@getvitops/utils 7.0.0 → 8.0.0

package/dist/schema/index.mjs

@@ -0,0 +1,241 @@
+//#region src/schema/article.ts
+/** Build a schema.org Article JSON-LD graph. */
+function articleGraph(options) {
+	const { headline, description, image, datePublished, dateModified, author, publisher, mainEntityOfPage, articleSection, wordCount, keywords } = options;
+	const authors = Array.isArray(author) ? author : [author];
+	return {
+		"@context": "https://schema.org",
+		"@type": "Article",
+		headline,
+		...description && { description },
+		...image && { image: Array.isArray(image) ? image : [image] },
+		datePublished,
+		...dateModified && { dateModified },
+		author: authors.map((a) => ({
+			"@type": "Person",
+			name: a.name,
+			...a.url && { url: a.url }
+		})),
+		...publisher && { publisher: {
+			"@type": "Organization",
+			name: publisher.name,
+			...publisher.logo && { logo: {
+				"@type": "ImageObject",
+				url: publisher.logo
+			} }
+		} },
+		...mainEntityOfPage && { mainEntityOfPage: {
+			"@type": "WebPage",
+			"@id": mainEntityOfPage
+		} },
+		...articleSection && { articleSection },
+		...wordCount && { wordCount },
+		...keywords && { keywords: keywords.join(", ") }
+	};
+}
+
+//#endregion
+//#region src/schema/breadcrumb.ts
+/** Build a schema.org BreadcrumbList JSON-LD graph. */
+function breadcrumbGraph(options) {
+	return {
+		"@context": "https://schema.org",
+		"@type": "BreadcrumbList",
+		itemListElement: options.items.map((item, index) => ({
+			"@type": "ListItem",
+			position: index + 1,
+			name: item.name,
+			item: item.url
+		}))
+	};
+}
+
+//#endregion
+//#region src/schema/faq.ts
+/**
+* Build a schema.org FAQPage JSON-LD graph.
+*
+* NOTE: Google recommends FAQ markup only for authoritative government
+* and health sites. For other sites, consider using QAPage schema instead.
+*/
+function faqGraph(options) {
+	return {
+		"@context": "https://schema.org",
+		"@type": "FAQPage",
+		mainEntity: options.items.map((item) => ({
+			"@type": "Question",
+			name: item.question,
+			acceptedAnswer: {
+				"@type": "Answer",
+				text: item.answer
+			}
+		}))
+	};
+}
+
+//#endregion
+//#region src/schema/itemList.ts
+/** Build a schema.org ItemList JSON-LD graph (e.g. for a carousel rich result). */
+function itemListGraph(options) {
+	const { items, name } = options;
+	return {
+		"@context": "https://schema.org",
+		"@type": "ItemList",
+		...name && { name },
+		itemListElement: items.map((item, index) => ({
+			"@type": "ListItem",
+			position: index + 1,
+			item: {
+				"@type": item.type,
+				name: item.name,
+				url: item.url,
+				...item.image && { image: item.image },
+				...item.description && { description: item.description }
+			}
+		}))
+	};
+}
+
+//#endregion
+//#region src/schema/localBusiness.ts
+/** Build a schema.org LocalBusiness (or subtype) JSON-LD graph. */
+function localBusinessGraph(options) {
+	const { type = "LocalBusiness", name, description, url, telephone, email, image, priceRange, address, geo, openingHoursSpecification, specialOpeningHoursSpecification, aggregateRating, review, paymentAccepted, currenciesAccepted, areaServed, sameAs, knowsLanguage } = options;
+	const hours = [...(openingHoursSpecification ?? []).map((spec) => ({
+		"@type": "OpeningHoursSpecification",
+		dayOfWeek: spec.dayOfWeek,
+		opens: spec.opens,
+		closes: spec.closes
+	})), ...(specialOpeningHoursSpecification ?? []).map((spec) => ({
+		"@type": "OpeningHoursSpecification",
+		validFrom: spec.validFrom,
+		...spec.validThrough && { validThrough: spec.validThrough },
+		...spec.opens && { opens: spec.opens },
+		...spec.closes && { closes: spec.closes }
+	}))];
+	return {
+		"@context": "https://schema.org",
+		"@type": type,
+		name,
+		...description && { description },
+		...url && { url },
+		...telephone && { telephone },
+		...email && { email },
+		...image && { image: Array.isArray(image) ? image : [image] },
+		...priceRange && { priceRange },
+		...address && { address: {
+			"@type": "PostalAddress",
+			...address.streetAddress && { streetAddress: address.streetAddress },
+			...address.addressLocality && { addressLocality: address.addressLocality },
+			...address.addressRegion && { addressRegion: address.addressRegion },
+			...address.postalCode && { postalCode: address.postalCode },
+			...address.addressCountry && { addressCountry: address.addressCountry }
+		} },
+		...geo && { geo: {
+			"@type": "GeoCoordinates",
+			latitude: geo.latitude,
+			longitude: geo.longitude
+		} },
+		...hours.length > 0 && { openingHoursSpecification: hours },
+		...aggregateRating && { aggregateRating: {
+			"@type": "AggregateRating",
+			ratingValue: aggregateRating.ratingValue,
+			...aggregateRating.reviewCount && { reviewCount: aggregateRating.reviewCount },
+			...aggregateRating.ratingCount && { ratingCount: aggregateRating.ratingCount },
+			bestRating: aggregateRating.bestRating ?? 5,
+			worstRating: aggregateRating.worstRating ?? 1
+		} },
+		...review && { review: review.map((r) => ({
+			"@type": "Review",
+			author: {
+				"@type": "Person",
+				name: r.author
+			},
+			datePublished: r.datePublished,
+			reviewBody: r.reviewBody,
+			...r.reviewRating && { reviewRating: {
+				"@type": "Rating",
+				ratingValue: r.reviewRating.ratingValue,
+				bestRating: r.reviewRating.bestRating ?? 5,
+				worstRating: r.reviewRating.worstRating ?? 1
+			} }
+		})) },
+		...paymentAccepted && { paymentAccepted },
+		...currenciesAccepted && { currenciesAccepted },
+		...areaServed && { areaServed },
+		...sameAs && { sameAs },
+		...knowsLanguage && { knowsLanguage }
+	};
+}
+
+//#endregion
+//#region src/schema/organization.ts
+/** Build a schema.org Organization JSON-LD graph. */
+function organizationGraph(options) {
+	const { name, url, logo, description, email, telephone, address, sameAs, foundingDate, founders, numberOfEmployees, parentOrganization, subOrganization, contactPoint, areaServed, brand, award, memberOf } = options;
+	return {
+		"@context": "https://schema.org",
+		"@type": "Organization",
+		name,
+		...url && { url },
+		...logo && { logo },
+		...description && { description },
+		...email && { email },
+		...telephone && { telephone },
+		...address && { address: {
+			"@type": "PostalAddress",
+			...address.streetAddress && { streetAddress: address.streetAddress },
+			...address.addressLocality && { addressLocality: address.addressLocality },
+			...address.addressRegion && { addressRegion: address.addressRegion },
+			...address.postalCode && { postalCode: address.postalCode },
+			...address.addressCountry && { addressCountry: address.addressCountry }
+		} },
+		...sameAs && { sameAs },
+		...foundingDate && { foundingDate },
+		...founders && { founders: founders.map((f) => ({
+			"@type": "Person",
+			name: f
+		})) },
+		...numberOfEmployees && { numberOfEmployees: typeof numberOfEmployees === "number" ? {
+			"@type": "QuantitativeValue",
+			value: numberOfEmployees
+		} : {
+			"@type": "QuantitativeValue",
+			minValue: numberOfEmployees.minValue,
+			maxValue: numberOfEmployees.maxValue
+		} },
+		...parentOrganization && { parentOrganization: {
+			"@type": "Organization",
+			name: parentOrganization.name,
+			...parentOrganization.url && { url: parentOrganization.url }
+		} },
+		...subOrganization && { subOrganization: subOrganization.map((sub) => ({
+			"@type": "Organization",
+			name: sub.name,
+			...sub.url && { url: sub.url }
+		})) },
+		...contactPoint && { contactPoint: contactPoint.map((cp) => ({
+			"@type": "ContactPoint",
+			telephone: cp.telephone,
+			contactType: cp.contactType,
+			...cp.email && { email: cp.email },
+			...cp.availableLanguage && { availableLanguage: cp.availableLanguage },
+			...cp.areaServed && { areaServed: cp.areaServed }
+		})) },
+		...areaServed && { areaServed },
+		...brand && { brand: {
+			"@type": "Brand",
+			name: brand
+		} },
+		...award && { award },
+		...memberOf && { memberOf: memberOf.map((m) => ({
+			"@type": "Organization",
+			name: m.name,
+			...m.url && { url: m.url }
+		})) }
+	};
+}
+
+//#endregion
+export { articleGraph, breadcrumbGraph, faqGraph, itemListGraph, localBusinessGraph, organizationGraph };
+//# sourceMappingURL=index.mjs.map

