@canonry/canonry 4.164.0 → 4.165.0

package/assets/assets/{react-sigma_core.esm.min-sVSSzmzq.js → react-sigma_core.esm.min-BtG8TWTe.js}

@@ -1,4 +1,4 @@
-import{g as Bt,t as S,r as C}from"./vendor-tanstack-Dock0eH1.js";import{e as Ht,G as Wt}from"./SiteHealthSection-DvuvziPJ.js";import"./index-C_y0aGQL.js";import"./vendor-radix-4UOaVWza.js";import"./vendor-recharts-D8rt5lKn.js";import"./vendor-lucide-nYKv-BB7.js";import"./vendor-markdown-Bn7fRwrx.js";import"./vendor-yaml-GWJz5H2G.js";import"./ChartPrimitives-BoYe2M-i.js";function Vt(r,n){if(typeof r!="object"||!r)return r;var i=r[Symbol.toPrimitive];if(i!==void 0){var e=i.call(r,n);if(typeof e!="object")return e;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(r)}function ae(r){var n=Vt(r,"string");return typeof n=="symbol"?n:n+""}function A(r,n){if(!(r instanceof n))throw new TypeError("Cannot call a class as a function")}function He(r,n){for(var i=0;i<n.length;i++){var e=n[i];e.enumerable=e.enumerable||!1,e.configurable=!0,"value"in e&&(e.writable=!0),Object.defineProperty(r,ae(e.key),e)}}function L(r,n,i){return n&&He(r.prototype,n),i&&He(r,i),Object.defineProperty(r,"prototype",{writable:!1}),r}function Q(r){return Q=Object.setPrototypeOf?Object.getPrototypeOf.bind():function(n){return n.__proto__||Object.getPrototypeOf(n)},Q(r)}function yt(){try{var r=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){}))}catch{}return(yt=function(){return!!r})()}function jt(r){if(r===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return r}function Zt(r,n){if(n&&(typeof n=="object"||typeof n=="function"))return n;if(n!==void 0)throw new TypeError("Derived constructors may only return object or undefined");return jt(r)}function I(r,n,i){return n=Q(n),Zt(r,yt()?Reflect.construct(n,i||[],Q(r).constructor):n.apply(r,i))}function xe(r,n){return xe=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(i,e){return i.__proto__=e,i},xe(r,n)}function G(r,n){if(typeof n!="function"&&n!==null)throw new TypeError("Super expression must either be null or a function");r.prototype=Object.create(n&&n.prototype,{constructor:{value:r,writable:!0,configurable:!0}}),Object.defineProperty(r,"prototype",{writable:!1}),n&&xe(r,n)}function qt(r){if(Array.isArray(r))return r}function Yt(r,n){var i=r==null?null:typeof Symbol<"u"&&r[Symbol.iterator]||r["@@iterator"];if(i!=null){var e,t,a,o,s=[],l=!0,h=!1;try{if(a=(i=i.call(r)).next,n===0){if(Object(i)!==i)return;l=!1}else for(;!(l=(e=a.call(i)).done)&&(s.push(e.value),s.length!==n);l=!0);}catch(u){h=!0,t=u}finally{try{if(!l&&i.return!=null&&(o=i.return(),Object(o)!==o))return}finally{if(h)throw t}}return s}}function Se(r,n){(n==null||n>r.length)&&(n=r.length);for(var i=0,e=Array(n);i<n;i++)e[i]=r[i];return e}function Tt(r,n){if(r){if(typeof r=="string")return Se(r,n);var i={}.toString.call(r).slice(8,-1);return i==="Object"&&r.constructor&&(i=r.constructor.name),i==="Map"||i==="Set"?Array.from(r):i==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(i)?Se(r,n):void 0}}function Xt(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
+import{g as Bt,t as S,r as C}from"./vendor-tanstack-Dock0eH1.js";import{e as Ht,G as Wt}from"./SiteHealthSection-k4I71wfJ.js";import"./index-rqOXhYwp.js";import"./vendor-radix-4UOaVWza.js";import"./vendor-recharts-D8rt5lKn.js";import"./vendor-lucide-nYKv-BB7.js";import"./vendor-markdown-Bn7fRwrx.js";import"./vendor-yaml-GWJz5H2G.js";import"./ChartPrimitives-BoYe2M-i.js";function Vt(r,n){if(typeof r!="object"||!r)return r;var i=r[Symbol.toPrimitive];if(i!==void 0){var e=i.call(r,n);if(typeof e!="object")return e;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(r)}function ae(r){var n=Vt(r,"string");return typeof n=="symbol"?n:n+""}function A(r,n){if(!