npm - @particle-academy/google-analytics-ui - Versions diffs - 0.4.0 → 0.5.1 - Mend

@particle-academy/google-analytics-ui 0.4.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -8,6 +8,47 @@ The four packages share one version, because they are generated from one
 `provider/` definition and a version that meant something different in each
 would be a version nobody could reason about.
+## [0.5.1] — 2026-11-08
+### Fixed
+- **The Laravel config's environment variable names now split camelCase**,
+  as documented. **Consumer action: none.** The old unsplit names are still
+  read as a fallback, so an app that set them keeps working; the new names
+  are preferred.
+  | Preferred | Still read |
+  |---|---|
+  | `GOOGLE_ANALYTICS_CLIENT_ID` | `GOOGLE_ANALYTICS_CLIENTID` |
+  | `GOOGLE_ANALYTICS_CLIENT_SECRET` | `GOOGLE_ANALYTICS_CLIENTSECRET` |
+  | `GOOGLE_ANALYTICS_ACCESS_TOKEN` | `GOOGLE_ANALYTICS_ACCESSTOKEN` |
+  | `GOOGLE_ANALYTICS_REFRESH_TOKEN` | `GOOGLE_ANALYTICS_REFRESHTOKEN` |
+## [0.5.0] — 2026-11-08
+### Added
+- **One Google consent grant, shared by every Google connector** (`oauth.grant:
+  "google"`), for an org-level Google connection: one OAuth client, one consent
+  and one refresh token per person, with each feature's scopes asked for when it
+  is first used. Declared in the manifest, the `-ui` package's OAuth constant,
+  the README and the registry index:
+  - `authorizeParams`: `access_type=offline` and `include_granted_scopes=true`.
+    A refresh token comes back only on the FIRST code exchange, so keep the stored
+    one when an exchange returns none.
+  - `revoke`: POST `https://oauth2.googleapis.com/revoke` with `token`, and
+    `scope: "grant"`. **Revoking removes the person's WHOLE Google grant, every
+    Google connector**, so a per-feature disconnect stops using that feature's
+    scopes locally and only a full Google disconnect revokes.
+  - `identity`: identify the account by the id_token's `sub` (request `openid`;
+    issuer `https://accounts.google.com` or `accounts.google.com`; audience is
+    the `clientId`), never by email, which Google says is neither unique nor
+    permanent.
+  `restrictedScopes` is empty: none of this connector's scopes is restricted.
+  Nothing a request sends has changed; this is what a host needs to run the
+  connection.
 ## [0.4.0] — 2026-11-08
 ### Added

package/README.md CHANGED Viewed

@@ -55,6 +55,13 @@ Google Analytics uses OAuth2 (authorization_code). The package DECLARES the exch
 - **Scopes** — `https://www.googleapis.com/auth/analytics.readonly`
 - **Access token lifetime** — 3600 seconds (1 hours). A host that never refreshes works all afternoon and is broken by morning.
+**One consent grant, shared** (`grant: "google"`). Every connector declaring the same grant can run on ONE OAuth client, with one consent and one refresh token per person.
+- **Authorize with** `access_type=offline`, `include_granted_scopes=true`. Ask for a feature's scopes when it is first used; the new token covers every scope granted before. A refresh token comes back only on the FIRST exchange, so keep the stored one when an exchange returns none.
+- **Revoke** — POST https://oauth2.googleapis.com/revoke with `token`. **It removes the WHOLE grant**: every connector sharing it, not only this one. A per-feature disconnect stops using that feature's scopes locally; only a full disconnect revokes.
+- **Identify the account by `sub`**: request `openid`, then verify the token response's id_token (issuer `https://accounts.google.com` or `accounts.google.com`, keys at https://www.googleapis.com/oauth2/v3/certs, audience = `clientId`). Never key a connection by email.
+- **No restricted scopes** in this connector.
 The refresh tokens do **not** rotate: the same one is reusable, so a refresh may safely be retried and may run concurrently. Stated rather than assumed, because the opposite — a provider that spends the token and revokes the grant on a replay — looks identical until it happens.
 ### The estate

package/dist/index.cjs CHANGED Viewed

@@ -50,7 +50,28 @@ var GOOGLE_ANALYTICS_OAUTH = {
   "accessTokenCredential": "accessToken",
   "refreshTokenCredential": "refreshToken",
   "refreshTokenRotates": false,
-  "accessTokenTtlSeconds": 3600
+  "accessTokenTtlSeconds": 3600,
+  "grant": "google",
+  "authorizeParams": {
+    "access_type": "offline",
+    "include_granted_scopes": "true"
+  },
+  "revoke": {
+    "url": "https://oauth2.googleapis.com/revoke",
+    "param": "token",
+    "scope": "grant"
+  },
+  "identity": {
+    "scope": "openid",
+    "claim": "sub",
+    "issuers": [
+      "https://accounts.google.com",
+      "accounts.google.com"
+    ],
+    "jwksUrl": "https://www.googleapis.com/oauth2/v3/certs",
+    "audienceCredential": "clientId"
+  },
+  "restrictedScopes": []
 };
 function googleAnalyticsMeta(role, operation, docs) {
   return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/service.ts","../src/kinds/report-run.ts","../src/index.ts"],"names":["defineConnectorKind","summarize"],"mappings":";;;;;AAkCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAAA,EACtC,OAAA,EAAS,kBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA;AAEZ;AAoBO,IAAM,sBAAA,GAAyB;AAAA,EACpC,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB;AAC3B;AAGO,SAAS,mBAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,wBAAA,EAA0B,IAAA,EAAM,WAAW,IAAA,EAAK;AAC9D;ACxHO,IAAM,4BAAA,GAA+B;AACrC,IAAM,iCAAA,GAAoC;AAE1C,IAAM,4BAAA,GAA+B,mBAAA,CAAoB,QAAA,EAAU,cAAA,EAAgB,sGAAsG;AAUzL,IAAM,8BAAA,GAAgD;AAAA,EAC3D;AAAA,IACE,MAAA,EAAQ,WAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgDA,+BAAoB,4BAAA,EAA8B;AAAA,EAC7G,IAAA,EAAM,4BAAA;AAAA,EACN,OAAA,EAAS,CAAC,yBAAyB,CAAA;AAAA,EACnC,KAAA,EAAO,yBAAA;AAAA,EACP,WAAA,EAAa,qDAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,8BAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,UAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,aAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,WAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,WAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,OAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,SAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,YAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,SAAA,EAAW,MAAA;AAAA,MACX,aAAA,EAAe;AAAA;AACjB,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACbC,oBAAA,CAAU,4BAAA,EAA8B,QAAmC,cAAc;AAC7F,CAAC;;;AClFM,IAAM,sBAAA,GAA+C;AAAA,EAC1D;AACF","file":"index.cjs","sourcesContent":["/*\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's identity on the authoring surface, shared by every Google\n * Analytics node.