@omega.js/manager 0.1.0

package/dist/services/repo/ensure/pages.js

@@ -0,0 +1,72 @@
+/**
+ * Ensure GitHub Pages serves the brand's website from the brand repo:
+ * gh-pages source branch + custom domain from brand.url.
+ *
+ * A missing gh-pages branch is NOT an error — it appears with the first
+ * deploy (omega-manager treated it the same way). Old-world subdomain Pages
+ * repos ({brand}-{sub}-website) don't map to the monorepo (one Pages site
+ * per repo) — multi-site hosting is an open design question for the
+ * cloudflare port.
+ */
+const chalk = require('chalk').default;
+const { brandRepoName, brandRepoOwner } = require('../../../vendor/config/index.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async function ensurePages(context) {
+  const { brand, brandConfig, options = {}, githubApi: api } = context;
+
+  if (!brand.enabledTargets.includes('web')) {
+    console.log(`      ${chalk.dim('⊘ No web target — Pages not needed')}`);
+    return { status: 'success', output: { pages: { skipped: 'no web target' } } };
+  }
+
+  const repoName = brandRepoName(brandConfig);
+  const repoOwner = brandRepoOwner(brandConfig);
+  const domain = (brandConfig.brand?.url || '').replace(/^https?:\/\//, '');
+
+  // The branch only exists once the site has deployed at least once
+  if (!api.branchExists(repoOwner, repoName, 'gh-pages')) {
+    console.log(`      ${chalk.yellow('⚠')} No gh-pages branch yet — deploy the website first`);
+    return { status: 'success', output: { pages: { skipped: 'no gh-pages branch' } } };
+  }
+
+  try {
+    // Source: enabled, serving from gh-pages
+    let pages = api.getPages(repoOwner, repoName);
+
+    if (!pages) {
+      if (options.dryRun) {
+        return dryRunPlan('enable Pages on gh-pages', { status: 'success', output: { pages: { planned: ['enable', 'domain'] } } });
+      }
+      console.log(`      Enabling Pages on gh-pages...`);
+      api.enablePages(repoOwner, repoName, { branch: 'gh-pages', path: '/' });
+      console.log(`      ${chalk.green('✓')} Pages enabled`);
+      pages = api.getPages(repoOwner, repoName);
+    } else if (pages.source?.branch !== 'gh-pages') {
+      if (options.dryRun) {
+        dryRunPlan(`switch source branch ${pages.source?.branch} → gh-pages`);
+      } else {
+        console.log(`      Updating source branch to gh-pages...`);
+        api.updatePages(repoOwner, repoName, { branch: 'gh-pages', path: '/' });
+        console.log(`      ${chalk.green('✓')} Source branch updated`);
+      }
+    }
+
+    // Custom domain
+    if (pages?.cname !== domain) {
+      if (options.dryRun) {
+        return dryRunPlan(`set domain to ${domain}`, { status: 'success', output: { pages: { planned: ['domain'] } } });
+      }
+      console.log(`      Setting domain to ${chalk.cyan(domain)}...`);
+      api.setPagesDomain(repoOwner, repoName, domain);
+      console.log(`      ${chalk.green('✓')} Domain set to ${chalk.cyan(domain)}`);
+      return { status: 'success', state: { pages: { domain } }, output: { pages: { updated: ['domain'] } } };
+    }
+
+    console.log(`      ${chalk.green('✓')} Pages serving ${chalk.cyan(domain)} from gh-pages`);
+    return { status: 'success', state: { pages: { domain } } };
+  } catch (error) {
+    console.log(`      ${chalk.red('✗')} Pages configuration failed${chalk.dim(`: ${error.message}`)}`);
+    return { status: 'warned', reason: 'GitHub Pages configuration failed', output: { pages: { error: error.message } } };
+  }
+};

