@aligulzar729/google-ads-mcp 0.1.0

package/dist/index.js

@@ -0,0 +1,4494 @@
+#!/usr/bin/env node
+
+// src/lib/gaxiosNativeFetch.ts
+import { Gaxios } from "gaxios";
+var original = Gaxios.prototype.request;
+Gaxios.prototype.request = function patchedRequest(opts) {
+  if (this.defaults && this.defaults.fetchImplementation == null) {
+    this.defaults.fetchImplementation = globalThis.fetch;
+  }
+  return original.call(this, opts);
+};
+
+// src/index.ts
+import { createRequire as createRequire3 } from "module";
+
+// src/env.ts
+import { z } from "zod";
+var base = z.object({
+  GOOGLE_ADS_DEVELOPER_TOKEN: z.string().min(1, "required (the business developer token)"),
+  GOOGLE_OAUTH_CLIENT_ID: z.string().min(1, "required"),
+  GOOGLE_OAUTH_CLIENT_SECRET: z.string().min(1, "required"),
+  LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"),
+  // Display name on OAuth consent + error pages; override when white-labeling.
+  APP_NAME: z.string().min(1).default("Google Ads MCP")
+});
+var httpExtra = z.object({
+  PORT: z.coerce.number().int().positive().default(3001),
+  // 32-byte AES key (base64) that encrypts users' Google refresh tokens at rest.
+  TOKEN_ENC_KEY: z.string().refine((s) => Buffer.from(s, "base64").length === 32, "required in --http mode: 32 bytes base64 (generate with: openssl rand -base64 32)"),
+  AUDIT_DB_PATH: z.string().default("./data/audit.db"),
+  // Public HTTPS base URL of this service; builds the OAuth redirect URI - register that exact URI in the Google OAuth client.
+  PUBLIC_BASE_URL: z.string().url("required in --http mode, e.g. https://acme.example.com"),
+  // Allowlisted redirect targets (origin, host, or *.wildcard); blocks the broker from registering/authorizing anything else, which stops phished /authorize redirects.
+  ALLOWED_REDIRECT_ORIGINS: z.string().min(1, 'required in --http mode, e.g. "*.example.com" or "https://apple.example.com"').transform((s, ctx) => {
+    const out = [];
+    const hostPat = /^(\*\.)?[a-z0-9.-]+$/;
+    for (const raw of s.split(",").map((x) => x.trim().toLowerCase()).filter(Boolean)) {
+      if (raw.includes("://")) {
+        try {
+          out.push(new URL(raw).origin);
+        } catch {
+          ctx.addIssue({ code: z.ZodIssueCode.custom, message: `not a valid origin: ${raw}` });
+        }
+      } else if (hostPat.test(raw)) {
+        const labels = (raw.startsWith("*.") ? raw.slice(2) : raw).split(".");
+        const malformed = raw.startsWith(".") || raw.endsWith(".") || labels.some((l) => !l);
+        const tooBroad = labels.length < 2 && raw !== "localhost";
+        if (malformed || tooBroad) {
+          ctx.addIssue({ code: z.ZodIssueCode.custom, message: `not a usable host/wildcard (use "apple.example.com" or "*.example.com"): ${raw}` });
+        } else {
+          out.push(raw);
+        }
+      } else {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `not a valid origin or host pattern: ${raw}` });
+      }
+    }
+    if (!out.length) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "at least one entry is required" });
+    return out;
+  })
+});
+var stdioExtra = z.object({
+  GOOGLE_ADS_REFRESH_TOKEN: z.string().default(""),
+  GOOGLE_ADS_CUSTOMER_ID: z.string().default(""),
+  GOOGLE_ADS_LOGIN_CUSTOMER_ID: z.string().default("")
+});
+function fail(prefix, err) {
+  const lines = err.issues.map((i) => `  - ${i.path.join(".") || "env"}: ${i.message}`);
+  process.stderr.write(`${prefix}
+${lines.join("\n")}
+`);
+  process.exit(1);
+}
+function loadConfig(mode, raw = process.env) {
+  const b = base.safeParse(raw);
+  if (!b.success) fail("Invalid environment:", b.error);
+  const common = {
+    mode,
+    logLevel: b.data.LOG_LEVEL,
+    appName: b.data.APP_NAME,
+    developerToken: b.data.GOOGLE_ADS_DEVELOPER_TOKEN,
+    oauthClientId: b.data.GOOGLE_OAUTH_CLIENT_ID,
+    oauthClientSecret: b.data.GOOGLE_OAUTH_CLIENT_SECRET
+  };
+  if (mode === "http") {
+    const h = httpExtra.safeParse(raw);
+    if (!h.success) fail("Invalid environment for --http mode:", h.error);
+    return {
+      ...common,
+      port: h.data.PORT,
+      tokenEncKey: h.data.TOKEN_ENC_KEY,
+      auditDbPath: h.data.AUDIT_DB_PATH,
+      publicBaseUrl: h.data.PUBLIC_BASE_URL.replace(/\/$/, ""),
+      allowedRedirectOrigins: h.data.ALLOWED_REDIRECT_ORIGINS,
+      refreshToken: "",
+      customerId: "",
+      loginCustomerId: ""
+    };
+  }
+  const s = stdioExtra.safeParse(raw);
+  if (!s.success) fail("Invalid environment for --stdio mode:", s.error);
+  return {
+    ...common,
+    port: 0,
+    tokenEncKey: "",
+    auditDbPath: "",
+    publicBaseUrl: "",
+    allowedRedirectOrigins: [],
+    refreshToken: s.data.GOOGLE_ADS_REFRESH_TOKEN,
+    customerId: s.data.GOOGLE_ADS_CUSTOMER_ID,
+    loginCustomerId: s.data.GOOGLE_ADS_LOGIN_CUSTOMER_ID
+  };
+}
+var CONFIG_ENV_KEYS = [
+  ...Object.keys(base.shape),
+  ...Object.keys(httpExtra.shape),
+  ...Object.keys(stdioExtra.shape),
+  "REQUIRE_USER_CONFIRMATION"
+];
+function parseConfigFlags(argv) {
+  const known = new Set(CONFIG_ENV_KEYS);
+  const modeFlags = /* @__PURE__ */ new Set(["--http", "--stdio", "--help", "-h", "--version", "-v"]);
+  const env = {};
+  const unknown = [];
+  for (const arg of argv) {
+    if (!arg.startsWith("--") || modeFlags.has(arg)) continue;
+    let body = arg.slice(2);
+    let value = "true";
+    const eq = body.indexOf("=");
+    if (eq >= 0) {
+      value = body.slice(eq + 1);
+      body = body.slice(0, eq);
+    } else if (body.startsWith("no-")) {
+      body = body.slice(3);
+      value = "false";
+    }
+    const key = body.replace(/-/g, "_").toUpperCase();
+    if (known.has(key)) env[key] = value;
+    else unknown.push(body);
+  }
+  return { env, unknown };
+}
+
+// src/logger.ts
+var ORDER = { debug: 0, info: 1, warn: 2, error: 3 };
+var Logger = class {
+  constructor(threshold = "info") {
+    this.threshold = threshold;
+  }
+  threshold;
+  write(level, source, message, meta) {
+    if (ORDER[level] < ORDER[this.threshold]) return;
+    const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, source, message, ...meta ?? {} };
+    let line;
+    try {
+      line = JSON.stringify(entry) + "\n";
+    } catch {
+      line = JSON.stringify({ ts: entry.ts, level, source, message }) + "\n";
+    }
+    try {
+      process.stderr.write(line);
+    } catch {
+    }
+  }
+  debug(source, message, meta) {
+    this.write("debug", source, message, meta);
+  }
+  info(source, message, meta) {
+    this.write("info", source, message, meta);
+  }
+  warn(source, message, meta) {
+    this.write("warn", source, message, meta);
+  }
+  error(source, message, meta) {
+    this.write("error", source, message, meta);
+  }
+  /** Stream a structured activity entry (also persisted by the Audit store). */
+  activity(entry) {
+    this.write(entry.status === "error" ? "warn" : "info", entry.server, entry.summary, {
+      category: entry.category,
+      customerId: entry.customerId,
+      status: entry.status,
+      errorMessage: entry.errorMessage,
+      // Full raw error (stack/decoded GoogleAdsFailure); stays in the local JSONL stream, never returned to the client. Undefined on success.
+      errorDetail: entry.errorDetail
+    });
+  }
+};
+
+// src/ads/api.ts
+import { GoogleAdsApi } from "google-ads-api";
+
+// src/lib/retry.ts
+var TRANSIENT_RE = /\b(RESOURCE_EXHAUSTED|INTERNAL|UNAVAILABLE|DEADLINE_EXCEEDED)\b/;
+var TRANSIENT_CODES = /* @__PURE__ */ new Set([4, 8, 13, 14]);
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+function getPath(obj, keys) {
+  let cur = obj;
+  for (const k of keys) {
+    if (!isRecord(cur)) return void 0;
+    cur = cur[k];
+  }
+  return cur;
+}
+function failureErrorCodes(err) {
+  const errs = isRecord(err) ? err.errors : void 0;
+  if (!Array.isArray(errs)) return [];
+  const out = [];
+  for (const e of errs) {
+    const code = isRecord(e) ? e.error_code : void 0;
+    if (isRecord(code)) out.push(...Object.keys(code));
+  }
+  return out;
+}
+function toNum(v) {
+  if (v == null) return 0;
+  if (typeof v === "number") return Number.isFinite(v) ? v : 0;
+  if (typeof v === "string") {
+    const n4 = Number(v);
+    return Number.isFinite(n4) ? n4 : 0;
+  }
+  if (isRecord(v) && typeof v.toNumber === "function") {
+    const n4 = v.toNumber();
+    return Number.isFinite(n4) ? n4 : 0;
+  }
+  const n3 = Number(v);
+  return Number.isFinite(n3) ? n3 : 0;
+}
+function isTransient(err) {
+  if (!isRecord(err)) return false;
+  if (typeof err.code === "number" && TRANSIENT_CODES.has(err.code)) return true;
+  return TRANSIENT_RE.test(String(err.message ?? err));
+}
+function isQuotaExhausted(err) {
+  if (!isRecord(err)) return false;
+  if (err.code === 8) return true;
+  if (failureErrorCodes(err).includes("quota_error")) return true;
+  return /RESOURCE_EXHAUSTED/.test(String(err.message ?? err));
+}
+function parseRetryDelayMs(err) {
+  const errs = isRecord(err) ? err.errors : void 0;
+  if (!Array.isArray(errs)) return void 0;
+  for (const e of errs) {
+    const d = getPath(e, ["details", "quota_error_details", "retry_delay"]);
+    if (isRecord(d)) {
+      const ms = toNum(d.seconds) * 1e3 + Math.floor(toNum(d.nanos) / 1e6);
+      if (ms > 0) return ms;
+    }
+  }
+  return void 0;
+}
+var REAUTH_RE = /\b(invalid_grant|unauthorized_client|UNAUTHENTICATED)\b/;
+function isReauthRequired(err) {
+  if (!isRecord(err)) return false;
+  if (err.code === 16) return true;
+  if (failureErrorCodes(err).includes("authentication_error")) return true;
+  return REAUTH_RE.test(String(err.message ?? err));
+}
+function retryDelayMs(err, attempt, opts = {}) {
+  const { baseDelayMs = 1e3, maxDelayMs = 6e4 } = opts;
+  if (isQuotaExhausted(err)) {
+    const rd = parseRetryDelayMs(err);
+    if (rd !== void 0) return Math.min(maxDelayMs, rd);
+  }
+  return Math.min(maxDelayMs, baseDelayMs * 2 ** attempt);
+}
+async function withRetry(fn, opts = {}) {
+  const { retries = 4 } = opts;
+  let attempt = 0;
+  while (true) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (attempt >= retries || !(isTransient(err) || isQuotaExhausted(err))) throw err;
+      const base2 = retryDelayMs(err, attempt, opts);
+      const jitter = Math.random() * base2 * 0.25;
+      await new Promise((r) => setTimeout(r, base2 + jitter));
+      attempt++;
+    }
+  }
+}
+
+// src/ads/api.ts
+var AdsService = class {
+  api;
+  constructor(opts) {
+    this.api = new GoogleAdsApi({
+      developer_token: opts.developerToken,
+      client_id: opts.clientId,
+      client_secret: opts.clientSecret
+    });
+  }
+  /** Per-call Customer: cheap to construct, and the SDK caches access tokens. */
+  customer(creds) {
+    return this.api.Customer({
+      customer_id: creds.customerId,
+      refresh_token: creds.refreshToken,
+      login_customer_id: creds.loginCustomerId
+    });
+  }
+  /** Run a GAQL query (1 op, regardless of rows). Retried on transient errors. */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async query(creds, gaql) {
+    return withRetry(() => this.customer(creds).query(gaql));
+  }
+  /** Fetches one bounded page plus its true total row count in a single Search call, so a capped report can say "top N of TOTAL" without a second round-trip. Uses the private `search` (via cast, like `searchFields`) since `query` buffers every page and `queryStream` can't carry a count. */
+  async searchPage(creds, gaql, pageSize) {
+    const customer = this.customer(creds);
+    return withRetry(async () => {
+      const raw = await customer.search(gaql, { search_settings: { return_total_results_count: true } });
+      return interpretSearchPage(raw, pageSize);
+    });
+  }
+  /** The account's reporting timezone (e.g. "Asia/Tokyo"), cached. Used to align report date windows. */
+  tzCache = /* @__PURE__ */ new Map();
+  async timeZone(creds) {
+    const cached = this.tzCache.get(creds.customerId);
+    if (cached) return cached;
+    try {
+      const rows = await this.query(creds, "SELECT customer.time_zone FROM customer LIMIT 1");
+      const tz = rows[0]?.customer?.time_zone;
+      if (tz) this.tzCache.set(creds.customerId, tz);
+      return tz;
+    } catch {
+      return void 0;
+    }
+  }
+  /** The account's reporting currency (e.g. "JPY", "USD"), cached. Used to label cost in reports. */
+  currencyCache = /* @__PURE__ */ new Map();
+  async currencyCode(creds) {
+    const cached = this.currencyCache.get(creds.customerId);
+    if (cached) return cached;
+    try {
+      const rows = await this.query(creds, "SELECT customer.currency_code FROM customer LIMIT 1");
+      const code = rows[0]?.customer?.currency_code;
+      if (code) this.currencyCache.set(creds.customerId, code);
+      return code;
+    } catch {
+      return void 0;
+    }
+  }
+  /** Accounts this refresh token can reach, as bare 10-digit ids; ignores login-customer-id, returning only directly-accessible accounts (the valid account-picker values). */
+  async listAccessibleCustomers(refreshToken) {
+    const res = await withRetry(() => this.api.listAccessibleCustomers(refreshToken));
+    return res.resource_names.map((rn) => rn.split("/")[1] ?? "").filter(Boolean);
+  }
+  /** Account-picker label (manager flag + display name); best-effort, returns {} if unqueryable so `list` never fails over one account. */
+  async accountMeta(refreshToken, customerId) {
+    try {
+      const rows = await this.query({ refreshToken, customerId }, "SELECT customer.manager, customer.descriptive_name FROM customer LIMIT 1");
+      const c = rows[0]?.customer;
+      return { manager: c?.manager, name: c?.descriptive_name };
+    } catch {
+      return {};
+    }
+  }
+  /** Field metadata via GoogleAdsFieldService, powering the report `metadata` action so the model discovers valid fields instead of guessing; the service is private on the Opteo client, reached via cast. */
+  async searchFields(creds, where) {
+    const customer = this.customer(creds);
+    const svc = customer.googleAdsFields;
+    const query = `SELECT name, category, data_type, selectable, filterable, sortable, metrics, segments, selectable_with WHERE ${where}`;
+    const res = await withRetry(() => svc.searchGoogleAdsFields({ query }));
+    const rows = Array.isArray(res) ? res[0] : res.results ?? res.response;
+    return rows ?? [];
+  }
+};
+function interpretSearchPage(raw, cap) {
+  const all = raw.response ?? [];
+  const rows = all.slice(0, cap);
+  const reported = raw.totalResultsCount != null ? Number(raw.totalResultsCount) : void 0;
+  const total = reported ?? (raw.nextPageToken ? void 0 : all.length);
+  const truncated = Boolean(raw.nextPageToken) || all.length > rows.length || total != null && total > rows.length;
+  return { rows, total, truncated };
+}
+
+// src/store/db.ts
+import { createRequire } from "module";
+import fs from "fs";
+import path from "path";
+var requireCjs = createRequire(import.meta.url);
+function openDb(file) {
+  const sqlite = loadSqlite();
+  fs.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+  const db = new sqlite.DatabaseSync(file);
+  db.exec("PRAGMA journal_mode = WAL");
+  migrate(db);
+  return db;
+}
+function loadSqlite() {
+  silenceSqliteExperimentalWarning();
+  try {
+    return requireCjs("node:sqlite");
+  } catch (err) {
+    throw new Error(
+      `HTTP mode needs Node's built-in SQLite ("node:sqlite"), available in Node >= 22.5 (some 22.x builds require the --experimental-sqlite flag). This runtime does not provide it; upgrade Node to run HTTP mode. stdio mode does not use it. Cause: ` + (err instanceof Error ? err.message : String(err))
+    );
+  }
+}
+var warningSilenced = false;
+function silenceSqliteExperimentalWarning() {
+  if (warningSilenced) return;
+  warningSilenced = true;
+  const original2 = process.emitWarning.bind(process);
+  process.emitWarning = ((warning, ...rest) => {
+    const message = typeof warning === "string" ? warning : warning?.message;
+    if (/SQLite is an experimental feature/.test(String(message ?? ""))) return;
+    original2(warning, ...rest);
+  });
+}
+function migrate(db) {
+  db.exec(`
+    -- Append-only audit trail; mutations must leave a durable record.
+    CREATE TABLE IF NOT EXISTS audit (
+      id            INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts            INTEGER NOT NULL,
+      category      TEXT    NOT NULL,
+      summary       TEXT    NOT NULL,
+      customer_id   TEXT,
+      status        TEXT    NOT NULL,
+      error_message TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit(ts);
+
+    -- OAuth broker: DCR-registered MCP clients. PKCE-only, no client secret.
+    CREATE TABLE IF NOT EXISTS oauth_clients (
+      client_id     TEXT PRIMARY KEY,
+      client_name   TEXT,
+      redirect_uris TEXT    NOT NULL,   -- JSON array; exact-match validated
+      created_ts    INTEGER NOT NULL
+    );
+
+    -- One session per (user, client); holds the AES-256-GCM-encrypted Google refresh token.
+    CREATE TABLE IF NOT EXISTS oauth_sessions (
+      id                   TEXT PRIMARY KEY,
+      client_id            TEXT    NOT NULL,
+      google_refresh_enc   TEXT    NOT NULL,   -- iv.tag.ciphertext (base64url)
+      scope                TEXT    NOT NULL,
+      customer_id          TEXT,               -- active account
+      accessible_customers TEXT,               -- JSON array
+      created_ts           INTEGER NOT NULL,
+      last_used_ts         INTEGER NOT NULL
+    );
+
+    -- Auth codes and our tokens are stored as SHA-256 hashes only.
+    CREATE TABLE IF NOT EXISTS oauth_codes (
+      code_hash      TEXT PRIMARY KEY,
+      client_id      TEXT    NOT NULL,
+      redirect_uri   TEXT    NOT NULL,
+      pkce_challenge TEXT    NOT NULL,
+      session_id     TEXT    NOT NULL,
+      expires_ts     INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS oauth_tokens (
+      token_hash TEXT PRIMARY KEY,
+      session_id TEXT    NOT NULL,
+      kind       TEXT    NOT NULL,   -- 'access' | 'refresh'
+      expires_ts INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_oauth_tokens_session ON oauth_tokens(session_id);
+    CREATE INDEX IF NOT EXISTS idx_oauth_tokens_expires ON oauth_tokens(expires_ts);
+    CREATE INDEX IF NOT EXISTS idx_oauth_codes_expires ON oauth_codes(expires_ts);
+    CREATE INDEX IF NOT EXISTS idx_oauth_sessions_created ON oauth_sessions(created_ts);
+  `);
+}
+
+// src/store/audit.ts
+var Audit = class {
+  constructor(db, logger) {
+    this.db = db;
+    this.logger = logger;
+  }
+  db;
+  logger;
+  /** True when a durable, queryable audit store exists (i.e. --http mode). */
+  get hasStore() {
+    return this.db !== null;
+  }
+  record(entry) {
+    this.logger.activity(entry);
+    if (!this.db) return;
+    try {
+      this.db.prepare("INSERT INTO audit (ts, category, summary, customer_id, status, error_message) VALUES (?, ?, ?, ?, ?, ?)").run(entry.timestamp, entry.category, entry.summary, entry.customerId ?? null, entry.status, entry.errorMessage ?? null);
+    } catch (e) {
+      this.logger.warn("audit", "failed to persist audit row", { error: e instanceof Error ? e.message : String(e) });
+    }
+  }
+  /** Read recent audit rows for one customer, newest first. Empty if no store. */
+  query(q) {
+    if (!this.db) return [];
+    const where = ["customer_id = ?"];
+    const params = [q.customerId];
+    if (q.category) {
+      where.push("category = ?");
+      params.push(q.category);
+    }
+    if (q.status) {
+      where.push("status = ?");
+      params.push(q.status);
+    }
+    if (q.sinceTs !== void 0) {
+      where.push("ts >= ?");
+      params.push(q.sinceTs);
+    }
+    params.push(q.limit);
+    return this.db.prepare(
+      `SELECT ts, category, summary, customer_id, status, error_message
+           FROM audit WHERE ${where.join(" AND ")}
+          ORDER BY ts DESC, id DESC LIMIT ?`
+    ).all(...params);
+  }
+};
+
+// src/oauth/crypto.ts
+import crypto from "crypto";
+var ALG = "aes-256-gcm";
+var IV_BYTES = 12;
+function loadEncKey(b64) {
+  const key = Buffer.from(b64, "base64");
+  if (key.length !== 32) {
+    throw new Error(`TOKEN_ENC_KEY must decode to 32 bytes (got ${key.length}). Generate one with: openssl rand -base64 32`);
+  }
+  return key;
+}
+function encryptSecret(plaintext, key) {
+  const iv = crypto.randomBytes(IV_BYTES);
+  const cipher = crypto.createCipheriv(ALG, key, iv);
+  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64url")}.${tag.toString("base64url")}.${ct.toString("base64url")}`;
+}
+function decryptSecret(blob, key) {
+  const parts = blob.split(".");
+  if (parts.length !== 3) throw new Error("malformed ciphertext");
+  const [ivB, tagB, ctB] = parts;
+  const decipher = crypto.createDecipheriv(ALG, key, Buffer.from(ivB, "base64url"));
+  decipher.setAuthTag(Buffer.from(tagB, "base64url"));
+  return Buffer.concat([decipher.update(Buffer.from(ctB, "base64url")), decipher.final()]).toString("utf8");
+}
+function randomToken(bytes = 32) {
+  return crypto.randomBytes(bytes).toString("base64url");
+}
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+function verifyPkceS256(verifier, challenge) {
+  if (!verifier || !challenge) return false;
+  const computed = crypto.createHash("sha256").update(verifier).digest("base64url");
+  if (computed.length !== challenge.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(challenge));
+}
+
+// src/oauth/store.ts
+var TXN_TTL_MS = 10 * 6e4;
+var CODE_TTL_MS = 6e4;
+var ACCESS_TTL_MS = 60 * 6e4;
+var REFRESH_TTL_MS = 180 * 24 * 60 * 6e4;
+var MAX_TXNS = 5e3;
+var SESSION_GC_GRACE_MS = 60 * 6e4;
+var OAuthStore = class {
+  constructor(db, encKey, now = () => Date.now()) {
+    this.db = db;
+    this.encKey = encKey;
+    this.now = now;
+  }
+  db;
+  encKey;
+  now;
+  txns = /* @__PURE__ */ new Map();
+  // Clients (Dynamic Client Registration)
+  registerClient(redirectUris, clientName) {
+    const clientId = `mcp_${randomToken(16)}`;
+    this.db.prepare("INSERT INTO oauth_clients (client_id, client_name, redirect_uris, created_ts) VALUES (?, ?, ?, ?)").run(clientId, clientName ?? null, JSON.stringify(redirectUris), this.now());
+    return { clientId, clientName, redirectUris };
+  }
+  getClient(clientId) {
+    const row = this.db.prepare("SELECT client_id, client_name, redirect_uris FROM oauth_clients WHERE client_id = ?").get(clientId);
+    if (!row) return null;
+    return { clientId: row.client_id, clientName: row.client_name ?? void 0, redirectUris: JSON.parse(row.redirect_uris) };
+  }
+  // Pending authorize transactions (in-memory, single-use)
+  putTxn(txn) {
+    if (this.txns.size >= MAX_TXNS) {
+      const cutoff = this.now() - TXN_TTL_MS;
+      for (const [k, v] of this.txns) if (v.createdMs < cutoff) this.txns.delete(k);
+      if (this.txns.size >= MAX_TXNS) {
+        const oldest = this.txns.keys().next().value;
+        if (oldest !== void 0) this.txns.delete(oldest);
+      }
+    }
+    const state = randomToken(16);
+    this.txns.set(state, { ...txn, createdMs: this.now() });
+    return state;
+  }
+  /** Read-and-delete (single use); returns null if missing or expired. */
+  takeTxn(state) {
+    const txn = this.txns.get(state);
+    if (!txn) return null;
+    this.txns.delete(state);
+    if (this.now() - txn.createdMs > TXN_TTL_MS) return null;
+    return txn;
+  }
+  // Sessions (hold the encrypted Google refresh token)
+  createSession(args) {
+    const id = randomToken(16);
+    const ts = this.now();
+    this.db.prepare(
+      "INSERT INTO oauth_sessions (id, client_id, google_refresh_enc, scope, customer_id, accessible_customers, created_ts, last_used_ts) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+    ).run(id, args.clientId, encryptSecret(args.googleRefreshToken, this.encKey), args.scope, args.customerId, JSON.stringify(args.accessibleCustomers), ts, ts);
+    return id;
+  }
+  getSession(id) {
+    const row = this.db.prepare("SELECT id, client_id, scope, customer_id, accessible_customers FROM oauth_sessions WHERE id = ?").get(id);
+    if (!row) return null;
+    return {
+      id: row.id,
+      clientId: row.client_id,
+      scope: row.scope,
+      customerId: row.customer_id,
+      accessibleCustomers: row.accessible_customers ? JSON.parse(row.accessible_customers) : []
+    };
+  }
+  /** Decrypts and returns the Google refresh token for use with the Ads client. */
+  getGoogleRefreshToken(sessionId) {
+    const row = this.db.prepare("SELECT google_refresh_enc FROM oauth_sessions WHERE id = ?").get(sessionId);
+    return row ? decryptSecret(row.google_refresh_enc, this.encKey) : null;
+  }
+  setActiveCustomer(sessionId, customerId) {
+    this.db.prepare("UPDATE oauth_sessions SET customer_id = ?, last_used_ts = ? WHERE id = ?").run(customerId, this.now(), sessionId);
+  }
+  touchSession(id) {
+    this.db.prepare("UPDATE oauth_sessions SET last_used_ts = ? WHERE id = ?").run(this.now(), id);
+  }
+  deleteSession(id) {
+    this.db.prepare("DELETE FROM oauth_sessions WHERE id = ?").run(id);
+    this.db.prepare("DELETE FROM oauth_tokens WHERE session_id = ?").run(id);
+    this.db.prepare("DELETE FROM oauth_codes WHERE session_id = ?").run(id);
+  }
+  // Authorization codes (hashed, single-use, short TTL)
+  issueCode(info) {
+    const code = randomToken(32);
+    this.db.prepare("INSERT INTO oauth_codes (code_hash, client_id, redirect_uri, pkce_challenge, session_id, expires_ts) VALUES (?, ?, ?, ?, ?, ?)").run(sha256Hex(code), info.clientId, info.redirectUri, info.pkceChallenge, info.sessionId, this.now() + CODE_TTL_MS);
+    return code;
+  }
+  /** Read-and-delete (single use); returns null if unknown or expired. */
+  takeCode(code) {
+    const hash = sha256Hex(code);
+    const row = this.db.prepare("SELECT client_id, redirect_uri, pkce_challenge, session_id, expires_ts FROM oauth_codes WHERE code_hash = ?").get(hash);
+    if (!row) return null;
+    this.db.prepare("DELETE FROM oauth_codes WHERE code_hash = ?").run(hash);
+    if (this.now() > row.expires_ts) return null;
+    return { clientId: row.client_id, redirectUri: row.redirect_uri, pkceChallenge: row.pkce_challenge, sessionId: row.session_id };
+  }
+  // Our issued tokens (hashed)
+  issueToken(sessionId, kind, ttlMs) {
+    const token = randomToken(32);
+    this.db.prepare("INSERT INTO oauth_tokens (token_hash, session_id, kind, expires_ts) VALUES (?, ?, ?, ?)").run(sha256Hex(token), sessionId, kind, this.now() + ttlMs);
+    return token;
+  }
+  /** Returns the session id if the token is valid, of the right kind, and unexpired. */
+  resolveToken(token, kind) {
+    const row = this.db.prepare("SELECT session_id, kind, expires_ts FROM oauth_tokens WHERE token_hash = ?").get(sha256Hex(token));
+    if (!row || row.kind !== kind || this.now() > row.expires_ts) return null;
+    return row.session_id;
+  }
+  /** Slides a refresh token's expiry forward on each successful refresh, so only true idle time (never active use) can expire it. */
+  touchRefreshToken(token, ttlMs) {
+    const now = this.now();
+    this.db.prepare("UPDATE oauth_tokens SET expires_ts = ? WHERE token_hash = ? AND kind = 'refresh' AND expires_ts > ?").run(now + ttlMs, sha256Hex(token), now);
+  }
+  revokeToken(token) {
+    this.db.prepare("DELETE FROM oauth_tokens WHERE token_hash = ?").run(sha256Hex(token));
+  }
+  revokeSessionTokens(sessionId) {
+    this.db.prepare("DELETE FROM oauth_tokens WHERE session_id = ?").run(sessionId);
+  }
+  /** Periodic cleanup of expired codes/tokens and stale in-memory transactions. */
+  sweepExpired() {
+    const now = this.now();
+    this.db.prepare("DELETE FROM oauth_codes WHERE expires_ts < ?").run(now);
+    this.db.prepare("DELETE FROM oauth_tokens WHERE expires_ts < ?").run(now);
+    this.db.prepare(
+      `DELETE FROM oauth_sessions
+          WHERE created_ts < ?
