n * which field holds the record and how its entries are ordered); only the\n * read/write mechanics are shared here.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\n\n/** A cache file's shape: a version tag plus one record field, keyed by `key`. */\ntype Versioned<Key extends string> = { version: 1 } & Record<Key, Record<string, unknown> | null>;\n\n/**\n * Read a versioned cache file, or `undefined` when there isn't a usable one\n * (missing, unparsable, wrong version, or `key`'s field isn't an object).\n */\nexport function readVersioned<T extends Versioned<Key>, Key extends string>(\n  path: string,\n  key: Key,\n): T | undefined {\n  if (!existsSync(path)) return undefined;\n  try {\n    const raw = JSON.parse(readFileSync(path, 'utf8')) as T;\n    if (raw?.version !== 1 || typeof raw[key] !== 'object' || raw[key] === null) return undefined;\n    return raw;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Write a cache file, creating its directory. Call only once the value is final. */\nexport function writeVersioned(path: string, value: unknown): void {\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(value, null, 2)}\\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cACd,MACA,KACe;CACf,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;EACjD,IAAI,KAAK,YAAY,KAAK,OAAO,IAAI,SAAS,YAAY,IAAI,SAAS,MAAM,OAAO;EACpF,OAAO;CACT,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,eAAe,MAAc,OAAsB;CACjE,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,cAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAC3D"}

package/dist/media/index.d.mts

@@ -65,7 +65,6 @@ interface MediaConfig {
 }
 /** A discovered source video. */
 interface MediaSource {
-  /** Absolute path on disk. */
   path: string;
   /**
    * Path relative to the raw directory, POSIX-separated — the manifest key.
@@ -101,7 +100,6 @@ interface MediaPlan {
 interface MediaManifestEntry {
   /** `MediaSource.hash` at the time of encoding. */
   source: string;
-  /** Settings hash at the time of encoding. */
   settings: string;
   /** Output paths relative to the output directory. */
   outputs: string[];