\n \n This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n \n ## The sandbox trap\n \n Google Analytics has no sandbox. A report reads a real property's real data\n * and spends real quota. The faker returns a plausibly-shaped report so a flow\n * can be built without a Google account.\n /\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/\n The connector API version this package was GENERATED against.\n \n A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n /\nexport const CONNECTOR_API_VERSION = 1;\n\n/* The parts of a connector's identity that belong to the SERVICE, not the node. /\nexport const GOOGLE_ANALYTICS_SERVICE = {\n service: \"google_analytics\",\n serviceTitle: \"Google Analytics\",\n domain: \"analytics\",\n sandbox: \"none\",\n} as const satisfies Pick<ConnectorMeta, \"service\" \| \"serviceTitle\" \| \"domain\" \| \"sandbox\">;\n\n/\n Every connector domain weaver knows, pinned against fancy-flow's union.\n \n A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n /\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n \"payments\",\n \"commerce\",\n \"messaging\",\n \"email\",\n \"crm\",\n \"support\",\n \"storage\",\n \"calendar\",\n \"productivity\",\n \"database\",\n \"devtools\",\n \"analytics\",\n \"marketing\",\n \"ai\",\n \"forms\",\n \"hr\",\n \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/* The credentials a Google Analytics connection holds. /\nexport const GOOGLE_ANALYTICS_CREDENTIALS = [\n {\n \"key\": \"clientId\",\n \"label\": \"OAuth client ID\",\n \"scope\": \"provider\",\n \"secret\": false,\n \"help\": \"From Google Cloud Console -> APIs & Services -> Credentials. ONE value for the whole installation, not per connected account.\"\n },\n {\n \"key\": \"clientSecret\",\n \"label\": \"OAuth client secret\",\n \"scope\": \"provider\",\n \"secret\": true,\n \"help\": \"The client secret for the same OAuth app. One value for the whole installation.\"\n },\n {\n \"key\": \"accessToken\",\n \"label\": \"Access token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account, and it expires after ONE HOUR. The host refreshes it with the refresh token.\"\n },\n {\n \"key\": \"refreshToken\",\n \"label\": \"Refresh token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account. Google issues one only when the consent request asks for offline access.\"\n }\n] as const;\n\n/\n The OAuth2 exchange Google Analytics requires — DECLARED here, performed by\n * the host.\n \n A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n \n The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n \n Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n /\nexport const GOOGLE_ANALYTICS_OAUTH = {\n \"flow\": \"authorization_code\",\n \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n \"scopes\": [\n \"https://www.googleapis.com/auth/analytics.readonly\"\n ],\n \"accessTokenCredential\": \"accessToken\",\n \"refreshTokenCredential\": \"refreshToken\",\n \"refreshTokenRotates\": false,\n \"accessTokenTtlSeconds\": 3600\n} as const;\n\n/* Build a Google Analytics node's connector metadata from the operation it performs. /\nexport function googleAnalyticsMeta(\n role: ConnectorMeta[\"role\"],\n operation: string,\n docs: string,\n): ConnectorMeta {\n return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };\n}\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/actions/report-run.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/report-run.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics report — Run a report against a Google Analytics 4\n * property.\n \n https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\n /\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAnalyticsMeta } from \"../service.js\";\n\nexport const GOOGLE_ANALYTICS_REPORT_KIND = \"@particle-academy/google_analytics_report\";\nexport const GOOGLE_ANALYTICS_REPORT_OPERATION = \"report_run\";\n\nexport const GOOGLE_ANALYTICS_REPORT_META = googleAnalyticsMeta(\"action\", \"run a report\", \"https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\");\n\n/\n What this node emits — the \"ingredients\" a downstream node can reference.\n \n fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n /\nexport const GOOGLE_ANALYTICS_REPORT_OUTPUT: OutputField[] = [\n {\n \"path\": \"data.rows\",\n \"type\": \"array\",\n \"description\": \"One entry per combination of dimension values. Each carries dimensionValues and metricValues, in the order requested.\"\n },\n {\n \"path\": \"data.rowCount\",\n \"type\": \"number\",\n \"description\": \"Total rows matching the query, which can exceed the rows returned.\"\n },\n {\n \"path\": \"data.metricHeaders\",\n \"type\": \"array\",\n \"description\": \"The metrics in the order their values appear in each row -- the only thing that says which number is which.\"\n }\n];\n\nexport const googleAnalyticsReportKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ANALYTICS_REPORT_META, {\n name: GOOGLE_ANALYTICS_REPORT_KIND,\n aliases: [\"google_analytics_report\"],\n label: \"Google Analytics report\",\n description: \"Run a report against a Google Analytics 4 property.\",\n inputs: [{ id: \"in\" }],\n outputs: [{ id: \"out\" }],\n sideEffects: \"none\",\n outputShape: GOOGLE_ANALYTICS_REPORT_OUTPUT,\n configSchema: [\n {\n \"type\": \"text\",\n \"key\": \"property\",\n \"label\": \"Property\",\n \"required\": true,\n \"default\": \"properties/\",\n \"description\": \"The GA4 property, written as `properties/1234567890`. The numeric id alone is not accepted.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"startDate\",\n \"label\": \"Start date\",\n \"required\": true,\n \"default\": \"28daysAgo\",\n \"description\": \"YYYY-MM-DD, or a relative form Google accepts such as `28daysAgo`, `yesterday` or `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"endDate\",\n \"label\": \"End date\",\n \"required\": true,\n \"default\": \"today\",\n \"description\": \"YYYY-MM-DD, or a relative form such as `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"metrics\",\n \"label\": \"Metrics\",\n \"required\": true,\n \"default\": \"activeUsers,sessions\",\n \"description\": \"Metric names, comma separated. For example activeUsers, sessions, screenPageViews.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"dimensions\",\n \"label\": \"Dimensions\",\n \"default\": \"date\",\n \"description\": \"Dimension names, comma separated. For example date, country, pagePath. Leave empty for a single total row.\"\n }\n ],\n defaultConfig: {\n \"mode\": \"auto\"\n },\n renderBody: ({ config }) =>\n summarize(GOOGLE_ANALYTICS_REPORT_META, config as Record<string, unknown>, \"run a report\"),\n});\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's node kinds for fancy-flow.\n \n Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n /\n\nexport from \"./service.js\";\nexport * from \"./kinds/report-run.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAnalyticsReportKind } from \"./kinds/report-run.js\";\n\n/** Every Google Analytics kind, for a host that registers the lot. */\nexport const GOOGLE_ANALYTICS_KINDS: NodeKindDefinition[] = [\n googleAnalyticsReportKind,\n];\n"]}
