deepline 0.3.86 → 0.3.87

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-legacy-aliases.ts

@@ -0,0 +1,16 @@
+const LEGACY_STORED_PROVIDER_MONITOR_CAPABILITY_ALIASES: Readonly<
+  Record<string, string>
+> = {
+  'tamradar.company_radar': 'deepline_native.company_radar',
+  'tamradar.contact_radar': 'deepline_native.contact_radar',
+  'tamradar.industry_radar': 'deepline_native.industry_radar',
+};
+
+export function canonicalizeStoredProviderMonitorCapabilityId(
+  providerCapability: string,
+): string {
+  return (
+    LEGACY_STORED_PROVIDER_MONITOR_CAPABILITY_ALIASES[providerCapability] ??
+    providerCapability
+  );
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-priority-execution.ts

@@ -0,0 +1,56 @@
+import type { ProviderMonitorCapabilityDefinition } from '@deepline/monitors/provider-monitor-capability';
+import type { ProviderMonitorStatus } from './provider-monitor-status';
+
+export const PRIORITY_MONITOR_EXECUTION_TYPE = 'priority' as const;
+export const MAX_PRIORITY_MONITORS_PER_ORG = 10;
+
+export const PRIORITY_MONITOR_SLOT_STATUSES = [
+  'active',
+  // A billing suspension writes disabled before upstream deprovisioning. Keep
+  // the slot occupied until that delete confirms success and clears the
+  // projection; a failed cleanup can leave the priority radar live.
+  'disabled',
+  'deleting',
+  'error',
+  'deleted',
+  // A fleet monitor holds its priority reservation from the commit that
+  // records the desired state, not from the provider create that follows it.
+  'pending_create',
+] as const satisfies readonly ProviderMonitorStatus[];
+
+const PRIORITY_MONITOR_SLOT_STATUS_SET = new Set<ProviderMonitorStatus>(
+  PRIORITY_MONITOR_SLOT_STATUSES,
+);
+
+export function requestedPriorityMonitorExecution(definition: {
+  controls?: Record<string, unknown>;
+}) {
+  return (
+    definition.controls?.execution_type === PRIORITY_MONITOR_EXECUTION_TYPE
+  );
+}
+
+export function priorityMonitorExecutionIsSupported(
+  capability: ProviderMonitorCapabilityDefinition,
+) {
+  return capability.provider === 'deepline_native';
+}
+
+export function priorityMonitorConsumesSlot(input: {
+  priorityExecution: boolean;
+  status: ProviderMonitorStatus;
+}) {
+  return (
+    input.priorityExecution &&
+    PRIORITY_MONITOR_SLOT_STATUS_SET.has(input.status)
+  );
+}
+
+export function priorityMonitorReservedSlotCount(input: {
+  priorityExecution: boolean;
+  status: ProviderMonitorStatus;
+  priorityExecutionSlots?: number;
+}) {
+  if (!priorityMonitorConsumesSlot(input)) return 0;
+  return input.priorityExecutionSlots === 2 ? 2 : 1;
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-public-aliases.ts

@@ -0,0 +1,28 @@
+import {
+  ANALYTICS_INTEGRATION_SLUG,
+  ANALYTICS_PUBLIC_PROVIDER,
+  ANALYTICS_PUBLIC_TOOL,
+} from '@/lib/analytics/public';
+
+export const ANALYTICS_MONITOR_KEY = ANALYTICS_INTEGRATION_SLUG;
+export const ANALYTICS_INTERNAL_MONITOR_KEY = 'snitcher-website-sessions';
+export const ANALYTICS_INTERNAL_TOOL = 'snitcher.website_sessions';
+
+export function canonicalProviderMonitorKey(key: string) {
+  return key === ANALYTICS_MONITOR_KEY ? ANALYTICS_INTERNAL_MONITOR_KEY : key;
+}
+
+/** Convert a customer-facing monitor tool id to its internal registry id. */
+export function canonicalProviderMonitorTool(tool: string) {
+  return tool === ANALYTICS_PUBLIC_TOOL ? ANALYTICS_INTERNAL_TOOL : tool;
+}
+
+/** Convert an internal registry id to the stable customer-facing tool id. */
+export function publicProviderMonitorTool(tool: string) {
+  return tool === ANALYTICS_INTERNAL_TOOL ? ANALYTICS_PUBLIC_TOOL : tool;
+}
+
+/** Convert an internal provider name to the stable customer-facing name. */
+export function publicProviderMonitorProvider(provider: string) {
+  return provider === 'snitcher' ? ANALYTICS_PUBLIC_PROVIDER : provider;
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-runtime-read-eligibility.ts

