@getvitops/utils 8.1.0 → 8.2.0-alpha.0

package/dist/plan-BLKikoOG.mjs

@@ -0,0 +1,150 @@
+import { t as table } from "./plan-format-A18SvJ7C.mjs";
+
+//#region src/onboarding/plan.ts
+/** The `sc-domain:` property identifier for a bare domain. */
+const siteUrlFor = (domain) => `sc-domain:${domain}`;
+/**
+* Backoff ladder for the verification retry, in milliseconds.
+*
+* DNS_TXT verification fails until the record has propagated, which is a matter of
+* seconds-to-minutes, not a real error — so the schedule is a *policy*, decided
+* here and asserted in the tests, while the actual sleeping is the CLI's job.
+* Capped at `maxAttempts`; a domain still unverified after the last attempt is
+* reported PENDING, never failed.
+*/
+function backoffSchedule(maxAttempts = 5) {
+	const out = [];
+	for (let i = 1; i <= maxAttempts; i++) out.push(2 ** i * 1e3);
+	return out;
+}
+/** Decide the four steps for one domain from its desired config and live state. */
+function planDomain(setup, state) {
+	const reminders = [];
+	if (setup.fullUserGroup) reminders.push(`add ${setup.fullUserGroup} as a Full User in Search Console — no API exists for this, do it in the UI`);
+	const txt = state.txtPresent ? {
+		action: "skip",
+		detail: "apex TXT already present"
+	} : {
+		action: "create",
+		detail: "create apex TXT verification record"
+	};
+	const verify = state.verified ? {
+		action: "skip",
+		detail: "ownership already verified"
+	} : {
+		action: "create",
+		detail: "verify ownership (DNS_TXT)"
+	};
+	const property = state.propertyExists ? {
+		action: "skip",
+		detail: "property already exists"
+	} : {
+		action: "create",
+		detail: `add property ${siteUrlFor(setup.domain)}`
+	};
+	const desired = setup.delegatedOwners ?? [];
+	const present = new Set(state.currentOwners.map((o) => o.toLowerCase()));
+	const ownersToAdd = desired.filter((o) => !present.has(o.toLowerCase()));
+	const owners = desired.length === 0 ? {
+		action: "skip",
+		detail: "no delegated owners"
+	} : ownersToAdd.length === 0 ? {
+		action: "skip",
+		detail: "all delegated owners already present"
+	} : {
+		action: "update",
+		detail: `add ${ownersToAdd.length} owner(s): ${ownersToAdd.join(", ")}`
+	};
+	return {
+		domain: setup.domain,
+		siteUrl: siteUrlFor(setup.domain),
+		txt,
+		verify,
+		property,
+		owners,
+		ownersToAdd,
+		reminders
+	};
+}
+/**
+* The owner set to PUT: everyone already there, plus everyone being added.
+*
+* `updateOwners` REPLACES the owner list, so this is the one computation standing
+* between a delegation and locking yourself out — pass a bare `ownersToAdd` and
+* the account that just verified the domain is removed from it. It belongs here
+* rather than at the call site for exactly that reason: it is a decision, it is
+* the dangerous one, and the executor is not allowed to make it.
+*
+* `current` comes FIRST so the API's own casing survives dedupe; matching is
+* case-insensitive, mirroring `planDomain`'s `present` check, because Google
+* echoes back addresses in whatever case the account uses and a case-sensitive
+* `Set` would re-add an owner who is already there.
+*/
+function ownerUnion(current, toAdd) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const o of [...current, ...toAdd]) {
+		const key = o.toLowerCase();
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(o);
+	}
+	return out;
+}
+/** Plan every domain. */
+function plan(config, states) {
+	const notes = [];
+	return {
+		domains: config.domains.map((setup) => {
+			const state = states.get(setup.domain);
+			if (!state) notes.push(`${setup.domain}: no observed state; treating everything as pending`);
+			return planDomain(setup, state ?? {
+				txtPresent: false,
+				verified: false,
+				currentOwners: [],
+				propertyExists: false
+			});
+		}),
+		notes
+	};
+}
+/** Any step on any domain is a mutation — i.e. the live state has drifted. */
+function hasDrift(p) {
+	return p.domains.some((d) => d.txt.action !== "skip" || d.verify.action !== "skip" || d.property.action !== "skip" || d.owners.action !== "skip");
+}
+/** Render a plan as the block `--dry` and `--check` print. */
+function formatPlan(p) {
+	const lines = [];
+	const glyph = (s) => s.action === "skip" ? "·" : "+";
+	for (const d of p.domains) {
+		lines.push(d.domain);
+		lines.push(`  ${glyph(d.txt)} TXT       ${d.txt.detail}`);
+		lines.push(`  ${glyph(d.verify)} verify    ${d.verify.detail}`);
+		lines.push(`  ${glyph(d.property)} property  ${d.property.detail}`);
+		lines.push(`  ${glyph(d.owners)} owners    ${d.owners.detail}`);
+		for (const r of d.reminders) lines.push(`  ! ${r}`);
+	}
+	for (const n of p.notes) lines.push(`! ${n}`);
+	return lines.join("\n");
+}
+/** Render the end-of-run summary: one row per domain, plus any reminders. */
+function formatSummary(results) {
+	const headers = [
+		"DOMAIN",
+		"TXT",
+		"VERIFIED",
+		"PROPERTY"
+	];
+	const rows = results.map((r) => [
+		r.domain,
+		r.txt,
+		r.verified,
+		r.property
+	]);
+	const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.domain}: ${m}`));
+	return table(headers, rows, reminders);
+}
+
+//#endregion
+export { ownerUnion as a, siteUrlFor as c, hasDrift as i, formatPlan as n, plan as o, formatSummary as r, planDomain as s, backoffSchedule as t };
+//# sourceMappingURL=plan-BLKikoOG.mjs.map

