@canonry/canonry 4.169.0 → 4.171.0

package/dist/{chunk-T2UJAYTX.js → chunk-5KGN224W.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-HVBAGSQC.js";
+} from "./chunk-IIFDS3K2.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -30,6 +30,7 @@ import {
   anyUsersExist,
   apiKeys,
   apiRoutes,
+  assessConversionTrackingIntegrity,
   auditLog,
   backlinkDomains,
   backlinkSummaries,
@@ -55,6 +56,7 @@ import {
   downloadFile,
   dropLegacyCredentialColumns,
   ensureCurrentQueryBasketRevision,
+  exchangeCode,
   executeDiscovery,
   extractLegacyCredentials,
   extractRecommendedCompetitors,
@@ -72,10 +74,13 @@ import {
   gbpPlaceActions,
   gbpPlaceDetails,
   getAttributes,
+  getAuthUrl,
   getCrawlIssues,
   getLodging,
   getPlaceDetails,
   getUrlInfo,
+  googleAdsConnections,
+  googleAdsRawSnapshots,
   groupRunsByCreatedAt,
   gscCoverageSnapshots,
   gscDailyTotals,
@@ -83,6 +88,8 @@ import {
   gscQueryDailyTotals,
   gscSearchData,
   gscUrlInspections,
+  gtmConnections,
+  gtmRawSnapshots,
   hashAttributes,
   hashLodging,
   hashPlaceDetails,
@@ -138,7 +145,7 @@ import {
   siteCrawlSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-U2X42SKN.js";
+} from "./chunk-O226BLC7.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -151,6 +158,16 @@ import {
   CITED_URL_CAPTURE_VERSION,
   CcReleaseSyncStatuses,
   DiscoveryCompetitorTypes,
+  GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS,
+  GOOGLE_ADS_CAMPAIGN_METRICS_MAX_DAYS,
+  GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS,
+  GoogleAdsCampaignStatuses,
+  GoogleAdsConversionActionStatuses,
+  GoogleAdsCustomerStatuses,
+  GoogleAdsGoalConfigurationLevels,
+  GoogleAdsSnapshotKinds,
+  GoogleMarketingProviders,
+  GtmSnapshotKinds,
   LLM_CAPABILITIES,
   LlmCapabilities,
   MemorySources,
@@ -188,6 +205,9 @@ import {
   authRequired,
   bucketOnboardingCount,
   buildRunErrorFromMessages,
+  canonicalizeGtmAccountId,
+  canonicalizeGtmContainerId,
+  canonicalizeGtmResourceSelection,
   classifyTemplateLinkEdge,
   cloudflareQueueNameSchema,
   computeBacklinkSummaryMetrics,
@@ -196,6 +216,7 @@ import {
   createTemplateLinkDetectionTally,
   createTemplateLinkPairIndex,
   deriveCitedUrlCandidates,
+  deriveGoogleAdsEffectiveGoalGraph,
   deriveIndexCoverage,
   deriveSiteHealthState,
   describeError,
@@ -209,6 +230,19 @@ import {
   forbidden,
   formatIsoDateInTimeZone,
   frameAncestorsHeaderValue,
+  googleAdsAccessibleCustomerDtoSchema,
+  googleAdsAccessibleCustomersResponseSchema,
+  googleAdsCampaignMetricsQuerySchema,
+  googleAdsRawSnapshotDtoSchema,
+  gtmAccountsResponseSchema,
+  gtmContainerListResponseSchema,
+  gtmGoogleAdsConversionIdMappingDtoSchema,
+  gtmGoogleAdsConversionLabelMappingDtoSchema,
+  gtmGoogleAdsConversionValueMappingDtoSchema,
+  gtmGoogleAdsCurrencyMappingDtoSchema,
+  gtmGoogleAdsTransactionIdMappingDtoSchema,
+  gtmRawSnapshotDtoSchema,
+  gtmWorkspaceListResponseSchema,
   hostMatchesAnyDomain,
   hostMatchesDomain,
   hostOf,
@@ -233,6 +267,7 @@ import {
   providerSupportsLocationContext,
   registrableDomain,
   resolveSnapshotRequestQueries,
+  retryAfterDelayMs,
   serializeForInlineScript,
   serializeRunError,
   shiftIsoCalendarDate,
@@ -247,7 +282,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-K7XXDKYY.js";
+} from "./chunk-HJ7W2LXI.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -576,13 +611,2720 @@ function checkLatestVersionForServer(opts) {
   return buildUpdateAvailable(PKG_VERSION, memoryCache.latest);
 }
 
