@particle-academy/google-ads-ui 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@particle-academy/google-ads-ui`,
 `@particle-academy/google-ads-js`, `particle-academy/google-ads-php` and
 `fancy-google-ads`.
 
+## [0.3.0] — 2026-11-08
+
+### Added
+
+- **One Google consent grant, shared by every Google connector** (`oauth.grant:
+  "google"`), for an org-level Google connection: one OAuth client, one consent
+  and one refresh token per person, with each feature's scopes asked for when it
+  is first used. Declared in the manifest, the `-ui` package's OAuth constant,
+  the README and the registry index:
+  - `authorizeParams`: `access_type=offline` and `include_granted_scopes=true`.
+    A refresh token comes back only on the FIRST code exchange, so keep the stored
+    one when an exchange returns none.
+  - `revoke`: POST `https://oauth2.googleapis.com/revoke` with `token`, and
+    `scope: "grant"`. **Revoking removes the person's WHOLE Google grant, every
+    Google connector**, so a per-feature disconnect stops using that feature's
+    scopes locally and only a full Google disconnect revokes.
+  - `identity`: identify the account by the id_token's `sub` (request `openid`;
+    issuer `https://accounts.google.com` or `accounts.google.com`; audience is
+    the `clientId`), never by email, which Google says is neither unique nor
+    permanent.
+  `restrictedScopes` is empty: none of this connector's scopes is restricted.
+
+  Nothing a request sends has changed; this is what a host needs to run the
+  connection.
+
 ## [0.2.0] — 2026-11-08
 
 ### Added

package/README.md

@@ -59,6 +59,13 @@ Google Ads uses OAuth2 (authorization_code). The package DECLARES the exchange;
 - **Scopes** — `https://www.googleapis.com/auth/adwords`
 - **Access token lifetime** — 3600 seconds (1 hours). A host that never refreshes works all afternoon and is broken by morning.
 
+**One consent grant, shared** (`grant: "google"`). Every connector declaring the same grant can run on ONE OAuth client, with one consent and one refresh token per person.
+
+- **Authorize with** `access_type=offline`, `include_granted_scopes=true`. Ask for a feature's scopes when it is first used; the new token covers every scope granted before. A refresh token comes back only on the FIRST exchange, so keep the stored one when an exchange returns none.
+- **Revoke** — POST https://oauth2.googleapis.com/revoke with `token`. **It removes the WHOLE grant**: every connector sharing it, not only this one. A per-feature disconnect stops using that feature's scopes locally; only a full disconnect revokes.
+- **Identify the account by `sub`**: request `openid`, then verify the token response's id_token (issuer `https://accounts.google.com` or `accounts.google.com`, keys at https://www.googleapis.com/oauth2/v3/certs, audience = `clientId`). Never key a connection by email.
+- **No restricted scopes** in this connector.
+
 The refresh tokens do **not** rotate: the same one is reusable, so a refresh may safely be retried and may run concurrently. Stated rather than assumed, because the opposite — a provider that spends the token and revokes the grant on a replay — looks identical until it happens.
 
 ### The estate

package/dist/index.cjs

@@ -65,7 +65,28 @@ var GOOGLE_ADS_OAUTH = {
   "accessTokenCredential": "accessToken",
   "refreshTokenCredential": "refreshToken",
   "refreshTokenRotates": false,
-  "accessTokenTtlSeconds": 3600
+  "accessTokenTtlSeconds": 3600,
+  "grant": "google",
+  "authorizeParams": {
+    "access_type": "offline",
+    "include_granted_scopes": "true"
+  },
+  "revoke": {
+    "url": "https://oauth2.googleapis.com/revoke",
+    "param": "token",
+    "scope": "grant"
+  },
+  "identity": {
+    "scope": "openid",
+    "claim": "sub",
+    "issuers": [
+      "https://accounts.google.com",
+      "accounts.google.com"
+    ],
+    "jwksUrl": "https://www.googleapis.com/oauth2/v3/certs",
+    "audienceCredential": "clientId"
+  },
+  "restrictedScopes": []
 };
 function googleAdsMeta(role, operation, docs) {
   return { ...GOOGLE_ADS_SERVICE, role, operation, docs };