1	+ {"version":3,"sources":["../src/service.ts","../src/kinds/report-run.ts","../src/index.ts"],"names":["defineConnectorKind","summarize"],"mappings":";;;;;AAkCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAAA,EACtC,OAAA,EAAS,kBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA;AAEZ;AA2BO,IAAM,sBAAA,GAAyB;AAAA,EACpC,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB,IAAA;AAAA,EACzB,OAAA,EAAS,QAAA;AAAA,EACT,iBAAA,EAAmB;AAAA,IACjB,aAAA,EAAe,SAAA;AAAA,IACf,wBAAA,EAA0B;AAAA,GAC5B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,KAAA,EAAO,sCAAA;AAAA,IACP,OAAA,EAAS,OAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAAA,EACA,UAAA,EAAY;AAAA,IACV,OAAA,EAAS,QAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,MACT,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,SAAA,EAAW,4CAAA;AAAA,IACX,oBAAA,EAAsB;AAAA,GACxB;AAAA,EACA,oBAAoB;AACtB;AAGO,SAAS,mBAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,wBAAA,EAA0B,IAAA,EAAM,WAAW,IAAA,EAAK;AAC9D;ACpJO,IAAM,4BAAA,GAA+B;AACrC,IAAM,iCAAA,GAAoC;AAE1C,IAAM,4BAAA,GAA+B,mBAAA,CAAoB,QAAA,EAAU,cAAA,EAAgB,sGAAsG;AAUzL,IAAM,8BAAA,GAAgD;AAAA,EAC3D;AAAA,IACE,MAAA,EAAQ,WAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgDA,+BAAoB,4BAAA,EAA8B;AAAA,EAC7G,IAAA,EAAM,4BAAA;AAAA,EACN,OAAA,EAAS,CAAC,yBAAyB,CAAA;AAAA,EACnC,KAAA,EAAO,yBAAA;AAAA,EACP,WAAA,EAAa,qDAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,8BAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,UAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,aAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,WAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,WAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,OAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,SAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,YAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,SAAA,EAAW,MAAA;AAAA,MACX,aAAA,EAAe;AAAA;AACjB,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACbC,oBAAA,CAAU,4BAAA,EAA8B,QAAmC,cAAc;AAC7F,CAAC;;;AClFM,IAAM,sBAAA,GAA+C;AAAA,EAC1D;AACF","file":"index.cjs","sourcesContent":["/*\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's identity on the authoring surface, shared by every Google\n * Analytics node.\n \n This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n \n ## The sandbox trap\n \n Google Analytics has no sandbox. A report reads a real property's real data\n * and spends real quota. The faker returns a plausibly-shaped report so a flow\n * can be built without a Google account.\n /\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/\n The connector API version this package was GENERATED against.\n \n A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n /\nexport const CONNECTOR_API_VERSION = 1;\n\n/* The parts of a connector's identity that belong to the SERVICE, not the node. /\nexport const GOOGLE_ANALYTICS_SERVICE = {\n service: \"google_analytics\",\n serviceTitle: \"Google Analytics\",\n domain: \"analytics\",\n sandbox: \"none\",\n} as const satisfies Pick<ConnectorMeta, \"service\" \| \"serviceTitle\" \| \"domain\" \| \"sandbox\">;\n\n/\n Every connector domain weaver knows, pinned against fancy-flow's union.\n \n A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n /\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n \"payments\",\n \"commerce\",\n \"messaging\",\n \"email\",\n \"crm\",\n \"support\",\n \"storage\",\n \"calendar\",\n \"productivity\",\n \"database\",\n \"devtools\",\n \"analytics\",\n \"marketing\",\n \"ai\",\n \"forms\",\n \"hr\",\n \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/* The credentials a Google Analytics connection holds. /\nexport const GOOGLE_ANALYTICS_CREDENTIALS = [\n {\n \"key\": \"clientId\",\n \"label\": \"OAuth client ID\",\n \"scope\": \"provider\",\n \"secret\": false,\n \"help\": \"From Google Cloud Console -> APIs & Services -> Credentials. ONE value for the whole installation, not per connected account.\"\n },\n {\n \"key\": \"clientSecret\",\n \"label\": \"OAuth client secret\",\n \"scope\": \"provider\",\n \"secret\": true,\n \"help\": \"The client secret for the same OAuth app. One value for the whole installation.\"\n },\n {\n \"key\": \"accessToken\",\n \"label\": \"Access token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account, and it expires after ONE HOUR. The host refreshes it with the refresh token.\"\n },\n {\n \"key\": \"refreshToken\",\n \"label\": \"Refresh token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account. Google issues one only when the consent request asks for offline access.\"\n }\n] as const;\n\n/\n The OAuth2 exchange Google Analytics requires — DECLARED here, performed by\n * the host.\n \n A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n \n The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n \n Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n \n Its consent grant is SHARED with every connector declaring grant \"google\":\n * one OAuth client, one consent and one refresh token per person, scopes added\n * as features are first used (authorizeParams). Revoking removes the WHOLE\n * grant, so only a full disconnect revokes; a per-feature disconnect stops\n * using the scope locally. Identify the account by the id_token's sub, never\n * by email.\n /\nexport const GOOGLE_ANALYTICS_OAUTH = {\n \"flow\": \"authorization_code\",\n \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n \"scopes\": [\n \"https://www.googleapis.com/auth/analytics.readonly\"\n ],\n \"accessTokenCredential\": \"accessToken\",\n \"refreshTokenCredential\": \"refreshToken\",\n \"refreshTokenRotates\": false,\n \"accessTokenTtlSeconds\": 3600,\n \"grant\": \"google\",\n \"authorizeParams\": {\n \"access_type\": \"offline\",\n \"include_granted_scopes\": \"true\"\n },\n \"revoke\": {\n \"url\": \"https://oauth2.googleapis.com/revoke\",\n \"param\": \"token\",\n \"scope\": \"grant\"\n },\n \"identity\": {\n \"scope\": \"openid\",\n \"claim\": \"sub\",\n \"issuers\": [\n \"https://accounts.google.com\",\n \"accounts.google.com\"\n ],\n \"jwksUrl\": \"https://www.googleapis.com/oauth2/v3/certs\",\n \"audienceCredential\": \"clientId\"\n },\n \"restrictedScopes\": []\n} as const;\n\n/* Build a Google Analytics node's connector metadata from the operation it performs. /\nexport function googleAnalyticsMeta(\n role: ConnectorMeta[\"role\"],\n operation: string,\n docs: string,\n): ConnectorMeta {\n return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };\n}\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/actions/report-run.