@ainyc/canonry 1.45.0 → 1.45.2

package/dist/{chunk-B4EP44AR.js → chunk-WNOUK4KA.js}

@@ -23,7 +23,7 @@ import {
   runs,
   schedules,
   usageCounters
-} from "./chunk-SVPQUYTG.js";
+} from "./chunk-HO22LHTY.js";
 
 // src/config.ts
 import fs from "fs";
@@ -268,7 +268,7 @@ import crypto22 from "crypto";
 import fs5 from "fs";
 import path6 from "path";
 import { fileURLToPath } from "url";
-import { eq as eq23 } from "drizzle-orm";
+import { eq as eq23, sql as sql6 } from "drizzle-orm";
 import Fastify from "fastify";
 
 // ../contracts/src/config-schema.ts
@@ -817,7 +817,14 @@ var wordpressDiffDtoSchema = z7.object({
 import { z as z8 } from "zod";
 var runStatusSchema = z8.enum(["queued", "running", "completed", "partial", "failed", "cancelled"]);
 var RunStatuses = runStatusSchema.enum;
-var runKindSchema = z8.enum(["answer-visibility", "site-audit", "gsc-sync", "inspect-sitemap"]);
+var runKindSchema = z8.enum([
+  "answer-visibility",
+  "site-audit",
+  "gsc-sync",
+  "inspect-sitemap",
+  "ga-sync",
+  "bing-inspect"
+]);
 var RunKinds = runKindSchema.enum;
 var runTriggerSchema = z8.enum(["manual", "scheduled", "config-apply"]);
 var RunTriggers = runTriggerSchema.enum;
@@ -6171,7 +6178,14 @@ function validateDate(date, label) {
   }
 }
 function gscClientLog(level, action, ctx) {
-  const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, module: "GscClient", action, ...ctx };
+  const entry = {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    module: "GscClient",
+    action,
+    ...ctx
+  };
+  if (entry.accessToken) entry.accessToken = "***";
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
@@ -6348,7 +6362,15 @@ function validateScope(scope) {
   }
 }
 function ga4Log(level, action, ctx) {
-  const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, module: "GA4Client", action, ...ctx };
+  const entry = {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    module: "GA4Client",
+    action,
+    ...ctx
+  };
+  if (entry.accessToken) entry.accessToken = "***";
+  if (entry.privateKey) entry.privateKey = "***";
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
@@ -7542,7 +7564,15 @@ function validateUrls(urls) {
   }
 }
 function bingClientLog(level, action, ctx) {
-  const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, module: "BingClient", action, ...ctx };
+  const entry = {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    module: "BingClient",
+    action,
+    ...ctx
+  };
+  if (entry.apiKey) entry.apiKey = "***";
+  if (entry.apikey) entry.apikey = "***";
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
@@ -7793,6 +7823,7 @@ async function bingRoutes(app, opts) {
     const notIndexedUrls = [];
     const unknownUrls = [];
     let lastInspectedAt = null;
+    let snapshotRunId = null;
     for (const [, row] of latestByUrl) {
       if (row.inIndex === 1) {
         indexedUrls.push(row);
@@ -7803,6 +7834,7 @@ async function bingRoutes(app, opts) {
       }
       if (!lastInspectedAt || row.inspectedAt > lastInspectedAt) {
         lastInspectedAt = row.inspectedAt;
+        snapshotRunId = row.syncRunId ?? null;
       }
     }
     const indexed = indexedUrls.length;
@@ -7827,6 +7859,7 @@ async function bingRoutes(app, opts) {
       app.db.insert(bingCoverageSnapshots).values({
         id: crypto15.randomUUID(),
         projectId: project.id,
+        syncRunId: snapshotRunId,
         date: snapshotDate,
         indexed,
         notIndexed,
@@ -7834,7 +7867,7 @@ async function bingRoutes(app, opts) {
         createdAt: now
       }).onConflictDoUpdate({
         target: [bingCoverageSnapshots.projectId, bingCoverageSnapshots.date],
-        set: { indexed, notIndexed, unknown, createdAt: now }
+        set: { indexed, notIndexed, unknown, createdAt: now, syncRunId: snapshotRunId }
       }).run();
     }
     return {
@@ -7900,9 +7933,19 @@ async function bingRoutes(app, opts) {
       const err = validationError("url is required");
       return reply.status(err.statusCode).send(err.toJSON());
     }
-    let result;
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const runId = crypto15.randomUUID();
+    app.db.insert(runs).values({
+      id: runId,
+      projectId: project.id,
+      kind: RunKinds["bing-inspect"],
+      status: RunStatuses.running,
+      trigger: RunTriggers.manual,
+      startedAt,
+      createdAt: startedAt
+    }).run();