+// src/google-marketing-runtime.ts
+import crypto3 from "crypto";
+
+// ../integration-google-ads/src/constants.ts
+var GOOGLE_ADS_API_VERSION = "v25";
+var GOOGLE_ADS_API_HOST = "https://googleads.googleapis.com";
+var GOOGLE_ADS_API_BASE = `${GOOGLE_ADS_API_HOST}/${GOOGLE_ADS_API_VERSION}`;
+var GOOGLE_ADS_OAUTH_SCOPE = "https://www.googleapis.com/auth/adwords";
+var GOOGLE_ADS_REQUEST_TIMEOUT_MS = 3e4;
+var GOOGLE_ADS_MAX_RETRIES = 3;
+var GOOGLE_ADS_RETRY_BASE_DELAY_MS = 1e3;
+var GOOGLE_ADS_RETRY_MAX_DELAY_MS = 3e4;
+var GOOGLE_ADS_MAX_RESULT_ROWS = 1e4;
+var GOOGLE_ADS_MAX_DAILY_METRICS_DAYS = 90;
+var GOOGLE_ADS_MAX_CAMPAIGN_FILTER_IDS = 200;
+var GOOGLE_ADS_DEFAULT_ACCESSIBLE_CUSTOMER_DETAILS = 20;
+var GOOGLE_ADS_MAX_ACCESSIBLE_CUSTOMER_DETAILS = 100;
+var GOOGLE_ADS_CUSTOMER_DETAIL_CONCURRENCY = 5;
+var GOOGLE_ADS_DEFAULT_CUSTOMER_CLIENTS = 100;
+var GOOGLE_ADS_MAX_CUSTOMER_CLIENTS = 1e3;
+var GOOGLE_ADS_DEFAULT_CUSTOMER_CLIENT_DEPTH = 1;
+var GOOGLE_ADS_MAX_CUSTOMER_CLIENT_DEPTH = 10;
+
+// ../integration-google-ads/src/goal-semantics.ts
+function addInclusion(included, action, inclusion) {
+  const existing = included.get(action.resourceName);
+  if (existing) {
+    existing.includedBy.push(inclusion);
+    return;
+  }
+  included.set(action.resourceName, { conversionAction: action, includedBy: [inclusion] });
+}
+function resolveEffectiveCampaignGoalInputs(inputs) {
+  const actions = inputs.conversionActions.map((row) => row.conversionAction);
+  const actionsByResource = new Map(actions.map((action) => [action.resourceName, action]));
+  const customGoalsByResource = new Map(
+    inputs.customGoals.map((row) => [row.customConversionGoal.resourceName, row.customConversionGoal])
+  );
+  return inputs.campaignConfigs.map((row) => {
+    const config = row.conversionGoalCampaignConfig;
+    let categoryGoalSource = "UNKNOWN";
+    let categoryOriginGoals = [];
+    if (config.goalConfigLevel === "CUSTOMER") {
+      categoryGoalSource = "CUSTOMER";
+      categoryOriginGoals = inputs.customerGoals.map(({ customerConversionGoal: goal }) => ({
+        resourceName: goal.resourceName,
+        source: "CUSTOMER",
+        category: goal.category,
+        origin: goal.origin,
+        biddable: goal.biddable === true
+      }));
+    } else if (config.goalConfigLevel === "CAMPAIGN") {
+      categoryGoalSource = "CAMPAIGN";
+      categoryOriginGoals = inputs.campaignGoals.filter(({ campaignConversionGoal: goal }) => goal.campaign === config.campaign).map(({ campaignConversionGoal: goal }) => ({
+        resourceName: goal.resourceName,
+        source: "CAMPAIGN",
+        category: goal.category,
+        origin: goal.origin,
+        biddable: goal.biddable === true
+      }));
+    }
+    const included = /* @__PURE__ */ new Map();
+    for (const goal of categoryOriginGoals) {
+      if (!goal.biddable) continue;
+      for (const action of actions) {
+        if (action.primaryForGoal !== false && action.category === goal.category && action.origin === goal.origin) {
+          addInclusion(included, action, {
+            source: goal.source === "CUSTOMER" ? "CUSTOMER_GOAL" : "CAMPAIGN_GOAL",
+            goalResourceName: goal.resourceName,
+            category: goal.category,
+            origin: goal.origin
+          });
+        }
+      }
+    }
+    let customGoal = null;
+    let missingCustomGoalResourceName;
+    const missingConversionActionResourceNames = [];
+    if (config.goalConfigLevel === "CAMPAIGN" && config.customConversionGoal) {
+      customGoal = customGoalsByResource.get(config.customConversionGoal) ?? null;
+      if (!customGoal) {
+        missingCustomGoalResourceName = config.customConversionGoal;
+      } else {
+        for (const resourceName of customGoal.conversionActions ?? []) {
+          const action = actionsByResource.get(resourceName);
+          if (!action) {
+            missingConversionActionResourceNames.push(resourceName);
+            continue;
+          }
+          addInclusion(included, action, {
+            source: "CUSTOM_GOAL",
+            goalResourceName: customGoal.resourceName
+          });
+        }
+      }
+    }
+    return {
+      campaign: row.campaign,
+      config,
+      categoryGoalSource,
+      categoryOriginGoals,
+      customGoal,
+      conversionActions: [...included.values()],
+      ...missingCustomGoalResourceName ? { missingCustomGoalResourceName } : {},
+      missingConversionActionResourceNames
+    };
+  });
+}
+
+// ../integration-google-ads/src/types.ts
+var GoogleAdsApiError = class extends Error {
+  constructor(message, status, providerStatus, requestId, retryAfter) {
+    super(message);
+    this.status = status;
+    this.providerStatus = providerStatus;
+    this.requestId = requestId;
+    this.retryAfter = retryAfter;
+  }
+  status;
+  providerStatus;
+  requestId;
+  retryAfter;
+  name = "GoogleAdsApiError";
+};
+
+// ../integration-google-ads/src/queries.ts
+var DATE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/;
+function selectQuery(fields, resource, clauses) {
+  return [
+    "SELECT",
+    ...fields.map((field, index) => `  ${field}${index === fields.length - 1 ? "" : ","}`),
+    `FROM ${resource}`,
+    ...clauses
+  ].join("\n");
+}
+function validatedLimit(limit) {
+  const value = limit ?? GOOGLE_ADS_MAX_RESULT_ROWS;
+  if (!Number.isInteger(value) || value < 1 || value > GOOGLE_ADS_MAX_RESULT_ROWS) {
+    throw new GoogleAdsApiError(
+      `Limit must be an integer between 1 and ${GOOGLE_ADS_MAX_RESULT_ROWS}`,
+      400
+    );
+  }
+  return value;
+}
+function normalizeGoogleAdsCustomerId(value, label = "Customer ID") {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new GoogleAdsApiError(`${label} is required`, 400);
+  }
+  const normalized = value.trim().replaceAll("-", "");
+  if (!/^\d{10}$/.test(normalized)) {
+    throw new GoogleAdsApiError(`${label} must contain exactly 10 digits`, 400);
+  }
+  return normalized;
+}
+function normalizeGoogleAdsCustomerClientsOptions(options = {}) {
+  const maxDepth = options.maxDepth ?? GOOGLE_ADS_DEFAULT_CUSTOMER_CLIENT_DEPTH;
+  if (!Number.isInteger(maxDepth) || maxDepth < 0 || maxDepth > GOOGLE_ADS_MAX_CUSTOMER_CLIENT_DEPTH) {
+    throw new GoogleAdsApiError(
+      `Customer-client depth must be an integer between 0 and ${GOOGLE_ADS_MAX_CUSTOMER_CLIENT_DEPTH}`,
+      400
+    );
+  }
+  const maxCustomers = options.maxCustomers ?? GOOGLE_ADS_DEFAULT_CUSTOMER_CLIENTS;
+  if (!Number.isInteger(maxCustomers) || maxCustomers < 1 || maxCustomers > GOOGLE_ADS_MAX_CUSTOMER_CLIENTS) {
+    throw new GoogleAdsApiError(
+      `Customer-client limit must be an integer between 1 and ${GOOGLE_ADS_MAX_CUSTOMER_CLIENTS}`,
+      400
+    );
+  }
+  return { maxDepth, maxCustomers };
+}
+function buildCustomerDetailsQuery() {
+  return selectQuery([
+    "customer.resource_name",
+    "customer.id",
+    "customer.descriptive_name",
+    "customer.currency_code",
+    "customer.time_zone",
+    "customer.manager",
+    "customer.test_account",
+    "customer.status",
+    "customer.auto_tagging_enabled",
+    "customer.conversion_tracking_setting.conversion_tracking_id",
+    "customer.conversion_tracking_setting.conversion_tracking_status",
+    "customer.conversion_tracking_setting.cross_account_conversion_tracking_id",
+    "customer.conversion_tracking_setting.google_ads_conversion_customer"
+  ], "customer", ["LIMIT 1"]);
+}
+function buildCustomerClientsQuery(options = {}) {
+  const { maxDepth, maxCustomers } = normalizeGoogleAdsCustomerClientsOptions(options);
+  return selectQuery([
+    "customer_client.resource_name",
+    "customer_client.client_customer",
+    "customer_client.id",
+    "customer_client.descriptive_name",
+    "customer_client.currency_code",
+    "customer_client.time_zone",
+    "customer_client.manager",
+    "customer_client.test_account",
+    "customer_client.hidden",
+    "customer_client.status",
+    "customer_client.level"
+  ], "customer_client", [
+    `WHERE customer_client.level <= ${maxDepth}`,
+    "ORDER BY customer_client.level ASC, customer_client.id ASC",
+    `LIMIT ${maxCustomers + 1}`
+  ]);
+}
+function parseIsoDate(value, label) {
+  const match = DATE_PATTERN.exec(value);
+  if (!match) {
+    throw new GoogleAdsApiError(`${label} must use YYYY-MM-DD format`, 400);
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const timestamp = Date.UTC(year, month - 1, day);
+  const parsed = new Date(timestamp);
+  if (parsed.getUTCFullYear() !== year || parsed.getUTCMonth() !== month - 1 || parsed.getUTCDate() !== day) {
+    throw new GoogleAdsApiError(`${label} must be a real calendar date`, 400);
+  }
+  return timestamp;
+}
+function dailyMetricClauses(options) {
+  const start = parseIsoDate(options.startDate, "Start date");
+  const end = parseIsoDate(options.endDate, "End date");
+  if (start > end) {
+    throw new GoogleAdsApiError("Start date must be on or before end date", 400);
+  }
+  const inclusiveDays = Math.floor((end - start) / 864e5) + 1;
+  if (inclusiveDays > GOOGLE_ADS_MAX_DAILY_METRICS_DAYS) {
+    throw new GoogleAdsApiError(
+      `Daily metrics range cannot exceed ${GOOGLE_ADS_MAX_DAILY_METRICS_DAYS} days`,
+      400
+    );
+  }
+  const filters = [
+    `segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'`,
+    "campaign.status != 'REMOVED'"
+  ];
+  if (options.campaignIds !== void 0) {
+    if (!Array.isArray(options.campaignIds) || options.campaignIds.length === 0) {
+      throw new GoogleAdsApiError("Campaign IDs must be a non-empty array when provided", 400);
+    }
+    if (options.campaignIds.length > GOOGLE_ADS_MAX_CAMPAIGN_FILTER_IDS) {
+      throw new GoogleAdsApiError(
+        `Campaign ID filter cannot exceed ${GOOGLE_ADS_MAX_CAMPAIGN_FILTER_IDS} IDs`,
+        400
+      );
+    }
+    const normalized = options.campaignIds.map((id) => {
+      const value = id.trim();
+      if (!/^\d+$/.test(value)) {
+        throw new GoogleAdsApiError("Campaign IDs must contain digits only", 400);
+      }
+      return value;
+    });
+    const unique = [...new Set(normalized)];
+    filters.push(`campaign.id IN (${unique.join(", ")})`);
+  }
+  return [
+    `WHERE ${filters.join("\n  AND ")}`,
+    "ORDER BY segments.date ASC, campaign.id ASC",
+    `LIMIT ${validatedLimit(options.limit)}`
+  ];
+}
+function buildCampaignsQuery(options = {}) {
+  const clauses = [];
+  if (!options.includeRemoved) clauses.push("WHERE campaign.status != 'REMOVED'");
+  clauses.push("ORDER BY campaign.id ASC", `LIMIT ${validatedLimit(options.limit)}`);
+  return selectQuery([
+    "campaign.resource_name",
+    "campaign.id",
+    "campaign.name",
+    "campaign.status",
+    "campaign.primary_status",
+    "campaign.serving_status",
+    "campaign.advertising_channel_type",
+    "campaign.advertising_channel_sub_type",
+    "campaign.campaign_budget",
+    "campaign.bidding_strategy",
+    "campaign.bidding_strategy_type",
+    "campaign.maximize_conversions.target_cpa_micros",
+    "campaign.maximize_conversion_value.target_roas",
+    "campaign.target_cpa.target_cpa_micros",
+    "campaign.target_roas.target_roas",
+    "campaign.target_impression_share.cpc_bid_ceiling_micros",
+    "campaign.target_impression_share.location",
+    "campaign.target_impression_share.location_fraction_micros",
+    "campaign.target_spend.cpc_bid_ceiling_micros",
+    "campaign.target_spend.target_spend_micros",
+    "campaign_budget.resource_name",
+    "campaign_budget.id",
+    "campaign_budget.name",
+    "campaign_budget.amount_micros",
+    "campaign_budget.total_amount_micros",
+    "campaign_budget.status",
+    "campaign_budget.explicitly_shared",
+    "bidding_strategy.resource_name",
+    "bidding_strategy.id",
+    "bidding_strategy.name",
+    "bidding_strategy.status",
+    "bidding_strategy.type",
+    "bidding_strategy.maximize_conversions.target_cpa_micros",
+    "bidding_strategy.maximize_conversion_value.target_roas",
+    "bidding_strategy.target_cpa.target_cpa_micros",
+    "bidding_strategy.target_roas.target_roas"
+  ], "campaign", clauses);
+}
+function buildConversionActionsQuery(options = {}) {
+  const clauses = [];
+  if (!options.includeRemoved) clauses.push("WHERE conversion_action.status != 'REMOVED'");
+  clauses.push("ORDER BY conversion_action.id ASC", `LIMIT ${validatedLimit(options.limit)}`);
+  return selectQuery([
+    "conversion_action.resource_name",
+    "conversion_action.id",
+    "conversion_action.name",
+    "conversion_action.status",
+    "conversion_action.type",
+    "conversion_action.category",
+    "conversion_action.origin",
+    "conversion_action.owner_customer",
+    "conversion_action.primary_for_goal",
+    "conversion_action.include_in_conversions_metric",
+    "conversion_action.counting_type",
+    "conversion_action.click_through_lookback_window_days",
+    "conversion_action.view_through_lookback_window_days",
+    "conversion_action.attribution_model_settings.attribution_model",
+    "conversion_action.value_settings.always_use_default_value",
+    "conversion_action.value_settings.default_currency_code",
+    "conversion_action.value_settings.default_value",
+    "conversion_action.google_analytics_4_settings.event_name",
+    "conversion_action.google_analytics_4_settings.property_id",
+    "conversion_action.google_analytics_4_settings.property_name",
+    "conversion_action.tag_snippets"
+  ], "conversion_action", clauses);
+}
+function buildCustomerConversionGoalsQuery(limit) {
+  return selectQuery([
+    "customer_conversion_goal.resource_name",
+    "customer_conversion_goal.category",
+    "customer_conversion_goal.origin",
+    "customer_conversion_goal.biddable"
+  ], "customer_conversion_goal", [
+    "ORDER BY customer_conversion_goal.category ASC, customer_conversion_goal.origin ASC",
+    `LIMIT ${validatedLimit(limit)}`
+  ]);
+}
+function buildCampaignConversionGoalsQuery(limit) {
+  return selectQuery([
+    "campaign_conversion_goal.resource_name",
+    "campaign_conversion_goal.campaign",
+    "campaign_conversion_goal.category",
+    "campaign_conversion_goal.origin",
+    "campaign_conversion_goal.biddable",
+    "campaign.resource_name",
+    "campaign.id",
+    "campaign.name",
+    "campaign.status"
+  ], "campaign_conversion_goal", [
+    "WHERE campaign.status != 'REMOVED'",
+    "ORDER BY campaign.id ASC, campaign_conversion_goal.category ASC, campaign_conversion_goal.origin ASC",
+    `LIMIT ${validatedLimit(limit)}`
+  ]);
+}
+function buildCustomConversionGoalsQuery(limit) {
+  return selectQuery([
+    "custom_conversion_goal.resource_name",
+    "custom_conversion_goal.id",
+    "custom_conversion_goal.name",
+    "custom_conversion_goal.status",
+    "custom_conversion_goal.conversion_actions"
+  ], "custom_conversion_goal", [
+    "ORDER BY custom_conversion_goal.id ASC",
+    `LIMIT ${validatedLimit(limit)}`
+  ]);
+}
+function buildConversionGoalCampaignConfigsQuery(limit) {
+  return selectQuery([
+    "conversion_goal_campaign_config.resource_name",
+    "conversion_goal_campaign_config.campaign",
+    "conversion_goal_campaign_config.custom_conversion_goal",
+    "conversion_goal_campaign_config.goal_config_level",
+    "campaign.resource_name",
+    "campaign.id",
+    "campaign.name",
+    "campaign.status"
+  ], "conversion_goal_campaign_config", [
+    "WHERE campaign.status != 'REMOVED'",
+    "ORDER BY campaign.id ASC",
+    `LIMIT ${validatedLimit(limit)}`
+  ]);
+}
+function buildDailyCampaignMetricsQuery(options) {
+  return selectQuery([
+    "segments.date",
+    "campaign.resource_name",
+    "campaign.id",
+    "campaign.name",
+    "campaign.status",
+    "metrics.impressions",
+    "metrics.clicks",
+    "metrics.cost_micros",
+    "metrics.average_cpc",
+    "metrics.ctr",
+    "metrics.conversions",
+    "metrics.conversions_value",
+    "metrics.all_conversions",
+    "metrics.all_conversions_value",
+    "metrics.search_impression_share"
+  ], "campaign", dailyMetricClauses(options));
+}
+function buildDailyConversionMetricsQuery(options) {
+  return selectQuery([
+    "segments.date",
+    "segments.conversion_action",
+    "segments.conversion_action_name",
+    "segments.conversion_action_category",
+    "campaign.resource_name",
+    "campaign.id",
+    "campaign.name",
+    "campaign.status",
+    "metrics.conversions",
+    "metrics.conversions_value",
+    "metrics.all_conversions",
+    "metrics.all_conversions_value"
+  ], "campaign", dailyMetricClauses(options));
+}
+
+// ../integration-google-ads/src/google-ads-client.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function sanitizeText(value, secrets) {
+  let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
+  for (const secret of secrets) {
+    if (!secret) continue;
+    sanitized = sanitized.replace(new RegExp(escapeRegExp(secret), "g"), "***");
+    const encoded = encodeURIComponent(secret);
+    if (encoded !== secret) {
+      sanitized = sanitized.replace(new RegExp(escapeRegExp(encoded), "g"), "***");
+    }
+  }
+  return sanitized.length <= 1e3 ? sanitized : `${sanitized.slice(0, 1e3)}... [truncated]`;
+}
+function safeRequestId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (trimmed === "" || trimmed.length > 256 || /[\r\n]/.test(trimmed)) return void 0;
+  return trimmed;
+}
+function findRequestId(value, depth = 0) {
+  if (depth > 6 || value === null || typeof value !== "object") return void 0;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = findRequestId(item, depth + 1);
+      if (found) return found;
+    }
+    return void 0;
+  }
+  const record = value;
+  const direct = safeRequestId(record.requestId) ?? safeRequestId(record.request_id);
+  if (direct) return direct;
+  for (const nested of Object.values(record)) {
+    const found = findRequestId(nested, depth + 1);
+    if (found) return found;
+  }
+  return void 0;
+}
+function providerErrorParts(payload) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return {};
+  const envelope = payload;
+  const message = typeof envelope.error?.message === "string" ? envelope.error.message : void 0;
+  const providerStatus = typeof envelope.error?.status === "string" ? envelope.error.status : void 0;
+  const requestId = findRequestId(envelope.error?.details);
+  return { message, providerStatus, requestId };
+}
+function validateCredential(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new GoogleAdsApiError(`${label} is required`, 400);
+  }
+  return value.trim();
+}
+function validatedAccessibleCustomerLimit(value) {
+  const limit = value ?? GOOGLE_ADS_DEFAULT_ACCESSIBLE_CUSTOMER_DETAILS;
+  if (!Number.isInteger(limit) || limit < 1 || limit > GOOGLE_ADS_MAX_ACCESSIBLE_CUSTOMER_DETAILS) {
+    throw new GoogleAdsApiError(
+      `Accessible customer detail limit must be an integer between 1 and ${GOOGLE_ADS_MAX_ACCESSIBLE_CUSTOMER_DETAILS}`,
+      400
+    );
+  }
+  return limit;
+}
+function customerIdFromResourceName(resourceName) {
+  const match = /^customers\/(\d{10})$/.exec(resourceName);
+  if (!match) {
+    throw new GoogleAdsApiError(
+      "Google Ads API returned an invalid accessible customer resource name",
+      502
+    );
+  }
+  return match[1];
+}
+function isCustomerClientRow(row) {
+  return row.customerClient !== void 0;
+}
+var GoogleAdsClient = class {
+  #accessToken;
+  #developerToken;
+  #loginCustomerId;
+  #fetch;
+  #requestTimeoutMs;
+  #retry;
+  constructor(credentials, options = {}) {
+    this.#accessToken = validateCredential(credentials.accessToken, "Access token");
+    this.#developerToken = validateCredential(credentials.developerToken, "Developer token");
+    this.#loginCustomerId = credentials.loginCustomerId === void 0 ? void 0 : normalizeGoogleAdsCustomerId(credentials.loginCustomerId, "Login customer ID");
+    this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.#requestTimeoutMs = options.requestTimeoutMs ?? GOOGLE_ADS_REQUEST_TIMEOUT_MS;
+    if (!Number.isInteger(this.#requestTimeoutMs) || this.#requestTimeoutMs < 1) {
+      throw new GoogleAdsApiError("Request timeout must be a positive integer in milliseconds", 400);
+    }
+    this.#retry = options.retry ?? {};
+  }
+  async listAccessibleCustomers() {
+    const result = await this.#requestJson(
+      "list-accessible-customers",
+      "/customers:listAccessibleCustomers",
+      { method: "GET" },
+      false
+    );
+    const resourceNames = result.data.resourceNames ?? [];
+    if (!Array.isArray(resourceNames) || resourceNames.some((name) => typeof name !== "string")) {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned an invalid accessible-customer response",
+        502,
+        void 0,
+        result.metadata.requestId
+      );
+    }
+    return { ...result, data: { resourceNames } };
+  }
+  async getCustomerDetails(customerId) {
+    const result = await this.#searchStream(
+      customerId,
+      "customer-details",
+      buildCustomerDetailsQuery()
+    );
+    if (result.data.length !== 1 || !result.data[0]?.customer) {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned an invalid customer detail response",
+        502,
+        void 0,
+        result.metadata.requestId
+      );
+    }
+    return { data: result.data[0].customer, metadata: result.metadata };
+  }
+  async listAccessibleCustomerDetails(options = {}) {
+    const maxCustomers = validatedAccessibleCustomerLimit(options.maxCustomers);
+    const accessible = await this.listAccessibleCustomers();
+    const resourceNames = accessible.data.resourceNames.slice(0, maxCustomers);
+    const attempts = await mapWithConcurrency(
+      resourceNames,
+      GOOGLE_ADS_CUSTOMER_DETAIL_CONCURRENCY,
+      async (resourceName) => {
+        let customerId;
+        try {
+          customerId = customerIdFromResourceName(resourceName);
+          const result = await this.getCustomerDetails(customerId);
+          return { customer: result.data, metadata: result.metadata };
+        } catch (error) {
+          const googleAdsError = error instanceof GoogleAdsApiError ? error : void 0;
+          const detail = describeError(error);
+          return {
+            failure: {
+              resourceName,
+              ...customerId ? { customerId } : {},
+              ...googleAdsError?.status !== void 0 ? { status: googleAdsError.status } : {},
+              ...googleAdsError?.providerStatus ? { providerStatus: googleAdsError.providerStatus } : {},
+              ...googleAdsError?.requestId ? { requestId: googleAdsError.requestId } : {},
+              message: sanitizeText(detail, this.#secrets())
+            },
+            ...customerId ? {
+              metadata: {
+                apiVersion: GOOGLE_ADS_API_VERSION,
+                operation: "customer-details",
+                ...googleAdsError?.requestId ? { requestId: googleAdsError.requestId } : {}
+              }
+            } : {}
+          };
+        }
+      }
+    );
+    const customers = attempts.flatMap((attempt) => attempt.customer ? [attempt.customer] : []);
+    const failures = attempts.flatMap((attempt) => attempt.failure ? [attempt.failure] : []);
+    const omitted = accessible.data.resourceNames.length - resourceNames.length;
+    return {
+      data: {
+        customers,
+        failures,
+        totalAccessible: accessible.data.resourceNames.length,
+        attempted: resourceNames.length,
+        returned: customers.length,
+        truncated: omitted > 0,
+        omitted
+      },
+      metadata: {
+        apiVersion: GOOGLE_ADS_API_VERSION,
+        requests: [
+          accessible.metadata,
+          ...attempts.flatMap((attempt) => attempt.metadata ? [attempt.metadata] : [])
+        ]
+      }
+    };
+  }
+  async getCustomerClients(customerId, options = {}) {
+    const normalizedOptions = normalizeGoogleAdsCustomerClientsOptions(options);
+    const result = await this.#searchStream(
+      customerId,
+      "customer-clients",
+      buildCustomerClientsQuery(normalizedOptions)
+    );
+    if (!result.data.every(isCustomerClientRow)) {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned an invalid customer-client response",
+        502,
+        void 0,
+        result.metadata.requestId
+      );
+    }
+    const truncated = result.data.length > normalizedOptions.maxCustomers;
+    const customerClients = result.data.slice(0, normalizedOptions.maxCustomers).map((row) => row.customerClient);
+    return {
+      data: {
+        customerClients,
+        maxDepth: normalizedOptions.maxDepth,
+        returned: customerClients.length,
+        truncated
+      },
+      metadata: result.metadata
+    };
+  }
+  async getCampaigns(customerId, options = {}) {
+    return this.#searchStream(customerId, "campaigns", buildCampaignsQuery(options));
+  }
+  async getConversionActions(customerId, options = {}) {
+    return this.#searchStream(customerId, "conversion-actions", buildConversionActionsQuery(options));
+  }
+  async getConversionGoals(customerId) {
+    const normalizedCustomerId = normalizeGoogleAdsCustomerId(customerId);
+    const [conversionActions, customerGoals, campaignGoals, customGoals, campaignConfigs] = await Promise.all([
+      this.#searchStream(
+        normalizedCustomerId,
+        "conversion-actions",
+        buildConversionActionsQuery({ includeRemoved: true })
+      ),
+      this.#searchStream(
+        normalizedCustomerId,
+        "customer-conversion-goals",
+        buildCustomerConversionGoalsQuery()
+      ),
+      this.#searchStream(
+        normalizedCustomerId,
+        "campaign-conversion-goals",
+        buildCampaignConversionGoalsQuery()
+      ),
+      this.#searchStream(
+        normalizedCustomerId,
+        "custom-conversion-goals",
+        buildCustomConversionGoalsQuery()
+      ),
+      this.#searchStream(
+        normalizedCustomerId,
+        "conversion-goal-campaign-configs",
+        buildConversionGoalCampaignConfigsQuery()
+      )
+    ]);
+    const raw = {
+      conversionActions: conversionActions.data,
+      customerGoals: customerGoals.data,
+      campaignGoals: campaignGoals.data,
+      customGoals: customGoals.data,
+      campaignConfigs: campaignConfigs.data
+    };
+    return {
+      data: {
+        ...raw,
+        // A result exactly at the cap may have more rows upstream. Treat it
+        // as incomplete rather than silently deriving absent campaign goals.
+        campaignGoalsComplete: campaignGoals.data.length < GOOGLE_ADS_MAX_RESULT_ROWS,
+        effectiveCampaignGoalInputs: resolveEffectiveCampaignGoalInputs(raw)
+      },
+      metadata: {
+        apiVersion: GOOGLE_ADS_API_VERSION,
+        requests: [
+          conversionActions.metadata,
+          customerGoals.metadata,
+          campaignGoals.metadata,
+          customGoals.metadata,
+          campaignConfigs.metadata
+        ]
+      }
+    };
+  }
+  async getDailyCampaignMetrics(customerId, options) {
+    return this.#searchStream(
+      customerId,
+      "daily-campaign-metrics",
+      buildDailyCampaignMetricsQuery(options)
+    );
+  }
+  async getDailyConversionMetrics(customerId, options) {
+    return this.#searchStream(
+      customerId,
+      "daily-conversion-metrics",
