@getvitops/utils 8.0.1 → 8.2.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,281 @@
 # @getvitops/utils
 
+## 8.2.0-alpha.0
+
+### Minor Changes
+
+- 0574388: Add `site.crm` — push form submissions into HubSpot, Zoho Bigin, or Jobber.
+
+  Client sites need form submissions to land in the client's CRM. The options available before this
+  — a HubSpot/Bigin/Jobber iframe or JS embed — fail on three counts: the markup can't be
+  white-labelled against this design system, nothing can operate on the submission before it leaves
+  the page, and the submission never touched `createConversionRoute()`, so `_ac` ad-click attribution
+  was lost and no conversion notification was planned.
+
+  This adds one server-side path for all three CRMs, hung off the conversion route that already
+  exists. `createConversionRoute()` gets a new `crm` option (`{ config, credentials, fetch?,
+timeoutMs? }`); credentials arrive as a function of `locals`, exactly like the existing `binding`
+  option, and are never config. A failed CRM write never fails the request and is folded into the
+  notification email's new "Delivery" section, so a broken CRM token is never silent.
+
+  New `@getvitops/utils/crm` subpath: `deliverToCrm()`, `mapSubmission()`, `deriveLastName()` (Bigin
+  requires a last name; this derives one from an explicit field, a full name, or an email address,
+  refusing rather than fabricating one), `submitToHubSpot()`, `submitToBigin()`, `submitToJobber()`.
+  `identifySubmitter()` was promoted out of `notify`'s private name-guessing cascade into
+  `@getvitops/utils/tracking`, since the CRM mapper needed the whole identity (first/last name,
+  email, phone, company), not just a display name.
+
+  Jobber is GraphQL, not REST, and answers `200 OK` for failures — a rejected `clientCreate` returns
+  `userErrors[]`, a malformed request returns top-level `errors[]`. `submitToJobber()` classifies on
+  the response body, not just the status. Its refresh tokens also rotate by default: **Refresh Token
+  Rotation must be turned off** in the app's Developer Center settings, since a Worker reading a
+  static `VITOPS_JOBBER_REFRESH_TOKEN` cannot persist a rotated one — a rotated token is detected at
+  exchange time and reported with the fix, rather than surfacing an hour later as an opaque 401.
+  Attribution and unmapped extra fields render into a best-effort note by default (works on every
+  Jobber plan); a resubmitting visitor creates a second Jobber client unless `crm.jobber.dedupe: true`
+  is set once its lookup query has been verified against a live account (defaults `false` pending
+  that verification — see `jobber.ts`'s docblock).
+
+  New `site.crm` config block (`provider`, `hubspot`/`bigin`/`jobber`, `fieldMap`, `trackingFields`)
+  and two CLI commands: `vitops crm check` (fetches the live HubSpot property list or Bigin field
+  list and reports every mapped name that doesn't exist there — HubSpot rejects an unknown field
+  outright, Bigin silently drops it; Jobber has nothing live to check yet, since its mapped values
+  currently render as note text) and `vitops crm setup` (creates missing HubSpot properties; Bigin
+  and Jobber have no such API, so both always print a manual reminder).
+
+  The generated privacy policy now names HubSpot, Zoho Bigin, or Jobber when `site.crm` configures
+  one. Bigin gets the same cross-border-transfer derivation Matomo Cloud already gets: a
+  `dataCenter: 'ca'` asserts no transfer outside Canada, any other data centre does. Jobber's
+  operator (Octopusapp Inc. d/b/a Jobber) is Canadian, but its own privacy policy names the United
+  States as a processing location too, so the policy always asserts a cross-border transfer for
+  Jobber regardless of config — a Canadian operator is not read as Canadian-only storage.
+
+  Credentials: `VITOPS_HUBSPOT_ACCESS_TOKEN` for HubSpot; `VITOPS_ZOHO_CLIENT_ID` /
+  `VITOPS_ZOHO_CLIENT_SECRET` / `VITOPS_ZOHO_REFRESH_TOKEN` for Bigin; `VITOPS_JOBBER_CLIENT_ID` /
+  `VITOPS_JOBBER_CLIENT_SECRET` / `VITOPS_JOBBER_REFRESH_TOKEN` for Jobber. Never config.
+
+  No consumer-facing change in `@getvitops/astro` beyond the new `crm` route option and a build
+  warning when `site.crm` is configured with no route answering `TRACKING_ENDPOINT` — CSS/Bricks/
+  tailwind outputs are unaffected.
+
+- c3c1bcb: **New: the design-system editor, mounted inside the EmDash admin.** `vitopsEmdash({
+designSystemEditor: { config } })` (`config` is your `site.json`, e.g. `import config from
+'./site.json' with { type: 'json' }`) adds a `/design-system` admin page mounting
+  `<wc-theme-editor>` — the same live token editor `@getvitops/vite`'s dev server has always
+  offered, now usable by the client directly, no dev server required. An edit is visible
+  site-wide immediately (a runtime `:root` override, served via a new plugin API route and
+  `page:fragments`) and — once `site.deployment.repo`/`branch` and a `VITOPS_GITHUB_TOKEN`
+  secret are set (see the scaffold's `SETUP.html`) — auto-commits to your `dev` branch, so it
+  reaches the git-tracked `site.json` through your repo's normal review path rather than
+  becoming a second, unreviewed source of truth. Until that's configured, the live half still
+  works; only the auto-commit half is skipped (and says so in the admin page). The save route
+  runs the exact same accessibility (APCA contrast) gate `generate()` enforces at build time,
+  synchronously, before persisting — nothing non-compliant ever goes live even momentarily.
