@canonry/canonry 4.170.0 → 4.171.0

package/dist/{chunk-NMCLLN5X.js → chunk-5KGN224W.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-BMW3AURU.js";
+} from "./chunk-IIFDS3K2.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -145,7 +145,7 @@ import {
   siteCrawlSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-CCZNCH7Y.js";
+} from "./chunk-O226BLC7.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -11829,7 +11829,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-64IPZ4NU.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-KT6K4ODY.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -18003,6 +18003,37 @@ async function createServer(opts) {
     // Resolved fresh each call so a key added at runtime (settings API) shows
     // up immediately in the `config.agent-providers` doctor check.
     getAgentProviderSummary: () => buildAgentProvidersResponse(opts.config).providers,
+    getGoogleMarketingDoctorInput: (ctx) => {
+      if (!ctx.project) return null;
+      const googleAds = opts.db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, ctx.project.id)).get();
+      const gtm = opts.db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, ctx.project.id)).get();
+      const googleAdsCredential = getGoogleAdsConnection(opts.config, ctx.project.id);
+      const gtmCredential = getGtmConnection(opts.config, ctx.project.id);
+      const googleAdsConnected = Boolean(googleAdsCredential?.accessToken);
+      const gtmConnected = Boolean(gtmCredential?.accessToken);
+      return {
+        googleAds: googleAds && googleAdsConnected ? {
+          credentialsPresent: Boolean(
+            googleAdsCredential?.accessToken || googleAdsCredential?.refreshToken
+          ),
+          grantedScopes: googleAds.scopes,
+          selectedLoginCustomerId: googleAds.selectedLoginCustomerId,
+          selectedCustomerId: googleAds.selectedCustomerId,
+          latestSnapshotAt: [
+            googleAds.lastInventorySnapshotAt,
+            googleAds.lastMetricsSnapshotAt
+          ].filter((value) => Boolean(value)).sort().at(-1) ?? null
+        } : null,
+        gtm: gtm && gtmConnected ? {
+          credentialsPresent: Boolean(gtmCredential?.accessToken || gtmCredential?.refreshToken),
+          grantedScopes: gtm.scopes,
+          selectedAccountId: gtm.selectedAccountId,
+          selectedContainerId: gtm.selectedContainerId,
+          selectedWorkspaceId: gtm.selectedWorkspaceId,
+          latestSnapshotAt: gtm.lastSnapshotAt
+        } : null
+      };
+    },
     googleConnectionStore,
     googleStateSecret,
     publicUrl: googlePublicUrl,

package/dist/{chunk-BMW3AURU.js → chunk-IIFDS3K2.js}

@@ -4,6 +4,7 @@ import {
   CodingAgents,
   DISCOVERY_MAX_PROBES_CAP,
   DISCOVERY_PROBE_CONCURRENCY_CAP,
+  GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX,
   SKILL_MANIFEST_FILENAME,
   SkillsClients,
   adsActivateTreeRequestSchema,
@@ -19,6 +20,8 @@ import {
   adsPauseRequestSchema,
   adsUnresolvedOperationListQuerySchema,
   backlinkSourceSchema,
+  canonicalizeGtmAccountId,
+  canonicalizeGtmResourceSelection,
   classifySkillFile,
   coerceSkillManifest,
   competitorBatchRequestSchema,
@@ -9350,6 +9353,54 @@ var adsAdPauseInputSchema = z3.object({
   adId: z3.string().min(1),
   request: adsPauseRequestSchema
 });
+var googleMarketingSnapshotPageInputSchema = z3.object({
+  project: projectNameSchema,
+  limit: z3.number().int().min(1).max(GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX).optional(),
+  cursor: z3.string().trim().min(1).optional()
+}).strict();
+var googleMarketingSnapshotInputSchema = z3.object({
+  project: projectNameSchema,
+  snapshotId: z3.string().trim().min(1)
+}).strict();
+var gtmAccountInputSchema = z3.object({
+  project: projectNameSchema,
+  accountId: z3.string().trim().min(1)
+}).strict().superRefine((input, context) => {
+  if (!canonicalizeGtmAccountId(input.accountId)) {
+    context.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["accountId"],
+      message: "Expected a safe GTM account ID or accounts/{id} resource path."
