@meffecta/agent 0.0.1

package/scripts/verify-credentials.mjs

@@ -0,0 +1,557 @@
+#!/usr/bin/env node
+// Credential doctor: exercises every configured credential the agent's jobs and
+// poller depend on, the same way its consumer uses it, and prints ok/FAIL/skip
+// per surface. Run locally with `pnpm creds` (.env via dotenv), or on Cloud Run
+// (through /test: "run node /app/scripts/verify-credentials.mjs and return the
+// output" — absolute path, since a run's cwd is the content clone and this file
+// ships in the image) where the metadata-server surfaces also become testable.
+// Never prints a credential value. Exits 1 if anything configured actually fails.
+
+import { execFile } from "node:child_process";
+
+const env = process.env;
+const results = [];
+const record = (name, status, detail = "") => results.push({ name, status, detail });
+const ok = (name, detail) => record(name, "ok", detail);
+const fail = (name, detail) => record(name, "FAIL", detail);
+const skip = (name, detail) => record(name, "skip", detail);
+
+async function http(url, { headers = {}, method = "GET", body, timeoutMs = 10_000 } = {}) {
+  const res = await fetch(url, { method, headers, body, signal: AbortSignal.timeout(timeoutMs) });
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    json = undefined;
+  }
+  return { status: res.status, json };
+}
+
+// --- Metadata server (Cloud Run) --------------------------------------------
+
+let onCloudRun = false;
+async function metadataToken(scopes) {
+  const url = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token${
+    scopes ? `?scopes=${encodeURIComponent(scopes.join(","))}` : ""
+  }`;
+  const res = await fetch(url, { headers: { "Metadata-Flavor": "Google" }, signal: AbortSignal.timeout(3000) });
+  if (!res.ok) {
+    throw new Error(`metadata server ${res.status}`);
+  }
+  return (await res.json()).access_token;
+}
+
+// --- Checks ------------------------------------------------------------------
+
+async function checkGithub() {
+  if (!env.GITHUB_TOKEN) {
+    return skip("GITHUB_TOKEN", "unset");
+  }
+  // The content repo (from GIT_REPO_URL, when it's a GitHub URL), plus the working
+  // repos this deployment's jobs clone (deployment-specific — derive from jobs/ one day).
+  const contentRepo = env.GIT_REPO_URL?.match(/github\.com\/([^/]+\/[^/.]+)/)?.[1];
+  const repos = [...(contentRepo ? [contentRepo] : []), "meffecta/sweepos"];
+  const codes = await Promise.all(
+    repos.map(
+      async (r) =>
+        (await http(`https://api.github.com/repos/${r}`, { headers: { Authorization: `Bearer ${env.GITHUB_TOKEN}` } }))
+          .status,
+    ),
+  );
+  const bad = repos.filter((_, i) => codes[i] !== 200);
+  bad.length
+    ? fail("GITHUB_TOKEN", `cannot see ${bad.join(", ")} (${codes.join("/")})`)
+    : ok("GITHUB_TOKEN", `clones ${repos.join(", ")}`);
+}
+
+async function checkGrafana() {
+  if (!env.GRAFANA_API_KEY || !env.GRAFANA_LOGS_HOST || !env.GRAFANA_LOGS_USERNAME) {
+    return skip("GRAFANA (Loki)", "GRAFANA_LOGS_HOST/USERNAME/API_KEY not all set");
+  }
+  const auth = Buffer.from(`${env.GRAFANA_LOGS_USERNAME}:${env.GRAFANA_API_KEY}`).toString("base64");
+  const { status } = await http(`${env.GRAFANA_LOGS_HOST}/loki/api/v1/labels`, {
+    headers: { Authorization: `Basic ${auth}` },
+  });
+  status === 200 ? ok("GRAFANA (Loki)") : fail("GRAFANA (Loki)", `labels query → ${status}`);
+}
+
+async function checkResend() {
+  if (!env.RESEND_API_KEY) {
+    return skip("RESEND_API_KEY", "unset");
+  }