+      buildDailyConversionMetricsQuery(options)
+    );
+  }
+  async #searchStream(customerId, operation, query) {
+    const normalizedCustomerId = normalizeGoogleAdsCustomerId(customerId);
+    const result = await this.#requestJson(
+      operation,
+      `/customers/${normalizedCustomerId}/googleAds:searchStream`,
+      {
+        method: "POST",
+        body: JSON.stringify({ query })
+      },
+      true
+    );
+    if (!Array.isArray(result.data)) {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned an invalid searchStream response",
+        502,
+        void 0,
+        result.metadata.requestId
+      );
+    }
+    const rows = [];
+    let requestId = result.metadata.requestId;
+    for (const chunk of result.data) {
+      if (Array.isArray(chunk.results)) rows.push(...chunk.results);
+      requestId ??= safeRequestId(chunk.requestId);
+    }
+    return {
+      data: rows,
+      metadata: {
+        ...result.metadata,
+        ...requestId ? { requestId } : {}
+      }
+    };
+  }
+  async #requestJson(operation, path9, init, includeLoginCustomerId) {
+    const maxRetries = this.#retry.maxRetries ?? GOOGLE_ADS_MAX_RETRIES;
+    const baseDelayMs = this.#retry.baseDelayMs ?? GOOGLE_ADS_RETRY_BASE_DELAY_MS;
+    const maxDelayMs = this.#retry.maxDelayMs ?? GOOGLE_ADS_RETRY_MAX_DELAY_MS;
+    return withRetry(
+      () => this.#requestJsonOnce(operation, path9, init, includeLoginCustomerId),
+      {
+        maxRetries,
+        baseDelayMs,
+        maxDelayMs,
+        jitter: this.#retry.jitter,
+        sleep: this.#retry.sleep,
+        isRetryable: isRetryableHttpError,
+        computeDelayMs: (_attempt, error, defaultMs) => retryAfterDelayMs(error) ?? defaultMs
+      }
+    );
+  }
+  async #requestJsonOnce(operation, path9, init, includeLoginCustomerId) {
+    const headers = {
+      Authorization: `Bearer ${this.#accessToken}`,
+      "Content-Type": "application/json",
+      "developer-token": this.#developerToken
+    };
+    if (includeLoginCustomerId && this.#loginCustomerId) {
+      headers["login-customer-id"] = this.#loginCustomerId;
+    }
+    let response;
+    try {
+      response = await this.#fetch(`${GOOGLE_ADS_API_BASE}${path9}`, {
+        ...init,
+        headers,
+        signal: AbortSignal.timeout(this.#requestTimeoutMs)
+      });
+    } catch (error) {
+      const detail = describeError(error);
+      throw new GoogleAdsApiError(
+        `Google Ads API request failed: ${sanitizeText(detail, this.#secrets())}`
+      );
+    }
+    const headerRequestId = safeRequestId(response.headers.get("request-id")) ?? safeRequestId(response.headers.get("google-ads-request-id"));
+    const retryAfter = response.headers.get("retry-after") ?? void 0;
+    let body;
+    try {
+      body = await response.text();
+    } catch (error) {
+      const detail = describeError(error);
+      throw new GoogleAdsApiError(
+        `Google Ads API response failed: ${sanitizeText(detail, this.#secrets())}`,
+        void 0,
+        void 0,
+        headerRequestId
+      );
+    }
+    let payload;
+    try {
+      payload = body.trim() === "" ? null : JSON.parse(body);
+    } catch {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned invalid JSON",
+        502,
+        void 0,
+        headerRequestId,
+        retryAfter
+      );
+    }
+    if (!response.ok) {
+      const provider = providerErrorParts(payload);
+      const requestId = headerRequestId ?? provider.requestId;
+      const rawDetail = provider.message ?? (body.trim() || response.statusText);
+      const detail = sanitizeText(rawDetail, this.#secrets());
+      throw new GoogleAdsApiError(
+        `Google Ads API error (${response.status}): ${detail}`,
+        response.status,
+        provider.providerStatus,
+        requestId,
+        retryAfter
+      );
+    }
+    if (payload === null) {
+      throw new GoogleAdsApiError(
+        "Google Ads API returned an empty response",
+        502,
+        void 0,
+        headerRequestId
+      );
+    }
+    return {
+      data: payload,
+      metadata: {
+        apiVersion: GOOGLE_ADS_API_VERSION,
+        operation,
+        ...headerRequestId ? { requestId: headerRequestId } : {}
+      }
+    };
+  }
+  #secrets() {
+    return [this.#accessToken, this.#developerToken];
+  }
+};
+
+// ../integration-google-tag-manager/src/constants.ts
+var GTM_API_BASE = "https://tagmanager.googleapis.com/tagmanager/v2";
+var GTM_READONLY_SCOPE = "https://www.googleapis.com/auth/tagmanager.readonly";
+var GTM_REQUEST_TIMEOUT_MS = 3e4;
+var GTM_MAX_PAGES = 200;
+var GTM_SNAPSHOT_SCHEMA_VERSION = "gtm-container-snapshot-v1";
+var GTM_COMPARISON_SCHEMA_VERSION = "gtm-container-comparison-v1";
+var GTM_GOOGLE_ADS_CONVERSION_RECOGNIZER_VERSION = "google-ads-conversion-v1";
+var GTM_GOOGLE_ADS_CONVERSION_ASSESSMENT_SCHEMA_VERSION = "gtm-google-ads-conversion-assessment-v1";
+
+// ../integration-google-tag-manager/src/checksum.ts
+import crypto2 from "crypto";
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value !== "object") throw new TypeError("Value is not JSON-serializable");
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const object = value;
+  const members = Object.keys(object).filter((key) => object[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`);
+  return `{${members.join(",")}}`;
+}
+function checksumJson(value) {
+  return crypto2.createHash("sha256").update(stableStringify(value)).digest("hex");
+}
+
+// ../integration-google-tag-manager/src/types.ts
+var GtmApiError = class extends Error {
+  status;
+  providerStatus;
+  reason;
+  retryAfter;
+  requestId;
+  constructor(message, status, options = {}) {
+    super(message);
+    this.name = "GtmApiError";
+    this.status = status;
+    this.providerStatus = options.providerStatus ?? null;
+    this.reason = options.reason ?? null;
+    this.retryAfter = options.retryAfter ?? null;
+    this.requestId = options.requestId ?? null;
+  }
+};
+
+// ../integration-google-tag-manager/src/http.ts
+function safeMessage(body, status, accessToken) {
+  const payload = body;
+  const providerMessage = payload?.error?.message;
+  const message = typeof providerMessage === "string" ? providerMessage : `Tag Manager request failed (HTTP ${status})`;
+  const redacted = accessToken ? message.replaceAll(accessToken, "[redacted]") : message;
+  return redacted.replace(/[\r\n\t]+/g, " ").slice(0, 500);
+}
+function providerReason(body) {
+  const payload = body;
+  for (const detail of payload?.error?.details ?? []) {
+    if (typeof detail.reason === "string") return detail.reason;
+  }
+  return null;
+}
+async function fetchOnce(url, accessToken, options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? GTM_REQUEST_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        accept: "application/json"
+      },
+      signal: controller.signal
+    });
+    const text = await response.text();
+    let body = void 0;
+    let invalidJson = false;
+    if (text) {
+      try {
+        body = JSON.parse(text);
+      } catch {
+        invalidJson = true;
+      }
+    }
+    if (!response.ok) {
+      const payload = body;
+      throw new GtmApiError(safeMessage(body, response.status, accessToken), response.status, {
+        providerStatus: payload?.error?.status ?? null,
+        reason: providerReason(body),
+        retryAfter: response.headers.get("retry-after"),
+        requestId: response.headers.get("x-request-id")
+      });
+    }
+    if (invalidJson) {
+      throw new GtmApiError("Tag Manager returned invalid JSON", 502, {
+        reason: "INVALID_PROVIDER_RESPONSE",
+        retryAfter: response.headers.get("retry-after"),
+        requestId: response.headers.get("x-request-id")
+      });
+    }
+    return body;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function gtmFetchGet(url, accessToken, options) {
+  return withRetry(() => fetchOnce(url, accessToken, options), {
+    maxRetries: options.retry?.maxRetries ?? 3,
+    baseDelayMs: options.retry?.baseDelayMs ?? 1e3,
+    jitter: true,
+    isRetryable: isRetryableHttpError,
+    computeDelayMs: (_attempt, error, defaultMs) => retryAfterDelayMs(error) ?? defaultMs,
+    sleep: options.retry?.sleep
+  });
+}
+
+// ../integration-google-tag-manager/src/snapshot.ts
+var COMPARISON_METADATA_KEYS = /* @__PURE__ */ new Set([
+  "accountId",
+  "containerId",
+  "workspaceId",
+  "path",
+  "fingerprint",
+  "tagManagerUrl"
+]);
+function comparisonValue(raw) {
+  return Object.fromEntries(
+    Object.entries(raw).filter(([key]) => !COMPARISON_METADATA_KEYS.has(key))
+  );
+}
+function resourceId(kind, raw) {
+  const explicit = kind === "tag" ? raw.tagId : kind === "trigger" ? raw.triggerId : kind === "variable" ? raw.variableId : kind === "folder" ? raw.folderId : raw.type;
+  if (explicit) return explicit;
+  if (raw.path) {
+    const finalSegment = raw.path.split("/").filter(Boolean).at(-1);
+    if (finalSegment) return finalSegment;
+  }
+  if (raw.name) return `name:${raw.name}`;
+  return `anonymous:${checksumJson(raw)}`;
+}
+function snapshotEntity(kind, raw) {
+  return {
+    kind,
+    id: resourceId(kind, raw),
+    name: raw.name ?? null,
+    fingerprint: "fingerprint" in raw && typeof raw.fingerprint === "string" ? raw.fingerprint : null,
+    checksum: checksumJson(raw),
+    contentChecksum: checksumJson(comparisonValue(raw)),
+    raw
+  };
+}
+function snapshotEntities(lists) {
+  const entities = {
+    tags: lists.tags.map((raw) => snapshotEntity("tag", raw)),
+    triggers: lists.triggers.map((raw) => snapshotEntity("trigger", raw)),
+    variables: lists.variables.map((raw) => snapshotEntity("variable", raw)),
+    folders: lists.folders.map((raw) => snapshotEntity("folder", raw)),
+    builtInVariables: lists.builtInVariables.map((raw) => snapshotEntity("builtInVariable", raw))
+  };
+  entities.tags.sort((left, right) => left.id.localeCompare(right.id));
+  entities.triggers.sort((left, right) => left.id.localeCompare(right.id));
+  entities.variables.sort((left, right) => left.id.localeCompare(right.id));
+  entities.folders.sort((left, right) => left.id.localeCompare(right.id));
+  entities.builtInVariables.sort((left, right) => left.id.localeCompare(right.id));
+  assertUniqueIdentities(entities);
+  return entities;
+}
+function allEntities(sets) {
+  return [
+    ...sets.tags,
+    ...sets.triggers,
+    ...sets.variables,
+    ...sets.folders,
+    ...sets.builtInVariables
+  ];
+}
+function assertUniqueIdentities(sets) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const entity of allEntities(sets)) {
+    const identity = `${entity.kind}:${entity.id}`;
+    if (seen.has(identity)) {
+      throw new GtmApiError(`Tag Manager returned duplicate ${entity.kind} identity`, 502, {
+        reason: "DUPLICATE_ENTITY_IDENTITY"
+      });
+    }
+    seen.add(identity);
+  }
+}
+function snapshotChecksum(accountId, containerId, entities) {
+  return checksumJson({
+    accountId,
+    containerId,
+    entities: allEntities(entities).map((entity) => ({
+      kind: entity.kind,
+      id: entity.id,
+      contentChecksum: entity.contentChecksum
+    }))
+  });
+}
+function buildLiveSnapshot(version) {
+  const entities = snapshotEntities({
+    tags: version.tag ?? [],
+    triggers: version.trigger ?? [],
+    variables: version.variable ?? [],
+    folders: version.folder ?? [],
+    builtInVariables: version.builtInVariable ?? []
+  });
+  const accountId = version.accountId ?? null;
+  const containerId = version.containerId ?? null;
+  return {
+    schemaVersion: GTM_SNAPSHOT_SCHEMA_VERSION,
+    source: "live",
+    identity: {
+      accountId,
+      containerId,
+      containerVersionId: version.containerVersionId ?? null,
+      workspaceId: null,
+      path: version.path ?? null,
+      fingerprint: version.fingerprint ?? null
+    },
+    entities,
+    checksum: snapshotChecksum(accountId, containerId, entities),
+    raw: { containerVersion: version }
+  };
+}
+function buildWorkspaceSnapshot(workspace, status, lists) {
+  const entities = snapshotEntities(lists);
+  const accountId = workspace.accountId ?? null;
+  const containerId = workspace.containerId ?? null;
+  return {
+    schemaVersion: GTM_SNAPSHOT_SCHEMA_VERSION,
+    source: "workspace",
+    identity: {
+      accountId,
+      containerId,
+      containerVersionId: null,
+      workspaceId: workspace.workspaceId ?? null,
+      path: workspace.path ?? null,
+      fingerprint: workspace.fingerprint ?? null
+    },
+    entities,
+    checksum: snapshotChecksum(accountId, containerId, entities),
+    raw: { workspace, workspaceStatus: status }
+  };
+}
+function fingerprintMatches(live, draft) {
+  if (!live?.fingerprint || !draft?.fingerprint) return null;
+  return live.fingerprint === draft.fingerprint;
+}
+function compareContainerSnapshots(live, draft) {
+  if (live.source !== "live" || draft.source !== "workspace") {
+    throw new GtmApiError("Comparison requires one live snapshot and one workspace snapshot", 400, {
+      reason: "INVALID_SNAPSHOT_PAIR"
+    });
+  }
+  if (live.identity.accountId !== draft.identity.accountId || live.identity.containerId !== draft.identity.containerId) {
+    throw new GtmApiError("Live and workspace snapshots belong to different containers", 400, {
+      reason: "CONTAINER_IDENTITY_MISMATCH"
+    });
+  }
+  const liveByIdentity = new Map(allEntities(live.entities).map((entity) => [`${entity.kind}:${entity.id}`, entity]));
+  const draftByIdentity = new Map(allEntities(draft.entities).map((entity) => [`${entity.kind}:${entity.id}`, entity]));
+  const identities = [.../* @__PURE__ */ new Set([...liveByIdentity.keys(), ...draftByIdentity.keys()])].sort();
+  const changes = identities.map((identity) => {
+    const liveEntity = liveByIdentity.get(identity);
+    const draftEntity = draftByIdentity.get(identity);
+    const contentMatches = Boolean(
+      liveEntity && draftEntity && liveEntity.contentChecksum === draftEntity.contentChecksum
+    );
+    const status = !liveEntity ? "added" : !draftEntity ? "removed" : contentMatches ? "unchanged" : "changed";
+    const entity = draftEntity ?? liveEntity;
+    if (!entity) throw new Error("Entity comparison invariant failed");
+    return {
+      kind: entity.kind,
+      id: entity.id,
+      name: entity.name,
+      status,
+      contentMatches,
+      providerFingerprintMatches: fingerprintMatches(liveEntity, draftEntity),
+      live: liveEntity ?? null,
+      draft: draftEntity ?? null
+    };
+  });
+  const workspaceStatus = draft.raw.workspaceStatus ?? {};
+  const workspaceChanges = workspaceStatus.workspaceChange ?? [];
+  const mergeConflicts = workspaceStatus.mergeConflict ?? [];
+  const hasConflicts = mergeConflicts.length > 0;
+  const hasUnpublishedChanges = hasConflicts || workspaceChanges.length > 0 || changes.some((change) => change.status !== "unchanged");
+  return {
+    schemaVersion: GTM_COMPARISON_SCHEMA_VERSION,
+    state: hasConflicts ? "conflicted" : hasUnpublishedChanges ? "unpublished-changes" : "in-sync",
+    hasUnpublishedChanges,
+    hasConflicts,
+    liveChecksum: live.checksum,
+    draftChecksum: draft.checksum,
+    changes,
+    workspaceChanges,
+    mergeConflicts
+  };
+}
+
+// ../integration-google-tag-manager/src/client.ts
+var GTM_ID_SEGMENT = String.raw`[\w-]+`;
+var PATH_PATTERNS = {
+  account: new RegExp(`^accounts/${GTM_ID_SEGMENT}$`),
+  container: new RegExp(`^accounts/${GTM_ID_SEGMENT}/containers/${GTM_ID_SEGMENT}$`),
+  workspace: new RegExp(
+    `^accounts/${GTM_ID_SEGMENT}/containers/${GTM_ID_SEGMENT}/workspaces/${GTM_ID_SEGMENT}$`
+  )
+};
+function assertAccessToken(accessToken) {
+  if (typeof accessToken !== "string" || accessToken.trim() === "") {
+    throw new GtmApiError("OAuth access token is required", 400, { reason: "INVALID_ACCESS_TOKEN" });
+  }
+}
+function assertPath(path9, kind) {
+  if (!PATH_PATTERNS[kind].test(path9)) {
+    throw new GtmApiError(`Invalid Tag Manager ${kind} resource path`, 400, {
+      reason: "INVALID_RESOURCE_PATH"
+    });
+  }
+}
+function apiUrl(path9, pageToken) {
+  const url = new URL(`${GTM_API_BASE}/${path9}`);
+  if (pageToken !== void 0) url.searchParams.set("pageToken", pageToken);
+  return url.toString();
+}
+async function listCollection(accessToken, path9, responseKey, options) {
+  const collected = [];
+  const seenTokens = /* @__PURE__ */ new Set();
+  let pageToken;
+  for (let page = 0; page < GTM_MAX_PAGES; page++) {
+    const response = await gtmFetchGet(apiUrl(path9, pageToken), accessToken, options);
+    const values = response[responseKey];
+    if (values !== void 0 && !Array.isArray(values)) {
+      throw new GtmApiError(`Tag Manager returned an invalid ${responseKey} list`, 502, {
+        reason: "INVALID_PROVIDER_RESPONSE"
+      });
+    }
+    collected.push(...values ?? []);
+    const nextPageToken = response.nextPageToken;
+    if (nextPageToken === void 0 || nextPageToken === "") return collected;
+    if (typeof nextPageToken !== "string" || seenTokens.has(nextPageToken)) {
+      throw new GtmApiError("Tag Manager returned an invalid pagination token", 502, {
+        reason: "INVALID_PROVIDER_PAGINATION"
+      });
+    }
+    seenTokens.add(nextPageToken);
+    pageToken = nextPageToken;
+  }
+  throw new GtmApiError("Tag Manager pagination exceeded the safety limit", 502, {
+    reason: "PAGINATION_LIMIT_EXCEEDED"
+  });
+}
+function createGoogleTagManagerClient(accessToken, options = {}) {
+  assertAccessToken(accessToken);
+  const listAccounts = () => listCollection(accessToken, "accounts", "account", options);
+  const listContainers = async (accountPath2) => {
+    assertPath(accountPath2, "account");
+    return listCollection(accessToken, `${accountPath2}/containers`, "container", options);
+  };
+  const listWorkspaces = async (containerPath2) => {
+    assertPath(containerPath2, "container");
+    return listCollection(accessToken, `${containerPath2}/workspaces`, "workspace", options);
+  };
+  const getLiveContainerVersion = async (containerPath2) => {
+    assertPath(containerPath2, "container");
+    return gtmFetchGet(
+      `${GTM_API_BASE}/${containerPath2}/versions:live`,
+      accessToken,
+      options
+    );
+  };
+  const getLiveSnapshot = async (containerPath2) => buildLiveSnapshot(await getLiveContainerVersion(containerPath2));
+  const getWorkspaceSnapshot = async (workspacePath2) => {
+    assertPath(workspacePath2, "workspace");
+    const [workspace, status, tags, triggers, variables, folders, builtInVariables] = await Promise.all([
+      gtmFetchGet(`${GTM_API_BASE}/${workspacePath2}`, accessToken, options),
+      gtmFetchGet(`${GTM_API_BASE}/${workspacePath2}/status`, accessToken, options),
+      listCollection(accessToken, `${workspacePath2}/tags`, "tag", options),
+      listCollection(accessToken, `${workspacePath2}/triggers`, "trigger", options),
+      listCollection(accessToken, `${workspacePath2}/variables`, "variable", options),
+      listCollection(accessToken, `${workspacePath2}/folders`, "folder", options),
+      listCollection(
+        accessToken,
+        `${workspacePath2}/built_in_variables`,
+        "builtInVariable",
+        options
+      )
+    ]);
+    return buildWorkspaceSnapshot(workspace, status, { tags, triggers, variables, folders, builtInVariables });
+  };
+  const compareLiveAndWorkspace = async (containerPath2, workspacePath2) => {
+    const [live, workspace] = await Promise.all([
+      getLiveSnapshot(containerPath2),
+      getWorkspaceSnapshot(workspacePath2)
+    ]);
+    return compareContainerSnapshots(live, workspace);
+  };
+  return {
+    listAccounts,
+    listContainers,
+    listWorkspaces,
+    getLiveContainerVersion,
+    getLiveSnapshot,
+    getWorkspaceSnapshot,
+    compareLiveAndWorkspace
+  };
+}
+
+// ../integration-google-tag-manager/src/recognizer.ts
+var GOOGLE_ADS_CONVERSION_TAG_TYPE = "awct";
+var URL_TRIGGER_TYPES = /* @__PURE__ */ new Set([
+  "pageview",
+  "domReady",
+  "windowLoaded",
+  "init",
+  "consentInit",
+  "serverPageview",
+  "historyChange"
+]);
+function unknownReason(tagType) {
+  if (tagType === "html") return "custom-html";
+  if (tagType === "cvt" || tagType?.startsWith("cvt_")) return "custom-template";
+  return "unsupported-tag-type";
+}
+function parametersByKey(parameters) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const parameter of parameters ?? []) {
+    if (!parameter.key) continue;
+    const values = byKey.get(parameter.key) ?? [];
+    values.push(parameter);
+    byKey.set(parameter.key, values);
+  }
+  return byKey;
+}
+function scalarMapping(byKey, key) {
+  const parameters = byKey.get(key);
+  if (parameters?.length !== 1) return null;
+  const parameter = parameters[0];
+  if (typeof parameter.value !== "string" || parameter.list || parameter.map) return null;
+  const trimmed = parameter.value.trim();
+  const hasVariable = parameter.value.includes("{{") && parameter.value.includes("}}");
+  const onlyVariable = trimmed.startsWith("{{") && trimmed.endsWith("}}");
+  return {
+    parameterKey: key,
+    value: parameter.value,
+    source: onlyVariable ? "variable" : hasVariable ? "mixed" : "literal"
+  };
+}
+function conditions(trigger) {
+  return [
+    ...trigger.customEventFilter ?? [],
+    ...trigger.filter ?? [],
+    ...trigger.autoEventFilter ?? []
+  ];
+}
+function conditionParameter(condition, key) {
+  const parameter = condition.parameter?.find((candidate) => candidate.key === key);
+  return typeof parameter?.value === "string" ? parameter.value : null;
+}
+function normalizedVariableName(value) {
+  const trimmed = value.trim();
+  const unwrapped = trimmed.startsWith("{{") && trimmed.endsWith("}}") ? trimmed.slice(2, -2) : trimmed;
+  return unwrapped.trim().toLowerCase();
+}
+function isEventVariable(value) {
+  const normalized = normalizedVariableName(value);
+  return normalized === "_event" || normalized === "event" || normalized === "event name";
+}
+function isHostnameVariable(value) {
+  const normalized = normalizedVariableName(value);
+  return normalized === "page hostname" || normalized === "_hostname";
+}
+function customEventNames(trigger) {
+  const names = [];
+  for (const condition of trigger.customEventFilter ?? []) {
+    const left = conditionParameter(condition, "arg0");
+    const right = conditionParameter(condition, "arg1");
+    if (left && right && isEventVariable(left)) names.push(right);
+  }
+  return names;
+}
+function filterMatchesHostname(operator, filterValue, hostname) {
+  const expected = hostname.toLowerCase();
+  const value = filterValue.toLowerCase();
+  if (operator === "equals") return expected === value;
+  if (operator === "contains") return expected.includes(value);
+  if (operator === "startsWith") return expected.startsWith(value);
+  if (operator === "endsWith") return expected.endsWith(value);
+  if (operator === "matchRegex" || operator === "urlMatches") {
+    try {
+      return new RegExp(filterValue, "i").test(hostname);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function hostnameFilters(trigger, expectedHostname) {
+  const filters = [];
+  for (const condition of conditions(trigger)) {
+    const left = conditionParameter(condition, "arg0");
+    const right = conditionParameter(condition, "arg1");
+    if (!left || !right || !isHostnameVariable(left)) continue;
+    const negated = conditionParameter(condition, "negate") === "true";
+    filters.push({
+      operator: condition.type ?? "conditionTypeUnspecified",
+      value: right,
+      negated,
+      matchesExpectedHostname: expectedHostname === void 0 ? null : !negated && filterMatchesHostname(condition.type ?? "", right, expectedHostname)
+    });
+  }
+  return filters;
+}
+function triggerStrategy(triggers) {
+  if (triggers.length === 0) return "none";
+  const categories = new Set(triggers.map((trigger) => {
+    if (trigger.type === "customEvent") return "custom-event";
+    if (trigger.type && URL_TRIGGER_TYPES.has(trigger.type)) return "url-based";
+    return "unknown";
+  }));
+  if (categories.size > 1) return "mixed";
+  return [...categories][0];
+}
+function unknownAssessment(tag, reason, triggers, options) {
+  const firingTriggerIds = [...tag.firingTriggerId ?? []];
+  const triggerById = /* @__PURE__ */ new Map();
+  for (const trigger of triggers) {
+    if (typeof trigger.triggerId === "string") triggerById.set(trigger.triggerId, trigger);
+  }
+  const resolved = firingTriggerIds.map((id) => triggerById.get(id)).filter((trigger) => trigger !== void 0);
+  return {
+    schemaVersion: GTM_GOOGLE_ADS_CONVERSION_ASSESSMENT_SCHEMA_VERSION,
+    recognizerVersion: GTM_GOOGLE_ADS_CONVERSION_RECOGNIZER_VERSION,
+    recognition: { status: "unknown", reason },
+    review: { status: "needs-review", reasons: ["tag-unknown"] },
+    tag: {
+      id: tag.tagId ?? null,
+      name: tag.name ?? null,
+      type: tag.type ?? null,
+      checksum: checksumJson(tag)
+    },
+    conversion: null,
+    trigger: {
+      strategy: triggerStrategy(resolved),
+      firingTriggerIds,
+      resolvedTriggerIds: resolved.flatMap((trigger) => trigger.triggerId ? [trigger.triggerId] : []),
+      unresolvedTriggerIds: firingTriggerIds.filter((id) => !triggerById.has(id)),
+      customEventNames: [...new Set(resolved.flatMap(customEventNames))],
+      hostnameFilters: resolved.flatMap((trigger) => hostnameFilters(trigger, options.expectedHostname))
+    }
+  };
+}
+function recognizeGoogleAdsConversionTag(tag, triggers, options = {}) {
+  if (tag.type !== GOOGLE_ADS_CONVERSION_TAG_TYPE) {
+    return unknownAssessment(tag, unknownReason(tag.type), triggers, options);
+  }
+  const byKey = parametersByKey(tag.parameter);
+  const conversionId = scalarMapping(byKey, "conversionId");
+  const conversionLabel = scalarMapping(byKey, "conversionLabel");
+  if (!conversionId || !conversionLabel) {
+    return unknownAssessment(tag, "malformed-google-ads-conversion-tag", triggers, options);
+  }
+  const conversionValue = scalarMapping(byKey, "conversionValue");
+  const transactionId = scalarMapping(byKey, "orderId");
+  const currency = scalarMapping(byKey, "currencyCode");
+  const firingTriggerIds = [...tag.firingTriggerId ?? []];
+  const triggerById = /* @__PURE__ */ new Map();
+  for (const trigger of triggers) {
+    if (typeof trigger.triggerId === "string") triggerById.set(trigger.triggerId, trigger);
+  }
+  const resolved = firingTriggerIds.map((id) => triggerById.get(id)).filter((trigger) => trigger !== void 0);
+  const unresolvedTriggerIds = firingTriggerIds.filter((id) => !triggerById.has(id));
+  const strategy = triggerStrategy(resolved);
+  const eventNames = [...new Set(resolved.flatMap(customEventNames))];
+  const hostFilters = resolved.flatMap((trigger) => hostnameFilters(trigger, options.expectedHostname));
+  const reasons = [];
+  if (tag.paused) reasons.push("tag-paused");
+  if (firingTriggerIds.length === 0) reasons.push("no-firing-trigger");
+  if (unresolvedTriggerIds.length > 0) reasons.push("unresolved-firing-trigger");
+  if (strategy === "url-based") reasons.push("url-based-trigger");