+    });
+  }
+});
+var gtmContainerInputSchema = z3.object({
+  project: projectNameSchema,
+  accountId: z3.string().trim().min(1),
+  containerId: z3.string().trim().min(1)
+}).strict().superRefine((input, context) => {
+  if (!canonicalizeGtmResourceSelection(input)) {
+    context.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["containerId"],
+      message: "Expected matching safe GTM account/container IDs or resource paths."
+    });
+  }
+});
+function canonicalGtmMcpAccountId(accountId) {
+  const canonical = canonicalizeGtmAccountId(accountId);
+  if (!canonical) throw new Error("Invalid GTM account input.");
+  return canonical;
+}
+function canonicalGtmMcpSelection(accountId, containerId) {
+  const canonical = canonicalizeGtmResourceSelection({ accountId, containerId });
+  if (!canonical) throw new Error("Invalid GTM account/container input.");
+  return canonical;
+}
+var conversionTrackingContractInputSchema = z3.object({
+  project: projectNameSchema,
+  contractId: z3.string().trim().min(1)
+}).strict();
 var keywordsInputSchema = z3.object({
   project: projectNameSchema,
   request: keywordBatchRequestSchema
@@ -11692,6 +11743,187 @@ var canonryMcpTools = [
       checkDeadLinks: input.checkDeadLinks
     })
   }),
+  // ----- Google Marketing: Google Ads + Google Tag Manager -----
+  // OAuth, selection, disconnect, and contract writes deliberately stay on
+  // the operator CLI/dashboard. The agent surface can only inspect bounded
+  // evidence, trigger bounded read-only syncs, and assess stored integrity.
+  defineTool({
+    name: "canonry_google_ads_status",
+    title: "Get Google Ads connection status",
+    description: "Read the project-local Google Ads connection, selected customer, and stored-evidence freshness. This never exposes credentials or changes a Google Ads account.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/status"],
+    handler: (client2, input) => client2.getGoogleAdsStatus(input.project)
+  }),
+  defineTool({
+    name: "canonry_google_ads_customers",
+    title: "List live Google Ads customers",
+    description: "Read the bounded set of Google Ads customers available to the project OAuth connection. This makes live provider GET requests and requires google-marketing.read-live; customer selection remains an explicit operator action.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/customers"],
+    handler: (client2, input) => client2.listGoogleAdsCustomers(input.project)
+  }),
+  defineTool({
+    name: "canonry_google_ads_snapshots",
+    title: "List stored Google Ads evidence",
+    description: "List a bounded page of redacted, append-only Google Ads snapshots. Stored reads are quota-free and do not call Google.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: googleMarketingSnapshotPageInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/snapshots"],
+    handler: (client2, input) => client2.listGoogleAdsSnapshots(input.project, {
+      limit: input.limit,
+      cursor: input.cursor
+    })
+  }),
+  defineTool({
+    name: "canonry_google_ads_snapshot_get",
+    title: "Get stored Google Ads evidence",
+    description: "Read one redacted Google Ads evidence snapshot by ID. It can show conversion actions and effective campaign goals, but cannot prove a browser conversion fired.",
+    access: "read",
+    tier: "google-ads",
+    inputSchema: googleMarketingSnapshotInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/google-ads/snapshots/{snapshotId}"],
+    handler: (client2, input) => client2.getGoogleAdsSnapshot(input.project, input.snapshotId)
+  }),
+  defineTool({
+    name: "canonry_google_ads_sync",
+    title: "Sync Google Ads conversion evidence",