+  const { status, json } = await http("https://api.resend.com/domains", {
+    headers: { Authorization: `Bearer ${env.RESEND_API_KEY}` },
+  });
+  status === 200
+    ? ok("RESEND_API_KEY", `${json?.data?.length ?? 0} domains`)
+    : fail("RESEND_API_KEY", `domains → ${status}`);
+}
+
+async function checkInternalApi() {
+  if (!env.SWEEPOS_API_URL || !env.INTERNAL_API_KEY) {
+    return skip("SWEEPOS internal API", "SWEEPOS_API_URL/INTERNAL_API_KEY not set");
+  }
+  const { status } = await http(`${env.SWEEPOS_API_URL}/v1/internal/leads?limit=1`, {
+    headers: { Authorization: `Bearer ${env.INTERNAL_API_KEY}` },
+  });
+  status === 200 ? ok("SWEEPOS internal API") : fail("SWEEPOS internal API", `leads → ${status}`);
+}
+
+function checkPostgres() {
+  return new Promise((resolve) => {
+    if (!env.SWEEPOS_POSTGRES_URL_READONLY) {
+      skip("SWEEPOS_POSTGRES_URL_READONLY", "unset");
+      return resolve();
+    }
+    execFile("psql", [env.SWEEPOS_POSTGRES_URL_READONLY, "-Atc", "SELECT 1"], { timeout: 10_000 }, (err, stdout) => {
+      if (err) {
+        err.code === "ENOENT"
+          ? skip("SWEEPOS_POSTGRES_URL_READONLY", "psql not installed here")
+          : fail("SWEEPOS_POSTGRES_URL_READONLY", err.message.split("\n")[0].slice(0, 120));
+      } else {
+        stdout.trim() === "1"
+          ? ok("SWEEPOS_POSTGRES_URL_READONLY")
+          : fail("SWEEPOS_POSTGRES_URL_READONLY", "unexpected result");
+      }
+      resolve();
+    });
+  });
+}
+
+async function checkPosthog() {
+  if (!env.POSTHOG_HOST || !env.POSTHOG_API_KEY) {
+    return skip("POSTHOG", "POSTHOG_HOST/POSTHOG_API_KEY not set");
+  }
+  const worlds = Object.keys(env).filter((k) => k.endsWith("_POSTHOG_PROJECT_ID") && env[k]);
+  if (worlds.length === 0) {
+    return skip("POSTHOG", "no *_POSTHOG_PROJECT_ID set");
+  }
+  for (const k of worlds) {
+    const { status } = await http(`${env.POSTHOG_HOST}/api/projects/${env[k]}/`, {
+      headers: { Authorization: `Bearer ${env.POSTHOG_API_KEY}` },
+    });
+    status === 200 ? ok(`POSTHOG ${k}`) : fail(`POSTHOG ${k}`, `project → ${status}`);
+  }
+}
+
+async function checkAhrefs() {
+  if (!env.AHREFS_API_KEY) {
+    return skip("AHREFS_API_KEY", "unset");
+  }
+  const { status, json } = await http("https://api.ahrefs.com/v3/public/domain-rating-free?target=sweepos.app", {
+    headers: { Authorization: `Bearer ${env.AHREFS_API_KEY}` },
+  });
+  status === 200
+    ? ok("AHREFS_API_KEY", `sweepos.app DR ${json?.domain_rating?.domain_rating ?? "?"}`)
+    : fail("AHREFS_API_KEY", `domain-rating-free → ${status}`);
+}
+
+async function checkCloudflare() {
+  if (!env.CLOUDFLARE_API_KEY || !env.CLOUDFLARE_ACCOUNT_ID) {
+    return skip("CLOUDFLARE", "CLOUDFLARE_API_KEY/ACCOUNT_ID not set");
+  }
+  const headers = { Authorization: `Bearer ${env.CLOUDFLARE_API_KEY}` };
+  const verify = await http(
+    `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}/tokens/verify`,
+    { headers },
+  );
+  if (!verify.json?.success) {
+    return fail("CLOUDFLARE", `token verify → ${verify.status}`);
+  }
+  const zones = await http("https://api.cloudflare.com/client/v4/zones?per_page=50", { headers });
+  zones.json?.success
+    ? ok("CLOUDFLARE", `${zones.json.result.length} zones`)
+    : fail("CLOUDFLARE", `zones → ${zones.status}`);
+}
+
+async function checkElevenlabs() {
+  if (!env.ELEVENLABS_API_KEY) {
+    return skip("ELEVENLABS_API_KEY", "unset");
+  }
+  const { status } = await http("https://api.elevenlabs.io/v1/user", {