package/dist/schema/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/schema/article.ts","../../src/schema/breadcrumb.ts","../../src/schema/faq.ts","../../src/schema/itemList.ts","../../src/schema/localBusiness.ts","../../src/schema/organization.ts"],"sourcesContent":["export interface ArticleAuthor {\n  name: string;\n  url?: string;\n}\n\nexport interface ArticleGraphOptions {\n  headline: string;\n  description?: string;\n  image?: string | string[];\n  datePublished: string;\n  dateModified?: string;\n  author: ArticleAuthor | ArticleAuthor[];\n  publisher?: {\n    name: string;\n    logo?: string;\n  };\n  mainEntityOfPage?: string;\n  articleSection?: string;\n  wordCount?: number;\n  keywords?: string[];\n}\n\n/** Build a schema.org Article JSON-LD graph. */\nexport function articleGraph(options: ArticleGraphOptions): Record<string, unknown> {\n  const {\n    headline,\n    description,\n    image,\n    datePublished,\n    dateModified,\n    author,\n    publisher,\n    mainEntityOfPage,\n    articleSection,\n    wordCount,\n    keywords,\n  } = options;\n\n  const authors = Array.isArray(author) ? author : [author];\n\n  return {\n    '@context': 'https://schema.org',\n    '@type': 'Article',\n    headline,\n    ...(description && { description }),\n    ...(image && { image: Array.isArray(image) ? image : [image] }),\n    datePublished,\n    ...(dateModified && { dateModified }),\n    author: authors.map((a) => ({\n      '@type': 'Person',\n      name: a.name,\n      ...(a.url && { url: a.url }),\n    })),\n    ...(publisher && {\n      publisher: {\n        '@type': 'Organization',\n        name: publisher.name,\n        ...(publisher.logo && { logo: { '@type': 'ImageObject', url: publisher.logo } }),\n      },\n    }),\n    ...(mainEntityOfPage && { mainEntityOfPage: { '@type': 'WebPage', '@id': mainEntityOfPage } }),\n    ...(articleSection && { articleSection }),\n    ...(wordCount && { wordCount }),\n    ...(keywords && { keywords: keywords.join(', ') }),\n  };\n}\n","export interface BreadcrumbItem {\n  name: string;\n  url: string;\n}\n\nexport interface BreadcrumbGraphOptions {\n  items: BreadcrumbItem[];\n}\n\n/** Build a schema.org BreadcrumbList JSON-LD graph. */\nexport function breadcrumbGraph(options: BreadcrumbGraphOptions): Record<string, unknown> {\n  return {\n    '@context': 'https://schema.org',\n    '@type': 'BreadcrumbList',\n    itemListElement: options.items.map((item, index) => ({\n      '@type': 'ListItem',\n      position: index + 1,\n      name: item.name,\n      item: item.url,\n    })),\n  };\n}\n","export interface FAQItem {\n  question: string;\n  answer: string;\n}\n\nexport interface FAQGraphOptions {\n  items: FAQItem[];\n}\n\n/**\n * Build a schema.org FAQPage JSON-LD graph.\n *\n * NOTE: Google recommends FAQ markup only for authoritative government\n * and health sites. For other sites, consider using QAPage schema instead.\n */\nexport function faqGraph(options: FAQGraphOptions): Record<string, unknown> {\n  return {\n    '@context': 'https://schema.org',\n    '@type': 'FAQPage',\n    mainEntity: options.items.map((item) => ({\n      '@type': 'Question',\n      name: item.question,\n      acceptedAnswer: {\n        '@type': 'Answer',\n        text: item.answer,\n      },\n    })),\n  };\n}\n","export type ItemListEntryType =\n  | 'Article'\n  | 'Recipe'\n  | 'Movie'\n  | 'Course'\n  | 'Restaurant'\n  | 'Product'\n  // Anything else is still valid ItemList markup, just not a Google\n  // carousel rich-result candidate — those six are the full supported set.\n  | (string & {});\n\nexport interface ItemListEntry {\n  type: ItemListEntryType;\n  name: string;\n  /**\n   * Summary-page format: the item's own detail page (unique, same domain).\n   * All-in-one-page format: this page's URL plus an HTML anchor pointing at\n   * the item on it.\n   */\n  url: string;\n  image?: string;\n  description?: string;\n}\n\nexport interface ItemListGraphOptions {\n  items: ItemListEntry[];\n  /** Recommended, not required by the spec — names the list itself. */\n  name?: string;\n}\n\n/** Build a schema.org ItemList JSON-LD graph (e.g. for a carousel rich result). */\nexport function itemListGraph(options: ItemListGraphOptions): Record<string, unknown> {\n  const { items, name } = options;\n\n  return {\n    '@context': 'https://schema.org',\n    '@type': 'ItemList',\n    ...(name && { name }),\n    itemListElement: items.map((item, index) => ({\n      '@type': 'ListItem',\n      position: index + 1,\n      item: {\n        '@type': item.type,\n        name: item.name,\n        url: item.url,\n        ...(item.image && { image: item.image }),\n        ...(item.description && { description: item.description }),\n      },\n    })),\n  };\n}\n","export interface OpeningHoursSpecification {\n  dayOfWeek: ('Monday' | 'Tuesday' | 'Wednesday' | 'Thursday' | 'Friday' | 'Saturday' | 'Sunday')[];\n  opens: string;\n  closes: string;\n}\n\n/**\n * A dated deviation from the recurring `openingHoursSpecification` — holiday\n * hours, a one-off closure, a temporary schedule. Same schema.org shape\n * (`OpeningHoursSpecification`), distinguished by carrying `validFrom`. A full\n * closure omits `opens`/`closes` rather than encoding it as an open interval.\n */\nexport interface SpecialHoursSpecification {\n  validFrom: string;\n  validThrough?: string;\n  opens?: string;\n  closes?: string;\n}\n\nexport interface LocalBusinessGraphOptions {\n  /** schema.org `LocalBusiness` subtype, e.g. `'Restaurant'`, `'ProfessionalService'`. Defaults to `'LocalBusiness'`. */\n  type?: string;\n  name: string;\n  description?: string;\n  url?: string;\n  telephone?: string;\n  email?: string;\n  image?: string | string[];\n  priceRange?: string;\n  address?: {\n    streetAddress?: string;\n    addressLocality?: string;\n    addressRegion?: string;\n    postalCode?: string;\n    addressCountry?: string;\n  };\n  geo?: {\n    latitude: number;\n    longitude: number;\n  };\n  openingHoursSpecification?: OpeningHoursSpecification[];\n  specialOpeningHoursSpecification?: SpecialHoursSpecification[];\n  aggregateRating?: {\n    ratingValue: number;\n    reviewCount?: number;\n    ratingCount?: number;\n    bestRating?: number;\n    worstRating?: number;\n  };\n  review?: {\n    author: string;\n    datePublished: string;\n    reviewBody: string;\n    reviewRating?: {\n      ratingValue: number;\n      bestRating?: number;\n      worstRating?: number;\n    };\n  }[];\n  paymentAccepted?: string[];\n  currenciesAccepted?: string;\n  areaServed?: string[];\n  sameAs?: string[];\n  knowsLanguage?: string[];\n}\n\n/** Build a schema.org LocalBusiness (or subtype) JSON-LD graph. */\nexport function localBusinessGraph(options: LocalBusinessGraphOptions): Record<string, unknown> {\n  const {\n    type = 'LocalBusiness',\n    name,\n    description,\n    url,\n    telephone,\n    email,\n    image,\n    priceRange,\n    address,\n    geo,\n    openingHoursSpecification,\n    specialOpeningHoursSpecification,\n    aggregateRating,\n    review,\n    paymentAccepted,\n    currenciesAccepted,\n    areaServed,\n    sameAs,\n    knowsLanguage,\n  } = options;\n\n  const hours = [\n    ...(openingHoursSpecification ?? []).map((spec) => ({\n      '@type': 'OpeningHoursSpecification',\n      dayOfWeek: spec.dayOfWeek,\n      opens: spec.opens,\n      closes: spec.closes,\n    })),\n    ...(specialOpeningHoursSpecification ?? []).map((spec) => ({\n      '@type': 'OpeningHoursSpecification',\n      validFrom: spec.validFrom,\n      ...(spec.validThrough && { validThrough: spec.validThrough }),\n      ...(spec.opens && { opens: spec.opens }),\n      ...(spec.closes && { closes: spec.closes }),\n    })),\n  ];\n\n  return {\n    '@context': 'https://schema.org',\n    '@type': type,\n    name,\n    ...(description && { description }),\n    ...(url && { url }),\n    ...(telephone && { telephone }),\n    ...(email && { email }),\n    ...(image && { image: Array.isArray(image) ? image : [image] }),\n    ...(priceRange && { priceRange }),\n    ...(address && {\n      address: {\n        '@type': 'PostalAddress',\n        ...(address.streetAddress && { streetAddress: address.streetAddress }),\n        ...(address.addressLocality && { addressLocality: address.addressLocality }),\n        ...(address.addressRegion && { addressRegion: address.addressRegion }),\n        ...(address.postalCode && { postalCode: address.postalCode }),\n        ...(address.addressCountry && { addressCountry: address.addressCountry }),\n      },\n    }),\n    ...(geo && {\n      geo: {\n        '@type': 'GeoCoordinates',\n        latitude: geo.latitude,\n        longitude: geo.longitude,\n      },\n    }),\n    ...(hours.length > 0 && { openingHoursSpecification: hours }),\n    ...(aggregateRating && {\n      aggregateRating: {\n        '@type': 'AggregateRating',\n        ratingValue: aggregateRating.ratingValue,\n        ...(aggregateRating.reviewCount && { reviewCount: aggregateRating.reviewCount }),\n        ...(aggregateRating.ratingCount && { ratingCount: aggregateRating.ratingCount }),\n        bestRating: aggregateRating.bestRating ?? 5,\n        worstRating: aggregateRating.worstRating ?? 1,\n      },\n    }),\n    ...(review && {\n      review: review.map((r) => ({\n        '@type': 'Review',\n        author: { '@type': 'Person', name: r.author },\n        datePublished: r.datePublished,\n        reviewBody: r.reviewBody,\n        ...