(r instanceof n))throw new TypeError("Cannot call a class as a function")}function He(r,n){for(var i=0;i<n.length;i++){var e=n[i];e.enumerable=e.enumerable||!1,e.configurable=!0,"value"in e&&(e.writable=!0),Object.defineProperty(r,ae(e.key),e)}}function L(r,n,i){return n&&He(r.prototype,n),i&&He(r,i),Object.defineProperty(r,"prototype",{writable:!1}),r}function Q(r){return Q=Object.setPrototypeOf?Object.getPrototypeOf.bind():function(n){return n.__proto__||Object.getPrototypeOf(n)},Q(r)}function yt(){try{var r=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){}))}catch{}return(yt=function(){return!!r})()}function jt(r){if(r===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return r}function Zt(r,n){if(n&&(typeof n=="object"||typeof n=="function"))return n;if(n!==void 0)throw new TypeError("Derived constructors may only return object or undefined");return jt(r)}function I(r,n,i){return n=Q(n),Zt(r,yt()?Reflect.construct(n,i||[],Q(r).constructor):n.apply(r,i))}function xe(r,n){return xe=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(i,e){return i.__proto__=e,i},xe(r,n)}function G(r,n){if(typeof n!="function"&&n!==null)throw new TypeError("Super expression must either be null or a function");r.prototype=Object.create(n&&n.prototype,{constructor:{value:r,writable:!0,configurable:!0}}),Object.defineProperty(r,"prototype",{writable:!1}),n&&xe(r,n)}function qt(r){if(Array.isArray(r))return r}function Yt(r,n){var i=r==null?null:typeof Symbol<"u"&&r[Symbol.iterator]||r["@@iterator"];if(i!=null){var e,t,a,o,s=[],l=!0,h=!1;try{if(a=(i=i.call(r)).next,n===0){if(Object(i)!==i)return;l=!1}else for(;!(l=(e=a.call(i)).done)&&(s.push(e.value),s.length!==n);l=!0);}catch(u){h=!0,t=u}finally{try{if(!l&&i.return!=null&&(o=i.return(),Object(o)!==o))return}finally{if(h)throw t}}return s}}function Se(r,n){(n==null||n>r.length)&&(n=r.length);for(var i=0,e=Array(n);i<n;i++)e[i]=r[i];return e}function Tt(r,n){if(r){if(typeof r=="string")return Se(r,n);var i={}.toString.call(r).slice(8,-1);return i==="Object"&&r.constructor&&(i=r.constructor.name),i==="Map"||i==="Set"?Array.from(r):i==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(i)?Se(r,n):void 0}}function Xt(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
 In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ee(r,n){return qt(r)||Yt(r,n)||Tt(r,n)||Xt()}var pe={black:"#000000",silver:"#C0C0C0",gray:"#808080",grey:"#808080",white:"#FFFFFF",maroon:"#800000",red:"#FF0000",purple:"#800080",fuchsia:"#FF00FF",green:"#008000",lime:"#00FF00",olive:"#808000",yellow:"#FFFF00",navy:"#000080",blue:"#0000FF",teal:"#008080",aqua:"#00FFFF",darkblue:"#00008B",mediumblue:"#0000CD",darkgreen:"#006400",darkcyan:"#008B8B",deepskyblue:"#00BFFF",darkturquoise:"#00CED1",mediumspringgreen:"#00FA9A",springgreen:"#00FF7F",cyan:"#00FFFF",midnightblue:"#191970",dodgerblue:"#1E90FF",lightseagreen:"#20B2AA",forestgreen:"#228B22",seagreen:"#2E8B57",darkslategray:"#2F4F4F",darkslategrey:"#2F4F4F",limegreen:"#32CD32",mediumseagreen:"#3CB371",turquoise:"#40E0D0",royalblue:"#4169E1",steelblue:"#4682B4",darkslateblue:"#483D8B",mediumturquoise:"#48D1CC",indigo:"#4B0082",darkolivegreen:"#556B2F",cadetblue:"#5F9EA0",cornflowerblue:"#6495ED",rebeccapurple:"#663399",mediumaquamarine:"#66CDAA",dimgray:"#696969",dimgrey:"#696969",slateblue:"#6A5ACD",olivedrab:"#6B8E23",slategray:"#708090",slategrey:"#708090",lightslategray:"#778899",lightslategrey:"#778899",mediumslateblue:"#7B68EE",lawngreen:"#7CFC00",chartreuse:"#7FFF00",aquamarine:"#7FFFD4",skyblue:"#87CEEB",lightskyblue:"#87CEFA",blueviolet:"#8A2BE2",darkred:"#8B0000",darkmagenta:"#8B008B",saddlebrown:"#8B4513",darkseagreen:"#8FBC