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/service.ts","../src/kinds/customer-list-accessible.ts","../src/index.ts"],"names":["defineConnectorKind","summarize"],"mappings":";;;;;AAmCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,kBAAA,GAAqB;AAAA,EAChC,OAAA,EAAS,YAAA;AAAA,EACT,YAAA,EAAc,YAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,sBAAA,GAAyB;AAAA,EACpC;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,gBAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,iBAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,MAAA,EAAQ;AAAA;AAEZ;AAoBO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB;AAC3B;AAGO,SAAS,aAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,kBAAA,EAAoB,IAAA,EAAM,WAAW,IAAA,EAAK;AACxD;ACtIO,IAAM,6BAAA,GAAgC;AACtC,IAAM,kCAAA,GAAqC;AAE3C,IAAM,6BAAA,GAAgC,aAAA,CAAc,QAAA,EAAU,oCAAA,EAAsC,wGAAwG;AAU5M,IAAM,+BAAA,GAAiD;AAAA,EAC5D;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgDA,+BAAoB,6BAAA,EAA+B;AAAA,EAC9G,IAAA,EAAM,6BAAA;AAAA,EACN,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,KAAA,EAAO,iCAAA;AAAA,EACP,WAAA,EAAa,mNAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,+BAAA;AAAA,EACb,cAAc,EAAC;AAAA,EACf,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACbC,oBAAA,CAAU,6BAAA,EAA+B,QAAmC,oCAAoC;AACpH,CAAC;;;AClCM,IAAM,gBAAA,GAAyC;AAAA,EACpD;AACF","file":"index.cjs","sourcesContent":["/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's identity on the authoring surface, shared by every Google Ads\n * node.\n *\n * This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n *\n * ## The sandbox trap\n *\n * Use a dedicated Google Ads test manager and test client account. Test and\n * production hierarchies cannot interact; test ads never serve or incur cost,\n * but some features such as billing, conversion uploads and serving reports\n * cannot be exercised there.\n */\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/**\n * The connector API version this package was GENERATED against.\n *\n * A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n */\nexport const CONNECTOR_API_VERSION = 1;\n\n/** The parts of a connector's identity that belong to the SERVICE, not the node. */\nexport const GOOGLE_ADS_SERVICE = {\n  service: \"google_ads\",\n  serviceTitle: \"Google Ads\",\n  domain: \"marketing\",\n  sandbox: \"separate-account\",\n} as const satisfies Pick<ConnectorMeta, \"service\" | \"serviceTitle\" | \"domain\" | \"sandbox\">;\n\n/**\n * Every connector domain weaver knows, pinned against fancy-flow's union.\n *\n * A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n */\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n  \"payments\",\n  \"commerce\",\n  \"messaging\",\n  \"email\",\n  \"crm\",\n  \"support\",\n  \"storage\",\n  \"calendar\",\n  \"productivity\",\n  \"database\",\n  \"devtools\",\n  \"analytics\",\n  \"marketing\",\n  \"ai\",\n  \"forms\",\n  \"hr\",\n  \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/** The credentials a Google Ads connection holds. */\nexport const GOOGLE_ADS_CREDENTIALS = [\n  {\n    \"key\": \"clientId\",\n    \"label\": \"OAuth client ID\",\n    \"scope\": \"provider\",\n    \"secret\": false,\n    \"help\": \"The Google Cloud OAuth client shared by the installation.\"\n  },\n  {\n    \"key\": \"clientSecret\",\n    \"label\": \"OAuth client secret\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The matching Google Cloud OAuth client secret.\"\n  },\n  {\n    \"key\": \"developerToken\",\n    \"label\": \"Developer token\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The 22-character Google Ads API developer token from the manager account's API Center. Google says to treat it like a password; one token identifies the installed application.\"\n  },\n  {\n    \"key\": \"accessToken\",\n    \"label\": \"Access token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The connected Google user's one-hour OAuth access token.\"\n  },\n  {\n    \"key\": \"refreshToken\",\n    \"label\": \"Refresh token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The reusable offline token used to replace expired access tokens.\"\n  },\n  {\n    \"key\": \"loginCustomerId\",\n    \"label\": \"Manager customer ID\",\n    \"scope\": \"account\",\n    \"secret\": false,\n    \"optional\": true,\n    \"help\": \"Optional. The manager account's 10-digit customer ID without hyphens. Required when the OAuth user reaches a client through that manager; omit it for direct access.\"\n  }\n] as const;\n\n/**\n * The OAuth2 exchange Google Ads requires — DECLARED here, performed by the\n * host.\n *\n * A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n *\n * The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n *\n * Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n */\nexport const GOOGLE_ADS_OAUTH = {\n  \"flow\": \"authorization_code\",\n  \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n  \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n  \"scopes\": [\n    \"https://www.googleapis.com/auth/adwords\"\n  ],\n  \"accessTokenCredential\": \"accessToken\",\n  \"refreshTokenCredential\": \"refreshToken\",\n  \"refreshTokenRotates\": false,\n  \"accessTokenTtlSeconds\": 3600\n} as const;\n\n/** Build a Google Ads node's connector metadata from the operation it performs. */\nexport function googleAdsMeta(\n  role: ConnectorMeta[\"role\"],\n  operation: string,\n  docs: string,\n): ConnectorMeta {\n  return { ...GOOGLE_ADS_SERVICE, role, operation, docs };\n}\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/actions/customer-list-accessible.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/customer-list-accessible.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Accessible Google Ads customers — List Google Ads customer resource names\n * directly accessible to the authenticated user. Manager-linked client\n * accounts are not included; query the account hierarchy after choosing a\n * directly accessible manager.