@getvitops/utils 8.2.0-alpha.0 → 8.3.0-alpha.0

package/dist/{token-DkKC5m23.mjs → token-CJSl9eIS.mjs}

@@ -1,6 +1,4 @@
-import { createSign } from "node:crypto";
-
-//#region src/google/token.ts
+// src/google/token.ts
 /**
 * Google OAuth2 token exchange — one request, two grants.
 *
@@ -29,11 +27,29 @@ import { createSign } from "node:crypto";
 * it, so it lands in a shared chunk, which is free for a Node library. (The
 * "don't create a shared chunk" rule in AGENTS.md is about browser bundles and
 * the consent gate.)
+*
+* **Worker-safe: Web Crypto only, no Node builtins.** `./notify` re-exports the Google Ads
+* upload, which signs a service-account assertion from inside a Worker, and `./notify` is
+* documented as free of Node builtins. `crypto.subtle` and `btoa` exist in Node, workerd and
+* browsers alike; `node:crypto`'s `createSign` and `Buffer` do not exist in a bare Worker.
 */
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const b64url = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const b64url = (input) => {
+	const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+/** Decode a PKCS#8 PEM ("-----BEGIN PRIVATE KEY-----") to its DER bytes. */
+function pemToDer(pem) {
+	const body = pem.replace(/\\n/g, "\n").replace(/-----(BEGIN|END) [A-Z ]+-----/g, "").replace(/\s+/g, "");
+	const binary = atob(body);
+	const der = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) der[i] = binary.charCodeAt(i);
+	return der;
+}
 /** Sign the RS256 JWT assertion a service-account grant carries. */
-function assertionFor(account, scope, now) {
+async function assertionFor(account, scope, now) {
 	const iat = Math.floor(now / 1e3);
 	const header = b64url(JSON.stringify({
 		alg: "RS256",
@@ -46,10 +62,12 @@ function assertionFor(account, scope, now) {
 		iat,
 		exp: iat + 3600
 	}));
-	const signer = createSign("RSA-SHA256");
-	signer.update(`${header}.${claims}`);
-	const pem = account.private_key.replace(/\\n/g, "\n");
-	return `${header}.${claims}.${b64url(signer.sign(pem))}`;
+	const key = await crypto.subtle.importKey("pkcs8", pemToDer(account.private_key), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(`${header}.${claims}`));
+	return `${header}.${claims}.${b64url(new Uint8Array(signature))}`;
 }
 /** The half that never differs: POST the grant, surface the cause, return the token. */
 async function requestToken(body, fetchImpl) {
@@ -72,7 +90,7 @@ async function requestToken(body, fetchImpl) {
 *
 * `now` is a parameter so the assertion is testable without mocking the clock.
 */
-function googleAccessToken(credential, fetchImpl = fetch, now = Date.now()) {
+async function googleAccessToken(credential, fetchImpl = fetch, now = Date.now()) {
 	return requestToken(credential.kind === "oauth" ? new URLSearchParams({
 		grant_type: "refresh_token",
 		client_id: credential.oauth.clientId,
@@ -80,7 +98,7 @@ function googleAccessToken(credential, fetchImpl = fetch, now = Date.now()) {
 		refresh_token: credential.oauth.refreshToken
 	}) : new URLSearchParams({
 		grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-		assertion: assertionFor(credential.account, credential.scope, now)
+		assertion: await assertionFor(credential.account, credential.scope, now)
 	}), fetchImpl);
 }
 /** Auth headers for a Google REST call, with the quota project when there is one. */
@@ -110,9 +128,10 @@ const SCOPES = {
 	/** Site Verification API. */
 	siteVerification: "https://www.googleapis.com/auth/siteverification",
 	/** Business Profile (reviews). The GCP project must be allowlisted by Google. */
-	businessProfile: "https://www.googleapis.com/auth/business.manage"
+	businessProfile: "https://www.googleapis.com/auth/business.manage",
+	/** Google Ads API (offline conversion upload). Needs an approved developer token too. */
+	adwords: "https://www.googleapis.com/auth/adwords"
 };
 
-//#endregion
 export { googleHeaders as a, googleAccessToken as i, encodeSite as n, errorDetail as r, SCOPES as t };
-//# sourceMappingURL=token-DkKC5m23.mjs.map
+//# sourceMappingURL=token-CJSl9eIS.mjs.map