8F",lightgreen:"#90EE90",mediumpurple:"#9370DB",darkviolet:"#9400D3",palegreen:"#98FB98",darkorchid:"#9932CC",yellowgreen:"#9ACD32",sienna:"#A0522D",brown:"#A52A2A",darkgray:"#A9A9A9",darkgrey:"#A9A9A9",lightblue:"#ADD8E6",greenyellow:"#ADFF2F",paleturquoise:"#AFEEEE",lightsteelblue:"#B0C4DE",powderblue:"#B0E0E6",firebrick:"#B22222",darkgoldenrod:"#B8860B",mediumorchid:"#BA55D3",rosybrown:"#BC8F8F",darkkhaki:"#BDB76B",mediumvioletred:"#C71585",indianred:"#CD5C5C",peru:"#CD853F",chocolate:"#D2691E",tan:"#D2B48C",lightgray:"#D3D3D3",lightgrey:"#D3D3D3",thistle:"#D8BFD8",orchid:"#DA70D6",goldenrod:"#DAA520",palevioletred:"#DB7093",crimson:"#DC143C",gainsboro:"#DCDCDC",plum:"#DDA0DD",burlywood:"#DEB887",lightcyan:"#E0FFFF",lavender:"#E6E6FA",darksalmon:"#E9967A",violet:"#EE82EE",palegoldenrod:"#EEE8AA",lightcoral:"#F08080",khaki:"#F0E68C",aliceblue:"#F0F8FF",honeydew:"#F0FFF0",azure:"#F0FFFF",sandybrown:"#F4A460",wheat:"#F5DEB3",beige:"#F5F5DC",whitesmoke:"#F5F5F5",mintcream:"#F5FFFA",ghostwhite:"#F8F8FF",salmon:"#FA8072",antiquewhite:"#FAEBD7",linen:"#FAF0E6",lightgoldenrodyellow:"#FAFAD2",oldlace:"#FDF5E6",magenta:"#FF00FF",deeppink:"#FF1493",orangered:"#FF4500",tomato:"#FF6347",hotpink:"#FF69B4",coral:"#FF7F50",darkorange:"#FF8C00",lightsalmon:"#FFA07A",orange:"#FFA500",lightpink:"#FFB6C1",pink:"#FFC0CB",gold:"#FFD700",peachpuff:"#FFDAB9",navajowhite:"#FFDEAD",moccasin:"#FFE4B5",bisque:"#FFE4C4",mistyrose:"#FFE4E1",blanchedalmond:"#FFEBCD",papayawhip:"#FFEFD5",lavenderblush:"#FFF0F5",seashell:"#FFF5EE",cornsilk:"#FFF8DC",lemonchiffon:"#FFFACD",floralwhite:"#FFFAF0",snow:"#FFFAFA",lightyellow:"#FFFFE0",ivory:"#FFFFF0"},Ct=new Int8Array(4),be=new Int32Array(Ct.buffer,0,1),$t=new Float32Array(Ct.buffer,0,1),Kt=/^\s*rgba?\s*\(/,Jt=/^\s*rgba?\s*\(\s*([0-9]*)\s*,\s*([0-9]*)\s*,\s*([0-9]*)(?:\s*,\s*(.*)?)?\)\s*$/;function Qt(r){var n=0,i=0,e=0,t=1;if(r[0]==="#")r.length===4?(n=parseInt(r.charAt(1)+r.charAt(1),16),i=parseInt(r.charAt(2)+r.charAt(2),16),e=parseInt(r.charAt(3)+r.charAt(3),16)):(n=parseInt(r.charAt(1)+r.charAt(2),16),i=parseInt(r.charAt(3)+r.charAt(4),16),e=parseInt(r.charAt(5)+r.charAt(6),16)),r.length===9&&(t=parseInt(r.charAt(7)+r.charAt(8),16)/255);else if(Kt.test(r)){var a=r.match(Jt);a&&(n=+a[1],i=+a[2],e=+a[3],a[4]&&(t=+a[4]))}return{r:n,g:i,b:e,a:t}}var J={};for(var le in pe)J[le]=oe(pe[le]),J[pe[le]]=J[le];function Rt(r,n,i,e,t){return be[0]=e<<24|i<<16|n<<8|r,be[0]=be[0]&4278190079,$t[0]}function oe(r){if(r=r.toLowerCase(),typeof J[r]<"u")return J[r];var n=Qt(r),i=n.r,e=n.g,t=n.b,a=n.a;a=a*255|0;var o=Rt(i,e,t,a);return J[r]=o,o}var Ee={};function _t(r){if(typeof Ee[r]<"u")return Ee[r];var n=(r&16711680)>>>16,i=(r&65280)>>>8,e=r&255,t=255,a=Rt(n,i,e,t);return Ee[r]=a,a}function We(r,n,i,e){return i+(n<<8)+(r<<16)}function Ve(r,n,i,e,t,a){var o=Math.floor(i/a*t),s=Math.floor(r.drawingBufferHeight/a-e/a*t),l=new Uint8Array(4);r.bindFramebuffer(r.FRAMEBUFFER,n),r.readPixels(o,s,1,1,r.RGBA,r.UNSIGNED_BYTE,l);var h=ee(l,4),u=h[0],d=h[1],f=h[2],g=h[3];return[u,d,f,g]}function c(r,n,i){return(n=ae(n))in r?Object.defineProperty(r,n,{value:i,enumerable:!0,configurable:!0,writable:!0}):r[n]=i,r}function je(r,n){var i=Object.keys(r);if(Object.getOwnPropertySymbols){var e=Object.getOwnPropertySymbols(r);n&&(e=e.filter(function(t){return Object.getOwnPropertyDescriptor(r,t).enumerable})),i.push.apply(i,e)}return i}function b(r){for(var n=1;n<arguments.length;n++){var i=arguments[n]!=null?arguments[n]:{};n%2?je(Object(i),!0).forEach(function(e){c(r,e,i[e])}):Object.getOwnPropertyDescriptors?Object.defineProperties(r,Object.getOwnPropertyDescriptors(i)):je(Object(i)).forEach(function(e){Object.defineProperty(r,e,Object.getOwnPropertyDescriptor(i,e))})}return r}function ei(r,n){for(;!