\n *\n * https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\n */\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAdsMeta } from \"../service.js\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_KIND = \"@particle-academy/google_ads_customer_list\";\nexport const GOOGLE_ADS_CUSTOMER_LIST_OPERATION = \"customer_list_accessible\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_META = googleAdsMeta(\"action\", \"list directly accessible customers\", \"https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\");\n\n/**\n * What this node emits — the \"ingredients\" a downstream node can reference.\n *\n * fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n */\nexport const GOOGLE_ADS_CUSTOMER_LIST_OUTPUT: OutputField[] = [\n  {\n    \"path\": \"data.resourceNames\",\n    \"type\": \"array\",\n    \"description\": \"Customer resource names in customers/{customer_id} form that the OAuth identity can access directly.\"\n  }\n];\n\nexport const googleAdsCustomerListKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ADS_CUSTOMER_LIST_META, {\n  name: GOOGLE_ADS_CUSTOMER_LIST_KIND,\n  aliases: [\"google_ads_customer_list\"],\n  label: \"Accessible Google Ads customers\",\n  description: \"List Google Ads customer resource names directly accessible to the authenticated user. Manager-linked client accounts are not included; query the account hierarchy after choosing a directly accessible manager.\",\n  inputs: [{ id: \"in\" }],\n  outputs: [{ id: \"out\" }],\n  sideEffects: \"none\",\n  outputShape: GOOGLE_ADS_CUSTOMER_LIST_OUTPUT,\n  configSchema: [],\n  defaultConfig: {\n    \"mode\": \"auto\"\n  },\n  renderBody: ({ config }) =>\n    summarize(GOOGLE_ADS_CUSTOMER_LIST_META, config as Record<string, unknown>, \"list directly accessible customers\"),\n});\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's node kinds for fancy-flow.\n *\n * Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n */\n\nexport * from \"./service.js\";\nexport * from \"./kinds/customer-list-accessible.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAdsCustomerListKind } from \"./kinds/customer-list-accessible.js\";\n\n/** Every Google Ads kind, for a host that registers the lot. */\nexport const GOOGLE_ADS_KINDS: NodeKindDefinition[] = [\n  googleAdsCustomerListKind,\n];\n"]}
+{"version":3,"sources":["../src/service.ts","../src/kinds/customer-list-accessible.ts","../src/index.ts"],"names":["defineConnectorKind","summarize"],"mappings":";;;;;AAmCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,kBAAA,GAAqB;AAAA,EAChC,OAAA,EAAS,YAAA;AAAA,EACT,YAAA,EAAc,YAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,sBAAA,GAAyB;AAAA,EACpC;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,gBAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,iBAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,MAAA,EAAQ;AAAA;AAEZ;AA2BO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB,IAAA;AAAA,EACzB,OAAA,EAAS,QAAA;AAAA,EACT,iBAAA,EAAmB;AAAA,IACjB,aAAA,EAAe,SAAA;AAAA,IACf,wBAAA,EAA0B;AAAA,GAC5B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,KAAA,EAAO,sCAAA;AAAA,IACP,OAAA,EAAS,OAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAAA,EACA,UAAA,EAAY;AAAA,IACV,OAAA,EAAS,QAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,MACT,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,SAAA,EAAW,4CAAA;AAAA,IACX,oBAAA,EAAsB;AAAA,GACxB;AAAA,EACA,oBAAoB;AACtB;AAGO,SAAS,aAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,kBAAA,EAAoB,IAAA,EAAM,WAAW,IAAA,EAAK;AACxD;AClKO,IAAM,6BAAA,GAAgC;AACtC,IAAM,kCAAA,GAAqC;AAE3C,IAAM,6BAAA,GAAgC,aAAA,CAAc,QAAA,EAAU,oCAAA,EAAsC,wGAAwG;AAU5M,IAAM,+BAAA,GAAiD;AAAA,EAC5D;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgDA,+BAAoB,6BAAA,EAA+B;AAAA,EAC9G,IAAA,EAAM,6BAAA;AAAA,EACN,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,KAAA,EAAO,iCAAA;AAAA,EACP,WAAA,EAAa,mNAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,+BAAA;AAAA,EACb,cAAc,EAAC;AAAA,EACf,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACbC,oBAAA,CAAU,6BAAA,EAA+B,QAAmC,oCAAoC;AACpH,CAAC;;;AClCM,IAAM,gBAAA,GAAyC;AAAA,EACpD;AACF","file":"index.cjs","sourcesContent":["/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's identity on the authoring surface, shared by every Google Ads\n * node.\n *\n * This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n *\n * ## The sandbox trap\n *\n * Use a dedicated Google Ads test manager and test client account. Test and\n * production hierarchies cannot interact; test ads never serve or incur cost,\n * but some features such as billing, conversion uploads and serving reports\n * cannot be exercised there.\n */\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/**\n * The connector API version this package was GENERATED against.\n *\n * A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n */\nexport const CONNECTOR_API_VERSION = 1;\n\n/** The parts of a connector's identity that belong to the SERVICE, not the node. */\nexport const GOOGLE_ADS_SERVICE = {\n  service: \"google_ads\",\n  serviceTitle: \"Google Ads\",\n  domain: \"marketing\",\n  sandbox: \"separate-account\",\n} as const satisfies Pick<ConnectorMeta, \"service\" | \"serviceTitle\" | \"domain\" | \"sandbox\">;\n\n/**\n * Every connector domain weaver knows, pinned against fancy-flow's union.\n *\n * A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n */\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n  \"payments\",\n  \"commerce\",\n  \"messaging\",\n  \"email\",\n  \"crm\",\n  \"support\",\n  \"storage\",\n  \"calendar\",\n  \"productivity\",\n  \"database\",\n  \"devtools\",\n  \"analytics\",\n  \"marketing\",\n  \"ai\",\n  \"forms\",\n  \"hr\",\n  \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/** The credentials a Google Ads connection holds. */\nexport const GOOGLE_ADS_CREDENTIALS = [\n  {\n    \"key\": \"clientId\",\n    \"label\": \"OAuth client ID\",\n    \"scope\": \"provider\",\n    \"secret\": false,\n    \"help\": \"The Google Cloud OAuth client shared by the installation.