google-apis-cli 0.1.0 → 0.3.0

package/README.md

@@ -1,14 +1,23 @@
 # google-apis-cli (`gapi`)
 
-`gapi` is one CLI for Google Ads, GTM, GA4 (Admin + Data), Search Console, and Indexing.
+`gapi` is one CLI for 47 Google API entries, built from Google's discovery documents at runtime:
 
-- One login. One refresh token. All scopes. Read and write.
+- Google Ads v26, GA4 Admin (v1beta, v1alpha), GA4 Data (v1beta, v1alpha), Search Console, Tag Manager, Indexing
+- Merchant API (13 v1 sub-APIs + Reviews v1alpha), Business Profile (7 v1 APIs + v4)
+- Search Ads 360 (Reporting v0, legacy v2), Campaign Manager 360 v5, Display & Video 360 v4, Bid Manager v2
+- YouTube Data v3, YouTube Analytics v2, YouTube Reporting v1
+- PageSpeed Insights v5, CrUX v1 (API key)
+- BigQuery Data Transfer v1, Data Manager v1, Gmail Postmaster Tools v2, Site Verification v1, Sheets v4, Places (New) v1, Web Risk v1
+
+`gapi --help` lists the entry names; [skills/gapi/reference/index.md](skills/gapi/reference/index.md) gives title, version, method count and auth per entry.
+
+- One login. One refresh token. Every scope the entries use (computed from the documents). Read and write.
 - One runtime dependency: `google-auth-library` (Google). Nothing third-party.
 - All network calls use native `fetch`.
-- TypeScript 7 (strict), Node 24. Node runs `.ts` directly (type-stripping) — no build step in dev. Biome for lint + format. pnpm 12 (corepack-pinned) for package management.
+- TypeScript 7 (strict), Node 26. Node runs `.ts` directly (type-stripping) — no build step in dev. Biome for lint + format. pnpm 12 (pinned via `packageManager`) for package management.
 - It replaces the 4 fragmented Google MCPs in vmCODE.
 
-Command shape: `gapi <api> <resource> <verb> [--json|--raw]`
+Command shape: `gapi <api> <resource>… <method> [--params '<json>'] [--body '<json>'] [--upload <file> [--upload-content-type <type>] [--upload-protocol media|multipart|resumable]] [--output <file>] [--page-all [--page-limit <n>]] [--cache <age>] [--dry-run]`. `gapi <api> [<resource>…]` lists a level (the api level also lists helpers); `… <method> --help` shows method help. `gapi <api> +<helper> … [--dry-run] [--cache <age>] [--project <id>] [--api-key <key>] [<entry header flag>]` runs a hand command, e.g. `gapi ads +gaql "<query>" --customer <id> [--stream]`, `gapi indexing +publishBatch <file>`. `gapi search <words…>` lists at most 20 methods across all API entries that match the words (command, marks, HTTP method, first sentence of the description). `gapi schema <api> <resource>[.<sub>…].<method> | <SchemaName> [--resolve-refs]` prints a method shape or a schema as JSON; `--find <word>` prints instead only the field paths of the expanded schema (a method: `request.…` and `response.…`) whose path or printed description (first sentence, max 100 chars) contains the word. `gapi discovery refresh [<api>…]` refetches discovery documents now; `gapi discovery path` prints the cache dir. `gapi search --help`, `gapi schema --help`, `gapi discovery --help` and `gapi auth [<sub>] --help` print that command's usage and run nothing.
 
 ## Install
 
@@ -16,57 +25,64 @@ Command shape: `gapi <api> <resource> <verb> [--json|--raw]`
 npm i -g google-apis-cli    # installs the `gapi` bin
 ```
 
-Needs **Node ≥ 24** — `gapi` ships as TypeScript and runs on Node's native type-stripping, so there is no build step and no bundle.
+Needs **Node ≥ 26**. The package ships `dist/` (plain `tsc` output, built at publish, no bundle); in the repo, Node runs the `.ts` sources directly.