{}.hasOwnProperty.call(r,n)&&(r=Q(r))!==null;);return r}function Ae(){return Ae=typeof Reflect<"u"&&Reflect.get?Reflect.get.bind():function(r,n,i){var e=ei(r,n);if(e){var t=Object.getOwnPropertyDescriptor(e,n);return t.get?t.get.call(arguments.length<3?r:i):t.value}},Ae.apply(null,arguments)}function wt(r,n,i,e){var t=Ae(Q(r.prototype),n,i);return typeof t=="function"?function(a){return t.apply(i,a)}:t}function ti(r){return r.normalized?1:r.size}function ye(r){var n=0;return r.forEach(function(i){return n+=ti(i)}),n}function xt(r,n,i){var e=r==="VERTEX"?n.VERTEX_SHADER:n.FRAGMENT_SHADER,t=n.createShader(e);if(t===null)throw new Error("loadShader: error while creating the shader");n.shaderSource(t,i),n.compileShader(t);var a=n.getShaderParameter(t,n.COMPILE_STATUS);if(!a){var o=n.getShaderInfoLog(t);throw n.deleteShader(t),new Error(`loadShader: error while compiling the shader:
 `.concat(o,`
 `).concat(i))}return t}function ii(r,n){return xt("VERTEX",r,n)}function ri(r,n){return xt("FRAGMENT",r,n)}function ni(r,n){var i=r.createProgram();if(i===null)throw new Error("loadProgram: error while creating the program.");var e,t;for(e=0,t=n.length;e<t;e++)r.attachShader(i,n[e]);r.linkProgram(i);var a=r.getProgramParameter(i,r.LINK_STATUS);if(!a){var o=r.getProgramInfoLog(i);throw r.deleteProgram(i),new Error("loadProgram: error while linking the program: ".concat(o))}return i}function Ze(r){var n=r.gl,i=r.buffer,e=r.program,t=r.vertexShader,a=r.fragmentShader;n.deleteShader(t),n.deleteShader(a),n.deleteProgram(e),n.deleteBuffer(i)}var qe=`#define PICKING_MODE

package/assets/index.html

@@ -12,7 +12,7 @@
     <link rel="icon" type="image/png" sizes="32x32" href="./favicon-32.png" />
     <link rel="apple-touch-icon" href="./apple-touch-icon.png" />
     <title>Canonry</title>
-    <script type="module" crossorigin src="./assets/index-C_y0aGQL.js"></script>
+    <script type="module" crossorigin src="./assets/index-rqOXhYwp.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/vendor-tanstack-Dock0eH1.js">
     <link rel="modulepreload" crossorigin href="./assets/vendor-radix-4UOaVWza.js">
     <link rel="modulepreload" crossorigin href="./assets/vendor-recharts-D8rt5lKn.js">

package/dist/{chunk-BFGHZ2GU.js → chunk-BU6C2DKF.js}

@@ -11189,12 +11189,34 @@ var ga4StatusDtoSchema = z34.object({
   createdAt: z34.string().nullable().optional(),
   updatedAt: z34.string().nullable().optional()
 });
+var ga4PropertySummaryDtoSchema = z34.object({
+  propertyId: z34.string(),
+  displayName: z34.string(),
+  /** GA4 account that owns the property. Two accounts can hold like-named properties. */
+  accountName: z34.string()
+});
+var ga4PropertiesDtoSchema = z34.object({
+  properties: z34.array(ga4PropertySummaryDtoSchema)
+});
 var ga4SyncResponseDtoSchema = z34.object({
   synced: z34.boolean(),
   rowCount: z34.number().int().nonnegative(),
   aiReferralCount: z34.number().int().nonnegative(),
   socialReferralCount: z34.number().int().nonnegative(),
+  /**
+   * The window that was ACTUALLY fetched and written, in days — the request's
+   * `days` bounded to GA4's supported sync range (1–90). Read this, not
+   * `requestedDays`, when reporting or reasoning about coverage: a
+   * `--days 500` sync writes 90 days, and this field says 90.
+   */
   days: z34.number().int().nonnegative(),
+  /** The window the caller asked for, before bounding. Equals `days` unless `clamped`. */
+  requestedDays: z34.number().int().nonnegative(),
+  /**
+   * True when `requestedDays` fell outside GA4's supported range and `days`
+   * differs from it — i.e. the synced history is not the range requested.