package/dist/plan-BLKikoOG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-BLKikoOG.mjs","names":[],"sources":["../src/onboarding/plan.ts"],"sourcesContent":["/**\n * Every decision `vitops search setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock. The executors\n * beside this one gather each domain's live state and apply what they are told;\n * this module decides, from that state, what is left to do. That split is what\n * makes `--dry` a complete account of a run and `--check` an honest drift report —\n * the same arrangement the indexing planner makes against `gsc.ts`/`indexnow.ts`.\n *\n * Idempotency lives here too: a step whose desired state already holds resolves to\n * `skip`, so a re-run of a fully-onboarded domain is all skips — a no-op, by\n * construction rather than by the executors checking twice.\n */\nimport type { DomainSetup, DomainState, OnboardingConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision: do it, or skip it because it already holds. */\nexport type StepAction = 'create' | 'update' | 'skip';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do. */\n  detail: string;\n}\n\n/** The four onboarding steps for one domain, decided against its live state. */\nexport interface DomainPlan {\n  domain: string;\n  /** `sc-domain:` property identifier this domain maps to. */\n  siteUrl: string;\n  /** Ensure the apex TXT verification record. */\n  txt: StepPlan;\n  /** Verify ownership via the Site Verification API (DNS_TXT). */\n  verify: StepPlan;\n  /** Add the Search Console domain property. */\n  property: StepPlan;\n  /** Add delegated owners to the verified web resource. */\n  owners: StepPlan;\n  /** Owners not yet present that the run should add. */\n  ownersToAdd: string[];\n  /** Manual follow-ups (e.g. a Full-User group). */\n  reminders: string[];\n}\n\nexport interface OnboardingPlan {\n  domains: DomainPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/** The `sc-domain:` property identifier for a bare domain. */\nexport const siteUrlFor = (domain: string): string => `sc-domain:${domain}`;\n\n/**\n * Backoff ladder for the verification retry, in milliseconds.\n *\n * DNS_TXT verification fails until the record has propagated, which is a matter of\n * seconds-to-minutes, not a real error — so the schedule is a *policy*, decided\n * here and asserted in the tests, while the actual sleeping is the CLI's job.\n * Capped at `maxAttempts`; a domain still unverified after the last attempt is\n * reported PENDING, never failed.\n */\nexport function backoffSchedule(maxAttempts = 5): number[] {\n  const out: number[] = [];\n  for (let i = 1; i <= maxAttempts; i++) out.push(2 ** i * 1000);\n  return out;\n}\n\n/** Decide the four steps for one domain from its desired config and live state. */\nexport function planDomain(setup: DomainSetup, state: DomainState): DomainPlan {\n  const reminders: string[] = [];\n  if (setup.fullUserGroup)\n    reminders.push(\n      `add ${setup.fullUserGroup} as a Full User in Search Console — no API exists for this, do it in the UI`,\n    );\n\n  const txt: StepPlan = state.txtPresent\n    ? { action: 'skip', detail: 'apex TXT already present' }\n    : { action: 'create', detail: 'create apex TXT verification record' };\n\n  const verify: StepPlan = state.verified\n    ? { action: 'skip', detail: 'ownership already verified' }\n    : { action: 'create', detail: 'verify ownership (DNS_TXT)' };\n\n  const property: StepPlan = state.propertyExists\n    ? { action: 'skip', detail: 'property already exists' }\n    : { action: 'create', detail: `add property ${siteUrlFor(setup.domain)}` };\n\n  // Owners can only be read once verified; before that, treat every delegated\n  // owner as still-to-add so --check reports the drift rather than hiding it.\n  const desired = setup.delegatedOwners ?? [];\n  const present = new Set(state.currentOwners.map((o) => o.toLowerCase()));\n  const ownersToAdd = desired.filter((o) => !present.has(o.toLowerCase()));\n  const owners: StepPlan =\n    desired.length === 0\n      ? { action: 'skip', detail: 'no delegated owners' }\n      : ownersToAdd.length === 0\n        ? { action: 'skip', detail: 'all delegated owners already present' }\n        : {\n            action: 'update',\n            detail: `add ${ownersToAdd.length} owner(s): ${ownersToAdd.join(', ')}`,\n          };\n\n  return {\n    domain: setup.domain,\n    siteUrl: siteUrlFor(setup.domain),\n    txt,\n    verify,\n    property,\n    owners,\n    ownersToAdd,\n    reminders,\n  };\n}\n\n/**\n * The owner set to PUT: everyone already there, plus everyone being added.\n *\n * `updateOwners` REPLACES the owner list, so this is the one computation standing\n * between a delegation and locking yourself out — pass a bare `ownersToAdd` and\n * the account that just verified the domain is removed from it. It belongs here\n * rather than at the call site for exactly that reason: it is a decision, it is\n * the dangerous one, and the executor is not allowed to make it.\n *\n * `current` comes FIRST so the API's own casing survives dedupe; matching is\n * case-insensitive, mirroring `planDomain`'s `present` check, because Google\n * echoes back addresses in whatever case the account uses and a case-sensitive\n * `Set` would re-add an owner who is already there.\n */\nexport function ownerUnion(current: string[], toAdd: string[]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const o of [...current, ...toAdd]) {\n    const key = o.toLowerCase();\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(o);\n  }\n  return out;\n}\n\n/** Plan every domain. */\nexport function plan(config: OnboardingConfig, states: Map<string, DomainState>): OnboardingPlan {\n  const notes: string[] = [];\n  const domains = config.domains.map((setup) => {\n    const state = states.get(setup.domain);\n    if (!state)\n      // Should not happen — the CLI observes every domain before planning — but a\n      // missing observation must not silently read as \"nothing to do\".\n      notes.push(`${setup.domain}: no observed state; treating everything as pending`);\n    return planDomain(\n      setup,\n      state ?? { txtPresent: false, verified: false, currentOwners: [], propertyExists: false },\n    );\n  });\n  return { domains, notes };\n}\n\n/** Any step on any domain is a mutation — i.e. the live state has drifted. */\nexport function hasDrift(p: OnboardingPlan): boolean {\n  return p.domains.some(\n    (d) =>\n      d.txt.action !== 'skip' ||\n      d.verify.action !== 'skip' ||\n      d.property.action !== 'skip' ||\n      d.owners.action !== 'skip',\n  );\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: OnboardingPlan): string {\n  const lines: string[] = [];\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : '+');\n  for (const d of p.domains) {\n    lines.push(d.domain);\n    lines.push(`  ${glyph(d.txt)} TXT       ${d.txt.detail}`);\n    lines.push(`  ${glyph(d.verify)} verify    ${d.verify.detail}`);\n    lines.push(`  ${glyph(d.property)} property  ${d.property.detail}`);\n    lines.push(`  ${glyph(d.owners)} owners    ${d.owners.detail}`);\n    for (const r of d.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one domain's run, for the summary table. */\nexport interface DomainResult {\n  domain: string;\n  txt: 'created' | 'present' | 'failed' | '—';\n  verified: 'yes' | 'pending' | 'failed' | '—';\n  property: 'added' | 'present' | 'failed' | '—';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per domain, plus any reminders. */\nexport function formatSummary(results: DomainResult[]): string {\n  const headers = ['DOMAIN', 'TXT', 'VERIFIED', 'PROPERTY'];\n  const rows = results.map((r) => [r.domain, r.txt, r.verified, r.property]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.domain}: ${m}`));\n  return table(headers, rows, reminders);\n}\n"],"mappings":";;;;AAmDA,MAAa,cAAc,WAA2B,aAAa;;;;;;;;;;AAWnE,SAAgB,gBAAgB,cAAc,GAAa;CACzD,MAAM,MAAgB,CAAC;CACvB,KAAK,IAAI,IAAI,GAAG,KAAK,aAAa,KAAK,IAAI,KAAK,KAAK,IAAI,GAAI;CAC7D,OAAO;AACT;;AAGA,SAAgB,WAAW,OAAoB,OAAgC;CAC7E,MAAM,YAAsB,CAAC;CAC7B,IAAI,MAAM,eACR,UAAU,KACR,OAAO,MAAM,cAAc,4EAC7B;CAEF,MAAM,MAAgB,MAAM,aACxB;EAAE,QAAQ;EAAQ,QAAQ;CAA2B,IACrD;EAAE,QAAQ;EAAU,QAAQ;CAAsC;CAEtE,MAAM,SAAmB,MAAM,WAC3B;EAAE,QAAQ;EAAQ,QAAQ;CAA6B,IACvD;EAAE,QAAQ;EAAU,QAAQ;CAA6B;CAE7D,MAAM,WAAqB,MAAM,iBAC7B;EAAE,QAAQ;EAAQ,QAAQ;CAA0B,IACpD;EAAE,QAAQ;EAAU,QAAQ,gBAAgB,WAAW,MAAM,MAAM;CAAI;CAI3E,MAAM,UAAU,MAAM,mBAAmB,CAAC;CAC1C,MAAM,UAAU,IAAI,IAAI,MAAM,cAAc,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;CACvE,MAAM,cAAc,QAAQ,QAAQ,MAAM,CAAC,QAAQ,IAAI,EAAE,YAAY,CAAC,CAAC;CACvE,MAAM,SACJ,QAAQ,WAAW,IACf;EAAE,QAAQ;EAAQ,QAAQ;CAAsB,IAChD,YAAY,WAAW,IACrB;EAAE,QAAQ;EAAQ,QAAQ;CAAuC,IACjE;EACE,QAAQ;EACR,QAAQ,OAAO,YAAY,OAAO,aAAa,YAAY,KAAK,IAAI;CACtE;CAER,OAAO;EACL,QAAQ,MAAM;EACd,SAAS,WAAW,MAAM,MAAM;EAChC;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,WAAW,SAAmB,OAA2B;CACvE,MAAM,MAAgB,CAAC;CACvB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,KAAK,CAAC,GAAG,SAAS,GAAG,KAAK,GAAG;EACtC,MAAM,MAAM,EAAE,YAAY;EAC1B,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EACZ,IAAI,KAAK,CAAC;CACZ;CACA,OAAO;AACT;;AAGA,SAAgB,KAAK,QAA0B,QAAkD;CAC/F,MAAM,QAAkB,CAAC;CAYzB,OAAO;EAAE,SAXO,OAAO,QAAQ,KAAK,UAAU;GAC5C,MAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;GACrC,IAAI,CAAC,OAGH,MAAM,KAAK,GAAG,MAAM,OAAO,oDAAoD;GACjF,OAAO,WACL,OACA,SAAS;IAAE,YAAY;IAAO,UAAU;IAAO,eAAe,CAAC;IAAG,gBAAgB;GAAM,CAC1F;EACF,CACe;EAAG;CAAM;AAC1B;;AAGA,SAAgB,SAAS,GAA4B;CACnD,OAAO,EAAE,QAAQ,MACd,MACC,EAAE,IAAI,WAAW,UACjB,EAAE,OAAO,WAAW,UACpB,EAAE,SAAS,WAAW,UACtB,EAAE,OAAO,WAAW,MACxB;AACF;;AAGA,SAAgB,WAAW,GAA2B;CACpD,MAAM,QAAkB,CAAC;CACzB,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM;CAC5D,KAAK,MAAM,KAAK,EAAE,SAAS;EACzB,MAAM,KAAK,EAAE,MAAM;EACnB,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,QAAQ;EACxD,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,QAAQ;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,QAAQ;EAClE,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,QAAQ;EAC9D,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAiC;CAC7D,MAAM,UAAU;EAAC;EAAU;EAAO;EAAY;CAAU;CACxD,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAQ,EAAE;EAAK,EAAE;EAAU,EAAE;CAAQ,CAAC;CACzE,MAAM,YAAY,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC;CACxF,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC"}

