@memberjunction/connector-ga4 0.2.0

package/dist/GA4Config.d.ts

@@ -0,0 +1,72 @@
+/**
+ * `CompanyIntegration.Configuration` for GA4 — the non-secret half of the setup.
+ *
+ * The secret half (the service-account key) lives in `MJ: Credentials` and is never read from here.
+ * Everything in this file is safe to log, which is why the property id is here rather than in the
+ * credential: "which property am I pointed at" is the first question any support conversation asks.
+ *
+ * Every field except `propertyId` is optional, and every parse failure falls back to the documented
+ * default rather than throwing. A malformed `lookbackDays` should not take a working integration
+ * offline; a missing `propertyId` genuinely must, because there is nothing to query.
+ */
+export interface GA4Config {
+    /** The numeric GA4 property id, as a string. Digits only — GA4 rejects anything else. */
+    propertyId: string;
+    /** Days of already-synced history to re-read on every incremental run. See {@link DEFAULT_LOOKBACK_DAYS}. */
+    lookbackDays: number;
+    /** Earliest date to read when there is no watermark, `YYYY-MM-DD`. */
+    startDate: string | null;
+    /** Maximum span, in days, of any single GA4 request. See {@link DEFAULT_MAX_WINDOW_DAYS}. */
+    maxWindowDays: number;
+}
+/**
+ * Three days.
+ *
+ * GA4 does not finalize a day when the day ends. Event data continues to arrive and be reprocessed
+ * for up to 48 hours, and user-scoped metrics — the two cardinalities — can move for longer as late
+ * sessions are stitched onto existing users. A watermark that advanced strictly to the last day seen
+ * would therefore land every day's numbers exactly once, at their least accurate, and never correct
+ * them.
+ *
+ * Re-reading the tail is cheap in the only way that matters: the engine's content-hash prefetch turns
+ * an unchanged row into zero writes, so the cost of a lookback window is reads, and the days that DID
+ * move are precisely the ones that should be rewritten.
+ *
+ * Three rather than two: GA4's 48 hours is measured from the event, not from midnight in the
+ * property's reporting time zone, so a strict two-day window can end a few hours short of it.
+ */
+export declare const DEFAULT_LOOKBACK_DAYS = 3;
+/** Sanity bound. A lookback longer than this is a request for a full re-read; clear the watermark instead. */
+export declare const MAX_LOOKBACK_DAYS = 400;
+/**
+ * Ninety days per request.
+ *
+ * This does NOT bound how much history a run covers — when a window is exhausted and there is more
+ * to read, the cursor advances to the next window and the same run keeps going. It bounds the size
+ * of any single GA4 response, which matters because a wide date range against a high-cardinality
+ * dimension like `pagePath` is exactly the shape that trips GA4's own cardinality limits and starts
+ * collapsing rows into the `(other)` bucket. Narrower windows keep each request inside those limits.
+ */
+export declare const DEFAULT_MAX_WINDOW_DAYS = 90;
+/** GA4's own hard cap on rows per `runReport` request. */
+export declare const GA4_MAX_LIMIT = 250000;
+/**
+ * How far back a cold start reads when `startDate` is not configured.
+ *
+ * Slightly over GA4's default 14-month event-data retention, so the default behaviour is "everything
+ * the property still has" rather than an arbitrary window. Properties set to 2-month retention will
+ * simply return nothing for the earlier part, at no cost beyond a few empty requests.
+ */
+export declare const DEFAULT_COLD_START_DAYS = 430;
+/**
+ * Parse `CompanyIntegration.Configuration`.
+ *
+ * @throws when `propertyId` is absent or is not digits — the one unrecoverable case.
+ */
+export declare function parseGA4Config(configuration: string | null | undefined): GA4Config;
+/**
+ * Accept the property id as a string or a number, and tolerate the two forms people paste from the
+ * GA4 UI and the API docs — `properties/123456789` and a stray `G-` measurement id is rejected,
+ * because silently querying the wrong thing is worse than failing setup.
+ */
+export declare function normalizePropertyId(value: unknown): string | null;

package/dist/GA4Config.js

@@ -0,0 +1,103 @@
+/**
+ * `CompanyIntegration.Configuration` for GA4 — the non-secret half of the setup.
+ *
+ * The secret half (the service-account key) lives in `MJ: Credentials` and is never read from here.
+ * Everything in this file is safe to log, which is why the property id is here rather than in the
+ * credential: "which property am I pointed at" is the first question any support conversation asks.
+ *
+ * Every field except `propertyId` is optional, and every parse failure falls back to the documented
+ * default rather than throwing. A malformed `lookbackDays` should not take a working integration
+ * offline; a missing `propertyId` genuinely must, because there is nothing to query.
+ */
+/**
+ * Three days.