+   */
+  clamped: z34.boolean(),
   syncedAt: z34.string(),
   measurement: z34.object({
     acquisition: z34.object({ days: z34.number().int().nonnegative(), status: z34.enum(["ready", "error"]), rowCount: z34.number().int().nonnegative(), error: z34.string().optional() }),
@@ -15380,6 +15402,7 @@ export {
   aiReferralClassCounts,
   formatAiReferralClassSummary,
   ga4StatusDtoSchema,
+  ga4PropertiesDtoSchema,
   ga4SyncResponseDtoSchema,
   ga4AiReferralHistoryEntrySchema,
   ga4AiReferralDailyDtoSchema,

package/dist/{chunk-RULHNUBH.js → chunk-L5SMSDZB.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-C4WKYU5C.js";
+} from "./chunk-QDOZEMDK.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -139,7 +139,7 @@ import {
   siteCrawlSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-GCQPFCP2.js";
+} from "./chunk-QKLNTSQ2.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -253,7 +253,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-BFGHZ2GU.js";
+} from "./chunk-BU6C2DKF.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -9084,7 +9084,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-Z3XS2UXQ.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-RDGUEEZQ.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);

package/dist/{chunk-C4WKYU5C.js → chunk-QDOZEMDK.js}

@@ -81,7 +81,7 @@ import {
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema,
   trafficSeriesGranularitySchema
-} from "./chunk-BFGHZ2GU.js";
+} from "./chunk-BU6C2DKF.js";
 
 // src/config.ts
 import fs from "fs";
@@ -4148,6 +4148,18 @@ var getApiV1ProjectsByNameGaStatus = (options) => {
     ...options
   });
 };
+var getApiV1ProjectsByNameGaProperties = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/ga/properties",
+    ...options
+  });
+};
 var getApiV1ProjectsByNameGaMeasurementAnalysis = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -6925,6 +6937,11 @@ var ApiClient = class {
       () => getApiV1ProjectsByNameGaStatus({ client: this.heyClient, path: { name: project } })
     );
   }
+  async gaProperties(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGaProperties({ client: this.heyClient, path: { name: project } })
+    );
+  }
   async gaMeasurementAnalysis(project, params) {
     return this.invoke(
       () => getApiV1ProjectsByNameGaMeasurementAnalysis({
@@ -9299,6 +9316,17 @@ var canonryMcpTools = [
     openApiOperations: ["GET /api/v1/projects/{name}/ga/status"],
     handler: (client2, input) => client2.gaStatus(input.project)
   }),
+  defineTool({
+    name: "canonry_ga_properties",
+    title: "List GA4 properties",
+    description: `List the GA4 properties the project's connected Google account can read, with their numeric property ids. Use this to find the id that "canonry ga connect --property-id" needs; it cannot be derived from the domain or the OAuth grant.`,
+    access: "read",
+    tier: "ga",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/ga/properties"],
+    handler: (client2, input) => client2.gaProperties(input.project)
+  }),
   defineTool({
     name: "canonry_ga_measurement_analysis",
     title: "Analyze GA acquisition and search demand",

package/dist/{chunk-GCQPFCP2.js → chunk-QKLNTSQ2.js}

@@ -271,6 +271,7 @@ import {
   formatWindowCountDelta,
   ga4AiReferralDailyDtoSchema,
   ga4AiReferralHistoryEntrySchema,
+  ga4PropertiesDtoSchema,
   ga4SessionHistoryEntrySchema,
   ga4SocialReferralHistoryEntrySchema,
   ga4StatusDtoSchema,
@@ -581,7 +582,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-BFGHZ2GU.js";
+} from "./chunk-BU6C2DKF.js";
 
 // src/intelligence-service.ts
 import { eq as eq59, desc as desc26, asc as asc11, and as and47, ne as ne7, or as or13, inArray as inArray21, gte as gte14, lte as lte12 } from "drizzle-orm";
@@ -9225,6 +9226,13 @@ function assertProjectScope(request, projectId) {
     throw forbidden("This API key is scoped to a different project.");
   }
 }
+function assertNotProjectScoped(request, what) {
+  if (request.apiKey?.projectId) {
+    throw forbidden(
+      `This API key is scoped to a single project, and ${what} covers every account the connected Google principal can see. Use a full-instance key.`
+    );
+  }
+}
 function hashApiKey(key) {
   return crypto4.createHash("sha256").update(key).digest("hex");
 }
@@ -28064,6 +28072,7 @@ var SCHEMA_TABLE = {
   GA4MeasurementAnalysisDto: gaMeasurementAnalysisDtoSchema,
   GA4SessionHistoryEntry: ga4SessionHistoryEntrySchema,
   GA4SocialReferralHistoryEntry: ga4SocialReferralHistoryEntrySchema,
+  GA4PropertiesDto: ga4PropertiesDtoSchema,
   GA4StatusDto: ga4StatusDtoSchema,
   GA4SyncResponseDto: ga4SyncResponseDtoSchema,
   GbpAccountListResponse: gbpAccountListResponseSchema,
@@ -32893,7 +32902,7 @@ var routeCatalog = [
   {
     method: "post",
     path: "/api/v1/projects/{name}/ga/connect",
-    summary: "Connect Google Analytics 4 via service account",
+    summary: "Connect Google Analytics 4 (service account or existing OAuth connection)",
     tags: ["ga4"],
     parameters: [nameParameter],
     requestBody: {
@@ -32902,9 +32911,12 @@ var routeCatalog = [
         "application/json": {
           schema: {
             type: "object",
-            required: ["propertyId", "keyJson"],
+            required: ["propertyId"],
             properties: {
               propertyId: stringSchema,
+              // Optional: omit it to select a property on an existing OAuth
+              // connection (canonry google connect --type ga4). Required only
+              // for service-account auth.