 
 ## Start here
 
 ```
-gapi auth setup   # store your own OAuth Desktop client (id + secret)
-gapi auth login   # one consent, all 13 scopes
-gapi auth status  # account, refresh token, granted scopes
+gapi auth setup   # store your own OAuth Desktop client (id + secret), optional ids and API key
+gapi auth login   # one consent for every scope the API entries use
+gapi auth status  # account, refresh token, API key, granted and missing scopes
 ```
 
-First run, or a console step fails? **[docs/SETUP.md](docs/SETUP.md)** walks the five steps and
-the traps in each. `gapi` is multi-tenant: every operator brings their own Cloud project.
+First run, or a console step fails? **[docs/SETUP.md](docs/SETUP.md)** walks the steps (services,
+API key, Business Profile access, consent, Merchant registration) and the traps in each. `gapi` is multi-tenant: every operator brings their own Cloud project.
 
 ## OAuth App Verification
 
-`gapi` asks for sensitive scopes (`analytics.manage.users`, `tagmanager.manage.*`, `adwords`, `webmasters`).
+`gapi` asks for sensitive scopes (e.g. `analytics.manage.users`, `tagmanager.manage.*`, `adwords`, `webmasters`). `gapi auth status` shows the granted and the missing scopes. Never requested: `drive`/`drive.*` (restricted) and `display-video-user-management` (Google rejects it for this app).
 
-- **Testing mode** (default) works for all commands, but the refresh token expires every ~7 days — re-run `gapi auth login` when it does.
-- **Production** removes that expiry, but Google requires **OAuth App Verification** first: a privacy-policy URL, a homepage, and a reviewed consent screen. Review timeline is not guaranteed.
+- **Testing mode** (default) works for all commands, but the refresh token expires after 7 days — re-run `gapi auth login` when it does. [Google](https://developers.google.com/identity/protocols/oauth2#expiration): "a publishing status of "Testing" is issued a refresh token expiring in 7 days".
+- **In production** (`Publish app`) removes that expiry. It needs home page, privacy policy and terms of service links ([Google](https://support.google.com/cloud/answer/15549049): "These links are required for all external production apps."). Verification is not a precondition: an unverified production app shows the "unverified app" warning on consent and has a cap of 100 new users ([Manage App Audience](https://support.google.com/cloud/answer/15549945)).
+- **OAuth App Verification** removes the warning and the cap. Personal use does not need it ([Google](https://support.google.com/cloud/answer/13464323): "If the app is for your personal use (fewer than 100 users), you and your limited number of users can continue using the app without going through verification"). Review timeline is not guaranteed.
 
-Testing mode is enough to use the CLI; Production is the no-expiry target. Until verification passes, stay in Testing and re-auth on the ~7-day cadence.
+Testing mode is enough to use the CLI; production is the no-expiry target. Step 4 of [docs/SETUP.md](docs/SETUP.md) walks the switch.
 
 ## Flow
 
-The project has 3 parts. A call moves through them in order.
+A call moves through these parts in order.