package/dist/plan-Hq8Pb0Uw.d.mts

@@ -0,0 +1,133 @@
+//#region src/onboarding/types.d.ts
+/**
+ * The onboarding module's own option surface.
+ *
+ * Deliberately structural rather than `Config['site']['searchConsole']` imported
+ * from `@getvitops/generator`: the generator already depends on this package, so
+ * importing back would be a cycle. The vocabulary mirrors that block field for
+ * field, so the CLI's adapter is a flat map — the same arrangement, and for the
+ * same reason, as `IndexingConfig` beside it.
+ *
+ * Optional fields are written `?: T | undefined` throughout: `exactOptionalPropertyTypes`
+ * is on, and these types describe a *parsed JSON config* where an absent key and an
+ * explicit `undefined` are the same thing.
+ */
+/** One domain to onboard, as the config declares it. */
+interface DomainSetup {
+  /** The domain, bare (`acme.ca`). Becomes the `sc-domain:` property and the DNS zone name. */
+  domain: string;
+  /**
+   * Emails added as verification owners on the Site Verification web resource.
+   * Additive: existing owners are never removed.
+   */
+  delegatedOwners?: string[] | undefined;
+  /**
+   * A Google Group to grant Full-User access in Search Console. Surfaced as a
+   * reminder only — Search Console has no user/permission API.
+   */
+  fullUserGroup?: string | undefined;
+}
+/** Everything `plan()` needs, once the CLI has read the config and creds. */
+interface OnboardingConfig {
+  /** The domains to onboard. Already filtered to `--domain` if that was passed. */
+  domains: DomainSetup[];
+}
+/**
+ * One domain's observed live state, gathered by the executors before planning.
+ *
+ * `plan()` compares this against the desired `DomainSetup` to decide each step —
+ * the same shape the indexing planner takes its sitemap snapshot in, for the same
+ * reason: the decision is pure, the observation is not.
+ */
+interface DomainState {
+  /** The Cloudflare zone id for the domain, if one was found. */
+  zoneId?: string | undefined;
+  /** An apex TXT record already carrying the verification token exists. */
+  txtPresent: boolean;
+  /** The Site Verification web resource reports this domain as verified. */
+  verified: boolean;
+  /** Owners currently on the web resource (empty when not yet verified). */
+  currentOwners: string[];
+  /** A `sc-domain:` property already exists in Search Console. */
+  propertyExists: boolean;
+}
+//#endregion
+//#region src/onboarding/plan.d.ts
+/** A step's decision: do it, or skip it because it already holds. */
+type StepAction = 'create' | 'update' | 'skip';
+interface StepPlan {
+  action: StepAction;
+  /** Why it's a skip, or what the mutation will do. */
+  detail: string;
+}
+/** The four onboarding steps for one domain, decided against its live state. */
+interface DomainPlan {
+  domain: string;
+  /** `sc-domain:` property identifier this domain maps to. */
+  siteUrl: string;
+  /** Ensure the apex TXT verification record. */
+  txt: StepPlan;
+  /** Verify ownership via the Site Verification API (DNS_TXT). */
+  verify: StepPlan;
+  /** Add the Search Console domain property. */
+  property: StepPlan;
+  /** Add delegated owners to the verified web resource. */
+  owners: StepPlan;
+  /** Owners not yet present that the run should add. */
+  ownersToAdd: string[];
+  /** Manual follow-ups (e.g. a Full-User group). */
+  reminders: string[];
+}
+interface OnboardingPlan {
+  domains: DomainPlan[];
+  /** Operator-facing warnings that span the whole run. */
+  notes: string[];
+}
+/** The `sc-domain:` property identifier for a bare domain. */
+declare const siteUrlFor: (domain: string) => string;
+/**
+ * Backoff ladder for the verification retry, in milliseconds.
+ *
+ * DNS_TXT verification fails until the record has propagated, which is a matter of
+ * seconds-to-minutes, not a real error — so the schedule is a *policy*, decided
+ * here and asserted in the tests, while the actual sleeping is the CLI's job.
+ * Capped at `maxAttempts`; a domain still unverified after the last attempt is
+ * reported PENDING, never failed.
+ */
+declare function backoffSchedule(maxAttempts?: number): number[];
+/** Decide the four steps for one domain from its desired config and live state. */
+declare function planDomain(setup: DomainSetup, state: DomainState): DomainPlan;
+/**
+ * The owner set to PUT: everyone already there, plus everyone being added.
+ *
+ * `updateOwners` REPLACES the owner list, so this is the one computation standing
+ * between a delegation and locking yourself out — pass a bare `ownersToAdd` and
+ * the account that just verified the domain is removed from it. It belongs here
+ * rather than at the call site for exactly that reason: it is a decision, it is
+ * the dangerous one, and the executor is not allowed to make it.
+ *
+ * `current` comes FIRST so the API's own casing survives dedupe; matching is
+ * case-insensitive, mirroring `planDomain`'s `present` check, because Google
+ * echoes back addresses in whatever case the account uses and a case-sensitive
+ * `Set` would re-add an owner who is already there.
+ */
+declare function ownerUnion(current: string[], toAdd: string[]): string[];
+/** Plan every domain. */
+declare function plan(config: OnboardingConfig, states: Map<string, DomainState>): OnboardingPlan;
+/** Any step on any domain is a mutation — i.e. the live state has drifted. */
+declare function hasDrift(p: OnboardingPlan): boolean;
+/** Render a plan as the block `--dry` and `--check` print. */
+declare function formatPlan(p: OnboardingPlan): string;
+/** The outcome of one domain's run, for the summary table. */
+interface DomainResult {
+  domain: string;
+  txt: 'created' | 'present' | 'failed' | '—';
+  verified: 'yes' | 'pending' | 'failed' | '—';
+  property: 'added' | 'present' | 'failed' | '—';
+  reminders: string[];
+}
+/** Render the end-of-run summary: one row per domain, plus any reminders. */
+declare function formatSummary(results: DomainResult[]): string;
+//#endregion
+export { StepPlan as a, formatSummary as c, plan as d, planDomain as f, OnboardingConfig as g, DomainState as h, StepAction as i, hasDrift as l, DomainSetup as m, DomainResult as n, backoffSchedule as o, siteUrlFor as p, OnboardingPlan as r, formatPlan as s, DomainPlan as t, ownerUnion as u };
+//# sourceMappingURL=plan-Hq8Pb0Uw.d.mts.map