               keyJson: stringSchema
             }
           }
@@ -32940,6 +32952,19 @@ var routeCatalog = [
       404: errorResponse("Project not found.")
     }
   },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/ga/properties",
+    summary: "List GA4 properties the connected account can read",
+    description: "Lists every GA4 property visible to the project's OAuth connection, so the numeric property id needed by ga/connect can be discovered without leaving canonry. Requires an OAuth GA4 connection; service-account connections already carry their property id.",
+    tags: ["ga4"],
+    parameters: [nameParameter],
+    responses: {
+      200: jsonResponse("GA4 properties returned.", "GA4PropertiesDto"),
+      400: errorResponse("No OAuth GA4 connection for this project."),
+      404: errorResponse("Project not found.")
+    }
+  },
   {
     method: "get",
     path: "/api/v1/projects/{name}/ga/measurement-analysis",
@@ -32985,6 +33010,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/ga/sync",
     summary: "Sync GA4 traffic and AI referral data",
+    description: "Syncs a window of GA4 history. `days` is bounded to GA4's supported sync range (1-90); a request outside it is clamped rather than rejected. The response reports the window ACTUALLY written as `days`, the unbounded request as `requestedDays`, and sets `clamped` when the two differ.",
     tags: ["ga4"],
     parameters: [nameParameter],
     requestBody: {
@@ -32994,7 +33020,7 @@ var routeCatalog = [
           schema: {
             type: "object",
             properties: {
-              days: integerSchema
+              days: { ...integerSchema, description: "Days of history to sync. Clamped to 1-90; check `clamped` in the response to detect truncation. Defaults to 30." }
             }
           }
         }
@@ -36113,10 +36139,16 @@ import crypto26 from "crypto";
 
 // ../integration-google-analytics/src/constants.ts
 var GA4_DATA_API_BASE = "https://analyticsdata.googleapis.com/v1beta";
+var GA4_ADMIN_API_BASE = "https://analyticsadmin.googleapis.com/v1beta";
 var GA4_SCOPE = "https://www.googleapis.com/auth/analytics.readonly";
 var GOOGLE_TOKEN_URL2 = "https://oauth2.googleapis.com/token";
 var GA4_DEFAULT_SYNC_DAYS = 30;
 var GA4_MAX_SYNC_DAYS = 90;
+function resolveGa4SyncDays(days) {
+  const requestedDays = days != null && Number.isFinite(days) ? Math.trunc(days) : GA4_DEFAULT_SYNC_DAYS;
+  const effectiveDays = Math.min(Math.max(1, requestedDays), GA4_MAX_SYNC_DAYS);
+  return { requestedDays, effectiveDays, clamped: effectiveDays !== requestedDays };
+}
 var GA4_REQUEST_TIMEOUT_MS = 3e4;
 var GA4_MAX_PAGES = 50;
 var GA4_MAX_CONCURRENT_REQUESTS = 4;
@@ -36299,6 +36331,9 @@ function isRetryableGa4Error(err) {
   if (err instanceof GA4ApiError) {
     return err.status === 429 || err.status >= 500;
   }
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+    return true;
+  }
   return false;
 }
 async function withGa4Retry(fn, errLabel) {
@@ -36435,7 +36470,7 @@ function formatDate2(d) {
   return d.toISOString().slice(0, 10);
 }
 function measurementDateRange(days) {
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setUTCDate(startDate.getUTCDate() - syncDays);
@@ -36543,7 +36578,7 @@ var AI_REFERRAL_SOURCE_FILTERS = [
 async function fetchTrafficByLandingPage(accessToken, propertyId, days) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setDate(startDate.getDate() - syncDays);
@@ -36672,10 +36707,73 @@ async function verifyConnectionWithToken(accessToken, propertyId) {
   });
   return true;
 }
+async function listProperties(accessToken) {
+  validateAccessToken2(accessToken);
+  const properties = [];
+  let pageToken;
+  do {
+    const url = new URL(`${GA4_ADMIN_API_BASE}/accountSummaries`);
+    url.searchParams.set("pageSize", "200");
+    if (pageToken) url.searchParams.set("pageToken", pageToken);
+    const body = await withGa4Limit(() => withGa4Retry(async () => {
+      const res = await fetch(url, {
+        headers: { "Authorization": `Bearer ${accessToken}` },
+        signal: AbortSignal.timeout(GA4_REQUEST_TIMEOUT_MS)
+      });
+      if (!res.ok) {
+        const raw = await res.text().catch(() => "");
+        let detail = "";
+        let quotaReason = false;
+        try {
+          const parsed = JSON.parse(raw);
+          if (parsed.error?.status === "SERVICE_DISABLED") {
+            detail = " The Google Analytics Admin API is not enabled for this GCP project. Enable it at: https://console.developers.google.com/apis/api/analyticsadmin.googleapis.com/overview";
+          } else if (parsed.error?.message) {
+            detail = ` ${parsed.error.message}`;
+          }
+          quotaReason = (parsed.error?.errors ?? []).some(
+            (e) => e.reason === "rateLimitExceeded" || e.reason === "quotaExceeded" || e.reason === "userRateLimitExceeded"
+          ) || parsed.error?.status === "RESOURCE_EXHAUSTED";
+        } catch {
+          if (raw.length < 200) detail = ` ${raw}`;