+    headers: { "xi-api-key": env.ELEVENLABS_API_KEY },
+  });
+  status === 200 ? ok("ELEVENLABS_API_KEY") : fail("ELEVENLABS_API_KEY", `user → ${status}`);
+}
+
+async function checkPlaces() {
+  if (!env.GOOGLE_API_KEY) {
+    return skip("GOOGLE_API_KEY", "unset");
+  }
+  const { status, json } = await http("https://places.googleapis.com/v1/places:searchText", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Goog-Api-Key": env.GOOGLE_API_KEY,
+      "X-Goog-FieldMask": "places.id",
+    },
+    body: JSON.stringify({ textQuery: "städfirma Stockholm", pageSize: 1 }),
+  });
+  status === 200
+    ? ok("GOOGLE_API_KEY (Places)")
+    : fail("GOOGLE_API_KEY (Places)", json?.error?.message?.slice(0, 100) ?? `→ ${status}`);
+}
+
+async function gmailRefresh(refreshToken) {
+  const { status, json } = await http("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: env.GMAIL_CLIENT_ID,
+      client_secret: env.GMAIL_CLIENT_SECRET,
+      refresh_token: refreshToken,
+      grant_type: "refresh_token",
+    }),
+  });
+  if (status !== 200 || !json?.access_token) {
+    throw new Error(json?.error ?? `→ ${status}`);
+  }
+  return json.access_token;
+}
+
+async function checkGmailAccounts() {
+  if (!env.GMAIL_CLIENT_ID || !env.GMAIL_CLIENT_SECRET) {
+    return skip("GMAIL (OAuth)", "GMAIL_CLIENT_ID/SECRET not set");
+  }
+  const accounts = Object.keys(env)
+    .filter((k) => /^GMAIL(_[A-Z0-9]+)?_REFRESH_TOKEN$/.test(k) || k === "GMAIL_REFRESH_TOKEN")
+    .filter((k) => env[k]);
+  if (accounts.length === 0) {
+    return skip("GMAIL (OAuth)", "no refresh tokens set");
+  }
+  for (const k of accounts) {
+    const label = `GMAIL ${k === "GMAIL_REFRESH_TOKEN" ? "default" : k.replace(/^GMAIL_|_REFRESH_TOKEN$/g, "")}`;
+    try {
+      const token = await gmailRefresh(env[k]);
+      const { json } = await http("https://gmail.googleapis.com/gmail/v1/users/me/profile", {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      json?.emailAddress ? ok(label, json.emailAddress) : fail(label, "profile fetch failed");
+    } catch (err) {
+      fail(label, String(err.message).slice(0, 120));
+    }
+  }
+}
+
+// Microsoft Graph: same shape as the Gmail check — refresh, then use the token the
+// way query-outlook does. Reads the mailbox profile only; never touches a message.
+async function checkGraphAccounts() {
+  if (!env.MSGRAPH_TENANT_ID || !env.MSGRAPH_CLIENT_ID || !env.MSGRAPH_CLIENT_SECRET) {
+    return skip("MSGRAPH (Graph)", "MSGRAPH_TENANT_ID/CLIENT_ID/CLIENT_SECRET not set");
+  }
+  const accounts = Object.keys(env)
+    .filter((k) => /^MSGRAPH_[A-Z0-9]+_REFRESH_TOKEN$/.test(k))
+    .filter((k) => env[k]);
+  if (accounts.length === 0) {
+    return skip("MSGRAPH (Graph)", "no refresh tokens set");
+  }
+  for (const k of accounts) {
+    const label = `MSGRAPH ${k.replace(/^MSGRAPH_|_REFRESH_TOKEN$/g, "")}`;
+    try {
+      const { status, json } = await http(
+        `https://login.microsoftonline.com/${env.MSGRAPH_TENANT_ID}/oauth2/v2.0/token`,
+        {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            client_id: env.MSGRAPH_CLIENT_ID,
+            client_secret: env.MSGRAPH_CLIENT_SECRET,
+            refresh_token: env[k],
+            grant_type: "refresh_token",
+            scope: "offline_access https://graph.microsoft.com/Mail.Read https://graph.microsoft.com/Calendars.Read",
+          }),
+        },
+      );
+      if (status !== 200 || !json?.access_token) {
+        // A conditional-access refusal looks nothing like an expired token; say which.