 
 | Part | File | Function |
 |---|---|---|
-| **auth** | `src/auth.ts` | `gapi auth login` gets one OAuth consent. It stores the refresh token in `~/.config/gapi/credentials.json` (mode 600). `getAccessToken()` refreshes the access token. Only part with real handlers. |
-| **manifest** | `src/apis/*.ts` | Each API is data, not code: `resource → verb → { httpMethod, pathTemplate, scopes, requiredHeaders?, decoder?, listKey?, query? }`. One file per surface. A glob finds them. No central registry. Row/seam types live in `src/types.ts`. |
-| **executor seam** | `src/rest.ts` | `execute(manifestRow, params, { tokenProvider, fetch })` builds the URL, adds headers, follows pagination, applies the `decoder`, and formats `--json`/`--raw`. All network calls pass here. It is the one test seam. |
+| **run** | `src/run.ts` | `run(argv, io)`: strict argv parse, routing (`--help`, `auth`, `search`, `schema`, `discovery`, `<api> …`), `GapiError` → exit code. `bin/gapi.ts` passes process io. |
+| **Catalog** | `src/catalog.ts` | API entries (`src/apis/*.ts`, glob, no registry) → `ApiModel`. Discovery entries: document cached 24 h. |
+| **Planner** | `src/plan.ts` | `plan(model, words \| methodId, input, settings)` → `CallPlan`. Pure. Every `--params`/`--body` rule; validation fails exit 3 before network. |
+| **Transport** | `src/transport.ts` + `src/transport/{upload,download,batch}.ts` | `send(plan, { fetch, authorize, out, sleep })`. `authorize` adds the credential per request; GET/HEAD/PUT/DELETE and `reads` POSTs retry 408/429/5xx and network errors (max 3, backoff with jitter); non-2xx or network failure → exit 1; 403 `ACCESS_TOKEN_SCOPE_INSUFFICIENT` (also in an array body or a batch part) → exit 2. `--page-all` follows `nextPageToken`, sending `pageToken` in the query or in the request body (methods whose request schema has `pageToken`): one JSON line per page, max `--page-limit` (default 10). `--upload` streams a file to `rootUrl` + `upload/` (media, multipart, or resumable in 8 MiB chunks, resumed from the session's `Range` after a 5xx or network error); `--output` writes the `alt=media` body to a file, from `rootUrl` + `download/` when the method sets `useMediaDownloadService`. `+publishBatch` sends `multipart/mixed` to the document's `batchPath`. `--dry-run` prints the plan instead. |
+| **Search** | `src/search.ts` | `search(models, query)`: SQLite FTS5 index (`node:sqlite`) built in memory per call from every loaded ApiModel, nothing on disk. Words split at camelCase, `-`, `_`, `.`; query tokens are letters and digits only, double-quoted, joined with `OR`; best 20 by `bm25`. |
+| **Renderers** | `src/render.ts` | Root help, level listing, method help, search hits, `schemaView` (`$ref` expansion, cycle guard), `schemaFind` (`--find` field paths), and the skill reference Markdown that `pnpm gen:skill` writes to `skills/gapi/reference/` (generated; do not edit by hand). |
+| **Response cache** | `src/responses.ts` | `--cache <age>` (1s–7d, opt-in per call, [ADR 0001](docs/adr/0001-response-cache.md)): `run` checks eligibility before any network call (no `nocache` entry, single call or pages, `GET` or a `reads` POST), then answers a hit from `responses/` in the config dir (dir 700, files 600) with no fetch, or stores a miss after a successful send. Key holds `identity(auth)` from Credentials (refresh-token hash), so accounts never share entries. `auth login` and `auth logout` delete `responses/`. |
+| **Credentials** | `src/credentials.ts` | Only reader and writer of `config.json` and `credentials.json` (mode 600) in the config dir (`GAPI_CONFIG_DIR` or `~/.config/gapi`; it also holds the discovery `cache/` and `responses/`). `settings`: `--project`, `--api-key` and entry header flags, each flag → env → config. `authorize`: OAuth Bearer (refreshed token saved) or `X-Goog-Api-Key`. `login`, `status` (with `missing`), `logout` (revoke, then delete), `setup`. |
 
-`bin/gapi.ts` parses argv. The dispatch, `--help`, and URL resolution all come from the manifests.
+CLI tests call `run` in-process (`test/run.test.ts`, `test/helpers/io.ts`). Terms: [GLOSSARY.md](GLOSSARY.md).
 
 ## Where to look
 
 | For | Read |
 |---|---|
-| Onboarding a Google account: consent, Ads access level, customer IDs, runtime errors | **[docs/SETUP.md](docs/SETUP.md)** |
+| Onboarding a Google account: services to enable, Ads access level, Business Profile access, API key, consent, Merchant registration, customer IDs, runtime errors | **[docs/SETUP.md](docs/SETUP.md)** |
+| Using the CLI as an agent: grammar, `--params`, `schema`, `--dry-run`, paging, media, helpers, exit codes, marks | [skills/gapi/SKILL.md](skills/gapi/SKILL.md) + generated [reference](skills/gapi/reference/index.md) |
 | What the CLI does, decisions, scopes, endpoints, risks | **[docs/SPEC.md](docs/SPEC.md)** — behavior source of truth |
 | How work is tracked (issues, blocking edges) | [docs/agents/issue-tracker.md](docs/agents/issue-tracker.md) |
 | Triage labels | [docs/agents/triage-labels.md](docs/agents/triage-labels.md) |
-| Domain vocabulary (CONTEXT.md, ADRs) | [docs/agents/domain.md](docs/agents/domain.md) |
+| Domain vocabulary (GLOSSARY.md, ADRs) | [docs/agents/domain.md](docs/agents/domain.md) |
 | Real commands and scripts | `package.json`, `gapi --help` |
 
 ## Add an API or a resource
 
-- New resource = one manifest row.