+    description: "Queue a bounded read-only Google Ads evidence sync using GETs and SearchStream POSTs. It creates a local run and sanitized snapshots, but never changes campaigns, conversion actions, goals, bids, or budgets. Requires google-marketing.read-live and write authority.",
+    access: "write",
+    tier: "google-ads",
+    inputSchema: projectInputSchema,
+    annotations: writeAnnotations({ idempotentHint: false, openWorldHint: true }),
+    openApiOperations: ["POST /api/v1/projects/{name}/google-ads/sync"],
+    handler: (client2, input) => client2.triggerGoogleAdsSync(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_status",
+    title: "Get Google Tag Manager connection status",
+    description: "Read the project-local GTM connection, selected account/container/workspace, and stored-evidence freshness. This never exposes credentials or edits GTM.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/status"],
+    handler: (client2, input) => client2.getGtmStatus(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_accounts",
+    title: "List live GTM accounts",
+    description: "Read the bounded set of GTM accounts available to the project OAuth connection. This makes live provider GET requests and requires google-marketing.read-live; resource selection remains operator-only.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts"],
+    handler: (client2, input) => client2.listGtmAccounts(input.project)
+  }),
+  defineTool({
+    name: "canonry_gtm_containers",
+    title: "List live GTM containers",
+    description: "Read the bounded set of containers in one GTM account. This is a live GET-only provider read; it cannot edit or publish a container.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: gtmAccountInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts/{accountId}/containers"],
+    handler: (client2, input) => client2.listGtmContainers(
+      input.project,
+      canonicalGtmMcpAccountId(input.accountId)
+    )
+  }),
+  defineTool({
+    name: "canonry_gtm_workspaces",
+    title: "List live GTM workspaces",
+    description: "Read the bounded set of workspaces in one GTM container. This is a live GET-only provider read; it cannot edit a workspace or publish a version.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: gtmContainerInputSchema,
+    annotations: readAnnotations(true),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/accounts/{accountId}/containers/{containerId}/workspaces"],
+    handler: (client2, input) => {
+      const selection = canonicalGtmMcpSelection(input.accountId, input.containerId);
+      return client2.listGtmWorkspaces(input.project, selection.accountId, selection.containerId);
+    }
+  }),
+  defineTool({
+    name: "canonry_gtm_snapshots",
+    title: "List stored GTM evidence",
+    description: "List a bounded page of redacted, append-only GTM live/draft graph snapshots. Stored reads are quota-free and do not call Google.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: googleMarketingSnapshotPageInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/snapshots"],
+    handler: (client2, input) => client2.listGtmSnapshots(input.project, {
+      limit: input.limit,
+      cursor: input.cursor
+    })
+  }),
+  defineTool({
+    name: "canonry_gtm_snapshot_get",
+    title: "Get stored GTM evidence",
+    description: "Read one redacted GTM live/draft graph snapshot by ID. It can prove static tag and trigger configuration only; it cannot prove a browser event fired.",
+    access: "read",
+    tier: "gtm",
+    inputSchema: googleMarketingSnapshotInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/gtm/snapshots/{snapshotId}"],
+    handler: (client2, input) => client2.getGtmSnapshot(input.project, input.snapshotId)
+  }),
+  defineTool({
+    name: "canonry_gtm_sync",
+    title: "Sync GTM conversion evidence",
