@getvitops/utils 8.3.0-alpha.3 → 8.3.0-alpha.5

package/dist/providers-CEHw-j4v.mjs

@@ -0,0 +1,351 @@
+// src/ads/types.ts
+/**
+* A bare string is back-compat shorthand for `{ call: label }` — the only
+* action that existed before this was a map. Absent input normalises to `{}`.
+*/
+function normalizeConversionLabels(label) {
+	if (label == null) return {};
+	return typeof label === "string" ? { call: label } : label;
+}
+/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */
+function normalizeConversionActionIds(id) {
+	if (id == null) return {};
+	return typeof id === "string" ? { call: id } : id;
+}
+
+// src/ads/providers.ts
+/**
+* What each ad platform actually lets a build tool do — the table every `vitops ads`
+* subcommand reads.
+*
+* Written the way the indexing module was written: start from what the platforms
+* accept, because it is much narrower than it looks, and record the *absence* of a
+* path as a fact rather than leaving it as a gap.
+*
+*  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,
+*    Snapchat). That record is the one thing here that can be created for you.
+*  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,
+*    Microsoft Ads). Linking is the tag and the account id, nothing else. Those
+*    resolve to a skip *plus* a named reason — a silent omission would read as
+*    "already done".
+*  - **No platform Marketing API is called.** Meta's Business Management
+*    `verify_domain` needs a system-user token; the Google Ads API needs an
+*    approved developer token and puts the consumer's own account on the line.
+*    That is the same reasoning that keeps the Google Indexing API unwired: a
+*    toolchain other people install must not ship a documented path to a terms
+*    violation. The final "Verify" click stays a reminder.
+*
+* The verification token is **not a secret** — it is published in DNS, and the
+* platform fetching it back is the ownership proof, exactly like the IndexNow key.
+* So it lives in the config while credentials stay in the environment.
+*
+* Each tag is the platform's documented bootstrap reduced to its queue stub, with
+* the remote library on `data-src` for the consent gate to attach after the
+* bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body
+* first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a
+* snippet that creates its own `<script>`; those declare no `src`, and their body
+* stays inert until activation, so an undecided visitor still issues no request.
+*/
+/**
+* `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.
+*
+* `gtag('config', id)` only loads the tag — it never reports a conversion. When
+* `entry.conversionLabel` names one or more actions, this also exposes a
+* `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry
+* per configured action, so a call, an email click and a form submission each
+* carry their own `send_to` target instead of all three sharing one (that
+* sharing was a real bug: a call and an email click used to report as the same
+* Google Ads conversion action, indistinguishable in the account). Bootstrap
+* time only loads the tag; `scripts/tracking.ts`'s click handler and
+* `vitopsFormConversion()` each read their own action's key and fire
+* `gtag('event', 'conversion', …)` at the moment of the actual interaction —
+* bootstrap-time firing would count every pageview as a conversion.
+*
+* `entry` is trusted here — `resolveAds()` validates every configured label
+* against `SAFE_ID` before it reaches this function, the same guard `id`
+* already gets.
+*
+* **`entry.reporting === 'server'` suppresses an action here, never
+* silently.** An action fires client-side unless reporting is `'server'`
+* *and* that same action has a `conversionActionId` configured — so turning
+* reporting to `'server'` before the id is filled in leaves the action firing
+* client-side rather than dropping the conversion. Once both are set, the
+* server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,
+* wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one
+* place that action reports from — this is what avoids double-counting.
+*/
+const gtagBootstrap = (id, entry) => {
+	const labels = normalizeConversionLabels(entry.conversionLabel);
+	const actionIds = normalizeConversionActionIds(entry.conversionActionId);
+	const actions = Object.entries(labels).filter((pair) => !!pair[1] && !(entry.reporting === "server" && !!actionIds[pair[0]]));
+	return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('js',new Date());gtag('config','${id}');` + callTrackingConfig(id, entry) + (actions.length ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};window.vitopsAdsConversions.google=${JSON.stringify(Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])))};` : "");
+};
+/**
+* Google's website call conversions: `gtag('config', 'AW-…/<label>', { phone_conversion_number })`.
+*
+* Google fetches a forwarding number for a visitor who arrived from a Google ad and
+* replaces the displayed number's **text** — never the `tel:` href, which Google says
+* needs the callback. The callback hands the result to `vitopsSwapPhone`
+* (`@getvitops/astro`'s tracking script) through a queue, because this inline body and
+* that module load in no guaranteed order: a call that lands first is replayed when the
+* script defines the function, rather than lost.
+*
+* `entry.callTracking` is trusted — `resolveAds()` checks the label against `SAFE_ID`
+* and the number against a phone pattern before it reaches here.
+*/
+const callTrackingConfig = (id, entry) => {
+	const call = entry.callTracking;
+	if (!call) return "";
+	const options = call.cache === false ? ",phone_conversion_options:{cache:false}" : "";
+	return `window.vitopsPhoneSwaps=window.vitopsPhoneSwaps||[];gtag('config','${id}/${call.label}',{phone_conversion_number:${JSON.stringify(call.number)},phone_conversion_callback:function(f,m){var a=[f,m,${JSON.stringify(call.number)}];window.vitopsSwapPhone?window.vitopsSwapPhone.apply(null,a):window.vitopsPhoneSwaps.push(a)}${options}});`;
+};
+/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */
+const queueStub = (global, methods) => `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};window.${global}.methods=${methods};`;
+const AD_PLATFORMS = {
+	google: {
+		name: "Google Ads",
+		operatorCountry: "the United States",
+		clickIdParams: [
+			"gclid",
+			"gbraid",
+			"wbraid"
+		],
+		websiteCallTracking: true,
+		consoleUrl: "https://ads.google.com/",
+		verification: {
+			method: "none",
+			reason: "Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)"
+		},
+		tag: {
+			needs: "pixelId",
+			src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,
+			bootstrap: gtagBootstrap,
+			cookies: [
+				"_gcl_au",
+				"_gcl_aw",
+				"_gcl_dc",
+				"_gac_*"
+			],
+			privacyUrl: "https://policies.google.com/privacy",
+			optOut: "https://adssettings.google.com/"
+		},
+		manualSteps: (e) => [
+			...Object.keys(normalizeConversionLabels(e.conversionLabel)).length ? ["confirm each conversion action's category in Google Ads (call → \"Phone call lead\", email → \"Contact\", form → \"Submit lead form\"); the tag cannot set it, and a wrong one reports under the wrong goal"] : ["create a conversion action in Google Ads and record its label as `conversionLabel`"],
+			"link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions",
+			...e.callTracking ? [
+				"in Google Ads, create a conversion action of type \"Calls from a phone number on your website\", set its minimum call length, and make either it or the `conversionLabel.call` (tap) action secondary so one call is not counted twice",
+				"verify the domain through Search Console, not the tag — Google cannot scan a page whose number is swapped (a tag installed through Google Tag Manager can't verify it either)",
+				"test with `#google-wcc-debug` appended to a landing URL after granting marketing consent"
+			] : []
+		]
+	},
+	meta: {
+		name: "Meta",
+		operatorCountry: "the United States",
+		clickIdParams: ["fbclid"],
+		websiteCallTracking: false,
+		consoleUrl: "https://business.facebook.com/settings/owned-domains",
+		verification: {
+			method: "dns-txt",
+			txtPrefix: "facebook-domain-verification=",
+			where: "Business settings → Brand safety → Domains → Add → DNS verification"
+		},
+		tag: {
+			needs: "pixelId",
+			src: () => "https://connect.facebook.net/en_US/fbevents.js",
+			bootstrap: (id) => `${queueStub("fbq", `['init','track','trackCustom','consent']`)}fbq('init','${id}');fbq('track','PageView');`,
+			cookies: ["_fbp", "_fbc"],
+			privacyUrl: "https://www.facebook.com/privacy/policy/",
+			optOut: "https://www.facebook.com/adpreferences/ad_settings"
+		},
+		manualSteps: () => ["click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called"]
+	},
+	linkedin: {
+		name: "LinkedIn",
+		operatorCountry: "the United States",
+		clickIdParams: ["li_fat_id"],
+		websiteCallTracking: false,
+		consoleUrl: "https://www.linkedin.com/campaignmanager/",
+		verification: {
+			method: "none",
+			reason: "LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)"
+		},
+		tag: {
+			needs: "accountId",
+			src: () => "https://snap.licdn.com/li.lms-analytics/insight.min.js",
+			bootstrap: (id) => `window._linkedin_partner_id='${id}';window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];window._linkedin_data_partner_ids.push('${id}');`,
+			cookies: [
+				"li_sugr",
+				"li_gc",
+				"bcookie",
+				"lidc",
+				"UserMatchHistory"
+			],
+			privacyUrl: "https://www.linkedin.com/legal/privacy-policy",
+			optOut: "https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out"
+		},
+		manualSteps: () => ["add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions"]
+	},
+	reddit: {
+		name: "Reddit",
+		operatorCountry: "the United States",
+		clickIdParams: ["rdt_cid"],
+		websiteCallTracking: false,
+		consoleUrl: "https://ads.reddit.com/",
+		verification: {
+			method: "none",
+			reason: "Reddit Ads has no domain verification — the Reddit Pixel is the link."