(r.reviewRating && {\n          reviewRating: {\n            '@type': 'Rating',\n            ratingValue: r.reviewRating.ratingValue,\n            bestRating: r.reviewRating.bestRating ?? 5,\n            worstRating: r.reviewRating.worstRating ?? 1,\n          },\n        }),\n      })),\n    }),\n    ...(paymentAccepted && { paymentAccepted }),\n    ...(currenciesAccepted && { currenciesAccepted }),\n    ...(areaServed && { areaServed }),\n    ...(sameAs && { sameAs }),\n    ...(knowsLanguage && { knowsLanguage }),\n  };\n}\n","export interface OrganizationGraphOptions {\n  name: string;\n  url?: string;\n  logo?: string;\n  description?: string;\n  email?: string;\n  telephone?: string;\n  address?: {\n    streetAddress?: string;\n    addressLocality?: string;\n    addressRegion?: string;\n    postalCode?: string;\n    addressCountry?: string;\n  };\n  sameAs?: string[];\n  foundingDate?: string;\n  founders?: string[];\n  numberOfEmployees?: number | { minValue: number; maxValue: number };\n  parentOrganization?: {\n    name: string;\n    url?: string;\n  };\n  subOrganization?: {\n    name: string;\n    url?: string;\n  }[];\n  contactPoint?: {\n    type?: 'customer service' | 'technical support' | 'sales' | 'billing support' | 'reservations';\n    telephone: string;\n    email?: string;\n    contactType: string;\n    availableLanguage?: string[];\n    areaServed?: string[];\n  }[];\n  areaServed?: string[];\n  brand?: string;\n  award?: string[];\n  memberOf?: {\n    name: string;\n    url?: string;\n  }[];\n}\n\n/** Build a schema.org Organization JSON-LD graph. */\nexport function organizationGraph(options: OrganizationGraphOptions): Record<string, unknown> {\n  const {\n    name,\n    url,\n    logo,\n    description,\n    email,\n    telephone,\n    address,\n    sameAs,\n    foundingDate,\n    founders,\n    numberOfEmployees,\n    parentOrganization,\n    subOrganization,\n    contactPoint,\n    areaServed,\n    brand,\n    award,\n    memberOf,\n  } = options;\n\n  return {\n    '@context': 'https://schema.org',\n    '@type': 'Organization',\n    name,\n    ...(url && { url }),\n    ...(logo && { logo }),\n    ...(description && { description }),\n    ...(email && { email }),\n    ...(telephone && { telephone }),\n    ...(address && {\n      address: {\n        '@type': 'PostalAddress',\n        ...(address.streetAddress && { streetAddress: address.streetAddress }),\n        ...(address.addressLocality && { addressLocality: address.addressLocality }),\n        ...(address.addressRegion && { addressRegion: address.addressRegion }),\n        ...(address.postalCode && { postalCode: address.postalCode }),\n        ...(address.addressCountry && { addressCountry: address.addressCountry }),\n      },\n    }),\n    ...(sameAs && { sameAs }),\n    ...(foundingDate && { foundingDate }),\n    ...(founders && {\n      founders: founders.map((f) => ({\n        '@type': 'Person',\n        name: f,\n      })),\n    }),\n    ...(numberOfEmployees && {\n      numberOfEmployees:\n        typeof numberOfEmployees === 'number'\n          ? { '@type': 'QuantitativeValue', value: numberOfEmployees }\n          : {\n              '@type': 'QuantitativeValue',\n              minValue: numberOfEmployees.minValue,\n              maxValue: numberOfEmployees.maxValue,\n            },\n    }),\n    ...(parentOrganization && {\n      parentOrganization: {\n        '@type': 'Organization',\n        name: parentOrganization.name,\n        ...(parentOrganization.url && { url: parentOrganization.url }),\n      },\n    }),\n    ...(subOrganization && {\n      subOrganization: subOrganization.map((sub) => ({\n        '@type': 'Organization',\n        name: sub.name,\n        ...(sub.url && { url: sub.url }),\n      })),\n    }),\n    ...(contactPoint && {\n      contactPoint: contactPoint.map((cp) => ({\n        '@type': 'ContactPoint',\n        telephone: cp.telephone,\n        contactType: cp.contactType,\n        ...(cp.email && { email: cp.email }),\n        ...(cp.availableLanguage && { availableLanguage: cp.availableLanguage }),\n        ...(cp.areaServed && { areaServed: cp.areaServed }),\n      })),\n    }),\n    ...(areaServed && { areaServed }),\n    ...(brand && { brand: { '@type': 'Brand', name: brand } }),\n    ...(award && { award }),\n    ...(memberOf && {\n      memberOf: memberOf.map((m) => ({\n        '@type': 'Organization',\n        name: m.name,\n        ...(m.url && { url: m.url }),\n      })),\n    }),\n  };\n}\n"],"mappings":";;AAuBA,SAAgB,aAAa,SAAuD;CAClF,MAAM,EACJ,UACA,aACA,OACA,eACA,cACA,QACA,WACA,kBACA,gBACA,WACA,aACE;CAEJ,MAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;CAExD,OAAO;EACL,YAAY;EACZ,SAAS;EACT;EACA,GAAI,eAAe,EAAE,YAAY;EACjC,GAAI,SAAS,EAAE,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE;EAC7D;EACA,GAAI,gBAAgB,EAAE,aAAa;EACnC,QAAQ,QAAQ,KAAK,OAAO;GAC1B,SAAS;GACT,MAAM,EAAE;GACR,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI;EAC5B,EAAE;EACF,GAAI,aAAa,EACf,WAAW;GACT,SAAS;GACT,MAAM,UAAU;GAChB,GAAI,UAAU,QAAQ,EAAE,MAAM;IAAE,SAAS;IAAe,KAAK,UAAU;GAAK,EAAE;EAChF,EACF;EACA,GAAI,oBAAoB,EAAE,kBAAkB;GAAE,SAAS;GAAW,OAAO;EAAiB,EAAE;EAC5F,GAAI,kBAAkB,EAAE,eAAe;EACvC,GAAI,aAAa,EAAE,UAAU;EAC7B,GAAI,YAAY,EAAE,UAAU,SAAS,KAAK,IAAI,EAAE;CAClD;AACF;;;;;ACvDA,SAAgB,gBAAgB,SAA0D;CACxF,OAAO;EACL,YAAY;EACZ,SAAS;EACT,iBAAiB,QAAQ,MAAM,KAAK,MAAM,WAAW;GACnD,SAAS;GACT,UAAU,QAAQ;GAClB,MAAM,KAAK;GACX,MAAM,KAAK;EACb,EAAE;CACJ;AACF;;;;;;;;;;ACNA,SAAgB,SAAS,SAAmD;CAC1E,OAAO;EACL,YAAY;EACZ,SAAS;EACT,YAAY,QAAQ,MAAM,KAAK,UAAU;GACvC,SAAS;GACT,MAAM,KAAK;GACX,gBAAgB;IACd,SAAS;IACT,MAAM,KAAK;GACb;EACF,EAAE;CACJ;AACF;;;;;ACGA,SAAgB,cAAc,SAAwD;CACpF,MAAM,EAAE,OAAO,SAAS;CAExB,OAAO;EACL,YAAY;EACZ,SAAS;EACT,GAAI,QAAQ,EAAE,KAAK;EACnB,iBAAiB,MAAM,KAAK,MAAM,WAAW;GAC3C,SAAS;GACT,UAAU,QAAQ;GAClB,MAAM;IACJ,SAAS,KAAK;IACd,MAAM,KAAK;IACX,KAAK,KAAK;IACV,GAAI,KAAK,SAAS,EAAE,OAAO,KAAK,MAAM;IACtC,GAAI,KAAK,eAAe,EAAE,aAAa,KAAK,YAAY;GAC1D;EACF,EAAE;CACJ;AACF;;;;;ACiBA,SAAgB,mBAAmB,SAA6D;CAC9F,MAAM,EACJ,OAAO,iBACP,MACA,aACA,KACA,WACA,OACA,OACA,YACA,SACA,KACA,2BACA,kCACA,iBACA,QACA,iBACA,oBACA,YACA,QACA,kBACE;CAEJ,MAAM,QAAQ,CACZ,IAAI,6BAA6B,CAAC,EAAC,CAAE,KAAK,UAAU;EAClD,SAAS;EACT,WAAW,KAAK;EAChB,OAAO,KAAK;EACZ,QAAQ,KAAK;CACf,EAAE,GACF,IAAI,oCAAoC,CAAC,EAAC,CAAE,KAAK,UAAU;EACzD,SAAS;EACT,WAAW,KAAK;EAChB,GAAI,KAAK,gBAAgB,EAAE,cAAc,KAAK,aAAa;EAC3D,GAAI,KAAK,SAAS,EAAE,OAAO,KAAK,MAAM;EACtC,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;CAC3C,EAAE,CACJ;CAEA,OAAO;EACL,YAAY;EACZ,SAAS;EACT;EACA,GAAI,eAAe,EAAE,YAAY;EACjC,GAAI,OAAO,EAAE,IAAI;EACjB,GAAI,aAAa,EAAE,UAAU;EAC7B,GAAI,SAAS,EAAE,MAAM;EACrB,GAAI,SAAS,EAAE,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE;EAC7D,GAAI,cAAc,EAAE,WAAW;EAC/B,GAAI,WAAW,EACb,SAAS;GACP,SAAS;GACT,GAAI,QAAQ,iBAAiB,EAAE,eAAe,QAAQ,cAAc;GACpE,GAAI,QAAQ,mBAAmB,EAAE,iBAAiB,QAAQ,gBAAgB;GAC1E,GAAI,QAAQ,iBAAiB,EAAE,eAAe,QAAQ,cAAc;GACpE,GAAI,QAAQ,cAAc,EAAE,YAAY,QAAQ,WAAW;GAC3D,GAAI,QAAQ,kBAAkB,EAAE,gBAAgB,QAAQ,eAAe;EACzE,EACF;EACA,GAAI,OAAO,EACT,KAAK;GACH,SAAS;GACT,UAAU,IAAI;GACd,WAAW,IAAI;EACjB,EACF;EACA,GAAI,MAAM,SAAS,KAAK,EAAE,2BAA2B,MAAM;EAC3D,GAAI,mBAAmB,EACrB,iBAAiB;GACf,SAAS;GACT,aAAa,gBAAgB;GAC7B,GAAI,gBAAgB,eAAe,EAAE,aAAa,gBAAgB,YAAY;GAC9E,GAAI,gBAAgB,eAAe,EAAE,aAAa,gBAAgB,YAAY;GAC9E,YAAY,gBAAgB,cAAc;GAC1C,aAAa,gBAAgB,eAAe;EAC9C,EACF;EACA,GAAI,UAAU,EACZ,QAAQ,OAAO,KAAK,OAAO;GACzB,SAAS;GACT,QAAQ;IAAE,SAAS;IAAU,MAAM,EAAE;GAAO;GAC5C,eAAe,EAAE;GACjB,YAAY,EAAE;GACd,GAAI,EAAE,gBAAgB,EACpB,cAAc;IACZ,SAAS;IACT,aAAa,EAAE,aAAa;IAC5B,YAAY,EAAE,aAAa,cAAc;IACzC,aAAa,EAAE,aAAa,eAAe;GAC7C,EACF;EACF,EAAE,EACJ;EACA,GAAI,mBAAmB,EAAE,gBAAgB;EACzC,GAAI,sBAAsB,EAAE,mBAAmB;EAC/C,GAAI,cAAc,EAAE,WAAW;EAC/B,GAAI,UAAU,EAAE,OAAO;EACvB,GAAI,iBAAiB,EAAE,cAAc;CACvC;AACF;;;;;AC1HA,SAAgB,kBAAkB,SAA4D;CAC5F,MAAM,EACJ,MACA,KACA,MACA,aACA,OACA,WACA,SACA,QACA,cACA,UACA,mBACA,oBACA,iBACA,cACA,YACA,OACA,OACA,aACE;CAEJ,OAAO;EACL,YAAY;EACZ,SAAS;EACT;EACA,GAAI,OAAO,EAAE,IAAI;EACjB,GAAI,QAAQ,EAAE,KAAK;EACnB,GAAI,eAAe,EAAE,YAAY;EACjC,GAAI,SAAS,EAAE,MAAM;EACrB,GAAI,aAAa,EAAE,UAAU;EAC7B,GAAI,WAAW,EACb,SAAS;GACP,SAAS;GACT,GAAI,QAAQ,iBAAiB,EAAE,eAAe,QAAQ,cAAc;GACpE,GAAI,QAAQ,mBAAmB,EAAE,iBAAiB,QAAQ,gBAAgB;GAC1E,GAAI,QAAQ,iBAAiB,EAAE,eAAe,QAAQ,cAAc;GACpE,GAAI,QAAQ,cAAc,EAAE,YAAY,QAAQ,WAAW;GAC3D,GAAI,QAAQ,kBAAkB,EAAE,gBAAgB,QAAQ,eAAe;EACzE,EACF;EACA,GAAI,UAAU,EAAE,OAAO;EACvB,GAAI,gBAAgB,EAAE,aAAa;EACnC,GAAI,YAAY,EACd,UAAU,SAAS,KAAK,OAAO;GAC7B,SAAS;GACT,MAAM;EACR,EAAE,EACJ;EACA,GAAI,qBAAqB,EACvB,mBACE,OAAO,sBAAsB,WACzB;GAAE,SAAS;GAAqB,OAAO;EAAkB,IACzD;GACE,SAAS;GACT,UAAU,kBAAkB;GAC5B,UAAU,kBAAkB;EAC9B,EACR;EACA,GAAI,sBAAsB,EACxB,oBAAoB;GAClB,SAAS;GACT,MAAM,mBAAmB;GACzB,GAAI,mBAAmB,OAAO,EAAE,KAAK,mBAAmB,IAAI;EAC9D,EACF;EACA,GAAI,mBAAmB,EACrB,iBAAiB,gBAAgB,KAAK,SAAS;GAC7C,SAAS;GACT,MAAM,IAAI;GACV,GAAI,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI;EAChC,EAAE,EACJ;EACA,GAAI,gBAAgB,EAClB,cAAc,aAAa,KAAK,QAAQ;GACtC,SAAS;GACT,WAAW,GAAG;GACd,aAAa,GAAG;GAChB,GAAI,GAAG,SAAS,EAAE,OAAO,GAAG,MAAM;GAClC,GAAI,GAAG,qBAAqB,EAAE,mBAAmB,GAAG,kBAAkB;GACtE,GAAI,GAAG,cAAc,EAAE,YAAY,GAAG,WAAW;EACnD,EAAE,EACJ;EACA,GAAI,cAAc,EAAE,WAAW;EAC/B,GAAI,SAAS,EAAE,OAAO;GAAE,SAAS;GAAS,MAAM;EAAM,EAAE;EACxD,GAAI,SAAS,EAAE,MAAM;EACrB,GAAI,YAAY,EACd,UAAU,SAAS,KAAK,OAAO;GAC7B,SAAS;GACT,MAAM,EAAE;GACR,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI;EAC5B,EAAE,EACJ;CACF;AACF"}

