@getvitops/utils 8.2.0-alpha.0 → 8.3.0-alpha.0

package/dist/ads/index.d.mts

@@ -1,27 +1,15 @@
-import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-BiK61Oq4.mjs";
-//#region src/ads/types.d.ts
-/**
- * The ads module's own option surface.
- *
- * Deliberately structural rather than `Config['site']['ads']` imported from
- * `@getvitops/generator`: the generator already depends on this package, so
- * importing back would be a cycle. The vocabulary mirrors that block field for
- * field, so the CLI's adapter is a flat map — the same arrangement, and for the
- * same reason, as `IndexingConfig` and `DomainSetup` beside it.
- *
- * Optional fields are written `?: T | undefined` throughout: `exactOptionalPropertyTypes`
- * is on, and these describe a *parsed JSON config* where an absent key and an explicit
- * `undefined` are the same thing.
- */
+import { AdPropertyConfig } from "@getvitops/config";
+import { AdProvider as AdProvider$1 } from "@getvitops/config/providers";
 /**
  * The ad platforms this toolchain knows how to link a site to.
  *
- * A closed set, mirroring `AD_PROVIDERS` in the generator's `config.ts` — the
- * capability table in `providers.ts` has one entry per member, and a test in the
- * generator asserts the two lists agree. An open string would mean a typo'd
- * provider silently getting no verification step and no tag.
+ * A closed set, and `AD_PROVIDERS` in `@getvitops/config` is its single source: the capability
+ * table in `providers.ts` is a `Record<AdProvider, …>`, so a provider added there without an entry
+ * here is a compile error. (This was a hand-copied union held to the schema's enum by a test in the
+ * generator; the schema now lives below this package, so the copy and the test are gone.) An open
+ * string would mean a typo'd provider silently getting no verification step and no tag.
  */
-type AdProvider = 'google' | 'meta' | 'linkedin' | 'reddit' | 'tiktok' | 'microsoft' | 'pinterest' | 'snapchat';
+type AdProvider = AdProvider$1;
 /** Which consent category gates a provider's tag. */
 type AdConsentCategory = 'marketing' | 'analytics';
 /**
@@ -52,38 +40,35 @@ interface ConversionLabelMap {
  * action that existed before this was a map. Absent input normalises to `{}`.
  */
 export declare function normalizeConversionLabels(label: string | ConversionLabelMap | undefined): ConversionLabelMap;
-/** One ad property to link, as the config declares it. */
-interface AdPropertySetup {
-  provider: AdProvider;
-  /**
-   * The account as the platform shows it — Google Ads customer id, Meta ad
-   * account, LinkedIn partner id, Reddit advertiser id.
-   */
-  accountId?: string | undefined;
-  /** The tag/pixel id, when the platform issues one distinct from the account. */
-  pixelId?: string | undefined;
-  /**
-   * Google Ads only: the conversion label(s) paired with the conversion id —
-   * either one bare label (back-compat, treated as the `call` action) or a map
-   * of action → label, so a call, an email click and a form submission each
-   * fire their own Google Ads conversion action instead of sharing one. See
-   * `gtagBootstrap`/`normalizeConversionLabels` below.
-   */
-  conversionLabel?: string | ConversionLabelMap | undefined;
-  /** The host to verify, bare (`acme.ca`). The CLI defaults it from the canonical domain. */
-  domain?: string | undefined;
-  /**
-   * The verification token from the platform UI.
-   *
-   * A bare token gets the provider's TXT prefix applied; a value already
-   * containing `=` is used as the whole record content, which is the escape hatch
-   * for a platform changing its prefix without waiting on a toolchain release.
-   */
-  domainVerification?: string | undefined;
-  /** Category the tag waits on. Defaults to `marketing`. */
-  category?: AdConsentCategory | undefined;
-  enabled?: boolean | undefined;
+/**
+ * One Google Ads conversion action **resource id** per action this site
+ * uploads server-side — a numeric id (`"123456789"`) or a full resource name
+ * (`"customers/123/conversionActions/456"`), never the `conversionLabel`
+ * string. Written out field by field for the same `exactOptionalPropertyTypes`
+ * reason as `ConversionLabelMap` above.
+ *
+ * **This is a genuinely different identifier from `conversionLabel`, not an
+ * alternate spelling of it.** `conversionLabel` is the opaque label the web
+ * tag embeds in `send_to: "AW-…/label"` — it identifies the conversion action
+ * to `gtag.js`, not to the Ads API. The API's click-conversion upload
+ * (`ConversionUploadService.UploadClickConversions`) addresses the action by
+ * `conversion_action` **resource name**, a value the label cannot be turned
+ * into locally — Google returns both when a conversion action is created, but
+ * only the label ships to the browser today. Until something in this
+ * toolchain calls `ConversionActionService` to create/list actions and print
+ * both back, this field has to be copied in by hand from the Ads UI/API.
+ */
+interface ConversionActionIdMap {
+  call?: string | undefined;
+  email?: string | undefined;
+  form?: string | undefined;
 }
+/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */
+export declare function normalizeConversionActionIds(id: string | ConversionActionIdMap | undefined): ConversionActionIdMap;
+/** One ad property to link: the config block, plus the platform it is keyed by. */
+type AdPropertySetup = AdPropertyConfig & {
+  provider: AdProvider;
+};
 /** Everything `plan()` needs, once the CLI has read the config. */
 interface AdsConfig {
   /** The properties to link. Already filtered to `--provider` if that was passed. */
@@ -103,8 +88,6 @@ interface AdDomainState {
   /** Every apex TXT record content, unquoted. */
   txtContents: string[];
 }
-//#endregion
-//#region src/ads/plan.d.ts
 /** A step's decision. `blocked` means the config is missing something. */
 type StepAction = 'create' | 'skip' | 'blocked';
 /** A config field the operator can supply to unblock a step. */
@@ -168,8 +151,6 @@ interface AdPropertyResult {
 }
 /** Render the end-of-run summary: one row per property, plus any reminders. */
 export declare function formatSummary(results: AdPropertyResult[]): string;
-//#endregion
-//#region src/ads/providers.d.ts
 /** How a platform proves you own the domain. */
 interface AdVerificationSpec {
   method: 'dns-txt' | 'none';
@@ -255,6 +236,5 @@ export declare const categoryOf: (entry: AdPropertySetup) => AdConsentCategory;
  * than emit a snippet that initialises `undefined`.
  */
 export declare function renderTag(entry: AdPropertySetup, strategy?: 'idle' | 'async' | 'interaction'): string | null;
-//#endregion
-export { type AdConsentCategory, type AdDomainState, type AdPlatform, type AdPropertyPlan, type AdPropertyResult, type AdPropertySetup, type AdProvider, type AdTagSpec, type AdVerificationSpec, type AdsConfig, type AdsPlan, type ConversionAction, type ConversionLabelMap, type MissingField, type StepAction, type StepPlan, createApexTxt, findZoneId, listApexTxt };
+export type { AdConsentCategory, AdDomainState, AdPlatform, AdPropertyPlan, AdPropertyResult, AdPropertySetup, AdProvider, AdTagSpec, AdVerificationSpec, AdsConfig, AdsPlan, ConversionAction, ConversionActionIdMap, ConversionLabelMap, MissingField, StepAction, StepPlan };
 //# sourceMappingURL=index.d.mts.map

package/dist/ads/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/ads/types.ts","../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;KAsBY;;KAWA;;;;;;;KAQA;;;;;;;;;;;;UAaK;EACf;EACA;EACA;;;;;;wBAOc,0BACd,gBAAgB,iCACf;;UAMc;EACf,UAAU;;;;;EAKV;;EAEA;;;;;;;;EAQA,2BAA2B;;EAE3B;;;;;;;;EAQA;;EAEA,WAAW;EACX;;;UAIe;;EAEf,YAAY;;;;;;;;;;;UAYG;EACf;;EAEA;;;;;KCjGU;;KAGA;UAEK;EACf,QAAQ;;EAER;;EAEA,QAAQ;;;UAIO;EACf,UAAU;;EAEV;;EAEA;;EAEA,KAAK;;EAEL,KAAK;;EAEL;;EAEA;;UAGe;EACf,YAAY;;EAEZ;;;;;;;;;;;wBAYc,aAAa,OAAO,iBAAiB,OAAO,gBAAgB;;wBAoD5D,KAAK,QAAQ,WAAW,QAAQ,YAAY,iBAAiB;;wBAe7D,SAAS,GAAG;;wBAKZ,cAAc,GAAG;EAAY;EAAkB,OAAO;;;wBAYtD,WAAW,GAAG;;UAcb;EACf;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,SAAS;;;;UC7ItB;EACf;;;;;;;EAOA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,OAAO;;EAEP,YAAY,YAAY,OAAO;;;;;EAK/B;;EAEA;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA;;EAEA;;EAEA;EACA,cAAc;EACd,KAAK;;EAEL,cAAc,OAAO;;qBA0CV,cAAc,OAAO,YAAY;;qBAuMjC,kBAAgD;;qBAGhD,eAAgB,kBAAgB,SAAS;;;;;;;;;;wBAWtC,UAAU,UAAU,YAAY;;wBAOhC,MAAM,OAAO;;qBAMhB,aAAc,OAAO,oBAAkB;;;;;;;;;;;;wBAiBpC,UACd,OAAO,iBACP"}
+{"version":3,"file":"index.d.mts","names":["AdProviderConfig"],"sources":["../../src/ads/types.ts","../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;;;;;;;;;;KAmBY,aAAaA;;KAGb;;;;;;;KAQA;;;;;;;;;;;;UAaK;EACf;EACA;EACA;;;;;;wBAOc,0BACd,gBAAgB,iCACf;;;;;;;;;;;;;;;;;;;UAuBc;EACf;EACA;EACA;;;wBAIc,6BACd,aAAa,oCACZ;;KAMS,kBAAkB;EAC5B,UAAU;;;UAIK;;EAEf,YAAY;;;;;;;;;;;UAYG;EACf;;EAEA;;;KC1FU;;KAGA;UAEK;EACf,QAAQ;;EAER;;EAEA,QAAQ;;;UAIO;EACf,UAAU;;EAEV;;EAEA;;EAEA,KAAK;;EAEL,KAAK;;EAEL;;EAEA;;UAGe;EACf,YAAY;;EAEZ;;;;;;;;;;;wBAYc,aAAa,OAAO,iBAAiB,OAAO,gBAAgB;;wBAoD5D,KAAK,QAAQ,WAAW,QAAQ,YAAY,iBAAiB;;wBAe7D,SAAS,GAAG;;wBAKZ,cAAc,GAAG;EAAY;EAAkB,OAAO;;;wBAYtD,WAAW,GAAG;;UAcb;EACf;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,SAAS;;UC7ItB;EACf;;;;;;;EAOA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,OAAO;;EAEP,YAAY,YAAY,OAAO;;;;;EAK/B;;EAEA;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA;;EAEA;;EAEA;EACA,cAAc;EACd,KAAK;;EAEL,cAAc,OAAO;;qBAwDV,cAAc,OAAO,YAAY;;qBAuMjC,kBAAgD;;qBAGhD,eAAgB,kBAAgB,SAAS;;;;;;;;;;wBAWtC,UAAU,UAAU,YAAY;;wBAOhC,MAAM,OAAO;;qBAMhB,aAAc,OAAO,oBAAkB;;;;;;;;;;;;wBAiBpC,UACd,OAAO,iBACP"}

package/dist/ads/index.mjs

@@ -1,7 +1,6 @@
-import { t as table } from "../plan-format-A18SvJ7C.mjs";
-import { n as findZoneId, r as listApexTxt, t as createApexTxt } from "../cloudflare-CD8vwrgj.mjs";
+import { t as table } from "../plan-format-CIz6Feg2.mjs";
 
-//#region src/ads/types.ts
+// src/ads/types.ts
 /**
 * A bare string is back-compat shorthand for `{ call: label }` — the only
 * action that existed before this was a map. Absent input normalises to `{}`.