package/dist/token-CJSl9eIS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-CJSl9eIS.mjs","names":[],"sources":["../src/google/token.ts"],"sourcesContent":["/**\n * Google OAuth2 token exchange — one request, two grants.\n *\n * Both of this package's Google modules need a bearer token, and both used to\n * mint one themselves. The two copies looked different because the *credentials*\n * differ, but everything after building the form body was identical: same\n * endpoint, same content-type, same \"surface the response body as the error\"\n * rule, same `access_token` extraction. So the seam is precise —\n * **credential → form params differs, params → token does not.**\n *\n * The two grants are kept because they are not accidental duplication; they track\n * how each command is actually run:\n *\n *   - **service account** (RS256 JWT bearer) for `search notify`, which runs on\n *     every deploy in CI. It never expires. A refresh token can be revoked, and\n *     for an OAuth client still in *Testing* publishing status Google expires it\n *     after 7 days — a bad property for a deploy step.\n *   - **user OAuth** (refresh-token grant) for `search setup`, which is a\n *     one-time human operation. Site verification makes the calling identity an\n *     *owner* of the property, and that should be a person, not a project robot.\n *\n * `googleapis` is deliberately not a dependency — this is one REST endpoint in a\n * CLI that installs into every consumer project. See AGENTS.md.\n *\n * Internal: not a published subpath. Both `./indexing` and `./onboarding` import\n * it, so it lands in a shared chunk, which is free for a Node library. (The\n * \"don't create a shared chunk\" rule in AGENTS.md is about browser bundles and\n * the consent gate.)\n *\n * **Worker-safe: Web Crypto only, no Node builtins.** `./notify` re-exports the Google Ads\n * upload, which signs a service-account assertion from inside a Worker, and `./notify` is\n * documented as free of Node builtins. `crypto.subtle` and `btoa` exist in Node, workerd and\n * browsers alike; `node:crypto`'s `createSign` and `Buffer` do not exist in a bare Worker.\n */\nconst TOKEN_URL = 'https://oauth2.googleapis.com/token';\n\n/** The fields we need from a service-account JSON key. */\nexport interface ServiceAccount {\n  client_email: string;\n  private_key: string;\n}\n\n/** A user OAuth credential (refresh-token flow — never a service account). */\nexport interface GoogleOAuth {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\n/**\n * Which identity to act as.\n *\n * `scope` rides on the service-account variant because that grant carries its\n * scope in the signed assertion. A user OAuth token's scopes are fixed when the\n * refresh token is minted, so there is nothing to pass at exchange time — the\n * asymmetry is the protocol's, not ours.\n */\nexport type GoogleCredential =\n  | { kind: 'service-account'; account: ServiceAccount; scope: string }\n  | { kind: 'oauth'; oauth: GoogleOAuth };\n\nconst b64url = (input: Uint8Array | string): string => {\n  const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : input;\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n};\n\n/** Decode a PKCS#8 PEM (\"-----BEGIN PRIVATE KEY-----\") to its DER bytes. */\nfunction pemToDer(pem: string): Uint8Array<ArrayBuffer> {\n  // `\\n` survives most secret stores as a literal; normalise so a pasted key works.\n  const body = pem\n    .replace(/\\\\n/g, '\\n')\n    .replace(/-----(BEGIN|END) [A-Z ]+-----/g, '')\n    .replace(/\\s+/g, '');\n  const binary = atob(body);\n  const der = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) der[i] = binary.charCodeAt(i);\n  return der;\n}\n\n/** Sign the RS256 JWT assertion a service-account grant carries. */\nasync function assertionFor(account: ServiceAccount, scope: string, now: number): Promise<string> {\n  const iat = Math.floor(now / 1000);\n  const header = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = b64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: TOKEN_URL, iat, exp: iat + 3600 }),\n  );\n  // Google issues service-account keys as PKCS#8, which is what Web Crypto imports.\n  const key = await crypto.subtle.importKey(\n    'pkcs8',\n    pemToDer(account.private_key),\n    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const signature = await crypto.subtle.sign(\n    'RSASSA-PKCS1-v1_5',\n    key,\n    new TextEncoder().encode(`${header}.${claims}`),\n  );\n  return `${header}.${claims}.${b64url(new Uint8Array(signature))}`;\n}\n\n/** The half that never differs: POST the grant, surface the cause, return the token. */\nasync function requestToken(body: URLSearchParams, fetchImpl: typeof fetch): Promise<string> {\n  const res = await fetchImpl(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n  if (!res.ok) {\n    // The body names the cause — clock skew, wrong audience or a revoked key for a\n    // service account; `invalid_grant` / `invalid_client` for OAuth — and carries\n    // no secret of ours: the assertion travels in the request, not the response.\n    throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);\n  }\n  const { access_token } = (await res.json()) as { access_token?: string };\n  if (!access_token) throw new Error('token exchange returned no access_token');\n  return access_token;\n}\n\n/**\n * Exchange either credential for a short-lived access token.\n *\n * Throws rather than returning a result: nothing downstream can run without a\n * token, so there is no per-item decision for a caller to make. (The API calls\n * themselves do return structured results — those fail per domain.)\n *\n * `now` is a parameter so the assertion is testable without mocking the clock.\n */\nexport async function googleAccessToken(\n  credential: GoogleCredential,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  const body =\n    credential.kind === 'oauth'\n      ? new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: credential.oauth.clientId,\n          client_secret: credential.oauth.clientSecret,\n          refresh_token: credential.oauth.refreshToken,\n        })\n      : new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: await assertionFor(credential.account, credential.scope, now),\n        });\n  return requestToken(body, fetchImpl);\n}\n\n/**\n * A bearer token, plus the project its usage is attributed to.\n *\n * `quotaProject` becomes the `x-goog-user-project` header, and it is **required**\n * for a user credential — an ADC login or a `VITOPS_GOOGLE_*` refresh token\n * authenticates through a shared OAuth client that carries no project, so Google\n * refuses the call with a 403 naming the missing quota project rather than\n * guessing one. A service account already belongs to a project, so it needs none.\n *\n * It is deliberately per-call rather than baked into the token: one agency\n * identity administers many sites, each with its own project, so the identity is\n * shared and the attribution is not.\n */\nexport interface GoogleAuth {\n  token: string;\n  quotaProject?: string;\n}\n\n/**\n * A bare token still works everywhere an auth does.\n *\n * The token-only form is what every caller passed before per-site projects\n * existed, and a service-account caller never needs more, so widening the\n * parameter beats a breaking signature change across seven exported functions.\n */\nexport type GoogleAuthLike = string | GoogleAuth;\n\n/** Auth headers for a Google REST call, with the quota project when there is one. */\nexport function googleHeaders(\n  auth: GoogleAuthLike,\n  extra?: Record<string, string>,\n): Record<string, string> {\n  const { token, quotaProject } = typeof auth === 'string' ? { token: auth } : auth;\n  return {\n    authorization: `Bearer ${token}`,\n    ...(quotaProject ? { 'x-goog-user-project': quotaProject } : {}),\n    ...extra,\n  };\n}\n\n/** Percent-encode a Search Console `siteUrl` (e.g. `sc-domain:acme.ca`) for a path segment. */\nexport const encodeSite = (siteUrl: string): string => encodeURIComponent(siteUrl);\n\n/**\n * Render a failed response's detail: a caller-supplied hint on a specific status\n * (e.g. what a `403` almost always means for this endpoint), or the raw body\n * otherwise. Shared by every REST call here that follows the \"PUT and report\n * why\" shape — `gsc.ts`'s `submitSitemap`, `onboarding/google.ts`'s `addSite`.\n */\nexport async function errorDetail(\n  res: Response,\n  hint?: (status: number) => string | undefined,\n): Promise<string> {\n  const named = hint?.(res.status);\n  return named ?? `${res.status}: ${await res.text()}`;\n}\n\n/** Scopes, named once so a caller never spells one out. */\nexport const SCOPES = {\n  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */\n  webmasters: 'https://www.googleapis.com/auth/webmasters',\n  /** Site Verification API. */\n  siteVerification: 'https://www.googleapis.com/auth/siteverification',\n  /** Business Profile (reviews). The GCP project must be allowlisted by Google. */\n  businessProfile: 'https://www.googleapis.com/auth/business.manage',\n  /** Google Ads API (offline conversion upload). Needs an approved developer token too. */\n  adwords: 'https://www.googleapis.com/auth/adwords',\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,YAAY;AA2BlB,MAAM,UAAU,UAAuC;CACrD,MAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI;CAC5E,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,SAAS,SAAS,KAAsC;CAEtD,MAAM,OAAO,IACV,QAAQ,QAAQ,IAAI,CAAC,CACrB,QAAQ,kCAAkC,EAAE,CAAC,CAC7C,QAAQ,QAAQ,EAAE;CACrB,MAAM,SAAS,KAAK,IAAI;CACxB,MAAM,MAAM,IAAI,WAAW,OAAO,MAAM;CACxC,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,IAAI,KAAK,OAAO,WAAW,CAAC;CACpE,OAAO;AACT;;AAGA,eAAe,aAAa,SAAyB,OAAe,KAA8B;CAChG,MAAM,MAAM,KAAK,MAAM,MAAM,GAAI;CACjC,MAAM,SAAS,OAAO,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CAClE,MAAM,SAAS,OACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAW;EAAK,KAAK,MAAM;CAAK,CAAC,CAC3F;CAEA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,SACA,SAAS,QAAQ,WAAW,GAC5B;EAAE,MAAM;EAAqB,MAAM;CAAU,GAC7C,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,qBACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,QAAQ,CAChD;CACA,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,IAAI,WAAW,SAAS,CAAC;AAChE;;AAGA,eAAe,aAAa,MAAuB,WAA0C;CAC3F,MAAM,MAAM,MAAM,UAAU,WAAW;EACrC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,KAAK,SAAS;CACtB,CAAC;CACD,IAAI,CAAC,IAAI,IAIP,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;CAE9E,MAAM,EAAE,iBAAkB,MAAM,IAAI,KAAK;CACzC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;CAC5E,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,kBACpB,YACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CAajB,OAAO,aAXL,WAAW,SAAS,UAChB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,WAAW,MAAM;EAC5B,eAAe,WAAW,MAAM;EAChC,eAAe,WAAW,MAAM;CAClC,CAAC,IACD,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,MAAM,aAAa,WAAW,SAAS,WAAW,OAAO,GAAG;CACzE,CAAC,GACmB,SAAS;AACrC;;AA8BA,SAAgB,cACd,MACA,OACwB;CACxB,MAAM,EAAE,OAAO,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI;CAC7E,OAAO;EACL,eAAe,UAAU;EACzB,GAAI,eAAe,EAAE,uBAAuB,aAAa,IAAI,CAAC;EAC9D,GAAG;CACL;AACF;;AAGA,MAAa,cAAc,YAA4B,mBAAmB,OAAO;;;;;;;AAQjF,eAAsB,YACpB,KACA,MACiB;CAEjB,OADc,OAAO,IAAI,MAAM,KACf,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;AACnD;;AAGA,MAAa,SAAS;;CAEpB,YAAY;;CAEZ,kBAAkB;;CAElB,iBAAiB;;CAEjB,SAAS;AACX"}