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/report-run.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics report — Run a report against a Google Analytics 4\n * property.\n \n https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\n /\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAnalyticsMeta } from \"../service.js\";\n\nexport const GOOGLE_ANALYTICS_REPORT_KIND = \"@particle-academy/google_analytics_report\";\nexport const GOOGLE_ANALYTICS_REPORT_OPERATION = \"report_run\";\n\nexport const GOOGLE_ANALYTICS_REPORT_META = googleAnalyticsMeta(\"action\", \"run a report\", \"https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\");\n\n/\n What this node emits — the \"ingredients\" a downstream node can reference.\n \n fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n /\nexport const GOOGLE_ANALYTICS_REPORT_OUTPUT: OutputField[] = [\n {\n \"path\": \"data.rows\",\n \"type\": \"array\",\n \"description\": \"One entry per combination of dimension values. Each carries dimensionValues and metricValues, in the order requested.\"\n },\n {\n \"path\": \"data.rowCount\",\n \"type\": \"number\",\n \"description\": \"Total rows matching the query, which can exceed the rows returned.\"\n },\n {\n \"path\": \"data.metricHeaders\",\n \"type\": \"array\",\n \"description\": \"The metrics in the order their values appear in each row -- the only thing that says which number is which.\"\n }\n];\n\nexport const googleAnalyticsReportKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ANALYTICS_REPORT_META, {\n name: GOOGLE_ANALYTICS_REPORT_KIND,\n aliases: [\"google_analytics_report\"],\n label: \"Google Analytics report\",\n description: \"Run a report against a Google Analytics 4 property.\",\n inputs: [{ id: \"in\" }],\n outputs: [{ id: \"out\" }],\n sideEffects: \"none\",\n outputShape: GOOGLE_ANALYTICS_REPORT_OUTPUT,\n configSchema: [\n {\n \"type\": \"text\",\n \"key\": \"property\",\n \"label\": \"Property\",\n \"required\": true,\n \"default\": \"properties/\",\n \"description\": \"The GA4 property, written as `properties/1234567890`. The numeric id alone is not accepted.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"startDate\",\n \"label\": \"Start date\",\n \"required\": true,\n \"default\": \"28daysAgo\",\n \"description\": \"YYYY-MM-DD, or a relative form Google accepts such as `28daysAgo`, `yesterday` or `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"endDate\",\n \"label\": \"End date\",\n \"required\": true,\n \"default\": \"today\",\n \"description\": \"YYYY-MM-DD, or a relative form such as `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"metrics\",\n \"label\": \"Metrics\",\n \"required\": true,\n \"default\": \"activeUsers,sessions\",\n \"description\": \"Metric names, comma separated. For example activeUsers, sessions, screenPageViews.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"dimensions\",\n \"label\": \"Dimensions\",\n \"default\": \"date\",\n \"description\": \"Dimension names, comma separated. For example date, country, pagePath. Leave empty for a single total row.\"\n }\n ],\n defaultConfig: {\n \"mode\": \"auto\"\n },\n renderBody: ({ config }) =>\n summarize(GOOGLE_ANALYTICS_REPORT_META, config as Record<string, unknown>, \"run a report\"),\n});\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's node kinds for fancy-flow.\n \n Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n /\n\nexport from \"./service.js\";\nexport * from \"./kinds/report-run.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAnalyticsReportKind } from \"./kinds/report-run.js\";\n\n/** Every Google Analytics kind, for a host that registers the lot. */\nexport const GOOGLE_ANALYTICS_KINDS: NodeKindDefinition[] = [\n googleAnalyticsReportKind,\n];\n"]}

package/dist/index.d.cts CHANGED Viewed

@@ -84,6 +84,13 @@ declare const GOOGLE_ANALYTICS_CREDENTIALS: readonly [{
  * safely be retried and may run concurrently. That is stated rather than
  * assumed because the opposite — a provider that spends the token and revokes
  * the grant on a replay — looks identical until it happens.
+ *
+ * Its consent grant is SHARED with every connector declaring grant "google":
+ * one OAuth client, one consent and one refresh token per person, scopes added
+ * as features are first used (authorizeParams). Revoking removes the WHOLE
+ * grant, so only a full disconnect revokes; a per-feature disconnect stops
+ * using the scope locally. Identify the account by the id_token's sub, never
+ * by email.
  */
 declare const GOOGLE_ANALYTICS_OAUTH: {
     readonly flow: "authorization_code";
@@ -94,6 +101,24 @@ declare const GOOGLE_ANALYTICS_OAUTH: {
     readonly refreshTokenCredential: "refreshToken";
     readonly refreshTokenRotates: false;
     readonly accessTokenTtlSeconds: 3600;
+    readonly grant: "google";
+    readonly authorizeParams: {
+        readonly access_type: "offline";
+        readonly include_granted_scopes: "true";
+    };
+    readonly revoke: {
+        readonly url: "https://oauth2.googleapis.com/revoke";
+        readonly param: "token";
+        readonly scope: "grant";
+    };
+    readonly identity: {
+        readonly scope: "openid";
+        readonly claim: "sub";
+        readonly issuers: readonly ["https://accounts.google.com", "accounts.google.com"];
+        readonly jwksUrl: "https://www.googleapis.com/oauth2/v3/certs";
+        readonly audienceCredential: "clientId";
+    };
+    readonly restrictedScopes: readonly [];
 };
 /** Build a Google Analytics node's connector metadata from the operation it performs. */
 declare function googleAnalyticsMeta(role: ConnectorMeta["role"], operation: string, docs: string): ConnectorMeta;

package/dist/index.d.ts CHANGED Viewed

@@ -84,6 +84,13 @@ declare const GOOGLE_ANALYTICS_CREDENTIALS: readonly [{
  * safely be retried and may run concurrently. That is stated rather than
  * assumed because the opposite — a provider that spends the token and revokes
  * the grant on a replay — looks identical until it happens.
+ *
+ * Its consent grant is SHARED with every connector declaring grant "google":
+ * one OAuth client, one consent and one refresh token per person, scopes added
+ * as features are first used (authorizeParams). Revoking removes the WHOLE
+ * grant, so only a full disconnect revokes; a per-feature disconnect stops
+ * using the scope locally. Identify the account by the id_token's sub, never
+ * by email.
