@nebulacomponents/citable 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 1.6.0 — 2026-07-19
+
+### Added
+
+- Optional read-only connector SDK with explicit non-secret connection state,
+  property discovery, access validation, bounded synchronization, and disconnect.
+- Google Search Console Search Analytics and GA4 Data API adapters that collect
+  declared metrics into immutable observations without storing access tokens.
+
+## 1.5.1 — 2026-07-18
+
+### Fixed
+
+- `Ship release` now explicitly dispatches trusted npm publishing at the newly
+  created tag because GitHub suppresses workflow events generated by its own
+  repository token.
+
 ## 1.5.0 — 2026-07-18
 
 ### Added

package/README.md

@@ -153,6 +153,8 @@ citable apply --input remediation-spec.json          # dry run
 citable apply --input remediation-spec.json --write  # reviewed + hash-locked
 citable monitor [runA runB]
 citable metrics import --provider gsc --input metrics.csv
+citable connect configure --provider gsc --connection-id CONNECTION-GSC --property-id sc-domain:example.com --write
+GSC_ACCESS_TOKEN=... citable connect sync --connection-id CONNECTION-GSC --start-date 2026-06-01 --end-date 2026-06-30
 citable objectives init --input objective.json --write
 citable objectives validate
 citable evaluate OBJECTIVE-PRODUCT_DISCOVERY --ref-date 2026-07-18

package/dist/universal/.agents/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.agents/skills/citable/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

package/dist/universal/.agents/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,

package/dist/universal/.agents/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "managedBy": "citable-cli",
   "provider": "codex",
   "providerName": "OpenAI Codex",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.0",
+  "sourcePackage": "@nebulacomponents/citable@1.6.0",
   "variantPath": ".agents/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:6709d90e247435b08afd543950c810dfc48581374fb220d9c68ad757ea45b25f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -38,7 +38,7 @@
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
@@ -57,9 +57,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:108e48a53c8bd39c312e48d8b62e274c1c7da02cf2da3bc818e078524175558f",
+    "SKILL.md": "sha256:d60d894b72372da0f77185bdec5ed366ee071f82040b84ade578acfff478018b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:acb57a7135b2d7d6e665f67f056e21353023b93835f54def1ae523bf76f1bfb3"
+    "VERSION": "sha256:cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5"
   },
-  "treeHash": "sha256:887e87c19988b711b5e466cdb31b2a2dc9d212cb10f198b82001641aa4a45498"
+  "treeHash": "sha256:f47445faa4a4c734ef5478342653ae6dc89cba8019f6a5cef97008d7a91c705f"
 }

package/dist/universal/.agents/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.claude/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.claude/skills/citable/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

package/dist/universal/.claude/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,

package/dist/universal/.claude/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "managedBy": "citable-cli",
   "provider": "claude",
   "providerName": "Claude Code",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.0",
+  "sourcePackage": "@nebulacomponents/citable@1.6.0",
   "variantPath": ".claude/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:6709d90e247435b08afd543950c810dfc48581374fb220d9c68ad757ea45b25f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -38,7 +38,7 @@
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
@@ -57,9 +57,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:108e48a53c8bd39c312e48d8b62e274c1c7da02cf2da3bc818e078524175558f",
+    "SKILL.md": "sha256:d60d894b72372da0f77185bdec5ed366ee071f82040b84ade578acfff478018b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:acb57a7135b2d7d6e665f67f056e21353023b93835f54def1ae523bf76f1bfb3"
+    "VERSION": "sha256:cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5"
   },
-  "treeHash": "sha256:887e87c19988b711b5e466cdb31b2a2dc9d212cb10f198b82001641aa4a45498"
+  "treeHash": "sha256:f47445faa4a4c734ef5478342653ae6dc89cba8019f6a5cef97008d7a91c705f"
 }

package/dist/universal/.claude/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.cursor/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.cursor/skills/citable/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

package/dist/universal/.cursor/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,

package/dist/universal/.cursor/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "managedBy": "citable-cli",
   "provider": "cursor",
   "providerName": "Cursor",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.0",
+  "sourcePackage": "@nebulacomponents/citable@1.6.0",
   "variantPath": ".cursor/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:6709d90e247435b08afd543950c810dfc48581374fb220d9c68ad757ea45b25f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -38,7 +38,7 @@
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
@@ -57,9 +57,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:108e48a53c8bd39c312e48d8b62e274c1c7da02cf2da3bc818e078524175558f",
+    "SKILL.md": "sha256:d60d894b72372da0f77185bdec5ed366ee071f82040b84ade578acfff478018b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:acb57a7135b2d7d6e665f67f056e21353023b93835f54def1ae523bf76f1bfb3"
+    "VERSION": "sha256:cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5"
   },
-  "treeHash": "sha256:887e87c19988b711b5e466cdb31b2a2dc9d212cb10f198b82001641aa4a45498"
+  "treeHash": "sha256:f47445faa4a4c734ef5478342653ae6dc89cba8019f6a5cef97008d7a91c705f"
 }

package/dist/universal/.cursor/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.gemini/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.gemini/skills/citable/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

package/dist/universal/.gemini/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,

package/dist/universal/.gemini/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "managedBy": "citable-cli",
   "provider": "gemini",
   "providerName": "Gemini CLI",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.0",
+  "sourcePackage": "@nebulacomponents/citable@1.6.0",
   "variantPath": ".gemini/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:6709d90e247435b08afd543950c810dfc48581374fb220d9c68ad757ea45b25f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -38,7 +38,7 @@
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
@@ -57,9 +57,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:108e48a53c8bd39c312e48d8b62e274c1c7da02cf2da3bc818e078524175558f",
+    "SKILL.md": "sha256:d60d894b72372da0f77185bdec5ed366ee071f82040b84ade578acfff478018b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:acb57a7135b2d7d6e665f67f056e21353023b93835f54def1ae523bf76f1bfb3"
+    "VERSION": "sha256:cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5"
   },
-  "treeHash": "sha256:887e87c19988b711b5e466cdb31b2a2dc9d212cb10f198b82001641aa4a45498"
+  "treeHash": "sha256:f47445faa4a4c734ef5478342653ae6dc89cba8019f6a5cef97008d7a91c705f"
 }

package/dist/universal/.gemini/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.github/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.github/skills/citable/VERSION

@@ -1 +1 @@
-1.5.0
+1.6.0

package/dist/universal/.github/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,

package/dist/universal/.github/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "managedBy": "citable-cli",
   "provider": "github",
   "providerName": "GitHub Copilot",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.0",
+  "sourcePackage": "@nebulacomponents/citable@1.6.0",
   "variantPath": ".github/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:6709d90e247435b08afd543950c810dfc48581374fb220d9c68ad757ea45b25f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -38,7 +38,7 @@
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
@@ -57,9 +57,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:108e48a53c8bd39c312e48d8b62e274c1c7da02cf2da3bc818e078524175558f",
+    "SKILL.md": "sha256:d60d894b72372da0f77185bdec5ed366ee071f82040b84ade578acfff478018b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:acb57a7135b2d7d6e665f67f056e21353023b93835f54def1ae523bf76f1bfb3"
+    "VERSION": "sha256:cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5"
   },
-  "treeHash": "sha256:887e87c19988b711b5e466cdb31b2a2dc9d212cb10f198b82001641aa4a45498"
+  "treeHash": "sha256:f47445faa4a4c734ef5478342653ae6dc89cba8019f6a5cef97008d7a91c705f"
 }

package/dist/universal/.github/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.kiro/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.0
+version: 1.6.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -89,6 +89,12 @@ citable observe <mode> [options]      # render/index/citation/log/passage/consen
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]