     try {
-      result = await getUrlInfo(conn.apiKey, conn.siteUrl, url);
+      const result = await getUrlInfo(conn.apiKey, conn.siteUrl, url);
       bingLog("info", "inspect-url.result", {
         domain: project.canonicalDomain,
         url,
@@ -7911,49 +7954,52 @@ async function bingRoutes(app, opts) {
         documentSize: result.DocumentSize ?? null,
         lastCrawledDate: result.LastCrawledDate ?? null
       });
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const id = crypto15.randomUUID();
+      const httpCode = result.HttpStatus ?? result.HttpCode ?? null;
+      let derivedInIndex = null;
+      if (result.InIndex != null) {
+        derivedInIndex = result.InIndex;
+      } else if (result.DocumentSize != null && result.DocumentSize > 0) {
+        derivedInIndex = true;
+      }
+      const lastCrawledDate = parseBingDate(result.LastCrawledDate);
+      const inIndexDate = parseBingDate(result.InIndexDate);
+      const discoveryDate = parseBingDate(result.DiscoveryDate);
+      app.db.insert(bingUrlInspections).values({
+        id,
+        projectId: project.id,
+        url,
+        httpCode,
+        inIndex: derivedInIndex === true ? 1 : derivedInIndex === false ? 0 : null,
+        lastCrawledDate,
+        inIndexDate,
+        inspectedAt: now,
+        syncRunId: runId,
+        createdAt: now,
+        documentSize: result.DocumentSize ?? null,
+        anchorCount: result.AnchorCount ?? null,
+        discoveryDate
+      }).run();
+      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: now }).where(eq15(runs.id, runId)).run();
+      return {
+        id,
+        url,
+        httpCode,
+        inIndex: derivedInIndex,
+        lastCrawledDate,
+        inIndexDate,
+        inspectedAt: now,
+        documentSize: result.DocumentSize ?? null,
+        anchorCount: result.AnchorCount ?? null,
+        discoveryDate
+      };
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       bingLog("error", "inspect-url.failed", { domain: project.canonicalDomain, url, error: msg });
+      app.db.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq15(runs.id, runId)).run();
       throw e;
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const id = crypto15.randomUUID();
-    const httpCode = result.HttpStatus ?? result.HttpCode ?? null;
-    let derivedInIndex = null;
-    if (result.InIndex != null) {
-      derivedInIndex = result.InIndex;
-    } else if (result.DocumentSize != null && result.DocumentSize > 0) {
-      derivedInIndex = true;
-    }
-    const lastCrawledDate = parseBingDate(result.LastCrawledDate);
-    const inIndexDate = parseBingDate(result.InIndexDate);
-    const discoveryDate = parseBingDate(result.DiscoveryDate);
-    app.db.insert(bingUrlInspections).values({
-      id,
-      projectId: project.id,
-      url,
-      httpCode,
-      inIndex: derivedInIndex === true ? 1 : derivedInIndex === false ? 0 : null,
-      lastCrawledDate,
-      inIndexDate,
-      inspectedAt: now,
-      createdAt: now,
-      documentSize: result.DocumentSize ?? null,
-      anchorCount: result.AnchorCount ?? null,
-      discoveryDate
-    }).run();
-    return {
-      id,
-      url,
-      httpCode,
-      inIndex: derivedInIndex,
-      lastCrawledDate,
-      inIndexDate,
-      inspectedAt: now,
-      documentSize: result.DocumentSize ?? null,
-      anchorCount: result.AnchorCount ?? null,
-      discoveryDate
-    };
   });
   app.post("/projects/:name/bing/request-indexing", async (request, reply) => {
     const store = requireConnectionStore(reply);
@@ -8434,18 +8480,28 @@ async function ga4Routes(app, opts) {
     const syncAi = !only || only === "ai";
     const syncSocial = !only || only === "social";
     const syncSummary = !only;
-    const { accessToken, propertyId } = await resolveGa4AccessToken(opts, project.name, project.canonicalDomain);
-    let rows = [];
-    let summary;
-    let aiReferrals = [];
-    let socialReferrals = [];
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const runId = crypto16.randomUUID();
+    app.db.insert(runs).values({
+      id: runId,
+      projectId: project.id,
+      kind: RunKinds["ga-sync"],
+      status: RunStatuses.running,
+      trigger: RunTriggers.manual,
+      startedAt,
+      createdAt: startedAt
+    }).run();
     try {
+      const { accessToken, propertyId } = await resolveGa4AccessToken(opts, project.name, project.canonicalDomain);