package/dist/plan-Hq8Pb0Uw.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-Hq8Pb0Uw.d.mts","names":[],"sources":["../src/onboarding/types.ts","../src/onboarding/plan.ts"],"mappings":";;;;;;;;;;;;;;;UAeiB;;EAEf;;;;;EAKA;;;;;EAKA;;;UAIe;;EAEf,SAAS;;;;;;;;;UAiBM;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;KC3CU;UAEK;EACf,QAAQ;;EAER;;;UAIe;EACf;;EAEA;;EAEA,KAAK;;EAEL,QAAQ;;EAER,UAAU;;EAEV,QAAQ;;EAER;;EAEA;;UAGe;EACf,SAAS;;EAET;;;cAIW,aAAc;;;;;;;;;;iBAWX,gBAAgB;;iBAOhB,WAAW,OAAO,aAAa,OAAO,cAAc;;;;;;;;;;;;;;;iBA4DpD,WAAW,mBAAmB;;iBAa9B,KAAK,QAAQ,kBAAkB,QAAQ,YAAY,eAAe;;iBAiBlE,SAAS,GAAG;;iBAWZ,WAAW,GAAG;;UAgBb;EACf;EACA;EACA;EACA;EACA;;;iBAIc,cAAc,SAAS"}

package/dist/reviews/index.d.mts

@@ -1,6 +1,5 @@
-import { a as SCOPES, c as googleHeaders, i as GoogleOAuth, n as GoogleAuthLike, r as GoogleCredential, s as googleAccessToken, t as GoogleAuth } from "../token-Bz_-igw-.mjs";
-import { n as adcQuotaProject, r as parseAdcUser, t as adcCredentialsPath } from "../adc-BFrzpMHq.mjs";
-
+import { a as SCOPES, c as googleHeaders, i as GoogleOAuth, n as GoogleAuthLike, r as GoogleCredential, s as googleAccessToken, t as GoogleAuth } from "../token-DmmoQ7um.mjs";
+import { n as adcQuotaProject, r as parseAdcUser, t as adcCredentialsPath } from "../adc-BoEoogyo.mjs";
 //#region src/reviews/types.d.ts
 /**
  * The reviews module's own option surface.
@@ -91,9 +90,9 @@ interface PlanInput {
   hasCredential: boolean;
 }
 /** Decide which locations to fetch, and why any are skipped. */
-declare function plan(input: PlanInput): ReviewsPlan;
+export declare function plan(input: PlanInput): ReviewsPlan;
 /** Render a plan as the human-readable block `--dry` prints. */
-declare function formatPlan(p: ReviewsPlan): string;
+export declare function formatPlan(p: ReviewsPlan): string;
 /**
  * Filter and order one location's reviews for display.
  *
@@ -103,7 +102,7 @@ declare function formatPlan(p: ReviewsPlan): string;
  * is a design choice a config field should not have to spell out every time),
  * sorted, then capped by `limit`.
  */
-declare function selectReviews(reviews: Review[], config: ReviewLocationConfig): Review[];
+export declare function selectReviews(reviews: Review[], config: ReviewLocationConfig): Review[];
 /**
  * Merge a fresh fetch into the existing cache.
  *
@@ -112,11 +111,11 @@ declare function selectReviews(reviews: Review[], config: ReviewLocationConfig):
  * failure (one location's fetch errors) non-destructive — `cmdReviews` merges
  * only the locations that succeeded and leaves the rest of the cache alone.
  */
-declare function mergeCache(existing: ReviewCache | undefined, fetched: Record<string, LocationReviews>): ReviewCache;
+export declare function mergeCache(existing: ReviewCache | undefined, fetched: Record<string, LocationReviews>): ReviewCache;
 //#endregion
 //#region src/reviews/cache.d.ts
 /** Default location, relative to the consumer's project root. */
-declare const REVIEWS_CACHE_PATH = ".vitops/reviews.json";
+export declare const REVIEWS_CACHE_PATH = ".vitops/reviews.json";
 /**
  * Read the cache, or `undefined` when there isn't a usable one.
  *
@@ -125,11 +124,11 @@ declare const REVIEWS_CACHE_PATH = ".vitops/reviews.json";
  * from "this business genuinely has no reviews" and silently ship an empty
  * carousel.
  */
-declare function readCache(path: string): ReviewCache | undefined;
+export declare function readCache(path: string): ReviewCache | undefined;
 /** Build a cache with its keys and each location's reviews in a stable order. */
-declare function toCache(locations: Record<string, LocationReviews>): ReviewCache;
+export declare function toCache(locations: Record<string, LocationReviews>): ReviewCache;
 /** Write the cache, creating its directory. */
-declare function writeCache(path: string, cache: ReviewCache): void;
+export declare function writeCache(path: string, cache: ReviewCache): void;
 //#endregion
 //#region src/reviews/gbp.d.ts
 /** One page (or, having paginated, the whole set) of a location's reviews. */
@@ -148,7 +147,7 @@ interface FetchReviewsResult {
  * several locations can fetch what it can and report the rest, the same contract
  * `../indexing/gsc.ts`'s `inspectUrl` keeps.
  */
-declare function fetchReviews(auth: GoogleAuthLike, accountId: string, locationId: string, fetchImpl?: typeof fetch): Promise<FetchReviewsResult>;
+export declare function fetchReviews(auth: GoogleAuthLike, accountId: string, locationId: string, fetchImpl?: typeof fetch): Promise<FetchReviewsResult>;
 //#endregion
-export { type FetchReviewsResult, type GoogleAuth, type GoogleAuthLike, type GoogleCredential, type GoogleOAuth, type LocationPlan, type LocationReviews, type PlanInput, REVIEWS_CACHE_PATH, type Review, type ReviewCache, type ReviewLocationConfig, type ReviewsConfig, type ReviewsPlan, SCOPES, adcCredentialsPath, adcQuotaProject, fetchReviews, formatPlan, googleAccessToken, googleHeaders, mergeCache, parseAdcUser, plan, readCache, selectReviews, toCache, writeCache };
+export { type FetchReviewsResult, type GoogleAuth, type GoogleAuthLike, type GoogleCredential, type GoogleOAuth, type LocationPlan, type LocationReviews, type PlanInput, type Review, type ReviewCache, type ReviewLocationConfig, type ReviewsConfig, type ReviewsPlan, SCOPES, adcCredentialsPath, adcQuotaProject, googleAccessToken, googleHeaders, parseAdcUser };
 //# sourceMappingURL=index.d.mts.map

