@canonry/canonry 4.169.0 → 4.171.0

package/dist/{chunk-HVBAGSQC.js → chunk-IIFDS3K2.js}

@@ -4,6 +4,7 @@ import {
   CodingAgents,
   DISCOVERY_MAX_PROBES_CAP,
   DISCOVERY_PROBE_CONCURRENCY_CAP,
+  GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX,
   SKILL_MANIFEST_FILENAME,
   SkillsClients,
   adsActivateTreeRequestSchema,
@@ -19,6 +20,8 @@ import {
   adsPauseRequestSchema,
   adsUnresolvedOperationListQuerySchema,
   backlinkSourceSchema,
+  canonicalizeGtmAccountId,
+  canonicalizeGtmResourceSelection,
   classifySkillFile,
   coerceSkillManifest,
   competitorBatchRequestSchema,
@@ -88,12 +91,13 @@ import {
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema,
   trafficSeriesGranularitySchema
-} from "./chunk-K7XXDKYY.js";
+} from "./chunk-HJ7W2LXI.js";
 
 // src/config.ts
 import fs from "fs";
 import path from "path";
 import os from "os";
+import crypto from "crypto";
 import { parse, stringify } from "yaml";
 function normalizeGoogleConfig(config) {
   if (!config.google) return;
@@ -105,6 +109,24 @@ function normalizeGoogleConfig(config) {
     scopes: connection.scopes ?? []
   }));
 }
+function normalizeGoogleMarketingConfig(config) {
+  if (config.googleAds) {
+    config.googleAds.connections = (config.googleAds.connections ?? []).map((connection) => ({
+      ...connection,
+      refreshToken: connection.refreshToken ?? null,
+      tokenExpiresAt: connection.tokenExpiresAt ?? null,
+      scopes: connection.scopes ?? []
+    }));
+  }
+  if (config.gtm) {
+    config.gtm.connections = (config.gtm.connections ?? []).map((connection) => ({
+      ...connection,
+      refreshToken: connection.refreshToken ?? null,
+      tokenExpiresAt: connection.tokenExpiresAt ?? null,
+      scopes: connection.scopes ?? []
+    }));
+  }
+}
 function normalizeWordpressConfig(config) {
   if (!config.wordpress) return;
   config.wordpress.connections = (config.wordpress.connections ?? []).map((connection) => ({
@@ -166,6 +188,7 @@ Do not write config.yaml by hand; use "canonry init", "canonry settings", or "ca
     };
   }
   normalizeGoogleConfig(parsed);
+  normalizeGoogleMarketingConfig(parsed);
   normalizeWordpressConfig(parsed);
   normalizeCloudflareTrafficConfig(parsed);
   const portOverride = process.env.CANONRY_PORT?.trim();
@@ -228,6 +251,35 @@ function loadConfigRaw() {
     return null;
   }
 }
+function writeConfigAtomically(configPath, contents) {
+  const directory = path.dirname(configPath);
+  const temporaryPath = path.join(
+    directory,
+    `.${path.basename(configPath)}.${process.pid}.${crypto.randomUUID()}.tmp`
+  );
+  let descriptor;
+  try {
+    descriptor = fs.openSync(temporaryPath, "wx", 384);
+    fs.fchmodSync(descriptor, 384);
+    fs.writeFileSync(descriptor, contents, { encoding: "utf-8" });
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = void 0;
+    fs.renameSync(temporaryPath, configPath);
+  } catch (error) {
+    if (descriptor !== void 0) {
+      try {
+        fs.closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      fs.unlinkSync(temporaryPath);
+    } catch {
+    }
+    throw error;
+  }
+}
 function saveConfig(config) {
   const configDir = getConfigDir();
   if (!fs.existsSync(configDir)) {
@@ -254,7 +306,7 @@ function saveConfig(config) {
     }
   }
   const yaml = stringify(merged);
-  fs.writeFileSync(configPath, yaml, { encoding: "utf-8", mode: 384 });
+  writeConfigAtomically(configPath, yaml);
 }
 function saveConfigPatch(patch) {
   const configDir = getConfigDir();
@@ -284,7 +336,7 @@ function saveConfigPatch(patch) {
     }
   }
   const yaml = stringify(merged);
-  fs.writeFileSync(configPath, yaml, { encoding: "utf-8", mode: 384 });
+  writeConfigAtomically(configPath, yaml);
 }
 function configExists() {
   return fs.existsSync(getConfigPath());
@@ -2799,27 +2851,339 @@ var putApiV1Telemetry = (options) => {
     }
   });
 };
-var getApiV1CdpStatus = (options) => {
-  return (options?.client ?? client).get({
+var getApiV1CdpStatus = (options) => {
+  return (options?.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/cdp/status",
+    ...options
+  });
+};
+var postApiV1CdpScreenshot = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/cdp/screenshot",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var getApiV1ProjectsByNameRunsByRunIdBrowserDiff = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/runs/{runId}/browser-diff",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGoogleAdsStatus = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/status",
+    ...options
+  });
+};
+var postApiV1ProjectsByNameGoogleAdsOauthConnect = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/oauth/connect",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var getApiV1ProjectsByNameGoogleAdsCustomers = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/customers",
+    ...options
+  });
+};
+var putApiV1ProjectsByNameGoogleAdsSelection = (options) => {
+  return (options.client ?? client).put({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/selection",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var postApiV1ProjectsByNameGoogleAdsSync = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/sync",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGoogleAdsSnapshots = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/snapshots",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGoogleAdsSnapshotsBySnapshotId = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/snapshots/{snapshotId}",
