@getvitops/utils 8.1.0 → 8.2.0-alpha.0

package/dist/notify/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/notify/email.ts","../../src/notify/plan.ts","../../src/notify/render.ts","../../src/notify/index.ts"],"sourcesContent":["/**\n * The e-mail channel — Cloudflare Email Sending.\n *\n * I/O only: it executes an `EmailPlan` and decides nothing. Whether to send, to\n * whom, and from where were all settled in `plan.ts`.\n *\n * **The binding is passed in, never imported.** `@getvitops/utils` does not depend\n * on `cloudflare:workers`, so this module runs in Node and in a test with a stub,\n * and the Astro package gains no Cloudflare coupling. The consumer's route hands\n * over `env.EMAIL`.\n *\n * Uses the current Email Sending binding — a structured `send({ to, from,\n * subject, html, text })` — not the legacy `EmailMessage` + hand-built MIME path.\n * The domain in `from` must have been onboarded (`wrangler email sending enable\n * <domain>`); nothing here can check that, which is why `E_SENDER_NOT_VERIFIED`\n * is surfaced verbatim rather than collapsed into \"send failed\".\n */\nimport type { RenderedMessage } from './types.ts';\nimport type { ChannelResult, EmailBinding, EmailPlan } from './types.ts';\n\n/**\n * Provider errors worth retrying.\n *\n * Everything else is a configuration fault — an unverified sender, a malformed\n * payload, a suppressed recipient — where a retry is pure latency and the send\n * will fail identically. Retrying those also burns the daily quota.\n */\nconst RETRYABLE = new Set([\n  'E_RATE_LIMIT_EXCEEDED',\n  'E_DELIVERY_FAILED',\n  'E_INTERNAL_SERVER_ERROR',\n]);\n\nfunction codeOf(error: unknown): string | undefined {\n  const code = (error as { code?: unknown } | null)?.code;\n  return typeof code === 'string' ? code : undefined;\n}\n\nfunction messageOf(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nexport interface SendEmailOptions {\n  /** Attempts for a retryable failure (default 3). */\n  attempts?: number;\n  /**\n   * Per-attempt ceiling in milliseconds (default 10000; `0` disables).\n   *\n   * `binding.send()` is a network call with no deadline of its own, so without\n   * this one hung attempt hangs the request that produced it — forever, in the\n   * one module otherwise built on always saying why. A conversion endpoint\n   * cannot be the thing that makes a form submission time out, so the bound\n   * belongs here rather than in every consumer's wrapper.\n   *\n   * A timeout is treated as retryable: it is a transient condition by\n   * definition, unlike `E_SENDER_NOT_VERIFIED` and friends.\n   */\n  timeoutMs?: number;\n  /** Injected for tests; real callers let it default to a real delay. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\nconst wait = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\n/** Marker for a send that exceeded its deadline, so the retry rule can see it. */\nconst TIMEOUT_CODE = 'E_SEND_TIMEOUT';\n\n/**\n * Race a send against its deadline.\n *\n * The timer is always cleared — a pending `setTimeout` keeps a Worker's event\n * loop alive past the response, which turns a bounded send into an unbounded\n * invocation and bills for the difference.\n */\nasync function withTimeout<T>(work: Promise<T>, ms: number): Promise<T> {\n  if (ms <= 0) return work;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      work,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          const err = new Error(`Email send exceeded ${ms}ms.`) as Error & { code: string };\n          err.code = TIMEOUT_CODE;\n          reject(err);\n        }, ms);\n      }),\n    ]);\n  } finally {\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n\n/**\n * Send one rendered message according to a plan.\n *\n * Never throws: a failed notification must not take down the request that\n * produced it. The visitor has already submitted their form, and failing their\n * response because our mail didn't go out would turn a lost notification into a\n * lost conversion. The failure is returned instead, for the caller to log.\n */\nexport async function sendEmail(\n  plan: EmailPlan,\n  message: RenderedMessage,\n  binding: EmailBinding,\n  options: SendEmailOptions = {},\n): Promise<ChannelResult> {\n  if (!plan.enabled || !plan.to || !plan.from) {\n    return { channel: 'email', sent: false, reason: plan.skip ?? 'Channel not enabled.' };\n  }\n\n  const attempts = Math.max(1, options.attempts ?? 3);\n  const sleep = options.sleep ?? wait;\n  const timeoutMs = options.timeoutMs ?? 10_000;\n\n  for (let attempt = 1; attempt <= attempts; attempt++) {\n    try {\n      await withTimeout(\n        binding.send({\n          to: plan.to,\n          from: plan.fromName ? { email: plan.from, name: plan.fromName } : { email: plan.from },\n          subject: message.subject,\n          text: message.text,\n          html: message.html,\n          ...(plan.replyTo ? { replyTo: plan.replyTo } : {}),\n        }),\n        timeoutMs,\n      );\n      return { channel: 'email', sent: true };\n    } catch (error) {\n      const code = codeOf(error);\n      if (attempt === attempts || !code || !(RETRYABLE.has(code) || code === TIMEOUT_CODE)) {\n        return {\n          channel: 'email',\n          sent: false,\n          reason: messageOf(error),\n          ...(code ? { code } : {}),\n        };\n      }\n      // Exponential backoff. Cloudflare's rate limit is per-account, so a burst\n      // of conversions retrying in lockstep would keep colliding.\n      await sleep(2 ** (attempt - 1) * 250);\n    }\n  }\n\n  /* c8 ignore next -- the loop always returns; this satisfies the type checker. */\n  return { channel: 'email', sent: false, reason: 'Exhausted attempts.' };\n}\n\n/**\n * Print the message instead of sending it.\n *\n * The dev path, for a machine with no binding. Explicit rather than a silent\n * no-op, because \"I never saw the notification\" is the symptom of both a broken\n * integration and a working one nobody could observe.\n */\nexport function logEmail(\n  plan: EmailPlan,\n  message: RenderedMessage,\n  log: (line: string) => void = console.log,\n): ChannelResult {\n  log(\n    [\n      '\\n========== NOTIFICATION EMAIL (not sent — no binding) ==========',\n      `To: ${plan.to ?? '(unresolved)'}`,\n      `From: ${plan.from ?? '(unresolved)'}`,\n      `Subject: ${message.subject}`,\n      '---',\n      message.text,\n      '================================================================\\n',\n    ].join('\\n'),\n  );\n  return { channel: 'email', sent: false, reason: 'No binding — logged to the console.' };\n}\n","/**\n * Every decision a notification makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no binding, no clock. Whether a\n * channel fires, who it reaches, and *why* it was skipped are all decided here and\n * asserted in `plan.test.ts`; the senders beside this file do what they are told\n * and decide nothing. That is the same split `indexing/plan.ts` makes against\n * `gsc.ts`, and `@getvitops/core`'s consent store makes against its DOM wiring,\n * for the same reason: the consequential logic has to be testable without the\n * environment it runs in.\n *\n * The practical payoff is that a misconfigured site can be told exactly what will\n * and won't happen without sending anything — a silently unsent conversion\n * notification is indistinguishable from no conversion.\n */\nimport type { EmailChannelConfig, EmailPlan, NotificationPlan, NotifyContext } from './types.ts';\n\n/** Default Workers binding name for Cloudflare Email Sending. */\nexport const DEFAULT_EMAIL_BINDING = 'EMAIL';\n\n/** Normalise the `email` shorthand: a bare address means a Cloudflare send to it. */\nexport function normalizeEmailChannel(\n  input: string | EmailChannelConfig | undefined,\n): EmailChannelConfig | undefined {\n  if (input === undefined) return undefined;\n  return typeof input === 'string' ? { provider: 'cloudflare', to: input } : input;\n}\n\n/**\n * Who the notification reaches.\n *\n * An explicit recipient wins; otherwise it falls to the site's own contact\n * addresses, primary first. This cascade is why a site that has already said\n * where it receives mail doesn't have to say it twice.\n */\nexport function resolveRecipient(\n  channel: EmailChannelConfig,\n  ctx: NotifyContext,\n): string | undefined {\n  if (channel.to) return channel.to;\n  return ctx.locationEmails?.find((e) => !!e);\n}\n\n/**\n * The From address.\n *\n * `noreply@<canonical>` by default, because the sending domain has to be one the\n * site controls — Cloudflare rejects anything else with `E_SENDER_NOT_VERIFIED`,\n * and guessing from the recipient's domain would send that failure every time.\n */\nexport function resolveSender(channel: EmailChannelConfig, ctx: NotifyContext): string | undefined {\n  if (channel.from) return channel.from;\n  if (!ctx.canonical) return undefined;\n  let host: string;\n  try {\n    host = new URL(ctx.canonical).hostname;\n  } catch {\n    // A bare hostname is a legitimate way to write `domains.canonical`.\n    host = ctx.canonical.replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');\n  }\n  return host ? `noreply@${host}` : undefined;\n}\n\n/**\n * Decide what will be sent, and say why anything won't be.\n *\n * Every \"off\" carries a reason rather than being an absence, so a caller can\n * report the misconfiguration instead of reporting success over a no-op.\n */\nexport function planNotifications(ctx: NotifyContext): NotificationPlan {\n  const email = planEmail(ctx);\n  return { email, empty: !email.enabled };\n}\n\nfunction planEmail(ctx: NotifyContext): EmailPlan {\n  const channel = normalizeEmailChannel(ctx.notifications?.email);\n  const binding = channel?.binding ?? DEFAULT_EMAIL_BINDING;\n\n  if (!channel) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      enabled: false,\n      skip: 'No `notifications.email` configured.',\n    };\n  }\n\n  const to = resolveRecipient(channel, ctx);\n  if (!to) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      enabled: false,\n      skip:\n        'No recipient: set `notifications.email.to`, or give a location an `email` ' +\n        'so the notification has somewhere to go.',\n    };\n  }\n\n  const from = resolveSender(channel, ctx);\n  if (!from) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      to,\n      enabled: false,\n      skip:\n        'No sender: set `notifications.email.from`, or `domains.canonical` so ' +\n        '`noreply@<host>` can be derived. Cloudflare only sends from a domain you have onboarded.',\n    };\n  }\n\n  return {\n    provider: 'cloudflare',\n    binding,\n    to,\n    from,\n    fromName: channel.fromName ?? ctx.organizationName,\n    replyTo: channel.replyTo,\n    enabled: true,\n  };\n}\n","/**\n * Turning a `ConversionEvent` into something a person reads.\n *\n * Pure, and separate from both the plan and the sender, because rendering is the\n * part that differs per channel: an SMS channel will render the same event in 160\n * characters, a portal log as a row. The event stays the fact; only this file has\n * an opinion about prose.\n *\n * The layout is three sections — who got in touch, which ad sent them, and what\n * the request looked like — because that is the order the reader needs them in.\n * The contact details are the point; attribution is why it matters; the visitor\n * context is for when something looks wrong.\n */\nimport { getPrimaryClickId, identifyPlatform } from '../tracking/platform.ts';\nimport type { ConversionEvent } from '../tracking/types.ts';\nimport type { RenderedMessage } from './types.ts';\n\n/**\n * Fields never worth putting in a notification.\n *\n * A honeypot is not visitor-supplied — it is bait, and reporting it as something\n * they submitted is untrue. The same rule `legal/derive.ts` applies when deriving\n * `piiCollected`, and for the same reason. Callers may strip more.\n */\nconst OMIT_FIELDS = new Set(['website', '_honeypot', 'honeypot', 'cf-turnstile-response']);\n\nfunction label(key: string): string {\n  return key.charAt(0).toUpperCase() + key.slice(1).replace(/[_-]/g, ' ');\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n\n/** One section: a heading and its lines. Empty sections are dropped by the caller. */\ninterface Section {\n  heading: string;\n  lines: [string, string][];\n}\n\n/**\n * Who submitted the form, for the subject line.\n *\n * `formData['name']` alone is the shape a form has when someone writes it that\n * way, and most don't: a downstream site had `first_name`/`last_name` on five of\n * six forms, so every notification read \"from Unknown\" and the renderer could\n * not be adopted at all. The cascade is ordered most-specific first, and falls\n * back to the email rather than to nothing — an address identifies the person\n * even when no name field exists.