-- New API = one new `src/apis/<api>.ts` file (default-export `satisfies Manifest`). The glob finds it. No shared file changes.
-- Accept rule — **coverage-oracle**: the self-check fails if the manifest does not cover 100% of the discovery-doc resources.
-- Test through the executor seam. Inject a fake `tokenProvider` and `fetch`. Use no real network.
+- New API = one new `src/apis/<api>.ts` file that default-exports an API entry (`satisfies ApiEntry`): the discovery URL plus overlays (`retired`, `deprecated`, `paid`, `reads`, `nocache`, `headers`, `helpers`). The discovery document gives every resource and method. The glob finds the file; `api` must equal the file name, or the Catalog fails to load. No shared file changes.
+- Check the API's caching terms; set `nocache` (`{ reason, source }`) when they forbid or bound caching ([ADR 0001](docs/adr/0001-response-cache.md)). Else list POST methods that only read (reports, searches) by id in `reads`, so `--cache` accepts them.
+- Accept rule — `pnpm discovery:check` exits 0. It fails when an overlay names a method id that is not in the document. CI runs it weekly and on manual dispatch (`.github/workflows/discovery.yml`); `prepublishOnly` runs it before every publish.
+- Test through `run(argv, io)`: fixture entries via `io.apisDir`, cache seeded in a temp `GAPI_CONFIG_DIR`, fake `fetch` (`test/helpers/fetch.ts`). `--dry-run` shows the request. Use no real network.
 - Before commit: `pnpm typecheck` (tsc --noEmit) · `pnpm lint` (biome) · `pnpm test`.
 - Fix lint by fixing the code it flags — never `biome --unsafe`, never disable a rule to clear it.
 
@@ -76,4 +92,4 @@ The project has 3 parts. A call moves through them in order.
 |---|---|---|
 | Issue tracker | GitHub issues via `gh` | [docs/agents/issue-tracker.md](docs/agents/issue-tracker.md) |
 | Triage labels | 5 canonical labels (string == role) | [docs/agents/triage-labels.md](docs/agents/triage-labels.md) |
-| Domain docs | Single-context (`CONTEXT.md` + `docs/adr/`) | [docs/agents/domain.md](docs/agents/domain.md) |
+| Domain docs | Single-context (`GLOSSARY.md` + `docs/adr/`) | [docs/agents/domain.md](docs/agents/domain.md) |

package/dist/bin/gapi.js

@@ -1,138 +1,14 @@
 #!/usr/bin/env node
-// argv -> dispatch. The command tree, --help, and URL resolution all derive
-// from the auto-discovered manifests (single source). Two branches step outside
-// generic dispatch: `auth` (real handlers) and the `ads gaql` sugar (story 31,
-// query positional + --customer/--stream). Ads adds the optional
-// login-customer-id HTTP header (resolveAdsHeaders) on `ads` calls only.
-import { parseArgs } from 'node:util';
-import { gaqlBody } from '../src/apis/ads.js';
-import { configureAuth, loginLoopback, loginManual, logout, makeTokenProvider, status, } from '../src/auth.js';
-import { QUOTA_PROJECT_ENV, resolveAdsHeaders, resolveSetting } from '../src/config.js';
-import { checkSchema, findRow, loadManifests } from '../src/manifest.js';
-import { execute, pathParams } from '../src/rest.js';
-const GLOBAL_OPTIONS = {
-    json: { type: 'boolean' },
-    raw: { type: 'boolean' },
-    help: { type: 'boolean' },
-    limit: { type: 'string' },
-    body: { type: 'string' },
-    project: { type: 'string' },
-    // Ads (see `ads gaql` sugar + resolveAdsHeaders): login-customer-id header,
-    // target account, and search/searchStream toggle.