+ *
+ * GA4 does not finalize a day when the day ends. Event data continues to arrive and be reprocessed
+ * for up to 48 hours, and user-scoped metrics — the two cardinalities — can move for longer as late
+ * sessions are stitched onto existing users. A watermark that advanced strictly to the last day seen
+ * would therefore land every day's numbers exactly once, at their least accurate, and never correct
+ * them.
+ *
+ * Re-reading the tail is cheap in the only way that matters: the engine's content-hash prefetch turns
+ * an unchanged row into zero writes, so the cost of a lookback window is reads, and the days that DID
+ * move are precisely the ones that should be rewritten.
+ *
+ * Three rather than two: GA4's 48 hours is measured from the event, not from midnight in the
+ * property's reporting time zone, so a strict two-day window can end a few hours short of it.
+ */
+export const DEFAULT_LOOKBACK_DAYS = 3;
+/** Sanity bound. A lookback longer than this is a request for a full re-read; clear the watermark instead. */
+export const MAX_LOOKBACK_DAYS = 400;
+/**
+ * Ninety days per request.
+ *
+ * This does NOT bound how much history a run covers — when a window is exhausted and there is more
+ * to read, the cursor advances to the next window and the same run keeps going. It bounds the size
+ * of any single GA4 response, which matters because a wide date range against a high-cardinality
+ * dimension like `pagePath` is exactly the shape that trips GA4's own cardinality limits and starts
+ * collapsing rows into the `(other)` bucket. Narrower windows keep each request inside those limits.
+ */
+export const DEFAULT_MAX_WINDOW_DAYS = 90;
+/** GA4's own hard cap on rows per `runReport` request. */
+export const GA4_MAX_LIMIT = 250_000;
+/**
+ * How far back a cold start reads when `startDate` is not configured.
+ *
+ * Slightly over GA4's default 14-month event-data retention, so the default behaviour is "everything
+ * the property still has" rather than an arbitrary window. Properties set to 2-month retention will
+ * simply return nothing for the earlier part, at no cost beyond a few empty requests.
+ */
+export const DEFAULT_COLD_START_DAYS = 430;
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+/**
+ * Parse `CompanyIntegration.Configuration`.
+ *
+ * @throws when `propertyId` is absent or is not digits — the one unrecoverable case.
+ */
+export function parseGA4Config(configuration) {
+    const raw = readJSONObject(configuration);
+    const propertyId = normalizePropertyId(raw.propertyId);
+    if (propertyId === null) {
+        throw new Error('GA4: Configuration.propertyId is required and must be the numeric GA4 property id, e.g. {"propertyId":"123456789"}. ' +
+            'It is the number shown as "PROPERTY ID" in GA4 Admin → Property Settings — not the measurement id (G-XXXXXXX) and not the account id.');
+    }
+    return {
+        propertyId,
+        lookbackDays: clampInt(raw.lookbackDays, DEFAULT_LOOKBACK_DAYS, 0, MAX_LOOKBACK_DAYS),
+        startDate: ISO_DATE.test(String(raw.startDate)) ? String(raw.startDate) : null,
+        maxWindowDays: clampInt(raw.maxWindowDays, DEFAULT_MAX_WINDOW_DAYS, 1, 400),
+    };
+}
+/**
+ * Accept the property id as a string or a number, and tolerate the two forms people paste from the
+ * GA4 UI and the API docs — `properties/123456789` and a stray `G-` measurement id is rejected,
+ * because silently querying the wrong thing is worse than failing setup.
+ */
+export function normalizePropertyId(value) {
+    if (typeof value === 'number' && Number.isInteger(value) && value > 0)
+        return String(value);
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim().replace(/^properties\//, '');
+    return /^\d+$/.test(trimmed) ? trimmed : null;
+}
+function readJSONObject(text) {
+    if (!text)
+        return {};
+    try {
+        const parsed = JSON.parse(text);
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function clampInt(value, fallback, min, max) {
+    const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.min(max, Math.max(min, Math.trunc(n)));
+}
+//# sourceMappingURL=GA4Config.js.map

package/dist/GA4Config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GA4Config.js","sourceRoot":"","sources":["../src/GA4Config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,aAAwC;IACnE,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACX,sHAAsH;YAClH,uIAAuI,CAC9I,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU;QACV,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC,EAAE,iBAAiB,CAAC;QACrF,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9E,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,uBAAuB,EAAE,CAAC,EAAE,GAAG,CAAC;KAC9E,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,IAA+B;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IACxE,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/GA4Connector.d.ts

@@ -0,0 +1,82 @@
+import { type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+import type { MJCompanyIntegrationEntity } from '@memberjunction/core-entities';
+import { BaseIntegrationConnector, type ConnectionTestResult, type ExternalFieldSchema, type ExternalObjectSchema, type FetchBatchResult, type FetchContext, type IntegrationObjectInfo } from '@memberjunction/integration-engine';
+import { type GA4ServiceAccount } from './GA4ServiceAccount.js';
+import { type GA4ReportPort } from './GA4Report.js';
+export declare class GA4Connector extends BaseIntegrationConnector {
+    get IntegrationName(): string;
+    /** The watermark is a date that only ever advances toward today. */
+    get MonotonicWatermark(): boolean;
+    /**
+     * GA4 orders a report by its own default and offers no stable seek key. Position is carried by
+     * the cursor's offset against a pinned date range instead — which is exact for the duration of a
+     * run, where a sort key would only be approximate.