\"\n  },\n  {\n    \"key\": \"clientSecret\",\n    \"label\": \"OAuth client secret\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The matching Google Cloud OAuth client secret.\"\n  },\n  {\n    \"key\": \"developerToken\",\n    \"label\": \"Developer token\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The 22-character Google Ads API developer token from the manager account's API Center. Google says to treat it like a password; one token identifies the installed application.\"\n  },\n  {\n    \"key\": \"accessToken\",\n    \"label\": \"Access token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The connected Google user's one-hour OAuth access token.\"\n  },\n  {\n    \"key\": \"refreshToken\",\n    \"label\": \"Refresh token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The reusable offline token used to replace expired access tokens.\"\n  },\n  {\n    \"key\": \"loginCustomerId\",\n    \"label\": \"Manager customer ID\",\n    \"scope\": \"account\",\n    \"secret\": false,\n    \"optional\": true,\n    \"help\": \"Optional. The manager account's 10-digit customer ID without hyphens. Required when the OAuth user reaches a client through that manager; omit it for direct access.\"\n  }\n] as const;\n\n/**\n * The OAuth2 exchange Google Ads requires — DECLARED here, performed by the\n * host.\n *\n * A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n *\n * The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n *\n * Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n *\n * Its consent grant is SHARED with every connector declaring grant \"google\":\n * one OAuth client, one consent and one refresh token per person, scopes added\n * as features are first used (authorizeParams). Revoking removes the WHOLE\n * grant, so only a full disconnect revokes; a per-feature disconnect stops\n * using the scope locally. Identify the account by the id_token's sub, never\n * by email.\n */\nexport const GOOGLE_ADS_OAUTH = {\n  \"flow\": \"authorization_code\",\n  \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n  \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n  \"scopes\": [\n    \"https://www.googleapis.com/auth/adwords\"\n  ],\n  \"accessTokenCredential\": \"accessToken\",\n  \"refreshTokenCredential\": \"refreshToken\",\n  \"refreshTokenRotates\": false,\n  \"accessTokenTtlSeconds\": 3600,\n  \"grant\": \"google\",\n  \"authorizeParams\": {\n    \"access_type\": \"offline\",\n    \"include_granted_scopes\": \"true\"\n  },\n  \"revoke\": {\n    \"url\": \"https://oauth2.googleapis.com/revoke\",\n    \"param\": \"token\",\n    \"scope\": \"grant\"\n  },\n  \"identity\": {\n    \"scope\": \"openid\",\n    \"claim\": \"sub\",\n    \"issuers\": [\n      \"https://accounts.google.com\",\n      \"accounts.google.com\"\n    ],\n    \"jwksUrl\": \"https://www.googleapis.com/oauth2/v3/certs\",\n    \"audienceCredential\": \"clientId\"\n  },\n  \"restrictedScopes\": []\n} as const;\n\n/** Build a Google Ads node's connector metadata from the operation it performs. */\nexport function googleAdsMeta(\n  role: ConnectorMeta[\"role\"],\n  operation: string,\n  docs: string,\n): ConnectorMeta {\n  return { ...GOOGLE_ADS_SERVICE, role, operation, docs };\n}\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/actions/customer-list-accessible.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/customer-list-accessible.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Accessible Google Ads customers — List Google Ads customer resource names\n * directly accessible to the authenticated user. Manager-linked client\n * accounts are not included; query the account hierarchy after choosing a\n * directly accessible manager.\n *\n * https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\n */\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAdsMeta } from \"../service.js\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_KIND = \"@particle-academy/google_ads_customer_list\";\nexport const GOOGLE_ADS_CUSTOMER_LIST_OPERATION = \"customer_list_accessible\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_META = googleAdsMeta(\"action\", \"list directly accessible customers\", \"https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\");\n\n/**\n * What this node emits — the \"ingredients\" a downstream node can reference.\n *\n * fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n */\nexport const GOOGLE_ADS_CUSTOMER_LIST_OUTPUT: OutputField[] = [\n  {\n    \"path\": \"data.resourceNames\",\n    \"type\": \"array\",\n    \"description\": \"Customer resource names in customers/{customer_id} form that the OAuth identity can access directly.\"\n  }\n];\n\nexport const googleAdsCustomerListKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ADS_CUSTOMER_LIST_META, {\n  name: GOOGLE_ADS_CUSTOMER_LIST_KIND,\n  aliases: [\"google_ads_customer_list\"],\n  label: \"Accessible Google Ads customers\",\n  description: \"List Google Ads customer resource names directly accessible to the authenticated user. Manager-linked client accounts are not included; query the account hierarchy after choosing a directly accessible manager.\",\n  inputs: [{ id: \"in\" }],\n  outputs: [{ id: \"out\" }],\n  sideEffects: \"none\",\n  outputShape: GOOGLE_ADS_CUSTOMER_LIST_OUTPUT,\n  configSchema: [],\n  defaultConfig: {\n    \"mode\": \"auto\"\n  },\n  renderBody: ({ config }) =>\n    summarize(GOOGLE_ADS_CUSTOMER_LIST_META, config as Record<string, unknown>, \"list directly accessible customers\"),\n});\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's node kinds for fancy-flow.\n *\n * Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n */\n\nexport * from \"./service.js\";\nexport * from \"./kinds/customer-list-accessible.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAdsCustomerListKind } from \"./kinds/customer-list-accessible.js\";\n\n/** Every Google Ads kind, for a host that registers the lot. */\nexport const GOOGLE_ADS_KINDS: NodeKindDefinition[] = [\n  googleAdsCustomerListKind,\n];\n"]}

