@getvitops/utils 8.3.0-alpha.3 → 8.3.0-alpha.5

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @getvitops/utils
 
+## 8.3.0-alpha.5
+
+### Minor Changes
+
+- bb61a35: **Call tracking numbers: show an ad visitor a number that attributes the phone call.** Two additive config blocks, no CSS, no breaking change — all formats unaffected.
+
+  - **`site.ads.google.callTracking`** — Google Ads _website call conversions_. `{ label, number, cache? }` makes the consent-gated Google tag fetch a Google forwarding number (Canada supported) and swap it in for visitors who arrived from a Google ad. Google replaces text only, so the capture script also rewrites the matching `tel:` href. Needs `pixelId` and `site.tracking.enabled`; rejected on any other platform (only Google can put a number on the website — Microsoft's exist only inside the ad, in the US/UK/AU).
+  - **`site.tracking.phoneNumbers`** — per-platform numbers for every other platform: the real `number`, `sources` keyed by `site.ads` platform (plus `default-paid`), and an informational `provider`. You provision the numbers with a call-tracking service (Twilio, CallRail, …). The landing URL decides first, then the `_ac` cookie, so a visitor who declines `marketing` sees a tracking number on the landing page only. An organic visitor is never swapped, and the server-rendered HTML always carries the real number.
+  - The `tel:` tap beacon now carries which number was shown (`phoneSource`), and the conversion notification says so.
+  - `vitops ads lint` flags a call-tracking provider that is not in `site.legal.privacyPolicy.processors`, and notes that `callTracking` plus `conversionLabel.call` can count one call twice (make one secondary in Google Ads).
+  - `@getvitops/utils/tracking` exports the pure `selectPhoneNumber()` and helpers; the capture script mirrors it and `tracking.test.ts` pins the two.
+  - `@getvitops/skills` gains a **`vitops-ads`** skill (overview plus a `call-tracking.md` topic). The templates gitignore synced skills by prefix (`vitops-*`, `emdash-*`), so it needs no `.gitignore` line of its own.
+
+  `@getvitops/core`, `@getvitops/vite` and `@getvitops/emdash` — no consumer-facing change in these packages.
+
+### Patch Changes
+
+- 785b8b3: Docs only: the `site.ads.google.conversionLabel` field descriptions and `vitops ads` now state which Google Ads category each conversion action needs (`call` → Phone call lead, `email` → Contact, `form` → Submit lead form). The category is set on the action in Google Ads, not by the tag, so a wrong one reports under the wrong goal with no code-side signal. `vitopsFormConversion()`'s docblock also warns against firing a form conversion from a success-page query parameter. No behaviour change.
+- Updated dependencies [785b8b3]
+- Updated dependencies [bb61a35]
+- Updated dependencies [4d94c8b]
+  - @getvitops/config@8.3.0-alpha.5
+
+## 8.3.0-alpha.4
+
+### Patch Changes
+
+- 00a9d86: - **`vitops audit` lets the page settle before axe reads colours.** At `load` Chromium can still be running the CSS transitions every pattern declares, so axe measured a filled button mid-way from its unstyled colour and reported ten `color-contrast` failures no visitor sees. The audit now waits (up to 2 s) for CSS transitions to finish first.
+  - `.carousel__hint` reads `text-surface-muted` instead of `x-muted` (the placeholder tier the contrast contract exempts), and its scroll-driven fade ends hidden instead of at 0.2 opacity (`--carousel-hint-dimmed` now defaults to 0): a hint parked at 20% was still text to an audit (1.34:1). all formats.
+  - The templates' `button` pattern becomes the toolkit's `btn` affordance (`fill: false`, transparent, text colour inherited), as `defaultSiteConfig()` already shipped: the old filled entry lost its white text to the new `link` pattern on `<a class="btn">` (dark green on green, 1.36:1). A filled call to action is `.cta`.
+  - The templates move the `info` and `danger` solids to step 700. Their step-600 solids (sky, rose) clear the generator's APCA bar for `text-on-<role>` (Lc 60) but not WCAG AA's 4.5:1 that axe and Lighthouse apply (4.2:1 and 4.4:1), so a `.cta-info` or a CTA inside an `info` callout failed the audit. Step 700 reads at 6.4:1 and 6.8:1 with the recomputed text. The APCA/WCAG gap in the contract itself is logged in TODO.md.
+  - @getvitops/config@8.3.0-alpha.4
+
 ## 8.3.0-alpha.3
 
 ### Patch Changes

package/dist/ads/index.d.mts

@@ -1,93 +1,4 @@
-import { AdPropertyConfig } from "@getvitops/config";
-import { AdProvider as AdProvider$1 } from "@getvitops/config/providers";
-/**
- * The ad platforms this toolchain knows how to link a site to.
- *
- * A closed set, and `AD_PROVIDERS` in `@getvitops/config` is its single source: the capability
- * table in `providers.ts` is a `Record<AdProvider, …>`, so a provider added there without an entry
- * here is a compile error. (This was a hand-copied union held to the schema's enum by a test in the
- * generator; the schema now lives below this package, so the copy and the test are gone.) An open
- * string would mean a typo'd provider silently getting no verification step and no tag.
- */
-type AdProvider = AdProvider$1;
-/** Which consent category gates a provider's tag. */
-type AdConsentCategory = 'marketing' | 'analytics';
-/**
- * The three interactions Google Ads can report a distinct conversion action
- * for. `form` is fired client-side via `vitopsFormConversion()`
- * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:
- * click handler.
- */
-type ConversionAction = 'call' | 'email' | 'form';
-/**
- * One label per action this site wants Google Ads to tell apart.
- *
- * Written out field by field, `?: string | undefined` — not
- * `Partial<Record<ConversionAction, string>>` — matching this file's own
- * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`
- * (present-or-absent) and `{ email?: string | undefined }` (present,
- * absent, or explicitly `undefined`) as different types, and a parsed JSON
- * config's optional field is the latter. `Partial<Record<...>>` produces the
- * former, which rejected the zod-inferred shape config.ts actually produces.
- */
-interface ConversionLabelMap {
-  call?: string | undefined;
-  email?: string | undefined;
-  form?: string | undefined;
-}
-/**
- * A bare string is back-compat shorthand for `{ call: label }` — the only
- * action that existed before this was a map. Absent input normalises to `{}`.
- */
-export declare function normalizeConversionLabels(label: string | ConversionLabelMap | undefined): ConversionLabelMap;
-/**
- * One Google Ads conversion action **resource id** per action this site
- * uploads server-side — a numeric id (`"123456789"`) or a full resource name
- * (`"customers/123/conversionActions/456"`), never the `conversionLabel`
- * string. Written out field by field for the same `exactOptionalPropertyTypes`
- * reason as `ConversionLabelMap` above.
- *
- * **This is a genuinely different identifier from `conversionLabel`, not an
- * alternate spelling of it.** `conversionLabel` is the opaque label the web
- * tag embeds in `send_to: "AW-…/label"` — it identifies the conversion action
- * to `gtag.js`, not to the Ads API. The API's click-conversion upload
- * (`ConversionUploadService.UploadClickConversions`) addresses the action by
- * `conversion_action` **resource name**, a value the label cannot be turned
- * into locally — Google returns both when a conversion action is created, but
- * only the label ships to the browser today. Until something in this
- * toolchain calls `ConversionActionService` to create/list actions and print
- * both back, this field has to be copied in by hand from the Ads UI/API.
- */
-interface ConversionActionIdMap {
-  call?: string | undefined;
-  email?: string | undefined;
-  form?: string | undefined;
-}
-/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */
-export declare function normalizeConversionActionIds(id: string | ConversionActionIdMap | undefined): ConversionActionIdMap;
-/** One ad property to link: the config block, plus the platform it is keyed by. */
-type AdPropertySetup = AdPropertyConfig & {
-  provider: AdProvider;
-};
-/** Everything `plan()` needs, once the CLI has read the config. */
-interface AdsConfig {
-  /** The properties to link. Already filtered to `--provider` if that was passed. */
-  properties: AdPropertySetup[];
-}
-/**
- * One property's observed live state, gathered by the executor before planning.
- *
- * Same shape of arrangement as `DomainState`: the decision is pure, the
- * observation is not. `txtContents` is every apex TXT record on the domain, so
- * the planner can decide both "our record is present" and "a *different* record
- * from this provider is present" — the second is a token rotation, which needs
- * saying rather than silently adding a second record.
- */
-interface AdDomainState {
-  zoneId?: string | undefined;
-  /** Every apex TXT record content, unquoted. */
-  txtContents: string[];
-}
+import { a as AdsConfig, c as ConversionLabelMap, i as AdProvider, l as normalizeConversionActionIds, n as AdDomainState, o as ConversionAction, r as AdPropertySetup, s as ConversionActionIdMap, t as AdConsentCategory, u as normalizeConversionLabels } from "../types-C0hQKdsM.mjs";
 /** A step's decision. `blocked` means the config is missing something. */
 type StepAction = 'create' | 'skip' | 'blocked';
 /** A config field the operator can supply to unblock a step. */
@@ -198,6 +109,14 @@ interface AdPlatform {
   operatorCountry: string;
   /** Click-ID parameters this platform stamps on an ad landing URL. */
   clickIdParams: string[];
+  /**
+   * Can the platform itself swap a forwarding number into the website for its own
+   * visitors? Only Google can (website call conversions, Canada included). Microsoft's
+   * forwarding numbers exist only inside the ad, and only in the US/UK/AU; every other
+   * platform offers none. A site wanting a per-platform number provisions its own and
+   * states it in `site.tracking.phoneNumbers`.