+		},
+		tag: {
+			needs: "pixelId",
+			src: () => "https://www.redditstatic.com/ads/pixel.js",
+			bootstrap: (id) => `${queueStub("rdt", `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,
+			cookies: ["_rdt_uuid"],
+			privacyUrl: "https://www.reddit.com/policies/privacy-policy"
+		},
+		manualSteps: () => []
+	},
+	tiktok: {
+		name: "TikTok",
+		operatorCountry: "Singapore",
+		clickIdParams: ["ttclid"],
+		websiteCallTracking: false,
+		consoleUrl: "https://ads.tiktok.com/",
+		verification: {
+			method: "dns-txt",
+			txtPrefix: "tiktok-developers-site-verification=",
+			where: "Ads Manager → Assets → Events → Web events → Verify domain → DNS"
+		},
+		tag: {
+			needs: "pixelId",
+			src: (id) => `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,
+			bootstrap: (id) => `window.TiktokAnalyticsObject='ttq';${queueStub("ttq", `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}ttq('init','${id}');ttq('page');`,
+			cookies: ["_ttp"],
+			privacyUrl: "https://www.tiktok.com/legal/privacy-policy"
+		},
+		manualSteps: () => []
+	},
+	microsoft: {
+		name: "Microsoft Ads",
+		operatorCountry: "the United States",
+		clickIdParams: ["msclkid"],
+		websiteCallTracking: false,
+		consoleUrl: "https://ads.microsoft.com/",
+		verification: {
+			method: "none",
+			reason: "Microsoft Ads has no domain verification — the UET tag is the link."
+		},
+		tag: {
+			needs: "pixelId",
+			bootstrap: (id) => `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,
+			cookies: [
+				"_uetsid",
+				"_uetvid",
+				"MUID"
+			],
+			privacyUrl: "https://privacy.microsoft.com/privacystatement",
+			optOut: "https://account.microsoft.com/privacy/ad-settings"
+		},
+		manualSteps: () => []
+	},
+	pinterest: {
+		name: "Pinterest",
+		operatorCountry: "the United States",
+		clickIdParams: ["epik"],
+		websiteCallTracking: false,
+		consoleUrl: "https://ads.pinterest.com/",
+		verification: {
+			method: "dns-txt",
+			txtPrefix: "pinterest-site-verification=",
+			where: "Business hub → Claim → Websites → Claim → Add TXT record"
+		},
+		tag: {
+			needs: "pixelId",
+			bootstrap: (id) => `${queueStub("pintrk", `['load','page','track']`)}!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();pintrk('load','${id}');pintrk('page');`,
+			cookies: [
+				"_pinterest_ct_ua",
+				"_pin_unauth",
+				"_epik"
+			],
+			privacyUrl: "https://policy.pinterest.com/privacy-policy"
+		},
+		manualSteps: () => ["confirm the claim in Business hub → Claim once the TXT record has propagated"]
+	},
+	snapchat: {
+		name: "Snapchat",
+		operatorCountry: "the United States",
+		clickIdParams: ["ScCid"],
+		websiteCallTracking: false,
+		consoleUrl: "https://ads.snapchat.com/",
+		verification: {
+			method: "dns-txt",
+			txtPrefix: "snap-domain-verification=",
+			where: "Business Manager → Public Profiles / Domains → Verify domain → DNS"
+		},
+		tag: {
+			needs: "pixelId",
+			src: () => "https://sc-static.net/scevent.min.js",
+			bootstrap: (id) => `${queueStub("snaptr", `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,
+			cookies: [
+				"_scid",
+				"_scid_r",
+				"sc_at"
+			],
+			privacyUrl: "https://snap.com/privacy/privacy-policy"
+		},
+		manualSteps: () => []
+	}
+};
+/** Every provider, in table order — the one place iteration order is decided. */
+const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS);
+/** Whether a string names a known provider (for CLI arg validation). */
+const isAdProvider = (value) => value in AD_PLATFORMS;
+/**
+* The DNS TXT record content for a token.
+*
+* A value already containing `=` is taken as the whole record and left alone. That
+* is the same escape hatch an icon name containing `:` gets: a platform can change
+* its prefix spelling without waiting on a toolchain release, and an operator who
+* pasted the full record from the UI gets what they meant rather than a
+* double-prefixed record that verifies against nothing.
+*/
+function txtRecord(provider, token) {
+	const trimmed = token.trim();
+	if (trimmed.includes("=")) return trimmed;
+	return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ""}${trimmed}`;
+}
+/** The tag id for an entry, or undefined when the field it needs is unset. */
+function tagId(entry) {
+	return entry[AD_PLATFORMS[entry.provider].tag.needs];
+}
+/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */
+const categoryOf = (entry) => entry.category ?? "marketing";
+const escapeAttr = (value) => value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+/**
+* One provider's tag, rendered as a **consent-gated, inert** `<script>`.
+*
+* `type="text/plain"` with the URL on `data-src` is what makes the gate real: the
+* browser neither parses the body nor fetches the library, so an undecided
+* visitor's page issues no third-party request. Never give one of these a live
+* `src` — a gate that instead asks a loaded tracker not to track is a promise.
+*
+* Returns null when the entry has no tag id, so a caller can report the gap rather
+* than emit a snippet that initialises `undefined`.