+
+  Requires `@astrojs/react` + `react` + `react-dom` (already scaffold dependencies, for
+  EmDash's own admin) and `@getvitops/core` (added as a new scaffold dependency this release).
+  Declares two new plugin capabilities when enabled: `network:request` (for the GitHub
+  auto-commit) and `hooks.page-fragments:register` (for the live override) — reviewed once at
+  plugin-install time.
+
+  **Breaking for `@getvitops/emdash`**: `vitopsEmdash()`'s `hooks.page-fragments:register`
+  capability is now also granted whenever `designSystemEditor` is set, independent of the
+  existing `scripts: 'fragments'` option (which governs something unrelated — web-component
+  script delivery). No change if you don't use `designSystemEditor`.
+
+  Also new, supporting the above:
+  - `@getvitops/generator`: `validateColorContract()` and `buildReverseIndex()` (both
+    `/tokens` subpath, Worker-safe) — the monotonicity/contrast gate and the
+    `design-manifest.json` reverse-index, each extracted from `generate()`'s `build()` into
+    standalone, non-throwing functions. `patchToOverrideCss()` turns a design-system patch
+    into the `:root` override `<style>` block. `designSystemPath`/`getAt`/`setAt`/
+    `mergePatch`/`formatConfig` moved from `@getvitops/vite` into `@getvitops/generator/config`
+    (re-exported from `@getvitops/vite` unchanged) — one "patch a config file's design-system
+    subtree" implementation shared by the dev endpoint and the new plugin route. New
+    `site.deployment.repo`/`branch` config fields.
+  - `@getvitops/utils`: new `/git` subpath — `commitFile()`, a Worker-safe (fetch-only)
+    wrapper over GitHub's Contents API.
+  - `@getvitops/core`: `<wc-theme-editor>` gains a `save-endpoint` attribute (default
+    unchanged — `/__vitops/design-system`) so the same element can target the new plugin
+    route instead of the dev-only Vite endpoint.
+
+- 0574388: Add `vitops email setup|check` — connect `site.notifications.email.from` to whether its domain is
+  actually onboarded onto an outbound email provider.
+
+  Before this, nothing checked that. `EMAIL.send()` throws `E_SENDER_NOT_VERIFIED` at runtime with no
+  build or deploy-time warning — the failure mode is silent and production-only.
+
+  `vitops email setup [domain]` onboards a sending domain (currently Cloudflare Email Sending only)
+  and polls DNS until its SPF/DKIM/DMARC records resolve or a timeout is reached; `vitops email
+check` is the non-blocking deploy guard both `@getvitops/create` templates' `deploy`/`deploy:dev`
+  scripts now run first (`--strict` makes it a real gate; opt out per-site with
+  `site.notifications.email.verifySender: false`, or globally with `--skip` /
+  `VITOPS_SKIP_EMAIL_CHECK`).
+
+  Two things worth knowing before running it:
+  - **The onboarded entity is an exact name, and it is usually a subdomain**
+    (`send.yourdomain.com`), never the apex your `from` address names. When the exact domain isn't
+    onboarded but a sibling in the same zone already is, the command reports that as the fix — send
+    from the onboarded subdomain — rather than silently trying to onboard the apex, which rewrites
+    `_dmarc.<domain>` and can tighten DMARC policy on every other mail your domain sends.
+  - Candidates come from `site.notifications.email.from` (or its derived `noreply@<domains
+.canonical>` default) first; a best-effort scan of `--src` only supplements it, and never guesses
+    at a computed `from` value.
+
+  New `@getvitops/utils/email` subpath and `site.notifications.email.verifySender` config field.
+  Needs `CLOUDFLARE_API_TOKEN` with an Email Sending scope in addition to the `Zone:Read` other
+  commands already use.
+
+- 0574388: Fire a Google Ads conversion on a tel:/mailto: click, and fix a rate-limit bug on the conversion
+  route that could silently drop one of the two.
+
+  `site.ads.google.conversionLabel` used to be accepted by the config schema and typed all the way
+  through to the rendered tag, but nothing actually read it — no `gtag('event', 'conversion', …)`
+  was ever emitted. When set, the click tracker `<Tracking />` inlines now fires the conversion at
+  the moment a visitor taps a `tel:` or `mailto:` link, using the `AW-…/label` target Google Ads
+  expects. A `conversionLabel` that can't safely land inside the inline bootstrap script (the same
+  check `pixelId`/`accountId` already get) is dropped with a warning rather than firing something
+  malformed — the ad tag itself still loads.
+
+  Also: `createConversionRoute()`'s rate limiter previously keyed on IP address alone, so a call
+  beacon and an email-click beacon from the same visitor, seconds apart, competed for one window —
+  the second could 429 and vanish with no error anywhere. It's now keyed on IP _and_ event type, so
+  distinct conversion types never starve each other; repeats of the same type are still throttled
+  exactly as before.
+
+  No config changes — a site with `site.ads.google.conversionLabel` already set picks this up
+  automatically on the next build.
+
+- 0574388: Track `mailto:` link clicks as conversions, alongside the existing `tel:` link tracking.