-    'login-customer-id': { type: 'string' },
-    customer: { type: 'string' },
-    stream: { type: 'boolean' },
-};
-function printTree(manifests) {
-    console.log('gapi <api> <resource> <verb> [--json|--raw]\n');
-    console.log('auth  setup | login [--manual] | status | logout\n');
-    for (const [api, m] of Object.entries(manifests).sort()) {
-        console.log(api);
-        for (const [resource, verbs] of Object.entries(m.resources).sort()) {
-            console.log(`  ${resource}  ${Object.keys(verbs).sort().join(' | ')}`);
-        }
-    }
-}
-async function runAuth(sub, values) {
-    if (sub === 'login') {
-        const tokens = values.manual ? await loginManual() : await loginLoopback();
-        console.error('gapi: authorized (' +
-            (tokens.refresh_token ? 'refresh token stored' : 'no refresh token') +
-            ')');
-        return;
-    }
-    if (sub === 'setup') {
-        await configureAuth();
-        return console.error('gapi: saved to ~/.config/gapi/config.json');
-    }
-    if (sub === 'status')
-        return console.log(JSON.stringify(status(), null, 2));
-    if (sub === 'logout') {
-        logout();
-        return console.error('gapi: credentials removed');
-    }
-    throw new Error(`unknown auth command: ${sub}`);
-}
-async function main() {
-    const argv = process.argv.slice(2);
-    const manifests = await loadManifests();
-    checkSchema(manifests);
-    if (argv.length === 0 || (argv[0] === '--help' && argv.length === 1)) {
-        printTree(manifests);
-        return;
-    }
-    const [api, ...rest] = argv;
-    if (api === 'auth') {
-        const { values, positionals } = parseArgs({
-            args: rest,
-            options: { manual: { type: 'boolean' }, help: { type: 'boolean' } },
-            allowPositionals: true,
-        });
-        return runAuth(positionals[0], values);
-    }
-    if (!manifests[api])
-        throw new Error(`unknown api: ${api} (try \`gapi --help\`)`);
-    const { values, positionals } = parseArgs({
-        args: rest,
-        options: GLOBAL_OPTIONS,
-        allowPositionals: true,
-    });
-    const [resource, verb] = positionals;
-    if (values.help || !resource || !verb) {
-        printTree({ [api]: manifests[api] });
-        return;
-    }
-    // `ads gaql` is the one sugar beyond generic dispatch (story 31): the query is
-    // a positional, --stream picks searchStream, --customer fills the path param.
-    const isGaql = api === 'ads' && resource === 'gaql';
-    const row = isGaql
-        ? findRow(manifests, api, 'gaql', values.stream ? 'searchStream' : 'search')
-        : findRow(manifests, api, resource, verb);
-    if (!row)
-        throw new Error(`unknown command: ${api} ${resource} ${verb}`);
-    const params = {};
-    if (isGaql) {
-        if (!values.customer)
-            throw new Error('ads gaql requires --customer <id>');
-        params.customer = values.customer;
-        params.body = gaqlBody(verb); // `verb` is the GAQL query string here
-    }
-    else {
-        // params = positional path args after verb, then row.query params as further
-        // positionals, plus body/limit from flags.
-        const pp = pathParams(row.pathTemplate);
-        pp.forEach((name, i) => {
-            if (positionals[2 + i] != null)
-                params[name] = positionals[2 + i];
-        });
-        (row.query ?? []).forEach((name, i) => {
-            const v = positionals[2 + pp.length + i];
-            if (v != null)
-                params[name] = v;
-        });
-    }
-    if (values.limit != null)
-        params.limit = values.limit;
-    if (values.body != null)
-        params.body = JSON.parse(values.body);
-    const quotaProject = resolveSetting(values, {
-        flag: 'project',
-        env: QUOTA_PROJECT_ENV,
-        key: 'project',
-    });
-    // Only Ads calls carry the optional login-customer-id header, so other APIs
-    // never send an Ads-specific header.
