@getvitops/utils 8.2.0-alpha.0 → 8.3.0-alpha.0

package/dist/url/index.d.mts

@@ -0,0 +1,18 @@
+/**
+ * URL safety for values that end up in an `href`/`src`.
+ *
+ * Worker-safe, dependency-free: used by the EmDash blocks, the Astro components that render
+ * data from outside the repo (Google reviews), and `nodesToHtml`. It is an allowlist rather
+ * than a sanitizer on purpose — nothing here takes HTML, and the only dangerous input is a URL
+ * whose scheme runs script when followed.
+ */
+/**
+ * Return `href` only when it is safe to put in an anchor or image, otherwise `undefined`.
+ *
+ * Editors are semi-trusted, but `javascript:` and `data:` URLs run script on click, so only
+ * web/mail/phone schemes and scheme-less (relative, `#`, `?`) values pass. Browsers ignore
+ * ASCII whitespace and control characters inside a scheme (`java\tscript:`), so they are
+ * stripped before the check rather than trusted to be absent.
+ */
+export declare function safeHref(href: unknown): string | undefined;
+//# sourceMappingURL=index.d.mts.map

package/dist/url/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/url/index.ts"],"mappings":";;;;;;;;;;;;;;;;wBAmBgB,SAAS"}

package/dist/url/index.mjs

@@ -0,0 +1,34 @@
+// src/url/index.ts
+/**
+* URL safety for values that end up in an `href`/`src`.
+*
+* Worker-safe, dependency-free: used by the EmDash blocks, the Astro components that render
+* data from outside the repo (Google reviews), and `nodesToHtml`. It is an allowlist rather
+* than a sanitizer on purpose — nothing here takes HTML, and the only dangerous input is a URL
+* whose scheme runs script when followed.
+*/
+const SAFE_SCHEMES = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+/**
+* Return `href` only when it is safe to put in an anchor or image, otherwise `undefined`.
+*
+* Editors are semi-trusted, but `javascript:` and `data:` URLs run script on click, so only
+* web/mail/phone schemes and scheme-less (relative, `#`, `?`) values pass. Browsers ignore
+* ASCII whitespace and control characters inside a scheme (`java\tscript:`), so they are
+* stripped before the check rather than trusted to be absent.
+*/
+function safeHref(href) {
+	if (typeof href !== "string") return void 0;
+	const trimmed = href.trim();
+	const probe = trimmed.replace(/[\u0000- ]/g, "");
+	const scheme = /^([a-z][a-z0-9+.-]*:)/i.exec(probe)?.[1]?.toLowerCase();
+	if (scheme && !SAFE_SCHEMES.has(scheme)) return void 0;
+	return trimmed || void 0;
+}
+
+export { safeHref };
+//# sourceMappingURL=index.mjs.map