package/dist/services/repo/ensure/repo.js

@@ -0,0 +1,90 @@
+/**
+ * Ensure the brand-monorepo repo exists on GitHub with the right settings.
+ *
+ * Missing → created EMPTY (the brand already exists locally — the user pushes
+ * to it; no template, no clone: that's onboarding's job). Existing → diff
+ * visibility + homepage, patch only the drift (omega-manager's exact repo
+ * reconciliation, minus per-target repos).
+ *
+ * The repo identity is pure derivation from config (repo.providers.github +
+ * brand.id), so nothing about it is persisted — every service that needs it
+ * derives it the same way.
+ */
+const chalk = require('chalk').default;
+const { brandRepoName, brandRepoOwner } = require('../../../vendor/config/index.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async function ensureRepo(context) {
+  const { brandConfig, options = {}, githubApi: api } = context;
+
+  const github = brandConfig.repo?.providers?.github;
+  const repoName = brandRepoName(brandConfig);
+  const repoOwner = brandRepoOwner(brandConfig);
+  const fullName = `${repoOwner}/${repoName}`;
+  const isPrivate = github.private !== false;
+  const homepage = brandConfig.brand?.url || '';
+
+  const repo = api.getRepo(repoOwner, repoName);
+
+  // ── Missing: create it ─────────────────────────────────────────────────────
+  if (!repo) {
+    if (options.dryRun) {
+      return dryRunPlan(`create ${fullName} (${isPrivate ? 'private' : 'public'})`, { status: 'success', output: { repo: { planned: 'create' } } });
+    }
+
+    console.log(`      Creating ${chalk.cyan(fullName)}...`);
+
+    try {
+      const created = api.createRepo(repoOwner, repoName, {
+        isPrivate,
+        description: brandConfig.brand?.description || '',
+        homepage,
+      });
+
+      console.log(`      ${chalk.green('✓')} Created: ${chalk.cyan(created.html_url)}`);
+      console.log(`      ${chalk.dim(`Push your local repo: git remote add origin ${created.html_url}.git && git push -u origin main`)}`);
+
+      return {
+        status: 'success',
+        state: { repo: { fullName, htmlUrl: created.html_url, private: isPrivate } },
+        output: { repo: { created: true } },
+      };
+    } catch (error) {
+      console.log(`      ${chalk.red('✗')} Failed to create repo${chalk.dim(`: ${error.message}`)}`);
+      return { status: 'error', error: error.message };
+    }
+  }
+
+  // ── Exists: reconcile settings ─────────────────────────────────────────────
+  const updates = {};
+
+  if (repo.private !== isPrivate) {
+    updates.private = isPrivate;
+    console.log(`      private: ${repo.private} ${chalk.dim('→')} ${chalk.cyan(isPrivate)}`);
+  }
+
+  if (homepage && repo.homepage !== homepage) {
+    updates.homepage = homepage;
+    console.log(`      homepage: "${repo.homepage || '(none)'}" ${chalk.dim('→')} "${chalk.cyan(homepage)}"`);
+  }
+
+  const state = { repo: { fullName, htmlUrl: repo.html_url, private: isPrivate } };
+
+  if (Object.keys(updates).length === 0) {
+    console.log(`      ${chalk.green('✓')} ${chalk.cyan(fullName)} already configured`);
+    return { status: 'success', state };
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan('update repo settings', { status: 'success', state, output: { repo: { planned: Object.keys(updates) } } });
+  }
+
+  try {
+    api.updateRepo(repoOwner, repoName, updates);
+    console.log(`      ${chalk.green('✓')} ${chalk.cyan(fullName)} updated`);
+    return { status: 'success', state, output: { repo: { updated: Object.keys(updates) } } };
+  } catch (error) {
+    console.log(`      ${chalk.red('✗')} Failed to update repo${chalk.dim(`: ${error.message}`)}`);
+    return { status: 'error', error: error.message };
+  }
+};