@@ -10,9 +9,13 @@ function normalizeConversionLabels(label) {
 	if (label == null) return {};
 	return typeof label === "string" ? { call: label } : label;
 }
+/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */
+function normalizeConversionActionIds(id) {
+	if (id == null) return {};
+	return typeof id === "string" ? { call: id } : id;
+}
 
-//#endregion
-//#region src/ads/providers.ts
+// src/ads/providers.ts
 /**
 * What each ad platform actually lets a build tool do — the table every `vitops ads`
 * subcommand reads.
@@ -63,10 +66,20 @@ function normalizeConversionLabels(label) {
 * `entry` is trusted here — `resolveAds()` validates every configured label
 * against `SAFE_ID` before it reaches this function, the same guard `id`
 * already gets.
+*
+* **`entry.reporting === 'server'` suppresses an action here, never
+* silently.** An action fires client-side unless reporting is `'server'`
+* *and* that same action has a `conversionActionId` configured — so turning
+* reporting to `'server'` before the id is filled in leaves the action firing
+* client-side rather than dropping the conversion. Once both are set, the
+* server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,
+* wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one
+* place that action reports from — this is what avoids double-counting.
 */
 const gtagBootstrap = (id, entry) => {
 	const labels = normalizeConversionLabels(entry.conversionLabel);
-	const actions = Object.entries(labels).filter((pair) => !!pair[1]);
+	const actionIds = normalizeConversionActionIds(entry.conversionActionId);
+	const actions = Object.entries(labels).filter((pair) => !!pair[1] && !(entry.reporting === "server" && !!actionIds[pair[0]]));
 	return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('js',new Date());gtag('config','${id}');` + (actions.length ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};window.vitopsAdsConversions.google=${JSON.stringify(Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])))};` : "");
 };
 /** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */
@@ -301,8 +314,7 @@ function renderTag(entry, strategy = "idle") {
 	return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\n<script ${attrs.join(" ")}>${platform.tag.bootstrap(id, entry)}<\/script>`;
 }
 
-//#endregion
-//#region src/ads/plan.ts
+// src/ads/plan.ts
 /**
 * Every decision `vitops ads setup` makes, as one pure function.
 *
@@ -435,6 +447,5 @@ function formatSummary(results) {
 	return table(headers, rows, reminders);
 }
 
-//#endregion
-export { AD_PLATFORMS, AD_PROVIDER_KEYS, categoryOf, createApexTxt, findZoneId, formatPlan, formatSummary, hasDrift, isAdProvider, listApexTxt, missingFields, normalizeConversionLabels, plan, planProperty, renderTag, tagId, txtRecord };
+export { AD_PLATFORMS, AD_PROVIDER_KEYS, categoryOf, formatPlan, formatSummary, hasDrift, isAdProvider, missingFields, normalizeConversionActionIds, normalizeConversionLabels, plan, planProperty, renderTag, tagId, txtRecord };
 //# sourceMappingURL=index.mjs.map

package/dist/ads/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/ads/types.ts","../../src/ads/providers.ts","../../src/ads/plan.ts"],"sourcesContent":["/**\n * The ads module's own option surface.\n *\n * Deliberately structural rather than `Config['site']['ads']` imported from\n * `@getvitops/generator`: the generator already depends on this package, so\n * importing back would be a cycle. The vocabulary mirrors that block field for\n * field, so the CLI's adapter is a flat map — the same arrangement, and for the\n * same reason, as `IndexingConfig` and `DomainSetup` beside it.\n *\n * Optional fields are written `?: T | undefined` throughout: `exactOptionalPropertyTypes`\n * is on, and these describe a *parsed JSON config* where an absent key and an explicit\n * `undefined` are the same thing.\n */\n\n/**\n * The ad platforms this toolchain knows how to link a site to.\n *\n * A closed set, mirroring `AD_PROVIDERS` in the generator's `config.ts` — the\n * capability table in `providers.ts` has one entry per member, and a test in the\n * generator asserts the two lists agree. An open string would mean a typo'd\n * provider silently getting no verification step and no tag.\n */\nexport type AdProvider =\n  | 'google'\n  | 'meta'\n  | 'linkedin'\n  | 'reddit'\n  | 'tiktok'\n  | 'microsoft'\n  | 'pinterest'\n  | 'snapchat';\n\n/** Which consent category gates a provider's tag. */\nexport type AdConsentCategory = 'marketing' | 'analytics';\n\n/**\n * The three interactions Google Ads can report a distinct conversion action\n * for. `form` is fired client-side via `vitopsFormConversion()`\n * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:\n * click handler.\n */\nexport type ConversionAction = 'call' | 'email' | 'form';\n\n/**\n * One label per action this site wants Google Ads to tell apart.\n *\n * Written out field by field, `?: string | undefined` — not\n * `Partial<Record<ConversionAction, string>>` — matching this file's own\n * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`\n * (present-or-absent) and `{ email?: string | undefined }` (present,\n * absent, or explicitly `undefined`) as different types, and a parsed JSON\n * config's optional field is the latter. `Partial<Record<...>>` produces the\n * former, which rejected the zod-inferred shape config.ts actually produces.\n */\nexport interface ConversionLabelMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/**\n * A bare string is back-compat shorthand for `{ call: label }` — the only\n * action that existed before this was a map. Absent input normalises to `{}`.\n */\nexport function normalizeConversionLabels(\n  label: string | ConversionLabelMap | undefined,\n): ConversionLabelMap {\n  if (label == null) return {};\n  return typeof label === 'string' ? { call: label } : label;\n}\n\n/** One ad property to link, as the config declares it. */\nexport interface AdPropertySetup {\n  provider: AdProvider;\n  /**\n   * The account as the platform shows it — Google Ads customer id, Meta ad\n   * account, LinkedIn partner id, Reddit advertiser id.\n   */\n  accountId?: string | undefined;\n  /** The tag/pixel id, when the platform issues one distinct from the account. */\n  pixelId?: string | undefined;\n  /**\n   * Google Ads only: the conversion label(s) paired with the conversion id —\n   * either one bare label (back-compat, treated as the `call` action) or a map\n   * of action → label, so a call, an email click and a form submission each\n   * fire their own Google Ads conversion action instead of sharing one. See\n   * `gtagBootstrap`/`normalizeConversionLabels` below.\n   */\n  conversionLabel?: string | ConversionLabelMap | undefined;\n  /** The host to verify, bare (`acme.ca`). The CLI defaults it from the canonical domain. */\n  domain?: string | undefined;\n  /**\n   * The verification token from the platform UI.\n   *\n   * A bare token gets the provider's TXT prefix applied; a value already\n   * containing `=` is used as the whole record content, which is the escape hatch\n   * for a platform changing its prefix without waiting on a toolchain release.\n   */\n  domainVerification?: string | undefined;\n  /** Category the tag waits on. Defaults to `marketing`. */\n  category?: AdConsentCategory | undefined;\n  enabled?: boolean | undefined;\n}\n\n/** Everything `plan()` needs, once the CLI has read the config. */\nexport interface AdsConfig {\n  /** The properties to link. Already filtered to `--provider` if that was passed. */\n  properties: AdPropertySetup[];\n}\n\n/**\n * One property's observed live state, gathered by the executor before planning.\n *\n * Same shape of arrangement as `DomainState`: the decision is pure, the\n * observation is not. `txtContents` is every apex TXT record on the domain, so\n * the planner can decide both \"our record is present\" and \"a *different* record\n * from this provider is present\" — the second is a token rotation, which needs\n * saying rather than silently adding a second record.\n */\nexport interface AdDomainState {\n  zoneId?: string | undefined;\n  /** Every apex TXT record content, unquoted. */\n  txtContents: string[];\n}\n","/**\n * What each ad platform actually lets a build tool do — the table every `vitops ads`\n * subcommand reads.\n *\n * Written the way the indexing module was written: start from what the platforms\n * accept, because it is much narrower than it looks, and record the *absence* of a\n * path as a fact rather than leaving it as a gap.\n *\n *  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,\n *    Snapchat). That record is the one thing here that can be created for you.\n *  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,\n *    Microsoft Ads). Linking is the tag and the account id, nothing else. Those\n *    resolve to a skip *plus* a named reason — a silent omission would read as\n *    \"already done\".\n *  - **No platform Marketing API is called.** Meta's Business Management\n *    `verify_domain` needs a system-user token; the Google Ads API needs an\n *    approved developer token and puts the consumer's own account on the line.\n *    That is the same reasoning that keeps the Google Indexing API unwired: a\n *    toolchain other people install must not ship a documented path to a terms\n *    violation. The final \"Verify\" click stays a reminder.\n *\n * The verification token is **not a secret** — it is published in DNS, and the\n * platform fetching it back is the ownership proof, exactly like the IndexNow key.\n * So it lives in the config while credentials stay in the environment.\n *\n * Each tag is the platform's documented bootstrap reduced to its queue stub, with\n * the remote library on `data-src` for the consent gate to attach after the\n * bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body\n * first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a\n * snippet that creates its own `<script>`; those declare no `src`, and their body\n * stays inert until activation, so an undecided visitor still issues no request.\n */\nimport { normalizeConversionLabels } from './types.ts';\nimport type { AdConsentCategory, AdProvider, AdPropertySetup } from './types.ts';\n\n/** How a platform proves you own the domain. */\nexport interface AdVerificationSpec {\n  method: 'dns-txt' | 'none';\n  /**\n   * Prefix prepended to a bare token to form the record content. Owned here so a\n   * config holds the token the platform shows, not a hand-assembled record — but\n   * see `txtRecord`: a value already containing `=` passes through whole, which is\n   * the escape hatch when a platform changes its spelling.\n   */\n  txtPrefix?: string;\n  /** Where in the platform UI the token is found. Printed when asking for it. */\n  where?: string;\n  /** Why there is nothing to automate. Required when `method` is `none`. */\n  reason?: string;\n}\n\n/** The tag, and which config field carries its id. */\nexport interface AdTagSpec {\n  /** Which field the tag id comes from — and therefore what to ask for when absent. */\n  needs: 'pixelId' | 'accountId';\n  /** The remote library. Absent when the platform's own bootstrap loads itself. */\n  src?: (id: string) => string;\n  /** The inline bootstrap, which the gate runs before attaching `src`. */\n  bootstrap: (id: string, entry: AdPropertySetup) => string;\n  /**\n   * Cookies the tag sets, for `data-consent-cookies` (what a revoke clears) and\n   * for the generated cookie notice. A `*` suffix is a prefix match.