+  if (strategy === "mixed") reasons.push("mixed-trigger-strategies");
+  if (strategy === "custom-event" && eventNames.length === 0) reasons.push("missing-custom-event-name");
+  if (strategy === "custom-event" && options.expectedEventName && !eventNames.includes(options.expectedEventName)) reasons.push("unexpected-custom-event-name");
+  if (hostFilters.length === 0) reasons.push("missing-hostname-filter");
+  if (options.expectedHostname && hostFilters.length > 0 && !hostFilters.some((filter) => filter.matchesExpectedHostname)) reasons.push("unexpected-hostname-filter");
+  if (!conversionValue) reasons.push("missing-conversion-value");
+  if (!transactionId) reasons.push("missing-transaction-id");
+  return {
+    schemaVersion: GTM_GOOGLE_ADS_CONVERSION_ASSESSMENT_SCHEMA_VERSION,
+    recognizerVersion: GTM_GOOGLE_ADS_CONVERSION_RECOGNIZER_VERSION,
+    recognition: { status: "recognized", kind: "google-ads-conversion" },
+    review: { status: reasons.length === 0 ? "pass" : "needs-review", reasons },
+    tag: {
+      id: tag.tagId ?? null,
+      name: tag.name ?? null,
+      type: tag.type ?? null,
+      checksum: checksumJson(tag)
+    },
+    conversion: {
+      id: conversionId,
+      label: conversionLabel,
+      value: conversionValue,
+      transactionId,
+      currency
+    },
+    trigger: {
+      strategy,
+      firingTriggerIds,
+      resolvedTriggerIds: resolved.flatMap((trigger) => trigger.triggerId ? [trigger.triggerId] : []),
+      unresolvedTriggerIds,
+      customEventNames: eventNames,
+      hostnameFilters: hostFilters
+    }
+  };
+}
+
+// ../integration-google-tag-manager/src/dto-adapter.ts
+function required(value, label) {
+  if (!value) {
+    throw new GtmApiError(`Tag Manager response is missing ${label}`, 502, {
+      reason: "INVALID_PROVIDER_RESPONSE"
+    });
+  }
+  return value;
+}
+function finalPathSegment(path9) {
+  return path9?.split("/").filter(Boolean).at(-1);
+}
+function uniqueStrings(values) {
+  return [...new Set(values.filter((value) => typeof value === "string"))].sort();
+}
+function parameterKeys(parameters) {
+  return uniqueStrings((parameters ?? []).map((parameter) => parameter.key));
+}
+function parameterValues(parameters) {
+  return (parameters ?? []).flatMap((parameter) => [
+    ...typeof parameter.value === "string" ? [parameter.value] : [],
+    ...parameterValues(parameter.list),
+    ...parameterValues(parameter.map)
+  ]);
+}
+function referencedVariableIds(tag, variableIdsByName) {
+  const ids = [];
+  for (const value of parameterValues(tag.parameter)) {
+    for (const match of value.matchAll(/\{\{([^{}]+)\}\}/g)) {
+      const name = match[1].trim();
+      if (name) ids.push(...variableIdsByName.get(name) ?? []);
+    }
+  }
+  return uniqueStrings(ids);
+}
+function conditionParameter2(condition, key) {
+  const parameter = condition.parameter?.find((candidate) => candidate.key === key);
+  return typeof parameter?.value === "string" ? parameter.value : null;
+}
+function normalizedVariableName2(value) {
+  const trimmed = value.trim();
+  const unwrapped = trimmed.startsWith("{{") && trimmed.endsWith("}}") ? trimmed.slice(2, -2) : trimmed;
+  return unwrapped.trim().toLowerCase();
+}
+function safeCustomEventNames(trigger) {
+  const names = [];
+  for (const condition of trigger.customEventFilter ?? []) {
+    const left = conditionParameter2(condition, "arg0");
+    const right = conditionParameter2(condition, "arg1");
+    if (left && right) {
+      const variableName = normalizedVariableName2(left);
+      if (variableName === "_event" || variableName === "event" || variableName === "event name") {
+        names.push(right);
+      }
+    }
+  }
+  return uniqueStrings(names);
+}
+function conditionKeys(conditions2) {
+  return uniqueStrings((conditions2 ?? []).flatMap((condition) => (condition.parameter ?? []).map((parameter) => parameter.key)));
+}
+function triggerConditions(trigger) {
+  return [
+    ...trigger.customEventFilter ?? [],
+    ...trigger.filter ?? [],
+    ...trigger.autoEventFilter ?? []
+  ];
+}
+function triggerPredicate(trigger) {
+  if (!trigger.triggerId) return null;
+  const eventPredicates = [];
+  const hostnamePredicates = [];
+  let unsupportedConditionCount = 0;
+  for (const condition of triggerConditions(trigger)) {
+    const left = conditionParameter2(condition, "arg0");
+    const right = conditionParameter2(condition, "arg1");
+    const operator = condition.type?.trim() ?? "";
+    if (!left || right === null || !operator || operator.length > 64 || right.length > 2048) {
+      unsupportedConditionCount += 1;
+      continue;
+    }
+    const predicate = {
+      operator,
+      value: right,
+      negated: conditionParameter2(condition, "negate")?.toLowerCase() === "true",
+      ignoreCase: (conditionParameter2(condition, "ignore_case") ?? conditionParameter2(condition, "ignoreCase"))?.toLowerCase() === "true"
+    };
+    const variableName = normalizedVariableName2(left);
+    if (variableName === "_event" || variableName === "event" || variableName === "event name") {
+      eventPredicates.push(predicate);
+    } else if (variableName === "page hostname" || variableName === "_hostname") {
+      hostnamePredicates.push(predicate);
+    } else {
+      unsupportedConditionCount += 1;
+    }
+  }
+  return {
+    triggerId: trigger.triggerId,
+    triggerType: trigger.type ?? "",
+    eventPredicates,
+    hostnamePredicates,
+    unsupportedConditionCount
+  };
+}
+function toGtmAccountDto(account) {
+  return {
+    id: required(account.accountId ?? finalPathSegment(account.path), "account id"),
+    path: account.path ?? "",
+    name: account.name ?? "",
+    shareData: typeof account.shareData === "boolean" ? account.shareData : null
+  };
+}
+function toGtmContainerDto(container) {
+  return {
+    accountId: required(container.accountId, "container account id"),
+    id: required(container.containerId ?? finalPathSegment(container.path), "container id"),
+    path: container.path ?? "",
+    name: container.name ?? "",
+    publicId: container.publicId ?? null,
+    domainName: container.domainName?.join(", ") ?? null,
+    usageContexts: [...container.usageContext ?? []]
+  };
+}
+function toGtmWorkspaceDto(workspace) {
+  return {
+    accountId: required(workspace.accountId, "workspace account id"),
+    containerId: required(workspace.containerId, "workspace container id"),
+    id: required(workspace.workspaceId ?? finalPathSegment(workspace.path), "workspace id"),
+    path: workspace.path ?? "",
+    name: workspace.name ?? "",
+    description: workspace.description ?? null,
+    fingerprint: workspace.fingerprint ?? null
+  };
+}
+function toGtmContainerVersionDto(version) {
+  return {
+    accountId: required(version.accountId, "container version account id"),
+    containerId: required(version.containerId, "container version container id"),
+    id: required(version.containerVersionId ?? finalPathSegment(version.path), "container version id"),
+    path: version.path ?? "",
+    name: version.name ?? "",
+    description: version.description ?? null,
+    fingerprint: version.fingerprint ?? null,
+    deleted: version.deleted ?? false
+  };
+}
+function toGtmTagDto(tag, fallbackId, variableIdsByName) {
+  return {
+    id: required(tag.tagId ?? fallbackId, "tag id"),
+    name: tag.name ?? "",
+    type: tag.type ?? "",
+    paused: tag.paused ?? false,
+    firingTriggerIds: uniqueStrings(tag.firingTriggerId ?? []),
+    blockingTriggerIds: uniqueStrings(tag.blockingTriggerId ?? []),
+    referencedVariableIds: referencedVariableIds(tag, variableIdsByName),
+    parameterKeys: parameterKeys(tag.parameter),
+    fingerprint: tag.fingerprint ?? null
+  };
+}
+function toGtmTriggerDto(trigger, fallbackId) {
+  return {
+    id: required(trigger.triggerId ?? fallbackId, "trigger id"),
+    name: trigger.name ?? "",
+    type: trigger.type ?? "",
+    customEventNames: safeCustomEventNames(trigger),
+    filterKeys: uniqueStrings([
+      ...conditionKeys(trigger.customEventFilter),
+      ...conditionKeys(trigger.filter)
+    ]),
+    autoEventFilterKeys: conditionKeys(trigger.autoEventFilter),
+    fingerprint: trigger.fingerprint ?? null
+  };
+}
+function dataLayerVariableName(variable) {
+  if (variable.type !== "v") return null;
+  const name = variable.parameter?.find((parameter) => parameter.key === "name")?.value;
+  return typeof name === "string" && name.trim() ? name : null;
+}
+function toGtmVariableDto(variable, fallbackId) {
+  return {
+    id: required(variable.variableId ?? fallbackId, "variable id"),
+    name: variable.name ?? "",
+    type: variable.type ?? "",
+    dataLayerVariableName: dataLayerVariableName(variable),
+    parameterKeys: parameterKeys(variable.parameter),
+    fingerprint: variable.fingerprint ?? null
+  };
+}
+function absentMapping() {
+  return { source: "absent", literal: null, variableRef: null };
+}
+function unknownMapping() {
+  return { source: "unknown", literal: null, variableRef: null };
+}
+function normalizedVariableReference(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("{{") || !trimmed.endsWith("}}")) return null;
+  const inner = trimmed.slice(2, -2);
+  const normalized = inner.trim();
+  if (!normalized || normalized.length > 128 || inner.includes("{{") || inner.includes("}}") || !/^\w[\w ./-]*$/.test(normalized)) return null;
+  return `{{${normalized}}}`;
+}
+function normalizedLiteral(field, value) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (field === "conversionId") {
+    const match = /^(?:AW-)?(\d{1,20})$/i.exec(trimmed);
+    return match ? `AW-${match[1]}` : null;
+  }
+  if (field === "conversionLabel") {
+    return /^[\w-]{1,128}$/.test(trimmed) ? trimmed : null;
+  }
+  if (field === "value") {
+    if (!/^(?:0|[1-9]\d{0,11})(?:\.\d{1,6})?$/.test(trimmed)) return null;
+    const [whole, fractional = ""] = trimmed.split(".");
+    const normalizedFractional = fractional.replace(/0+$/, "");
+    return normalizedFractional ? `${whole}.${normalizedFractional}` : whole;
+  }
+  if (field === "currency") {
+    return /^[a-z]{3}$/i.test(trimmed) ? trimmed.toUpperCase() : null;
+  }
+  return null;
+}
+function fieldMapping(field, value, source) {
+  if (source === "variable") {
+    const variableRef = normalizedVariableReference(value);
+    return variableRef ? { source: "variable-ref", literal: null, variableRef } : unknownMapping();
+  }
+  if (source !== "literal") return unknownMapping();
+  const literal = normalizedLiteral(field, value);
+  return literal ? { source: "literal", literal, variableRef: null } : unknownMapping();
+}
+function toFieldMapping(mapping, field) {
+  return mapping ? fieldMapping(field, mapping.value, mapping.source) : absentMapping();
+}
+function safeTagFieldMapping(tag, key, field) {
+  const parameters = (tag.parameter ?? []).filter((parameter) => parameter.key === key);
+  if (parameters.length === 0) return absentMapping();
+  if (parameters.length !== 1) return unknownMapping();
+  const value = parameters[0]?.value;
+  if (typeof value !== "string" || parameters[0]?.list || parameters[0]?.map) return unknownMapping();
+  const variableRef = normalizedVariableReference(value);
+  if (variableRef) return { source: "variable-ref", literal: null, variableRef };
+  if (value.includes("{{") || value.includes("}}") || !value.trim()) return unknownMapping();
+  return fieldMapping(field, value, "literal");
+}
+function triggerStrategy2(assessment, triggers) {
+  if (assessment.trigger.unresolvedTriggerIds.length > 0) return "unknown";
+  if (assessment.trigger.strategy === "custom-event") return "custom-event";
+  if (assessment.trigger.strategy !== "url-based") return "unknown";
+  const firingIds = new Set(assessment.trigger.firingTriggerIds);
+  const resolved = triggers.filter((trigger) => trigger.triggerId && firingIds.has(trigger.triggerId));
+  const hasFilters = resolved.some((trigger) => (trigger.customEventFilter?.length ?? 0) > 0 || (trigger.filter?.length ?? 0) > 0 || (trigger.autoEventFilter?.length ?? 0) > 0);
+  return hasFilters ? "filtered" : "all-pages";
+}
+function mapReviewReasons(assessment, tag, fields) {
+  const reasons = /* @__PURE__ */ new Set();
+  if (assessment.recognition.status === "unknown") {
+    if (assessment.recognition.reason === "custom-html") reasons.add("custom-html-opaque");
+    else if (assessment.recognition.reason === "custom-template") reasons.add("unsupported-tag-type");
+    else if (assessment.recognition.reason === "unsupported-tag-type") reasons.add("not-google-ads-tag");
+    else {
+      reasons.add("conversion-id-unresolved");
+      reasons.add("conversion-label-unresolved");
+    }
+  }
+  for (const reason of assessment.review.reasons) {
+    if (reason === "no-firing-trigger" || reason === "unresolved-firing-trigger" || reason === "url-based-trigger" || reason === "mixed-trigger-strategies" || reason === "missing-custom-event-name" || reason === "unexpected-custom-event-name") reasons.add("trigger-unresolved");
+    if (reason === "missing-hostname-filter" || reason === "unexpected-hostname-filter") {
+      reasons.add("hostname-filter-unresolved");
+    }
+    if (reason === "missing-conversion-value") reasons.add("value-mapping-missing");
+    if (reason === "missing-transaction-id") reasons.add("transaction-id-mapping-missing");
+  }
+  if (tag.type === "awct") {
+    if (fields.conversionId.source === "absent" || fields.conversionId.source === "unknown") {
+      reasons.add("conversion-id-unresolved");
+    }
+    if (fields.conversionLabel.source === "absent" || fields.conversionLabel.source === "unknown") {
+      reasons.add("conversion-label-unresolved");
+    }
+    if (fields.value.source === "absent" || fields.value.source === "unknown") {
+      reasons.add("value-mapping-missing");
+    }
+    if (fields.transactionId.source === "absent" || fields.transactionId.source === "unknown") {
+      reasons.add("transaction-id-mapping-missing");
+    }
+    if (fields.currency.source === "absent" || fields.currency.source === "unknown") {
+      reasons.add("currency-mapping-missing");
+    }
+  }
+  return [...reasons];
+}
+function toGtmGoogleAdsTagAssessmentDto(tag, triggers, options = {}, fallbackTagId) {
+  const assessment = recognizeGoogleAdsConversionTag(tag, triggers, options);
+  const knownConversion = assessment.conversion;
+  const knownTag = tag.type === "awct";
+  const fields = {
+    conversionId: gtmGoogleAdsConversionIdMappingDtoSchema.parse(knownConversion ? toFieldMapping(knownConversion.id, "conversionId") : knownTag ? safeTagFieldMapping(tag, "conversionId", "conversionId") : unknownMapping()),
+    conversionLabel: gtmGoogleAdsConversionLabelMappingDtoSchema.parse(knownConversion ? toFieldMapping(knownConversion.label, "conversionLabel") : knownTag ? safeTagFieldMapping(tag, "conversionLabel", "conversionLabel") : unknownMapping()),
+    value: gtmGoogleAdsConversionValueMappingDtoSchema.parse(knownConversion ? toFieldMapping(knownConversion.value, "value") : knownTag ? safeTagFieldMapping(tag, "conversionValue", "value") : unknownMapping()),
+    transactionId: gtmGoogleAdsTransactionIdMappingDtoSchema.parse(knownConversion ? toFieldMapping(knownConversion.transactionId, "transactionId") : knownTag ? safeTagFieldMapping(tag, "orderId", "transactionId") : unknownMapping()),
+    currency: gtmGoogleAdsCurrencyMappingDtoSchema.parse(knownConversion ? toFieldMapping(knownConversion.currency, "currency") : knownTag ? safeTagFieldMapping(tag, "currencyCode", "currency") : unknownMapping())
+  };
+  return {
+    tagId: required(tag.tagId ?? fallbackTagId, "Google Ads assessment tag id"),
+    tagType: tag.type ?? "",
+    recognition: assessment.recognition.status,
+    recognitionReason: assessment.recognition.status === "unknown" ? assessment.recognition.reason : null,
+    ...fields,
+    triggerStrategy: triggerStrategy2(assessment, triggers),
+    triggerIds: uniqueStrings(assessment.trigger.firingTriggerIds),
+    triggerPredicates: triggers.filter((trigger) => trigger.triggerId && assessment.trigger.firingTriggerIds.includes(trigger.triggerId)).map(triggerPredicate).filter((predicate) => predicate !== null).sort((left, right) => left.triggerId.localeCompare(right.triggerId)),
+    reviewReasons: mapReviewReasons(assessment, tag, fields)
+  };
+}
+function toGtmConfigurationGraphDto(snapshot, options = {}) {
+  const accountId = required(snapshot.identity.accountId, "snapshot account id");
+  const containerId = required(snapshot.identity.containerId, "snapshot container id");
+  const triggers = snapshot.entities.triggers.map((entity) => entity.raw);
+  const variableIdsByName = /* @__PURE__ */ new Map();
+  for (const entity of snapshot.entities.variables) {
+    const name = entity.raw.name?.trim();
+    if (!name) continue;
+    const id = required(entity.raw.variableId ?? entity.id, "variable id");
+    variableIdsByName.set(name, [...variableIdsByName.get(name) ?? [], id]);
+  }
+  return {
+    accountId,
+    containerId,
+    workspaceId: snapshot.source === "workspace" ? required(snapshot.identity.workspaceId, "snapshot workspace id") : null,
+    tags: snapshot.entities.tags.map((entity) => toGtmTagDto(entity.raw, entity.id, variableIdsByName)),
+    triggers: snapshot.entities.triggers.map((entity) => toGtmTriggerDto(entity.raw, entity.id)),
+    variables: snapshot.entities.variables.map((entity) => toGtmVariableDto(entity.raw, entity.id)),
+    googleAdsTagAssessments: snapshot.entities.tags.map((entity) => toGtmGoogleAdsTagAssessmentDto(entity.raw, triggers, options, entity.id))
+  };
+}
+function fetchedAt(options) {
+  return options.fetchedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+}
+function toGtmLiveContainerGraphDto(snapshot, options = {}) {
+  if (snapshot.source !== "live") {
+    throw new GtmApiError("Live graph adapter requires a live snapshot", 400, {
+      reason: "INVALID_SNAPSHOT_SOURCE"
+    });
+  }
+  const version = snapshot.raw.containerVersion;
+  if (!version) {
+    throw new GtmApiError("Live snapshot is missing its container version", 502, {
+      reason: "INVALID_PROVIDER_RESPONSE"
+    });
+  }
+  return {
+    source: "live",
+    version: toGtmContainerVersionDto(version),
+    graph: toGtmConfigurationGraphDto(snapshot, options),
+    fetchedAt: fetchedAt(options)
+  };
+}
+function toGtmDraftWorkspaceGraphDto(snapshot, options = {}) {
+  if (snapshot.source !== "workspace") {
+    throw new GtmApiError("Draft graph adapter requires a workspace snapshot", 400, {
+      reason: "INVALID_SNAPSHOT_SOURCE"
+    });
+  }
+  const workspace = snapshot.raw.workspace;
+  if (!workspace) {
+    throw new GtmApiError("Workspace snapshot is missing its workspace", 502, {
+      reason: "INVALID_PROVIDER_RESPONSE"
+    });
+  }
+  return {
+    source: "draft",
+    workspace: toGtmWorkspaceDto(workspace),
+    graph: toGtmConfigurationGraphDto(snapshot, options),
+    conflictCount: snapshot.raw.workspaceStatus?.mergeConflict?.length ?? 0,
+    fetchedAt: fetchedAt(options)
+  };
+}
+
+// src/google-ads-config.ts
+function ensureConnections(config) {
+  if (!config.googleAds) config.googleAds = {};
+  if (!config.googleAds.connections) config.googleAds.connections = [];
+  return config.googleAds.connections;
+}
+function getGoogleAdsAuthConfig(config) {
+  return {
+    clientId: config.googleAds?.clientId ?? config.google?.clientId,
+    clientSecret: config.googleAds?.clientSecret ?? config.google?.clientSecret,
+    developerToken: config.googleAds?.developerToken
+  };
+}
+function setGoogleAdsAuthConfig(config, patch) {
+  if (!config.googleAds) config.googleAds = {};
+  if (patch.developerToken !== void 0) config.googleAds.developerToken = patch.developerToken;
+  if (patch.clientId !== void 0) config.googleAds.clientId = patch.clientId;
+  if (patch.clientSecret !== void 0) config.googleAds.clientSecret = patch.clientSecret;
+}
+function getGoogleAdsConnection(config, projectId) {
+  return config.googleAds?.connections?.find((entry) => entry.projectId === projectId);
+}
+function upsertGoogleAdsConnection(config, connection) {
+  const connections = ensureConnections(config);
+  const index = connections.findIndex((entry) => entry.projectId === connection.projectId);
+  if (index === -1) connections.push(connection);
+  else connections[index] = connection;
+  return connection;
+}
+function removeGoogleAdsConnection(config, projectId) {
+  const connections = config.googleAds?.connections;
+  if (!connections?.length) return false;
+  const next = connections.filter((entry) => entry.projectId !== projectId);
+  if (next.length === connections.length) return false;
+  if (!config.googleAds) return false;
+  config.googleAds.connections = next;
+  return true;
+}
+function removeLegacyGoogleAdsConnections(config) {
+  const connections = config.googleAds?.connections;
+  if (!connections?.length) return 0;
+  const next = connections.filter((entry) => typeof entry.projectId === "string" && entry.projectId.trim().length > 0);
+  const removed = connections.length - next.length;
+  if (removed > 0 && config.googleAds) config.googleAds.connections = next;
+  return removed;
+}
+function removeOrphanedGoogleAdsConnections(config, projectIds) {
+  const connections = config.googleAds?.connections;
+  if (!connections?.length) return 0;
+  const next = connections.filter((entry) => projectIds.has(entry.projectId));
+  const removed = connections.length - next.length;
+  if (removed > 0 && config.googleAds) config.googleAds.connections = next;
+  return removed;
+}
+
+// src/gtm-config.ts
+function ensureConnections2(config) {
+  if (!config.gtm) config.gtm = {};
+  if (!config.gtm.connections) config.gtm.connections = [];
+  return config.gtm.connections;
+}
+function getGtmAuthConfig(config) {
+  return {
+    clientId: config.gtm?.clientId ?? config.google?.clientId,
+    clientSecret: config.gtm?.clientSecret ?? config.google?.clientSecret
+  };
+}
+function getGtmConnection(config, projectId) {
+  return config.gtm?.connections?.find((entry) => entry.projectId === projectId);
+}
+function upsertGtmConnection(config, connection) {
+  const connections = ensureConnections2(config);
+  const index = connections.findIndex((entry) => entry.projectId === connection.projectId);
+  if (index === -1) connections.push(connection);
+  else connections[index] = connection;
+  return connection;
+}
+function removeGtmConnection(config, projectId) {
+  const connections = config.gtm?.connections;
+  if (!connections?.length) return false;
+  const next = connections.filter((entry) => entry.projectId !== projectId);
+  if (next.length === connections.length) return false;
+  if (!config.gtm) return false;
+  config.gtm.connections = next;
+  return true;
+}
+function removeLegacyGtmConnections(config) {
+  const connections = config.gtm?.connections;
+  if (!connections?.length) return 0;
+  const next = connections.filter((entry) => typeof entry.projectId === "string" && entry.projectId.trim().length > 0);
+  const removed = connections.length - next.length;
+  if (removed > 0 && config.gtm) config.gtm.connections = next;
+  return removed;
+}
+function removeOrphanedGtmConnections(config, projectIds) {
+  const connections = config.gtm?.connections;
+  if (!connections?.length) return 0;
+  const next = connections.filter((entry) => projectIds.has(entry.projectId));
+  const removed = connections.length - next.length;
+  if (removed > 0 && config.gtm) config.gtm.connections = next;
+  return removed;
+}
+
+// src/google-marketing-runtime.ts
+var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+var DEFAULT_LIST_LIMIT = 100;
+var MAX_LIST_LIMIT = 1e3;
+var GoogleMarketingRuntimeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
+  name = "GoogleMarketingRuntimeError";
+};
+function credentialGeneration(connection) {
+  return crypto3.createHash("sha256").update(JSON.stringify({
+    projectId: connection.projectId,
+    credentialGeneration: connection.credentialGeneration ?? null,
+    accessToken: connection.accessToken ?? null,
+    refreshToken: connection.refreshToken ?? null,
+    tokenExpiresAt: connection.tokenExpiresAt ?? null,
+    scopes: connection.scopes ?? [],
+    createdAt: connection.createdAt,
+    updatedAt: connection.updatedAt
+  })).digest("base64url");
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new GoogleMarketingRuntimeError(`${label} is required`, "INVALID_INPUT");
+  }
+  return value.trim();
+}
+function validateProject(project) {
+  return {
+    id: nonEmpty(project.id, "Project ID"),
+    name: nonEmpty(project.name, "Project name")
+  };
+}
+function validatedListLimit(value) {
+  const limit = value ?? DEFAULT_LIST_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_LIST_LIMIT) {
+    throw new GoogleMarketingRuntimeError(
+      `List limit must be an integer between 1 and ${MAX_LIST_LIMIT}`,
+      "INVALID_INPUT"
+    );
+  }
+  return limit;
+}
+function resourceId2(value, label) {
+  const id = value.split("/").filter(Boolean).at(-1);
+  if (!id) throw new GoogleMarketingRuntimeError(`${label} is invalid`, "INVALID_INPUT");
+  return id;
+}
+function canonicalGtmAccountId(value) {
+  const accountId = canonicalizeGtmAccountId(value);
+  if (!accountId) {
+    throw new GoogleMarketingRuntimeError("GTM account ID is invalid", "INVALID_INPUT");
+  }
+  return accountId;
+}
+function canonicalGtmContainerId(value, accountId) {
+  const containerId = canonicalizeGtmContainerId(value, accountId);
+  if (!containerId) {
+    throw new GoogleMarketingRuntimeError("GTM container ID is invalid or belongs to another account", "INVALID_INPUT");
+  }
+  return containerId;
+}
+function accountPath(accountId) {
+  return `accounts/${canonicalGtmAccountId(accountId)}`;
+}
+function containerPath(accountId, containerId) {
+  const canonicalAccountId = canonicalGtmAccountId(accountId);
+  return `accounts/${canonicalAccountId}/containers/${canonicalGtmContainerId(containerId, canonicalAccountId)}`;
+}
+function workspacePath(accountId, containerId, workspaceId) {
+  const selection = canonicalizeGtmResourceSelection({ accountId, containerId, workspaceId });
+  if (!selection?.workspaceId) {
+    throw new GoogleMarketingRuntimeError("GTM workspace ID is invalid or belongs to another container", "INVALID_INPUT");
+  }
+  return `accounts/${selection.accountId}/containers/${selection.containerId}/workspaces/${selection.workspaceId}`;
+}
+function normalizedCustomerStatus(status) {
+  switch (status?.toUpperCase()) {
+    case "ENABLED":
+      return GoogleAdsCustomerStatuses.enabled;
+    case "SUSPENDED":
+      return GoogleAdsCustomerStatuses.suspended;
+    case "CLOSED":
+      return GoogleAdsCustomerStatuses.closed;
+    case "CANCELED":
+      return GoogleAdsCustomerStatuses.canceled;
+    case "UNSPECIFIED":
+      return GoogleAdsCustomerStatuses.unspecified;
+    default:
+      return GoogleAdsCustomerStatuses.unknown;
+  }
+}
+function accessibleCustomerDto(customer) {
+  return googleAdsAccessibleCustomerDtoSchema.parse({
+    resourceName: customer.resourceName,
+    customerId: customer.id,
+    parentCustomerId: null,