\n */\nfunction submitterName(formData: Record<string, string>): string {\n  const get = (...keys: string[]): string | undefined => {\n    for (const k of keys) {\n      const v = formData[k]?.trim();\n      if (v) return v;\n    }\n    return undefined;\n  };\n  const full = get('name', 'full_name', 'fullName', 'fullname', 'your-name');\n  if (full) return full;\n  const first = get('first_name', 'firstName', 'firstname', 'given_name');\n  const last = get('last_name', 'lastName', 'lastname', 'family_name', 'surname');\n  if (first || last) return [first, last].filter(Boolean).join(' ');\n  return get('email', 'email_address', 'emailAddress') ?? 'Unknown';\n}\n\n/**\n * The event as sections — the shared structure behind both renderings.\n *\n * Extracted so the text and HTML versions cannot disagree about content. They\n * differ only in markup; a field added here appears in both.\n */\nexport function describeEvent(event: ConversionEvent): { subject: string; sections: Section[] } {\n  const t = event.tracking;\n  const platform = t ? identifyPlatform(t) : null;\n  const clickId = t ? getPrimaryClickId(t) : null;\n\n  const contact: [string, string][] = [];\n  let subject: string;\n\n  if (event.type === 'form' && event.formData) {\n    const name = submitterName(event.formData);\n    subject = `[Contact Form] New submission from ${name}`;\n    for (const [key, value] of Object.entries(event.formData)) {\n      if (!OMIT_FIELDS.has(key) && value) contact.push([label(key), value]);\n    }\n  } else {\n    const phone = event.phone ?? 'unknown';\n    subject = `[Phone Call] Visitor calling ${phone}`;\n    contact.push(['Phone', phone]);\n  }\n\n  const attribution: [string, string][] = [];\n  if (t) {\n    if (platform) attribution.push(['Platform', platform]);\n    if (clickId) attribution.push([`Click ID (${clickId.param})`, clickId.value]);\n    for (const key of ['utm_campaign', 'utm_source', 'utm_medium', 'utm_content', 'utm_term']) {\n      const value = t[key];\n      if (value) attribution.push([label(key.replace('utm_', '')), String(value)]);\n    }\n    if (t.ab_variant) attribution.push(['A/B variant', t.ab_variant]);\n  }\n\n  const context: [string, string][] = [];\n  if (t?.landingPage) context.push(['Landing page', t.landingPage]);\n  if (t?.referrer) context.push(['Referrer', t.referrer]);\n  if (t?.ts) context.push(['First visit', new Date(t.ts).toISOString()]);\n  context.push(['Received', new Date(event.at).toISOString()]);\n  if (event.userAgent) context.push(['User agent', event.userAgent]);\n  if (event.ip) context.push(['IP', event.ip]);\n\n  const sections: Section[] = [\n    { heading: 'Contact details', lines: contact },\n    // Stated rather than omitted: \"we don't know where this came from\" is a\n    // useful answer, and a silently missing section reads as a bug in the tool.\n    {\n      heading: 'Ad attribution',\n      lines: attribution.length\n        ? attribution\n        : [['Source', 'None — visitor arrived without ad tracking']],\n    },\n    { heading: 'Visitor context', lines: context },\n  ];\n\n  return { subject, sections: sections.filter((s) => s.lines.length) };\n}\n\n/** Render for e-mail. Both halves, always — see `RenderedMessage`. */\nexport function renderEmail(event: ConversionEvent): RenderedMessage {\n  const { subject, sections } = describeEvent(event);\n\n  const text = sections\n    .map((s) => [`--- ${s.heading} ---`, ...s.lines.map(([k, v]) => `${k}: ${v}`)].join('\\n'))\n    .join('\\n\\n');\n\n  const html = sections\n    .map(\n      (s) =>\n        `<h2 style=\"font:600 14px system-ui;margin:24px 0 8px\">${escapeHtml(s.heading)}</h2>` +\n        `<table style=\"font:14px system-ui;border-collapse:collapse\">${s.lines\n          .map(\n            ([k, v]) =>\n              `<tr><td style=\"padding:2px 12px 2px 0;color:#666;vertical-align:top\">${escapeHtml(k)}</td>` +\n              `<td style=\"padding:2px 0\">${escapeHtml(v)}</td></tr>`,\n          )\n          .join('')}</table>`,\n    )\n    .join('');\n\n  return { subject, text, html };\n}\n","/**\n * Conversion notifications — plan, render, dispatch.\n *\n * The seam between \"a conversion happened\" and \"someone found out about it\".\n * A `ConversionEvent` from `@getvitops/utils/tracking` goes in; where it goes and\n * how it reads are config, not code at the call site.\n *\n * Three files, three jobs, matching `indexing/`:\n *   - `plan.ts`    decides everything, purely — which channels, which recipients,\n *                  and why anything is off.\n *   - `render.ts`  turns the event into prose, purely.\n *   - `email.ts`   executes, and decides nothing.\n *\n * ---\n *\n * **TODO — further channels.** Only `email` is implemented. The seam is\n * `NotificationsConfig` + a sender with `sendEmail`'s signature `(plan, message,\n * transport) => ChannelResult`; adding one should mean a new sender file, a new\n * branch in `planNotifications`, and a schema variant — touching neither\n * `ConversionEvent` nor the recipient cascade. Planned:\n *   - `sms`      — the same event rendered short. `render.ts` already separates\n *                  `describeEvent` from `renderEmail` for exactly this.\n *   - `persist`  — append to a store (D1, a portal log) the client reviews.\n * The generic `email`/`text`/`persist` helpers taking content + provider config\n * belong at that point, not before: one implemented channel is not enough to know\n * what the abstraction should be.\n */\nimport type { ConversionEvent } from '../tracking/types.ts';\nimport { logEmail, sendEmail } from './email.ts';\nimport { planNotifications } from './plan.ts';\nimport { renderEmail } from './render.ts';\nimport type { ChannelResult, EmailBinding, NotifyContext } from './types.ts';\n\nexport interface NotifyDeps {\n  /**\n   * The Workers `send_email` binding (`env.EMAIL`). Omit it and the notification\n   * is printed instead — the dev path.\n   */\n  email?: EmailBinding | undefined;\n}\n\nexport interface NotifyResult {\n  results: ChannelResult[];\n  /** True when at least one channel delivered. */\n  delivered: boolean;\n}\n\n/**\n * Notify every configured channel about a conversion.\n *\n * Channels are independent: one failing must not stop the others, and none of\n * them may throw into the request that produced the event. Every outcome —\n * delivered, skipped, failed — comes back as data for the caller to log.\n */\nexport async function notify(\n  event: ConversionEvent,\n  ctx: NotifyContext,\n  deps: NotifyDeps = {},\n): Promise<NotifyResult> {\n  const plan = planNotifications(ctx);\n  const results: ChannelResult[] = [];\n\n  if (plan.email.enabled) {\n    const message = renderEmail(event);\n    results.push(\n      deps.email ? await sendEmail(plan.email, message, deps.email) : logEmail(plan.email, message),\n    );\n  } else {\n    results.push({ channel: 'email', sent: false, reason: plan.email.skip ?? 'Not configured.' });\n  }\n\n  return { results, delivered: results.some((r) => r.sent) };\n}\n\nexport {\n  DEFAULT_EMAIL_BINDING,\n  normalizeEmailChannel,\n  planNotifications,\n  resolveRecipient,\n  resolveSender,\n} from './plan.ts';\nexport { describeEvent, renderEmail } from './render.ts';\nexport { logEmail, sendEmail } from './email.ts';\nexport type {\n  ChannelPlan,\n  ChannelResult,\n  EmailBinding,\n  EmailChannelConfig,\n  EmailPlan,\n  NotificationPlan,\n  NotificationsConfig,\n  NotifyContext,\n  RenderedMessage,\n} from './types.ts';\n"],"mappings":";;;;;;;;;;AA2BA,MAAM,YAAY,IAAI,IAAI;CACxB;CACA;CACA;AACF,CAAC;AAED,SAAS,OAAO,OAAoC;CAClD,MAAM,OAAQ,OAAqC;CACnD,OAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,SAAS,UAAU,OAAwB;CACzC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAsBA,MAAM,QAAQ,OAA8B,IAAI,SAAS,MAAM,WAAW,GAAG,EAAE,CAAC;;AAGhF,MAAM,eAAe;;;;;;;;AASrB,eAAe,YAAe,MAAkB,IAAwB;CACtE,IAAI,MAAM,GAAG,OAAO;CACpB,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,MACA,IAAI,SAAgB,GAAG,WAAW;GAChC,QAAQ,iBAAiB;IACvB,MAAM,sBAAM,IAAI,MAAM,uBAAuB,GAAG,IAAI;IACpD,IAAI,OAAO;IACX,OAAO,GAAG;GACZ,GAAG,EAAE;EACP,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,UAAU,QAAW,aAAa,KAAK;CAC7C;AACF;;;;;;;;;AAUA,eAAsB,UACpB,MACA,SACA,SACA,UAA4B,CAAC,GACL;CACxB,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,MACrC,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ,KAAK,QAAQ;CAAuB;CAGtF,MAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,YAAY,CAAC;CAClD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,YAAY,QAAQ,aAAa;CAEvC,KAAK,IAAI,UAAU,GAAG,WAAW,UAAU,WACzC,IAAI;EACF,MAAM,YACJ,QAAQ,KAAK;GACX,IAAI,KAAK;GACT,MAAM,KAAK,WAAW;IAAE,OAAO,KAAK;IAAM,MAAM,KAAK;GAAS,IAAI,EAAE,OAAO,KAAK,KAAK;GACrF,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAClD,CAAC,GACD,SACF;EACA,OAAO;GAAE,SAAS;GAAS,MAAM;EAAK;CACxC,SAAS,OAAO;EACd,MAAM,OAAO,OAAO,KAAK;EACzB,IAAI,YAAY,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,KAAK,SAAS,eACrE,OAAO;GACL,SAAS;GACT,MAAM;GACN,QAAQ,UAAU,KAAK;GACvB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACzB;EAIF,MAAM,MAAM,MAAM,UAAU,KAAK,GAAG;CACtC;;CAIF,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ;CAAsB;AACxE;;;;;;;;AASA,SAAgB,SACd,MACA,SACA,MAA8B,QAAQ,KACvB;CACf,IACE;EACE;EACA,OAAO,KAAK,MAAM;EAClB,SAAS,KAAK,QAAQ;EACtB,YAAY,QAAQ;EACpB;EACA,QAAQ;EACR;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CACA,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ;CAAsC;AACxF;;;;;AC3JA,MAAa,wBAAwB;;AAGrC,SAAgB,sBACd,OACgC;CAChC,IAAI,UAAU,QAAW,OAAO;CAChC,OAAO,OAAO,UAAU,WAAW;EAAE,UAAU;EAAc,IAAI;CAAM,IAAI;AAC7E;;;;;;;;AASA,SAAgB,iBACd,SACA,KACoB;CACpB,IAAI,QAAQ,IAAI,OAAO,QAAQ;CAC/B,OAAO,IAAI,gBAAgB,MAAM,MAAM,CAAC,CAAC,CAAC;AAC5C;;;;;;;;AASA,SAAgB,cAAc,SAA6B,KAAwC;CACjG,IAAI,QAAQ,MAAM,OAAO,QAAQ;CACjC,IAAI,CAAC,IAAI,WAAW,OAAO;CAC3B,IAAI;CACJ,IAAI;EACF,OAAO,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC;CAChC,QAAQ;EAEN,OAAO,IAAI,UAAU,QAAQ,gBAAgB,EAAE,CAAC,CAAC,QAAQ,SAAS,EAAE;CACtE;CACA,OAAO,OAAO,WAAW,SAAS;AACpC;;;;;;;AAQA,SAAgB,kBAAkB,KAAsC;CACtE,MAAM,QAAQ,UAAU,GAAG;CAC3B,OAAO;EAAE;EAAO,OAAO,CAAC,MAAM;CAAQ;AACxC;AAEA,SAAS,UAAU,KAA+B;CAChD,MAAM,UAAU,sBAAsB,IAAI,eAAe,KAAK;CAC9D,MAAM,UAAU,SAAS;CAEzB,IAAI,CAAC,SACH,OAAO;EACL,UAAU;EACV;EACA,SAAS;EACT,MAAM;CACR;CAGF,MAAM,KAAK,iBAAiB,SAAS,GAAG;CACxC,IAAI,CAAC,IACH,OAAO;EACL,UAAU;EACV;EACA,SAAS;EACT,MACE;CAEJ;CAGF,MAAM,OAAO,cAAc,SAAS,GAAG;CACvC,IAAI,CAAC,MACH,OAAO;EACL,UAAU;EACV;EACA;EACA,SAAS;EACT,MACE;CAEJ;CAGF,OAAO;EACL,UAAU;EACV;EACA;EACA;EACA,UAAU,QAAQ,YAAY,IAAI;EAClC,SAAS,QAAQ;EACjB,SAAS;CACX;AACF;;;;;;;;;;;;;;;;;;;;;;;;ACjGA,MAAM,cAAc,IAAI,IAAI;CAAC;CAAW;CAAa;CAAY;AAAuB,CAAC;AAEzF,SAAS,MAAM,KAAqB;CAClC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,SAAS,GAAG;AACxE;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ;AAC3B;;;;;;;;;;;AAkBA,SAAS,cAAc,UAA0C;CAC/D,MAAM,OAAO,GAAG,SAAuC;EACrD,KAAK,MAAM,KAAK,MAAM;GACpB,MAAM,IAAI,SAAS,EAAE,EAAE,KAAK;GAC5B,IAAI,GAAG,OAAO;EAChB;CAEF;CACA,MAAM,OAAO,IAAI,QAAQ,aAAa,YAAY,YAAY,WAAW;CACzE,IAAI,MAAM,OAAO;CACjB,MAAM,QAAQ,IAAI,cAAc,aAAa,aAAa,YAAY;CACtE,MAAM,OAAO,IAAI,aAAa,YAAY,YAAY,eAAe,SAAS;CAC9E,IAAI,SAAS,MAAM,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CAChE,OAAO,IAAI,SAAS,iBAAiB,cAAc,KAAK;AAC1D;;;;;;;AAQA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,IAAI,MAAM;CAChB,MAAM,WAAW,IAAI,iBAAiB,CAAC,IAAI;CAC3C,MAAM,UAAU,IAAI,kBAAkB,CAAC,IAAI;CAE3C,MAAM,UAA8B,CAAC;CACrC,IAAI;CAEJ,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU;EAE3C,UAAU,sCADG,cAAc,MAAM,QACkB;EACnD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,GACtD,IAAI,CAAC,YAAY,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;CAExE,OAAO;EACL,MAAM,QAAQ,MAAM,SAAS;EAC7B,UAAU,gCAAgC;EAC1C,QAAQ,KAAK,CAAC,SAAS,KAAK,CAAC;CAC/B;CAEA,MAAM,cAAkC,CAAC;CACzC,IAAI,GAAG;EACL,IAAI,UAAU,YAAY,KAAK,CAAC,YAAY,QAAQ,CAAC;EACrD,IAAI,SAAS,YAAY,KAAK,CAAC,aAAa,QAAQ,MAAM,IAAI,QAAQ,KAAK,CAAC;EAC5E,KAAK,MAAM,OAAO;GAAC;GAAgB;GAAc;GAAc;GAAe;EAAU,GAAG;GACzF,MAAM,QAAQ,EAAE;GAChB,IAAI,OAAO,YAAY,KAAK,CAAC,MAAM,IAAI,QAAQ,QAAQ,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC;EAC7E;EACA,IAAI,EAAE,YAAY,YAAY,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC;CAClE;CAEA,MAAM,UAA8B,CAAC;CACrC,IAAI,GAAG,aAAa,QAAQ,KAAK,CAAC,gBAAgB,EAAE,WAAW,CAAC;CAChE,IAAI,GAAG,UAAU,QAAQ,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;CACtD,IAAI,GAAG,IAAI,QAAQ,KAAK,CAAC,eAAe,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;CACrE,QAAQ,KAAK,CAAC,YAAY,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;CAC3D,IAAI,MAAM,WAAW,QAAQ,KAAK,CAAC,cAAc,MAAM,SAAS,CAAC;CACjE,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,EAAE,CAAC;CAE3C,MAAM,WAAsB;EAC1B;GAAE,SAAS;GAAmB,OAAO;EAAQ;EAG7C;GACE,SAAS;GACT,OAAO,YAAY,SACf,cACA,CAAC,CAAC,UAAU,4CAA4C,CAAC;EAC/D;EACA;GAAE,SAAS;GAAmB,OAAO;EAAQ;CAC/C;CAEA,OAAO;EAAE;EAAS,UAAU,SAAS,QAAQ,MAAM,EAAE,MAAM,MAAM;CAAE;AACrE;;AAGA,SAAgB,YAAY,OAAyC;CACnE,MAAM,EAAE,SAAS,aAAa,cAAc,KAAK;CAoBjD,OAAO;EAAE;EAAS,MAlBL,SACV,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CACzF,KAAK,MAgBa;EAAG,MAdX,SACV,KACE,MACC,yDAAyD,WAAW,EAAE,OAAO,EAAE,mEAChB,EAAE,MAC9D,KACE,CAAC,GAAG,OACH,wEAAwE,WAAW,CAAC,EAAE,iCACzD,WAAW,CAAC,EAAE,WAC/C,CAAC,CACA,KAAK,EAAE,EAAE,SAChB,CAAC,CACA,KAAK,EAEmB;CAAE;AAC/B;;;;;;;;;;;ACpGA,eAAsB,OACpB,OACA,KACA,OAAmB,CAAC,GACG;CACvB,MAAM,OAAO,kBAAkB,GAAG;CAClC,MAAM,UAA2B,CAAC;CAElC,IAAI,KAAK,MAAM,SAAS;EACtB,MAAM,UAAU,YAAY,KAAK;EACjC,QAAQ,KACN,KAAK,QAAQ,MAAM,UAAU,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,OAAO,CAC9F;CACF,OACE,QAAQ,KAAK;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ,KAAK,MAAM,QAAQ;CAAkB,CAAC;CAG9F,OAAO;EAAE;EAAS,WAAW,QAAQ,MAAM,MAAM,EAAE,IAAI;CAAE;AAC3D"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/notify/email.ts","../../src/notify/plan.ts","../../src/notify/render.ts","../../src/notify/index.ts"],"sourcesContent":["/**\n * The e-mail channel — Cloudflare Email Sending.