+    description: "Queue a bounded GTM GET-only evidence sync. It creates a local run and sanitized live/draft snapshots, but never edits a workspace or publishes a container version. Requires google-marketing.read-live and write authority.",
+    access: "write",
+    tier: "gtm",
+    inputSchema: projectInputSchema,
+    annotations: writeAnnotations({ idempotentHint: false, openWorldHint: true }),
+    openApiOperations: ["POST /api/v1/projects/{name}/gtm/sync"],
+    handler: (client2, input) => client2.triggerGtmSync(input.project)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_contracts",
+    title: "List conversion-tracking contracts",
+    description: "List the project\u2019s declared business contracts linking an application event to Google Ads and GTM identifiers. Contract creation and changes remain operator-only.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: projectInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts"],
+    handler: (client2, input) => client2.listConversionTrackingContracts(input.project)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_contract_get",
+    title: "Get conversion-tracking contract",
+    description: "Read one declared conversion-tracking contract. It declares intended semantics; use integrity assessment to evaluate stored evidence.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: conversionTrackingContractInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts/{contractId}"],
+    handler: (client2, input) => client2.getConversionTrackingContract(input.project, input.contractId)
+  }),
+  defineTool({
+    name: "canonry_conversion_tracking_integrity",
+    title: "Assess stored conversion integrity",
+    description: "Evaluate a declared contract against stored redacted Google Ads and GTM evidence. This does not call providers and cannot treat static configuration as proof of a browser event or observed Google Ads conversion.",
+    access: "read",
+    tier: "conversion-tracking",
+    inputSchema: conversionTrackingContractInputSchema,
+    annotations: readAnnotations(),
+    openApiOperations: ["GET /api/v1/projects/{name}/conversion-tracking/contracts/{contractId}/integrity"],
+    handler: (client2, input) => client2.getConversionTrackingIntegrity(input.project, input.contractId)
+  }),
   // ----- OpenAI ads (ChatGPT ads) -----
   defineTool({
     name: "canonry_ads_status",

package/dist/{chunk-CCZNCH7Y.js → chunk-O226BLC7.js}

@@ -61640,6 +61640,251 @@ var WORDPRESS_PUBLISH_CHECKS = [
   }
 ];
 
+// ../api-routes/src/doctor/checks/google-marketing.ts
+var GOOGLE_ADS_REQUIRED_OAUTH_SCOPES = [
+  "https://www.googleapis.com/auth/adwords"
+];
+var GTM_REQUIRED_OAUTH_SCOPES = [
+  "https://www.googleapis.com/auth/tagmanager.readonly"
+];
+var FRESH_SNAPSHOT_WARN_DAYS = 7;
+var FRESH_SNAPSHOT_FAIL_DAYS = 30;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function unavailableStatus() {
+  return {
+    status: CheckStatuses.skipped,
+    code: "google-marketing.status-unavailable",
+    summary: "Google marketing status metadata is not configured for this deployment.",
+    remediation: null
+  };
+}
+function noProjectStatus() {
+  return {
+    status: CheckStatuses.skipped,
+    code: "google-marketing.no-project",
+    summary: "Project context required.",
+    remediation: null
+  };
+}
+function notConnectedStatus(provider, requiredScopes) {
+  return {
+    status: CheckStatuses.skipped,
+    code: provider === "Google Ads" ? "google-ads.auth.not-connected" : "gtm.auth.not-connected",
+    summary: `${provider} is not connected for this project.`,
+    remediation: null,
+    details: { requiredScopes: [...requiredScopes] }
+  };
+}
+function credentialsOutput(provider, credentialsPresent) {
+  if (credentialsPresent) {
+    return {
+      status: CheckStatuses.ok,
+      code: `${provider}.auth.credentials-metadata-present`,
