gsclaw 0.0.0-stage → 0.1.0

package/dist/app-DdGjQNXR.js

@@ -0,0 +1,4489 @@
+import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
+import { z } from "zod";
+//#region src/core/activity.ts
+/**
+* Recent tool calls for the dashboard's trust view: metadata only, never arguments beyond the
+* property or response payloads. In-memory and per instance: serverless platforms may run several
+* instances, and each keeps its own list.
+*/
+var ActivityLog = class {
+	capacity;
+	persistent = false;
+	entries = [];
+	constructor(capacity = 200) {
+		this.capacity = capacity;
+	}
+	record(entry) {
+		this.entries.push(entry);
+		if (this.entries.length > this.capacity) this.entries.shift();
+	}
+	list(limit = this.capacity) {
+		return this.entries.slice(-limit).reverse();
+	}
+};
+const KNOWN_CLIENTS = [
+	[/claude-code|claude code/i, "Claude Code"],
+	[/claude/i, "Claude"],
+	[/chatgpt|openai/i, "ChatGPT"],
+	[/cursor/i, "Cursor"],
+	[/visual studio code|vscode|copilot/i, "VS Code"],
+	[/inspector/i, "MCP Inspector"],
+	[/openclaw/i, "OpenClaw"],
+	[/gemini/i, "Gemini CLI"],
+	[/codex/i, "Codex"]
+];
+/** Maps a User-Agent to a short client label. */
+function clientLabel(userAgent) {
+	if (!userAgent) return "unknown";
+	for (const [pattern, label] of KNOWN_CLIENTS) if (pattern.test(userAgent)) return label;
+	return userAgent.split(/[\s/]/)[0].slice(0, 40) || "unknown";
+}
+//#endregion
+//#region src/core/crypto.ts
+const encoder = new TextEncoder();
+function utf8(input) {
+	return encoder.encode(input);
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+	return btoa(binary);
+}
+function base64ToBytes(base64) {
+	const normalized = base64.replace(/-/g, "+").replace(/_/g, "/").replace(/\s+/g, "");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+function base64UrlEncode(input) {
+	return bytesToBase64(typeof input === "string" ? utf8(input) : input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sha256(input) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(input)));
+}
+/**
+* Constant-time string comparison. Both inputs are hashed first so the comparison time does not
+* depend on where the strings differ or on their lengths.
+*/
+async function timingSafeEqual(a, b) {
+	const [ha, hb] = await Promise.all([sha256(a), sha256(b)]);
+	let diff = 0;
+	for (let i = 0; i < ha.length; i++) diff |= ha[i] ^ hb[i];
+	return diff === 0;
+}
+function randomToken(bytes = 32) {
+	return [...crypto.getRandomValues(new Uint8Array(bytes))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+//#region src/core/log.ts
+const LOG_LEVELS = [
+	"debug",
+	"info",
+	"warn",
+	"error",
+	"silent"
+];
+const RANK = {
+	debug: 10,
+	info: 20,
+	warn: 30,
+	error: 40,
+	silent: 100
+};
+const SECRET_KEY = /token|secret|password|authorization|cookie|private_?key|assertion|credential|api_?key/i;
+const defaultWriter = (line, level) => {
+	if (level === "error" || level === "warn") console.error(line);
+	else console.log(line);
+};
+/** For stdio transports: stdout carries the MCP protocol, so every log line goes to stderr. */
+const stderrWriter = (line) => console.error(line);
+function redact(value, depth = 0) {
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message
+	};
+	if (depth > 4 || value === null || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.slice(0, 20).map((v) => redact(v, depth + 1));
+	const out = {};
+	for (const [key, v] of Object.entries(value)) out[key] = SECRET_KEY.test(key) ? "[redacted]" : redact(v, depth + 1);
+	return out;
+}
+function createLogger(options = {}) {
+	const threshold = RANK[options.level ?? "info"];
+	const write = options.write ?? defaultWriter;
+	const base = options.base ?? {};
+	const emit = (level, msg, fields) => {
+		if (RANK[level] < threshold) return;
+		const entry = {
+			time: (/* @__PURE__ */ new Date()).toISOString(),
+			level,
+			msg,
+			...base,
+			...fields ?? {}
+		};
+		write(JSON.stringify(redact(entry)), level);
+	};
+	return {
+		debug: (msg, fields) => emit("debug", msg, fields),
+		info: (msg, fields) => emit("info", msg, fields),
+		warn: (msg, fields) => emit("warn", msg, fields),
+		error: (msg, fields) => emit("error", msg, fields),
+		child: (fields) => createLogger({
+			level: options.level,
+			write,
+			base: {
+				...base,
+				...fields
+			}
+		})
+	};
+}
+createLogger({ level: "silent" });
+const SETUP_DOCS_URL = "https://github.com/tuyakhov/gsclaw/blob/main/docs/setup.md";
+/**
+* Loads and validates configuration from environment variables. Never throws.