package/dist/services/repo/index.js

@@ -0,0 +1,52 @@
+/**
+ * Repo service — ensures the brand's GitHub presence matches config:
+ * org profile, the brand-monorepo repo, and GitHub Pages. The monorepo
+ * cousin of omega-manager's github service (which managed one repo per
+ * target); here a brand is ONE repo.
+ *
+ * Config (brand omega.json5 `repo.providers.github`):
+ *   org      — repo owner (GitHub org or user). No default; unset = service skips.
+ *   shared   — org shared with other brands → org-level reconciliation skipped.
+ *   repo     — optional "owner/name" slug or bare name; name defaults to the
+ *              brand id, owner to repo.providers.github.org (@omega.js/config brandRepoName/
+ *              brandRepoOwner — shared with deploy --direct).
+ *   private  — repo visibility (manager default: true).
+ *   location — org profile location; only reconciled when set.
+ */
+const chalk = require('chalk').default;
+const { brandRepoName, brandRepoOwner } = require('../../vendor/config/index.js');
+const { createServiceRunner } = require('../../lib/service-runner.js');
+const { GitHubAPI } = require('./lib/github-api.js');
+
+// Operations that touch org-level settings — skipped when the org is shared
+// with other brands (one brand must not rewrite a shared org's profile)
+const SHARED_SKIP_OPERATIONS = new Set(['org']);
+
+module.exports.run = createServiceRunner({
+  serviceDir: __dirname,
+  setup: (context) => {
+    const github = context.brandConfig.repo?.providers?.github || {};
+
+    if (github.enabled === false) {
+      return { skip: true, reason: 'github.enabled = false' };
+    }
+
+    if (!github.org) {
+      return { skip: true, reason: 'no repo.providers.github.org configured (set repo.providers.github.org in config/omega.json5)' };
+    }
+
+    const repoName = brandRepoName(context.brandConfig);
+    const repoOwner = brandRepoOwner(context.brandConfig);
+    console.log(`    Repo: ${chalk.cyan(`${repoOwner}/${repoName}`)}${github.shared === true ? chalk.dim(' (shared org)') : ''}`);
+
+    // Tests inject a fake client via context.githubApi; the real one verifies
+    // gh is installed + authenticated at construction
+    const result = { githubApi: context.githubApi || new GitHubAPI() };
+
+    if (github.shared === true) {
+      result.operations = context.operations.filter((op) => !SHARED_SKIP_OPERATIONS.has(op.name));
+    }
+
+    return result;
+  },
+});