+    descriptiveName: customer.descriptiveName ?? null,
+    currencyCode: customer.currencyCode ?? null,
+    timeZone: customer.timeZone ?? null,
+    manager: customer.manager ?? false,
+    hidden: false,
+    testAccount: customer.testAccount ?? false,
+    level: 0,
+    status: normalizedCustomerStatus(customer.status)
+  });
+}
+function accessibleCustomerClientDto(customer, loginCustomerId) {
+  const level = Number(customer.level ?? "0");
+  if (!Number.isSafeInteger(level) || level < 0) {
+    throw new GoogleMarketingRuntimeError(
+      "Google Ads returned an invalid customer hierarchy level",
+      "INVALID_INPUT"
+    );
+  }
+  return googleAdsAccessibleCustomerDtoSchema.parse({
+    resourceName: customer.clientCustomer || `customers/${customer.id}`,
+    customerId: customer.id,
+    // Google Ads exposes the selected login-manager root and hierarchy depth,
+    // but not a direct parent edge in this query. Retain the root as the
+    // account context required to read any discovered child honestly.
+    parentCustomerId: customer.id === loginCustomerId ? null : loginCustomerId,
+    descriptiveName: customer.descriptiveName ?? null,
+    currencyCode: customer.currencyCode ?? null,
+    timeZone: customer.timeZone ?? null,
+    manager: customer.manager ?? false,
+    hidden: customer.hidden ?? false,
+    testAccount: customer.testAccount ?? false,
+    level,
+    status: normalizedCustomerStatus(customer.status)
+  });
+}
+function campaignStatus(status) {
+  switch (status.toUpperCase()) {
+    case "ENABLED":
+      return GoogleAdsCampaignStatuses.enabled;
+    case "PAUSED":
+      return GoogleAdsCampaignStatuses.paused;
+    case "REMOVED":
+      return GoogleAdsCampaignStatuses.removed;
+    default:
+      return GoogleAdsCampaignStatuses.unknown;
+  }
+}
+function conversionActionStatus(status) {
+  switch (status.toUpperCase()) {
+    case "ENABLED":
+      return GoogleAdsConversionActionStatuses.enabled;
+    case "HIDDEN":
+      return GoogleAdsConversionActionStatuses.hidden;
+    case "REMOVED":
+      return GoogleAdsConversionActionStatuses.removed;
+    default:
+      return GoogleAdsConversionActionStatuses.unknown;
+  }
+}
+function campaignDto(campaign) {
+  return {
+    id: campaign.id,
+    resourceName: campaign.resourceName,
+    name: campaign.name,
+    status: campaignStatus(campaign.status),
+    advertisingChannelType: campaign.advertisingChannelType ?? null,
+    biddingStrategyType: campaign.biddingStrategyType ?? null
+  };
+}
+function conversionActionDto(action) {
+  return {
+    id: action.id,
+    resourceName: action.resourceName,
+    name: action.name,
+    status: conversionActionStatus(action.status),
+    category: action.category,
+    origin: action.origin,
+    primaryForGoal: action.primaryForGoal ?? false,
+    includeInConversionsMetric: action.includeInConversionsMetric ?? false
+  };
+}
+function inventoryDto(customerId, fetchedAt2, campaigns, goals) {
+  return {
+    customerId,
+    fetchedAt: fetchedAt2,
+    campaigns: campaigns.map(campaignDto),
+    conversionActions: goals.conversionActions.map((row) => conversionActionDto(row.conversionAction)),
+    customerConversionGoals: goals.customerGoals.map((row) => ({
+      category: row.customerConversionGoal.category,
+      origin: row.customerConversionGoal.origin,
+      biddable: row.customerConversionGoal.biddable ?? false
+    })),
+    campaignConversionGoals: goals.campaignGoals.map((row) => ({
+      campaignId: row.campaign.id,
+      category: row.campaignConversionGoal.category,
+      origin: row.campaignConversionGoal.origin,
+      biddable: row.campaignConversionGoal.biddable ?? false
+    })),
+    campaignConversionGoalsComplete: goals.campaignGoalsComplete === true,
+    customConversionGoals: goals.customGoals.map((row) => ({
+      id: row.customConversionGoal.id,
+      name: row.customConversionGoal.name,
+      conversionActionIds: (row.customConversionGoal.conversionActions ?? []).map((name) => resourceId2(name, "Conversion action resource name"))
+    })),
+    campaignGoalConfigurations: goals.campaignConfigs.map((row) => {
+      const level = row.conversionGoalCampaignConfig.goalConfigLevel;
+      if (level !== "CUSTOMER" && level !== "CAMPAIGN") {
+        throw new GoogleMarketingRuntimeError(
+          "Google Ads returned an unsupported campaign goal configuration level",
+          "INVALID_INPUT"
+        );
+      }
+      return {
+        campaignId: row.campaign.id,
+        goalConfigLevel: level === "CAMPAIGN" ? GoogleAdsGoalConfigurationLevels.campaign : GoogleAdsGoalConfigurationLevels.customer,
+        customGoalId: row.conversionGoalCampaignConfig.customConversionGoal ? resourceId2(
+          row.conversionGoalCampaignConfig.customConversionGoal,
+          "Custom conversion goal resource name"
+        ) : null
+      };
+    })
+  };
+}
+function nonnegativeInteger(value, label) {
+  const parsed = Number(value ?? "0");
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new GoogleMarketingRuntimeError(`Google Ads returned an invalid ${label}`, "INVALID_INPUT");
+  }
+  return parsed;
+}
+function conversionValueMicros(metrics) {
+  if (metrics.conversionsValue === void 0) return null;
+  const value = Math.round(metrics.conversionsValue * 1e6);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new GoogleMarketingRuntimeError(
+      "Google Ads returned an invalid conversion value",
+      "INVALID_INPUT"
+    );
+  }
+  return value;
+}
+function campaignMetricDto(row) {
+  return {
+    campaignId: row.campaign.id,
+    date: row.segments.date,
+    impressions: nonnegativeInteger(row.metrics.impressions, "impression count"),
+    clicks: nonnegativeInteger(row.metrics.clicks, "click count"),
+    costMicros: nonnegativeInteger(row.metrics.costMicros, "cost"),
+    conversions: row.metrics.conversions ?? 0,
+    conversionValueMicros: conversionValueMicros(row.metrics)
+  };
+}
+function defaultMetricsQuery(now, campaigns, timeZone) {
+  const campaignIds = campaigns.map((campaign) => campaign.id).sort((left, right) => left.localeCompare(right));
+  const selected = campaignIds.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS);
+  if (selected.length === 0) return { query: null, inventoryTruncated: false };
+  const customerTimeZone = typeof timeZone === "string" && timeZone.trim() !== "" ? timeZone : "UTC";
+  const endDate = formatIsoDateInTimeZone(now.toISOString(), customerTimeZone);
+  return {
+    query: googleAdsCampaignMetricsQuerySchema.parse({
+      campaignIds: selected,
+      startDate: shiftIsoCalendarDate(endDate, -(GOOGLE_ADS_CAMPAIGN_METRICS_MAX_DAYS - 1)),
+      endDate
+    }),
+    inventoryTruncated: campaignIds.length > selected.length
+  };
+}
+function countRedactedProviderValues(value) {
+  if (value === null || typeof value !== "object") return 0;
+  if (Array.isArray(value)) {
+    let total = 0;
+    for (const item of value) total += countRedactedProviderValues(item);
+    return total;
+  }
+  return Object.entries(value).reduce((total, [key, item]) => {
+    const own = key === "value" || key === "globalSiteTag" || key === "eventSnippet" ? 1 : 0;
+    return total + own + countRedactedProviderValues(item);
+  }, 0);
+}
+function rawMetadata(value) {
+  return {
+    // The provider clients intentionally do not expose exact response bytes.
+    // A hash of normalized objects would not be an honest raw-body checksum.
+    rawPayloadSha256: null,
+    rawPayloadBytes: null,
+    redactedFieldCount: countRedactedProviderValues(value)
+  };
+}
+var ConfigCredentialStore = class {
+  #config;
+  #saveConfigPatch;
+  #now;
+  #refresh;
+  #refreshes = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.#config = options.config;
+    this.#saveConfigPatch = options.saveConfigPatch;
+    this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.#refresh = options.refreshAccessToken ?? refreshAccessToken;
+  }
+  async getCredential(project, provider) {
+    const normalizedProject = validateProject(project);
+    const accessToken = await this.#accessToken(normalizedProject, provider);
+    return { accessToken };
+  }
+  async #accessToken(project, provider) {
+    const connection = provider === GoogleMarketingProviders["google-ads"] ? getGoogleAdsConnection(this.#config, project.id) : getGtmConnection(this.#config, project.id);
+    if (!connection) {
+      throw new GoogleMarketingRuntimeError(
+        `${provider === GoogleMarketingProviders["google-ads"] ? "Google Ads" : "GTM"} is not connected for this project`,
+        "CONNECTION_NOT_FOUND"
+      );
+    }
+    if (this.#hasFreshAccessToken(connection)) return connection.accessToken;
+    const key = `${provider}\0${project.id}\0${credentialGeneration(connection)}`;
+    const pending = this.#refreshes.get(key);
+    if (pending) return pending;
+    const refresh = this.#refreshConnection(project, provider, connection);
+    this.#refreshes.set(key, refresh);
+    try {
+      return await refresh;
+    } finally {
+      if (this.#refreshes.get(key) === refresh) this.#refreshes.delete(key);
+    }
+  }
+  #hasFreshAccessToken(connection) {
+    if (!connection.accessToken || !connection.tokenExpiresAt) return false;
+    const expiresAt = Date.parse(connection.tokenExpiresAt);
+    return Number.isFinite(expiresAt) && this.#now().getTime() < expiresAt - TOKEN_REFRESH_SKEW_MS;
+  }
+  #connection(provider, projectId) {
+    return provider === GoogleMarketingProviders["google-ads"] ? getGoogleAdsConnection(this.#config, projectId) : getGtmConnection(this.#config, projectId);
+  }
+  #connectionHasGeneration(provider, projectId, expectedGeneration) {
+    const current = this.#connection(provider, projectId);
+    return current !== void 0 && credentialGeneration(current) === expectedGeneration;
+  }
+  #restoreConnection(provider, connection) {
+    if (provider === GoogleMarketingProviders["google-ads"]) {
+      upsertGoogleAdsConnection(this.#config, connection);
+    } else {
+      upsertGtmConnection(this.#config, connection);
+    }
+  }
+  async #refreshConnection(project, provider, connection) {
+    if (!connection.refreshToken) {
+      throw new GoogleMarketingRuntimeError(
+        "Google OAuth access has expired and no refresh token is available",
+        "TOKEN_REFRESH_REQUIRED"
+      );
+    }
+    const auth = provider === GoogleMarketingProviders["google-ads"] ? getGoogleAdsAuthConfig(this.#config) : getGtmAuthConfig(this.#config);
+    if (!auth.clientId || !auth.clientSecret) {
+      throw new GoogleMarketingRuntimeError(
+        "Google OAuth client credentials are not configured",
+        "NOT_CONFIGURED"
+      );
+    }
+    const generationBeforeRefresh = credentialGeneration(connection);
+    const tokens = await this.#refresh(auth.clientId, auth.clientSecret, connection.refreshToken);
+    if (typeof tokens.access_token !== "string" || tokens.access_token.trim() === "" || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0) {
+      throw new GoogleMarketingRuntimeError(
+        "Google OAuth returned an invalid token response",
+        "INVALID_TOKEN_RESPONSE"
+      );
+    }
+    const now = this.#now();
+    const patch = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? connection.refreshToken,
+      tokenExpiresAt: new Date(now.getTime() + tokens.expires_in * 1e3).toISOString(),
+      ...tokens.scope ? { scopes: tokens.scope.split(/\s+/).filter(Boolean) } : {},
+      updatedAt: now.toISOString()
+    };
+    if (!this.#connectionHasGeneration(provider, project.id, generationBeforeRefresh)) {
+      throw new GoogleMarketingRuntimeError(
+        `${provider === GoogleMarketingProviders["google-ads"] ? "Google Ads" : "GTM"} connection changed during token refresh`,
+        "CONNECTION_NOT_FOUND"
+      );
+    }
+    const refreshedConnection = { ...connection, ...patch };
+    const refreshedGeneration = credentialGeneration(refreshedConnection);
+    this.#restoreConnection(provider, refreshedConnection);
+    try {
+      await this.#saveConfigPatch(
+        provider === GoogleMarketingProviders["google-ads"] ? { googleAds: this.#config.googleAds } : { gtm: this.#config.gtm }
+      );
+    } catch (error) {
+      if (this.#connectionHasGeneration(provider, project.id, refreshedGeneration)) {
+        this.#restoreConnection(provider, connection);
+      }
+      throw error;
+    }
+    return tokens.access_token;
+  }
+};
+var DefaultGoogleMarketingRuntime = class {
+  #config;
+  #credentials;
+  #env;
+  #fetch;
+  #now;
+  #randomUUID;
+  constructor(options) {
+    this.#config = options.config;
+    this.#credentials = new ConfigCredentialStore(options);
+    this.#env = options.env ?? process.env;
+    this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.#randomUUID = options.randomUUID ?? crypto3.randomUUID;
+  }
+  async listGoogleAdsCustomers(project, options = {}) {
+    const normalizedProject = validateProject(project);
+    const client = await this.#adsClient(normalizedProject, options.loginCustomerId);
+    const result = await client.listAccessibleCustomerDetails({ maxCustomers: options.maxCustomers });
+    const fetchedAt2 = this.#now().toISOString();
+    const customersById = new Map(
+      result.data.customers.map((customer) => {
+        const dto = accessibleCustomerDto(customer);
+        return [dto.customerId, dto];
+      })
+    );
+    let hierarchyTruncated = false;
+    for (const root of result.data.customers) {
+      if (!root.manager) continue;
+      const remaining = GOOGLE_ADS_MAX_CUSTOMER_CLIENTS - customersById.size;
+      if (remaining <= 0) {
+        hierarchyTruncated = true;
+        break;
+      }
+      try {
+        const hierarchy = await client.getCustomerClients(root.id, { maxCustomers: remaining });
+        hierarchyTruncated ||= hierarchy.data.truncated;
+        for (const customer of hierarchy.data.customerClients) {
+          const dto = accessibleCustomerClientDto(customer, root.id);
+          const existing = customersById.get(dto.customerId);
+          if (!existing || dto.level < existing.level) customersById.set(dto.customerId, dto);
+        }
+      } catch {
+        hierarchyTruncated = true;
+      }
+    }
+    const customers = [...customersById.values()].sort((left, right) => left.level - right.level || left.customerId.localeCompare(right.customerId));
+    return googleAdsAccessibleCustomersResponseSchema.parse({
+      customers,
+      totalAccessible: customers.length,
+      truncated: result.data.truncated || result.data.failures.length > 0 || hierarchyTruncated,
+      selection: {
+        loginCustomerId: options.loginCustomerId ? normalizeGoogleAdsCustomerId(options.loginCustomerId, "Login customer ID") : null,
+        customerId: null,
+        selectedAt: null
+      },
+      fetchedAt: fetchedAt2
+    });
+  }
+  async getGoogleAdsCustomer(project, input) {
+    const normalizedProject = validateProject(project);
+    const client = await this.#adsClient(normalizedProject, input.loginCustomerId);
+    const result = await client.getCustomerDetails(input.customerId);
+    return accessibleCustomerDto(result.data);
+  }
+  async listGtmAccounts(project, options = {}) {
+    const limit = validatedListLimit(options.maxResults);
+    const client = await this.#gtmClient(validateProject(project));
+    const accounts = (await client.listAccounts()).map(toGtmAccountDto);
+    return gtmAccountsResponseSchema.parse({
+      accounts: accounts.slice(0, limit),
+      totalAccessible: accounts.length,
+      truncated: accounts.length > limit,
+      fetchedAt: this.#now().toISOString()
+    });
+  }
+  async listGtmContainers(project, accountId, options = {}) {
+    const limit = validatedListLimit(options.maxResults);
+    const normalizedAccountId = canonicalGtmAccountId(accountId);
+    const client = await this.#gtmClient(validateProject(project));
+    const containers = (await client.listContainers(accountPath(normalizedAccountId))).map(toGtmContainerDto);
+    return gtmContainerListResponseSchema.parse({
+      accountId: normalizedAccountId,
+      containers: containers.slice(0, limit),
+      totalAccessible: containers.length,
+      truncated: containers.length > limit,
+      fetchedAt: this.#now().toISOString()
+    });
+  }
+  async listGtmWorkspaces(project, accountId, containerId, options = {}) {
+    const limit = validatedListLimit(options.maxResults);
+    const normalizedAccountId = canonicalGtmAccountId(accountId);
+    const normalizedContainerId = canonicalGtmContainerId(containerId, normalizedAccountId);
+    const client = await this.#gtmClient(validateProject(project));
+    const workspaces = (await client.listWorkspaces(
+      containerPath(normalizedAccountId, normalizedContainerId)
+    )).map(toGtmWorkspaceDto);
+    return gtmWorkspaceListResponseSchema.parse({
+      accountId: normalizedAccountId,
+      containerId: normalizedContainerId,
+      workspaces: workspaces.slice(0, limit),
+      totalAccessible: workspaces.length,
+      truncated: workspaces.length > limit,
+      fetchedAt: this.#now().toISOString()
+    });
+  }
+  async syncGoogleAds(input) {
+    const project = validateProject(input.project);
+    const context = this.#snapshotContext(project, input.connectionId, input.runId);
+    const customerId = normalizeGoogleAdsCustomerId(input.selection.customerId);
+    const suppliedMetricsQuery = input.metricsQuery ? googleAdsCampaignMetricsQuerySchema.parse(input.metricsQuery) : void 0;
+    const client = await this.#adsClient(project, input.selection.loginCustomerId);
+    const [customerResult, campaignResult, goalResult] = await Promise.all([
+      client.getCustomerDetails(customerId),
+      client.getCampaigns(customerId, { limit: GOOGLE_ADS_MAX_RESULT_ROWS }),
+      client.getConversionGoals(customerId)
+    ]);
+    const capturedAt = this.#now().toISOString();
+    const accessibleCustomersData = googleAdsAccessibleCustomersResponseSchema.parse({
+      customers: [accessibleCustomerDto(customerResult.data)],
+      totalAccessible: 1,
+      truncated: false,
+      selection: {
+        loginCustomerId: input.selection.loginCustomerId ? normalizeGoogleAdsCustomerId(input.selection.loginCustomerId, "Login customer ID") : null,
+        customerId,
+        selectedAt: input.selection.selectedAt ?? null
+      },
+      fetchedAt: capturedAt
+    });
+    const accessibleCustomersPayload = {
+      kind: GoogleAdsSnapshotKinds["accessible-customers"],
+      data: accessibleCustomersData
+    };
+    const accessibleCustomersSnapshot = this.#googleAdsSnapshot(
+      context,
+      accessibleCustomersPayload,
+      customerId,
+      customerResult.data,
+      capturedAt
+    );
+    const inventory = inventoryDto(
+      customerId,
+      capturedAt,
+      campaignResult.data.map((row) => row.campaign),
+      goalResult.data
+    );
+    const inventoryPayload = {
+      kind: GoogleAdsSnapshotKinds.inventory,
+      data: inventory
+    };
+    const inventoryRaw = {
+      campaigns: campaignResult.data,
+      conversionGoals: goalResult.data
+    };
+    const inventorySnapshot = this.#googleAdsSnapshot(
+      context,
+      inventoryPayload,
+      customerId,
+      inventoryRaw,
+      capturedAt
+    );
+    const effectiveGoalGraph = deriveGoogleAdsEffectiveGoalGraph(inventory);
+    const defaults = defaultMetricsQuery(this.#now(), inventory.campaigns, customerResult.data.timeZone);
+    const metricsQuery = suppliedMetricsQuery ?? defaults.query;
+    if (!metricsQuery) {
+      return {
+        accessibleCustomers: accessibleCustomersSnapshot,
+        inventory: inventorySnapshot,
+        metrics: null,
+        effectiveGoalGraph
+      };
+    }
+    const metricResult = await client.getDailyCampaignMetrics(customerId, {
+      ...metricsQuery,
+      limit: GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS + 1
+    });
+    const metricRows = metricResult.data.map(campaignMetricDto);
+    const response = {
+      query: metricsQuery,
+      rows: metricRows.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS),
+      truncated: metricRows.length > GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS || suppliedMetricsQuery === void 0 && defaults.inventoryTruncated,
+      fetchedAt: this.#now().toISOString()
+    };
+    const metricsPayload = {
+      kind: GoogleAdsSnapshotKinds["campaign-metrics"],
+      data: response
+    };
+    const metricsSnapshot = this.#googleAdsSnapshot(
+      context,
+      metricsPayload,
+      customerId,
+      metricResult.data,
+      response.fetchedAt
+    );
+    return {
+      accessibleCustomers: accessibleCustomersSnapshot,
+      inventory: inventorySnapshot,
+      metrics: metricsSnapshot,
+      effectiveGoalGraph
+    };
+  }
+  async syncGtm(input) {
+    const project = validateProject(input.project);
+    const context = this.#snapshotContext(project, input.connectionId, input.runId);
+    const selected = canonicalizeGtmResourceSelection({
+      accountId: input.selection.accountId,
+      containerId: input.selection.containerId,
+      ...input.selection.workspaceId === void 0 || input.selection.workspaceId === null ? {} : { workspaceId: input.selection.workspaceId }
+    });
+    if (!selected) {
+      throw new GoogleMarketingRuntimeError("GTM resource selection is invalid", "INVALID_INPUT");
+    }
+    const selectedAccountId = selected.accountId;
+    const selectedContainerId = selected.containerId;
+    const selectedWorkspaceId = selected.workspaceId ?? null;
+    const client = await this.#gtmClient(project);
+    const accounts = await client.listAccounts();
+    const accountDtos = accounts.map(toGtmAccountDto);
+    const account = accountDtos.find((candidate) => candidate.id === selectedAccountId);
+    if (!account) {
+      throw new GoogleMarketingRuntimeError("Selected GTM account was not found", "RESOURCE_NOT_FOUND");
+    }
+    const selectedContainerPath = containerPath(selectedAccountId, selectedContainerId);
+    const [containers, workspaces] = await Promise.all([
+      client.listContainers(accountPath(selectedAccountId)),
+      client.listWorkspaces(selectedContainerPath)
+    ]);
+    const containerDtos = containers.map(toGtmContainerDto);
+    const container = containerDtos.find((candidate) => candidate.id === selectedContainerId);
+    if (!container) {
+      throw new GoogleMarketingRuntimeError("Selected GTM container was not found", "RESOURCE_NOT_FOUND");
+    }
+    const workspaceDtos = workspaces.map(toGtmWorkspaceDto);
+    if (workspaceDtos.length > MAX_LIST_LIMIT) {
+      throw new GoogleMarketingRuntimeError(
+        `GTM workspace inventory exceeds the ${MAX_LIST_LIMIT}-workspace safety limit`,
+        "INVALID_INPUT"
+      );
+    }
+    const selectedWorkspace = selectedWorkspaceId ? workspaceDtos.find((candidate) => candidate.id === selectedWorkspaceId) : void 0;
+    if (selectedWorkspaceId && !selectedWorkspace) {
+      throw new GoogleMarketingRuntimeError("Selected GTM workspace was not found", "RESOURCE_NOT_FOUND");
+    }
+    const snapshotReads = [
+      client.getLiveSnapshot(selectedContainerPath)
+    ];
+    if (selectedWorkspaceId) {
+      snapshotReads.push(client.getWorkspaceSnapshot(
+        workspacePath(selectedAccountId, selectedContainerId, selectedWorkspaceId)
+      ));
+    }
+    const snapshots = await Promise.all(snapshotReads);
+    const capturedAt = this.#now().toISOString();
+    const adapterOptions = {
+      fetchedAt: capturedAt,
+      ...input.expectedEventName ? { expectedEventName: input.expectedEventName } : {},
+      ...input.expectedHostname ? { expectedHostname: input.expectedHostname } : {}
+    };
+    const live = toGtmLiveContainerGraphDto(snapshots[0], adapterOptions);
+    const draft = snapshots[1] ? toGtmDraftWorkspaceGraphDto(snapshots[1], adapterOptions) : null;
+    const payload = {
+      kind: GtmSnapshotKinds.container,
+      data: {
+        account,
+        container,
+        workspaces: workspaceDtos,
+        live,
+        draft,
+        fetchedAt: capturedAt
+      }
+    };
+    const raw = { accounts, containers, workspaces, snapshots };
+    return this.#gtmSnapshot(
+      context,
+      payload,
+      selectedAccountId,
+      selectedContainerId,
+      selectedWorkspaceId,
+      raw,
+      capturedAt
+    );
+  }
+  async #adsClient(project, loginCustomerId) {
+    const { accessToken } = await this.#credentials.getCredential(
+      project,
+      GoogleMarketingProviders["google-ads"]
+    );
+    const auth = getGoogleAdsAuthConfig(this.#config);
+    const developerToken = this.#env.GOOGLE_ADS_DEVELOPER_TOKEN?.trim() || auth.developerToken?.trim();
+    if (!developerToken) {
+      throw new GoogleMarketingRuntimeError(
+        "Google Ads developer token is not configured",
+        "NOT_CONFIGURED"
+      );
+    }
+    return new GoogleAdsClient({
+      accessToken,
+      developerToken,
+      ...loginCustomerId ? { loginCustomerId } : {}
+    }, { fetch: this.#fetch });
+  }
+  async #gtmClient(project) {
+    const { accessToken } = await this.#credentials.getCredential(
+      project,
+      GoogleMarketingProviders.gtm
+    );
+    return createGoogleTagManagerClient(accessToken, { fetch: this.#fetch });
+  }
+  #snapshotContext(project, connectionId, runId) {
+    return {
+      project,
+      connectionId: nonEmpty(connectionId, "Connection ID"),
+      runId: nonEmpty(runId, "Run ID")
+    };
+  }
+  #googleAdsSnapshot(context, payload, customerId, raw, capturedAt) {
+    return googleAdsRawSnapshotDtoSchema.parse({
+      metadata: {
+        id: this.#randomUUID(),
+        projectId: context.project.id,
+        connectionId: context.connectionId,
+        runId: context.runId,
+        kind: payload.kind,
+        customerId,
+        payloadChecksum: checksumJson(payload),
+        ...rawMetadata(raw),
+        capturedAt,
+        createdAt: capturedAt
+      },
+      payload
+    });
+  }
+  #gtmSnapshot(context, payload, accountId, containerId, workspaceId, raw, capturedAt) {
+    return gtmRawSnapshotDtoSchema.parse({
+      metadata: {
+        id: this.#randomUUID(),
+        projectId: context.project.id,
+        connectionId: context.connectionId,
+        runId: context.runId,
+        kind: payload.kind,
+        accountId,
+        containerId,
+        workspaceId,
+        payloadChecksum: checksumJson(payload),
+        ...rawMetadata(raw),
+        capturedAt,
+        createdAt: capturedAt
+      },
+      payload
+    });
+  }
+};
+function createGoogleMarketingCredentialStore(options) {
+  return new ConfigCredentialStore(options);
+}
+function createGoogleMarketingRuntime(options) {
+  return new DefaultGoogleMarketingRuntime(options);
+}
+
 // src/server.ts
 import { createRequire as createRequire4 } from "module";
-import crypto24 from "crypto";
+import crypto26 from "crypto";
 import fs7 from "fs";
 import path8 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { and as and18, eq as eq24 } from "drizzle-orm";
+import { and as and19, eq as eq25 } from "drizzle-orm";
 import Fastify from "fastify";
 import os4 from "os";
 