+*
+* Error messages name variables but never echo their values: on serverless deployments they are
+* shown on the public setup page, and a secret pasted into the wrong variable must not leak.
+*/
+function loadConfig(env, opts) {
+	const errors = [];
+	const warnings = [];
+	const read = (key) => {
+		const value = env[key]?.trim();
+		return value ? value : void 0;
+	};
+	const hasServiceAccount = Boolean(read("GOOGLE_SERVICE_ACCOUNT_JSON"));
+	const hasOAuth = Boolean(read("GOOGLE_OAUTH_CLIENT_ID") || read("GOOGLE_OAUTH_CLIENT_SECRET"));
+	const explicitMode = read("GSCLAW_AUTH_MODE");
+	let authMode;
+	if (explicitMode) {
+		if (explicitMode === "service_account" || explicitMode === "oauth") authMode = explicitMode;
+		else errors.push({
+			variable: "GSCLAW_AUTH_MODE",
+			message: "must be \"service_account\" or \"oauth\"."
+		});
+	} else if (hasServiceAccount && hasOAuth) errors.push({
+		variable: "GSCLAW_AUTH_MODE",
+		message: "both service-account and Google OAuth variables are set. Set GSCLAW_AUTH_MODE to \"service_account\" or \"oauth\" to choose one."
+	});
+	else if (hasServiceAccount) authMode = "service_account";
+	else if (hasOAuth) authMode = "oauth";
+	else errors.push({ message: "No authentication mode is configured, so GSClaw refuses to start (it never runs open). " + (opts.transport === "http" ? "Set GOOGLE_SERVICE_ACCOUNT_JSON and GSCLAW_ACCESS_TOKEN (service-account mode), or GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GSCLAW_ENCRYPTION_KEY and PUBLIC_BASE_URL (Google OAuth mode)." : "Set GOOGLE_SERVICE_ACCOUNT_JSON or GOOGLE_APPLICATION_CREDENTIALS.") + ` See ${SETUP_DOCS_URL}` });
+	let serviceAccount;
+	let accessToken;
+	if (authMode === "service_account") {
+		const raw = read("GOOGLE_SERVICE_ACCOUNT_JSON");
+		if (!raw) errors.push({
+			variable: "GOOGLE_SERVICE_ACCOUNT_JSON",
+			message: "is required in service-account mode (paste the key JSON, raw or base64)."
+		});
+		else {
+			const parsed = parseServiceAccountJson(raw);
+			if ("error" in parsed) errors.push({
+				variable: "GOOGLE_SERVICE_ACCOUNT_JSON",
+				message: parsed.error
+			});
+			else serviceAccount = parsed.key;
+		}
+		if (opts.transport === "http") {
+			accessToken = read("GSCLAW_ACCESS_TOKEN");
+			if (!accessToken) errors.push({
+				variable: "GSCLAW_ACCESS_TOKEN",
+				message: "is required for HTTP deployments so the endpoint is never public. Generate one with `openssl rand -hex 32` or `npx gsclaw generate-token`."