package/dist/services/repo/lib/github-api.js

@@ -0,0 +1,196 @@
+/**
+ * GitHub API client — omega-manager's gh-CLI wrapper, trimmed to the
+ * brand-monorepo surface (one repo per brand: org profile, repo settings,
+ * Pages). Old-world methods (template creation, cloning, GitHub Desktop)
+ * ride the onboarding/company-mode ports.
+ *
+ * Uses the `gh` CLI for all operations. Requires `gh` installed and
+ * authenticated — `gh auth login`, or a GH_TOKEN/GITHUB_TOKEN in the brand
+ * .env (loaded before services run; gh honors both env vars).
+ *
+ * Every invocation is execFileSync with an argv array — no shell, so
+ * brand-config values (descriptions, homepages) can never inject commands.
+ */
+
+const { execFileSync } = require('node:child_process');
+
+class GitHubAPI {
+  constructor() {
+    this.verifyGhCli();
+  }
+
+  /**
+   * Verify gh CLI is installed and authenticated
+   */
+  verifyGhCli() {
+    try {
+      execFileSync('gh', ['--version'], { encoding: 'utf8', stdio: 'pipe' });
+    } catch {
+      throw new Error('GitHub CLI (gh) is not installed. Install from: https://cli.github.com/');
+    }
+
+    try {
+      execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: 'pipe' });
+    } catch {
+      throw new Error('GitHub CLI is not authenticated. Run: gh auth login (or set GH_TOKEN in the brand .env)');
+    }
+  }
+
+  /**
+   * Run a gh CLI command (argv array, no shell) and return trimmed stdout
+   */
+  runCommand(args, options = {}) {
+    try {
+      const result = execFileSync('gh', args, {
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        ...options,
+      });
+      return result.trim();
+    } catch (error) {
+      const stderr = error.stderr?.toString() || error.message;
+      throw new Error(`gh command failed: ${stderr}`);
+    }
+  }
+
+  /**
+   * Run a gh CLI command and return parsed JSON
+   */
+  runJsonCommand(args, options = {}) {
+    const result = this.runCommand(args, options);
+    if (!result) {
+      return null;
+    }
+    return JSON.parse(result);
+  }
+
+  /**
+   * Get authenticated user info
+   */
+  getAuthenticatedUser() {
+    return this.runJsonCommand(['api', 'user']);
+  }
+
+  /**
+   * Get organization details (null if the owner is not an org / not found)
+   */
+  getOrg(orgName) {
+    try {
+      return this.runJsonCommand(['api', `orgs/${orgName}`]);
+    } catch (error) {
+      if (error.message.includes('404')) {
+        return null;
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Update organization settings
+   */
+  updateOrg(orgName, settings) {
+    const fields = Object.entries(settings)
+      .flatMap(([key, value]) => ['-f', `${key}=${String(value)}`]);
+    return this.runJsonCommand(['api', `orgs/${orgName}`, '-X', 'PATCH', ...fields]);
+  }
+
+  /**
+   * Get repository details (null if not found)
+   */
+  getRepo(owner, repoName) {
+    try {
+      return this.runJsonCommand(['api', `repos/${owner}/${repoName}`]);
+    } catch (error) {
+      if (error.message.includes('404')) {
+        return null;
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Create an empty repository (the brand monorepo already exists locally —
+   * the user pushes to it; no template, no clone)
+   */
+  createRepo(owner, name, { isPrivate = true, description = '', homepage = '' } = {}) {
+    const args = ['repo', 'create', `${owner}/${name}`, isPrivate ? '--private' : '--public'];
+
+    if (description) {
+      args.push('--description', description);
+    }
+    if (homepage) {
+      args.push('--homepage', homepage);
+    }
+
+    this.runCommand(args);
+
+    return {
+      full_name: `${owner}/${name}`,
+      html_url: `https://github.com/${owner}/${name}`,
+    };
+  }
+
+  /**
+   * Update repository settings (-F for typed values so booleans arrive as
+   * real JSON booleans, not the string "true")
+   */
+  updateRepo(owner, repoName, settings) {
+    const fields = Object.entries(settings)
+      .flatMap(([key, value]) => {
+        if (typeof value === 'boolean') {
+          return ['-F', `${key}=${value}`];
+        }
+        return ['-f', `${key}=${String(value)}`];
+      });
+    return this.runJsonCommand(['api', `repos/${owner}/${repoName}`, '-X', 'PATCH', ...fields]);
+  }
+
+  /**
+   * Check if a branch exists in the repository
+   */
+  branchExists(owner, repo, branch) {
+    try {
+      this.runJsonCommand(['api', `repos/${owner}/${repo}/branches/${branch}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Get GitHub Pages configuration (null if Pages is not enabled)
+   */
+  getPages(owner, repo) {
+    try {
+      return this.runJsonCommand(['api', `repos/${owner}/${repo}/pages`]);
+    } catch (error) {
+      if (error.message.includes('404')) {
+        return null;
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Enable GitHub Pages on a repository
+   */
+  enablePages(owner, repo, { branch = 'gh-pages', path = '/' } = {}) {
+    return this.runJsonCommand(['api', `repos/${owner}/${repo}/pages`, '-X', 'POST', '-f', `source[branch]=${branch}`, '-f', `source[path]=${path}`]);
+  }
+
+  /**
+   * Update GitHub Pages source configuration
+   */
+  updatePages(owner, repo, { branch = 'gh-pages', path = '/' } = {}) {
+    return this.runJsonCommand(['api', `repos/${owner}/${repo}/pages`, '-X', 'PUT', '-f', `source[branch]=${branch}`, '-f', `source[path]=${path}`]);
+  }
+
+  /**
+   * Set the custom domain for GitHub Pages
+   */
+  setPagesDomain(owner, repo, domain) {
+    return this.runJsonCommand(['api', `repos/${owner}/${repo}/pages`, '-X', 'PUT', '-f', `cname=${domain}`]);
+  }
+}
+
+module.exports = { GitHubAPI };