+    ...options
+  });
+};
+var deleteApiV1ProjectsByNameGoogleAdsConnection = (options) => {
+  return (options.client ?? client).delete({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/google-ads/connection",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGtmStatus = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/status",
+    ...options
+  });
+};
+var postApiV1ProjectsByNameGtmOauthConnect = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/oauth/connect",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var getApiV1ProjectsByNameGtmAccounts = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/accounts",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGtmAccountsByAccountIdContainers = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/accounts/{accountId}/containers",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGtmAccountsByAccountIdContainersByContainerIdWorkspaces = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/accounts/{accountId}/containers/{containerId}/workspaces",
+    ...options
+  });
+};
+var putApiV1ProjectsByNameGtmSelection = (options) => {
+  return (options.client ?? client).put({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/selection",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var postApiV1ProjectsByNameGtmSync = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/sync",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGtmSnapshots = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/snapshots",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameGtmSnapshotsBySnapshotId = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/snapshots/{snapshotId}",
+    ...options
+  });
+};
+var deleteApiV1ProjectsByNameGtmConnection = (options) => {
+  return (options.client ?? client).delete({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/gtm/connection",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameConversionTrackingContracts = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts",
+    ...options
+  });
+};
+var postApiV1ProjectsByNameConversionTrackingContracts = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
+var deleteApiV1ProjectsByNameConversionTrackingContractsByContractId = (options) => {
+  return (options.client ?? client).delete({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts/{contractId}",
+    ...options
+  });
+};
+var getApiV1ProjectsByNameConversionTrackingContractsByContractId = (options) => {
+  return (options.client ?? client).get({
     security: [
       {
         scheme: "bearer",
         type: "http"
       }
     ],
-    url: "/api/v1/cdp/status",
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts/{contractId}",
     ...options
   });
 };
-var postApiV1CdpScreenshot = (options) => {
-  return (options.client ?? client).post({
+var putApiV1ProjectsByNameConversionTrackingContractsByContractId = (options) => {
+  return (options.client ?? client).put({
     security: [
       {
         scheme: "bearer",
         type: "http"
       }
     ],
-    url: "/api/v1/cdp/screenshot",
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts/{contractId}",
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -2827,7 +3191,7 @@ var postApiV1CdpScreenshot = (options) => {
     }
   });
 };
-var getApiV1ProjectsByNameRunsByRunIdBrowserDiff = (options) => {
+var getApiV1ProjectsByNameConversionTrackingContractsByContractIdIntegrity = (options) => {
   return (options.client ?? client).get({
     security: [
       {
@@ -2835,7 +3199,7 @@ var getApiV1ProjectsByNameRunsByRunIdBrowserDiff = (options) => {
         type: "http"
       }
     ],
-    url: "/api/v1/projects/{name}/runs/{runId}/browser-diff",
+    url: "/api/v1/projects/{name}/conversion-tracking/contracts/{contractId}/integrity",
     ...options
   });
 };
@@ -6381,6 +6745,207 @@ var ApiClient = class {
       })
     );
   }
+  // ── Google Marketing: Google Ads + Google Tag Manager ──────────────────
+  async connectGoogleAds(project, request) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameGoogleAdsOauthConnect({
+        client: this.heyClient,
+        path: { name: project },
+        body: request
+      })
+    );
+  }
+  async connectGtm(project, request) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameGtmOauthConnect({
+        client: this.heyClient,
+        path: { name: project },
+        body: request
+      })
+    );
+  }
+  async disconnectGoogleAds(project) {
+    return this.invoke(
+      () => deleteApiV1ProjectsByNameGoogleAdsConnection({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async disconnectGtm(project) {
+    return this.invoke(
+      () => deleteApiV1ProjectsByNameGtmConnection({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async getGoogleAdsStatus(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGoogleAdsStatus({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async listGoogleAdsCustomers(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGoogleAdsCustomers({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async setGoogleAdsSelection(project, request) {
+    return this.invoke(
+      () => putApiV1ProjectsByNameGoogleAdsSelection({
+        client: this.heyClient,
+        path: { name: project },
+        body: request
+      })
+    );
+  }