+*/
+function renderTag(entry, strategy = "idle") {
+	const platform = AD_PLATFORMS[entry.provider];
+	const id = tagId(entry);
+	if (!id) return null;
+	const attrs = [
+		"type=\"text/plain\"",
+		"data-vitops-tag",
+		`data-consent="${categoryOf(entry)}"`,
+		`data-strategy="${strategy}"`,
+		...platform.tag.src ? [`data-src="${escapeAttr(platform.tag.src(id))}"`] : [],
+		`data-consent-cookies="${escapeAttr(platform.tag.cookies.join(","))}"`
+	];
+	return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\n<script ${attrs.join(" ")}>${platform.tag.bootstrap(id, entry)}<\/script>`;
+}
+
+export { renderTag as a, normalizeConversionActionIds as c, isAdProvider as i, normalizeConversionLabels as l, AD_PROVIDER_KEYS as n, tagId as o, categoryOf as r, txtRecord as s, AD_PLATFORMS as t };
+//# sourceMappingURL=providers-CEHw-j4v.mjs.map

package/dist/providers-CEHw-j4v.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers-CEHw-j4v.mjs","names":[],"sources":["../src/ads/types.ts","../src/ads/providers.ts"],"sourcesContent":["/**\n * The ads module's own option surface.\n *\n * `AdPropertySetup` is the `site.ads.<platform>` block from `@getvitops/config` plus the platform it\n * is keyed by — inferred from the schema `validateConfig` runs, not re-declared here.\n */\n\nimport type { AdPropertyConfig } from '@getvitops/config';\nimport type { AdProvider as AdProviderConfig } from '@getvitops/config/providers';\n\n/**\n * The ad platforms this toolchain knows how to link a site to.\n *\n * A closed set, and `AD_PROVIDERS` in `@getvitops/config` is its single source: the capability\n * table in `providers.ts` is a `Record<AdProvider, …>`, so a provider added there without an entry\n * here is a compile error. (This was a hand-copied union held to the schema's enum by a test in the\n * generator; the schema now lives below this package, so the copy and the test are gone.) An open\n * string would mean a typo'd provider silently getting no verification step and no tag.\n */\nexport type AdProvider = AdProviderConfig;\n\n/** Which consent category gates a provider's tag. */\nexport type AdConsentCategory = 'marketing' | 'analytics';\n\n/**\n * The three interactions Google Ads can report a distinct conversion action\n * for. `form` is fired client-side via `vitopsFormConversion()`\n * (`@getvitops/astro`'s tracking script), the other two from the tel:/mailto:\n * click handler.\n */\nexport type ConversionAction = 'call' | 'email' | 'form';\n\n/**\n * One label per action this site wants Google Ads to tell apart.\n *\n * Written out field by field, `?: string | undefined` — not\n * `Partial<Record<ConversionAction, string>>` — matching this file's own\n * convention above: `exactOptionalPropertyTypes` treats `{ email?: string }`\n * (present-or-absent) and `{ email?: string | undefined }` (present,\n * absent, or explicitly `undefined`) as different types, and a parsed JSON\n * config's optional field is the latter. `Partial<Record<...>>` produces the\n * former, which rejected the zod-inferred shape config.ts actually produces.\n */\nexport interface ConversionLabelMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/**\n * A bare string is back-compat shorthand for `{ call: label }` — the only\n * action that existed before this was a map. Absent input normalises to `{}`.\n */\nexport function normalizeConversionLabels(\n  label: string | ConversionLabelMap | undefined,\n): ConversionLabelMap {\n  if (label == null) return {};\n  return typeof label === 'string' ? { call: label } : label;\n}\n\n/**\n * One Google Ads conversion action **resource id** per action this site\n * uploads server-side — a numeric id (`\"123456789\"`) or a full resource name\n * (`\"customers/123/conversionActions/456\"`), never the `conversionLabel`\n * string. Written out field by field for the same `exactOptionalPropertyTypes`\n * reason as `ConversionLabelMap` above.\n *\n * **This is a genuinely different identifier from `conversionLabel`, not an\n * alternate spelling of it.** `conversionLabel` is the opaque label the web\n * tag embeds in `send_to: \"AW-…/label\"` — it identifies the conversion action\n * to `gtag.js`, not to the Ads API. The API's click-conversion upload\n * (`ConversionUploadService.UploadClickConversions`) addresses the action by\n * `conversion_action` **resource name**, a value the label cannot be turned\n * into locally — Google returns both when a conversion action is created, but\n * only the label ships to the browser today. Until something in this\n * toolchain calls `ConversionActionService` to create/list actions and print\n * both back, this field has to be copied in by hand from the Ads UI/API.\n */\nexport interface ConversionActionIdMap {\n  call?: string | undefined;\n  email?: string | undefined;\n  form?: string | undefined;\n}\n\n/** Same back-compat shorthand as `normalizeConversionLabels`, for ids. */\nexport function normalizeConversionActionIds(\n  id: string | ConversionActionIdMap | undefined,\n): ConversionActionIdMap {\n  if (id == null) return {};\n  return typeof id === 'string' ? { call: id } : id;\n}\n\n/** One ad property to link: the config block, plus the platform it is keyed by. */\nexport type AdPropertySetup = AdPropertyConfig & {\n  provider: AdProvider;\n};\n\n/** Everything `plan()` needs, once the CLI has read the config. */\nexport interface AdsConfig {\n  /** The properties to link. Already filtered to `--provider` if that was passed. */\n  properties: AdPropertySetup[];\n}\n\n/**\n * One property's observed live state, gathered by the executor before planning.\n *\n * Same shape of arrangement as `DomainState`: the decision is pure, the\n * observation is not. `txtContents` is every apex TXT record on the domain, so\n * the planner can decide both \"our record is present\" and \"a *different* record\n * from this provider is present\" — the second is a token rotation, which needs\n * saying rather than silently adding a second record.\n */\nexport interface AdDomainState {\n  zoneId?: string | undefined;\n  /** Every apex TXT record content, unquoted. */\n  txtContents: string[];\n}\n","/**\n * What each ad platform actually lets a build tool do — the table every `vitops ads`\n * subcommand reads.\n *\n * Written the way the indexing module was written: start from what the platforms\n * accept, because it is much narrower than it looks, and record the *absence* of a\n * path as a fact rather than leaving it as a gap.\n *\n *  - **Four platforms verify a domain by DNS TXT** (Meta, TikTok, Pinterest,\n *    Snapchat). That record is the one thing here that can be created for you.\n *  - **Four have no domain verification at all** (Google Ads, LinkedIn, Reddit,\n *    Microsoft Ads). Linking is the tag and the account id, nothing else. Those\n *    resolve to a skip *plus* a named reason — a silent omission would read as\n *    \"already done\".