package/dist/security/index.d.mts

@@ -0,0 +1,48 @@
+//#region src/security/turnstile.d.ts
+/**
+ * Cloudflare Turnstile server-side verification.
+ *
+ * `site.security.turnstile.siteKey` is public and lives in the config; the
+ * matching **secret** key never does — same rule as every other credential in
+ * this toolchain (`CLOUDFLARE_API_TOKEN`, the Google OAuth/service-account
+ * grants) and the same reason: an env var, injected by the caller, never
+ * imported here. Before this module existed, `siteKey` was read by the legal
+ * templates (`legal/providers.ts`, `legal/derive.ts`) to *name* Turnstile in the
+ * generated privacy policy, with nothing in the toolchain that verified a token
+ * — a config field asserting a fact the site didn't actually implement, which is
+ * exactly what the legal system's own rule ("the config records facts; the
+ * template owns prose") argues against. `verifyTurnstileToken` plus
+ * `createConversionRoute()`'s `turnstile` option (`@getvitops/astro/routes`) is
+ * what lets that field describe something real.
+ *
+ * A separate `@getvitops/utils/security` subpath for the same reason
+ * `notify`/`tracking` are: this runs in a **Worker**, on every submission, and
+ * must not pull in anything build-time.
+ *
+ * The widget itself — `<script src="https://challenges.cloudflare.com/turnstile/
+ * v0/api.js" async defer></script>` plus a `<div class="cf-turnstile"
+ * data-sitekey="…">` — is the consumer's own markup, on their own hand-written
+ * form. There is no `FormRenderer` (removed 2026-07-27, see `AGENTS.md`) for this
+ * to hook into generically, so wiring the widget follows the same pattern a
+ * consumer already uses for the rest of their form: write the HTML, submit it to
+ * `createConversionRoute()`.
+ */
+interface TurnstileVerifyResult {
+  success: boolean;
+  /** Cloudflare's own codes (e.g. `timeout-or-duplicate`), present iff not successful. */
+  errorCodes?: string[];
+}
+/**
+ * Verify a submitted `cf-turnstile-response` token against Cloudflare's
+ * siteverify endpoint.
+ *
+ * Never throws — a network failure or a malformed response both come back as
+ * `{ success: false }` with an error code the caller can log, the same
+ * "structured result, not an exception" rule `indexing`/`notify` follow. A
+ * failed verification is not this module's business to act on; the caller
+ * (`createConversionRoute`) decides what a failure means for the request.
+ */
+declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, fetchImpl?: typeof fetch): Promise<TurnstileVerifyResult>;
+//#endregion
+export { type TurnstileVerifyResult, verifyTurnstileToken };
+//# sourceMappingURL=index.d.mts.map

package/dist/security/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/security/turnstile.ts"],"mappings":";;AA+BA;;;;AAGY;AAaZ;;;;;;;;;;;;;;;;AAKgC;;;;;;UArBf,qBAAA;EACf,OAAA;;EAEA,UAAU;AAAA;;;;;;;;;;;iBAaU,oBAAA,CACpB,KAAA,UACA,SAAA,UACA,QAAA,WACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,qBAAA"}

package/dist/security/index.mjs

@@ -0,0 +1,80 @@
+//#region src/security/turnstile.ts
+/**
+* Cloudflare Turnstile server-side verification.
+*
+* `site.security.turnstile.siteKey` is public and lives in the config; the
+* matching **secret** key never does — same rule as every other credential in
+* this toolchain (`CLOUDFLARE_API_TOKEN`, the Google OAuth/service-account
+* grants) and the same reason: an env var, injected by the caller, never
+* imported here. Before this module existed, `siteKey` was read by the legal
+* templates (`legal/providers.ts`, `legal/derive.ts`) to *name* Turnstile in the
+* generated privacy policy, with nothing in the toolchain that verified a token
+* — a config field asserting a fact the site didn't actually implement, which is
+* exactly what the legal system's own rule ("the config records facts; the
+* template owns prose") argues against. `verifyTurnstileToken` plus
+* `createConversionRoute()`'s `turnstile` option (`@getvitops/astro/routes`) is
+* what lets that field describe something real.
+*
+* A separate `@getvitops/utils/security` subpath for the same reason
+* `notify`/`tracking` are: this runs in a **Worker**, on every submission, and
+* must not pull in anything build-time.
+*
+* The widget itself — `<script src="https://challenges.cloudflare.com/turnstile/
+* v0/api.js" async defer><\/script>` plus a `<div class="cf-turnstile"
+* data-sitekey="…">` — is the consumer's own markup, on their own hand-written
+* form. There is no `FormRenderer` (removed 2026-07-27, see `AGENTS.md`) for this
+* to hook into generically, so wiring the widget follows the same pattern a
+* consumer already uses for the rest of their form: write the HTML, submit it to
+* `createConversionRoute()`.
+*/
+const VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+* Verify a submitted `cf-turnstile-response` token against Cloudflare's
+* siteverify endpoint.
+*
+* Never throws — a network failure or a malformed response both come back as
+* `{ success: false }` with an error code the caller can log, the same
+* "structured result, not an exception" rule `indexing`/`notify` follow. A
+* failed verification is not this module's business to act on; the caller
+* (`createConversionRoute`) decides what a failure means for the request.
+*/
+async function verifyTurnstileToken(token, secretKey, remoteIp, fetchImpl = fetch) {
+	const body = new URLSearchParams({
+		secret: secretKey,
+		response: token
+	});
+	if (remoteIp) body.set("remoteip", remoteIp);
+	let res;
+	try {
+		res = await fetchImpl(VERIFY_ENDPOINT, {
+			method: "POST",
+			body
+		});
+	} catch (e) {
+		return {
+			success: false,
+			errorCodes: [`network-error: ${e.message}`]
+		};
+	}
+	if (!res.ok) return {
+		success: false,
+		errorCodes: [`http-${res.status}`]
+	};
+	let data;
+	try {
+		data = await res.json();
+	} catch {
+		return {
+			success: false,
+			errorCodes: ["malformed-response"]
+		};
+	}
+	return data.success === true ? { success: true } : {
+		success: false,
+		errorCodes: data["error-codes"] ?? ["unknown-error"]
+	};
+}
+
+//#endregion
+export { verifyTurnstileToken };
+//# sourceMappingURL=index.mjs.map