\n   */\n  cookies: string[];\n  /** The provider's own privacy policy, for the cookie notice. */\n  privacyUrl: string;\n  /** A visitor-facing opt-out, where the platform offers one. */\n  optOut?: string;\n}\n\nexport interface AdPlatform {\n  /** The platform as a reader would recognise it. */\n  name: string;\n  /**\n   * The jurisdiction that can compel this platform to produce what it receives —\n   * where the contracting entity is established. Feeds the generated privacy\n   * policy's cross-border transfer disclosure, which is a claim about foreign\n   * *access*, not foreign storage (see `Processor.operatorCountry` in the\n   * generator's `legal/providers.ts`). A consumer whose contracting entity differs\n   * declares their own processor entry instead.\n   */\n  operatorCountry: string;\n  /** Click-ID parameters this platform stamps on an ad landing URL. */\n  clickIdParams: string[];\n  /** Where the operator manages the property. */\n  consoleUrl: string;\n  verification: AdVerificationSpec;\n  tag: AdTagSpec;\n  /** Follow-ups no API covers, given this entry. */\n  manualSteps: (entry: AdPropertySetup) => string[];\n}\n\n/**\n * `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.\n *\n * `gtag('config', id)` only loads the tag — it never reports a conversion. When\n * `entry.conversionLabel` names one or more actions, this also exposes a\n * `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry\n * per configured action, so a call, an email click and a form submission each\n * carry their own `send_to` target instead of all three sharing one (that\n * sharing was a real bug: a call and an email click used to report as the same\n * Google Ads conversion action, indistinguishable in the account). Bootstrap\n * time only loads the tag; `scripts/tracking.ts`'s click handler and\n * `vitopsFormConversion()` each read their own action's key and fire\n * `gtag('event', 'conversion', …)` at the moment of the actual interaction —\n * bootstrap-time firing would count every pageview as a conversion.\n *\n * `entry` is trusted here — `resolveAds()` validates every configured label\n * against `SAFE_ID` before it reaches this function, the same guard `id`\n * already gets.\n */\nconst gtagBootstrap = (id: string, entry: AdPropertySetup): string => {\n  const labels = normalizeConversionLabels(entry.conversionLabel);\n  const actions = Object.entries(labels).filter((pair): pair is [string, string] => !!pair[1]);\n  return (\n    `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}` +\n    `gtag('js',new Date());gtag('config','${id}');` +\n    (actions.length\n      ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};` +\n        `window.vitopsAdsConversions.google=${JSON.stringify(\n          Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])),\n        )};`\n      : '')\n  );\n};\n\n/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */\nconst queueStub = (global: string, methods: string): string =>\n  `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};` +\n  `window.${global}.methods=${methods};`;\n\nexport const AD_PLATFORMS: Record<AdProvider, AdPlatform> = {\n  google: {\n    name: 'Google Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['gclid', 'gbraid', 'wbraid'],\n    consoleUrl: 'https://ads.google.com/',\n    verification: {\n      method: 'none',\n      reason:\n        'Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)',\n    },\n    tag: {\n      // The customer id (`123-456-7890`) is not the tag id: the conversion tag is\n      // `AW-…`, which is why this asks for `pixelId` rather than reusing accountId.\n      needs: 'pixelId',\n      src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,\n      bootstrap: gtagBootstrap,\n      cookies: ['_gcl_au', '_gcl_aw', '_gcl_dc', '_gac_*'],\n      privacyUrl: 'https://policies.google.com/privacy',\n      optOut: 'https://adssettings.google.com/',\n    },\n    manualSteps: (e) => [\n      ...(Object.keys(normalizeConversionLabels(e.conversionLabel)).length\n        ? []\n        : ['create a conversion action in Google Ads and record its label as `conversionLabel`']),\n      'link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions',\n    ],\n  },\n\n  meta: {\n    name: 'Meta',\n    operatorCountry: 'the United States',\n    clickIdParams: ['fbclid'],\n    consoleUrl: 'https://business.facebook.com/settings/owned-domains',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'facebook-domain-verification=',\n      where: 'Business settings → Brand safety → Domains → Add → DNS verification',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://connect.facebook.net/en_US/fbevents.js',\n      bootstrap: (id) =>\n        `${queueStub('fbq', `['init','track','trackCustom','consent']`)}` +\n        `fbq('init','${id}');fbq('track','PageView');`,\n      cookies: ['_fbp', '_fbc'],\n      privacyUrl: 'https://www.facebook.com/privacy/policy/',\n      optOut: 'https://www.facebook.com/adpreferences/ad_settings',\n    },\n    manualSteps: () => [\n      'click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called',\n    ],\n  },\n\n  linkedin: {\n    name: 'LinkedIn',\n    operatorCountry: 'the United States',\n    clickIdParams: ['li_fat_id'],\n    consoleUrl: 'https://www.linkedin.com/campaignmanager/',\n    verification: {\n      method: 'none',\n      reason:\n        'LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)',\n    },\n    tag: {\n      needs: 'accountId',\n      src: () => 'https://snap.licdn.com/li.lms-analytics/insight.min.js',\n      bootstrap: (id) =>\n        `window._linkedin_partner_id='${id}';` +\n        `window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];` +\n        `window._linkedin_data_partner_ids.push('${id}');`,\n      cookies: ['li_sugr', 'li_gc', 'bcookie', 'lidc', 'UserMatchHistory'],\n      privacyUrl: 'https://www.linkedin.com/legal/privacy-policy',\n      optOut: 'https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out',\n    },\n    manualSteps: () => [\n      'add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions',\n    ],\n  },\n\n  reddit: {\n    name: 'Reddit',\n    operatorCountry: 'the United States',\n    clickIdParams: ['rdt_cid'],\n    consoleUrl: 'https://ads.reddit.com/',\n    verification: {\n      method: 'none',\n      reason: 'Reddit Ads has no domain verification — the Reddit Pixel is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://www.redditstatic.com/ads/pixel.js',\n      bootstrap: (id) =>\n        `${queueStub('rdt', `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,\n      cookies: ['_rdt_uuid'],\n      privacyUrl: 'https://www.reddit.com/policies/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  tiktok: {\n    name: 'TikTok',\n    operatorCountry: 'Singapore',\n    clickIdParams: ['ttclid'],\n    consoleUrl: 'https://ads.tiktok.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'tiktok-developers-site-verification=',\n      where: 'Ads Manager → Assets → Events → Web events → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: (id) =>\n        `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,\n      bootstrap: (id) =>\n        `window.TiktokAnalyticsObject='ttq';` +\n        `${queueStub('ttq', `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}` +\n        `ttq('init','${id}');ttq('page');`,\n      cookies: ['_ttp'],\n      privacyUrl: 'https://www.tiktok.com/legal/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  microsoft: {\n    name: 'Microsoft Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['msclkid'],\n    consoleUrl: 'https://ads.microsoft.com/',\n    verification: {\n      method: 'none',\n      reason: 'Microsoft Ads has no domain verification — the UET tag is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      // No `src`: UET must be constructed *after* bat.js evaluates, so the\n      // platform's own snippet attaches an onload handler to a script it creates.\n      // Inert until activation all the same — the body is never parsed before then.\n      bootstrap: (id) =>\n        `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};` +\n        `o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,` +\n        `n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},` +\n        `i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,\n      cookies: ['_uetsid', '_uetvid', 'MUID'],\n      privacyUrl: 'https://privacy.microsoft.com/privacystatement',\n      optOut: 'https://account.microsoft.com/privacy/ad-settings',\n    },\n    manualSteps: () => [],\n  },\n\n  pinterest: {\n    name: 'Pinterest',\n    operatorCountry: 'the United States',\n    clickIdParams: ['epik'],\n    consoleUrl: 'https://ads.pinterest.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'pinterest-site-verification=',\n      where: 'Business hub → Claim → Websites → Claim → Add TXT record',\n    },\n    tag: {\n      needs: 'pixelId',\n      // Pinterest's stub creates the script itself once `pintrk('load')` runs.\n      bootstrap: (id) =>\n        `${queueStub('pintrk', `['load','page','track']`)}` +\n        `!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';` +\n        `var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();` +\n        `pintrk('load','${id}');pintrk('page');`,\n      cookies: ['_pinterest_ct_ua', '_pin_unauth', '_epik'],\n      privacyUrl: 'https://policy.pinterest.com/privacy-policy',\n    },\n    manualSteps: () => [\n      'confirm the claim in Business hub → Claim once the TXT record has propagated',\n    ],\n  },\n\n  snapchat: {\n    name: 'Snapchat',\n    operatorCountry: 'the United States',\n    clickIdParams: ['ScCid'],\n    consoleUrl: 'https://ads.snapchat.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'snap-domain-verification=',\n      where: 'Business Manager → Public Profiles / Domains → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://sc-static.net/scevent.min.js',\n      bootstrap: (id) =>\n        `${queueStub('snaptr', `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,\n      cookies: ['_scid', '_scid_r', 'sc_at'],\n      privacyUrl: 'https://snap.com/privacy/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n};\n\n/** Every provider, in table order — the one place iteration order is decided. */\nexport const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS) as AdProvider[];\n\n/** Whether a string names a known provider (for CLI arg validation). */\nexport const isAdProvider = (value: string): value is AdProvider => value in AD_PLATFORMS;\n\n/**\n * The DNS TXT record content for a token.\n *\n * A value already containing `=` is taken as the whole record and left alone. That\n * is the same escape hatch an icon name containing `:` gets: a platform can change\n * its prefix spelling without waiting on a toolchain release, and an operator who\n * pasted the full record from the UI gets what they meant rather than a\n * double-prefixed record that verifies against nothing.\n */\nexport function txtRecord(provider: AdProvider, token: string): string {\n  const trimmed = token.trim();\n  if (trimmed.includes('=')) return trimmed;\n  return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ''}${trimmed}`;\n}\n\n/** The tag id for an entry, or undefined when the field it needs is unset. */\nexport function tagId(entry: AdPropertySetup): string | undefined {\n  const field = AD_PLATFORMS[entry.provider].tag.needs;\n  return entry[field];\n}\n\n/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */\nexport const categoryOf = (entry: AdPropertySetup): AdConsentCategory =>\n  entry.category ?? 'marketing';\n\nconst escapeAttr = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;');\n\n/**\n * One provider's tag, rendered as a **consent-gated, inert** `<script>`.