package/dist/tracking/index.d.mts

@@ -1,5 +1,4 @@
-import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-7ELci8RQ.mjs";
-//#region src/tracking/params.d.ts
+import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-oac2P5or.mjs";
 /**
  * The ad-platform vocabulary — the one place that says which URL parameters mean
  * "this visit came from an ad", and which platform each belongs to.
@@ -40,8 +39,6 @@ export declare const TRACKING_COOKIE = "_ac";
 export declare const TRACKING_COOKIE_DAYS = 90;
 /** The A/B variant cookie, assigned by the router when a site runs experiments. */
 export declare const AB_COOKIE = "_ab";
-//#endregion
-//#region src/tracking/cookie.d.ts
 /** Read one cookie out of a `document.cookie`-shaped string. */
 export declare function readCookie(cookieString: string | null | undefined, name: string): string | null;
 /**
@@ -73,8 +70,6 @@ export declare function cookieAttributes(now: number, secure: boolean): string;
  * outlive the click it represents.
  */
 export declare function mergeTracking(existing: TrackingData | null, captured: TrackingData, now: number): TrackingData;
-//#endregion
-//#region src/tracking/platform.d.ts
 /**
  * Which platform sent this visitor.
  *
@@ -88,8 +83,6 @@ export declare function getPrimaryClickId(data: TrackingData): {
   param: string;
   value: string;
 } | null;
-//#endregion
-//#region src/tracking/identity.d.ts
 /**
  * Pulling a submitter's identity out of a form's fields.
  *
@@ -115,6 +108,5 @@ interface SubmitterIdentity {
   company?: string | undefined;
 }
 export declare function identifySubmitter(formData: Record<string, string>): SubmitterIdentity;
-//#endregion
 export type { ConversionEvent, SubmitterIdentity, TrackingCategory, TrackingConfig, TrackingData };
 //# sourceMappingURL=index.d.mts.map

package/dist/tracking/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts","../../src/tracking/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;qBAuBa,iBAAiB,SAAS;;qBAc1B;qBAEA;;qBASA;;;;;;;;qBASA;;qBAGA;;qBAGA;;;;wBChDG,WAAW,yCAAyC;;;;;;;;;wBAiBpD,oBAAoB,0CAA0C;;wBAa9D,wBAAwB,MAAM;;;;;;;;;wBAe9B,iBAAiB,aAAa;;;;;;;;;wBAa9B,cACd,UAAU,qBACV,UAAU,cACV,cACC;;;;;;;;;;wBC3Da,iBAAiB,MAAM;;wBASvB,kBAAkB,MAAM;EAAiB;EAAe;;;;;;;;;;;;;;;;;;UCZvD;EACf;EACA;;;EAGA;EACA;EACA;EACA;;wBAWc,kBAAkB,UAAU,yBAAyB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts","../../src/tracking/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;qBAuBa,iBAAiB,SAAS;;qBAc1B;qBAEA;;qBASA;;;;;;;;qBASA;;qBAGA;;qBAGA;;wBChDG,WAAW,yCAAyC;;;;;;;;;wBAiBpD,oBAAoB,0CAA0C;;wBAa9D,wBAAwB,MAAM;;;;;;;;;wBAe9B,iBAAiB,aAAa;;;;;;;;;wBAa9B,cACd,UAAU,qBACV,UAAU,cACV,cACC;;;;;;;;wBC3Da,iBAAiB,MAAM;;wBASvB,kBAAkB,MAAM;EAAiB;EAAe;;;;;;;;;;;;;;;;UCZvD;EACf;EACA;;;EAGA;EACA;EACA;EACA;;wBAWc,kBAAkB,UAAU,yBAAyB"}

package/dist/tracking/index.mjs

@@ -1,7 +1,7 @@
-import { t as identifySubmitter } from "../identity-BoRddTx3.mjs";
-import { a as PLATFORM_PARAMS, c as TRACKING_COOKIE_DAYS, i as CLICK_ID_PARAMS, l as UTM_PARAMS, n as identifyPlatform, o as TRACKED_PARAMS, r as AB_COOKIE, s as TRACKING_COOKIE, t as getPrimaryClickId } from "../platform-0nlOIy8h.mjs";
+import { t as identifySubmitter } from "../identity-C4yInICW.mjs";
+import { a as PLATFORM_PARAMS, c as TRACKING_COOKIE_DAYS, i as CLICK_ID_PARAMS, l as UTM_PARAMS, n as identifyPlatform, o as TRACKED_PARAMS, r as AB_COOKIE, s as TRACKING_COOKIE, t as getPrimaryClickId } from "../platform-Cb_RtsF1.mjs";
 
-//#region src/tracking/cookie.ts
+// src/tracking/cookie.ts
 /**
 * Reading and writing the `_ac` cookie, as functions over a cookie **string**.
 *
@@ -73,6 +73,5 @@ function mergeTracking(existing, captured, now) {
 	};
 }
 
-//#endregion
 export { AB_COOKIE, CLICK_ID_PARAMS, PLATFORM_PARAMS, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, UTM_PARAMS, cookieAttributes, getPrimaryClickId, identifyPlatform, identifySubmitter, mergeTracking, parseTrackingCookie, readCookie, serializeTrackingCookie };
 //# sourceMappingURL=index.mjs.map

package/dist/turnstile/index.d.mts

@@ -0,0 +1,105 @@
+/** A Turnstile widget as the list endpoint returns it. The list never carries the secret. */
+interface WidgetSummary {
+  sitekey: string;
+  name: string;
+  domains: string[];
+  mode: string;
+}
+/** What the config asks for. */
+interface TurnstileSetup {
+  /** Widget display name (not unique in Cloudflare). */
+  name: string;
+  /** Hostnames to protect; the widget also covers their subdomains. */
+  domains: string[];
+  /** `site.security.turnstile.siteKey`, when already set. */
+  siteKey?: string | undefined;
+}
+/** What the executor observed. */
+interface TurnstileState {
+  /** Undefined when no account could be resolved. */
+  accountId?: string | undefined;
+  widgets: WidgetSummary[];
+}
+type StepAction = 'create' | 'skip' | 'blocked';
+interface StepPlan {
+  action: StepAction;
+  detail: string;
+}
+interface TurnstilePlan {
+  /** Create the widget in Cloudflare. */
+  widget: StepPlan;
+  /** Write the public site key to `site.security.turnstile.siteKey`. */
+  config: StepPlan;
+  /** The widget the config should point at, when one already exists (adopted). */
+  adopt?: WidgetSummary | undefined;
+  /** Hostnames the created widget will cover. */
+  domains: string[];
+  /** What only a human can do — most importantly, where the secret goes. */
+  reminders: string[];
+}
+/** Cloudflare caps a widget at 10 domains; more is a plan-time refusal, not an API 400. */
+export declare const MAX_DOMAINS = 10;
+export declare function plan(setup: TurnstileSetup, state: TurnstileState): TurnstilePlan;
+/** Any step that isn't a skip — the live state or the config has drifted. */
+export declare function hasDrift(p: TurnstilePlan): boolean;
+export declare function formatPlan(p: TurnstilePlan): string;
+type StepStatus = 'created' | 'present' | 'blocked' | 'failed';
+interface TurnstileResult {
+  step: string;
+  status: StepStatus;
+  detail: string;
+}
+export declare function formatSummary(results: TurnstileResult[]): string;
+/**
+ * The account to create the widget in. `CLOUDFLARE_ACCOUNT_ID` wins; otherwise the token's
+ * only account. Cloudflare's docs state no permission for `GET /accounts`, so a token scoped
+ * to Turnstile alone may be refused here: the message says to set the id instead.
+ */
+export declare function resolveAccountId(token: string, explicit: string | undefined, fetchImpl?: typeof fetch): Promise<{
+  ok: boolean;
+  accountId?: string;
+  message?: string;
+}>;
+/** Every widget in the account, following pagination. */
+export declare function listWidgets(token: string, accountId: string, fetchImpl?: typeof fetch): Promise<{
+  ok: boolean;
+  widgets: WidgetSummary[];
+  message?: string;
+}>;
+/**
+ * Create a managed widget. **Create only** — the planner decides whether one is needed. The
+ * returned `secret` is the only time Cloudflare shows it; the caller must store it as a Worker
+ * secret and must not write it to a config file.
+ */
+export declare function createWidget(token: string, accountId: string, widget: {
+  name: string;
+  domains: string[];
+}, fetchImpl?: typeof fetch): Promise<{
+  ok: boolean;
+  sitekey?: string;
+  secret?: string;
+  message?: string;
+}>;
+/**
+ * Hostnames a widget should cover, from the site config: the canonical domain and every
+ * environment's URL. Cloudflare matches subdomains too, so `example.com` already covers
+ * `dev.example.com`. Deduplicated, lowercase, no scheme or port. `localhost` is never added:
+ * Cloudflare publishes always-pass test keys for local development.
+ */
+export declare function deriveDomains(site: {
+  domains?: {
+    canonical?: string | undefined;
+  } | undefined;
+  environments?: Record<string, {
+    url?: string | undefined;
+  } | undefined> | undefined;
+}): string[];
+/**
+ * Merge the site key into a **raw, on-disk** config object — the rule `ads setup`'s
+ * `patchRaw` follows: never write from the resolved object, so `extends` and shorthand
+ * shapes are not normalised into a copy nothing builds from. Everything outside
+ * `site.security.turnstile.siteKey` is left exactly as it was.
+ */
+export declare function patchSiteKey(raw: unknown, siteKey: string): unknown;
+export type { StepAction, StepPlan, StepStatus, TurnstilePlan, TurnstileResult, TurnstileSetup, TurnstileState, WidgetSummary };
+//# sourceMappingURL=index.d.mts.map