package/dist/url/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/url/index.ts"],"sourcesContent":["/**\n * URL safety for values that end up in an `href`/`src`.\n *\n * Worker-safe, dependency-free: used by the EmDash blocks, the Astro components that render\n * data from outside the repo (Google reviews), and `nodesToHtml`. It is an allowlist rather\n * than a sanitizer on purpose — nothing here takes HTML, and the only dangerous input is a URL\n * whose scheme runs script when followed.\n */\n\nconst SAFE_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:']);\n\n/**\n * Return `href` only when it is safe to put in an anchor or image, otherwise `undefined`.\n *\n * Editors are semi-trusted, but `javascript:` and `data:` URLs run script on click, so only\n * web/mail/phone schemes and scheme-less (relative, `#`, `?`) values pass. Browsers ignore\n * ASCII whitespace and control characters inside a scheme (`java\\tscript:`), so they are\n * stripped before the check rather than trusted to be absent.\n */\nexport function safeHref(href: unknown): string | undefined {\n  if (typeof href !== 'string') return undefined;\n  const trimmed = href.trim();\n  // eslint-disable-next-line no-control-regex\n  const probe = trimmed.replace(/[\\u0000- ]/g, '');\n  const scheme = /^([a-z][a-z0-9+.-]*:)/i.exec(probe)?.[1]?.toLowerCase();\n  if (scheme && !SAFE_SCHEMES.has(scheme)) return undefined;\n  return trimmed || undefined;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;;;;;;;;;AAUnE,SAAgB,SAAS,MAAmC;CAC1D,IAAI,OAAO,SAAS,UAAU,OAAO;CACrC,MAAM,UAAU,KAAK,KAAK;CAE1B,MAAM,QAAQ,QAAQ,QAAQ,eAAe,EAAE;CAC/C,MAAM,SAAS,yBAAyB,KAAK,KAAK,CAAC,GAAG,EAAE,EAAE,YAAY;CACtE,IAAI,UAAU,CAAC,aAAa,IAAI,MAAM,GAAG,OAAO;CAChD,OAAO,WAAW;AACpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getvitops/utils",
-  "version": "8.2.0-alpha.0",
+  "version": "8.3.0-alpha.0",
   "description": "Shared build-time utilities for the Vitops toolchain — favicon generation and friends.",
   "homepage": "https://docs.vitops.ca",
   "bugs": "https://github.com/getvitops/design-system/issues",
@@ -26,6 +26,14 @@
       "types": "./dist/favicon.d.mts",
       "import": "./dist/favicon.mjs"
     },
+    "./content": {
+      "types": "./dist/content.d.mts",
+      "import": "./dist/content.mjs"
+    },
+    "./url": {
+      "types": "./dist/url/index.d.mts",
+      "import": "./dist/url/index.mjs"
+    },
     "./color": {
       "types": "./dist/color/index.d.mts",
       "import": "./dist/color/index.mjs"
@@ -42,10 +50,22 @@
       "types": "./dist/reviews/index.d.mts",
       "import": "./dist/reviews/index.mjs"
     },
+    "./turnstile": {
+      "types": "./dist/turnstile/index.d.mts",
+      "import": "./dist/turnstile/index.mjs"
+    },
+    "./reviews/select": {
+      "types": "./dist/reviews/select.d.mts",
+      "import": "./dist/reviews/select.mjs"
+    },
     "./ads": {
       "types": "./dist/ads/index.d.mts",
       "import": "./dist/ads/index.mjs"
     },
+    "./audit": {
+      "types": "./dist/audit/index.d.mts",
+      "import": "./dist/audit/index.mjs"
+    },
     "./media": {
       "types": "./dist/media/index.d.mts",
       "import": "./dist/media/index.mjs"
@@ -87,12 +107,33 @@
     "access": "public"
   },
   "dependencies": {
+    "@getvitops/config": "8.3.0-alpha.0",
     "colorjs.io": "^0.5.2",
     "parse5": "^7.3.0",
     "png-to-ico": "^3.0.2",
     "sharp": "^0.35.3"
   },
-  "devDependencies": {},
+  "devDependencies": {
+    "@axe-core/playwright": "^4.10.0",
+    "lighthouse": "^13.0.0",
+    "playwright": "^1.62.1"
+  },
+  "peerDependencies": {
+    "@axe-core/playwright": ">=4.10.0",
+    "lighthouse": ">=13.0.0",
+    "playwright": ">=1.50.0"
+  },
+  "peerDependenciesMeta": {
+    "@axe-core/playwright": {
+      "optional": true
+    },
+    "lighthouse": {
+      "optional": true
+    },
+    "playwright": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=24"
   }

package/dist/adc-BoEoogyo.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adc-BoEoogyo.d.mts","names":[],"sources":["../src/google/adc.ts"],"mappings":";;;iBAkBgB,aAAa,cAAc;;iBAwB3B,gBAAgB;;;;;;;;;;iBAiBhB,mBAAmB;EACjC,KAAK;EACL;EACA;EACA,UAAU"}