+			});
+			else if (accessToken.length < 32) errors.push({
+				variable: "GSCLAW_ACCESS_TOKEN",
+				message: `must be at least 32 characters. Generate one with \`openssl rand -hex 32\`.`
+			});
+		}
+	}
+	const encryptionKey = read("GSCLAW_ENCRYPTION_KEY");
+	if (encryptionKey && encryptionKey.length < 32) errors.push({
+		variable: "GSCLAW_ENCRYPTION_KEY",
+		message: `must be at least 32 characters. Generate one with \`openssl rand -hex 32\`.`
+	});
+	let googleOAuth;
+	if (authMode === "oauth") {
+		if (opts.transport === "stdio") errors.push({
+			variable: "GSCLAW_AUTH_MODE",
+			message: "Google OAuth mode is for HTTP deployments. For local stdio use, set GOOGLE_SERVICE_ACCOUNT_JSON or GOOGLE_APPLICATION_CREDENTIALS instead."
+		});
+		const clientId = read("GOOGLE_OAUTH_CLIENT_ID");
+		const clientSecret = read("GOOGLE_OAUTH_CLIENT_SECRET");
+		if (!clientId) errors.push({
+			variable: "GOOGLE_OAUTH_CLIENT_ID",
+			message: "is required in OAuth mode (Google Cloud → APIs & Services → Credentials → OAuth client ID)."
+		});
+		if (!clientSecret) errors.push({
+			variable: "GOOGLE_OAUTH_CLIENT_SECRET",
+			message: "is required in OAuth mode."
+		});
+		if (!encryptionKey) errors.push({
+			variable: "GSCLAW_ENCRYPTION_KEY",
+			message: "is required in OAuth mode; it encrypts the tokens GSClaw issues. Generate one with `openssl rand -hex 32`."
+		});
+		const list = (key) => (read(key) ?? "").split(",").map((v) => v.trim().toLowerCase().replace(/^@/, "")).filter(Boolean);
+		if (clientId && clientSecret) googleOAuth = {
+			clientId,
+			clientSecret,
+			allowedEmails: list("ALLOWED_GOOGLE_EMAILS"),
+			allowedDomains: list("ALLOWED_GOOGLE_DOMAINS")
+		};
+	}
+	const bool = (key, fallback) => {
+		const value = read(key);
+		if (value === void 0) return fallback;
+		const v = value.toLowerCase();
+		if ([
+			"1",
+			"true",
+			"yes",
+			"on"
+		].includes(v)) return true;
+		if ([
+			"0",
+			"false",
+			"no",
+			"off"
+		].includes(v)) return false;
+		errors.push({
+			variable: key,
+			message: "must be \"true\" or \"false\"."
+		});
+		return fallback;
+	};
+	const int = (key, fallback, min, max) => {
+		const value = read(key);
+		if (value === void 0) return fallback;
+		const n = Number(value);
+		if (!Number.isInteger(n) || n < min || n > max) {
+			errors.push({
+				variable: key,
+				message: `must be an integer between ${min} and ${max}.`
+			});
+			return fallback;
+		}
+		return n;
+	};
+	const logLevelRaw = (read("LOG_LEVEL") ?? "info").toLowerCase();
+	let logLevel = "info";
+	if (LOG_LEVELS.includes(logLevelRaw)) logLevel = logLevelRaw;
+	else errors.push({
+		variable: "LOG_LEVEL",
+		message: `must be one of ${LOG_LEVELS.join(", ")}.`
+	});
+	let publicBaseUrl = read("PUBLIC_BASE_URL") ?? detectPlatformBaseUrl(env);
+	if (publicBaseUrl) try {
+		const url = new URL(publicBaseUrl);
+		publicBaseUrl = url.origin + url.pathname.replace(/\/+$/, "");
+	} catch {
+		errors.push({
+			variable: "PUBLIC_BASE_URL",
+			message: "is not a valid URL (expected e.g. https://gsclaw.example.com)."