+            AND id NOT IN (SELECT session_id FROM oauth_tokens WHERE expires_ts > ?)`
+    ).run(now - SESSION_GC_GRACE_MS, now);
+    this.db.prepare("DELETE FROM oauth_tokens WHERE session_id NOT IN (SELECT id FROM oauth_sessions)").run();
+    this.db.prepare("DELETE FROM oauth_codes WHERE session_id NOT IN (SELECT id FROM oauth_sessions)").run();
+    const cutoff = now - TXN_TTL_MS;
+    for (const [k, v] of this.txns) if (v.createdMs < cutoff) this.txns.delete(k);
+  }
+};
+
+// src/lib/pagecache.ts
+import { randomUUID } from "crypto";
+var PageCache = class {
+  entries = /* @__PURE__ */ new Map();
+  TTL = 5 * 60 * 1e3;
+  MAX_ENTRIES = 100;
+  /** Park a fully-rendered row set; returns a cursor id. */
+  create(scope, title, rows, startOffset, customerId) {
+    this.sweep();
+    const id = randomUUID().slice(0, 12);
+    this.entries.set(id, { scope, title, rows, offset: startOffset, total: rows.length, createdAt: Date.now(), customerId: customerId ?? scope });
+    return id;
+  }
+  /** Fetch an entry, enforcing scope + TTL. Touches it (LRU-by-access). */
+  get(id, scope) {
+    const e = this.entries.get(id);
+    if (!e) return null;
+    if (e.scope !== scope) return null;
+    if (Date.now() - e.createdAt > this.TTL) {
+      this.entries.delete(id);
+      return null;
+    }
+    e.createdAt = Date.now();
+    return e;
+  }
+  /** Advance the cursor; drop the entry once exhausted. */
+  advance(id, newOffset) {
+    const e = this.entries.get(id);
+    if (!e) return;
+    if (newOffset >= e.total) this.entries.delete(id);
+    else e.offset = newOffset;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [id, e] of this.entries) if (now - e.createdAt > this.TTL) this.entries.delete(id);
+    while (this.entries.size >= this.MAX_ENTRIES) {
+      let oldestId = null;
+      let oldestAt = Infinity;
+      for (const [id, e] of this.entries) if (e.createdAt < oldestAt) oldestAt = e.createdAt, oldestId = id;
+      if (oldestId) this.entries.delete(oldestId);
+      else break;
+    }
+  }
+};
+
+// src/app.ts
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { serve } from "@hono/node-server";
+import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
+
+// src/lib/rateLimit.ts
+var RateLimiter = class {
+  constructor(limit, windowMs) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+  }
+  limit;
+  windowMs;
+  hits = /* @__PURE__ */ new Map();
+  /** Returns true if the key is still under the limit (and records this hit). */
+  allow(key) {
+    const now = Date.now();
+    const cutoff = now - this.windowMs;
+    let times = this.hits.get(key);
+    if (!times) {
+      times = [];
+      this.hits.set(key, times);
+    }
+    let i = 0;
+    while (i < times.length && times[i] < cutoff) i++;
+    if (i > 0) times.splice(0, i);
+    if (times.length >= this.limit) return false;
+    times.push(now);
+    if (this.hits.size > 1e4) {
+      for (const [k, t] of this.hits) {
+        if (!t.length || t[t.length - 1] < cutoff) this.hits.delete(k);
+      }
+    }
+    return true;
+  }
+};
+
+// src/lib/startup.ts
+import fs2 from "fs";
+import path2 from "path";
+function runStartupChecks(config, logger) {
+  const base2 = config.publicBaseUrl;
+  logger.info("startup", `OAuth issuer: ${base2}  (MCP endpoint: ${base2}/mcp)`);
+  logger.info("startup", `Register this redirect URI on the Google OAuth client: ${base2}/auth/callback`);
+  const isHttps = base2.startsWith("https://");
+  const isLocal = /^https?:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/.test(base2);
+  if (!isHttps && !isLocal) {
+    logger.warn("startup", `PUBLIC_BASE_URL is not HTTPS (${base2}). Google rejects non-HTTPS redirect URIs and the consent cookie is Secure-only, so the connect flow will fail.`);
+  }
+  checkPersistence(config, logger);
+  void probePublicEndpoints(base2, logger);
+}
+function checkPersistence(config, logger) {
+  try {
+    const dir = path2.dirname(path2.resolve(config.auditDbPath));
+    const mounts = fs2.readFileSync("/proc/self/mountinfo", "utf8").split("\n").map((l) => l.split(" ")[4]).filter((m) => Boolean(m) && m !== "/");
+    const onMount = mounts.some((m) => dir === m || dir.startsWith(m.endsWith("/") ? m : `${m}/`));
+    if (!onMount) {
+      logger.warn(
+        "startup",
+        `DB dir ${dir} is NOT on a mounted volume. The audit log AND every user's stored Google authorization will be LOST on container recreate. Mount a volume there.`
+      );
+    }
+  } catch {
+  }
+}
+async function probePublicEndpoints(base2, logger) {
+  const url = `${base2}/.well-known/oauth-protected-resource`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 5e3);
+  timer.unref?.();
+  try {
+    const res = await fetch(url, { signal: ctrl.signal, redirect: "manual" });
+    const text = await res.text().catch(() => "");
+    if (res.ok && text.includes("authorization_servers")) {
+      logger.info("startup", "Public OAuth endpoints reachable. The reverse proxy is forwarding this subdomain to the container.");
+    } else {
+      logger.warn(
+        "startup",
+        `${url} did not return this server's metadata (HTTP ${res.status}). Check the reverse proxy forwards this subdomain to the container, plus DNS/TLS for ${base2}. (Best-effort; ignore if connect works for users.)`
+      );
+    }
+  } catch (e) {
+    logger.warn(
+      "startup",
+      `Could not reach ${url} from inside the container (${e instanceof Error ? e.message : String(e)}). Verify the reverse proxy and DNS/TLS for ${base2}. (Best-effort.)`
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/mcp/router.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+function writeJson(res, status, obj) {
+  if (res.headersSent) return;
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(obj));
+}
+var McpSessionManager = class {
+  constructor(makeServer, logger) {
+    this.makeServer = makeServer;
+    this.logger = logger;
+    this.sweepTimer = setInterval(() => this.sweep(), 5 * 60 * 1e3);
+    this.sweepTimer.unref?.();
+  }
+  makeServer;
+  logger;
+  sessions = /* @__PURE__ */ new Map();
+  sweepTimer;
+  MAX_SESSIONS = 200;
+  IDLE_TTL = 12 * 60 * 60 * 1e3;
+  ABS_MAX = 48 * 60 * 60 * 1e3;
+  KEEPALIVE = 60 * 1e3;
+  safeClose(fn) {
+    try {
+      const r = fn();
+      if (r && typeof r.then === "function") r.catch(() => {
+      });
+    } catch {
+    }
+  }
+  destroy(sid) {
+    const s = this.sessions.get(sid);
+    if (!s) return;
+    this.sessions.delete(sid);
+    if (s.keepaliveTimer) clearInterval(s.keepaliveTimer);
+    this.safeClose(() => s.transport.close?.());
+    this.safeClose(() => s.server.close());
+  }
+  startKeepalive(session) {
+    session.keepaliveTimer = setInterval(() => {
+      session.server.server.notification({ method: "notifications/message", params: { level: "debug", data: { type: "keepalive", ts: Date.now() } } }).catch(() => {
+      });
+    }, this.KEEPALIVE);
+    session.keepaliveTimer.unref?.();
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [sid, s] of this.sessions) {
+      if (s.inFlight > 0) continue;
+      if (now - s.lastActivity > this.IDLE_TTL || now - s.createdAt > this.ABS_MAX) this.destroy(sid);
+    }
+  }
+  async handlePost(incoming, outgoing, body, creds, oauthSessionId) {
+    const sessionId = incoming.headers["mcp-session-id"];
+    const existing = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (existing) {
+      existing.lastActivity = Date.now();
+      existing.inFlight++;
+      try {
+        await existing.runWithAuth(creds, oauthSessionId, () => existing.transport.handleRequest(incoming, outgoing, body));
+      } finally {
+        existing.inFlight--;
+        existing.lastActivity = Date.now();
+      }
+      return;
+    }
+    if (sessionId) {
+      writeJson(outgoing, 400, { jsonrpc: "2.0", error: { code: -32e3, message: "Unknown session; please re-initialize." }, id: null });
+      return;
+    }
+    if (this.sessions.size >= this.MAX_SESSIONS) {
+      const stale = [...this.sessions.entries()].filter(([, s]) => s.inFlight === 0).sort((a, b) => a[1].lastActivity - b[1].lastActivity);
+      const evict = Math.min(stale.length, Math.ceil(this.sessions.size * 0.2));
+      for (let i = 0; i < evict; i++) this.destroy(stale[i][0]);
+      if (this.sessions.size >= this.MAX_SESSIONS) {
+        writeJson(outgoing, 503, { error: "Too many active sessions. Try again later." });
+        return;
+      }
+    }
+    const { server, runWithAuth } = this.makeServer();
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => randomUUID2(),
+      onsessioninitialized: (sid) => {
+        const session = { transport, server, runWithAuth, lastActivity: Date.now(), createdAt: Date.now(), inFlight: 1, keepaliveTimer: null };
+        this.sessions.set(sid, session);
+        this.startKeepalive(session);
+      }
+    });
+    transport.onclose = () => {
+      if (transport.sessionId) this.destroy(transport.sessionId);
+    };
+    transport.onerror = (err) => {
+      this.logger.error("mcp", "transport error", { error: err.message });
+      if (transport.sessionId) this.destroy(transport.sessionId);
+    };
+    try {
+      await runWithAuth(creds, oauthSessionId, async () => {
+        await server.connect(transport);
+        await transport.handleRequest(incoming, outgoing, body);
+      });
+    } catch (err) {
+      if (transport.sessionId) {
+        this.destroy(transport.sessionId);
+      } else {
+        this.safeClose(() => transport.close?.());
+        this.safeClose(() => server.close());
+      }
+      throw err;
+    } finally {
+      const s = transport.sessionId ? this.sessions.get(transport.sessionId) : void 0;
+      if (s) {
+        s.inFlight--;
+        s.lastActivity = Date.now();
+      }
+    }
+  }
+  async handleGet(incoming, outgoing) {
+    const sessionId = incoming.headers["mcp-session-id"];
+    const session = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (!session) {
+      writeJson(outgoing, 400, { error: "Invalid or missing session id." });
+      return;
+    }
+    session.lastActivity = Date.now();
+    session.inFlight++;
+    try {
+      await session.transport.handleRequest(incoming, outgoing);
+    } finally {
+      session.inFlight--;
+      session.lastActivity = Date.now();
+    }
+  }
+  async handleDelete(incoming, outgoing) {
+    const sessionId = incoming.headers["mcp-session-id"];
+    const session = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (!session || !sessionId) {
+      writeJson(outgoing, 400, { error: "Invalid or missing session id." });
+      return;
+    }
+    session.inFlight++;
+    try {
+      await session.transport.handleRequest(incoming, outgoing);
+    } finally {
+      session.inFlight--;
+    }
+    this.destroy(sessionId);
+  }
+  close() {
+    clearInterval(this.sweepTimer);
+    for (const sid of [...this.sessions.keys()]) this.destroy(sid);
+  }
+};
+
+// src/mcp/server.ts
+import { createRequire as createRequire2 } from "module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/types.ts
+function formatErrorDetail(e) {
+  if (e instanceof Error) return e.stack || `${e.name}: ${e.message}`;
+  if (typeof e === "string") return e;
+  try {
+    return JSON.stringify(e, null, 2);
+  } catch {
+    return String(e);
+  }
+}
+
+// src/lib/adsError.ts
+var MAX = 500;
+function isRecord2(v) {
+  return typeof v === "object" && v !== null;
+}
+function firstLine(s) {
+  return s.split("\n")[0].trim();
+}
+function fieldPath(err) {
+  const elems = isRecord2(err.location) ? err.location.field_path_elements : void 0;
+  if (!Array.isArray(elems)) return void 0;
+  const parts = elems.map((el) => isRecord2(el) && typeof el.field_name === "string" ? el.field_name : "").filter(Boolean);
+  return parts.length ? parts.join(".") : void 0;
+}
+function gaErrorLine(err) {
+  const msg = typeof err.message === "string" ? err.message.trim() : "";
+  const category = isRecord2(err.error_code) ? Object.keys(err.error_code)[0] : void 0;
+  const fp = fieldPath(err);
+  let line = category ? `${msg} [${category}]` : msg;
+  if (fp) line += ` (field: ${fp})`;
+  return line.trim();
+}
+function describeAdsError(e) {
+  if (e == null) return "Unknown error";
+  if (typeof e === "string") return e.slice(0, MAX);
+  if (isRecord2(e) && Array.isArray(e.errors)) {
+    const joined = e.errors.map(gaErrorLine).filter(Boolean).join("; ");
+    if (joined) {
+      const reqId = typeof e.request_id === "string" ? e.request_id : void 0;
+      return (reqId ? `${joined} (request_id: ${reqId})` : joined).slice(0, MAX);
+    }
+  }
+  if (e instanceof Error) {
+    const details = e.details;
+    const msg = typeof details === "string" && details ? details : e.message;
+    return firstLine(msg).slice(0, MAX) || "Unknown error";
+  }
+  if (isRecord2(e)) {
+    if (typeof e.message === "string" && e.message) return firstLine(e.message).slice(0, MAX);
+    if (typeof e.details === "string" && e.details) return firstLine(e.details).slice(0, MAX);
+    return formatErrorDetail(e).slice(0, MAX);
+  }
+  return String(e).slice(0, MAX);
+}
+function actionableHint(text) {
+  const t = text.toLowerCase();
+  if (t.includes("manager account") || t.includes("requested_metrics_for_manager") || t.includes("metrics cannot be requested")) {
+    return "That is a manager (MCC) account; metrics live on client accounts. Switch with google_ads_account (action switch), then retry.";
+  }
+  if (t.includes("not allowed with project") || t.includes("developer_token_prohibited")) {
+    return "The developer token is tied to a different Google Cloud project than this OAuth client (GOOGLE_OAUTH_CLIENT_ID). With Basic/Test access a token only works with OAuth credentials from its own GCP project: either use an OAuth client created in that project, or link this project to the token in the Google Ads API Center. Standard access removes the restriction.";
+  }
+  if (t.includes("developer token") || t.includes("developer_token")) {
+    return "The developer token is not approved for this account. Apply for Basic access in the Google Ads API Center.";
+  }
+  if (t.includes("user_permission_denied") || t.includes("doesn't have permission") || t.includes("permission to access")) {
+    return "This login cannot access that account. Verify access, or set the manager id as login_customer_id.";
+  }
+  if (t.includes("customer_not_enabled") || t.includes("not enabled")) {
+    return "The account is not active/enabled in Google Ads.";
+  }
+  if (t.includes("campaign_budget") && (t.includes("not allowed for the given context") || t.includes("context_error"))) {
+    return "This account cannot hold campaigns/budgets, it is almost certainly a manager (MCC) account. Campaigns and budgets exist only on CLIENT accounts. Run account list to find a [client] account, switch to it (google_ads_account switch), then retry. This is NOT a missing-budget problem; create makes the budget for you.";
+  }
+  if (t.includes("mutates are not allowed") || t.includes("mutate_not_allowed")) {
+    return "The Google Ads API refuses to create this resource. For a VIDEO campaign this is expected: Google sunset Video Action campaigns (migrated to Demand Gen), so new video campaigns cannot be created via the API. Create a DEMAND_GEN campaign instead (it serves on YouTube, Discover, and Gmail). Do not retry the video create.";
+  }
+  if (t.includes("cannot be mutated for removed campaign")) {
+    return "This belongs to a REMOVED (deleted) campaign, so Google will not let it be updated or deleted independently: it was already removed together with its campaign, and removal is permanent. There is nothing to delete: it is already gone. Report it as removed rather than retrying.";
+  }
+  if (t.includes("duplicate asset")) {
+    return "Two assets have identical content, e.g. the same image URL used for more than one slot (a common mistake: reusing one URL for both square_images and logos). Use a DISTINCT image for each slot.";
+  }
+  if (t.includes("brand guidelines")) {
+    return "P-MAX with Brand Guidelines requires a business name + square logo linked as CampaignAssets. The create already sets brand_guidelines_enabled=false to avoid this, if it still appears, the account enforces brand guidelines: add a business name and square logo in the Google Ads UI, or turn Brand Guidelines off for the account, then retry.";
+  }
+  if (t.includes("unrecognized field") || t.includes("unknown field") || t.includes("field is not") || t.includes("invalid field")) {
+    return "That field name does not exist for this resource. Call the report metadata action (action: metadata, resource: <name>) to list valid selectable/filterable/sortable fields, then retry with exact names.";
+  }
+  return void 0;
+}
+
+// src/tools/define.ts
+var TOOL_TIMEOUT_MS = 6e4;
+var MAX_OUTPUT_CHARS = 5e4;
+var SET_CREDS_HTTP = "Set your Google Ads credentials (refresh token and customer ID) in your MCP client settings for this server, then try again.";
+var SET_CREDS_STDIO = "Set GOOGLE_ADS_REFRESH_TOKEN and GOOGLE_ADS_CUSTOMER_ID in the environment.";
+var NotConnectedError = class extends Error {
+  constructor(mode) {
+    super("not_connected");
+    this.mode = mode;
+    this.name = "NotConnectedError";
+  }
+  mode;
+};
+function errorResult(message) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: message }) }], isError: true };
+}
+function textResult(text) {
+  const clipped = text.length > MAX_OUTPUT_CHARS ? `${text.slice(0, MAX_OUTPUT_CHARS)}
+... (truncated)` : text;
+  return { content: [{ type: "text", text: clipped }] };
+}
+function sanitizeError(e) {
+  return describeAdsError(e);
+}
+function friendlyMessage(e) {
+  if (isQuotaExhausted(e)) {
+    return "Google Ads rate/quota limit reached. Retry later; if it persists, the developer token likely needs Standard Access.";
+  }
+  const message = describeAdsError(e);
+  const hint = actionableHint(message);
+  return hint ? `${message}
+\u2192 ${hint}` : message;
+}
+function defineTool(def) {
+  const original2 = def.execute;
+  def.execute = async (params, ctx) => {
+    const parsed = def.parameters.safeParse(params);
+    if (!parsed.success) {
+      const issues = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "root"}: ${i.message}`).join("\n");
+      throw new Error(`Invalid parameters for '${def.name}':
+${issues}
+
+Rewrite the input to match the schema.`);
+    }
+    let timer;
+    const timeoutMsg = def.annotations?.destructiveHint ? `Tool '${def.name}' timed out after ${TOOL_TIMEOUT_MS / 1e3}s. \u26A0\uFE0F The change MAY have been applied, check the account before retrying (do not blindly retry).` : `Tool '${def.name}' timed out after ${TOOL_TIMEOUT_MS / 1e3}s.`;
+    return Promise.race([
+      original2(parsed.data, ctx).finally(() => clearTimeout(timer)),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(timeoutMsg)), TOOL_TIMEOUT_MS);
+      })
+    ]);
+  };
+  return def;
+}
+function wrapForMcp(tool, ctx) {
+  return async (params) => {
+    try {
+      const result = await tool.execute(params, ctx);
+      ctx.audit.record({
+        timestamp: Date.now(),
+        server: "mcp",
+        category: result.category ?? tool.logCategory,
+        summary: result.auditSummary ?? tool.name,
+        customerId: result.customerId,
+        status: "success"
+      });
+      return textResult(result.output);
+    } catch (e) {
+      if (e instanceof NotConnectedError) {
+        return textResult(
+          e.mode === "http" ? `You haven't set your Google Ads credentials yet.
+
+${SET_CREDS_HTTP}` : `No Google Ads credentials configured.
+
+${SET_CREDS_STDIO}`
+        );
+      }
+      if (isReauthRequired(e)) {
+        if (ctx.mode === "http" && ctx.oauthSessionId) {
+          ctx.oauthStore?.deleteSession(ctx.oauthSessionId);
+        }
+        ctx.audit.record({
+          timestamp: Date.now(),
+          server: "mcp",
+          category: "auth",
+          summary: `${tool.name}: refresh token rejected, session cleared`,
+          customerId: ctx.credentials?.customerId,
+          status: "error",
+          errorMessage: "invalid_grant / unauthorized_client / UNAUTHENTICATED"
+        });
+        return textResult(
+          ctx.mode === "http" ? "\u26A0\uFE0F Your Google Ads authorization is no longer valid and has been reset. Click Connect to re-authorize." : "\u26A0\uFE0F The configured GOOGLE_ADS_REFRESH_TOKEN was rejected (expired/revoked). Update it."
+        );
+      }
+      ctx.audit.record({
+        timestamp: Date.now(),
+        server: "mcp",
+        category: "error",
+        summary: `${tool.name} failed`,
+        customerId: ctx.credentials?.customerId,
+        status: "error",
+        errorMessage: sanitizeError(e),
+        errorDetail: formatErrorDetail(e)
+      });
+      return errorResult(friendlyMessage(e));
+    }
+  };
+}
+
+// src/tools/orchestrator.ts
+import { z as z2 } from "zod";
+function injectAction(output, action) {
+  if (!action || !output.includes("Example: {") || output.includes('"action"')) return output;
+  return output.replace("Example: {", `Example: {"action": "${action}", `);
+}
+function buildDescription(spec) {
+  return [
+    `Purpose: ${spec.purpose}`,
+    "Actions:",
+    ...spec.handlers.map((h) => `- ${h.action}: ${h.summary}`),
+    `Limitations: ${spec.limitations}`,
+    "Examples:",
+    ...spec.examples.map((e) => `  ${e}`)
+  ].join("\n");
+}
+function defineOrchestrator(spec) {
+  const { name, handlers } = spec;
+  const byAction = new Map(handlers.map((h) => [h.action, h]));
+  const actions = handlers.map((h) => h.action);
+  const shape = {
+    action: z2.enum(actions).describe(`The operation to perform. One of: ${actions.join(", ")}.`)
+  };
+  for (const h of handlers) {
+    const fields = h.schema.shape;
+    for (const [key, field] of Object.entries(fields)) {
+      if (!shape[key]) shape[key] = field.optional();
+    }
+  }
+  return defineTool({
+    name,
+    description: buildDescription(spec),
+    // readOnlyHint only when EVERY action is read-only (orchestrators are usually mixed).
+    annotations: handlers.every((h) => h.readOnly) ? { readOnlyHint: true } : {},
+    logCategory: "report",
+    // default only; the per-call category comes from result.category
+    parameters: z2.object(shape),
+    async execute(params, ctx) {
+      const action = typeof params.action === "string" ? params.action : "";
+      const handler = byAction.get(action);
+      if (!handler) {
+        throw new Error(`Unknown action "${action}" for ${name}. Valid actions: ${actions.join(", ")}.`);
+      }
+      const parsed = handler.schema.safeParse(params);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "param"}: ${i.message}`).join("\n");
+        throw new Error(`Invalid parameters for ${name} action "${action}":
+${issues}`);
+      }
+      const result = await handler.execute(parsed.data, ctx);
+      const output = injectAction(result.output, action);
+      return { ...result, output, category: result.category ?? handler.category };
+    }
+  });
+}
+
+// src/tools/handlers/account/status.ts
+import { z as z3 } from "zod";
+
+// src/tools/connection.ts
+function requireConnection(ctx) {
+  if (!ctx.credentials) throw new NotConnectedError(ctx.mode);
+  return ctx.credentials;
+}
+function formatCid(id) {
+  return /^\d{10}$/.test(id) ? `${id.slice(0, 3)}-${id.slice(3, 6)}-${id.slice(6)}` : id;
+}
+var SETTINGS_HINT = "Set your Google Ads refresh token and customer ID in your MCP client settings for this server.";
+
+// src/tools/handlers/account/status.ts
+var schema = z3.object({
+  check_live: z3.boolean().default(true).describe("Confirm the token works with a live API call (1 op).")
+});
+var statusHandler = {
+  action: "status",
+  summary: "Check whether Google Ads credentials are present and the refresh token still works. check_live (default true) makes one live API call.",
+  readOnly: true,
+  category: "auth",
+  schema,
+  async execute(params, ctx) {
+    const creds = ctx.credentials;
+    if (!creds) {
+      return {
+        output: ctx.mode === "http" ? `Not connected. ${SETTINGS_HINT}` : "Not connected. Set GOOGLE_ADS_REFRESH_TOKEN and GOOGLE_ADS_CUSTOMER_ID.",
+        auditSummary: "Connection status: not connected"
+      };
+    }
+    if (!params.check_live) {
+      return { output: `Connected to account ${formatCid(creds.customerId)} (token not live-checked).`, auditSummary: "Connection status: connected (cached)", customerId: creds.customerId };
+    }
+    try {
+      const rows = await ctx.ads.query(creds, "SELECT customer.descriptive_name, customer.id FROM customer LIMIT 1");
+      const name = rows[0]?.customer?.descriptive_name?.trim();
+      const label = name ? `${name} (${formatCid(creds.customerId)})` : formatCid(creds.customerId);
+      return { output: `\u2705 Connected and token valid, account ${label}.`, auditSummary: "Connection status: healthy", customerId: creds.customerId };
+    } catch (e) {
+      if (isReauthRequired(e)) {
+        return {
+          output: ctx.mode === "http" ? `\u26A0\uFE0F Refresh token rejected (expired/revoked). Update it in your MCP client settings for this server.` : "\u26A0\uFE0F GOOGLE_ADS_REFRESH_TOKEN was rejected, update it.",
+          auditSummary: "Connection status: token rejected",
+          customerId: creds.customerId
+        };
+      }
+      throw e;
+    }
+  }
+};
+
+// src/tools/handlers/account/list.ts
+import { z as z4 } from "zod";
+var schema2 = z4.object({});
+var listHandler = {
+  action: "list",
+  summary: "List the active account plus other accounts this login can access (use it to get a customer_id before switch).",
+  readOnly: true,
+  category: "report",
+  schema: schema2,
+  async execute(_params, ctx) {
+    const creds = requireConnection(ctx);
+    const ids = await ctx.ads.listAccessibleCustomers(creds.refreshToken);
+    const LABEL_CAP = 40;
+    const metas = ids.length <= LABEL_CAP ? await Promise.all(ids.map((id) => ctx.ads.accountMeta(creds.refreshToken, id))) : [];
+    const lines = ids.map((id, i) => {
+      const m = metas[i];
+      const name = m?.name ? ` ${m.name}` : "";
+      const type = m?.manager === true ? " [manager, no campaigns/metrics]" : m?.manager === false ? " [client]" : "";
+      return `${id === creds.customerId ? "\u2192 " : "  "}${formatCid(id)}${name}${type}`;
+    });
+    const hint = ids.length <= LABEL_CAP ? "\n\nCreate campaigns/run metrics on a [client] account; switch to one first." : "";
+    return {
+      output: [`Active account: ${formatCid(creds.customerId)}`, "", ids.length ? "Accessible accounts:" : "No other accessible accounts found.", ...lines].join("\n") + hint,
+      auditSummary: "Listed accessible accounts",
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/account/switch.ts
+import { z as z5 } from "zod";
+var schema3 = z5.object({
+  customer_id: z5.string().describe("The 10-digit account ID to make active (dashes optional).")