\n *  - **No platform Marketing API is called.** Meta's Business Management\n *    `verify_domain` needs a system-user token; the Google Ads API needs an\n *    approved developer token and puts the consumer's own account on the line.\n *    That is the same reasoning that keeps the Google Indexing API unwired: a\n *    toolchain other people install must not ship a documented path to a terms\n *    violation. The final \"Verify\" click stays a reminder.\n *\n * The verification token is **not a secret** — it is published in DNS, and the\n * platform fetching it back is the ownership proof, exactly like the IndexNow key.\n * So it lives in the config while credentials stay in the environment.\n *\n * Each tag is the platform's documented bootstrap reduced to its queue stub, with\n * the remote library on `data-src` for the consent gate to attach after the\n * bootstrap has run (`@getvitops/core`'s `activateScript` emits the inline body\n * first for exactly this reason). Two platforms — Microsoft and Pinterest — ship a\n * snippet that creates its own `<script>`; those declare no `src`, and their body\n * stays inert until activation, so an undecided visitor still issues no request.\n */\nimport { normalizeConversionActionIds, normalizeConversionLabels } from './types.ts';\nimport type { AdConsentCategory, AdProvider, AdPropertySetup } from './types.ts';\n\n/** How a platform proves you own the domain. */\nexport interface AdVerificationSpec {\n  method: 'dns-txt' | 'none';\n  /**\n   * Prefix prepended to a bare token to form the record content. Owned here so a\n   * config holds the token the platform shows, not a hand-assembled record — but\n   * see `txtRecord`: a value already containing `=` passes through whole, which is\n   * the escape hatch when a platform changes its spelling.\n   */\n  txtPrefix?: string;\n  /** Where in the platform UI the token is found. Printed when asking for it. */\n  where?: string;\n  /** Why there is nothing to automate. Required when `method` is `none`. */\n  reason?: string;\n}\n\n/** The tag, and which config field carries its id. */\nexport interface AdTagSpec {\n  /** Which field the tag id comes from — and therefore what to ask for when absent. */\n  needs: 'pixelId' | 'accountId';\n  /** The remote library. Absent when the platform's own bootstrap loads itself. */\n  src?: (id: string) => string;\n  /** The inline bootstrap, which the gate runs before attaching `src`. */\n  bootstrap: (id: string, entry: AdPropertySetup) => string;\n  /**\n   * Cookies the tag sets, for `data-consent-cookies` (what a revoke clears) and\n   * for the generated cookie notice. A `*` suffix is a prefix match.\n   */\n  cookies: string[];\n  /** The provider's own privacy policy, for the cookie notice. */\n  privacyUrl: string;\n  /** A visitor-facing opt-out, where the platform offers one. */\n  optOut?: string;\n}\n\nexport interface AdPlatform {\n  /** The platform as a reader would recognise it. */\n  name: string;\n  /**\n   * The jurisdiction that can compel this platform to produce what it receives —\n   * where the contracting entity is established. Feeds the generated privacy\n   * policy's cross-border transfer disclosure, which is a claim about foreign\n   * *access*, not foreign storage (see `Processor.operatorCountry` in the\n   * generator's `legal/providers.ts`). A consumer whose contracting entity differs\n   * declares their own processor entry instead.\n   */\n  operatorCountry: string;\n  /** Click-ID parameters this platform stamps on an ad landing URL. */\n  clickIdParams: string[];\n  /**\n   * Can the platform itself swap a forwarding number into the website for its own\n   * visitors? Only Google can (website call conversions, Canada included). Microsoft's\n   * forwarding numbers exist only inside the ad, and only in the US/UK/AU; every other\n   * platform offers none. A site wanting a per-platform number provisions its own and\n   * states it in `site.tracking.phoneNumbers`.\n   */\n  websiteCallTracking: boolean;\n  /** Where the operator manages the property. */\n  consoleUrl: string;\n  verification: AdVerificationSpec;\n  tag: AdTagSpec;\n  /** Follow-ups no API covers, given this entry. */\n  manualSteps: (entry: AdPropertySetup) => string[];\n}\n\n/**\n * `gtag` is shared by every Google tag; the id shape (`AW-…`) is what differs.\n *\n * `gtag('config', id)` only loads the tag — it never reports a conversion. When\n * `entry.conversionLabel` names one or more actions, this also exposes a\n * `{action: 'id/label'}` map on `window.vitopsAdsConversions.google` — one entry\n * per configured action, so a call, an email click and a form submission each\n * carry their own `send_to` target instead of all three sharing one (that\n * sharing was a real bug: a call and an email click used to report as the same\n * Google Ads conversion action, indistinguishable in the account). Bootstrap\n * time only loads the tag; `scripts/tracking.ts`'s click handler and\n * `vitopsFormConversion()` each read their own action's key and fire\n * `gtag('event', 'conversion', …)` at the moment of the actual interaction —\n * bootstrap-time firing would count every pageview as a conversion.\n *\n * `entry` is trusted here — `resolveAds()` validates every configured label\n * against `SAFE_ID` before it reaches this function, the same guard `id`\n * already gets.\n *\n * **`entry.reporting === 'server'` suppresses an action here, never\n * silently.** An action fires client-side unless reporting is `'server'`\n * *and* that same action has a `conversionActionId` configured — so turning\n * reporting to `'server'` before the id is filled in leaves the action firing\n * client-side rather than dropping the conversion. Once both are set, the\n * server-side upload (`@getvitops/utils/notify`'s `uploadClickConversion`,\n * wired in by `createConversionRoute`'s `googleAdsOffline` option) is the one\n * place that action reports from — this is what avoids double-counting.\n */\nconst gtagBootstrap = (id: string, entry: AdPropertySetup): string => {\n  const labels = normalizeConversionLabels(entry.conversionLabel);\n  const actionIds = normalizeConversionActionIds(entry.conversionActionId);\n  const actions = Object.entries(labels).filter(\n    (pair): pair is [string, string] =>\n      !!pair[1] &&\n      !(entry.reporting === 'server' && !!actionIds[pair[0] as keyof typeof actionIds]),\n  );\n  return (\n    `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}` +\n    `gtag('js',new Date());gtag('config','${id}');` +\n    callTrackingConfig(id, entry) +\n    (actions.length\n      ? `window.vitopsAdsConversions=window.vitopsAdsConversions||{};` +\n        `window.vitopsAdsConversions.google=${JSON.stringify(\n          Object.fromEntries(actions.map(([action, label]) => [action, `${id}/${label}`])),\n        )};`\n      : '')\n  );\n};\n\n/**\n * Google's website call conversions: `gtag('config', 'AW-…/<label>', { phone_conversion_number })`.