@getvitops/utils 8.0.1 → 8.2.0-alpha.0

package/dist/hosting/index.mjs

@@ -0,0 +1,553 @@
+import { t as table } from "../plan-format-A18SvJ7C.mjs";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+
+//#region src/hosting/plan.ts
+/**
+* Every decision `vitops setup` makes, as one pure function.
+*
+* Same split as `onboarding/plan.ts` and `ads/plan.ts`: this module decides, from
+* observed live state, what's left to do; `wrangler.ts`/`github.ts` execute a plan
+* and decide nothing. That is what makes `--dry` a complete account of a run and
+* `--check` an honest drift report with no network beyond the observation step.
+*
+* Idempotency lives here: a step whose desired state already holds resolves to
+* `skip`, so a re-run of a fully-provisioned project is all skips by construction.
+*
+* `blocked` (ads' addition to onboarding's three-state `StepAction`) covers the one
+* thing this command genuinely cannot do: mint a Cloudflare API token. That is
+* config nothing here can supply — surfaced as blocked, carrying the manual path,
+* never as a failure.
+*
+* Never destructive: no step here deletes a database, a bucket, a branch, a
+* protection rule, or a DNS record — matching `onboarding/cloudflare.ts`'s DNS
+* verbs, which have no update or delete either.
+*/
+const SECRETS_FOR = (setup) => setup.platform === "cloudflare" ? [
+	"DEV_D1_ID",
+	"CLOUDFLARE_ACCOUNT_ID",
+	"CLOUDFLARE_API_TOKEN"
+] : [];
+/** Plan the whole hosting sequence from setup + observed state. */
+function plan(setup, state) {
+	const notes = [];
+	const repo = state.originRemote && state.repoNwo ? {
+		action: "skip",
+		detail: `repo already exists (${state.repoNwo})`
+	} : {
+		action: "create",
+		detail: `create GitHub repo "${setup.projectName}" (${setup.repoVisibility})`
+	};
+	const branches = state.branches.includes("main") && state.branches.includes("dev") ? {
+		action: "skip",
+		detail: "main + dev already exist"
+	} : {
+		action: "create",
+		detail: "push main + dev"
+	};
+	const defaultBranch = state.defaultBranch === "dev" ? {
+		action: "skip",
+		detail: "dev is already the default branch"
+	} : {
+		action: "update",
+		detail: "make dev the default branch"
+	};
+	const mainProtection = state.mainProtected ? {
+		action: "skip",
+		detail: "main is already protected"
+	} : {
+		action: "blocked",
+		detail: "requires GitHub Pro/Team on a private repo — set it manually in Settings → Branches (PR + review + the \"ci\" check required) if this stays blocked"
+	};
+	const prodEnvironment = state.environments.includes("production") ? {
+		action: "skip",
+		detail: "production environment already exists"
+	} : {
+		action: "blocked",
+		detail: "requires GitHub Pro/Team on a private repo — create a \"production\" environment gated on your admin collaborators manually if this stays blocked"
+	};
+	const devEnvironment = state.environments.includes("dev") ? {
+		action: "skip",
+		detail: "dev environment already exists"
+	} : {
+		action: "create",
+		detail: "create \"dev\" environment with no required reviewers (stays open)"
+	};
+	const d1 = setup.platform !== "cloudflare" || !setup.devResources ? {
+		action: "skip",
+		detail: "not a cloudflare project, or dev resources not requested"
+	} : state.d1Present ? {
+		action: "skip",
+		detail: `dev D1 already exists (${state.d1Id ?? "id unknown"})`
+	} : {
+		action: "create",
+		detail: `create D1 database "${setup.projectName}-dev"`
+	};
+	const r2 = setup.platform !== "cloudflare" || !setup.devResources ? {
+		action: "skip",
+		detail: "not a cloudflare project, or dev resources not requested"
+	} : state.r2Present ? {
+		action: "skip",
+		detail: `dev R2 bucket already exists`
+	} : {
+		action: "create",
+		detail: `create R2 bucket "${setup.projectName}-media-dev"`
+	};
+	const secrets = {};
+	for (const name of SECRETS_FOR(setup)) {
+		if (!state.ghAuthed || !state.originRemote) {
+			secrets[name] = {
+				action: "blocked",
+				detail: "no GitHub repo wired up yet — run the repo step first"
+			};
+			continue;
+		}
+		if (state.secretsPresent.includes(name)) {
+			secrets[name] = {
+				action: "skip",
+				detail: "already set"
+			};
+			continue;
+		}
+		if (name === "CLOUDFLARE_API_TOKEN") {
+			secrets[name] = {
+				action: "blocked",
+				detail: "tokens cannot be created via any API — create one at https://dash.cloudflare.com/profile/api-tokens (Workers + D1 + R2 edit), then `gh secret set CLOUDFLARE_API_TOKEN`"
+			};
+			continue;
+		}
+		secrets[name] = (name === "DEV_D1_ID" ? state.d1Id : name === "CLOUDFLARE_ACCOUNT_ID" ? state.accountId : void 0) ? {
+			action: "create",
+			detail: `set from provisioned/observed value`
+		} : {
+			action: "blocked",
+			detail: "value not yet known — provision the resource first"
+		};
+	}
+	if (!state.wranglerAuthed && setup.platform === "cloudflare" && setup.devResources) notes.push("wrangler is not logged in — run `npx wrangler login` first");
+	if (!state.ghAuthed) notes.push("gh is not logged in — run `gh auth login` first");
+	return {
+		repo,
+		branches,
+		defaultBranch,
+		mainProtection,
+		prodEnvironment,
+		devEnvironment,
+		d1,
+		r2,
+		secrets,
+		notes
+	};
+}
+const allSteps = (p) => [
+	p.repo,
+	p.branches,
+	p.defaultBranch,
+	p.mainProtection,
+	p.prodEnvironment,
+	p.devEnvironment,
+	p.d1,
+	p.r2,
+	...Object.values(p.secrets)
+];
+/** Any step that isn't a skip — i.e. the live state has drifted from desired. */
+function hasDrift(p) {
+	return allSteps(p).some((s) => s.action !== "skip");
+}
+/** Every blocked step, with a name — what `--check` reports and the CLI surfaces. */
+function blockedSteps(p) {
+	return [
+		["repo", p.repo],
+		["branches", p.branches],
+		["defaultBranch", p.defaultBranch],
+		["mainProtection", p.mainProtection],
+		["prodEnvironment", p.prodEnvironment],
+		["devEnvironment", p.devEnvironment],
+		["d1", p.d1],
+		["r2", p.r2],
+		...Object.entries(p.secrets).map(([name, s]) => [`secret:${name}`, s])
+	].filter(([, s]) => s.action === "blocked").map(([name, s]) => ({
+		name,
+		detail: s.detail
+	}));
+}
+/** Render a plan as the block `--dry` and `--check` print. */
+function formatPlan(p) {
+	const glyph = (s) => s.action === "skip" ? "·" : s.action === "blocked" ? "?" : s.action === "update" ? "~" : "+";
+	const lines = [];
+	lines.push(`${glyph(p.repo)} repo             ${p.repo.detail}`);
+	lines.push(`${glyph(p.branches)} branches         ${p.branches.detail}`);
+	lines.push(`${glyph(p.defaultBranch)} default branch   ${p.defaultBranch.detail}`);
+	lines.push(`${glyph(p.mainProtection)} main protection  ${p.mainProtection.detail}`);
+	lines.push(`${glyph(p.prodEnvironment)} production env   ${p.prodEnvironment.detail}`);
+	lines.push(`${glyph(p.devEnvironment)} dev env          ${p.devEnvironment.detail}`);
+	lines.push(`${glyph(p.d1)} dev D1           ${p.d1.detail}`);
+	lines.push(`${glyph(p.r2)} dev R2           ${p.r2.detail}`);
+	for (const [name, s] of Object.entries(p.secrets)) lines.push(`${glyph(s)} secret ${name}${" ".repeat(Math.max(1, 11 - name.length))}${s.detail}`);
+	for (const n of p.notes) lines.push(`! ${n}`);
+	return lines.join("\n");
+}
+/** Render the end-of-run summary: one row per step, plus blocked reminders. */
+function formatSummary(results) {
+	const headers = [
+		"STEP",
+		"STATUS",
+		"DETAIL"
+	];
+	const rows = results.map((r) => [
+		r.step,
+		r.status,
+		r.detail
+	]);
+	const reminders = results.filter((r) => r.status === "blocked").map((r) => `  ! ${r.step}: ${r.detail}`);
+	return table(headers, rows, reminders);
+}
+/**
+* Plan the domain-consistency check on its own — it has no executor, only an
+* observation (`wrangler.jsonc` + the config), and it is never applied by this
+* command. See `SETUP.html`'s "Domain strategy" stage: the actual cutover is a
+* human, deliberate action.