\n *\n * `type=\"text/plain\"` with the URL on `data-src` is what makes the gate real: the\n * browser neither parses the body nor fetches the library, so an undecided\n * visitor's page issues no third-party request. Never give one of these a live\n * `src` — a gate that instead asks a loaded tracker not to track is a promise.\n *\n * Returns null when the entry has no tag id, so a caller can report the gap rather\n * than emit a snippet that initialises `undefined`.\n */\nexport function renderTag(\n  entry: AdPropertySetup,\n  strategy: 'idle' | 'async' | 'interaction' = 'idle',\n): string | null {\n  const platform = AD_PLATFORMS[entry.provider];\n  const id = tagId(entry);\n  if (!id) return null;\n  const attrs = [\n    'type=\"text/plain\"',\n    'data-vitops-tag',\n    `data-consent=\"${categoryOf(entry)}\"`,\n    `data-strategy=\"${strategy}\"`,\n    ...(platform.tag.src ? [`data-src=\"${escapeAttr(platform.tag.src(id))}\"`] : []),\n    `data-consent-cookies=\"${escapeAttr(platform.tag.cookies.join(','))}\"`,\n  ];\n  return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\\n<script ${attrs.join(' ')}>${platform.tag.bootstrap(id, entry)}</script>`;\n}\n","/**\n * Every decision `vitops ads setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The\n * executor gathers each domain's live DNS state and applies what it is told; this\n * module decides, from that state, what is left to do. The same split\n * `onboarding/plan.ts` makes, for the same two payoffs: `--dry` is a *complete*\n * account of a run, and `--check` is an honest drift report.\n *\n * Idempotency lives here — a step whose desired state already holds resolves to\n * `skip`, so a re-run of a linked property is all skips by construction rather than\n * by the executor checking twice.\n *\n * One thing this planner adds over the onboarding one: a step that cannot proceed\n * for want of a **config value** resolves to `blocked` carrying the field name in\n * `needs`. That is a machine-readable gap, which is what lets the CLI *ask* for the\n * missing token and re-plan, while the planner itself stays pure and knows nothing\n * about a terminal. A blocked step is drift, never a skip — the first run of a\n * property whose token has not been fetched yet must not read as \"already linked\".\n */\nimport { AD_PLATFORMS, tagId, txtRecord } from './providers.ts';\nimport type { AdDomainState, AdPropertySetup, AdsConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision. `blocked` means the config is missing something. */\nexport type StepAction = 'create' | 'skip' | 'blocked';\n\n/** A config field the operator can supply to unblock a step. */\nexport type MissingField = 'domainVerification' | 'accountId' | 'pixelId';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do, or what is missing. */\n  detail: string;\n  /** Set only on `blocked`: which config field would unblock it. */\n  needs?: MissingField | undefined;\n}\n\n/** The steps for one ad property, decided against its live state. */\nexport interface AdPropertyPlan {\n  provider: AdPropertySetup['provider'];\n  /** The platform name, so a formatter needn't reach back into the table. */\n  name: string;\n  /** The domain being verified, when the platform verifies one. */\n  domain?: string | undefined;\n  /** Ensure the apex verification TXT. */\n  txt: StepPlan;\n  /** Whether the tag can be emitted (`ads tags`). */\n  tag: StepPlan;\n  /** The exact TXT content to create, when `txt.action` is `create`. */\n  txtContent?: string | undefined;\n  /** Manual follow-ups — including *why* a platform has no verification step. */\n  reminders: string[];\n}\n\nexport interface AdsPlan {\n  properties: AdPropertyPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/**\n * Decide one property's steps.\n *\n * The `dns-txt` branch has three outcomes, and keeping them distinct is the point:\n * our record is present (skip), a *different* record from the same platform is\n * present (create, and say so — a token rotation leaves the old record in place,\n * since this command never edits or deletes DNS), or no token is configured yet\n * (blocked, naming the field).\n */\nexport function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan {\n  const platform = AD_PLATFORMS[setup.provider];\n  const reminders = [...platform.manualSteps(setup)];\n\n  let txt: StepPlan;\n  let txtContent: string | undefined;\n\n  if (platform.verification.method === 'none') {\n    txt = { action: 'skip', detail: platform.verification.reason ?? 'no domain verification' };\n  } else if (!setup.domainVerification) {\n    txt = {\n      action: 'blocked',\n      detail: `needs the verification token from ${platform.verification.where ?? platform.consoleUrl}`,\n      needs: 'domainVerification',\n    };\n  } else {\n    const desired = txtRecord(setup.provider, setup.domainVerification);\n    const prefix = platform.verification.txtPrefix;\n    const stale =\n      prefix != null && state.txtContents.some((c) => c.startsWith(prefix) && c !== desired);\n    txt = state.txtContents.includes(desired)\n      ? { action: 'skip', detail: 'verification TXT already present' }\n      : {\n          action: 'create',\n          detail: stale\n            ? 'create verification TXT (an older token from this platform is still present — remove it yourself; this command never deletes DNS)'\n            : 'create verification TXT',\n        };\n    if (txt.action === 'create') txtContent = desired;\n  }\n\n  const id = tagId(setup);\n  const tag: StepPlan = id\n    ? { action: 'skip', detail: `tag ready (${platform.tag.needs} ${id})` }\n    : {\n        action: 'blocked',\n        detail: `needs ${platform.tag.needs} from ${platform.consoleUrl} to emit the tag`,\n        needs: platform.tag.needs,\n      };\n\n  return {\n    provider: setup.provider,\n    name: platform.name,\n    ...(setup.domain ? { domain: setup.domain } : {}),\n    txt,\n    tag,\n    ...(txtContent ? { txtContent } : {}),\n    reminders,\n  };\n}\n\n/** Plan every configured property. */\nexport function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan {\n  const notes: string[] = [];\n  const properties = config.properties.map((setup) => {\n    const key = setup.domain ?? '';\n    const state = states.get(key);\n    if (!state && AD_PLATFORMS[setup.provider].verification.method === 'dns-txt')\n      // Should not happen — the CLI observes every verifiable domain before\n      // planning — but a missing observation must not read as \"nothing to do\".\n      notes.push(`${setup.provider}: no observed DNS state for ${key || '(no domain)'}`);\n    return planProperty(setup, state ?? { txtContents: [] });\n  });\n  return { properties, notes };\n}\n\n/** Any step that isn't a skip — i.e. the live state or the config has drifted. */\nexport function hasDrift(p: AdsPlan): boolean {\n  return p.properties.some((x) => x.txt.action !== 'skip' || x.tag.action !== 'skip');\n}\n\n/** Every field a run still needs, per provider — what the CLI asks for. */\nexport function missingFields(p: AdsPlan): { provider: string; needs: MissingField }[] {\n  const out: { provider: string; needs: MissingField }[] = [];\n  for (const x of p.properties) {\n    for (const step of [x.txt, x.tag]) {\n      if (step.action === 'blocked' && step.needs)\n        out.push({ provider: x.provider, needs: step.needs });\n    }\n  }\n  return out;\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: AdsPlan): string {\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : s.action === 'blocked' ? '?' : '+');\n  const lines: string[] = [];\n  for (const x of p.properties) {\n    lines.push(`${x.provider}${x.domain ? `  (${x.domain})` : ''}`);\n    lines.push(`  ${glyph(x.txt)} verify  ${x.txt.detail}`);\n    lines.push(`  ${glyph(x.tag)} tag     ${x.tag.detail}`);\n    for (const r of x.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one property's run, for the summary table. */\nexport interface AdPropertyResult {\n  provider: string;\n  domain: string;\n  txt: 'created' | 'present' | 'blocked' | 'failed' | 'n/a';\n  tag: 'ready' | 'blocked';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per property, plus any reminders. */\nexport function formatSummary(results: AdPropertyResult[]): string {\n  const headers = ['PROVIDER', 'DOMAIN', 'VERIFY', 'TAG'];\n  const rows = results.map((r) => [r.provider, r.domain, r.txt, r.tag]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`));\n  return table(headers, rows, reminders);\n}\n"],"mappings":";;;;;;;;AAgEA,SAAgB,0BACd,OACoB;CACpB,IAAI,SAAS,MAAM,OAAO,CAAC;CAC3B,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC0CA,MAAM,iBAAiB,IAAY,UAAmC;CACpE,MAAM,SAAS,0BAA0B,MAAM,eAAe;CAC9D,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,SAAmC,CAAC,CAAC,KAAK,EAAE;CAC3F,OACE,wHACwC,GAAG,QAC1C,QAAQ,SACL,kGACsC,KAAK,UACzC,OAAO,YAAY,QAAQ,KAAK,CAAC,QAAQ,WAAW,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CACjF,EAAE,KACF;AAER;;AAGA,MAAM,aAAa,QAAgB,YACjC,UAAU,OAAO,UAAU,OAAO,uBAAuB,OAAO,YAAY,OAAO,kCACzE,OAAO,WAAW,QAAQ;AAEtC,MAAa,eAA+C;CAC1D,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe;GAAC;GAAS;GAAU;EAAQ;EAC3C,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GAGH,OAAO;GACP,MAAM,OAAO,+CAA+C,mBAAmB,EAAE;GACjF,WAAW;GACX,SAAS;IAAC;IAAW;IAAW;IAAW;GAAQ;GACnD,YAAY;GACZ,QAAQ;EACV;EACA,cAAc,MAAM,CAClB,GAAI,OAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC,CAAC,CAAC,SAC1D,CAAC,IACD,CAAC,oFAAoF,GACzF,gGACF;CACF;CAEA,MAAM;EACJ,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,0CAA0C,gBAC/C,GAAG;GACpB,SAAS,CAAC,QAAQ,MAAM;GACxB,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,2KACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,WAAW;EAC3B,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,gCAAgC,GAAG,oHAEQ,GAAG;GAChD,SAAS;IAAC;IAAW;IAAS;IAAW;IAAQ;GAAkB;GACnE,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,kGACF;CACF;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,kBAAkB,EAAE,cAAc,GAAG;GAC3D,SAAS,CAAC,WAAW;GACrB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,MAAM,OACJ,2DAA2D,mBAAmB,EAAE,EAAE;GACpF,YAAY,OACV,sCACG,UAAU,OAAO,0HAA0H,gBAC/H,GAAG;GACpB,SAAS,CAAC,MAAM;GAChB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GAIP,YAAY,OACV,wEAAwE,GAAG;GAI7E,SAAS;IAAC;IAAW;IAAW;GAAM;GACtC,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,MAAM;EACtB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GAEP,YAAY,OACV,GAAG,UAAU,UAAU,yBAAyB,4MAG9B,GAAG;GACvB,SAAS;IAAC;IAAoB;IAAe;GAAO;GACpD,YAAY;EACd;EACA,mBAAmB,CACjB,8EACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,OAAO;EACvB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,UAAU,kBAAkB,EAAE,iBAAiB,GAAG;GACjE,SAAS;IAAC;IAAS;IAAW;GAAO;GACrC,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;AACF;;AAGA,MAAa,mBAAmB,OAAO,KAAK,YAAY;;AAGxD,MAAa,gBAAgB,UAAuC,SAAS;;;;;;;;;;AAW7E,SAAgB,UAAU,UAAsB,OAAuB;CACrE,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,QAAQ,SAAS,GAAG,GAAG,OAAO;CAClC,OAAO,GAAG,aAAa,SAAS,CAAC,aAAa,aAAa,KAAK;AAClE;;AAGA,SAAgB,MAAM,OAA4C;CAEhE,OAAO,MADO,aAAa,MAAM,SAAS,CAAC,IAAI;AAEjD;;AAGA,MAAa,cAAc,UACzB,MAAM,YAAY;AAEpB,MAAM,cAAc,UAClB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM;;;;;;;;;;;;AAa3E,SAAgB,UACd,OACA,WAA6C,QAC9B;CACf,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,KAAK,MAAM,KAAK;CACtB,IAAI,CAAC,IAAI,OAAO;CAChB,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB,WAAW,KAAK,EAAE;EACnC,kBAAkB,SAAS;EAC3B,GAAI,SAAS,IAAI,MAAM,CAAC,aAAa,WAAW,SAAS,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;EAC7E,yBAAyB,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE;CACtE;CACA,OAAO,QAAQ,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,IAAI,UAAU,IAAI,KAAK,EAAE;AAC5I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AChUA,SAAgB,aAAa,OAAwB,OAAsC;CACzF,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,YAAY,CAAC,GAAG,SAAS,YAAY,KAAK,CAAC;CAEjD,IAAI;CACJ,IAAI;CAEJ,IAAI,SAAS,aAAa,WAAW,QACnC,MAAM;EAAE,QAAQ;EAAQ,QAAQ,SAAS,aAAa,UAAU;CAAyB;MACpF,IAAI,CAAC,MAAM,oBAChB,MAAM;EACJ,QAAQ;EACR,QAAQ,qCAAqC,SAAS,aAAa,SAAS,SAAS;EACrF,OAAO;CACT;MACK;EACL,MAAM,UAAU,UAAU,MAAM,UAAU,MAAM,kBAAkB;EAClE,MAAM,SAAS,SAAS,aAAa;EACrC,MAAM,QACJ,UAAU,QAAQ,MAAM,YAAY,MAAM,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,OAAO;EACvF,MAAM,MAAM,YAAY,SAAS,OAAO,IACpC;GAAE,QAAQ;GAAQ,QAAQ;EAAmC,IAC7D;GACE,QAAQ;GACR,QAAQ,QACJ,sIACA;EACN;EACJ,IAAI,IAAI,WAAW,UAAU,aAAa;CAC5C;CAEA,MAAM,KAAK,MAAM,KAAK;CACtB,MAAM,MAAgB,KAClB;EAAE,QAAQ;EAAQ,QAAQ,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG;CAAG,IACpE;EACE,QAAQ;EACR,QAAQ,SAAS,SAAS,IAAI,MAAM,QAAQ,SAAS,WAAW;EAChE,OAAO,SAAS,IAAI;CACtB;CAEJ,OAAO;EACL,UAAU,MAAM;EAChB,MAAM,SAAS;EACf,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C;EACA;EACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC;CACF;AACF;;AAGA,SAAgB,KAAK,QAAmB,QAA6C;CACnF,MAAM,QAAkB,CAAC;CAUzB,OAAO;EAAE,YATU,OAAO,WAAW,KAAK,UAAU;GAClD,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,CAAC,SAAS,aAAa,MAAM,SAAS,CAAC,aAAa,WAAW,WAGjE,MAAM,KAAK,GAAG,MAAM,SAAS,8BAA8B,OAAO,eAAe;GACnF,OAAO,aAAa,OAAO,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;EACzD,CACkB;EAAG;CAAM;AAC7B;;AAGA,SAAgB,SAAS,GAAqB;CAC5C,OAAO,EAAE,WAAW,MAAM,MAAM,EAAE,IAAI,WAAW,UAAU,EAAE,IAAI,WAAW,MAAM;AACpF;;AAGA,SAAgB,cAAc,GAAyD;CACrF,MAAM,MAAmD,CAAC;CAC1D,KAAK,MAAM,KAAK,EAAE,YAChB,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,GAC9B,IAAI,KAAK,WAAW,aAAa,KAAK,OACpC,IAAI,KAAK;EAAE,UAAU,EAAE;EAAU,OAAO,KAAK;CAAM,CAAC;CAG1D,OAAO;AACT;;AAGA,SAAgB,WAAW,GAAoB;CAC7C,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM,EAAE,WAAW,YAAY,MAAM;CAC3F,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,EAAE,YAAY;EAC5B,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,OAAO,KAAK,IAAI;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAqC;CACjE,MAAM,UAAU;EAAC;EAAY;EAAU;EAAU;CAAK;CACtD,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAU,EAAE;EAAQ,EAAE;EAAK,EAAE;CAAG,CAAC;CACpE,MAAM,YAAY,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;CAC1F,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/ads/types.ts","../../src/ads/providers.ts","../../src/ads/plan.ts"],"sourcesContent":["/**\n * The ads module's own option surface.\n *\n * `AdPropertySetup` is the `site.ads.<platform>` block from `@getvitops/config` plus the platform it\n * is keyed by — inferred from the schema `validateConfig` runs, not re-declared here.\n */\n\nimport type { AdPropertyConfig } from '@getvitops/config';\nimport type { AdProvider as AdProviderConfig } from '@getvitops/config/providers';\n\n/**\n * The ad platforms this toolchain knows how to link a site to.\n *\n * A closed set, and `AD_PROVIDERS` in `@getvitops/config` is its single source: the capability\n * table in `providers.ts` is a `Record<AdProvider, …>`, so a provider added there without an entry\n * here is a compile error. (This was a hand-copied union held to the schema's enum by a test in the\n * generator; the schema now lives below this package, so the copy and the test are gone.) An open\n * string would mean a typo'd provider silently getting no verification step and no tag.\n */\nexport type AdProvider = AdProviderConfig;\n\n/** Which consent category gates a provider's tag. */\nexport type AdConsentCategory = 'marketing' | 'analytics';\n\n/**\n * The three interactions Google Ads can report a distinct conversion action\n * for. `form` is fired client-side via `vitopsFormConversion()`\n * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:\n * click handler.\n */\nexport type ConversionAction = 'call' | 'email' | 'form';\n\n/**\n * One label per action this site wants Google Ads to tell apart.\n *\n * Written out field by field, `?: string | undefined` — not\n * `Partial<Record<ConversionAction, string>>` — matching this file's own\n * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`\n * (present-or-absent) and `{ email?: string | undefined }` (present,\n * absent, or explicitly `undefined`) as different types, and a parsed JSON\n * config's optional field is the latter. `Partial<Record<...>>` produces the\n * former, which rejected the zod-inferred shape config.ts actually produces.\n */\nexport interface ConversionLabelMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/**\n * A bare string is back-compat shorthand for `{ call: label }` — the only\n * action that existed before this was a map. Absent input normalises to `{}`.\n */\nexport function normalizeConversionLabels(\n  label: string | ConversionLabelMap | undefined,\n): ConversionLabelMap {\n  if (label == null) return {};\n  return typeof label === 'string' ? { call: label } : label;\n}\n\n/**\n * One Google Ads conversion action **resource id** per action this site\n * uploads server-side — a numeric id (`\"123456789\"`) or a full resource name\n * (`\"customers/123/conversionActions/456\"`), never the `conversionLabel`\n * string. Written out field by field for the same `exactOptionalPropertyTypes`\n * reason as `ConversionLabelMap` above.\n *\n * **This is a genuinely different identifier from `conversionLabel`, not an\n * alternate spelling of it.** `conversionLabel` is the opaque label the web\n * tag embeds in `send_to: \"AW-…/label\"` — it identifies the conversion action\n * to `gtag.js`, not to the Ads API. The API's click-conversion upload\n * (`ConversionUploadService.UploadClickConversions`) addresses the action by\n * `conversion_action` **resource name**, a value the label cannot be turned\n * into locally — Google returns both when a conversion action is created, but\n * only the label ships to the browser today. Until something in this\n * toolchain calls `ConversionActionService` to create/list actions and print\n * both back, this field has to be copied in by hand from the Ads UI/API.\n */\nexport interface ConversionActionIdMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */\nexport function normalizeConversionActionIds(\n  id: string | ConversionActionIdMap | undefined,\n): ConversionActionIdMap {\n  if (id == null) return {};\n  return typeof id === 'string' ? { call: id } : id;\n}\n\n/** One ad property to link: the config block, plus the platform it is keyed by. */\nexport type AdPropertySetup = AdPropertyConfig & {\n  provider: AdProvider;\n};\n\n/** Everything `plan()` needs, once the CLI has read the config. */\nexport interface AdsConfig {\n  /** The properties to link. Already filtered to `--provider` if that was passed. */\n  properties: AdPropertySetup[];\n}\n\n/**\n * One property's observed live state, gathered by the executor before planning.\n *\n * Same shape of arrangement as `DomainState`: the decision is pure, the\n * observation is not. `txtContents` is every apex TXT record on the domain, so\n * the planner can decide both \"our record is present\" and \"a *different* record\n * from this provider is present\" — the second is a token rotation, which needs\n * saying rather than silently adding a second record.\n */\nexport interface AdDomainState {\n  zoneId?: string | undefined;\n  /** Every apex TXT record content, unquoted. */\n  txtContents: string[];\n}\n","/**\n * What each ad platform actually lets a build tool do — the table every `vitops ads`\n * subcommand reads.\n *\n * Written the way the indexing module was written: start from what the platforms\n * accept, because it is much narrower than it looks, and record the *absence* of a\n * path as a fact rather than leaving it as a gap.\n *\n *  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,\n *    Snapchat). That record is the one thing here that can be created for you.\n *  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,\n *    Microsoft Ads). Linking is the tag and the account id, nothing else. Those\n *    resolve to a skip *plus* a named reason — a silent omission would read as\n *    \"already done\".\n *  - **No platform Marketing API is called.** Meta's Business Management\n *    `verify_domain` needs a system-user token; the Google Ads API needs an\n *    approved developer token and puts the consumer's own account on the line.\n *    That is the same reasoning that keeps the Google Indexing API unwired: a\n *    toolchain other people install must not ship a documented path to a terms\n *    violation. The final \"Verify\" click stays a reminder.\n *\n * The verification token is **not a secret** — it is published in DNS, and the\n * platform fetching it back is the ownership proof, exactly like the IndexNow key.\n * So it lives in the config while credentials stay in the environment.\n *\n * Each tag is the platform's documented bootstrap reduced to its queue stub, with\n * the remote library on `data-src` for the consent gate to attach after the\n * bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body\n * first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a\n * snippet that creates its own `<script>`; those declare no `src`, and their body\n * stays inert until activation, so an undecided visitor still issues no request.\n */\nimport { normalizeConversionActionIds, normalizeConversionLabels } from './types.ts';\nimport type { AdConsentCategory, AdProvider, AdPropertySetup } from './types.ts';\n\n/** How a platform proves you own the domain. */\nexport interface AdVerificationSpec {\n  method: 'dns-txt' | 'none';\n  /**\n   * Prefix prepended to a bare token to form the record content. Owned here so a\n   * config holds the token the platform shows, not a hand-assembled record — but\n   * see `txtRecord`: a value already containing `=` passes through whole, which is\n   * the escape hatch when a platform changes its spelling.\n   */\n  txtPrefix?: string;\n  /** Where in the platform UI the token is found. Printed when asking for it. */\n  where?: string;\n  /** Why there is nothing to automate. Required when `method` is `none`. */\n  reason?: string;\n}\n\n/** The tag, and which config field carries its id. */\nexport interface AdTagSpec {\n  /** Which field the tag id comes from — and therefore what to ask for when absent. */\n  needs: 'pixelId' | 'accountId';\n  /** The remote library. Absent when the platform's own bootstrap loads itself. */\n  src?: (id: string) => string;\n  /** The inline bootstrap, which the gate runs before attaching `src`. */\n  bootstrap: (id: string, entry: AdPropertySetup) => string;\n  /**\n   * Cookies the tag sets, for `data-consent-cookies` (what a revoke clears) and\n   * for the generated cookie notice. A `*` suffix is a prefix match.\n   */\n  cookies: string[];\n  /** The provider's own privacy policy, for the cookie notice. */\n  privacyUrl: string;\n  /** A visitor-facing opt-out, where the platform offers one. */\n  optOut?: string;\n}\n\nexport interface AdPlatform {\n  /** The platform as a reader would recognise it. */\n  name: string;\n  /**\n   * The jurisdiction that can compel this platform to produce what it receives —\n   * where the contracting entity is established. Feeds the generated privacy\n   * policy's cross-border transfer disclosure, which is a claim about foreign\n   * *access*, not foreign storage (see `Processor.operatorCountry` in the\n   * generator's `legal/providers.ts`). A consumer whose contracting entity differs\n   * declares their own processor entry instead.