package/dist/cloudflare-BiK61Oq4.d.mts

@@ -1,27 +0,0 @@
-//#region src/onboarding/cloudflare.d.ts
-/** Find the zone id for a domain (`GET /zones?name=`). */
-declare function findZoneId(token: string, domain: string, fetchImpl?: typeof fetch): Promise<{
-  ok: boolean;
-  status: number;
-  zoneId?: string;
-  message?: string;
-}>;
-/** List the apex TXT record contents for a zone. */
-declare function listApexTxt(token: string, zoneId: string, domain: string, fetchImpl?: typeof fetch): Promise<{
-  ok: boolean;
-  status: number;
-  contents: string[];
-  message?: string;
-}>;
-/**
- * Create an apex TXT record. **Create only** — never called when one already
- * exists (the planner decides that), and there is no sibling that edits or removes.
- */
-declare function createApexTxt(token: string, zoneId: string, domain: string, content: string, fetchImpl?: typeof fetch): Promise<{
-  ok: boolean;
-  status: number;
-  message?: string;
-}>;
-//#endregion
-export { findZoneId as n, listApexTxt as r, createApexTxt as t };
-//# sourceMappingURL=cloudflare-BiK61Oq4.d.mts.map

package/dist/cloudflare-BiK61Oq4.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-BiK61Oq4.d.mts","names":[],"sources":["../src/onboarding/cloudflare.ts"],"mappings":";;iBA8BsB,WACpB,eACA,gBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;EAAiB;;;iBAsBrC,YACpB,eACA,gBACA,gBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB;EAAoB;;;;;;iBAiBxC,cACpB,eACA,gBACA,gBACA,iBACA,mBAAkB,QACjB;EAAU;EAAa;EAAgB"}

package/dist/cloudflare-CD8vwrgj.mjs

@@ -1,92 +0,0 @@
-//#region src/onboarding/cloudflare.ts
-/**
-* Cloudflare DNS — the one thing this command writes.
-*
-* Scoped to exactly what onboarding needs and nothing more: find a zone by name,
-* read the apex TXT records, and *create* the verification TXT when it is missing.
-* There is deliberately no update and no delete — the command's contract is that it
-* never removes a DNS record, so the destructive verbs are simply absent rather
-* than guarded.
-*
-* The token is a `Zone:DNS:Edit` credential from the environment
-* (`CLOUDFLARE_API_TOKEN`); listing a zone by name also needs `Zone:Read`, which
-* Cloudflare's standard "Edit zone DNS" token template already bundles. As with the
-* indexing executors, `fetchImpl` is injected so the request shape is testable
-* without the network, and every call returns a structured result rather than
-* throwing — the caller decides what a failure means per domain.
-*/
-const API = "https://api.cloudflare.com/client/v4";
-const cfError = (status, body) => {
-	const first = body.errors?.[0];
-	return first ? `${first.code} ${first.message}` : `HTTP ${status}`;
-};
-/** Find the zone id for a domain (`GET /zones?name=`). */
-async function findZoneId(token, domain, fetchImpl = fetch) {
-	const res = await fetchImpl(`${API}/zones?name=${encodeURIComponent(domain)}`, { headers: { authorization: `Bearer ${token}` } });
-	const body = await res.json();
-	if (!res.ok || !body.success) return {
-		ok: false,
-		status: res.status,
-		message: cfError(res.status, body)
-	};
-	const zone = body.result?.[0];
-	if (!zone) return {
-		ok: false,
-		status: res.status,
-		message: `no Cloudflare zone named "${domain}" (is it in this account, and does the token carry Zone:Read as well as Zone:DNS:Edit? The "Edit zone DNS" template covers both.)`
-	};
-	return {
-		ok: true,
-		status: res.status,
-		zoneId: zone.id
-	};
-}
-/** List the apex TXT record contents for a zone. */
-async function listApexTxt(token, zoneId, domain, fetchImpl = fetch) {
-	const res = await fetchImpl(`${API}/zones/${zoneId}/dns_records?type=TXT&name=${encodeURIComponent(domain)}`, { headers: { authorization: `Bearer ${token}` } });
-	const body = await res.json();
-	if (!res.ok || !body.success) return {
-		ok: false,
-		status: res.status,
-		contents: [],
-		message: cfError(res.status, body)
-	};
-	const contents = (body.result ?? []).map((r) => r.content.replace(/^"|"$/g, ""));
-	return {
-		ok: true,
-		status: res.status,
-		contents
-	};
-}
-/**
-* Create an apex TXT record. **Create only** — never called when one already
-* exists (the planner decides that), and there is no sibling that edits or removes.
-*/
-async function createApexTxt(token, zoneId, domain, content, fetchImpl = fetch) {
-	const res = await fetchImpl(`${API}/zones/${zoneId}/dns_records`, {
-		method: "POST",
-		headers: {
-			authorization: `Bearer ${token}`,
-			"content-type": "application/json"
-		},
-		body: JSON.stringify({
-			type: "TXT",
-			name: domain,
-			content
-		})
-	});
-	const body = await res.json();
-	if (!res.ok || !body.success) return {
-		ok: false,
-		status: res.status,
-		message: cfError(res.status, body)
-	};
-	return {
-		ok: true,
-		status: res.status
-	};
-}
-
-//#endregion
-export { findZoneId as n, listApexTxt as r, createApexTxt as t };
-//# sourceMappingURL=cloudflare-CD8vwrgj.mjs.map