+*/
+function planDomainConsistency(state) {
+	if (Boolean(state.customDomain)) {
+		if (!state.canonical || state.canonical !== `https://${state.customDomain}`) return {
+			action: "blocked",
+			detail: `wrangler.jsonc names a custom domain (${state.customDomain}) but site.domains.canonical doesn't match — a visitor sees the new site while <link rel=canonical> still points at the old one`
+		};
+		if (state.robots?.includes("noindex")) return {
+			action: "blocked",
+			detail: "custom domain is live but robots is still \"noindex,nofollow\" — flip it back after cutover"
+		};
+		return {
+			action: "skip",
+			detail: "custom domain configured and consistent"
+		};
+	}
+	if (!state.robots?.includes("noindex")) return {
+		action: "blocked",
+		detail: "still on *.workers.dev but robots does not say \"noindex,nofollow\" — a workers.dev URL is indexable, and this is what stops search engines treating it as a duplicate of the real site"
+	};
+	return {
+		action: "skip",
+		detail: "workers.dev phase, correctly noindexed"
+	};
+}
+
+//#endregion
+//#region src/hosting/wrangler.ts
+/**
+* Cloudflare resources — dev D1 + R2, plus the account id. Executes a plan and
+* decides nothing; every observation and mutation is a structured result, never a
+* throw, so the CLI decides what a failure means.
+*
+* Shells out to `wrangler` and reads `gh`'s account-id output — there is no REST
+* alternative that doesn't also need the same credential wrangler already holds
+* from `wrangler login`. Same class of executor as `@getvitops/utils/media`
+* shelling to `ffmpeg`: an external tool, not an npm dependency, with `execImpl`
+* injected so the parsing is testable without a real Cloudflare account.
+*/
+const exec = promisify(execFile);
+/** The real executor — `execFile` with an argv array, never a shell string. */
+const realExec = async (cmd, args) => {
+	try {
+		const { stdout } = await exec(cmd, args, { maxBuffer: 16777216 });
+		return {
+			ok: true,
+			stdout
+		};
+	} catch (err) {
+		const e = err;
+		return {
+			ok: false,
+			stdout: e.stdout ?? "",
+			message: e.stderr || e.message || "command failed"
+		};
+	}
+};
+/** `wrangler whoami` — auth check + the 32-hex account id, from one call. */
+async function wranglerWhoami(execImpl = realExec) {
+	const res = await execImpl("npx", ["wrangler", "whoami"]);
+	if (!res.ok) return { authed: false };
+	const accountId = /\b([0-9a-f]{32})\b/.exec(res.stdout)?.[1];
+	return {
+		authed: true,
+		...accountId ? { accountId } : {}
+	};
+}
+/**
+* Find an existing dev D1 database's id by name.
+*
+* `d1 create`'s own stdout carries the id, but its format has drifted across
+* wrangler versions before — a re-list is the one thing guaranteed to still hold
+* the answer, so both the "does it exist" check and the post-create fallback go
+* through this.
+*/
+async function findD1(name, execImpl = realExec) {
+	const res = await execImpl("npx", [
+		"wrangler",
+		"d1",
+		"list",
+		"--json"
+	]);
+	if (!res.ok) return void 0;
+	try {
+		return JSON.parse(res.stdout).find((d) => d.name === name)?.uuid;
+	} catch {
+		return;
+	}
+}
+/** Create a dev D1 database, then resolve its id via `findD1` (see its docblock). */
+async function createD1(name, execImpl = realExec) {
+	const res = await execImpl("npx", [
+		"wrangler",
+		"d1",
+		"create",
+		name
+	]);
+	if (!res.ok) return {
+		ok: false,
+		message: res.message
+	};
+	const id = /"database_id":\s*"([0-9a-f-]{36})"/.exec(res.stdout)?.[1] ?? await findD1(name, execImpl);
+	if (!id) return {
+		ok: false,
+		message: "created, but could not determine the database id"
+	};
+	return {
+		ok: true,
+		id
+	};
+}
+async function findR2Bucket(name, execImpl = realExec) {
+	const res = await execImpl("npx", [
+		"wrangler",
+		"r2",
+		"bucket",
+		"list"
+	]);
+	if (!res.ok) return false;
+	return new RegExp(`name:\\s+${name}\\s*$`, "m").test(res.stdout);
+}
+async function createR2Bucket(name, execImpl = realExec) {
+	const res = await execImpl("npx", [
+		"wrangler",
+		"r2",
+		"bucket",
+		"create",
+		name
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+
+//#endregion
+//#region src/hosting/github.ts
+async function ghAuthed(execImpl = realExec) {
+	return (await execImpl("gh", ["auth", "status"])).ok;
+}
+async function originRemote(execImpl = realExec) {
+	const res = await execImpl("git", [
+		"remote",
+		"get-url",
+		"origin"
+	]);
+	return res.ok ? res.stdout.trim() : void 0;
+}
+async function repoNwo(execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner"
+	]);
+	if (!res.ok) return void 0;
+	try {
+		return JSON.parse(res.stdout).nameWithOwner;
+	} catch {
+		return;
+	}
+}
+async function branches(execImpl = realExec) {
+	const res = await execImpl("git", [
+		"branch",
+		"--list",
+		"--format=%(refname:short)"
+	]);
+	if (!res.ok) return [];
+	return res.stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+}
+async function defaultBranch(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"repo",
+		"view",
+		nwo,
+		"--json",
+		"defaultBranchRef"
+	]);
+	if (!res.ok) return void 0;
+	try {
+		return JSON.parse(res.stdout).defaultBranchRef?.name;
+	} catch {
+		return;
+	}
+}
+async function mainProtected(nwo, execImpl = realExec) {
+	return (await execImpl("gh", ["api", `repos/${nwo}/branches/main/protection`])).ok;
+}
+async function environments(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", ["api", `repos/${nwo}/environments`]);
+	if (!res.ok) return [];
+	try {
+		return (JSON.parse(res.stdout).environments ?? []).map((e) => e.name);
+	} catch {
+		return [];
+	}
+}
+async function secretsPresent(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", ["api", `repos/${nwo}/actions/secrets`]);
+	if (!res.ok) return [];
+	try {
+		return (JSON.parse(res.stdout).secrets ?? []).map((s) => s.name);
+	} catch {
+		return [];
+	}
+}
+async function createRepo(name, visibility, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"repo",
+		"create",
+		name,
+		`--${visibility}`,
+		"--source=.",
+		"--remote=origin"
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+async function pushBranches(execImpl = realExec) {
+	const res = await execImpl("git", [
+		"push",
+		"-u",
+		"origin",
+		"main",
+		"dev"
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+async function setDefaultBranch(nwo, branch, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"repo",
+		"edit",
+		nwo,
+		`--default-branch=${branch}`
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+/**
+* `PUT .../branches/main/protection`. A 403 on Pro/Team-gated repos is expected.