+        const detail = String(json?.error_description ?? `→ ${status}`);
+        fail(
+          label,
+          /AADSTS50076|AADSTS53003/.test(detail)
+            ? "conditional access demands interactive sign-in"
+            : detail.slice(0, 120),
+        );
+        continue;
+      }
+      // Which identity consented, read from the token's own claims: /me needs
+      // User.Read, which this token deliberately doesn't hold.
+      const claims = JSON.parse(Buffer.from(json.access_token.split(".")[1], "base64url").toString());
+      const identity = claims.upn ?? claims.unique_name ?? claims.preferred_username ?? "unknown identity";
+      // Probe a mail endpoint, which is what the skill actually uses. Counts only.
+      const { status: mailStatus, json: inbox } = await http(
+        "https://graph.microsoft.com/v1.0/me/mailFolders/inbox?$select=totalItemCount,unreadItemCount",
+        { headers: { Authorization: `Bearer ${json.access_token}` } },
+      );
+      if (mailStatus === 200) {
+        ok(label, `${identity} — inbox reachable, ${inbox?.unreadItemCount ?? "?"} unread`);
+      } else if (/inactive, soft-deleted, or is hosted on-premise/.test(String(inbox?.error?.message))) {
+        // The classic trap: consenting as an admin account, which has no mailbox.
+        fail(label, `${identity} has no Exchange mailbox — re-mint signed in as the everyday account`);
+      } else {
+        fail(label, `${identity} — inbox → ${mailStatus} ${String(inbox?.error?.message ?? "").slice(0, 60)}`);
+      }
+    } catch (err) {
+      fail(label, String(err.message).slice(0, 120));
+    }
+  }
+}
+
+async function dwdToken(mailbox, scope) {
+  const saToken = await metadataToken();
+  const saEmail = (
+    await (
+      await fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email", {
+        headers: { "Metadata-Flavor": "Google" },
+      })
+    ).text()
+  ).trim();
+  const now = Math.floor(Date.now() / 1000);
+  const sign = await http(
+    `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(saEmail)}:signJwt`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${saToken}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        payload: JSON.stringify({
+          iss: saEmail,
+          sub: mailbox,
+          scope,
+          aud: "https://oauth2.googleapis.com/token",
+          iat: now,
+          exp: now + 600,
+        }),
+      }),
+    },
+  );
+  const exch = await http("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion: sign.json.signedJwt,
+    }),
+  });
+  if (!exch.json?.access_token) {
+    throw new Error(exch.json?.error ?? "token exchange failed");
+  }
+  return exch.json.access_token;
+}
+
+async function checkPersonalDrive() {
+  if (!env.GMAIL_CLIENT_ID || !env.GMAIL_CLIENT_SECRET || !env.GMAIL_REFRESH_TOKEN) {
+    return skip("PERSONAL drive scope", "default GMAIL account not configured");
+  }
+  try {
+    const token = await gmailRefresh(env.GMAIL_REFRESH_TOKEN);
+    const { status } = await http("https://www.googleapis.com/drive/v3/about?fields=user", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    status === 200
+      ? ok("PERSONAL drive scope")
+      : fail("PERSONAL drive scope", `about → ${status} (token minted without drive scopes — re-mint)`);
+  } catch (err) {
+    fail("PERSONAL drive scope", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkDwdMailbox() {
+  if (!env.AGENT_INBOX_MAILBOX) {
+    return skip("DWD inbox mailbox", "AGENT_INBOX_MAILBOX unset");
+  }
+  if (!onCloudRun) {
+    return skip("DWD inbox mailbox", "needs the metadata server — run on Cloud Run");
+  }
+  try {
+    const token = await dwdToken(env.AGENT_INBOX_MAILBOX, "https://www.googleapis.com/auth/gmail.readonly");