+		});
+		publicBaseUrl = void 0;
+	}
+	const allowedOrigins = [];
+	for (const entry of (read("GSCLAW_ALLOWED_ORIGINS") ?? "").split(",")) {
+		const value = entry.trim();
+		if (!value) continue;
+		try {
+			allowedOrigins.push(new URL(value).origin);
+		} catch {
+			errors.push({
+				variable: "GSCLAW_ALLOWED_ORIGINS",
+				message: "contains an invalid origin (expected e.g. https://app.example.com)."
+			});
+		}
+	}
+	const allowWrites = bool("GSCLAW_ALLOW_WRITES", false);
+	const dashboard = bool("GSCLAW_DASHBOARD", true);
+	const secretPath = bool("GSCLAW_SECRET_PATH", true);
+	const rateLimitPerMinute = int("GSCLAW_RATE_LIMIT_PER_MINUTE", 120, 0, 1e5);
+	const cacheTtlSeconds = int("GSCLAW_CACHE_TTL_SECONDS", 300, 0, 86400);
+	const maxRows = int("GSCLAW_MAX_ROWS", 25e3, 1, 5e5);
+	const batchInspectMax = int("GSCLAW_BATCH_INSPECT_MAX", 50, 1, 500);
+	const oauthRedirectHosts = (read("GSCLAW_OAUTH_REDIRECT_HOSTS") ?? "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+	if (authMode === "oauth" && opts.transport === "http") {
+		if (!publicBaseUrl) errors.push({
+			variable: "PUBLIC_BASE_URL",
+			message: "is required in OAuth mode (e.g. https://gsclaw.example.com); Google redirects back to PUBLIC_BASE_URL/oauth/google/callback."
+		});
+		else {
+			const url = new URL(publicBaseUrl);
+			const loopback = [
+				"localhost",
+				"127.0.0.1",
+				"[::1]"
+			].includes(url.hostname);
+			if (url.protocol !== "https:" && !loopback) errors.push({
+				variable: "PUBLIC_BASE_URL",
+				message: "must use https in OAuth mode."
+			});
+		}
+	}
+	if (errors.length > 0 || !authMode) return {
+		ok: false,
+		errors
+	};
+	if (googleOAuth && googleOAuth.allowedEmails.length === 0 && googleOAuth.allowedDomains.length === 0) warnings.push("No ALLOWED_GOOGLE_EMAILS or ALLOWED_GOOGLE_DOMAINS set: anyone with a Google account can sign in to this deployment (each person only sees their own Search Console properties).");
+	if (allowWrites) warnings.push("GSCLAW_ALLOW_WRITES=true: submit_sitemap and delete_sitemap are enabled. The service account needs Full permission on each property.");
+	return {
+		ok: true,
+		warnings,
+		config: {
+			authMode,
+			serviceAccount,
+			accessToken,
+			googleOAuth,
+			sealingSecret: opts.transport !== "http" ? void 0 : accessToken ? [encryptionKey, accessToken].filter(Boolean).join("\n") : encryptionKey,
+			oauthRedirectHosts,
+			publicBaseUrl,
+			allowWrites,
+			dashboard,
+			secretPath,
+			allowedOrigins,
+			logLevel,
+			rateLimitPerMinute,
+			cacheTtlSeconds,
+			maxRows,
+			batchInspectMax
+		}
+	};
+}
+function parseServiceAccountJson(raw) {
+	let text = raw.trim();
+	if (!text.startsWith("{")) try {
+		text = new TextDecoder().decode(base64ToBytes(text)).trim();
+	} catch {
+		return { error: "is neither JSON nor base64-encoded JSON." };
+	}
+	let data;
+	try {
+		data = JSON.parse(text);
+	} catch {
+		return { error: "is not valid JSON. Paste the whole key file you downloaded from Google Cloud (or base64-encode it)." };
+	}
+	if (!data || typeof data !== "object") return { error: "must be a JSON object." };
+	const obj = data;
+	if (obj.type !== void 0 && obj.type !== "service_account") return { error: `has type "${JSON.stringify(obj.type)}" but must be a service-account key ("type": "service_account"). OAuth client JSON files belong in GOOGLE_OAUTH_CLIENT_ID/SECRET instead.` };
+	if (typeof obj.client_email !== "string" || !obj.client_email.includes("@")) return { error: "is missing \"client_email\"." };