+     */
+    StableOrderingKey(_objectName: string): string | null;
+    /** Overridable so tests drive the clock and the API without a credential or a network. */
+    protected Now(): Date;
+    protected Report(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<GA4ReportPort>;
+    GetIntegrationObjects(): IntegrationObjectInfo[];
+    DiscoverObjects(_companyIntegration: MJCompanyIntegrationEntity, _contextUser: UserInfo): Promise<ExternalObjectSchema[]>;
+    /**
+     * MaxLength/Precision/Scale/IsPrimaryKey are set explicitly, and that is load-bearing. The engine
+     * has two bridges from a declared catalog into field schemas and they are not equivalent — one
+     * carries these attributes, the other drops them. A `--base` connector that leaves them to be
+     * inferred gets unbounded columns and hash-based identity instead of key-based.
+     */
+    DiscoverFields(_companyIntegration: MJCompanyIntegrationEntity, objectName: string, _contextUser: UserInfo): Promise<ExternalFieldSchema[]>;
+    /**
+     * The smallest report that proves the whole chain: one metric, one dimension, one row, today.
+     *
+     * It has to be a real report rather than a metadata call, because the ways GA4 setup fails are
+     * only distinguishable when you actually query DATA. The credential can be valid, the Data API
+     * can be enabled, and the service account can still be unable to read this property — that last
+     * step happens in the Analytics UI, not in Cloud Console, and it is the one people miss. So a
+     * permission failure is reported as its own case with the fix in the message, rather than as
+     * whatever Google's error string happened to say.
+     *
+     * On success it reports the property's reporting time zone, because every `date` this connector
+     * lands is a day in that zone rather than in UTC, and that is not otherwise discoverable from
+     * the synced table.
+     */
+    TestConnection(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<ConnectionTestResult>;
+    /**
+     * One `runReport` per call — see the 30s note in the class docs.
+     *
+     * The call resolves its position from the cursor, or opens the run's first window from the
+     * watermark. It returns `HasMore: true` with a fresh cursor for as long as there is either more
+     * of this window to page or another window to open, and only on the very last page of the very
+     * last window does it emit `NewWatermarkValue`.
+     *
+     * The watermark is the run's PINNED `today`, not the newest date actually seen in the data. Those
+     * differ whenever a property has no traffic on its most recent days, and using the data's own
+     * maximum would leave the watermark stuck behind a quiet weekend, re-reading the same empty range
+     * on every run until traffic resumed.
+     */
+    FetchChanges(ctx: FetchContext): Promise<FetchBatchResult>;
+    /** Resume where the run left off, or open the run's first window from the watermark. */
+    private ResolveCursor;
+    /** Move to the next date window, or null when the run has reached its pinned `today`. */
+    private AdvanceWindow;
+    /**
+     * Project the response, collecting the conditions worth warning about.
+     *
+     * These are all things GA4 reports about the DATA rather than about the request, so none of them
+     * fails a run — but each one means the landed numbers do not say what they appear to say, and
+     * that must not be invisible.
+     */
+    private ProjectRows;
+    /**
+     * The service-account key comes from `MJ: Credentials` and nowhere else.
+     *
+     * Not from `CompanyIntegration.Configuration`, which carries the non-secret half, and not from a
+     * process env var — the legacy provider accepted a `GA4_SA_JSON` fallback, which made the
+     * effective credential depend on the host's environment rather than on the record, so two
+     * companies on one MJAPI could silently read the same property. And explicitly not from
+     * `CompanyIntegration.APIKey`: that column is not decrypt-on-read, so an mj-sync-encrypted value
+     * comes back as the literal `$ENC$…` string and would be handed to Google verbatim.
+     */
+    protected LoadServiceAccount(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo, provider?: IMetadataProvider): Promise<GA4ServiceAccount>;
+}
+/** Tree-shaking prevention function — import and call from the module entry point. */
+export declare function LoadGA4Connector(): void;

package/dist/GA4Connector.js

@@ -0,0 +1,353 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * Google Analytics 4 connector, over the Data API v1beta.