+});
+var switchHandler = {
+  action: "switch",
+  summary: "Set which Google Ads account (customer_id) the tools act on, for a login that can access several. Persists on the session.",
+  readOnly: false,
+  category: "auth",
+  schema: schema3,
+  async execute(params, ctx) {
+    const creds = requireConnection(ctx);
+    const cid = params.customer_id.replace(/-/g, "");
+    if (!ctx.oauthStore || !ctx.oauthSessionId) {
+      return { output: "Switching accounts is only available on the hosted server.", customerId: creds.customerId };
+    }
+    const session = ctx.oauthStore.getSession(ctx.oauthSessionId);
+    if (!session) return { output: "Your session was not found. Please reconnect." };
+    if (!session.accessibleCustomers.includes(cid)) {
+      const list = session.accessibleCustomers.map(formatCid).join(", ") || "none found";
+      return { output: `Account ${formatCid(cid)} isn't one your authorization can access. Accessible accounts: ${list}.`, customerId: creds.customerId };
+    }
+    ctx.oauthStore.setActiveCustomer(ctx.oauthSessionId, cid);
+    return { output: `\u2705 Active account set to ${formatCid(cid)}. It applies to your next requests.`, auditSummary: `Set active account to ${cid}`, customerId: cid };
+  }
+};
+
+// src/tools/handlers/account/audit.ts
+import { z as z6 } from "zod";
+var schema4 = z6.object({
+  limit: z6.number().int().min(1).max(200).default(50).describe("Max entries to return (newest first). Default 50."),
+  category: z6.enum(["report", "mutate", "auth", "error"]).optional().describe("Filter by action category."),
+  status: z6.enum(["success", "error"]).optional().describe("Filter by outcome."),
+  since_days: z6.number().int().min(1).max(365).optional().describe("Only actions from the last N days.")
+});
+var auditHandler = {
+  action: "audit",
+  summary: "Show the recent audit trail (when / what / outcome) of actions on the connected account. Filter by category, status, or since_days.",
+  readOnly: true,
+  category: "report",
+  schema: schema4,
+  async execute(params, ctx) {
+    const creds = requireConnection(ctx);
+    if (!ctx.audit.hasStore) {
+      return {
+        output: "The audit trail is only available on the hosted server (--http mode); this session has no durable audit store.",
+        auditSummary: "Audit log: unavailable (no store)",
+        customerId: creds.customerId
+      };
+    }
+    const sinceTs = params.since_days ? Date.now() - params.since_days * 864e5 : void 0;
+    const rows = ctx.audit.query({
+      customerId: creds.customerId,
+      limit: params.limit,
+      category: params.category,
+      status: params.status,
+      sinceTs
+    });
+    if (!rows.length) {
+      return {
+        output: `No audited actions found for ${formatCid(creds.customerId)} in the selected range.`,
+        auditSummary: "Audit log: 0 entries",
+        customerId: creds.customerId
+      };
+    }
+    const lines = rows.map((r) => {
+      const when = new Date(r.ts).toISOString().replace("T", " ").slice(0, 19);
+      const mark = r.status === "error" ? "\u2717" : "\u2713";
+      const err = r.error_message ? `: ${r.error_message}` : "";
+      return `${when}  ${mark} [${r.category}] ${r.summary}${err}`;
+    });
+    return {
+      output: [`${rows.length} most recent audited action(s) for ${formatCid(creds.customerId)} (newest first):`, "", ...lines].join("\n"),
+      auditSummary: `Read audit log (${rows.length} entries)`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/orchestrators/account.ts
+var accountTool = defineOrchestrator({
+  name: "google_ads_account",
+  purpose: "Connection and account management. status checks the connection and token. list shows the accounts you can access. switch changes the active account. audit reads the audit trail.",
+  limitations: "switch and audit only work on the hosted (http) server, not stdio. Customer ids are 10 digits with no dashes. A manager (MCC) account cannot be queried for metrics, so switch to a client account first if you need reporting.",
+  examples: [
+    '{"action":"status"}',
+    '{"action":"list"}',
+    '{"action":"switch","customer_id":"1234567890"}',
+    '{"action":"audit","limit":20,"status":"error"}'
+  ],
+  handlers: [statusHandler, listHandler, switchHandler, auditHandler]
+});
+
+// src/tools/handlers/report/performance.ts
+import { z as z7 } from "zod";
+import { enums } from "google-ads-api";
+
+// src/tools/format.ts
+var money = (micros) => (Number(micros) / 1e6).toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 });
+var formatUnits = (units) => Number(units).toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 });
+var int = (n3) => Math.round(Number(n3)).toLocaleString("en-US");
+var pct = (frac) => `${(Number(frac) * 100).toFixed(2)}%`;
+function enumLabel(enumObj, value) {
+  if (typeof value === "string") return value;
+  if (value == null) return "-";
+  for (const k of Object.keys(enumObj)) if (enumObj[k] === value) return k;
+  return String(value);
+}
+
+// src/lib/paginate.ts
+var PAGE_BUDGET_CHARS = 4e4;
+function paginate(args) {
+  const { ctx, cursor, customerId } = args;
+  const cache = ctx.pageCache;
+  const scope = ctx.credentials?.customerId ?? "";
+  let lines;
+  let offset;
+  let title;
+  let effectiveCustomerId = customerId;
+  if (cursor) {
+    const entry = cache.get(cursor, scope);
+    if (!entry) {
+      return {
+        output: "That report has expired (pages are cached ~5 minutes). Re-run the report to start again.",
+        auditSummary: `${args.summary} (cursor expired)`,
+        customerId
+      };
+    }
+    lines = entry.rows;
+    offset = entry.offset;
+    title = entry.title;
+    effectiveCustomerId = entry.customerId ?? customerId;
+  } else {
+    lines = args.rows;
+    offset = 0;
+    title = args.title;
+  }
+  const total = lines.length;
+  let used = title.length;
+  let i = offset;
+  for (; i < total; i++) {
+    const ln = lines[i];
+    if (i > offset && used + ln.length + 1 > PAGE_BUDGET_CHARS) break;
+    used += ln.length + 1;
+  }
+  const shownTo = i;
+  const pageLines = lines.slice(offset, shownTo);
+  const hasMore = shownTo < total;
+  let nextCursor = null;
+  if (cursor) {
+    cache.advance(cursor, shownTo);
+    nextCursor = hasMore ? cursor : null;
+  } else if (hasMore) {
+    nextCursor = cache.create(scope, title, lines, shownTo, effectiveCustomerId);
+  }
+  const range = total === 0 ? "0 of 0" : `${offset + 1}-${shownTo} of ${total}`;
+  const footer = hasMore ? `
+... showing ${range}. ${total - shownTo} more row(s). To continue, call this tool again with cursor:"${nextCursor}". Ask the user first if they want the rest.` : offset > 0 ? `
+(showing ${range}, end of report)` : "";
+  return {
+    output: [title, "", ...pageLines, footer].join("\n"),
+    auditSummary: cursor ? `${args.summary} (page from row ${offset + 1})` : args.summary,
+    customerId: effectiveCustomerId
+  };
+}
+
+// src/ads/dates.ts
+var DATE_RANGES = [
+  "TODAY",
+  "YESTERDAY",
+  "LAST_7_DAYS",
+  "LAST_14_DAYS",
+  "LAST_30_DAYS",
+  "THIS_MONTH",
+  "LAST_MONTH"
+];
+function fmt(d) {
+  return d.toISOString().slice(0, 10);
+}
+function accountToday(tz) {
+  if (!tz) {
+    const n3 = /* @__PURE__ */ new Date();
+    return new Date(Date.UTC(n3.getUTCFullYear(), n3.getUTCMonth(), n3.getUTCDate()));
+  }
+  const parts = new Intl.DateTimeFormat("en-CA", { timeZone: tz, year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(/* @__PURE__ */ new Date());
+  const get = (t) => Number(parts.find((p2) => p2.type === t).value);
+  return new Date(Date.UTC(get("year"), get("month") - 1, get("day")));
+}
+function addDays(d, n3) {
+  const x = new Date(d);
+  x.setUTCDate(x.getUTCDate() + n3);
+  return x;
+}
+function explicitWindow(range, tz) {
+  const today = accountToday(tz);
+  switch (range) {
+    case "TODAY":
+      return { start: fmt(today), end: fmt(today) };
+    case "YESTERDAY": {
+      const y = addDays(today, -1);
+      return { start: fmt(y), end: fmt(y) };
+    }
+    case "LAST_7_DAYS":
+      return { start: fmt(addDays(today, -7)), end: fmt(addDays(today, -1)) };
+    case "LAST_14_DAYS":
+      return { start: fmt(addDays(today, -14)), end: fmt(addDays(today, -1)) };
+    case "LAST_30_DAYS":
+      return { start: fmt(addDays(today, -30)), end: fmt(addDays(today, -1)) };
+    case "THIS_MONTH":
+      return { start: fmt(new Date(Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), 1))), end: fmt(today) };
+    case "LAST_MONTH":
+      return {
+        start: fmt(new Date(Date.UTC(today.getUTCFullYear(), today.getUTCMonth() - 1, 1))),
+        end: fmt(new Date(Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), 0)))
+      };
+  }
+}
+function previousWindow(w) {
+  const start = /* @__PURE__ */ new Date(`${w.start}T00:00:00Z`);
+  const end = /* @__PURE__ */ new Date(`${w.end}T00:00:00Z`);
+  const lenDays = Math.round((end.getTime() - start.getTime()) / 864e5) + 1;
+  const prevEnd = addDays(start, -1);
+  const prevStart = addDays(prevEnd, -(lenDays - 1));
+  return { start: fmt(prevStart), end: fmt(prevEnd) };
+}
+
+// src/tools/handlers/report/performance.ts
+var CHANNELS = ["SEARCH", "PERFORMANCE_MAX", "DISPLAY", "SHOPPING", "VIDEO", "DEMAND_GEN"];
+var METRICS = "metrics.impressions, metrics.clicks, metrics.ctr, metrics.average_cpc, metrics.cost_micros, metrics.conversions, metrics.conversions_value, metrics.conversions_from_interactions_rate";
+var n = (v) => Number(v ?? 0);
+var roas = (value, cost) => cost > 0 ? (value / cost).toFixed(2) : "-";
+function sum(rows) {
+  return rows.reduce(
+    (a, r) => ({
+      impressions: a.impressions + n(r.metrics.impressions),
+      clicks: a.clicks + n(r.metrics.clicks),
+      cost: a.cost + n(r.metrics.cost_micros) / 1e6,
+      conversions: a.conversions + n(r.metrics.conversions),
+      value: a.value + n(r.metrics.conversions_value)
+    }),
+    { impressions: 0, clicks: 0, cost: 0, conversions: 0, value: 0 }
+  );
+}
+function delta(cur, prev) {
+  if (prev === 0) return cur === 0 ? "\xB10%" : "n/a";
+  const d = (cur - prev) / prev * 100;
+  return `${d >= 0 ? "+" : ""}${d.toFixed(1)}%`;
+}
+function campaignLine(r, currency) {
+  const m = r.metrics;
+  const cost = n(m.cost_micros) / 1e6;
+  const cur = currency ? `${currency} ` : "";
+  const ctr = m.ctr != null ? pct(n(m.ctr)) : "-";
+  return `\u2022 ${r.campaign.name} (${enumLabel(enums.AdvertisingChannelType, r.campaign.advertising_channel_type)}) id ${r.campaign.id}, Impr ${int(n(m.impressions))} | Clicks ${int(n(m.clicks))} | CTR ${ctr} | Cost ${cur}${formatUnits(cost)} | Conv ${n(m.conversions).toFixed(1)} | CvR ${m.conversions_from_interactions_rate != null ? pct(n(m.conversions_from_interactions_rate)) : "-"} | Value ${formatUnits(n(m.conversions_value))} | ROAS ${roas(n(m.conversions_value), cost)}`;
+}
+function performanceTitle(range, customerId, rows, truncated, cap, total, currency) {
+  const t = sum(rows);
+  const cur = currency ? `${currency} ` : "";
+  const totals = rows.length ? ` \xB7 Totals: Impr ${int(t.impressions)} | Cost ${cur}${formatUnits(t.cost)} | Conv ${t.conversions.toFixed(1)} | ROAS ${roas(t.value, t.cost)}` : "";
+  const note = truncated ? `
+(top ${cap}${total != null ? ` of ${int(total)}` : ""} campaigns by cost shown; refine filters or export for the full set)` : "";
+  const acct = `account ${formatCid(customerId)}${currency ? ` \xB7 ${currency}` : ""}`;
+  return `Campaign performance, ${range} (${acct})${totals}${note}`;
+}
+function renderCompare(customerId, cur, prev, curRows, prevRows, currency) {
+  const c = sum(curRows);
+  const p2 = sum(prevRows);
+  const line = (label, cv, pv, fmt2) => `${label.padEnd(13)} ${fmt2(cv).padStart(14)} ${fmt2(pv).padStart(14)}   ${delta(cv, pv)}`;
+  return [
+    `Campaign performance, comparison (account ${formatCid(customerId)}${currency ? ` \xB7 ${currency}` : ""})`,
+    `Current : ${cur.start} \u2192 ${cur.end}`,
+    `Previous: ${prev.start} \u2192 ${prev.end}`,
+    "",
+    `${"Metric".padEnd(13)} ${"Current".padStart(14)} ${"Previous".padStart(14)}   \u0394`,
+    line("Impressions", c.impressions, p2.impressions, int),
+    line("Clicks", c.clicks, p2.clicks, int),
+    line("Cost", c.cost, p2.cost, formatUnits),
+    line("Conversions", c.conversions, p2.conversions, (x) => x.toFixed(1)),
+    line("Conv. value", c.value, p2.value, formatUnits),
+    `${"ROAS".padEnd(13)} ${roas(c.value, c.cost).padStart(14)} ${roas(p2.value, p2.cost).padStart(14)}`
+  ].join("\n");
+}
+var schema5 = z7.object({
+  date_range: z7.enum(DATE_RANGES).default("LAST_30_DAYS"),
+  channel_type: z7.enum(CHANNELS).optional().describe("Filter to one campaign type, e.g. PERFORMANCE_MAX"),
+  compare_previous: z7.boolean().default(false).describe("Compare with the preceding equal-length period"),
+  limit: z7.number().int().min(1).max(2e3).default(200).describe("Max campaigns to fetch this run (paginated for display)"),
+  cursor: z7.string().optional().describe("Continuation token from a previous page (served from cache, no new Google call)")
+});
+var performanceHandler = {
+  action: "campaign_performance",
+  summary: "Campaign performance (impressions, clicks, CTR, cost, conversions, value, computed ROAS). Pick a date_range; optional channel_type filter and compare_previous; paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema5,
+  async execute(params, ctx) {
+    if (params.cursor) {
+      return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Report: campaign performance (page)" });
+    }
+    const creds = await requireConnection(ctx);
+    const channelFilter = params.channel_type ? ` AND campaign.advertising_channel_type = ${params.channel_type}` : "";
+    const select = `SELECT campaign.id, campaign.name, campaign.advertising_channel_type, ${METRICS} FROM campaign`;
+    const currency = await ctx.ads.currencyCode(creds);
+    if (params.compare_previous) {
+      const tz = await ctx.ads.timeZone(creds);
+      const cur = explicitWindow(params.date_range, tz);
+      const prev = previousWindow(cur);
+      const order = " ORDER BY metrics.cost_micros DESC";
+      const cap = 1e3;
+      const [curRes, prevRes] = await Promise.all([
+        ctx.ads.searchPage(creds, `${select} WHERE segments.date BETWEEN '${cur.start}' AND '${cur.end}'${channelFilter}${order}`, cap),
+        ctx.ads.searchPage(creds, `${select} WHERE segments.date BETWEEN '${prev.start}' AND '${prev.end}'${channelFilter}${order}`, cap)
+      ]);
+      const maxTotal = Math.max(curRes.total ?? 0, prevRes.total ?? 0);
+      const truncNote = curRes.truncated || prevRes.truncated ? `
+(\u26A0\uFE0F totals cover the top ${cap}${maxTotal ? ` of ${int(maxTotal)}` : ""} campaigns by cost per period; narrow with channel_type for exact totals on a larger account)` : "";
+      return {
+        output: renderCompare(creds.customerId, cur, prev, curRes.rows, prevRes.rows, currency) + truncNote,
+        auditSummary: `Report: compare ${params.date_range}${params.channel_type ? ` (${params.channel_type})` : ""}`,
+        customerId: creds.customerId
+      };
+    }
+    const gaql = `${select} WHERE segments.date DURING ${params.date_range}${channelFilter} ORDER BY metrics.cost_micros DESC`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    if (!rows.length) {
+      return {
+        output: `Campaign performance, ${params.date_range} (account ${formatCid(creds.customerId)})
+
+No campaigns with data in this period.`,
+        auditSummary: `Report: campaign performance (${params.date_range})`,
+        customerId: creds.customerId
+      };
+    }
+    return paginate({
+      ctx,
+      title: performanceTitle(params.date_range, creds.customerId, rows, truncated, params.limit, total, currency),
+      rows: rows.map((r) => campaignLine(r, currency)),
+      summary: `Report: campaign performance (${params.date_range}${params.channel_type ? `, ${params.channel_type}` : ""})`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/report/impressionShare.ts
+import { z as z8 } from "zod";
+var FIELDS = "campaign.id, campaign.name, metrics.search_impression_share, metrics.search_top_impression_share, metrics.search_absolute_top_impression_share, metrics.search_budget_lost_impression_share, metrics.search_rank_lost_impression_share";
+var p = (v) => v != null ? pct(Number(v)) : "-";
+function isLine(r) {
+  const m = r.metrics;
+  return `\u2022 ${r.campaign.name} id ${r.campaign.id}, IS ${p(m.search_impression_share)} | top ${p(m.search_top_impression_share)} | abs-top ${p(m.search_absolute_top_impression_share)} | lost(budget) ${p(m.search_budget_lost_impression_share)} | lost(rank) ${p(m.search_rank_lost_impression_share)}`;
+}
+var schema6 = z8.object({
+  date_range: z8.enum(DATE_RANGES).default("LAST_30_DAYS"),
+  limit: z8.number().int().min(1).max(2e3).default(200),
+  cursor: z8.string().optional()
+});
+var impressionShareHandler = {
+  action: "impression_share",
+  summary: "Search impression-share report (the Average-Position replacement): impression share, top and absolute-top IS, and share lost to budget vs rank, per campaign. Search campaigns only. Pick a date_range; paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema6,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Impression share (page)" });
+    const creds = await requireConnection(ctx);
+    const gaql = `SELECT ${FIELDS} FROM campaign WHERE campaign.advertising_channel_type = SEARCH AND segments.date DURING ${params.date_range} ORDER BY metrics.search_impression_share DESC`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    if (!rows.length) {
+      return { output: `No Search campaigns with impression-share data in ${params.date_range}.`, auditSummary: `Report: impression share (${params.date_range})`, customerId: creds.customerId };
+    }
+    return paginate({
+      ctx,
+      title: `Search impression share, ${params.date_range} (account ${formatCid(creds.customerId)})${truncated ? ` - top ${params.limit}${total != null ? ` of ${int(total)}` : ""}` : ""}`,
+      rows: rows.map(isLine),
+      summary: `Report: impression share (${params.date_range})`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/report/assetGroup.ts
+import { z as z10 } from "zod";
+import { enums as enums2 } from "google-ads-api";
+
+// src/tools/shared.ts
+import { z as z9 } from "zod";
+var ID = z9.string().regex(/^\d+$/, "must be a numeric Google Ads id (digits only)");
+function youtubeVideoId(input) {
+  const s = input.trim();
+  if (/^[A-Za-z0-9_-]{11}$/.test(s)) return s;
+  const m = s.match(/(?:v=|\/embed\/|youtu\.be\/|\/v\/|\/shorts\/)([A-Za-z0-9_-]{11})/);
+  if (m?.[1]) return m[1];
+  throw new Error(`"${input}" is not a YouTube video id or URL. Pass the 11-character video id or a youtube.com/watch?v=... / youtu.be/... link.`);
+}
+var confirmFields = {
+  confirmed: z9.boolean().default(false).describe(
+    'Apply the write. Leave false (or omit) on the first call to get a validate-only preview. Set true ONLY after the user typed "yes" or "ok" in chat in reply to that preview. Never set true on the first call; never invent approval.'
+  ),
+  user_confirmation: z9.enum(["yes", "ok"]).optional().describe(
+    `Required when confirmed is true. Pass exactly "yes" or "ok" \u2014 the user's affirmative reply in chat. Do not set this until they type it. Not a free-form string; only those two values.`
+  )
+};
+function userConfirmationRequired() {
+  return !/^(false|0|no|off)$/i.test((process.env.REQUIRE_USER_CONFIRMATION ?? "").trim());
+}
+function stripConfirm(example) {
+  const out = {};
+  for (const [k, v] of Object.entries(example)) {
+    if (k === "confirmed" || k === "user_confirmation") continue;
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function preview(action, applyExample) {
+  const intent = stripConfirm(applyExample);
+  const example = { ...intent, confirmed: true, user_confirmation: "yes" };
+  return [
+    `\u26A0\uFE0F Validated, NOT applied yet. This will ${action}.`,
+    "",
+    'Show these exact values to the user as a short question and ask them to type "yes" or "ok" to proceed (anything else = cancel).',
+    "Do NOT call this tool again with confirmed:true until they type yes or ok in chat.",
+    'After they reply yes/ok, call again with confirmed:true and user_confirmation set to "yes" or "ok" (match what they typed).',
+    `Example: ${JSON.stringify(example)}`
+  ].join("\n");
+}
+function previewRemove(what, applyExample) {
+  const intent = stripConfirm(applyExample);
+  const example = { ...intent, confirmed: true, user_confirmation: "yes" };
+  return [
+    `\u26A0\uFE0F DELETE: this PERMANENTLY REMOVES ${what}. It cannot be undone.`,
+    "",
+    "NOT applied yet (validated only). Tell the user EXACTLY what will be deleted.",
+    'Ask them to type "yes" or "ok" to delete it (anything else = cancel).',
+    "Do NOT call again with confirmed:true until they type yes or ok in chat.",
+    'After they reply yes/ok, call again with confirmed:true and user_confirmation set to "yes" or "ok".',
+    `Example: ${JSON.stringify(example)}`
+  ].join("\n");
+}
+function assertUserConfirmed(params) {
+  if (!params.confirmed) {
+    throw new Error("Internal error: assertUserConfirmed called without confirmed:true.");
+  }
+  if (!userConfirmationRequired()) return;
+  if (params.user_confirmation !== "yes" && params.user_confirmation !== "ok") {
+    throw new Error(
+      `confirmed:true requires user_confirmation "yes" or "ok" from the user's chat reply. Call once without confirmed to preview, show the values, ask them to type yes or ok, then re-call with confirmed:true and user_confirmation:"yes" (or "ok").`
+    );
+  }
+}
+function assertUserConfirmedIfClaimed(params) {
+  if (params.confirmed) assertUserConfirmed(params);
+}
+function createdId(result, key) {
+  const responses = result?.mutate_operation_responses ?? result?.results ?? [];
+  for (const r of responses) {
+    const rn = r?.[key]?.resource_name;
+    if (rn) return String(rn).split("/").pop() ?? null;
+  }
+  return null;
+}
+
+// src/tools/handlers/report/assetGroup.ts
+var n2 = (v) => Number(v ?? 0);
+var roas2 = (value, cost) => cost > 0 ? (value / cost).toFixed(2) : "-";
+function agLine(r) {
+  const ag = r.asset_group;
+  const m = r.metrics;
+  const cost = n2(m.cost_micros) / 1e6;
+  return `\u2022 ${ag.name} (${enumLabel(enums2.AssetGroupStatus, ag.status)}) id ${ag.id} [campaign ${r.campaign?.id}], Impr ${int(n2(m.impressions))} | Clicks ${int(n2(m.clicks))} | Cost ${formatUnits(cost)} | Conv ${n2(m.conversions).toFixed(1)} | Value ${formatUnits(n2(m.conversions_value))} | ROAS ${roas2(n2(m.conversions_value), cost)}`;
+}
+var schema7 = z10.object({
+  date_range: z10.enum(DATE_RANGES).default("LAST_30_DAYS"),
+  campaign_id: ID.optional().describe("Limit to one Performance Max campaign"),
+  limit: z10.number().int().min(1).max(2e3).default(200),
+  cursor: z10.string().optional()
+});
+var assetGroupHandler = {
+  action: "asset_group",
+  summary: "Performance Max asset-group performance: impressions, clicks, cost, conversions, value, and computed ROAS per asset group. Optionally scope to one campaign_id. Pick a date_range; paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema7,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Asset-group performance (page)" });
+    const creds = await requireConnection(ctx);
+    const campaignFilter = params.campaign_id ? ` AND campaign.id = ${params.campaign_id}` : "";
+    const gaql = `SELECT asset_group.id, asset_group.name, asset_group.status, campaign.id, campaign.name, metrics.impressions, metrics.clicks, metrics.cost_micros, metrics.conversions, metrics.conversions_value FROM asset_group WHERE segments.date DURING ${params.date_range}${campaignFilter} ORDER BY metrics.cost_micros DESC`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    if (!rows.length) {
+      return { output: `No asset-group data in ${params.date_range}${params.campaign_id ? ` for campaign ${params.campaign_id}` : ""}.`, auditSummary: `Report: asset groups (${params.date_range})`, customerId: creds.customerId };
+    }
+    return paginate({
+      ctx,
+      title: `P-MAX asset-group performance, ${params.date_range} (account ${formatCid(creds.customerId)})${truncated ? ` - top ${params.limit}${total != null ? ` of ${int(total)}` : ""}` : ""}`,
+      rows: rows.map(agLine),
+      summary: `Report: asset groups (${params.date_range})`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/report/gaql.ts
+import { z as z11 } from "zod";
+var RESOURCE = /^[a-z][a-z0-9_]*$/;
+var FIELD = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+var BLOCKED_RESOURCES = /* @__PURE__ */ new Set([
+  "customer_user_access",
+  "customer_user_access_invitation",
+  "change_event",
+  "change_status",
+  "billing_setup",
+  "payments_account",
+  "account_budget",
+  "account_budget_proposal"
+]);
+function buildGaql(p2) {
+  if (!RESOURCE.test(p2.resource)) {
+    throw new Error(`Invalid resource "${p2.resource}". Use a single resource name like campaign or ad_group (call metadata to discover resources).`);
+  }
+  if (BLOCKED_RESOURCES.has(p2.resource)) {
+    throw new Error(`Resource "${p2.resource}" is not allowed: it exposes user emails, change history, or billing data. This tool reports performance only, query campaign, ad_group, keyword_view, search_term_view, and similar.`);
+  }
+  if (!p2.fields?.length) {
+    throw new Error("Provide at least one field in `fields` (call metadata to discover valid fields).");
+  }
+  for (const f of p2.fields) {
+    if (!FIELD.test(f)) {
+      throw new Error(`Invalid field "${f}". Use a fully-qualified field like campaign.name or metrics.clicks (call metadata to discover valid fields).`);
+    }
+  }
+  const parts = [`SELECT ${p2.fields.join(", ")} FROM ${p2.resource}`];
+  const conds = (p2.conditions ?? []).map((c) => c.trim()).filter(Boolean);
+  if (conds.length) {
+    for (const c of conds) {
+      const first = c.split(/\s+/)[0] ?? "";
+      if (!FIELD.test(first)) {
+        throw new Error(`Invalid condition "${c}". Each condition must start with a fully-qualified field, e.g. "metrics.clicks > 100" or "segments.date DURING LAST_30_DAYS".`);
+      }
+      if (/[;`]/.test(c) || /\b(select|from)\b/i.test(c)) {
+        throw new Error(`Disallowed token in condition "${c}".`);
+      }
+    }
+    parts.push(`WHERE ${conds.join(" AND ")}`);
+  }
+  if (p2.orderings?.length) {
+    const ords = [];
+    for (const o of p2.orderings) {
+      const m = o.trim().match(/^([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+)(?:\s+(ASC|DESC))?$/i);
+      if (!m) {
+        throw new Error(`Invalid ordering "${o}". Use a field with optional ASC/DESC, e.g. "metrics.cost_micros DESC".`);
+      }
+      ords.push(m[2] ? `${m[1]} ${m[2].toUpperCase()}` : m[1]);
+    }
+    parts.push(`ORDER BY ${ords.join(", ")}`);
+  }
+  if (p2.limit != null) parts.push(`LIMIT ${p2.limit}`);
+  return parts.join(" ");
+}
+function humanizeMicros(value) {
+  if (Array.isArray(value)) return value.map(humanizeMicros);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (k.endsWith("_micros") && v != null && v !== "" && !Number.isNaN(Number(v))) {
+        out[k.slice(0, -"_micros".length)] = Math.round(Number(v) / 1e4) / 100;
+      } else {
+        out[k] = humanizeMicros(v);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+var schema8 = z11.object({
+  resource: z11.string().describe("Reporting resource to query, e.g. campaign, ad_group, keyword_view, search_term_view. Performance resources only, user-access, change-history, and billing resources are blocked."),
+  fields: z11.array(z11.string()).min(1).describe('Fully-qualified fields to select, e.g. ["campaign.name","metrics.clicks","segments.date"]. Call metadata first.'),
+  conditions: z11.array(z11.string()).optional().describe('WHERE clauses joined by AND, e.g. ["segments.date DURING LAST_30_DAYS","metrics.clicks > 100"].'),
+  orderings: z11.array(z11.string()).optional().describe('ORDER BY entries, e.g. ["metrics.cost_micros DESC"].'),
+  limit: z11.number().int().min(1).max(2e3).optional().describe("Max rows to fetch (default 200)."),
+  cursor: z11.string().optional().describe("Continuation token from a previous page (served from cache, no new Google call).")