+
+  Before this, the capture script only beaconed `tel:` clicks; a `mailto:` link on the same page was
+  invisible to attribution — a visitor who emailed the business instead of calling generated no
+  conversion event at all. `<Tracking />`'s inlined script now listens for both, sending `{ event:
+'email', email }` via `navigator.sendBeacon` the same way it already sends `{ event: 'call', phone
+}`.
+
+  `ConversionEvent['type']` gains an `'email'` member alongside `'form'`/`'call'`, with a new
+  `email` field. `createConversionRoute()` handles it exactly like a call: no honeypot, Turnstile or
+  CRM checks (there are no form fields to validate or map), a 204 response, and a notification email
+  subject reading `[Email Click] Visitor emailing ...`.
+
+  No config changes and no new options — a site with `<Tracking />` already mounted picks this up
+  automatically the next time it rebuilds.
+
+- dde3df3: **`site.ads.google.conversionLabel` now accepts a per-action map** —
+  `{ call?, email?, form? }` — instead of one bare string shared by every
+  interaction. A bare string still works (back-compat, treated as `call`), but a
+  call and an email click used to report as the **same** Google Ads conversion
+  action, indistinguishable in the account; each action now gets its own
+  `send_to` target.
+
+  **New: `vitopsFormConversion(formEl)`**, exposed as `window.vitopsFormConversion`
+  by `<Tracking />`'s capture script — call it from your own fetch-based form
+  submit handler once the POST to `createConversionRoute()` succeeds, to fire the
+  `form` Google Ads conversion action client-side (mirroring the existing
+  tel:/mailto: click handler, which now fires `call`/`email` instead of sharing
+  one label). Idempotent per form element. There's deliberately no server-side
+  equivalent for a no-JS `<form method="post">` submission — that's a full-page
+  redirect with no script to fire from, and a real server-side Google Ads
+  conversion needs the Ads API's click-conversion upload (developer token + MCC
+  access), tracked separately in the vNext backlog.
+
+  **Fixed: the conversion route's rate limiter no longer trusts the client's
+  raw `event` field.** It used to key on whatever string a client sent
+  (`` `${ip}:${body.event}` ``), so varying that value on every request let a
+  form submission dodge the per-IP rate limit entirely — only `'call'`/`'email'`
+  were ever recognized, and anything else got its own fresh bucket. The key now
+  uses the server's own classification (`call` | `email` | `form`), closing that
+  bypass without changing the existing call-vs-email-don't-compete behavior.
+
+  **New: `site.notifications.actionUrl`** — an optional action-link template
+  added to the conversion-notification email as an "Actions" section.
+  `{clickId}` is replaced with the ad click ID captured on `_ac` (gclid, fbclid,
+  etc.); the section is omitted when the event has no click ID to interpolate,
+  rather than emailing a broken link.
+
+### Patch Changes
+
+- 0574388: Bump `emdash`/`@emdash-cms/cloudflare` peers to `>=1.0.0 <2` and `vite-plus` to `^1.0.0`, following
+  both projects' GA releases.
+
+  **Breaking for `@getvitops/emdash` consumers on EmDash 0.x**: the peer range no longer admits
+  `emdash@0.31.x`/`@emdash-cms/cloudflare@0.31.x`. Upgrade `emdash` and `@emdash-cms/cloudflare` to
+  `^1.0.1` first — nothing in `@getvitops/emdash`'s own plugin surface (`admin.portableTextBlocks`,
+  the `hooks.page-fragments:register` capability, `definePlugin()`) changed against EmDash 1.0, so no
+  code here needed to change, only the declared range.
+
+  The `emdash` scaffold template (`vp create @getvitops:emdash`) picks up several fixes alongside
+  the version bump:
+  - `tailwindcss`/`@tailwindcss/vite` are now real dependencies — the template selected
+    `css.format: 'tailwind'` without installing either, which threw on build.
+  - `site.json` now sets `site.icons.sprite: true` plus the full `semantic` list the
+    `vitops.actionLink` block's icon picker offers — previously its sprite icons pointed at a file
+    the build never generated.
+  - `astro.config.mjs` sets `migrations: { runtime: 'check', dev: 'auto' }`, and
+    `site-deploy-emdash.yml` runs EmDash 1.0's documented `build → status → apply → deploy → check`
+    migration sequence explicitly, rather than relying solely on first-request auto-migration. This
+    needs a new GitHub Environment variable, `EMDASH_TARGET_FINGERPRINT` (one per environment),
+    which only a human can set — run `emdash migrate --status` against the real deployed database,
+    review the printed identity, then `gh variable set EMDASH_TARGET_FINGERPRINT --env <env> --body
+<value>`. Deploys fail clearly on the migration-apply step until it's set.
+  - `lint.options.typeAware`/`typeCheck` in the template's own `vite.config.ts` are commented out,
+    not deleted: vite-plus 1.0 only honours that option in a project's actual root config, and hard
+    errors on it in a nested one (which this file is, sitting inside the `design-system` monorepo).
+    Uncomment it once scaffolded into its own repo.
+
+  No config schema changes. `@getvitops/generator` also switches from the `zod/mini` subpath import
+  to the standalone `@zod/mini` package (zod 4.5+; same API) and fixes `validateConfig()` silently
+  losing the offending key name on an `unrecognized_keys` error (e.g. a typo'd `site.ads` platform
+  now names the bad key instead of reporting a bare "Invalid input").