+      let rows = [];
+      let aiReferrals = [];
+      let socialReferrals = [];
       const fetches = [fetchAggregateSummary(accessToken, propertyId, days)];
       if (syncTraffic) fetches.push(fetchTrafficByLandingPage(accessToken, propertyId, days));
       if (syncAi) fetches.push(fetchAiReferrals(accessToken, propertyId, days));
       if (syncSocial) fetches.push(fetchSocialReferrals(accessToken, propertyId, days));
       const results = await Promise.all(fetches);
-      summary = results[0];
+      const summary = results[0];
       let idx = 1;
       if (syncTraffic) {
         rows = results[idx++];
@@ -8456,111 +8512,118 @@ async function ga4Routes(app, opts) {
       if (syncSocial) {
         socialReferrals = results[idx++];
       }
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      gaLog("error", "sync.fetch-failed", { projectId: project.id, error: msg });
-      throw e;
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    app.db.transaction((tx) => {
-      if (syncTraffic) {
-        tx.delete(gaTrafficSnapshots).where(
-          and6(
-            eq17(gaTrafficSnapshots.projectId, project.id),
-            sql3`${gaTrafficSnapshots.date} >= ${summary.periodStart}`,
-            sql3`${gaTrafficSnapshots.date} <= ${summary.periodEnd}`
-          )
-        ).run();
-        for (const row of rows) {
-          tx.insert(gaTrafficSnapshots).values({
-            id: crypto16.randomUUID(),
-            projectId: project.id,
-            date: row.date,
-            landingPage: row.landingPage,
-            sessions: row.sessions,
-            organicSessions: row.organicSessions,
-            users: row.users,
-            syncedAt: now
-          }).run();
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      app.db.transaction((tx) => {
+        if (syncTraffic) {
+          tx.delete(gaTrafficSnapshots).where(
+            and6(
+              eq17(gaTrafficSnapshots.projectId, project.id),
+              sql3`${gaTrafficSnapshots.date} >= ${summary.periodStart}`,
+              sql3`${gaTrafficSnapshots.date} <= ${summary.periodEnd}`
+            )
+          ).run();
+          for (const row of rows) {
+            tx.insert(gaTrafficSnapshots).values({
+              id: crypto16.randomUUID(),
+              projectId: project.id,
+              date: row.date,
+              landingPage: row.landingPage,
+              sessions: row.sessions,
+              organicSessions: row.organicSessions,
+              users: row.users,
+              syncedAt: now,
+              syncRunId: runId
+            }).run();
+          }
         }
-      }
-      if (syncAi) {
-        tx.delete(gaAiReferrals).where(
-          and6(
-            eq17(gaAiReferrals.projectId, project.id),
-            sql3`${gaAiReferrals.date} >= ${summary.periodStart}`,
-            sql3`${gaAiReferrals.date} <= ${summary.periodEnd}`
-          )
-        ).run();
-        for (const row of aiReferrals) {
-          tx.insert(gaAiReferrals).values({
-            id: crypto16.randomUUID(),
-            projectId: project.id,
-            date: row.date,
-            source: row.source,
-            medium: row.medium,
-            sourceDimension: row.sourceDimension,
-            sessions: row.sessions,
-            users: row.users,
-            syncedAt: now
-          }).run();
+        if (syncAi) {
+          tx.delete(gaAiReferrals).where(
+            and6(
+              eq17(gaAiReferrals.projectId, project.id),
+              sql3`${gaAiReferrals.date} >= ${summary.periodStart}`,
+              sql3`${gaAiReferrals.date} <= ${summary.periodEnd}`
+            )
+          ).run();
+          for (const row of aiReferrals) {
+            tx.insert(gaAiReferrals).values({
+              id: crypto16.randomUUID(),
+              projectId: project.id,
+              date: row.date,
+              source: row.source,
+              medium: row.medium,
+              sourceDimension: row.sourceDimension,
+              sessions: row.sessions,
+              users: row.users,
+              syncedAt: now,
+              syncRunId: runId
+            }).run();
+          }
         }
-      }
-      if (syncSocial) {
-        tx.delete(gaSocialReferrals).where(
-          and6(
-            eq17(gaSocialReferrals.projectId, project.id),