+  async triggerGoogleAdsSync(project) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameGoogleAdsSync({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async listGoogleAdsSnapshots(project, query) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGoogleAdsSnapshots({
+        client: this.heyClient,
+        path: { name: project },
+        query
+      })
+    );
+  }
+  async getGoogleAdsSnapshot(project, snapshotId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGoogleAdsSnapshotsBySnapshotId({
+        client: this.heyClient,
+        path: { name: project, snapshotId }
+      })
+    );
+  }
+  async getGtmStatus(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmStatus({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async listGtmAccounts(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmAccounts({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async listGtmContainers(project, accountId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmAccountsByAccountIdContainers({
+        client: this.heyClient,
+        path: { name: project, accountId }
+      })
+    );
+  }
+  async listGtmWorkspaces(project, accountId, containerId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmAccountsByAccountIdContainersByContainerIdWorkspaces({
+        client: this.heyClient,
+        path: { name: project, accountId, containerId }
+      })
+    );
+  }
+  async setGtmSelection(project, request) {
+    return this.invoke(
+      () => putApiV1ProjectsByNameGtmSelection({
+        client: this.heyClient,
+        path: { name: project },
+        body: request
+      })
+    );
+  }
+  async triggerGtmSync(project) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameGtmSync({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async listGtmSnapshots(project, query) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmSnapshots({
+        client: this.heyClient,
+        path: { name: project },
+        query
+      })
+    );
+  }
+  async getGtmSnapshot(project, snapshotId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameGtmSnapshotsBySnapshotId({
+        client: this.heyClient,
+        path: { name: project, snapshotId }
+      })
+    );
+  }
+  async listConversionTrackingContracts(project) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameConversionTrackingContracts({
+        client: this.heyClient,
+        path: { name: project }
+      })
+    );
+  }
+  async getConversionTrackingContract(project, contractId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameConversionTrackingContractsByContractId({
+        client: this.heyClient,
+        path: { name: project, contractId }
+      })
+    );
+  }
+  async createConversionTrackingContract(project, request) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameConversionTrackingContracts({
+        client: this.heyClient,
+        path: { name: project },
+        body: request
+      })
+    );
+  }
+  async updateConversionTrackingContract(project, contractId, request) {
+    return this.invoke(
+      () => putApiV1ProjectsByNameConversionTrackingContractsByContractId({
+        client: this.heyClient,
+        path: { name: project, contractId },
+        body: request
+      })
+    );
+  }
+  async deleteConversionTrackingContract(project, contractId) {
+    await this.invoke(
+      () => deleteApiV1ProjectsByNameConversionTrackingContractsByContractId({
+        client: this.heyClient,
+        path: { name: project, contractId }
+      })
+    );
+  }
+  async getConversionTrackingIntegrity(project, contractId) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameConversionTrackingContractsByContractIdIntegrity({
+        client: this.heyClient,
+        path: { name: project, contractId }
+      })
+    );
+  }
   // Google Business Profile (Phase 1: auth + discovery)
   async listGbpAccounts(project) {
     return this.invoke(
@@ -7816,7 +8381,7 @@ var _require = createRequire(import.meta.url);
 var PACKAGE_VERSION = _require("../package.json").version;
 
 // src/commands/skills.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import fs2 from "fs";
 import os2 from "os";
 import path2 from "path";
@@ -7871,7 +8436,7 @@ function walkRelative(dir, prefix = "") {
   return out.sort();
 }
 function sha256File(filePath) {
-  return crypto.createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex");
+  return crypto2.createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex");
 }
 function readSkillManifest(skillDir) {
   try {
@@ -8788,6 +9353,54 @@ var adsAdPauseInputSchema = z3.object({
   adId: z3.string().min(1),
   request: adsPauseRequestSchema
 });
+var googleMarketingSnapshotPageInputSchema = z3.object({
+  project: projectNameSchema,
+  limit: z3.number().int().min(1).max(GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX).optional(),
+  cursor: z3.string().trim().min(1).optional()
+}).strict();
+var googleMarketingSnapshotInputSchema = z3.object({
+  project: projectNameSchema,
+  snapshotId: z3.string().trim().min(1)
+}).strict();
+var gtmAccountInputSchema = z3.object({
+  project: projectNameSchema,
+  accountId: z3.string().trim().min(1)
+}).strict().superRefine((input, context) => {
+  if (!canonicalizeGtmAccountId(input.accountId)) {
+    context.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["accountId"],
+      message: "Expected a safe GTM account ID or accounts/{id} resource path."