+   */
+  websiteCallTracking: boolean;
   /** Where the operator manages the property. */
   consoleUrl: string;
   verification: AdVerificationSpec;
@@ -236,5 +155,5 @@ export declare const categoryOf: (entry: AdPropertySetup) => AdConsentCategory;
  * than emit a snippet that initialises `undefined`.
  */
 export declare function renderTag(entry: AdPropertySetup, strategy?: 'idle' | 'async' | 'interaction'): string | null;
-export type { AdConsentCategory, AdDomainState, AdPlatform, AdPropertyPlan, AdPropertyResult, AdPropertySetup, AdProvider, AdTagSpec, AdVerificationSpec, AdsConfig, AdsPlan, ConversionAction, ConversionActionIdMap, ConversionLabelMap, MissingField, StepAction, StepPlan };
+export { type AdConsentCategory, type AdDomainState, type AdPlatform, type AdPropertyPlan, type AdPropertyResult, type AdPropertySetup, type AdProvider, type AdTagSpec, type AdVerificationSpec, type AdsConfig, type AdsPlan, type ConversionAction, type ConversionActionIdMap, type ConversionLabelMap, type MissingField, type StepAction, type StepPlan, normalizeConversionActionIds, normalizeConversionLabels };
 //# sourceMappingURL=index.d.mts.map

package/dist/ads/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":["AdProviderConfig"],"sources":["../../src/ads/types.ts","../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;;;;;;;;;;KAmBY,aAAaA;;KAGb;;;;;;;KAQA;;;;;;;;;;;;UAaK;EACf;EACA;EACA;;;;;;wBAOc,0BACd,gBAAgB,iCACf;;;;;;;;;;;;;;;;;;;UAuBc;EACf;EACA;EACA;;;wBAIc,6BACd,aAAa,oCACZ;;KAMS,kBAAkB;EAC5B,UAAU;;;UAIK;;EAEf,YAAY;;;;;;;;;;;UAYG;EACf;;EAEA;;;KC1FU;;KAGA;UAEK;EACf,QAAQ;;EAER;;EAEA,QAAQ;;;UAIO;EACf,UAAU;;EAEV;;EAEA;;EAEA,KAAK;;EAEL,KAAK;;EAEL;;EAEA;;UAGe;EACf,YAAY;;EAEZ;;;;;;;;;;;wBAYc,aAAa,OAAO,iBAAiB,OAAO,gBAAgB;;wBAoD5D,KAAK,QAAQ,WAAW,QAAQ,YAAY,iBAAiB;;wBAe7D,SAAS,GAAG;;wBAKZ,cAAc,GAAG;EAAY;EAAkB,OAAO;;;wBAYtD,WAAW,GAAG;;UAcb;EACf;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,SAAS;;UC7ItB;EACf;;;;;;;EAOA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,OAAO;;EAEP,YAAY,YAAY,OAAO;;;;;EAK/B;;EAEA;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA;;EAEA;;EAEA;EACA,cAAc;EACd,KAAK;;EAEL,cAAc,OAAO;;qBAwDV,cAAc,OAAO,YAAY;;qBAuMjC,kBAAgD;;qBAGhD,eAAgB,kBAAgB,SAAS;;;;;;;;;;wBAWtC,UAAU,UAAU,YAAY;;wBAOhC,MAAM,OAAO;;qBAMhB,aAAc,OAAO,oBAAkB;;;;;;;;;;;;wBAiBpC,UACd,OAAO,iBACP"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/ads/plan.ts","../../src/ads/providers.ts"],"mappings":";;KAyBY;;KAGA;UAEK;EACf,QAAQ;;EAER;;EAEA,QAAQ;;;UAIO;EACf,UAAU;;EAEV;;EAEA;;EAEA,KAAK;;EAEL,KAAK;;EAEL;;EAEA;;UAGe;EACf,YAAY;;EAEZ;;;;;;;;;;;wBAYc,aAAa,OAAO,iBAAiB,OAAO,gBAAgB;;wBAoD5D,KAAK,QAAQ,WAAW,QAAQ,YAAY,iBAAiB;;wBAe7D,SAAS,GAAG;;wBAKZ,cAAc,GAAG;EAAY;EAAkB,OAAO;;;wBAYtD,WAAW,GAAG;;UAcb;EACf;EACA;EACA;EACA;EACA;;;wBAIc,cAAc,SAAS;;UC7ItB;EACf;;;;;;;EAOA;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,OAAO;;EAEP,YAAY,YAAY,OAAO;;;;;EAK/B;;EAEA;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA;;EAEA;;;;;;;;EAQA;;EAEA;EACA,cAAc;EACd,KAAK;;EAEL,cAAc,OAAO;;qBAkFV,cAAc,OAAO,YAAY;;qBAwNjC,kBAAgD;;qBAGhD,eAAgB,kBAAgB,SAAS;;;;;;;;;;wBAWtC,UAAU,UAAU,YAAY;;wBAOhC,MAAM,OAAO;;qBAMhB,aAAc,OAAO,oBAAkB;;;;;;;;;;;;wBAiBpC,UACd,OAAO,iBACP"}

package/dist/ads/index.mjs

@@ -1,318 +1,5 @@
 import { t as table } from "../plan-format-CIz6Feg2.mjs";
-
-// src/ads/types.ts
-/**
-* A bare string is back-compat shorthand for `{ call: label }` — the only
-* action that existed before this was a map. Absent input normalises to `{}`.
-*/
-function normalizeConversionLabels(label) {
-	if (label == null) return {};
-	return typeof label === "string" ? { call: label } : label;
-}
-/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */
-function normalizeConversionActionIds(id) {
-	if (id == null) return {};
-	return typeof id === "string" ? { call: id } : id;
-}
-
-// src/ads/providers.ts
-/**
-* What each ad platform actually lets a build tool do — the table every `vitops ads`
-* subcommand reads.
-*
-* Written the way the indexing module was written: start from what the platforms
-* accept, because it is much narrower than it looks, and record the *absence* of a
-* path as a fact rather than leaving it as a gap.
-*
-*  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,
-*    Snapchat). That record is the one thing here that can be created for you.
-*  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,
-*    Microsoft Ads). Linking is the tag and the account id, nothing else. Those
-*    resolve to a skip *plus* a named reason — a silent omission would read as
-*    "already done".
-*  - **No platform Marketing API is called.** Meta's Business Management
-*    `verify_domain` needs a system-user token; the Google Ads API needs an
-*    approved developer token and puts the consumer's own account on the line.
-*    That is the same reasoning that keeps the Google Indexing API unwired: a
-*    toolchain other people install must not ship a documented path to a terms
-*    violation. The final "Verify" click stays a reminder.
-*
-* The verification token is **not a secret** — it is published in DNS, and the
-* platform fetching it back is the ownership proof, exactly like the IndexNow key.
-* So it lives in the config while credentials stay in the environment.
-*
-* Each tag is the platform's documented bootstrap reduced to its queue stub, with
-* the remote library on `data-src` for the consent gate to attach after the
-* bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body
-* first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a
-* snippet that creates its own `<script>`; those declare no `src`, and their body
-* stays inert until activation, so an undecided visitor still issues no request.
-*/
-/**
-* `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.
-*
-* `gtag('config', id)` only loads the tag — it never reports a conversion. When
-* `entry.conversionLabel` names one or more actions, this also exposes a
-* `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry
-* per configured action, so a call, an email click and a form submission each
-* carry their own `send_to` target instead of all three sharing one (that
-* sharing was a real bug: a call and an email click used to report as the same
-* Google Ads conversion action, indistinguishable in the account). Bootstrap
-* time only loads the tag; `scripts/tracking.ts`'s click handler and
-* `vitopsFormConversion()` each read their own action's key and fire
-* `gtag('event', 'conversion', …)` at the moment of the actual interaction —
-* bootstrap-time firing would count every pageview as a conversion.
-*
-* `entry` is trusted here — `resolveAds()` validates every configured label
-* against `SAFE_ID` before it reaches this function, the same guard `id`
-* already gets.
-*
-* **`entry.reporting === 'server'` suppresses an action here, never
-* silently.** An action fires client-side unless reporting is `'server'`
-* *and* that same action has a `conversionActionId` configured — so turning
-* reporting to `'server'` before the id is filled in leaves the action firing
-* client-side rather than dropping the conversion. Once both are set, the
-* server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,
-* wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one
-* place that action reports from — this is what avoids double-counting.