+    const prof = await http("https://gmail.googleapis.com/gmail/v1/users/me/profile", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    prof.json?.emailAddress
+      ? ok("DWD inbox mailbox", prof.json.emailAddress)
+      : fail("DWD inbox mailbox", "profile fetch failed");
+  } catch (err) {
+    fail("DWD inbox mailbox", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkDwdDrive() {
+  if (!env.AGENT_INBOX_MAILBOX) {
+    return skip("DWD drive+docs+slides", "AGENT_INBOX_MAILBOX unset");
+  }
+  if (!onCloudRun) {
+    return skip("DWD drive+docs+slides", "needs the metadata server — run on Cloud Run");
+  }
+  try {
+    const token = await dwdToken(
+      env.AGENT_INBOX_MAILBOX,
+      "https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/presentations",
+    );
+    const { status } = await http("https://www.googleapis.com/drive/v3/files?pageSize=1", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    status === 200 ? ok("DWD drive+docs+slides") : fail("DWD drive+docs+slides", `files → ${status}`);
+  } catch (err) {
+    fail("DWD drive+docs+slides", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkDwdCalendar() {
+  if (!env.AGENT_INBOX_MAILBOX) {
+    return skip("DWD calendar (write scope)", "AGENT_INBOX_MAILBOX unset");
+  }
+  if (!onCloudRun) {
+    return skip("DWD calendar (write scope)", "needs the metadata server — run on Cloud Run");
+  }
+  try {
+    const token = await dwdToken(env.AGENT_INBOX_MAILBOX, "https://www.googleapis.com/auth/calendar");
+    const { status } = await http("https://www.googleapis.com/calendar/v3/users/me/calendarList?maxResults=1", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    status === 200 ? ok("DWD calendar (write scope)") : fail("DWD calendar (write scope)", `calendarList → ${status}`);
+  } catch (err) {
+    fail("DWD calendar (write scope)", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkSearchConsole() {
+  if (!onCloudRun) {
+    return skip("SEARCH CONSOLE", "needs the metadata server — run on Cloud Run");
+  }
+  try {
+    const token = await metadataToken(["https://www.googleapis.com/auth/webmasters.readonly"]);
+    const { status, json } = await http("https://www.googleapis.com/webmasters/v3/sites", {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    status === 200
+      ? ok("SEARCH CONSOLE", `${json?.siteEntry?.length ?? 0} properties`)
+      : fail("SEARCH CONSOLE", `sites → ${status} (SA not invited?)`);
+  } catch (err) {
+    fail("SEARCH CONSOLE", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkGa4() {
+  const worlds = Object.keys(env).filter((k) => k.endsWith("GA4_PROPERTY_ID") && env[k]);
+  if (worlds.length === 0) {
+    return skip("GA4", "no *_GA4_PROPERTY_ID set");
+  }
+  if (!onCloudRun) {
+    return skip("GA4", "needs the metadata server — run on Cloud Run");
+  }
+  const token = await metadataToken(["https://www.googleapis.com/auth/analytics.readonly"]);
+  for (const k of worlds) {
+    const { status } = await http(`https://analyticsdata.googleapis.com/v1beta/properties/${env[k]}/metadata`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    status === 200 ? ok(`GA4 ${k}`) : fail(`GA4 ${k}`, `metadata → ${status} (SA not invited?)`);
+  }
+}
+
+async function checkGoogleAds() {
+  if (!env.GOOGLE_ADS_DEVELOPER_TOKEN || !env.SWEEPOS_GOOGLE_ADS_CUSTOMER_ID) {
+    return skip("GOOGLE ADS", "developer token / customer id not set");
+  }
+  if (!onCloudRun) {
+    return skip("GOOGLE ADS", "needs the metadata server — run on Cloud Run");
+  }
+  try {
+    const token = await metadataToken(["https://www.googleapis.com/auth/adwords"]);
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      "developer-token": env.GOOGLE_ADS_DEVELOPER_TOKEN,
+      "Content-Type": "application/json",