@@ -0,0 +1,38 @@
+type ProviderMonitorCallbackRuntimeRow = {
+  status: string;
+  billing_state: unknown;
+};
+
+function billingStateKind(value: unknown) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const state = (value as Record<string, unknown>).state;
+  return typeof state === 'string' && state.trim() ? state.trim() : null;
+}
+
+/** True when an admitted callback is allowed to write an event for this monitor. */
+export function isProviderMonitorCallbackWriteEnabled(
+  row: Pick<ProviderMonitorCallbackRuntimeRow, 'status'>,
+) {
+  return row.status === 'active';
+}
+
+/**
+ * Matches the Customer DB callback lookup predicate for a row that has already
+ * been selected from the Convex callback-token projection.
+ */
+export function isProviderMonitorCallbackRuntimeEligible(
+  row: ProviderMonitorCallbackRuntimeRow,
+) {
+  if (isProviderMonitorCallbackWriteEnabled(row)) {
+    return true;
+  }
+  return (
+    row.status === 'disabled' &&
+    (billingStateKind(row.billing_state) === 'upstream_disable_pending' ||
+      billingStateKind(row.billing_state) === 'upstream_disable_failed' ||
+      // A credit suspension turns the provider resource off but does not turn
+      // off receipt capture. The inbound processor stores raw provenance and
+      // returns its explicit billing-suspended outcome without typed writes.
+      billingStateKind(row.billing_state) === 'billing_suspended')
+  );
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-status.ts

@@ -0,0 +1,10 @@
+export type ProviderMonitorStatus =
+  | 'replacement_pending'
+  | 'replacement_active_old_cleanup_pending'
+  | 'replacement_cleanup_failed'
+  | 'active'
+  | 'disabled'
+  | 'deleted'
+  | 'deleting'
+  | 'error'
+  | 'pending_create';