package/dist/reviews/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/reviews/types.ts","../../src/reviews/plan.ts","../../src/reviews/cache.ts","../../src/reviews/gbp.ts"],"mappings":";;;;;;;;AAgBA;;;;;UAAiB,oBAAA;EAMf;EAJA,SAAA;EAQA;EANA,UAAA;EAQI;EANJ,QAAA;EAUe;EARf,SAAA;;EAEA,KAAA;EAQA;EANA,IAAA;AAAA;;UAIe,aAAA;EAI+B;EAF9C,SAAA;EAMqB;EAJrB,SAAA,EAAW,MAAM,SAAS,oBAAA;AAAA;;UAIX,MAAA;EACf,EAAA;EAKA;EAHA,QAAA;EAKA;EAHA,MAAA;EACA,MAAA;EACA,WAAA;EACA,IAAA;EACA,WAAA;EACA,SAAA;EACA,KAAA;IAAU,IAAA;IAAc,EAAA;EAAA;;EAExB,GAAA;AAAA;;UAIe,eAAA;EACf,UAAA;EACA,SAAA;EACA,SAAA;EACA,aAAA;EACA,gBAAA;EACA,OAAA,EAAS,MAAM;AAAA;;UAIA,WAAA;EACf,OAAA;EACA,SAAA,EAAW,MAAM,SAAS,eAAA;AAAA;;;;UClDX,YAAA;EACf,GAAA;EACA,SAAA;EACA,UAAA;EDUe;ECRf,IAAA;AAAA;AAAA,UAGe,WAAA;EDOf;ECLA,OAAA;EACA,SAAA,EAAW,YAAY;EACvB,KAAA;AAAA;AAAA,UAGe,SAAA;EACf,MAAA,EAAQ,aAAA;EDKa;ECHrB,cAAA,EAAgB,GAAG;EDGE;ECDrB,YAAA;EDIA;ECFA,aAAA;AAAA;;iBAIc,IAAA,CAAK,KAAA,EAAO,SAAA,GAAY,WAAW;;iBAuDnC,UAAA,CAAW,CAAc,EAAX,WAAW;;;;;;AD/CpC;AAIL;;;iBC8DgB,aAAA,CAAc,OAAA,EAAS,MAAA,IAAU,MAAA,EAAQ,oBAAA,GAAuB,MAAA;;;;;;;;;iBA2BhE,UAAA,CACd,QAAA,EAAU,WAAA,cACV,OAAA,EAAS,MAAA,SAAe,eAAA,IACvB,WAAA;;;;cCvIU,kBAAA;;;AFcP;AAIN;;;;;iBERgB,SAAA,CAAU,IAAA,WAAe,WAAW;;iBAKpC,OAAA,CAAQ,SAAA,EAAW,MAAA,SAAe,eAAA,IAAmB,WAAA;;iBAarD,UAAA,CAAW,IAAA,UAAc,KAAA,EAAO,WAAW;;;;UCoB1C,kBAAA;EACf,EAAA;EACA,OAAA,EAAS,MAAM;EACf,aAAA;EACA,gBAAA;EACA,MAAA;EACA,OAAA;AAAA;;;;;;;;iBAUoB,YAAA,CACpB,IAAA,EAAM,cAAA,EACN,SAAA,UACA,UAAA,UACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,kBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/reviews/types.ts","../../src/reviews/plan.ts","../../src/reviews/cache.ts","../../src/reviews/gbp.ts"],"mappings":";;;;;;;;;;;;UAgBiB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,WAAW,eAAe;;;UAIX;EACf;;EAEA;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;IAAU;IAAc;;;EAExB;;;UAIe;EACf;EACA;EACA;EACA;EACA;EACA,SAAS;;;UAIM;EACf;EACA,WAAW,eAAe;;;;;UClDX;EACf;EACA;EACA;;EAEA;;UAGe;;EAEf;EACA,WAAW;EACX;;UAGe;EACf,QAAQ;;EAER,gBAAgB;;EAEhB;;EAEA;;;wBAIc,KAAK,OAAO,YAAY;;wBAuDxB,WAAW,GAAG;;;;;;;;;;wBAmBd,cAAc,SAAS,UAAU,QAAQ,uBAAuB;;;;;;;;;wBA2BhE,WACd,UAAU,yBACV,SAAS,eAAe,mBACvB;;;;qBCvIU;;;;;;;;;wBAUG,UAAU,eAAe;;wBAKzB,QAAQ,WAAW,eAAe,mBAAmB;;wBAarD,WAAW,cAAc,OAAO;;;;UCoB/B;EACf;EACA,SAAS;EACT;EACA;EACA;EACA;;;;;;;;;wBAUoB,aACpB,MAAM,gBACN,mBACA,oBACA,mBAAkB,QACjB,QAAQ"}