+ *
+ * This class is ORCHESTRATION ONLY. The report catalog, the config parse, the service-account parse,
+ * the window arithmetic and cursor codec, and the row projection all live in pure modules beside it
+ * with their own tests. What is left here is the part that needs an engine, a clock and a network.
+ *
+ * ── WHAT MAKES GA4 UNLIKE THE OTHER CONNECTORS ───────────────────────────────────────────────────
+ *
+ * There is nothing to list. Every other connector in this repo reads an API that has records —
+ * `/projects`, `/users`, a CSV of organizations — and the connector's job is to walk them. GA4 has
+ * no records. It has a query engine, and a "report" is whatever you ask it for: a set of dimensions,
+ * a set of metrics, and a date range, aggregated on demand. So the objects here are *defined
+ * reports*, declared in the catalog, and the identity of a row is the dimension tuple that produced
+ * it. That has three consequences that shape everything below.
+ *
+ * 1. **`date` must be a dimension, on every object.** A report aggregated over a range is one answer
+ *    whose shape changes whenever the range moves; there is no stable row to upsert. Adding `date`
+ *    turns it into one row per day, which is the only form with an identity that survives across
+ *    runs.
+ *
+ * 2. **A day is not final when it ends.** GA4 keeps reprocessing recent events for up to 48 hours,
+ *    and user-scoped metrics keep moving for longer. A watermark that advanced strictly forward
+ *    would land every day exactly once, at its least accurate, and never revisit it — so the window
+ *    opens `lookbackDays` behind the watermark and re-reads the tail. The engine's content-hash
+ *    prefetch makes that nearly free: days that did not move cost a read and no write.
+ *
+ * 3. **The grain is chosen, not given.** Which is why there are three objects rather than one with a
+ *    rollup — see the long note in `GA4Objects.ts`. Short version: GA4's user metrics are
+ *    cardinalities, cardinalities are not additive, and a rollup that is right for the counts and
+ *    quietly wrong for the users is worse than no rollup.
+ *
+ * ── THE ENGINE CONSTRAINT THIS ANSWERS TO ────────────────────────────────────────────────────────
+ *
+ * `FetchChangesMs` is 30s, read from a module constant with no per-connector override, and a timeout
+ * is classified retryable while the timeout wrapper is a non-cancelling `Promise.race` — so an
+ * overrun is not a clean retry, it is the same work running three times concurrently. Every call
+ * here therefore issues exactly ONE `runReport` and returns, rather than looping until the batch is
+ * full. One request per call is also the honest shape: GA4 pages by offset, and the engine's re-call
+ * loop is a perfectly good pump.
+ */
+import { RegisterClass } from '@memberjunction/global';
+import { Metadata } from '@memberjunction/core';
+import { BaseIntegrationConnector, } from '@memberjunction/integration-engine';
+import { parseGA4Config, GA4_MAX_LIMIT } from './GA4Config.js';
+import { GA4_OBJECTS, catalogObject, toIntegrationObjectInfo, } from './GA4Objects.js';
+import { parseServiceAccount } from './GA4ServiceAccount.js';
+import { DefaultGA4ReportPort, isPermissionError, isQuotaError, } from './GA4Report.js';
+import { projectRow } from './GA4Rows.js';
+import { formatCursor, initialWindow, nextWindow, parseCursor, toISODate, } from './GA4Window.js';
+let GA4Connector = class GA4Connector extends BaseIntegrationConnector {
+    get IntegrationName() {
+        return 'Google Analytics 4';
+    }
+    /** The watermark is a date that only ever advances toward today. */
+    get MonotonicWatermark() {
+        return true;
+    }
+    /**
+     * GA4 orders a report by its own default and offers no stable seek key. Position is carried by
+     * the cursor's offset against a pinned date range instead — which is exact for the duration of a
+     * run, where a sort key would only be approximate.
+     */
+    StableOrderingKey(_objectName) {
+        return null;
+    }
+    /** Overridable so tests drive the clock and the API without a credential or a network. */
+    Now() {
+        return new Date();
+    }
+    async Report(companyIntegration, contextUser) {
+        const account = await this.LoadServiceAccount(companyIntegration, contextUser);
+        return new DefaultGA4ReportPort(account.client_email, account.private_key);
+    }
+    // ── Discovery ─────────────────────────────────────────────────────────────
+    // Answered from the declared catalog rather than from seeded metadata, so the connector is usable
+    // BEFORE its metadata has been pushed — which is the state it is in at first setup.