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -0,0 +1,112 @@
+// Convex-safe provider monitor identity contract.
+//
+// This deliberately contains only declarative identity metadata and pure
+// normalization. Convex claim mutations import it directly, so it must not
+// pull in the Node-only provider registry, generated OpenAPI loaders, or any
+// deployment runtime. A monitor provider adds its account-unique identity here
+// and declares the same fields on its capability; registry validation keeps the
+// two declarations aligned.
+
+export type ProviderMonitorUpstreamIdentityValue = string | null;
+
+export type ProviderMonitorUpstreamIdentitySignature = {
+  tool: string;
+  key: Record<string, ProviderMonitorUpstreamIdentityValue>;
+};
+
+type ProviderMonitorUpstreamIdentityField = {
+  name: string;
+  // A provider runtime payload can use its upstream request name while the
+  // public monitor definition uses a clearer field name. Identity backfills
+  // use this declarative alias rather than provider-specific conditionals.
+  runtimePayloadAliases?: readonly string[];
+};
+
+const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
+  'deepline_native.company_radar': [{ name: 'radar_type' }, { name: 'domain' }],
+  'deepline_native.contact_radar': [
+    { name: 'radar_type' },
+    { name: 'profile_url' },
+  ],
+  'deepline_native.industry_radar': [
+    { name: 'radar_type' },
+    { name: 'industry', runtimePayloadAliases: ['keyword'] },
+  ],
+} as const satisfies Record<
+  string,
+  readonly ProviderMonitorUpstreamIdentityField[]
+>;
+
+function canonicalMonitorTool(tool: string) {
+  // Public TamRadar ids existed before the deepline_native hard cutover. Keep
+  // their legacy control records in the same claim namespace during migration.
+  return tool.startsWith('tamradar.')
+    ? `deepline_native.${tool.slice('tamradar.'.length)}`
+    : tool;
+}
+
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>)
+      .filter(([, entry]) => entry !== undefined)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`);
+    return `{${entries.join(',')}}`;
+  }
+  return JSON.stringify(value) ?? 'null';
+}
+
+export function normalizeProviderMonitorUpstreamIdentityValue(
+  value: unknown,
+): ProviderMonitorUpstreamIdentityValue {
+  if (value === null || value === undefined) return null;
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    return normalized || null;
+  }
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  if (Array.isArray(value)) {
+    const normalized = value
+      .map(normalizeProviderMonitorUpstreamIdentityValue)
+      .filter((entry): entry is string => entry !== null)
+      .sort();
+    return normalized.length ? normalized.join(',') : null;
+  }
+  return stableJson(value).toLowerCase();
+}
+
+export function providerMonitorUpstreamIdentityFields(tool: string) {
+  const canonical = canonicalMonitorTool(tool);
+  return PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+    canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+  ]?.map((field) => field.name);
+}
+
+export function providerMonitorUpstreamIdentitySignature(
+  tool: string,
+  payload: Record<string, unknown> | null | undefined,
+): ProviderMonitorUpstreamIdentitySignature | null {
+  const canonical = canonicalMonitorTool(tool);
+  const fields =
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ];
+  if (!fields?.length) return null;
+  const key: Record<string, ProviderMonitorUpstreamIdentityValue> = {};
+  for (const field of fields) {
+    const aliases =
+      'runtimePayloadAliases' in field
+        ? field.runtimePayloadAliases
+        : undefined;
+    const value =
+      payload?.[field.name] ??
+      aliases
+        ?.map((alias) => payload?.[alias])
+        .find((aliasValue) => aliasValue !== undefined);
+    key[field.name] = normalizeProviderMonitorUpstreamIdentityValue(value);
+  }
+  return { tool: canonical, key };
+}

package/dist/bundling-sources/shared_libs/monitors/provider-webhook-monitor-runtime.ts