  */
 declare const GOOGLE_ANALYTICS_OAUTH: {
     readonly flow: "authorization_code";
@@ -94,6 +101,24 @@ declare const GOOGLE_ANALYTICS_OAUTH: {
     readonly refreshTokenCredential: "refreshToken";
     readonly refreshTokenRotates: false;
     readonly accessTokenTtlSeconds: 3600;
+    readonly grant: "google";
+    readonly authorizeParams: {
+        readonly access_type: "offline";
+        readonly include_granted_scopes: "true";
+    };
+    readonly revoke: {
+        readonly url: "https://oauth2.googleapis.com/revoke";
+        readonly param: "token";
+        readonly scope: "grant";
+    };
+    readonly identity: {
+        readonly scope: "openid";
+        readonly claim: "sub";
+        readonly issuers: readonly ["https://accounts.google.com", "accounts.google.com"];
+        readonly jwksUrl: "https://www.googleapis.com/oauth2/v3/certs";
+        readonly audienceCredential: "clientId";
+    };
+    readonly restrictedScopes: readonly [];
 };
 /** Build a Google Analytics node's connector metadata from the operation it performs. */
 declare function googleAnalyticsMeta(role: ConnectorMeta["role"], operation: string, docs: string): ConnectorMeta;

package/dist/index.js CHANGED Viewed

@@ -48,7 +48,28 @@ var GOOGLE_ANALYTICS_OAUTH = {
   "accessTokenCredential": "accessToken",
   "refreshTokenCredential": "refreshToken",
   "refreshTokenRotates": false,
-  "accessTokenTtlSeconds": 3600
+  "accessTokenTtlSeconds": 3600,
+  "grant": "google",
+  "authorizeParams": {
+    "access_type": "offline",
+    "include_granted_scopes": "true"
+  },
+  "revoke": {
+    "url": "https://oauth2.googleapis.com/revoke",
+    "param": "token",
+    "scope": "grant"
+  },
+  "identity": {
+    "scope": "openid",
+    "claim": "sub",
+    "issuers": [
+      "https://accounts.google.com",
+      "accounts.google.com"
+    ],
+    "jwksUrl": "https://www.googleapis.com/oauth2/v3/certs",
+    "audienceCredential": "clientId"
+  },
+  "restrictedScopes": []
 };
 function googleAnalyticsMeta(role, operation, docs) {
   return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/service.ts","../src/kinds/report-run.ts","../src/index.ts"],"names":[],"mappings":";;;AAkCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAAA,EACtC,OAAA,EAAS,kBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA;AAEZ;AAoBO,IAAM,sBAAA,GAAyB;AAAA,EACpC,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB;AAC3B;AAGO,SAAS,mBAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,wBAAA,EAA0B,IAAA,EAAM,WAAW,IAAA,EAAK;AAC9D;ACxHO,IAAM,4BAAA,GAA+B;AACrC,IAAM,iCAAA,GAAoC;AAE1C,IAAM,4BAAA,GAA+B,mBAAA,CAAoB,QAAA,EAAU,cAAA,EAAgB,sGAAsG;AAUzL,IAAM,8BAAA,GAAgD;AAAA,EAC3D;AAAA,IACE,MAAA,EAAQ,WAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgD,oBAAoB,4BAAA,EAA8B;AAAA,EAC7G,IAAA,EAAM,4BAAA;AAAA,EACN,OAAA,EAAS,CAAC,yBAAyB,CAAA;AAAA,EACnC,KAAA,EAAO,yBAAA;AAAA,EACP,WAAA,EAAa,qDAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,8BAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,UAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,aAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,WAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,WAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,OAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,SAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,YAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,SAAA,EAAW,MAAA;AAAA,MACX,aAAA,EAAe;AAAA;AACjB,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACb,SAAA,CAAU,4BAAA,EAA8B,QAAmC,cAAc;AAC7F,CAAC;;;AClFM,IAAM,sBAAA,GAA+C;AAAA,EAC1D;AACF","file":"index.js","sourcesContent":["/*\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's identity on the authoring surface, shared by every Google\n * Analytics node.\n \n This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n \n ## The sandbox trap\n \n Google Analytics has no sandbox. A report reads a real property's real data\n * and spends real quota. The faker returns a plausibly-shaped report so a flow\n * can be built without a Google account.\n /\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/\n The connector API version this package was GENERATED against.\n \n A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n /\nexport const CONNECTOR_API_VERSION = 1;\n\n/* The parts of a connector's identity that belong to the SERVICE, not the node. /\nexport const GOOGLE_ANALYTICS_SERVICE = {\n service: \"google_analytics\",\n serviceTitle: \"Google Analytics\",\n domain: \"analytics\",\n sandbox: \"none\",\n} as const satisfies Pick<ConnectorMeta, \"service\" \| \"serviceTitle\" \| \"domain\" \| \"sandbox\">;\n\n/\n Every connector domain weaver knows, pinned against fancy-flow's union.\n \n A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n /\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n \"payments\",\n \"commerce\",\n \"messaging\",\n \"email\",\n \"crm\",\n \"support\",\n \"storage\",\n \"calendar\",\n \"productivity\",\n \"database\",\n \"devtools\",\n \"analytics\",\n \"marketing\",\n \"ai\",\n \"forms\",\n \"hr\",\n \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/* The credentials a Google Analytics connection holds. /\nexport const GOOGLE_ANALYTICS_CREDENTIALS = [\n {\n \"key\": \"clientId\",\n \"label\": \"OAuth client ID\",\n \"scope\": \"provider\",\n \"secret\": false,\n \"help\": \"From Google Cloud Console -> APIs & Services -> Credentials. ONE value for the whole installation, not per connected account.\"\n },\n {\n \"key\": \"clientSecret\",\n \"label\": \"OAuth client secret\",\n \"scope\": \"provider\",\n \"secret\": true,\n \"help\": \"The client secret for the same OAuth app. One value for the whole installation.\"\n },\n {\n \"key\": \"accessToken\",\n \"label\": \"Access token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account, and it expires after ONE HOUR. The host refreshes it with the refresh token.\"\n },\n {\n \"key\": \"refreshToken\",\n \"label\": \"Refresh token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account. Google issues one only when the consent request asks for offline access.