package/dist/index.d.cts

@@ -98,6 +98,13 @@ declare const GOOGLE_ADS_CREDENTIALS: readonly [{
  * safely be retried and may run concurrently. That is stated rather than
  * assumed because the opposite — a provider that spends the token and revokes
  * the grant on a replay — looks identical until it happens.
+ *
+ * Its consent grant is SHARED with every connector declaring grant "google":
+ * one OAuth client, one consent and one refresh token per person, scopes added
+ * as features are first used (authorizeParams). Revoking removes the WHOLE
+ * grant, so only a full disconnect revokes; a per-feature disconnect stops
+ * using the scope locally. Identify the account by the id_token's sub, never
+ * by email.
  */
 declare const GOOGLE_ADS_OAUTH: {
     readonly flow: "authorization_code";
@@ -108,6 +115,24 @@ declare const GOOGLE_ADS_OAUTH: {
     readonly refreshTokenCredential: "refreshToken";
     readonly refreshTokenRotates: false;
     readonly accessTokenTtlSeconds: 3600;
+    readonly grant: "google";
+    readonly authorizeParams: {
+        readonly access_type: "offline";
+        readonly include_granted_scopes: "true";
+    };
+    readonly revoke: {
+        readonly url: "https://oauth2.googleapis.com/revoke";
+        readonly param: "token";
+        readonly scope: "grant";
+    };
+    readonly identity: {
+        readonly scope: "openid";
+        readonly claim: "sub";
+        readonly issuers: readonly ["https://accounts.google.com", "accounts.google.com"];
+        readonly jwksUrl: "https://www.googleapis.com/oauth2/v3/certs";
+        readonly audienceCredential: "clientId";
+    };
+    readonly restrictedScopes: readonly [];
 };
 /** Build a Google Ads node's connector metadata from the operation it performs. */
 declare function googleAdsMeta(role: ConnectorMeta["role"], operation: string, docs: string): ConnectorMeta;

package/dist/index.d.ts

@@ -98,6 +98,13 @@ declare const GOOGLE_ADS_CREDENTIALS: readonly [{
  * safely be retried and may run concurrently. That is stated rather than
  * assumed because the opposite — a provider that spends the token and revokes
  * the grant on a replay — looks identical until it happens.
+ *
+ * Its consent grant is SHARED with every connector declaring grant "google":
+ * one OAuth client, one consent and one refresh token per person, scopes added
+ * as features are first used (authorizeParams). Revoking removes the WHOLE
+ * grant, so only a full disconnect revokes; a per-feature disconnect stops
+ * using the scope locally. Identify the account by the id_token's sub, never
+ * by email.
  */
 declare const GOOGLE_ADS_OAUTH: {
     readonly flow: "authorization_code";
@@ -108,6 +115,24 @@ declare const GOOGLE_ADS_OAUTH: {
     readonly refreshTokenCredential: "refreshToken";
     readonly refreshTokenRotates: false;
     readonly accessTokenTtlSeconds: 3600;
+    readonly grant: "google";
+    readonly authorizeParams: {
+        readonly access_type: "offline";
+        readonly include_granted_scopes: "true";
+    };
+    readonly revoke: {
+        readonly url: "https://oauth2.googleapis.com/revoke";
+        readonly param: "token";
+        readonly scope: "grant";
+    };
+    readonly identity: {
+        readonly scope: "openid";
+        readonly claim: "sub";
+        readonly issuers: readonly ["https://accounts.google.com", "accounts.google.com"];
+        readonly jwksUrl: "https://www.googleapis.com/oauth2/v3/certs";
+        readonly audienceCredential: "clientId";
+    };
+    readonly restrictedScopes: readonly [];
 };
 /** Build a Google Ads node's connector metadata from the operation it performs. */
 declare function googleAdsMeta(role: ConnectorMeta["role"], operation: string, docs: string): ConnectorMeta;