+
+  Also fixed: `vp check`'s `tsconfig-error` for `packages/create/templates/emdash/tsconfig.json`
+  (`extends: "astro/tsconfigs/strict"`, unresolvable from inside this monorepo since the template
+  has no `node_modules` of its own — a pre-existing, structural gap, newly surfaced as a hard error
+  by oxlint 1.85's deeper config discovery, and blocking on every commit since this repo's pre-commit
+  hook runs `vp check --fix`). Fixed with a new `scripts/link-template-deps.mjs`, wired as the root
+  `postinstall` script: symlinks `astro`/`emdash`/`@emdash-cms/cloudflare` into the template's own
+  `node_modules/` (resolved fresh from sibling packages that already depend on them for real, not a
+  hardcoded `.pnpm` hash) and writes a minimal `astro:content` ambient shim at `.astro/types.d.ts`
+  (the same path `astro sync` would generate for real). Both are gitignored and only ever exist
+  inside this monorepo's copy of the template — a real scaffold installs its own real copies instead.
+  Considered and rejected first: inlining astro's strict preset (drift risk against astro's own
+  evolving default) and making the template a real pnpm workspace member (would change how its
+  `@getvitops/*: "latest"` deps resolve locally, which `templates.test.ts` exists to protect).
+
+  **Known gap, not fixed here**: `packages/astro/src/components/container.test.ts` (the
+  `AstroContainer`-based render tests) fails to even load under vite-plus 1.0's Vite 8 — direct
+  `.astro` imports in a Vitest file need the Astro Vite plugin registered, which nothing in this
+  repo's test config actually does (Astro's own docs call for `getViteConfig()`, which doesn't
+  compose with vite-plus's own `defineConfig`). A type-level shim
+  (`packages/astro/src/components/astro-modules.d.ts`) fixes `vp check`'s type-aware pass, but the
+  runtime `vp test` failure for this one file is still open.
+
+## 8.1.0
+
+### Minor Changes
+
+- **Added — `vitops init --site` and `vitops setup`, the scripted client-onboarding path.**
+
+  `vitops init --site [--name] [--url]` scaffolds a starter `site.json` (the umbrella `Config`,
+  embedding a starter design system at `designSystem.themes.default`) instead of a bare
+  `design-system.json` — exported as `defaultSiteConfig()` from `@getvitops/generator`, alongside a
+  new `CONFIG_SCHEMA_LOCAL_PATH` and an optional `$schema` field on `ConfigSchema` so a scaffolded
+  config gets editor autocomplete the same way `design-system.json` already does.
+
+  `vitops setup <repo|hosting|domain|search|ads|all>` (new `@getvitops/utils/hosting` subpath: a
+  pure planner + `wrangler`/`gh`-shelling executors, following the same idempotent
+  plan/observe/apply split as `onboarding`/`ads`) automates GitHub repo + branch policy and
+  Cloudflare dev D1/R2 + repo secrets, and plans/checks the workers.dev-vs-custom-domain
+  consistency without ever applying the cutover itself — see AGENTS.md's new "Client onboarding"
+  section for the full design rationale. `search`/`ads` forward to the existing `search setup`/
+  `ads setup` subcommands rather than reimplementing them.
+
+  No consumer-facing change in `@getvitops/vite` or `@getvitops/astro` in this release — bumped
+  only because they are in the `fixed` release group with `generator`/`utils`/`cli`.
+  `@getvitops/core` does have a real fix in this release; see the separate `banner-hidden-fix`
+  changeset.
+
 ## 8.0.1
 
 ## 8.0.0
@@ -11,7 +287,6 @@
 
   **Breaking (`css`/`bricks` and `tailwind` formats — `.lightbox-dialog`'s markup
   contract changed):**
-
   - `<Gallery />` now emits ONE `<dialog class="lightbox-dialog">` per gallery,
     wrapping a `<Carousel />`, instead of one dialog per image. A `.gallery__trigger`
     is now a plain `<a href="#slide-id">`, not a `command="show-modal"` button.
@@ -73,7 +348,6 @@
 ### Minor Changes
 
 - Add Google Business Profile reviews: fetch, cache, render.
-
   - **`vitops reviews`** (new CLI command) fetches a client's GBP reviews (legacy v4 API — the only
     one that has them) and writes them to `.vitops/reviews.json`, meant to be committed so a build
     never needs a live Google credential. `--dry` prints the plan; `--check` diffs against the cache
@@ -108,7 +382,6 @@
   `--site` for now.)
 
   **Fixed:**
-
   - `@getvitops/core`'s 12 runtime deps (`lit`, both `@oddbird` polyfills, both
     `@webcomponents` packages, `colorjs.io`, etc.) were listed as `dependencies` despite
     being bundled into `dist/elements.js`/`dist/polyfills.js`/`dist/deferred.js` — a
@@ -521,20 +794,28 @@ here changed, and no code that imports `@getvitops/utils` needs editing.
   {
     "designSystem": {
       "themes": {
-        "default": {/* … */},
+        "default": {
+          /* … */
+        },
       },
     },
     "organization": {
       "name": "Acme",
       "contact": "hq",
       "locations": {
-        "hq": {/* … */},
+        "hq": {
+          /* … */
+        },
       },
     },
     "site": {
       "defaultLocale": "en",
-      "domains": {/* … */},
-      "analytics": {/* … */},
+      "domains": {
+        /* … */
+      },
+      "analytics": {
+        /* … */
+      },
     },
   }
   ```
@@ -603,7 +884,7 @@ here changed, and no code that imports `@getvitops/utils` needs editing.