\n *\n * I/O only: it executes an `EmailPlan` and decides nothing. Whether to send, to\n * whom, and from where were all settled in `plan.ts`.\n *\n * **The binding is passed in, never imported.** `@getvitops/utils` does not depend\n * on `cloudflare:workers`, so this module runs in Node and in a test with a stub,\n * and the Astro package gains no Cloudflare coupling. The consumer's route hands\n * over `env.EMAIL`.\n *\n * Uses the current Email Sending binding — a structured `send({ to, from,\n * subject, html, text })` — not the legacy `EmailMessage` + hand-built MIME path.\n * The domain in `from` must have been onboarded (`wrangler email sending enable\n * <domain>`); nothing here can check that, which is why `E_SENDER_NOT_VERIFIED`\n * is surfaced verbatim rather than collapsed into \"send failed\".\n */\nimport type { RenderedMessage } from './types.ts';\nimport type { ChannelResult, EmailBinding, EmailPlan } from './types.ts';\n\n/**\n * Provider errors worth retrying.\n *\n * Everything else is a configuration fault — an unverified sender, a malformed\n * payload, a suppressed recipient — where a retry is pure latency and the send\n * will fail identically. Retrying those also burns the daily quota.\n */\nconst RETRYABLE = new Set([\n  'E_RATE_LIMIT_EXCEEDED',\n  'E_DELIVERY_FAILED',\n  'E_INTERNAL_SERVER_ERROR',\n]);\n\nfunction codeOf(error: unknown): string | undefined {\n  const code = (error as { code?: unknown } | null)?.code;\n  return typeof code === 'string' ? code : undefined;\n}\n\nfunction messageOf(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nexport interface SendEmailOptions {\n  /** Attempts for a retryable failure (default 3). */\n  attempts?: number;\n  /**\n   * Per-attempt ceiling in milliseconds (default 10000; `0` disables).\n   *\n   * `binding.send()` is a network call with no deadline of its own, so without\n   * this one hung attempt hangs the request that produced it — forever, in the\n   * one module otherwise built on always saying why. A conversion endpoint\n   * cannot be the thing that makes a form submission time out, so the bound\n   * belongs here rather than in every consumer's wrapper.\n   *\n   * A timeout is treated as retryable: it is a transient condition by\n   * definition, unlike `E_SENDER_NOT_VERIFIED` and friends.\n   */\n  timeoutMs?: number;\n  /** Injected for tests; real callers let it default to a real delay. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\nconst wait = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\n/** Marker for a send that exceeded its deadline, so the retry rule can see it. */\nconst TIMEOUT_CODE = 'E_SEND_TIMEOUT';\n\n/**\n * Race a send against its deadline.\n *\n * The timer is always cleared — a pending `setTimeout` keeps a Worker's event\n * loop alive past the response, which turns a bounded send into an unbounded\n * invocation and bills for the difference.\n */\nasync function withTimeout<T>(work: Promise<T>, ms: number): Promise<T> {\n  if (ms <= 0) return work;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      work,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          const err = new Error(`Email send exceeded ${ms}ms.`) as Error & { code: string };\n          err.code = TIMEOUT_CODE;\n          reject(err);\n        }, ms);\n      }),\n    ]);\n  } finally {\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n\n/**\n * Send one rendered message according to a plan.\n *\n * Never throws: a failed notification must not take down the request that\n * produced it. The visitor has already submitted their form, and failing their\n * response because our mail didn't go out would turn a lost notification into a\n * lost conversion. The failure is returned instead, for the caller to log.\n */\nexport async function sendEmail(\n  plan: EmailPlan,\n  message: RenderedMessage,\n  binding: EmailBinding,\n  options: SendEmailOptions = {},\n): Promise<ChannelResult> {\n  if (!plan.enabled || !plan.to || !plan.from) {\n    return { channel: 'email', sent: false, reason: plan.skip ?? 'Channel not enabled.' };\n  }\n\n  const attempts = Math.max(1, options.attempts ?? 3);\n  const sleep = options.sleep ?? wait;\n  const timeoutMs = options.timeoutMs ?? 10_000;\n\n  for (let attempt = 1; attempt <= attempts; attempt++) {\n    try {\n      await withTimeout(\n        binding.send({\n          to: plan.to,\n          from: plan.fromName ? { email: plan.from, name: plan.fromName } : { email: plan.from },\n          subject: message.subject,\n          text: message.text,\n          html: message.html,\n          ...(plan.replyTo ? { replyTo: plan.replyTo } : {}),\n        }),\n        timeoutMs,\n      );\n      return { channel: 'email', sent: true };\n    } catch (error) {\n      const code = codeOf(error);\n      if (attempt === attempts || !code || !(RETRYABLE.has(code) || code === TIMEOUT_CODE)) {\n        return {\n          channel: 'email',\n          sent: false,\n          reason: messageOf(error),\n          ...(code ? { code } : {}),\n        };\n      }\n      // Exponential backoff. Cloudflare's rate limit is per-account, so a burst\n      // of conversions retrying in lockstep would keep colliding.\n      await sleep(2 ** (attempt - 1) * 250);\n    }\n  }\n\n  /* c8 ignore next -- the loop always returns; this satisfies the type checker. */\n  return { channel: 'email', sent: false, reason: 'Exhausted attempts.' };\n}\n\n/**\n * Print the message instead of sending it.\n *\n * The dev path, for a machine with no binding. Explicit rather than a silent\n * no-op, because \"I never saw the notification\" is the symptom of both a broken\n * integration and a working one nobody could observe.\n */\nexport function logEmail(\n  plan: EmailPlan,\n  message: RenderedMessage,\n  log: (line: string) => void = console.log,\n): ChannelResult {\n  log(\n    [\n      '\\n========== NOTIFICATION EMAIL (not sent — no binding) ==========',\n      `To: ${plan.to ?? '(unresolved)'}`,\n      `From: ${plan.from ?? '(unresolved)'}`,\n      `Subject: ${message.subject}`,\n      '---',\n      message.text,\n      '================================================================\\n',\n    ].join('\\n'),\n  );\n  return { channel: 'email', sent: false, reason: 'No binding — logged to the console.' };\n}\n","/**\n * Every decision a notification makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no binding, no clock. Whether a\n * channel fires, who it reaches, and *why* it was skipped are all decided here and\n * asserted in `plan.test.ts`; the senders beside this file do what they are told\n * and decide nothing. That is the same split `indexing/plan.ts` makes against\n * `gsc.ts`, and `@getvitops/core`'s consent store makes against its DOM wiring,\n * for the same reason: the consequential logic has to be testable without the\n * environment it runs in.\n *\n * The practical payoff is that a misconfigured site can be told exactly what will\n * and won't happen without sending anything — a silently unsent conversion\n * notification is indistinguishable from no conversion.\n */\nimport type { EmailChannelConfig, EmailPlan, NotificationPlan, NotifyContext } from './types.ts';\n\n/** Default Workers binding name for Cloudflare Email Sending. */\nexport const DEFAULT_EMAIL_BINDING = 'EMAIL';\n\n/** Normalise the `email` shorthand: a bare address means a Cloudflare send to it. */\nexport function normalizeEmailChannel(\n  input: string | EmailChannelConfig | undefined,\n): EmailChannelConfig | undefined {\n  if (input === undefined) return undefined;\n  return typeof input === 'string' ? { provider: 'cloudflare', to: input } : input;\n}\n\n/**\n * Who the notification reaches.\n *\n * An explicit recipient wins; otherwise it falls to the site's own contact\n * addresses, primary first. This cascade is why a site that has already said\n * where it receives mail doesn't have to say it twice.\n */\nexport function resolveRecipient(\n  channel: EmailChannelConfig,\n  ctx: NotifyContext,\n): string | undefined {\n  if (channel.to) return channel.to;\n  return ctx.locationEmails?.find((e) => !!e);\n}\n\n/**\n * The From address.\n *\n * `noreply@<canonical>` by default, because the sending domain has to be one the\n * site controls — Cloudflare rejects anything else with `E_SENDER_NOT_VERIFIED`,\n * and guessing from the recipient's domain would send that failure every time.\n */\nexport function resolveSender(channel: EmailChannelConfig, ctx: NotifyContext): string | undefined {\n  if (channel.from) return channel.from;\n  if (!ctx.canonical) return undefined;\n  let host: string;\n  try {\n    host = new URL(ctx.canonical).hostname;\n  } catch {\n    // A bare hostname is a legitimate way to write `domains.canonical`.\n    host = ctx.canonical.replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');\n  }\n  return host ? `noreply@${host}` : undefined;\n}\n\n/**\n * Decide what will be sent, and say why anything won't be.\n *\n * Every \"off\" carries a reason rather than being an absence, so a caller can\n * report the misconfiguration instead of reporting success over a no-op.\n */\nexport function planNotifications(ctx: NotifyContext): NotificationPlan {\n  const email = planEmail(ctx);\n  return { email, empty: !email.enabled };\n}\n\nfunction planEmail(ctx: NotifyContext): EmailPlan {\n  const channel = normalizeEmailChannel(ctx.notifications?.email);\n  const binding = channel?.binding ?? DEFAULT_EMAIL_BINDING;\n\n  if (!channel) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      enabled: false,\n      skip: 'No `notifications.email` configured.',\n    };\n  }\n\n  const to = resolveRecipient(channel, ctx);\n  if (!to) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      enabled: false,\n      skip:\n        'No recipient: set `notifications.email.to`, or give a location an `email` ' +\n        'so the notification has somewhere to go.',\n    };\n  }\n\n  const from = resolveSender(channel, ctx);\n  if (!from) {\n    return {\n      provider: 'cloudflare',\n      binding,\n      to,\n      enabled: false,\n      skip:\n        'No sender: set `notifications.email.from`, or `domains.canonical` so ' +\n        '`noreply@<host>` can be derived. Cloudflare only sends from a domain you have onboarded.',\n    };\n  }\n\n  return {\n    provider: 'cloudflare',\n    binding,\n    to,\n    from,\n    fromName: channel.fromName ?? ctx.organizationName,\n    replyTo: channel.replyTo,\n    enabled: true,\n  };\n}\n","/**\n * Turning a `ConversionEvent` into something a person reads.\n *\n * Pure, and separate from both the plan and the sender, because rendering is the\n * part that differs per channel: an SMS channel will render the same event in 160\n * characters, a portal log as a row. The event stays the fact; only this file has\n * an opinion about prose.\n *\n * The layout is three sections — who got in touch, which ad sent them, and what\n * the request looked like — because that is the order the reader needs them in.\n * The contact details are the point; attribution is why it matters; the visitor\n * context is for when something looks wrong.\n */\nimport { identifySubmitter } from '../tracking/identity.ts';\nimport { getPrimaryClickId, identifyPlatform } from '../tracking/platform.ts';\nimport type { ConversionEvent } from '../tracking/types.ts';\nimport type { RenderedMessage } from './types.ts';\n\n/**\n * Fields never worth putting in a notification.\n *\n * A honeypot is not visitor-supplied — it is bait, and reporting it as something\n * they submitted is untrue. The same rule `legal/derive.ts` applies when deriving\n * `piiCollected`, and for the same reason. Callers may strip more.