-            sql3`${gaSocialReferrals.date} >= ${summary.periodStart}`,
-            sql3`${gaSocialReferrals.date} <= ${summary.periodEnd}`
-          )
-        ).run();
-        for (const row of socialReferrals) {
-          tx.insert(gaSocialReferrals).values({
+        if (syncSocial) {
+          tx.delete(gaSocialReferrals).where(
+            and6(
+              eq17(gaSocialReferrals.projectId, project.id),
+              sql3`${gaSocialReferrals.date} >= ${summary.periodStart}`,
+              sql3`${gaSocialReferrals.date} <= ${summary.periodEnd}`
+            )
+          ).run();
+          for (const row of socialReferrals) {
+            tx.insert(gaSocialReferrals).values({
+              id: crypto16.randomUUID(),
+              projectId: project.id,
+              date: row.date,
+              source: row.source,
+              medium: row.medium,
+              channelGroup: row.channelGroup,
+              sessions: row.sessions,
+              users: row.users,
+              syncedAt: now,
+              syncRunId: runId
+            }).run();
+          }
+        }
+        if (syncSummary) {
+          tx.delete(gaTrafficSummaries).where(eq17(gaTrafficSummaries.projectId, project.id)).run();
+          tx.insert(gaTrafficSummaries).values({
             id: crypto16.randomUUID(),
             projectId: project.id,
-            date: row.date,
-            source: row.source,
-            medium: row.medium,
-            channelGroup: row.channelGroup,
-            sessions: row.sessions,
-            users: row.users,
-            syncedAt: now
+            periodStart: summary.periodStart,
+            periodEnd: summary.periodEnd,
+            totalSessions: summary.totalSessions,
+            totalOrganicSessions: summary.totalOrganicSessions,
+            totalUsers: summary.totalUsers,
+            syncedAt: now,
+            syncRunId: runId
           }).run();
         }
-      }
-      if (syncSummary) {
-        tx.delete(gaTrafficSummaries).where(eq17(gaTrafficSummaries.projectId, project.id)).run();
-        tx.insert(gaTrafficSummaries).values({
-          id: crypto16.randomUUID(),
-          projectId: project.id,
-          periodStart: summary.periodStart,
-          periodEnd: summary.periodEnd,
-          totalSessions: summary.totalSessions,
-          totalOrganicSessions: summary.totalOrganicSessions,
-          totalUsers: summary.totalUsers,
-          syncedAt: now
-        }).run();
-      }
-    });
-    const syncedComponents = only ? [only, ...only !== "social" && only !== "ai" && only !== "traffic" ? [] : []] : void 0;
-    gaLog("info", "sync.complete", {
-      projectId: project.id,
-      rowCount: rows.length,
-      aiReferralCount: aiReferrals.length,
-      socialReferralCount: socialReferrals.length,
-      days,
-      totalUsers: summary.totalUsers,
-      ...only ? { only } : {}
-    });
-    return {
-      synced: true,
-      rowCount: rows.length,
-      aiReferralCount: aiReferrals.length,
-      socialReferralCount: socialReferrals.length,
-      days,
-      syncedAt: now,
-      ...syncedComponents ? { syncedComponents } : {}
-    };
+      });
+      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: now }).where(eq17(runs.id, runId)).run();
+      const syncedComponents = only ? [only, ...only !== "social" && only !== "ai" && only !== "traffic" ? [] : []] : void 0;
+      gaLog("info", "sync.complete", {
+        projectId: project.id,
+        runId,
+        rowCount: rows.length,
+        aiReferralCount: aiReferrals.length,
+        socialReferralCount: socialReferrals.length,
+        days,
+        totalUsers: summary.totalUsers,
+        ...only ? { only } : {}
+      });
+      return {
+        synced: true,
+        rowCount: rows.length,
+        aiReferralCount: aiReferrals.length,
+        socialReferralCount: socialReferrals.length,
+        days,
+        syncedAt: now,
+        ...syncedComponents ? { syncedComponents } : {}
+      };
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      gaLog("error", "sync.fetch-failed", { projectId: project.id, runId, error: msg });
+      app.db.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq17(runs.id, runId)).run();
+      throw e;
+    }
   });
   app.get("/projects/:name/ga/traffic", async (request, _reply) => {
     const project = resolveProject(app.db, request.params.name);