   Also new, and worth wiring at the same time — **`gitLastmod()` for real sitemap dates**:
 
   ```js
-  import vitops, { gitLastmod } from "@getvitops/astro";
+  import vitops, { gitLastmod } from '@getvitops/astro';
   vitops({ sitemap: { serialize: await gitLastmod() } });
   ```
 

package/dist/{adc-BFrzpMHq.d.mts → adc-BoEoogyo.d.mts}

@@ -1,5 +1,4 @@
-import { i as GoogleOAuth } from "./token-Bz_-igw-.mjs";
-
+import { i as GoogleOAuth } from "./token-DmmoQ7um.mjs";
 //#region src/google/adc.d.ts
 /** A parsed ADC user credential, or `undefined` if `raw` is not one. */
 declare function parseAdcUser(raw: string): GoogleOAuth | undefined;
@@ -22,4 +21,4 @@ declare function adcCredentialsPath(opts: {
 }): string | undefined;
 //#endregion
 export { adcQuotaProject as n, parseAdcUser as r, adcCredentialsPath as t };
-//# sourceMappingURL=adc-BFrzpMHq.d.mts.map
+//# sourceMappingURL=adc-BoEoogyo.d.mts.map

package/dist/adc-BoEoogyo.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adc-BoEoogyo.d.mts","names":[],"sources":["../src/google/adc.ts"],"mappings":";;;iBAkBgB,aAAa,cAAc;;iBAwB3B,gBAAgB;;;;;;;;;;iBAiBhB,mBAAmB;EACjC,KAAK;EACL;EACA;EACA,UAAU"}

package/dist/ads/index.d.mts

@@ -1,5 +1,4 @@
 import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-BiK61Oq4.mjs";
-
 //#region src/ads/types.d.ts
 /**
  * The ads module's own option surface.
@@ -25,6 +24,34 @@ import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudf
 type AdProvider = 'google' | 'meta' | 'linkedin' | 'reddit' | 'tiktok' | 'microsoft' | 'pinterest' | 'snapchat';
 /** Which consent category gates a provider's tag. */
 type AdConsentCategory = 'marketing' | 'analytics';
+/**
+ * The three interactions Google Ads can report a distinct conversion action
+ * for. `form` is fired client-side via `vitopsFormConversion()`
+ * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:
+ * click handler.
+ */
+type ConversionAction = 'call' | 'email' | 'form';
+/**
+ * One label per action this site wants Google Ads to tell apart.
+ *
+ * Written out field by field, `?: string | undefined` — not
+ * `Partial<Record<ConversionAction, string>>` — matching this file's own
+ * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`
+ * (present-or-absent) and `{ email?: string | undefined }` (present,
+ * absent, or explicitly `undefined`) as different types, and a parsed JSON
+ * config's optional field is the latter. `Partial<Record<...>>` produces the
+ * former, which rejected the zod-inferred shape config.ts actually produces.
+ */
+interface ConversionLabelMap {
+  call?: string | undefined;
+  email?: string | undefined;
+  form?: string | undefined;
+}
+/**
+ * A bare string is back-compat shorthand for `{ call: label }` — the only
+ * action that existed before this was a map. Absent input normalises to `{}`.
+ */
+export declare function normalizeConversionLabels(label: string | ConversionLabelMap | undefined): ConversionLabelMap;
 /** One ad property to link, as the config declares it. */
 interface AdPropertySetup {
   provider: AdProvider;
@@ -35,8 +62,14 @@ interface AdPropertySetup {
   accountId?: string | undefined;
   /** The tag/pixel id, when the platform issues one distinct from the account. */
   pixelId?: string | undefined;
-  /** Google Ads only: the conversion label paired with the conversion id. */
-  conversionLabel?: string | undefined;
+  /**
+   * Google Ads only: the conversion label(s) paired with the conversion id —
+   * either one bare label (back-compat, treated as the `call` action) or a map
+   * of action → label, so a call, an email click and a form submission each
+   * fire their own Google Ads conversion action instead of sharing one. See
+   * `gtagBootstrap`/`normalizeConversionLabels` below.
+   */
+  conversionLabel?: string | ConversionLabelMap | undefined;
   /** The host to verify, bare (`acme.ca`). The CLI defaults it from the canonical domain. */
   domain?: string | undefined;
   /**
@@ -113,18 +146,18 @@ interface AdsPlan {
  * since this command never edits or deletes DNS), or no token is configured yet
  * (blocked, naming the field).