+    });
+  }
+});
+var gtmContainerInputSchema = z3.object({
+  project: projectNameSchema,
+  accountId: z3.string().trim().min(1),
+  containerId: z3.string().trim().min(1)
+}).strict().superRefine((input, context) => {
+  if (!canonicalizeGtmResourceSelection(input)) {
+    context.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["containerId"],
+      message: "Expected matching safe GTM account/container IDs or resource paths."
+    });
+  }
+});
+function canonicalGtmMcpAccountId(accountId) {
+  const canonical = canonicalizeGtmAccountId(accountId);
+  if (!canonical) throw new Error("Invalid GTM account input.");
+  return canonical;
+}
+function canonicalGtmMcpSelection(accountId, containerId) {
+  const canonical = canonicalizeGtmResourceSelection({ accountId, containerId });
+  if (!canonical) throw new Error("Invalid GTM account/container input.");
+  return canonical;
+}
+var conversionTrackingContractInputSchema = z3.object({
+  project: projectNameSchema,
+  contractId: z3.string().trim().min(1)
+}).strict();
 var keywordsInputSchema = z3.object({
   project: projectNameSchema,
   request: keywordBatchRequestSchema
@@ -11130,6 +11743,187 @@ var canonryMcpTools = [
       checkDeadLinks: input.checkDeadLinks
     })
   }),
+  // ----- Google Marketing: Google Ads + Google Tag Manager -----
+  // OAuth, selection, disconnect, and contract writes deliberately stay on
+  // the operator CLI/dashboard. The agent surface can only inspect bounded
+  // evidence, trigger bounded read-only syncs, and assess stored integrity.
+  defineTool({
+    name: "canonry_google_ads_status",
+    title: "Get Google Ads connection status",
+    description: "Read the project-local Google Ads connection, selected customer, and stored-evidence freshness. This never exposes credentials or changes a Google Ads account.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/status"],
+    handler: (client2, input) => client2.getGoogleAdsStatus(input.project)
+  }),
+  defineTool({
+    name: "canonry_google_ads_customers",
+    title: "List live Google Ads customers",
+    description: "Read the bounded set of Google Ads customers available to the project OAuth connection. This makes live provider GET requests and requires google-marketing.read-live; customer selection remains an explicit operator action.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/customers"],
+    handler: (client2, input) => client2.listGoogleAdsCustomers(input.project)
+  }),
+  defineTool({
+    name: "canonry_google_ads_snapshots",
+    title: "List stored Google Ads evidence",
+    description: "List a bounded page of redacted, append-only Google Ads snapshots. Stored reads are quota-free and do not call Google.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: googleMarketingSnapshotPageInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/snapshots"],
+    handler: (client2, input) => client2.listGoogleAdsSnapshots(input.project, {
+      limit: input.limit,
+      cursor: input.cursor
+    })
+  }),
+  defineTool({
+    name: "canonry_google_ads_snapshot_get",
+    title: "Get stored Google Ads evidence",
+    description: "Read one redacted Google Ads evidence snapshot by ID. It can show conversion actions and effective campaign goals, but cannot prove a browser conversion fired.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: googleMarketingSnapshotInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/snapshots/{snapshotId}"],
+    handler: (client2, input) => client2.getGoogleAdsSnapshot(input.project, input.snapshotId)
+  }),
+  defineTool({
+    name: "canonry_google_ads_sync",
+    title: "Sync Google Ads conversion evidence",
+    description: "Queue a bounded read-only Google Ads evidence sync using GETs and SearchStream POSTs. It creates a local run and sanitized snapshots, but never changes campaigns, conversion actions, goals, bids, or budgets. Requires google-marketing.read-live and write authority.",
+    access: "write",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: writeAnnotations({ idempotentHint: false, openWorldHint: true }),
+    openApiOperations: ["POST /api/v1/projects/{name}/google-ads/sync"],
+    handler: (client2, input) => client2.triggerGoogleAdsSync(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_status",
+    title: "Get Google Tag Manager connection status",
+    description: "Read the project-local GTM connection, selected account/container/workspace, and stored-evidence freshness. This never exposes credentials or edits GTM.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/status"],
+    handler: (client2, input) => client2.getGtmStatus(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_accounts",
+    title: "List live GTM accounts",