@@ -0,0 +1,300 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import type { ProviderMonitorCapabilityDefinition } from '@deepline/monitors/provider-monitor-capability';
+import {
+  createProviderCallbackSecret,
+  MONITOR_CALLBACK_SECRET_HEADER,
+} from '@deepline/monitors/provider-callback-verification';
+
+type ProviderMonitorDefinitionLike = {
+  key: string;
+  name?: string;
+  payload?: Record<string, unknown>;
+};
+
+const DEFAULT_MONITOR_CALLBACK_BASE_URL = 'http://localhost:3000';
+const DEFAULT_PREVIEW_CALLBACK_URL_FILE =
+  '.cache/dev/plays-preview-callback-url';
+
+function readRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function readString(value: unknown) {
+  if (typeof value === 'number' && Number.isFinite(value)) return String(value);
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  return trimmed || null;
+}
+
+function firstString(...values: unknown[]) {
+  for (const value of values) {
+    const string = readString(value);
+    if (string) return string;
+  }
+  return null;
+}
+
+function isAbsoluteFilePath(value: string) {
+  return value.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(value);
+}
+
+function cwdRelativePath(value: string) {
+  return isAbsoluteFilePath(value) ? value : `${process.cwd()}/${value}`;
+}
+
+function readPreviewCallbackUrlFile(
+  environment: NodeJS.ProcessEnv = process.env,
+) {
+  const configuredPath = environment.DEEPLINE_PREVIEW_CALLBACK_URL_FILE?.trim();
+  const filePath = cwdRelativePath(
+    configuredPath || DEFAULT_PREVIEW_CALLBACK_URL_FILE,
+  );
+  try {
+    if (!existsSync(filePath)) return null;
+    return readString(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function readStringArray(value: unknown) {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((item) => readString(item))
+    .filter((item): item is string => Boolean(item));
+}
+
+function readNumberArray(value: unknown) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (item): item is number =>
+      typeof item === 'number' && Number.isInteger(item),
+  );
+}
+
+function boundedName(value: string, maxLength: number) {
+  const normalized = value.replace(/\s+/g, ' ').trim();
+  if (normalized.length <= maxLength) return normalized;
+  return normalized.slice(0, maxLength).trim();
+}
+
+function managedWebhookName(input: {
+  definition: ProviderMonitorDefinitionLike;
+  provider: string;
+  maxLength?: number;
+}) {
+  const source = input.definition.name ?? input.definition.key;
+  const name = `Deepline ${input.provider} ${source}`;
+  return boundedName(name, input.maxLength ?? 80);
+}
+
+/**
+ * Resolve the externally reachable origin for provider callbacks and durable
+ * workers. Local Convex actions need the preview tunnel, not a loopback URL.
+ */
+export function resolveProviderMonitorCallbackBaseUrl(
+  explicit?: string | null,
+  environment: NodeJS.ProcessEnv = process.env,
+) {
+  const baseUrl =
+    explicit ||
+    environment.DEEPLINE_WORKER_CALLBACK_URL ||
+    readPreviewCallbackUrlFile(environment) ||
+    environment.WORKTREE_PUBLIC_APP_URL ||
+    environment.DEEPLINE_API_BASE_URL ||
+    environment.NEXT_PUBLIC_APP_URL ||
+    environment.APP_URL ||
+    environment.VERCEL_URL ||
+    DEFAULT_MONITOR_CALLBACK_BASE_URL;
+  return baseUrl.startsWith('http') ? baseUrl : `https://${baseUrl}`;
+}
+
+export function createProviderWebhookCallbackToken() {
+  return randomBytes(32).toString('hex');
+}
+
+export function providerWebhookCallbackPath(input: {
+  provider: string;
+  orgId: string;
+  token: string;
+}) {
+  return `/api/v2/monitors/provider-callbacks/webhook/${encodeURIComponent(
+    input.provider,
+  )}/${encodeURIComponent(input.orgId)}/${encodeURIComponent(input.token)}`;
+}
+
+export function buildProviderWebhookCallbackUrl(input: {
+  provider: string;
+  orgId: string;
+  token: string;
+  callbackBaseUrl?: string | null;
+}) {
+  const baseUrl = resolveProviderMonitorCallbackBaseUrl(input.callbackBaseUrl);
+  if (input.provider === 'snitcher') {
+    return `${baseUrl.replace(/\/$/, '')}/api/v2/monitors/provider-callbacks/deepline-analytics`;
+  }
+  return `${baseUrl.replace(/\/$/, '')}${providerWebhookCallbackPath(input)}`;
+}
+
+export function readProviderWebhookCallbackUrl(
+  payload: Record<string, unknown>,
+) {
+  const webhook = readRecord(payload.webhook);
+  return firstString(
+    payload.target_url,
+    payload.target_hook_url,
+    payload.webhook_url,
+    webhook.webhook_url,
+  );
+}
+
+export function extractProviderWebhookId(raw: unknown) {
+  const root = readRecord(raw);