\n *\n * Google fetches a forwarding number for a visitor who arrived from a Google ad and\n * replaces the displayed number's **text** — never the `tel:` href, which Google says\n * needs the callback. The callback hands the result to `vitopsSwapPhone`\n * (`@getvitops/astro`'s tracking script) through a queue, because this inline body and\n * that module load in no guaranteed order: a call that lands first is replayed when the\n * script defines the function, rather than lost.\n *\n * `entry.callTracking` is trusted — `resolveAds()` checks the label against `SAFE_ID`\n * and the number against a phone pattern before it reaches here.\n */\nconst callTrackingConfig = (id: string, entry: AdPropertySetup): string => {\n  const call = entry.callTracking;\n  if (!call) return '';\n  const options = call.cache === false ? ',phone_conversion_options:{cache:false}' : '';\n  return (\n    `window.vitopsPhoneSwaps=window.vitopsPhoneSwaps||[];` +\n    `gtag('config','${id}/${call.label}',{phone_conversion_number:${JSON.stringify(call.number)},` +\n    `phone_conversion_callback:function(f,m){var a=[f,m,${JSON.stringify(call.number)}];` +\n    `window.vitopsSwapPhone?window.vitopsSwapPhone.apply(null,a):window.vitopsPhoneSwaps.push(a)}${options}});`\n  );\n};\n\n/** The queue-stub shape shared by fbq/ttq/rdt/snaptr/pintrk. */\nconst queueStub = (global: string, methods: string): string =>\n  `window.${global}=window.${global}||function(){(window.${global}.q=window.${global}.q||[]).push(arguments)};` +\n  `window.${global}.methods=${methods};`;\n\nexport const AD_PLATFORMS: Record<AdProvider, AdPlatform> = {\n  google: {\n    name: 'Google Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['gclid', 'gbraid', 'wbraid'],\n    websiteCallTracking: true,\n    consoleUrl: 'https://ads.google.com/',\n    verification: {\n      method: 'none',\n      reason:\n        'Google Ads has no domain verification — the conversion tag is the link. (Merchant Center claims a website; that is a different product.)',\n    },\n    tag: {\n      // The customer id (`123-456-7890`) is not the tag id: the conversion tag is\n      // `AW-…`, which is why this asks for `pixelId` rather than reusing accountId.\n      needs: 'pixelId',\n      src: (id) => `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`,\n      bootstrap: gtagBootstrap,\n      cookies: ['_gcl_au', '_gcl_aw', '_gcl_dc', '_gac_*'],\n      privacyUrl: 'https://policies.google.com/privacy',\n      optOut: 'https://adssettings.google.com/',\n    },\n    manualSteps: (e) => [\n      ...(Object.keys(normalizeConversionLabels(e.conversionLabel)).length\n        ? [\n            'confirm each conversion action\\'s category in Google Ads (call → \"Phone call lead\", email → \"Contact\", form → \"Submit lead form\"); the tag cannot set it, and a wrong one reports under the wrong goal',\n          ]\n        : ['create a conversion action in Google Ads and record its label as `conversionLabel`']),\n      'link the Google Ads account to Search Console / GA4 in the UI if you want imported conversions',\n      ...(e.callTracking\n        ? [\n            'in Google Ads, create a conversion action of type \"Calls from a phone number on your website\", set its minimum call length, and make either it or the `conversionLabel.call` (tap) action secondary so one call is not counted twice',\n            \"verify the domain through Search Console, not the tag — Google cannot scan a page whose number is swapped (a tag installed through Google Tag Manager can't verify it either)\",\n            'test with `#google-wcc-debug` appended to a landing URL after granting marketing consent',\n          ]\n        : []),\n    ],\n  },\n\n  meta: {\n    name: 'Meta',\n    operatorCountry: 'the United States',\n    clickIdParams: ['fbclid'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://business.facebook.com/settings/owned-domains',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'facebook-domain-verification=',\n      where: 'Business settings → Brand safety → Domains → Add → DNS verification',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://connect.facebook.net/en_US/fbevents.js',\n      bootstrap: (id) =>\n        `${queueStub('fbq', `['init','track','trackCustom','consent']`)}` +\n        `fbq('init','${id}');fbq('track','PageView');`,\n      cookies: ['_fbp', '_fbc'],\n      privacyUrl: 'https://www.facebook.com/privacy/policy/',\n      optOut: 'https://www.facebook.com/adpreferences/ad_settings',\n    },\n    manualSteps: () => [\n      'click Verify on the domain in Business settings once the TXT record has propagated — the Business Management API needs a system-user token and is deliberately not called',\n    ],\n  },\n\n  linkedin: {\n    name: 'LinkedIn',\n    operatorCountry: 'the United States',\n    clickIdParams: ['li_fat_id'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://www.linkedin.com/campaignmanager/',\n    verification: {\n      method: 'none',\n      reason:\n        'LinkedIn Ads has no domain verification — the Insight Tag is the link. (Verifying a LinkedIn *Page* is a separate, unrelated flow.)',\n    },\n    tag: {\n      needs: 'accountId',\n      src: () => 'https://snap.licdn.com/li.lms-analytics/insight.min.js',\n      bootstrap: (id) =>\n        `window._linkedin_partner_id='${id}';` +\n        `window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];` +\n        `window._linkedin_data_partner_ids.push('${id}');`,\n      cookies: ['li_sugr', 'li_gc', 'bcookie', 'lidc', 'UserMatchHistory'],\n      privacyUrl: 'https://www.linkedin.com/legal/privacy-policy',\n      optOut: 'https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out',\n    },\n    manualSteps: () => [\n      'add conversions in Campaign Manager — the Insight Tag alone records page visits, not conversions',\n    ],\n  },\n\n  reddit: {\n    name: 'Reddit',\n    operatorCountry: 'the United States',\n    clickIdParams: ['rdt_cid'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://ads.reddit.com/',\n    verification: {\n      method: 'none',\n      reason: 'Reddit Ads has no domain verification — the Reddit Pixel is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://www.redditstatic.com/ads/pixel.js',\n      bootstrap: (id) =>\n        `${queueStub('rdt', `['init','track']`)}rdt('init','${id}');rdt('track','PageVisit');`,\n      cookies: ['_rdt_uuid'],\n      privacyUrl: 'https://www.reddit.com/policies/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  tiktok: {\n    name: 'TikTok',\n    operatorCountry: 'Singapore',\n    clickIdParams: ['ttclid'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://ads.tiktok.