+});
+var gaqlHandler = {
+  action: "gaql",
+  summary: "Run a CUSTOM report by building a GAQL query from structured pieces (resource, fields, conditions, orderings, limit). Use for anything the curated reports do not cover (daily/weekly trends via segments.date, keyword / search-term / asset-group views). Call metadata first to learn valid fields.",
+  readOnly: true,
+  category: "report",
+  schema: schema8,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Report: custom GAQL (page)" });
+    const creds = await requireConnection(ctx);
+    const limit = params.limit ?? 200;
+    const gaql = buildGaql({ ...params, limit: void 0 });
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, limit);
+    if (!rows.length) {
+      return { output: `No rows for:
+${gaql}`, auditSummary: `Report: custom GAQL (0 rows), ${gaql}`, customerId: creds.customerId };
+    }
+    const hasMicros = params.fields.some((f) => f.endsWith("_micros"));
+    const currency = hasMicros ? await ctx.ads.currencyCode(creds) : void 0;
+    const acct = `account ${formatCid(creds.customerId)}${currency ? ` \xB7 ${currency}` : ""}`;
+    const cap = truncated ? `, top ${limit}${total != null ? ` of ${int(total)}` : ""}` : "";
+    const moneyNote = hasMicros ? currency ? ` (amounts in ${currency}, converted from micros)` : " (amounts converted from micros)" : "";
+    return paginate({
+      ctx,
+      title: `Custom report (${acct})${cap}${moneyNote}
+${gaql}`,
+      rows: rows.map((r) => JSON.stringify(humanizeMicros(r))),
+      summary: `Report: custom GAQL, ${gaql}`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/report/metadata.ts
+import { z as z12 } from "zod";
+var RESOURCE2 = /^[a-z][a-z0-9_]*$/;
+var schema9 = z12.object({
+  resource: z12.string().describe("Resource to introspect, e.g. campaign, ad_group, keyword_view, search_term_view.")
+});
+var metadataHandler = {
+  action: "metadata",
+  summary: "Discover the valid fields for a resource before writing a gaql query: selectable / filterable / sortable fields plus compatible metrics and segments. Do not guess field names, look them up here.",
+  readOnly: true,
+  category: "report",
+  schema: schema9,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const resource = params.resource.trim().toLowerCase();
+    if (!RESOURCE2.test(resource)) {
+      throw new Error(`Invalid resource "${params.resource}". Use a single resource name like campaign or ad_group.`);
+    }
+    const [attrs, nodeRows] = await Promise.all([
+      ctx.ads.searchFields(creds, `name LIKE '${resource}.%'`),
+      ctx.ads.searchFields(creds, `name = '${resource}'`)
+    ]);
+    if (!attrs.length && !nodeRows.length) {
+      return { output: `No field metadata found for resource "${resource}". Check the resource name.`, auditSummary: `Metadata: ${resource} (none)`, customerId: creds.customerId };
+    }
+    const names = (pred) => attrs.filter(pred).map((f) => f.name).sort();
+    const node = nodeRows[0];
+    const block = (label, items) => `${label} (${items.length}):
+  ${items.length ? items.join(", ") : "(none)"}`;
+    return {
+      output: [
+        `Fields for "${resource}" (use these exact names in a gaql query):`,
+        block("Selectable", names((f) => Boolean(f.selectable))),
+        block("Filterable", names((f) => Boolean(f.filterable))),
+        block("Sortable", names((f) => Boolean(f.sortable))),
+        block("Compatible metrics", (node?.metrics ?? []).slice().sort()),
+        block("Compatible segments", (node?.segments ?? []).slice().sort())
+      ].join("\n\n"),
+      auditSummary: `Metadata: ${resource}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/orchestrators/report.ts
+var reportTool = defineOrchestrator({
+  name: "google_ads_report",
+  purpose: "Read Google Ads performance. Prefer a curated action: campaign_performance for any channel, impression_share for Search visibility (the Average Position replacement), or asset_group for Performance Max. For anything else, daily or weekly trends, keyword or search-term views, custom field combinations, use gaql after calling metadata first.",
+  limitations: "Read-only. ROAS is computed as conversion value divided by cost. Average Position does not exist; use action impression_share instead. impression_share only applies to Search campaigns; asset_group only applies to Performance Max. Curated reports already format values, but in raw gaql results, money fields are in micros (divide by 1,000,000) and rates (metrics.ctr, conversion rate, impression share) are ratios from 0 to 1. For gaql, do not guess field names: call metadata first to get the exact selectable, filterable, and sortable fields plus compatible metrics and segments, then use those names verbatim.",
+  examples: [
+    '{"action":"campaign_performance","date_range":"LAST_30_DAYS"}',
+    '{"action":"campaign_performance","date_range":"LAST_MONTH","compare_previous":true,"channel_type":"PERFORMANCE_MAX"}',
+    '{"action":"impression_share","date_range":"LAST_30_DAYS"}',
+    '{"action":"asset_group","campaign_id":"1234567890","date_range":"LAST_30_DAYS"}',
+    '{"action":"metadata","resource":"keyword_view"}',
+    '{"action":"gaql","resource":"keyword_view","fields":["ad_group_criterion.keyword.text","metrics.clicks","segments.date"],"conditions":["segments.date DURING LAST_7_DAYS"]}'
+  ],
+  handlers: [performanceHandler, impressionShareHandler, assetGroupHandler, gaqlHandler, metadataHandler]
+});
+
+// src/tools/handlers/campaign/create.ts
+import { z as z13 } from "zod";
+import { enums as enums3, toMicros as toMicros2, ResourceNames } from "google-ads-api";
+
+// src/tools/handlers/campaign/helpers.ts
+import { toMicros } from "google-ads-api";
+var BIDDING = ["MANUAL_CPC", "MAXIMIZE_CONVERSIONS", "MAXIMIZE_CONVERSION_VALUE", "TARGET_CPA", "TARGET_ROAS"];
+function biddingFields(strategy, targetCpa, targetRoas, forUpdate = false) {
+  switch (strategy) {
+    case "MANUAL_CPC":
+      return { manual_cpc: { enhanced_cpc_enabled: false } };
+    case "MAXIMIZE_CONVERSIONS":
+      return { maximize_conversions: targetCpa != null ? { target_cpa_micros: toMicros(targetCpa) } : forUpdate ? { target_cpa_micros: 0 } : {} };
+    case "MAXIMIZE_CONVERSION_VALUE":
+      return { maximize_conversion_value: targetRoas != null ? { target_roas: targetRoas } : forUpdate ? { target_roas: 0 } : {} };
+    case "TARGET_CPA":
+      return { target_cpa: { target_cpa_micros: toMicros(targetCpa ?? 0) } };
+    case "TARGET_ROAS":
+      return { target_roas: { target_roas: targetRoas ?? 0 } };
+  }
+}
+var LANG_IDS = {
+  english: "1000",
+  en: "1000",
+  german: "1001",
+  french: "1002",
+  spanish: "1003",
+  italian: "1004",
+  japanese: "1005",
+  ja: "1005",
+  dutch: "1010",
+  portuguese: "1014",
+  swedish: "1015",
+  korean: "1012",
+  ko: "1012",
+  chinese: "1017",
+  "chinese (simplified)": "1017",
+  "chinese (traditional)": "1018",
+  arabic: "1019",
+  russian: "1031"
+};
+function geoId(s) {
+  if (/^\d+$/.test(s)) return s;
+  throw new Error(`Location "${s}" must be a numeric geo target constant id. Resolve the name to an id with google_ads_lookup (action location) first, then pass the id.`);
+}
+function langId(s) {
+  if (/^\d+$/.test(s)) return s;
+  const id = LANG_IDS[s.toLowerCase()];
+  if (!id) throw new Error(`Unknown language "${s}". Resolve it with google_ads_lookup (action language), or pass a numeric language constant id.`);
+  return id;
+}
+
+// src/tools/handlers/campaign/create.ts
+var schema10 = z13.object({
+  name: z13.string().min(1).max(255),
+  channel_type: z13.enum(["SEARCH", "PERFORMANCE_MAX", "DISPLAY", "DEMAND_GEN", "VIDEO", "APP", "SHOPPING"]),
+  daily_budget: z13.number().positive().describe("Daily amount in account currency (e.g. 50 = 50.00/day)"),
+  bidding: z13.enum(BIDDING).default("MAXIMIZE_CONVERSIONS"),
+  target_cpa: z13.number().positive().optional().describe("Target CPA in account currency (TARGET_CPA / MAXIMIZE_CONVERSIONS)"),
+  target_roas: z13.number().positive().optional().describe("Target ROAS as a ratio, e.g. 4 = 400% (TARGET_ROAS / MAXIMIZE_CONVERSION_VALUE)"),
+  app_id: z13.string().optional().describe("APP only: the app id (Android package name like com.example.app, or the numeric iOS App Store id)."),
+  app_store: z13.enum(["GOOGLE_APP_STORE", "APPLE_APP_STORE"]).optional().describe("APP only: which store the app is in."),
+  merchant_id: z13.string().regex(/^\d+$/).optional().describe("SHOPPING only: the linked Merchant Center account id; products come from its feed."),
+  brand_guidelines_enabled: z13.boolean().optional().describe("PERFORMANCE_MAX only. ON requires a business name + square logo (added in the UI); OFF creates without brand assets. Ask the user, do not assume."),
+  contains_eu_political_advertising: z13.boolean().default(false).describe("Google-required EU political-ads disclosure. Almost always false; set true only if this campaign runs EU political advertising."),
+  ...confirmFields
+});
+var createHandler = {
+  action: "create",
+  summary: "Create a campaign plus its daily budget, atomically. channel_type: SEARCH, DISPLAY, DEMAND_GEN, VIDEO, PERFORMANCE_MAX, APP (needs app_id + app_store, TARGET_CPA bidding), or SHOPPING (needs merchant_id from a linked Merchant Center). Created PAUSED. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema10,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    if (params.channel_type === "PERFORMANCE_MAX" && params.brand_guidelines_enabled === void 0) {
+      return {
+        output: `Before I create the P-MAX campaign "${params.name}", one choice I will not assume:
+
+Brand Guidelines, ON or OFF?
+\u2022 OFF: I create it now; no brand assets needed.
+\u2022 ON: Google requires a business name + a square logo linked to the campaign. Those have to be added in the Google Ads UI, so the API create fails until they exist.
+
+Ask the user, then call create again with brand_guidelines_enabled set to true or false.`,
+        auditSummary: `Wizard: brand-guidelines choice for "${params.name}"`,
+        customerId: creds.customerId
+      };
+    }
+    if (params.channel_type === "PERFORMANCE_MAX" && params.bidding !== "MAXIMIZE_CONVERSIONS" && params.bidding !== "MAXIMIZE_CONVERSION_VALUE") {
+      throw new Error("Performance Max requires MAXIMIZE_CONVERSIONS or MAXIMIZE_CONVERSION_VALUE bidding.");
+    }
+    if (params.channel_type === "DEMAND_GEN" && params.bidding === "MANUAL_CPC") {
+      throw new Error("Demand Gen requires automated bidding (not MANUAL_CPC): use MAXIMIZE_CONVERSIONS, TARGET_CPA, MAXIMIZE_CONVERSION_VALUE, or TARGET_ROAS.");
+    }
+    if (params.channel_type === "VIDEO" && params.bidding !== "MAXIMIZE_CONVERSIONS" && params.bidding !== "TARGET_CPA") {
+      throw new Error("A Video Action campaign requires automated bidding (MAXIMIZE_CONVERSIONS or TARGET_CPA), not MANUAL_CPC.");
+    }
+    if (params.channel_type === "APP") {
+      if (!params.app_id) throw new Error("app_id is required for an App campaign (the Android package name or numeric iOS App Store id).");
+      if (!params.app_store) throw new Error("app_store is required for an App campaign (GOOGLE_APP_STORE or APPLE_APP_STORE).");
+      if (params.bidding !== "TARGET_CPA") throw new Error("An App campaign requires TARGET_CPA bidding (target_cpa = your target cost per install).");
+    }
+    if (params.channel_type === "SHOPPING" && !params.merchant_id) {
+      throw new Error("merchant_id is required for a Shopping campaign: its products come from a linked Merchant Center account. Link Merchant Center to this Google Ads account first, then pass its id.");
+    }
+    if (params.bidding === "TARGET_CPA" && params.target_cpa == null) throw new Error("target_cpa is required for TARGET_CPA bidding.");
+    if (params.bidding === "TARGET_ROAS" && params.target_roas == null) throw new Error("target_roas is required for TARGET_ROAS bidding.");
+    const channelTypeOf = {
+      SEARCH: enums3.AdvertisingChannelType.SEARCH,
+      DISPLAY: enums3.AdvertisingChannelType.DISPLAY,
+      DEMAND_GEN: enums3.AdvertisingChannelType.DEMAND_GEN,
+      VIDEO: enums3.AdvertisingChannelType.VIDEO,
+      PERFORMANCE_MAX: enums3.AdvertisingChannelType.PERFORMANCE_MAX,
+      SHOPPING: enums3.AdvertisingChannelType.SHOPPING,
+      APP: enums3.AdvertisingChannelType.MULTI_CHANNEL
+    };
+    const budgetRN = ResourceNames.campaignBudget(creds.customerId, "-1");
+    const campaign = {
+      name: params.name,
+      advertising_channel_type: channelTypeOf[params.channel_type],
+      status: enums3.CampaignStatus.PAUSED,
+      // never auto-launch spend
+      campaign_budget: budgetRN,
+      // Google requires this disclosure on every create (omitting it is a field_error).
+      contains_eu_political_advertising: params.contains_eu_political_advertising ? enums3.EuPoliticalAdvertisingStatus.CONTAINS_EU_POLITICAL_ADVERTISING : enums3.EuPoliticalAdvertisingStatus.DOES_NOT_CONTAIN_EU_POLITICAL_ADVERTISING,
+      ...biddingFields(params.bidding, params.target_cpa, params.target_roas)
+    };
+    if (params.channel_type === "SEARCH") {
+      campaign.network_settings = { target_google_search: true, target_search_network: true };
+    } else if (params.channel_type === "DISPLAY") {
+      campaign.network_settings = { target_content_network: true };
+    } else if (params.channel_type === "VIDEO") {
+      campaign.advertising_channel_sub_type = enums3.AdvertisingChannelSubType.VIDEO_ACTION;
+    } else if (params.channel_type === "APP") {
+      campaign.advertising_channel_sub_type = enums3.AdvertisingChannelSubType.APP_CAMPAIGN;
+      campaign.app_campaign_setting = {
+        app_id: params.app_id,
+        app_store: enums3.AppCampaignAppStore[params.app_store],
+        bidding_strategy_goal_type: enums3.AppCampaignBiddingStrategyGoalType.OPTIMIZE_INSTALLS_TARGET_INSTALL_COST
+      };
+    } else if (params.channel_type === "SHOPPING") {
+      campaign.shopping_setting = { merchant_id: Number(params.merchant_id) };
+    } else if (params.channel_type === "PERFORMANCE_MAX") {
+      campaign.brand_guidelines_enabled = params.brand_guidelines_enabled;
+    }
+    const operations = [
+      {
+        entity: "campaign_budget",
+        operation: "create",
+        resource: { resource_name: budgetRN, name: `${params.name} Budget`, delivery_method: enums3.BudgetDeliveryMethod.STANDARD, amount_micros: toMicros2(params.daily_budget), explicitly_shared: false }
+      },
+      { entity: "campaign", operation: "create", resource: campaign }
+    ];
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.mutateResources(operations, { validate_only: true });
+      const euDecl = params.contains_eu_political_advertising ? "this campaign CONTAINS EU political advertising" : "this campaign does NOT contain EU political advertising";
+      return {
+        output: preview(
+          `create a ${params.channel_type} campaign "${params.name}" with a ${params.daily_budget}/day budget and ${params.bidding} bidding (created PAUSED).
+
+\u2696\uFE0F LEGAL DECLARATION submitted to Google on the user's behalf: ${euDecl} (contains_eu_political_advertising=${params.contains_eu_political_advertising}). Show ALL of these values to the user and get their explicit OK (change any they did not ask for). If the campaign runs EU political ads, set contains_eu_political_advertising=true before confirming.`,
+          { name: params.name, channel_type: params.channel_type, daily_budget: params.daily_budget, bidding: params.bidding, contains_eu_political_advertising: params.contains_eu_political_advertising }
+        ),
+        auditSummary: `Preview: create ${params.channel_type} campaign "${params.name}"`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    const result = await customer.mutateResources(operations);
+    const id = createdId(result, "campaign_result");
+    const nextByChannel = {
+      PERFORMANCE_MAX: "\nNext: add an asset group before enabling, a P-MAX campaign needs assets to serve.",
+      DISPLAY: "\nNext: add an ad group, then a responsive display ad (add_ad ad_type RESPONSIVE_DISPLAY_AD) or an HTML5 ad, then enable the campaign.",
+      DEMAND_GEN: "\nNext: add an ad group, then a Demand Gen ad (add_ad ad_type DEMAND_GEN_MULTI_ASSET), then enable the campaign.",
+      VIDEO: "\nNext: add an ad group, then a responsive video ad (add_ad ad_type VIDEO_RESPONSIVE with a YouTube video), then enable the campaign.",
+      APP: "\nNext: App campaigns auto-create an ad group, find it with ad_group list_ads (or a report), add an app ad (add_ad ad_type APP), then enable the campaign.",
+      SHOPPING: "\nNext: add an ad group, then a product ad (add_ad ad_type SHOPPING_PRODUCT). Products serve from the linked Merchant Center feed, make sure Merchant Center is linked.",
+      SEARCH: "\nNext: add an ad group and a responsive search ad, then enable the campaign."