-*/
-const gtagBootstrap = (id, entry) => {
-	const labels = normalizeConversionLabels(entry.conversionLabel);
-	const actionIds = normalizeConversionActionIds(entry.conversionActionId);
-	const actions = Object.entries(labels).filter((pair) => !!pair[1] && !(entry.reporting === "server" && !!actionIds[pair[0]]));
-	return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('js',new Date());gtag('config','${id}');` + (actions.length ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};window.vitopsAdsConversions.google=${JSON.stringify(Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])))};` : "");
-};
-/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */
-const queueStub = (global, methods) => `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};window.${global}.methods=${methods};`;
-const AD_PLATFORMS = {
-	google: {
-		name: "Google Ads",
-		operatorCountry: "the United States",
-		clickIdParams: [
-			"gclid",
-			"gbraid",
-			"wbraid"
-		],
-		consoleUrl: "https://ads.google.com/",
-		verification: {
-			method: "none",
-			reason: "Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)"
-		},
-		tag: {
-			needs: "pixelId",
-			src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,
-			bootstrap: gtagBootstrap,
-			cookies: [
-				"_gcl_au",
-				"_gcl_aw",
-				"_gcl_dc",
-				"_gac_*"
-			],
-			privacyUrl: "https://policies.google.com/privacy",
-			optOut: "https://adssettings.google.com/"
-		},
-		manualSteps: (e) => [...Object.keys(normalizeConversionLabels(e.conversionLabel)).length ? [] : ["create a conversion action in Google Ads and record its label as `conversionLabel`"], "link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions"]
-	},
-	meta: {
-		name: "Meta",
-		operatorCountry: "the United States",
-		clickIdParams: ["fbclid"],
-		consoleUrl: "https://business.facebook.com/settings/owned-domains",
-		verification: {
-			method: "dns-txt",
-			txtPrefix: "facebook-domain-verification=",
-			where: "Business settings → Brand safety → Domains → Add → DNS verification"
-		},
-		tag: {
-			needs: "pixelId",
-			src: () => "https://connect.facebook.net/en_US/fbevents.js",
-			bootstrap: (id) => `${queueStub("fbq", `['init','track','trackCustom','consent']`)}fbq('init','${id}');fbq('track','PageView');`,
-			cookies: ["_fbp", "_fbc"],
-			privacyUrl: "https://www.facebook.com/privacy/policy/",
-			optOut: "https://www.facebook.com/adpreferences/ad_settings"
-		},
-		manualSteps: () => ["click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called"]
-	},
-	linkedin: {
-		name: "LinkedIn",
-		operatorCountry: "the United States",
-		clickIdParams: ["li_fat_id"],
-		consoleUrl: "https://www.linkedin.com/campaignmanager/",
-		verification: {
-			method: "none",
-			reason: "LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)"
-		},
-		tag: {
-			needs: "accountId",
-			src: () => "https://snap.licdn.com/li.lms-analytics/insight.min.js",
-			bootstrap: (id) => `window._linkedin_partner_id='${id}';window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];window._linkedin_data_partner_ids.push('${id}');`,
-			cookies: [
-				"li_sugr",
-				"li_gc",
-				"bcookie",
-				"lidc",
-				"UserMatchHistory"
-			],
-			privacyUrl: "https://www.linkedin.com/legal/privacy-policy",
-			optOut: "https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out"
-		},
-		manualSteps: () => ["add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions"]
-	},
-	reddit: {
-		name: "Reddit",
-		operatorCountry: "the United States",
-		clickIdParams: ["rdt_cid"],
-		consoleUrl: "https://ads.reddit.com/",
-		verification: {
-			method: "none",
-			reason: "Reddit Ads has no domain verification — the Reddit Pixel is the link."
-		},
-		tag: {
-			needs: "pixelId",
-			src: () => "https://www.redditstatic.com/ads/pixel.js",
-			bootstrap: (id) => `${queueStub("rdt", `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,
-			cookies: ["_rdt_uuid"],
-			privacyUrl: "https://www.reddit.com/policies/privacy-policy"
-		},
-		manualSteps: () => []
-	},
-	tiktok: {
-		name: "TikTok",
-		operatorCountry: "Singapore",
-		clickIdParams: ["ttclid"],
-		consoleUrl: "https://ads.tiktok.com/",
-		verification: {
-			method: "dns-txt",
-			txtPrefix: "tiktok-developers-site-verification=",
-			where: "Ads Manager → Assets → Events → Web events → Verify domain → DNS"
-		},
-		tag: {
-			needs: "pixelId",
-			src: (id) => `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,
-			bootstrap: (id) => `window.TiktokAnalyticsObject='ttq';${queueStub("ttq", `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}ttq('init','${id}');ttq('page');`,
-			cookies: ["_ttp"],
-			privacyUrl: "https://www.tiktok.com/legal/privacy-policy"
-		},
-		manualSteps: () => []
-	},
-	microsoft: {
-		name: "Microsoft Ads",
-		operatorCountry: "the United States",
-		clickIdParams: ["msclkid"],
-		consoleUrl: "https://ads.microsoft.com/",
-		verification: {
-			method: "none",
-			reason: "Microsoft Ads has no domain verification — the UET tag is the link."
-		},
-		tag: {
-			needs: "pixelId",
-			bootstrap: (id) => `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,
-			cookies: [
-				"_uetsid",
-				"_uetvid",
-				"MUID"
-			],
-			privacyUrl: "https://privacy.microsoft.com/privacystatement",
-			optOut: "https://account.microsoft.com/privacy/ad-settings"
-		},
-		manualSteps: () => []
-	},
-	pinterest: {
-		name: "Pinterest",
-		operatorCountry: "the United States",
-		clickIdParams: ["epik"],
-		consoleUrl: "https://ads.pinterest.com/",
-		verification: {
-			method: "dns-txt",
-			txtPrefix: "pinterest-site-verification=",
-			where: "Business hub → Claim → Websites → Claim → Add TXT record"
-		},
-		tag: {
-			needs: "pixelId",
-			bootstrap: (id) => `${queueStub("pintrk", `['load','page','track']`)}!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();pintrk('load','${id}');pintrk('page');`,
-			cookies: [
-				"_pinterest_ct_ua",
-				"_pin_unauth",
-				"_epik"
-			],
-			privacyUrl: "https://policy.pinterest.com/privacy-policy"
-		},
-		manualSteps: () => ["confirm the claim in Business hub → Claim once the TXT record has propagated"]
-	},
-	snapchat: {
-		name: "Snapchat",
-		operatorCountry: "the United States",
-		clickIdParams: ["ScCid"],
-		consoleUrl: "https://ads.snapchat.com/",
-		verification: {
-			method: "dns-txt",
-			txtPrefix: "snap-domain-verification=",
-			where: "Business Manager → Public Profiles / Domains → Verify domain → DNS"
-		},
-		tag: {
-			needs: "pixelId",
-			src: () => "https://sc-static.net/scevent.min.js",
-			bootstrap: (id) => `${queueStub("snaptr", `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,
-			cookies: [
-				"_scid",
-				"_scid_r",
-				"sc_at"
-			],
-			privacyUrl: "https://snap.com/privacy/privacy-policy"
-		},
-		manualSteps: () => []
-	}
-};
-/** Every provider, in table order — the one place iteration order is decided. */
-const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS);
-/** Whether a string names a known provider (for CLI arg validation). */
-const isAdProvider = (value) => value in AD_PLATFORMS;
-/**
-* The DNS TXT record content for a token.
-*
-* A value already containing `=` is taken as the whole record and left alone. That
-* is the same escape hatch an icon name containing `:` gets: a platform can change
-* its prefix spelling without waiting on a toolchain release, and an operator who
-* pasted the full record from the UI gets what they meant rather than a
-* double-prefixed record that verifies against nothing.
-*/
-function txtRecord(provider, token) {
-	const trimmed = token.trim();
-	if (trimmed.includes("=")) return trimmed;
-	return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ""}${trimmed}`;
-}
-/** The tag id for an entry, or undefined when the field it needs is unset. */
-function tagId(entry) {
-	return entry[AD_PLATFORMS[entry.provider].tag.needs];
-}
-/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */
-const categoryOf = (entry) => entry.category ?? "marketing";
-const escapeAttr = (value) => value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
-/**
-* One provider's tag, rendered as a **consent-gated, inert** `<script>`.
-*
-* `type="text/plain"` with the URL on `data-src` is what makes the gate real: the
-* browser neither parses the body nor fetches the library, so an undecided
-* visitor's page issues no third-party request. Never give one of these a live
-* `src` — a gate that instead asks a loaded tracker not to track is a promise.
-*
-* Returns null when the entry has no tag id, so a caller can report the gap rather
-* than emit a snippet that initialises `undefined`.