+      summary: `${provider === "google-ads" ? "Google Ads" : "Google Tag Manager"} credential metadata is present.`,
+      remediation: null,
+      details: { credentialsPresent }
+    };
+  }
+  return {
+    status: CheckStatuses.fail,
+    code: `${provider}.auth.credentials-metadata-missing`,
+    summary: `${provider === "google-ads" ? "Google Ads" : "Google Tag Manager"} connection metadata exists but credentials are unavailable.`,
+    remediation: "Reconnect this Google integration to restore its credential metadata.",
+    details: { credentialsPresent }
+  };
+}
+function scopesOutput(provider, grantedScopes, requiredScopes) {
+  const granted = [...new Set(grantedScopes)];
+  const missing = requiredScopes.filter((scope) => !granted.includes(scope));
+  const label = provider === "google-ads" ? "Google Ads" : "Google Tag Manager";
+  const scopeDescription = provider === "google-ads" ? "OAuth scope" : "read-only OAuth scope";
+  if (missing.length === 0) {
+    return {
+      status: CheckStatuses.ok,
+      code: `${provider}.auth.scopes-ok`,
+      summary: `${label} has the required ${scopeDescription}.`,
+      remediation: null,
+      details: { requiredScopes: [...requiredScopes], grantedScopes: granted, missingScopes: missing }
+    };
+  }
+  return {
+    status: CheckStatuses.fail,
+    code: `${provider}.auth.required-scope-missing`,
+    summary: `${label} is missing a required ${scopeDescription}.`,
+    remediation: `Reconnect the integration and grant every required ${scopeDescription}.`,
+    details: { requiredScopes: [...requiredScopes], grantedScopes: granted, missingScopes: missing }
+  };
+}
+function snapshotOutput(provider, latestSnapshotAt, now) {
+  const label = provider === "google-ads" ? "Google Ads" : "Google Tag Manager";
+  if (!latestSnapshotAt) {
+    return {
+      status: CheckStatuses.warn,
+      code: `${provider}.data.snapshot-never-captured`,
+      summary: `${label} is connected but has no stored snapshot.`,
+      remediation: "Run a read-only snapshot sync to establish a fresh configuration record.",
+      details: { latestSnapshotAt: null }
+    };
+  }
+  const snapshotMs = Date.parse(latestSnapshotAt);
+  if (!Number.isFinite(snapshotMs)) {
+    return {
+      status: CheckStatuses.fail,
+      code: `${provider}.data.snapshot-timestamp-invalid`,
+      summary: `${label} has an invalid latest snapshot timestamp.`,
+      remediation: "Run a new snapshot sync to replace the invalid freshness metadata.",
+      details: { latestSnapshotAt }
+    };
+  }
+  const ageDays = (now.getTime() - snapshotMs) / DAY_MS;
+  const details = { latestSnapshotAt, ageDays: Math.max(0, Math.round(ageDays)) };
+  if (ageDays < 0) {
+    return {
+      status: CheckStatuses.warn,
+      code: `${provider}.data.snapshot-in-future`,
+      summary: `${label} latest snapshot timestamp is in the future.`,
+      remediation: "Check the host clock and run a new snapshot sync.",
+      details
+    };
+  }
+  if (ageDays > FRESH_SNAPSHOT_FAIL_DAYS) {
+    return {
+      status: CheckStatuses.fail,
+      code: `${provider}.data.snapshot-stale`,
+      summary: `${label} latest snapshot is ${Math.round(ageDays)} days old (> ${FRESH_SNAPSHOT_FAIL_DAYS}d).`,
+      remediation: "Run a read-only snapshot sync and verify its schedule.",
+      details
+    };
+  }
+  if (ageDays > FRESH_SNAPSHOT_WARN_DAYS) {
+    return {
+      status: CheckStatuses.warn,
+      code: `${provider}.data.snapshot-aging`,
+      summary: `${label} latest snapshot is ${Math.round(ageDays)} days old (> ${FRESH_SNAPSHOT_WARN_DAYS}d).`,
+      remediation: "Schedule a read-only snapshot sync to keep configuration evidence fresh.",
+      details
+    };
+  }
+  return {
+    status: CheckStatuses.ok,
+    code: `${provider}.data.snapshot-fresh`,