@@ -2977,7 +5719,7 @@ function getPlacesConfig(config) {
 }
 
 // src/google-config.ts
-function ensureConnections(config) {
+function ensureConnections3(config) {
   if (!config.google) config.google = {};
   if (!config.google.connections) config.google.connections = [];
   return config.google.connections;
@@ -3006,7 +5748,7 @@ function getGoogleConnection(config, domain, connectionType) {
   return (config.google?.connections ?? []).find((connection) => connection.domain === domain && connection.connectionType === connectionType);
 }
 function upsertGoogleConnection(config, connection) {
-  const connections = ensureConnections(config);
+  const connections = ensureConnections3(config);
   const index = connections.findIndex((entry) => entry.domain === connection.domain && entry.connectionType === connection.connectionType);
   const normalized = {
     ...connection,
@@ -3051,7 +5793,7 @@ function removeGoogleConnection(config, domain, connectionType) {
 }
 
 // src/ga4-config.ts
-function ensureConnections2(config) {
+function ensureConnections4(config) {
   if (!config.ga4) config.ga4 = {};
   if (!config.ga4.connections) config.ga4.connections = [];
   return config.ga4.connections;
@@ -3060,7 +5802,7 @@ function getGa4Connection(config, projectName) {
   return (config.ga4?.connections ?? []).find((c) => c.projectName === projectName);
 }
 function upsertGa4Connection(config, connection) {
-  const connections = ensureConnections2(config);
+  const connections = ensureConnections4(config);
   const index = connections.findIndex((c) => c.projectName === connection.projectName);
   if (index === -1) {
     connections.push(connection);
@@ -3083,7 +5825,7 @@ function removeGa4Connection(config, projectName) {
 }
 
 // src/cloud-run-config.ts
-function ensureConnections3(config) {
+function ensureConnections5(config) {
   if (!config.cloudRun) config.cloudRun = {};
   if (!config.cloudRun.connections) config.cloudRun.connections = [];
   return config.cloudRun.connections;
@@ -3092,7 +5834,7 @@ function getCloudRunConnection(config, projectName) {
   return (config.cloudRun?.connections ?? []).find((c) => c.projectName === projectName);
 }
 function upsertCloudRunConnection(config, connection) {
-  const connections = ensureConnections3(config);
+  const connections = ensureConnections5(config);
   const index = connections.findIndex((c) => c.projectName === connection.projectName);
   if (index === -1) {
     connections.push(connection);
@@ -3115,7 +5857,7 @@ function removeCloudRunConnection(config, projectName) {
 }
 
 // src/wordpress-traffic-config.ts
-function ensureConnections4(config) {
+function ensureConnections6(config) {
   if (!config.wordpressTraffic) config.wordpressTraffic = {};
   if (!config.wordpressTraffic.connections) config.wordpressTraffic.connections = [];
   return config.wordpressTraffic.connections;
@@ -3124,7 +5866,7 @@ function getWordpressTrafficConnection(config, projectName) {
   return (config.wordpressTraffic?.connections ?? []).find((c) => c.projectName === projectName);
 }
 function upsertWordpressTrafficConnection(config, connection) {
-  const connections = ensureConnections4(config);
+  const connections = ensureConnections6(config);
   const index = connections.findIndex((c) => c.projectName === connection.projectName);
   if (index === -1) {
     connections.push(connection);
@@ -3147,7 +5889,7 @@ function removeWordpressTrafficConnection(config, projectName) {
 }
 
 // src/vercel-traffic-config.ts
-function ensureConnections5(config) {
+function ensureConnections7(config) {
   if (!config.vercelTraffic) config.vercelTraffic = {};
   if (!config.vercelTraffic.connections) config.vercelTraffic.connections = [];
   return config.vercelTraffic.connections;
@@ -3156,7 +5898,7 @@ function getVercelTrafficConnection(config, projectName) {
   return (config.vercelTraffic?.connections ?? []).find((c) => c.projectName === projectName);
 }
 function upsertVercelTrafficConnection(config, connection) {
-  const connections = ensureConnections5(config);
+  const connections = ensureConnections7(config);
   const index = connections.findIndex((c) => c.projectName === connection.projectName);
   if (index === -1) {
     connections.push(connection);
@@ -3183,7 +5925,7 @@ function unsupportedDeliveryMode(deliveryMode) {
   const label = typeof deliveryMode === "string" ? ` "${deliveryMode}"` : "";
   return new Error(`Unsupported Cloudflare traffic delivery mode${label}`);
 }
-function ensureConnections6(config) {
+function ensureConnections8(config) {
   if (!config.cloudflareTraffic) config.cloudflareTraffic = {};
   if (!config.cloudflareTraffic.connections) config.cloudflareTraffic.connections = [];
   return config.cloudflareTraffic.connections;
@@ -3213,7 +5955,7 @@ function getCloudflareTrafficConnectionBySourceId(config, sourceId) {
 }
 function upsertCloudflareTrafficConnection(config, connection) {
   normalizeCloudflareTrafficConnection(connection);
-  const connections = ensureConnections6(config);
+  const connections = ensureConnections8(config);
   const index = connections.findIndex((c) => c.sourceId === connection.sourceId);
   if (index === -1) {
     connections.push(connection);
@@ -3252,7 +5994,7 @@ function buildCloudflareIngestUrlTemplate(config) {
 }
 
 // src/wordpress-config.ts
-function ensureConnections7(config) {
+function ensureConnections9(config) {
   if (!config.wordpress) config.wordpress = {};
   if (!config.wordpress.connections) config.wordpress.connections = [];
   return config.wordpress.connections;
@@ -3269,7 +6011,7 @@ function getWordpressConnection(config, projectName) {
   return (config.wordpress?.connections ?? []).find((connection) => connection.projectName === projectName);
 }
 function upsertWordpressConnection(config, connection) {
-  const connections = ensureConnections7(config);
+  const connections = ensureConnections9(config);
   const normalized = normalizeConnection(connection);
   const index = connections.findIndex((entry) => entry.projectName === connection.projectName);
   if (index === -1) {
@@ -3303,14 +6045,14 @@ function removeWordpressConnection(config, projectName) {
 }
 
 // src/job-runner.ts
-import crypto4 from "crypto";
+import crypto6 from "crypto";
 import fs2 from "fs";
 import path3 from "path";
 import os3 from "os";
 import { and as and2, eq as eq2, inArray, ne, sql as sql2 } from "drizzle-orm";
 
 // src/run-telemetry.ts
-import crypto2 from "crypto";
+import crypto4 from "crypto";
 function extractRegistrableHost(input) {
   if (!input) return null;
   const trimmed = input.trim();
@@ -3330,7 +6072,7 @@ function extractRegistrableHost(input) {
 function hashDomain(input) {
   const host = extractRegistrableHost(input);
   if (!host) return null;
-  return crypto2.createHash("sha256").update(host).digest("hex");
+  return crypto4.createHash("sha256").update(host).digest("hex");
 }
 function buildRunCompletedProps(input) {
   const totalMs = input.phases?.total_ms ?? Date.now() - input.startTime;
@@ -3415,7 +6157,7 @@ function getSharedProviderExecutionGate(providerName, maxConcurrency, maxPerMinu
 }
 
 // src/usage-quota.ts
-import crypto3 from "crypto";
+import crypto5 from "crypto";
 import { and, eq, lte, sql } from "drizzle-orm";
 function getCurrentUsageDay() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -3432,7 +6174,7 @@ function reserveDailyQueryQuota(db, input) {
     )).run();
     if (reserveExisting().changes === 1) return { reserved: true, used: 0 };
     const inserted = tx.insert(usageCounters).values({
-      id: crypto3.randomUUID(),
+      id: crypto5.randomUUID(),
       scope: input.scope,
       period: input.period,
       metric: "queries",
@@ -3846,7 +6588,7 @@ var JobRunner = class {
             );
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs2.existsSync(raw.screenshotPath)) {
-              const snapshotId = crypto4.randomUUID();
+              const snapshotId = crypto6.randomUUID();
               const screenshotDir = path3.join(os3.homedir(), ".canonry", "screenshots", runId);
               if (!fs2.existsSync(screenshotDir)) fs2.mkdirSync(screenshotDir, { recursive: true });
               const destPath = path3.join(screenshotDir, `${snapshotId}.png`);
@@ -3889,7 +6631,7 @@ var JobRunner = class {
               }).run();
             } else {
               this.db.insert(querySnapshots).values({
-                id: crypto4.randomUUID(),
+                id: crypto6.randomUUID(),
                 runId,
                 queryId: q.id,
                 queryText: q.query,
@@ -4001,7 +6743,7 @@ var JobRunner = class {
               competitorDomains,
               allBrandNames
             );
-            const snapshotId = crypto4.randomUUID();
+            const snapshotId = crypto6.randomUUID();
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs2.existsSync(raw.screenshotPath)) {
               const screenshotDir = path3.join(os3.homedir(), ".canonry", "screenshots", runId);
@@ -4237,7 +6979,7 @@ var JobRunner = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const period = now.slice(0, 10);
     this.db.insert(usageCounters).values({
-      id: crypto4.randomUUID(),
+      id: crypto6.randomUUID(),
       scope,
       period,
       metric,
@@ -4339,11 +7081,11 @@ function maybeShowActivationNotice(io = {}) {
 }
 
 // src/gsc-sync.ts
-import crypto6 from "crypto";
+import crypto8 from "crypto";
 import { eq as eq4, and as and4, sql as sql3 } from "drizzle-orm";
 
 // src/gsc-coverage-snapshot.ts
-import crypto5 from "crypto";
+import crypto7 from "crypto";
 import { and as and3, desc, eq as eq3, gte } from "drizzle-orm";
 var COVERAGE_IMPRESSION_WINDOW_DAYS = 30;
 function pageKey(raw) {
@@ -4405,7 +7147,7 @@ function writeCoverageSnapshot(db, projectId, runId, opts = {}) {
   const snapshotDate = now.toISOString().split("T")[0];
   db.delete(gscCoverageSnapshots).where(and3(eq3(gscCoverageSnapshots.projectId, projectId), eq3(gscCoverageSnapshots.date, snapshotDate))).run();
   db.insert(gscCoverageSnapshots).values({
-    id: crypto5.randomUUID(),
+    id: crypto7.randomUUID(),
     projectId,
     syncRunId: runId,
     date: snapshotDate,
@@ -4484,7 +7226,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       for (const row of batch) {
         const [query, page, country, device, date] = row.keys;
         db.insert(gscSearchData).values({
-          id: crypto6.randomUUID(),
+          id: crypto8.randomUUID(),
           projectId,
           syncRunId: runId,
           date: date ?? "",
@@ -4516,7 +7258,7 @@ async function executeGscSync(db, runId, projectId, opts) {
     for (const row of totalRows) {
       const [date] = row.keys;
       db.insert(gscDailyTotals).values({
-        id: crypto6.randomUUID(),
+        id: crypto8.randomUUID(),
         projectId,
         date: date ?? "",
         clicks: row.clicks,
@@ -4565,7 +7307,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       const [date, query] = row.keys;
       if (!date || !query) continue;
       db.insert(gscQueryDailyTotals).values({
-        id: crypto6.randomUUID(),
+        id: crypto8.randomUUID(),
         projectId,
         date,
         query,
@@ -4590,7 +7332,7 @@ async function executeGscSync(db, runId, projectId, opts) {
 }
 
 // src/gbp-sync.ts
-import crypto7 from "crypto";
+import crypto9 from "crypto";
 import { eq as eq5, and as and5, desc as desc2, inArray as inArray2, lt } from "drizzle-orm";
 var MS_PER_DAY = 864e5;
 var log3 = createLogger("GbpSync");
@@ -4715,7 +7457,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             tx.delete(gbpDailyMetrics).where(and5(eq5(gbpDailyMetrics.projectId, projectId), eq5(gbpDailyMetrics.locationName, loc.locationName))).run();
             for (const row of metricRows) {
               tx.insert(gbpDailyMetrics).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 date: row.date,
@@ -4727,7 +7469,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             tx.delete(gbpKeywordImpressions).where(and5(eq5(gbpKeywordImpressions.projectId, projectId), eq5(gbpKeywordImpressions.locationName, loc.locationName))).run();
             for (const row of keywordRows) {
               tx.insert(gbpKeywordImpressions).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 periodStart: monthKey(keywordsStart),
@@ -4748,7 +7490,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
               for (const { month, rows } of monthlyKeywordResults) {
                 for (const row of rows) {
                   tx.insert(gbpKeywordMonthly).values({
-                    id: crypto7.randomUUID(),
+                    id: crypto9.randomUUID(),
                     projectId,
                     locationName: loc.locationName,
                     month,
@@ -4769,7 +7511,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             tx.delete(gbpPlaceActions).where(and5(eq5(gbpPlaceActions.projectId, projectId), eq5(gbpPlaceActions.locationName, loc.locationName))).run();
             for (const row of placeActionRows) {
               tx.insert(gbpPlaceActions).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 placeActionLinkName: row.placeActionLinkName,
@@ -4782,7 +7524,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (lodging !== null && lodgingChanged) {
               tx.insert(gbpLodgingSnapshots).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 contentHash: lodgingHash,
@@ -4796,7 +7538,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (attributesChanged) {
               tx.insert(gbpAttributesSnapshots).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 contentHash: attributesHash,
@@ -4810,7 +7552,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (placeToWrite) {
               tx.insert(gbpPlaceDetails).values({
-                id: crypto7.randomUUID(),
+                id: crypto9.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 placeId: placeToWrite.placeId,
@@ -4897,7 +7639,7 @@ async function refreshSelectedLocationProfiles(db, projectId, accessToken, locat
 }
 
 // src/ads-sync.ts
-import crypto8 from "crypto";
+import crypto10 from "crypto";
 import { eq as eq6 } from "drizzle-orm";
 
 // ../integration-openai-ads/src/constants.ts
@@ -5388,7 +8130,7 @@ async function getAdGroupInsights(apiKey, adGroupId, opts) {
 }
 
 // src/ads-config.ts
-function ensureConnections8(config) {
+function ensureConnections10(config) {
   if (!config.openaiAds) config.openaiAds = {};
   if (!config.openaiAds.connections) config.openaiAds.connections = [];
   return config.openaiAds.connections;
@@ -5397,7 +8139,7 @@ function getOpenAiAdsConnection(config, projectName) {
   return (config.openaiAds?.connections ?? []).find((c) => c.projectName === projectName);
 }
 function upsertOpenAiAdsConnection(config, connection) {
-  const connections = ensureConnections8(config);
+  const connections = ensureConnections10(config);
   const index = connections.findIndex((c) => c.projectName === connection.projectName);
   if (index === -1) {
     connections.push(connection);
@@ -5625,7 +8367,7 @@ async function executeAdsSync(db, runId, projectId, opts) {
       }
       for (const upsert of insightUpserts) {
         tx.insert(adsInsightsDaily).values({
-          id: crypto8.randomUUID(),
+          id: crypto10.randomUUID(),
           projectId,
           level: upsert.level,
           entityId: upsert.entityId,
@@ -5692,7 +8434,7 @@ async function executeAdsSync(db, runId, projectId, opts) {
 }
 
 // src/gsc-inspect-sitemap.ts
-import crypto10 from "crypto";
+import crypto12 from "crypto";
 import { eq as eq7 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
@@ -5792,7 +8534,7 @@ async function parseSitemapRecursive(url, urls, visited, depth, isChild) {
 }
 
 // src/inspect-rate-gate.ts
-import crypto9 from "crypto";
+import crypto11 from "crypto";
 var gates = /* @__PURE__ */ new Map();
 function sharedRateGate(key) {
   let entry = gates.get(key);
@@ -5811,7 +8553,7 @@ function sharedRateGate(key) {
   };
 }
 function credentialGateKey(prefix, secret) {
-  const digest = crypto9.createHash("sha256").update(secret).digest("hex").slice(0, 12);
+  const digest = crypto11.createHash("sha256").update(secret).digest("hex").slice(0, 12);
   return `${prefix}:${digest}`;
 }
 
@@ -5966,7 +8708,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
           const rich = ir.richResultsResult;
           const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
           db.insert(gscUrlInspections).values({
-            id: crypto10.randomUUID(),
+            id: crypto12.randomUUID(),
             projectId,
             syncRunId: runId,
             url: pageUrl,
@@ -6024,7 +8766,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/bing-inspect-sitemap.ts
-import crypto11 from "crypto";
+import crypto13 from "crypto";
 import { eq as eq8, desc as desc3 } from "drizzle-orm";
 var log7 = createLogger("BingInspectSitemap");
 var BING_INSPECT_SPACING_MS = 2e3;
@@ -6129,7 +8871,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
             derivedInIndex = false;
           }
           db.insert(bingUrlInspections).values({
-            id: crypto11.randomUUID(),
+            id: crypto13.randomUUID(),
             projectId,
             url: pageUrl,
             httpCode,
@@ -6213,7 +8955,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const snapNow = (/* @__PURE__ */ new Date()).toISOString();
     db.insert(bingCoverageSnapshots).values({
-      id: crypto11.randomUUID(),
+      id: crypto13.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -6254,7 +8996,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/coverage-refresh.ts
-import crypto12 from "crypto";
+import crypto14 from "crypto";
 import { and as and6, desc as desc4, eq as eq9, inArray as inArray3 } from "drizzle-orm";
 var log8 = createLogger("CoverageRefresh");
 var COVERAGE_REFRESH_MIN_INTERVAL_MS = 60 * 60 * 1e3;
@@ -6304,7 +9046,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
       return null;
     }
   }
-  const runId = crypto12.randomUUID();
+  const runId = crypto14.randomUUID();
   db.insert(runs).values({
     id: runId,
     projectId,
@@ -6327,7 +9069,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
 }
 
 // src/commoncrawl-sync.ts
-import crypto13 from "crypto";
+import crypto15 from "crypto";
 import path4 from "path";
 import { and as and7, eq as eq10, sql as sql4 } from "drizzle-orm";
 var log9 = createLogger("CommonCrawlSync");
@@ -6402,7 +9144,7 @@ async function executeReleaseSync(db, syncId, opts) {
         if (!projectIds) continue;
         for (const projectId of projectIds) {
           expanded.push({
-            id: crypto13.randomUUID(),
+            id: crypto15.randomUUID(),
             projectId,
             releaseSyncId: syncId,
             release,
@@ -6422,7 +9164,7 @@ async function executeReleaseSync(db, syncId, opts) {
         const projectRows = rowsByProject.get(p.id) ?? [];
         const summary = computeSummary(projectRows);
         tx.insert(backlinkSummaries).values({
-          id: crypto13.randomUUID(),
+          id: crypto15.randomUUID(),
           projectId: p.id,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -6519,7 +9261,7 @@ function computeSummary(rows) {
 }
 
 // src/backlink-extract.ts
-import crypto14 from "crypto";
+import crypto16 from "crypto";
 import fs3 from "fs";
 import { and as and8, desc as desc5, eq as eq11 } from "drizzle-orm";
 var log10 = createLogger("BacklinkExtract");
@@ -6575,7 +9317,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       ).run();
       if (rows.length > 0) {
         const values = rows.map((r) => ({
-          id: crypto14.randomUUID(),
+          id: crypto16.randomUUID(),
           projectId,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -6589,7 +9331,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       }
       const summary = computeSummary2(rows);
       tx.insert(backlinkSummaries).values({
-        id: crypto14.randomUUID(),
+        id: crypto16.randomUUID(),
         projectId,
         releaseSyncId: syncId,
         source: BacklinkSources.commoncrawl,
@@ -6632,7 +9374,7 @@ function computeSummary2(rows) {
 }
 