\n   */\n  operatorCountry: string;\n  /** Click-ID parameters this platform stamps on an ad landing URL. */\n  clickIdParams: string[];\n  /** Where the operator manages the property. */\n  consoleUrl: string;\n  verification: AdVerificationSpec;\n  tag: AdTagSpec;\n  /** Follow-ups no API covers, given this entry. */\n  manualSteps: (entry: AdPropertySetup) => string[];\n}\n\n/**\n * `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.\n *\n * `gtag('config', id)` only loads the tag — it never reports a conversion. When\n * `entry.conversionLabel` names one or more actions, this also exposes a\n * `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry\n * per configured action, so a call, an email click and a form submission each\n * carry their own `send_to` target instead of all three sharing one (that\n * sharing was a real bug: a call and an email click used to report as the same\n * Google Ads conversion action, indistinguishable in the account). Bootstrap\n * time only loads the tag; `scripts/tracking.ts`'s click handler and\n * `vitopsFormConversion()` each read their own action's key and fire\n * `gtag('event', 'conversion', …)` at the moment of the actual interaction —\n * bootstrap-time firing would count every pageview as a conversion.\n *\n * `entry` is trusted here — `resolveAds()` validates every configured label\n * against `SAFE_ID` before it reaches this function, the same guard `id`\n * already gets.\n *\n * **`entry.reporting === 'server'` suppresses an action here, never\n * silently.** An action fires client-side unless reporting is `'server'`\n * *and* that same action has a `conversionActionId` configured — so turning\n * reporting to `'server'` before the id is filled in leaves the action firing\n * client-side rather than dropping the conversion. Once both are set, the\n * server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,\n * wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one\n * place that action reports from — this is what avoids double-counting.\n */\nconst gtagBootstrap = (id: string, entry: AdPropertySetup): string => {\n  const labels = normalizeConversionLabels(entry.conversionLabel);\n  const actionIds = normalizeConversionActionIds(entry.conversionActionId);\n  const actions = Object.entries(labels).filter(\n    (pair): pair is [string, string] =>\n      !!pair[1] &&\n      !(entry.reporting === 'server' && !!actionIds[pair[0] as keyof typeof actionIds]),\n  );\n  return (\n    `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}` +\n    `gtag('js',new Date());gtag('config','${id}');` +\n    (actions.length\n      ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};` +\n        `window.vitopsAdsConversions.google=${JSON.stringify(\n          Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])),\n        )};`\n      : '')\n  );\n};\n\n/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */\nconst queueStub = (global: string, methods: string): string =>\n  `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};` +\n  `window.${global}.methods=${methods};`;\n\nexport const AD_PLATFORMS: Record<AdProvider, AdPlatform> = {\n  google: {\n    name: 'Google Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['gclid', 'gbraid', 'wbraid'],\n    consoleUrl: 'https://ads.google.com/',\n    verification: {\n      method: 'none',\n      reason:\n        'Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)',\n    },\n    tag: {\n      // The customer id (`123-456-7890`) is not the tag id: the conversion tag is\n      // `AW-…`, which is why this asks for `pixelId` rather than reusing accountId.\n      needs: 'pixelId',\n      src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,\n      bootstrap: gtagBootstrap,\n      cookies: ['_gcl_au', '_gcl_aw', '_gcl_dc', '_gac_*'],\n      privacyUrl: 'https://policies.google.com/privacy',\n      optOut: 'https://adssettings.google.com/',\n    },\n    manualSteps: (e) => [\n      ...(Object.keys(normalizeConversionLabels(e.conversionLabel)).length\n        ? []\n        : ['create a conversion action in Google Ads and record its label as `conversionLabel`']),\n      'link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions',\n    ],\n  },\n\n  meta: {\n    name: 'Meta',\n    operatorCountry: 'the United States',\n    clickIdParams: ['fbclid'],\n    consoleUrl: 'https://business.facebook.com/settings/owned-domains',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'facebook-domain-verification=',\n      where: 'Business settings → Brand safety → Domains → Add → DNS verification',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://connect.facebook.net/en_US/fbevents.js',\n      bootstrap: (id) =>\n        `${queueStub('fbq', `['init','track','trackCustom','consent']`)}` +\n        `fbq('init','${id}');fbq('track','PageView');`,\n      cookies: ['_fbp', '_fbc'],\n      privacyUrl: 'https://www.facebook.com/privacy/policy/',\n      optOut: 'https://www.facebook.com/adpreferences/ad_settings',\n    },\n    manualSteps: () => [\n      'click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called',\n    ],\n  },\n\n  linkedin: {\n    name: 'LinkedIn',\n    operatorCountry: 'the United States',\n    clickIdParams: ['li_fat_id'],\n    consoleUrl: 'https://www.linkedin.com/campaignmanager/',\n    verification: {\n      method: 'none',\n      reason:\n        'LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)',\n    },\n    tag: {\n      needs: 'accountId',\n      src: () => 'https://snap.licdn.com/li.lms-analytics/insight.min.js',\n      bootstrap: (id) =>\n        `window._linkedin_partner_id='${id}';` +\n        `window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];` +\n        `window._linkedin_data_partner_ids.push('${id}');`,\n      cookies: ['li_sugr', 'li_gc', 'bcookie', 'lidc', 'UserMatchHistory'],\n      privacyUrl: 'https://www.linkedin.com/legal/privacy-policy',\n      optOut: 'https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out',\n    },\n    manualSteps: () => [\n      'add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions',\n    ],\n  },\n\n  reddit: {\n    name: 'Reddit',\n    operatorCountry: 'the United States',\n    clickIdParams: ['rdt_cid'],\n    consoleUrl: 'https://ads.reddit.com/',\n    verification: {\n      method: 'none',\n      reason: 'Reddit Ads has no domain verification — the Reddit Pixel is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://www.redditstatic.com/ads/pixel.js',\n      bootstrap: (id) =>\n        `${queueStub('rdt', `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,\n      cookies: ['_rdt_uuid'],\n      privacyUrl: 'https://www.reddit.com/policies/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  tiktok: {\n    name: 'TikTok',\n    operatorCountry: 'Singapore',\n    clickIdParams: ['ttclid'],\n    consoleUrl: 'https://ads.tiktok.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'tiktok-developers-site-verification=',\n      where: 'Ads Manager → Assets → Events → Web events → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: (id) =>\n        `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,\n      bootstrap: (id) =>\n        `window.TiktokAnalyticsObject='ttq';` +\n        `${queueStub('ttq', `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}` +\n        `ttq('init','${id}');ttq('page');`,\n      cookies: ['_ttp'],\n      privacyUrl: 'https://www.tiktok.com/legal/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  microsoft: {\n    name: 'Microsoft Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['msclkid'],\n    consoleUrl: 'https://ads.microsoft.com/',\n    verification: {\n      method: 'none',\n      reason: 'Microsoft Ads has no domain verification — the UET tag is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      // No `src`: UET must be constructed *after* bat.js evaluates, so the\n      // platform's own snippet attaches an onload handler to a script it creates.\n      // Inert until activation all the same — the body is never parsed before then.\n      bootstrap: (id) =>\n        `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};` +\n        `o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,` +\n        `n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},` +\n        `i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,\n      cookies: ['_uetsid', '_uetvid', 'MUID'],\n      privacyUrl: 'https://privacy.microsoft.com/privacystatement',\n      optOut: 'https://account.microsoft.com/privacy/ad-settings',\n    },\n    manualSteps: () => [],\n  },\n\n  pinterest: {\n    name: 'Pinterest',\n    operatorCountry: 'the United States',\n    clickIdParams: ['epik'],\n    consoleUrl: 'https://ads.pinterest.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'pinterest-site-verification=',\n      where: 'Business hub → Claim → Websites → Claim → Add TXT record',\n    },\n    tag: {\n      needs: 'pixelId',\n      // Pinterest's stub creates the script itself once `pintrk('load')` runs.\n      bootstrap: (id) =>\n        `${queueStub('pintrk', `['load','page','track']`)}` +\n        `!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';` +\n        `var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();` +\n        `pintrk('load','${id}');pintrk('page');`,\n      cookies: ['_pinterest_ct_ua', '_pin_unauth', '_epik'],\n      privacyUrl: 'https://policy.pinterest.com/privacy-policy',\n    },\n    manualSteps: () => [\n      'confirm the claim in Business hub → Claim once the TXT record has propagated',\n    ],\n  },\n\n  snapchat: {\n    name: 'Snapchat',\n    operatorCountry: 'the United States',\n    clickIdParams: ['ScCid'],\n    consoleUrl: 'https://ads.snapchat.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'snap-domain-verification=',\n      where: 'Business Manager → Public Profiles / Domains → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://sc-static.net/scevent.min.js',\n      bootstrap: (id) =>\n        `${queueStub('snaptr', `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,\n      cookies: ['_scid', '_scid_r', 'sc_at'],\n      privacyUrl: 'https://snap.com/privacy/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n};\n\n/** Every provider, in table order — the one place iteration order is decided. */\nexport const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS) as AdProvider[];\n\n/** Whether a string names a known provider (for CLI arg validation). */\nexport const isAdProvider = (value: string): value is AdProvider => value in AD_PLATFORMS;\n\n/**\n * The DNS TXT record content for a token.\n *\n * A value already containing `=` is taken as the whole record and left alone. That\n * is the same escape hatch an icon name containing `:` gets: a platform can change\n * its prefix spelling without waiting on a toolchain release, and an operator who\n * pasted the full record from the UI gets what they meant rather than a\n * double-prefixed record that verifies against nothing.\n */\nexport function txtRecord(provider: AdProvider, token: string): string {\n  const trimmed = token.trim();\n  if (trimmed.includes('=')) return trimmed;\n  return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ''}${trimmed}`;\n}\n\n/** The tag id for an entry, or undefined when the field it needs is unset. */\nexport function tagId(entry: AdPropertySetup): string | undefined {\n  const field = AD_PLATFORMS[entry.provider].tag.needs;\n  return entry[field];\n}\n\n/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */\nexport const categoryOf = (entry: AdPropertySetup): AdConsentCategory =>\n  entry.category ?? 'marketing';\n\nconst escapeAttr = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;');\n\n/**\n * One provider's tag, rendered as a **consent-gated, inert** `<script>`.