+*
+* Every field goes through `gh api`'s `-f`/`-F` form flags rather than a JSON body
+* on stdin — `gh api` supports nested keys (`a[b]=c`) and repeated array keys
+* (`a[]=x`) this way, so no request needs a second I/O channel `ExecImpl` would
+* have to carry just for this one call.
+*/
+async function protectMain(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"api",
+		"--method",
+		"PUT",
+		`repos/${nwo}/branches/main/protection`,
+		"-F",
+		"required_status_checks[strict]=true",
+		"-f",
+		"required_status_checks[contexts][]=ci",
+		"-F",
+		"enforce_admins=false",
+		"-F",
+		"required_pull_request_reviews[required_approving_review_count]=1",
+		"-F",
+		"restrictions=null",
+		"-F",
+		"allow_force_pushes=false",
+		"-F",
+		"allow_deletions=false"
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+/** The repo's admin collaborators — numeric user ids, which is what the
+* environment-reviewers API wants (not logins). */
+async function adminCollaboratorIds(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", ["api", `repos/${nwo}/collaborators?permission=admin`]);
+	if (!res.ok) return [];
+	try {
+		return JSON.parse(res.stdout).map((c) => c.id);
+	} catch {
+		return [];
+	}
+}
+/** `PUT .../environments/production`, reviewers = current admin collaborators. */
+async function createProdEnvironment(nwo, reviewerUserIds, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"api",
+		"--method",
+		"PUT",
+		`repos/${nwo}/environments/production`,
+		"-f",
+		`deployment_branch_policy[protected_branches]=true`,
+		"-f",
+		`deployment_branch_policy[custom_branch_policies]=false`,
+		...reviewerUserIds.flatMap((id) => [
+			"-F",
+			`reviewers[][id]=${id}`,
+			"-f",
+			"reviewers[][type]=User"
+		])
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+/** `PUT .../environments/dev` with no reviewers — deliberately left open. */
+async function createDevEnvironment(nwo, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"api",
+		"--method",
+		"PUT",
+		`repos/${nwo}/environments/dev`
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+async function setSecret(name, value, execImpl = realExec) {
+	const res = await execImpl("gh", [
+		"secret",
+		"set",
+		name,
+		"--body",
+		value
+	]);
+	return res.ok ? { ok: true } : {
+		ok: false,
+		message: res.message
+	};
+}
+
+//#endregion
+export { adminCollaboratorIds, blockedSteps, branches, createD1, createDevEnvironment, createProdEnvironment, createR2Bucket, createRepo, defaultBranch, environments, findD1, findR2Bucket, formatPlan, formatSummary, ghAuthed, hasDrift, mainProtected, originRemote, plan, planDomainConsistency, protectMain, pushBranches, realExec, repoNwo, secretsPresent, setDefaultBranch, setSecret, wranglerWhoami };
+//# sourceMappingURL=index.mjs.map

package/dist/hosting/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/hosting/plan.ts","../../src/hosting/wrangler.ts","../../src/hosting/github.ts"],"sourcesContent":["/**\n * Every decision `vitops setup` makes, as one pure function.\n *\n * Same split as `onboarding/plan.ts` and `ads/plan.ts`: this module decides, from\n * observed live state, what's left to do; `wrangler.ts`/`github.ts` execute a plan\n * and decide nothing. That is what makes `--dry` a complete account of a run and\n * `--check` an honest drift report with no network beyond the observation step.\n *\n * Idempotency lives here: a step whose desired state already holds resolves to\n * `skip`, so a re-run of a fully-provisioned project is all skips by construction.\n *\n * `blocked` (ads' addition to onboarding's three-state `StepAction`) covers the one\n * thing this command genuinely cannot do: mint a Cloudflare API token. That is\n * config nothing here can supply — surfaced as blocked, carrying the manual path,\n * never as a failure.\n *\n * Never destructive: no step here deletes a database, a bucket, a branch, a\n * protection rule, or a DNS record — matching `onboarding/cloudflare.ts`'s DNS\n * verbs, which have no update or delete either.\n */\nimport { table } from '../plan-format.ts';\nimport type { DomainState, HostingSetup, HostingState } from './types.ts';\n\nexport type StepAction = 'create' | 'update' | 'skip' | 'blocked';\n\nexport interface StepPlan {\n  action: StepAction;\n  detail: string;\n}\n\nexport interface HostingPlan {\n  repo: StepPlan;\n  branches: StepPlan;\n  defaultBranch: StepPlan;\n  mainProtection: StepPlan;\n  prodEnvironment: StepPlan;\n  devEnvironment: StepPlan;\n  d1: StepPlan;\n  r2: StepPlan;\n  /** One step per repo secret this command sets. */\n  secrets: Record<string, StepPlan>;\n  notes: string[];\n}\n\nconst SECRETS_FOR = (setup: HostingSetup): string[] =>\n  setup.platform === 'cloudflare'\n    ? ['DEV_D1_ID', 'CLOUDFLARE_ACCOUNT_ID', 'CLOUDFLARE_API_TOKEN']\n    : [];\n\n/** Plan the whole hosting sequence from setup + observed state. */\nexport function plan(setup: HostingSetup, state: HostingState): HostingPlan {\n  const notes: string[] = [];\n\n  const repo: StepPlan =\n    state.originRemote && state.repoNwo\n      ? { action: 'skip', detail: `repo already exists (${state.repoNwo})` }\n      : {\n          action: 'create',\n          detail: `create GitHub repo \"${setup.projectName}\" (${setup.repoVisibility})`,\n        };\n\n  const branches: StepPlan =\n    state.branches.includes('main') && state.branches.includes('dev')\n      ? { action: 'skip', detail: 'main + dev already exist' }\n      : { action: 'create', detail: 'push main + dev' };\n\n  const defaultBranch: StepPlan =\n    state.defaultBranch === 'dev'\n      ? { action: 'skip', detail: 'dev is already the default branch' }\n      : { action: 'update', detail: 'make dev the default branch' };\n\n  const mainProtection: StepPlan = state.mainProtected\n    ? { action: 'skip', detail: 'main is already protected' }\n    : {\n        action: 'blocked',\n        detail:\n          'requires GitHub Pro/Team on a private repo — set it manually in Settings → Branches ' +\n          '(PR + review + the \"ci\" check required) if this stays blocked',\n      };\n\n  const prodEnvironment: StepPlan = state.environments.includes('production')\n    ? { action: 'skip', detail: 'production environment already exists' }\n    : {\n        action: 'blocked',\n        detail:\n          'requires GitHub Pro/Team on a private repo — create a \"production\" environment ' +\n          'gated on your admin collaborators manually if this stays blocked',\n      };\n\n  const devEnvironment: StepPlan = state.environments.includes('dev')\n    ? { action: 'skip', detail: 'dev environment already exists' }\n    : {\n        action: 'create',\n        detail: 'create \"dev\" environment with no required reviewers (stays open)',\n      };\n\n  const d1: StepPlan =\n    setup.platform !