package/dist/turnstile/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/turnstile/types.ts","../../src/turnstile/plan.ts","../../src/turnstile/cloudflare.ts","../../src/turnstile/index.ts"],"mappings":";UACiB;EACf;EACA;EACA;EACA;;;UAIe;;EAEf;;EAEA;;EAEA;;;UAIe;;EAEf;EACA,SAAS;;KCJC;UAEK;EACf,QAAQ;EACR;;UAGe;;EAEf,QAAQ;;EAER,QAAQ;;EAER,QAAQ;;EAER;;EAEA;;;qBAIW;wBAKG,KAAK,OAAO,gBAAgB,OAAO,iBAAiB;;wBA4FpD,SAAS,GAAG;wBAMZ,WAAW,GAAG;KAUlB;UAEK;EACf;EACA,QAAQ;EACR;;wBAGc,cAAc,SAAS;;;;;;wBCpHjB,iBACpB,eACA,8BACA,mBAAkB,QACjB;EAAU;EAAa;EAAoB;;;wBAuBxB,YACpB,eACA,mBACA,mBAAkB,QACjB;EAAU;EAAa,SAAS;EAAiB;;;;;;;wBA2B9B,aACpB,eACA,mBACA;EAAU;EAAc;GACxB,mBAAkB,QACjB;EAAU;EAAa;EAAkB;EAAiB;;;;;;;;wBCrF7C,cAAc;EAC5B;IAAY;;EACZ,eAAe;IAAiB;;;;;;;;;wBA0BlB,aAAa,cAAc"}