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'tiktok-developers-site-verification=',\n      where: 'Ads Manager → Assets → Events → Web events → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: (id) =>\n        `https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=${encodeURIComponent(id)}&lib=ttq`,\n      bootstrap: (id) =>\n        `window.TiktokAnalyticsObject='ttq';` +\n        `${queueStub('ttq', `['page','track','identify','instances','debug','on','off','once','ready','alias','group','enableCookie','disableCookie']`)}` +\n        `ttq('init','${id}');ttq('page');`,\n      cookies: ['_ttp'],\n      privacyUrl: 'https://www.tiktok.com/legal/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n\n  microsoft: {\n    name: 'Microsoft Ads',\n    operatorCountry: 'the United States',\n    clickIdParams: ['msclkid'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://ads.microsoft.com/',\n    verification: {\n      method: 'none',\n      reason: 'Microsoft Ads has no domain verification — the UET tag is the link.',\n    },\n    tag: {\n      needs: 'pixelId',\n      // No `src`: UET must be constructed *after* bat.js evaluates, so the\n      // platform's own snippet attaches an onload handler to a script it creates.\n      // Inert until activation all the same — the body is never parsed before then.\n      bootstrap: (id) =>\n        `(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:'${id}',enableAutoSpaTracking:true};` +\n        `o.q=w[u],w[u]=new UET(o),w[u].push('pageLoad')},n=d.createElement(t),n.src=r,n.async=1,` +\n        `n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=='loaded'&&s!=='complete'||(f(),n.onload=n.onreadystatechange=null)},` +\n        `i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,'script','https://bat.bing.com/bat.js','uetq');`,\n      cookies: ['_uetsid', '_uetvid', 'MUID'],\n      privacyUrl: 'https://privacy.microsoft.com/privacystatement',\n      optOut: 'https://account.microsoft.com/privacy/ad-settings',\n    },\n    manualSteps: () => [],\n  },\n\n  pinterest: {\n    name: 'Pinterest',\n    operatorCountry: 'the United States',\n    clickIdParams: ['epik'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://ads.pinterest.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'pinterest-site-verification=',\n      where: 'Business hub → Claim → Websites → Claim → Add TXT record',\n    },\n    tag: {\n      needs: 'pixelId',\n      // Pinterest's stub creates the script itself once `pintrk('load')` runs.\n      bootstrap: (id) =>\n        `${queueStub('pintrk', `['load','page','track']`)}` +\n        `!function(){var t=document.createElement('script');t.async=!0,t.src='https://s.pinimg.com/ct/core.js';` +\n        `var e=document.getElementsByTagName('script')[0];e.parentNode.insertBefore(t,e)}();` +\n        `pintrk('load','${id}');pintrk('page');`,\n      cookies: ['_pinterest_ct_ua', '_pin_unauth', '_epik'],\n      privacyUrl: 'https://policy.pinterest.com/privacy-policy',\n    },\n    manualSteps: () => [\n      'confirm the claim in Business hub → Claim once the TXT record has propagated',\n    ],\n  },\n\n  snapchat: {\n    name: 'Snapchat',\n    operatorCountry: 'the United States',\n    clickIdParams: ['ScCid'],\n    websiteCallTracking: false,\n    consoleUrl: 'https://ads.snapchat.com/',\n    verification: {\n      method: 'dns-txt',\n      txtPrefix: 'snap-domain-verification=',\n      where: 'Business Manager → Public Profiles / Domains → Verify domain → DNS',\n    },\n    tag: {\n      needs: 'pixelId',\n      src: () => 'https://sc-static.net/scevent.min.js',\n      bootstrap: (id) =>\n        `${queueStub('snaptr', `['init','track']`)}snaptr('init','${id}');snaptr('track','PAGE_VIEW');`,\n      cookies: ['_scid', '_scid_r', 'sc_at'],\n      privacyUrl: 'https://snap.com/privacy/privacy-policy',\n    },\n    manualSteps: () => [],\n  },\n};\n\n/** Every provider, in table order — the one place iteration order is decided. */\nexport const AD_PROVIDER_KEYS = Object.keys(AD_PLATFORMS) as AdProvider[];\n\n/** Whether a string names a known provider (for CLI arg validation). */\nexport const isAdProvider = (value: string): value is AdProvider => value in AD_PLATFORMS;\n\n/**\n * The DNS TXT record content for a token.\n *\n * A value already containing `=` is taken as the whole record and left alone. That\n * is the same escape hatch an icon name containing `:` gets: a platform can change\n * its prefix spelling without waiting on a toolchain release, and an operator who\n * pasted the full record from the UI gets what they meant rather than a\n * double-prefixed record that verifies against nothing.\n */\nexport function txtRecord(provider: AdProvider, token: string): string {\n  const trimmed = token.trim();\n  if (trimmed.includes('=')) return trimmed;\n  return `${AD_PLATFORMS[provider].verification.txtPrefix ?? ''}${trimmed}`;\n}\n\n/** The tag id for an entry, or undefined when the field it needs is unset. */\nexport function tagId(entry: AdPropertySetup): string | undefined {\n  const field = AD_PLATFORMS[entry.provider].tag.needs;\n  return entry[field];\n}\n\n/** The consent category gating an entry's tag. `marketing` unless stated otherwise. */\nexport const categoryOf = (entry: AdPropertySetup): AdConsentCategory =>\n  entry.category ?? 'marketing';\n\nconst escapeAttr = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;');\n\n/**\n * One provider's tag, rendered as a **consent-gated, inert** `<script>`.\n *\n * `type=\"text/plain\"` with the URL on `data-src` is what makes the gate real: the\n * browser neither parses the body nor fetches the library, so an undecided\n * visitor's page issues no third-party request. Never give one of these a live\n * `src` — a gate that instead asks a loaded tracker not to track is a promise.\n *\n * Returns null when the entry has no tag id, so a caller can report the gap rather\n * than emit a snippet that initialises `undefined`.\n */\nexport function renderTag(\n  entry: AdPropertySetup,\n  strategy: 'idle' | 'async' | 'interaction' = 'idle',\n): string | null {\n  const platform = AD_PLATFORMS[entry.provider];\n  const id = tagId(entry);\n  if (!id) return null;\n  const attrs = [\n    'type=\"text/plain\"',\n    'data-vitops-tag',\n    `data-consent=\"${categoryOf(entry)}\"`,\n    `data-strategy=\"${strategy}\"`,\n    ...(platform.tag.src ? [`data-src=\"${escapeAttr(platform.tag.src(id))}\"`] : []),\n    `data-consent-cookies=\"${escapeAttr(platform.tag.cookies.join(','))}\"`,\n  ];\n  return `<!