\n */\nconst OMIT_FIELDS = new Set(['website', '_honeypot', 'honeypot', 'cf-turnstile-response']);\n\nfunction label(key: string): string {\n  return key.charAt(0).toUpperCase() + key.slice(1).replace(/[_-]/g, ' ');\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n\n/** One section: a heading and its lines. Empty sections are dropped by the caller. */\ninterface Section {\n  heading: string;\n  lines: [string, string][];\n}\n\n/**\n * One line, already rendered both ways — a plain fact (`html` is just the\n * escaped `text`) or a link (`html` an anchor, `text` the bare href). Built at\n * the point each line is known rather than carried as a union and branched on\n * later: `describeEvent`'s lines are always plain `[label, value]` pairs (see\n * `Section` above, which `render.test.ts` destructures as such), and the one\n * line shape `renderEmail` adds itself — the \"Actions\" link — is turned into\n * this same rendered shape immediately, so the two renderers below share one\n * line format instead of branching on what kind of line each one is.\n */\ninterface RenderedLine {\n  label: string;\n  text: string;\n  html: string;\n}\n\n/** A section as `renderEmail` assembles it — `describeEvent`'s output plus its own additions. */\ninterface RenderSection {\n  heading: string;\n  lines: RenderedLine[];\n}\n\nfunction factLine([label, value]: readonly [string, string]): RenderedLine {\n  return { label, text: value, html: escapeHtml(value) };\n}\n\nfunction linkLine(label: string, href: string): RenderedLine {\n  return { label, text: href, html: `<a href=\"${escapeHtml(href)}\">${escapeHtml(href)}</a>` };\n}\n\nfunction toRenderSection(section: Section): RenderSection {\n  return { heading: section.heading, lines: section.lines.map(factLine) };\n}\n\n/**\n * Who submitted the form, for the subject line.\n *\n * `formData['name']` alone is the shape a form has when someone writes it that\n * way, and most don't: a downstream site had `first_name`/`last_name` on five of\n * six forms, so every notification read \"from Unknown\" and the renderer could\n * not be adopted at all. The cascade is ordered most-specific first, and falls\n * back to the email rather than to nothing — an address identifies the person\n * even when no name field exists.\n */\nfunction submitterName(formData: Record<string, string>): string {\n  return identifySubmitter(formData).fullName;\n}\n\n/**\n * The event as sections — the shared structure behind both renderings.\n *\n * Extracted so the text and HTML versions cannot disagree about content. They\n * differ only in markup; a field added here appears in both.\n */\nexport function describeEvent(event: ConversionEvent): { subject: string; sections: Section[] } {\n  const t = event.tracking;\n  const platform = t ? identifyPlatform(t) : null;\n  const clickId = t ? getPrimaryClickId(t) : null;\n\n  const contact: [string, string][] = [];\n  let subject: string;\n\n  if (event.type === 'form' && event.formData) {\n    const name = submitterName(event.formData);\n    subject = `[Contact Form] New submission from ${name}`;\n    for (const [key, value] of Object.entries(event.formData)) {\n      if (!OMIT_FIELDS.has(key) && value) contact.push([label(key), value]);\n    }\n  } else if (event.type === 'email') {\n    const email = event.email ?? 'unknown';\n    subject = `[Email Click] Visitor emailing ${email}`;\n    contact.push(['Email', email]);\n  } else {\n    const phone = event.phone ?? 'unknown';\n    subject = `[Phone Call] Visitor calling ${phone}`;\n    contact.push(['Phone', phone]);\n  }\n\n  const attribution: [string, string][] = [];\n  if (t) {\n    if (platform) attribution.push(['Platform', platform]);\n    if (clickId) attribution.push([`Click ID (${clickId.param})`, clickId.value]);\n    for (const key of ['utm_campaign', 'utm_source', 'utm_medium', 'utm_content', 'utm_term']) {\n      const value = t[key];\n      if (value) attribution.push([label(key.replace('utm_', '')), String(value)]);\n    }\n    if (t.ab_variant) attribution.push(['A/B variant', t.ab_variant]);\n  }\n\n  const context: [string, string][] = [];\n  if (t?.landingPage) context.push(['Landing page', t.landingPage]);\n  if (t?.referrer) context.push(['Referrer', t.referrer]);\n  if (t?.ts) context.push(['First visit', new Date(t.ts).toISOString()]);\n  context.push(['Received', new Date(event.at).toISOString()]);\n  if (event.userAgent) context.push(['User agent', event.userAgent]);\n  if (event.ip) context.push(['IP', event.ip]);\n\n  const sections: Section[] = [\n    { heading: 'Contact details', lines: contact },\n    // Stated rather than omitted: \"we don't know where this came from\" is a\n    // useful answer, and a silently missing section reads as a bug in the tool.\n    {\n      heading: 'Ad attribution',\n      lines: attribution.length\n        ? attribution\n        : [['Source', 'None — visitor arrived without ad tracking']],\n    },\n    { heading: 'Visitor context', lines: context },\n  ];\n\n  return { subject, sections: sections.filter((s) => s.lines.length) };\n}\n\n/** Render for e-mail. Both halves, always — see `RenderedMessage`. */\nexport function renderEmail(\n  event: ConversionEvent,\n  extra: { notes?: string[] | undefined; actionUrl?: string | undefined } = {},\n): RenderedMessage {\n  const { subject, sections: eventSections } = describeEvent(event);\n\n  // `{clickId}` is the only placeholder — an event has no durable id nothing\n  // in this toolchain could look back up (there's no store), so interpolating\n  // one would be decorative. Omitted entirely when there's no click ID to\n  // interpolate, rather than emailing a link with a literal `{clickId}` in it.\n  const clickId = event.tracking ? getPrimaryClickId(event.tracking) : null;\n  const actionSection: RenderSection | null =\n    extra.actionUrl && clickId\n      ? {\n          heading: 'Actions',\n          lines: [\n            linkLine(\n              'View in ad platform',\n              extra.actionUrl.replace(/\\{clickId\\}/g, encodeURIComponent(clickId.value)),\n            ),\n          ],\n        }\n      : null;\n\n  // Deliberately a channel-neutral `string[]` rather than a typed CRM result —\n  // this module gains no dependency on `crm`, and the seam serves any future\n  // sink the same way.\n  const sections: RenderSection[] = [\n    ...eventSections.map(toRenderSection),\n    ...(actionSection ? [actionSection] : []),\n    ...(extra.notes && extra.notes.length\n      ? [{ heading: 'Delivery', lines: extra.notes.map((n) => factLine(['CRM', n])) }]\n      : []),\n  ];\n\n  const text = sections\n    .map((s) => [`--- ${s.heading} ---`, ...s.lines.map((l) => `${l.label}: ${l.text}`)].join('\\n'))\n    .join('\\n\\n');\n\n  const html = sections\n    .map(\n      (s) =>\n        `<h2 style=\"font:600 14px system-ui;margin:24px 0 8px\">${escapeHtml(s.heading)}</h2>` +\n        `<table style=\"font:14px system-ui;border-collapse:collapse\">${s.lines\n          .map(\n            (l) =>\n              `<tr><td style=\"padding:2px 12px 2px 0;color:#666;vertical-align:top\">${escapeHtml(l.label)}</td>` +\n              `<td style=\"padding:2px 0\">${l.html}</td></tr>`,\n          )\n          .join('')}</table>`,\n    )\n    .join('');\n\n  return { subject, text, html };\n}\n","/**\n * Conversion notifications — plan, render, dispatch.\n *\n * The seam between \"a conversion happened\" and \"someone found out about it\".\n * A `ConversionEvent` from `@getvitops/utils/tracking` goes in; where it goes and\n * how it reads are config, not code at the call site.\n *\n * Three files, three jobs, matching `indexing/`:\n *   - `plan.ts`    decides everything, purely — which channels, which recipients,\n *                  and why anything is off.\n *   - `render.ts`  turns the event into prose, purely.\n *   - `email.ts`   executes, and decides nothing.\n *\n * ---\n *\n * **TODO — further channels.** Only `email` is implemented. The seam is\n * `NotificationsConfig` + a sender with `sendEmail`'s signature `(plan, message,\n * transport) => ChannelResult`; adding one should mean a new sender file, a new\n * branch in `planNotifications`, and a schema variant — touching neither\n * `ConversionEvent` nor the recipient cascade. Planned:\n *   - `sms`      — the same event rendered short. `render.ts` already separates\n *                  `describeEvent` from `renderEmail` for exactly this.\n *   - `persist`  — append to a store (D1, a portal log) the client reviews.\n * The generic `email`/`text`/`persist` helpers taking content + provider config\n * belong at that point, not before: one implemented channel is not enough to know\n * what the abstraction should be.\n */\nimport type { ConversionEvent } from '../tracking/types.ts';\nimport { logEmail, sendEmail } from './email.ts';\nimport { planNotifications } from './plan.ts';\nimport { renderEmail } from './render.ts';\nimport type { ChannelResult, EmailBinding, NotifyContext } from './types.ts';\n\nexport interface NotifyDeps {\n  /**\n   * The Workers `send_email` binding (`env.EMAIL`). Omit it and the notification\n   * is printed instead — the dev path.\n   */\n  email?: EmailBinding | undefined;\n}\n\nexport interface NotifyResult {\n  results: ChannelResult[];\n  /** True when at least one channel delivered. */\n  delivered: boolean;\n}\n\n/**\n * Notify every configured channel about a conversion.\n *\n * Channels are independent: one failing must not stop the others, and none of\n * them may throw into the request that produced the event. Every outcome —\n * delivered, skipped, failed — comes back as data for the caller to log.\n */\nexport async function notify(\n  event: ConversionEvent,\n  ctx: NotifyContext,\n  deps: NotifyDeps = {},\n  extra: { notes?: string[] | undefined } = {},\n): Promise<NotifyResult> {\n  const plan = planNotifications(ctx);\n  const results: ChannelResult[] = [];\n\n  if (plan.email.enabled) {\n    const message = renderEmail(event, { ...extra, actionUrl: ctx.notifications?.actionUrl });\n    results.push(\n      deps.email ? await sendEmail(plan.email, message, deps.email) : logEmail(plan.email, message),\n    );\n  } else {\n    results.push({ channel: 'email', sent: false, reason: plan.email.skip ?? 'Not configured.' });\n  }\n\n  return { results, delivered: results.some((r) => r.sent) };\n}\n\nexport {\n  DEFAULT_EMAIL_BINDING,\n  normalizeEmailChannel,\n  planNotifications,\n  resolveRecipient,\n  resolveSender,\n} from './plan.ts';\nexport { describeEvent, renderEmail } from './render.ts';\nexport { logEmail, sendEmail } from './email.ts';\nexport type {\n  ChannelPlan,\n  ChannelResult,\n  EmailBinding,\n  EmailChannelConfig,\n  EmailPlan,\n  NotificationPlan,\n  NotificationsConfig,\n  NotifyContext,\n  RenderedMessage,\n} from './types.ts';\n"],"mappings":";;;;;;;;;;;AA2BA,MAAM,4BAAY,IAAI,IAAI;CACxB;CACA;CACA;AACF,CAAC;AAED,SAAS,OAAO,OAAoC;CAClD,MAAM,OAAQ,OAAqC;CACnD,OAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,SAAS,UAAU,OAAwB;CACzC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAsBA,MAAM,QAAQ,OAA8B,IAAI,SAAS,MAAM,WAAW,GAAG,EAAE,CAAC;;AAGhF,MAAM,eAAe;;;;;;;;AASrB,eAAe,YAAe,MAAkB,IAAwB;CACtE,IAAI,MAAM,GAAG,OAAO;CACpB,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,MACA,IAAI,SAAgB,GAAG,WAAW;GAChC,QAAQ,iBAAiB;IACvB,MAAM,sBAAM,IAAI,MAAM,uBAAuB,GAAG,IAAI;IACpD,IAAI,OAAO;IACX,OAAO,GAAG;GACZ,GAAG,EAAE;EACP,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,UAAU,QAAW,aAAa,KAAK;CAC7C;AACF;;;;;;;;;AAUA,eAAsB,UACpB,MACA,SACA,SACA,UAA4B,CAAC,GACL;CACxB,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,MACrC,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ,KAAK,QAAQ;CAAuB;CAGtF,MAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,YAAY,CAAC;CAClD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,YAAY,QAAQ,aAAa;CAEvC,KAAK,IAAI,UAAU,GAAG,WAAW,UAAU,WACzC,IAAI;EACF,MAAM,YACJ,QAAQ,KAAK;GACX,IAAI,KAAK;GACT,MAAM,KAAK,WAAW;IAAE,OAAO,KAAK;IAAM,MAAM,KAAK;GAAS,IAAI,EAAE,OAAO,KAAK,KAAK;GACrF,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAClD,CAAC,GACD,SACF;EACA,OAAO;GAAE,SAAS;GAAS,MAAM;EAAK;CACxC,SAAS,OAAO;EACd,MAAM,OAAO,OAAO,KAAK;EACzB,IAAI,YAAY,YAAY,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,KAAK,SAAS,eACrE,OAAO;GACL,SAAS;GACT,MAAM;GACN,QAAQ,UAAU,KAAK;GACvB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACzB;EAIF,MAAM,MAAM,MAAM,UAAU,KAAK,GAAG;CACtC;;CAIF,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ;CAAsB;AACxE;;;;;;;;AASA,SAAgB,SACd,MACA,SACA,MAA8B,QAAQ,KACvB;CACf,IACE;EACE;EACA,OAAO,KAAK,MAAM;EAClB,SAAS,KAAK,QAAQ;EACtB,YAAY,QAAQ;EACpB;EACA,QAAQ;EACR;CACF,CAAC,CAAC,KAAK,IAAI,CACb;CACA,OAAO;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ;CAAsC;AACxF;;;;;AC3JA,MAAa,wBAAwB;;AAGrC,SAAgB,sBACd,OACgC;CAChC,IAAI,UAAU,QAAW,OAAO;CAChC,OAAO,OAAO,UAAU,WAAW;EAAE,UAAU;EAAc,IAAI;CAAM,IAAI;AAC7E;;;;;;;;AASA,SAAgB,iBACd,SACA,KACoB;CACpB,IAAI,QAAQ,IAAI,OAAO,QAAQ;CAC/B,OAAO,IAAI,gBAAgB,MAAM,MAAM,CAAC,CAAC,CAAC;AAC5C;;;;;;;;AASA,SAAgB,cAAc,SAA6B,KAAwC;CACjG,IAAI,QAAQ,MAAM,OAAO,QAAQ;CACjC,IAAI,CAAC,IAAI,WAAW,OAAO;CAC3B,IAAI;CACJ,IAAI;EACF,OAAO,