package/dist/turnstile/index.mjs

@@ -0,0 +1,281 @@
+import { t as table } from "../plan-format-CIz6Feg2.mjs";
+
+// src/turnstile/plan.ts
+/**
+* Every decision `vitops setup turnstile` makes, as one pure function.
+*
+* Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The
+* executor (`cloudflare.ts`) lists the account's widgets and creates the missing one;
+* this module decides, from that observation, what is left to do. The same split
+* `ads/plan.ts` and `onboarding/plan.ts` make, for the same two payoffs: `--dry` is a
+* *complete* account of a run, and `--check` is an honest drift report.
+*
+* Idempotency lives here. A widget that already covers the site's domains resolves
+* to `skip`, so a re-run is all skips by construction rather than by the executor
+* checking twice. And there is no update or delete verb anywhere in this module's
+* vocabulary: an existing widget is only ever *adopted* (its public site key is
+* written to the config), never edited, rotated or removed.
+*/
+/** Cloudflare caps a widget at 10 domains; more is a plan-time refusal, not an API 400. */
+const MAX_DOMAINS = 10;
+const covers = (w, domains) => domains.every((d) => w.domains.some((wd) => d === wd || d.endsWith(`.${wd}`)));
+function plan(setup, state) {
+	const reminders = ["Set the secret on the Worker: `npx wrangler secret put VITOPS_TURNSTILE_SECRET` (and on the dev worker with `--env`/`--config` as your setup uses). It is shown once, at creation, and never written to site.json."];
+	if (setup.domains.length === 0) return {
+		widget: {
+			action: "blocked",
+			detail: "no hostnames to protect — set site.domains.canonical or site.environments.<env>.url"
+		},
+		config: {
+			action: "blocked",
+			detail: "needs a widget first"
+		},
+		domains: [],
+		reminders: []
+	};
+	if (setup.domains.length > 10) return {
+		widget: {
+			action: "blocked",
+			detail: `${setup.domains.length} hostnames, but Cloudflare allows ${10} per widget`
+		},
+		config: {
+			action: "blocked",
+			detail: "needs a widget first"
+		},
+		domains: setup.domains,
+		reminders: []
+	};
+	if (!state.accountId) return {
+		widget: {
+			action: "blocked",
+			detail: "no Cloudflare account id — set CLOUDFLARE_ACCOUNT_ID (or use a token that can list accounts)"
+		},
+		config: {
+			action: "blocked",
+			detail: "needs a widget first"
+		},
+		domains: setup.domains,
+		reminders: []
+	};
+	const configured = setup.siteKey ? state.widgets.find((w) => w.sitekey === setup.siteKey) : void 0;
+	if (setup.siteKey && !configured) return {
+		widget: {
+			action: "blocked",
+			detail: `site.security.turnstile.siteKey ${setup.siteKey} matches no widget in this account — remove it to let setup adopt or create one`
+		},
+		config: {
+			action: "blocked",
+			detail: "config key is unverified"
+		},
+		domains: setup.domains,
+		reminders: []
+	};
+	const existing = configured ?? state.widgets.find((w) => covers(w, setup.domains));
+	if (existing) {
+		const uncovered = setup.domains.filter((d) => !covers(existing, [d]));
+		return {
+			widget: {
+				action: "skip",
+				detail: uncovered.length === 0 ? `widget "${existing.name}" already covers ${setup.domains.join(", ")}` : `widget "${existing.name}" exists but does not cover ${uncovered.join(", ")} — add them in the dashboard; this command never edits a widget`
+			},
+			config: setup.siteKey === existing.sitekey ? {
+				action: "skip",
+				detail: "site key already in site.json"
+			} : {
+				action: "create",
+				detail: `write ${existing.sitekey} to site.json`
+			},
+			adopt: existing,
+			domains: setup.domains,
+			reminders: ["The secret of an existing widget cannot be read back. Lost it? Rotate it in the dashboard (Turnstile > the widget > Rotate secret), then `wrangler secret put VITOPS_TURNSTILE_SECRET`."]
+		};
+	}
+	return {
+		widget: {
+			action: "create",
+			detail: `create "${setup.name}" (managed) for ${setup.domains.join(", ")}`
+		},
+		config: {
+			action: "create",
+			detail: "write the new site key to site.json"
+		},
+		domains: setup.domains,
+		reminders
+	};
+}
+/** Any step that isn't a skip — the live state or the config has drifted. */
+function hasDrift(p) {
+	return p.widget.action !== "skip" || p.config.action !== "skip";
+}
+const GLYPH = {
+	create: "+",
+	skip: "·",
+	blocked: "!"
+};
+function formatPlan(p) {
+	const rows = [["widget", p.widget], ["config", p.config]].map(([name, step]) => [
+		GLYPH[step.action],
+		name,
+		step.detail
+	]);
+	return table([
+		"",
+		"step",
+		"detail"
+	], rows, p.reminders);
+}
+function formatSummary(results) {
+	return table([
+		"step",
+		"status",
+		"detail"
+	], results.map((r) => [
+		r.step,
+		r.status,
+		r.detail
+	]), []);
+}
+
+// src/turnstile/cloudflare.ts
+const API = "https://api.cloudflare.com/client/v4";
+const cfError = (status, body) => {
+	const first = body.errors?.[0];
+	return first ? `${first.code} ${first.message}` : `HTTP ${status}`;
+};
+const PERMISSION_HINT = " (does the token carry Account > Turnstile > Edit?)";
+async function json(res) {
+	try {
+		return await res.json();
+	} catch {
+		return { success: false };
+	}
+}
+/**
+* The account to create the widget in. `CLOUDFLARE_ACCOUNT_ID` wins; otherwise the token's
+* only account. Cloudflare's docs state no permission for `GET /accounts`, so a token scoped
+* to Turnstile alone may be refused here: the message says to set the id instead.
+*/
+async function resolveAccountId(token, explicit, fetchImpl = fetch) {
+	if (explicit) return {
+		ok: true,
+		accountId: explicit
+	};
+	const res = await fetchImpl(`${API}/accounts?per_page=5`, { headers: { authorization: `Bearer ${token}` } });
+	const body = await json(res);
+	if (!res.ok || !body.success) return {
+		ok: false,
+		message: `${cfError(res.status, body)} — set CLOUDFLARE_ACCOUNT_ID to skip the account lookup`
+	};
+	const accounts = body.result ?? [];
+	if (accounts.length === 1) return {
+		ok: true,
+		accountId: accounts[0].id
+	};
+	return {
+		ok: false,
+		message: accounts.length === 0 ? "the token can see no accounts — set CLOUDFLARE_ACCOUNT_ID" : `the token can see ${accounts.length} accounts — set CLOUDFLARE_ACCOUNT_ID to choose one`
+	};
+}
+/** Every widget in the account, following pagination. */
+async function listWidgets(token, accountId, fetchImpl = fetch) {
+	const widgets = [];
+	for (let page = 1; page <= 20; page++) {
+		const res = await fetchImpl(`${API}/accounts/${encodeURIComponent(accountId)}/challenges/widgets?page=${page}&per_page=100`, { headers: { authorization: `Bearer ${token}` } });
+		const body = await json(res);
+		if (!res.ok || !body.success) return {
+			ok: false,
+			widgets: [],
+			message: cfError(res.status, body) + (res.status === 403 ? PERMISSION_HINT : "")
+		};
+		for (const w of body.result ?? []) widgets.push({
+			sitekey: w.sitekey,
+			name: w.name,
+			domains: w.domains ?? [],
+			mode: w.mode
+		});
+		const info = body.result_info;
+		if (!info || page * info.per_page >= info.total_count) break;
+	}
+	return {
+		ok: true,
+		widgets
+	};
+}
+/**
+* Create a managed widget. **Create only** — the planner decides whether one is needed. The
+* returned `secret` is the only time Cloudflare shows it; the caller must store it as a Worker
+* secret and must not write it to a config file.
+*/
+async function createWidget(token, accountId, widget, fetchImpl = fetch) {
+	const res = await fetchImpl(`${API}/accounts/${encodeURIComponent(accountId)}/challenges/widgets`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${token}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			name: widget.name,
+			domains: widget.domains,
+			mode: "managed"
+		})
+	});
+	const body = await json(res);
+	if (!res.ok || !body.success || !body.result?.sitekey || !body.result.secret) return {
+		ok: false,
+		message: cfError(res.status, body) + (res.status === 403 ? PERMISSION_HINT : "")
+	};
+	return {
+		ok: true,
+		sitekey: body.result.sitekey,
+		secret: body.result.secret
+	};
+}
+
+// src/turnstile/index.ts
+/**
+* Hostnames a widget should cover, from the site config: the canonical domain and every
+* environment's URL. Cloudflare matches subdomains too, so `example.com` already covers
+* `dev.example.com`. Deduplicated, lowercase, no scheme or port. `localhost` is never added:
+* Cloudflare publishes always-pass test keys for local development.
+*/
+function deriveDomains(site) {
+	const urls = [site.domains?.canonical, ...Object.values(site.environments ?? {}).map((e) => e?.url)];
+	const hosts = /* @__PURE__ */ new Set();
+	for (const url of urls) {
+		if (!url) continue;
+		try {
+			const host = new URL(url).hostname.toLowerCase();
+			if (host && host !== "localhost") hosts.add(host);
+		} catch {}
+	}
+	return [...hosts].filter((h) => ![...hosts].some((p) => p !== h && h.endsWith(`.${p}`)));
+}
+/**
+* Merge the site key into a **raw, on-disk** config object — the rule `ads setup`'s
+* `patchRaw` follows: never write from the resolved object, so `extends` and shorthand
+* shapes are not normalised into a copy nothing builds from. Everything outside
+* `site.security.turnstile.siteKey` is left exactly as it was.
+*/
+function patchSiteKey(raw, siteKey) {
+	if (typeof raw !== "object" || raw == null || Array.isArray(raw)) throw new Error("config is not an object");
+	const root = raw;
+	const site = root["site"] ?? {};
+	const security = site["security"] ?? {};
+	const turnstile = security["turnstile"] ?? {};
+	return {
+		...root,
+		site: {
+			...site,
+			security: {
+				...security,
+				turnstile: {
+					...turnstile,
+					siteKey
+				}
+			}
+		}
+	};
+}
+
+export { MAX_DOMAINS, createWidget, deriveDomains, formatPlan, formatSummary, hasDrift, listWidgets, patchSiteKey, plan, resolveAccountId };
+//# sourceMappingURL=index.mjs.map