-- ${platform.name} — gated on ${categoryOf(entry)} consent -->\\n<script ${attrs.join(' ')}>${platform.tag.bootstrap(id, entry)}</script>`;\n}\n"],"mappings":";;;;;AAqDA,SAAgB,0BACd,OACoB;CACpB,IAAI,SAAS,MAAM,OAAO,CAAC;CAC3B,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD;;AA2BA,SAAgB,6BACd,IACuB;CACvB,IAAI,MAAM,MAAM,OAAO,CAAC;CACxB,OAAO,OAAO,OAAO,WAAW,EAAE,MAAM,GAAG,IAAI;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACsCA,MAAM,iBAAiB,IAAY,UAAmC;CACpE,MAAM,SAAS,0BAA0B,MAAM,eAAe;CAC9D,MAAM,YAAY,6BAA6B,MAAM,kBAAkB;CACvE,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpC,SACC,CAAC,CAAC,KAAK,MACP,EAAE,MAAM,cAAc,YAAY,CAAC,CAAC,UAAU,KAAK,IACvD;CACA,OACE,wHACwC,GAAG,OAC3C,mBAAmB,IAAI,KAAK,KAC3B,QAAQ,SACL,kGACsC,KAAK,UACzC,OAAO,YAAY,QAAQ,KAAK,CAAC,QAAQ,WAAW,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CACjF,EAAE,KACF;AAER;;;;;;;;;;;;;;AAeA,MAAM,sBAAsB,IAAY,UAAmC;CACzE,MAAM,OAAO,MAAM;CACnB,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,KAAK,UAAU,QAAQ,4CAA4C;CACnF,OACE,sEACkB,GAAG,GAAG,KAAK,MAAM,6BAA6B,KAAK,UAAU,KAAK,MAAM,EAAE,sDACtC,KAAK,UAAU,KAAK,MAAM,EAAE,gGACa,QAAQ;AAE3G;;AAGA,MAAM,aAAa,QAAgB,YACjC,UAAU,OAAO,UAAU,OAAO,uBAAuB,OAAO,YAAY,OAAO,kCACzE,OAAO,WAAW,QAAQ;AAEtC,MAAa,eAA+C;CAC1D,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe;GAAC;GAAS;GAAU;EAAQ;EAC3C,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GAGH,OAAO;GACP,MAAM,OAAO,+CAA+C,mBAAmB,EAAE;GACjF,WAAW;GACX,SAAS;IAAC;IAAW;IAAW;IAAW;GAAQ;GACnD,YAAY;GACZ,QAAQ;EACV;EACA,cAAc,MAAM;GAClB,GAAI,OAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC,CAAC,CAAC,SAC1D,CACE,6MACF,IACA,CAAC,oFAAoF;GACzF;GACA,GAAI,EAAE,eACF;IACE;IACA;IACA;GACF,IACA,CAAC;EACP;CACF;CAEA,MAAM;EACJ,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,0CAA0C,gBAC/C,GAAG;GACpB,SAAS,CAAC,QAAQ,MAAM;GACxB,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,2KACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,WAAW;EAC3B,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QACE;EACJ;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,gCAAgC,GAAG,oHAEQ,GAAG;GAChD,SAAS;IAAC;IAAW;IAAS;IAAW;IAAQ;GAAkB;GACnE,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CACjB,kGACF;CACF;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,OAAO,kBAAkB,EAAE,cAAc,GAAG;GAC3D,SAAS,CAAC,WAAW;GACrB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,QAAQ;EACN,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,QAAQ;EACxB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,MAAM,OACJ,2DAA2D,mBAAmB,EAAE,EAAE;GACpF,YAAY,OACV,sCACG,UAAU,OAAO,0HAA0H,gBAC/H,GAAG;GACpB,SAAS,CAAC,MAAM;GAChB,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,SAAS;EACzB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,QAAQ;EACV;EACA,KAAK;GACH,OAAO;GAIP,YAAY,OACV,wEAAwE,GAAG;GAI7E,SAAS;IAAC;IAAW;IAAW;GAAM;GACtC,YAAY;GACZ,QAAQ;EACV;EACA,mBAAmB,CAAC;CACtB;CAEA,WAAW;EACT,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,MAAM;EACtB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GAEP,YAAY,OACV,GAAG,UAAU,UAAU,yBAAyB,4MAG9B,GAAG;GACvB,SAAS;IAAC;IAAoB;IAAe;GAAO;GACpD,YAAY;EACd;EACA,mBAAmB,CACjB,8EACF;CACF;CAEA,UAAU;EACR,MAAM;EACN,iBAAiB;EACjB,eAAe,CAAC,OAAO;EACvB,qBAAqB;EACrB,YAAY;EACZ,cAAc;GACZ,QAAQ;GACR,WAAW;GACX,OAAO;EACT;EACA,KAAK;GACH,OAAO;GACP,WAAW;GACX,YAAY,OACV,GAAG,UAAU,UAAU,kBAAkB,EAAE,iBAAiB,GAAG;GACjE,SAAS;IAAC;IAAS;IAAW;GAAO;GACrC,YAAY;EACd;EACA,mBAAmB,CAAC;CACtB;AACF;;AAGA,MAAa,mBAAmB,OAAO,KAAK,YAAY;;AAGxD,MAAa,gBAAgB,UAAuC,SAAS;;;;;;;;;;AAW7E,SAAgB,UAAU,UAAsB,OAAuB;CACrE,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,QAAQ,SAAS,GAAG,GAAG,OAAO;CAClC,OAAO,GAAG,aAAa,SAAS,CAAC,aAAa,aAAa,KAAK;AAClE;;AAGA,SAAgB,MAAM,OAA4C;CAEhE,OAAO,MADO,aAAa,MAAM,SAAS,CAAC,IAAI;AAEjD;;AAGA,MAAa,cAAc,UACzB,MAAM,YAAY;AAEpB,MAAM,cAAc,UAClB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM;;;;;;;;;;;;AAa3E,SAAgB,UACd,OACA,WAA6C,QAC9B;CACf,MAAM,WAAW,aAAa,MAAM;CACpC,MAAM,KAAK,MAAM,KAAK;CACtB,IAAI,CAAC,IAAI,OAAO;CAChB,MAAM,QAAQ;EACZ;EACA;EACA,iBAAiB,WAAW,KAAK,EAAE;EACnC,kBAAkB,SAAS;EAC3B,GAAI,SAAS,IAAI,MAAM,CAAC,aAAa,WAAW,SAAS,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;EAC7E,yBAAyB,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE;CACtE;CACA,OAAO,QAAQ,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,IAAI,UAAU,IAAI,KAAK,EAAE;AAC5I"}

package/dist/tracking/index.d.mts

@@ -1,4 +1,5 @@
-import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-oac2P5or.mjs";
+import { i as AdProvider } from "../types-C0hQKdsM.mjs";
+import { i as TrackingData, n as TrackingCategory, r as TrackingConfig, t as ConversionEvent } from "../types-ByK6OuXQ.mjs";
 /**
  * The ad-platform vocabulary — the one place that says which URL parameters mean
  * "this visit came from an ad", and which platform each belongs to.
@@ -83,6 +84,56 @@ export declare function getPrimaryClickId(data: TrackingData): {
   param: string;
   value: string;
 } | null;
+/** The fallback key: any paid visit with no platform-specific number. */
+export declare const DEFAULT_PAID = "default-paid";
+interface PhoneNumbersConfig {
+  /** The real number, exactly as it is displayed on the page. */
+  number: string;
+  /** One tracking number per platform, plus an optional `default-paid` fallback. */
+  sources: Readonly<Record<string, string | undefined>>;
+}
+interface SelectedNumber {
+  /** The number to display, in the format it was configured in. */
+  number: string;
+  /** The `sources` key that matched, for the conversion notification. */
+  source: string;
+}
+/** Click-ID parameter → the `site.ads` provider key it belongs to. */
+export declare const PROVIDER_BY_PARAM: Readonly<Record<string, AdProvider>>;
+/**
+ * `utm_source` values people actually write → provider key. A UTM is self-declared, so
+ * this is matched loosely; a click ID needs no such help.
+ */
+export declare const UTM_SOURCE_ALIASES: Readonly<Record<string, AdProvider>>;
+/** `utm_medium` values that mean "paid" and so qualify for `default-paid`. */
+export declare const PAID_MEDIUM: RegExp;
+/**
+ * The digits of a phone number with a leading North American `1` removed, so
+ * `+1 (613) 555-0100`, `613-555-0100` and `tel:+16135550100` all compare equal.
+ */
+export declare function phoneDigits(value: string): string;
+/** Do two displayed numbers name the same line? Empty never matches. */
+export declare function samePhone(a: string, b: string): boolean;
+/**
+ * The `tel:` URI for a displayed number. A bare ten-digit number is North American
+ * (this toolchain's market) and gets `+1`; anything already carrying a country code
+ * keeps it.
+ */
+export declare function telUri(display: string): string;
+/**
+ * Pick the number for this visit, or null to leave the real one alone.
+ *
+ * `current` is what this page's URL carried and `stored` is the `_ac` cookie. The URL
+ * wins: a visitor arriving from a Meta ad today with a stale Google click ID stored
+ * from last month is a Meta visitor now. An organic visit (neither carries anything)
+ * always returns null — nobody is shown a tracking number they were not sent to.
+ *
+ * `googleNative` is true when `site.ads.google.callTracking` is configured; Google's
+ * tag owns that swap, so a Google visit returns null here rather than competing.
+ */
+export declare function selectPhoneNumber(current: TrackingData | null, stored: TrackingData | null, config: PhoneNumbersConfig | undefined, opts?: {
+  googleNative?: boolean;
+}): SelectedNumber | null;
 /**
  * Pulling a submitter's identity out of a form's fields.