-*/
-function renderTag(entry, strategy = "idle") {
-	const platform = AD_PLATFORMS[entry.provider];
-	const id = tagId(entry);
-	if (!id) return null;
-	const attrs = [
-		"type=\"text/plain\"",
-		"data-vitops-tag",
-		`data-consent="${categoryOf(entry)}"`,
-		`data-strategy="${strategy}"`,
-		...platform.tag.src ? [`data-src="${escapeAttr(platform.tag.src(id))}"`] : [],
-		`data-consent-cookies="${escapeAttr(platform.tag.cookies.join(","))}"`
-	];
-	return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\n<script ${attrs.join(" ")}>${platform.tag.bootstrap(id, entry)}<\/script>`;
-}
+import { a as renderTag, c as normalizeConversionActionIds, i as isAdProvider, l as normalizeConversionLabels, n as AD_PROVIDER_KEYS, o as tagId, r as categoryOf, s as txtRecord, t as AD_PLATFORMS } from "../providers-CEHw-j4v.mjs";
 
 // src/ads/plan.ts
 /**

package/dist/ads/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/ads/types.ts","../../src/ads/providers.ts","../../src/ads/plan.ts"],"sourcesContent":["/**\n * The ads module's own option surface.\n *\n * `AdPropertySetup` is the `site.ads.<platform>` block from `@getvitops/config` plus the platform it\n * is keyed by — inferred from the schema `validateConfig` runs, not re-declared here.\n */\n\nimport type { AdPropertyConfig } from '@getvitops/config';\nimport type { AdProvider as AdProviderConfig } from '@getvitops/config/providers';\n\n/**\n * The ad platforms this toolchain knows how to link a site to.\n *\n * A closed set, and `AD_PROVIDERS` in `@getvitops/config` is its single source: the capability\n * table in `providers.ts` is a `Record<AdProvider, …>`, so a provider added there without an entry\n * here is a compile error. (This was a hand-copied union held to the schema's enum by a test in the\n * generator; the schema now lives below this package, so the copy and the test are gone.) An open\n * string would mean a typo'd provider silently getting no verification step and no tag.\n */\nexport type AdProvider = AdProviderConfig;\n\n/** Which consent category gates a provider's tag. */\nexport type AdConsentCategory = 'marketing' | 'analytics';\n\n/**\n * The three interactions Google Ads can report a distinct conversion action\n * for. `form` is fired client-side via `vitopsFormConversion()`\n * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:\n * click handler.\n */\nexport type ConversionAction = 'call' | 'email' | 'form';\n\n/**\n * One label per action this site wants Google Ads to tell apart.\n *\n * Written out field by field, `?: string | undefined` — not\n * `Partial<Record<ConversionAction, string>>` — matching this file's own\n * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`\n * (present-or-absent) and `{ email?: string | undefined }` (present,\n * absent, or explicitly `undefined`) as different types, and a parsed JSON\n * config's optional field is the latter. `Partial<Record<...>>` produces the\n * former, which rejected the zod-inferred shape config.ts actually produces.\n */\nexport interface ConversionLabelMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/**\n * A bare string is back-compat shorthand for `{ call: label }` — the only\n * action that existed before this was a map. Absent input normalises to `{}`.\n */\nexport function normalizeConversionLabels(\n  label: string | ConversionLabelMap | undefined,\n): ConversionLabelMap {\n  if (label == null) return {};\n  return typeof label === 'string' ? { call: label } : label;\n}\n\n/**\n * One Google Ads conversion action **resource id** per action this site\n * uploads server-side — a numeric id (`\"123456789\"`) or a full resource name\n * (`\"customers/123/conversionActions/456\"`), never the `conversionLabel`\n * string. Written out field by field for the same `exactOptionalPropertyTypes`\n * reason as `ConversionLabelMap` above.\n *\n * **This is a genuinely different identifier from `conversionLabel`, not an\n * alternate spelling of it.** `conversionLabel` is the opaque label the web\n * tag embeds in `send_to: \"AW-…/label\"` — it identifies the conversion action\n * to `gtag.js`, not to the Ads API. The API's click-conversion upload\n * (`ConversionUploadService.UploadClickConversions`) addresses the action by\n * `conversion_action` **resource name**, a value the label cannot be turned\n * into locally — Google returns both when a conversion action is created, but\n * only the label ships to the browser today. Until something in this\n * toolchain calls `ConversionActionService` to create/list actions and print\n * both back, this field has to be copied in by hand from the Ads UI/API.\n */\nexport interface ConversionActionIdMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */\nexport function normalizeConversionActionIds(\n  id: string | ConversionActionIdMap | undefined,\n): ConversionActionIdMap {\n  if (id == null) return {};\n  return typeof id === 'string' ? { call: id } : id;\n}\n\n/** One ad property to link: the config block, plus the platform it is keyed by. */\nexport type AdPropertySetup = AdPropertyConfig & {\n  provider: AdProvider;\n};\n\n/** Everything `plan()` needs, once the CLI has read the config. */\nexport interface AdsConfig {\n  /** The properties to link. Already filtered to `--provider` if that was passed. */\n  properties: AdPropertySetup[];\n}\n\n/**\n * One property's observed live state, gathered by the executor before planning.\n *\n * Same shape of arrangement as `DomainState`: the decision is pure, the\n * observation is not. `txtContents` is every apex TXT record on the domain, so\n * the planner can decide both \"our record is present\" and \"a *different* record\n * from this provider is present\" — the second is a token rotation, which needs\n * saying rather than silently adding a second record.\n */\nexport interface AdDomainState {\n  zoneId?: string | undefined;\n  /** Every apex TXT record content, unquoted. */\n  txtContents: string[];\n}\n","/**\n * What each ad platform actually lets a build tool do — the table every `vitops ads`\n * subcommand reads.\n *\n * Written the way the indexing module was written: start from what the platforms\n * accept, because it is much narrower than it looks, and record the *absence* of a\n * path as a fact rather than leaving it as a gap.\n *\n *  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,\n *    Snapchat). That record is the one thing here that can be created for you.\n *  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,\n *    Microsoft Ads). Linking is the tag and the account id, nothing else. Those\n *    resolve to a skip *plus* a named reason — a silent omission would read as\n *    \"already done\".\n *  - **No platform Marketing API is called.** Meta's Business Management\n *    `verify_domain` needs a system-user token; the Google Ads API needs an\n *    approved developer token and puts the consumer's own account on the line.\n *    That is the same reasoning that keeps the Google Indexing API unwired: a\n *    toolchain other people install must not ship a documented path to a terms\n *    violation. The final \"Verify\" click stays a reminder.\n *\n * The verification token is **not a secret** — it is published in DNS, and the\n * platform fetching it back is the ownership proof, exactly like the IndexNow key.\n * So it lives in the config while credentials stay in the environment.\n *\n * Each tag is the platform's documented bootstrap reduced to its queue stub, with\n * the remote library on `data-src` for the consent gate to attach after the\n * bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body\n * first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a\n * snippet that creates its own `<script>`; those declare no `src`, and their body\n * stays inert until activation, so an undecided visitor still issues no request.\n */\nimport { normalizeConversionActionIds, normalizeConversionLabels } from './types.ts';\nimport type { AdConsentCategory, AdProvider, AdPropertySetup } from './types.ts';\n\n/** How a platform proves you own the domain. */\nexport interface AdVerificationSpec {\n  method: 'dns-txt' | 'none';\n  /**\n   * Prefix prepended to a bare token to form the record content. Owned here so a\n   * config holds the token the platform shows, not a hand-assembled record — but\n   * see `txtRecord`: a value already containing `=` passes through whole, which is\n   * the escape hatch when a platform changes its spelling.\n   */\n  txtPrefix?: string;\n  /** Where in the platform UI the token is found. Printed when asking for it. */\n  where?: string;\n  /** Why there is nothing to automate. Required when `method` is `none`. */\n  reason?: string;\n}\n\n/** The tag, and which config field carries its id. */\nexport interface AdTagSpec {\n  /** Which field the tag id comes from — and therefore what to ask for when absent. */\n  needs: 'pixelId' | 'accountId';\n  /** The remote library. Absent when the platform's own bootstrap loads itself. */\n  src?: (id: string) => string;\n  /** The inline bootstrap, which the gate runs before attaching `src`. */\n  bootstrap: (id: string, entry: AdPropertySetup) => string;\n  /**\n   * Cookies the tag sets, for `data-consent-cookies` (what a revoke clears) and\n   * for the generated cookie notice. A `*` suffix is a prefix match.