+    GetIntegrationObjects() {
+        return GA4_OBJECTS.map(toIntegrationObjectInfo);
+    }
+    async DiscoverObjects(_companyIntegration, _contextUser) {
+        return GA4_OBJECTS.map((o) => ({
+            Name: o.Name,
+            Label: o.DisplayName,
+            Description: o.Description,
+            SupportsIncrementalSync: o.SupportsIncrementalSync,
+            SupportsWrite: false,
+        }));
+    }
+    /**
+     * MaxLength/Precision/Scale/IsPrimaryKey are set explicitly, and that is load-bearing. The engine
+     * has two bridges from a declared catalog into field schemas and they are not equivalent — one
+     * carries these attributes, the other drops them. A `--base` connector that leaves them to be
+     * inferred gets unbounded columns and hash-based identity instead of key-based.
+     */
+    async DiscoverFields(_companyIntegration, objectName, _contextUser) {
+        return catalogObject(objectName).Fields.map((f) => ({
+            Name: f.Name,
+            Label: f.DisplayName,
+            Description: f.Description,
+            DataType: f.Type,
+            IsRequired: f.IsRequired,
+            AllowsNull: f.AllowsNull,
+            IsPrimaryKey: f.IsPrimaryKey,
+            IsUniqueKey: f.IsUniqueKey,
+            IsReadOnly: true,
+            MaxLength: f.Length ?? null,
+            Precision: f.Precision ?? null,
+            Scale: f.Scale ?? null,
+        }));
+    }
+    // ── Connection ────────────────────────────────────────────────────────────
+    /**
+     * The smallest report that proves the whole chain: one metric, one dimension, one row, today.
+     *
+     * It has to be a real report rather than a metadata call, because the ways GA4 setup fails are
+     * only distinguishable when you actually query DATA. The credential can be valid, the Data API
+     * can be enabled, and the service account can still be unable to read this property — that last
+     * step happens in the Analytics UI, not in Cloud Console, and it is the one people miss. So a
+     * permission failure is reported as its own case with the fix in the message, rather than as
+     * whatever Google's error string happened to say.
+     *
+     * On success it reports the property's reporting time zone, because every `date` this connector
+     * lands is a day in that zone rather than in UTC, and that is not otherwise discoverable from
+     * the synced table.
+     */
+    async TestConnection(companyIntegration, contextUser) {
+        let config;
+        try {
+            config = parseGA4Config(companyIntegration.Configuration);
+        }
+        catch (e) {
+            return { Success: false, Message: e.message };
+        }
+        let account;
+        try {
+            account = await this.LoadServiceAccount(companyIntegration, contextUser);
+        }
+        catch (e) {
+            return { Success: false, Message: e.message };
+        }
+        const today = toISODate(this.Now());
+        try {
+            const port = await this.Report(companyIntegration, contextUser);
+            const response = await port.RunReport({
+                property: `properties/${config.propertyId}`,
+                dateRanges: [{ startDate: today, endDate: today }],
+                dimensions: [{ name: 'date' }],
+                metrics: [{ name: 'sessions' }],
+                limit: 1,
+                offset: 0,
+                returnPropertyQuota: true,
+            });
+            const zone = response.metadata?.timeZone ?? 'unknown';
+            return {
+                Success: true,
+                Message: `Read property ${config.propertyId} as ${account.client_email}. ` +
+                    `Reporting time zone: ${zone} — every synced 'date' is a day in that zone, not UTC.`,
+                ServerVersion: 'v1beta',
+            };
+        }
+        catch (e) {
+            if (isPermissionError(e)) {
+                return {
+                    Success: false,
+                    Message: `The service account ${account.client_email} authenticated, but is not permitted to read GA4 property ${config.propertyId}. ` +
+                        'A Cloud IAM role is not sufficient: add that email as a property user in Google Analytics → Admin → Property Access Management with at least Viewer. ' +
+                        'Also confirm the Google Analytics Data API is enabled on the service account\'s project.',
+                };
+            }
+            if (isQuotaError(e)) {
+                return {
+                    Success: false,
+                    Message: `GA4 quota is exhausted for property ${config.propertyId}; the credential itself looks fine. Analytics token buckets refill hourly and daily — retry later. (${e.message})`,
+                };
+            }
+            return {
+                Success: false,
+                Message: `GA4 runReport failed for property ${config.propertyId}: ${e.message}`,
+            };
+        }
+    }
+    // ── Fetch ─────────────────────────────────────────────────────────────────
+    /**
+     * One `runReport` per call — see the 30s note in the class docs.
+     *
+     * The call resolves its position from the cursor, or opens the run's first window from the
+     * watermark. It returns `HasMore: true` with a fresh cursor for as long as there is either more
+     * of this window to page or another window to open, and only on the very last page of the very
+     * last window does it emit `NewWatermarkValue`.
+     *
+     * The watermark is the run's PINNED `today`, not the newest date actually seen in the data. Those
+     * differ whenever a property has no traffic on its most recent days, and using the data's own
+     * maximum would leave the watermark stuck behind a quiet weekend, re-reading the same empty range
+     * on every run until traffic resumed.