+    };
+    const next = nextByChannel[params.channel_type] ?? nextByChannel.SEARCH;
+    return {
+      output: `\u2705 Created ${params.channel_type} campaign "${params.name}"${id ? ` (id ${id})` : ""}, PAUSED, ${params.daily_budget}/day, ${params.bidding} bidding.` + next,
+      auditSummary: `Created ${params.channel_type} campaign "${params.name}"${id ? ` (${id})` : ""}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/campaign/update.ts
+import { z as z14 } from "zod";
+var DATE = /^\d{4}-\d{2}-\d{2}$/;
+var schema11 = z14.object({
+  campaign_id: ID,
+  name: z14.string().min(1).max(255).optional(),
+  start_date: z14.string().regex(DATE, "must be YYYY-MM-DD").optional(),
+  end_date: z14.string().regex(DATE, "must be YYYY-MM-DD").optional(),
+  search_network: z14.boolean().optional().describe("Search campaigns only: include Google search partners"),
+  content_network: z14.boolean().optional().describe("Search campaigns only: include the Display Network (search with display expansion)"),
+  ...confirmFields
+});
+var updateHandler = {
+  action: "update",
+  summary: "Edit a campaign in place: rename, change start/end dates (YYYY-MM-DD), or toggle search-partner / display-network settings (Search campaigns only). Requires campaign_id and at least one field. In-place update, not delete-and-recreate. For pause/resume use action status, for budget use budget, for bidding use bidding. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema11,
+  async execute(params, ctx) {
+    const hasNetwork = params.search_network != null || params.content_network != null;
+    if (params.name == null && params.start_date == null && params.end_date == null && !hasNetwork) {
+      throw new Error("Provide at least one of name, start_date, end_date, search_network, content_network.");
+    }
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const resource = { resource_name: `customers/${creds.customerId}/campaigns/${params.campaign_id}` };
+    if (params.name != null) resource.name = params.name;
+    if (params.start_date != null) resource.start_date = params.start_date;
+    if (params.end_date != null) resource.end_date = params.end_date;
+    if (hasNetwork) {
+      const ns = {};
+      if (params.search_network != null) ns.target_search_network = params.search_network;
+      if (params.content_network != null) ns.target_content_network = params.content_network;
+      resource.network_settings = ns;
+    }
+    const changes = [
+      params.name != null ? `name\u2192${params.name}` : "",
+      params.start_date != null ? `start\u2192${params.start_date}` : "",
+      params.end_date != null ? `end\u2192${params.end_date}` : "",
+      params.search_network != null ? `search_network\u2192${params.search_network}` : "",
+      params.content_network != null ? `content_network\u2192${params.content_network}` : ""
+    ].filter(Boolean).join(", ");
+    const ops = [{ entity: "campaign", operation: "update", resource }];
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`update campaign ${params.campaign_id} (${changes})`, {
+          campaign_id: params.campaign_id,
+          ...params.name != null ? { name: params.name } : {},
+          ...params.start_date != null ? { start_date: params.start_date } : {},
+          ...params.end_date != null ? { end_date: params.end_date } : {},
+          ...params.search_network != null ? { search_network: params.search_network } : {},
+          ...params.content_network != null ? { content_network: params.content_network } : {},
+          confirmed: true
+        }),
+        auditSummary: `Preview: update campaign ${params.campaign_id} (${changes})`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: `\u2705 Updated campaign ${params.campaign_id} (${changes}).`,
+      auditSummary: `Updated campaign ${params.campaign_id} (${changes})`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/campaign/status.ts
+import { z as z15 } from "zod";
+import { enums as enums4 } from "google-ads-api";
+var schema12 = z15.object({
+  campaign_id: ID,
+  status: z15.enum(["ENABLED", "PAUSED", "REMOVED"]),
+  ...confirmFields
+});
+var statusHandler2 = {
+  action: "status",
+  summary: "Pause, resume (ENABLED), or delete (REMOVED) a campaign. Requires campaign_id + status (ENABLED|PAUSED|REMOVED). REMOVED is permanent and cannot be undone. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema12,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const rn = `customers/${creds.customerId}/campaigns/${params.campaign_id}`;
+    const isRemove = params.status === "REMOVED";
+    const identity = { campaign_id: params.campaign_id, status: params.status };
+    const updateOp = [{ resource_name: rn, status: enums4.CampaignStatus[params.status] }];
+    if (!params.confirmed && (!isRemove || userConfirmationRequired())) {
+      if (isRemove) await customer.campaigns.remove([rn], { validate_only: true });
+      else await customer.campaigns.update(updateOp, { validate_only: true });
+      const output = isRemove ? previewRemove(`campaign ${params.campaign_id} (deletes the campaign permanently)`, identity) : preview(`set campaign ${params.campaign_id} to ${params.status}`, identity);
+      return {
+        output,
+        auditSummary: `Preview: ${params.status} campaign ${params.campaign_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    if (isRemove) {
+      await customer.campaigns.remove([rn]);
+      return { output: `\u2705 Campaign ${params.campaign_id} removed (permanently deleted).`, auditSummary: `REMOVED campaign ${params.campaign_id}`, customerId: creds.customerId };
+    }
+    await customer.campaigns.update(updateOp);
+    return {
+      output: `\u2705 Campaign ${params.campaign_id} is now ${params.status}.`,
+      auditSummary: `${params.status} campaign ${params.campaign_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/campaign/budget.ts
+import { z as z16 } from "zod";
+import { toMicros as toMicros3 } from "google-ads-api";
+var schema13 = z16.object({
+  campaign_id: ID,
+  daily_budget: z16.number().positive().describe("New daily amount in account currency (not micros)"),
+  ...confirmFields
+});
+var budgetHandler = {
+  action: "budget",
+  summary: "Change a campaign's daily budget (account currency). Requires campaign_id + daily_budget. Shows before/after and warns on shared budgets. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema13,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const rows = await ctx.ads.query(
+      creds,
+      `SELECT campaign.id, campaign_budget.resource_name, campaign_budget.amount_micros, campaign_budget.explicitly_shared, campaign_budget.reference_count FROM campaign WHERE campaign.id = ${params.campaign_id} LIMIT 1`
+    );
+    if (!rows.length) throw new Error(`Campaign ${params.campaign_id} not found in the connected account.`);
+    const cb = rows[0].campaign_budget;
+    const budgetResource = cb.resource_name;
+    const currentMicros = Number(cb.amount_micros ?? 0);
+    const newMicros = toMicros3(params.daily_budget);
+    const refCount = Number(cb.reference_count ?? 1);
+    const sharedWarn = cb.explicitly_shared || refCount > 1 ? `
+\u26A0\uFE0F This budget is SHARED by ${refCount} campaign(s). This change affects all of them, not just ${params.campaign_id}.` : "";
+    const op = [{ resource_name: budgetResource, amount_micros: newMicros }];
+    if (!params.confirmed) {
+      await customer.campaignBudgets.update(op, { validate_only: true });
+      return {
+        output: preview(`change the daily budget of campaign ${params.campaign_id} from ${money(currentMicros)} to ${money(newMicros)}`, {
+          campaign_id: params.campaign_id,
+          daily_budget: params.daily_budget,
+          confirmed: true
+        }) + sharedWarn,
+        auditSummary: `Preview: budget campaign ${params.campaign_id} ${money(currentMicros)}\u2192${money(newMicros)}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.campaignBudgets.update(op);
+    return {
+      output: `\u2705 Daily budget for campaign ${params.campaign_id} set to ${money(newMicros)} (was ${money(currentMicros)}).${sharedWarn}`,
+      auditSummary: `Set budget campaign ${params.campaign_id} \u2192 ${money(newMicros)}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/campaign/bidding.ts
+import { z as z17 } from "zod";
+import { ResourceNames as ResourceNames2 } from "google-ads-api";
+var schema14 = z17.object({
+  campaign_id: ID,
+  strategy: z17.enum(BIDDING),
+  target_cpa: z17.number().positive().optional(),
+  target_roas: z17.number().positive().optional(),
+  ...confirmFields
+});
+var biddingHandler = {
+  action: "bidding",
+  summary: "Change a campaign's bidding strategy (MANUAL_CPC, MAXIMIZE_CONVERSIONS, MAXIMIZE_CONVERSION_VALUE, TARGET_CPA, TARGET_ROAS). Provide target_cpa/target_roas for the matching strategy. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema14,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    if (params.strategy === "TARGET_CPA" && params.target_cpa == null) throw new Error("target_cpa is required for TARGET_CPA.");
+    if (params.strategy === "TARGET_ROAS" && params.target_roas == null) throw new Error("target_roas is required for TARGET_ROAS.");
+    const op = [
+      {
+        resource_name: ResourceNames2.campaign(creds.customerId, params.campaign_id),
+        ...biddingFields(params.strategy, params.target_cpa, params.target_roas, true)
+      }
+    ];
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.campaigns.update(op, { validate_only: true });
+      return {
+        output: preview(`change campaign ${params.campaign_id} bidding to ${params.strategy}`, { campaign_id: params.campaign_id, strategy: params.strategy, confirmed: true }),
+        auditSummary: `Preview: bidding ${params.strategy} on campaign ${params.campaign_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.campaigns.update(op);
+    return {
+      output: `\u2705 Campaign ${params.campaign_id} bidding set to ${params.strategy}.`,
+      auditSummary: `Set bidding ${params.strategy} on campaign ${params.campaign_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/campaign/targeting.ts
+import { z as z18 } from "zod";
+import { enums as enums5, ResourceNames as ResourceNames3 } from "google-ads-api";
+var schema15 = z18.object({
+  campaign_id: ID,
+  locations: z18.array(z18.string()).optional().describe("Numeric geo target constant ids. Resolve a name first with google_ads_lookup (action location)."),
+  languages: z18.array(z18.string()).optional().describe("Numeric language constant ids (common names also accepted). Resolve a name with google_ads_lookup (action language)."),
+  ad_schedule: z18.array(
+    z18.object({
+      day: z18.enum(["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]),
+      start_hour: z18.number().int().min(0).max(23),
+      end_hour: z18.number().int().min(1).max(24)
+    })
+  ).optional().describe("Hours ads may run, per day"),
+  ...confirmFields
+});
+var targetingHandler = {
+  action: "targeting",
+  summary: "Add targeting to a campaign: locations (numeric geo ids), languages (names or ids), and/or ad_schedule (hours). Provide at least one. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema15,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    if (!params.locations?.length && !params.languages?.length && !params.ad_schedule?.length) {
+      throw new Error("Provide at least one of locations, languages, or ad_schedule.");
+    }
+    const campaignRN = ResourceNames3.campaign(creds.customerId, params.campaign_id);
+    const ops = [];
+    for (const loc of params.locations ?? []) {
+      ops.push({ entity: "campaign_criterion", operation: "create", resource: { campaign: campaignRN, location: { geo_target_constant: ResourceNames3.geoTargetConstant(geoId(loc)) } } });
+    }
+    for (const lang of params.languages ?? []) {
+      ops.push({ entity: "campaign_criterion", operation: "create", resource: { campaign: campaignRN, language: { language_constant: ResourceNames3.languageConstant(langId(lang)) } } });
+    }
+    for (const s of params.ad_schedule ?? []) {
+      if (s.end_hour <= s.start_hour) {
+        throw new Error(`ad_schedule for ${s.day}: end_hour (${s.end_hour}) must be greater than start_hour (${s.start_hour}).`);
+      }
+      ops.push({
+        entity: "campaign_criterion",
+        operation: "create",
+        resource: { campaign: campaignRN, ad_schedule: { day_of_week: enums5.DayOfWeek[s.day], start_hour: s.start_hour, start_minute: enums5.MinuteOfHour.ZERO, end_hour: s.end_hour, end_minute: enums5.MinuteOfHour.ZERO } }
+      });
+    }
+    const parts = [];
+    if (params.locations?.length) parts.push(`${params.locations.length} location(s)`);
+    if (params.languages?.length) parts.push(`${params.languages.length} language(s)`);
+    if (params.ad_schedule?.length) parts.push(`${params.ad_schedule.length} schedule(s)`);
+    const what = parts.join(", ");
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`add ${what} targeting to campaign ${params.campaign_id}`, { campaign_id: params.campaign_id, confirmed: true }),
+        auditSummary: `Preview: targeting (${what}) on campaign ${params.campaign_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: `\u2705 Added ${what} targeting to campaign ${params.campaign_id}.`,
+      auditSummary: `Targeting (${what}) on campaign ${params.campaign_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/orchestrators/campaign.ts
+var campaignTool = defineOrchestrator({
+  name: "google_ads_campaign",
+  purpose: "Create and manage campaigns. create builds a new one for Search, Display, Demand Gen, App, Shopping, or Performance Max (for YouTube, use DEMAND_GEN, not VIDEO). update renames it or changes its dates and network settings. status pauses or resumes it. budget sets the daily budget. bidding sets the bidding strategy. targeting sets location, language, and schedule.",
+  limitations: "Every write previews first; then the user must type yes or ok in chat before confirmed:true + user_confirmation. New campaigns are created PAUSED. All edits here are in-place updates, not delete-and-recreate. Use the right action: update for name, dates, and networks; status for pause or resume; budget for the daily budget; bidding for the strategy; targeting for locations, languages, and schedule. Get campaign_id from report. Performance Max, Demand Gen, and Video all require automated bidding. App needs app_id, app_store, and TARGET_CPA bidding. Shopping needs a merchant_id from a linked Merchant Center account. VIDEO campaigns can no longer be created through the API (Google sunset Video Action campaigns for Demand Gen), so use DEMAND_GEN for YouTube instead. Location and language are numeric ids, so resolve names with google_ads_lookup first.",
+  examples: [
+    '{"action":"create","name":"Brand - Search","channel_type":"SEARCH","daily_budget":50,"bidding":"MAXIMIZE_CONVERSIONS"}',
+    '{"action":"create","name":"App - Installs","channel_type":"APP","daily_budget":50,"bidding":"TARGET_CPA","target_cpa":3,"app_id":"com.example.app","app_store":"GOOGLE_APP_STORE"}',
+    '{"action":"create","name":"Shopping - All Products","channel_type":"SHOPPING","daily_budget":50,"bidding":"MANUAL_CPC","merchant_id":"1234567"}',
+    '{"action":"update","campaign_id":"123","name":"Brand 2026","end_date":"2026-12-31","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"status","campaign_id":"123","status":"PAUSED","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"budget","campaign_id":"123","daily_budget":75,"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"bidding","campaign_id":"123","strategy":"TARGET_ROAS","target_roas":4,"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"targeting","campaign_id":"123","locations":["2392"],"languages":["1005"],"confirmed":true,"user_confirmation":"yes"}'
+  ],
+  handlers: [createHandler, updateHandler, statusHandler2, budgetHandler, biddingHandler, targetingHandler]
+});
+
+// src/tools/handlers/adGroup/create.ts
+import { z as z19 } from "zod";
+import { enums as enums6, toMicros as toMicros4, ResourceNames as ResourceNames4 } from "google-ads-api";
+var schema16 = z19.object({
+  campaign_id: ID,
+  name: z19.string().min(1).max(255),
+  cpc_bid: z19.number().positive().optional().describe("Default max CPC in account currency (manual bidding only)"),
+  ...confirmFields
+});
+var createHandler2 = {
+  action: "create",
+  summary: "Create an ad group inside a Search/Display campaign. Requires campaign_id + name. Not for Performance Max. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema16,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const rows = await ctx.ads.query(creds, `SELECT campaign.advertising_channel_type FROM campaign WHERE campaign.id = ${params.campaign_id} LIMIT 1`);
+    const channel = rows[0]?.campaign?.advertising_channel_type;
+    if (channel === enums6.AdvertisingChannelType.PERFORMANCE_MAX) {
+      throw new Error("Performance Max campaigns use asset groups, not ad groups, use the pmax tool (create_asset_group).");
+    }
+    const typeByChannel = {
+      [enums6.AdvertisingChannelType.SEARCH]: enums6.AdGroupType.SEARCH_STANDARD,
+      [enums6.AdvertisingChannelType.DISPLAY]: enums6.AdGroupType.DISPLAY_STANDARD,
+      [enums6.AdvertisingChannelType.SHOPPING]: enums6.AdGroupType.SHOPPING_PRODUCT_ADS,
+      [enums6.AdvertisingChannelType.VIDEO]: enums6.AdGroupType.VIDEO_RESPONSIVE
+    };
+    const resource = {
+      name: params.name,
+      campaign: ResourceNames4.campaign(creds.customerId, params.campaign_id),
+      status: enums6.AdGroupStatus.ENABLED
+    };
+    if (channel != null && typeByChannel[channel] != null) resource.type = typeByChannel[channel];
+    if (params.cpc_bid != null) resource.cpc_bid_micros = toMicros4(params.cpc_bid);
+    const customer = ctx.ads.customer(creds);
+    const ops = [{ entity: "ad_group", operation: "create", resource }];
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`create ad group "${params.name}" in campaign ${params.campaign_id}`, { campaign_id: params.campaign_id, name: params.name, ...params.cpc_bid != null ? { cpc_bid: params.cpc_bid } : {} }),
+        auditSummary: `Preview: create ad group "${params.name}"`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    const result = await customer.mutateResources(ops);
+    const id = createdId(result, "ad_group_result");
+    return {
+      output: `\u2705 Created ad group "${params.name}"${id ? ` (id ${id})` : ""} in campaign ${params.campaign_id}.`,
+      auditSummary: `Created ad group "${params.name}"${id ? ` (${id})` : ""}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/adGroup/update.ts
+import { z as z20 } from "zod";
+import { toMicros as toMicros5 } from "google-ads-api";
+var schema17 = z20.object({
+  ad_group_id: ID,
+  name: z20.string().min(1).max(255).optional(),
+  cpc_bid: z20.number().positive().optional().describe("Default max CPC in account currency (manual bidding only)"),
+  ...confirmFields
+});
+var updateHandler2 = {
+  action: "update",
+  summary: "Edit an ad group's name and/or default max CPC. Requires ad_group_id and at least one of name, cpc_bid. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema17,
+  async execute(params, ctx) {
+    if (params.name == null && params.cpc_bid == null) throw new Error("Provide name and/or cpc_bid to change.");
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const resource = { resource_name: `customers/${creds.customerId}/adGroups/${params.ad_group_id}` };
+    if (params.name != null) resource.name = params.name;
+    if (params.cpc_bid != null) resource.cpc_bid_micros = toMicros5(params.cpc_bid);
+    const changes = [params.name != null ? `name\u2192${params.name}` : "", params.cpc_bid != null ? `bid\u2192${params.cpc_bid}` : ""].filter(Boolean).join(", ");
+    const ops = [{ entity: "ad_group", operation: "update", resource }];
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`update ad group ${params.ad_group_id} (${changes})`, {
+          ad_group_id: params.ad_group_id,
+          ...params.name != null ? { name: params.name } : {},
+          ...params.cpc_bid != null ? { cpc_bid: params.cpc_bid } : {},
+          confirmed: true
+        }),
+        auditSummary: `Preview: update ad group ${params.ad_group_id} (${changes})`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: `\u2705 Updated ad group ${params.ad_group_id} (${changes}).`,
+      auditSummary: `Updated ad group ${params.ad_group_id} (${changes})`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/adGroup/status.ts
+import { z as z21 } from "zod";
+import { enums as enums7 } from "google-ads-api";
+var schema18 = z21.object({
+  ad_group_id: ID,
+  status: z21.enum(["ENABLED", "PAUSED", "REMOVED"]),
+  ...confirmFields
+});
+var statusHandler3 = {
+  action: "status",
+  summary: "Pause, resume, or remove an ad group. Requires ad_group_id + status (ENABLED|PAUSED|REMOVED). REMOVED deletes the ad group. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema18,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const rn = `customers/${creds.customerId}/adGroups/${params.ad_group_id}`;
+    const isRemove = params.status === "REMOVED";
+    const ops = isRemove ? [{ entity: "ad_group", operation: "remove", resource: rn }] : [{ entity: "ad_group", operation: "update", resource: { resource_name: rn, status: enums7.AdGroupStatus[params.status] } }];
+    const identity = { ad_group_id: params.ad_group_id, status: params.status };
+    if (!params.confirmed && (!isRemove || userConfirmationRequired())) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: isRemove ? previewRemove(`ad group ${params.ad_group_id} and all of its ads and keywords`, identity) : preview(`set ad group ${params.ad_group_id} to ${params.status}`, identity),
+        auditSummary: `Preview: ${params.status} ad group ${params.ad_group_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: isRemove ? `\u2705 Removed ad group ${params.ad_group_id}.` : `\u2705 Ad group ${params.ad_group_id} is now ${params.status}.`,
+      auditSummary: `${params.status} ad group ${params.ad_group_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/adGroup/listAds.ts
+import { z as z22 } from "zod";
+import { enums as enums8 } from "google-ads-api";
+function adLine(r) {
+  const a = r.ad_group_ad;
+  const headline = a.ad?.responsive_search_ad?.headlines?.[0]?.text;
+  const label = headline ? `"${headline}..."` : a.ad?.name || "(no name)";
+  return `\u2022 ad ${a.ad?.id} ${label} | ${enumLabel(enums8.AdGroupAdStatus, a.status)} | type ${enumLabel(enums8.AdType, a.ad?.type)} | ag ${r.ad_group?.id}`;
+}
+var schema19 = z22.object({
+  ad_group_id: ID,
+  limit: z22.number().int().min(1).max(2e3).default(200),
+  cursor: z22.string().optional()
+});
+var listAdsHandler = {
+  action: "list_ads",
+  summary: "List the ads in an ad group with their ad id and status. Use it to get an ad id for ad_status. Requires ad_group_id. Paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema19,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Ads (page)" });
+    const creds = await requireConnection(ctx);
+    const gaql = `SELECT ad_group.id, ad_group_ad.ad.id, ad_group_ad.ad.name, ad_group_ad.ad.type, ad_group_ad.status, ad_group_ad.ad.responsive_search_ad.headlines FROM ad_group_ad WHERE ad_group.id = ${params.ad_group_id} ORDER BY ad_group_ad.ad.id`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    if (!rows.length) return { output: "No ads found in this ad group.", auditSummary: "Listed ads (0)", customerId: creds.customerId };
+    return paginate({
+      ctx,
+      title: `Ads (account ${formatCid(creds.customerId)}, ad group ${params.ad_group_id})${truncated ? ` - top ${params.limit}${total != null ? ` of ${int(total)}` : ""}` : ""}`,
+      rows: rows.map(adLine),
+      summary: `Listed ads (ad group ${params.ad_group_id})`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/adGroup/addAd.ts
+import { z as z23 } from "zod";
+import { ResourceNames as ResourceNames9 } from "google-ads-api";
+
+// src/tools/handlers/adGroup/ads/build.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { ResourceNames as ResourceNames5 } from "google-ads-api";
+
+// src/lib/fetchImage.ts
+import http from "http";
+import https from "https";
+import dns from "dns";
+import net from "net";
+var IMAGE_MAX_BYTES = 5 * 1024 * 1024;
+var BUNDLE_MAX_BYTES = 2 * 1024 * 1024;
+var TIMEOUT_MS = 1e4;
+function expandIpv6(ip) {
+  const [head, tail] = ip.split("::");
+  const h = head ? head.split(":") : [];
+  const t = tail !== void 0 ? tail ? tail.split(":") : [] : null;
+  let groups;
+  if (t === null) {
+    if (h.length !== 8) return null;
+    groups = h;
+  } else {
+    const missing = 8 - h.length - t.length;
+    if (missing < 0) return null;
+    groups = [...h, ...Array(missing).fill("0"), ...t];
+  }
+  return groups.map((g) => parseInt(g || "0", 16) & 65535);
+}
+function isPrivateIp(ip) {
+  if (net.isIPv4(ip)) {
+    const p2 = ip.split(".").map(Number);
+    const a = p2[0];
+    const b = p2[1];
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+  const lower = ip.toLowerCase().replace(/%.*$/, "");
+  if (lower.startsWith("::ffff:") && lower.includes(".")) return isPrivateIp(lower.slice("::ffff:".length));
+  const g = expandIpv6(lower);
+  if (!g) return lower === "::1" || lower === "::";
+  if (g.slice(0, 5).every((x) => x === 0) && (g[5] === 65535 || g[5] === 0)) {
+    return isPrivateIp(`${g[6] >>> 8}.${g[6] & 255}.${g[7] >>> 8}.${g[7] & 255}`);
+  }
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  return false;
+}
+function guardedLookup(hostname, options, cb) {
+  dns.lookup(hostname, { all: true, family: options.family, hints: options.hints }, (err, addrs) => {
+    if (err) return cb(err, "", 0);
+    for (const a of addrs) {
+      if (isPrivateIp(a.address)) return cb(new Error(`Refusing to fetch a private/internal address (${hostname}).`), "", 0);
+    }
+    const first = addrs[0];
+    if (!first) return cb(new Error(`Could not resolve ${hostname}`), "", 0);
+    cb(null, first.address, first.family);
+  });
+}
+function guardedFetch(rawUrl, spec) {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = new URL(rawUrl);
+    } catch {
+      return reject(new Error(`Invalid ${spec.what} URL: ${rawUrl}`));
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return reject(new Error(`${spec.what} URL must be http(s).`));
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (net.isIP(host) && isPrivateIp(host)) {
+      return reject(new Error(`Refusing to fetch a private/internal address (${host}).`));
+    }
+    const mod = url.protocol === "https:" ? https : http;
+    const req = mod.get(url, { lookup: guardedLookup, autoSelectFamily: false, timeout: TIMEOUT_MS }, (res) => {
+      const status = res.statusCode ?? 0;
+      if (status >= 300 && status < 400) {
+        res.destroy();
+        return reject(new Error(`Refusing redirect (${status}), provide a direct ${spec.what} URL.`));
+      }
+      if (status !== 200) {
+        res.destroy();
+        return reject(new Error(`${spec.what} fetch failed (${status}) for ${url.hostname}, the host may block automated fetches (e.g. Wikimedia returns 403). Use a directly reachable image URL like https://dummyimage.com/600x314/000/fff.png.`));
+      }
+      const ct = String(res.headers["content-type"] ?? "");
+      if (!spec.accept(ct)) {
+        res.destroy();
+        return reject(new Error(`URL did not return a ${spec.what} (content-type: ${ct || "unknown"}).`));
+      }
+      const declared = Number(res.headers["content-length"] ?? 0);
+      if (declared > spec.maxBytes) {
+        res.destroy();
+        return reject(new Error(`${spec.what} too large (${declared} bytes, max ${spec.maxBytes}).`));
+      }
+      const chunks = [];
+      let total = 0;
+      res.on("data", (chunk) => {
+        total += chunk.length;
+        if (total > spec.maxBytes) {
+          res.destroy();
+          reject(new Error(`${spec.what} exceeds ${spec.maxBytes} bytes.`));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("end", () => total === 0 ? reject(new Error(`${spec.what} was empty.`)) : resolve(Buffer.concat(chunks)));
+      res.on("error", reject);
+    });
+    req.on("timeout", () => req.destroy(new Error(`${spec.what} fetch timed out.`)));
+    req.on(
+      "error",
+      (e) => reject(new Error(`Could not fetch the ${spec.what} from ${url.hostname}: ${e.message}. The host may be down or blocking, use a direct, publicly reachable image URL (no redirects), e.g. https://dummyimage.com/600x314/000/fff.png.`))
+    );
+  });
+}
+function fetchImageBytes(rawUrl) {
+  return guardedFetch(rawUrl, { what: "image", accept: (ct) => ct.startsWith("image/"), maxBytes: IMAGE_MAX_BYTES });
+}
+function fetchMediaBundleBytes(rawUrl) {
+  return guardedFetch(rawUrl, {
+    what: "media bundle",
+    accept: (ct) => ct.includes("zip") || ct === "application/octet-stream",
+    maxBytes: BUNDLE_MAX_BYTES
+  });
+}
+
+// src/tools/handlers/adGroup/ads/build.ts
+function makeTemp() {
+  let t = -1;
+  return () => String(t--);
+}
+async function imageAssets(cid, inputs, nextTemp) {
+  const ops = [];
+  const refs = [];
+  for (const item of inputs) {
+    if (/^\d+$/.test(item)) {
+      refs.push({ asset: ResourceNames5.asset(cid, item) });
+    } else {
+      const data = await fetchImageBytes(item);
+      const aRN = ResourceNames5.asset(cid, nextTemp());
+      ops.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, name: `image-${randomUUID3()}`, image_asset: { data } } });
+      refs.push({ asset: aRN });
+    }
+  }
+  return { ops, refs };
+}
+
+// src/tools/handlers/adGroup/ads/responsiveSearch.ts
+import { enums as enums9 } from "google-ads-api";
+function buildResponsiveSearchAd(p2, adGroupRN) {
+  if (!p2.headlines || p2.headlines.length < 3) throw new Error("A Responsive Search Ad needs 3-15 headlines (<=30 chars each) in `headlines`.");
+  if (!p2.descriptions || p2.descriptions.length < 2) throw new Error("A Responsive Search Ad needs 2-4 descriptions (<=90 chars each) in `descriptions`.");
+  const rsa = {
+    headlines: p2.headlines.map((text) => ({ text })),
+    descriptions: p2.descriptions.map((text) => ({ text }))
+  };
+  if (p2.path1) rsa.path1 = p2.path1;
+  if (p2.path2) rsa.path2 = p2.path2;
+  return {
+    ops: [
+      {
+        entity: "ad_group_ad",
+        operation: "create",
+        resource: { ad_group: adGroupRN, status: enums9.AdGroupAdStatus.ENABLED, ad: { final_urls: [p2.final_url], responsive_search_ad: rsa } }
+      }
+    ],
+    summary: `responsive search ad (${p2.headlines.length} headlines, ${p2.descriptions.length} descriptions)`
+  };
+}
+
+// src/tools/handlers/adGroup/ads/responsiveDisplay.ts
+import { enums as enums10 } from "google-ads-api";
+async function buildResponsiveDisplayAd(p2, cid, adGroupRN, nextTemp) {
+  if (!p2.marketing_images?.length) throw new Error("A Responsive Display Ad needs at least one 1.91:1 image in `marketing_images` (URL or asset id).");
+  if (!p2.square_marketing_images?.length) throw new Error("A Responsive Display Ad needs at least one 1:1 image in `square_marketing_images` (URL or asset id).");
+  if (!p2.headlines?.length) throw new Error("A Responsive Display Ad needs at least one short headline (<=30 chars) in `headlines`.");
+  if (!p2.long_headline) throw new Error("A Responsive Display Ad needs a `long_headline` (<=90 chars).");
+  if (!p2.descriptions?.length) throw new Error("A Responsive Display Ad needs at least one description (<=90 chars) in `descriptions`.");
+  if (!p2.business_name) throw new Error("A Responsive Display Ad needs a `business_name` (<=25 chars).");
+  const marketing = await imageAssets(cid, p2.marketing_images, nextTemp);
+  const square = await imageAssets(cid, p2.square_marketing_images, nextTemp);
+  const logos = p2.logo_images?.length ? await imageAssets(cid, p2.logo_images, nextTemp) : { ops: [], refs: [] };
+  const rda = {
+    marketing_images: marketing.refs,
+    square_marketing_images: square.refs,
+    headlines: p2.headlines.map((text) => ({ text })),
+    long_headline: { text: p2.long_headline },
+    descriptions: p2.descriptions.map((text) => ({ text })),
+    business_name: p2.business_name
+  };
+  if (logos.refs.length) rda.logo_images = logos.refs;
+  return {
+    ops: [
+      ...marketing.ops,
+      ...square.ops,
+      ...logos.ops,
+      {
+        entity: "ad_group_ad",
+        operation: "create",
+        resource: { ad_group: adGroupRN, status: enums10.AdGroupAdStatus.ENABLED, ad: { final_urls: [p2.final_url], responsive_display_ad: rda } }
+      }
+    ],
+    summary: `responsive display ad "${p2.business_name}"`
+  };
+}
+
+// src/tools/handlers/adGroup/ads/html5Upload.ts
+import { enums as enums11, ResourceNames as ResourceNames6 } from "google-ads-api";
+async function buildHtml5UploadAd(p2, cid, adGroupRN, nextTemp) {
+  if (!p2.media_bundle) throw new Error("An HTML5 upload ad needs `media_bundle`: a .zip URL or an existing media-bundle asset id.");
+  const ops = [];
+  let bundleRef;
+  if (/^\d+$/.test(p2.media_bundle)) {
+    bundleRef = { asset: ResourceNames6.asset(cid, p2.media_bundle) };
+  } else {
+    const data = await fetchMediaBundleBytes(p2.media_bundle);
+    const aRN = ResourceNames6.asset(cid, nextTemp());
+    ops.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, media_bundle_asset: { data } } });
+    bundleRef = { asset: aRN };
+  }
+  ops.push({
+    entity: "ad_group_ad",
+    operation: "create",
+    resource: {
+      ad_group: adGroupRN,
+      status: enums11.AdGroupAdStatus.ENABLED,
+      ad: { final_urls: [p2.final_url], display_upload_ad: { display_upload_product_type: enums11.DisplayUploadProductType.HTML5_UPLOAD_AD, media_bundle: bundleRef } }
+    }
+  });
+  return { ops, summary: "HTML5 upload ad" };
+}
+
+// src/tools/handlers/adGroup/ads/demandGenMultiAsset.ts
+import { enums as enums12 } from "google-ads-api";
+async function buildDemandGenMultiAssetAd(p2, cid, adGroupRN, nextTemp) {
+  if (!p2.square_marketing_images?.length && !p2.marketing_images?.length) {
+    throw new Error("A Demand Gen ad needs at least one image in `square_marketing_images` (1:1) or `marketing_images` (1.91:1), as URLs or asset ids.");
+  }
+  if (!p2.logo_images?.length) throw new Error("A Demand Gen ad needs at least one 1:1 logo in `logo_images` (URL or asset id).");
+  if (!p2.headlines?.length) throw new Error("A Demand Gen ad needs at least one headline in `headlines`.");
+  if (!p2.descriptions?.length) throw new Error("A Demand Gen ad needs at least one description in `descriptions`.");
+  if (!p2.business_name) throw new Error("A Demand Gen ad needs a `business_name`.");
+  const market = p2.marketing_images?.length ? await imageAssets(cid, p2.marketing_images, nextTemp) : { ops: [], refs: [] };
+  const square = p2.square_marketing_images?.length ? await imageAssets(cid, p2.square_marketing_images, nextTemp) : { ops: [], refs: [] };
+  const portrait = p2.portrait_marketing_images?.length ? await imageAssets(cid, p2.portrait_marketing_images, nextTemp) : { ops: [], refs: [] };
+  const tall = p2.tall_portrait_marketing_images?.length ? await imageAssets(cid, p2.tall_portrait_marketing_images, nextTemp) : { ops: [], refs: [] };
+  const logos = await imageAssets(cid, p2.logo_images, nextTemp);
+  const ad = {
+    headlines: p2.headlines.map((text) => ({ text })),
+    descriptions: p2.descriptions.map((text) => ({ text })),
+    business_name: p2.business_name,
+    logo_images: logos.refs
+  };
+  if (market.refs.length) ad.marketing_images = market.refs;
+  if (square.refs.length) ad.square_marketing_images = square.refs;
+  if (portrait.refs.length) ad.portrait_marketing_images = portrait.refs;
+  if (tall.refs.length) ad.tall_portrait_marketing_images = tall.refs;
+  if (p2.call_to_action_text) ad.call_to_action_text = p2.call_to_action_text;
+  return {
+    ops: [
+      ...market.ops,
+      ...square.ops,
+      ...portrait.ops,
+      ...tall.ops,
+      ...logos.ops,
+      {
+        entity: "ad_group_ad",
+        operation: "create",
+        resource: { ad_group: adGroupRN, status: enums12.AdGroupAdStatus.ENABLED, ad: { final_urls: [p2.final_url], demand_gen_multi_asset_ad: ad } }
+      }
+    ],
+    summary: `Demand Gen ad "${p2.business_name}"`
+  };
+}
+
+// src/tools/handlers/adGroup/ads/videoResponsive.ts
+import { enums as enums13, ResourceNames as ResourceNames7 } from "google-ads-api";
+async function buildVideoResponsiveAd(p2, cid, adGroupRN, nextTemp) {
+  if (!p2.youtube_video_ids?.length) throw new Error("A responsive video ad needs at least one YouTube video in `youtube_video_ids` (id or URL).");
+  if (!p2.headlines?.length) throw new Error("A responsive video ad needs at least one headline in `headlines`.");
+  if (!p2.long_headlines?.length) throw new Error("A responsive video ad needs at least one long headline in `long_headlines`.");
+  if (!p2.descriptions?.length) throw new Error("A responsive video ad needs at least one description in `descriptions`.");
+  if (!p2.business_name) throw new Error("A responsive video ad needs a `business_name`.");
+  const ops = [];
+  const videoRefs = [];
+  for (const v of p2.youtube_video_ids) {
+    const aRN = ResourceNames7.asset(cid, nextTemp());
+    ops.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, youtube_video_asset: { youtube_video_id: youtubeVideoId(v) } } });
+    videoRefs.push({ asset: aRN });
+  }
+  const logos = p2.logo_images?.length ? await imageAssets(cid, p2.logo_images, nextTemp) : { ops: [], refs: [] };
+  ops.push(...logos.ops);
+  const text = (s) => ({ text: s });
+  const ad = {
+    videos: videoRefs,
+    headlines: p2.headlines.map(text),
+    long_headlines: p2.long_headlines.map(text),
+    descriptions: p2.descriptions.map(text),
+    business_name: text(p2.business_name)
+  };
+  if (p2.call_to_actions?.length) ad.call_to_actions = p2.call_to_actions.map(text);
+  if (logos.refs.length) ad.logo_images = logos.refs;
+  if (p2.breadcrumb1) ad.breadcrumb1 = p2.breadcrumb1;
+  if (p2.breadcrumb2) ad.breadcrumb2 = p2.breadcrumb2;
+  ops.push({
+    entity: "ad_group_ad",
+    operation: "create",
+    resource: { ad_group: adGroupRN, status: enums13.AdGroupAdStatus.ENABLED, ad: { final_urls: [p2.final_url], video_responsive_ad: ad } }
+  });
+  return { ops, summary: `responsive video ad "${p2.business_name}"` };
+}
+
+// src/tools/handlers/adGroup/ads/appAd.ts
+import { enums as enums14, ResourceNames as ResourceNames8 } from "google-ads-api";
+async function buildAppAd(p2, cid, adGroupRN, nextTemp) {
+  if (!p2.headlines?.length) throw new Error("An app ad needs at least one headline in `headlines`.");
+  if (!p2.descriptions?.length) throw new Error("An app ad needs at least one description in `descriptions`.");
+  const ops = [];
+  const text = (s) => ({ text: s });
+  const ad = { headlines: p2.headlines.map(text), descriptions: p2.descriptions.map(text) };
+  const imageInputs = [...p2.marketing_images ?? [], ...p2.square_marketing_images ?? []];
+  if (imageInputs.length) {
+    const imgs = await imageAssets(cid, imageInputs, nextTemp);
+    ops.push(...imgs.ops);
+    ad.images = imgs.refs;
+  }
+  if (p2.youtube_video_ids?.length) {
+    const videos = [];
+    for (const v of p2.youtube_video_ids) {
+      const aRN = ResourceNames8.asset(cid, nextTemp());
+      ops.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, youtube_video_asset: { youtube_video_id: youtubeVideoId(v) } } });
+      videos.push({ asset: aRN });
+    }
+    ad.youtube_videos = videos;
+  }
+  ops.push({ entity: "ad_group_ad", operation: "create", resource: { ad_group: adGroupRN, status: enums14.AdGroupAdStatus.ENABLED, ad: { app_ad: ad } } });
+  return { ops, summary: "app ad" };
+}
+
+// src/tools/handlers/adGroup/ads/shoppingProduct.ts
+import { enums as enums15 } from "google-ads-api";
+function buildShoppingProductAd(_p, adGroupRN) {
+  return {
+    ops: [
+      {
+        entity: "ad_group_ad",
+        operation: "create",
+        resource: { ad_group: adGroupRN, status: enums15.AdGroupAdStatus.ENABLED, ad: { shopping_product_ad: {} } }
+      }
+    ],
+    summary: "shopping product ad (creative comes from the Merchant Center feed)"
+  };
+}
+
+// src/tools/handlers/adGroup/addAd.ts
+var AD_TYPES = ["RESPONSIVE_SEARCH_AD", "RESPONSIVE_DISPLAY_AD", "HTML5_UPLOAD", "DEMAND_GEN_MULTI_ASSET", "VIDEO_RESPONSIVE", "APP", "SHOPPING_PRODUCT"];
+var NEEDS_FINAL_URL = /* @__PURE__ */ new Set(["RESPONSIVE_SEARCH_AD", "RESPONSIVE_DISPLAY_AD", "HTML5_UPLOAD", "DEMAND_GEN_MULTI_ASSET", "VIDEO_RESPONSIVE"]);
+var schema20 = z23.object({
+  ad_group_id: ID,
+  // Each field is tagged with the ad types it applies to; extra fields are ignored.