+	if (typeof obj.private_key !== "string" || !obj.private_key.includes("PRIVATE KEY")) return { error: "is missing \"private_key\"." };
+	const privateKey = obj.private_key.includes("\n") ? obj.private_key : obj.private_key.replace(/\\n/g, "\n");
+	return { key: {
+		client_email: obj.client_email,
+		private_key: privateKey,
+		private_key_id: typeof obj.private_key_id === "string" ? obj.private_key_id : void 0,
+		project_id: typeof obj.project_id === "string" ? obj.project_id : void 0,
+		token_uri: typeof obj.token_uri === "string" ? obj.token_uri : void 0
+	} };
+}
+/** Best-effort public URL detection so one-click deploys work without PUBLIC_BASE_URL. */
+function detectPlatformBaseUrl(env) {
+	const https = (host) => host ? `https://${host.replace(/^https?:\/\//, "")}` : void 0;
+	return https(env.VERCEL_PROJECT_PRODUCTION_URL) ?? env.URL ?? env.RENDER_EXTERNAL_URL ?? https(env.RAILWAY_PUBLIC_DOMAIN) ?? env.APP_URL ?? (env.FLY_APP_NAME ? `https://${env.FLY_APP_NAME}.fly.dev` : void 0);
+}
+function formatConfigErrors(errors) {
+	return [
+		"GSClaw is not configured correctly and will not start:",
+		"",
+		...errors.map((e) => `  • ${e.variable ? `${e.variable} ` : ""}${e.message}`),
+		"",
+		`Setup guide: ${SETUP_DOCS_URL}`
+	].join("\n");
+}
+//#endregion
+//#region src/core/errors.ts
+/** An error whose message is written for the end user (and their AI) and safe to show verbatim. */
+var UserFacingError = class extends Error {
+	kind;
+	constructor(message, kind = "invalid_input") {
+		super(message);
+		this.name = "UserFacingError";
+		this.kind = kind;
+	}
+};
+var GscApiError = class extends UserFacingError {
+	status;
+	reason;
+	googleMessage;
+	retryable;
+	constructor(opts) {
+		const suffix = opts.googleMessage ? `\n\nGoogle said: ${opts.googleMessage}` : "";
+		super(`${opts.advice}${suffix}`, opts.kind);
+		this.name = "GscApiError";
+		this.status = opts.status;
+		this.reason = opts.reason;
+		this.googleMessage = opts.googleMessage;
+		this.retryable = opts.retryable ?? false;
+	}
+};
+const RATE_LIMIT_REASONS = /* @__PURE__ */ new Set([
+	"rateLimitExceeded",
+	"userRateLimitExceeded",
+	"rateLimitExceededUnreg"
+]);
+const DAILY_QUOTA_REASONS = /* @__PURE__ */ new Set([
+	"quotaExceeded",
+	"dailyLimitExceeded",
+	"dailyLimitExceededUnreg"
+]);
+function who(identity) {
+	return identity.kind === "service_account" ? `The service account ${identity.email}` : `Your Google account (${identity.email})`;
+}
+/** Turns a Google API error response into an actionable message. */
+function toGscApiError(status, body, ctx) {
+	const err = body?.error;
+	const googleMessage = (err?.message ?? (typeof body === "string" ? body : "")).slice(0, 500);
+	const reasons = /* @__PURE__ */ new Set();
+	for (const e of err?.errors ?? []) if (e.reason) reasons.add(e.reason);
+	for (const d of err?.details ?? []) if (d.reason) reasons.add(d.reason);
+	if (err?.status) reasons.add(err.status);
+	const reason = [...reasons][0];
+	const has = (...names) => names.some((n) => reasons.has(n));
+	const site = ctx.siteUrl ? `'${ctx.siteUrl}'` : "this property";
+	const { identity } = ctx;
+	if (status === 429 || has(...RATE_LIMIT_REASONS) || has("RESOURCE_EXHAUSTED") && !has(...DAILY_QUOTA_REASONS)) return new GscApiError({
+		kind: "rate_limited",
+		status,
+		reason,
+		googleMessage,
+		retryable: true,
+		advice: "Google's Search Console API rate limit was hit (Search Analytics allows ~1,200 queries/min per site; URL Inspection 600/min). Wait a minute and retry. If it keeps happening, use shorter date ranges or fewer page/query breakdowns, which count heavier against the load quota."