+    summary: `${label} latest snapshot is ${Math.round(ageDays)} day(s) old.`,
+    remediation: null,
+    details
+  };
+}
+function evaluateGoogleMarketingDoctor(input, now = /* @__PURE__ */ new Date()) {
+  const ads = input.googleAds;
+  const gtm = input.gtm;
+  const adsCredentials = ads ? credentialsOutput("google-ads", ads.credentialsPresent) : notConnectedStatus("Google Ads", GOOGLE_ADS_REQUIRED_OAUTH_SCOPES);
+  const adsScopes = ads ? scopesOutput("google-ads", ads.grantedScopes, GOOGLE_ADS_REQUIRED_OAUTH_SCOPES) : notConnectedStatus("Google Ads", GOOGLE_ADS_REQUIRED_OAUTH_SCOPES);
+  const adsContext = !ads ? notConnectedStatus("Google Ads", GOOGLE_ADS_REQUIRED_OAUTH_SCOPES) : !ads.selectedCustomerId ? {
+    status: CheckStatuses.fail,
+    code: "google-ads.account.customer-not-selected",
+    summary: "Google Ads has no selected customer context for this project.",
+    remediation: "Select the customer whose campaigns and conversion goals this project should read.",
+    details: {
+      loginCustomerId: ads.selectedLoginCustomerId,
+      customerId: ads.selectedCustomerId
+    }
+  } : {
+    status: CheckStatuses.ok,
+    code: "google-ads.account.context-selected",
+    summary: "Google Ads customer context is selected.",
+    remediation: null,
+    details: {
+      loginCustomerId: ads.selectedLoginCustomerId,
+      customerId: ads.selectedCustomerId
+    }
+  };
+  const adsSnapshot = ads ? snapshotOutput("google-ads", ads.latestSnapshotAt, now) : notConnectedStatus("Google Ads", GOOGLE_ADS_REQUIRED_OAUTH_SCOPES);
+  const gtmCredentials = gtm ? credentialsOutput("gtm", gtm.credentialsPresent) : notConnectedStatus("Google Tag Manager", GTM_REQUIRED_OAUTH_SCOPES);
+  const gtmScopes = gtm ? scopesOutput("gtm", gtm.grantedScopes, GTM_REQUIRED_OAUTH_SCOPES) : notConnectedStatus("Google Tag Manager", GTM_REQUIRED_OAUTH_SCOPES);
+  const gtmContext = !gtm ? notConnectedStatus("Google Tag Manager", GTM_REQUIRED_OAUTH_SCOPES) : !gtm.selectedAccountId || !gtm.selectedContainerId ? {
+    status: CheckStatuses.fail,
+    code: "gtm.container.account-or-container-not-selected",
+    summary: "GTM needs both a selected account and container for this project.",
+    remediation: "Select the GTM account and container whose configuration this project should inspect.",
+    details: {
+      accountId: gtm.selectedAccountId,
+      containerId: gtm.selectedContainerId,
+      workspaceId: gtm.selectedWorkspaceId
+    }
+  } : !gtm.selectedWorkspaceId ? {
+    status: CheckStatuses.warn,
+    code: "gtm.container.workspace-not-selected",
+    summary: "GTM account and container are selected, but no draft workspace is selected.",
+    remediation: "Select a draft workspace when this project needs workspace-level configuration evidence.",
+    details: {
+      accountId: gtm.selectedAccountId,
+      containerId: gtm.selectedContainerId,
+      workspaceId: gtm.selectedWorkspaceId
+    }
+  } : {
+    status: CheckStatuses.ok,
+    code: "gtm.container.context-selected",
+    summary: "GTM account, container, and workspace context are selected.",
+    remediation: null,
+    details: {
+      accountId: gtm.selectedAccountId,
+      containerId: gtm.selectedContainerId,
+      workspaceId: gtm.selectedWorkspaceId
+    }
+  };
+  const gtmSnapshot = gtm ? snapshotOutput("gtm", gtm.latestSnapshotAt, now) : notConnectedStatus("Google Tag Manager", GTM_REQUIRED_OAUTH_SCOPES);
+  const gtmRuntime = !gtm ? {
+    status: CheckStatuses.skipped,
+    code: "gtm.runtime.not-connected",
+    summary: "GTM is not connected, so API configuration and runtime firing cannot be assessed.",
+    remediation: null
+  } : {
+    status: CheckStatuses.skipped,
+    code: "gtm.runtime.firing-not-proven",
+    summary: "GTM API configuration does not prove that a tag fired in a real browser session.",