package/dist/cloudflare-CD8vwrgj.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-CD8vwrgj.mjs","names":[],"sources":["../src/onboarding/cloudflare.ts"],"sourcesContent":["/**\n * Cloudflare DNS — the one thing this command writes.\n *\n * Scoped to exactly what onboarding needs and nothing more: find a zone by name,\n * read the apex TXT records, and *create* the verification TXT when it is missing.\n * There is deliberately no update and no delete — the command's contract is that it\n * never removes a DNS record, so the destructive verbs are simply absent rather\n * than guarded.\n *\n * The token is a `Zone:DNS:Edit` credential from the environment\n * (`CLOUDFLARE_API_TOKEN`); listing a zone by name also needs `Zone:Read`, which\n * Cloudflare's standard \"Edit zone DNS\" token template already bundles. As with the\n * indexing executors, `fetchImpl` is injected so the request shape is testable\n * without the network, and every call returns a structured result rather than\n * throwing — the caller decides what a failure means per domain.\n */\nconst API = 'https://api.cloudflare.com/client/v4';\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  errors?: { code: number; message: string }[];\n  result?: T;\n}\n\nconst cfError = (status: number, body: CfEnvelope<unknown>): string => {\n  const first = body.errors?.[0];\n  return first ? `${first.code} ${first.message}` : `HTTP ${status}`;\n};\n\n/** Find the zone id for a domain (`GET /zones?name=`). */\nexport async function findZoneId(\n  token: string,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; zoneId?: string; message?: string }> {\n  const res = await fetchImpl(`${API}/zones?name=${encodeURIComponent(domain)}`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  const body = (await res.json()) as CfEnvelope<{ id: string; name: string }[]>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, message: cfError(res.status, body) };\n  const zone = body.result?.[0];\n  if (!zone)\n    return {\n      ok: false,\n      status: res.status,\n      // Name the scope: this lookup is a GET /zones?name=, which needs\n      // `Zone:Read` — a token carrying only `Zone:DNS:Edit` reaches here and\n      // reads as \"the zone isn't in this account\", which sends you to the\n      // wrong dashboard.\n      message: `no Cloudflare zone named \"${domain}\" (is it in this account, and does the token carry Zone:Read as well as Zone:DNS:Edit? The \"Edit zone DNS\" template covers both.)