+	});
+	if (has(...DAILY_QUOTA_REASONS)) return new GscApiError({
+		kind: "quota_exceeded",
+		status,
+		reason,
+		googleMessage,
+		advice: "The daily Search Console API quota is used up (URL Inspection allows 2,000 inspections per property per day). It resets at midnight Pacific Time."
+	});
+	if (has("SERVICE_DISABLED", "accessNotConfigured") || /has not been used in project|is disabled/i.test(googleMessage)) {
+		const project = identity.projectId ?? googleMessage.match(/project (\d+|[a-z][a-z0-9-]+)/)?.[1];
+		const link = `https://console.cloud.google.com/apis/library/searchconsole.googleapis.com${project ? `?project=${project}` : ""}`;
+		return new GscApiError({
+			kind: "api_disabled",
+			status,
+			reason,
+			googleMessage,
+			advice: `The Google Search Console API is not enabled for the Google Cloud project${project ? ` "${project}"` : ""}. Enable it at ${link}, wait a minute, then retry.`
+		});
+	}
+	if (status === 401) return new GscApiError({
+		kind: "auth",
+		status,
+		reason,
+		googleMessage,
+		advice: identity.kind === "service_account" ? "Google rejected the service-account credentials. The key may have been deleted or rotated: create a new JSON key in Google Cloud and update GOOGLE_SERVICE_ACCOUNT_JSON." : "Your Google sign-in has expired or was revoked. Reconnect GSClaw in your AI client to sign in again."
+	});
+	if (status === 403) {
+		const fix = identity.kind === "service_account" ? `In Search Console, open the property → Settings → Users and permissions → Add user, and add ${identity.email} (Restricted is enough for reading; Full is needed for sitemap changes).` : "Ask an owner of the property to add your Google account in Search Console → Settings → Users and permissions.";
+		return new GscApiError({
+			kind: "permission",
+			status,
+			reason,
+			googleMessage,
+			advice: `${who(identity)} does not have access to ${site}. ${fix} Also check the property format: domain properties look like 'sc-domain:example.com', URL-prefix properties like 'https://www.example.com/' (exact scheme, www and trailing slash). Run list_sites to see every property this server can read.`
+		});
+	}
+	if (status === 404) return new GscApiError({
+		kind: "not_found",
+		status,
+		reason,
+		googleMessage,
+		advice: `Not found. Check the property and URL: run list_sites for valid properties, and pass sitemaps as full URLs exactly as list_sitemaps shows them.`
+	});
+	if (status === 400) return new GscApiError({
+		kind: "invalid_argument",
+		status,
+		reason,
+		googleMessage,
+		advice: "Google rejected the request parameters. Common causes: searchAppearance combined with other dimensions, aggregation_type \"byProperty\" with a page dimension/filter, Discover/Google News with query or position data, or dates older than 16 months."