+     */
+    async FetchChanges(ctx) {
+        const obj = catalogObject(ctx.ObjectName);
+        const config = parseGA4Config(ctx.CompanyIntegration.Configuration);
+        const port = await this.Report(ctx.CompanyIntegration, ctx.ContextUser);
+        const cursor = this.ResolveCursor(ctx, config);
+        const limit = Math.max(1, Math.min(ctx.BatchSize, GA4_MAX_LIMIT));
+        const request = {
+            property: `properties/${config.propertyId}`,
+            dateRanges: [{ startDate: cursor.From, endDate: cursor.To }],
+            dimensions: obj.Dimensions.map((name) => ({ name })),
+            metrics: obj.Metrics.map((name) => ({ name })),
+            limit,
+            offset: cursor.Offset,
+            returnPropertyQuota: true,
+        };
+        let response;
+        try {
+            response = await port.RunReport(request);
+        }
+        catch (e) {
+            // Rethrown with the window attached. A bare Google error names neither the property nor
+            // the date range, and "which request failed" is the first thing anyone needs.
+            throw new Error(`GA4 runReport failed for ${ctx.ObjectName} on property ${config.propertyId} over ${cursor.From}..${cursor.To} (offset ${cursor.Offset}): ${e.message}`);
+        }
+        const { records, warnings } = this.ProjectRows(obj, response, config, cursor);
+        // GA4 reports the full match count on every page, so exhaustion of a window is knowable
+        // without probing for an empty page. Falling back to the consumed count when `rowCount` is
+        // absent makes a short page mean "done" rather than looping forever on a missing field, and
+        // the `rowsReturned > 0` guard makes an empty page terminal under any response shape.
+        const rowsReturned = response.rows?.length ?? 0;
+        const consumed = cursor.Offset + rowsReturned;
+        const total = typeof response.rowCount === 'number' ? response.rowCount : consumed;
+        const next = consumed < total && rowsReturned > 0
+            ? { ...cursor, Offset: consumed }
+            : this.AdvanceWindow(cursor, config);
+        return {
+            Records: records,
+            HasMore: next !== null,
+            NextCursor: next ? formatCursor(next) : undefined,
+            // Only when the whole run is done. Advancing mid-run would let a crash mark days ingested
+            // that were never read, and the lookback window is not wide enough to recover an
+            // arbitrary gap.
+            NewWatermarkValue: next === null ? cursor.Today : undefined,
+            Warnings: warnings.length > 0 ? warnings : undefined,
+        };
+    }
+    /** Resume where the run left off, or open the run's first window from the watermark. */
+    ResolveCursor(ctx, config) {
+        const existing = parseCursor(ctx.CurrentCursor);
+        if (existing)
+            return existing;
+        const today = toISODate(this.Now());
+        const window = initialWindow(config, ctx.WatermarkValue, today);
+        return { Today: today, From: window.From, To: window.To, Offset: 0 };
+    }
+    /** Move to the next date window, or null when the run has reached its pinned `today`. */
+    AdvanceWindow(cursor, config) {
+        const window = nextWindow(cursor, config, cursor.Today);
+        return window ? { Today: cursor.Today, From: window.From, To: window.To, Offset: 0 } : null;
+    }
+    /**
+     * Project the response, collecting the conditions worth warning about.
+     *
+     * These are all things GA4 reports about the DATA rather than about the request, so none of them
+     * fails a run — but each one means the landed numbers do not say what they appear to say, and
+     * that must not be invisible.
+     */
+    ProjectRows(obj, response, config, cursor) {
+        const records = [];
+        const warnings = [];
+        let unkeyable = 0;
+        let otherRows = 0;
+        for (const row of response.rows ?? []) {
+            const projected = projectRow(obj, row, config.propertyId);
+            if (projected === null) {
+                unkeyable++;
+                continue;
+            }
+            if (projected.IsOtherRow)
+                otherRows++;
+            records.push(projected.Record);
+        }
+        if (unkeyable > 0) {
+            warnings.push({
+                Code: 'UNKEYABLE_ROW',
+                Message: `${unkeyable} row(s) skipped: GA4 returned a value for the 'date' dimension that is not a date, so the row has no stable identity.`,
+                Data: { count: unkeyable, window: `${cursor.From}..${cursor.To}` },
+            });
+        }
+        if (response.metadata?.dataLossFromOtherRow || otherRows > 0) {
+            // The rows are still emitted — they are real traffic, and dropping them would silently
+            // shrink every total computed from this table. The warning is what stops '(other)' from
+            // being read as a campaign name.