package/dist/services/search/ensure/ga-link.js

@@ -0,0 +1,57 @@
+/**
+ * Ensure Search Console is associated with the brand's GA4 property.
+ *
+ * There is NO API for this on either side (the GA Admin API supports
+ * Firebase/Ads/BigQuery links but not Search Console; the Search Console API
+ * can't read associations either) — so the check follows the firebase
+ * OAuth-redirect pattern: instructions + interactive confirm, warned until
+ * the link is confirmed. A confirmation nothing can re-check is the one kind
+ * of reconcile flag config keeps (#434): it lands at
+ * `search.providers.searchConsole.gaLinked`, so the next run believes it.
+ */
+const chalk = require('chalk').default;
+const { confirm, pressEnterToOpen } = require('../../../vendor/devkit/prompt.js');
+const { writeBrandConfig } = require('../../../lib/config-write.js');
+const { canPrompt } = require('../../../lib/run-gates.js');
+
+const CONFIG_PATH = 'search.providers.searchConsole.gaLinked';
+
+module.exports = async function ensureGaLink(context) {
+  const { brandConfig, serviceData, options = {} } = context;
+
+  if (!serviceData.propertyUrl) {
+    console.log(chalk.dim('      ⊘ No Search Console property yet — nothing to associate'));
+    return {};
+  }
+
+  const propertyId = brandConfig.analytics?.providers?.google?.propertyId;
+  if (!propertyId) {
+    console.log(chalk.dim('      ⊘ No analytics.providers.google.propertyId — nothing to associate'));
+    return {};
+  }
+
+  if (brandConfig.search?.providers?.searchConsole?.gaLinked === true) {
+    console.log(`      ${chalk.green('✓')} GA association confirmed`);
+    return {};
+  }
+
+  const associationsUrl = `https://search.google.com/search-console/settings/associations?resource_id=${encodeURIComponent(serviceData.propertyUrl)}`;
+
+  console.log(`      ${chalk.yellow('⚠')} No API exists to check the Search Console ↔ GA association`);
+  console.log(`      ${chalk.dim('→')} Associate with GA property ${chalk.cyan(propertyId)} on the associations page`);
+
+  if (canPrompt(options)) {
+    await pressEnterToOpen(associationsUrl, 'the Search Console associations page');
+    const done = await confirm({ message: `Search Console associated with GA property ${propertyId}?`, default: false });
+    if (done) {
+      writeBrandConfig(context, { [CONFIG_PATH]: true });
+      console.log(`      ${chalk.green('✓')} GA association confirmed`);
+      return {};
+    }
+  } else {
+    console.log(`      ${chalk.dim('→')} ${chalk.cyan(associationsUrl)}`);
+    console.log(`      ${chalk.dim('→')} (rerun in an interactive terminal to confirm)`);
+  }
+
+  return { status: 'warned', reason: 'GA association not confirmed — link it on the associations page', output: { gaLink: { associationsUrl } } };
+};