+        }
+        const sanitized = detail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        const retryAfterSeconds = res.status === 429 || res.status >= 500 || res.status === 403 && quotaReason ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
+        ga4Log("error", "admin.account-summaries-failed", {
+          httpStatus: res.status,
+          retryAfterSeconds,
+          quotaReason
+        });
+        throw new GA4ApiError(
+          `Failed to list GA4 properties.${sanitized}`,
+          // A quota 403 is surfaced as 429 so every downstream consumer — the
+          // retry predicate and the route's error mapper — reads it as rate
+          // limiting rather than as a permission denial.
+          res.status === 403 && quotaReason ? 429 : res.status,
+          retryAfterSeconds
+        );
+      }
+      return await res.json();
+    }, "GA4 accountSummaries"));
+    for (const account of body.accountSummaries ?? []) {
+      for (const summary of account.propertySummaries ?? []) {
+        const propertyId = (summary.property ?? "").split("/").pop() ?? "";
+        if (!propertyId) continue;
+        properties.push({
+          propertyId,
+          displayName: summary.displayName ?? "",
+          accountName: account.displayName ?? ""
+        });
+      }
+    }
+    pageToken = body.nextPageToken;
+  } while (pageToken);
+  return properties;
+}
 async function fetchAggregateSummary(accessToken, propertyId, days) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setDate(startDate.getDate() - syncDays);
@@ -36725,7 +36823,7 @@ function parseOptionalCountMetric(value) {
 async function fetchDailyTotals(accessToken, propertyId, days) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setDate(startDate.getDate() - syncDays);
@@ -36818,7 +36916,7 @@ async function fetchWindowSummary(accessToken, propertyId, windowKey) {
 async function fetchAiReferrals(accessToken, propertyId, days) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setDate(startDate.getDate() - syncDays);
@@ -36911,7 +37009,7 @@ var SOCIAL_CHANNEL_GROUPS = ["Organic Social", "Paid Social"];
 async function fetchSocialReferrals(accessToken, propertyId, days) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const syncDays = Math.min(Math.max(1, days ?? GA4_DEFAULT_SYNC_DAYS), GA4_MAX_SYNC_DAYS);
+  const { effectiveDays: syncDays } = resolveGa4SyncDays(days);
   const endDate = /* @__PURE__ */ new Date();
   const startDate = /* @__PURE__ */ new Date();
   startDate.setDate(startDate.getDate() - syncDays);
@@ -37736,6 +37834,7 @@ async function googleRoutes(app, opts) {
     return reply.status(204).send();
   });
   app.get("/projects/:name/google/properties", async (request) => {
+    assertNotProjectScoped(request, "listing Search Console properties");
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
       throw validationError("Google OAuth is not configured");
@@ -38652,6 +38751,7 @@ async function googleRoutes(app, opts) {
     return listSelectionResponse(project.id);
   });
   app.get("/projects/:name/gbp/accounts", async (request) => {
+    assertNotProjectScoped(request, "listing Business Profile accounts");
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
       throw validationError("Google OAuth is not configured");
@@ -44172,6 +44272,7 @@ async function bingRoutes(app, opts) {
     };
   });
   app.get("/projects/:name/bing/sites", async (request) => {
+    assertNotProjectScoped(request, "listing Bing Webmaster sites");
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
     const conn = requireConnection(store, project.canonicalDomain);
@@ -45038,6 +45139,22 @@ async function refreshOAuthTokenIfNeeded(googleStore, authConfig, canonicalDomai
   }
   return oauthConn.accessToken;
 }
+function ga4ErrorToAppError(err, context) {
+  if (err instanceof AppError) return err;
+  if (err instanceof GA4ApiError) {
+    if (err.status === 429) {
+      return quotaExceeded("Google Analytics Admin API (rate limited; retries exhausted)");
+    }
+    if (err.status === 401 || err.status === 403) {
+      return forbidden(
+        `${context}: the connected Google account was rejected by Google (${err.status}). Reconnect with "canonry google connect <project> --type ga4".`,
+        { reason: "ga4-upstream-auth", upstreamStatus: err.status }
+      );
+    }
+    return providerError(`${context}: ${err.message}`);
+  }
+  return providerError(`${context}: ${err instanceof Error ? err.message : String(err)}`);
+}
 async function resolveGa4AccessToken(opts, projectName, canonicalDomain) {
   const saConn = opts.ga4CredentialStore?.getConnection(projectName);
   if (saConn?.clientEmail && saConn?.privateKey && saConn?.propertyId) {
@@ -45059,7 +45176,7 @@ async function resolveGa4AccessToken(opts, projectName, canonicalDomain) {
   }
   if (!oauthConn.propertyId) {
     throw validationError(
-      'GA4 property ID not set. Run "canonry ga set-property <project> <propertyId>" to configure it.'