\n   */\n  cookies: string[];\n  /** The provider's own privacy policy, for the cookie notice. */\n  privacyUrl: string;\n  /** A visitor-facing opt-out, where the platform offers one. */\n  optOut?: string;\n}\n\nexport interface AdPlatform {\n  /** The platform as a reader would recognise it. */\n  name: string;\n  /**\n   * The jurisdiction that can compel this platform to produce what it receives —\n   * where the contracting entity is established. Feeds the generated privacy\n   * policy's cross-border transfer disclosure, which is a claim about foreign\n   * *access*, not foreign storage (see `Processor.operatorCountry` in the\n   * generator's `legal/providers.ts`). A consumer whose contracting entity differs\n   * declares their own processor entry instead.\n   */\n  operatorCountry: string;\n  /** Click-ID parameters this platform stamps on an ad landing URL. */\n  clickIdParams: string[];\n  /** Where the operator manages the property. */\n  consoleUrl: string;\n  verification: AdVerificationSpec;\n  tag: AdTagSpec;\n  /** Follow-ups no API covers, given this entry. */\n  manualSteps: (entry: AdPropertySetup) => string[];\n}\n\n/**\n * `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.\n *\n * `gtag('config', id)` only loads the tag — it never reports a conversion. When\n * `entry.conversionLabel` names one or more actions, this also exposes a\n * `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry\n * per configured action, so a call, an email click and a form submission each\n * carry their own `send_to` target instead of all three sharing one (that\n * sharing was a real bug: a call and an email click used to report as the same\n * Google Ads conversion action, indistinguishable in the account). Bootstrap\n * time only loads the tag; `scripts/tracking.ts`'s click handler and\n * `vitopsFormConversion()` each read their own action's key and fire\n * `gtag('event', 'conversion', …)` at the moment of the actual interaction —\n * bootstrap-time firing would count every pageview as a conversion.\n *\n * `entry` is trusted here — `resolveAds()` validates every configured label\n * against `SAFE_ID` before it reaches this function, the same guard `id`\n * already gets.\n *\n * **`entry.reporting === 'server'` suppresses an action here, never\n * silently.** An action fires client-side unless reporting is `'server'`\n * *and* that same action has a `conversionActionId` configured — so turning\n * reporting to `'server'` before the id is filled in leaves the action firing\n * client-side rather than dropping the conversion. Once both are set, the\n * server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,\n * wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one\n * place that action reports from — this is what avoids double-counting.\n */\nconst gtagBootstrap = (id: string, entry: AdPropertySetup): string => {\n  const labels = normalizeConversionLabels(entry.conversionLabel);\n  const actionIds = normalizeConversionActionIds(entry.conversionActionId);\n  const actions = Object.entries(labels).filter(\n    (pair): pair is [string, string] =>\n      !!pair[1] &&\n      !(entry.reporting === 'server' && !!actionIds[pair[0] as keyof typeof actionIds]),\n  );\n  return (\n    `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}` +\n    `gtag('js',new Date());gtag('config','${id}');` +\n    (actions.length\n      ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};` +\n        `window.vitopsAdsConversions.google=${JSON.stringify(\n          Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])),\n        )};`\n      : '')\n  );\n};\n\n/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */\nconst queueStub = (global: string, methods: string): string =>\n  `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};` +\n  `window.${global}.methods=${methods};`;\n\nexport const AD_PLATFORMS: Record<AdProvider, AdPlatform> = {\n  google: {\n    name: 'Google Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['gclid', 'gbraid', 'wbraid'],\n    consoleUrl: 'https://ads.google.com/',\n    verification: {\n      method: 'none',\n      reason:\n        'Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)',\n    },\n    tag: {\n      // The customer id (`123-456-7890`) is not the tag id: the conversion tag is\n      // `AW-…`, which is why this asks for `pixelId` rather than reusing accountId.\n      needs: 'pixelId',\n      src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,\n      bootstrap: gtagBootstrap,\n      cookies: ['_gcl_au', '_gcl_aw', '_gcl_dc', '_gac_*'],\n      privacyUrl: 'https://policies.google.com/privacy',\n      optOut: 'https://adssettings.google.com/',\n    },\n    manualSteps: (e) => [\n      ...(Object.keys(normalizeConversionLabels(e.conversionLabel)).length\n        ? []\n        : ['create a conversion action in Google Ads and record its label as `conversionLabel`']),\n      'link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions',\n    ],\n  },\n\n  meta: {\n    name: 'Meta',\n    operatorCountry: 'the United States',\n    clickIdParams: ['fbclid'],\n    consoleUrl: 'https://business.facebook.com/settings/owned-domains',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'facebook-domain-verification=',\n      where: 'Business settings → Brand safety → Domains → Add → DNS verification',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://connect.facebook.net/en_US/fbevents.js',\n      bootstrap: (id) =>\n        `${queueStub('fbq', `['init','track','trackCustom','consent']`)}` +\n        `fbq('init','${id}');fbq('track','PageView');`,\n      cookies: ['_fbp', '_fbc'],\n      privacyUrl: 'https://www.facebook.com/privacy/policy/',\n      optOut: 'https://www.facebook.com/adpreferences/ad_settings',\n    },\n    manualSteps: () => [\n      'click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called',\n    ],\n  },\n\n  linkedin: {\n    name: 'LinkedIn',\n    operatorCountry: 'the United States',\n    clickIdParams: ['li_fat_id'],\n    consoleUrl: 'https://www.linkedin.com/campaignmanager/',\n    verification: {\n      method: 'none',\n      reason:\n        'LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)',\n    },\n    tag: {\n      needs: 'accountId',\n      src: () => 'https://snap.licdn.com/li.lms-analytics/insight.min.js',\n      bootstrap: (id) =>\n        `window._linkedin_partner_id='${id}';` +\n        `window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];` +\n        `window._linkedin_data_partner_ids.push('${id}');`,\n      cookies: ['li_sugr', 'li_gc', 'bcookie', 'lidc', 'UserMatchHistory'],\n      privacyUrl: 'https://www.linkedin.com/legal/privacy-policy',\n      optOut: 'https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out',\n    },\n    manualSteps: () => [\n      'add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions',\n    ],\n  },\n\n  reddit: {\n    name: 'Reddit',\n    operatorCountry: 'the United States',\n    clickIdParams: ['rdt_cid'],\n    consoleUrl: 'https://ads.reddit.com/',\n    verification: {\n      method: 'none',\n      reason: 'Reddit Ads has no domain verification — the Reddit Pixel is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://www.redditstatic.com/ads/pixel.js',\n      bootstrap: (id) =>\n        `${queueStub('rdt', `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,\n      cookies: ['_rdt_uuid'],\n      privacyUrl: 'https://www.reddit.com/policies/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  tiktok: {\n    name: 'TikTok',\n    operatorCountry: 'Singapore',\n    clickIdParams: ['ttclid'],\n    consoleUrl: 'https://ads.tiktok.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'tiktok-developers-site-verification=',\n      where: 'Ads Manager → Assets → Events → Web events → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: (id) =>\n        `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,\n      bootstrap: (id) =>\n        `window.TiktokAnalyticsObject='ttq';` +\n        `${queueStub('ttq', `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}` +\n        `ttq('init','${id}');ttq('page');`,\n      cookies: ['_ttp'],\n      privacyUrl: 'https://www.tiktok.com/legal/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  microsoft: {\n    name: 'Microsoft Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['msclkid'],\n    consoleUrl: 'https://ads.microsoft.com/',\n    verification: {\n      method: 'none',\n      reason: 'Microsoft Ads has no domain verification — the UET tag is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      // No `src`: UET must be constructed *after* bat.js evaluates, so the\n      // platform's own snippet attaches an onload handler to a script it creates.\n      // Inert until activation all the same — the body is never parsed before then.\n      bootstrap: (id) =>\n        `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};` +\n        `o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,` +\n        `n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},` +\n        `i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,\n      cookies: ['_uetsid', '_uetvid', 'MUID'],\n      privacyUrl: 'https://privacy.microsoft.com/privacystatement',\n      optOut: 'https://account.microsoft.com/privacy/ad-settings',\n    },\n    manualSteps: () => [],\n  },\n\n  pinterest: {\n    name: 'Pinterest',\n    operatorCountry: 'the United States',\n    clickIdParams: ['epik'],\n    consoleUrl: 'https://ads.pinterest.