\n *\n * `type=\"text/plain\"` with the URL on `data-src` is what makes the gate real: the\n * browser neither parses the body nor fetches the library, so an undecided\n * visitor's page issues no third-party request. Never give one of these a live\n * `src` — a gate that instead asks a loaded tracker not to track is a promise.\n *\n * Returns null when the entry has no tag id, so a caller can report the gap rather\n * than emit a snippet that initialises `undefined`.\n */\nexport function renderTag(\n  entry: AdPropertySetup,\n  strategy: 'idle' | 'async' | 'interaction' = 'idle',\n): string | null {\n  const platform = AD_PLATFORMS[entry.provider];\n  const id = tagId(entry);\n  if (!id) return null;\n  const attrs = [\n    'type=\"text/plain\"',\n    'data-vitops-tag',\n    `data-consent=\"${categoryOf(entry)}\"`,\n    `data-strategy=\"${strategy}\"`,\n    ...(platform.tag.src ? [`data-src=\"${escapeAttr(platform.tag.src(id))}\"`] : []),\n    `data-consent-cookies=\"${escapeAttr(platform.tag.cookies.join(','))}\"`,\n  ];\n  return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\\n<script ${attrs.join(' ')}>${platform.tag.bootstrap(id, entry)}</script>`;\n}\n","/**\n * Every decision `vitops ads setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The\n * executor gathers each domain's live DNS state and applies what it is told; this\n * module decides, from that state, what is left to do. The same split\n * `onboarding/plan.ts` makes, for the same two payoffs: `--dry` is a *complete*\n * account of a run, and `--check` is an honest drift report.\n *\n * Idempotency lives here — a step whose desired state already holds resolves to\n * `skip`, so a re-run of a linked property is all skips by construction rather than\n * by the executor checking twice.\n *\n * One thing this planner adds over the onboarding one: a step that cannot proceed\n * for want of a **config value** resolves to `blocked` carrying the field name in\n * `needs`. That is a machine-readable gap, which is what lets the CLI *ask* for the\n * missing token and re-plan, while the planner itself stays pure and knows nothing\n * about a terminal. A blocked step is drift, never a skip — the first run of a\n * property whose token has not been fetched yet must not read as \"already linked\".\n */\nimport { AD_PLATFORMS, tagId, txtRecord } from './providers.ts';\nimport type { AdDomainState, AdPropertySetup, AdsConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision. `blocked` means the config is missing something. */\nexport type StepAction = 'create' | 'skip' | 'blocked';\n\n/** A config field the operator can supply to unblock a step. */\nexport type MissingField = 'domainVerification' | 'accountId' | 'pixelId';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do, or what is missing. */\n  detail: string;\n  /** Set only on `blocked`: which config field would unblock it. */\n  needs?: MissingField | undefined;\n}\n\n/** The steps for one ad property, decided against its live state. */\nexport interface AdPropertyPlan {\n  provider: AdPropertySetup['provider'];\n  /** The platform name, so a formatter needn't reach back into the table. */\n  name: string;\n  /** The domain being verified, when the platform verifies one. */\n  domain?: string | undefined;\n  /** Ensure the apex verification TXT. */\n  txt: StepPlan;\n  /** Whether the tag can be emitted (`ads tags`). */\n  tag: StepPlan;\n  /** The exact TXT content to create, when `txt.action` is `create`. */\n  txtContent?: string | undefined;\n  /** Manual follow-ups — including *why* a platform has no verification step. */\n  reminders: string[];\n}\n\nexport interface AdsPlan {\n  properties: AdPropertyPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/**\n * Decide one property's steps.\n *\n * The `dns-txt` branch has three outcomes, and keeping them distinct is the point:\n * our record is present (skip), a *different* record from the same platform is\n * present (create, and say so — a token rotation leaves the old record in place,\n * since this command never edits or deletes DNS), or no token is configured yet\n * (blocked, naming the field).\n */\nexport function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan {\n  const platform = AD_PLATFORMS[setup.provider];\n  const reminders = [...platform.manualSteps(setup)];\n\n  let txt: StepPlan;\n  let txtContent: string | undefined;\n\n  if (platform.verification.method === 'none') {\n    txt = { action: 'skip', detail: platform.verification.reason ?? 'no domain verification' };\n  } else if (!setup.domainVerification) {\n    txt = {\n      action: 'blocked',\n      detail: `needs the verification token from ${platform.verification.where ?? platform.consoleUrl}`,\n      needs: 'domainVerification',\n    };\n  } else {\n    const desired = txtRecord(setup.provider, setup.domainVerification);\n    const prefix = platform.verification.txtPrefix;\n    const stale =\n      prefix != null && state.txtContents.some((c) => c.startsWith(prefix) && c !== desired);\n    txt = state.txtContents.includes(desired)\n      ? { action: 'skip', detail: 'verification TXT already present' }\n      : {\n          action: 'create',\n          detail: stale\n            ? 'create verification TXT (an older token from this platform is still present — remove it yourself; this command never deletes DNS)'\n            : 'create verification TXT',\n        };\n    if (txt.action === 'create') txtContent = desired;\n  }\n\n  const id = tagId(setup);\n  const tag: StepPlan = id\n    ? { action: 'skip', detail: `tag ready (${platform.tag.needs} ${id})` }\n    : {\n        action: 'blocked',\n        detail: `needs ${platform.tag.needs} from ${platform.consoleUrl} to emit the tag`,\n        needs: platform.tag.needs,\n      };\n\n  return {\n    provider: setup.provider,\n    name: platform.name,\n    ...(setup.domain ? { domain: setup.domain } : {}),\n    txt,\n    tag,\n    ...(txtContent ? { txtContent } : {}),\n    reminders,\n  };\n}\n\n/** Plan every configured property. */\nexport function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan {\n  const notes: string[] = [];\n  const properties = config.properties.map((setup) => {\n    const key = setup.domain ?? '';\n    const state = states.get(key);\n    if (!state && AD_PLATFORMS[setup.provider].verification.method === 'dns-txt')\n      // Should not happen — the CLI observes every verifiable domain before\n      // planning — but a missing observation must not read as \"nothing to do\".\n      notes.push(`${setup.provider}: no observed DNS state for ${key || '(no domain)'}`);\n    return planProperty(setup, state ?? { txtContents: [] });\n  });\n  return { properties, notes };\n}\n\n/** Any step that isn't a skip — i.e. the live state or the config has drifted. */\nexport function hasDrift(p: AdsPlan): boolean {\n  return p.properties.some((x) => x.txt.action !== 'skip' || x.tag.action !== 'skip');\n}\n\n/** Every field a run still needs, per provider — what the CLI asks for. */\nexport function missingFields(p: AdsPlan): { provider: string; needs: MissingField }[] {\n  const out: { provider: string; needs: MissingField }[] = [];\n  for (const x of p.properties) {\n    for (const step of [x.txt, x.tag]) {\n      if (step.action === 'blocked' && step.needs)\n        out.push({ provider: x.provider, needs: step.needs });\n    }\n  }\n  return out;\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: AdsPlan): string {\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : s.action === 'blocked' ? '?' : '+');\n  const lines: string[] = [];\n  for (const x of p.properties) {\n    lines.push(`${x.provider}${x.domain ? `  (${x.domain})` : ''}`);\n    lines.push(`  ${glyph(x.txt)} verify  ${x.txt.detail}`);\n    lines.push(`  ${glyph(x.tag)} tag     ${x.tag.detail}`);\n    for (const r of x.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one property's run, for the summary table. */\nexport interface AdPropertyResult {\n  provider: string;\n  domain: string;\n  txt: 'created' | 'present' | 'blocked' | 'failed' | 'n/a';\n  tag: 'ready' | 'blocked';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per property, plus any reminders. */\nexport function formatSummary(results: AdPropertyResult[]): string {\n  const headers = ['PROVIDER', 'DOMAIN', 'VERIFY', 'TAG'];\n  const rows = results.map((r) => [r.provider, r.domain, r.txt, r.tag]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`));\n  return table(headers, rows, reminders);\n}\n"],"mappings":";;;;;;;AAqDA,SAAgB,0BACd,OACoB;CACpB,IAAI,SAAS,MAAM,OAAO,CAAC;CAC3B,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD;;AA2BA,SAAgB,6BACd,IACuB;CACvB,IAAI,MAAM,MAAM,OAAO,CAAC;CACxB,OAAO,OAAO,OAAO,WAAW,EAAE,MAAM,GAAG,IAAI;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BA,MAAM,iBAAiB,IAAY,UAAmC;CACpE,MAAM,SAAS,0BAA0B,MAAM,eAAe;CAC9D,MAAM,YAAY,6BAA6B,MAAM,kBAAkB;CACvE,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpC,SACC,CAAC,CAAC,KAAK,MACP,EAAE,MAAM,cAAc,YAAY,CAAC,CAAC,UAAU,KAAK,IACvD;CACA,OACE,wHACwC,GAAG,QAC1C,QAAQ,SACL,kGACsC,KAAK,UACzC,OAAO,YAAY,QAAQ,KAAK,CAAC,QAAQ,WAAW,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CACjF,EAAE,KACF;AAER;;AAGA,MAAM,aAAa,QAAgB,YACjC,UAAU,OAAO,UAAU,OAAO,uBAAuB,OAAO,YAAY,OAAO,kCACzE,OAAO,WAAW,QAAQ;AAEtC,MAAa,eAA+C;CAC1D,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe;GAAC;GAAS;GAAU;EAAQ;EAC3C,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GAGH,OAAO;GACP,MAAM,OAAO,+CAA+C,mBAAmB,EAAE;GACjF,WAAW;GACX,SAAS;IAAC;IAAW;IAAW;IAAW;GAAQ;GACnD,YAAY;GACZ,QAAQ;EACV;EACA,cAAc,MAAM,CAClB,GAAI,OAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC,CAAC,CAAC,SAC1D,CAAC,IACD,CAAC,oFAAoF,GACzF,gGACF;CACF;CAEA,MAAM;EACJ,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,0CAA0C,gBAC/C,GAAG;GACpB,SAAS,CAAC,QAAQ,MAAM;GACxB,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,2KACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,WAAW;EAC3B,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,gCAAgC,GAAG,oHAEQ,GAAG;GAChD,SAAS;IAAC;IAAW;IAAS;IAAW;IAAQ;GAAkB;GACnE,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,kGACF;CACF;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,kBAAkB,EAAE,cAAc,GAAG;GAC3D,SAAS,CAAC,WAAW;GACrB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,MAAM,OACJ,2DAA2D,mBAAmB,EAAE,EAAE;GACpF,YAAY,OACV,sCACG,UAAU,OAAO,0HAA0H,gBAC/H,GAAG;GACpB,SAAS,CAAC,MAAM;GAChB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GAIP,YAAY,OACV,wEAAwE,GAAG;GAI7E,SAAS;IAAC;IAAW;IAAW;GAAM;GACtC,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,MAAM;EACtB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GAEP,YAAY,OACV,GAAG,UAAU,UAAU,yBAAyB,4MAG9B,GAAG;GACvB,SAAS;IAAC;IAAoB;IAAe;GAAO;GACpD,YAAY;EACd;EACA,mBAAmB,CACjB,8EACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,OAAO;EACvB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,UAAU,kBAAkB,EAAE,iBAAiB,GAAG;GACjE,SAAS;IAAC;IAAS;IAAW;GAAO;GACrC,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;AACF;;AAGA,MAAa,mBAAmB,OAAO,KAAK,YAAY;;AAGxD,MAAa,gBAAgB,UAAuC,SAAS;;;;;;;;;;AAW7E,SAAgB,UAAU,UAAsB,OAAuB;CACrE,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,QAAQ,SAAS,GAAG,GAAG,OAAO;CAClC,OAAO,GAAG,aAAa,SAAS,CAAC,aAAa,aAAa,KAAK;AAClE;;AAGA,SAAgB,MAAM,OAA4C;CAEhE,OAAO,MADO,aAAa,MAAM,SAAS,CAAC,IAAI;AAEjD;;AAGA,MAAa,cAAc,UACzB,MAAM,YAAY;AAEpB,MAAM,cAAc,UAClB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM;;;;;;;;;;;;AAa3E,SAAgB,UACd,OACA,WAA6C,QAC9B;CACf,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,KAAK,MAAM,KAAK;CACtB,IAAI,CAAC,IAAI,OAAO;CAChB,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB,WAAW,KAAK,EAAE;EACnC,kBAAkB,SAAS;EAC3B,GAAI,SAAS,IAAI,MAAM,CAAC,aAAa,WAAW,SAAS