== 'cloudflare' || !setup.devResources\n      ? { action: 'skip', detail: 'not a cloudflare project, or dev resources not requested' }\n      : state.d1Present\n        ? { action: 'skip', detail: `dev D1 already exists (${state.d1Id ?? 'id unknown'})` }\n        : { action: 'create', detail: `create D1 database \"${setup.projectName}-dev\"` };\n\n  const r2: StepPlan =\n    setup.platform !== 'cloudflare' || !setup.devResources\n      ? { action: 'skip', detail: 'not a cloudflare project, or dev resources not requested' }\n      : state.r2Present\n        ? { action: 'skip', detail: `dev R2 bucket already exists` }\n        : { action: 'create', detail: `create R2 bucket \"${setup.projectName}-media-dev\"` };\n\n  const secrets: Record<string, StepPlan> = {};\n  for (const name of SECRETS_FOR(setup)) {\n    if (!state.ghAuthed || !state.originRemote) {\n      secrets[name] = {\n        action: 'blocked',\n        detail: 'no GitHub repo wired up yet — run the repo step first',\n      };\n      continue;\n    }\n    if (state.secretsPresent.includes(name)) {\n      secrets[name] = { action: 'skip', detail: 'already set' };\n      continue;\n    }\n    if (name === 'CLOUDFLARE_API_TOKEN') {\n      secrets[name] = {\n        action: 'blocked',\n        detail:\n          'tokens cannot be created via any API — create one at ' +\n          'https://dash.cloudflare.com/profile/api-tokens (Workers + D1 + R2 edit), then ' +\n          '`gh secret set CLOUDFLARE_API_TOKEN`',\n      };\n      continue;\n    }\n    const value =\n      name === 'DEV_D1_ID'\n        ? state.d1Id\n        : name === 'CLOUDFLARE_ACCOUNT_ID'\n          ? state.accountId\n          : undefined;\n    secrets[name] = value\n      ? { action: 'create', detail: `set from provisioned/observed value` }\n      : { action: 'blocked', detail: 'value not yet known — provision the resource first' };\n  }\n\n  if (!state.wranglerAuthed && setup.platform === 'cloudflare' && setup.devResources)\n    notes.push('wrangler is not logged in — run `npx wrangler login` first');\n  if (!state.ghAuthed) notes.push('gh is not logged in — run `gh auth login` first');\n\n  return {\n    repo,\n    branches,\n    defaultBranch,\n    mainProtection,\n    prodEnvironment,\n    devEnvironment,\n    d1,\n    r2,\n    secrets,\n    notes,\n  };\n}\n\nconst allSteps = (p: HostingPlan): StepPlan[] => [\n  p.repo,\n  p.branches,\n  p.defaultBranch,\n  p.mainProtection,\n  p.prodEnvironment,\n  p.devEnvironment,\n  p.d1,\n  p.r2,\n  ...Object.values(p.secrets),\n];\n\n/** Any step that isn't a skip — i.e. the live state has drifted from desired. */\nexport function hasDrift(p: HostingPlan): boolean {\n  return allSteps(p).some((s) => s.action !== 'skip');\n}\n\n/** Every blocked step, with a name — what `--check` reports and the CLI surfaces. */\nexport function blockedSteps(p: HostingPlan): { name: string; detail: string }[] {\n  const named: [string, StepPlan][] = [\n    ['repo', p.repo],\n    ['branches', p.branches],\n    ['defaultBranch', p.defaultBranch],\n    ['mainProtection', p.mainProtection],\n    ['prodEnvironment', p.prodEnvironment],\n    ['devEnvironment', p.devEnvironment],\n    ['d1', p.d1],\n    ['r2', p.r2],\n    ...Object.entries(p.secrets).map(([name, s]) => [`secret:${name}`, s] as [string, StepPlan]),\n  ];\n  return named\n    .filter(([, s]) => s.action === 'blocked')\n    .map(([name, s]) => ({ name, detail: s.detail }));\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: HostingPlan): string {\n  const glyph = (s: StepPlan) =>\n    s.action === 'skip' ? '·' : s.action === 'blocked' ? '?' : s.action === 'update' ? '~' : '+';\n  const lines: string[] = [];\n  lines.push(`${glyph(p.repo)} repo             ${p.repo.detail}`);\n  lines.push(`${glyph(p.branches)} branches         ${p.branches.detail}`);\n  lines.push(`${glyph(p.defaultBranch)} default branch   ${p.defaultBranch.detail}`);\n  lines.push(`${glyph(p.mainProtection)} main protection  ${p.mainProtection.detail}`);\n  lines.push(`${glyph(p.prodEnvironment)} production env   ${p.prodEnvironment.detail}`);\n  lines.push(`${glyph(p.devEnvironment)} dev env          ${p.devEnvironment.detail}`);\n  lines.push(`${glyph(p.d1)} dev D1           ${p.d1.detail}`);\n  lines.push(`${glyph(p.r2)} dev R2           ${p.r2.detail}`);\n  for (const [name, s] of Object.entries(p.secrets))\n    lines.push(`${glyph(s)} secret ${name}${' '.repeat(Math.max(1, 11 - name.length))}${s.detail}`);\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one run, for the summary table. */\nexport interface HostingResult {\n  step: string;\n  status: 'created' | 'updated' | 'present' | 'blocked' | 'failed';\n  detail: string;\n}\n\n/** Render the end-of-run summary: one row per step, plus blocked reminders. */\nexport function formatSummary(results: HostingResult[]): string {\n  const headers = ['STEP', 'STATUS', 'DETAIL'];\n  const rows = results.map((r) => [r.step, r.status, r.detail]);\n  const reminders = results\n    .filter((r) => r.status === 'blocked')\n    .map((r) => `  ! ${r.step}: ${r.detail}`);\n  return table(headers, rows, reminders);\n}\n\n/**\n * Plan the domain-consistency check on its own — it has no executor, only an\n * observation (`wrangler.jsonc` + the config), and it is never applied by this\n * command. See `SETUP.html`'s \"Domain strategy\" stage: the actual cutover is a\n * human, deliberate action.\n */\nexport function planDomainConsistency(state: DomainState): StepPlan {\n  const cutover = Boolean(state.customDomain);\n  if (cutover) {\n    if (!state.canonical || state.canonical !