+  ad_type: z23.enum(AD_TYPES).describe(
+    "Which ad to create; MUST match the ad group campaign channel. RESPONSIVE_SEARCH_AD=Search, RESPONSIVE_DISPLAY_AD=Display, HTML5_UPLOAD=Display (.zip), DEMAND_GEN_MULTI_ASSET=Demand Gen, VIDEO_RESPONSIVE=Video, APP=App, SHOPPING_PRODUCT=Shopping. Send only the fields tagged for your type."
+  ),
+  final_url: z23.string().url().optional().describe("Landing page URL. Required for every ad type except App and Shopping."),
+  headlines: z23.array(z23.string().min(1).max(30)).max(15).optional().describe("Headlines, <=30 chars. Search: 3-15; Display/Demand Gen/Video/App: 1-5."),
+  long_headlines: z23.array(z23.string().min(1).max(90)).max(5).optional().describe("Video: long headlines, <=90 chars."),
+  descriptions: z23.array(z23.string().min(1).max(90)).max(5).optional().describe("Descriptions, <=90 chars. Search: 2-4; Display/Demand Gen/Video/App: 1-5."),
+  call_to_actions: z23.array(z23.string().min(1).max(30)).max(5).optional().describe('Video: CTA labels, e.g. ["Subscribe"].'),
+  youtube_video_ids: z23.array(z23.string()).max(5).optional().describe("Video (required), App (optional): YouTube video ids or URLs (referenced, not uploaded)."),
+  breadcrumb1: z23.string().max(30).optional().describe("Video: breadcrumb 1."),
+  breadcrumb2: z23.string().max(30).optional().describe("Video: breadcrumb 2."),
+  path1: z23.string().max(15).optional().describe("Search: display-URL path 1."),
+  path2: z23.string().max(15).optional().describe("Search: display-URL path 2."),
+  long_headline: z23.string().min(1).max(90).optional().describe("Display: one long headline, <=90 chars."),
+  business_name: z23.string().min(1).max(25).optional().describe("Display/Demand Gen/Video: <=25 chars."),
+  marketing_images: z23.array(z23.string()).max(20).optional().describe("Display/Demand Gen/App: 1.91:1 images (URL or asset id)."),
+  square_marketing_images: z23.array(z23.string()).max(20).optional().describe("Display/Demand Gen/App: 1:1 images (URL or asset id)."),
+  portrait_marketing_images: z23.array(z23.string()).max(20).optional().describe("Demand Gen: 4:5 images (URL or asset id)."),
+  tall_portrait_marketing_images: z23.array(z23.string()).max(20).optional().describe("Demand Gen: 9:16 images (URL or asset id)."),
+  logo_images: z23.array(z23.string()).max(20).optional().describe("Demand Gen (required); Display/Video (optional): 1:1 logos (URL or asset id)."),
+  call_to_action_text: z23.string().max(30).optional().describe('Demand Gen: CTA label, e.g. "Shop now".'),
+  media_bundle: z23.string().optional().describe("HTML5: .zip URL or media-bundle asset id."),
+  ...confirmFields
+});
+function dispatch(params, cid, adGroupRN) {
+  const nextTemp = makeTemp();
+  switch (params.ad_type) {
+    case "RESPONSIVE_SEARCH_AD":
+      return buildResponsiveSearchAd(params, adGroupRN);
+    case "RESPONSIVE_DISPLAY_AD":
+      return buildResponsiveDisplayAd(params, cid, adGroupRN, nextTemp);
+    case "HTML5_UPLOAD":
+      return buildHtml5UploadAd(params, cid, adGroupRN, nextTemp);
+    case "DEMAND_GEN_MULTI_ASSET":
+      return buildDemandGenMultiAssetAd(params, cid, adGroupRN, nextTemp);
+    case "VIDEO_RESPONSIVE":
+      return buildVideoResponsiveAd(params, cid, adGroupRN, nextTemp);
+    case "APP":
+      return buildAppAd(params, cid, adGroupRN, nextTemp);
+    case "SHOPPING_PRODUCT":
+      return buildShoppingProductAd(params, adGroupRN);
+    default:
+      throw new Error(`Unsupported ad_type: ${String(params.ad_type)}`);
+  }
+}
+var addAdHandler = {
+  action: "add_ad",
+  summary: "Create an ad in an ad group. Pick ad_type: RESPONSIVE_SEARCH_AD (Search), RESPONSIVE_DISPLAY_AD or HTML5_UPLOAD (Display). It must match the ad group campaign channel. Images and HTML5 bundles are passed as http(s) URLs (downloaded, SSRF-guarded) or existing asset ids; the model never sends bytes. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema20,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const cid = creds.customerId;
+    const adGroupRN = ResourceNames9.adGroup(cid, params.ad_group_id);
+    if (NEEDS_FINAL_URL.has(params.ad_type) && !params.final_url) {
+      throw new Error(`final_url is required for ad_type ${params.ad_type}.`);
+    }
+    const build = await dispatch(params, cid, adGroupRN);
+    const customer = ctx.ads.customer(creds);
+    const { confirmed, user_confirmation, ...echo } = params;
+    if (!confirmed) {
+      await customer.mutateResources(build.ops, { validate_only: true });
+      return {
+        output: preview(`create a ${build.summary} in ad group ${params.ad_group_id}`, { ...echo, confirmed: true }),
+        auditSummary: `Preview: create ${build.summary} in ad group ${params.ad_group_id}`,
+        customerId: cid
+      };
+    }
+    assertUserConfirmed({ confirmed, user_confirmation });
+    const result = await customer.mutateResources(build.ops);
+    const id = createdId(result, "ad_group_ad_result");
+    return {
+      output: `\u2705 Created ${build.summary}${id ? ` (id ${id})` : ""} in ad group ${params.ad_group_id}.`,
+      auditSummary: `Created ${build.summary} in ad group ${params.ad_group_id}`,
+      customerId: cid
+    };
+  }
+};
+
+// src/tools/handlers/adGroup/adStatus.ts
+import { z as z24 } from "zod";
+import { enums as enums16 } from "google-ads-api";
+var schema21 = z24.object({
+  ad_group_id: ID,
+  ad_id: ID,
+  status: z24.enum(["ENABLED", "PAUSED", "REMOVED"]),
+  ...confirmFields
+});
+var adStatusHandler = {
+  action: "ad_status",
+  summary: "Pause, resume, or remove an ad. Requires ad_group_id + ad_id (from list_ads) + status (ENABLED|PAUSED|REMOVED). REMOVED deletes the ad. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema21,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const rn = `customers/${creds.customerId}/adGroupAds/${params.ad_group_id}~${params.ad_id}`;
+    const isRemove = params.status === "REMOVED";
+    const ops = isRemove ? [{ entity: "ad_group_ad", operation: "remove", resource: rn }] : [{ entity: "ad_group_ad", operation: "update", resource: { resource_name: rn, status: enums16.AdGroupAdStatus[params.status] } }];
+    const identity = { ad_group_id: params.ad_group_id, ad_id: params.ad_id, status: params.status };
+    if (!params.confirmed && (!isRemove || userConfirmationRequired())) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: isRemove ? previewRemove(`ad ${params.ad_id}`, identity) : preview(`set ad ${params.ad_id} to ${params.status}`, identity),
+        auditSummary: `Preview: ${params.status} ad ${params.ad_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: isRemove ? `\u2705 Removed ad ${params.ad_id}.` : `\u2705 Ad ${params.ad_id} is now ${params.status}.`,
+      auditSummary: `${params.status} ad ${params.ad_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/orchestrators/adGroup.ts
+var adGroupTool = defineOrchestrator({
+  name: "google_ads_ad_group",
+  purpose: "Create and manage ad groups and the ads inside them. create makes an ad group, update edits it, and status pauses, resumes, or removes it. list_ads lists the ads in a group. add_ad adds an ad (responsive search, display, HTML5, Demand Gen, video, app, or shopping). ad_status pauses, resumes, or removes a single ad.",
+  limitations: "Ad groups exist for Search, Display, Demand Gen, Video, and Shopping campaigns. Performance Max has no ad groups (use pmax asset groups instead). App campaigns create their one ad group automatically, so do not call create for App; find it with list_ads instead. add_ad needs an ad_type that matches the ad group campaign channel: RESPONSIVE_SEARCH_AD for Search, RESPONSIVE_DISPLAY_AD or HTML5_UPLOAD for Display, DEMAND_GEN_MULTI_ASSET for Demand Gen, VIDEO_RESPONSIVE for Video, APP for App, SHOPPING_PRODUCT for Shopping (no creative needed there, products come from Merchant Center). Every write previews first; then the user must type yes or ok in chat before confirmed:true + user_confirmation. Get campaign_id and ad_group_id from the report or campaign tools, and get an ad_id from list_ads. Ad text cannot be edited in place, so remove the ad and add a new one instead.",
+  examples: [
+    '{"action":"create","campaign_id":"123","name":"Locksmith - Exact","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"update","ad_group_id":"456","cpc_bid":1.5,"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"status","ad_group_id":"456","status":"PAUSED","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"list_ads","ad_group_id":"456"}',
+    '{"action":"add_ad","ad_group_id":"456","ad_type":"RESPONSIVE_SEARCH_AD","final_url":"https://example.com","headlines":["A","B","C"],"descriptions":["One","Two"],"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"add_ad","ad_group_id":"456","ad_type":"RESPONSIVE_DISPLAY_AD","final_url":"https://example.com","headlines":["Big sale"],"long_headline":"Our biggest sale of the year","descriptions":["Shop the deals"],"business_name":"Acme","marketing_images":["https://cdn.example.com/wide.jpg"],"square_marketing_images":["https://cdn.example.com/square.jpg"],"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"ad_status","ad_group_id":"456","ad_id":"789","status":"PAUSED","confirmed":true,"user_confirmation":"yes"}'
+  ],
+  handlers: [createHandler2, updateHandler2, statusHandler3, listAdsHandler, addAdHandler, adStatusHandler]
+});
+
+// src/tools/handlers/keyword/list.ts
+import { z as z25 } from "zod";
+import { enums as enums17 } from "google-ads-api";
+function kwLine(r) {
+  const c = r.ad_group_criterion;
+  const bid = c.cpc_bid_micros != null ? (Number(c.cpc_bid_micros) / 1e6).toFixed(2) : "-";
+  const qs = c.quality_info?.quality_score != null ? String(c.quality_info.quality_score) : "-";
+  const neg = c.negative ? " [NEG]" : "";
+  return `\u2022 "${c.keyword.text}" [${enumLabel(enums17.KeywordMatchType, c.keyword.match_type)}]${neg} crit=${c.criterion_id} ag=${r.ad_group.id} | ${enumLabel(enums17.AdGroupCriterionStatus, c.status)} | bid ${bid} | QS ${qs}`;
+}
+var schema22 = z25.object({
+  ad_group_id: ID.optional(),
+  include_negative: z25.boolean().default(false).describe("Include negative (excluded) keywords"),
+  limit: z25.number().int().min(1).max(2e3).default(200),
+  cursor: z25.string().optional()
+});
+var listHandler2 = {
+  action: "list",
+  summary: "List keywords with criterion_id, match type, status, max CPC, and Quality Score. Use it to get criterion_id for update. Optionally scope to one ad_group_id. Paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema22,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Keywords (page)" });
+    const creds = await requireConnection(ctx);
+    const where = ["ad_group_criterion.type = KEYWORD"];
+    if (params.ad_group_id) where.push(`ad_group.id = ${params.ad_group_id}`);
+    const gaql = `SELECT ad_group.id, ad_group.name, ad_group_criterion.criterion_id, ad_group_criterion.keyword.text, ad_group_criterion.keyword.match_type, ad_group_criterion.status, ad_group_criterion.negative, ad_group_criterion.cpc_bid_micros, ad_group_criterion.quality_info.quality_score FROM ad_group_criterion WHERE ${where.join(" AND ")} ORDER BY ad_group_criterion.keyword.text`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    const kept = params.include_negative ? rows : rows.filter((r) => !r.ad_group_criterion?.negative);
+    if (!kept.length) {
+      return { output: "No keywords found.", auditSummary: "Listed keywords (0)", customerId: creds.customerId };
+    }
+    const title = `Keywords (account ${formatCid(creds.customerId)}${params.ad_group_id ? `, ad group ${params.ad_group_id}` : ""})` + (truncated ? ` - top ${params.limit}${total != null ? ` of ${int(total)}` : ""}` : "");
+    return paginate({
+      ctx,
+      title,
+      rows: kept.map(kwLine),
+      summary: `Listed keywords${params.ad_group_id ? ` (ad group ${params.ad_group_id})` : ""}`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/keyword/add.ts
+import { z as z26 } from "zod";
+import { enums as enums18, toMicros as toMicros6, ResourceNames as ResourceNames10 } from "google-ads-api";
+var schema23 = z26.object({
+  ad_group_id: ID,
+  keywords: z26.array(z26.string().min(1).max(80)).min(1).max(100),
+  match_type: z26.enum(["BROAD", "PHRASE", "EXACT"]),
+  negative: z26.boolean().default(false).describe("true = exclude these terms as negative keywords"),
+  cpc_bid: z26.number().positive().optional().describe("Max CPC for positive keywords (manual bidding only)"),
+  ...confirmFields
+});
+var addHandler = {
+  action: "add",
+  summary: "Add keywords to an ad group: positive (to target) or negative (set negative:true to exclude). Requires ad_group_id, keywords[], match_type. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema23,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const adGroupRN = ResourceNames10.adGroup(creds.customerId, params.ad_group_id);
+    const ops = params.keywords.map((text) => {
+      const resource = {
+        ad_group: adGroupRN,
+        status: enums18.AdGroupCriterionStatus.ENABLED,
+        negative: params.negative,
+        keyword: { text, match_type: enums18.KeywordMatchType[params.match_type] }
+      };
+      if (!params.negative && params.cpc_bid != null) resource.cpc_bid_micros = toMicros6(params.cpc_bid);
+      return { entity: "ad_group_criterion", operation: "create", resource };
+    });
+    const verb = params.negative ? "exclude" : "add";
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`${verb} ${params.keywords.length} ${params.match_type} keyword(s) ${params.negative ? "as negatives " : ""}in ad group ${params.ad_group_id}`, {
+          ad_group_id: params.ad_group_id,
+          keywords: params.keywords,
+          match_type: params.match_type,
+          negative: params.negative,
+          confirmed: true
+        }),
+        auditSummary: `Preview: ${verb} ${params.keywords.length} keyword(s) in ad group ${params.ad_group_id}`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: `\u2705 ${params.negative ? "Excluded" : "Added"} ${params.keywords.length} ${params.match_type} keyword(s) in ad group ${params.ad_group_id}.`,
+      auditSummary: `${params.negative ? "Excluded" : "Added"} ${params.keywords.length} keyword(s) in ad group ${params.ad_group_id}`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/keyword/update.ts
+import { z as z27 } from "zod";
+import { enums as enums19, toMicros as toMicros7, ResourceNames as ResourceNames11 } from "google-ads-api";
+var schema24 = z27.object({
+  ad_group_id: ID,
+  criterion_id: ID,
+  cpc_bid: z27.number().positive().optional().describe("New max CPC in account currency"),
+  status: z27.enum(["ENABLED", "PAUSED", "REMOVED"]).optional(),
+  ...confirmFields
+});
+var updateHandler3 = {
+  action: "update",
+  summary: "Set a keyword's max CPC and/or status (ENABLED, PAUSED, or REMOVED). Requires ad_group_id + criterion_id (from keyword list). Provide cpc_bid and/or status. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema24,
+  async execute(params, ctx) {
+    if (params.cpc_bid == null && !params.status) throw new Error("Provide cpc_bid and/or status to change.");
+    const creds = await requireConnection(ctx);
+    const customer = ctx.ads.customer(creds);
+    const rn = ResourceNames11.adGroupCriterion(creds.customerId, params.ad_group_id, params.criterion_id);
+    const isRemove = params.status === "REMOVED";
+    const changes = [params.cpc_bid != null ? `bid\u2192${params.cpc_bid}` : "", params.status ? `status\u2192${params.status}` : ""].filter(Boolean).join(", ");
+    const buildUpdate = () => {
+      const op = { resource_name: rn };
+      if (params.cpc_bid != null) op.cpc_bid_micros = toMicros7(params.cpc_bid);
+      if (params.status && !isRemove) op.status = enums19.AdGroupCriterionStatus[params.status];
+      return op;
+    };
+    const removeIdentity = { ad_group_id: params.ad_group_id, criterion_id: params.criterion_id, status: "REMOVED" };
+    if (!params.confirmed && (!isRemove || userConfirmationRequired())) {
+      if (isRemove) await customer.adGroupCriteria.remove([rn], { validate_only: true });
+      else await customer.adGroupCriteria.update([buildUpdate()], { validate_only: true });
+      const apply = {
+        ad_group_id: params.ad_group_id,
+        criterion_id: params.criterion_id,
+        ...params.cpc_bid != null ? { cpc_bid: params.cpc_bid } : {},
+        ...params.status ? { status: params.status } : {}
+      };
+      return {
+        output: isRemove ? previewRemove(`keyword ${params.criterion_id}`, removeIdentity) : preview(`update keyword ${params.criterion_id} (${changes})`, apply),
+        auditSummary: `Preview: ${isRemove ? "remove" : "update"} keyword ${params.criterion_id} (${changes})`,
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    if (isRemove) {
+      await customer.adGroupCriteria.remove([rn]);
+      return { output: `\u2705 Removed keyword ${params.criterion_id}.`, auditSummary: `Removed keyword ${params.criterion_id}`, customerId: creds.customerId };
+    }
+    await customer.adGroupCriteria.update([buildUpdate()]);
+    return { output: `\u2705 Updated keyword ${params.criterion_id} (${changes}).`, auditSummary: `Updated keyword ${params.criterion_id} (${changes})`, customerId: creds.customerId };
+  }
+};
+
+// src/tools/orchestrators/keyword.ts
+var keywordTool = defineOrchestrator({
+  name: "google_ads_keyword",
+  purpose: "Manage keywords. list shows them with criterion_id and Quality Score. add adds positive or negative keywords. update changes a keyword bid or status.",
+  limitations: 'Every write previews first; then the user must type yes or ok in chat before confirmed:true + user_confirmation. Get criterion_id from action "list" before "update". Negative keywords cannot carry a bid. cpc_bid only applies under manual bidding.',
+  examples: [
+    '{"action":"list","ad_group_id":"456"}',
+    '{"action":"add","ad_group_id":"456","keywords":["24h locksmith"],"match_type":"PHRASE","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"add","ad_group_id":"456","keywords":["cheap"],"match_type":"BROAD","negative":true,"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"update","ad_group_id":"456","criterion_id":"789","status":"PAUSED","confirmed":true,"user_confirmation":"yes"}'
+  ],
+  handlers: [listHandler2, addHandler, updateHandler3]
+});
+
+// src/tools/handlers/pmax/createAssetGroup.ts
+import { z as z28 } from "zod";
+import { enums as enums21, ResourceNames as ResourceNames13 } from "google-ads-api";
+
+// src/tools/handlers/pmax/images.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { enums as enums20, ResourceNames as ResourceNames12 } from "google-ads-api";
+async function buildImageOps(cid, agRN, imgs, nextTemp) {
+  const cats = [
+    { list: imgs.marketing_images, field: enums20.AssetFieldType.MARKETING_IMAGE, req: "marketing" },
+    { list: imgs.square_images, field: enums20.AssetFieldType.SQUARE_MARKETING_IMAGE, req: "square" },
+    { list: imgs.portrait_images, field: enums20.AssetFieldType.PORTRAIT_MARKETING_IMAGE, req: null },
+    { list: imgs.logos, field: enums20.AssetFieldType.LOGO, req: "logo" },
+    { list: imgs.landscape_logos, field: enums20.AssetFieldType.LANDSCAPE_LOGO, req: null }
+  ];
+  const toDownload = [];
+  const existing = [];
+  const has = { marketing: 0, square: 0, logo: 0 };
+  for (const c of cats) {
+    for (const item of c.list ?? []) {
+      if (c.req) has[c.req]++;
+      if (/^\d+$/.test(item)) existing.push({ id: item, field: c.field });
+      else toDownload.push({ url: item, field: c.field });
+    }
+  }
+  const downloaded = await Promise.all(toDownload.map(async (t) => ({ buf: await fetchImageBytes(t.url), field: t.field })));
+  const assetOps = [];
+  const linkOps = [];
+  for (const d of downloaded) {
+    const aRN = ResourceNames12.asset(cid, nextTemp());
+    assetOps.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, name: `image-${randomUUID4()}`, image_asset: { data: d.buf } } });
+    linkOps.push({ entity: "asset_group_asset", operation: "create", resource: { asset_group: agRN, asset: aRN, field_type: d.field } });
+  }
+  for (const e of existing) {
+    linkOps.push({ entity: "asset_group_asset", operation: "create", resource: { asset_group: agRN, asset: ResourceNames12.asset(cid, e.id), field_type: e.field } });
+  }
+  return { assetOps, linkOps, total: downloaded.length + existing.length, downloaded: downloaded.length, existing: existing.length, has };
+}
+
+// src/tools/handlers/pmax/createAssetGroup.ts
+var CTA = [
+  "LEARN_MORE",
+  "GET_QUOTE",
+  "APPLY_NOW",
+  "SIGN_UP",
+  "CONTACT_US",
+  "SUBSCRIBE",
+  "DOWNLOAD",
+  "BOOK_NOW",
+  "SHOP_NOW",
+  "BUY_NOW",
+  "DONATE_NOW",
+  "ORDER_NOW",
+  "PLAY_NOW",
+  "SEE_MORE",
+  "START_NOW",
+  "VISIT_SITE",
+  "WATCH_NOW"
+];
+var schema25 = z28.object({
+  campaign_id: ID,
+  name: z28.string().min(1).max(128),
+  final_url: z28.string().url(),
+  headlines: z28.array(z28.string().min(1).max(30)).min(3).max(5),
+  long_headline: z28.string().min(1).max(90),
+  descriptions: z28.array(z28.string().min(1).max(90)).min(2).max(5),
+  business_name: z28.string().min(1).max(25),
+  // Google requires at least one marketing (1.91:1), square (1:1), and logo (1:1) image.