package/dist/security/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/security/turnstile.ts"],"sourcesContent":["/**\n * Cloudflare Turnstile server-side verification.\n *\n * `site.security.turnstile.siteKey` is public and lives in the config; the\n * matching **secret** key never does — same rule as every other credential in\n * this toolchain (`CLOUDFLARE_API_TOKEN`, the Google OAuth/service-account\n * grants) and the same reason: an env var, injected by the caller, never\n * imported here. Before this module existed, `siteKey` was read by the legal\n * templates (`legal/providers.ts`, `legal/derive.ts`) to *name* Turnstile in the\n * generated privacy policy, with nothing in the toolchain that verified a token\n * — a config field asserting a fact the site didn't actually implement, which is\n * exactly what the legal system's own rule (\"the config records facts; the\n * template owns prose\") argues against. `verifyTurnstileToken` plus\n * `createConversionRoute()`'s `turnstile` option (`@getvitops/astro/routes`) is\n * what lets that field describe something real.\n *\n * A separate `@getvitops/utils/security` subpath for the same reason\n * `notify`/`tracking` are: this runs in a **Worker**, on every submission, and\n * must not pull in anything build-time.\n *\n * The widget itself — `<script src=\"https://challenges.cloudflare.com/turnstile/\n * v0/api.js\" async defer></script>` plus a `<div class=\"cf-turnstile\"\n * data-sitekey=\"…\">` — is the consumer's own markup, on their own hand-written\n * form. There is no `FormRenderer` (removed 2026-07-27, see `AGENTS.md`) for this\n * to hook into generically, so wiring the widget follows the same pattern a\n * consumer already uses for the rest of their form: write the HTML, submit it to\n * `createConversionRoute()`.\n */\n\nconst VERIFY_ENDPOINT = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';\n\nexport interface TurnstileVerifyResult {\n  success: boolean;\n  /** Cloudflare's own codes (e.g. `timeout-or-duplicate`), present iff not successful. */\n  errorCodes?: string[];\n}\n\n/**\n * Verify a submitted `cf-turnstile-response` token against Cloudflare's\n * siteverify endpoint.\n *\n * Never throws — a network failure or a malformed response both come back as\n * `{ success: false }` with an error code the caller can log, the same\n * \"structured result, not an exception\" rule `indexing`/`notify` follow. A\n * failed verification is not this module's business to act on; the caller\n * (`createConversionRoute`) decides what a failure means for the request.\n */\nexport async function verifyTurnstileToken(\n  token: string,\n  secretKey: string,\n  remoteIp?: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<TurnstileVerifyResult> {\n  const body = new URLSearchParams({ secret: secretKey, response: token });\n  if (remoteIp) body.set('remoteip', remoteIp);\n\n  let res: Response;\n  try {\n    res = await fetchImpl(VERIFY_ENDPOINT, { method: 'POST', body });\n  } catch (e) {\n    return { success: false, errorCodes: [`network-error: ${(e as Error).message}`] };\n  }\n  if (!res.ok) return { success: false, errorCodes: [`http-${res.status}`] };\n\n  let data: { success?: boolean; 'error-codes'?: string[] };\n  try {\n    data = (await res.json()) as typeof data;\n  } catch {\n    return { success: false, errorCodes: ['malformed-response'] };\n  }\n\n  return data.success === true\n    ? { success: true }\n    : { success: false, errorCodes: data['error-codes'] ?? ['unknown-error'] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,kBAAkB;;;;;;;;;;;AAkBxB,eAAsB,qBACpB,OACA,WACA,UACA,YAA0B,OACM;CAChC,MAAM,OAAO,IAAI,gBAAgB;EAAE,QAAQ;EAAW,UAAU;CAAM,CAAC;CACvE,IAAI,UAAU,KAAK,IAAI,YAAY,QAAQ;CAE3C,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,UAAU,iBAAiB;GAAE,QAAQ;GAAQ;EAAK,CAAC;CACjE,SAAS,GAAG;EACV,OAAO;GAAE,SAAS;GAAO,YAAY,CAAC,kBAAmB,EAAY,SAAS;EAAE;CAClF;CACA,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,SAAS;EAAO,YAAY,CAAC,QAAQ,IAAI,QAAQ;CAAE;CAEzE,IAAI;CACJ,IAAI;EACF,OAAQ,MAAM,IAAI,KAAK;CACzB,QAAQ;EACN,OAAO;GAAE,SAAS;GAAO,YAAY,CAAC,oBAAoB;EAAE;CAC9D;CAEA,OAAO,KAAK,YAAY,OACpB,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,YAAY,KAAK,kBAAkB,CAAC,eAAe;CAAE;AAC7E"}

package/dist/{token-BlShEM6J.d.mts → token-Bz_-igw-.d.mts}

@@ -66,8 +66,9 @@ declare function googleHeaders(auth: GoogleAuthLike, extra?: Record<string, stri
 /** Scopes, named once so a caller never spells one out. */
 declare const SCOPES: {
   /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */readonly webmasters: "https://www.googleapis.com/auth/webmasters"; /** Site Verification API. */
-  readonly siteVerification: "https://www.googleapis.com/auth/siteverification";
+  readonly siteVerification: "https://www.googleapis.com/auth/siteverification"; /** Business Profile (reviews). The GCP project must be allowlisted by Google. */
+  readonly businessProfile: "https://www.googleapis.com/auth/business.manage";
 };
 //#endregion
 export { SCOPES as a, googleHeaders as c, GoogleOAuth as i, GoogleAuthLike as n, ServiceAccount as o, GoogleCredential as r, googleAccessToken as s, GoogleAuth as t };
-//# sourceMappingURL=token-BlShEM6J.d.mts.map
+//# sourceMappingURL=token-Bz_-igw-.d.mts.map

package/dist/{token-BlShEM6J.d.mts.map → token-Bz_-igw-.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"token-BlShEM6J.d.mts","names":[],"sources":["../src/google/token.ts"],"mappings":";;UAkCiB,cAAA;EACf,YAAA;EACA,WAAW;AAAA;AAAA;AAAA,UAII,WAAA;EACf,QAAA;EACA,YAAA;EACA,YAAA;AAAA;;;;AAAY;AAWd;;;;KAAY,gBAAA;EACN,IAAA;EAAyB,OAAA,EAAS,cAAA;EAAgB,KAAA;AAAA;EAClD,IAAA;EAAe,KAAA,EAAO,WAAW;AAAA;AAAA;AA8CvC;;;;;;;;AA9CuC,iBA8CvB,iBAAA,CACd,UAAA,EAAY,gBAAA,EACZ,SAAA,UAAkB,KAAA,EAClB,GAAA,YACC,OAAA;;;;;;;AAAO;AA6BV;;;;AAEc;AAUd;UAZiB,UAAA;EACf,KAAA;EACA,YAAY;AAAA;AAad;;;;;;;AAAA,KAHY,cAAA,YAA0B,UAAU;;iBAGhC,aAAA,CACd,IAAA,EAAM,cAAA,EACN,KAAA,GAAQ,MAAA,mBACP,MAAA;;cAUU,MAAA;EAVV,6EAeO,UAAA,gDAfD;EAAA,SAeC,gBAAA;AAAA"}
+{"version":3,"file":"token-Bz_-igw-.d.mts","names":[],"sources":["../src/google/token.ts"],"mappings":";;UAkCiB,cAAA;EACf,YAAA;EACA,WAAW;AAAA;AAAA;AAAA,UAII,WAAA;EACf,QAAA;EACA,YAAA;EACA,YAAA;AAAA;;;;AAAY;AAWd;;;;KAAY,gBAAA;EACN,IAAA;EAAyB,OAAA,EAAS,cAAA;EAAgB,KAAA;AAAA;EAClD,IAAA;EAAe,KAAA,EAAO,WAAW;AAAA;AAAA;AA8CvC;;;;;;;;AA9CuC,iBA8CvB,iBAAA,CACd,UAAA,EAAY,gBAAA,EACZ,SAAA,UAAkB,KAAA,EAClB,GAAA,YACC,OAAA;;;;;;;AAAO;AA6BV;;;;AAEc;AAUd;UAZiB,UAAA;EACf,KAAA;EACA,YAAY;AAAA;AAad;;;;;;;AAAA,KAHY,cAAA,YAA0B,UAAU;;iBAGhC,aAAA,CACd,IAAA,EAAM,cAAA,EACN,KAAA,GAAQ,MAAA,mBACP,MAAA;;cA2BU,MAAA"}

package/dist/{token-CuyjDo6I.mjs → token-DkKC5m23.mjs}

@@ -92,14 +92,27 @@ function googleHeaders(auth, extra) {
 		...extra
 	};
 }
+/** Percent-encode a Search Console `siteUrl` (e.g. `sc-domain:acme.ca`) for a path segment. */
+const encodeSite = (siteUrl) => encodeURIComponent(siteUrl);
+/**
+* Render a failed response's detail: a caller-supplied hint on a specific status
+* (e.g. what a `403` almost always means for this endpoint), or the raw body
+* otherwise. Shared by every REST call here that follows the "PUT and report
+* why" shape — `gsc.ts`'s `submitSitemap`, `onboarding/google.ts`'s `addSite`.
+*/
+async function errorDetail(res, hint) {
+	return hint?.(res.status) ?? `${res.status}: ${await res.text()}`;
+}
 /** Scopes, named once so a caller never spells one out. */
 const SCOPES = {
 	/** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */
 	webmasters: "https://www.googleapis.com/auth/webmasters",
 	/** Site Verification API. */
-	siteVerification: "https://www.googleapis.com/auth/siteverification"
+	siteVerification: "https://www.googleapis.com/auth/siteverification",
+	/** Business Profile (reviews). The GCP project must be allowlisted by Google. */
+	businessProfile: "https://www.googleapis.com/auth/business.manage"
 };
 