\"\n }\n] as const;\n\n/\n The OAuth2 exchange Google Analytics requires — DECLARED here, performed by\n * the host.\n \n A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n \n The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n \n Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n /\nexport const GOOGLE_ANALYTICS_OAUTH = {\n \"flow\": \"authorization_code\",\n \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n \"scopes\": [\n \"https://www.googleapis.com/auth/analytics.readonly\"\n ],\n \"accessTokenCredential\": \"accessToken\",\n \"refreshTokenCredential\": \"refreshToken\",\n \"refreshTokenRotates\": false,\n \"accessTokenTtlSeconds\": 3600\n} as const;\n\n/* Build a Google Analytics node's connector metadata from the operation it performs. /\nexport function googleAnalyticsMeta(\n role: ConnectorMeta[\"role\"],\n operation: string,\n docs: string,\n): ConnectorMeta {\n return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };\n}\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/actions/report-run.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/report-run.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics report — Run a report against a Google Analytics 4\n * property.\n \n https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\n /\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAnalyticsMeta } from \"../service.js\";\n\nexport const GOOGLE_ANALYTICS_REPORT_KIND = \"@particle-academy/google_analytics_report\";\nexport const GOOGLE_ANALYTICS_REPORT_OPERATION = \"report_run\";\n\nexport const GOOGLE_ANALYTICS_REPORT_META = googleAnalyticsMeta(\"action\", \"run a report\", \"https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\");\n\n/\n What this node emits — the \"ingredients\" a downstream node can reference.\n \n fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n /\nexport const GOOGLE_ANALYTICS_REPORT_OUTPUT: OutputField[] = [\n {\n \"path\": \"data.rows\",\n \"type\": \"array\",\n \"description\": \"One entry per combination of dimension values. Each carries dimensionValues and metricValues, in the order requested.\"\n },\n {\n \"path\": \"data.rowCount\",\n \"type\": \"number\",\n \"description\": \"Total rows matching the query, which can exceed the rows returned.\"\n },\n {\n \"path\": \"data.metricHeaders\",\n \"type\": \"array\",\n \"description\": \"The metrics in the order their values appear in each row -- the only thing that says which number is which.\"\n }\n];\n\nexport const googleAnalyticsReportKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ANALYTICS_REPORT_META, {\n name: GOOGLE_ANALYTICS_REPORT_KIND,\n aliases: [\"google_analytics_report\"],\n label: \"Google Analytics report\",\n description: \"Run a report against a Google Analytics 4 property.\",\n inputs: [{ id: \"in\" }],\n outputs: [{ id: \"out\" }],\n sideEffects: \"none\",\n outputShape: GOOGLE_ANALYTICS_REPORT_OUTPUT,\n configSchema: [\n {\n \"type\": \"text\",\n \"key\": \"property\",\n \"label\": \"Property\",\n \"required\": true,\n \"default\": \"properties/\",\n \"description\": \"The GA4 property, written as `properties/1234567890`. The numeric id alone is not accepted.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"startDate\",\n \"label\": \"Start date\",\n \"required\": true,\n \"default\": \"28daysAgo\",\n \"description\": \"YYYY-MM-DD, or a relative form Google accepts such as `28daysAgo`, `yesterday` or `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"endDate\",\n \"label\": \"End date\",\n \"required\": true,\n \"default\": \"today\",\n \"description\": \"YYYY-MM-DD, or a relative form such as `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"metrics\",\n \"label\": \"Metrics\",\n \"required\": true,\n \"default\": \"activeUsers,sessions\",\n \"description\": \"Metric names, comma separated. For example activeUsers, sessions, screenPageViews.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"dimensions\",\n \"label\": \"Dimensions\",\n \"default\": \"date\",\n \"description\": \"Dimension names, comma separated. For example date, country, pagePath. Leave empty for a single total row.\"\n }\n ],\n defaultConfig: {\n \"mode\": \"auto\"\n },\n renderBody: ({ config }) =>\n summarize(GOOGLE_ANALYTICS_REPORT_META, config as Record<string, unknown>, \"run a report\"),\n});\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's node kinds for fancy-flow.\n \n Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n /\n\nexport from \"./service.js\";\nexport * from \"./kinds/report-run.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAnalyticsReportKind } from \"./kinds/report-run.js\";\n\n/** Every Google Analytics kind, for a host that registers the lot. */\nexport const GOOGLE_ANALYTICS_KINDS: NodeKindDefinition[] = [\n googleAnalyticsReportKind,\n];\n"]}
1	+ {"version":3,"sources":["../src/service.ts","../src/kinds/report-run.ts","../src/index.ts"],"names":[],"mappings":";;;AAkCO,IAAM,qBAAA,GAAwB;AAG9B,IAAM,wBAAA,GAA2B;AAAA,EACtC,OAAA,EAAS,kBAAA;AAAA,EACT,YAAA,EAAc,kBAAA;AAAA,EACd,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS;AACX;AA+BO,IAAM,4BAAA,GAA+B;AAAA,EAC1C;AAAA,IACE,KAAA,EAAO,UAAA;AAAA,IACP,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,qBAAA;AAAA,IACT,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,aAAA;AAAA,IACP,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,GACV;AAAA,EACA;AAAA,IACE,KAAA,EAAO,cAAA;AAAA,IACP,OAAA,EAAS,eAAA;AAAA,IACT,OAAA,EAAS,SAAA;AAAA,IACT,QAAA,EAAU,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA;AAEZ;AA2BO,IAAM,sBAAA,GAAyB;AAAA,EACpC,MAAA,EAAQ,oBAAA;AAAA,EACR,cAAA,EAAgB,8CAAA;AAAA,EAChB,UAAA,EAAY,qCAAA;AAAA,EACZ,QAAA,EAAU;AAAA,IACR;AAAA,GACF;AAAA,EACA,uBAAA,EAAyB,aAAA;AAAA,EACzB,wBAAA,EAA0B,cAAA;AAAA,EAC1B,qBAAA,EAAuB,KAAA;AAAA,EACvB,uBAAA,EAAyB,IAAA;AAAA,EACzB,OAAA,EAAS,QAAA;AAAA,EACT,iBAAA,EAAmB;AAAA,IACjB,aAAA,EAAe,SAAA;AAAA,IACf,wBAAA,EAA0B;AAAA,GAC5B;AAAA,EACA,QAAA,EAAU;AAAA,IACR,KAAA,EAAO,sCAAA;AAAA,IACP,OAAA,EAAS,OAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAAA,EACA,UAAA,EAAY;AAAA,IACV,OAAA,EAAS,QAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,SAAA,EAAW;AAAA,MACT,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