package/dist/turnstile/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/turnstile/plan.ts","../../src/turnstile/cloudflare.ts","../../src/turnstile/index.ts"],"sourcesContent":["/**\n * Every decision `vitops setup turnstile` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The\n * executor (`cloudflare.ts`) lists the account's widgets and creates the missing one;\n * this module decides, from that observation, what is left to do. The same split\n * `ads/plan.ts` and `onboarding/plan.ts` make, for the same two payoffs: `--dry` is a\n * *complete* account of a run, and `--check` is an honest drift report.\n *\n * Idempotency lives here. A widget that already covers the site's domains resolves\n * to `skip`, so a re-run is all skips by construction rather than by the executor\n * checking twice. And there is no update or delete verb anywhere in this module's\n * vocabulary: an existing widget is only ever *adopted* (its public site key is\n * written to the config), never edited, rotated or removed.\n */\nimport { table } from '../plan-format.ts';\nimport type { TurnstileSetup, TurnstileState, WidgetSummary } from './types.ts';\n\nexport type StepAction = 'create' | 'skip' | 'blocked';\n\nexport interface StepPlan {\n  action: StepAction;\n  detail: string;\n}\n\nexport interface TurnstilePlan {\n  /** Create the widget in Cloudflare. */\n  widget: StepPlan;\n  /** Write the public site key to `site.security.turnstile.siteKey`. */\n  config: StepPlan;\n  /** The widget the config should point at, when one already exists (adopted). */\n  adopt?: WidgetSummary | undefined;\n  /** Hostnames the created widget will cover. */\n  domains: string[];\n  /** What only a human can do — most importantly, where the secret goes. */\n  reminders: string[];\n}\n\n/** Cloudflare caps a widget at 10 domains; more is a plan-time refusal, not an API 400. */\nexport const MAX_DOMAINS = 10;\n\nconst covers = (w: WidgetSummary, domains: string[]): boolean =>\n  domains.every((d) => w.domains.some((wd) => d === wd || d.endsWith(`.${wd}`)));\n\nexport function plan(setup: TurnstileSetup, state: TurnstileState): TurnstilePlan {\n  const reminders = [\n    'Set the secret on the Worker: `npx wrangler secret put VITOPS_TURNSTILE_SECRET` (and on the dev worker with `--env`/`--config` as your setup uses). It is shown once, at creation, and never written to site.json.',\n  ];\n\n  if (setup.domains.length === 0)\n    return {\n      widget: {\n        action: 'blocked',\n        detail:\n          'no hostnames to protect — set site.domains.canonical or site.environments.<env>.url',\n      },\n      config: { action: 'blocked', detail: 'needs a widget first' },\n      domains: [],\n      reminders: [],\n    };\n  if (setup.domains.length > MAX_DOMAINS)\n    return {\n      widget: {\n        action: 'blocked',\n        detail: `${setup.domains.length} hostnames, but Cloudflare allows ${MAX_DOMAINS} per widget`,\n      },\n      config: { action: 'blocked', detail: 'needs a widget first' },\n      domains: setup.domains,\n      reminders: [],\n    };\n\n  if (!state.accountId)\n    return {\n      widget: {\n        action: 'blocked',\n        detail:\n          'no Cloudflare account id — set CLOUDFLARE_ACCOUNT_ID (or use a token that can list accounts)',\n      },\n      config: { action: 'blocked', detail: 'needs a widget first' },\n      domains: setup.domains,\n      reminders: [],\n    };\n\n  // The config's own key wins: if it names a widget in this account, that is the one.\n  const configured = setup.siteKey\n    ? state.widgets.find((w) => w.sitekey === setup.siteKey)\n    : undefined;\n  if (setup.siteKey && !configured) {\n    // A key that no widget in this account owns is drift (typo, another account, a deleted\n    // widget). Creating a second widget would hide it, so stop and say so.\n    return {\n      widget: {\n        action: 'blocked',\n        detail: `site.security.turnstile.siteKey ${setup.siteKey} matches no widget in this account — remove it to let setup adopt or create one`,\n      },\n      config: { action: 'blocked', detail: 'config key is unverified' },\n      domains: setup.domains,\n      reminders: [],\n    };\n  }\n\n  const existing = configured ?? state.widgets.find((w) => covers(w, setup.domains));\n  if (existing) {\n    const uncovered = setup.domains.filter((d) => !covers(existing, [d]));\n    return {\n      widget: {\n        action: 'skip',\n        detail:\n          uncovered.length === 0\n            ? `widget \"${existing.name}\" already covers ${setup.domains.join(', ')}`\n            : `widget \"${existing.name}\" exists but does not cover ${uncovered.join(', ')} — add them in the dashboard; this command never edits a widget`,\n      },\n      config:\n        setup.siteKey === existing.sitekey\n          ? { action: 'skip', detail: 'site key already in site.json' }\n          : { action: 'create', detail: `write ${existing.sitekey} to site.json` },\n      adopt: existing,\n      domains: setup.domains,\n      reminders: [\n        'The secret of an existing widget cannot be read back. Lost it? Rotate it in the dashboard (Turnstile > the widget > Rotate secret), then `wrangler secret put VITOPS_TURNSTILE_SECRET`.',\n      ],\n    };\n  }\n\n  return {\n    widget: {\n      action: 'create',\n      detail: `create \"${setup.name}\" (managed) for ${setup.domains.join(', ')}`,\n    },\n    config: { action: 'create', detail: 'write the new site key to site.json' },\n    domains: setup.domains,\n    reminders,\n  };\n}\n\n/** Any step that isn't a skip — the live state or the config has drifted. */\nexport function hasDrift(p: TurnstilePlan): boolean {\n  return p.widget.action !== 'skip' || p.config.action !== 'skip';\n}\n\nconst GLYPH: Record<StepAction, string> = { create: '+', skip: '·', blocked: '!' };\n\nexport function formatPlan(p: TurnstilePlan): string {\n  const rows = (\n    [\n      ['widget', p.widget],\n      ['config', p.config],\n    ] as const\n  ).map(([name, step]) => [GLYPH[step.action], name, step.detail]);\n  return table(['', 'step', 'detail'], rows, p.reminders);\n}\n\nexport type StepStatus = 'created' | 'present' | 'blocked' | 'failed';\n\nexport interface TurnstileResult {\n  step: string;\n  status: StepStatus;\n  detail: string;\n}\n\nexport function formatSummary(results: TurnstileResult[]): string {\n  return table(\n    ['step', 'status', 'detail'],\n    results.map((r) => [r.step, r.status, r.detail]),\n    [],\n  );\n}\n","/**\n * Cloudflare's Turnstile widget API — the one thing `vitops setup turnstile` writes.\n *\n * Verified against developers.cloudflare.com (2026-11): list is\n * `GET /accounts/{id}/challenges/widgets` (paged, `per_page` 5 to 1000), create is\n * `POST` to the same path with `name`, `domains` (max 10) and `mode` required, and only\n * the create response carries `secret`. The token needs the **Account > Turnstile > Edit**\n * permission (API reference names: `Turnstile Sites Write`, or `Account Settings Write`).\n *\n * As in `onboarding/cloudflare.ts` there is deliberately no update, rotate or delete verb:\n * the destructive operations are absent rather than guarded. `fetchImpl` is injected and\n * every call returns a structured result rather than throwing.\n */\nimport type { WidgetSummary } from './types.ts';\n\nconst API = 'https://api.cloudflare.com/client/v4';\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  errors?: { code: number; message: string }[];\n  result?: T;\n  result_info?: { page: number; per_page: number; total_count: number };\n}\n\nconst cfError = (status: number, body: CfEnvelope<unknown>): string => {\n  const first = body.errors?.[0];\n  return first ? `${first.code} ${first.message}` : `HTTP ${status}`;\n};\n\nconst PERMISSION_HINT = ' (does the token carry Account > Turnstile > Edit?)';\n\nasync function json<T>(res: Response): Promise<CfEnvelope<T>> {\n  try {\n    return (await res.json()) as CfEnvelope<T>;\n  } catch {\n    return { success: false };\n  }\n}\n\n/**\n * The account to create the widget in. `CLOUDFLARE_ACCOUNT_ID` wins; otherwise the token's\n * only account. Cloudflare's docs state no permission for `GET /accounts`, so a token scoped\n * to Turnstile alone may be refused here: the message says to set the id instead.\n */\nexport async function resolveAccountId(\n  token: string,\n  explicit: string | undefined,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; accountId?: string; message?: string }> {\n  if (explicit) return { ok: true, accountId: explicit };\n  const res = await fetchImpl(`${API}/accounts?per_page=5`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  const body = await json<{ id: string; name: string }[]>(res);\n  if (!res.ok || !body.success)\n    return {\n      ok: false,\n      message: `${cfError(res.status, body)} — set CLOUDFLARE_ACCOUNT_ID to skip the account lookup`,\n    };\n  const accounts = body.result ?? [];\n  if (accounts.length === 1) return { ok: true, accountId: accounts[0]!.id };\n  return {\n    ok: false,\n    message:\n      accounts.length === 0\n        ? 