 //#endregion
-export { googleAccessToken as n, googleHeaders as r, SCOPES as t };
-//# sourceMappingURL=token-CuyjDo6I.mjs.map
+export { googleHeaders as a, googleAccessToken as i, encodeSite as n, errorDetail as r, SCOPES as t };
+//# sourceMappingURL=token-DkKC5m23.mjs.map

package/dist/{token-CuyjDo6I.mjs.map → token-DkKC5m23.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"token-CuyjDo6I.mjs","names":[],"sources":["../src/google/token.ts"],"sourcesContent":["/**\n * Google OAuth2 token exchange — one request, two grants.\n *\n * Both of this package's Google modules need a bearer token, and both used to\n * mint one themselves. The two copies looked different because the *credentials*\n * differ, but everything after building the form body was identical: same\n * endpoint, same content-type, same \"surface the response body as the error\"\n * rule, same `access_token` extraction. So the seam is precise —\n * **credential → form params differs, params → token does not.**\n *\n * The two grants are kept because they are not accidental duplication; they track\n * how each command is actually run:\n *\n *   - **service account** (RS256 JWT bearer) for `search notify`, which runs on\n *     every deploy in CI. It never expires. A refresh token can be revoked, and\n *     for an OAuth client still in *Testing* publishing status Google expires it\n *     after 7 days — a bad property for a deploy step.\n *   - **user OAuth** (refresh-token grant) for `search setup`, which is a\n *     one-time human operation. Site verification makes the calling identity an\n *     *owner* of the property, and that should be a person, not a project robot.\n *\n * `googleapis` is deliberately not a dependency — this is one REST endpoint in a\n * CLI that installs into every consumer project. See AGENTS.md.\n *\n * Internal: not a published subpath. Both `./indexing` and `./onboarding` import\n * it, so it lands in a shared chunk, which is free for a Node library. (The\n * \"don't create a shared chunk\" rule in AGENTS.md is about browser bundles and\n * the consent gate.)\n */\nimport { createSign } from 'node:crypto';\n\nconst TOKEN_URL = 'https://oauth2.googleapis.com/token';\n\n/** The fields we need from a service-account JSON key. */\nexport interface ServiceAccount {\n  client_email: string;\n  private_key: string;\n}\n\n/** A user OAuth credential (refresh-token flow — never a service account). */\nexport interface GoogleOAuth {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\n/**\n * Which identity to act as.\n *\n * `scope` rides on the service-account variant because that grant carries its\n * scope in the signed assertion. A user OAuth token's scopes are fixed when the\n * refresh token is minted, so there is nothing to pass at exchange time — the\n * asymmetry is the protocol's, not ours.\n */\nexport type GoogleCredential =\n  | { kind: 'service-account'; account: ServiceAccount; scope: string }\n  | { kind: 'oauth'; oauth: GoogleOAuth };\n\nconst b64url = (input: Buffer | string): string =>\n  Buffer.from(input).toString('base64').replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n\n/** Sign the RS256 JWT assertion a service-account grant carries. */\nfunction assertionFor(account: ServiceAccount, scope: string, now: number): string {\n  const iat = Math.floor(now / 1000);\n  const header = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = b64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: TOKEN_URL, iat, exp: iat + 3600 }),\n  );\n  const signer = createSign('RSA-SHA256');\n  signer.update(`${header}.${claims}`);\n  // `\\n` survives most secret stores as a literal; normalise so a pasted key works.\n  const pem = account.private_key.replace(/\\\\n/g, '\\n');\n  return `${header}.${claims}.${b64url(signer.sign(pem))}`;\n}\n\n/** The half that never differs: POST the grant, surface the cause, return the token. */\nasync function requestToken(body: URLSearchParams, fetchImpl: typeof fetch): Promise<string> {\n  const res = await fetchImpl(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n  if (!res.ok) {\n    // The body names the cause — clock skew, wrong audience or a revoked key for a\n    // service account; `invalid_grant` / `invalid_client` for OAuth — and carries\n    // no secret of ours: the assertion travels in the request, not the response.\n    throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);\n  }\n  const { access_token } = (await res.json()) as { access_token?: string };\n  if (!access_token) throw new Error('token exchange returned no access_token');\n  return access_token;\n}\n\n/**\n * Exchange either credential for a short-lived access token.\n *\n * Throws rather than returning a result: nothing downstream can run without a\n * token, so there is no per-item decision for a caller to make. (The API calls\n * themselves do return structured results — those fail per domain.)\n *\n * `now` is a parameter so the assertion is testable without mocking the clock.\n */\nexport function googleAccessToken(\n  credential: GoogleCredential,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  const body =\n    credential.kind === 'oauth'\n      ? new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: credential.oauth.clientId,\n          client_secret: credential.oauth.clientSecret,\n          refresh_token: credential.oauth.refreshToken,\n        })\n      : new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: assertionFor(credential.account, credential.scope, now),\n        });\n  return requestToken(body, fetchImpl);\n}\n\n/**\n * A bearer token, plus the project its usage is attributed to.\n *\n * `quotaProject` becomes the `x-goog-user-project` header, and it is **required**\n * for a user credential — an ADC login or a `VITOPS_GOOGLE_*` refresh token\n * authenticates through a shared OAuth client that carries no project, so Google\n * refuses the call with a 403 naming the missing quota project rather than\n * guessing one. A service account already belongs to a project, so it needs none.\n *\n * It is deliberately per-call rather than baked into the token: one agency\n * identity administers many sites, each with its own project, so the identity is\n * shared and the attribution is not.\n */\nexport interface GoogleAuth {\n  token: string;\n  quotaProject?: string;\n}\n\n/**\n * A bare token still works everywhere an auth does.\n *\n * The token-only form is what every caller passed before per-site projects\n * existed, and a service-account caller never needs more, so widening the\n * parameter beats a breaking signature change across seven exported functions.\n */\nexport type GoogleAuthLike = string | GoogleAuth;\n\n/** Auth headers for a Google REST call, with the quota project when there is one. */\nexport function googleHeaders(\n  auth: GoogleAuthLike,\n  extra?: Record<string, string>,\n): Record<string, string> {\n  const { token, quotaProject } = typeof auth === 'string' ? { token: auth } : auth;\n  return {\n    authorization: `Bearer ${token}`,\n    ...(quotaProject ? { 'x-goog-user-project': quotaProject } : {}),\n    ...extra,\n  };\n}\n\n/** Scopes, named once so a caller never spells one out. */\nexport const SCOPES = {\n  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */\n  webmasters: 'https://www.googleapis.com/auth/webmasters',\n  /** Site Verification API. */\n  siteVerification: 'https://www.googleapis.com/auth/siteverification',\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,YAAY;AA2BlB,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;;AAGjG,SAAS,aAAa,SAAyB,OAAe,KAAqB;CACjF,MAAM,MAAM,KAAK,MAAM,MAAM,GAAI;CACjC,MAAM,SAAS,OAAO,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CAClE,MAAM,SAAS,OACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAW;EAAK,KAAK,MAAM;CAAK,CAAC,CAC3F;CACA,MAAM,SAAS,WAAW,YAAY;CACtC,OAAO,OAAO,GAAG,OAAO,GAAG,QAAQ;CAEnC,MAAM,MAAM,QAAQ,YAAY,QAAQ,QAAQ,IAAI;CACpD,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG,CAAC;AACvD;;AAGA,eAAe,aAAa,MAAuB,WAA0C;CAC3F,MAAM,MAAM,MAAM,UAAU,WAAW;EACrC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,KAAK,SAAS;CACtB,CAAC;CACD,IAAI,CAAC,IAAI,IAIP,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;CAE9E,MAAM,EAAE,iBAAkB,MAAM,IAAI,KAAK;CACzC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;CAC5E,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,kBACd,YACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CAajB,OAAO,aAXL,WAAW,SAAS,UAChB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,WAAW,MAAM;EAC5B,eAAe,WAAW,MAAM;EAChC,eAAe,WAAW,MAAM;CAClC,CAAC,IACD,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,aAAa,WAAW,SAAS,WAAW,OAAO,GAAG;CACnE,CAAC,GACmB,SAAS;AACrC;;AA8BA,SAAgB,cACd,MACA,OACwB;CACxB,MAAM,EAAE,OAAO,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI;CAC7E,OAAO;EACL,eAAe,UAAU;EACzB,GAAI,eAAe,EAAE,uBAAuB,aAAa,IAAI,CAAC;EAC9D,GAAG;CACL;AACF;;AAGA,MAAa,SAAS;;CAEpB,YAAY;;CAEZ,kBAAkB;AACpB"}