package/dist/services/search/ensure/property.js

@@ -0,0 +1,137 @@
+/**
+ * Ensure the domain property (`sc-domain:{domain}`) exists in Search Console.
+ *
+ * An existing property is converged proof — nothing else to check. A missing
+ * one is created in one pass: fetch the DNS_TXT verification token (idempotent
+ * — Google returns the same token until it's used), write the TXT record via
+ * Cloudflare (stale google-site-verification records at the same name are
+ * replaced), then verify — interactive runs poll until DNS propagates;
+ * non-interactive/dry runs attempt verification ONCE, report warned, and the
+ * rerun converges.
+ */
+const chalk = require('chalk').default;
+const { pollWithSpinner } = require('../../../vendor/devkit/flows.js');
+const { canPrompt, dryRunPlan } = require('../../../lib/run-gates.js');
+
+// Google answers this when the domain was verified by an earlier attempt
+const isAlreadyVerified = (error) => error.message.includes('already verified')
+  || error.message.includes('already been verified');
+
+module.exports = async function ensureProperty(context) {
+  const { searchConsoleApi: api, cloudflareApi, domain, apexDomain, propertyUrl, options = {} } = context;
+
+  // === READ: does the domain property already exist? ===
+  const sites = await api.listSites();
+  const existing = sites.find((site) => site.siteUrl === propertyUrl);
+
+  if (existing) {
+    console.log(`      ${chalk.green('✓')} Domain property exists (${chalk.cyan(existing.permissionLevel)})`);
+    return { state: { propertyUrl, permissionLevel: existing.permissionLevel } };
+  }
+
+  console.log(`      ${chalk.dim('→')} Domain property ${chalk.cyan(propertyUrl)} does not exist yet`);
+
+  if (options.dryRun) {
+    return dryRunPlan('verify the domain (DNS TXT) and add the property', { output: { property: { planned: 'verify-and-add' } } });
+  }
+
+  // === Verification token (same token returned until verification succeeds) ===
+  const tokenResponse = await api.getVerificationToken(domain, 'DNS_TXT', 'INET_DOMAIN');
+  if (!tokenResponse.token) {
+    throw new Error('No verification token received from Google Site Verification');
+  }
+  const token = tokenResponse.token;
+
+  // === TXT record via Cloudflare ===
+  // The record lives at the property's own name (apex '@', or the subdomain
+  // label for subdomain brands) in the APEX zone
+  const recordName = domain === apexDomain ? '@' : domain.replace(`.${apexDomain}`, '');
+  const recordFqdn = domain;
+
+  if (!cloudflareApi) {
+    console.log(`      ${chalk.yellow('⚠')} No CLOUDFLARE_TOKEN — add this TXT record manually, then rerun:`);
+    console.log(`        ${chalk.cyan(recordFqdn)}  TXT  ${chalk.cyan(`"${token}"`)}`);
+    return { status: 'warned', reason: 'no CLOUDFLARE_TOKEN — add the verification TXT record by hand', output: { property: { manualRecord: { name: recordFqdn, type: 'TXT', content: token } } } };
+  }
+
+  const zone = await cloudflareApi.getZoneByName(apexDomain);
+  if (!zone) {
+    console.log(`      ${chalk.yellow('⚠')} No Cloudflare zone for ${chalk.cyan(apexDomain)} — rerun once the cloudflare service creates it`);
+    return { status: 'warned', reason: 'no Cloudflare zone yet', output: { property: { note: 'no Cloudflare zone yet' } } };
+  }
+
+  const records = await cloudflareApi.makeRequest(`/zones/${zone.id}/dns_records?type=TXT&per_page=100`, { method: 'GET' });
+  const atName = (records.result || []).filter((r) => r.type === 'TXT' && r.name === recordFqdn);
+  const tokenRecord = atName.find((r) => r.content === token || r.content === `"${token}"`);
+
+  if (tokenRecord) {
+    console.log(`      ${chalk.dim('→')} Verification TXT record already in place`);
+  } else {
+    // Stale tokens from older verification attempts just add confusion —
+    // replace them (only google-site-verification records are touched)
+    for (const stale of atName.filter((r) => r.content.includes('google-site-verification'))) {
+      await cloudflareApi.makeRequest(`/zones/${zone.id}/dns_records/${stale.id}`, { method: 'DELETE' });
+      console.log(`      ${chalk.dim('↻')} Deleted stale verification record`);
+    }
+
+    await cloudflareApi.makeRequest(`/zones/${zone.id}/dns_records`, {
+      method: 'POST',
+      body: JSON.stringify({
+        type: 'TXT',
+        name: recordName,
+        content: `"${token}"`,
+        ttl: 60,
+        comment: 'Google domain verification',
+      }),
+    });
+    console.log(`      ${chalk.green('✓')} Verification TXT record added`);
+  }
+
+  // === Verify — DNS may need a minute; interactive runs wait it out ===
+  let verified = false;
+  let lastError = null;
+  try {
+    await api.verifySite(domain, 'DNS_TXT', 'INET_DOMAIN');
+    verified = true;
+  } catch (error) {
+    verified = isAlreadyVerified(error);
+    lastError = error.message;
+  }
+
+  if (!verified && canPrompt(options)) {
+    const result = await pollWithSpinner({
+      check: async () => {
+        try {
+          await api.verifySite(domain, 'DNS_TXT', 'INET_DOMAIN');
+          return { done: true };
+        } catch (error) {
+          // Anything else = DNS still propagating; keep polling
+          return isAlreadyVerified(error) ? { done: true } : { done: false };
+        }
+      },
+      intervalMs: 5000,
+      message: 'Waiting for DNS propagation',
+      indent: '        ',
+    });
+    verified = result.success;
+  }
+
+  if (!verified) {
+    console.log(`      ${chalk.yellow('⚠')} Verification pending${lastError ? chalk.dim(` (${lastError})`) : ''} — DNS is likely still propagating, rerun in a few minutes`);
+    return { status: 'warned', reason: 'domain verification pending — DNS is still propagating', output: { property: { pendingVerification: true } } };
+  }
+  console.log(`      ${chalk.green('✓')} Domain verified`);
+
+  // === Add the property ===
+  try {
+    await api.addSite(propertyUrl);
+    console.log(`      ${chalk.green('✓')} Domain property added to Search Console`);
+  } catch (error) {
+    if (!error.message.includes('already exists')) {
+      throw error;
+    }
+  }
+  console.log(`      ${chalk.dim('→')} Dashboard: https://search.google.com/search-console?resource_id=${encodeURIComponent(propertyUrl)}`);
+
+  return { state: { propertyUrl, verificationMethod: 'DNS_TXT' } };
+};