package/dist/index.js

@@ -63,7 +63,28 @@ var GOOGLE_ADS_OAUTH = {
   "accessTokenCredential": "accessToken",
   "refreshTokenCredential": "refreshToken",
   "refreshTokenRotates": false,
-  "accessTokenTtlSeconds": 3600
+  "accessTokenTtlSeconds": 3600,
+  "grant": "google",
+  "authorizeParams": {
+    "access_type": "offline",
+    "include_granted_scopes": "true"
+  },
+  "revoke": {
+    "url": "https://oauth2.googleapis.com/revoke",
+    "param": "token",
+    "scope": "grant"
+  },
+  "identity": {
+    "scope": "openid",
+    "claim": "sub",
+    "issuers": [
+      "https://accounts.google.com",
+      "accounts.google.com"
+    ],
+    "jwksUrl": "https://www.googleapis.com/oauth2/v3/certs",
+    "audienceCredential": "clientId"
+  },
+  "restrictedScopes": []
 };
 function googleAdsMeta(role, operation, docs) {
   return { ...GOOGLE_ADS_SERVICE, role, operation, docs };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/service.ts","../src/kinds/customer-list-accessible.ts","../src/index.ts"],"names":[],"mappings":";;;AAmCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,kBAAA,GAAqB;AAAA,EAChC,OAAA,EAAS,YAAA;AAAA,EACT,YAAA,EAAc,YAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,sBAAA,GAAyB;AAAA,EACpC;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,gBAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,iBAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,MAAA,EAAQ;AAAA;AAEZ;AAoBO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB;AAC3B;AAGO,SAAS,aAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,kBAAA,EAAoB,IAAA,EAAM,WAAW,IAAA,EAAK;AACxD;ACtIO,IAAM,6BAAA,GAAgC;AACtC,IAAM,kCAAA,GAAqC;AAE3C,IAAM,6BAAA,GAAgC,aAAA,CAAc,QAAA,EAAU,oCAAA,EAAsC,wGAAwG;AAU5M,IAAM,+BAAA,GAAiD;AAAA,EAC5D;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgD,oBAAoB,6BAAA,EAA+B;AAAA,EAC9G,IAAA,EAAM,6BAAA;AAAA,EACN,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,KAAA,EAAO,iCAAA;AAAA,EACP,WAAA,EAAa,mNAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,+BAAA;AAAA,EACb,cAAc,EAAC;AAAA,EACf,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACb,SAAA,CAAU,6BAAA,EAA+B,QAAmC,oCAAoC;AACpH,CAAC;;;AClCM,IAAM,gBAAA,GAAyC;AAAA,EACpD;AACF","file":"index.js","sourcesContent":["/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's identity on the authoring surface, shared by every Google Ads\n * node.\n *\n * This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n *\n * ## The sandbox trap\n *\n * Use a dedicated Google Ads test manager and test client account. Test and\n * production hierarchies cannot interact; test ads never serve or incur cost,\n * but some features such as billing, conversion uploads and serving reports\n * cannot be exercised there.\n */\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/**\n * The connector API version this package was GENERATED against.\n *\n * A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n */\nexport const CONNECTOR_API_VERSION = 1;\n\n/** The parts of a connector's identity that belong to the SERVICE, not the node. */\nexport const GOOGLE_ADS_SERVICE = {\n  service: \"google_ads\",\n  serviceTitle: \"Google Ads\",\n  domain: \"marketing\",\n  sandbox: \"separate-account\",\n} as const satisfies Pick<ConnectorMeta, \"service\" | \"serviceTitle\" | \"domain\" | \"sandbox\">;\n\n/**\n * Every connector domain weaver knows, pinned against fancy-flow's union.\n *\n * A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n */\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n  \"payments\",\n  \"commerce\",\n  \"messaging\",\n  \"email\",\n  \"crm\",\n  \"support\",\n  \"storage\",\n  \"calendar\",\n  \"productivity\",\n  \"database\",\n  \"devtools\",\n  \"analytics\",\n  \"marketing\",\n  \"ai\",\n  \"forms\",\n  \"hr\",\n  \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/** The credentials a Google Ads connection holds. */\nexport const GOOGLE_ADS_CREDENTIALS = [\n  {\n    \"key\": \"clientId\",\n    \"label\": \"OAuth client ID\",\n    \"scope\": \"provider\",\n    \"secret\": false,\n    \"help\": \"The Google Cloud OAuth client shared by the installation.\"\n  },\n  {\n    \"key\": \"clientSecret\",\n    \"label\": \"OAuth client secret\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The matching Google Cloud OAuth client secret.\"\n  },\n  {\n    \"key\": \"developerToken\",\n    \"label\": \"Developer token\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The 22-character Google Ads API developer token from the manager account's API Center. Google says to treat it like a password; one token identifies the installed application.\"\n  },\n  {\n    \"key\": \"accessToken\",\n    \"label\": \"Access token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The connected Google user's one-hour OAuth access token.\"\n  },\n  {\n    \"key\": \"refreshToken\",\n    \"label\": \"Refresh token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The reusable offline token used to replace expired access tokens.\"\n  },\n  {\n    \"key\": \"loginCustomerId\",\n    \"label\": \"Manager customer ID\",\n    \"scope\": \"account\",\n    \"secret\": false,\n    \"optional\": true,\n    \"help\": \"Optional. The manager account's 10-digit customer ID without hyphens. Required when the OAuth user reaches a client through that manager; omit it for direct access.\"\n  }\n] as const;\n\n/**\n * The OAuth2 exchange Google Ads requires — DECLARED here, performed by the\n * host.\n *\n * A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n *\n * The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n *\n * Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n */\nexport const GOOGLE_ADS_OAUTH = {\n  \"flow\": \"authorization_code\",\n  \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n  \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n  \"scopes\": [\n    \"https://www.googleapis.com/auth/adwords\"\n  ],\n  \"accessTokenCredential\": \"accessToken\",\n  \"refreshTokenCredential\": \"refreshToken\",\n  \"refreshTokenRotates\": false,\n  \"accessTokenTtlSeconds\": 3600\n} as const;\n\n/** Build a Google Ads node's connector metadata from the operation it performs. */\nexport function googleAdsMeta(\n  role: ConnectorMeta[\"role\"],\n  operation: string,\n  docs: string,\n): ConnectorMeta {\n  return { ...GOOGLE_ADS_SERVICE, role, operation, docs };\n}\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/actions/customer-list-accessible.