+{"version":3,"file":"token-DkKC5m23.mjs","names":[],"sources":["../src/google/token.ts"],"sourcesContent":["/**\n * Google OAuth2 token exchange — one request, two grants.\n *\n * Both of this package's Google modules need a bearer token, and both used to\n * mint one themselves. The two copies looked different because the *credentials*\n * differ, but everything after building the form body was identical: same\n * endpoint, same content-type, same \"surface the response body as the error\"\n * rule, same `access_token` extraction. So the seam is precise —\n * **credential → form params differs, params → token does not.**\n *\n * The two grants are kept because they are not accidental duplication; they track\n * how each command is actually run:\n *\n *   - **service account** (RS256 JWT bearer) for `search notify`, which runs on\n *     every deploy in CI. It never expires. A refresh token can be revoked, and\n *     for an OAuth client still in *Testing* publishing status Google expires it\n *     after 7 days — a bad property for a deploy step.\n *   - **user OAuth** (refresh-token grant) for `search setup`, which is a\n *     one-time human operation. Site verification makes the calling identity an\n *     *owner* of the property, and that should be a person, not a project robot.\n *\n * `googleapis` is deliberately not a dependency — this is one REST endpoint in a\n * CLI that installs into every consumer project. See AGENTS.md.\n *\n * Internal: not a published subpath. Both `./indexing` and `./onboarding` import\n * it, so it lands in a shared chunk, which is free for a Node library. (The\n * \"don't create a shared chunk\" rule in AGENTS.md is about browser bundles and\n * the consent gate.)\n */\nimport { createSign } from 'node:crypto';\n\nconst TOKEN_URL = 'https://oauth2.googleapis.com/token';\n\n/** The fields we need from a service-account JSON key. */\nexport interface ServiceAccount {\n  client_email: string;\n  private_key: string;\n}\n\n/** A user OAuth credential (refresh-token flow — never a service account). */\nexport interface GoogleOAuth {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\n/**\n * Which identity to act as.\n *\n * `scope` rides on the service-account variant because that grant carries its\n * scope in the signed assertion. A user OAuth token's scopes are fixed when the\n * refresh token is minted, so there is nothing to pass at exchange time — the\n * asymmetry is the protocol's, not ours.\n */\nexport type GoogleCredential =\n  | { kind: 'service-account'; account: ServiceAccount; scope: string }\n  | { kind: 'oauth'; oauth: GoogleOAuth };\n\nconst b64url = (input: Buffer | string): string =>\n  Buffer.from(input).toString('base64').replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n\n/** Sign the RS256 JWT assertion a service-account grant carries. */\nfunction assertionFor(account: ServiceAccount, scope: string, now: number): string {\n  const iat = Math.floor(now / 1000);\n  const header = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = b64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: TOKEN_URL, iat, exp: iat + 3600 }),\n  );\n  const signer = createSign('RSA-SHA256');\n  signer.update(`${header}.${claims}`);\n  // `\\n` survives most secret stores as a literal; normalise so a pasted key works.\n  const pem = account.private_key.replace(/\\\\n/g, '\\n');\n  return `${header}.${claims}.${b64url(signer.sign(pem))}`;\n}\n\n/** The half that never differs: POST the grant, surface the cause, return the token. */\nasync function requestToken(body: URLSearchParams, fetchImpl: typeof fetch): Promise<string> {\n  const res = await fetchImpl(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n  if (!res.ok) {\n    // The body names the cause — clock skew, wrong audience or a revoked key for a\n    // service account; `invalid_grant` / `invalid_client` for OAuth — and carries\n    // no secret of ours: the assertion travels in the request, not the response.\n    throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);\n  }\n  const { access_token } = (await res.json()) as { access_token?: string };\n  if (!access_token) throw new Error('token exchange returned no access_token');\n  return access_token;\n}\n\n/**\n * Exchange either credential for a short-lived access token.\n *\n * Throws rather than returning a result: nothing downstream can run without a\n * token, so there is no per-item decision for a caller to make. (The API calls\n * themselves do return structured results — those fail per domain.)\n *\n * `now` is a parameter so the assertion is testable without mocking the clock.\n */\nexport function googleAccessToken(\n  credential: GoogleCredential,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  const body =\n    credential.kind === 'oauth'\n      ? new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: credential.oauth.clientId,\n          client_secret: credential.oauth.clientSecret,\n          refresh_token: credential.oauth.refreshToken,\n        })\n      : new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: assertionFor(credential.account, credential.scope, now),\n        });\n  return requestToken(body, fetchImpl);\n}\n\n/**\n * A bearer token, plus the project its usage is attributed to.\n *\n * `quotaProject` becomes the `x-goog-user-project` header, and it is **required**\n * for a user credential — an ADC login or a `VITOPS_GOOGLE_*` refresh token\n * authenticates through a shared OAuth client that carries no project, so Google\n * refuses the call with a 403 naming the missing quota project rather than\n * guessing one. A service account already belongs to a project, so it needs none.\n *\n * It is deliberately per-call rather than baked into the token: one agency\n * identity administers many sites, each with its own project, so the identity is\n * shared and the attribution is not.\n */\nexport interface GoogleAuth {\n  token: string;\n  quotaProject?: string;\n}\n\n/**\n * A bare token still works everywhere an auth does.\n *\n * The token-only form is what every caller passed before per-site projects\n * existed, and a service-account caller never needs more, so widening the\n * parameter beats a breaking signature change across seven exported functions.\n */\nexport type GoogleAuthLike = string | GoogleAuth;\n\n/** Auth headers for a Google REST call, with the quota project when there is one. */\nexport function googleHeaders(\n  auth: GoogleAuthLike,\n  extra?: Record<string, string>,\n): Record<string, string> {\n  const { token, quotaProject } = typeof auth === 'string' ? { token: auth } : auth;\n  return {\n    authorization: `Bearer ${token}`,\n    ...(quotaProject ? { 'x-goog-user-project': quotaProject } : {}),\n    ...extra,\n  };\n}\n\n/** Percent-encode a Search Console `siteUrl` (e.g. `sc-domain:acme.ca`) for a path segment. */\nexport const encodeSite = (siteUrl: string): string => encodeURIComponent(siteUrl);\n\n/**\n * Render a failed response's detail: a caller-supplied hint on a specific status\n * (e.g. what a `403` almost always means for this endpoint), or the raw body\n * otherwise. Shared by every REST call here that follows the \"PUT and report\n * why\" shape — `gsc.ts`'s `submitSitemap`, `onboarding/google.ts`'s `addSite`.\n */\nexport async function errorDetail(\n  res: Response,\n  hint?: (status: number) => string | undefined,\n): Promise<string> {\n  const named = hint?.(res.status);\n  return named ?? `${res.status}: ${await res.text()}`;\n}\n\n/** Scopes, named once so a caller never spells one out. */\nexport const SCOPES = {\n  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */\n  webmasters: 'https://www.googleapis.com/auth/webmasters',\n  /** Site Verification API. */\n  siteVerification: 'https://www.googleapis.com/auth/siteverification',\n  /** Business Profile (reviews). The GCP project must be allowlisted by Google. */\n  businessProfile: 'https://www.googleapis.com/auth/business.manage',\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,YAAY;AA2BlB,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;;AAGjG,SAAS,aAAa,SAAyB,OAAe,KAAqB;CACjF,MAAM,MAAM,KAAK,MAAM,MAAM,GAAI;CACjC,MAAM,SAAS,OAAO,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CAClE,MAAM,SAAS,OACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAW;EAAK,KAAK,MAAM;CAAK,CAAC,CAC3F;CACA,MAAM,SAAS,WAAW,YAAY;CACtC,OAAO,OAAO,GAAG,OAAO,GAAG,QAAQ;CAEnC,MAAM,MAAM,QAAQ,YAAY,QAAQ,QAAQ,IAAI;CACpD,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG,CAAC;AACvD;;AAGA,eAAe,aAAa,MAAuB,WAA0C;CAC3F,MAAM,MAAM,MAAM,UAAU,WAAW;EACrC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,KAAK,SAAS;CACtB,CAAC;CACD,IAAI,CAAC,IAAI,IAIP,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;CAE9E,MAAM,EAAE,iBAAkB,MAAM,IAAI,KAAK;CACzC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;CAC5E,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,kBACd,YACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CAajB,OAAO,aAXL,WAAW,SAAS,UAChB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,WAAW,MAAM;EAC5B,eAAe,WAAW,MAAM;EAChC,eAAe,WAAW,MAAM;CAClC,CAAC,IACD,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,aAAa,WAAW,SAAS,WAAW,OAAO,GAAG;CACnE,CAAC,GACmB,SAAS;AACrC;;AA8BA,SAAgB,cACd,MACA,OACwB;CACxB,MAAM,EAAE,OAAO,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI;CAC7E,OAAO;EACL,eAAe,UAAU;EACzB,GAAI,eAAe,EAAE,uBAAuB,aAAa,IAAI,CAAC;EAC9D,GAAG;CACL;AACF;;AAGA,MAAa,cAAc,YAA4B,mBAAmB,OAAO;;;;;;;AAQjF,eAAsB,YACpB,KACA,MACiB;CAEjB,OADc,OAAO,IAAI,MAAM,KACf,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;AACnD;;AAGA,MAAa,SAAS;;CAEpB,YAAY;;CAEZ,kBAAkB;;CAElB,iBAAiB;AACnB"}

package/dist/tracking/index.d.mts

@@ -1,4 +1,4 @@
-import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-C3lHaSrU.mjs";
+import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-CHHjzRrv.mjs";
 