  */
-declare function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan;
+export declare function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan;
 /** Plan every configured property. */
-declare function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan;
+export declare function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan;
 /** Any step that isn't a skip — i.e. the live state or the config has drifted. */
-declare function hasDrift(p: AdsPlan): boolean;
+export declare function hasDrift(p: AdsPlan): boolean;
 /** Every field a run still needs, per provider — what the CLI asks for. */
-declare function missingFields(p: AdsPlan): {
+export declare function missingFields(p: AdsPlan): {
   provider: string;
   needs: MissingField;
 }[];
 /** Render a plan as the block `--dry` and `--check` print. */
-declare function formatPlan(p: AdsPlan): string;
+export declare function formatPlan(p: AdsPlan): string;
 /** The outcome of one property's run, for the summary table. */
 interface AdPropertyResult {
   provider: string;
@@ -134,7 +167,7 @@ interface AdPropertyResult {
   reminders: string[];
 }
 /** Render the end-of-run summary: one row per property, plus any reminders. */
-declare function formatSummary(results: AdPropertyResult[]): string;
+export declare function formatSummary(results: AdPropertyResult[]): string;
 //#endregion
 //#region src/ads/providers.d.ts
 /** How a platform proves you own the domain. */
@@ -191,11 +224,11 @@ interface AdPlatform {
   /** Follow-ups no API covers, given this entry. */
   manualSteps: (entry: AdPropertySetup) => string[];
 }
-declare const AD_PLATFORMS: Record<AdProvider, AdPlatform>;
+export declare const AD_PLATFORMS: Record<AdProvider, AdPlatform>;
 /** Every provider, in table order — the one place iteration order is decided. */
-declare const AD_PROVIDER_KEYS: AdProvider[];
+export declare const AD_PROVIDER_KEYS: AdProvider[];
 /** Whether a string names a known provider (for CLI arg validation). */
-declare const isAdProvider: (value: string) => value is AdProvider;
+export declare const isAdProvider: (value: string) => value is AdProvider;
 /**
  * The DNS TXT record content for a token.
  *
@@ -205,11 +238,11 @@ declare const isAdProvider: (value: string) => value is AdProvider;
  * pasted the full record from the UI gets what they meant rather than a
  * double-prefixed record that verifies against nothing.
  */
-declare function txtRecord(provider: AdProvider, token: string): string;
+export declare function txtRecord(provider: AdProvider, token: string): string;
 /** The tag id for an entry, or undefined when the field it needs is unset. */
-declare function tagId(entry: AdPropertySetup): string | undefined;
+export declare function tagId(entry: AdPropertySetup): string | undefined;
 /** The consent category gating an entry's tag. `marketing` unless stated otherwise. */
-declare const categoryOf: (entry: AdPropertySetup) => AdConsentCategory;
+export declare const categoryOf: (entry: AdPropertySetup) => AdConsentCategory;
 /**
  * One provider's tag, rendered as a **consent-gated, inert** `<script>`.
  *
@@ -221,7 +254,7 @@ declare const categoryOf: (entry: AdPropertySetup) => AdConsentCategory;
  * Returns null when the entry has no tag id, so a caller can report the gap rather
  * than emit a snippet that initialises `undefined`.
  */
-declare function renderTag(entry: AdPropertySetup, strategy?: 'idle' | 'async' | 'interaction'): string | null;
+export declare function renderTag(entry: AdPropertySetup, strategy?: 'idle' | 'async' | 'interaction'): string | null;
 //#endregion
-export { AD_PLATFORMS, AD_PROVIDER_KEYS, type AdConsentCategory, type AdDomainState, type AdPlatform, type AdPropertyPlan, type AdPropertyResult, type AdPropertySetup, type AdProvider, type AdTagSpec, type AdVerificationSpec, type AdsConfig, type AdsPlan, type MissingField, type StepAction, type StepPlan, categoryOf, createApexTxt, findZoneId, formatPlan, formatSummary, hasDrift, isAdProvider, listApexTxt, missingFields, plan, planProperty, renderTag, tagId, txtRecord };