package/dist/schema/index.d.mts

@@ -20,7 +20,7 @@ interface ArticleGraphOptions {
   keywords?: string[];
 }
 /** Build a schema.org Article JSON-LD graph. */
-declare function articleGraph(options: ArticleGraphOptions): Record<string, unknown>;
+export declare function articleGraph(options: ArticleGraphOptions): Record<string, unknown>;
 //#endregion
 //#region src/schema/breadcrumb.d.ts
 interface BreadcrumbItem {
@@ -31,7 +31,7 @@ interface BreadcrumbGraphOptions {
   items: BreadcrumbItem[];
 }
 /** Build a schema.org BreadcrumbList JSON-LD graph. */
-declare function breadcrumbGraph(options: BreadcrumbGraphOptions): Record<string, unknown>;
+export declare function breadcrumbGraph(options: BreadcrumbGraphOptions): Record<string, unknown>;
 //#endregion
 //#region src/schema/faq.d.ts
 interface FAQItem {
@@ -47,7 +47,7 @@ interface FAQGraphOptions {
  * NOTE: Google recommends FAQ markup only for authoritative government
  * and health sites. For other sites, consider using QAPage schema instead.
  */
-declare function faqGraph(options: FAQGraphOptions): Record<string, unknown>;
+export declare function faqGraph(options: FAQGraphOptions): Record<string, unknown>;
 //#endregion
 //#region src/schema/itemList.d.ts
 type ItemListEntryType = 'Article' | 'Recipe' | 'Movie' | 'Course' | 'Restaurant' | 'Product' | (string & {});
@@ -69,7 +69,7 @@ interface ItemListGraphOptions {
   name?: string;
 }
 /** Build a schema.org ItemList JSON-LD graph (e.g. for a carousel rich result). */
-declare function itemListGraph(options: ItemListGraphOptions): Record<string, unknown>;
+export declare function itemListGraph(options: ItemListGraphOptions): Record<string, unknown>;
 //#endregion
 //#region src/schema/localBusiness.d.ts
 interface OpeningHoursSpecification {
@@ -136,7 +136,7 @@ interface LocalBusinessGraphOptions {
   knowsLanguage?: string[];
 }
 /** Build a schema.org LocalBusiness (or subtype) JSON-LD graph. */
-declare function localBusinessGraph(options: LocalBusinessGraphOptions): Record<string, unknown>;
+export declare function localBusinessGraph(options: LocalBusinessGraphOptions): Record<string, unknown>;
 //#endregion
 //#region src/schema/organization.d.ts
 interface OrganizationGraphOptions {
@@ -185,7 +185,7 @@ interface OrganizationGraphOptions {
   }[];
 }
 /** Build a schema.org Organization JSON-LD graph. */
-declare function organizationGraph(options: OrganizationGraphOptions): Record<string, unknown>;
+export declare function organizationGraph(options: OrganizationGraphOptions): Record<string, unknown>;
 //#endregion
-export { type ArticleAuthor, type ArticleGraphOptions, type BreadcrumbGraphOptions, type BreadcrumbItem, type FAQGraphOptions, type FAQItem, type ItemListEntry, type ItemListEntryType, type ItemListGraphOptions, type LocalBusinessGraphOptions, type OpeningHoursSpecification, type OrganizationGraphOptions, type SpecialHoursSpecification, articleGraph, breadcrumbGraph, faqGraph, itemListGraph, localBusinessGraph, organizationGraph };
+export type { ArticleAuthor, ArticleGraphOptions, BreadcrumbGraphOptions, BreadcrumbItem, FAQGraphOptions, FAQItem, ItemListEntry, ItemListEntryType, ItemListGraphOptions, LocalBusinessGraphOptions, OpeningHoursSpecification, OrganizationGraphOptions, SpecialHoursSpecification };
 //# sourceMappingURL=index.d.mts.map

package/dist/schema/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/schema/article.ts","../../src/schema/breadcrumb.ts","../../src/schema/faq.ts","../../src/schema/itemList.ts","../../src/schema/localBusiness.ts","../../src/schema/organization.ts"],"mappings":";UAAiB,aAAA;EACf,IAAA;EACA,GAAG;AAAA;AAAA,UAGY,mBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,aAAA;EACA,YAAA;EACA,MAAA,EAAQ,aAAA,GAAgB,aAAa;EACrC,SAAA;IACE,IAAA;IACA,IAAA;EAAA;EAEF,gBAAA;EACA,cAAA;EACA,SAAA;EACA,QAAA;AAAA;;iBAIc,YAAA,CAAa,OAAA,EAAS,mBAAA,GAAsB,MAAM;;;UCvBjD,cAAA;EACf,IAAA;EACA,GAAG;AAAA;AAAA,UAGY,sBAAA;EACf,KAAA,EAAO,cAAc;AAAA;;iBAIP,eAAA,CAAgB,OAAA,EAAS,sBAAA,GAAyB,MAAM;;;UCVvD,OAAA;EACf,QAAA;EACA,MAAM;AAAA;AAAA,UAGS,eAAA;EACf,KAAA,EAAO,OAAO;AAAA;;;;;;;iBASA,QAAA,CAAS,OAAA,EAAS,eAAA,GAAkB,MAAM;;;KCf9C,iBAAA;AAAA,UAWK,aAAA;EACf,IAAA,EAAM,iBAAiB;EACvB,IAAA;EHZA;AACG;AAGL;;;EGcE,GAAA;EACA,KAAA;EACA,WAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA,EAAO,aAAa;EHdpB;EGgBA,IAAA;AAAA;;iBAIc,aAAA,CAAc,OAAA,EAAS,oBAAA,GAAuB,MAAM;;;UC/BnD,yBAAA;EACf,SAAA;EACA,KAAA;EACA,MAAA;AAAA;AJDG;AAGL;;;;;AAHK,UIUY,yBAAA;EACf,SAAA;EACA,YAAA;EACA,KAAA;EACA,MAAA;AAAA;AAAA,UAGe,yBAAA;EJPf;EISA,IAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;EACA,SAAA;EACA,KAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA;IACE,aAAA;IACA,eAAA;IACA,aAAA;IACA,UAAA;IACA,cAAA;EAAA;EAEF,GAAA;IACE,QAAA;IACA,SAAA;EAAA;EAEF,yBAAA,GAA4B,yBAAA;EAC5B,gCAAA,GAAmC,yBAAyB;EAC5D,eAAA;IACE,WAAA;IACA,WAAA;IACA,WAAA;IACA,UAAA;IACA,WAAA;EAAA;EAEF,MAAA;IACE,MAAA;IACA,aAAA;IACA,UAAA;IACA,YAAA;MACE,WAAA;MACA,UAAA;MACA,WAAA;IAAA;EAAA;EAGJ,eAAA;EACA,kBAAA;EACA,UAAA;EACA,MAAA;EACA,aAAA;AAAA;;iBAIc,kBAAA,CAAmB,OAAA,EAAS,yBAAA,GAA4B,MAAM;;;UCnE7D,wBAAA;EACf,IAAA;EACA,GAAA;EACA,IAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;IACE,aAAA;IACA,eAAA;IACA,aAAA;IACA,UAAA;IACA,cAAA;EAAA;EAEF,MAAA;EACA,YAAA;EACA,QAAA;EACA,iBAAA;IAA+B,QAAA;IAAkB,QAAA;EAAA;EACjD,kBAAA;IACE,IAAA;IACA,GAAA;EAAA;EAEF,eAAA;IACE,IAAA;IACA,GAAA;EAAA;EAEF,YAAA;IACE,IAAA;IACA,SAAA;IACA,KAAA;IACA,WAAA;IACA,iBAAA;IACA,UAAA;EAAA;EAEF,UAAA;EACA,KAAA;EACA,KAAA;EACA,QAAA;IACE,IAAA;IACA,GAAA;EAAA;AAAA;;iBAKY,iBAAA,CAAkB,OAAA,EAAS,wBAAA,GAA2B,MAAM"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/schema/article.ts","../../src/schema/breadcrumb.ts","../../src/schema/faq.ts","../../src/schema/itemList.ts","../../src/schema/localBusiness.ts","../../src/schema/organization.ts"],"mappings":";UAAiB;EACf;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA,QAAQ,gBAAgB;EACxB;IACE;IACA;;EAEF;EACA;EACA;EACA;;;wBAIc,aAAa,SAAS,sBAAsB;;;UCvB3C;EACf;EACA;;UAGe;EACf,OAAO;;;wBAIO,gBAAgB,SAAS,yBAAyB;;;UCVjD;EACf;EACA;;UAGe;EACf,OAAO;;;;;;;;wBASO,SAAS,SAAS,kBAAkB;;;KCfxC;UAWK;EACf,MAAM;EACN;;;;;;EAMA;EACA;EACA;;UAGe;EACf,OAAO;;EAEP;;;wBAIc,cAAc,SAAS,uBAAuB;;;UC/B7C;EACf;EACA;EACA;;;;;;;;UASe;EACf;EACA;EACA;EACA;;UAGe;;EAEf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;;EAEF;IACE;IACA;;EAEF,4BAA4B;EAC5B,mCAAmC;EACnC;IACE;IACA;IACA;IACA;IACA;;EAEF;IACE;IACA;IACA;IACA;MACE;MACA;MACA;;;EAGJ;EACA;EACA;EACA;EACA;;;wBAIc,mBAAmB,SAAS,4BAA4B;;;UCnEvD;EACf;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;;EAEF;EACA;EACA;EACA;IAA+B;IAAkB;;EACjD;IACE;IACA;;EAEF;IACE;IACA;;EAEF;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;EACA;EACA;EACA;IACE;IACA;;;;wBAKY,kBAAkB,SAAS,2BAA2B"}