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC;CAChC,QAAQ;EAEN,OAAO,IAAI,UAAU,QAAQ,gBAAgB,EAAE,CAAC,CAAC,QAAQ,SAAS,EAAE;CACtE;CACA,OAAO,OAAO,WAAW,SAAS;AACpC;;;;;;;AAQA,SAAgB,kBAAkB,KAAsC;CACtE,MAAM,QAAQ,UAAU,GAAG;CAC3B,OAAO;EAAE;EAAO,OAAO,CAAC,MAAM;CAAQ;AACxC;AAEA,SAAS,UAAU,KAA+B;CAChD,MAAM,UAAU,sBAAsB,IAAI,eAAe,KAAK;CAC9D,MAAM,UAAU,SAAS;CAEzB,IAAI,CAAC,SACH,OAAO;EACL,UAAU;EACV;EACA,SAAS;EACT,MAAM;CACR;CAGF,MAAM,KAAK,iBAAiB,SAAS,GAAG;CACxC,IAAI,CAAC,IACH,OAAO;EACL,UAAU;EACV;EACA,SAAS;EACT,MACE;CAEJ;CAGF,MAAM,OAAO,cAAc,SAAS,GAAG;CACvC,IAAI,CAAC,MACH,OAAO;EACL,UAAU;EACV;EACA;EACA,SAAS;EACT,MACE;CAEJ;CAGF,OAAO;EACL,UAAU;EACV;EACA;EACA;EACA,UAAU,QAAQ,YAAY,IAAI;EAClC,SAAS,QAAQ;EACjB,SAAS;CACX;AACF;;;;;;;;;;;;;;;;;;;;;;;;AChGA,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAW;CAAa;CAAY;AAAuB,CAAC;AAEzF,SAAS,MAAM,KAAqB;CAClC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,SAAS,GAAG;AACxE;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ;AAC3B;AA8BA,SAAS,SAAS,CAAC,OAAO,QAAiD;CACzE,OAAO;EAAE;EAAO,MAAM;EAAO,MAAM,WAAW,KAAK;CAAE;AACvD;AAEA,SAAS,SAAS,OAAe,MAA4B;CAC3D,OAAO;EAAE;EAAO,MAAM;EAAM,MAAM,YAAY,WAAW,IAAI,EAAE,IAAI,WAAW,IAAI,EAAE;CAAM;AAC5F;AAEA,SAAS,gBAAgB,SAAiC;CACxD,OAAO;EAAE,SAAS,QAAQ;EAAS,OAAO,QAAQ,MAAM,IAAI,QAAQ;CAAE;AACxE;;;;;;;;;;;AAYA,SAAS,cAAc,UAA0C;CAC/D,OAAO,kBAAkB,QAAQ,CAAC,CAAC;AACrC;;;;;;;AAQA,SAAgB,cAAc,OAAkE;CAC9F,MAAM,IAAI,MAAM;CAChB,MAAM,WAAW,IAAI,iBAAiB,CAAC,IAAI;CAC3C,MAAM,UAAU,IAAI,kBAAkB,CAAC,IAAI;CAE3C,MAAM,UAA8B,CAAC;CACrC,IAAI;CAEJ,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU;EAE3C,UAAU,sCADG,cAAc,MAAM,QACkB;EACnD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,QAAQ,GACtD,IAAI,CAAC,YAAY,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;CAExE,OAAO,IAAI,MAAM,SAAS,SAAS;EACjC,MAAM,QAAQ,MAAM,SAAS;EAC7B,UAAU,kCAAkC;EAC5C,QAAQ,KAAK,CAAC,SAAS,KAAK,CAAC;CAC/B,OAAO;EACL,MAAM,QAAQ,MAAM,SAAS;EAC7B,UAAU,gCAAgC;EAC1C,QAAQ,KAAK,CAAC,SAAS,KAAK,CAAC;CAC/B;CAEA,MAAM,cAAkC,CAAC;CACzC,IAAI,GAAG;EACL,IAAI,UAAU,YAAY,KAAK,CAAC,YAAY,QAAQ,CAAC;EACrD,IAAI,SAAS,YAAY,KAAK,CAAC,aAAa,QAAQ,MAAM,IAAI,QAAQ,KAAK,CAAC;EAC5E,KAAK,MAAM,OAAO;GAAC;GAAgB;GAAc;GAAc;GAAe;EAAU,GAAG;GACzF,MAAM,QAAQ,EAAE;GAChB,IAAI,OAAO,YAAY,KAAK,CAAC,MAAM,IAAI,QAAQ,QAAQ,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC;EAC7E;EACA,IAAI,EAAE,YAAY,YAAY,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC;CAClE;CAEA,MAAM,UAA8B,CAAC;CACrC,IAAI,GAAG,aAAa,QAAQ,KAAK,CAAC,gBAAgB,EAAE,WAAW,CAAC;CAChE,IAAI,GAAG,UAAU,QAAQ,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;CACtD,IAAI,GAAG,IAAI,QAAQ,KAAK,CAAC,eAAe,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;CACrE,QAAQ,KAAK,CAAC,YAAY,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;CAC3D,IAAI,MAAM,WAAW,QAAQ,KAAK,CAAC,cAAc,MAAM,SAAS,CAAC;CACjE,IAAI,MAAM,IAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,EAAE,CAAC;CAE3C,MAAM,WAAsB;EAC1B;GAAE,SAAS;GAAmB,OAAO;EAAQ;EAG7C;GACE,SAAS;GACT,OAAO,YAAY,SACf,cACA,CAAC,CAAC,UAAU,4CAA4C,CAAC;EAC/D;EACA;GAAE,SAAS;GAAmB,OAAO;EAAQ;CAC/C;CAEA,OAAO;EAAE;EAAS,UAAU,SAAS,QAAQ,MAAM,EAAE,MAAM,MAAM;CAAE;AACrE;;AAGA,SAAgB,YACd,OACA,QAA0E,CAAC,GAC1D;CACjB,MAAM,EAAE,SAAS,UAAU,kBAAkB,cAAc,KAAK;CAMhE,MAAM,UAAU,MAAM,WAAW,kBAAkB,MAAM,QAAQ,IAAI;CACrE,MAAM,gBACJ,MAAM,aAAa,UACf;EACE,SAAS;EACT,OAAO,CACL,SACE,uBACA,MAAM,UAAU,QAAQ,gBAAgB,mBAAmB,QAAQ,KAAK,CAAC,CAC3E,CACF;CACF,IACA;CAKN,MAAM,WAA4B;EAChC,GAAG,cAAc,IAAI,eAAe;EACpC,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC;EACvC,GAAI,MAAM,SAAS,MAAM,MAAM,SAC3B,CAAC;GAAE,SAAS;GAAY,OAAO,MAAM,MAAM,KAAK,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;EAAE,CAAC,IAC7E,CAAC;CACP;CAoBA,OAAO;EAAE;EAAS,MAlBL,SACV,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAC/F,KAAK,MAgBa;EAAG,MAdX,SACV,KACE,MACC,yDAAyD,WAAW,EAAE,OAAO,EAAE,mEAChB,EAAE,MAC9D,KACE,MACC,wEAAwE,WAAW,EAAE,KAAK,EAAE,iCAC/D,EAAE,KAAK,WACxC,CAAC,CACA,KAAK,EAAE,EAAE,SAChB,CAAC,CACA,KAAK,EAEmB;CAAE;AAC/B;;;;;;;;;;;AC/JA,eAAsB,OACpB,OACA,KACA,OAAmB,CAAC,GACpB,QAA0C,CAAC,GACpB;CACvB,MAAM,OAAO,kBAAkB,GAAG;CAClC,MAAM,UAA2B,CAAC;CAElC,IAAI,KAAK,MAAM,SAAS;EACtB,MAAM,UAAU,YAAY,OAAO;GAAE,GAAG;GAAO,WAAW,IAAI,eAAe;EAAU,CAAC;EACxF,QAAQ,KACN,KAAK,QAAQ,MAAM,UAAU,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,OAAO,CAC9F;CACF,OACE,QAAQ,KAAK;EAAE,SAAS;EAAS,MAAM;EAAO,QAAQ,KAAK,MAAM,QAAQ;CAAkB,CAAC;CAG9F,OAAO;EAAE;EAAS,WAAW,QAAQ,MAAM,MAAM,EAAE,IAAI;CAAE;AAC3D"}

package/dist/onboarding/index.d.mts

@@ -1,140 +1,9 @@
 import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-BiK61Oq4.mjs";
-import { i as GoogleOAuth, n as GoogleAuthLike } from "../token-Bz_-igw-.mjs";
-
-//#region src/onboarding/types.d.ts
-/**
- * The onboarding module's own option surface.
- *
- * Deliberately structural rather than `Config['site']['searchConsole']` imported
- * from `@getvitops/generator`: the generator already depends on this package, so
- * importing back would be a cycle. The vocabulary mirrors that block field for
- * field, so the CLI's adapter is a flat map — the same arrangement, and for the
- * same reason, as `IndexingConfig` beside it.
- *
- * Optional fields are written `?: T | undefined` throughout: `exactOptionalPropertyTypes`
- * is on, and these types describe a *parsed JSON config* where an absent key and an
- * explicit `undefined` are the same thing.
- */
-/** One domain to onboard, as the config declares it. */
-interface DomainSetup {
-  /** The domain, bare (`acme.ca`). Becomes the `sc-domain:` property and the DNS zone name. */
-  domain: string;
-  /**
-   * Emails added as verification owners on the Site Verification web resource.
-   * Additive: existing owners are never removed.
-   */
-  delegatedOwners?: string[] | undefined;
-  /**
-   * A Google Group to grant Full-User access in Search Console. Surfaced as a
-   * reminder only — Search Console has no user/permission API.
-   */
-  fullUserGroup?: string | undefined;
-}
-/** Everything `plan()` needs, once the CLI has read the config and creds. */
-interface OnboardingConfig {
-  /** The domains to onboard. Already filtered to `--domain` if that was passed. */
-  domains: DomainSetup[];
-}
-/**
- * One domain's observed live state, gathered by the executors before planning.
- *
- * `plan()` compares this against the desired `DomainSetup` to decide each step —
- * the same shape the indexing planner takes its sitemap snapshot in, for the same
- * reason: the decision is pure, the observation is not.
- */
-interface DomainState {
-  /** The Cloudflare zone id for the domain, if one was found. */
-  zoneId?: string | undefined;
-  /** An apex TXT record already carrying the verification token exists. */
-  txtPresent: boolean;
-  /** The Site Verification web resource reports this domain as verified. */
-  verified: boolean;
-  /** Owners currently on the web resource (empty when not yet verified). */
-  currentOwners: string[];
-  /** A `sc-domain:` property already exists in Search Console. */
-  propertyExists: boolean;
-}
-//#endregion
-//#region src/onboarding/plan.d.ts
-/** A step's decision: do it, or skip it because it already holds. */
-type StepAction = 'create' | 'update' | 'skip';
-interface StepPlan {
-  action: StepAction;
-  /** Why it's a skip, or what the mutation will do. */
-  detail: string;
-}
-/** The four onboarding steps for one domain, decided against its live state. */
-interface DomainPlan {
-  domain: string;
-  /** `sc-domain:` property identifier this domain maps to. */
-  siteUrl: string;
-  /** Ensure the apex TXT verification record. */
-  txt: StepPlan;
-  /** Verify ownership via the Site Verification API (DNS_TXT). */
-  verify: StepPlan;
-  /** Add the Search Console domain property. */
-  property: StepPlan;
-  /** Add delegated owners to the verified web resource. */
-  owners: StepPlan;
-  /** Owners not yet present that the run should add. */
-  ownersToAdd: string[];
-  /** Manual follow-ups (e.g. a Full-User group). */
-  reminders: string[];
-}
-interface OnboardingPlan {
-  domains: DomainPlan[];
-  /** Operator-facing warnings that span the whole run. */
-  notes: string[];
-}
-/** The `sc-domain:` property identifier for a bare domain. */
-declare const siteUrlFor: (domain: string) => string;
-/**
- * Backoff ladder for the verification retry, in milliseconds.
- *
- * DNS_TXT verification fails until the record has propagated, which is a matter of
- * seconds-to-minutes, not a real error — so the schedule is a *policy*, decided
- * here and asserted in the tests, while the actual sleeping is the CLI's job.
- * Capped at `maxAttempts`; a domain still unverified after the last attempt is
- * reported PENDING, never failed.
- */
-declare function backoffSchedule(maxAttempts?: number): number[];
-/** Decide the four steps for one domain from its desired config and live state. */
-declare function planDomain(setup: DomainSetup, state: DomainState): DomainPlan;
-/**
- * The owner set to PUT: everyone already there, plus everyone being added.
- *
- * `updateOwners` REPLACES the owner list, so this is the one computation standing
- * between a delegation and locking yourself out — pass a bare `ownersToAdd` and
- * the account that just verified the domain is removed from it. It belongs here
- * rather than at the call site for exactly that reason: it is a decision, it is
- * the dangerous one, and the executor is not allowed to make it.
- *
- * `current` comes FIRST so the API's own casing survives dedupe; matching is
- * case-insensitive, mirroring `planDomain`'s `present` check, because Google
- * echoes back addresses in whatever case the account uses and a case-sensitive
- * `Set` would re-add an owner who is already there.
- */
-declare function ownerUnion(current: string[], toAdd: string[]): string[];
-/** Plan every domain. */
-declare function plan(config: OnboardingConfig, states: Map<string, DomainState>): OnboardingPlan;
-/** Any step on any domain is a mutation — i.e. the live state has drifted. */
-declare function hasDrift(p: OnboardingPlan): boolean;
-/** Render a plan as the block `--dry` and `--check` print. */
-declare function formatPlan(p: OnboardingPlan): string;
-/** The outcome of one domain's run, for the summary table. */
-interface DomainResult {
-  domain: string;
-  txt: 'created' | 'present' | 'failed' | '—';
-  verified: 'yes' | 'pending' | 'failed' | '—';
-  property: 'added' | 'present' | 'failed' | '—';
-  reminders: string[];
-}
-/** Render the end-of-run summary: one row per domain, plus any reminders. */
-declare function formatSummary(results: DomainResult[]): string;
-//#endregion
+import { i as GoogleOAuth, n as GoogleAuthLike } from "../token-DmmoQ7um.mjs";
+import { a as StepPlan, c as formatSummary, d as plan, f as planDomain, g as OnboardingConfig, h as DomainState, i as StepAction, l as hasDrift, m as DomainSetup, n as DomainResult, o as backoffSchedule, p as siteUrlFor, r as OnboardingPlan, s as formatPlan, t as DomainPlan, u as ownerUnion } from "../plan-Hq8Pb0Uw.mjs";
 //#region src/onboarding/google.d.ts
 /** Exchange a user OAuth refresh token for a short-lived access token. */
-declare function refreshTokenGrant(oauth: GoogleOAuth, fetchImpl?: typeof fetch): Promise<string>;
+export declare function refreshTokenGrant(oauth: GoogleOAuth, fetchImpl?: typeof fetch): Promise<string>;
 /**
  * Ask the Site Verification API for the DNS_TXT token for a domain.
  *
@@ -142,7 +11,7 @@ declare function refreshTokenGrant(oauth: GoogleOAuth, fetchImpl?: typeof fetch)
  * record. It is deterministic per (user, domain), so re-fetching it and comparing
  * against DNS is what makes the TXT step idempotent.
  */
-declare function getVerificationToken(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
+export declare function getVerificationToken(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   token?: string;
@@ -156,7 +25,7 @@ declare function getVerificationToken(auth: GoogleAuthLike, domain: string, fetc
  * contains resources the user already owns — so a hit *is* the verified state, and
  * carries the id and owners the later steps need.
  */
-declare function getWebResource(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
+export declare function getWebResource(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   exists: boolean;
@@ -165,7 +34,7 @@ declare function getWebResource(auth: GoogleAuthLike, domain: string, fetchImpl?
   message?: string;
 }>;
 /** Verify ownership (DNS_TXT). Succeeds only once the TXT record has propagated. */
-declare function verifyWebResource(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
+export declare function verifyWebResource(auth: GoogleAuthLike, domain: string, fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   id?: string;
@@ -179,13 +48,13 @@ declare function verifyWebResource(auth: GoogleAuthLike, domain: string, fetchIm
  * current owners and the ones to add — never a bare list of new owners, which
  * would drop everyone already there.