 //#region src/tracking/params.d.ts
 /**

package/dist/{types-C3lHaSrU.d.mts → types-CHHjzRrv.d.mts}

@@ -55,7 +55,6 @@ interface ConversionEvent {
   type: 'form' | 'call';
   /** Submitted fields, for `type: 'form'`. Honeypots are stripped before this. */
   formData?: Record<string, string> | undefined;
-  /** The dialled number, for `type: 'call'`. */
   phone?: string | undefined;
   /** Attribution from the `_ac` cookie, or null when the visitor arrived cold. */
   tracking: TrackingData | null;
@@ -66,4 +65,4 @@ interface ConversionEvent {
 }
 //#endregion
 export { TrackingData as i, TrackingCategory as n, TrackingConfig as r, ConversionEvent as t };
-//# sourceMappingURL=types-C3lHaSrU.d.mts.map
+//# sourceMappingURL=types-CHHjzRrv.d.mts.map

package/dist/types-CHHjzRrv.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-CHHjzRrv.d.mts","names":[],"sources":["../src/tracking/types.ts"],"mappings":";;AAiBA;;;;AAA4B;AAE5B;;;KAFY,gBAAA;AAAA,UAEK,cAAA;EACf,OAAA;EAOW;;;AACF;AAWX;;EAZE,QAAA,GAAW,gBAAgB;EAC3B,SAAA;AAAA;;;;;;AAoBU;AAeZ;;UAxBiB,YAAA;EAAA,CACd,KAAA;EAwBD;EAtBA,WAAA;EAwBW;EAtBX,QAAA;EAyBA;EAvBA,EAAA;EAwBA;EAtBA,UAAA;AAAA;;AAyBE;;;;;;;;;;;UAVa,eAAA;EACf,IAAA;;EAEA,QAAA,GAAW,MAAA;EACX,KAAA;;EAEA,QAAA,EAAU,YAAY;EACtB,SAAA;EACA,EAAA;;EAEA,EAAA;AAAA"}

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "@getvitops/utils",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "Shared build-time utilities for the Vitops toolchain — favicon generation and friends.",
+  "homepage": "https://docs.vitops.ca",
+  "bugs": "https://github.com/getvitops/design-system/issues",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvitops/design-system.git",
+    "directory": "packages/utils"
+  },
   "files": [
     "dist",
     "CHANGELOG.md"
   ],
   "type": "module",
+  "sideEffects": false,
   "types": "./dist/index.d.mts",
   "exports": {
     ".": {
@@ -30,6 +38,10 @@
       "types": "./dist/onboarding/index.d.mts",
       "import": "./dist/onboarding/index.mjs"
     },
+    "./reviews": {
+      "types": "./dist/reviews/index.d.mts",
+      "import": "./dist/reviews/index.mjs"
+    },
     "./ads": {
       "types": "./dist/ads/index.d.mts",
       "import": "./dist/ads/index.mjs"
@@ -45,6 +57,14 @@
     "./tracking": {
       "types": "./dist/tracking/index.d.mts",
       "import": "./dist/tracking/index.mjs"
+    },
+    "./security": {
+      "types": "./dist/security/index.d.mts",
+      "import": "./dist/security/index.mjs"
+    },
+    "./schema": {
+      "types": "./dist/schema/index.d.mts",
+      "import": "./dist/schema/index.mjs"
     }
   },
   "publishConfig": {
@@ -57,6 +77,9 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "vitest": "^4.1.9"
+    "vitest": "4.1.9"
+  },
+  "engines": {
+    "node": ">=24"
   }
 }

package/dist/cloudflare-CD8vwrgj.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-CD8vwrgj.mjs","names":[],"sources":["../src/onboarding/cloudflare.ts"],"sourcesContent":["/**\n * Cloudflare DNS — the one thing this command writes.\n *\n * Scoped to exactly what onboarding needs and nothing more: find a zone by name,\n * read the apex TXT records, and *create* the verification TXT when it is missing.\n * There is deliberately no update and no delete — the command's contract is that it\n * never removes a DNS record, so the destructive verbs are simply absent rather\n * than guarded.\n *\n * The token is a `Zone:DNS:Edit` credential from the environment\n * (`CLOUDFLARE_API_TOKEN`); listing a zone by name also needs `Zone:Read`, which\n * Cloudflare's standard \"Edit zone DNS\" token template already bundles. As with the\n * indexing executors, `fetchImpl` is injected so the request shape is testable\n * without the network, and every call returns a structured result rather than\n * throwing — the caller decides what a failure means per domain.\n */\nconst API = 'https://api.cloudflare.com/client/v4';\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  errors?: { code: number; message: string }[];\n  result?: T;\n}\n\nconst cfError = (status: number, body: CfEnvelope<unknown>): string => {\n  const first = body.errors?.[0];\n  return first ? `${first.code} ${first.message}` : `HTTP ${status}`;\n};\n\n/** Find the zone id for a domain (`GET /zones?name=`). */\nexport async function findZoneId(\n  token: string,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; zoneId?: string; message?: string }> {\n  const res = await fetchImpl(`${API}/zones?name=${encodeURIComponent(domain)}`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  const body = (await res.json()) as CfEnvelope<{ id: string; name: string }[]>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, message: cfError(res.status, body) };\n  const zone = body.result?.[0];\n  if (!zone)\n    return {\n      ok: false,\n      status: res.status,\n      // Name the scope: this lookup is a GET /zones?name=, which needs\n      // `Zone:Read` — a token carrying only `Zone:DNS:Edit` reaches here and\n      // reads as \"the zone isn't in this account\", which sends you to the\n      // wrong dashboard.\n      message: `no Cloudflare zone named \"${domain}\" (is it in this account, and does the token carry Zone:Read as well as Zone:DNS:Edit? The \"Edit zone DNS\" template covers both.)`,\n    };\n  return { ok: true, status: res.status, zoneId: zone.id };\n}\n\n/** List the apex TXT record contents for a zone. */\nexport async function listApexTxt(\n  token: string,\n  zoneId: string,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; contents: string[]; message?: string }> {\n  const res = await fetchImpl(\n    `${API}/zones/${zoneId}/dns_records?type=TXT&name=${encodeURIComponent(domain)}`,\n    { headers: { authorization: `Bearer ${token}` } },\n  );\n  const body = (await res.json()) as CfEnvelope<{ content: string }[]>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, contents: [], message: cfError(res.status, body) };\n  // Cloudflare returns TXT content quoted; normalise so an exact compare works.\n  const contents = (body.result ?? []).map((r) => r.content.replace(/^\"|\"$/g, ''));\n  return { ok: true, status: res.status, contents };\n}\n\n/**\n * Create an apex TXT record. **Create only** — never called when one already\n * exists (the planner decides that), and there is no sibling that edits or removes.\n */\nexport async function createApexTxt(\n  token: string,\n  zoneId: string,\n  domain: string,\n  content: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${API}/zones/${zoneId}/dns_records`, {\n    method: 'POST',\n    headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },\n    body: JSON.stringify({ type: 'TXT', name: domain, content }),\n  });\n  const body = (await res.json()) as CfEnvelope<{ id: string }>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, message: cfError(res.status, body) };\n  return { ok: true, status: res.status };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgBA,MAAM,MAAM;AAQZ,MAAM,WAAW,QAAgB,SAAsC;CACrE,MAAM,QAAQ,KAAK,SAAS;CAC5B,OAAO,QAAQ,GAAG,MAAM,KAAK,GAAG,MAAM,YAAY,QAAQ;AAC5D;;AAGA,eAAsB,WACpB,OACA,QACA,YAA0B,OACmD;CAC7E,MAAM,MAAM,MAAM,UAAU,GAAG,IAAI,cAAc,mBAAmB,MAAM,KAAK,EAC7E,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAC7E,MAAM,OAAO,KAAK,SAAS;CAC3B,IAAI,CAAC,MACH,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EAKZ,SAAS,6BAA6B,OAAO;CAC/C;CACF,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ,KAAK;CAAG;AACzD;;AAGA,eAAsB,YACpB,OACA,QACA,QACA,YAA0B,OACsD;CAChF,MAAM,MAAM,MAAM,UAChB,GAAG,IAAI,SAAS,OAAO,6BAA6B,mBAAmB,MAAM,KAC7E,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CAClD;CACA,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,UAAU,CAAC;EAAG,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAE3F,MAAM,YAAY,KAAK,UAAU,CAAC,EAAC,CAAE,KAAK,MAAM,EAAE,QAAQ,QAAQ,UAAU,EAAE,CAAC;CAC/E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ;CAAS;AAClD;;;;;AAMA,eAAsB,cACpB,OACA,QACA,QACA,SACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,IAAI,SAAS,OAAO,eAAe;EAChE,QAAQ;EACR,SAAS;GAAE,eAAe,UAAU;GAAS,gBAAgB;EAAmB;EAChF,MAAM,KAAK,UAAU;GAAE,MAAM;GAAO,MAAM;GAAQ;EAAQ,CAAC;CAC7D,CAAC;CACD,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAC7E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;AACxC"}

package/dist/types-C3lHaSrU.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-C3lHaSrU.d.mts","names":[],"sources":["../src/tracking/types.ts"],"mappings":";;AAiBA;;;;AAA4B;AAE5B;;;KAFY,gBAAA;AAAA,UAEK,cAAA;EACf,OAAA;EAOW;;;AACF;AAWX;;EAZE,QAAA,GAAW,gBAAgB;EAC3B,SAAA;AAAA;;;;;;AAoBU;AAeZ;;UAxBiB,YAAA;EAAA,CACd,KAAA;EAwBD;EAtBA,WAAA;EAwBW;EAtBX,QAAA;EA0BA;EAxBA,EAAA;EAyBA;EAvBA,UAAA;AAAA;;AA0BE;;;;;;;;;;;UAXa,eAAA;EACf,IAAA;;EAEA,QAAA,GAAW,MAAA;;EAEX,KAAA;;EAEA,QAAA,EAAU,YAAY;EACtB,SAAA;EACA,EAAA;;EAEA,EAAA;AAAA"}