+  const data = readRecord(root.data);
+  const result = readRecord(root.result);
+  const resultData = readRecord(result.data);
+  const webhook = readRecord(root.webhook);
+  const dataWebhook = readRecord(data.webhook);
+  const id = readRecord(root.id);
+  const dataId = readRecord(data.id);
+  const resultDataId = readRecord(resultData.id);
+  return firstString(
+    root.webhook_id,
+    root.webhookId,
+    root.hook_id,
+    root.hookId,
+    root.id,
+    root._id,
+    data.webhook_id,
+    data.webhookId,
+    data.hook_id,
+    data.hookId,
+    data.id,
+    data._id,
+    result.webhook_id,
+    result.webhookId,
+    result.hook_id,
+    result.hookId,
+    result.id,
+    result._id,
+    resultData.webhook_id,
+    resultData.webhookId,
+    resultData.hook_id,
+    resultData.hookId,
+    resultData.id,
+    resultData._id,
+    webhook.webhook_id,
+    webhook.id,
+    dataWebhook.webhook_id,
+    dataWebhook.id,
+    id.webhook_id,
+    dataId.webhook_id,
+    resultDataId.webhook_id,
+  );
+}
+
+export function buildProviderWebhookRuntimePayload(input: {
+  definition: ProviderMonitorDefinitionLike;
+  capability: ProviderMonitorCapabilityDefinition;
+  callbackUrl: string;
+}) {
+  const payload = input.definition.payload ?? {};
+  const provider = input.capability.provider;
+  switch (provider) {
+    case 'attio':
+      return {
+        target_url: input.callbackUrl,
+        subscriptions: readStringArray(payload.event_types).map(
+          (eventType) => ({
+            event_type: eventType,
+          }),
+        ),
+      };
+    case 'lemlist':
+      return {
+        target_url: input.callbackUrl,
+        type: readString(payload.event_type),
+        secret: createProviderCallbackSecret('lemlist'),
+        ...(readString(payload.campaign_id)
+          ? { campaign_id: readString(payload.campaign_id) }
+          : {}),
+      };
+    case 'instantly':
+      return {
+        target_hook_url: input.callbackUrl,
+        event_type: readString(payload.event_type),
+        headers: {
+          [MONITOR_CALLBACK_SECRET_HEADER]:
+            createProviderCallbackSecret('instantly'),
+        },
+        name: managedWebhookName({
+          definition: input.definition,
+          provider,
+        }),
+        ...(readString(payload.campaign_id)
+          ? { campaign: readString(payload.campaign_id) }
+          : {}),
+      };
+    case 'smartlead':
+      return {
+        campaign_id: payload.campaign_id,
+        webhook: {
+          id: null,
+          name: managedWebhookName({
+            definition: input.definition,
+            provider,
+          }),
+          webhook_url: input.callbackUrl,
+          event_types: readStringArray(payload.event_types),
+          ...(readStringArray(payload.categories).length
+            ? { categories: readStringArray(payload.categories) }
+            : {}),
+        },
+      };
+    case 'heyreach':
+      return {
+        webhook_name: managedWebhookName({
+          definition: input.definition,
+          provider,
+          maxLength: 25,
+        }),
+        webhook_url: input.callbackUrl,
+        event_type: readString(payload.event_type),
+        ...(readNumberArray(payload.campaign_ids).length
+          ? { campaign_ids: readNumberArray(payload.campaign_ids) }
+          : {}),
+      };
+    case 'vector':
+      // Vector's dashboard owns the webhook resource. This payload is durable
+      // setup evidence, not an upstream API request.
+      return {
+        callback_url: input.callbackUrl,
+        event_type: 'contact.visited',
+      };
+    case 'rb2b':
+      // RB2B's dashboard owns the single webhook connection. This payload is
+      // durable setup evidence, not an upstream API request.
+      return {
+        callback_url: input.callbackUrl,
+      };
+    case 'snitcher':
+      // Radar is configured at the operator level. The callback URL is durable
+      // evidence of the Deepline-owned receiver; the setup API creates the
+      // customer tracker and configures session delivery upstream.
+      return {
+        callback_url: input.callbackUrl,
+        domains: readStringArray(payload.domains),
+        form_tracking: payload.formTracking === true,
+        click_tracking: payload.clickTracking === true,
+        custom_events: payload.customEvents !== false,
+        wait_for_consent: payload.waitForConsent !== false,
+      };
+    default:
+      throw new Error(
+        `Provider webhook monitor payload builder is not implemented for ${provider}.`,
+      );
+  }
+}