  */
-declare function updateOwners(auth: GoogleAuthLike, id: string, domain: string, owners: string[], fetchImpl?: typeof fetch): Promise<{
+export declare function updateOwners(auth: GoogleAuthLike, id: string, domain: string, owners: string[], fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   message?: string;
 }>;
 /** Whether a Search Console property already exists (`GET sites/{siteUrl}`). */
-declare function getSite(auth: GoogleAuthLike, siteUrl: string, fetchImpl?: typeof fetch): Promise<{
+export declare function getSite(auth: GoogleAuthLike, siteUrl: string, fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   exists: boolean;
@@ -197,11 +66,11 @@ declare function getSite(auth: GoogleAuthLike, siteUrl: string, fetchImpl?: type
  * A `403` here almost always means the domain is not yet verified for this user
  * rather than a transient error — property creation is gated on ownership.
  */
-declare function addSite(auth: GoogleAuthLike, siteUrl: string, fetchImpl?: typeof fetch): Promise<{
+export declare function addSite(auth: GoogleAuthLike, siteUrl: string, fetchImpl?: typeof fetch): Promise<{
   ok: boolean;
   status: number;
   message?: string;
 }>;
 //#endregion
-export { type DomainPlan, type DomainResult, type DomainSetup, type DomainState, type GoogleOAuth, type OnboardingConfig, type OnboardingPlan, type StepAction, type StepPlan, addSite, backoffSchedule, createApexTxt, findZoneId, formatPlan, formatSummary, getSite, getVerificationToken, getWebResource, hasDrift, listApexTxt, ownerUnion, plan, planDomain, refreshTokenGrant, siteUrlFor, updateOwners, verifyWebResource };
+export { type DomainPlan, type DomainResult, type DomainSetup, type DomainState, type GoogleOAuth, type OnboardingConfig, type OnboardingPlan, type StepAction, type StepPlan, backoffSchedule, createApexTxt, findZoneId, formatPlan, formatSummary, hasDrift, listApexTxt, ownerUnion, plan, planDomain, siteUrlFor };
 //# sourceMappingURL=index.d.mts.map

package/dist/onboarding/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/onboarding/types.ts","../../src/onboarding/plan.ts","../../src/onboarding/google.ts"],"mappings":";;;;;;;;AAeA;;;;;;;;AAYe;AAIf;AAAA,UAhBiB,WAAA;;EAEf,MAAA;EAgBoB;AAiBtB;;;EA5BE,eAAA;EA8BA;;;;EAzBA,aAAA;AAAA;AAiCc;AAAA,UA7BC,gBAAA;;EAEf,OAAA,EAAS,WAAW;AAAA;;;;;;;ACXd;UD4BS,WAAA;ECxBU;ED0BzB,MAAA;ECrBK;EDuBL,UAAA;ECnBU;EDqBV,QAAA;ECnBgB;EDqBhB,aAAA;EC/BA;EDiCA,cAAA;AAAA;;;;KC3CU,UAAA;AAAA,UAEK,QAAA;EACf,MAAA,EAAQ,UAAU;ED8BH;EC5Bf,MAAA;AAAA;;UAIe,UAAA;EACf,MAAA;ED6BA;EC3BA,OAAA;ED+BA;EC7BA,GAAA,EAAK,QAAA;ED6BS;EC3Bd,MAAA,EAAQ,QAAA;;EAER,QAAA,EAAU,QAAA;EAlBA;EAoBV,MAAA,EAAQ,QAAA;;EAER,WAAA;EAtBoB;EAwBpB,SAAA;AAAA;AAAA,UAGe,cAAA;EACf,OAAA,EAAS,UAAU;EAzBnB;EA2BA,KAAA;AAAA;;cAIW,UAAA,GAAc,MAAc;AAzBzC;;;;;;;;;AAAA,iBAoCgB,eAAA,CAAgB,WAAe;;iBAO/B,UAAA,CAAW,KAAA,EAAO,WAAA,EAAa,KAAA,EAAO,WAAA,GAAc,UAAA;;;;;;;;;;;AA5BzD;AAGX;;;iBAqFgB,UAAA,CAAW,OAAA,YAAmB,KAAe;;iBAa7C,IAAA,CAAK,MAAA,EAAQ,gBAAA,EAAkB,MAAA,EAAQ,GAAA,SAAY,WAAA,IAAe,cAAA;;iBAiBlE,QAAA,CAAS,CAAiB,EAAd,cAAc;AAhHnC;AAAA,iBA2HS,UAAA,CAAW,CAAiB,EAAd,cAAc;;UAgB3B,YAAA;EACf,MAAA;EACA,GAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;AAAA;AAjI6C;AAAA,iBAqI/B,aAAA,CAAc,OAAuB,EAAd,YAAY;;;;iBCpKnC,iBAAA,CACd,KAAA,EAAO,WAAA,EACP,SAAA,UAAkB,KAAA,GACjB,OAAA;;;;;;;;iBAamB,oBAAA,CACpB,IAAA,EAAM,cAAA,EACN,MAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,KAAA;EAAgB,OAAA;AAAA;;;ADlCpC;AAEtB;;;;;iBCoDsB,cAAA,CACpB,IAAA,EAAM,cAAA,EACN,MAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EACD,EAAA;EACA,MAAA;EACA,MAAA;EACA,EAAA;EACA,MAAA;EACA,OAAA;AAAA;;iBAwBoB,iBAAA,CACpB,IAAA,EAAM,cAAA,EACN,MAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,EAAA;EAAa,MAAA;EAAkB,OAAA;AAAA;;;;;;;;iBAuBnD,YAAA,CACpB,IAAA,EAAM,cAAA,EACN,EAAA,UACA,MAAA,UACA,MAAA,YACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,OAAA;AAAA;;iBAWpB,OAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,MAAA;EAAiB,OAAA;AAAA;AD1GpD;AAIP;;;;AAAyC;AAJlC,iBCyHe,OAAA,CACpB,IAAA,EAAM,cAAA,EACN,OAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA;EAAU,EAAA;EAAa,MAAA;EAAgB,OAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/onboarding/google.ts"],"mappings":";;;;;wBA+BgB,kBACd,OAAO,aACP,mBAAkB,QACjB;;;;;;;;wBAamB,qBACpB,MAAM,gBACN,gBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;EAAgB;;;;;;;;;;wBAoBpC,eACpB,MAAM,gBACN,gBACA,mBAAkB,QACjB;EACD;EACA;EACA;EACA;EACA;EACA;;;wBAwBoB,kBACpB,MAAM,gBACN,gBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;EAAa;EAAkB;;;;;;;;;wBAuBnD,aACpB,MAAM,gBACN,YACA,gBACA,kBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;;;wBAWpB,QACpB,MAAM,gBACN,iBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;EAAiB;;;;;;;;wBAerC,QACpB,MAAM,gBACN,iBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB"}

package/dist/onboarding/index.mjs

@@ -1,150 +1,7 @@
 import { a as googleHeaders, i as googleAccessToken, n as encodeSite, r as errorDetail } from "../token-DkKC5m23.mjs";
-import { t as table } from "../plan-format-A18SvJ7C.mjs";
+import { a as ownerUnion, c as siteUrlFor, i as hasDrift, n as formatPlan, o as plan, r as formatSummary, s as planDomain, t as backoffSchedule } from "../plan-BLKikoOG.mjs";
 import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-CD8vwrgj.mjs";
 
-//#region src/onboarding/plan.ts
-/** The `sc-domain:` property identifier for a bare domain. */
-const siteUrlFor = (domain) => `sc-domain:${domain}`;
-/**
-* Backoff ladder for the verification retry, in milliseconds.
-*
-* DNS_TXT verification fails until the record has propagated, which is a matter of
-* seconds-to-minutes, not a real error — so the schedule is a *policy*, decided
-* here and asserted in the tests, while the actual sleeping is the CLI's job.
-* Capped at `maxAttempts`; a domain still unverified after the last attempt is
-* reported PENDING, never failed.
-*/
-function backoffSchedule(maxAttempts = 5) {
-	const out = [];
-	for (let i = 1; i <= maxAttempts; i++) out.push(2 ** i * 1e3);
-	return out;
-}
-/** Decide the four steps for one domain from its desired config and live state. */
-function planDomain(setup, state) {
-	const reminders = [];
-	if (setup.fullUserGroup) reminders.push(`add ${setup.fullUserGroup} as a Full User in Search Console — no API exists for this, do it in the UI`);
-	const txt = state.txtPresent ? {
-		action: "skip",
-		detail: "apex TXT already present"
-	} : {
-		action: "create",
-		detail: "create apex TXT verification record"
-	};
-	const verify = state.verified ? {
-		action: "skip",
-		detail: "ownership already verified"
-	} : {
-		action: "create",
-		detail: "verify ownership (DNS_TXT)"
-	};
-	const property = state.propertyExists ? {
-		action: "skip",
-		detail: "property already exists"
-	} : {
-		action: "create",
-		detail: `add property ${siteUrlFor(setup.domain)}`
-	};
-	const desired = setup.delegatedOwners ?? [];
-	const present = new Set(state.currentOwners.map((o) => o.toLowerCase()));
-	const ownersToAdd = desired.filter((o) => !present.has(o.toLowerCase()));
-	const owners = desired.length === 0 ? {
-		action: "skip",
-		detail: "no delegated owners"
-	} : ownersToAdd.length === 0 ? {
-		action: "skip",
-		detail: "all delegated owners already present"
-	} : {
-		action: "update",
-		detail: `add ${ownersToAdd.length} owner(s): ${ownersToAdd.join(", ")}`
-	};
-	return {
-		domain: setup.domain,
-		siteUrl: siteUrlFor(setup.domain),
-		txt,
-		verify,
-		property,
-		owners,
-		ownersToAdd,
-		reminders
-	};
-}
-/**
-* The owner set to PUT: everyone already there, plus everyone being added.
-*
-* `updateOwners` REPLACES the owner list, so this is the one computation standing
-* between a delegation and locking yourself out — pass a bare `ownersToAdd` and
-* the account that just verified the domain is removed from it. It belongs here
-* rather than at the call site for exactly that reason: it is a decision, it is
-* the dangerous one, and the executor is not allowed to make it.
-*
-* `current` comes FIRST so the API's own casing survives dedupe; matching is
-* case-insensitive, mirroring `planDomain`'s `present` check, because Google
-* echoes back addresses in whatever case the account uses and a case-sensitive
-* `Set` would re-add an owner who is already there.
-*/
-function ownerUnion(current, toAdd) {
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const o of [...current, ...toAdd]) {
-		const key = o.toLowerCase();
-		if (seen.has(key)) continue;
-		seen.add(key);
-		out.push(o);
-	}
-	return out;
-}
-/** Plan every domain. */
-function plan(config, states) {
-	const notes = [];
-	return {
-		domains: config.domains.map((setup) => {
-			const state = states.get(setup.domain);
-			if (!state) notes.push(`${setup.domain}: no observed state; treating everything as pending`);
-			return planDomain(setup, state ?? {
-				txtPresent: false,
-				verified: false,
-				currentOwners: [],
-				propertyExists: false
-			});
-		}),
-		notes
-	};
-}
-/** Any step on any domain is a mutation — i.e. the live state has drifted. */
-function hasDrift(p) {
-	return p.domains.some((d) => d.txt.action !== "skip" || d.verify.action !== "skip" || d.property.action !== "skip" || d.owners.action !== "skip");
-}
-/** Render a plan as the block `--dry` and `--check` print. */
-function formatPlan(p) {
-	const lines = [];
-	const glyph = (s) => s.action === "skip" ? "·" : "+";
-	for (const d of p.domains) {
-		lines.push(d.domain);
-		lines.push(`  ${glyph(d.txt)} TXT       ${d.txt.detail}`);
-		lines.push(`  ${glyph(d.verify)} verify    ${d.verify.detail}`);
-		lines.push(`  ${glyph(d.property)} property  ${d.property.detail}`);
-		lines.push(`  ${glyph(d.owners)} owners    ${d.owners.detail}`);
-		for (const r of d.reminders) lines.push(`  ! ${r}`);
-	}
-	for (const n of p.notes) lines.push(`! ${n}`);
-	return lines.join("\n");
-}
-/** Render the end-of-run summary: one row per domain, plus any reminders. */
-function formatSummary(results) {
-	return table([
-		"DOMAIN",
-		"TXT",
-		"VERIFIED",
-		"PROPERTY"
-	], results.map((r) => [
-		r.domain,
-		r.txt,
-		r.verified,
-		r.property
-	]), results.flatMap((r) => r.reminders.map((m) => `  ! ${r.domain}: ${m}`)));
-}
-
-//#endregion
 //#region src/onboarding/google.ts
 /**
 * Google — the two APIs onboarding drives, and the user-OAuth token behind both.