,SAAA,EAAW,4CAAA;AAAA,IACX,oBAAA,EAAsB;AAAA,GACxB;AAAA,EACA,oBAAoB;AACtB;AAGO,SAAS,mBAAA,CACd,IAAA,EACA,SAAA,EACA,IAAA,EACe;AACf,EAAA,OAAO,EAAE,GAAG,wBAAA,EAA0B,IAAA,EAAM,WAAW,IAAA,EAAK;AAC9D;ACpJO,IAAM,4BAAA,GAA+B;AACrC,IAAM,iCAAA,GAAoC;AAE1C,IAAM,4BAAA,GAA+B,mBAAA,CAAoB,QAAA,EAAU,cAAA,EAAgB,sGAAsG;AAUzL,IAAM,8BAAA,GAAgD;AAAA,EAC3D;AAAA,IACE,MAAA,EAAQ,WAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,aAAA,EAAe;AAAA,GACjB;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,oBAAA;AAAA,IACR,MAAA,EAAQ,OAAA;AAAA,IACR,aAAA,EAAe;AAAA;AAEnB;AAEO,IAAM,yBAAA,GAAgD,oBAAoB,4BAAA,EAA8B;AAAA,EAC7G,IAAA,EAAM,4BAAA;AAAA,EACN,OAAA,EAAS,CAAC,yBAAyB,CAAA;AAAA,EACnC,KAAA,EAAO,yBAAA;AAAA,EACP,WAAA,EAAa,qDAAA;AAAA,EACb,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,EACrB,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,OAAO,CAAA;AAAA,EACvB,WAAA,EAAa,MAAA;AAAA,EACb,WAAA,EAAa,8BAAA;AAAA,EACb,YAAA,EAAc;AAAA,IACZ;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,UAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,aAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,WAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,WAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,UAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,OAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,SAAA;AAAA,MACP,OAAA,EAAS,SAAA;AAAA,MACT,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe;AAAA,KACjB;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,KAAA,EAAO,YAAA;AAAA,MACP,OAAA,EAAS,YAAA;AAAA,MACT,SAAA,EAAW,MAAA;AAAA,MACX,aAAA,EAAe;AAAA;AACjB,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,UAAA,EAAY,CAAC,EAAE,MAAA,OACb,SAAA,CAAU,4BAAA,EAA8B,QAAmC,cAAc;AAC7F,CAAC;;;AClFM,IAAM,sBAAA,GAA+C;AAAA,EAC1D;AACF","file":"index.js","sourcesContent":["/*\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's identity on the authoring surface, shared by every Google\n * Analytics node.\n \n This file must import nothing from the js package: a PHP or Python project\n * installs the ui package and never that one, and the import would be a\n * dangling module the moment it did.\n \n ## The sandbox trap\n \n Google Analytics has no sandbox. A report reads a real property's real data\n * and spends real quota. The faker returns a plausibly-shaped report so a flow\n * can be built without a Google account.\n /\n\nimport type { ConnectorDomain, ConnectorMeta } from \"@particle-academy/fancy-flow/connectors\";\n\n/\n The connector API version this package was GENERATED against.\n \n A literal, never imported — an imported constant lets an upgrade rewrite the\n * very claim it exists to detect.\n /\nexport const CONNECTOR_API_VERSION = 1;\n\n/* The parts of a connector's identity that belong to the SERVICE, not the node. /\nexport const GOOGLE_ANALYTICS_SERVICE = {\n service: \"google_analytics\",\n serviceTitle: \"Google Analytics\",\n domain: \"analytics\",\n sandbox: \"none\",\n} as const satisfies Pick<ConnectorMeta, \"service\" \| \"serviceTitle\" \| \"domain\" \| \"sandbox\">;\n\n/\n Every connector domain weaver knows, pinned against fancy-flow's union.\n \n A closed set copied into three codebases stays correct only while something\n * MAKES it: this line fails to compile the moment weaver carries a value\n * fancy-flow does not, including the values no provider uses yet.\n /\nconst WEAVER_DOMAINS: readonly ConnectorDomain[] = [\n \"payments\",\n \"commerce\",\n \"messaging\",\n \"email\",\n \"crm\",\n \"support\",\n \"storage\",\n \"calendar\",\n \"productivity\",\n \"database\",\n \"devtools\",\n \"analytics\",\n \"marketing\",\n \"ai\",\n \"forms\",\n \"hr\",\n \"geo\"\n];\nvoid WEAVER_DOMAINS;\n\n/* The credentials a Google Analytics connection holds. /\nexport const GOOGLE_ANALYTICS_CREDENTIALS = [\n {\n \"key\": \"clientId\",\n \"label\": \"OAuth client ID\",\n \"scope\": \"provider\",\n \"secret\": false,\n \"help\": \"From Google Cloud Console -> APIs & Services -> Credentials. ONE value for the whole installation, not per connected account.\"\n },\n {\n \"key\": \"clientSecret\",\n \"label\": \"OAuth client secret\",\n \"scope\": \"provider\",\n \"secret\": true,\n \"help\": \"The client secret for the same OAuth app. One value for the whole installation.\"\n },\n {\n \"key\": \"accessToken\",\n \"label\": \"Access token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account, and it expires after ONE HOUR. The host refreshes it with the refresh token.\"\n },\n {\n \"key\": \"refreshToken\",\n \"label\": \"Refresh token\",\n \"scope\": \"account\",\n \"secret\": true,\n \"help\": \"Per connected Google account. Google issues one only when the consent request asks for offline access.\"\n }\n] as const;\n\n/\n The OAuth2 exchange Google Analytics requires — DECLARED here, performed by\n * the host.\n \n A consent screen needs a browser, a redirect URI and somewhere to persist\n * the result, and all three belong to the host; a package that ran the dance\n * itself would have to own a web server. So this says precisely enough for a\n * host to do it.\n \n The access token lasts 3600 seconds. A host that never refreshes will work\n * all afternoon and be broken by morning, which is why the lifetime is stated\n * rather than left to be discovered.\n \n Its refresh tokens do NOT rotate: the same one is reusable, so a refresh may\n * safely be retried and may run concurrently. That is stated rather than\n * assumed because the opposite — a provider that spends the token and revokes\n * the grant on a replay — looks identical until it happens.\n \n Its consent grant is SHARED with every connector declaring grant \"google\":\n * one OAuth client, one consent and one refresh token per person, scopes added\n * as features are first used (authorizeParams). Revoking removes the WHOLE\n * grant, so only a full disconnect revokes; a per-feature disconnect stops\n * using the scope locally. Identify the account by the id_token's sub, never\n * by email.