+export { type AdConsentCategory, type AdDomainState, type AdPlatform, type AdPropertyPlan, type AdPropertyResult, type AdPropertySetup, type AdProvider, type AdTagSpec, type AdVerificationSpec, type AdsConfig, type AdsPlan, type ConversionAction, type ConversionLabelMap, type MissingField, type StepAction, type StepPlan, createApexTxt, findZoneId, listApexTxt };
 //# sourceMappingURL=index.d.mts.map

package/dist/ads/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/ads/types.ts","../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;;;;;AAsBA;;;;AAAsB;AAWtB;;;;AAA6B;AAG7B;;;;;;;;AAAA,KAdY,UAAA;;KAWA,iBAAA;;UAGK,eAAA;EACf,QAAA,EAAU,UAAA;EAsBH;AAAA;AAIT;;EArBE,SAAA;EAuBA;EArBA,OAAA;EAiCe;EA/Bf,eAAA;;EAEA,MAAA;EAgCW;;;;ACvDb;;;ED+BE,kBAAA;EC/BoB;EDiCpB,QAAA,GAAW,iBAAiB;EAC5B,OAAA;AAAA;;UAIe,SAAA;ECjCA;EDmCf,UAAA,EAAY,eAAe;AAAA;;;;;;;;AC9BP;AAItB;UDsCiB,aAAA;EACf,MAAA;ECtCU;EDwCV,WAAW;AAAA;;;;KCvDD,UAAA;ADHZ;AAAA,KCMY,YAAA;AAAA,UAEK,QAAA;EACf,MAAA,EAAQ,UAAA;EDTY;ECWpB,MAAA;EDA2B;ECE3B,KAAA,GAAQ,YAAY;AAAA;ADFO;AAAA,UCMZ,cAAA;EACf,QAAA,EAAU,eAAA;;EAEV,IAAA;EDLA;ECOA,MAAA;EDFA;ECIA,GAAA,EAAK,QAAA;EDAL;ECEA,GAAA,EAAK,QAAA;EDQL;ECNA,UAAA;EDQW;ECNX,SAAA;AAAA;AAAA,UAGe,OAAA;EACf,UAAA,EAAY,cAAc;EDOF;ECLxB,KAAA;AAAA;ADO2B;AAY7B;;;;AAGa;;;;AAfgB,iBCKb,YAAA,CAAa,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAO,aAAA,GAAgB,cAAA;;iBAoD5D,IAAA,CAAK,MAAA,EAAQ,SAAA,EAAW,MAAA,EAAQ,GAAA,SAAY,aAAA,IAAiB,OAAA;;iBAe7D,QAAA,CAAS,CAAU,EAAP,OAAO;AA7GnC;AAAA,iBAkHgB,aAAA,CAAc,CAAA,EAAG,OAAA;EAAY,QAAA;EAAkB,KAAA,EAAO,YAAY;AAAA;AAhHlF;AAAA,iBA4HgB,UAAA,CAAW,CAAU,EAAP,OAAO;;UAcpB,gBAAA;EACf,QAAA;EACA,MAAA;EACA,GAAA;EACA,GAAA;EACA,SAAA;AAAA;AA1IoB;AAAA,iBA8IN,aAAA,CAAc,OAA2B,EAAlB,gBAAgB;;;ADhH1B;AAAA,UE9BZ,kBAAA;EACf,MAAA;;;AF4CW;;;;EErCX,SAAA;EDlBoB;ECoBpB,KAAA;EDpBoB;ECsBpB,MAAA;AAAA;;UAIe,SAAA;EDvBO;ECyBtB,KAAA;EDvBe;ECyBf,GAAA,IAAO,EAAA;;EAEP,SAAA,GAAY,EAAA,UAAY,KAAA,EAAO,eAAe;ED1B9C;;;;EC+BA,OAAA;ED3BoB;EC6BpB,UAAA;EDzBe;EC2Bf,MAAA;AAAA;AAAA,UAGe,UAAA;EDvBV;ECyBL,IAAA;EDvBa;;;;;;;;ECgCb,eAAA;EDhCK;ECkCL,aAAA;ED9BA;ECgCA,UAAA;EACA,YAAA,EAAc,kBAAA;EACd,GAAA,EAAK,SAAA;ED/BiB;ECiCtB,WAAA,GAAc,KAAA,EAAO,eAAA;AAAA;AAAA,cAaV,YAAA,EAAc,MAAA,CAAO,UAAA,EAAY,UAAA;;cAuMjC,gBAAA,EAAgD,UAAU;;cAG1D,YAAA,GAAgB,KAAA,aAAgB,KAAA,IAAS,UAAmC;ADzOzF;;;;;;;;;AAAA,iBCoPgB,SAAA,CAAU,QAAA,EAAU,UAAU,EAAE,KAAA;;iBAOhC,KAAA,CAAM,KAAsB,EAAf,eAAe;;cAM/B,UAAA,GAAc,KAAA,EAAO,eAAA,KAAkB,iBACrB;ADlQ2D;AAoD1F;;;;;;;;;;AApD0F,iBCkR1E,SAAA,CACd,KAAA,EAAO,eAAe,EACtB,QAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/ads/types.ts","../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;KAsBY;;KAWA;;;;;;;KAQA;;;;;;;;;;;;UAaK;EACf;EACA;EACA;;;;;;wBAOc,0BACd,gBAAgB,iCACf;;UAMc;EACf,UAAU;;;;;EAKV;;EAEA;;;;;;;;EAQA,2BAA2B;;EAE3B;;;;;;;;EAQA;;EAEA,WAAW;EACX;;;UAIe;;EAEf,YAAY;;;;;;;;;;;UAYG;EACf;;EAEA;;;;;KCjGU;;KAGA;UAEK;EACf,QAAQ;;EAER;;EAEA,QAAQ;;;UAIO;EACf,UAAU;;EAEV;;EAEA;;EAEA,KAAK;;EAEL,KAAK;;EAEL;;EAEA;;UAGe;EACf,YAAY;;EAEZ;;;;;;;;;;;wBAYc,aAAa,OAAO,iBAAiB,OAAO,gBAAgB;;wBAoD5D,KAAK,QAAQ,WAAW,QAAQ,YAAY,iBAAiB;;wBAe7D,SAAS,GAAG;;wBAKZ,cAAc,GAAG;EAAY;EAAkB,OAAO;;;wBAYtD,WAAW,GAAG;;UAcb;EACf;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,SAAS;;;;UC7ItB;EACf;;;;;;;EAOA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,OAAO;;EAEP,YAAY,YAAY,OAAO;;;;;EAK/B;;EAEA;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA;;EAEA;;EAEA;EACA,cAAc;EACd,KAAK;;EAEL,cAAc,OAAO;;qBA0CV,cAAc,OAAO,YAAY;;qBAuMjC,kBAAgD;;qBAGhD,eAAgB,kBAAgB,SAAS;;;;;;;;;;wBAWtC,UAAU,UAAU,YAAY;;wBAOhC,MAAM,OAAO;;qBAMhB,aAAc,OAAO,oBAAkB;;;;;;;;;;;;wBAiBpC,UACd,OAAO,iBACP"}

package/dist/ads/index.mjs

@@ -1,8 +1,74 @@
-import { i as table, n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-CgAsXiqe.mjs";
+import { t as table } from "../plan-format-A18SvJ7C.mjs";
+import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-CD8vwrgj.mjs";
 
+//#region src/ads/types.ts
+/**
+* A bare string is back-compat shorthand for `{ call: label }` — the only
+* action that existed before this was a map. Absent input normalises to `{}`.