package/dist/media/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/media/types.ts","../../src/media/discover.ts","../../src/media/plan.ts","../../src/media/ffmpeg.ts","../../src/media/manifest.ts","../../src/media/index.ts"],"mappings":";;AAUA;;;;AAAsB;AAGtB;;;KAHY,UAAA;AAG4B;AAAA,cAA3B,eAAA,EAAiB,UAAU;;cAG3B,UAAA,EAAY,MAAM,CAAC,UAAA;;AAAU;AAe1C;;;;AAA4B;AAG5B;;cAHa,eAAA;;UAGI,WAAA;EAgBf;;;;;;EATA,QAAA;EA8BoB;AAItB;;;;;;;EAzBE,GAAA;EAmCI;AAIN;;;;;EAhCE,UAAA;EAmCA;;AAAI;AAIN;EAlCE,KAAA;;;;;;;EAOA,UAAA;EAiCA;EA/BA,OAAA,GAAU,UAAU;AAAA;AAmCtB;AAAA,UA/BiB,WAAA;;EAEf,IAAA;EA8BA;;;;AAEK;EA1BL,EAAA;EA8BiC;EA5BjC,IAAA;AAAA;;UAIe,WAAA;EACf,IAAA,EAAM,UAAU;EA6BT;EA3BP,IAAA;AAAA;;UAIe,QAAA;EACf,MAAA,EAAQ,WAAA;EACR,OAAA,EAAS,WAAW;EA+BpB;EA7BA,QAAA;EA6BwB;EA3BxB,IAAA;AAAA;;UAIe,SAAA;EACf,IAAA,EAAM,QAAQ;EC7FH;ED+FX,KAAA;AAAA;;UAIe,kBAAA;ECvFJ;EDyFX,MAAA;;EAEA,QAAA;EC3FqC;ED6FrC,OAAA;AAAA;;;AC1F6C;AA4B/C;;UDsEiB,aAAA;EACf,OAAA;EACA,OAAA,EAAS,MAAM,SAAS,kBAAA;AAAA;;;AAvH1B;AAAA,cCIa,SAAA,EAAW,WAAW;;cAYtB,aAAA,EAAe,WAAW;ADhBjB;AAAA,iBCmBN,QAAA,CAAS,IAAA,WAAe,OAAO;;;;ADhBP;AAGxC;;iBCyCsB,cAAA,CAAe,GAAA,WAAc,OAAO,CAAC,WAAA;;;AD/C3D;AAAA,UEiBiB,mBAAA;EACf,QAAA;EACA,GAAA;EACA,UAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA,EAAS,UAAU;AAAA;AFpBmB;AAGxC;;;;AAA0C;AAHF,KE6B5B,WAAA,IAAe,YAAoB;AAAA,UAE9B,cAAA;EACf,OAAA,EAAS,WAAA;EACT,MAAA,GAAS,WAAA;EFfiB;EEiB1B,QAAA,GAAW,aAAA;EFde;EEgB1B,KAAA,GAAQ,WAAA;EFqBY;EEnBpB,KAAA;AAAA;;iBAMc,aAAA,CAAc,MAAA,GAAQ,WAAA,GAAmB,mBAAmB;;;;;AFatD;AAItB;iBEAgB,YAAA,CAAa,MAA2B,EAAnB,mBAAmB;;;;;;;AFUlD;AAIN;;;;;;iBEyBgB,SAAA,CAAU,KAAA,EAAO,cAAA,GAAiB,SAAS;;cA0C9C,WAAA,GAAe,IAAA,EAAM,SAAA,KAAY,QAAQ;AF5DtD;AAAA,iBE+DgB,UAAA,CAAW,IAAe,EAAT,SAAS;;;AFrJ1C;;;;AAAsB;AAGtB;;;;AAHA,iBG2BgB,aAAA,IAAiB,OAAO;AHrBxC;;;;AAA0C;AAe1C;;;AAfA,iBG0FsB,UAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;AH/EkB;AAG5B;;;;;;;AAH4B,iBG0IN,SAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;;iBAyBY,aAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;;;AHhMV;AAAA,cIIa,mBAAA;;;AJJS;AAGtB;;;;AAAwC;iBIWxB,YAAA,CAAa,IAAA,WAAe,aAAa;;iBAazC,UAAA,CAAW,OAAA,EAAS,MAAA,SAAe,kBAAA,IAAsB,aAAA;;AJrB/B;AAe1C;;;;AAA4B;iBIsBZ,aAAA,CAAc,IAAA,UAAc,QAAA,EAAU,aAAa;;;UC9BlD,mBAAA;ELbK;EKepB,GAAA;ELfoB;EKiBpB,GAAA;EACA,MAAA,GAAS,WAAW;ELfgD;EKiBpE,QAAA;ELjBsC;EKmBtC,KAAA;ELhBW;EKkBX,GAAA;;EAEA,UAAA,KAAe,OAAA;AAAA;AAAA,UAGA,kBAAA;EACf,IAAA,EAAM,SAAS;;EAEf,OAAA;ELX0B;EKa1B,OAAA;AAAA;;;;;;;;iBAUoB,YAAA,CAAa,OAAA,EAAS,mBAAA,GAAsB,OAAA,CAAQ,kBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/media/types.ts","../../src/media/discover.ts","../../src/media/plan.ts","../../src/media/ffmpeg.ts","../../src/media/manifest.ts","../../src/media/index.ts"],"mappings":";;AAUA;;;;AAAsB;AAGtB;;;KAHY,UAAA;AAG4B;AAAA,cAA3B,eAAA,EAAiB,UAAU;;cAG3B,UAAA,EAAY,MAAM,CAAC,UAAA;;AAAU;AAe1C;;;;AAA4B;AAG5B;;cAHa,eAAA;;UAGI,WAAA;EAgBf;;;;;;EATA,QAAA;EA8BoB;AAItB;;;;;;;EAzBE,GAAA;EAkCI;AAIN;;;;;EA/BE,UAAA;EAkCA;;AAAI;AAIN;EAjCE,KAAA;;;;;;;EAOA,UAAA;EAgCA;EA9BA,OAAA,GAAU,UAAU;AAAA;AAkCtB;AAAA,UA9BiB,WAAA;EACf,IAAA;EA8Bc;;;;;EAxBd,EAAA;EA8Be;EA5Bf,IAAA;AAAA;;UAIe,WAAA;EACf,IAAA,EAAM,UAAU;EA4BhB;EA1BA,IAAA;AAAA;AAkCF;AAAA,UA9BiB,QAAA;EACf,MAAA,EAAQ,WAAA;EACR,OAAA,EAAS,WAAW;EA6BpB;EA3BA,QAAA;EA4BS;EA1BT,IAAA;AAAA;AA0B0C;AAAA,UAtB3B,SAAA;EACf,IAAA,EAAM,QAAQ;;EAEd,KAAA;AAAA;;UAIe,kBAAA;EClGkB;EDoGjC,MAAA;EACA,QAAA;;EAEA,OAAA;AAAA;ACxFF;;;;AAA+C;AAA/C,UDgGiB,aAAA;EACf,OAAA;EACA,OAAA,EAAS,MAAM,SAAS,kBAAA;AAAA;;;AArH1B;AAAA,cCIa,SAAA,EAAW,WAAW;;cAYtB,aAAA,EAAe,WAAW;ADhBjB;AAAA,iBCmBN,QAAA,CAAS,IAAA,WAAe,OAAO;;;;ADhBP;AAGxC;;iBCyCsB,cAAA,CAAe,GAAA,WAAc,OAAO,CAAC,WAAA;;;AD/C3D;AAAA,UEiBiB,mBAAA;EACf,QAAA;EACA,GAAA;EACA,UAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA,EAAS,UAAU;AAAA;AFpBmB;AAGxC;;;;AAA0C;AAHF,KE6B5B,WAAA,IAAe,YAAoB;AAAA,UAE9B,cAAA;EACf,OAAA,EAAS,WAAA;EACT,MAAA,GAAS,WAAA;EFfiB;EEiB1B,QAAA,GAAW,aAAA;EFde;EEgB1B,KAAA,GAAQ,WAAA;EFqBY;EEnBpB,KAAA;AAAA;;iBAMc,aAAA,CAAc,MAAA,GAAQ,WAAA,GAAmB,mBAAmB;;;;;AFatD;AAItB;iBEAgB,YAAA,CAAa,MAA2B,EAAnB,mBAAmB;;;;;;;AFSlD;AAIN;;;;;;iBE0BgB,SAAA,CAAU,KAAA,EAAO,cAAA,GAAiB,SAAS;;cA0C9C,WAAA,GAAe,IAAA,EAAM,SAAA,KAAY,QAAQ;AF7DtD;AAAA,iBEgEgB,UAAA,CAAW,IAAe,EAAT,SAAS;;;AFrJ1C;;;;AAAsB;AAGtB;;;;AAHA,iBG2BgB,aAAA,IAAiB,OAAO;AHrBxC;;;;AAA0C;AAe1C;;;AAfA,iBG0FsB,UAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;AH/EkB;AAG5B;;;;;;;AAH4B,iBG0IN,SAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;;iBAyBY,aAAA,CACpB,KAAA,UACA,MAAA,UACA,MAAA,EAAQ,mBAAA,GACP,OAAO;;;AH7L8B;AAAA,cIA3B,mBAAA;;;;AJG6B;AAe1C;;;;iBIRgB,YAAA,CAAa,IAAA,WAAe,aAAa;AJWzD;AAAA,iBINgB,UAAA,CAAW,OAAA,EAAS,MAAA,SAAe,kBAAA,IAAsB,aAAA;;;;;;;;iBAgBzD,aAAA,CAAc,IAAA,UAAc,QAAA,EAAU,aAAa;;;UCrBlD,mBAAA;ELbK;EKepB,GAAA;ELfoB;EKiBpB,GAAA;EACA,MAAA,GAAS,WAAW;ELfgD;EKiBpE,QAAA;ELjBsC;EKmBtC,KAAA;ELhBW;EKkBX,GAAA;;EAEA,UAAA,KAAe,OAAA;AAAA;AAAA,UAGA,kBAAA;EACf,IAAA,EAAM,SAAS;;EAEf,OAAA;ELX0B;EKa1B,OAAA;AAAA;;;;;;;;iBAUoB,YAAA,CAAa,OAAA,EAAS,mBAAA,GAAsB,OAAA,CAAQ,kBAAA"}