`,\n    };\n  return { ok: true, status: res.status, zoneId: zone.id };\n}\n\n/** List the apex TXT record contents for a zone. */\nexport async function listApexTxt(\n  token: string,\n  zoneId: string,\n  domain: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; contents: string[]; message?: string }> {\n  const res = await fetchImpl(\n    `${API}/zones/${zoneId}/dns_records?type=TXT&name=${encodeURIComponent(domain)}`,\n    { headers: { authorization: `Bearer ${token}` } },\n  );\n  const body = (await res.json()) as CfEnvelope<{ content: string }[]>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, contents: [], message: cfError(res.status, body) };\n  // Cloudflare returns TXT content quoted; normalise so an exact compare works.\n  const contents = (body.result ?? []).map((r) => r.content.replace(/^\"|\"$/g, ''));\n  return { ok: true, status: res.status, contents };\n}\n\n/**\n * Create an apex TXT record. **Create only** — never called when one already\n * exists (the planner decides that), and there is no sibling that edits or removes.\n */\nexport async function createApexTxt(\n  token: string,\n  zoneId: string,\n  domain: string,\n  content: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<{ ok: boolean; status: number; message?: string }> {\n  const res = await fetchImpl(`${API}/zones/${zoneId}/dns_records`, {\n    method: 'POST',\n    headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },\n    body: JSON.stringify({ type: 'TXT', name: domain, content }),\n  });\n  const body = (await res.json()) as CfEnvelope<{ id: string }>;\n  if (!res.ok || !body.success)\n    return { ok: false, status: res.status, message: cfError(res.status, body) };\n  return { ok: true, status: res.status };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgBA,MAAM,MAAM;AAQZ,MAAM,WAAW,QAAgB,SAAsC;CACrE,MAAM,QAAQ,KAAK,SAAS;CAC5B,OAAO,QAAQ,GAAG,MAAM,KAAK,GAAG,MAAM,YAAY,QAAQ;AAC5D;;AAGA,eAAsB,WACpB,OACA,QACA,YAA0B,OACmD;CAC7E,MAAM,MAAM,MAAM,UAAU,GAAG,IAAI,cAAc,mBAAmB,MAAM,KAAK,EAC7E,SAAS,EAAE,eAAe,UAAU,QAAQ,EAC9C,CAAC;CACD,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAC7E,MAAM,OAAO,KAAK,SAAS;CAC3B,IAAI,CAAC,MACH,OAAO;EACL,IAAI;EACJ,QAAQ,IAAI;EAKZ,SAAS,6BAA6B,OAAO;CAC/C;CACF,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ,QAAQ,KAAK;CAAG;AACzD;;AAGA,eAAsB,YACpB,OACA,QACA,QACA,YAA0B,OACsD;CAChF,MAAM,MAAM,MAAM,UAChB,GAAG,IAAI,SAAS,OAAO,6BAA6B,mBAAmB,MAAM,KAC7E,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CAClD;CACA,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,UAAU,CAAC;EAAG,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAE3F,MAAM,YAAY,KAAK,UAAU,CAAC,EAAC,CAAE,KAAK,MAAM,EAAE,QAAQ,QAAQ,UAAU,EAAE,CAAC;CAC/E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;EAAQ;CAAS;AAClD;;;;;AAMA,eAAsB,cACpB,OACA,QACA,QACA,SACA,YAA0B,OACkC;CAC5D,MAAM,MAAM,MAAM,UAAU,GAAG,IAAI,SAAS,OAAO,eAAe;EAChE,QAAQ;EACR,SAAS;GAAE,eAAe,UAAU;GAAS,gBAAgB;EAAmB;EAChF,MAAM,KAAK,UAAU;GAAE,MAAM;GAAO,MAAM;GAAQ;EAAQ,CAAC;CAC7D,CAAC;CACD,MAAM,OAAQ,MAAM,IAAI,KAAK;CAC7B,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,SACnB,OAAO;EAAE,IAAI;EAAO,QAAQ,IAAI;EAAQ,SAAS,QAAQ,IAAI,QAAQ,IAAI;CAAE;CAC7E,OAAO;EAAE,IAAI;EAAM,QAAQ,IAAI;CAAO;AACxC"}