-    const extraHeaders = api === 'ads' ? resolveAdsHeaders(values) : undefined;
-    const { json, raw } = await execute(row, params, {
-        tokenProvider: makeTokenProvider(),
-        fetch,
-        quotaProject,
-        extraHeaders,
+import { run } from '../src/run.js';
+const { argv, env, stdin, stdout, stderr } = process;
+// stdout EPIPE (`gapi … | head`): the reader is gone, so stop, which also stops --page-all
+// fetches. Any other stream error (ENOSPC, EBADF) lost output: exit 5, never a silent 0.
+for (const s of [stdout, stderr]) {
+    s.on('error', (e) => {
+        if (e.code !== 'EPIPE')
+            process.exit(5);
+        if (s === stdout)
+            process.exit(0);
     });
-    console.log(JSON.stringify(values.raw ? raw : json, null, 2));
 }
-main().catch((e) => {
-    const detail = e.body ? `\n${JSON.stringify(e.body.error ?? e.body, null, 2)}` : '';
-    console.error(`gapi: ${e.message}${detail}`);
-    process.exit(1);
-});
+process.exitCode = await run(argv.slice(2), { env, fetch, stdin, stdout, stderr });

package/dist/src/apis/ads.js

@@ -1,54 +1,64 @@
-const ADS = ['adwords'];
-const C = '/v25/customers/{customer}';
-// Build the search-request body from a bare GAQL string (story 31). Trivial by
-// design — kept a named pure function so bin/gapi.ts's `gapi ads gaql "<q>"`
-// sugar has one tested seam.
-export const gaqlBody = (query) => ({ query });
-// searchStream → JSON array of {results, ...} chunks; concat into one list.
-const streamConcat = (data) => Array.isArray(data) ? data.flatMap((c) => c?.results ?? []) : data;
-// Every :mutate service is the same shape: POST customers/{}/{collection}:mutate
-// with a {operations:[...]} body. Only the collection segment varies.
-const mutate = (collection) => ({
-    mutate: {
-        httpMethod: 'POST',
-        pathTemplate: `${C}/${collection}:mutate`,
-        scopes: ADS,
+// Google Ads API v26: the discovery entry, plus the `login-customer-id` header for MCC
+// callers (D8) and the `+gaql` helper (D10). A version bump renames the resource literally
+// named `v26` (`gapi ads v26 listPlannableLocations`), so its commands change with it.
+// No developer-token header: it was sunset 2026-09-09 and the API ignores it
+// (https://developers.google.com/google-ads/api/docs/api-policy/developer-token).
+//
+// `:search` keeps its raw {results, nextPageToken}; `ads customers googleAds search
+// --page-all` pages it through the request body (epic #30 D6); `--stream` is the all-rows path.
+import { GapiError } from '../errors.js';
+import { isRecord } from '../json.js';
+import { plan } from '../plan.js';
+const GAQL_ARGS = '"<query>" --customer <id> [--stream]';
+// searchStream (gRPC server-streaming) → over REST a JSON array of {results, ...} chunks
+// with no nextPageToken; concat into one list. No Google doc covers an error mid-stream,
+// so a chunk with an `error` key fails the call rather than vanish from the rows.
+const streamConcat = (data) => {
+    if (!Array.isArray(data))
+        return data;
+    const failed = data.find((c) => isRecord(c) && Object.hasOwn(c, 'error'));
+    if (isRecord(failed)) {
+        const message = isRecord(failed.error) ? failed.error.message : undefined;
+        throw new GapiError(1, typeof message === 'string' ? message : 'searchStream: a chunk holds an error', failed);
+    }
+    const results = data.flatMap((c) => (isRecord(c) && Array.isArray(c.results) ? c.results : []));
+    // SUMMARY_ROW_SETTING puts the totals in the last chunk's summaryRow; keep them.
+    const summaryRow = data.findLast((c) => isRecord(c) && c.summaryRow !== undefined)?.summaryRow;
+    return summaryRow === undefined ? results : { results, summaryRow };
+};
+// D10: one GAQL query; `--stream` returns every row, without it the first page as returned.