+    };
+    if (env.GOOGLE_ADS_LOGIN_CUSTOMER_ID) {
+      headers["login-customer-id"] = env.GOOGLE_ADS_LOGIN_CUSTOMER_ID;
+    }
+    const { status, json } = await http(
+      `https://googleads.googleapis.com/v25/customers/${env.SWEEPOS_GOOGLE_ADS_CUSTOMER_ID}/googleAds:searchStream`,
+      { method: "POST", headers, body: JSON.stringify({ query: "SELECT customer.id FROM customer LIMIT 1" }) },
+    );
+    status === 200
+      ? ok("GOOGLE ADS")
+      : fail("GOOGLE ADS", (json?.[0]?.error?.message ?? json?.error?.message ?? `→ ${status}`).slice(0, 120));
+  } catch (err) {
+    fail("GOOGLE ADS", String(err.message).slice(0, 120));
+  }
+}
+
+async function checkDeploymentsContext() {
+  const project = env.CONTEXT_DEPLOYMENTS_PROJECT;
+  if (!project) {
+    return skip("Deployments context (run.viewer)", "CONTEXT_DEPLOYMENTS_PROJECT unset");
+  }
+  if (!onCloudRun) {
+    return skip("Deployments context (run.viewer)", "needs the metadata server — run on Cloud Run");
+  }
+  const region = env.CONTEXT_DEPLOYMENTS_REGION || "europe-west1";
+  const token = await metadataToken();
+  const { status } = await http(`https://run.googleapis.com/v2/projects/${project}/locations/${region}/services`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  status === 200
+    ? ok("Deployments context (run.viewer)", project)
+    : fail("Deployments context (run.viewer)", `list → ${status}`);
+}
+
+function checkPresence() {
+  for (const k of ["CLAUDE_CODE_OAUTH_TOKEN", "AGENT_WEBHOOK_SECRET"]) {
+    env[k] ? ok(k, "present (not remotely testable)") : skip(k, "unset");
+  }
+}
+
+// --- Run ---------------------------------------------------------------------
+
+try {
+  await metadataToken();
+  onCloudRun = true;
+} catch {
+  onCloudRun = false;
+}
+
+checkPresence();
+
+// A check that throws (a timeout, an unreachable host) becomes its own FAIL line —
+// one dead surface must never take the rest of the report down with it.
+const CHECKS = [
+  ["GITHUB_TOKEN", checkGithub],
+  ["GRAFANA (Loki)", checkGrafana],
+  ["RESEND_API_KEY", checkResend],
+  ["SWEEPOS internal API", checkInternalApi],
+  ["SWEEPOS_POSTGRES_URL_READONLY", checkPostgres],
+  ["POSTHOG", checkPosthog],
+  ["AHREFS_API_KEY", checkAhrefs],
+  ["CLOUDFLARE", checkCloudflare],
+  ["ELEVENLABS_API_KEY", checkElevenlabs],
+  ["GOOGLE_API_KEY (Places)", checkPlaces],
+  ["GMAIL (OAuth)", checkGmailAccounts],
+  ["MSGRAPH (Graph)", checkGraphAccounts],
+  ["PERSONAL drive scope", checkPersonalDrive],
+  ["DWD inbox mailbox", checkDwdMailbox],
+  ["DWD drive+docs+slides", checkDwdDrive],
+  ["DWD calendar (write scope)", checkDwdCalendar],
+  ["SEARCH CONSOLE", checkSearchConsole],
+  ["GA4", checkGa4],
+  ["GOOGLE ADS", checkGoogleAds],
+  ["Deployments context (run.viewer)", checkDeploymentsContext],
+];
+await Promise.all(
+  CHECKS.map(([label, check]) =>
+    check().catch((e) => fail(label, `check threw: ${e?.name === "TimeoutError" ? "timed out" : (e?.message ?? e)}`)),
+  ),
+);
+
+results.sort((a, b) => a.name.localeCompare(b.name));
+const pad = Math.max(...results.map((r) => r.name.length)) + 2;
+console.log(
+  `\nCredential check — ${onCloudRun ? "Cloud Run (all surfaces)" : "local (metadata-server surfaces skipped)"}\n`,
+);
+for (const r of results) {
+  const icon = r.status === "ok" ? "✅" : r.status === "FAIL" ? "❌" : "⏭️ ";
+  console.log(`${icon} ${r.name.padEnd(pad)} ${r.status === "ok" ? r.detail : r.detail && `— ${r.detail}`}`);
+}
+const failures = results.filter((r) => r.status === "FAIL");
+console.log(
+  `\n${results.filter((r) => r.status === "ok").length} ok, ${failures.length} failed, ${results.filter((r) => r.status === "skip").length} skipped`,
+);
+process.exit(failures.length ? 1 : 0);