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/customer-list-accessible.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Accessible Google Ads customers — List Google Ads customer resource names\n * directly accessible to the authenticated user. Manager-linked client\n * accounts are not included; query the account hierarchy after choosing a\n * directly accessible manager.\n *\n * https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\n */\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAdsMeta } from \"../service.js\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_KIND = \"@particle-academy/google_ads_customer_list\";\nexport const GOOGLE_ADS_CUSTOMER_LIST_OPERATION = \"customer_list_accessible\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_META = googleAdsMeta(\"action\", \"list directly accessible customers\", \"https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\");\n\n/**\n * What this node emits — the \"ingredients\" a downstream node can reference.\n *\n * fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n */\nexport const GOOGLE_ADS_CUSTOMER_LIST_OUTPUT: OutputField[] = [\n  {\n    \"path\": \"data.resourceNames\",\n    \"type\": \"array\",\n    \"description\": \"Customer resource names in customers/{customer_id} form that the OAuth identity can access directly.\"\n  }\n];\n\nexport const googleAdsCustomerListKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ADS_CUSTOMER_LIST_META, {\n  name: GOOGLE_ADS_CUSTOMER_LIST_KIND,\n  aliases: [\"google_ads_customer_list\"],\n  label: \"Accessible Google Ads customers\",\n  description: \"List Google Ads customer resource names directly accessible to the authenticated user. Manager-linked client accounts are not included; query the account hierarchy after choosing a directly accessible manager.\",\n  inputs: [{ id: \"in\" }],\n  outputs: [{ id: \"out\" }],\n  sideEffects: \"none\",\n  outputShape: GOOGLE_ADS_CUSTOMER_LIST_OUTPUT,\n  configSchema: [],\n  defaultConfig: {\n    \"mode\": \"auto\"\n  },\n  renderBody: ({ config }) =>\n    summarize(GOOGLE_ADS_CUSTOMER_LIST_META, config as Record<string, unknown>, \"list directly accessible customers\"),\n});\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's node kinds for fancy-flow.\n *\n * Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n */\n\nexport * from \"./service.js\";\nexport * from \"./kinds/customer-list-accessible.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAdsCustomerListKind } from \"./kinds/customer-list-accessible.js\";\n\n/** Every Google Ads kind, for a host that registers the lot. */\nexport const GOOGLE_ADS_KINDS: NodeKindDefinition[] = [\n  googleAdsCustomerListKind,\n];\n"]}
+{"version":3,"sources":["../src/service.ts","../src/kinds/customer-list-accessible.ts","../src/index.ts"],"names":[],"mappings":";;;AAmCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,kBAAA,GAAqB;AAAA,EAChC,OAAA,EAAS,YAAA;AAAA,EACT,YAAA,EAAc,YAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,sBAAA,GAAyB;AAAA,EACpC;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,gBAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,iBAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,UAAA,EAAY,IAAA;AAAA,IACZ,MAAA,EAAQ;AAAA;AAEZ;AA2BO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB,IAAA;AAAA,EACzB,OAAA,EAAS,QAAA;AAAA,EACT,iBAAA,EAAmB;AAAA,IACjB,aAAA,EAAe,SAAA;AAAA,IACf,wBAAA,EAA0B;AAAA,GAC5B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,KAAA,EAAO,sCAAA;AAAA,IACP,OAAA,EAAS,OAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAAA,EACA,UAAA,EAAY;AAAA,IACV,OAAA,EAAS,QAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,MACT,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,SAAA,EAAW,4CAAA;AAAA,IACX,oBAAA,EAAsB;AAAA,GACxB;AAAA,EACA,oBAAoB;AACtB;AAGO,SAAS,aAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,kBAAA,EAAoB,IAAA,EAAM,WAAW,IAAA,EAAK;AACxD;AClKO,IAAM,6BAAA,GAAgC;AACtC,IAAM,kCAAA,GAAqC;AAE3C,IAAM,6BAAA,GAAgC,aAAA,CAAc,QAAA,EAAU,oCAAA,EAAsC,wGAAwG;AAU5M,IAAM,+BAAA,GAAiD;AAAA,EAC5D;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgD,oBAAoB,6BAAA,EAA+B;AAAA,EAC9G,IAAA,EAAM,6BAAA;AAAA,EACN,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,KAAA,EAAO,iCAAA;AAAA,EACP,WAAA,EAAa,mNAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,+BAAA;AAAA,EACb,cAAc,EAAC;AAAA,EACf,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACb,SAAA,CAAU,6BAAA,EAA+B,QAAmC,oCAAoC;AACpH,CAAC;;;AClCM,IAAM,gBAAA,GAAyC;AAAA,EACpD;AACF","file":"index.js","sourcesContent":["/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's identity on the authoring surface, shared by every Google Ads\n * node.\n *\n * This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n *\n * ## The sandbox trap\n *\n * Use a dedicated Google Ads test manager and test client account. Test and\n * production hierarchies cannot interact; test ads never serve or incur cost,\n * but some features such as billing, conversion uploads and serving reports\n * cannot be exercised there.\n */\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/**\n * The connector API version this package was GENERATED against.\n *\n * A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n */\nexport const CONNECTOR_API_VERSION = 1;\n\n/** The parts of a connector's identity that belong to the SERVICE, not the node. */\nexport const GOOGLE_ADS_SERVICE = {\n  service: \"google_ads\",\n  serviceTitle: \"Google Ads\",\n  domain: \"marketing\",\n  sandbox: \"separate-account\",\n} as const satisfies Pick<ConnectorMeta, \"service\" | \"serviceTitle\" | \"domain\" | \"sandbox\">;\n\n/**\n * Every connector domain weaver knows, pinned against fancy-flow's union.\n *\n * A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n */\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n  \"payments\",\n  \"commerce\",\n  \"messaging\",\n  \"email\",\n  \"crm\",\n  \"support\",\n  \"storage\",\n  \"calendar\",\n  \"productivity\",\n  \"database\",\n  \"devtools\",\n  \"analytics\",\n  \"marketing\",\n  \"ai\",\n  \"forms\",\n  \"hr\",\n  \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/** The credentials a Google Ads connection holds. */\nexport const GOOGLE_ADS_CREDENTIALS = [\n  {\n    \"key\": \"clientId\",\n    \"label\": \"OAuth client ID\",\n    \"scope\": \"provider\",\n    \"secret\": false,\n    \"help\": \"The Google Cloud OAuth client shared by the installation.\"\n  },\n  {\n    \"key\": \"clientSecret\",\n    \"label\": \"OAuth client secret\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The matching Google Cloud OAuth client secret.