@@ -9049,7 +9112,8 @@ async function fetchJson(connection, siteUrl, path7, init) {
   });
   if (res.status === 401 || res.status === 403) {
     const text = await res.text().catch(() => "");
-    throw new WordpressApiError("AUTH_INVALID", buildAuthErrorMessage(res, text), res.status);
+    const errorMessage = buildAuthErrorMessage(res, text);
+    throw new WordpressApiError("AUTH_INVALID", errorMessage, res.status);
   }
   if (res.status === 404) {
     throw new WordpressApiError("NOT_FOUND", "WordPress endpoint not found", 404);
@@ -12250,56 +12314,63 @@ var chatgptTarget = {
     }
     return text;
   },
-  async extractCitations(client) {
-    const { result } = await client.Runtime.evaluate({
-      expression: `(() => {
-        const sources = [];
-        // ChatGPT shows citation pills as links within the response
-        // Multiple possible structures:
-        // 1. Inline citation links [1], [2] etc.
-        // 2. Source pills at the bottom of the response
-        // 3. "Sources" section with expandable links
+  extractCitations(client) {
+    return (async () => {
+      const { result } = await client.Runtime.evaluate({
+        expression: `(() => {
+          const sources = [];
+          const seen = new Set();
+          const turns = document.querySelectorAll('[data-message-author-role="assistant"]');
+          const last = turns.length ? turns[turns.length - 1] : null;
+          if (!last) return [];
 
-        // Collect external links from the last assistant message.
-        // :last-of-type does not work with attribute selectors (it selects
-        // by tag type), so we use JS to grab the actual last element.
-        const seen = new Set();
-        const turns = document.querySelectorAll('[data-message-author-role="assistant"]');
-        const last = turns.length ? turns[turns.length - 1] : null;
-        const links = last ? last.querySelectorAll('a[href]') : [];
-        for (const link of links) {
-          const href = link.getAttribute('href');
-          // ChatGPT appends ?utm_source=chatgpt.com to external links,
-          // so string-includes would false-positive on every citation.
-          // Parse the URL and compare the hostname instead.
-          if (!href) continue;
-          let hostname = '';
-          try { hostname = new URL(href).hostname.replace(/^www\\./, ''); } catch {}
-          if (!seen.has(href) && hostname !== 'chatgpt.com' && hostname !== 'openai.com') {
-            seen.add(href);
-            sources.push({
-              uri: href,
-              title: hostname || href,
-            });
+          const links = last.querySelectorAll('a[href]');
+          for (const link of links) {
+            const href = link.getAttribute('href');
+            if (!href) continue;
+            let hostname = '';
+            try {
+              const url = new URL(href);
+              hostname = url.hostname.replace(/^www\\./, '');
+            } catch {
+              // Check for relative links or weird protocols
+              if (href.startsWith('/') || href.startsWith('http')) {
+                 hostname = href;
+              } else {
+                 continue;
+              }
+            }
+
+            if (!seen.has(href) && hostname !== 'chatgpt.com' && hostname !== 'openai.com') {
+              seen.add(href);
+              sources.push({
+                uri: href,
+                title: hostname || href,
+              });
+            }
           }
-        }
 
-        // Also check for citation superscripts that may reference sources
-        const citeButtons = document.querySelectorAll('[data-testid="citation-button"], .citation-button');
-        for (const btn of citeButtons) {
-          const href = btn.getAttribute('data-href') || btn.closest('a')?.getAttribute('href');
-          const title = btn.getAttribute('data-title') || btn.textContent?.trim();
-          if (href && !seen.has(href)) {
-            seen.add(href);
-            sources.push({ uri: href, title: title || href });
+          // Also check for citation superscripts that may reference sources
+          const citeButtons = last.querySelectorAll('[data-testid="citation-button"], .citation-button');
+          for (const btn of citeButtons) {
+            const href = btn.getAttribute('data-href') || btn.closest('a')?.getAttribute('href');
+            const title = btn.getAttribute('data-title') || btn.textContent?.trim();