'the token can see no accounts — set CLOUDFLARE_ACCOUNT_ID'\n        : `the token can see ${accounts.length} accounts — set CLOUDFLARE_ACCOUNT_ID to choose one`,\n  };\n}\n\n/** Every widget in the account, following pagination. */\nexport async function listWidgets(\n  token: string,\n  accountId: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; widgets: WidgetSummary[]; message?: string }> {\n  const widgets: WidgetSummary[] = [];\n  for (let page = 1; page <= 20; page++) {\n    const res = await fetchImpl(\n      `${API}/accounts/${encodeURIComponent(accountId)}/challenges/widgets?page=${page}&per_page=100`,\n      { headers: { authorization: `Bearer ${token}` } },\n    );\n    const body = await json<WidgetSummary[]>(res);\n    if (!res.ok || !body.success)\n      return {\n        ok: false,\n        widgets: [],\n        message: cfError(res.status, body) + (res.status === 403 ? PERMISSION_HINT : ''),\n      };\n    for (const w of body.result ?? [])\n      widgets.push({ sitekey: w.sitekey, name: w.name, domains: w.domains ?? [], mode: w.mode });\n    const info = body.result_info;\n    if (!info || page * info.per_page >= info.total_count) break;\n  }\n  return { ok: true, widgets };\n}\n\n/**\n * Create a managed widget. **Create only** — the planner decides whether one is needed. The\n * returned `secret` is the only time Cloudflare shows it; the caller must store it as a Worker\n * secret and must not write it to a config file.\n */\nexport async function createWidget(\n  token: string,\n  accountId: string,\n  widget: { name: string; domains: string[] },\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; sitekey?: string; secret?: string; message?: string }> {\n  const res = await fetchImpl(\n    `${API}/accounts/${encodeURIComponent(accountId)}/challenges/widgets`,\n    {\n      method: 'POST',\n      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },\n      body: JSON.stringify({ name: widget.name, domains: widget.domains, mode: 'managed' }),\n    },\n  );\n  const body = await json<{ sitekey: string; secret: string }>(res);\n  if (!res.ok || !body.success || !body.result?.sitekey || !body.result.secret)\n    return {\n      ok: false,\n      message: cfError(res.status, body) + (res.status === 403 ? PERMISSION_HINT : ''),\n    };\n  return { ok: true, sitekey: body.result.sitekey, secret: body.result.secret };\n}\n","/**\n * `vitops setup turnstile` — create a Cloudflare Turnstile widget and record its public site\n * key in `site.json`.\n *\n * A separate subpath (`@getvitops/utils/turnstile`), matching `./ads` and `./hosting`. It is\n * build-time tooling, unlike `@getvitops/utils/security` (the Worker-side verifier): keep the\n * two apart so a conversion route never pulls this in.\n *\n * The layering is the repo's usual one: `plan.ts` decides everything and touches nothing;\n * `cloudflare.ts` executes and decides nothing.\n */\nexport { MAX_DOMAINS, formatPlan, formatSummary, hasDrift, plan } from './plan.ts';\nexport type { StepAction, StepPlan, StepStatus, TurnstilePlan, TurnstileResult } from './plan.ts';\nexport { createWidget, listWidgets, resolveAccountId } from './cloudflare.ts';\nexport type { TurnstileSetup, TurnstileState, WidgetSummary } from './types.ts';\n\n/**\n * Hostnames a widget should cover, from the site config: the canonical domain and every\n * environment's URL. Cloudflare matches subdomains too, so `example.com` already covers\n * `dev.example.com`. Deduplicated, lowercase, no scheme or port. `localhost` is never added:\n * Cloudflare publishes always-pass test keys for local development.\n */\nexport function deriveDomains(site: {\n  domains?: { canonical?: string | undefined } | undefined;\n  environments?: Record<string, { url?: string | undefined } | undefined> | undefined;\n}): string[] {\n  const urls = [\n    site.domains?.canonical,\n    ...Object.values(site.environments ?? {}).map((e) => e?.url),\n  ];\n  const hosts = new Set<string>();\n  for (const url of urls) {\n    if (!url) continue;\n    try {\n      const host = new URL(url).hostname.toLowerCase();\n      if (host && host !== 'localhost') hosts.add(host);\n    } catch {\n      // a malformed URL is the config validator's business, not a reason to create a widget for it\n    }\n  }\n  // Drop hostnames already covered by a parent in the set (dev.example.com under example.com).\n  return [...hosts].filter((h) => ![...hosts].some((p) => p !== h && h.endsWith(`.${p}`)));\n}\n\n/**\n * Merge the site key into a **raw, on-disk** config object — the rule `ads setup`'s\n * `patchRaw` follows: never write from the resolved object, so `extends` and shorthand\n * shapes are not normalised into a copy nothing builds from. Everything outside\n * `site.security.turnstile.siteKey` is left exactly as it was.\n */\nexport function patchSiteKey(raw: unknown, siteKey: string): unknown {\n  if (typeof raw !== 'object' || raw == null || Array.isArray(raw))\n    throw new Error('config is not an object');\n  const root = raw as Record<string, unknown>;\n  const site = (root['site'] ?? {}) as Record<string, unknown>;\n  const security = (site['security'] ?? {}) as Record<string, unknown>;\n  const turnstile = (security['turnstile'] ?? {}) as Record<string, unknown>;\n  return {\n    ...root,\n    site: { ...site, security: { ...security, turnstile: { ...turnstile, siteKey } } },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCA,MAAa,cAAc;AAE3B,MAAM,UAAU,GAAkB,YAChC,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,OAAO,MAAM,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;AAE/E,SAAgB,KAAK,OAAuB,OAAsC;CAChF,MAAM,YAAY,CAChB,oNACF;CAEA,IAAI,MAAM,QAAQ,WAAW,GAC3B,OAAO;EACL,QAAQ;GACN,QAAQ;GACR,QACE;EACJ;EACA,QAAQ;GAAE,QAAQ;GAAW,QAAQ;EAAuB;EAC5D,SAAS,CAAC;EACV,WAAW,CAAC;CACd;CACF,IAAI,MAAM,QAAQ,aAChB,OAAO;EACL,QAAQ;GACN,QAAQ;GACR,QAAQ,GAAG,MAAM,QAAQ,OAAO,uCAAgD;EAClF;EACA,QAAQ;GAAE,QAAQ;GAAW,QAAQ;EAAuB;EAC5D,SAAS,MAAM;EACf,WAAW,CAAC;CACd;CAEF,IAAI,CAAC,MAAM,WACT,OAAO;EACL,QAAQ;GACN,QAAQ;GACR,QACE;EACJ;EACA,QAAQ;GAAE,QAAQ;GAAW,QAAQ;EAAuB;EAC5D,SAAS,MAAM;EACf,WAAW,CAAC;CACd;CAGF,MAAM,aAAa,MAAM,UACrB,MAAM,QAAQ,MAAM,MAAM,EAAE,YAAY,MAAM,OAAO,IACrD;CACJ,IAAI,MAAM,WAAW,CAAC,YAGpB,OAAO;EACL,QAAQ;GACN,QAAQ;GACR,QAAQ,mCAAmC,MAAM,QAAQ;EAC3D;EACA,QAAQ;GAAE,QAAQ;GAAW,QAAQ;EAA2B;EAChE,SAAS,MAAM;EACf,WAAW,CAAC;CACd;CAGF,MAAM,WAAW,cAAc,MAAM,QAAQ,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;CACjF,IAAI,UAAU;EACZ,MAAM,YAAY,MAAM,QAAQ,QAAQ,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;EACpE,OAAO;GACL,QAAQ;IACN,QAAQ;IACR,QACE,UAAU,WAAW,IACjB,WAAW,SAAS,KAAK,mBAAmB,MAAM,QAAQ,KAAK,IAAI,MACnE,WAAW,SAAS,KAAK,8BAA8B,UAAU,KAAK,IAAI,EAAE;GACpF;GACA,QACE,MAAM,YAAY,SAAS,UACvB;IAAE,QAAQ;IAAQ,QAAQ;GAAgC,IAC1D;IAAE,QAAQ;IAAU,QAAQ,SAAS,SAAS,QAAQ;GAAe;GAC3E,OAAO;GACP,SAAS,MAAM;GACf,WAAW,CACT,yLACF;EACF;CACF;CAEA,OAAO;EACL,QAAQ;GACN,QAAQ;GACR,QAAQ,WAAW,MAAM,KAAK,kBAAkB,MAAM,QAAQ,KAAK,IAAI;EACzE;EACA,QAAQ;GAAE,QAAQ;GAAU,QAAQ;EAAsC;EAC1E,SAAS,MAAM;EACf;CACF;AACF;;AAGA,SAAgB,SAAS,GAA2B;CAClD,OAAO,EAAE,OAAO,WAAW,UAAU,EAAE,OAAO,WAAW;AAC3D;AAEA,MAAM,QAAoC;CAAE,QAAQ;CAAK,MAAM;CAAK,SAAS;AAAI;AAEjF,SAAgB,WAAW,GAA0B;CACnD,MAAM,OACJ,CACE,CAAC,UAAU,EAAE,MAAM,GACnB,CAAC,UAAU,EAAE,MAAM,CACrB,CAAC,CACD,KAAK,CAAC,MAAM,UAAU;EAAC,MAAM,KAAK;EAAS;EAAM,KAAK;CAAM,CAAC;CAC/D,OAAO,MAAM;EAAC;EAAI;EAAQ;CAAQ,GAAG,MAAM,EAAE,SAAS;AACxD;AAUA,SAAgB,cAAc,SAAoC;CAChE,OAAO,MACL;EAAC;EAAQ;EAAU;CAAQ,GAC3B,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAM,EAAE;EAAQ,EAAE;CAAM,CAAC,GAC/C,CAAC,CACH;AACF;;;ACvJA,MAAM,MAAM;AASZ,MAAM,WAAW,QAAgB,SAAsC;CACrE,MAAM,QAAQ,KAAK,SAAS;CAC5B,OAAO,QAAQ,GAAG,MAAM,KAAK,GAAG,MAAM,YAAY,QAAQ;AAC5D;AAEA,MAAM,kBAAkB;AAExB,eAAe,KAAQ,KAAuC;CAC5D,IAAI;EACF,OAAQ,MAAM,IAAI,KAAK;CACzB,QAAQ;EACN,OAAO,EAAE,SAAS,MAAM;CAC1B;AACF;;;;;;AAOA,eAAsB,iBACpB,OACA,UACA,YAA0B,OACsC;CAChE,IAAI,UAAU,OAAO;EAAE,IAAI;EAAM,WAAW;CAAS;CACrD,MAAM,MAAM,MAAM,UAAU,GAAG,IAAI,uBAAuB,EACxD,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,MAAM,OAAO,MAAM,KAAqC,GAAG;CAC3D,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EACL,IAAI;EACJ,SAAS,GAAG,QAAQ,IAAI,QAAQ,IAAI,EAAE;CACxC;CACF,MAAM,WAAW,KAAK,UAAU,CAAC;CACjC,IAAI,SAAS,WAAW,GAAG,OAAO;EAAE,IAAI;EAAM,WAAW,SAAS,EAAE,CAAE;CAAG;CACzE,OAAO;EACL,IAAI;EACJ,SACE,SAAS,WAAW,IAChB,8DACA,qBAAqB,SAAS,OAAO;CAC7C;AACF;;AAGA,eAAsB,YACpB,OACA,WACA,YAA0B,OAC4C;CACtE,MAAM,UAA2B,CAAC;CAClC,KAAK,IAAI,OAAO,GAAG,QAAQ,IAAI,QAAQ;EACrC,MAAM,MAAM,MAAM,UAChB,GAAG,IAAI,YAAY,mBAAmB,SAAS,EAAE,2BAA2B,KAAK,gBACjF,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CAClD;EACA,MAAM,OAAO,MAAM,KAAsB,GAAG;EAC5C,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;GACL,IAAI;GACJ,SAAS,CAAC;GACV,SAAS,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,WAAW,MAAM,kBAAkB;EAC/E;EACF,KAAK,MAAM,KAAK,KAAK,UAAU,CAAC,GAC9B,QAAQ,KAAK;GAAE,SAAS,EAAE;GAAS,MAAM,EAAE;GAAM,SAAS,EAAE,WAAW,CAAC;GAAG,MAAM,EAAE;EAAK,CAAC;EAC3F,MAAM,OAAO,KAAK;EAClB,IAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,KAAK,aAAa;CACzD;CACA,OAAO;EAAE,IAAI;EAAM;CAAQ;AAC7B;;;;;;AAOA,eAAsB,aACpB,OACA,WACA,QACA,YAA0B,OACqD;CAC/E,MAAM,MAAM,MAAM,UAChB,GAAG,IAAI,YAAY,mBAAmB,SAAS,EAAE,sBACjD;EACE,QAAQ;EACR,SAAS;GAAE,eAAe,UAAU;GAAS,gBAAgB;EAAmB;EAChF,MAAM,KAAK,UAAU;GAAE,MAAM,OAAO;GAAM,SAAS,OAAO;GAAS,MAAM;EAAU,CAAC;CACtF,CACF;CACA,MAAM,OAAO,MAAM,KAA0C,GAAG;CAChE,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,WAAW,CAAC,KAAK,QAAQ,WAAW,CAAC,KAAK,OAAO,QACpE,OAAO;EACL,IAAI;EACJ,SAAS,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,WAAW,MAAM,kBAAkB;CAC/E;CACF,OAAO;EAAE,IAAI;EAAM,SAAS,KAAK,OAAO;EAAS,QAAQ,KAAK,OAAO;CAAO;AAC9E;;;;;;;;;ACrGA,SAAgB,cAAc,MAGjB;CACX,MAAM,OAAO,CACX,KAAK,SAAS,WACd,GAAG,OAAO,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,GAAG,CAC7D;CACA,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAAC,KAAK;EACV,IAAI;GACF,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,YAAY;GAC/C,IAAI,QAAQ,SAAS,aAAa,MAAM,IAAI,IAAI;EAClD,QAAQ,CAER;CACF;CAEA,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM,MAAM,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;AACzF;;;;;;;AAQA,SAAgB,aAAa,KAAc,SAA0B;CACnE,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,MAAM,QAAQ,GAAG,GAC7D,MAAM,IAAI,MAAM,yBAAyB;CAC3C,MAAM,OAAO;CACb,MAAM,OAAQ,KAAK,WAAW,CAAC;CAC/B,MAAM,WAAY,KAAK,eAAe,CAAC;CACvC,MAAM,YAAa,SAAS,gBAAgB,CAAC;CAC7C,OAAO;EACL,GAAG;EACH,MAAM;GAAE,GAAG;GAAM,UAAU;IAAE,GAAG;IAAU,WAAW;KAAE,GAAG;KAAW;IAAQ;GAAE;EAAE;CACnF;AACF"}