+const gaql = {
+    summary: `${GAQL_ARGS}  run one GAQL query; --stream returns every row`,
+    options: { customer: { type: 'string' }, stream: { type: 'boolean' } },
+    plan: async ({ model, args, flags, settings }) => {
+        if (args.length !== 1)
+            throw new GapiError(3, `usage: gapi ads +gaql ${GAQL_ARGS}`);
+        if (typeof flags.customer !== 'string')
+            throw new GapiError(3, '--customer is required');
+        const stream = flags.stream === true;
+        const call = plan(model, `googleads.customers.googleAds.${stream ? 'searchStream' : 'search'}`, {
+            params: { customerId: flags.customer },
+            body: { query: args[0] },
+            dryRun: flags['dry-run'] === true,
+        }, settings);
+        return stream ? { ...call, decode: streamConcat } : call;
     },
-});
+};
 export default {
     api: 'ads',
-    baseUrl: 'https://googleads.googleapis.com',
-    resources: {
-        customers: {
-            // Empty body; returns { resourceNames: ["customers/123", ...] }. Ignores
-            // login-customer-id (direct-access accounts only).
-            'list-accessible': {
-                httpMethod: 'GET',
-                pathTemplate: '/v25/customers:listAccessibleCustomers',
-                scopes: ADS,
-            },
+    discovery: 'https://googleads.googleapis.com/$discovery/rest?version=v26',
+    reads: [
+        'googleads.customers.googleAds.search',
+        'googleads.customers.googleAds.searchStream',
+        'googleads.googleAdsFields.search',
+    ],
+    headers: [
+        {
+            name: 'login-customer-id',
+            flag: 'login-customer-id',
+            env: 'GOOGLE_ADS_LOGIN_CUSTOMER_ID',
+            configKey: 'login-customer-id',
         },
-        gaql: {
-            // Body-paged: {query, pageToken}. Raw {results, nextPageToken} out.
-            search: {
-                httpMethod: 'POST',
-                pathTemplate: `${C}/googleAds:search`,
-                scopes: ADS,
-            },
-            // Streams the whole result set in one response (array of chunks).
-            searchStream: {
-                httpMethod: 'POST',
-                pathTemplate: `${C}/googleAds:searchStream`,
-                scopes: ADS,
-                decoder: streamConcat,
-            },
-        },
-        // Core write surface (:mutate). Body: {operations:[{create|update|remove}]}.
-        campaigns: mutate('campaigns'),
-        'campaign-budgets': mutate('campaignBudgets'),
-        'campaign-criteria': mutate('campaignCriteria'),
-        'ad-groups': mutate('adGroups'),
-        'ad-group-ads': mutate('adGroupAds'),
-        'ad-group-criteria': mutate('adGroupCriteria'),
-    },
+    ],
+    helpers: { '+gaql': gaql },
 };

package/dist/src/apis/bid-manager.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'bid-manager',
+    discovery: 'https://doubleclickbidmanager.googleapis.com/$discovery/rest?version=v2',
+};

package/dist/src/apis/bigquery-dts.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'bigquery-dts',
+    discovery: 'https://bigquerydatatransfer.googleapis.com/$discovery/rest?version=v1',
+};

package/dist/src/apis/business-account-management.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-account-management',
+    discovery: 'https://mybusinessaccountmanagement.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-information.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-information',
+    discovery: 'https://mybusinessbusinessinformation.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-lodging.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-lodging',
+    discovery: 'https://mybusinesslodging.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-notifications.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-notifications',
+    discovery: 'https://mybusinessnotifications.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-performance.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-performance',
+    discovery: 'https://businessprofileperformance.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-place-actions.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-place-actions',
+    discovery: 'https://mybusinessplaceactions.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/business-v4.js