+    description: "Read the bounded set of GTM accounts available to the project OAuth connection. This makes live provider GET requests and requires google-marketing.read-live; resource selection remains operator-only.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts"],
+    handler: (client2, input) => client2.listGtmAccounts(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_containers",
+    title: "List live GTM containers",
+    description: "Read the bounded set of containers in one GTM account. This is a live GET-only provider read; it cannot edit or publish a container.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: gtmAccountInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts/{accountId}/containers"],
+    handler: (client2, input) => client2.listGtmContainers(
+      input.project,
+      canonicalGtmMcpAccountId(input.accountId)
+    )
+  }),
+  defineTool({
+    name: "canonry_gtm_workspaces",
+    title: "List live GTM workspaces",
+    description: "Read the bounded set of workspaces in one GTM container. This is a live GET-only provider read; it cannot edit a workspace or publish a version.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: gtmContainerInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts/{accountId}/containers/{containerId}/workspaces"],
+    handler: (client2, input) => {
+      const selection = canonicalGtmMcpSelection(input.accountId, input.containerId);
+      return client2.listGtmWorkspaces(input.project, selection.accountId, selection.containerId);
+    }
+  }),
+  defineTool({
+    name: "canonry_gtm_snapshots",
+    title: "List stored GTM evidence",
+    description: "List a bounded page of redacted, append-only GTM live/draft graph snapshots. Stored reads are quota-free and do not call Google.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: googleMarketingSnapshotPageInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/snapshots"],
+    handler: (client2, input) => client2.listGtmSnapshots(input.project, {
+      limit: input.limit,
+      cursor: input.cursor
+    })
+  }),
+  defineTool({
+    name: "canonry_gtm_snapshot_get",
+    title: "Get stored GTM evidence",
+    description: "Read one redacted GTM live/draft graph snapshot by ID. It can prove static tag and trigger configuration only; it cannot prove a browser event fired.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: googleMarketingSnapshotInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/snapshots/{snapshotId}"],
+    handler: (client2, input) => client2.getGtmSnapshot(input.project, input.snapshotId)
+  }),
+  defineTool({
+    name: "canonry_gtm_sync",
+    title: "Sync GTM conversion evidence",
+    description: "Queue a bounded GTM GET-only evidence sync. It creates a local run and sanitized live/draft snapshots, but never edits a workspace or publishes a container version. Requires google-marketing.read-live and write authority.",
+    access: "write",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: writeAnnotations({ idempotentHint: false, openWorldHint: true }),
+    openApiOperations: ["POST /api/v1/projects/{name}/gtm/sync"],
+    handler: (client2, input) => client2.triggerGtmSync(input.project)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_contracts",
+    title: "List conversion-tracking contracts",
+    description: "List the project\u2019s declared business contracts linking an application event to Google Ads and GTM identifiers. Contract creation and changes remain operator-only.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts"],
+    handler: (client2, input) => client2.listConversionTrackingContracts(input.project)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_contract_get",
+    title: "Get conversion-tracking contract",
+    description: "Read one declared conversion-tracking contract. It declares intended semantics; use integrity assessment to evaluate stored evidence.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: conversionTrackingContractInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts/{contractId}"],
+    handler: (client2, input) => client2.getConversionTrackingContract(input.project, input.contractId)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_integrity",
+    title: "Assess stored conversion integrity",
+    description: "Evaluate a declared contract against stored redacted Google Ads and GTM evidence. This does not call providers and cannot treat static configuration as proof of a browser event or observed Google Ads conversion.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: conversionTrackingContractInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts/{contractId}/integrity"],
+    handler: (client2, input) => client2.getConversionTrackingIntegrity(input.project, input.contractId)
+  }),
   // ----- OpenAI ads (ChatGPT ads) -----
   defineTool({
     name: "canonry_ads_status",