\"\n  },\n  {\n    \"key\": \"developerToken\",\n    \"label\": \"Developer token\",\n    \"scope\": \"provider\",\n    \"secret\": true,\n    \"help\": \"The 22-character Google Ads API developer token from the manager account's API Center. Google says to treat it like a password; one token identifies the installed application.\"\n  },\n  {\n    \"key\": \"accessToken\",\n    \"label\": \"Access token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The connected Google user's one-hour OAuth access token.\"\n  },\n  {\n    \"key\": \"refreshToken\",\n    \"label\": \"Refresh token\",\n    \"scope\": \"account\",\n    \"secret\": true,\n    \"help\": \"The reusable offline token used to replace expired access tokens.\"\n  },\n  {\n    \"key\": \"loginCustomerId\",\n    \"label\": \"Manager customer ID\",\n    \"scope\": \"account\",\n    \"secret\": false,\n    \"optional\": true,\n    \"help\": \"Optional. The manager account's 10-digit customer ID without hyphens. Required when the OAuth user reaches a client through that manager; omit it for direct access.\"\n  }\n] as const;\n\n/**\n * The OAuth2 exchange Google Ads requires — DECLARED here, performed by the\n * host.\n *\n * A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n *\n * The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n *\n * Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n *\n * Its consent grant is SHARED with every connector declaring grant \"google\":\n * one OAuth client, one consent and one refresh token per person, scopes added\n * as features are first used (authorizeParams). Revoking removes the WHOLE\n * grant, so only a full disconnect revokes; a per-feature disconnect stops\n * using the scope locally. Identify the account by the id_token's sub, never\n * by email.\n */\nexport const GOOGLE_ADS_OAUTH = {\n  \"flow\": \"authorization_code\",\n  \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n  \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n  \"scopes\": [\n    \"https://www.googleapis.com/auth/adwords\"\n  ],\n  \"accessTokenCredential\": \"accessToken\",\n  \"refreshTokenCredential\": \"refreshToken\",\n  \"refreshTokenRotates\": false,\n  \"accessTokenTtlSeconds\": 3600,\n  \"grant\": \"google\",\n  \"authorizeParams\": {\n    \"access_type\": \"offline\",\n    \"include_granted_scopes\": \"true\"\n  },\n  \"revoke\": {\n    \"url\": \"https://oauth2.googleapis.com/revoke\",\n    \"param\": \"token\",\n    \"scope\": \"grant\"\n  },\n  \"identity\": {\n    \"scope\": \"openid\",\n    \"claim\": \"sub\",\n    \"issuers\": [\n      \"https://accounts.google.com\",\n      \"accounts.google.com\"\n    ],\n    \"jwksUrl\": \"https://www.googleapis.com/oauth2/v3/certs\",\n    \"audienceCredential\": \"clientId\"\n  },\n  \"restrictedScopes\": []\n} as const;\n\n/** Build a Google Ads node's connector metadata from the operation it performs. */\nexport function googleAdsMeta(\n  role: ConnectorMeta[\"role\"],\n  operation: string,\n  docs: string,\n): ConnectorMeta {\n  return { ...GOOGLE_ADS_SERVICE, role, operation, docs };\n}\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/actions/customer-list-accessible.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/customer-list-accessible.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Accessible Google Ads customers — List Google Ads customer resource names\n * directly accessible to the authenticated user. Manager-linked client\n * accounts are not included; query the account hierarchy after choosing a\n * directly accessible manager.\n *\n * https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\n */\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAdsMeta } from \"../service.js\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_KIND = \"@particle-academy/google_ads_customer_list\";\nexport const GOOGLE_ADS_CUSTOMER_LIST_OPERATION = \"customer_list_accessible\";\n\nexport const GOOGLE_ADS_CUSTOMER_LIST_META = googleAdsMeta(\"action\", \"list directly accessible customers\", \"https://developers.google.com/google-ads/api/rest/reference/rest/v25/customers/listAccessibleCustomers\");\n\n/**\n * What this node emits — the \"ingredients\" a downstream node can reference.\n *\n * fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n */\nexport const GOOGLE_ADS_CUSTOMER_LIST_OUTPUT: OutputField[] = [\n  {\n    \"path\": \"data.resourceNames\",\n    \"type\": \"array\",\n    \"description\": \"Customer resource names in customers/{customer_id} form that the OAuth identity can access directly.\"\n  }\n];\n\nexport const googleAdsCustomerListKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ADS_CUSTOMER_LIST_META, {\n  name: GOOGLE_ADS_CUSTOMER_LIST_KIND,\n  aliases: [\"google_ads_customer_list\"],\n  label: \"Accessible Google Ads customers\",\n  description: \"List Google Ads customer resource names directly accessible to the authenticated user. Manager-linked client accounts are not included; query the account hierarchy after choosing a directly accessible manager.\",\n  inputs: [{ id: \"in\" }],\n  outputs: [{ id: \"out\" }],\n  sideEffects: \"none\",\n  outputShape: GOOGLE_ADS_CUSTOMER_LIST_OUTPUT,\n  configSchema: [],\n  defaultConfig: {\n    \"mode\": \"auto\"\n  },\n  renderBody: ({ config }) =>\n    summarize(GOOGLE_ADS_CUSTOMER_LIST_META, config as Record<string, unknown>, \"list directly accessible customers\"),\n});\n","/**\n * GENERATED FILE — do not edit.\n *\n * Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n *\n *     npm run provider -- google_ads\n */\n\n/**\n * Google Ads's node kinds for fancy-flow.\n *\n * Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n */\n\nexport * from \"./service.js\";\nexport * from \"./kinds/customer-list-accessible.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAdsCustomerListKind } from \"./kinds/customer-list-accessible.js\";\n\n/** Every Google Ads kind, for a host that registers the lot. */\nexport const GOOGLE_ADS_KINDS: NodeKindDefinition[] = [\n  googleAdsCustomerListKind,\n];\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@particle-academy/google-ads-ui",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Google Ads's authoring surface for fancy-flow — the node kinds, their config schemas and their declared output shapes. React on every host; carries no executor.",
   "repository": {
     "type": "git",