@@ -0,0 +1,52 @@
+const SUNSET = 'https://developers.google.com/my-business/content/sunset-dates';
+const health2024 = { reason: 'Discontinued 2024-07-01', source: SUNSET };
+const qa2025 = { reason: 'Q&A API discontinued 2025-11-03', source: SUNSET };
+const reference = { source: 'https://developers.google.com/my-business/reference/rest' };
+export default {
+    api: 'business-v4',
+    discovery: 'https://developers.google.com/my-business/samples/mybusiness_google_rest_v4p9.json',
+    scopes: ['business.manage'],
+    retired: {
+        'mybusiness.accounts.locations.reportInsights': {
+            reason: 'Discontinued 2023-03-30',
+            source: SUNSET,
+        },
+        'mybusiness.accounts.locations.localPosts.reportInsights': {
+            reason: 'Discontinued 2023-02-20',
+            source: SUNSET,
+        },
+        'mybusiness.accounts.locations.insuranceNetworks.list': health2024,
+        'mybusiness.accounts.locations.getHealthProviderAttributes': health2024,
+        'mybusiness.accounts.locations.updateHealthProviderAttributes': health2024,
+        'mybusiness.accounts.locations.questions.create': qa2025,
+        'mybusiness.accounts.locations.questions.delete': qa2025,
+        'mybusiness.accounts.locations.questions.list': qa2025,
+        'mybusiness.accounts.locations.questions.patch': qa2025,
+        'mybusiness.accounts.locations.questions.answers.delete': qa2025,
+        'mybusiness.accounts.locations.questions.answers.list': qa2025,
+        'mybusiness.accounts.locations.questions.answers.upsert': qa2025,
+    },
+    // The reference page leaves accounts.listRecommendGoogleLocations unmarked: it stays live.
+    deprecated: {
+        'mybusiness.accounts.create': reference,
+        'mybusiness.accounts.deleteNotifications': reference,
+        'mybusiness.accounts.generateAccountNumber': reference,
+        'mybusiness.accounts.get': reference,
+        'mybusiness.accounts.getNotifications': reference,
+        'mybusiness.accounts.list': reference,
+        'mybusiness.accounts.update': reference,
+        'mybusiness.accounts.updateNotifications': reference,
+        'mybusiness.accounts.admins.create': reference,
+        'mybusiness.accounts.admins.delete': reference,
+        'mybusiness.accounts.admins.list': reference,
+        'mybusiness.accounts.admins.patch': reference,
+        'mybusiness.accounts.invitations.accept': reference,
+        'mybusiness.accounts.invitations.decline': reference,
+        'mybusiness.accounts.invitations.list': reference,
+        'mybusiness.accounts.locations.admins.create': reference,
+        'mybusiness.accounts.locations.admins.delete': reference,
+        'mybusiness.accounts.locations.admins.list': reference,
+        'mybusiness.accounts.locations.admins.patch': reference,
+        'mybusiness.accounts.locations.transfer': reference,
+    },
+};

package/dist/src/apis/business-verifications.js

@@ -0,0 +1,5 @@
+export default {
+    api: 'business-verifications',
+    discovery: 'https://mybusinessverifications.googleapis.com/$discovery/rest?version=v1',
+    scopes: ['business.manage'],
+};

package/dist/src/apis/cm360.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'cm360',
+    discovery: 'https://dfareporting.googleapis.com/$discovery/rest?version=v5',
+};

package/dist/src/apis/crux.js

@@ -0,0 +1,8 @@
+export default {
+    api: 'crux',
+    discovery: 'https://chromeuxreport.googleapis.com/$discovery/rest?version=v1',
+    nocache: {
+        reason: 'Google-owned content; Google APIs Terms §5 bound caching to the cache header',
+        source: 'https://developers.google.com/terms',
+    },
+};

package/dist/src/apis/data-manager.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'data-manager',
+    discovery: 'https://datamanager.googleapis.com/$discovery/rest?version=v1',
+};

package/dist/src/apis/dv360.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'dv360',
+    discovery: 'https://displayvideo.googleapis.com/$discovery/rest?version=v4',
+};

package/dist/src/apis/ga4-admin-alpha.js

@@ -0,0 +1,4 @@
+export default {
+    api: 'ga4-admin-alpha',
+    discovery: 'https://analyticsadmin.googleapis.com/$discovery/rest?version=v1alpha',
+};