package/dist/services/search/ensure/sitemaps.js

@@ -0,0 +1,70 @@
+/**
+ * Ensure the configured sitemaps are submitted for the domain property.
+ *
+ * Submits only what's MISSING — omega-manager resubmitted existing sitemaps
+ * on every run ("refresh"), which made a converged brand mutate forever;
+ * Google re-crawls submitted sitemaps on its own. Paths come from
+ * `search.providers.searchConsole.sitemapPaths` (default `/sitemap.xml`); brands without a
+ * web target have no sitemap to serve and are skipped.
+ */
+const chalk = require('chalk').default;
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async function ensureSitemaps(context) {
+  const { searchConsoleApi: api, brandConfig, brand, domain, serviceData, options = {} } = context;
+
+  if (brandConfig.search?.providers?.searchConsole?.submitSitemap === false) {
+    console.log(chalk.dim('      ⊘ Sitemap submission disabled (search.providers.searchConsole.submitSitemap = false)'));
+    return {};
+  }
+
+  if (!brand.enabledTargets.includes('web')) {
+    console.log(chalk.dim('      ⊘ No web target — no sitemap to submit'));
+    return {};
+  }
+
+  if (!serviceData.propertyUrl) {
+    console.log(chalk.dim('      ⊘ No Search Console property yet — rerun once the property is verified'));
+    return {};
+  }
+
+  const siteUrl = serviceData.propertyUrl;
+  const paths = brandConfig.search?.providers?.searchConsole?.sitemapPaths || ['/sitemap.xml'];
+  const wanted = paths.map((path) => `https://${domain}${path}`);
+
+  // === READ ===
+  const existing = await api.listSitemaps(siteUrl);
+  const existingPaths = new Set(existing.map((s) => s.path));
+
+  const missing = wanted.filter((url) => !existingPaths.has(url));
+
+  if (missing.length === 0) {
+    console.log(`      ${chalk.green('✓')} All ${wanted.length} sitemap(s) submitted`);
+    return { output: { sitemaps: { submitted: 0, existing: wanted.length } } };
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan(`submit ${missing.length} sitemap(s): ${missing.join(', ')}`, { output: { sitemaps: { planned: missing } } });
+  }
+
+  // === WRITE: submit only the missing ones ===
+  const submitted = [];
+  const errors = [];
+  for (const url of missing) {
+    try {
+      await api.submitSitemap(siteUrl, url);
+      submitted.push(url);
+      console.log(`      ${chalk.green('✓')} Submitted: ${chalk.cyan(url)}`);
+    } catch (error) {
+      errors.push({ url, error: error.message });
+      console.log(`      ${chalk.yellow('⚠')} Failed: ${chalk.cyan(url)}${chalk.dim(` — ${error.message}`)}`);
+    }
+  }
+
+  const result = { output: { sitemaps: { submitted: submitted.length, existing: wanted.length - missing.length, errors } } };
+  if (errors.length > 0) {
+    result.status = 'warned';
+    result.reason = `${errors.length} sitemap(s) failed to submit: ${errors.map((e) => e.url).join(', ')}`;
+  }
+  return result;
+};