package/dist/onboarding/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/onboarding/plan.ts","../../src/onboarding/google.ts"],"sourcesContent":["/**\n * Every decision `vitops search setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock. The executors\n * beside this one gather each domain's live state and apply what they are told;\n * this module decides, from that state, what is left to do. That split is what\n * makes `--dry` a complete account of a run and `--check` an honest drift report —\n * the same arrangement the indexing planner makes against `gsc.ts`/`indexnow.ts`.\n *\n * Idempotency lives here too: a step whose desired state already holds resolves to\n * `skip`, so a re-run of a fully-onboarded domain is all skips — a no-op, by\n * construction rather than by the executors checking twice.\n */\nimport type { DomainSetup, DomainState, OnboardingConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision: do it, or skip it because it already holds. */\nexport type StepAction = 'create' | 'update' | 'skip';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do. */\n  detail: string;\n}\n\n/** The four onboarding steps for one domain, decided against its live state. */\nexport interface DomainPlan {\n  domain: string;\n  /** `sc-domain:` property identifier this domain maps to. */\n  siteUrl: string;\n  /** Ensure the apex TXT verification record. */\n  txt: StepPlan;\n  /** Verify ownership via the Site Verification API (DNS_TXT). */\n  verify: StepPlan;\n  /** Add the Search Console domain property. */\n  property: StepPlan;\n  /** Add delegated owners to the verified web resource. */\n  owners: StepPlan;\n  /** Owners not yet present that the run should add. */\n  ownersToAdd: string[];\n  /** Manual follow-ups (e.g. a Full-User group). */\n  reminders: string[];\n}\n\nexport interface OnboardingPlan {\n  domains: DomainPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/** The `sc-domain:` property identifier for a bare domain. */\nexport const siteUrlFor = (domain: string): string => `sc-domain:${domain}`;\n\n/**\n * Backoff ladder for the verification retry, in milliseconds.\n *\n * DNS_TXT verification fails until the record has propagated, which is a matter of\n * seconds-to-minutes, not a real error — so the schedule is a *policy*, decided\n * here and asserted in the tests, while the actual sleeping is the CLI's job.\n * Capped at `maxAttempts`; a domain still unverified after the last attempt is\n * reported PENDING, never failed.\n */\nexport function backoffSchedule(maxAttempts = 5): number[] {\n  const out: number[] = [];\n  for (let i = 1; i <= maxAttempts; i++) out.push(2 ** i * 1000);\n  return out;\n}\n\n/** Decide the four steps for one domain from its desired config and live state. */\nexport function planDomain(setup: DomainSetup, state: DomainState): DomainPlan {\n  const reminders: string[] = [];\n  if (setup.fullUserGroup)\n    reminders.push(\n      `add ${setup.fullUserGroup} as a Full User in Search Console — no API exists for this, do it in the UI`,\n    );\n\n  const txt: StepPlan = state.txtPresent\n    ? { action: 'skip', detail: 'apex TXT already present' }\n    : { action: 'create', detail: 'create apex TXT verification record' };\n\n  const verify: StepPlan = state.verified\n    ? { action: 'skip', detail: 'ownership already verified' }\n    : { action: 'create', detail: 'verify ownership (DNS_TXT)' };\n\n  const property: StepPlan = state.propertyExists\n    ? { action: 'skip', detail: 'property already exists' }\n    : { action: 'create', detail: `add property ${siteUrlFor(setup.domain)}` };\n\n  // Owners can only be read once verified; before that, treat every delegated\n  // owner as still-to-add so --check reports the drift rather than hiding it.\n  const desired = setup.delegatedOwners ?? [];\n  const present = new Set(state.currentOwners.map((o) => o.toLowerCase()));\n  const ownersToAdd = desired.filter((o) => !present.has(o.toLowerCase()));\n  const owners: StepPlan =\n    desired.length === 0\n      ? { action: 'skip', detail: 'no delegated owners' }\n      : ownersToAdd.length === 0\n        ? { action: 'skip', detail: 'all delegated owners already present' }\n        : {\n            action: 'update',\n            detail: `add ${ownersToAdd.length} owner(s): ${ownersToAdd.join(', ')}`,\n          };\n\n  return {\n    domain: setup.domain,\n    siteUrl: siteUrlFor(setup.domain),\n    txt,\n    verify,\n    property,\n    owners,\n    ownersToAdd,\n    reminders,\n  };\n}\n\n/**\n * The owner set to PUT: everyone already there, plus everyone being added.\n *\n * `updateOwners` REPLACES the owner list, so this is the one computation standing\n * between a delegation and locking yourself out — pass a bare `ownersToAdd` and\n * the account that just verified the domain is removed from it. It belongs here\n * rather than at the call site for exactly that reason: it is a decision, it is\n * the dangerous one, and the executor is not allowed to make it.\n *\n * `current` comes FIRST so the API's own casing survives dedupe; matching is\n * case-insensitive, mirroring `planDomain`'s `present` check, because Google\n * echoes back addresses in whatever case the account uses and a case-sensitive\n * `Set` would re-add an owner who is already there.\n */\nexport function ownerUnion(current: string[], toAdd: string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const o of [...current, ...toAdd]) {\n    const key = o.toLowerCase();\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(o);\n  }\n  return out;\n}\n\n/** Plan every domain. */\nexport function plan(config: OnboardingConfig, states: Map<string, DomainState>): OnboardingPlan {\n  const notes: string[] = [];\n  const domains = config.domains.map((setup) => {\n    const state = states.get(setup.domain);\n    if (!state)\n      // Should not happen — the CLI observes every domain before planning — but a\n      // missing observation must not silently read as \"nothing to do\".\n      notes.push(`${setup.domain}: no observed state; treating everything as pending`);\n    return planDomain(\n      setup,\n      state ?? { txtPresent: false, verified: false, currentOwners: [], propertyExists: false },\n    );\n  });\n  return { domains, notes };\n}\n\n/** Any step on any domain is a mutation — i.e. the live state has drifted. */\nexport function hasDrift(p: OnboardingPlan): boolean {\n  return p.domains.some(\n    (d) =>\n      d.txt.action !== 'skip' ||\n      d.verify.action !== 'skip' ||\n      d.property.action !== 'skip' ||\n      d.owners.action !== 'skip',\n  );\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: OnboardingPlan): string {\n  const lines: string[] = [];\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : '+');\n  for (const d of p.domains) {\n    lines.push(d.domain);\n    lines.push(`  ${glyph(d.txt)} TXT       ${d.txt.detail}`);\n    lines.push(`  ${glyph(d.verify)} verify    ${d.verify.detail}`);\n    lines.push(`  ${glyph(d.property)} property  ${d.property.detail}`);\n    lines.push(`  ${glyph(d.owners)} owners    ${d.owners.detail}`);\n    for (const r of d.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one domain's run, for the summary table. */\nexport interface DomainResult {\n  domain: string;\n  txt: 'created' | 'present' | 'failed' | '—';\n  verified: 'yes' | 'pending' | 'failed' | '—';\n  property: 'added' | 'present' | 'failed' | '—';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per domain, plus any reminders. */\nexport function formatSummary(results: DomainResult[]): string {\n  const headers = ['DOMAIN', 'TXT', 'VERIFIED', 'PROPERTY'];\n  const rows = results.map((r) => [r.domain, r.txt, r.verified, r.property]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.domain}: ${m}`));\n  return table(headers, rows, reminders);\n}\n","/**\n * Google — the two APIs onboarding drives, and the user-OAuth token behind both.\n *\n * Auth here is a **user OAuth refresh token**, not a service account: verifying a\n * site and adding a Search Console property act *as a person* who can own them, not\n * as a project robot. That makes the token exchange simpler than the indexing\n * module's — a `refresh_token` grant, no JWT and no `node:crypto` — but it needs\n * broader scope, granted when the refresh token is minted:\n *   - `https://www.googleapis.com/auth/siteverification`  (Site Verification API)\n *   - `https://www.googleapis.com/auth/webmasters`        (Search Console API)\n *\n * The exchange itself lives in `../google/token.ts`, shared with `indexing/gsc.ts`\n * — the grants differ, everything after building the form body did not. It throws\n * (nothing downstream can run without a token) while every API call below returns\n * a structured result and lets the caller decide per domain. `googleapis` is\n * deliberately not a dependency — these are a handful of REST endpoints in a CLI\n * that installs into every consumer.\n */\nimport {\n  encodeSite,\n  errorDetail,\n  googleAccessToken,\n  googleHeaders,\n  type GoogleAuthLike,\n  type GoogleOAuth,\n} from '../google/token.ts';\n\nconst SITEVERIFICATION = 'https://www.googleapis.com/siteVerification/v1';\nconst WEBMASTERS = 'https://www.googleapis.com/webmasters/v3';\n\n/** Exchange a user OAuth refresh token for a short-lived access token. */\nexport function refreshTokenGrant(\n  oauth: GoogleOAuth,\n  fetchImpl: typeof fetch = fetch,\n): Promise<string> {\n  return googleAccessToken({ kind: 'oauth', oauth }, fetchImpl);\n}\n\nconst inetSite = (domain: string) => ({ type: 'INET_DOMAIN', identifier: domain });\n\n/**\n * Ask the Site Verification API for the DNS_TXT token for a domain.\n *\n * Returns the full `google-site-verification=…` value that goes in the apex TXT\n * record. It is deterministic per (user, domain), so re-fetching it and comparing\n * against DNS is what makes the TXT step idempotent.\n */\nexport async function getVerificationToken(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; token?: string; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/token`, {\n    method: 'POST',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ verificationMethod: 'DNS_TXT', site: inetSite(domain) }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, message: await res.text() };\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) return { ok: false, status: res.status, message: 'no token in response' };\n  return { ok: true, status: res.status, token: body.token };\n}\n\n/**\n * Look up the verified web resource for a domain, if any.\n *\n * Uses `webResource.list` rather than a `get` by id, because the id format for an\n * INET_DOMAIN resource is awkward to construct by hand and the list only ever\n * contains resources the user already owns — so a hit *is* the verified state, and\n * carries the id and owners the later steps need.\n */\nexport async function getWebResource(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{\n  ok: boolean;\n  status: number;\n  exists: boolean;\n  id?: string;\n  owners: string[];\n  message?: string;\n}> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource`, {\n    headers: googleHeaders(auth),\n  });\n  if (!res.ok)\n    return { ok: false, status: res.status, exists: false, owners: [], message: await res.text() };\n  const body = (await res.json()) as {\n    items?: { id?: string; site?: { type?: string; identifier?: string }; owners?: string[] }[];\n  };\n  const match = body.items?.find(\n    (it) => it.site?.type === 'INET_DOMAIN' && it.site?.identifier === domain,\n  );\n  if (!match) return { ok: true, status: res.status, exists: false, owners: [] };\n  return {\n    ok: true,\n    status: res.status,\n    exists: true,\n    ...(match.id ? { id: match.id } : {}),\n    owners: match.owners ?? [],\n  };\n}\n\n/** Verify ownership (DNS_TXT). Succeeds only once the TXT record has propagated. */\nexport async function verifyWebResource(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; id?: string; owners: string[]; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource?verificationMethod=DNS_TXT`, {\n    method: 'POST',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ site: inetSite(domain), verificationMethod: 'DNS_TXT' }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, owners: [], message: await res.text() };\n  const body = (await res.json()) as { id?: string; owners?: string[] };\n  return {\n    ok: true,\n    status: res.status,\n    ...(body.id ? { id: body.id } : {}),\n    owners: body.owners ?? [],\n  };\n}\n\n/**\n * Set the owners of a verified web resource to a given list.\n *\n * The API replaces the owner set, so the caller passes the **union** of the\n * current owners and the ones to add — never a bare list of new owners, which\n * would drop everyone already there.\n */\nexport async function updateOwners(\n  auth: GoogleAuthLike,\n  id: string,\n  domain: string,\n  owners: string[],\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ id, site: inetSite(domain), owners }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, message: await res.text() };\n  return { ok: true, status: res.status };\n}\n\n/** Whether a Search Console property already exists (`GET sites/{siteUrl}`). */\nexport async function getSite(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; exists: boolean; message?: string }> {\n  const res = await fetchImpl(`${WEBMASTERS}/sites/${encodeSite(siteUrl)}`, {\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status, exists: true };\n  if (res.status === 404) return { ok: true, status: res.status, exists: false };\n  return { ok: false, status: res.status, exists: false, message: await res.text() };\n}\n\n/**\n * Add a Search Console property (`PUT sites/{siteUrl}`).\n *\n * A `403` here almost always means the domain is not yet verified for this user\n * rather than a transient error — property creation is gated on ownership.