== `https://${state.customDomain}`)\n      return {\n        action: 'blocked',\n        detail: `wrangler.jsonc names a custom domain (${state.customDomain}) but site.domains.canonical doesn't match — a visitor sees the new site while <link rel=canonical> still points at the old one`,\n      };\n    if (state.robots?.includes('noindex'))\n      return {\n        action: 'blocked',\n        detail:\n          'custom domain is live but robots is still \"noindex,nofollow\" — flip it back after cutover',\n      };\n    return { action: 'skip', detail: 'custom domain configured and consistent' };\n  }\n  if (!state.robots?.includes('noindex'))\n    return {\n      action: 'blocked',\n      detail:\n        'still on *.workers.dev but robots does not say \"noindex,nofollow\" — a workers.dev URL is indexable, and this is what stops search engines treating it as a duplicate of the real site',\n    };\n  return { action: 'skip', detail: 'workers.dev phase, correctly noindexed' };\n}\n","/**\n * Cloudflare resources — dev D1 + R2, plus the account id. Executes a plan and\n * decides nothing; every observation and mutation is a structured result, never a\n * throw, so the CLI decides what a failure means.\n *\n * Shells out to `wrangler` and reads `gh`'s account-id output — there is no REST\n * alternative that doesn't also need the same credential wrangler already holds\n * from `wrangler login`. Same class of executor as `@getvitops/utils/media`\n * shelling to `ffmpeg`: an external tool, not an npm dependency, with `execImpl`\n * injected so the parsing is testable without a real Cloudflare account.\n */\nimport { execFile } from 'node:child_process';\nimport { promisify } from 'node:util';\n\nconst exec = promisify(execFile);\n\nexport interface ExecResult {\n  ok: boolean;\n  stdout: string;\n  message?: string | undefined;\n}\n\nexport type ExecImpl = (cmd: string, args: string[]) => Promise<ExecResult>;\n\n/** The real executor — `execFile` with an argv array, never a shell string. */\nexport const realExec: ExecImpl = async (cmd, args) => {\n  try {\n    const { stdout } = await exec(cmd, args, { maxBuffer: 16 * 1024 * 1024 });\n    return { ok: true, stdout };\n  } catch (err) {\n    const e = err as { stdout?: string; stderr?: string; message?: string };\n    return {\n      ok: false,\n      stdout: e.stdout ?? '',\n      message: e.stderr || e.message || 'command failed',\n    };\n  }\n};\n\n/** `wrangler whoami` — auth check + the 32-hex account id, from one call. */\nexport async function wranglerWhoami(\n  execImpl: ExecImpl = realExec,\n): Promise<{ authed: boolean; accountId?: string }> {\n  const res = await execImpl('npx', ['wrangler', 'whoami']);\n  if (!res.ok) return { authed: false };\n  const accountId = /\\b([0-9a-f]{32})\\b/.exec(res.stdout)?.[1];\n  return { authed: true, ...(accountId ? { accountId } : {}) };\n}\n\n/**\n * Find an existing dev D1 database's id by name.\n *\n * `d1 create`'s own stdout carries the id, but its format has drifted across\n * wrangler versions before — a re-list is the one thing guaranteed to still hold\n * the answer, so both the \"does it exist\" check and the post-create fallback go\n * through this.\n */\nexport async function findD1(\n  name: string,\n  execImpl: ExecImpl = realExec,\n): Promise<string | undefined> {\n  const res = await execImpl('npx', ['wrangler', 'd1', 'list', '--json']);\n  if (!res.ok) return undefined;\n  try {\n    const list = JSON.parse(res.stdout) as { name: string; uuid: string }[];\n    return list.find((d) => d.name === name)?.uuid;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Create a dev D1 database, then resolve its id via `findD1` (see its docblock). */\nexport async function createD1(\n  name: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; id?: string | undefined; message?: string | undefined }> {\n  const res = await execImpl('npx', ['wrangler', 'd1', 'create', name]);\n  if (!res.ok) return { ok: false, message: res.message };\n  const inline = /\"database_id\":\\s*\"([0-9a-f-]{36})\"/.exec(res.stdout)?.[1];\n  const id = inline ?? (await findD1(name, execImpl));\n  if (!id) return { ok: false, message: 'created, but could not determine the database id' };\n  return { ok: true, id };\n}\n\nexport async function findR2Bucket(name: string, execImpl: ExecImpl = realExec): Promise<boolean> {\n  const res = await execImpl('npx', ['wrangler', 'r2', 'bucket', 'list']);\n  if (!res.ok) return false;\n  return new RegExp(`name:\\\\s+${name}\\\\s*$`, 'm').test(res.stdout);\n}\n\nexport async function createR2Bucket(\n  name: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('npx', ['wrangler', 'r2', 'bucket', 'create', name]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n","/**\n * GitHub repo, branches, environments and secrets. Executes a plan and decides\n * nothing — see `wrangler.ts`'s docblock for why this shells out (`gh` carries the\n * auth; there is no token-free REST alternative) and for the `execImpl` seam.\n *\n * Absorbs the behaviour of the templates' old `scripts/init-github.mjs`:\n * `dev` is left with **no required reviewers**, deliberately — that is what keeps\n * it the unprotected integration branch. `main` protection and the `production`\n * environment's reviewer policy both 403 on a private repo without GitHub\n * Pro/Team; that is reported as `blocked`, not `failed` — see `plan.ts`.\n */\nimport type { ExecImpl } from './wrangler.ts';\nimport { realExec } from './wrangler.ts';\n\nexport async function ghAuthed(execImpl: ExecImpl = realExec): Promise<boolean> {\n  return (await execImpl('gh', ['auth', 'status'])).ok;\n}\n\nexport async function originRemote(execImpl: ExecImpl = realExec): Promise<string | undefined> {\n  const res = await execImpl('git', ['remote', 'get-url', 'origin']);\n  return res.ok ? res.stdout.trim() : undefined;\n}\n\nexport async function repoNwo(execImpl: ExecImpl = realExec): Promise<string | undefined> {\n  const res = await execImpl('gh', ['repo', 'view', '--json', 'nameWithOwner']);\n  if (!res.ok) return undefined;\n  try {\n    return (JSON.parse(res.stdout) as { nameWithOwner: string }).nameWithOwner;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function branches(execImpl: ExecImpl = realExec): Promise<string[]> {\n  const res = await execImpl('git', ['branch', '--list', '--format=%(refname:short)']);\n  if (!res.ok) return [];\n  return res.stdout\n    .split('\\n')\n    .map((l) => l.trim())\n    .filter(Boolean);\n}\n\nexport async function defaultBranch(\n  nwo: string,\n  execImpl: ExecImpl = realExec,\n): Promise<string | undefined> {\n  const res = await execImpl('gh', ['repo', 'view', nwo, '--json', 'defaultBranchRef']);\n  if (!res.ok) return undefined;\n  try {\n    return (JSON.parse(res.stdout) as { defaultBranchRef?: { name: string } }).defaultBranchRef\n      ?.name;\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function mainProtected(nwo: string, execImpl: ExecImpl = realExec): Promise<boolean> {\n  return (await execImpl('gh', ['api', `repos/${nwo}/branches/main/protection`])).ok;\n}\n\nexport async function environments(nwo: string, execImpl: ExecImpl = realExec): Promise<string[]> {\n  const res = await execImpl('gh', ['api', `repos/${nwo}/environments`]);\n  if (!res.ok) return [];\n  try {\n    return (\n      (JSON.parse(res.stdout) as { environments?: { name: string }[] }).environments ?? []\n    ).map((e) => e.name);\n  } catch {\n    return [];\n  }\n}\n\nexport async function secretsPresent(\n  nwo: string,\n  execImpl: ExecImpl = realExec,\n): Promise<string[]> {\n  const res = await execImpl('gh', ['api', `repos/${nwo}/actions/secrets`]);\n  if (!res.ok) return [];\n  try {\n    return ((JSON.parse(res.stdout) as { secrets?: { name: string }[] }).secrets ?? []).map(\n      (s) => s.name,\n    );\n  } catch {\n    return [];\n  }\n}\n\n// ── Mutations ─────────────────────────────────────────────────────────────────\n\nexport async function createRepo(\n  name: string,\n  visibility: 'public' | 'private',\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', [\n    'repo',\n    'create',\n    name,\n    `--${visibility}`,\n    '--source=.',\n    '--remote=origin',\n  ]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\nexport async function pushBranches(\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('git', ['push', '-u', 'origin', 'main', 'dev']);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\nexport async function setDefaultBranch(\n  nwo: string,\n  branch: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', ['repo', 'edit', nwo, `--default-branch=${branch}`]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\n/**\n * `PUT .../branches/main/protection`. A 403 on Pro/Team-gated repos is expected.\n *\n * Every field goes through `gh api`'s `-f`/`-F` form flags rather than a JSON body\n * on stdin — `gh api` supports nested keys (`a[b]=c`) and repeated array keys\n * (`a[]=x`) this way, so no request needs a second I/O channel `ExecImpl` would\n * have to carry just for this one call.\n */\nexport async function protectMain(\n  nwo: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', [\n    'api',\n    '--method',\n    'PUT',\n    `repos/${nwo}/branches/main/protection`,\n    '-F',\n    'required_status_checks[strict]=true',\n    '-f',\n    'required_status_checks[contexts][]=ci',\n    '-F',\n    'enforce_admins=false',\n    '-F',\n    'required_pull_request_reviews[required_approving_review_count]=1',\n    '-F',\n    'restrictions=null',\n    '-F',\n    'allow_force_pushes=false',\n    '-F',\n    'allow_deletions=false',\n  ]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\n/** The repo's admin collaborators — numeric user ids, which is what the\n * environment-reviewers API wants (not logins). */\nexport async function adminCollaboratorIds(\n  nwo: string,\n  execImpl: ExecImpl = realExec,\n): Promise<number[]> {\n  const res = await execImpl('gh', ['api', `repos/${nwo}/collaborators?permission=admin`]);\n  if (!res.ok) return [];\n  try {\n    return (JSON.parse(res.stdout) as { id: number }[]).map((c) => c.id);\n  } catch {\n    return [];\n  }\n}\n\n/** `PUT .../environments/production`, reviewers = current admin collaborators. */\nexport async function createProdEnvironment(\n  nwo: string,\n  reviewerUserIds: number[],\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', [\n    'api',\n    '--method',\n    'PUT',\n    `repos/${nwo}/environments/production`,\n    '-f',\n    `deployment_branch_policy[protected_branches]=true`,\n    '-f',\n    `deployment_branch_policy[custom_branch_policies]=false`,\n    ...reviewerUserIds.flatMap((id) => [\n      '-F',\n      `reviewers[][id]=${id}`,\n      '-f',\n      'reviewers[][type]=User',\n    ]),\n  ]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\n/** `PUT .../environments/dev` with no reviewers — deliberately left open. */\nexport async function createDevEnvironment(\n  nwo: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', ['api', '--method', 'PUT', `repos/${nwo}/environments/dev`]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n\nexport async function setSecret(\n  name: string,\n  value: string,\n  execImpl: ExecImpl = realExec,\n): Promise<{ ok: boolean; message?: string | undefined }> {\n  const res = await execImpl('gh', ['secret', 'set', name, '--body', value]);\n  return res.ok ? { ok: true } : { ok: false, message: res.message };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,MAAM,eAAe,UACnB,MAAM,aAAa,eACf;CAAC;CAAa;CAAyB;AAAsB,IAC7D,CAAC;;AAGP,SAAgB,KAAK,OAAqB,OAAkC;CAC1E,MAAM,QAAkB,CAAC;CAEzB,MAAM,OACJ,MAAM,gBAAgB,MAAM,UACxB;EAAE,QAAQ;EAAQ,QAAQ,wBAAwB,MAAM,QAAQ;CAAG,IACnE;EACE,QAAQ;EACR,QAAQ,uBAAuB,MAAM,YAAY,KAAK,MAAM,eAAe;CAC7E;CAEN,MAAM,WACJ,MAAM,SAAS,SAAS,MAAM,KAAK,MAAM,SAAS,SAAS,KAAK,IAC5D;EAAE,QAAQ;EAAQ,QAAQ;CAA2B,IACrD;EAAE,QAAQ;EAAU,QAAQ;CAAkB;CAEpD,MAAM,gBACJ,MAAM,kBAAkB,QACpB;EAAE,QAAQ;EAAQ,QAAQ;CAAoC,IAC9D;EAAE,QAAQ;EAAU,QAAQ;CAA8B;CAEhE,MAAM,iBAA2B,MAAM,gBACnC;EAAE,QAAQ;EAAQ,QAAQ;CAA4B,IACtD;EACE,QAAQ;EACR,QACE;CAEJ;CAEJ,MAAM,kBAA4B,MAAM,aAAa,SAAS,YAAY,IACtE;EAAE,QAAQ;EAAQ,QAAQ;CAAwC,IAClE;EACE,QAAQ;EACR,QACE;CAEJ;CAEJ,MAAM,iBAA2B,MAAM,aAAa,SAAS,KAAK,IAC9D;EAAE,QAAQ;EAAQ,QAAQ;CAAiC,IAC3D;EACE,QAAQ;EACR,QAAQ;CACV;CAEJ,MAAM,KACJ,MAAM,aAAa,gBAAgB,CAAC,MAAM,eACtC;EAAE,QAAQ;EAAQ,QAAQ;CAA2D,IACrF,MAAM,YACJ;EAAE,QAAQ;EAAQ,QAAQ,0BAA0B,MAAM,QAAQ,aAAa;CAAG,IAClF;EAAE,QAAQ;EAAU,QAAQ,uBAAuB,MAAM,YAAY;CAAO;CAEpF,MAAM,KACJ,MAAM,aAAa,gBAAgB,CAAC,MAAM,eACtC;EAAE,QAAQ;EAAQ,QAAQ;CAA2D,IACrF,MAAM,YACJ;EAAE,QAAQ;EAAQ,QAAQ;CAA+B,IACzD;EAAE,QAAQ;EAAU,QAAQ,qBAAqB,MAAM,YAAY;CAAa;CAExF,MAAM,UAAoC,CAAC;CAC3C,KAAK,MAAM,QAAQ,YAAY,KAAK,GAAG;EACrC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,cAAc;GAC1C,QAAQ,QAAQ;IACd,QAAQ;IACR,QAAQ;GACV;GACA;EACF;EACA,IAAI,MAAM,eAAe,SAAS,IAAI,GAAG;GACvC,QAAQ,QAAQ;IAAE,QAAQ;IAAQ,QAAQ;GAAc;GACxD;EACF;EACA,IAAI,SAAS,wBAAwB;GACnC,QAAQ,QAAQ;IACd,QAAQ;IACR,QACE;GAGJ;GACA;EACF;EAOA,QAAQ,SALN,SAAS,cACL,MAAM,OACN,SAAS,0BACP,MAAM,YACN,UAEJ;GAAE,QAAQ;GAAU,QAAQ;EAAsC,IAClE;GAAE,QAAQ;GAAW,QAAQ;EAAqD;CACxF;CAEA,IAAI,CAAC,MAAM,kBAAkB,MAAM,aAAa,gBAAgB,MAAM,cACpE,MAAM,KAAK,4DAA4D;CACzE,IAAI,CAAC,MAAM,UAAU,MAAM,KAAK,iDAAiD;CAEjF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAM,YAAY,MAA+B;CAC/C,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,GAAG,OAAO,OAAO,EAAE,OAAO;AAC5B;;AAGA,SAAgB,SAAS,GAAyB;CAChD,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,WAAW,MAAM;AACpD;;AAGA,SAAgB,aAAa,GAAoD;CAY/E,OAAO;EAVL,CAAC,QAAQ,EAAE,IAAI;EACf,CAAC,YAAY,EAAE,QAAQ;EACvB,CAAC,iBAAiB,EAAE,aAAa;EACjC,CAAC,kBAAkB,EAAE,cAAc;EACnC,CAAC,mBAAmB,EAAE,eAAe;EACrC,CAAC,kBAAkB,EAAE,cAAc;EACnC,CAAC,MAAM,EAAE,EAAE;EACX,CAAC,MAAM,EAAE,EAAE;EACX,GAAG,OAAO,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,UAAU,QAAQ,CAAC,CAAuB;CAElF,CAAC,CACT,QAAQ,GAAG,OAAO,EAAE,WAAW,SAAS,CAAC,CACzC,KAAK,CAAC,MAAM,QAAQ;EAAE;EAAM,QAAQ,EAAE;CAAO,EAAE;AACpD;;AAGA,SAAgB,WAAW,GAAwB;CACjD,MAAM,SAAS,MACb,EAAE,WAAW,SAAS,MAAM,EAAE,WAAW,YAAY,MAAM,EAAE,WAAW,WAAW,MAAM;CAC3F,MAAM,QAAkB,CAAC;CACzB,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,QAAQ;CAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,SAAS,QAAQ;CACvE,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,QAAQ;CACjF,MAAM,KAAK,GAAG,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,QAAQ;CACnF,MAAM,KAAK,GAAG,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,QAAQ;CACrF,MAAM,KAAK,GAAG,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,QAAQ;CACnF,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,EAAE,oBAAoB,EAAE,GAAG,QAAQ;CAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,EAAE,oBAAoB,EAAE,GAAG,QAAQ;CAC3D,KAAK,MAAM,CAAC,MAAM,MAAM,OAAO,QAAQ,EAAE,OAAO,GAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,UAAU,OAAO,IAAI,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ;CAChG,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAUA,SAAgB,cAAc,SAAkC;CAC9D,MAAM,UAAU;EAAC;EAAQ;EAAU;CAAQ;CAC3C,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAM,EAAE;EAAQ,EAAE;CAAM,CAAC;CAC5D,MAAM,YAAY,QACf,QAAQ,MAAM,EAAE,WAAW,SAAS,CAAC,CACrC,KAAK,MAAM,OAAO,EAAE,KAAK,IAAI,EAAE,QAAQ;CAC1C,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC;;;;;;;AAQA,SAAgB,sBAAsB,OAA8B;CAElE,IADgB,QAAQ,MAAM,YACpB,GAAG;EACX,IAAI,CAAC,MAAM,aAAa,MAAM,cAAc,WAAW,MAAM,gBAC3D,OAAO;GACL,QAAQ;GACR,QAAQ,yCAAyC,MAAM,aAAa;EACtE;EACF,IAAI,MAAM,QAAQ,SAAS,SAAS,GAClC,OAAO;GACL,QAAQ;GACR,QACE;EACJ;EACF,OAAO;GAAE,QAAQ;GAAQ,QAAQ;EAA0C;CAC7E;CACA,IAAI,CAAC,MAAM,QAAQ,SAAS,SAAS,GACnC,OAAO;EACL,QAAQ;EACR,QACE;CACJ;CACF,OAAO;EAAE,QAAQ;EAAQ,QAAQ;CAAyC;AAC5E;;;;;;;;;;;;;;;ACxPA,MAAM,OAAO,UAAU,QAAQ;;AAW/B,MAAa,WAAqB,OAAO,KAAK,SAAS;CACrD,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,KAAK,MAAM,EAAE,WAAW,SAAiB,CAAC;EACxE,OAAO;GAAE,IAAI;GAAM;EAAO;CAC5B,SAAS,KAAK;EACZ,MAAM,IAAI;EACV,OAAO;GACL,IAAI;GACJ,QAAQ,EAAE,UAAU;GACpB,SAAS,EAAE,UAAU,EAAE,WAAW;EACpC;CACF;AACF;;AAGA,eAAsB,eACpB,WAAqB,UAC6B;CAClD,MAAM,MAAM,MAAM,SAAS,OAAO,CAAC,YAAY,QAAQ,CAAC;CACxD,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,QAAQ,MAAM;CACpC,MAAM,YAAY,qBAAqB,KAAK,IAAI,MAAM,CAAC,GAAG;CAC1D,OAAO;EAAE,QAAQ;EAAM,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC7D;;;;;;;;;AAUA,eAAsB,OACpB,MACA,WAAqB,UACQ;CAC7B,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAY;EAAM;EAAQ;CAAQ,CAAC;CACtE,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,IAAI;EAEF,OADa,KAAK,MAAM,IAAI,MAClB,CAAC,CAAC,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CAC5C,QAAQ;EACN;CACF;AACF;;AAGA,eAAsB,SACpB,MACA,WAAqB,UAC4D;CACjF,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAY;EAAM;EAAU;CAAI,CAAC;CACpE,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;CAEtD,MAAM,KADS,qCAAqC,KAAK,IAAI,MAAM,CAAC,GAAG,MACjD,MAAM,OAAO,MAAM,QAAQ;CACjD,IAAI,CAAC,IAAI,OAAO;EAAE,IAAI;EAAO,SAAS;CAAmD;CACzF,OAAO;EAAE,IAAI;EAAM;CAAG;AACxB;AAEA,eAAsB,aAAa,MAAc,WAAqB,UAA4B;CAChG,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAY;EAAM;EAAU;CAAM,CAAC;CACtE,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,OAAO,IAAI,OAAO,YAAY,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM;AACjE;AAEA,eAAsB,eACpB,MACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAY;EAAM;EAAU;EAAU;CAAI,CAAC;CAC9E,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;;;;AClFA,eAAsB,SAAS,WAAqB,UAA4B;CAC9E,QAAQ,MAAM,SAAS,MAAM,CAAC,QAAQ,QAAQ,CAAC,EAAC,CAAE;AACpD;AAEA,eAAsB,aAAa,WAAqB,UAAuC;CAC7F,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAU;EAAW;CAAQ,CAAC;CACjE,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI;AACtC;AAEA,eAAsB,QAAQ,WAAqB,UAAuC;CACxF,MAAM,MAAM,MAAM,SAAS,MAAM;EAAC;EAAQ;EAAQ;EAAU;CAAe,CAAC;CAC5E,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,IAAI;EACF,OAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,CAA+B;CAC/D,QAAQ;EACN;CACF;AACF;AAEA,eAAsB,SAAS,WAAqB,UAA6B;CAC/E,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAU;EAAU;CAA2B,CAAC;CACnF,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;CACrB,OAAO,IAAI,OACR,MAAM,IAAI,CAAC,CACX,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;AACnB;AAEA,eAAsB,cACpB,KACA,WAAqB,UACQ;CAC7B,MAAM,MAAM,MAAM,SAAS,MAAM;EAAC;EAAQ;EAAQ;EAAK;EAAU;CAAkB,CAAC;CACpF,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,IAAI;EACF,OAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,CAA6C,kBACvE;CACN,QAAQ;EACN;CACF;AACF;AAEA,eAAsB,cAAc,KAAa,WAAqB,UAA4B;CAChG,QAAQ,MAAM,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,0BAA0B,CAAC,EAAC,CAAE;AAClF;AAEA,eAAsB,aAAa,KAAa,WAAqB,UAA6B;CAChG,MAAM,MAAM,MAAM,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,cAAc,CAAC;CACrE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;CACrB,IAAI;EACF,QACG,KAAK,MAAM,IAAI,MAAM,CAAC,CAA2C,gBAAgB,CAAC,EAAC,CACpF,KAAK,MAAM,EAAE,IAAI;CACrB,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,eAAsB,eACpB,KACA,WAAqB,UACF;CACnB,MAAM,MAAM,MAAM,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,iBAAiB,CAAC;CACxE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;CACrB,IAAI;EACF,QAAS,KAAK,MAAM,IAAI,MAAM,CAAC,CAAsC,WAAW,CAAC,EAAC,CAAE,KACjF,MAAM,EAAE,IACX;CACF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAIA,eAAsB,WACpB,MACA,YACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAC/B;EACA;EACA;EACA,KAAK;EACL;EACA;CACF,CAAC;CACD,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;AAEA,eAAsB,aACpB,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