+	});
+	return new GscApiError({
+		kind: "server",
+		status,
+		reason,
+		googleMessage,
+		retryable: status >= 500,
+		advice: `Google's Search Console API returned an error (HTTP ${status}). This is usually temporary; try again shortly.`
+	});
+}
+/** Message for any thrown value, safe to return to clients. Unknown errors are not echoed in detail. */
+function publicErrorMessage(error) {
+	if (error instanceof UserFacingError) return {
+		message: error.message,
+		kind: error.kind
+	};
+	return {
+		message: "Unexpected internal error. Check the server logs for details.",
+		kind: "internal"
+	};
+}
+//#endregion
+//#region src/core/gsc/sites.ts
+function normalizePermission(level) {
+	switch (level.replace(/_/g, "").toLowerCase()) {
+		case "siteowner": return "owner";
+		case "sitefulluser": return "full";
+		case "siterestricteduser": return "restricted";
+		case "siteunverifieduser": return "unverified";
+		default: return "unknown";
+	}
+}
+function toProperty(entry) {
+	const permission = normalizePermission(entry.permissionLevel);
+	const isDomain = entry.siteUrl.startsWith("sc-domain:");
+	let host = entry.siteUrl;
+	if (isDomain) host = entry.siteUrl.slice(10);
+	else try {
+		host = new URL(entry.siteUrl).host;
+	} catch {}
+	return {
+		site_url: entry.siteUrl,
+		type: isDomain ? "domain" : "url_prefix",
+		host: host.toLowerCase(),
+		permission_level: permission,
+		has_access: permission !== "unverified"
+	};
+}
+async function listProperties(client, opts = {}) {
+	return (await client.listSites(opts)).map(toProperty).sort((a, b) => Number(b.has_access) - Number(a.has_access) || Number(b.type === "domain") - Number(a.type === "domain") || a.site_url.localeCompare(b.site_url));
+}
+function stripWww(host) {
+	return host.replace(/^www\./, "");
+}
+/** True if `property` would contain data for `url`. */
+function propertyCoversUrl(property, url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	const host = parsed.host.toLowerCase();
+	if (property.type === "domain") return host === property.host || host.endsWith(`.${property.host}`);
+	return url.startsWith(property.site_url) || `${url}/` === property.site_url;
+}
+function describeAvailable(properties) {
+	const usable = properties.filter((p) => p.has_access);
+	if (usable.length === 0) return "This server cannot read any Search Console property yet. Add its Google identity as a user on your properties (Search Console → Settings → Users and permissions).";
+	return `Available properties: ${usable.slice(0, 20).map((p) => `'${p.site_url}'`).join(", ")}${usable.length > 20 ? `, … (${usable.length} total)` : ""}.`;
+}
+/**
+* Resolves user input ('sc-domain:example.com', 'https://www.example.com/', 'example.com',
+* or any URL on the site) to a property this identity can read.