+  marketing_images: z28.array(z28.string()).max(20).optional().describe("REQUIRED (>=1): URLs or asset ids, 1.91:1 landscape marketing images."),
+  square_images: z28.array(z28.string()).max(20).optional().describe("REQUIRED (>=1): URLs or asset ids, 1:1 square marketing images."),
+  logos: z28.array(z28.string()).max(20).optional().describe("REQUIRED (>=1): URLs or asset ids, 1:1 square logos."),
+  portrait_images: z28.array(z28.string()).max(20).optional().describe("Optional: URLs or asset ids, 4:5 portrait marketing images."),
+  landscape_logos: z28.array(z28.string()).max(20).optional().describe("Optional: URLs or asset ids, 4:1 landscape logos."),
+  youtube_video_ids: z28.array(z28.string()).max(5).optional().describe("YouTube video ids or URLs to add as video assets. Recommended: Google auto-generates a weak video if none is supplied."),
+  call_to_action: z28.enum(CTA).optional().describe("Call-to-action button text for the asset group, e.g. SHOP_NOW."),
+  ...confirmFields
+});
+var createAssetGroupHandler = {
+  action: "create_asset_group",
+  summary: "Create a Performance Max asset group (so a P-MAX campaign can serve). Requires campaign_id, name, final_url, 3-5 headlines, long_headline, 2-5 descriptions, business_name, AND images (a valid asset group needs at least one marketing_images (1.91:1), one square_images (1:1), and one logos (1:1) image, as URLs or asset ids). Optionally youtube_video_ids and a call_to_action. Add more images later with add_images. Created PAUSED. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema25,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const cid = creds.customerId;
+    if (!params.marketing_images?.length || !params.square_images?.length || !params.logos?.length) {
+      throw new Error("A P-MAX asset group needs at least one marketing_images (1.91:1), one square_images (1:1), and one logos (1:1) image, as reachable http(s) URLs or existing asset ids. Ask the user for those images, then retry.");
+    }
+    let temp = -1;
+    const nextTemp = () => String(temp--);
+    const agRN = ResourceNames13.assetGroup(cid, nextTemp());
+    const agOp = {
+      entity: "asset_group",
+      operation: "create",
+      resource: { resource_name: agRN, name: params.name, campaign: ResourceNames13.campaign(cid, params.campaign_id), final_urls: [params.final_url], status: enums21.AssetGroupStatus.PAUSED }
+    };
+    const assetOps = [];
+    const linkOps = [];
+    const add = (resource, fieldType) => {
+      const aRN = ResourceNames13.asset(cid, nextTemp());
+      assetOps.push({ entity: "asset", operation: "create", resource: { resource_name: aRN, ...resource } });
+      linkOps.push({ entity: "asset_group_asset", operation: "create", resource: { asset_group: agRN, asset: aRN, field_type: fieldType } });
+    };
+    params.headlines.forEach((h) => add({ text_asset: { text: h } }, enums21.AssetFieldType.HEADLINE));
+    add({ text_asset: { text: params.long_headline } }, enums21.AssetFieldType.LONG_HEADLINE);
+    params.descriptions.forEach((d) => add({ text_asset: { text: d } }, enums21.AssetFieldType.DESCRIPTION));
+    add({ text_asset: { text: params.business_name } }, enums21.AssetFieldType.BUSINESS_NAME);
+    (params.youtube_video_ids ?? []).forEach((v) => add({ youtube_video_asset: { youtube_video_id: youtubeVideoId(v) } }, enums21.AssetFieldType.YOUTUBE_VIDEO));
+    if (params.call_to_action) {
+      add({ call_to_action_asset: { call_to_action: enums21.CallToActionType[params.call_to_action] } }, enums21.AssetFieldType.CALL_TO_ACTION_SELECTION);
+    }
+    const img = await buildImageOps(cid, agRN, params, nextTemp);
+    const ops = [agOp, ...assetOps, ...img.assetOps, ...linkOps, ...img.linkOps];
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`create P-MAX asset group "${params.name}" (text + ${img.total} image asset(s)) in campaign ${params.campaign_id}`, { campaign_id: params.campaign_id, name: params.name, confirmed: true }),
+        auditSummary: `Preview: create asset group "${params.name}"`,
+        customerId: cid
+      };
+    }
+    assertUserConfirmed(params);
+    const result = await customer.mutateResources(ops);
+    const id = createdId(result, "asset_group_result");
+    return {
+      output: `\u2705 Created P-MAX asset group "${params.name}"${id ? ` (id ${id})` : ""} in campaign ${params.campaign_id}, PAUSED, with ${img.total} image asset(s).
+Add more images anytime with add_images. Enable the asset group and the campaign when ready to serve.`,
+      auditSummary: `Created asset group "${params.name}"${id ? ` (${id})` : ""}`,
+      customerId: cid
+    };
+  }
+};
+
+// src/tools/handlers/pmax/assetGroup.ts
+import { z as z29 } from "zod";
+import { enums as enums22, ResourceNames as ResourceNames14 } from "google-ads-api";
+var schema26 = z29.object({
+  asset_group_id: ID,
+  name: z29.string().min(1).max(128).optional().describe("New asset group name."),
+  final_url: z29.string().url().optional().describe("New final URL for the asset group."),
+  status: z29.enum(["ENABLED", "PAUSED", "REMOVED"]).optional().describe("ENABLED to serve, PAUSED to stop, REMOVED to delete (permanent)."),
+  ...confirmFields
+});
+var assetGroupHandler2 = {
+  action: "asset_group",
+  summary: "Update or delete a P-MAX asset group: rename, change final_url, pause/resume (status ENABLED|PAUSED), or delete (status REMOVED, permanent). Requires asset_group_id (from create_asset_group or list_assets). Provide at least one of name, final_url, status. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema26,
+  async execute(params, ctx) {
+    if (params.name == null && params.final_url == null && !params.status) {
+      throw new Error("Provide at least one of name, final_url, or status to change.");
+    }
+    const creds = await requireConnection(ctx);
+    const cid = creds.customerId;
+    const rn = ResourceNames14.assetGroup(cid, params.asset_group_id);
+    const isRemove = params.status === "REMOVED";
+    const customer = ctx.ads.customer(creds);
+    const changes = [params.name != null ? `name "${params.name}"` : "", params.final_url != null ? `final_url ${params.final_url}` : "", params.status ? `status ${params.status}` : ""].filter(Boolean).join(", ");
+    const identity = {
+      asset_group_id: params.asset_group_id,
+      ...params.name != null ? { name: params.name } : {},
+      ...params.final_url != null ? { final_url: params.final_url } : {},
+      ...params.status ? { status: params.status } : {}
+    };
+    const updateResource = { resource_name: rn };
+    if (params.name != null) updateResource.name = params.name;
+    if (params.final_url != null) updateResource.final_urls = [params.final_url];
+    if (params.status && !isRemove) updateResource.status = enums22.AssetGroupStatus[params.status];
+    const ops = isRemove ? [{ entity: "asset_group", operation: "remove", resource: rn }] : [{ entity: "asset_group", operation: "update", resource: updateResource }];
+    if (!params.confirmed && (!isRemove || userConfirmationRequired())) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: isRemove ? previewRemove(`asset group ${params.asset_group_id} (deletes it permanently; the P-MAX campaign stops serving from it)`, identity) : preview(`update asset group ${params.asset_group_id} (${changes})`, identity),
+        auditSummary: `Preview: ${isRemove ? "remove" : "update"} asset group ${params.asset_group_id}`,
+        customerId: cid
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: isRemove ? `\u2705 Removed asset group ${params.asset_group_id} (permanently deleted).` : `\u2705 Updated asset group ${params.asset_group_id} (${changes}).`,
+      auditSummary: `${isRemove ? "Removed" : "Updated"} asset group ${params.asset_group_id}${isRemove ? "" : ` (${changes})`}`,
+      customerId: cid
+    };
+  }
+};
+
+// src/tools/handlers/pmax/addImages.ts
+import { z as z30 } from "zod";
+import { ResourceNames as ResourceNames15 } from "google-ads-api";
+var schema27 = z30.object({
+  asset_group_id: ID,
+  marketing_images: z30.array(z30.string()).max(20).optional().describe("URLs or asset ids, 1.91:1 landscape marketing images"),
+  square_images: z30.array(z30.string()).max(20).optional().describe("URLs or asset ids, 1:1 square marketing images"),
+  portrait_images: z30.array(z30.string()).max(20).optional().describe("URLs or asset ids, 4:5 portrait marketing images"),
+  logos: z30.array(z30.string()).max(20).optional().describe("URLs or asset ids, 1:1 logos"),
+  landscape_logos: z30.array(z30.string()).max(20).optional().describe("URLs or asset ids, 4:1 landscape logos"),
+  ...confirmFields
+});
+var addImagesHandler = {
+  action: "add_images",
+  summary: "Add image assets to a P-MAX asset group: marketing (1.91:1), square (1:1), portrait (4:5), logo (1:1), landscape logo (4:1). Pass http(s) URLs (downloaded, SSRF-guarded) or existing asset ids. Requires asset_group_id and at least one image. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema27,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const cid = creds.customerId;
+    const agRN = ResourceNames15.assetGroup(cid, params.asset_group_id);
+    let temp = -1;
+    const { assetOps, linkOps, total, downloaded, existing } = await buildImageOps(cid, agRN, params, () => String(temp--));
+    if (total === 0) throw new Error("Provide at least one image (URL or asset id) in marketing_images, square_images, portrait_images, logos, or landscape_logos.");
+    const ops = [...assetOps, ...linkOps];
+    const customer = ctx.ads.customer(creds);
+    if (!params.confirmed) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: preview(`add ${total} image(s) to asset group ${params.asset_group_id} (${downloaded} downloaded, ${existing} existing)`, { asset_group_id: params.asset_group_id, confirmed: true }),
+        auditSummary: `Preview: add ${total} image(s) to asset group ${params.asset_group_id}`,
+        customerId: cid
+      };
+    }
+    assertUserConfirmed(params);
+    await customer.mutateResources(ops);
+    return {
+      output: `\u2705 Added ${total} image(s) to asset group ${params.asset_group_id}.`,
+      auditSummary: `Added ${total} image(s) to asset group ${params.asset_group_id}`,
+      customerId: cid
+    };
+  }
+};
+
+// src/tools/handlers/pmax/listAssets.ts
+import { z as z31 } from "zod";
+import { enums as enums23 } from "google-ads-api";
+function assetLine(r) {
+  const aga = r.asset_group_asset;
+  const a = r.asset;
+  return `\u2022 ${enumLabel(enums23.AssetFieldType, aga.field_type)} | asset ${a?.id} (${enumLabel(enums23.AssetType, a?.type)}) | ${enumLabel(enums23.AssetLinkStatus, aga.status)}
+    ${aga.resource_name}`;
+}
+var schema28 = z31.object({
+  asset_group_id: ID,
+  limit: z31.number().int().min(1).max(2e3).default(200),
+  cursor: z31.string().optional()
+});
+var listAssetsHandler = {
+  action: "list_assets",
+  summary: "List the assets linked to a P-MAX asset group, with field type and the resource name needed to remove one. Requires asset_group_id. Paginated via cursor.",
+  readOnly: true,
+  category: "report",
+  schema: schema28,
+  async execute(params, ctx) {
+    if (params.cursor) return paginate({ ctx, cursor: params.cursor, title: "", rows: [], summary: "Asset-group assets (page)" });
+    const creds = await requireConnection(ctx);
+    const gaql = `SELECT asset_group_asset.resource_name, asset_group_asset.field_type, asset_group_asset.status, asset.id, asset.type, asset.name FROM asset_group_asset WHERE asset_group.id = ${params.asset_group_id} ORDER BY asset_group_asset.field_type`;
+    const { rows, total, truncated } = await ctx.ads.searchPage(creds, gaql, params.limit);
+    if (!rows.length) return { output: "No assets found in this asset group.", auditSummary: "Listed asset-group assets (0)", customerId: creds.customerId };
+    return paginate({
+      ctx,
+      title: `Asset group ${params.asset_group_id} assets (account ${formatCid(creds.customerId)})${truncated ? ` - top ${params.limit}${total != null ? ` of ${int(total)}` : ""}` : ""}`,
+      rows: rows.map(assetLine),
+      summary: `Listed asset-group assets (${params.asset_group_id})`,
+      customerId: creds.customerId
+    });
+  }
+};
+
+// src/tools/handlers/pmax/removeAsset.ts
+import { z as z32 } from "zod";
+var schema29 = z32.object({
+  asset_group_asset: z32.string().describe("The asset_group_asset resource name from pmax list_assets"),
+  ...confirmFields
+});
+var removeAssetHandler = {
+  action: "remove_asset",
+  summary: "Remove an asset from a P-MAX asset group. Requires asset_group_asset (the resource name from list_assets). To replace an asset, remove it then add a new one. Preview first (omit confirmed). Then ask the user to type yes or ok in chat; only after that re-call with confirmed:true and user_confirmation yes|ok.",
+  readOnly: false,
+  category: "mutate",
+  schema: schema29,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const prefix = `customers/${creds.customerId}/assetGroupAssets/`;
+    if (!params.asset_group_asset.startsWith(prefix)) {
+      throw new Error(`asset_group_asset must be a resource name from pmax list_assets for this account, e.g. ${prefix}456~789~MARKETING_IMAGE.`);
+    }
+    const customer = ctx.ads.customer(creds);
+    const ops = [{ entity: "asset_group_asset", operation: "remove", resource: params.asset_group_asset }];
+    const identity = { asset_group_asset: params.asset_group_asset };
+    if (!params.confirmed && userConfirmationRequired()) {
+      await customer.mutateResources(ops, { validate_only: true });
+      return {
+        output: previewRemove(`the asset ${params.asset_group_asset}`, identity),
+        auditSummary: "Preview: remove asset-group asset",
+        customerId: creds.customerId
+      };
+    }
+    assertUserConfirmedIfClaimed(params);
+    await customer.mutateResources(ops);
+    return { output: "\u2705 Removed the asset from the asset group.", auditSummary: "Removed asset-group asset", customerId: creds.customerId };
+  }
+};
+
+// src/tools/orchestrators/pmax.ts
+var pmaxTool = defineOrchestrator({
+  name: "google_ads_pmax",
+  purpose: "Performance Max assets. create_asset_group makes an asset group from text plus images (a group needs at least one marketing, square, and logo image, so images are required up front). asset_group updates or deletes a group. add_images adds more images. list_assets lists them. remove_asset removes one.",
+  limitations: "Every write previews first; then the user must type yes or ok in chat before confirmed:true + user_confirmation. create_asset_group needs images up front: at least one marketing image (1.91:1), one square image (1:1), and one logo (1:1), given as reachable http(s) URLs or existing asset ids. It fails without them. Asset groups are created PAUSED; enable one with asset_group status ENABLED. asset_group can rename a group, change its final_url, pause it, or delete it (status REMOVED); remove_asset removes a single asset within a group. Get campaign_id from report, asset_group_id is returned by create_asset_group, and an asset resource name comes from list_assets. Individual assets are not editable in place, so remove one and add a new one instead.",
+  examples: [
+    '{"action":"create_asset_group","campaign_id":"123","name":"Spring","final_url":"https://example.com","headlines":["A","B","C"],"long_headline":"Long one","descriptions":["One","Two"],"business_name":"Acme","marketing_images":["https://example.com/banner.jpg"],"square_images":["https://example.com/sq.jpg"],"logos":["https://example.com/logo.png"],"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"asset_group","asset_group_id":"999","status":"ENABLED","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"asset_group","asset_group_id":"999","name":"Spring v2","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"asset_group","asset_group_id":"999","status":"REMOVED","confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"add_images","asset_group_id":"999","marketing_images":["https://example.com/banner.jpg"],"square_images":["https://example.com/sq.jpg"],"logos":["https://example.com/logo.png"],"confirmed":true,"user_confirmation":"yes"}',
+    '{"action":"list_assets","asset_group_id":"999"}',
+    '{"action":"remove_asset","asset_group_asset":"customers/1234567890/assetGroupAssets/999~555~MARKETING_IMAGE","confirmed":true,"user_confirmation":"yes"}'
+  ],
+  handlers: [createAssetGroupHandler, assetGroupHandler2, addImagesHandler, listAssetsHandler, removeAssetHandler]
+});
+
+// src/tools/handlers/lookup/location.ts
+import { z as z33 } from "zod";
+var NAME = /^[\p{L}\p{N} .,'\-()/&]+$/u;
+function gaqlString(s) {
+  return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+var schema30 = z33.object({
+  name: z33.string().min(1).max(80).describe('Location name, e.g. "California", "Tokyo", "United States"'),
+  country_code: z33.string().length(2).optional().describe('ISO 3166-1 alpha-2 country code to disambiguate, e.g. "US", "JP"'),
+  limit: z33.number().int().min(1).max(50).default(20)
+});
+var locationHandler = {
+  action: "location",
+  summary: "Resolve a location NAME to its numeric geo target constant id (needed by campaign targeting and geo reports). Requires name; optional country_code disambiguates same-named places.",
+  readOnly: true,
+  category: "report",
+  schema: schema30,
+  async execute(params, ctx) {
+    if (!NAME.test(params.name)) throw new Error('Location name has unexpected characters. Use a plain place name like "California".');
+    const creds = await requireConnection(ctx);
+    const cc = params.country_code ? ` AND geo_target_constant.country_code = '${gaqlString(params.country_code.toUpperCase())}'` : "";
+    const gaql = `SELECT geo_target_constant.id, geo_target_constant.name, geo_target_constant.canonical_name, geo_target_constant.country_code, geo_target_constant.target_type FROM geo_target_constant WHERE geo_target_constant.status = 'ENABLED' AND geo_target_constant.name = '${gaqlString(params.name)}'${cc} LIMIT ${params.limit}`;
+    const rows = await ctx.ads.query(creds, gaql);
+    if (!rows.length) {
+      return {
+        output: `No location found named "${params.name}"${params.country_code ? ` in ${params.country_code.toUpperCase()}` : ""}. Check spelling and capitalization, or try again with a country_code.`,
+        auditSummary: `Geo lookup: ${params.name} (0)`,
+        customerId: creds.customerId
+      };
+    }
+    const lines = rows.map((r) => {
+      const g = r.geo_target_constant;
+      return `\u2022 id ${g.id} | ${g.canonical_name || g.name} (${g.target_type}, ${g.country_code})`;
+    });
+    return {
+      output: [`Geo target constants for "${params.name}" - use the id in campaign targeting or a geo report:`, ...lines].join("\n"),
+      auditSummary: `Geo lookup: ${params.name} (${rows.length})`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/handlers/lookup/language.ts
+import { z as z34 } from "zod";
+var schema31 = z34.object({
+  name: z34.string().min(1).max(40).describe('Language name, e.g. "Japanese", "English"')
+});
+var languageHandler = {
+  action: "language",
+  summary: "Resolve a language NAME to its numeric language constant id (needed by campaign targeting). Requires name.",
+  readOnly: true,
+  category: "report",
+  schema: schema31,
+  async execute(params, ctx) {
+    const creds = await requireConnection(ctx);
+    const rows = await ctx.ads.query(
+      creds,
+      "SELECT language_constant.id, language_constant.name, language_constant.code, language_constant.targetable FROM language_constant"
+    );
+    const q = params.name.trim().toLowerCase();
+    const matches = rows.filter((r) => {
+      const lc = r.language_constant;
+      return lc.targetable && (String(lc.name).toLowerCase().includes(q) || String(lc.code).toLowerCase() === q);
+    });
+    if (!matches.length) {
+      return { output: `No targetable language found matching "${params.name}".`, auditSummary: `Language lookup: ${params.name} (0)`, customerId: creds.customerId };
+    }
+    const lines = matches.map((r) => `\u2022 id ${r.language_constant.id} | ${r.language_constant.name} (${r.language_constant.code})`);
+    return {
+      output: [`Language constants for "${params.name}" - use the id in campaign targeting:`, ...lines].join("\n"),
+      auditSummary: `Language lookup: ${params.name} (${matches.length})`,
+      customerId: creds.customerId
+    };
+  }
+};
+
+// src/tools/orchestrators/lookup.ts
+var lookupTool = defineOrchestrator({
+  name: "google_ads_lookup",
+  purpose: "Resolve a location or language name to the numeric id the other tools need. Campaign targeting and geo reports take ids, not names, so call this first.",
+  limitations: "Read-only reference lookup. Location matching is by exact name, so use country_code to tell same-named places apart. Always resolve a location or language to an id here before passing it to campaign targeting or a geo report.",
+  examples: ['{"action":"location","name":"California","country_code":"US"}', '{"action":"language","name":"Japanese"}'],
+  handlers: [locationHandler, languageHandler]
+});
+
+// src/tools/registry.ts
+function registerAllTools(server, ctx) {
+  const tools = [accountTool, reportTool, campaignTool, adGroupTool, keywordTool, pmaxTool, lookupTool];
+  for (const tool of tools) {
+    server.registerTool(
+      tool.name,
+      {
+        description: tool.description,
+        annotations: tool.annotations,
+        inputSchema: tool.parameters
+      },
+      wrapForMcp(tool, ctx)
+    );
+  }
+}
+
+// src/tools/instructions.ts
+var ORIENTATION = "Google Ads (advertiser) tools for the user's connected account. Each tool takes an `action`; its action list, fields, and per-action help live on the tool itself. Below is only the cross-cutting map and the hard rules.";
+var DATA_MODEL = [
+  "DATA MODEL",
+  "- account (10-digit customer id, no dashes) > campaign > ad group > ads and keywords.",
+  "- Performance Max uses asset groups, not ad groups, and needs text plus image assets to serve.",
+  "- ROAS is computed as conversion value divided by cost. Average Position does not exist, use impression share instead. Quality Score only applies to Search keywords."
+].join("\n");
+var TOOLS = [
+  "TOOLS (capability summary; each tool lists and documents its own actions)",
+  "- google_ads_account (4): check connection/token, list and switch accounts, read the audit trail.",
+  "- google_ads_report (5): performance, impression share, P-MAX asset groups, and custom GAQL (call metadata first).",
+  "- google_ads_campaign (6): create campaigns and edit them (update, status, budget, bidding, targeting).",
+  "- google_ads_ad_group (6): ad groups and the ads inside them (create, update, status, list_ads, add_ad, ad_status).",
+  "- google_ads_keyword (3): list keywords, add positive/negative, update bid or status.",
+  "- google_ads_pmax (4): build and manage Performance Max asset groups and their image assets.",
+  "- google_ads_lookup (2): resolve a location or language name to the numeric id other tools need."
+].join("\n");
+var ROUTING = [
+  "QUICK REFERENCE (user says -> tool action)",
+  '- "check connection" -> account status ; "what accounts" -> account list ; "use account N" -> account switch',
+  '- "how are my ads doing" / "campaign performance" -> report campaign_performance (compare_previous for vs the prior period)',
+  '- "impression share" -> report impression_share (Search) ; "P-MAX asset performance" -> report asset_group',
+  '- "by day" / "trend" / "search terms" / "custom report" -> report metadata, then report gaql',
+  '- "create a campaign" -> campaign create ; rename/dates/networks -> campaign update ; pause/resume -> campaign status ; delete -> campaign status REMOVED ; budget/bidding/targeting -> the matching campaign action',
+  '- "make an ad group" -> ad_group create ; "write an ad" -> ad_group add_ad ; list/pause/remove ads -> ad_group list_ads / ad_status',
+  "- keywords -> keyword list/add/update (negative=true to exclude; status REMOVED to delete)",
+  '- "P-MAX assets" -> pmax create_asset_group, then add_images',
+  '- "target a place / a language" -> lookup location/language for the id, then campaign targeting'
+].join("\n");
+var RULES = [
+  "RULES",
+  '- Truth: while connected, this server is the source of truth for the account. Answer only from a tool result, or for a specific action from the schema for that action. Never state data, metrics, ids, or enums from memory, and never fabricate a number, row, id, or status. If a call returns nothing, say "no data" plainly.',
+  '- Confirmation (every write): never one-shot a write. (1) Call without confirmed to get a validate-only preview. (2) Show the exact field values to the user and ask them to type "yes" or "ok" (anything else = cancel). (3) Only after they type yes/ok in chat, call again with confirmed:true and user_confirmation:"yes" or "ok". Never invent approval; never set confirmed:true on the first call. If they change a value, preview again. Do not invent values the user did not give; ask about each meaningful choice, unless the user delegates it (e.g. "pick a random name").',
+  "- Legal and deletes: legal declarations (contains_eu_political_advertising) and permanent deletes (status REMOVED, pmax remove_asset) must be shown to the user verbatim; they must type yes or ok. Never auto-fill or silently default them.",
+  "- New campaigns and P-MAX asset groups are created PAUSED; nothing spends until the user enables them.",
+  "- Show human-readable names to the user, but pass ids between calls. Read ids from a list or report first; never invent customer, campaign, ad group, or criterion ids."