+    remediation: "Verify runtime firing with browser-side evidence or a trusted conversion receipt.",
+    details: { runtimeFiringProven: false }
+  };
+  return [
+    adsCredentials,
+    adsScopes,
+    adsContext,
+    adsSnapshot,
+    gtmCredentials,
+    gtmScopes,
+    gtmContext,
+    gtmSnapshot,
+    gtmRuntime
+  ];
+}
+var CHECK_METADATA = [
+  ["google-ads.auth.connection", CheckCategories.auth, "Google Ads credential metadata"],
+  ["google-ads.auth.scopes", CheckCategories.auth, "Google Ads granted scopes"],
+  ["google-ads.account.context", CheckCategories.auth, "Google Ads customer context"],
+  ["google-ads.data.recent-snapshot", CheckCategories.integrations, "Google Ads latest snapshot"],
+  ["gtm.auth.connection", CheckCategories.auth, "GTM credential metadata"],
+  ["gtm.auth.scopes", CheckCategories.auth, "GTM granted scopes"],
+  ["gtm.container.context", CheckCategories.auth, "GTM account, container, and workspace context"],
+  ["gtm.data.recent-snapshot", CheckCategories.integrations, "GTM latest snapshot"],
+  ["gtm.runtime.firing", CheckCategories.integrations, "GTM runtime firing evidence"]
+];
+function createGoogleMarketingDoctorChecks(resolveInput, now = () => /* @__PURE__ */ new Date()) {
+  return CHECK_METADATA.map(([id, category, title], index2) => ({
+    id,
+    category,
+    scope: CheckScopes.project,
+    title,
+    run: (ctx) => {
+      if (!ctx.project) return noProjectStatus();
+      const input = resolveInput(ctx);
+      if (!input) return unavailableStatus();
+      return evaluateGoogleMarketingDoctor(input, now())[index2];
+    }
+  }));
+}
+var GOOGLE_MARKETING_DOCTOR_CHECKS = createGoogleMarketingDoctorChecks(
+  (ctx) => ctx.getGoogleMarketingDoctorInput?.(ctx)
+);
+
 // ../api-routes/src/doctor/registry.ts
 var ALL_CHECKS = [
   // Runtime-state checks run first so file-system gone errors surface
@@ -61652,6 +61897,7 @@ var ALL_CHECKS = [
   ...WORDPRESS_PUBLISH_CHECKS,
   ...GA_AUTH_CHECKS,
   ...ADS_CHECKS,
+  ...GOOGLE_MARKETING_DOCTOR_CHECKS,
   ...PROVIDERS_CHECKS,
   ...TRAFFIC_SOURCE_CHECKS,
   ...BACKLINKS_CHECKS,
@@ -61748,7 +61994,8 @@ async function doctorRoutes(app, opts) {
       trafficSourceValidators: opts.trafficSourceValidators,
       runtimeStatePaths: opts.runtimeStatePaths,
       bundledSkills: opts.bundledSkills,
-      getAgentPluginState: opts.getAgentPluginState
+      getAgentPluginState: opts.getAgentPluginState,
+      getGoogleMarketingDoctorInput: opts.getGoogleMarketingDoctorInput
     };
     return runChecks(ctx, ALL_CHECKS, { checkIds });
   });
@@ -61776,7 +62023,8 @@ async function doctorRoutes(app, opts) {
       trafficSourceValidators: opts.trafficSourceValidators,
       runtimeStatePaths: opts.runtimeStatePaths,
       bundledSkills: opts.bundledSkills,
-      getAgentPluginState: opts.getAgentPluginState
+      getAgentPluginState: opts.getAgentPluginState,
+      getGoogleMarketingDoctorInput: opts.getGoogleMarketingDoctorInput
     };
     return runChecks(ctx, ALL_CHECKS, { checkIds });
   });
@@ -64704,7 +64952,8 @@ async function apiRoutes(app, opts) {
       trafficSourceValidators: buildTrafficSourceValidators(opts),
       runtimeStatePaths: opts.runtimeStatePaths,
       bundledSkills: opts.bundledSkills,
-      getAgentPluginState: opts.getAgentPluginState
+      getAgentPluginState: opts.getAgentPluginState,
+      getGoogleMarketingDoctorInput: opts.getGoogleMarketingDoctorInput
     });
     if (opts.registerAuthenticatedRoutes) {
       await opts.registerAuthenticatedRoutes(api);

package/dist/{chunk-HTUI6BSK.js → chunk-RR4KSDOD.js}

@@ -5,7 +5,7 @@ import {
   installSkills,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-BMW3AURU.js";
+} from "./chunk-IIFDS3K2.js";
 import {
   SKILL_MANIFEST_FILENAME,
   SkillsClients