+*/
+function normalizeConversionLabels(label) {
+	if (label == null) return {};
+	return typeof label === "string" ? { call: label } : label;
+}
+
+//#endregion
 //#region src/ads/providers.ts
-/** `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs. */
-const gtagBootstrap = (id) => `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('js',new Date());gtag('config','${id}');`;
+/**
+* What each ad platform actually lets a build tool do — the table every `vitops ads`
+* subcommand reads.
+*
+* Written the way the indexing module was written: start from what the platforms
+* accept, because it is much narrower than it looks, and record the *absence* of a
+* path as a fact rather than leaving it as a gap.
+*
+*  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,
+*    Snapchat). That record is the one thing here that can be created for you.
+*  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,
+*    Microsoft Ads). Linking is the tag and the account id, nothing else. Those
+*    resolve to a skip *plus* a named reason — a silent omission would read as
+*    "already done".
+*  - **No platform Marketing API is called.** Meta's Business Management
+*    `verify_domain` needs a system-user token; the Google Ads API needs an
+*    approved developer token and puts the consumer's own account on the line.
+*    That is the same reasoning that keeps the Google Indexing API unwired: a
+*    toolchain other people install must not ship a documented path to a terms
+*    violation. The final "Verify" click stays a reminder.
+*
+* The verification token is **not a secret** — it is published in DNS, and the
+* platform fetching it back is the ownership proof, exactly like the IndexNow key.
+* So it lives in the config while credentials stay in the environment.
+*
+* Each tag is the platform's documented bootstrap reduced to its queue stub, with
+* the remote library on `data-src` for the consent gate to attach after the
+* bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body
+* first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a
+* snippet that creates its own `<script>`; those declare no `src`, and their body
+* stays inert until activation, so an undecided visitor still issues no request.
+*/
+/**
+* `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.
+*
+* `gtag('config', id)` only loads the tag — it never reports a conversion. When
+* `entry.conversionLabel` names one or more actions, this also exposes a
+* `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry
+* per configured action, so a call, an email click and a form submission each
+* carry their own `send_to` target instead of all three sharing one (that
+* sharing was a real bug: a call and an email click used to report as the same
+* Google Ads conversion action, indistinguishable in the account). Bootstrap
+* time only loads the tag; `scripts/tracking.ts`'s click handler and
+* `vitopsFormConversion()` each read their own action's key and fire
+* `gtag('event', 'conversion', …)` at the moment of the actual interaction —
+* bootstrap-time firing would count every pageview as a conversion.
+*
+* `entry` is trusted here — `resolveAds()` validates every configured label
+* against `SAFE_ID` before it reaches this function, the same guard `id`
+* already gets.
+*/
+const gtagBootstrap = (id, entry) => {
+	const labels = normalizeConversionLabels(entry.conversionLabel);
+	const actions = Object.entries(labels).filter((pair) => !!pair[1]);
+	return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('js',new Date());gtag('config','${id}');` + (actions.length ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};window.vitopsAdsConversions.google=${JSON.stringify(Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])))};` : "");
+};
 /** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */
 const queueStub = (global, methods) => `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};window.${global}.methods=${methods};`;
 const AD_PLATFORMS = {
@@ -32,7 +98,7 @@ const AD_PLATFORMS = {
 			privacyUrl: "https://policies.google.com/privacy",
 			optOut: "https://adssettings.google.com/"
 		},
-		manualSteps: (e) => [...e.conversionLabel ? [] : ["create a conversion action in Google Ads and record its label as `conversionLabel`"], "link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions"]
+		manualSteps: (e) => [...Object.keys(normalizeConversionLabels(e.conversionLabel)).length ? [] : ["create a conversion action in Google Ads and record its label as `conversionLabel`"], "link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions"]
 	},
 	meta: {
 		name: "Meta",
@@ -353,19 +419,22 @@ function formatPlan(p) {
 }
 /** Render the end-of-run summary: one row per property, plus any reminders. */
 function formatSummary(results) {
-	return table([
+	const headers = [
 		"PROVIDER",
 		"DOMAIN",
 		"VERIFY",
 		"TAG"
-	], results.map((r) => [
+	];
+	const rows = results.map((r) => [
 		r.provider,
 		r.domain,
 		r.txt,
 		r.tag
-	]), results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`)));
+	]);
+	const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`));
+	return table(headers, rows, reminders);
 }
 
 //#endregion
-export { AD_PLATFORMS, AD_PROVIDER_KEYS, categoryOf, createApexTxt, findZoneId, formatPlan, formatSummary, hasDrift, isAdProvider, listApexTxt, missingFields, plan, planProperty, renderTag, tagId, txtRecord };
+export { AD_PLATFORMS, AD_PROVIDER_KEYS, categoryOf, createApexTxt, findZoneId, formatPlan, formatSummary, hasDrift, isAdProvider, listApexTxt, missingFields, normalizeConversionLabels, plan, planProperty, renderTag, tagId, txtRecord };
 //# sourceMappingURL=index.mjs.map