+            if (href && !seen.has(href)) {
+              let hostname = '';
+              try { hostname = new URL(href).hostname.replace(/^www\\./, ''); } catch {}
+              if (hostname !== 'chatgpt.com' && hostname !== 'openai.com') {
+                seen.add(href);
+                sources.push({ uri: href, title: title || hostname || href });
+              }
+            }
           }
-        }
 
-        return sources;
-      })()`,
-      returnByValue: true
-    });
-    return result.value ?? [];
+          return sources;
+        })()`,
+        returnByValue: true
+      });
+      return result.value ?? [];
+    })();
   }
 };
 async function waitForElement(client, selector, timeoutMs) {
@@ -12460,10 +12531,11 @@ var cdpChatgptAdapter = {
       const conn = getConnection(config);
       const health = await conn.healthcheck();
       if (!health.connected) {
+        const port = config.cdpEndpoint?.split(":").pop() || "9222";
         return {
           ok: false,
           provider: "cdp:chatgpt",
-          message: `Chrome not reachable at ${config.cdpEndpoint}`
+          message: `Chrome not reachable at ${config.cdpEndpoint}. Ensure Chrome is running with --remote-debugging-port=${port}`
         };
       }
       return {
@@ -15085,6 +15157,70 @@ function serializeSessionCookie(opts) {
   }
   return parts.join("; ");
 }
+function migrateDbCredentialsToConfig(db, config) {
+  try {
+    const googleColCheck = db.all(sql6.raw(
+      `SELECT COUNT(*) as c FROM pragma_table_info('google_connections') WHERE name = 'access_token'`
+    ));
+    if (googleColCheck[0]?.c) {
+      const rows = db.all(sql6.raw(
+        `SELECT domain, connection_type, property_id, sitemap_url, access_token, refresh_token, token_expires_at, scopes, created_at, updated_at FROM google_connections WHERE refresh_token IS NOT NULL AND refresh_token != ''`
+      ));
+      let migrated = 0;
+      for (const row of rows) {
+        const connType = row.connection_type;
+        const existing = getGoogleConnection(config, row.domain, connType);
+        if (existing?.refreshToken) continue;
+        upsertGoogleConnection(config, {
+          domain: row.domain,
+          connectionType: connType,
+          propertyId: row.property_id ?? null,
+          sitemapUrl: row.sitemap_url ?? null,
+          accessToken: row.access_token ?? void 0,
+          refreshToken: row.refresh_token ?? null,
+          tokenExpiresAt: row.token_expires_at ?? null,
+          scopes: parseJsonColumn(row.scopes, []),
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        });
+        migrated++;
+      }
+      if (migrated > 0) {
+        saveConfigPatch({ google: config.google });
+        log8.info("credentials.migrated", { type: "google", count: migrated });
+      }
+    }
+    const gaColCheck = db.all(sql6.raw(
+      `SELECT COUNT(*) as c FROM pragma_table_info('ga_connections') WHERE name = 'private_key'`
+    ));
+    if (gaColCheck[0]?.c) {
+      const rows = db.all(sql6.raw(
+        `SELECT id, project_id, property_id, client_email, private_key, created_at, updated_at FROM ga_connections WHERE private_key IS NOT NULL AND private_key != ''`
+      ));
+      let migrated = 0;
+      for (const row of rows) {
+        const project = db.select({ name: projects.name }).from(projects).where(eq23(projects.id, row.project_id)).get();
+        if (!project) continue;
+        const existing = getGa4Connection(config, project.name);
+        if (existing?.privateKey) continue;
+        upsertGa4Connection(config, {
+          projectName: project.name,
+          propertyId: row.property_id,
+          clientEmail: row.client_email,
+          privateKey: row.private_key,
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        });
+        migrated++;
+      }
+      if (migrated > 0) {
+        saveConfigPatch({ ga4: config.ga4 });
+        log8.info("credentials.migrated", { type: "ga4", count: migrated });
+      }
+    }
+  } catch {
+  }
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -15109,6 +15245,7 @@ async function createServer(opts) {
       quota: opts.config.geminiQuota
     };
   }
+  migrateDbCredentialsToConfig(opts.db, opts.config);
   log8.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
     const p = providers[k];
     return p?.apiKey || p?.baseUrl || p?.vertexProject;