+            warnings.push({
+                Code: 'CARDINALITY_LIMIT',
+                Message: `GA4 hit a cardinality limit for ${obj.Name} over ${cursor.From}..${cursor.To} and collapsed some rows into an '(other)' aggregate. ` +
+                    'Totals stay complete but the detail behind those rows is gone. Lower Configuration.maxWindowDays so each request covers a narrower range.',
+                Data: { object: obj.Name, otherRows, window: `${cursor.From}..${cursor.To}` },
+            });
+        }
+        if (response.metadata?.subjectToThresholding) {
+            warnings.push({
+                Code: 'DATA_THRESHOLDED',
+                Message: `GA4 withheld rows for ${obj.Name} over ${cursor.From}..${cursor.To} because the underlying audience was too small to report without identifying individuals. ` +
+                    'Thresholding applies when Google signals are enabled; the landed rows undercount by an amount GA4 does not disclose.',
+                Data: { object: obj.Name, window: `${cursor.From}..${cursor.To}` },
+            });
+        }
+        const remainingHourly = response.propertyQuota?.tokensPerHour?.remaining;
+        if (typeof remainingHourly === 'number' && remainingHourly <= 0) {
+            warnings.push({
+                Code: 'QUOTA_EXHAUSTED',
+                Message: `GA4 analytics tokens for this hour are exhausted on property ${config.propertyId}. Later requests in this run will fail until the bucket refills.`,
+                Data: { propertyId: config.propertyId },
+            });
+        }
+        return { records, warnings };
+    }
+    // ── Credentials ───────────────────────────────────────────────────────────
+    /**
+     * The service-account key comes from `MJ: Credentials` and nowhere else.
+     *
+     * Not from `CompanyIntegration.Configuration`, which carries the non-secret half, and not from a
+     * process env var — the legacy provider accepted a `GA4_SA_JSON` fallback, which made the
+     * effective credential depend on the host's environment rather than on the record, so two
+     * companies on one MJAPI could silently read the same property. And explicitly not from
+     * `CompanyIntegration.APIKey`: that column is not decrypt-on-read, so an mj-sync-encrypted value
+     * comes back as the literal `$ENC$…` string and would be handed to Google verbatim.
+     */
+    async LoadServiceAccount(companyIntegration, contextUser, provider) {
+        const credentialID = companyIntegration.CredentialID;
+        if (!credentialID) {
+            throw new Error('GA4: CompanyIntegration.CredentialID is not set. Create an MJ: Credentials record of type "Google Service Account" holding the downloaded key JSON and link it — the key is never read from Configuration.');
+        }
+        const md = provider ?? new Metadata();
+        const credential = await md.GetEntityObject('MJ: Credentials', contextUser);
+        const loaded = await credential.Load(credentialID);
+        if (!loaded) {
+            throw new Error(`GA4: credential ${credentialID} could not be loaded. It may have been deleted, or this user may not have access to it.`);
+        }
+        return parseServiceAccount(credential.Values);
+    }
+};
+GA4Connector = __decorate([
+    RegisterClass(BaseIntegrationConnector, 'GA4Connector'),
+    RegisterClass(BaseIntegrationConnector, '@memberjunction/connector-ga4')
+], GA4Connector);
+export { GA4Connector };
+/** Tree-shaking prevention function — import and call from the module entry point. */
+export function LoadGA4Connector() { }
+//# sourceMappingURL=GA4Connector.js.map

package/dist/GA4Connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GA4Connector.js","sourceRoot":"","sources":["../src/GA4Connector.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAyC,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EACH,wBAAwB,GAS3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EACH,WAAW,EACX,aAAa,EACb,uBAAuB,GAG1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAA0B,MAAM,wBAAwB,CAAC;AACrF,OAAO,EACH,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,GAIf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACH,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,SAAS,GAEZ,MAAM,gBAAgB,CAAC;AAIjB,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,wBAAwB;IACtD,IAAoB,eAAe;QAC/B,OAAO,oBAAoB,CAAC;IAChC,CAAC;IAED,oEAAoE;IACpE,IAAoB,kBAAkB;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACa,iBAAiB,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,0FAA0F;IAChF,GAAG;QACT,OAAO,IAAI,IAAI,EAAE,CAAC;IACtB,CAAC;IAES,KAAK,CAAC,MAAM,CAClB,kBAA8C,EAC9C,WAAqB;QAErB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAC/E,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,kGAAkG;IAClG,oFAAoF;IAEpE,qBAAqB;QACjC,OAAO,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC;IAEe,KAAK,CAAC,eAAe,CACjC,mBAA+C,EAC/C,YAAsB;QAEtB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,WAAW;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,uBAAuB,EAAE,CAAC,CAAC,uBAAuB;YAClD,aAAa,EAAE,KAAK;SACvB,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;OAKG;IACa,KAAK,CAAC,cAAc,CAChC,mBAA+C,EAC/C,UAAkB,EAClB,YAAsB;QAEtB,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CACvC,CAAC,CAAe,EAAuB,EAAE,CAAC,CAAC;YACvC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,WAAW;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;YAC3B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;SACzB,CAAC,CACL,CAAC;IACN,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;;OAaG;IACa,KAAK,CAAC,cAAc,CAChC,kBAA8C,EAC9C,WAAqB;QAErB,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,GAAG,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClC,QAAQ,EAAE,cAAc,MAAM,CAAC,UAAU,EAAE;gBAC3C,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC/B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,mBAAmB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;YACtD,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,OAAO,EACH,iBAAiB,MAAM,CAAC,UAAU,OAAO,OAAO,CAAC,YAAY,IAAI;oBACjE,wBAAwB,IAAI,wDAAwD;gBACxF,aAAa,EAAE,QAAQ;aAC1B,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,OAAO,EACH,uBAAuB,OAAO,CAAC,YAAY,6DAA6D,MAAM,CAAC,UAAU,IAAI;wBAC7H,uJAAuJ;wBACvJ,0FAA0F;iBACjG,CAAC;YACN,CAAC;YACD,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClB,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,uCAAuC,MAAM,CAAC,UAAU,uGAAwG,CAAW,CAAC,OAAO,GAAG;iBAClM,CAAC;YACN,CAAC;YACD,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,qCAAqC,MAAM,CAAC,UAAU,KAAM,CAAW,CAAC,OAAO,EAAE;aAC7F,CAAC;QACN,CAAC;IACL,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;OAYG;IACa,KAAK,CAAC,YAAY,CAAC,GAAiB;QAChD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QAElE,MAAM,OAAO,GAAwB;YACjC,QAAQ,EAAE,cAAc,MAAM,CAAC,UAAU,EAAE;YAC3C,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5D,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,mBAAmB,EAAE,IAAI;SAC5B,CAAC;QAEF,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,wFAAwF;YACxF,8EAA8E;YAC9E,MAAM,IAAI,KAAK,CACX,4BAA4B,GAAG,CAAC,UAAU,gBAAgB,MAAM,CAAC,UAAU,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,MAAM,CAAC,MAAM,MAAO,CAAW,CAAC,OAAO,EAAE,CACrK,CAAC;QACN,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,wFAAwF;QACxF,2FAA2F;QAC3F,4FAA4F;QAC5F,sFAAsF;QACtF,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEnF,MAAM,IAAI,GACN,QAAQ,GAAG,KAAK,IAAI,YAAY,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE7C,OAAO;YACH,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,IAAI,KAAK,IAAI;YACtB,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,0FAA0F;YAC1F,iFAAiF;YACjF,iBAAiB;YACjB,iBAAiB,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACvD,CAAC;IACN,CAAC;IAED,wFAAwF;IAChF,aAAa,CAAC,GAAiB,EAAE,MAAiB;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,yFAAyF;IACjF,aAAa,CAAC,MAAiB,EAAE,MAAiB;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CACf,GAAkB,EAClB,QAA8B,EAC9B,MAAiB,EACjB,MAAiB;QAEjB,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACrB,SAAS,EAAE,CAAC;gBACZ,SAAS;YACb,CAAC;YACD,IAAI,SAAS,CAAC,UAAU;gBAAE,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,GAAG,SAAS,uHAAuH;gBAC5I,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE;aACrE,CAAC,CAAC;QACP,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAC3D,uFAAuF;YACvF,wFAAwF;YACxF,iCAAiC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACH,mCAAmC,GAAG,CAAC,IAAI,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,wDAAwD;oBACrI,2IAA2I;gBAC/I,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE;aAChF,CAAC,CAAC;QACP,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EACH,yBAAyB,GAAG,CAAC,IAAI,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,4FAA4F;oBAC/J,sHAAsH;gBAC1H,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE;aACrE,CAAC,CAAC;QACP,CAAC;QAED,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,EAAE,aAAa,EAAE,SAAS,CAAC;QACzE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,gEAAgE,MAAM,CAAC,UAAU,kEAAkE;gBAC5J,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;aAC1C,CAAC,CAAC;QACP,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;OASG;IACO,KAAK,CAAC,kBAAkB,CAC9B,kBAA8C,EAC9C,WAAqB,EACrB,QAA4B;QAE5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACX,4MAA4M,CAC/M,CAAC;QACN,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,eAAe,CAAqB,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACX,mBAAmB,YAAY,yFAAyF,CAC3H,CAAC;QACN,CAAC;QACD,OAAO,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;CACJ,CAAA;AA/VY,YAAY;IAFxB,aAAa,CAAC,wBAAwB,EAAE,cAAc,CAAC;IACvD,aAAa,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;GAC5D,YAAY,CA+VxB;;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,KAAuB,CAAC"}