+      'GA4 property ID not set. Run "canonry ga properties <project>" to list the readable properties, then "canonry ga connect <project> --property-id <id>" to select one.'
     );
   }
   const accessToken = await refreshOAuthTokenIfNeeded(googleStore, authConfig, canonicalDomain, {
@@ -45188,6 +45305,33 @@ async function ga4Routes(app, opts) {
     });
     return reply.status(204).send();
   });
+  app.get("/projects/:name/ga/properties", async (request) => {
+    assertNotProjectScoped(request, "listing GA4 properties");
+    const project = resolveProject(app.db, request.params.name);
+    const googleStore = opts.googleConnectionStore;
+    const authConfig = opts.getGoogleAuthConfig?.();
+    if (!googleStore || !authConfig) {
+      throw validationError(
+        'Google OAuth is not configured. Run "canonry google connect <project> --type ga4" first.'
+      );
+    }
+    const oauthConn = googleStore.getConnection(project.canonicalDomain, "ga4");
+    if (!oauthConn?.accessToken || !oauthConn?.refreshToken) {
+      throw validationError(
+        'No GA4 OAuth connection for this project. Run "canonry google connect <project> --type ga4" first. Service-account connections already carry their property id and do not need this listing.'
+      );
+    }
+    try {
+      const accessToken = await refreshOAuthTokenIfNeeded(googleStore, authConfig, project.canonicalDomain, {
+        accessToken: oauthConn.accessToken,
+        refreshToken: oauthConn.refreshToken,
+        tokenExpiresAt: oauthConn.tokenExpiresAt
+      });
+      return { properties: await listProperties(accessToken) };
+    } catch (err) {
+      throw ga4ErrorToAppError(err, "Failed to list GA4 properties");
+    }
+  });
   app.get("/projects/:name/ga/status", async (request, _reply) => {
     const project = resolveProject(app.db, request.params.name);
     const saConn = opts.ga4CredentialStore?.getConnection(project.name);
@@ -45209,7 +45353,7 @@ async function ga4Routes(app, opts) {
   });
   app.post("/projects/:name/ga/sync", async (request, _reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const days = request.body?.days ?? 30;
+    const { requestedDays, effectiveDays: days, clamped } = resolveGa4SyncDays(request.body?.days);
     const only = request.body?.only;
     const validOnlyValues = ["traffic", "ai", "social"];
     if (only !== void 0 && !validOnlyValues.includes(only)) {
@@ -45220,8 +45364,8 @@ async function ga4Routes(app, opts) {
     const syncAi = !only || only === "ai";
     const syncSocial = !only || only === "social";
     const measurementState = app.db.select().from(gaMeasurementSyncStates).where(eq44(gaMeasurementSyncStates.projectId, project.id)).get();
-    const acquisitionDays = measurementState?.acquisitionSyncedAt != null ? Math.min(Math.max(1, days), 90) : 90;
-    const leadDays = measurementState?.leadSyncedAt != null ? Math.min(Math.max(1, days), 90) : 90;
+    const acquisitionDays = measurementState?.acquisitionSyncedAt != null ? days : GA4_MAX_SYNC_DAYS;
+    const leadDays = measurementState?.leadSyncedAt != null ? days : GA4_MAX_SYNC_DAYS;
     const leadEventNames = project.measurement.leadEventNames;
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const runId = crypto35.randomUUID();
@@ -45484,6 +45628,7 @@ async function ga4Routes(app, opts) {
         aiReferralCount: aiReferrals.length,
         socialReferralCount: socialReferrals.length,
         days,
+        ...clamped ? { requestedDays, clamped } : {},
         totalUsers: summary.totalUsers,
         ...only ? { only } : {}
       });
@@ -45493,6 +45638,8 @@ async function ga4Routes(app, opts) {
         aiReferralCount: aiReferrals.length,
         socialReferralCount: socialReferrals.length,
         days,
+        requestedDays,
+        clamped,
         syncedAt: now,
         measurement: {
           acquisition: acquisitionResult,