package/dist/{types-7ELci8RQ.d.mts → types-oac2P5or.d.mts}

@@ -1,25 +1,6 @@
-//#region src/tracking/types.d.ts
-/**
- * The tracking module's own option surface.
- *
- * Deliberately structural rather than `Config['site']['tracking']` imported from
- * `@getvitops/generator`: the generator already depends on this package, so
- * importing back would be a cycle. The vocabulary mirrors that block field for
- * field — the same arrangement, and for the same reason, as `IndexingConfig`.
- */
+import { TrackingConfig } from "@getvitops/config";
 /** Which consent category the `_ac` cookie waits on. */
-type TrackingCategory = 'marketing' | 'analytics';
-interface TrackingConfig {
-  enabled?: boolean | undefined;
-  /**
-   * Default `marketing`. `_ac` is a 90-day identifier tying a visitor to the ad
-   * that brought them, which is what advertising consent covers — but a site
-   * using click IDs purely for its own campaign reporting may reasonably file it
-   * under `analytics`, so this is stated rather than assumed.
-   */
-  category?: TrackingCategory | undefined;
-  platforms?: string[] | undefined;
-}
+type TrackingCategory = NonNullable<TrackingConfig['category']>;
 /**
  * What the `_ac` cookie holds: where a visitor came from, captured once on the
  * landing page and carried until it expires.
@@ -65,6 +46,5 @@ interface ConversionEvent {
   /** Epoch ms. */
   at: number;
 }
-//#endregion
 export { TrackingData as i, TrackingCategory as n, TrackingConfig as r, ConversionEvent as t };
-//# sourceMappingURL=types-7ELci8RQ.d.mts.map
+//# sourceMappingURL=types-oac2P5or.d.mts.map

package/dist/types-oac2P5or.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-oac2P5or.d.mts","names":[],"sources":["../src/tracking/types.ts"],"mappings":";;KAsBY,mBAAmB,YAAY;;;;;;;;;UAU1B;GACd;;EAED;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;;UAee;EACf;;EAEA,WAAW;EACX;;EAEA;;EAEA,UAAU;EACV;EACA;;EAEA"}