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'pinterest-site-verification=',\n      where: 'Business hub → Claim → Websites → Claim → Add TXT record',\n    },\n    tag: {\n      needs: 'pixelId',\n      // Pinterest's stub creates the script itself once `pintrk('load')` runs.\n      bootstrap: (id) =>\n        `${queueStub('pintrk', `['load','page','track']`)}` +\n        `!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';` +\n        `var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();` +\n        `pintrk('load','${id}');pintrk('page');`,\n      cookies: ['_pinterest_ct_ua', '_pin_unauth', '_epik'],\n      privacyUrl: 'https://policy.pinterest.com/privacy-policy',\n    },\n    manualSteps: () => [\n      'confirm the claim in Business hub → Claim once the TXT record has propagated',\n    ],\n  },\n\n  snapchat: {\n    name: 'Snapchat',\n    operatorCountry: 'the United States',\n    clickIdParams: ['ScCid'],\n    consoleUrl: 'https://ads.snapchat.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'snap-domain-verification=',\n      where: 'Business Manager → Public Profiles / Domains → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://sc-static.net/scevent.min.js',\n      bootstrap: (id) =>\n        `${queueStub('snaptr', `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,\n      cookies: ['_scid', '_scid_r', 'sc_at'],\n      privacyUrl: 'https://snap.com/privacy/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n};\n\n/** Every provider, in table order — the one place iteration order is decided. */\nexport const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS) as AdProvider[];\n\n/** Whether a string names a known provider (for CLI arg validation). */\nexport const isAdProvider = (value: string): value is AdProvider => value in AD_PLATFORMS;\n\n/**\n * The DNS TXT record content for a token.\n *\n * A value already containing `=` is taken as the whole record and left alone. That\n * is the same escape hatch an icon name containing `:` gets: a platform can change\n * its prefix spelling without waiting on a toolchain release, and an operator who\n * pasted the full record from the UI gets what they meant rather than a\n * double-prefixed record that verifies against nothing.\n */\nexport function txtRecord(provider: AdProvider, token: string): string {\n  const trimmed = token.trim();\n  if (trimmed.includes('=')) return trimmed;\n  return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ''}${trimmed}`;\n}\n\n/** The tag id for an entry, or undefined when the field it needs is unset. */\nexport function tagId(entry: AdPropertySetup): string | undefined {\n  const field = AD_PLATFORMS[entry.provider].tag.needs;\n  return entry[field];\n}\n\n/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */\nexport const categoryOf = (entry: AdPropertySetup): AdConsentCategory =>\n  entry.category ?? 'marketing';\n\nconst escapeAttr = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;');\n\n/**\n * One provider's tag, rendered as a **consent-gated, inert** `<script>`.\n *\n * `type=\"text/plain\"` with the URL on `data-src` is what makes the gate real: the\n * browser neither parses the body nor fetches the library, so an undecided\n * visitor's page issues no third-party request. Never give one of these a live\n * `src` — a gate that instead asks a loaded tracker not to track is a promise.\n *\n * Returns null when the entry has no tag id, so a caller can report the gap rather\n * than emit a snippet that initialises `undefined`.\n */\nexport function renderTag(\n  entry: AdPropertySetup,\n  strategy: 'idle' | 'async' | 'interaction' = 'idle',\n): string | null {\n  const platform = AD_PLATFORMS[entry.provider];\n  const id = tagId(entry);\n  if (!id) return null;\n  const attrs = [\n    'type=\"text/plain\"',\n    'data-vitops-tag',\n    `data-consent=\"${categoryOf(entry)}\"`,\n    `data-strategy=\"${strategy}\"`,\n    ...(platform.tag.src ? [`data-src=\"${escapeAttr(platform.tag.src(id))}\"`] : []),\n    `data-consent-cookies=\"${escapeAttr(platform.tag.cookies.join(','))}\"`,\n  ];\n  return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\\n<script ${attrs.join(' ')}>${platform.tag.bootstrap(id, entry)}</script>`;\n}\n","/**\n * Every decision `vitops ads setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The\n * executor gathers each domain's live DNS state and applies what it is told; this\n * module decides, from that state, what is left to do. The same split\n * `onboarding/plan.ts` makes, for the same two payoffs: `--dry` is a *complete*\n * account of a run, and `--check` is an honest drift report.\n *\n * Idempotency lives here — a step whose desired state already holds resolves to\n * `skip`, so a re-run of a linked property is all skips by construction rather than\n * by the executor checking twice.\n *\n * One thing this planner adds over the onboarding one: a step that cannot proceed\n * for want of a **config value** resolves to `blocked` carrying the field name in\n * `needs`. That is a machine-readable gap, which is what lets the CLI *ask* for the\n * missing token and re-plan, while the planner itself stays pure and knows nothing\n * about a terminal. A blocked step is drift, never a skip — the first run of a\n * property whose token has not been fetched yet must not read as \"already linked\".\n */\nimport { AD_PLATFORMS, tagId, txtRecord } from './providers.ts';\nimport type { AdDomainState, AdPropertySetup, AdsConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision. `blocked` means the config is missing something. */\nexport type StepAction = 'create' | 'skip' | 'blocked';\n\n/** A config field the operator can supply to unblock a step. */\nexport type MissingField = 'domainVerification' | 'accountId' | 'pixelId';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do, or what is missing. */\n  detail: string;\n  /** Set only on `blocked`: which config field would unblock it. */\n  needs?: MissingField | undefined;\n}\n\n/** The steps for one ad property, decided against its live state. */\nexport interface AdPropertyPlan {\n  provider: AdPropertySetup['provider'];\n  /** The platform name, so a formatter needn't reach back into the table. */\n  name: string;\n  /** The domain being verified, when the platform verifies one. */\n  domain?: string | undefined;\n  /** Ensure the apex verification TXT. */\n  txt: StepPlan;\n  /** Whether the tag can be emitted (`ads tags`). */\n  tag: StepPlan;\n  /** The exact TXT content to create, when `txt.action` is `create`. */\n  txtContent?: string | undefined;\n  /** Manual follow-ups — including *why* a platform has no verification step. */\n  reminders: string[];\n}\n\nexport interface AdsPlan {\n  properties: AdPropertyPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/**\n * Decide one property's steps.\n *\n * The `dns-txt` branch has three outcomes, and keeping them distinct is the point:\n * our record is present (skip), a *different* record from the same platform is\n * present (create, and say so — a token rotation leaves the old record in place,\n * since this command never edits or deletes DNS), or no token is configured yet\n * (blocked, naming the field).\n */\nexport function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan {\n  const platform = AD_PLATFORMS[setup.provider];\n  const reminders = [...platform.manualSteps(setup)];\n\n  let txt: StepPlan;\n  let txtContent: string | undefined;\n\n  if (platform.verification.method === 'none') {\n    txt = { action: 'skip', detail: platform.verification.reason ?? 'no domain verification' };\n  } else if (!setup.domainVerification) {\n    txt = {\n      action: 'blocked',\n      detail: `needs the verification token from ${platform.verification.where ?? platform.consoleUrl}`,\n      needs: 'domainVerification',\n    };\n  } else {\n    const desired = txtRecord(setup.provider, setup.domainVerification);\n    const prefix = platform.verification.txtPrefix;\n    const stale =\n      prefix != null && state.txtContents.some((c) => c.startsWith(prefix) && c !== desired);\n    txt = state.txtContents.includes(desired)\n      ? { action: 'skip', detail: 'verification TXT already present' }\n      : {\n          action: 'create',\n          detail: stale\n            ? 'create verification TXT (an older token from this platform is still present — remove it yourself; this command never deletes DNS)'\n            : 'create verification TXT',\n        };\n    if (txt.action === 'create') txtContent = desired;\n  }\n\n  const id = tagId(setup);\n  const tag: StepPlan = id\n    ? { action: 'skip', detail: `tag ready (${platform.tag.needs} ${id})` }\n    : {\n        action: 'blocked',\n        detail: `needs ${platform.tag.needs} from ${platform.consoleUrl} to emit the tag`,\n        needs: platform.tag.needs,\n      };\n\n  return {\n    provider: setup.provider,\n    name: platform.name,\n    ...(setup.domain ? { domain: setup.domain } : {}),\n    txt,\n    tag,\n    ...(txtContent ? { txtContent } : {}),\n    reminders,\n  };\n}\n\n/** Plan every configured property. */\nexport function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan {\n  const notes: string[] = [];\n  const properties = config.properties.map((setup) => {\n    const key = setup.domain ?? '';\n    const state = states.get(key);\n    if (!state && AD_PLATFORMS[setup.provider].verification.method === 'dns-txt')\n      // Should not happen — the CLI observes every verifiable domain before\n      // planning — but a missing observation must not read as \"nothing to do\".