package/dist/plan-Hq8Pb0Uw.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plan-Hq8Pb0Uw.d.mts","names":[],"sources":["../src/onboarding/types.ts","../src/onboarding/plan.ts"],"mappings":";;;;;;;;;;;;;;;UAeiB;;EAEf;;;;;EAKA;;;;;EAKA;;;UAIe;;EAEf,SAAS;;;;;;;;;UAiBM;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;KC3CU;UAEK;EACf,QAAQ;;EAER;;;UAIe;EACf;;EAEA;;EAEA,KAAK;;EAEL,QAAQ;;EAER,UAAU;;EAEV,QAAQ;;EAER;;EAEA;;UAGe;EACf,SAAS;;EAET;;;cAIW,aAAc;;;;;;;;;;iBAWX,gBAAgB;;iBAOhB,WAAW,OAAO,aAAa,OAAO,cAAc;;;;;;;;;;;;;;;iBA4DpD,WAAW,mBAAmB;;iBAa9B,KAAK,QAAQ,kBAAkB,QAAQ,YAAY,eAAe;;iBAiBlE,SAAS,GAAG;;iBAWZ,WAAW,GAAG;;UAgBb;EACf;EACA;EACA;EACA;EACA;;;iBAIc,cAAc,SAAS"}

package/dist/token-DkKC5m23.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-DkKC5m23.mjs","names":[],"sources":["../src/google/token.ts"],"sourcesContent":["/**\n * Google OAuth2 token exchange — one request, two grants.\n *\n * Both of this package's Google modules need a bearer token, and both used to\n * mint one themselves. The two copies looked different because the *credentials*\n * differ, but everything after building the form body was identical: same\n * endpoint, same content-type, same \"surface the response body as the error\"\n * rule, same `access_token` extraction. So the seam is precise —\n * **credential → form params differs, params → token does not.**\n *\n * The two grants are kept because they are not accidental duplication; they track\n * how each command is actually run:\n *\n *   - **service account** (RS256 JWT bearer) for `search notify`, which runs on\n *     every deploy in CI. It never expires. A refresh token can be revoked, and\n *     for an OAuth client still in *Testing* publishing status Google expires it\n *     after 7 days — a bad property for a deploy step.\n *   - **user OAuth** (refresh-token grant) for `search setup`, which is a\n *     one-time human operation. Site verification makes the calling identity an\n *     *owner* of the property, and that should be a person, not a project robot.\n *\n * `googleapis` is deliberately not a dependency — this is one REST endpoint in a\n * CLI that installs into every consumer project. See AGENTS.md.\n *\n * Internal: not a published subpath. Both `./indexing` and `./onboarding` import\n * it, so it lands in a shared chunk, which is free for a Node library. (The\n * \"don't create a shared chunk\" rule in AGENTS.md is about browser bundles and\n * the consent gate.)\n */\nimport { createSign } from 'node:crypto';\n\nconst TOKEN_URL = 'https://oauth2.googleapis.com/token';\n\n/** The fields we need from a service-account JSON key. */\nexport interface ServiceAccount {\n  client_email: string;\n  private_key: string;\n}\n\n/** A user OAuth credential (refresh-token flow — never a service account). */\nexport interface GoogleOAuth {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\n/**\n * Which identity to act as.\n *\n * `scope` rides on the service-account variant because that grant carries its\n * scope in the signed assertion. A user OAuth token's scopes are fixed when the\n * refresh token is minted, so there is nothing to pass at exchange time — the\n * asymmetry is the protocol's, not ours.\n */\nexport type GoogleCredential =\n  | { kind: 'service-account'; account: ServiceAccount; scope: string }\n  | { kind: 'oauth'; oauth: GoogleOAuth };\n\nconst b64url = (input: Buffer | string): string =>\n  Buffer.from(input).toString('base64').replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n\n/** Sign the RS256 JWT assertion a service-account grant carries. */\nfunction assertionFor(account: ServiceAccount, scope: string, now: number): string {\n  const iat = Math.floor(now / 1000);\n  const header = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));\n  const claims = b64url(\n    JSON.stringify({ iss: account.client_email, scope, aud: TOKEN_URL, iat, exp: iat + 3600 }),\n  );\n  const signer = createSign('RSA-SHA256');\n  signer.update(`${header}.