package/dist/security/index.d.mts

@@ -42,7 +42,7 @@ interface TurnstileVerifyResult {
  * failed verification is not this module's business to act on; the caller
  * (`createConversionRoute`) decides what a failure means for the request.
  */
-declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, fetchImpl?: typeof fetch): Promise<TurnstileVerifyResult>;
+export declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, fetchImpl?: typeof fetch): Promise<TurnstileVerifyResult>;
 //#endregion
-export { type TurnstileVerifyResult, verifyTurnstileToken };
+export type { TurnstileVerifyResult };
 //# sourceMappingURL=index.d.mts.map

package/dist/security/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/security/turnstile.ts"],"mappings":";;AA+BA;;;;AAGY;AAaZ;;;;;;;;;;;;;;;;AAKgC;;;;;;UArBf,qBAAA;EACf,OAAA;;EAEA,UAAU;AAAA;;;;;;;;;;;iBAaU,oBAAA,CACpB,KAAA,UACA,SAAA,UACA,QAAA,WACA,SAAA,UAAkB,KAAA,GACjB,OAAA,CAAQ,qBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/security/turnstile.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA+BiB;EACf;;EAEA;;;;;;;;;;;;wBAaoB,qBACpB,eACA,mBACA,mBACA,mBAAkB,QACjB,QAAQ"}

package/dist/{token-Bz_-igw-.d.mts → token-DmmoQ7um.d.mts}

@@ -65,10 +65,13 @@ type GoogleAuthLike = string | GoogleAuth;
 declare function googleHeaders(auth: GoogleAuthLike, extra?: Record<string, string>): Record<string, string>;
 /** Scopes, named once so a caller never spells one out. */
 declare const SCOPES: {
-  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */readonly webmasters: "https://www.googleapis.com/auth/webmasters"; /** Site Verification API. */
-  readonly siteVerification: "https://www.googleapis.com/auth/siteverification"; /** Business Profile (reviews). The GCP project must be allowlisted by Google. */
+  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */
+  readonly webmasters: "https://www.googleapis.com/auth/webmasters";
+  /** Site Verification API. */
+  readonly siteVerification: "https://www.googleapis.com/auth/siteverification";
+  /** Business Profile (reviews). The GCP project must be allowlisted by Google. */
   readonly businessProfile: "https://www.googleapis.com/auth/business.manage";
 };
 //#endregion
 export { SCOPES as a, googleHeaders as c, GoogleOAuth as i, GoogleAuthLike as n, ServiceAccount as o, GoogleCredential as r, googleAccessToken as s, GoogleAuth as t };
-//# sourceMappingURL=token-Bz_-igw-.d.mts.map
+//# sourceMappingURL=token-DmmoQ7um.d.mts.map

package/dist/token-DmmoQ7um.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-DmmoQ7um.d.mts","names":[],"sources":["../src/google/token.ts"],"mappings":";;UAkCiB;EACf;EACA;;;UAIe;EACf;EACA;EACA;;;;;;;;;;KAWU;EACN;EAAyB,SAAS;EAAgB;;EAClD;EAAe,OAAO;;;;;;;;;;;iBA8CZ,kBACd,YAAY,kBACZ,mBAAkB,OAClB,eACC;;;;;;;;;;;;;;UA6Bc;EACf;EACA;;;;;;;;;KAUU,0BAA0B;;iBAGtB,cACd,MAAM,gBACN,QAAQ,yBACP;;cA2BU"}