 // src/discovery-run.ts
-import crypto15 from "crypto";
+import crypto17 from "crypto";
 import { and as and9, eq as eq12 } from "drizzle-orm";
 var log11 = createLogger("DiscoveryRun");
 var DEFAULT_SEED_COUNT = 30;
@@ -6987,7 +9729,7 @@ function writeDiscoveryInsight(db, input) {
       eq12(insights.dismissed, false)
     )).run();
     tx.insert(insights).values({
-      id: crypto15.randomUUID(),
+      id: crypto17.randomUUID(),
       projectId: input.projectId,
       runId: input.runId,
       type: "discovery.basket-divergence",
@@ -7023,7 +9765,7 @@ function buildDiscoveryInsightTitle(input) {
 }
 
 // src/execute-site-audit.ts
-import crypto17 from "crypto";
+import crypto19 from "crypto";
 import { and as and12, eq as eq15, sql as sql6 } from "drizzle-orm";
 import { runSiteCrawl } from "@canonry/aeo-audit";
 
@@ -7212,7 +9954,7 @@ async function requestPinnedSiteAuditRoot(target, options) {
 }
 
 // src/site-crawl-graph-layout.ts
-import crypto16 from "crypto";
+import crypto18 from "crypto";
 import { createRequire as createRequire3 } from "module";
 import { Worker } from "worker_threads";
 import { and as and10, asc, count, desc as desc6, eq as eq13, isNull, ne as ne2, or, sql as sql5 } from "drizzle-orm";
@@ -7289,7 +10031,7 @@ function noverlapMaxIterations(nodeCount) {
 }
 var COMPONENT_PACKING_SPACING_FACTOR = 3;
 function siteCrawlGraphLayoutSettingsFingerprint(settings) {
-  return crypto16.createHash("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 8);
+  return crypto18.createHash("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 8);
 }
 var SITE_CRAWL_GRAPH_LAYOUT_ALGORITHM = "site-health-fa2-v5";
 var SITE_CRAWL_GRAPH_LAYOUT_VERSION = `${SITE_CRAWL_GRAPH_LAYOUT_ALGORITHM}-${siteCrawlGraphLayoutSettingsFingerprint({
@@ -7786,7 +10528,7 @@ function persistSiteCrawlGraphLayout(db, scope, layout, now = (/* @__PURE__ */ n
       eq13(siteCrawlGraphLayouts.attemptId, scope.attemptId)
     )).run();
     tx.insert(siteCrawlGraphLayouts).values({
-      id: crypto16.randomUUID(),
+      id: crypto18.randomUUID(),
       projectId: scope.projectId,
       runId: scope.runId,
       attemptId: scope.attemptId,
@@ -7806,7 +10548,7 @@ function persistSiteCrawlGraphLayout(db, scope, layout, now = (/* @__PURE__ */ n
     const batchSize = 250;
     for (let offset = 0; offset < layout.nodes.length; offset += batchSize) {
       tx.insert(siteCrawlGraphNodes).values(layout.nodes.slice(offset, offset + batchSize).map((node) => ({
-        id: crypto16.randomUUID(),
+        id: crypto18.randomUUID(),
         projectId: scope.projectId,
         runId: scope.runId,
         attemptId: scope.attemptId,
@@ -7819,7 +10561,7 @@ function persistSiteCrawlGraphLayout(db, scope, layout, now = (/* @__PURE__ */ n
     }
     for (let offset = 0; offset < layout.edges.length; offset += batchSize) {
       tx.insert(siteCrawlGraphEdges).values(layout.edges.slice(offset, offset + batchSize).map((edge) => ({
-        id: crypto16.randomUUID(),
+        id: crypto18.randomUUID(),
         projectId: scope.projectId,
         runId: scope.runId,
         attemptId: scope.attemptId,
@@ -8108,7 +10850,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
   const claim = db.update(runs).set({ status: "running", startedAt }).where(and12(eq15(runs.id, runId), eq15(runs.projectId, projectId), eq15(runs.status, "queued"))).run();
   if (claim.changes === 0) return;
   const attemptNumber = (db.select({ value: sql6`coalesce(max(${siteCrawlAttempts.attemptNumber}), 0)` }).from(siteCrawlAttempts).where(eq15(siteCrawlAttempts.runId, runId)).get()?.value ?? 0) + 1;
-  const attemptId = crypto17.randomUUID();
+  const attemptId = crypto19.randomUUID();
   db.insert(siteCrawlAttempts).values({
     id: attemptId,
     projectId,
@@ -8186,7 +10928,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       nodeKey: page.key
     });
     tx.insert(siteCrawlPages).values({
-      id: crypto17.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId,
       runId,
       attemptId,
@@ -8277,7 +11019,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     if (isSelfLink(edge.from, edge.to)) return;
     observedEdges.set(edge.key, edge);
     tx.insert(siteCrawlEdges).values({
-      id: crypto17.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId,
       runId,
       attemptId,
@@ -8347,7 +11089,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         return;
       }
       tx.insert(siteCrawlEventReceipts).values({
-        id: crypto17.randomUUID(),
+        id: crypto19.randomUUID(),
         projectId,
         runId,
         attemptId,
@@ -8481,7 +11223,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       if (claim2.changes === 0) return false;
       if (hasAuditedPages) {
         tx.insert(siteAuditSnapshots).values({
-          id: crypto17.randomUUID(),
+          id: crypto19.randomUUID(),
           projectId,
           runId,
           sitemapUrl: opts.sitemapUrl ?? new URL("/sitemap.xml", crawlRootUrl).href,
@@ -8499,7 +11241,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         for (const page of observedPages.values()) {
           if (!isLegacyScorecardPage(page)) continue;
           tx.insert(siteAuditPages).values({
-            id: crypto17.randomUUID(),
+            id: crypto19.randomUUID(),
             projectId,
             runId,
             url: page.finalUrl ?? page.requestedUrl,
@@ -8512,7 +11254,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         }
       }
       tx.insert(siteCrawlSnapshots).values({
-        id: crypto17.randomUUID(),
+        id: crypto19.randomUUID(),
         projectId,
         runId,
         attemptId,
@@ -8556,7 +11298,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       if (opts.checkDeadLinks) {
         for (const finding of deadLinkFindings) {
           tx.insert(siteCrawlFindings).values({
-            id: crypto17.randomUUID(),
+            id: crypto19.randomUUID(),
             projectId,
             runId,
             attemptId,
@@ -9087,7 +11829,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-6ZYTEFXX.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-KT6K4ODY.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -9663,7 +12405,7 @@ var ProviderRegistry = class {
 };
 
 // src/scheduler.ts
-import crypto18 from "crypto";
+import crypto20 from "crypto";
 import cron from "node-cron";
 import { and as and14, eq as eq17, inArray as inArray6, notExists, sql as sql8 } from "drizzle-orm";
 var log13 = createLogger("Scheduler");
@@ -9706,7 +12448,7 @@ var Scheduler = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     for (const project of projectsWithoutHealth) {
       this.db.insert(schedules).values({
-        id: crypto18.randomUUID(),
+        id: crypto20.randomUUID(),
         projectId: project.id,
         kind: SchedulableRunKinds.doctor,
         cronExpr: DEFAULT_HEALTH_CRON,
@@ -9865,7 +12607,7 @@ var Scheduler = class {
           log13.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
           return;
         }
-        const runId2 = crypto18.randomUUID();
+        const runId2 = crypto20.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -9898,7 +12640,7 @@ var Scheduler = class {
           this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq17(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto18.randomUUID();
+        const runId2 = crypto20.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -9973,7 +12715,7 @@ var Scheduler = class {
           this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq17(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto18.randomUUID();
+        const runId2 = crypto20.randomUUID();
         const effectiveRequest = normalizeSiteAuditRunRequest({});
         this.db.transaction((tx) => {
           tx.insert(runs).values({
@@ -10054,7 +12796,11 @@ async function refreshAllIntegrations(client, projectName) {
     { name: "bing", run: () => client.bingInspectSitemap(projectName, {}) },
     { name: "ga", run: () => client.gaSync(projectName, { days: 30 }) },
     { name: "gbp", run: () => client.triggerGbpSync(projectName, {}) },
-    { name: "ads", run: () => client.triggerAdsSync(projectName) }
+    // `ads` remains the OpenAI / ChatGPT Ads integration. For scheduled
+    // refreshes, Google providers have explicit names and fan out only here.
+    { name: "ads", run: () => client.triggerAdsSync(projectName) },
+    { name: "google-ads", run: () => client.triggerGoogleAdsSync(projectName) },
+    { name: "gtm", run: () => client.triggerGtmSync(projectName) }
   ];
   const results = await Promise.allSettled(integrations.map((i) => i.run()));
   results.forEach((result, idx) => {
@@ -10071,7 +12817,7 @@ async function refreshAllIntegrations(client, projectName) {
 
 // src/notifier.ts
 import { eq as eq18, desc as desc7, and as and15, inArray as inArray7, or as or2 } from "drizzle-orm";
-import crypto19 from "crypto";
+import crypto21 from "crypto";
 var log15 = createLogger("Notifier");
 var Notifier = class {
   db;
@@ -10397,7 +13143,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto19.randomUUID(),
+      id: crypto21.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -10559,7 +13305,7 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto23 from "crypto";
+import crypto25 from "crypto";
 import { eq as eq21 } from "drizzle-orm";
 
 // src/agent/session.ts
@@ -10993,12 +13739,12 @@ function stripProjectFromJsonSchema(jsonSchema) {
     return { schema: jsonSchema, hadProject: false };
   }
   const { project: _project, ...remainingProps } = properties;
-  const required = Array.isArray(obj.required) ? obj.required.filter((name) => name !== "project") : obj.required;
+  const required2 = Array.isArray(obj.required) ? obj.required.filter((name) => name !== "project") : obj.required;
   const stripped = { ...obj, properties: remainingProps };
-  if (required === void 0) {
+  if (required2 === void 0) {
     delete stripped.required;
   } else {
-    stripped.required = required;
+    stripped.required = required2;
   }
   return { schema: stripped, hadProject: true };
 }
@@ -11303,7 +14049,7 @@ function buildAeroStateTools(ctx, opts = {}) {
 }
 
 // src/agent/llm-usage.ts
-import crypto20 from "crypto";
+import crypto22 from "crypto";
 var AeroLlmUsageFeatures = {
   turn: "aero.turn"
 };
@@ -11322,7 +14068,7 @@ function recordLlmUsageEvent(args) {
     const usage = args.message.usage;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     args.db.insert(llmUsageEvents).values({
-      id: crypto20.randomUUID(),
+      id: crypto22.randomUUID(),
       projectId: args.projectId,
       runId: args.runId,
       agentSessionId: args.agentSessionId,
@@ -11398,7 +14144,7 @@ function splitAeroAnthropicSystemCachePayload(payload, model) {
 }
 
 // src/agent/tool-usage.ts
-import crypto21 from "crypto";
+import crypto23 from "crypto";
 var AeroToolEventStatuses = {
   success: "success",
   error: "error"
@@ -11461,7 +14207,7 @@ function createAeroToolUsageHooks(args) {
 function recordAgentToolEvent(args) {
   try {
     args.db.insert(agentToolEvents).values({
-      id: crypto21.randomUUID(),
+      id: crypto23.randomUUID(),
       projectId: args.projectId,
       agentSessionId: args.agentSessionId,
       toolCallId: args.toolCallId,
@@ -11688,7 +14434,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto22 from "crypto";
+import crypto24 from "crypto";
 import { and as and16, desc as desc8, eq as eq20, like, sql as sql9 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
@@ -11717,7 +14463,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto22.randomUUID();
+  const id = crypto24.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -11754,7 +14500,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto22.randomUUID();
+  const id = crypto24.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -12033,7 +14779,7 @@ var SessionRegistry = class {
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
     const systemPrompt = loadAeroSystemPrompt();
-    const sessionId = crypto23.randomUUID();
+    const sessionId = crypto25.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -12412,7 +15158,7 @@ ${lines.join("\n")}
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: params.id ?? crypto23.randomUUID(),
+      id: params.id ?? crypto25.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -12953,7 +15699,7 @@ var SnapshotService = class {
     });
     const enrichedResults = applyBatchAssessment(queryResults, batchAssessment);
     const summary = buildSnapshotSummary(companyName, profile.queries, providers, enrichedResults, audit, batchAssessment);
-    const reportCompetitors = uniqueStrings([
+    const reportCompetitors = uniqueStrings2([
       ...manualCompetitors,
       ...summary.topCompetitors.map((entry) => entry.name)
     ]);
@@ -13005,8 +15751,8 @@ var SnapshotService = class {
         return {
           industry: parsed.industry?.trim() || "Unknown",
           summary: parsed.summary?.trim() || ctx.audit.summary,
-          services: uniqueStrings(parsed.services ?? []).slice(0, 6),
-          categoryTerms: uniqueStrings(parsed.categoryTerms ?? []).slice(0, 8),
+          services: uniqueStrings2(parsed.services ?? []).slice(0, 6),
+          categoryTerms: uniqueStrings2(parsed.categoryTerms ?? []).slice(0, 8),
           queries: parsedQueries
         };
       } catch (err) {
@@ -13075,9 +15821,9 @@ var SnapshotService = class {
               accuracyNotes: null,
               incorrectClaims: [],
               recommendedCompetitors: preliminaryCompetitors,
-              citedDomains: uniqueStrings(normalized.citedDomains),
+              citedDomains: uniqueStrings2(normalized.citedDomains),
               groundingSources: normalized.groundingSources,
-              searchQueries: uniqueStrings(normalized.searchQueries),
+              searchQueries: uniqueStrings2(normalized.searchQueries),
               answerText: normalized.answerText,
               error: null
             };
@@ -13143,14 +15889,14 @@ var SnapshotService = class {
             mentioned: assessment.mentioned,
             describedAccurately: assessment.describedAccurately,
             accuracyNotes: assessment.accuracyNotes ?? null,
-            incorrectClaims: uniqueStrings(assessment.incorrectClaims ?? []).slice(0, 5),
+            incorrectClaims: uniqueStrings2(assessment.incorrectClaims ?? []).slice(0, 5),
             ...hasReviewedCompetitors ? {
-              recommendedCompetitors: uniqueStrings(assessment.recommendedCompetitors ?? []).slice(0, 10)
+              recommendedCompetitors: uniqueStrings2(assessment.recommendedCompetitors ?? []).slice(0, 10)
             } : {}
           };
         }),
-        whatThisMeans: uniqueStrings(parsed.whatThisMeans ?? []).slice(0, 4),
-        recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
+        whatThisMeans: uniqueStrings2(parsed.whatThisMeans ?? []).slice(0, 4),
+        recommendedActions: uniqueStrings2(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
       log19.warn("response.analysis-failed", {
@@ -13245,13 +15991,13 @@ function applyBatchAssessment(queryResults, batchAssessment) {
         };
       }
       const reviewedCompetitors = assessment.recommendedCompetitors;
-      const recommendedCompetitors = reviewedCompetitors !== void 0 ? uniqueStrings(reviewedCompetitors) : result.recommendedCompetitors;
+      const recommendedCompetitors = reviewedCompetitors !== void 0 ? uniqueStrings2(reviewedCompetitors) : result.recommendedCompetitors;
       return {
         ...result,
         mentioned: result.mentioned || assessment.mentioned === true,
         describedAccurately: assessment.describedAccurately ?? (result.mentioned ? "unknown" : "not-mentioned"),
         accuracyNotes: assessment.accuracyNotes ?? result.accuracyNotes ?? null,
-        incorrectClaims: uniqueStrings([
+        incorrectClaims: uniqueStrings2([
           ...result.incorrectClaims,
           ...assessment.incorrectClaims ?? []
         ]),
@@ -13281,7 +16027,7 @@ function buildSnapshotSummary(companyName, queries2, providers, queryResults, au
   const whatThisMeans = batchAssessment.whatThisMeans.length > 0 ? batchAssessment.whatThisMeans : [
     defaultMeaning
   ];
-  const combinedWhatThisMeans = uniqueStrings([...whatThisMeans, ...failureNote]).slice(0, 5);
+  const combinedWhatThisMeans = uniqueStrings2([...whatThisMeans, ...failureNote]).slice(0, 5);
   const recommendedActions = batchAssessment.recommendedActions.length > 0 ? batchAssessment.recommendedActions : buildFallbackRecommendedActions(audit);
   return {
     totalQueries: queries2.length,
@@ -13324,7 +16070,7 @@ function buildFallbackRecommendedActions(audit) {
     "Add machine-readable trust signals such as schema, FAQs, and llms.txt support.",
     "Build comparison and proof content that makes the category fit unmistakable."
   ];
-  return uniqueStrings([...weakestFactors, ...defaults]).slice(0, 4);
+  return uniqueStrings2([...weakestFactors, ...defaults]).slice(0, 4);
 }
 function citesTargetDomain(citedDomains, groundingSources, targetDomain) {
   for (const domain of citedDomains) {
@@ -13389,11 +16135,11 @@ function parseJsonObject(input) {
 }
 function normalizeStringList(values) {
   const items = values.flatMap((value) => value.split(","));
-  return uniqueStrings(
+  return uniqueStrings2(
     items.map((value) => value.trim()).filter(Boolean)
   );
 }
-function uniqueStrings(values) {
+function uniqueStrings2(values) {
   if (!Array.isArray(values)) return [];
   return [...new Set(
     values.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean)
@@ -13528,6 +16274,253 @@ function finalizeResearchRun(db, runId, fatalError) {
   }).where(eq23(researchRuns.id, runId)).run();
 }
 