\n      notes.push(`${setup.provider}: no observed DNS state for ${key || '(no domain)'}`);\n    return planProperty(setup, state ?? { txtContents: [] });\n  });\n  return { properties, notes };\n}\n\n/** Any step that isn't a skip — i.e. the live state or the config has drifted. */\nexport function hasDrift(p: AdsPlan): boolean {\n  return p.properties.some((x) => x.txt.action !== 'skip' || x.tag.action !== 'skip');\n}\n\n/** Every field a run still needs, per provider — what the CLI asks for. */\nexport function missingFields(p: AdsPlan): { provider: string; needs: MissingField }[] {\n  const out: { provider: string; needs: MissingField }[] = [];\n  for (const x of p.properties) {\n    for (const step of [x.txt, x.tag]) {\n      if (step.action === 'blocked' && step.needs)\n        out.push({ provider: x.provider, needs: step.needs });\n    }\n  }\n  return out;\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: AdsPlan): string {\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : s.action === 'blocked' ? '?' : '+');\n  const lines: string[] = [];\n  for (const x of p.properties) {\n    lines.push(`${x.provider}${x.domain ? `  (${x.domain})` : ''}`);\n    lines.push(`  ${glyph(x.txt)} verify  ${x.txt.detail}`);\n    lines.push(`  ${glyph(x.tag)} tag     ${x.tag.detail}`);\n    for (const r of x.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one property's run, for the summary table. */\nexport interface AdPropertyResult {\n  provider: string;\n  domain: string;\n  txt: 'created' | 'present' | 'blocked' | 'failed' | 'n/a';\n  tag: 'ready' | 'blocked';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per property, plus any reminders. */\nexport function formatSummary(results: AdPropertyResult[]): string {\n  const headers = ['PROVIDER', 'DOMAIN', 'VERIFY', 'TAG'];\n  const rows = results.map((r) => [r.provider, r.domain, r.txt, r.tag]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`));\n  return table(headers, rows, reminders);\n}\n"],"mappings":";;;;;;;AAqDA,SAAgB,0BACd,OACoB;CACpB,IAAI,SAAS,MAAM,OAAO,CAAC;CAC3B,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD;;AA2BA,SAAgB,6BACd,IACuB;CACvB,IAAI,MAAM,MAAM,OAAO,CAAC;CACxB,OAAO,OAAO,OAAO,WAAW,EAAE,MAAM,GAAG,IAAI;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BA,MAAM,iBAAiB,IAAY,UAAmC;CACpE,MAAM,SAAS,0BAA0B,MAAM,eAAe;CAC9D,MAAM,YAAY,6BAA6B,MAAM,kBAAkB;CACvE,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpC,SACC,CAAC,CAAC,KAAK,MACP,EAAE,MAAM,cAAc,YAAY,CAAC,CAAC,UAAU,KAAK,IACvD;CACA,OACE,wHACwC,GAAG,QAC1C,QAAQ,SACL,kGACsC,KAAK,UACzC,OAAO,YAAY,QAAQ,KAAK,CAAC,QAAQ,WAAW,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CACjF,EAAE,KACF;AAER;;AAGA,MAAM,aAAa,QAAgB,YACjC,UAAU,OAAO,UAAU,OAAO,uBAAuB,OAAO,YAAY,OAAO,kCACzE,OAAO,WAAW,QAAQ;AAEtC,MAAa,eAA+C;CAC1D,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe;GAAC;GAAS;GAAU;EAAQ;EAC3C,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GAGH,OAAO;GACP,MAAM,OAAO,+CAA+C,mBAAmB,EAAE;GACjF,WAAW;GACX,SAAS;IAAC;IAAW;IAAW;IAAW;GAAQ;GACnD,YAAY;GACZ,QAAQ;EACV;EACA,cAAc,MAAM,CAClB,GAAI,OAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC,CAAC,CAAC,SAC1D,CAAC,IACD,CAAC,oFAAoF,GACzF,gGACF;CACF;CAEA,MAAM;EACJ,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,0CAA0C,gBAC/C,GAAG;GACpB,SAAS,CAAC,QAAQ,MAAM;GACxB,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,2KACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,WAAW;EAC3B,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,gCAAgC,GAAG,oHAEQ,GAAG;GAChD,SAAS;IAAC;IAAW;IAAS;IAAW;IAAQ;GAAkB;GACnE,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,kGACF;CACF;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,kBAAkB,EAAE,cAAc,GAAG;GAC3D,SAAS,CAAC,WAAW;GACrB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,MAAM,OACJ,2DAA2D,mBAAmB,EAAE,EAAE;GACpF,YAAY,OACV,sCACG,UAAU,OAAO,0HAA0H,gBAC/H,GAAG;GACpB,SAAS,CAAC,MAAM;GAChB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GAIP,YAAY,OACV,wEAAwE,GAAG;GAI7E,SAAS;IAAC;IAAW;IAAW;GAAM;GACtC,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,MAAM;EACtB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GAEP,YAAY,OACV,GAAG,UAAU,UAAU,yBAAyB,4MAG9B,GAAG;GACvB,SAAS;IAAC;IAAoB;IAAe;GAAO;GACpD,YAAY;EACd;EACA,mBAAmB,CACjB,8EACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,OAAO;EACvB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,UAAU,kBAAkB,EAAE,iBAAiB,GAAG;GACjE,SAAS;IAAC;IAAS;IAAW;GAAO;GACrC,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;AACF;;AAGA,MAAa,mBAAmB,OAAO,KAAK,YAAY;;AAGxD,MAAa,gBAAgB,UAAuC,SAAS;;;;;;;;;;AAW7E,SAAgB,UAAU,UAAsB,OAAuB;CACrE,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,QAAQ,SAAS,GAAG,GAAG,OAAO;CAClC,OAAO,GAAG,aAAa,SAAS,CAAC,aAAa,aAAa,KAAK;AAClE;;AAGA,SAAgB,MAAM,OAA4C;CAEhE,OAAO,MADO,aAAa,MAAM,SAAS,CAAC,IAAI;AAEjD;;AAGA,MAAa,cAAc,UACzB,MAAM,YAAY;AAEpB,MAAM,cAAc,UAClB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM;;;;;;;;;;;;AAa3E,SAAgB,UACd,OACA,WAA6C,QAC9B;CACf,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,KAAK,MAAM,KAAK;CACtB,IAAI,CAAC,IAAI,OAAO;CAChB,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB,WAAW,KAAK,EAAE;EACnC,kBAAkB,SAAS;EAC3B,GAAI,SAAS,IAAI,MAAM,CAAC,aAAa,WAAW,SAAS,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;EAC7E,yBAAyB,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE;CACtE;CACA,OAAO,QAAQ,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,IAAI,UAAU,IAAI,KAAK,EAAE;AAC5I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9UA,SAAgB,aAAa,OAAwB,OAAsC;CACzF,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,YAAY,CAAC,GAAG,SAAS,YAAY,KAAK,CAAC;CAEjD,IAAI;CACJ,IAAI;CAEJ,IAAI,SAAS,aAAa,WAAW,QACnC,MAAM;EAAE,QAAQ;EAAQ,QAAQ,SAAS,aAAa,UAAU;CAAyB;MACpF,IAAI,CAAC,MAAM,oBAChB,MAAM;EACJ,QAAQ;EACR,QAAQ,qCAAqC,SAAS,aAAa,SAAS,SAAS;EACrF,OAAO;CACT;MACK;EACL,MAAM,UAAU,UAAU,MAAM,UAAU,MAAM,kBAAkB;EAClE,MAAM,SAAS,SAAS,aAAa;EACrC,MAAM,QACJ,UAAU,QAAQ,MAAM,YAAY,MAAM,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,OAAO;EACvF,MAAM,MAAM,YAAY,SAAS,OAAO,IACpC;GAAE,QAAQ;GAAQ,QAAQ;EAAmC,IAC7D;GACE,QAAQ;GACR,QAAQ,QACJ,sIACA;EACN;EACJ,IAAI,IAAI,WAAW,UAAU,aAAa;CAC5C;CAEA,MAAM,KAAK,MAAM,KAAK;CACtB,MAAM,MAAgB,KAClB;EAAE,QAAQ;EAAQ,QAAQ,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG;CAAG,IACpE;EACE,QAAQ;EACR,QAAQ,SAAS,SAAS,IAAI,MAAM,QAAQ,SAAS,WAAW;EAChE,OAAO,SAAS,IAAI;CACtB;CAEJ,OAAO;EACL,UAAU,MAAM;EAChB,MAAM,SAAS;EACf,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C;EACA;EACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC;CACF;AACF;;AAGA,SAAgB,KAAK,QAAmB,QAA6C;CACnF,MAAM,QAAkB,CAAC;CAUzB,OAAO;EAAE,YATU,OAAO,WAAW,KAAK,UAAU;GAClD,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,CAAC,SAAS,aAAa,MAAM,SAAS,CAAC,aAAa,WAAW,WAGjE,MAAM,KAAK,GAAG,MAAM,SAAS,8BAA8B,OAAO,eAAe;GACnF,OAAO,aAAa,OAAO,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;EACzD,CACkB;EAAG;CAAM;AAC7B;;AAGA,SAAgB,SAAS,GAAqB;CAC5C,OAAO,EAAE,WAAW,MAAM,MAAM,EAAE,IAAI,WAAW,UAAU,EAAE,IAAI,WAAW,MAAM;AACpF;;AAGA,SAAgB,cAAc,GAAyD;CACrF,MAAM,MAAmD,CAAC;CAC1D,KAAK,MAAM,KAAK,EAAE,YAChB,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,GAC9B,IAAI,KAAK,WAAW,aAAa,KAAK,OACpC,IAAI,KAAK;EAAE,UAAU,EAAE;EAAU,OAAO,KAAK;CAAM,CAAC;CAG1D,OAAO;AACT;;AAGA,SAAgB,WAAW,GAAoB;CAC7C,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM,EAAE,WAAW,YAAY,MAAM;CAC3F,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,EAAE,YAAY;EAC5B,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,OAAO,KAAK,IAAI;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAqC;CACjE,MAAM,UAAU;EAAC;EAAY;EAAU;EAAU;CAAK;CACtD,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAU,EAAE;EAAQ,EAAE;EAAK,EAAE;CAAG,CAAC;CACpE,MAAM,YAAY,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;CAC1F,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/ads/plan.ts"],"sourcesContent":["/**\n * Every decision `vitops ads setup` makes, as one pure function.\n *\n * Pure in the load-bearing sense: no `fetch`, no `fs`, no clock, no stdin. The\n * executor gathers each domain's live DNS state and applies what it is told; this\n * module decides, from that state, what is left to do. The same split\n * `onboarding/plan.ts` makes, for the same two payoffs: `--dry` is a *complete*\n * account of a run, and `--check` is an honest drift report.\n *\n * Idempotency lives here — a step whose desired state already holds resolves to\n * `skip`, so a re-run of a linked property is all skips by construction rather than\n * by the executor checking twice.\n *\n * One thing this planner adds over the onboarding one: a step that cannot proceed\n * for want of a **config value** resolves to `blocked` carrying the field name in\n * `needs`. That is a machine-readable gap, which is what lets the CLI *ask* for the\n * missing token and re-plan, while the planner itself stays pure and knows nothing\n * about a terminal. A blocked step is drift, never a skip — the first run of a\n * property whose token has not been fetched yet must not read as \"already linked\".