,OAAO;EAAC;EAAQ;EAAM;EAAU;EAAQ;CAAK,CAAC;CACzE,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;AAEA,eAAsB,iBACpB,KACA,QACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAAC;EAAQ;EAAQ;EAAK,oBAAoB;CAAQ,CAAC;CACpF,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;;;;;;;;;AAUA,eAAsB,YACpB,KACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAC/B;EACA;EACA;EACA,SAAS,IAAI;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;;;AAIA,eAAsB,qBACpB,KACA,WAAqB,UACF;CACnB,MAAM,MAAM,MAAM,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,gCAAgC,CAAC;CACvF,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;CACrB,IAAI;EACF,OAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,CAAsB,KAAK,MAAM,EAAE,EAAE;CACrE,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;AAGA,eAAsB,sBACpB,KACA,iBACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAC/B;EACA;EACA;EACA,SAAS,IAAI;EACb;EACA;EACA;EACA;EACA,GAAG,gBAAgB,SAAS,OAAO;GACjC;GACA,mBAAmB;GACnB;GACA;EACF,CAAC;CACH,CAAC;CACD,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;;AAGA,eAAsB,qBACpB,KACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAAC;EAAO;EAAY;EAAO,SAAS,IAAI;CAAkB,CAAC;CAC5F,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE;AAEA,eAAsB,UACpB,MACA,OACA,WAAqB,UACmC;CACxD,MAAM,MAAM,MAAM,SAAS,MAAM;EAAC;EAAU;EAAO;EAAM;EAAU;CAAK,CAAC;CACzE,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI;EAAE,IAAI;EAAO,SAAS,IAAI;CAAQ;AACnE"}

package/dist/identity-BoRddTx3.mjs

@@ -0,0 +1,35 @@
+//#region src/tracking/identity.ts
+function first(formData, ...keys) {
+	for (const k of keys) {
+		const v = formData[k]?.trim();
+		if (v) return v;
+	}
+}
+function identifySubmitter(formData) {
+	const fullNameField = first(formData, "name", "full_name", "fullName", "fullname", "your-name");
+	const firstName = first(formData, "first_name", "firstName", "firstname", "given_name");
+	const lastName = first(formData, "last_name", "lastName", "lastname", "family_name", "surname");
+	const email = first(formData, "email", "email_address", "emailAddress");
+	const phone = first(formData, "phone", "phone_number", "phoneNumber", "tel");
+	const company = first(formData, "company", "company_name", "organization", "business");
+	let derivedFirst = firstName;
+	let derivedLast = lastName;
+	if (!derivedFirst && !derivedLast && fullNameField) {
+		const parts = fullNameField.split(/\s+/);
+		derivedFirst = parts[0];
+		derivedLast = parts.slice(1).join(" ") || void 0;
+	}
+	const joined = [firstName, lastName].filter(Boolean).join(" ");
+	return {
+		firstName: derivedFirst,
+		lastName: derivedLast,
+		fullName: fullNameField || joined || email || "Unknown",
+		email,
+		phone,
+		company
+	};
+}
+
+//#endregion
+export { identifySubmitter as t };
+//# sourceMappingURL=identity-BoRddTx3.mjs.map

package/dist/identity-BoRddTx3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-BoRddTx3.mjs","names":[],"sources":["../src/tracking/identity.ts"],"sourcesContent":["/**\n * Pulling a submitter's identity out of a form's fields.\n *\n * Extracted from `notify/render.ts`'s `submitterName()`, which needed only the\n * display name for a subject line. `crm/map.ts` needs the whole set — first\n * name, last name, email, phone, company — to fill a CRM record, and a form's\n * field names vary the same way `submitterName()` already accounted for\n * (`name` vs `first_name`/`last_name` vs neither). Two independent cascades\n * over the same handful of aliases is exactly the failure `render.ts`'s own\n * comment records: a downstream site had five of six forms carrying\n * `first_name`/`last_name`, and a cascade that only checked `name` read every\n * one of them as \"Unknown\". Keep this the one place that knows the aliases;\n * `submitterName()` and `crm/map.ts` both delegate to it.\n */\n\nexport interface SubmitterIdentity {\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  /** The best available display name — a submitted full name, first + last\n   * joined, or the email address as a last resort. Never empty. */\n  fullName: string;\n  email?: string | undefined;\n  phone?: string | undefined;\n  company?: string | undefined;\n}\n\nfunction first(formData: Record<string, string>, ...keys: string[]): string | undefined {\n  for (const k of keys) {\n    const v = formData[k]?.trim();\n    if (v) return v;\n  }\n  return undefined;\n}\n\nexport function identifySubmitter(formData: Record<string, string>): SubmitterIdentity {\n  const fullNameField = first(formData, 'name', 'full_name', 'fullName', 'fullname', 'your-name');\n  const firstName = first(formData, 'first_name', 'firstName', 'firstname', 'given_name');\n  const lastName = first(formData, 'last_name', 'lastName', 'lastname', 'family_name', 'surname');\n  const email = first(formData, 'email', 'email_address', 'emailAddress');\n  const phone = first(formData, 'phone', 'phone_number', 'phoneNumber', 'tel');\n  const company = first(formData, 'company', 'company_name', 'organization', 'business');\n\n  let derivedFirst = firstName;\n  let derivedLast = lastName;\n  if (!derivedFirst && !derivedLast && fullNameField) {\n    const parts = fullNameField.split(/\\s+/);\n    derivedFirst = parts[0];\n    derivedLast = parts.slice(1).join(' ') || undefined;\n  }\n\n  const joined = [firstName, lastName].filter(Boolean).join(' ');\n  const fullName = fullNameField || joined || email || 'Unknown';\n\n  return {\n    firstName: derivedFirst,\n    lastName: derivedLast,\n    fullName,\n    email,\n    phone,\n    company,\n  };\n}\n"],"mappings":";AA0BA,SAAS,MAAM,UAAkC,GAAG,MAAoC;CACtF,KAAK,MAAM,KAAK,MAAM;EACpB,MAAM,IAAI,SAAS,EAAE,EAAE,KAAK;EAC5B,IAAI,GAAG,OAAO;CAChB;AAEF;AAEA,SAAgB,kBAAkB,UAAqD;CACrF,MAAM,gBAAgB,MAAM,UAAU,QAAQ,aAAa,YAAY,YAAY,WAAW;CAC9F,MAAM,YAAY,MAAM,UAAU,cAAc,aAAa,aAAa,YAAY;CACtF,MAAM,WAAW,MAAM,UAAU,aAAa,YAAY,YAAY,eAAe,SAAS;CAC9F,MAAM,QAAQ,MAAM,UAAU,SAAS,iBAAiB,cAAc;CACtE,MAAM,QAAQ,MAAM,UAAU,SAAS,gBAAgB,eAAe,KAAK;CAC3E,MAAM,UAAU,MAAM,UAAU,WAAW,gBAAgB,gBAAgB,UAAU;CAErF,IAAI,eAAe;CACnB,IAAI,cAAc;CAClB,IAAI,CAAC,gBAAgB,CAAC,eAAe,eAAe;EAClD,MAAM,QAAQ,cAAc,MAAM,KAAK;EACvC,eAAe,MAAM;EACrB,cAAc,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK;CAC5C;CAEA,MAAM,SAAS,CAAC,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CAG7D,OAAO;EACL,WAAW;EACX,UAAU;EACV,UALe,iBAAiB,UAAU,SAAS;EAMnD;EACA;EACA;CACF;AACF"}