+].join("\n");
+var SERVER_INSTRUCTIONS = [ORIENTATION, DATA_MODEL, TOOLS, ROUTING, RULES].join("\n\n");
+
+// src/mcp/server.ts
+var SERVER_NAME = "google-ads-mcp";
+function packageVersion() {
+  try {
+    return createRequire2(import.meta.url)("../../package.json").version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var SERVER_VERSION = packageVersion();
+function createSessionServer(ctx) {
+  const server = new McpServer(
+    { name: SERVER_NAME, version: SERVER_VERSION },
+    {
+      capabilities: { logging: {}, tools: { listChanged: false } },
+      instructions: SERVER_INSTRUCTIONS
+    }
+  );
+  registerAllTools(server, ctx);
+  return server;
+}
+
+// src/mcp/requestAuth.ts
+import { AsyncLocalStorage } from "async_hooks";
+function bindRequestAuth(base2) {
+  const als = new AsyncLocalStorage();
+  const ctx = {
+    ...base2,
+    get credentials() {
+      return als.getStore()?.creds ?? null;
+    },
+    get oauthSessionId() {
+      return als.getStore()?.sessionId;
+    }
+  };
+  return {
+    ctx,
+    runWithAuth: (creds, sessionId, fn) => als.run({ creds, sessionId }, fn)
+  };
+}
+
+// src/oauth/google.ts
+import { OAuth2Client } from "google-auth-library";
+var ADWORDS_SCOPE = "https://www.googleapis.com/auth/adwords";
+function makeOAuthClient(opts) {
+  return new OAuth2Client({ clientId: opts.clientId, clientSecret: opts.clientSecret, redirectUri: opts.redirectUri });
+}
+function authUrl(client, state) {
+  return client.generateAuthUrl({
+    access_type: "offline",
+    // ask for a refresh token
+    prompt: "consent",
+    // force a NEW refresh token even on re-consent
+    scope: [ADWORDS_SCOPE],
+    include_granted_scopes: true,
+    state
+  });
+}
+async function exchangeCode(client, code) {
+  const { tokens } = await client.getToken(code);
+  return tokens.refresh_token ?? void 0;
+}
+
+// src/oauth/broker.ts
+var CONSENT_COOKIE = "gads_oauth";
+var OAuthBroker = class {
+  constructor(deps) {
+    this.deps = deps;
+    brandName = deps.appName;
+  }
+  deps;
+  url(path3) {
+    return `${this.deps.issuer}${path3}`;
+  }
+  /** Is redirect origin on the allowlist? Closes the open-DCR phishing vector: a code can only go to a trusted origin, never an attacker-controlled one. */
+  isRedirectAllowed(uri) {
+    return redirectMatchesAllowlist(uri, this.deps.allowedRedirectOrigins);
+  }
+  authServerMetadata() {
+    return {
+      kind: "json",
+      status: 200,
+      body: {
+        issuer: this.deps.issuer,
+        authorization_endpoint: this.url("/authorize"),
+        token_endpoint: this.url("/token"),
+        registration_endpoint: this.url("/register"),
+        revocation_endpoint: this.url("/revoke"),
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: [ADWORDS_SCOPE]
+      }
+    };
+  }
+  protectedResourceMetadata() {
+    return {
+      kind: "json",
+      status: 200,
+      body: { resource: this.url("/mcp"), authorization_servers: [this.deps.issuer] }
+    };
+  }
+  // Dynamic Client Registration (RFC 7591)
+  register(body) {
+    const b = body ?? {};
+    const uris = Array.isArray(b.redirect_uris) ? b.redirect_uris.filter((u) => typeof u === "string") : [];
+    if (!uris.length) return jsonErr(400, "invalid_client_metadata", "redirect_uris is required");
+    for (const u of uris) {
+      try {
+        new URL(u);
+      } catch {
+        return jsonErr(400, "invalid_redirect_uri", `not an absolute URL: ${u}`);
+      }
+      if (!this.isRedirectAllowed(u)) return jsonErr(400, "invalid_redirect_uri", `redirect origin is not on the allowlist: ${u}`);
+    }
+    const name = typeof b.client_name === "string" ? b.client_name : void 0;
+    const client = this.deps.store.registerClient(uris, name);
+    return {
+      kind: "json",
+      status: 201,
+      body: {
+        client_id: client.clientId,
+        redirect_uris: client.redirectUris,
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        ...name ? { client_name: name } : {}
+      }
+    };
+  }
+  // Authorization (GET /authorize) → consent page
+  authorize(q) {
+    const client = q.client_id ? this.deps.store.getClient(q.client_id) : null;
+    if (!client || !q.redirect_uri || !client.redirectUris.includes(q.redirect_uri) || !this.isRedirectAllowed(q.redirect_uri)) {
+      return errorPage("Invalid client or redirect URI", "The application is not registered, its redirect URL does not match, or that destination is not allowed. Start the connection again from the chat.", 400);
+    }
+    const redirectUri = q.redirect_uri;
+    const state = q.state;
+    const back = (error, desc) => ({ kind: "redirect", url: appendParams(redirectUri, { error, error_description: desc, ...state ? { state } : {} }) });
+    if (q.response_type !== "code") return back("unsupported_response_type", "only response_type=code is supported");
+    if (q.code_challenge_method !== "S256") return back("invalid_request", "PKCE with S256 is required");
+    if (!q.code_challenge) return back("invalid_request", "code_challenge is required");
+    if (!/^[A-Za-z0-9_-]{43}$/.test(q.code_challenge)) return back("invalid_request", "code_challenge must be a base64url-encoded S256 digest (43 chars)");
+    const txnState = this.deps.store.putTxn({ clientId: client.clientId, clientRedirectUri: redirectUri, clientState: state, pkceChallenge: q.code_challenge, createdMs: Date.now() });
+    return {
+      kind: "html",
+      status: 200,
+      cookies: [{ name: CONSENT_COOKIE, value: txnState, maxAgeSec: 600 }],
+      html: consentPage(client.clientName, txnState, this.url("/consent"), new URL(redirectUri).host)
+    };
+  }
+  // Consent (POST /consent) → redirect to Google
+  consent(formState, cookieState) {
+    if (!formState || !cookieState || formState !== cookieState) {
+      return { ...errorPage("Session expired", "This consent link is invalid or expired. Start again from the chat.", 400), cookies: [{ name: CONSENT_COOKIE, value: "", clear: true }] };
+    }
+    return { kind: "redirect", url: this.deps.buildGoogleAuthUrl(formState) };
+  }
+  // Google callback (GET /auth/callback)
+  async callback(q, cookieState) {
+    const clear = [{ name: CONSENT_COOKIE, value: "", clear: true }];
+    if (q.error) return { ...errorPage("Authorization cancelled", `Google returned: ${escapeHtml(q.error)}`, 400), cookies: clear };
+    if (!q.code || !q.state) return { ...errorPage("Invalid response", "Missing authorization code or state.", 400), cookies: clear };
+    if (!cookieState || cookieState !== q.state) {
+      return { ...errorPage("Could not verify sign-in", "This sign-in could not be verified in this browser. Start again from the chat.", 400), cookies: clear };
+    }
+    const txn = this.deps.store.takeTxn(q.state);
+    if (!txn) return { ...errorPage("Link expired", "This authorization expired or was already used. Start again from the chat.", 400), cookies: clear };
+    let refreshToken;
+    try {
+      refreshToken = await this.deps.exchangeCodeForRefreshToken(q.code);
+    } catch (e) {
+      this.deps.logger.error("oauth", "google token exchange failed", { error: errMsg(e) });
+      return { ...errorPage("Connection failed", "Could not complete authorization with Google. Please try again.", 502), cookies: clear };
+    }
+    if (!refreshToken) {
+      return { ...errorPage("No refresh token", "Google didn't return a refresh token. Remove this app under your Google Account \u2192 Security \u2192 Third-party access, then connect again.", 400), cookies: clear };
+    }
+    let accessible = [];
+    try {
+      accessible = await this.deps.listAccessibleCustomers(refreshToken);
+    } catch (e) {
+      this.deps.logger.warn("oauth", "could not list accessible customers (continuing)", { error: errMsg(e) });
+    }
+    const sessionId = this.deps.store.createSession({
+      clientId: txn.clientId,
+      googleRefreshToken: refreshToken,
+      scope: ADWORDS_SCOPE,
+      customerId: accessible[0] ?? null,
+      accessibleCustomers: accessible
+    });
+    const code = this.deps.store.issueCode({ clientId: txn.clientId, redirectUri: txn.clientRedirectUri, pkceChallenge: txn.pkceChallenge, sessionId });
+    this.deps.logger.info("oauth", "authorization granted", { accounts: accessible.length });
+    return { kind: "redirect", url: appendParams(txn.clientRedirectUri, { code, ...txn.clientState ? { state: txn.clientState } : {} }), cookies: clear };
+  }
+  // Token endpoint (POST /token)
+  token(body) {
+    const grant = body.grant_type;
+    if (grant === "authorization_code") {
+      if (!body.code || !body.code_verifier) return jsonErr(400, "invalid_request", "code and code_verifier are required");
+      if (!/^[A-Za-z0-9\-._~]{43,128}$/.test(body.code_verifier)) return jsonErr(400, "invalid_grant", "code_verifier must be 43-128 unreserved characters (RFC 7636)");
+      const info = this.deps.store.takeCode(body.code);
+      if (!info) return jsonErr(400, "invalid_grant", "authorization code is invalid or expired");
+      if (body.client_id && info.clientId !== body.client_id) return jsonErr(400, "invalid_grant", "client_id mismatch");
+      if (body.redirect_uri && info.redirectUri !== body.redirect_uri) return jsonErr(400, "invalid_grant", "redirect_uri mismatch");
+      if (!verifyPkceS256(body.code_verifier, info.pkceChallenge)) return jsonErr(400, "invalid_grant", "PKCE verification failed");
+      const access = this.deps.store.issueToken(info.sessionId, "access", ACCESS_TTL_MS);
+      const refresh = this.deps.store.issueToken(info.sessionId, "refresh", REFRESH_TTL_MS);
+      return tokenOk(access, refresh);
+    }
+    if (grant === "refresh_token") {
+      if (!body.refresh_token) return jsonErr(400, "invalid_request", "refresh_token is required");
+      const sessionId = this.deps.store.resolveToken(body.refresh_token, "refresh");
+      if (!sessionId) return jsonErr(400, "invalid_grant", "refresh token is invalid or expired");
+      this.deps.store.touchRefreshToken(body.refresh_token, REFRESH_TTL_MS);
+      this.deps.store.touchSession(sessionId);
+      return tokenOk(this.deps.store.issueToken(sessionId, "access", ACCESS_TTL_MS));
+    }
+    return jsonErr(400, "unsupported_grant_type", `unsupported grant_type: ${grant ?? "(none)"}`);
+  }
+  // Revocation (POST /revoke, RFC 7009)
+  revoke(body) {
+    if (body.token) {
+      const session = this.deps.store.resolveToken(body.token, "refresh");
+      if (session) this.deps.store.deleteSession(session);
+      else this.deps.store.revokeToken(body.token);
+    }
+    return { kind: "json", status: 200, body: {} };
+  }
+};
+function redirectMatchesAllowlist(uri, patterns) {
+  let u;
+  try {
+    u = new URL(uri);
+  } catch {
+    return false;
+  }
+  const host = u.hostname.toLowerCase();
+  const origin = u.origin.toLowerCase();
+  const httpsOrLocal = u.protocol === "https:" || host === "localhost" || host === "127.0.0.1";
+  for (const p2 of patterns) {
+    if (p2.includes("://")) {
+      if (origin === p2) return true;
+      continue;
+    }
+    if (!httpsOrLocal) continue;
+    if (p2.startsWith("*.")) {
+      const suffix = p2.slice(1);
+      if (host.length > suffix.length && host.endsWith(suffix)) return true;
+    } else if (host === p2) {
+      return true;
+    }
+  }
+  return false;
+}
+function tokenOk(access, refresh) {
+  return {
+    kind: "json",
+    status: 200,
+    body: { access_token: access, token_type: "Bearer", expires_in: Math.floor(ACCESS_TTL_MS / 1e3), ...refresh ? { refresh_token: refresh } : {}, scope: ADWORDS_SCOPE }
+  };
+}
+function jsonErr(status, error, description) {
+  return { kind: "json", status, body: { error, error_description: description } };
+}
+function appendParams(base2, params) {
+  const u = new URL(base2);
+  for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+  return u.toString();
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function errMsg(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+var PAGE_CSS = `
+*,*::before,*::after{box-sizing:border-box}
+:root{
+  color-scheme:light;
+  --bg:oklch(0.984 0.004 255); --surface:oklch(0.997 0.0015 255);
+  --ink:oklch(0.27 0.03 262); --muted:oklch(0.52 0.028 260); --faint:oklch(0.60 0.02 260);
+  --line:oklch(0.915 0.012 255);
+  --accent:oklch(0.50 0.15 255); --accent-press:oklch(0.43 0.15 255);
+  --on-accent:oklch(0.99 0.01 255); --ring:oklch(0.50 0.15 255 / 0.35);
+  --positive:oklch(0.55 0.11 162); --danger:oklch(0.55 0.17 25);
+  --shadow:0 1px 2px oklch(0.27 0.03 262 / 0.05), 0 14px 36px -14px oklch(0.27 0.03 262 / 0.20);
+  --font-display:ui-serif,"Iowan Old Style","Palatino Linotype",Palatino,"Book Antiqua",Georgia,serif;
+  --font-body:-apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;
+  --font-mono:ui-monospace,"SF Mono","Cascadia Code",Menlo,monospace;
+}
+@media (prefers-color-scheme:dark){
+  :root{
+    color-scheme:dark;
+    --bg:oklch(0.205 0.02 262); --surface:oklch(0.25 0.022 262);
+    --ink:oklch(0.96 0.008 255); --muted:oklch(0.74 0.02 256); --faint:oklch(0.62 0.02 256);
+    --line:oklch(0.36 0.02 262);
+    --accent:oklch(0.72 0.13 255); --accent-press:oklch(0.66 0.13 255);
+    --on-accent:oklch(0.18 0.03 262); --ring:oklch(0.72 0.13 255 / 0.40);
+    --positive:oklch(0.74 0.12 162); --danger:oklch(0.70 0.15 25);
+    --shadow:0 1px 2px oklch(0 0 0 / 0.3), 0 20px 50px -18px oklch(0 0 0 / 0.6);
+  }
+}
+html{-webkit-text-size-adjust:100%}
+body{
+  margin:0; min-height:100svh; padding:24px; background:var(--bg); color:var(--ink);
+  font-family:var(--font-body); line-height:1.55; -webkit-font-smoothing:antialiased;
+  text-rendering:optimizeLegibility; display:grid; place-items:center;
+  background-image:radial-gradient(120% 70% at 50% -8%, oklch(0.50 0.15 255 / 0.06), transparent 60%);
+}
+.card{
+  width:100%; max-width:30rem; background:var(--surface); border:1px solid var(--line);
+  border-radius:18px; box-shadow:var(--shadow); padding:clamp(28px,5vw,44px);
+}
+.brand{display:flex; align-items:center; gap:10px; margin-bottom:30px}
+.brand b{font-weight:600; font-size:.94rem; letter-spacing:-0.01em}
+.eyebrow,.status{font-size:.72rem; letter-spacing:.14em; text-transform:uppercase; font-weight:600; margin:0 0 12px}
+.eyebrow{color:var(--faint)}
+.status{display:inline-flex; align-items:center; gap:8px; color:var(--danger)}
+.status .dot{width:7px; height:7px; border-radius:50%; background:var(--danger)}
+h1{
+  font-family:var(--font-display); font-weight:600; line-height:1.08; letter-spacing:-0.015em;
+  font-size:clamp(1.7rem, 1.15rem + 2.3vw, 2.3rem); margin:0 0 18px; color:var(--ink); text-wrap:balance;
+}
+.lead,.msg{font-size:1.02rem; color:var(--muted); margin:0 0 24px; max-width:36ch}
+.lead b{color:var(--ink); font-weight:600}
+ul.assurances{list-style:none; margin:0 0 26px; padding:0; display:grid; gap:13px}
+ul.assurances li{display:grid; grid-template-columns:18px 1fr; gap:11px; align-items:start; font-size:.94rem; color:var(--ink)}
+ul.assurances svg{margin-top:3px; color:var(--positive)}
+.return-block{margin:0 0 28px}
+.return{font-size:.88rem; color:var(--muted); margin:0 0 6px}
+.return .host{font-family:var(--font-mono); font-size:.82rem; color:var(--ink); background:oklch(0.50 0.15 255 / 0.09); padding:1px 7px; border-radius:6px}
+.caution{font-size:.8rem; color:var(--faint); margin:0}
+.btn{
+  appearance:none; cursor:pointer; width:100%; border:0; border-radius:12px;
+  font-family:var(--font-body); font-size:1rem; font-weight:600; letter-spacing:-0.005em;
+  color:var(--on-accent); background:var(--accent); padding:14px 20px;
+  display:inline-flex; align-items:center; justify-content:center; gap:9px;
+  box-shadow:0 1px 0 oklch(1 0 0 / 0.16) inset, 0 8px 20px -10px var(--accent);
+  transition:background .15s ease, transform .12s cubic-bezier(.2,.7,.3,1);
+}
+.btn:hover{background:var(--accent-press)}
+.btn:active{transform:translateY(1px)}
+.btn:focus-visible{outline:3px solid var(--ring); outline-offset:2px}
+.btn .arrow{transition:transform .2s cubic-bezier(.2,.7,.3,1)}
+.btn:hover .arrow{transform:translateX(3px)}
+.foot{margin:18px 0 0; font-size:.8rem; color:var(--faint)}
+@media (prefers-reduced-motion:no-preference){
+  .card>*{animation:rise .5s cubic-bezier(.2,.7,.3,1) both}
+  .card>*:nth-child(2){animation-delay:.04s}
+  .card>*:nth-child(3){animation-delay:.08s}
+  .card>*:nth-child(4){animation-delay:.12s}
+  .card>*:nth-child(5){animation-delay:.16s}
+  .card>*:nth-child(6){animation-delay:.20s}
+  .card>*:nth-child(7){animation-delay:.24s}
+  .card>*:nth-child(8){animation-delay:.28s}
+  @keyframes rise{from{opacity:0; transform:translateY(9px)}to{opacity:1; transform:none}}
+}`;
+var BRAND_MARK = `<svg width="22" height="22" viewBox="0 0 22 22" fill="none" aria-hidden="true"><path d="M5 16 11 5l6 11" stroke="var(--accent)" stroke-width="1.6" stroke-linejoin="round"/><circle cx="5" cy="16" r="2.4" fill="var(--accent)"/><circle cx="17" cy="16" r="2.4" fill="var(--accent)"/><circle cx="11" cy="5" r="2.4" fill="var(--accent)"/></svg>`;
+var CHECK = `<svg width="18" height="18" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M3 8.5 6.5 12 13 4.5" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+var ARROW = `<svg class="arrow" width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="M3.5 9H13M9 4.5 13.5 9 9 13.5" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+var brandName = "Google Ads MCP";
+function brandLockup() {
+  return `<div class="brand">${BRAND_MARK}<b>${escapeHtml(brandName)}</b></div>`;
+}
+function shell(titleText, inner) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex">
+<title>${escapeHtml(titleText)}</title><style>${PAGE_CSS}</style></head>
+<body><main class="card">${inner}</main></body></html>`;
+}
+function errorPage(title, message, status) {
+  const inner = `${brandLockup()}
+<p class="status"><span class="dot"></span>Couldn't continue</p>
+<h1>${escapeHtml(title)}</h1>
+<p class="msg">${escapeHtml(message)}</p>
+<p class="foot">${escapeHtml(brandName)} \xB7 secure connection to Google Ads</p>`;
+  return { kind: "html", status, html: shell(title, inner) };
+}
+function consentPage(clientName, state, action, redirectHost) {
+  const who = clientName ? escapeHtml(clientName) : "An application";
+  const inner = `${brandLockup()}
+<p class="eyebrow">Authorize access</p>
+<h1>Connect your Google Ads account</h1>
+<p class="lead"><b>${who}</b> is requesting access to manage your <b>Google&nbsp;Ads</b> account.</p>
+<ul class="assurances">
+  <li>${CHECK}<span>Google handles sign-in. We never see your password.</span></li>
+  <li>${CHECK}<span>The application never receives your Google token.</span></li>
+  <li>${CHECK}<span>Your authorization is stored encrypted on this server.</span></li>
+</ul>
+<div class="return-block">
+  <p class="return">After you approve, you return to <span class="host">${escapeHtml(redirectHost)}</span>.</p>
+  <p class="caution">Only continue if you started this connection yourself, from your AI chat.</p>
+</div>
+<form method="post" action="${escapeHtml(action)}">
+  <input type="hidden" name="state" value="${escapeHtml(state)}">
+  <button class="btn" type="submit"><span>Continue to Google</span>${ARROW}</button>
+</form>
+<p class="foot">You can revoke access anytime in your Google Account under Security.</p>`;
+  return shell("Connect Google Ads", inner);
+}
+
+// src/oauth/routes.ts
+import { getCookie, setCookie, deleteCookie } from "hono/cookie";
+function send(c, r) {
+  for (const ck of r.cookies ?? []) applyCookie(c, ck);
+  if (r.kind === "redirect") return c.redirect(r.url, 302);
+  if (r.kind === "html") {
+    c.header("X-Frame-Options", "DENY");
+    c.header("Content-Security-Policy", "frame-ancestors 'none'");
+    return c.html(r.html, r.status);
+  }
+  return c.json(r.body, r.status);
+}
+function applyCookie(c, ck) {
+  if (ck.clear) {
+    deleteCookie(c, ck.name, { path: "/" });
+    return;
+  }
+  setCookie(c, ck.name, ck.value, { httpOnly: true, secure: true, sameSite: "Lax", path: "/", maxAge: ck.maxAgeSec });
+}
+function queryObj(c) {
+  return c.req.query();
+}
+async function readForm(c) {
+  const ct = c.req.header("content-type") ?? "";
+  const raw = ct.includes("application/json") ? await c.req.json().catch(() => ({})) : await c.req.parseBody().catch(() => ({}));
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) if (typeof v === "string") out[k] = v;
+  return out;
+}
+function registerOAuthRoutes(app, broker) {
+  app.get("/.well-known/oauth-authorization-server", (c) => send(c, broker.authServerMetadata()));
+  app.get("/.well-known/oauth-protected-resource", (c) => send(c, broker.protectedResourceMetadata()));
+  app.post("/register", async (c) => send(c, broker.register(await c.req.json().catch(() => ({})))));
+  app.get("/authorize", (c) => send(c, broker.authorize(queryObj(c))));
+  app.post("/consent", async (c) => {
+    const form = await c.req.parseBody().catch(() => ({}));
+    const state = typeof form.state === "string" ? form.state : void 0;
+    return send(c, broker.consent(state, getCookie(c, CONSENT_COOKIE)));
+  });
+  app.get("/auth/callback", async (c) => send(c, await broker.callback(queryObj(c), getCookie(c, CONSENT_COOKIE))));
+  app.post("/token", async (c) => send(c, broker.token(await readForm(c))));
+  app.post("/revoke", async (c) => send(c, broker.revoke(await readForm(c))));
+}
+
+// src/app.ts
+async function startHttp(config, deps) {
+  const { ads, audit, logger, store } = deps;
+  const pageCache = new PageCache();
+  const oauthLimiter = new RateLimiter(60, 6e4);
+  const mcpLimiter = new RateLimiter(120, 6e4);
+  const makeServer = () => {
+    const { ctx, runWithAuth } = bindRequestAuth({ ads, mode: "http", pageCache, audit, logger, oauthStore: store });
+    const server2 = createSessionServer(ctx);
+    return { server: server2, runWithAuth };
+  };
+  const sessions = new McpSessionManager(makeServer, logger);
+  const redirectUri = `${config.publicBaseUrl}/auth/callback`;
+  const googleClient = () => makeOAuthClient({ clientId: config.oauthClientId, clientSecret: config.oauthClientSecret, redirectUri });
+  const broker = new OAuthBroker({
+    store,
+    issuer: config.publicBaseUrl,
+    allowedRedirectOrigins: config.allowedRedirectOrigins,
+    buildGoogleAuthUrl: (state) => authUrl(googleClient(), state),
+    exchangeCodeForRefreshToken: (code) => exchangeCode(googleClient(), code),
+    listAccessibleCustomers: (rt) => ads.listAccessibleCustomers(rt),
+    logger,
+    appName: config.appName
+  });
+  const app = new Hono();
+  app.use("*", bodyLimit({ maxSize: 1024 * 1024, onError: (c) => c.json({ error: "Request body too large (max 1MB)." }, 413) }));
+  const clientIp = (c) => {
+    const xff = c.req.header("x-forwarded-for");
+    if (xff) return xff.split(",")[0].trim();
+    const remote = c.env?.incoming?.socket?.remoteAddress;
+    return remote || "unknown";
+  };
+  app.get("/healthz", (c) => c.json({ status: "ok", mode: "http" }));
+  app.use("/register", async (c, next) => {
+    if (!oauthLimiter.allow(`reg:${clientIp(c)}`)) return c.json({ error: "rate_limit", message: "Too many registration requests. Retry later." }, 429);
+    return next();
+  });
+  app.use("/token", async (c, next) => {
+    if (!oauthLimiter.allow(`tok:${clientIp(c)}`)) return c.json({ error: "rate_limit", message: "Too many token requests. Retry later." }, 429);
+    return next();
+  });
+  app.use("/authorize", async (c, next) => {
+    if (!oauthLimiter.allow(`authz:${clientIp(c)}`)) return c.text("Too many authorize requests. Retry later.", 429);
+    return next();
+  });
+  app.use("/consent", async (c, next) => {
+    if (!oauthLimiter.allow(`consent:${clientIp(c)}`)) return c.text("Too many consent requests. Retry later.", 429);
+    return next();
+  });
+  registerOAuthRoutes(app, broker);
+  const resolveSession = (c) => {
+    const auth = c.req.header("authorization") ?? "";
+    const token = auth.startsWith("Bearer ") ? auth.slice(7).trim() : "";
+    const sessionId = token ? store.resolveToken(token, "access") : null;
+    if (!sessionId) return null;
+    const session = store.getSession(sessionId);
+    const refreshToken = session ? store.getGoogleRefreshToken(sessionId) : null;
+    if (!session || !refreshToken) return null;
+    store.touchSession(sessionId);
+    return { creds: { refreshToken, customerId: session.customerId ?? "" }, sessionId };
+  };
+  const wwwAuth = `Bearer resource_metadata="${config.publicBaseUrl}/.well-known/oauth-protected-resource"`;
+  const rateLimitMcp = (c) => mcpLimiter.allow(`mcp:${clientIp(c)}`);
+  app.post("/mcp", async (c) => {
+    if (!rateLimitMcp(c)) return c.json({ error: "rate_limit", message: "Too many MCP requests. Retry later." }, 429);
+    const s = resolveSession(c);
+    if (!s) {
+      c.header("WWW-Authenticate", wwwAuth);
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const body = await c.req.json().catch(() => void 0);
+    await sessions.handlePost(c.env.incoming, c.env.outgoing, body, s.creds, s.sessionId);
+    return RESPONSE_ALREADY_SENT;
+  });
+  app.get("/mcp", async (c) => {
+    if (!rateLimitMcp(c)) return c.json({ error: "rate_limit", message: "Too many MCP requests. Retry later." }, 429);
+    const s = resolveSession(c);
+    if (!s) {
+      c.header("WWW-Authenticate", wwwAuth);
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    await sessions.handleGet(c.env.incoming, c.env.outgoing);
+    return RESPONSE_ALREADY_SENT;
+  });
+  app.delete("/mcp", async (c) => {
+    if (!rateLimitMcp(c)) return c.json({ error: "rate_limit", message: "Too many MCP requests. Retry later." }, 429);
+    const s = resolveSession(c);
+    if (!s) {
+      c.header("WWW-Authenticate", wwwAuth);
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    await sessions.handleDelete(c.env.incoming, c.env.outgoing);
+    return RESPONSE_ALREADY_SENT;
+  });
+  const server = serve(
+    {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      fetch: app.fetch,
+      port: config.port,
+      hostname: "0.0.0.0"
+    },
+    () => {
+      logger.info("http", `listening on :${config.port}`);
+      runStartupChecks(config, logger);
+    }
+  );
+  server.on("error", (err) => {
+    const cause = err.code === "EADDRINUSE" ? `port ${config.port} is already in use (another instance running? set PORT to a free port)` : `server error: ${err.message}`;
+    logger.error("http", cause, { error: err.stack ?? err.message });
+    process.exit(1);
+  });
+  const sweep = setInterval(() => store.sweepExpired(), 10 * 6e4);
+  sweep.unref?.();
+  return {
+    async close() {
+      clearInterval(sweep);
+      sessions.close();
+      const srv = server;
+      await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          srv.closeAllConnections?.();
+          resolve();
+        }, 5e3);
+        timer.unref?.();
+        srv.close(() => {
+          clearTimeout(timer);
+          resolve();
+        });
+      });
+    }
+  };
+}
+
+// src/transports/stdio.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+async function startStdio(ctx) {
+  const server = createSessionServer(ctx);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// src/index.ts
+function parseMode(argv) {
+  if (argv.includes("--http")) return "http";
+  if (argv.includes("--stdio")) return "stdio";
+  return "stdio";
+}
+var USAGE = `google-ads-mcp: Google Ads API MCP server (stdio or http)
+
+Usage: google-ads-mcp [--stdio | --http]
+
+  --stdio   default; single account over stdio (Claude Code / local).
+            Env: GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_OAUTH_CLIENT_ID,
+            GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_ADS_REFRESH_TOKEN,
+            GOOGLE_ADS_CUSTOMER_ID.
+  --http    multi-tenant HTTP with a built-in OAuth broker (for hosted AI chat platforms).
+            Needs Node >= 22.5. See the README for the env it wants.
+
+  -h, --help      print this help
+  -v, --version   print the version
+
+Any config value can also be a flag instead of an env var (env name lowercased,
+dashes for underscores): --app-name="My Ads Bot", --port=3002, --log-level=debug,
+--no-require-user-confirmation.
+`;
+function version() {
+  try {
+    return createRequire3(import.meta.url)("../package.json").version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(USAGE);
+    return;
+  }
+  if (argv.includes("--version") || argv.includes("-v")) {
+    process.stdout.write(`${version()}
+`);
+    return;
+  }
+  const { env: flagEnv, unknown } = parseConfigFlags(argv);
+  for (const flag of unknown) process.stderr.write(`google-ads-mcp: ignoring unknown flag --${flag}
+`);
+  Object.assign(process.env, flagEnv);
+  const mode = parseMode(argv);
+  const config = loadConfig(mode);
+  const logger = new Logger(config.logLevel);
+  process.on("unhandledRejection", (reason) => {
+    logger.error("main", "unhandled promise rejection", {
+      error: reason instanceof Error ? reason.stack ?? reason.message : String(reason)
+    });
+  });
+  process.on("uncaughtException", (err) => {
+    logger.error("main", "uncaught exception, exiting", { error: err.stack ?? err.message });
+    process.exit(1);
+  });
+  const ads = new AdsService({
+    developerToken: config.developerToken,
+    clientId: config.oauthClientId,
+    clientSecret: config.oauthClientSecret
+  });
+  if (mode === "stdio") {
+    const audit2 = new Audit(null, logger);
+    const credentials = config.refreshToken && config.customerId ? { refreshToken: config.refreshToken, customerId: config.customerId, loginCustomerId: config.loginCustomerId || void 0 } : null;
+    if (!credentials) {
+      logger.warn("main", 'stdio: GOOGLE_ADS_REFRESH_TOKEN / GOOGLE_ADS_CUSTOMER_ID not set, tools will report "not connected" until provided');
+    }
+    const ctx = { ads, credentials, mode: "stdio", pageCache: new PageCache(), audit: audit2, logger };
+    await startStdio(ctx);
+    logger.info("main", "stdio MCP server ready");
+    return;
+  }
+  const db = openDb(config.auditDbPath);
+  const audit = new Audit(db, logger);
+  const store = new OAuthStore(db, loadEncKey(config.tokenEncKey));
+  const running = await startHttp(config, { ads, audit, logger, store });
+  const shutdown = (sig) => {
+    logger.info("main", `received ${sig}, shutting down`);
+    const hard = setTimeout(() => process.exit(1), 8e3);
+    hard.unref?.();
+    running.close().finally(() => {
+      try {
+        db.close();
+      } catch {
+      }
+      clearTimeout(hard);
+      process.exit(0);
+    });
+  };
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+}
+main().catch((err) => {
+  process.stderr.write(`fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}
+`);
+  process.exit(1);
+});