package/dist/media/index.mjs

@@ -1,4 +1,5 @@
-import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { n as writeVersioned, t as readVersioned } from "../json-store-30CFCbZZ.mjs";
+import { createReadStream, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
 import { dirname, extname, join, relative, resolve, sep } from "node:path";
@@ -253,15 +254,6 @@ async function extractPoster(input, output, config) {
 
 //#endregion
 //#region src/media/manifest.ts
-/**
-* The cache — what makes a second run free.
-*
-* A committed artifact, unlike `indexing/`'s snapshot: the recommended layout
-* checks in both the processed outputs and this file, so CI never needs ffmpeg
-* and the outputs only change when someone deliberately re-encodes. That is why
-* `writeManifest` sorts and carries no timestamp — an unchanged run has to produce
-* a byte-identical file, or every build shows up as a diff.
-*/
 /** Default location, relative to the consumer's project root. */
 const MEDIA_MANIFEST_PATH = ".vitops/media-manifest.json";
 /**
@@ -273,14 +265,7 @@ const MEDIA_MANIFEST_PATH = ".vitops/media-manifest.json";
 * would encode, and the build would reference outputs that were never written.
 */
 function readManifest(path) {
-	if (!existsSync(path)) return void 0;
-	try {
-		const raw = JSON.parse(readFileSync(path, "utf8"));
-		if (raw?.version !== 1 || typeof raw.entries !== "object" || raw.entries === null) return void 0;
-		return raw;
-	} catch {
-		return;
-	}
+	return readVersioned(path, "entries");
 }
 /** Build a manifest with its keys and output lists in a stable order. */
 function toManifest(entries) {
@@ -305,8 +290,7 @@ function toManifest(entries) {
 * result is a missing video that no rebuild ever fixes.
 */
 function writeManifest(path, manifest) {
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+	writeVersioned(path, manifest);
 }
 
 //#endregion