${claims}`);\n  // `\\n` survives most secret stores as a literal; normalise so a pasted key works.\n  const pem = account.private_key.replace(/\\\\n/g, '\\n');\n  return `${header}.${claims}.${b64url(signer.sign(pem))}`;\n}\n\n/** The half that never differs: POST the grant, surface the cause, return the token. */\nasync function requestToken(body: URLSearchParams, fetchImpl: typeof fetch): Promise<string> {\n  const res = await fetchImpl(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n  if (!res.ok) {\n    // The body names the cause — clock skew, wrong audience or a revoked key for a\n    // service account; `invalid_grant` / `invalid_client` for OAuth — and carries\n    // no secret of ours: the assertion travels in the request, not the response.\n    throw new Error(`token exchange failed (${res.status}): ${await res.text()}`);\n  }\n  const { access_token } = (await res.json()) as { access_token?: string };\n  if (!access_token) throw new Error('token exchange returned no access_token');\n  return access_token;\n}\n\n/**\n * Exchange either credential for a short-lived access token.\n *\n * Throws rather than returning a result: nothing downstream can run without a\n * token, so there is no per-item decision for a caller to make. (The API calls\n * themselves do return structured results — those fail per domain.)\n *\n * `now` is a parameter so the assertion is testable without mocking the clock.\n */\nexport function googleAccessToken(\n  credential: GoogleCredential,\n  fetchImpl: typeof fetch = fetch,\n  now: number = Date.now(),\n): Promise<string> {\n  const body =\n    credential.kind === 'oauth'\n      ? new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: credential.oauth.clientId,\n          client_secret: credential.oauth.clientSecret,\n          refresh_token: credential.oauth.refreshToken,\n        })\n      : new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: assertionFor(credential.account, credential.scope, now),\n        });\n  return requestToken(body, fetchImpl);\n}\n\n/**\n * A bearer token, plus the project its usage is attributed to.\n *\n * `quotaProject` becomes the `x-goog-user-project` header, and it is **required**\n * for a user credential — an ADC login or a `VITOPS_GOOGLE_*` refresh token\n * authenticates through a shared OAuth client that carries no project, so Google\n * refuses the call with a 403 naming the missing quota project rather than\n * guessing one. A service account already belongs to a project, so it needs none.\n *\n * It is deliberately per-call rather than baked into the token: one agency\n * identity administers many sites, each with its own project, so the identity is\n * shared and the attribution is not.\n */\nexport interface GoogleAuth {\n  token: string;\n  quotaProject?: string;\n}\n\n/**\n * A bare token still works everywhere an auth does.\n *\n * The token-only form is what every caller passed before per-site projects\n * existed, and a service-account caller never needs more, so widening the\n * parameter beats a breaking signature change across seven exported functions.\n */\nexport type GoogleAuthLike = string | GoogleAuth;\n\n/** Auth headers for a Google REST call, with the quota project when there is one. */\nexport function googleHeaders(\n  auth: GoogleAuthLike,\n  extra?: Record<string, string>,\n): Record<string, string> {\n  const { token, quotaProject } = typeof auth === 'string' ? { token: auth } : auth;\n  return {\n    authorization: `Bearer ${token}`,\n    ...