package/dist/tracking/index.d.mts

@@ -1,5 +1,4 @@
-import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-CHHjzRrv.mjs";
-
+import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-7ELci8RQ.mjs";
 //#region src/tracking/params.d.ts
 /**
  * The ad-platform vocabulary — the one place that says which URL parameters mean
@@ -23,12 +22,12 @@ import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as Con
  * unattributed — silently, since an unattributed conversion looks exactly like an
  * organic one. `li_fat_id` and `epik` were missing for precisely that reason.
  */
-declare const PLATFORM_PARAMS: Readonly<Record<string, string>>;
+export declare const PLATFORM_PARAMS: Readonly<Record<string, string>>;
 /** Just the parameter names, in the same precedence order. */
-declare const CLICK_ID_PARAMS: readonly string[];
-declare const UTM_PARAMS: readonly ["utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term"];
+export declare const CLICK_ID_PARAMS: readonly string[];
+export declare const UTM_PARAMS: readonly ["utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term"];
 /** Everything the capture script pulls off the landing URL. */
-declare const TRACKED_PARAMS: readonly string[];
+export declare const TRACKED_PARAMS: readonly string[];
 /**
  * The attribution cookie.
  *
@@ -36,15 +35,15 @@ declare const TRACKED_PARAMS: readonly string[];
  * never sent anywhere. It is still a persistent identifier, which is why writing
  * it waits on consent.
  */
-declare const TRACKING_COOKIE = "_ac";
+export declare const TRACKING_COOKIE = "_ac";
 /** 90 days — an ad click and the conversion it produces are rarely further apart. */
-declare const TRACKING_COOKIE_DAYS = 90;
+export declare const TRACKING_COOKIE_DAYS = 90;
 /** The A/B variant cookie, assigned by the router when a site runs experiments. */
-declare const AB_COOKIE = "_ab";
+export declare const AB_COOKIE = "_ab";
 //#endregion
 //#region src/tracking/cookie.d.ts
 /** Read one cookie out of a `document.cookie`-shaped string. */
-declare function readCookie(cookieString: string | null | undefined, name: string): string | null;
+export declare function readCookie(cookieString: string | null | undefined, name: string): string | null;
 /**
  * Cookie header → attribution, or `null`.
  *
@@ -53,9 +52,9 @@ declare function readCookie(cookieString: string | null | undefined, name: strin
  * fields happened to survive, which is worse than reporting it unattributed:
  * "we don't know" is actionable, a wrong campaign is not.
  */
-declare function parseTrackingCookie(cookieHeader: string | null | undefined): TrackingData | null;
+export declare function parseTrackingCookie(cookieHeader: string | null | undefined): TrackingData | null;
 /** Attribution → cookie value (not the full `Set-Cookie` — see `cookieAttributes`). */
-declare function serializeTrackingCookie(data: TrackingData): string;
+export declare function serializeTrackingCookie(data: TrackingData): string;
 /**
  * Attributes for the attribution cookie.
  *
@@ -64,7 +63,7 @@ declare function serializeTrackingCookie(data: TrackingData): string;
  * cross-site navigation — so a returning click would read as a fresh one. No
  * `HttpOnly`, because the capture script has to write it from the page.
  */
-declare function cookieAttributes(now: number, secure: boolean): string;
+export declare function cookieAttributes(now: number, secure: boolean): string;
 /**
  * Fold a fresh capture into whatever was already stored.
  *
@@ -73,7 +72,7 @@ declare function cookieAttributes(now: number, secure: boolean): string;
  * Taking the latest would restart the window on every visit and make the cookie
  * outlive the click it represents.
  */
-declare function mergeTracking(existing: TrackingData | null, captured: TrackingData, now: number): TrackingData;
+export declare function mergeTracking(existing: TrackingData | null, captured: TrackingData, now: number): TrackingData;
 //#endregion
 //#region src/tracking/platform.d.ts
 /**
@@ -83,12 +82,39 @@ declare function mergeTracking(existing: TrackingData | null, captured: Tracking
  * a newsletter or a partner site is still attribution, just self-declared rather
  * than platform-issued. Returns null when there is nothing to go on.
  */
-declare function identifyPlatform(data: TrackingData): string | null;
+export declare function identifyPlatform(data: TrackingData): string | null;
 /** The click ID to quote, with the parameter it came from. */
-declare function getPrimaryClickId(data: TrackingData): {
+export declare function getPrimaryClickId(data: TrackingData): {
   param: string;
   value: string;
 } | null;
 //#endregion
-export { AB_COOKIE, CLICK_ID_PARAMS, type ConversionEvent, PLATFORM_PARAMS, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, type TrackingCategory, type TrackingConfig, type TrackingData, UTM_PARAMS, cookieAttributes, getPrimaryClickId, identifyPlatform, mergeTracking, parseTrackingCookie, readCookie, serializeTrackingCookie };
+//#region src/tracking/identity.d.ts
+/**
+ * Pulling a submitter's identity out of a form's fields.
+ *
+ * Extracted from `notify/render.ts`'s `submitterName()`, which needed only the
+ * display name for a subject line. `crm/map.ts` needs the whole set — first
+ * name, last name, email, phone, company — to fill a CRM record, and a form's
+ * field names vary the same way `submitterName()` already accounted for
+ * (`name` vs `first_name`/`last_name` vs neither). Two independent cascades
+ * over the same handful of aliases is exactly the failure `render.ts`'s own
+ * comment records: a downstream site had five of six forms carrying
+ * `first_name`/`last_name`, and a cascade that only checked `name` read every
+ * one of them as "Unknown". Keep this the one place that knows the aliases;
+ * `submitterName()` and `crm/map.ts` both delegate to it.
+ */
+interface SubmitterIdentity {
+  firstName?: string | undefined;
+  lastName?: string | undefined;
+  /** The best available display name — a submitted full name, first + last
+   * joined, or the email address as a last resort. Never empty. */
+  fullName: string;
+  email?: string | undefined;
+  phone?: string | undefined;
+  company?: string | undefined;
+}
+export declare function identifySubmitter(formData: Record<string, string>): SubmitterIdentity;
+//#endregion
+export type { ConversionEvent, SubmitterIdentity, TrackingCategory, TrackingConfig, TrackingData };
 //# sourceMappingURL=index.d.mts.map

package/dist/tracking/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts"],"mappings":";;;;;;AAuBA;;;;AAA6C;AAc7C;;;;AAA8E;AAE9E;;;;AAMU;AAGV;;;;AAXA,cAda,eAAA,EAAiB,QAAQ,CAAC,MAAA;AAkCvC;AAAA,cApBa,eAAA;AAAA,cAEA,UAAA;;cASA,cAAA;AAYb;;;;AAAiC;AAGjC;;AAHA,cAHa,eAAA;;cAGA,oBAAA;;cAGA,SAAA;;;;iBChDG,UAAA,CAAW,YAAA,6BAAyC,IAAY;ADQhF;;;;AAA6C;AAc7C;;;AAdA,iBCSgB,mBAAA,CAAoB,YAAA,8BAA0C,YAAY;ADKZ;AAAA,iBCQ9D,uBAAA,CAAwB,IAAkB,EAAZ,YAAY;;;;ADAhD;AAGV;;;;iBCYgB,gBAAA,CAAiB,GAAA,UAAa,MAAe;ADH7D;;;;AAA4B;AAG5B;;;AAHA,iBCgBgB,aAAA,CACd,QAAA,EAAU,YAAA,SACV,QAAA,EAAU,YAAA,EACV,GAAA,WACC,YAAA;;;;;ADtDH;;;;AAA6C;iBEL7B,gBAAA,CAAiB,IAAkB,EAAZ,YAAY;;iBASnC,iBAAA,CAAkB,IAAA,EAAM,YAAY;EAAK,KAAA;EAAe,KAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts","../../src/tracking/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;qBAuBa,iBAAiB,SAAS;;qBAc1B;qBAEA;;qBASA;;;;;;;;qBASA;;qBAGA;;qBAGA;;;;wBChDG,WAAW,yCAAyC;;;;;;;;;wBAiBpD,oBAAoB,0CAA0C;;wBAa9D,wBAAwB,MAAM;;;;;;;;;wBAe9B,iBAAiB,aAAa;;;;;;;;;wBAa9B,cACd,UAAU,qBACV,UAAU,cACV,cACC;;;;;;;;;;wBC3Da,iBAAiB,MAAM;;wBASvB,kBAAkB,MAAM;EAAiB;EAAe;;;;;;;;;;;;;;;;;;UCZvD;EACf;EACA;;;EAGA;EACA;EACA;EACA;;wBAWc,kBAAkB,UAAU,yBAAyB"}

package/dist/tracking/index.mjs

@@ -1,3 +1,4 @@
+import { t as identifySubmitter } from "../identity-BoRddTx3.mjs";
 import { a as PLATFORM_PARAMS, c as TRACKING_COOKIE_DAYS, i as CLICK_ID_PARAMS, l as UTM_PARAMS, n as identifyPlatform, o as TRACKED_PARAMS, r as AB_COOKIE, s as TRACKING_COOKIE, t as getPrimaryClickId } from "../platform-0nlOIy8h.mjs";
 
 //#region src/tracking/cookie.ts
@@ -73,5 +74,5 @@ function mergeTracking(existing, captured, now) {
 }
 
 //#endregion
-export { AB_COOKIE, CLICK_ID_PARAMS, PLATFORM_PARAMS, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, UTM_PARAMS, cookieAttributes, getPrimaryClickId, identifyPlatform, mergeTracking, parseTrackingCookie, readCookie, serializeTrackingCookie };
+export { AB_COOKIE, CLICK_ID_PARAMS, PLATFORM_PARAMS, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, UTM_PARAMS, cookieAttributes, getPrimaryClickId, identifyPlatform, identifySubmitter, mergeTracking, parseTrackingCookie, readCookie, serializeTrackingCookie };
 //# sourceMappingURL=index.mjs.map