\n */\nexport async function addSite(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${WEBMASTERS}/sites/${encodeSite(siteUrl)}`, {\n    method: 'PUT',\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status };\n  const message = await errorDetail(res, (status) =>\n    status === 403\n      ? `403 — \"${siteUrl}\" is not verified for this account yet, or the OAuth token lacks the webmasters scope`\n      : undefined,\n  );\n  return { ok: false, status: res.status, message };\n}\n"],"mappings":";;;;;;AAmDA,MAAa,cAAc,WAA2B,aAAa;;;;;;;;;;AAWnE,SAAgB,gBAAgB,cAAc,GAAa;CACzD,MAAM,MAAgB,CAAC;CACvB,KAAK,IAAI,IAAI,GAAG,KAAK,aAAa,KAAK,IAAI,KAAK,KAAK,IAAI,GAAI;CAC7D,OAAO;AACT;;AAGA,SAAgB,WAAW,OAAoB,OAAgC;CAC7E,MAAM,YAAsB,CAAC;CAC7B,IAAI,MAAM,eACR,UAAU,KACR,OAAO,MAAM,cAAc,4EAC7B;CAEF,MAAM,MAAgB,MAAM,aACxB;EAAE,QAAQ;EAAQ,QAAQ;CAA2B,IACrD;EAAE,QAAQ;EAAU,QAAQ;CAAsC;CAEtE,MAAM,SAAmB,MAAM,WAC3B;EAAE,QAAQ;EAAQ,QAAQ;CAA6B,IACvD;EAAE,QAAQ;EAAU,QAAQ;CAA6B;CAE7D,MAAM,WAAqB,MAAM,iBAC7B;EAAE,QAAQ;EAAQ,QAAQ;CAA0B,IACpD;EAAE,QAAQ;EAAU,QAAQ,gBAAgB,WAAW,MAAM,MAAM;CAAI;CAI3E,MAAM,UAAU,MAAM,mBAAmB,CAAC;CAC1C,MAAM,UAAU,IAAI,IAAI,MAAM,cAAc,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;CACvE,MAAM,cAAc,QAAQ,QAAQ,MAAM,CAAC,QAAQ,IAAI,EAAE,YAAY,CAAC,CAAC;CACvE,MAAM,SACJ,QAAQ,WAAW,IACf;EAAE,QAAQ;EAAQ,QAAQ;CAAsB,IAChD,YAAY,WAAW,IACrB;EAAE,QAAQ;EAAQ,QAAQ;CAAuC,IACjE;EACE,QAAQ;EACR,QAAQ,OAAO,YAAY,OAAO,aAAa,YAAY,KAAK,IAAI;CACtE;CAER,OAAO;EACL,QAAQ,MAAM;EACd,SAAS,WAAW,MAAM,MAAM;EAChC;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,WAAW,SAAmB,OAA2B;CACvE,MAAM,MAAgB,CAAC;CACvB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,KAAK,CAAC,GAAG,SAAS,GAAG,KAAK,GAAG;EACtC,MAAM,MAAM,EAAE,YAAY;EAC1B,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EACZ,IAAI,KAAK,CAAC;CACZ;CACA,OAAO;AACT;;AAGA,SAAgB,KAAK,QAA0B,QAAkD;CAC/F,MAAM,QAAkB,CAAC;CAYzB,OAAO;EAAE,SAXO,OAAO,QAAQ,KAAK,UAAU;GAC5C,MAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;GACrC,IAAI,CAAC,OAGH,MAAM,KAAK,GAAG,MAAM,OAAO,oDAAoD;GACjF,OAAO,WACL,OACA,SAAS;IAAE,YAAY;IAAO,UAAU;IAAO,eAAe,CAAC;IAAG,gBAAgB;GAAM,CAC1F;EACF,CACe;EAAG;CAAM;AAC1B;;AAGA,SAAgB,SAAS,GAA4B;CACnD,OAAO,EAAE,QAAQ,MACd,MACC,EAAE,IAAI,WAAW,UACjB,EAAE,OAAO,WAAW,UACpB,EAAE,SAAS,WAAW,UACtB,EAAE,OAAO,WAAW,MACxB;AACF;;AAGA,SAAgB,WAAW,GAA2B;CACpD,MAAM,QAAkB,CAAC;CACzB,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM;CAC5D,KAAK,MAAM,KAAK,EAAE,SAAS;EACzB,MAAM,KAAK,EAAE,MAAM;EACnB,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,QAAQ;EACxD,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,QAAQ;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,QAAQ;EAClE,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,QAAQ;EAC9D,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAiC;CAI7D,OAAO,MAAM;EAHI;EAAU;EAAO;EAAY;CAG3B,GAFN,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAQ,EAAE;EAAK,EAAE;EAAU,EAAE;CAAQ,CAE/C,GADP,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,OAAO,IAAI,GAAG,CACnD,CAAC;AACvC;;;;;;;;;;;;;;;;;;;;;;AC7KA,MAAM,mBAAmB;AACzB,MAAM,aAAa;;AAGnB,SAAgB,kBACd,OACA,YAA0B,OACT;CACjB,OAAO,kBAAkB;EAAE,MAAM;EAAS;CAAM,GAAG,SAAS;AAC9D;AAEA,MAAM,YAAY,YAAoB;CAAE,MAAM;CAAe,YAAY;AAAO;;;;;;;;AAShF,eAAsB,qBACpB,MACA,QACA,YAA0B,OACkD;CAC5E,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,SAAS;EACvD,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE,oBAAoB;GAAW,MAAM,SAAS,MAAM;EAAE,CAAC;CAChF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,MAAM,IAAI,KAAK;CAAE;CAC/E,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS;CAAuB;CACzF,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,OAAO,KAAK;CAAM;AAC3D;;;;;;;;;AAUA,eAAsB,eACpB,MACA,QACA,YAA0B,OAQzB;CACD,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,eAAe,EAC7D,SAAS,cAAc,IAAI,EAC7B,CAAC;CACD,IAAI,CAAC,IAAI,IACP,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ;EAAO,QAAQ,CAAC;EAAG,SAAS,MAAM,IAAI,KAAK;CAAE;CAI/F,MAAM,SAAQ,MAHM,IAAI,KAAK,EAGX,CAAC,OAAO,MACvB,OAAO,GAAG,MAAM,SAAS,iBAAiB,GAAG,MAAM,eAAe,MACrE;CACA,IAAI,CAAC,OAAO,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;EAAO,QAAQ,CAAC;CAAE;CAC7E,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EACZ,QAAQ;EACR,GAAI,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;EACnC,QAAQ,MAAM,UAAU,CAAC;CAC3B;AACF;;AAGA,eAAsB,kBACpB,MACA,QACA,YAA0B,OACiE;CAC3F,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,0CAA0C;EACxF,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE,MAAM,SAAS,MAAM;GAAG,oBAAoB;EAAU,CAAC;CAChF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ,CAAC;EAAG,SAAS,MAAM,IAAI,KAAK;CAAE;CAC3F,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EACZ,GAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;EACjC,QAAQ,KAAK,UAAU,CAAC;CAC1B;AACF;;;;;;;;AASA,eAAsB,aACpB,MACA,IACA,QACA,QACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,eAAe,mBAAmB,EAAE,KAAK;EACvF,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE;GAAI,MAAM,SAAS,MAAM;GAAG;EAAO,CAAC;CAC7D,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,MAAM,IAAI,KAAK;CAAE;CAC/E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;AACxC;;AAGA,eAAsB,QACpB,MACA,SACA,YAA0B,OACmD;CAC7E,MAAM,MAAM,MAAM,UAAU,GAAG,WAAW,SAAS,WAAW,OAAO,KAAK,EACxE,SAAS,cAAc,IAAI,EAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;CAAK;CAChE,IAAI,IAAI,WAAW,KAAK,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;CAAM;CAC7E,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ;EAAO,SAAS,MAAM,IAAI,KAAK;CAAE;AACnF;;;;;;;AAQA,eAAsB,QACpB,MACA,SACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,WAAW,SAAS,WAAW,OAAO,KAAK;EACxE,QAAQ;EACR,SAAS,cAAc,IAAI;CAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;CAClD,MAAM,UAAU,MAAM,YAAY,MAAM,WACtC,WAAW,MACP,UAAU,QAAQ,yFAClB,MACN;CACA,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ;CAAQ;AAClD"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/onboarding/google.ts"],"sourcesContent":["/**\n * Google — the two APIs onboarding drives, and the user-OAuth token behind both.\n *\n * Auth here is a **user OAuth refresh token**, not a service account: verifying a\n * site and adding a Search Console property act *as a person* who can own them, not\n * as a project robot. That makes the token exchange simpler than the indexing\n * module's — a `refresh_token` grant, no JWT and no `node:crypto` — but it needs\n * broader scope, granted when the refresh token is minted:\n *   - `https://www.googleapis.com/auth/siteverification`  (Site Verification API)\n *   - `https://www.googleapis.com/auth/webmasters`        (Search Console API)\n *\n * The exchange itself lives in `../google/token.ts`, shared with `indexing/gsc.ts`\n * — the grants differ, everything after building the form body did not. It throws\n * (nothing downstream can run without a token) while every API call below returns\n * a structured result and lets the caller decide per domain. `googleapis` is\n * deliberately not a dependency — these are a handful of REST endpoints in a CLI\n * that installs into every consumer.\n */\nimport {\n  encodeSite,\n  errorDetail,\n  googleAccessToken,\n  googleHeaders,\n  type GoogleAuthLike,\n  type GoogleOAuth,\n} from '../google/token.ts';\n\nconst SITEVERIFICATION = 'https://www.googleapis.com/siteVerification/v1';\nconst WEBMASTERS = 'https://www.googleapis.com/webmasters/v3';\n\n/** Exchange a user OAuth refresh token for a short-lived access token. */\nexport function refreshTokenGrant(\n  oauth: GoogleOAuth,\n  fetchImpl: typeof fetch = fetch,\n): Promise<string> {\n  return googleAccessToken({ kind: 'oauth', oauth }, fetchImpl);\n}\n\nconst inetSite = (domain: string) => ({ type: 'INET_DOMAIN', identifier: domain });\n\n/**\n * Ask the Site Verification API for the DNS_TXT token for a domain.\n *\n * Returns the full `google-site-verification=…` value that goes in the apex TXT\n * record. It is deterministic per (user, domain), so re-fetching it and comparing\n * against DNS is what makes the TXT step idempotent.\n */\nexport async function getVerificationToken(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; token?: string; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/token`, {\n    method: 'POST',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ verificationMethod: 'DNS_TXT', site: inetSite(domain) }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, message: await res.text() };\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) return { ok: false, status: res.status, message: 'no token in response' };\n  return { ok: true, status: res.status, token: body.token };\n}\n\n/**\n * Look up the verified web resource for a domain, if any.\n *\n * Uses `webResource.list` rather than a `get` by id, because the id format for an\n * INET_DOMAIN resource is awkward to construct by hand and the list only ever\n * contains resources the user already owns — so a hit *is* the verified state, and\n * carries the id and owners the later steps need.\n */\nexport async function getWebResource(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{\n  ok: boolean;\n  status: number;\n  exists: boolean;\n  id?: string;\n  owners: string[];\n  message?: string;\n}> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource`, {\n    headers: googleHeaders(auth),\n  });\n  if (!res.ok)\n    return { ok: false, status: res.status, exists: false, owners: [], message: await res.text() };\n  const body = (await res.json()) as {\n    items?: { id?: string; site?: { type?: string; identifier?: string }; owners?: string[] }[];\n  };\n  const match = body.items?.find(\n    (it) => it.site?.type === 'INET_DOMAIN' && it.site?.identifier === domain,\n  );\n  if (!match) return { ok: true, status: res.status, exists: false, owners: [] };\n  return {\n    ok: true,\n    status: res.status,\n    exists: true,\n    ...(match.id ? { id: match.id } : {}),\n    owners: match.owners ?? [],\n  };\n}\n\n/** Verify ownership (DNS_TXT). Succeeds only once the TXT record has propagated. */\nexport async function verifyWebResource(\n  auth: GoogleAuthLike,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; id?: string; owners: string[]; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource?verificationMethod=DNS_TXT`, {\n    method: 'POST',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ site: inetSite(domain), verificationMethod: 'DNS_TXT' }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, owners: [], message: await res.text() };\n  const body = (await res.json()) as { id?: string; owners?: string[] };\n  return {\n    ok: true,\n    status: res.status,\n    ...(body.id ? { id: body.id } : {}),\n    owners: body.owners ?? [],\n  };\n}\n\n/**\n * Set the owners of a verified web resource to a given list.\n *\n * The API replaces the owner set, so the caller passes the **union** of the\n * current owners and the ones to add — never a bare list of new owners, which\n * would drop everyone already there.\n */\nexport async function updateOwners(\n  auth: GoogleAuthLike,\n  id: string,\n  domain: string,\n  owners: string[],\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${SITEVERIFICATION}/webResource/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: googleHeaders(auth, { 'content-type': 'application/json' }),\n    body: JSON.stringify({ id, site: inetSite(domain), owners }),\n  });\n  if (!res.ok) return { ok: false, status: res.status, message: await res.text() };\n  return { ok: true, status: res.status };\n}\n\n/** Whether a Search Console property already exists (`GET sites/{siteUrl}`). */\nexport async function getSite(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; exists: boolean; message?: string }> {\n  const res = await fetchImpl(`${WEBMASTERS}/sites/${encodeSite(siteUrl)}`, {\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status, exists: true };\n  if (res.status === 404) return { ok: true, status: res.status, exists: false };\n  return { ok: false, status: res.status, exists: false, message: await res.text() };\n}\n\n/**\n * Add a Search Console property (`PUT sites/{siteUrl}`).\n *\n * A `403` here almost always means the domain is not yet verified for this user\n * rather than a transient error — property creation is gated on ownership.\n */\nexport async function addSite(\n  auth: GoogleAuthLike,\n  siteUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${WEBMASTERS}/sites/${encodeSite(siteUrl)}`, {\n    method: 'PUT',\n    headers: googleHeaders(auth),\n  });\n  if (res.ok) return { ok: true, status: res.status };\n  const message = await errorDetail(res, (status) =>\n    status === 403\n      ? `403 — \"${siteUrl}\" is not verified for this account yet, or the OAuth token lacks the webmasters scope`\n      : undefined,\n  );\n  return { ok: false, status: res.status, message };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,mBAAmB;AACzB,MAAM,aAAa;;AAGnB,SAAgB,kBACd,OACA,YAA0B,OACT;CACjB,OAAO,kBAAkB;EAAE,MAAM;EAAS;CAAM,GAAG,SAAS;AAC9D;AAEA,MAAM,YAAY,YAAoB;CAAE,MAAM;CAAe,YAAY;AAAO;;;;;;;;AAShF,eAAsB,qBACpB,MACA,QACA,YAA0B,OACkD;CAC5E,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,SAAS;EACvD,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE,oBAAoB;GAAW,MAAM,SAAS,MAAM;EAAE,CAAC;CAChF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,MAAM,IAAI,KAAK;CAAE;CAC/E,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS;CAAuB;CACzF,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,OAAO,KAAK;CAAM;AAC3D;;;;;;;;;AAUA,eAAsB,eACpB,MACA,QACA,YAA0B,OAQzB;CACD,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,eAAe,EAC7D,SAAS,cAAc,IAAI,EAC7B,CAAC;CACD,IAAI,CAAC,IAAI,IACP,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ;EAAO,QAAQ,CAAC;EAAG,SAAS,MAAM,IAAI,KAAK;CAAE;CAI/F,MAAM,SAAQ,MAHM,IAAI,KAAK,EAGX,CAAC,OAAO,MACvB,OAAO,GAAG,MAAM,SAAS,iBAAiB,GAAG,MAAM,eAAe,MACrE;CACA,IAAI,CAAC,OAAO,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;EAAO,QAAQ,CAAC;CAAE;CAC7E,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EACZ,QAAQ;EACR,GAAI,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;EACnC,QAAQ,MAAM,UAAU,CAAC;CAC3B;AACF;;AAGA,eAAsB,kBACpB,MACA,QACA,YAA0B,OACiE;CAC3F,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,0CAA0C;EACxF,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE,MAAM,SAAS,MAAM;GAAG,oBAAoB;EAAU,CAAC;CAChF,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ,CAAC;EAAG,SAAS,MAAM,IAAI,KAAK;CAAE;CAC3F,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EACZ,GAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;EACjC,QAAQ,KAAK,UAAU,CAAC;CAC1B;AACF;;;;;;;;AASA,eAAsB,aACpB,MACA,IACA,QACA,QACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,iBAAiB,eAAe,mBAAmB,EAAE,KAAK;EACvF,QAAQ;EACR,SAAS,cAAc,MAAM,EAAE,gBAAgB,mBAAmB,CAAC;EACnE,MAAM,KAAK,UAAU;GAAE;GAAI,MAAM,SAAS,MAAM;GAAG;EAAO,CAAC;CAC7D,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,MAAM,IAAI,KAAK;CAAE;CAC/E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;AACxC;;AAGA,eAAsB,QACpB,MACA,SACA,YAA0B,OACmD;CAC7E,MAAM,MAAM,MAAM,UAAU,GAAG,WAAW,SAAS,WAAW,OAAO,KAAK,EACxE,SAAS,cAAc,IAAI,EAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;CAAK;CAChE,IAAI,IAAI,WAAW,KAAK,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ;CAAM;CAC7E,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,QAAQ;EAAO,SAAS,MAAM,IAAI,KAAK;CAAE;AACnF;;;;;;;AAQA,eAAsB,QACpB,MACA,SACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,WAAW,SAAS,WAAW,OAAO,KAAK;EACxE,QAAQ;EACR,SAAS,cAAc,IAAI;CAC7B,CAAC;CACD,IAAI,IAAI,IAAI,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;CAClD,MAAM,UAAU,MAAM,YAAY,MAAM,WACtC,WAAW,MACP,UAAU,QAAQ,yFAClB,MACN;CACA,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ;CAAQ;AAClD"}