(quotaProject ? { 'x-goog-user-project': quotaProject } : {}),\n    ...extra,\n  };\n}\n\n/** Percent-encode a Search Console `siteUrl` (e.g. `sc-domain:acme.ca`) for a path segment. */\nexport const encodeSite = (siteUrl: string): string => encodeURIComponent(siteUrl);\n\n/**\n * Render a failed response's detail: a caller-supplied hint on a specific status\n * (e.g. what a `403` almost always means for this endpoint), or the raw body\n * otherwise. Shared by every REST call here that follows the \"PUT and report\n * why\" shape — `gsc.ts`'s `submitSitemap`, `onboarding/google.ts`'s `addSite`.\n */\nexport async function errorDetail(\n  res: Response,\n  hint?: (status: number) => string | undefined,\n): Promise<string> {\n  const named = hint?.(res.status);\n  return named ?? `${res.status}: ${await res.text()}`;\n}\n\n/** Scopes, named once so a caller never spells one out. */\nexport const SCOPES = {\n  /** Search Console (`sitemaps.submit`, `urlInspection`, `sites`). */\n  webmasters: 'https://www.googleapis.com/auth/webmasters',\n  /** Site Verification API. */\n  siteVerification: 'https://www.googleapis.com/auth/siteverification',\n  /** Business Profile (reviews). The GCP project must be allowlisted by Google. */\n  businessProfile: 'https://www.googleapis.com/auth/business.manage',\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,YAAY;AA2BlB,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;;AAGjG,SAAS,aAAa,SAAyB,OAAe,KAAqB;CACjF,MAAM,MAAM,KAAK,MAAM,MAAM,GAAI;CACjC,MAAM,SAAS,OAAO,KAAK,UAAU;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC;CAClE,MAAM,SAAS,OACb,KAAK,UAAU;EAAE,KAAK,QAAQ;EAAc;EAAO,KAAK;EAAW;EAAK,KAAK,MAAM;CAAK,CAAC,CAC3F;CACA,MAAM,SAAS,WAAW,YAAY;CACtC,OAAO,OAAO,GAAG,OAAO,GAAG,QAAQ;CAEnC,MAAM,MAAM,QAAQ,YAAY,QAAQ,QAAQ,IAAI;CACpD,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,OAAO,KAAK,GAAG,CAAC;AACvD;;AAGA,eAAe,aAAa,MAAuB,WAA0C;CAC3F,MAAM,MAAM,MAAM,UAAU,WAAW;EACrC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,KAAK,SAAS;CACtB,CAAC;CACD,IAAI,CAAC,IAAI,IAIP,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;CAE9E,MAAM,EAAE,iBAAkB,MAAM,IAAI,KAAK;CACzC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;CAC5E,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,kBACd,YACA,YAA0B,OAC1B,MAAc,KAAK,IAAI,GACN;CAajB,OAAO,aAXL,WAAW,SAAS,UAChB,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,WAAW,MAAM;EAC5B,eAAe,WAAW,MAAM;EAChC,eAAe,WAAW,MAAM;CAClC,CAAC,IACD,IAAI,gBAAgB;EAClB,YAAY;EACZ,WAAW,aAAa,WAAW,SAAS,WAAW,OAAO,GAAG;CACnE,CAAC,GACmB,SAAS;AACrC;;AA8BA,SAAgB,cACd,MACA,OACwB;CACxB,MAAM,EAAE,OAAO,iBAAiB,OAAO,SAAS,WAAW,EAAE,OAAO,KAAK,IAAI;CAC7E,OAAO;EACL,eAAe,UAAU;EACzB,GAAI,eAAe,EAAE,uBAAuB,aAAa,IAAI,CAAC;EAC9D,GAAG;CACL;AACF;;AAGA,MAAa,cAAc,YAA4B,mBAAmB,OAAO;;;;;;;AAQjF,eAAsB,YACpB,KACA,MACiB;CAEjB,OADc,OAAO,IAAI,MAAM,KACf,GAAG,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK;AACnD;;AAGA,MAAa,SAAS;;CAEpB,YAAY;;CAEZ,kBAAkB;;CAElB,iBAAiB;AACnB"}

package/dist/token-DmmoQ7um.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-DmmoQ7um.d.mts","names":[],"sources":["../src/google/token.ts"],"mappings":";;UAkCiB;EACf;EACA;;;UAIe;EACf;EACA;EACA;;;;;;;;;;KAWU;EACN;EAAyB,SAAS;EAAgB;;EAClD;EAAe,OAAO;;;;;;;;;;;iBA8CZ,kBACd,YAAY,kBACZ,mBAAkB,OAClB,eACC;;;;;;;;;;;;;;UA6Bc;EACf;EACA;;;;;;;;;KAUU,0BAA0B;;iBAGtB,cACd,MAAM,gBACN,QAAQ,yBACP;;cA2BU"}

package/dist/types-7ELci8RQ.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-7ELci8RQ.d.mts","names":[],"sources":["../src/tracking/types.ts"],"mappings":";;;;;;;;;;KAiBY;UAEK;EACf;;;;;;;EAOA,WAAW;EACX;;;;;;;;;;UAWe;GACd;;EAED;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;;UAee;EACf;;EAEA,WAAW;EACX;;EAEA;;EAEA,UAAU;EACV;EACA;;EAEA"}