,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;EAC7E,yBAAyB,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE;CACtE;CACA,OAAO,QAAQ,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,IAAI,UAAU,IAAI,KAAK,EAAE;AAC5I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9UA,SAAgB,aAAa,OAAwB,OAAsC;CACzF,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,YAAY,CAAC,GAAG,SAAS,YAAY,KAAK,CAAC;CAEjD,IAAI;CACJ,IAAI;CAEJ,IAAI,SAAS,aAAa,WAAW,QACnC,MAAM;EAAE,QAAQ;EAAQ,QAAQ,SAAS,aAAa,UAAU;CAAyB;MACpF,IAAI,CAAC,MAAM,oBAChB,MAAM;EACJ,QAAQ;EACR,QAAQ,qCAAqC,SAAS,aAAa,SAAS,SAAS;EACrF,OAAO;CACT;MACK;EACL,MAAM,UAAU,UAAU,MAAM,UAAU,MAAM,kBAAkB;EAClE,MAAM,SAAS,SAAS,aAAa;EACrC,MAAM,QACJ,UAAU,QAAQ,MAAM,YAAY,MAAM,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,OAAO;EACvF,MAAM,MAAM,YAAY,SAAS,OAAO,IACpC;GAAE,QAAQ;GAAQ,QAAQ;EAAmC,IAC7D;GACE,QAAQ;GACR,QAAQ,QACJ,sIACA;EACN;EACJ,IAAI,IAAI,WAAW,UAAU,aAAa;CAC5C;CAEA,MAAM,KAAK,MAAM,KAAK;CACtB,MAAM,MAAgB,KAClB;EAAE,QAAQ;EAAQ,QAAQ,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG;CAAG,IACpE;EACE,QAAQ;EACR,QAAQ,SAAS,SAAS,IAAI,MAAM,QAAQ,SAAS,WAAW;EAChE,OAAO,SAAS,IAAI;CACtB;CAEJ,OAAO;EACL,UAAU,MAAM;EAChB,MAAM,SAAS;EACf,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C;EACA;EACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC;CACF;AACF;;AAGA,SAAgB,KAAK,QAAmB,QAA6C;CACnF,MAAM,QAAkB,CAAC;CAUzB,OAAO;EAAE,YATU,OAAO,WAAW,KAAK,UAAU;GAClD,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,CAAC,SAAS,aAAa,MAAM,SAAS,CAAC,aAAa,WAAW,WAGjE,MAAM,KAAK,GAAG,MAAM,SAAS,8BAA8B,OAAO,eAAe;GACnF,OAAO,aAAa,OAAO,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;EACzD,CACkB;EAAG;CAAM;AAC7B;;AAGA,SAAgB,SAAS,GAAqB;CAC5C,OAAO,EAAE,WAAW,MAAM,MAAM,EAAE,IAAI,WAAW,UAAU,EAAE,IAAI,WAAW,MAAM;AACpF;;AAGA,SAAgB,cAAc,GAAyD;CACrF,MAAM,MAAmD,CAAC;CAC1D,KAAK,MAAM,KAAK,EAAE,YAChB,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,GAC9B,IAAI,KAAK,WAAW,aAAa,KAAK,OACpC,IAAI,KAAK;EAAE,UAAU,EAAE;EAAU,OAAO,KAAK;CAAM,CAAC;CAG1D,OAAO;AACT;;AAGA,SAAgB,WAAW,GAAoB;CAC7C,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM,EAAE,WAAW,YAAY,MAAM;CAC3F,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,EAAE,YAAY;EAC5B,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,OAAO,KAAK,IAAI;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAqC;CACjE,MAAM,UAAU;EAAC;EAAY;EAAU;EAAU;CAAK;CACtD,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAU,EAAE;EAAQ,EAAE;EAAK,EAAE;CAAG,CAAC;CACpE,MAAM,YAAY,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;CAC1F,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC"}

package/dist/audit/index.d.mts

@@ -0,0 +1,180 @@
+/** Shapes shared by the audit planner, the executor and the report renderers. */
+type AxeImpact = 'minor' | 'moderate' | 'serious' | 'critical';
+interface AuditBudgets {
+  /** Largest Contentful Paint ceiling, ms. */
+  lcpMs: number;
+  /** Cumulative Layout Shift ceiling (unitless). */
+  cls: number;
+  /** Total Blocking Time ceiling, ms — the lab proxy for INP. */
+  tbtMs: number;
+  /** axe impacts that fail the page. Default: serious + critical. */
+  blockingImpacts: AxeImpact[];
+}
+interface AxeViolation {
+  id: string;
+  /** axe reports `null` impact for some incomplete rules; normalised to `moderate`. */
+  impact: AxeImpact;
+  help: string;
+  helpUrl: string;
+  /** Total nodes the rule failed on. */
+  nodeCount: number;
+  /** First few CSS selectors, for the report. */
+  targets: string[];
+}
+interface PageMetrics {
+  /** `undefined` when Lighthouse could not compute it — which fails the page, not passes it. */
+  lcpMs?: number | undefined;
+  cls?: number | undefined;
+  tbtMs?: number | undefined;
+  /** Lighthouse category scores, 0-100. */
+  scores: {
+    performance?: number | undefined;
+    seo?: number | undefined;
+    bestPractices?: number | undefined;
+  };
+}
+interface BudgetFailure {
+  kind: 'lcp' | 'cls' | 'tbt' | 'axe' | 'metric-missing' | 'page-error' | 'required-page-missing';
+  message: string;
+}
+type PageStatus = 'audited' | 'skipped' | 'error';
+interface PageResult {
+  path: string;
+  url: string;
+  status: PageStatus;
+  httpStatus?: number;
+  /** Why a page was skipped or errored. */
+  reason?: string;
+  metrics?: PageMetrics;
+  violations?: AxeViolation[];
+  failures: BudgetFailure[];
+}
+type FormFactor = 'mobile' | 'desktop';
+interface AuditReport {
+  generatedAt: string;
+  baseUrl: string;
+  formFactor: FormFactor;
+  budgets: AuditBudgets;
+  axeTags: string[];
+  pages: PageResult[];
+  /** True when no page has a failure. */
+  passed: boolean;
+  /** Always present: what a pass does and does not mean. */
+  disclaimer: string;
+  manualChecks: string[];
+}
+export declare const DEFAULT_BUDGETS: AuditBudgets;
+/**
+ * `wcag2a`/`wcag2aa` are what AODA (WCAG 2.0 AA) asks for; `wcag21a`/`wcag21aa` add the
+ * 2.1 criteria we target. `wcag21aa` alone covers only the *new AA* criteria, not the
+ * new level-A ones, so both 2.1 tags are listed.
+ */
+export declare const AXE_TAGS: string[];
+/** Pages tried on every run. `/` is required; the rest are skipped when they 404. */
+export declare const DEFAULT_PAGES: string[];
+export declare const DISCLAIMER: string;
+export declare const MANUAL_CHECKS: string[];
+/**
+ * A menu-ish thing: EmDash seed (`items`), `getMenu()` (`items`, items with `children`),
+ * or either shape nested. Only `name`, `url` and children are read.
+ */
+interface MenuLike {
+  name?: string;
+  items?: MenuItemLike[];
+}
+interface MenuItemLike {
+  url?: string | null;
+  children?: MenuItemLike[];
+  items?: MenuItemLike[];
+}
+/**
+ * Normalise to a site-relative path, or `undefined` for anything that is not an
+ * auditable page of this site: external URLs, hash-only links, `mailto:`/`tel:`,
+ * protocol-relative URLs, file downloads (anything with an extension) and the CMS
+ * admin. Query and hash are dropped; a trailing slash is too (except the root).
+ */
+export declare function normalizePath(url: string | null | undefined): string | undefined;
+/** Is this one of the menus whose links are pages worth auditing? */
+export declare function isAuditMenu(name: string | undefined): boolean;
+/** Paths from the `primary*` / `footer*` menus (`footer-legal`, `primary-mobile`, …). */
+export declare function pathsFromMenus(menus: MenuLike[]): string[];
+/** Same, from an EmDash seed file's parsed JSON (`{ menus: [...] }`). */
+export declare function pathsFromSeed(seed: unknown): string[];
+interface PagePlanInput {
+  /** Paths found in menus. */
+  menuPaths?: string[];
+  /** Paths from `--pages`. */
+  extra?: string[];
+  /** Default true. `--no-defaults` for a site that wants an exact list. */
+  includeDefaults?: boolean;
+}
+/** The pages to try, `/` always first, unique, in a stable order. */
+export declare function planPages(input?: PagePlanInput): string[];
+/**
+ * What an HTTP status means for a candidate page. 404/410 → skipped (a single-page
+ * site has no `/contact`, and that is fine) — except `/`, which must exist. Any other
+ * non-2xx is an error: a 500 on `/privacy` is a defect, not an absent page.
+ */
+export declare function classifyStatus(path: string, httpStatus: number | undefined): {
+  status: 'audited' | 'skipped' | 'error';
+  reason?: string;
+};
+/** axe can report a null impact; treat it as `moderate`, never silently drop it. */
+export declare function normalizeImpact(impact: string | null | undefined): AxeImpact;
+/** `serious,critical` → impacts, rejecting typos so a budget cannot silently be empty. */
+export declare function parseImpacts(list: string): AxeImpact[];
+/** Everything that makes one audited page fail. Empty = the page passes. */
+export declare function evaluatePage(metrics: PageMetrics | undefined, violations: AxeViolation[] | undefined, budgets: AuditBudgets): BudgetFailure[];
+/** Build a `PageResult` for a page that was not audited (skipped or error). */
+export declare function unauditedPage(path: string, url: string, httpStatus: number | undefined, verdict: {
+  status: 'skipped' | 'error';
+  reason?: string;
+}): PageResult;
+export declare function auditedPage(path: string, url: string, httpStatus: number, metrics: PageMetrics, violations: AxeViolation[], budgets: AuditBudgets): PageResult;
+export declare function buildReport(input: {
+  generatedAt: string;
+  baseUrl: string;
+  formFactor: FormFactor;
+  budgets: AuditBudgets;
+  pages: PageResult[];
+}): AuditReport;
+/** `/` → `home`, `/a/b` → `a-b`: a safe per-page filename. */
+export declare function pageSlug(path: string): string;
+export declare function renderPageMarkdown(page: PageResult, budgets: AuditBudgets): string;
+export declare function renderMarkdown(report: AuditReport): string;
+/** Files to write, relative to the output dir: JSON + markdown overall and per page. */
+export declare function reportFiles(report: AuditReport): Record<string, string>;
+/** One-line-per-failure console summary. */
+export declare function formatSummary(report: AuditReport): string;
+/** A free TCP port, or `true` for "this specific one is free". */
+export declare function isPortFree(port: number): Promise<boolean>;
+/** Run a command to completion, inheriting stdio. Rejects on a non-zero exit. */
+export declare function runCommand(cmd: string, args: string[], cwd: string): Promise<void>;
+interface PreviewServer {
+  baseUrl: string;
+  stop(): void;
+}
+/**
+ * `astro preview` on a dedicated port.
+ *
+ * Astro's preview server silently moves to the next port when its own is taken, and
+ * a readiness probe would then happily attach to whatever owns the original one — the
+ * failure `site/playwright.config.ts` documents. So the port is checked free first and
+ * the run aborts if it is not.
+ */
+export declare function startPreview(opts: {
+  cwd: string;
+  port: number;
+  timeoutMs?: number;
+}): Promise<PreviewServer>;
+interface RunOptions {
+  baseUrl: string;
+  paths: string[];
+  budgets: AuditBudgets;
+  formFactor: FormFactor;
+  onProgress?: (message: string) => void;
+}
+/** Audit each path. Never throws for a bad PAGE — only for missing tooling/browser. */
+export declare function runAudit(opts: RunOptions): Promise<PageResult[]>;
+export type { AuditBudgets, AuditReport, AxeImpact, AxeViolation, BudgetFailure, FormFactor, MenuItemLike, MenuLike, PageMetrics, PagePlanInput, PageResult, PageStatus, PreviewServer, RunOptions };
+//# sourceMappingURL=index.d.mts.map

package/dist/audit/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/audit/types.ts","../../src/audit/plan.ts","../../src/audit/run.ts"],"mappings":";KAEY;UAEK;;EAEf;;EAEA;;EAEA;;EAEA,iBAAiB;;UAGF;EACf;;EAEA,QAAQ;EACR;EACA;;EAEA;;EAEA;;UAGe;;EAEf;EACA;EACA;;EAEA;IACE;IACA;IACA;;;UAIa;EACf;EACA;;KAGU;UAEK;EACf;EACA;EACA,QAAQ;EACR;;EAEA;EACA,UAAU;EACV,aAAa;EACb,UAAU;;KAGA;UAEK;EACf;EACA;EACA,YAAY;EACZ,SAAS;EACT;EACA,OAAO;;EAEP;;EAEA;EACA;;qBCrDW,iBAAiB;;;;;;qBAYjB;;qBAGA;qBAEA;qBAKA;;;;;UAgBI;EACf;EACA,QAAQ;;UAEO;EACf;EACA,WAAW;EACX,QAAQ;;;;;;;;wBASM,cAAc;;wBAsBd,YAAY;;wBAKZ,eAAe,OAAO;;wBAOtB,cAAc;UAKb;;EAEf;;EAEA;;EAEA;;;wBAIc,UAAU,QAAO;;;;;;wBAqBjB,eACd,cACA;EACG;EAAyC;;;wBAgB9B,gBAAgB,oCAAoC;;wBAKpD,aAAa,eAAe;;wBAe5B,aACd,SAAS,yBACT,YAAY,4BACZ,SAAS,eACR;;wBAyCa,cACd,cACA,aACA,gCACA;EAAW;EAA6B;IACvC;wBAmBa,YACd,cACA,aACA,oBACA,SAAS,aACT,YAAY,gBACZ,SAAS,eACR;wBAYa,YAAY;EAC1B;EACA;EACA,YAAY;EACZ,SAAS;EACT,OAAO;IACL;;wBAiBY,SAAS;wBAOT,mBAAmB,MAAM,YAAY,SAAS;wBAyC9C,eAAe,QAAQ;;wBAiCvB,YAAY,QAAQ,cAAc;;wBAgBlC,cAAc,QAAQ;;wBC3VtB,WAAW,eAAe;;wBAoB1B,WAAW,aAAa,gBAAgB,cAAc;UAUrD;EACf;EACA;;;;;;;;;;wBAWoB,aAAa;EACjC;EACA;EACA;IACE,QAAQ;UA+FK;EACf;EACA;EACA,SAAS;EACT,YAAY;EACZ,cAAc;;;wBAIM,SAAS,MAAM,aAAa,QAAQ"}