\n /\nexport const GOOGLE_ANALYTICS_OAUTH = {\n \"flow\": \"authorization_code\",\n \"authorizeUrl\": \"https://accounts.google.com/o/oauth2/v2/auth\",\n \"tokenUrl\": \"https://oauth2.googleapis.com/token\",\n \"scopes\": [\n \"https://www.googleapis.com/auth/analytics.readonly\"\n ],\n \"accessTokenCredential\": \"accessToken\",\n \"refreshTokenCredential\": \"refreshToken\",\n \"refreshTokenRotates\": false,\n \"accessTokenTtlSeconds\": 3600,\n \"grant\": \"google\",\n \"authorizeParams\": {\n \"access_type\": \"offline\",\n \"include_granted_scopes\": \"true\"\n },\n \"revoke\": {\n \"url\": \"https://oauth2.googleapis.com/revoke\",\n \"param\": \"token\",\n \"scope\": \"grant\"\n },\n \"identity\": {\n \"scope\": \"openid\",\n \"claim\": \"sub\",\n \"issuers\": [\n \"https://accounts.google.com\",\n \"accounts.google.com\"\n ],\n \"jwksUrl\": \"https://www.googleapis.com/oauth2/v3/certs\",\n \"audienceCredential\": \"clientId\"\n },\n \"restrictedScopes\": []\n} as const;\n\n/* Build a Google Analytics node's connector metadata from the operation it performs. /\nexport function googleAnalyticsMeta(\n role: ConnectorMeta[\"role\"],\n operation: string,\n docs: string,\n): ConnectorMeta {\n return { ...GOOGLE_ANALYTICS_SERVICE, role, operation, docs };\n}\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/actions/report-run.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/actions/report-run.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics report — Run a report against a Google Analytics 4\n * property.\n \n https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\n /\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { defineConnectorKind, summarize, type OutputField } from \"@particle-academy/fancy-flow/connectors\";\nimport { googleAnalyticsMeta } from \"../service.js\";\n\nexport const GOOGLE_ANALYTICS_REPORT_KIND = \"@particle-academy/google_analytics_report\";\nexport const GOOGLE_ANALYTICS_REPORT_OPERATION = \"report_run\";\n\nexport const GOOGLE_ANALYTICS_REPORT_META = googleAnalyticsMeta(\"action\", \"run a report\", \"https://developers.google.com/analytics/devguides/reporting/data/v1/rest/v1beta/properties/runReport\");\n\n/\n What this node emits — the \"ingredients\" a downstream node can reference.\n \n fancy-flow reads `outputShape` off the kind and offers it in the variable\n * picker, so declaring it is the whole of the work: an author configuring the\n * next node picks `{{ $json.data.id }}` off a list instead of typing a path\n * and hoping.\n /\nexport const GOOGLE_ANALYTICS_REPORT_OUTPUT: OutputField[] = [\n {\n \"path\": \"data.rows\",\n \"type\": \"array\",\n \"description\": \"One entry per combination of dimension values. Each carries dimensionValues and metricValues, in the order requested.\"\n },\n {\n \"path\": \"data.rowCount\",\n \"type\": \"number\",\n \"description\": \"Total rows matching the query, which can exceed the rows returned.\"\n },\n {\n \"path\": \"data.metricHeaders\",\n \"type\": \"array\",\n \"description\": \"The metrics in the order their values appear in each row -- the only thing that says which number is which.\"\n }\n];\n\nexport const googleAnalyticsReportKind: NodeKindDefinition = defineConnectorKind(GOOGLE_ANALYTICS_REPORT_META, {\n name: GOOGLE_ANALYTICS_REPORT_KIND,\n aliases: [\"google_analytics_report\"],\n label: \"Google Analytics report\",\n description: \"Run a report against a Google Analytics 4 property.\",\n inputs: [{ id: \"in\" }],\n outputs: [{ id: \"out\" }],\n sideEffects: \"none\",\n outputShape: GOOGLE_ANALYTICS_REPORT_OUTPUT,\n configSchema: [\n {\n \"type\": \"text\",\n \"key\": \"property\",\n \"label\": \"Property\",\n \"required\": true,\n \"default\": \"properties/\",\n \"description\": \"The GA4 property, written as `properties/1234567890`. The numeric id alone is not accepted.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"startDate\",\n \"label\": \"Start date\",\n \"required\": true,\n \"default\": \"28daysAgo\",\n \"description\": \"YYYY-MM-DD, or a relative form Google accepts such as `28daysAgo`, `yesterday` or `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"endDate\",\n \"label\": \"End date\",\n \"required\": true,\n \"default\": \"today\",\n \"description\": \"YYYY-MM-DD, or a relative form such as `today`.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"metrics\",\n \"label\": \"Metrics\",\n \"required\": true,\n \"default\": \"activeUsers,sessions\",\n \"description\": \"Metric names, comma separated. For example activeUsers, sessions, screenPageViews.\"\n },\n {\n \"type\": \"text\",\n \"key\": \"dimensions\",\n \"label\": \"Dimensions\",\n \"default\": \"date\",\n \"description\": \"Dimension names, comma separated. For example date, country, pagePath. Leave empty for a single total row.\"\n }\n ],\n defaultConfig: {\n \"mode\": \"auto\"\n },\n renderBody: ({ config }) =>\n summarize(GOOGLE_ANALYTICS_REPORT_META, config as Record<string, unknown>, \"run a report\"),\n});\n","/\n GENERATED FILE — do not edit.\n \n Emitted from provider/manifest.json by weaver's generator.\n * A hand-edit here is destroyed by the next protocol sync, which is worse than\n * being rejected, because it works until it silently does not. Fix\n * provider/manifest.json (or weaver's template/) and regenerate:\n \n npm run provider -- google_analytics\n /\n\n/\n Google Analytics's node kinds for fancy-flow.\n \n Install this on every host. The TypeScript executors live in the js\n * package's `./flow` subpath; PHP and Python hosts run their own and need only\n * this.\n /\n\nexport from \"./service.js\";\nexport * from \"./kinds/report-run.js\";\n\nimport type { NodeKindDefinition } from \"@particle-academy/fancy-flow/engine\";\nimport { googleAnalyticsReportKind } from \"./kinds/report-run.js\";\n\n/** Every Google Analytics kind, for a host that registers the lot. */\nexport const GOOGLE_ANALYTICS_KINDS: NodeKindDefinition[] = [\n googleAnalyticsReportKind,\n];\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@particle-academy/google-analytics-ui",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Google Analytics's authoring surface for fancy-flow — the node kinds, their config schemas and their declared output shapes. React on every host; carries no executor.",
   "repository": {
     "type": "git",