\n */\nimport { AD_PLATFORMS, tagId, txtRecord } from './providers.ts';\nimport type { AdDomainState, AdPropertySetup, AdsConfig } from './types.ts';\nimport { table } from '../plan-format.ts';\n\n/** A step's decision. `blocked` means the config is missing something. */\nexport type StepAction = 'create' | 'skip' | 'blocked';\n\n/** A config field the operator can supply to unblock a step. */\nexport type MissingField = 'domainVerification' | 'accountId' | 'pixelId';\n\nexport interface StepPlan {\n  action: StepAction;\n  /** Why it's a skip, or what the mutation will do, or what is missing. */\n  detail: string;\n  /** Set only on `blocked`: which config field would unblock it. */\n  needs?: MissingField | undefined;\n}\n\n/** The steps for one ad property, decided against its live state. */\nexport interface AdPropertyPlan {\n  provider: AdPropertySetup['provider'];\n  /** The platform name, so a formatter needn't reach back into the table. */\n  name: string;\n  /** The domain being verified, when the platform verifies one. */\n  domain?: string | undefined;\n  /** Ensure the apex verification TXT. */\n  txt: StepPlan;\n  /** Whether the tag can be emitted (`ads tags`). */\n  tag: StepPlan;\n  /** The exact TXT content to create, when `txt.action` is `create`. */\n  txtContent?: string | undefined;\n  /** Manual follow-ups — including *why* a platform has no verification step. */\n  reminders: string[];\n}\n\nexport interface AdsPlan {\n  properties: AdPropertyPlan[];\n  /** Operator-facing warnings that span the whole run. */\n  notes: string[];\n}\n\n/**\n * Decide one property's steps.\n *\n * The `dns-txt` branch has three outcomes, and keeping them distinct is the point:\n * our record is present (skip), a *different* record from the same platform is\n * present (create, and say so — a token rotation leaves the old record in place,\n * since this command never edits or deletes DNS), or no token is configured yet\n * (blocked, naming the field).\n */\nexport function planProperty(setup: AdPropertySetup, state: AdDomainState): AdPropertyPlan {\n  const platform = AD_PLATFORMS[setup.provider];\n  const reminders = [...platform.manualSteps(setup)];\n\n  let txt: StepPlan;\n  let txtContent: string | undefined;\n\n  if (platform.verification.method === 'none') {\n    txt = { action: 'skip', detail: platform.verification.reason ?? 'no domain verification' };\n  } else if (!setup.domainVerification) {\n    txt = {\n      action: 'blocked',\n      detail: `needs the verification token from ${platform.verification.where ?? platform.consoleUrl}`,\n      needs: 'domainVerification',\n    };\n  } else {\n    const desired = txtRecord(setup.provider, setup.domainVerification);\n    const prefix = platform.verification.txtPrefix;\n    const stale =\n      prefix != null && state.txtContents.some((c) => c.startsWith(prefix) && c !== desired);\n    txt = state.txtContents.includes(desired)\n      ? { action: 'skip', detail: 'verification TXT already present' }\n      : {\n          action: 'create',\n          detail: stale\n            ? 'create verification TXT (an older token from this platform is still present — remove it yourself; this command never deletes DNS)'\n            : 'create verification TXT',\n        };\n    if (txt.action === 'create') txtContent = desired;\n  }\n\n  const id = tagId(setup);\n  const tag: StepPlan = id\n    ? { action: 'skip', detail: `tag ready (${platform.tag.needs} ${id})` }\n    : {\n        action: 'blocked',\n        detail: `needs ${platform.tag.needs} from ${platform.consoleUrl} to emit the tag`,\n        needs: platform.tag.needs,\n      };\n\n  return {\n    provider: setup.provider,\n    name: platform.name,\n    ...(setup.domain ? { domain: setup.domain } : {}),\n    txt,\n    tag,\n    ...(txtContent ? { txtContent } : {}),\n    reminders,\n  };\n}\n\n/** Plan every configured property. */\nexport function plan(config: AdsConfig, states: Map<string, AdDomainState>): AdsPlan {\n  const notes: string[] = [];\n  const properties = config.properties.map((setup) => {\n    const key = setup.domain ?? '';\n    const state = states.get(key);\n    if (!state && AD_PLATFORMS[setup.provider].verification.method === 'dns-txt')\n      // Should not happen — the CLI observes every verifiable domain before\n      // planning — but a missing observation must not read as \"nothing to do\".\n      notes.push(`${setup.provider}: no observed DNS state for ${key || '(no domain)'}`);\n    return planProperty(setup, state ?? { txtContents: [] });\n  });\n  return { properties, notes };\n}\n\n/** Any step that isn't a skip — i.e. the live state or the config has drifted. */\nexport function hasDrift(p: AdsPlan): boolean {\n  return p.properties.some((x) => x.txt.action !== 'skip' || x.tag.action !== 'skip');\n}\n\n/** Every field a run still needs, per provider — what the CLI asks for. */\nexport function missingFields(p: AdsPlan): { provider: string; needs: MissingField }[] {\n  const out: { provider: string; needs: MissingField }[] = [];\n  for (const x of p.properties) {\n    for (const step of [x.txt, x.tag]) {\n      if (step.action === 'blocked' && step.needs)\n        out.push({ provider: x.provider, needs: step.needs });\n    }\n  }\n  return out;\n}\n\n/** Render a plan as the block `--dry` and `--check` print. */\nexport function formatPlan(p: AdsPlan): string {\n  const glyph = (s: StepPlan) => (s.action === 'skip' ? '·' : s.action === 'blocked' ? '?' : '+');\n  const lines: string[] = [];\n  for (const x of p.properties) {\n    lines.push(`${x.provider}${x.domain ? `  (${x.domain})` : ''}`);\n    lines.push(`  ${glyph(x.txt)} verify  ${x.txt.detail}`);\n    lines.push(`  ${glyph(x.tag)} tag     ${x.tag.detail}`);\n    for (const r of x.reminders) lines.push(`  ! ${r}`);\n  }\n  for (const n of p.notes) lines.push(`! ${n}`);\n  return lines.join('\\n');\n}\n\n/** The outcome of one property's run, for the summary table. */\nexport interface AdPropertyResult {\n  provider: string;\n  domain: string;\n  txt: 'created' | 'present' | 'blocked' | 'failed' | 'n/a';\n  tag: 'ready' | 'blocked';\n  reminders: string[];\n}\n\n/** Render the end-of-run summary: one row per property, plus any reminders. */\nexport function formatSummary(results: AdPropertyResult[]): string {\n  const headers = ['PROVIDER', 'DOMAIN', 'VERIFY', 'TAG'];\n  const rows = results.map((r) => [r.provider, r.domain, r.txt, r.tag]);\n  const reminders = results.flatMap((r) => r.reminders.map((m) => `  ! ${r.provider}: ${m}`));\n  return table(headers, rows, reminders);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsEA,SAAgB,aAAa,OAAwB,OAAsC;CACzF,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,YAAY,CAAC,GAAG,SAAS,YAAY,KAAK,CAAC;CAEjD,IAAI;CACJ,IAAI;CAEJ,IAAI,SAAS,aAAa,WAAW,QACnC,MAAM;EAAE,QAAQ;EAAQ,QAAQ,SAAS,aAAa,UAAU;CAAyB;MACpF,IAAI,CAAC,MAAM,oBAChB,MAAM;EACJ,QAAQ;EACR,QAAQ,qCAAqC,SAAS,aAAa,SAAS,SAAS;EACrF,OAAO;CACT;MACK;EACL,MAAM,UAAU,UAAU,MAAM,UAAU,MAAM,kBAAkB;EAClE,MAAM,SAAS,SAAS,aAAa;EACrC,MAAM,QACJ,UAAU,QAAQ,MAAM,YAAY,MAAM,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,OAAO;EACvF,MAAM,MAAM,YAAY,SAAS,OAAO,IACpC;GAAE,QAAQ;GAAQ,QAAQ;EAAmC,IAC7D;GACE,QAAQ;GACR,QAAQ,QACJ,sIACA;EACN;EACJ,IAAI,IAAI,WAAW,UAAU,aAAa;CAC5C;CAEA,MAAM,KAAK,MAAM,KAAK;CACtB,MAAM,MAAgB,KAClB;EAAE,QAAQ;EAAQ,QAAQ,cAAc,SAAS,IAAI,MAAM,GAAG,GAAG;CAAG,IACpE;EACE,QAAQ;EACR,QAAQ,SAAS,SAAS,IAAI,MAAM,QAAQ,SAAS,WAAW;EAChE,OAAO,SAAS,IAAI;CACtB;CAEJ,OAAO;EACL,UAAU,MAAM;EAChB,MAAM,SAAS;EACf,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C;EACA;EACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC;CACF;AACF;;AAGA,SAAgB,KAAK,QAAmB,QAA6C;CACnF,MAAM,QAAkB,CAAC;CAUzB,OAAO;EAAE,YATU,OAAO,WAAW,KAAK,UAAU;GAClD,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,CAAC,SAAS,aAAa,MAAM,SAAS,CAAC,aAAa,WAAW,WAGjE,MAAM,KAAK,GAAG,MAAM,SAAS,8BAA8B,OAAO,eAAe;GACnF,OAAO,aAAa,OAAO,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;EACzD,CACkB;EAAG;CAAM;AAC7B;;AAGA,SAAgB,SAAS,GAAqB;CAC5C,OAAO,EAAE,WAAW,MAAM,MAAM,EAAE,IAAI,WAAW,UAAU,EAAE,IAAI,WAAW,MAAM;AACpF;;AAGA,SAAgB,cAAc,GAAyD;CACrF,MAAM,MAAmD,CAAC;CAC1D,KAAK,MAAM,KAAK,EAAE,YAChB,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,GAC9B,IAAI,KAAK,WAAW,aAAa,KAAK,OACpC,IAAI,KAAK;EAAE,UAAU,EAAE;EAAU,OAAO,KAAK;CAAM,CAAC;CAG1D,OAAO;AACT;;AAGA,SAAgB,WAAW,GAAoB;CAC7C,MAAM,SAAS,MAAiB,EAAE,WAAW,SAAS,MAAM,EAAE,WAAW,YAAY,MAAM;CAC3F,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,KAAK,EAAE,YAAY;EAC5B,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,OAAO,KAAK,IAAI;EAC9D,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,QAAQ;EACtD,KAAK,MAAM,KAAK,EAAE,WAAW,MAAM,KAAK,OAAO,GAAG;CACpD;CACA,KAAK,MAAM,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,GAAG;CAC5C,OAAO,MAAM,KAAK,IAAI;AACxB;;AAYA,SAAgB,cAAc,SAAqC;CACjE,MAAM,UAAU;EAAC;EAAY;EAAU;EAAU;CAAK;CACtD,MAAM,OAAO,QAAQ,KAAK,MAAM;EAAC,EAAE;EAAU,EAAE;EAAQ,EAAE;EAAK,EAAE;CAAG,CAAC;CACpE,MAAM,YAAY,QAAQ,SAAS,MAAM,EAAE,UAAU,KAAK,MAAM,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;CAC1F,OAAO,MAAM,SAAS,MAAM,SAAS;AACvC"}

package/dist/audit/index.mjs

@@ -525,6 +525,7 @@ async function runAudit(opts) {
 			let violations;
 			try {
 				await page.goto(url, { waitUntil: "load" });
+				await page.waitForFunction("document.getAnimations().every((a) => a.constructor.name !== 'CSSTransition' || a.playState === 'finished')", void 0, { timeout: 2e3 }).catch(() => void 0);
 				violations = toViolations(await new axe.AxeBuilder({ page }).withTags(AXE_TAGS).analyze());
 			} finally {
 				await context.close();