package/dist/bundling-sources/shared_libs/monitors/quickstart-prompts.ts

@@ -0,0 +1,22 @@
+export type MonitorQuickstartPrompt = {
+  prompt: string;
+  icon: 'job-change' | 'new-hires' | 'hiring-signal';
+};
+
+export const MONITOR_QUICKSTART_PROMPTS: MonitorQuickstartPrompt[] = [
+  {
+    prompt:
+      '/deepline-gtm Monitor my target accounts for new VP Sales, Marketing, and Revenue hires.',
+    icon: 'new-hires',
+  },
+  {
+    prompt:
+      '/deepline-gtm Monitor when people at my target accounts change jobs.',
+    icon: 'job-change',
+  },
+  {
+    prompt:
+      '/deepline-gtm Monitor my target accounts for job openings in the roles I sell to.',
+    icon: 'hiring-signal',
+  },
+];

package/dist/bundling-sources/shared_libs/monitors/snitcher-install-validation.ts

@@ -0,0 +1,93 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { DEEPLINE_ANALYTICS_BROWSER_OBJECT } from '@/lib/analytics/public';
+
+export type SnitcherInstallationCheck = {
+  domain: string;
+  status: 'installed' | 'not_found' | 'unreachable';
+  message: string;
+};
+
+export async function validateSnitcherInstallation(input: {
+  domains: string[];
+  trackingScriptId: string;
+}) {
+  return await Promise.all(
+    input.domains.map(async (domain): Promise<SnitcherInstallationCheck> => {
+      // Domains were validated and stored during setup. Never accept arbitrary URLs here.
+      if (isIP(domain) || domain === 'localhost')
+        return {
+          domain,
+          status: 'unreachable',
+          message: 'This domain cannot be checked.',
+        };
+      try {
+        const addresses = await lookup(domain, { all: true });
+        if (
+          !addresses.length ||
+          addresses.some(({ address }) => {
+            if (isIP(address) === 6) {
+              const lower = address.toLowerCase();
+              return (
+                lower === '::1' ||
+                lower.startsWith('fc') ||
+                lower.startsWith('fd') ||
+                lower.startsWith('fe80:')
+              );
+            }
+            const [a, b] = address.split('.').map(Number);
+            return (
+              a === 0 ||
+              a === 10 ||
+              a === 127 ||
+              (a === 169 && b === 254) ||
+              (a === 172 && b >= 16 && b <= 31) ||
+              (a === 192 && b === 168) ||
+              (a === 100 && b >= 64 && b <= 127)
+            );
+          })
+        )
+          return {
+            domain,
+            status: 'unreachable',
+            message: 'This domain cannot be checked.',
+          };
+        const response = await fetch(`https://${domain}`, {
+          redirect: 'error',
+          signal: AbortSignal.timeout(10_000),
+          headers: {
+            Accept: 'text/html',
+            'User-Agent': 'DeeplineTrackerValidator/1.0',
+          },
+        });
+        if (!response.ok)
+          return {
+            domain,
+            status: 'unreachable',
+            message: `The site returned HTTP ${response.status}.`,
+          };
+        const body = (await response.text()).slice(0, 500_000);
+        const installed =
+          body.includes(input.trackingScriptId) &&
+          body.includes(DEEPLINE_ANALYTICS_BROWSER_OBJECT);
+        return installed
+          ? {
+              domain,
+              status: 'installed',
+              message: 'Tracker found in the page source.',
+            }
+          : {
+              domain,
+              status: 'not_found',
+              message: 'Tracker was not found in the page source yet.',
+            };
+      } catch {
+        return {
+          domain,
+          status: 'unreachable',
+          message: 'Could not reach this site over HTTPS.',
+        };
+      }
+    }),
+  );
+}