+// src/google-marketing-sync.ts
+import { and as and18, eq as eq24, isNull as isNull3 } from "drizzle-orm";
+function safeErrorMessage(error) {
+  const raw = describeError(error);
+  return raw.replace(/(["']?authorization["']?\s*[:=]\s*["']?bearer\s+)[^\s,"'}]+/gi, "$1[redacted]").replace(/(["']?(?:developer|access|refresh|client)[_-]?(?:token|secret)["']?\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1[redacted]").replace(/[\r\n\t]+/g, " ").slice(0, 1e3);
+}
+function googleAdsSnapshotValues(snapshot) {
+  return {
+    ...snapshot.metadata,
+    payload: snapshot.payload
+  };
+}
+function gtmSnapshotValues(snapshot) {
+  return {
+    ...snapshot.metadata,
+    payload: snapshot.payload
+  };
+}
+function assertSnapshotContext(metadata, expected) {
+  if (metadata.projectId !== expected.projectId || metadata.connectionId !== expected.connectionId || metadata.runId !== expected.runId) {
+    throw new Error("Google Marketing runtime returned snapshot metadata for a different run context.");
+  }
+}
+function requireSyncRun(db, runId, projectId, kind) {
+  const run = db.select().from(runs).where(and18(
+    eq24(runs.id, runId),
+    eq24(runs.projectId, projectId),
+    eq24(runs.kind, kind)
+  )).get();
+  if (!run) throw new Error(`Run ${runId} is not a ${kind} run for this project.`);
+  if (run.status !== RunStatuses.queued) {
+    throw new Error(`Run ${runId} is ${run.status}; only queued Google Marketing runs can start.`);
+  }
+  return run;
+}
+function markFailed(db, runId, projectId, kind, expectedStatus, error) {
+  db.update(runs).set({
+    status: RunStatuses.failed,
+    error: serializeRunError({ message: safeErrorMessage(error) }),
+    finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+  }).where(and18(
+    eq24(runs.id, runId),
+    eq24(runs.projectId, projectId),
+    eq24(runs.kind, kind),
+    eq24(runs.status, expectedStatus)
+  )).run();
+}
+function claimSyncRun(db, runId, projectId, kind, startedAt) {
+  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and18(
+    eq24(runs.id, runId),
+    eq24(runs.projectId, projectId),
+    eq24(runs.kind, kind),
+    eq24(runs.status, RunStatuses.queued)
+  )).run();
+  return claim.changes === 1;
+}
+async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
+  let claimed = false;
+  try {
+    requireSyncRun(db, runId, projectId, RunKinds["google-ads-sync"]);
+    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    if (!project) throw new Error(`Project ${projectId} was not found.`);
+    const connection = db.select().from(googleAdsConnections).where(eq24(googleAdsConnections.projectId, projectId)).get();
+    if (!connection?.selectedCustomerId) {
+      throw new Error("Google Ads needs a selected customer before it can sync.");
+    }
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (!claimSyncRun(db, runId, projectId, RunKinds["google-ads-sync"], startedAt)) {
+      throw new Error(`Run ${runId} could not be claimed for Google Ads sync.`);
+    }
+    claimed = true;
+    const result = await runtime.syncGoogleAds({
+      project: { id: project.id, name: project.name },
+      connectionId: connection.id,
+      runId,
+      selection: {
+        customerId: connection.selectedCustomerId,
+        loginCustomerId: connection.selectedLoginCustomerId,
+        selectedAt: connection.lastValidatedAt
+      }
+    });
+    const expected = { projectId, connectionId: connection.id, runId };
+    assertSnapshotContext(result.accessibleCustomers.metadata, expected);
+    assertSnapshotContext(result.inventory.metadata, expected);
+    if (result.metrics) assertSnapshotContext(result.metrics.metadata, expected);
+    if (result.accessibleCustomers.payload.kind !== GoogleAdsSnapshotKinds["accessible-customers"]) {
+      throw new Error("Google Marketing runtime returned the wrong customer snapshot kind.");
+    }
+    if (result.inventory.payload.kind !== GoogleAdsSnapshotKinds.inventory) {
+      throw new Error("Google Marketing runtime returned the wrong inventory snapshot kind.");
+    }
+    if (result.metrics && result.metrics.payload.kind !== GoogleAdsSnapshotKinds["campaign-metrics"]) {
+      throw new Error("Google Marketing runtime returned the wrong metrics snapshot kind.");
+    }
+    if (result.accessibleCustomers.metadata.customerId !== connection.selectedCustomerId || result.inventory.metadata.customerId !== connection.selectedCustomerId || result.inventory.payload.data.customerId !== connection.selectedCustomerId || result.metrics && result.metrics.metadata.customerId !== connection.selectedCustomerId) {
+      throw new Error("Google Ads returned evidence for a different customer.");
+    }
+    const observedSelection = result.accessibleCustomers.payload.data.selection;
+    if (observedSelection.customerId !== connection.selectedCustomerId || observedSelection.loginCustomerId !== connection.selectedLoginCustomerId) {
+      throw new Error("Google Ads returned evidence for a different customer selection.");
+    }
+    const selectedCustomer = result.accessibleCustomers.payload.data.customers.find(
+      (customer) => customer.customerId === connection.selectedCustomerId
+    );
+    if (!selectedCustomer) {
+      throw new Error("Google Ads did not return the selected customer in its validated snapshot.");
+    }
+    const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    db.transaction((tx) => {
+      const terminalClaim = tx.update(runs).set({
+        status: RunStatuses.completed,
+        finishedAt,
+        error: null
+      }).where(and18(
+        eq24(runs.id, runId),
+        eq24(runs.projectId, projectId),
+        eq24(runs.kind, RunKinds["google-ads-sync"]),
+        eq24(runs.status, RunStatuses.running)
+      )).run();
+      if (terminalClaim.changes !== 1) {
+        throw new Error(`Run ${runId} was no longer running when Google Ads evidence was ready.`);
+      }
+      const connectionClaim = tx.update(googleAdsConnections).set({
+        selectedCustomerName: selectedCustomer.descriptiveName,
+        selectedCustomerCurrencyCode: selectedCustomer.currencyCode,
+        selectedCustomerTimeZone: selectedCustomer.timeZone,
+        selectedCustomerStatus: selectedCustomer.status,
+        lastValidatedAt: result.accessibleCustomers.metadata.capturedAt,
+        lastCustomerSnapshotId: result.accessibleCustomers.metadata.id,
+        lastInventorySnapshotAt: result.inventory.metadata.capturedAt,
+        lastInventorySnapshotId: result.inventory.metadata.id,
+        lastMetricsSnapshotAt: result.metrics?.metadata.capturedAt ?? connection.lastMetricsSnapshotAt,
+        lastMetricsSnapshotId: result.metrics?.metadata.id ?? connection.lastMetricsSnapshotId,
+        updatedAt: finishedAt
+      }).where(and18(
+        eq24(googleAdsConnections.id, connection.id),
+        eq24(googleAdsConnections.projectId, projectId),
+        eq24(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
+        connection.selectedLoginCustomerId === null ? isNull3(googleAdsConnections.selectedLoginCustomerId) : eq24(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
+        eq24(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
+      )).run();
+      if (connectionClaim.changes !== 1) {
+        throw new Error("Google Ads selection changed while its evidence was being collected.");
+      }
+      tx.insert(googleAdsRawSnapshots).values([
+        googleAdsSnapshotValues(result.accessibleCustomers),
+        googleAdsSnapshotValues(result.inventory),
+        ...result.metrics ? [googleAdsSnapshotValues(result.metrics)] : []
+      ]).run();
+    });
+  } catch (error) {
+    markFailed(
+      db,
+      runId,
+      projectId,
+      RunKinds["google-ads-sync"],
+      claimed ? RunStatuses.running : RunStatuses.queued,
+      error
+    );
+    throw error;
+  }
+}
+async function executeGtmMarketingSync(db, runtime, runId, projectId) {
+  let claimed = false;
+  try {
+    requireSyncRun(db, runId, projectId, RunKinds["gtm-sync"]);
+    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    if (!project) throw new Error(`Project ${projectId} was not found.`);
+    const connection = db.select().from(gtmConnections).where(eq24(gtmConnections.projectId, projectId)).get();
+    if (!connection?.selectedAccountId || !connection.selectedContainerId) {
+      throw new Error("GTM needs a selected account and container before it can sync.");
+    }
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (!claimSyncRun(db, runId, projectId, RunKinds["gtm-sync"], startedAt)) {
+      throw new Error(`Run ${runId} could not be claimed for GTM sync.`);
+    }
+    claimed = true;
+    const snapshot = await runtime.syncGtm({
+      project: { id: project.id, name: project.name },
+      connectionId: connection.id,
+      runId,
+      selection: {
+        accountId: connection.selectedAccountId,
+        containerId: connection.selectedContainerId,
+        workspaceId: connection.selectedWorkspaceId
+      },
+      expectedHostname: hostOf(project.canonicalDomain) ?? project.canonicalDomain
+    });
+    assertSnapshotContext(snapshot.metadata, { projectId, connectionId: connection.id, runId });
+    if (snapshot.payload.kind !== "container") {
+      throw new Error("Google Marketing runtime returned the wrong GTM snapshot kind.");
+    }
+    const graph = snapshot.payload.data;
+    if (snapshot.metadata.accountId !== connection.selectedAccountId || snapshot.metadata.containerId !== connection.selectedContainerId || snapshot.metadata.workspaceId !== connection.selectedWorkspaceId) {
+      throw new Error("GTM returned evidence for a different account, container, or workspace.");
+    }
+    const selectedWorkspace = connection.selectedWorkspaceId ? graph.workspaces.find((workspace) => workspace.id === connection.selectedWorkspaceId) : null;
+    const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    db.transaction((tx) => {
+      const terminalClaim = tx.update(runs).set({
+        status: RunStatuses.completed,
+        finishedAt,
+        error: null
+      }).where(and18(
+        eq24(runs.id, runId),
+        eq24(runs.projectId, projectId),
+        eq24(runs.kind, RunKinds["gtm-sync"]),
+        eq24(runs.status, RunStatuses.running)
+      )).run();
+      if (terminalClaim.changes !== 1) {
+        throw new Error(`Run ${runId} was no longer running when GTM evidence was ready.`);
+      }
+      const connectionClaim = tx.update(gtmConnections).set({
+        selectedAccountName: graph.account.name,
+        selectedContainerName: graph.container.name,
+        selectedContainerPublicId: graph.container.publicId,
+        selectedWorkspaceName: selectedWorkspace?.name ?? null,
+        lastValidatedAt: snapshot.metadata.capturedAt,
+        lastSnapshotAt: snapshot.metadata.capturedAt,
+        lastSnapshotId: snapshot.metadata.id,
+        updatedAt: finishedAt
+      }).where(and18(
+        eq24(gtmConnections.id, connection.id),
+        eq24(gtmConnections.projectId, projectId),
+        eq24(gtmConnections.selectedAccountId, connection.selectedAccountId),
+        eq24(gtmConnections.selectedContainerId, connection.selectedContainerId),
+        connection.selectedWorkspaceId === null ? isNull3(gtmConnections.selectedWorkspaceId) : eq24(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
+        eq24(gtmConnections.selectionGeneration, connection.selectionGeneration)
+      )).run();
+      if (connectionClaim.changes !== 1) {
+        throw new Error("GTM selection changed while its evidence was being collected.");
+      }
+      tx.insert(gtmRawSnapshots).values(gtmSnapshotValues(snapshot)).run();
+    });
+  } catch (error) {
+    markFailed(
+      db,
+      runId,
+      projectId,
+      RunKinds["gtm-sync"],
+      claimed ? RunStatuses.running : RunStatuses.queued,
+      error
+    );
+    throw error;
+  }
+}
+
 // src/server.ts
 var _require3 = createRequire4(import.meta.url);
 var { version: PKG_VERSION2 } = _require3("../package.json");
@@ -13595,14 +16588,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey(key) {
-  return crypto24.createHash("sha256").update(key).digest("hex");
+  return crypto26.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto24.randomBytes(16);
-  const derived = crypto24.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto26.randomBytes(16);
+  const derived = crypto26.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -13623,14 +16616,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto24.scryptSync(password, salt, expected.length, {
+    const derived = crypto26.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto24.timingSafeEqual(derived, expected),
+      ok: crypto26.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -13639,7 +16632,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto24.timingSafeEqual(candidate, expected);
+    const ok = crypto26.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -13748,6 +16741,126 @@ function resolveGooglePublicUrl(config, basePath) {
     return void 0;
   }
 }
+function cloneGoogleAdsConfig(config) {
+  if (!config) return void 0;
+  return {
+    ...config,
+    ...config.connections === void 0 ? {} : {
+      connections: config.connections.map((connection) => ({
+        ...connection,
+        ...connection.scopes === void 0 ? {} : { scopes: [...connection.scopes] }
+      }))
+    }
+  };
+}
+function cloneGtmConfig(config) {
+  if (!config) return void 0;
+  return {
+    ...config,
+    ...config.connections === void 0 ? {} : {
+      connections: config.connections.map((connection) => ({
+        ...connection,
+        ...connection.scopes === void 0 ? {} : { scopes: [...connection.scopes] }
+      }))
+    }
+  };
+}
+function createGoogleMarketingConfigCredentialStore(input) {
+  const persistConfigPatch = input.saveConfigPatch ?? saveConfigPatch;
+  const env = input.env ?? process.env;
+  const randomUUID = input.randomUUID ?? crypto26.randomUUID;
+  const snapshot = () => ({
+    googleAds: cloneGoogleAdsConfig(input.config.googleAds),
+    gtm: cloneGtmConfig(input.config.gtm)
+  });
+  const restore = (previous) => {
+    input.config.googleAds = previous.googleAds;
+    input.config.gtm = previous.gtm;
+  };
+  return {
+    hasGoogleAdsDeveloperToken: () => Boolean(
+      env.GOOGLE_ADS_DEVELOPER_TOKEN?.trim() || getGoogleAdsAuthConfig(input.config).developerToken?.trim()
+    ),
+    get: (project, provider) => {
+      if (provider === GoogleMarketingProviders["google-ads"]) {
+        const connection2 = getGoogleAdsConnection(input.config, project.id);
+        if (!connection2) return void 0;
+        return {
+          accessToken: connection2.accessToken ?? null,
+          refreshToken: connection2.refreshToken ?? null,
+          expiresAt: connection2.tokenExpiresAt ?? null,
+          scopes: connection2.scopes ?? [],
+          developerToken: getGoogleAdsAuthConfig(input.config).developerToken ?? null,
+          createdAt: connection2.createdAt,
+          updatedAt: connection2.updatedAt
+        };
+      }
+      const connection = getGtmConnection(input.config, project.id);
+      if (!connection) return void 0;
+      return {
+        accessToken: connection.accessToken ?? null,
+        refreshToken: connection.refreshToken ?? null,
+        expiresAt: connection.tokenExpiresAt ?? null,
+        scopes: connection.scopes ?? [],
+        createdAt: connection.createdAt,
+        updatedAt: connection.updatedAt
+      };
+    },
+    upsert: (project, provider, credential) => {
+      const previous = snapshot();
+      try {
+        if (provider === GoogleMarketingProviders["google-ads"]) {
+          if (credential.developerToken) {
+            setGoogleAdsAuthConfig(input.config, { developerToken: credential.developerToken });
+          }
+          upsertGoogleAdsConnection(input.config, {
+            projectId: project.id,
+            projectName: project.name,
+            credentialGeneration: randomUUID(),
+            ...credential.accessToken ? { accessToken: credential.accessToken } : {},
+            refreshToken: credential.refreshToken ?? null,
+            tokenExpiresAt: credential.expiresAt ?? null,
+            scopes: credential.scopes,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt
+          });
+        } else {
+          upsertGtmConnection(input.config, {
+            projectId: project.id,
+            projectName: project.name,
+            credentialGeneration: randomUUID(),
+            ...credential.accessToken ? { accessToken: credential.accessToken } : {},
+            refreshToken: credential.refreshToken ?? null,
+            tokenExpiresAt: credential.expiresAt ?? null,
+            scopes: credential.scopes,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt
+          });
+        }
+        persistConfigPatch(input.config);
+      } catch (error) {
+        restore(previous);
+        throw error;
+      }
+      return () => {
+        restore(previous);
+        persistConfigPatch(input.config);
+      };
+    },
+    delete: (project, provider) => {
+      const previous = snapshot();
+      const removed = provider === GoogleMarketingProviders["google-ads"] ? removeGoogleAdsConnection(input.config, project.id) : removeGtmConnection(input.config, project.id);
+      if (!removed) return false;
+      try {
+        persistConfigPatch(input.config);
+      } catch (error) {
+        restore(previous);
+        throw error;
+      }
+      return true;
+    }
+  };
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -13847,7 +16960,7 @@ async function createServer(opts) {
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
       if (!sessionRegistry) return;
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq24(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -13870,6 +16983,99 @@ async function createServer(opts) {
   );
   jobRunner.onRunCompleted = (runId, projectId) => runCoordinator.onRunCompleted(runId, projectId);
   const snapshotService = new SnapshotService(registry);
+  const liveProjectIds = new Set(
+    opts.db.select({ id: projects.id }).from(projects).all().map((project) => project.id)
+  );
+  const removedGoogleMarketingCredentials = removeLegacyGoogleAdsConnections(opts.config) + removeLegacyGtmConnections(opts.config) + removeOrphanedGoogleAdsConnections(opts.config, liveProjectIds) + removeOrphanedGtmConnections(opts.config, liveProjectIds);
+  if (removedGoogleMarketingCredentials > 0) {
+    saveConfigPatch({
+      googleAds: opts.config.googleAds,
+      gtm: opts.config.gtm
+    });
+  }
+  const googleMarketingRuntime = createGoogleMarketingRuntime({
+    config: opts.config,
+    saveConfigPatch
+  });
+  const googleMarketingCredentialStore = createGoogleMarketingConfigCredentialStore({
+    config: opts.config
+  });
+  const prepareGoogleMarketingCredentialDelete = (projectId) => {
+    const previousGoogleAdsConnections = opts.config.googleAds?.connections;
+    const previousGtmConnections = opts.config.gtm?.connections;
+    const restore = () => {
+      if (opts.config.googleAds) opts.config.googleAds.connections = previousGoogleAdsConnections;
+      if (opts.config.gtm) opts.config.gtm.connections = previousGtmConnections;
+    };
+    const removedGoogleAds = removeGoogleAdsConnection(opts.config, projectId);
+    const removedGtm = removeGtmConnection(opts.config, projectId);
+    if (!removedGoogleAds && !removedGtm) return void 0;
+    try {
+      saveConfigPatch({
+        googleAds: opts.config.googleAds,
+        gtm: opts.config.gtm
+      });
+    } catch (error) {
+      restore();
+      throw error;
+    }
+    return () => {
+      restore();
+      try {
+        saveConfigPatch({
+          googleAds: opts.config.googleAds,
+          gtm: opts.config.gtm
+        });
+      } catch (error) {
+        removeGoogleAdsConnection(opts.config, projectId);
+        removeGtmConnection(opts.config, projectId);
+        throw error;
+      }
+    };
+  };
+  const googleMarketingOAuth = {
+    authorizationUrl: (input) => {
+      const auth = input.provider === GoogleMarketingProviders["google-ads"] ? getGoogleAdsAuthConfig(opts.config) : getGtmAuthConfig(opts.config);
+      if (!auth.clientId || !auth.clientSecret) {
+        throw new Error("Google OAuth client credentials are not configured.");
+      }
+      return getAuthUrl(auth.clientId, input.redirectUri, [...input.scopes], input.state);
+    },
+    exchangeCode: async (input) => {
+      const auth = input.provider === GoogleMarketingProviders["google-ads"] ? getGoogleAdsAuthConfig(opts.config) : getGtmAuthConfig(opts.config);
+      if (!auth.clientId || !auth.clientSecret) {
+        throw new Error("Google OAuth client credentials are not configured.");
+      }
+      const tokens = await exchangeCode(
+        auth.clientId,
+        auth.clientSecret,
+        input.code,
+        input.redirectUri
+      );
+      return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token ?? null,
+        expiresAt: Number.isFinite(tokens.expires_in) && tokens.expires_in > 0 ? new Date(Date.now() + tokens.expires_in * 1e3).toISOString() : null,
+        scopes: tokens.scope?.split(/\s+/).filter(Boolean) ?? [input.provider === GoogleMarketingProviders["google-ads"] ? GOOGLE_ADS_OAUTH_SCOPE : GTM_READONLY_SCOPE]
+      };
+    }
+  };
+  const googleMarketingLiveReader = {
+    listGoogleAdsCustomers: (project) => googleMarketingRuntime.listGoogleAdsCustomers(project),
+    listGtmAccounts: (project) => googleMarketingRuntime.listGtmAccounts(project),
+    listGtmContainers: (project, accountId) => googleMarketingRuntime.listGtmContainers(project, accountId),
+    listGtmWorkspaces: (project, accountId, containerId) => googleMarketingRuntime.listGtmWorkspaces(project, accountId, containerId)
+  };
+  const runGoogleAdsMarketingSync = (runId, projectId) => {
+    executeGoogleAdsMarketingSync(opts.db, googleMarketingRuntime, runId, projectId).then(() => runCoordinator.onRunCompleted(runId, projectId)).catch(() => {
+      app.log.error({ runId, projectId }, "Google Ads sync failed");
+    });
+  };
+  const runGtmMarketingSync = (runId, projectId) => {
+    executeGtmMarketingSync(opts.db, googleMarketingRuntime, runId, projectId).then(() => runCoordinator.onRunCompleted(runId, projectId)).catch(() => {
+      app.log.error({ runId, projectId }, "GTM sync failed");
+    });
+  };
   const orphanedOpenClawDir = path8.join(os4.homedir(), ".openclaw-aero");
   if (fs7.existsSync(orphanedOpenClawDir)) {
     app.log.warn(
@@ -14197,7 +17403,7 @@ async function createServer(opts) {
       void (async () => {
         try {
           const report = await aeroClient.runDoctor({ project: projectName });
-          const project = opts.db.select().from(projects).where(eq24(projects.name, projectName)).get();
+          const project = opts.db.select().from(projects).where(eq25(projects.name, projectName)).get();
           if (!project) {
             app.log.warn({ projectName }, "doctor schedule fired for an unknown project");
             return;
@@ -14225,9 +17431,9 @@ async function createServer(opts) {
         });
         if (!probed) return;
         const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(
-          and18(
-            eq24(ccReleaseSyncs.release, probed.release),
-            eq24(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+          and19(
+            eq25(ccReleaseSyncs.release, probed.release),
+            eq25(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
           )
         ).limit(1).get();
         if (alreadySynced) {
@@ -14408,7 +17614,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto24.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto26.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -14484,11 +17690,11 @@ async function createServer(opts) {
   const googlePublicUrl = resolveGooglePublicUrl(opts.config, basePath);
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto24.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto26.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -14512,7 +17718,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto24.randomBytes(32).toString("hex");
+    const sessionId = crypto26.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -14536,7 +17742,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -14560,7 +17766,7 @@ async function createServer(opts) {
     if (!header) return false;
     const parts = header.split(" ");
     if (parts.length !== 2 || parts[0] !== "Bearer") return false;
-    const key = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(parts[1]))).get();
+    const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(parts[1]))).get();
     return Boolean(key && !key.revokedAt);
   };
   const namedAccountsInUse = () => anyUsersExist(opts.db);
@@ -14650,12 +17856,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq24(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header(
         "set-cookie",
@@ -14797,9 +18003,61 @@ async function createServer(opts) {
     // Resolved fresh each call so a key added at runtime (settings API) shows
     // up immediately in the `config.agent-providers` doctor check.
     getAgentProviderSummary: () => buildAgentProvidersResponse(opts.config).providers,
+    getGoogleMarketingDoctorInput: (ctx) => {
+      if (!ctx.project) return null;
+      const googleAds = opts.db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, ctx.project.id)).get();
+      const gtm = opts.db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, ctx.project.id)).get();
+      const googleAdsCredential = getGoogleAdsConnection(opts.config, ctx.project.id);
+      const gtmCredential = getGtmConnection(opts.config, ctx.project.id);
+      const googleAdsConnected = Boolean(googleAdsCredential?.accessToken);
+      const gtmConnected = Boolean(gtmCredential?.accessToken);
+      return {
+        googleAds: googleAds && googleAdsConnected ? {
+          credentialsPresent: Boolean(
+            googleAdsCredential?.accessToken || googleAdsCredential?.refreshToken
+          ),
+          grantedScopes: googleAds.scopes,
+          selectedLoginCustomerId: googleAds.selectedLoginCustomerId,
+          selectedCustomerId: googleAds.selectedCustomerId,
+          latestSnapshotAt: [
+            googleAds.lastInventorySnapshotAt,
+            googleAds.lastMetricsSnapshotAt
+          ].filter((value) => Boolean(value)).sort().at(-1) ?? null
+        } : null,
+        gtm: gtm && gtmConnected ? {
+          credentialsPresent: Boolean(gtmCredential?.accessToken || gtmCredential?.refreshToken),
+          grantedScopes: gtm.scopes,
+          selectedAccountId: gtm.selectedAccountId,
+          selectedContainerId: gtm.selectedContainerId,
+          selectedWorkspaceId: gtm.selectedWorkspaceId,
+          latestSnapshotAt: gtm.lastSnapshotAt
+        } : null
+      };
+    },
     googleConnectionStore,
     googleStateSecret,
     publicUrl: googlePublicUrl,
+    googleMarketingCredentialStore,
+    googleMarketingOAuth,
+    googleMarketingOAuthScopes: {
+      [GoogleMarketingProviders["google-ads"]]: [GOOGLE_ADS_OAUTH_SCOPE],
+      [GoogleMarketingProviders.gtm]: [GTM_READONLY_SCOPE]
+    },
+    googleMarketingLiveReader,
+    assessConversionTrackingIntegrity: ({ contract, googleAdsSnapshot, gtmSnapshot }) => {
+      const googleAdsInventory = googleAdsSnapshot?.payload.kind === "inventory" ? googleAdsSnapshot.payload.data : null;
+      const gtmLiveGraph = gtmSnapshot?.payload.kind === "container" ? gtmSnapshot.payload.data.live : gtmSnapshot?.payload.kind === "live" ? gtmSnapshot.payload.data : null;
+      return assessConversionTrackingIntegrity({
+        contract,
+        googleAdsInventory,
+        googleAdsEvidenceId: googleAdsSnapshot?.metadata.id,
+        gtmLiveGraph,
+        gtmEvidenceId: gtmSnapshot?.metadata.id,
+        evaluatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    },
+    onGoogleAdsSyncRequested: runGoogleAdsMarketingSync,
+    onGtmSyncRequested: runGtmMarketingSync,
     onGscSyncRequested: (runId, projectId, syncOpts) => {
       const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
       if (!googleClientId || !googleClientSecret) {
@@ -14872,7 +18130,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto24.randomUUID();
+            const runId = crypto26.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -14997,7 +18255,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq24(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq25(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(
             opts.db,
@@ -15107,7 +18365,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto24.randomUUID(),
+            id: crypto26.randomUUID(),
             projectId,
             actor: "api",
             action: existing ? "provider.updated" : "provider.created",
@@ -15152,8 +18410,17 @@ async function createServer(opts) {
       if (action === "upsert") scheduler.upsert(projectId, kind);
       if (action === "delete") scheduler.remove(projectId, kind);
     },
+    onProjectDeleting: prepareGoogleMarketingCredentialDelete,
     onProjectDeleted: (projectId) => {
       scheduler.removeAllForProject(projectId);
+      const removedGoogleAds = removeGoogleAdsConnection(opts.config, projectId);
+      const removedGtm = removeGtmConnection(opts.config, projectId);
+      if (removedGoogleAds || removedGtm) {
+        saveConfigPatch({
+          googleAds: opts.config.googleAds,
+          gtm: opts.config.gtm
+        });
+      }
     },
     onAliasesChanged: (projectId, projectName) => {
       setImmediate(() => {
@@ -15378,7 +18645,7 @@ async function createServer(opts) {
   }
   checkLatestVersionForServer();
   scheduler.start();
-  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq24(researchRuns.status, ResearchRunStatuses.queued)).all()) {
+  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq25(researchRuns.status, ResearchRunStatuses.queued)).all()) {
     dispatchResearchRun(run.id, run.projectId);
   }
   app.addHook("onClose", async () => {
@@ -15469,5 +18736,8 @@ export {
   coerceAgentProvider,
   AERO_TOOL_PROFILES,
   isAeroToolProfile,
+  GoogleMarketingRuntimeError,
+  createGoogleMarketingCredentialStore,
+  createGoogleMarketingRuntime,
   createServer
 };