  *
@@ -108,5 +159,5 @@ interface SubmitterIdentity {
   company?: string | undefined;
 }
 export declare function identifySubmitter(formData: Record<string, string>): SubmitterIdentity;
-export type { ConversionEvent, SubmitterIdentity, TrackingCategory, TrackingConfig, TrackingData };
+export type { ConversionEvent, PhoneNumbersConfig, SelectedNumber, SubmitterIdentity, TrackingCategory, TrackingConfig, TrackingData };
 //# sourceMappingURL=index.d.mts.map

package/dist/tracking/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts","../../src/tracking/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;qBAuBa,iBAAiB,SAAS;;qBAc1B;qBAEA;;qBASA;;;;;;;;qBASA;;qBAGA;;qBAGA;;wBChDG,WAAW,yCAAyC;;;;;;;;;wBAiBpD,oBAAoB,0CAA0C;;wBAa9D,wBAAwB,MAAM;;;;;;;;;wBAe9B,iBAAiB,aAAa;;;;;;;;;wBAa9B,cACd,UAAU,qBACV,UAAU,cACV,cACC;;;;;;;;wBC3Da,iBAAiB,MAAM;;wBASvB,kBAAkB,MAAM;EAAiB;EAAe;;;;;;;;;;;;;;;;UCZvD;EACf;EACA;;;EAGA;EACA;EACA;EACA;;wBAWc,kBAAkB,UAAU,yBAAyB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/tracking/params.ts","../../src/tracking/cookie.ts","../../src/tracking/platform.ts","../../src/tracking/phone.ts","../../src/tracking/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;qBAuBa,iBAAiB,SAAS;;qBAc1B;qBAEA;;qBASA;;;;;;;;qBASA;;qBAGA;;qBAGA;;wBChDG,WAAW,yCAAyC;;;;;;;;;wBAiBpD,oBAAoB,0CAA0C;;wBAa9D,wBAAwB,MAAM;;;;;;;;;wBAe9B,iBAAiB,aAAa;;;;;;;;;wBAa9B,cACd,UAAU,qBACV,UAAU,cACV,cACC;;;;;;;;wBC3Da,iBAAiB,MAAM;;wBASvB,kBAAkB,MAAM;EAAiB;EAAe;;;qBCR3D;UAEI;;EAEf;;EAEA,SAAS,SAAS;;UAGH;;EAEf;;EAEA;;;qBAIW,mBAAmB,SAAS,eAAe;;;;;qBAU3C,oBAAoB,SAAS,eAAe;;qBAkB5C,aAAW;;;;;wBAMR,YAAY;;wBAMZ,UAAU,WAAW;;;;;;wBAUrB,OAAO;;;;;;;;;;;;wBAkCP,kBACd,SAAS,qBACT,QAAQ,qBACR,QAAQ,gCACR;EAAQ;IACP;;;;;;;;;;;;;;;UC9Gc;EACf;EACA;;;EAGA;EACA;EACA;EACA;;wBAWc,kBAAkB,UAAU,yBAAyB"}

package/dist/tracking/index.mjs

@@ -1,3 +1,4 @@
+import { t as AD_PLATFORMS } from "../providers-CEHw-j4v.mjs";
 import { t as identifySubmitter } from "../identity-C4yInICW.mjs";
 import { a as PLATFORM_PARAMS, c as TRACKING_COOKIE_DAYS, i as CLICK_ID_PARAMS, l as UTM_PARAMS, n as identifyPlatform, o as TRACKED_PARAMS, r as AB_COOKIE, s as TRACKING_COOKIE, t as getPrimaryClickId } from "../platform-Cb_RtsF1.mjs";
 
@@ -73,5 +74,114 @@ function mergeTracking(existing, captured, now) {
 	};
 }
 
-export { AB_COOKIE, CLICK_ID_PARAMS, PLATFORM_PARAMS, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, UTM_PARAMS, cookieAttributes, getPrimaryClickId, identifyPlatform, identifySubmitter, mergeTracking, parseTrackingCookie, readCookie, serializeTrackingCookie };
+// src/tracking/phone.ts
+/**
+* Which phone number a visitor should be shown — the pure decision behind call tracking.
+*
+* `site.tracking.phoneNumbers` records facts: the real number, and one number per ad
+* platform the client has provisioned with a call-tracking provider (Twilio, CallRail,
+* …), each forwarding to the real line. This module decides which one a given arrival
+* gets. It touches no DOM, cookie or clock, so it runs in a Worker and in a test, and
+* `scripts/tracking.ts` in `@getvitops/astro` mirrors it (that file is inlined into the
+* document and cannot import) — `tracking.test.ts` there pins the two.
+*
+* Google is deliberately absent from the swap when `site.ads.google.callTracking` is
+* set: Google's own tag fetches and inserts its forwarding number, and swapping a second
+* number on top would show a visitor one number and attribute the call to another.
+*/
+/** The fallback key: any paid visit with no platform-specific number. */
+const DEFAULT_PAID = "default-paid";
+/** Click-ID parameter → the `site.ads` provider key it belongs to. */
+const PROVIDER_BY_PARAM = Object.fromEntries(Object.keys(AD_PLATFORMS).flatMap((provider) => AD_PLATFORMS[provider].clickIdParams.map((param) => [param, provider])));
+/**
+* `utm_source` values people actually write → provider key. A UTM is self-declared, so
+* this is matched loosely; a click ID needs no such help.
+*/
+const UTM_SOURCE_ALIASES = {
+	google: "google",
+	facebook: "meta",
+	instagram: "meta",
+	meta: "meta",
+	fb: "meta",
+	ig: "meta",
+	bing: "microsoft",
+	microsoft: "microsoft",
+	linkedin: "linkedin",
+	reddit: "reddit",
+	tiktok: "tiktok",
+	pinterest: "pinterest",
+	snapchat: "snapchat",
+	snap: "snapchat"
+};
+/** `utm_medium` values that mean "paid" and so qualify for `default-paid`. */
+const PAID_MEDIUM = /^(cpc|ppc|paid.*|cpm|display|paidsocial|paid_social)$/i;
+/**
+* The digits of a phone number with a leading North American `1` removed, so
+* `+1 (613) 555-0100`, `613-555-0100` and `tel:+16135550100` all compare equal.
+*/
+function phoneDigits(value) {
+	const digits = value.replace(/\D/g, "");
+	return digits.length === 11 && digits.startsWith("1") ? digits.slice(1) : digits;
+}
+/** Do two displayed numbers name the same line? Empty never matches. */
+function samePhone(a, b) {
+	const da = phoneDigits(a);
+	return da.length > 0 && da === phoneDigits(b);
+}
+/**
+* The `tel:` URI for a displayed number. A bare ten-digit number is North American
+* (this toolchain's market) and gets `+1`; anything already carrying a country code
+* keeps it.
+*/
+function telUri(display) {
+	const digits = display.replace(/\D/g, "");
+	if (digits.length === 10) return `tel:+1${digits}`;
+	return `tel:+${digits}`;
+}
+/** Which provider a set of tracking data points at, by click ID first and `utm_source` second. */
+function providerOf(data) {
+	for (const [param, provider] of Object.entries(PROVIDER_BY_PARAM)) if (data[param]) return provider;
+	const source = data["utm_source"];
+	return typeof source === "string" ? UTM_SOURCE_ALIASES[source.trim().toLowerCase()] ?? null : null;
+}
+function isPaid(data) {
+	for (const param of Object.keys(PROVIDER_BY_PARAM)) if (data[param]) return true;
+	const medium = data["utm_medium"];
+	return typeof medium === "string" && PAID_MEDIUM.test(medium.trim());
+}
+/**
+* Pick the number for this visit, or null to leave the real one alone.
+*
+* `current` is what this page's URL carried and `stored` is the `_ac` cookie. The URL
+* wins: a visitor arriving from a Meta ad today with a stale Google click ID stored
+* from last month is a Meta visitor now. An organic visit (neither carries anything)
+* always returns null — nobody is shown a tracking number they were not sent to.
+*
+* `googleNative` is true when `site.ads.google.callTracking` is configured; Google's
+* tag owns that swap, so a Google visit returns null here rather than competing.
+*/
+function selectPhoneNumber(current, stored, config, opts = {}) {
+	if (!config) return null;
+	for (const data of [current, stored]) {
+		if (!data) continue;
+		const provider = providerOf(data);
+		if (provider === "google" && opts.googleNative) return null;
+		const specific = provider ? config.sources[provider] : void 0;
+		if (specific && !samePhone(specific, config.number)) return {
+			number: specific,
+			source: provider
+		};
+		if (isPaid(data) || provider) {
+			const fallback = config.sources[DEFAULT_PAID];
+			if (fallback && !samePhone(fallback, config.number) && !(provider === "google" && opts.googleNative)) return {
+				number: fallback,
+				source: DEFAULT_PAID
+			};
+			return null;
+		}
+	}
+	return null;
+}
+
+export { AB_COOKIE, CLICK_ID_PARAMS, DEFAULT_PAID, PAID_MEDIUM, PLATFORM_PARAMS, PROVIDER_BY_PARAM, TRACKED_PARAMS, TRACKING_COOKIE, TRACKING_COOKIE_DAYS, UTM_PARAMS, UTM_SOURCE_ALIASES, cookieAttributes, getPrimaryClickId, identifyPlatform, identifySubmitter, mergeTracking, parseTrackingCookie, phoneDigits, readCookie, samePhone, selectPhoneNumber, serializeTrackingCookie, telUri };
 //# sourceMappingURL=index.mjs.map