+*/
+async function resolveProperty(client, input) {
+	const properties = await listProperties(client);
+	const usable = properties.filter((p) => p.has_access);
+	const raw = input.trim();
+	const lower = raw.toLowerCase();
+	const exact = properties.find((p) => p.site_url.toLowerCase() === lower || p.site_url.toLowerCase() === `${lower}/`);
+	if (exact) {
+		if (!exact.has_access) throw new UserFacingError(`'${exact.site_url}' is listed but unverified for this identity, so Search Console exposes no data for it. Verify ownership or ask an owner for access. ${describeAvailable(properties)}`, "permission");
+		return exact;
+	}
+	if (lower.startsWith("sc-domain:")) throw new UserFacingError(`No access to '${raw}'. ${describeAvailable(properties)}`, "not_found");
+	const hasScheme = /^https?:\/\//.test(lower);
+	let url;
+	try {
+		url = new URL(hasScheme ? raw : `https://${raw}`);
+	} catch {
+		throw new UserFacingError(`'${raw}' is not a valid property, domain or URL. ${describeAvailable(properties)}`);
+	}
+	const host = url.host.toLowerCase();
+	const domainMatch = usable.filter((p) => p.type === "domain" && (host === p.host || host.endsWith(`.${p.host}`))).sort((a, b) => b.host.length - a.host.length)[0];
+	const prefixMatches = usable.filter((p) => p.type === "url_prefix").filter((p) => {
+		if (hasScheme) return propertyCoversUrl(p, url.href);
+		return stripWww(p.host) === stripWww(host) && (url.pathname === "/" || propertyCoversUrl(p, `https://${p.host}${url.pathname}`));
+	}).sort((a, b) => {
+		if (b.site_url.length !== a.site_url.length && hasScheme) return b.site_url.length - a.site_url.length;
+		const score = (p) => (p.site_url.startsWith("https://") ? 2 : 0) + (p.host === host ? 1 : 0);
+		return score(b) - score(a);
+	});
+	const match = hasScheme ? prefixMatches[0] ?? domainMatch : domainMatch ?? prefixMatches[0];
+	if (match) return match;
+	throw new UserFacingError(`No Search Console property matches '${raw}'. ${describeAvailable(properties)}`, "not_found");
+}
+/** Resolves a page given as an absolute URL or a path ('/pricing') against a property. */
+function absolutePageUrl(property, page) {
+	if (/^https?:\/\//i.test(page)) return page;
+	if (!page.startsWith("/")) return null;
+	if (property.type === "url_prefix") return new URL(page.replace(/^\//, ""), property.site_url).href;
+	return null;
+}
+//#endregion
+//#region src/core/gsc/auth.ts
+const SCOPE_READONLY = "https://www.googleapis.com/auth/webmasters.readonly";
+const SCOPE_READWRITE = "https://www.googleapis.com/auth/webmasters";
+const EXPIRY_MARGIN_MS = 6e4;
+/**
+* Service-account tokens via the OAuth 2.0 JWT bearer flow, signed with WebCrypto (RS256) so it
+* runs on Node and Cloudflare Workers alike. The imported key and the access token are cached for
+* the life of the instance.
+*/
+var ServiceAccountTokenSource = class {
+	identity;
+	scopes;
+	key;
+	fetchImpl;
+	now;
+	cryptoKey;
+	cached;
+	inflight;
+	constructor(key, scopes, opts = {}) {
+		this.key = key;
+		this.scopes = scopes;
+		this.fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));
+		this.now = opts.now ?? Date.now;
+		this.identity = {
+			kind: "service_account",
+			email: key.client_email,
+			projectId: key.project_id
+		};
+	}
+	async getAccessToken() {
+		if (this.cached && this.cached.expiresAt - EXPIRY_MARGIN_MS > this.now()) return this.cached.token;
+		this.inflight ??= this.fetchToken().finally(() => {
+			this.inflight = void 0;
+		});
+		return this.inflight;
+	}
+	invalidate() {
+		this.cached = void 0;
+	}
+	/** Builds the signed JWT assertion. Exposed for tests. */
+	async createAssertion() {
+		const iat = Math.floor(this.now() / 1e3);
+		const header = {
+			alg: "RS256",
+			typ: "JWT",
+			...this.key.private_key_id ? { kid: this.key.private_key_id } : {}
+		};
+		const claims = {
+			iss: this.key.client_email,
+			scope: this.scopes.join(" "),
+			aud: this.key.token_uri ?? "https://oauth2.googleapis.com/token",
+			iat,
+			exp: iat + 3600
+		};
+		const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+		this.cryptoKey ??= importPkcs8(this.key.private_key);
+		const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", await this.cryptoKey, utf8(signingInput));
+		return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+	}
+	async fetchToken() {
+		let assertion;
+		try {
+			assertion = await this.createAssertion();
+		} catch {
+			this.cryptoKey = void 0;
+			throw new GscApiError({
+				kind: "auth",
+				status: 0,
+				googleMessage: "",
+				advice: "The service-account private key could not be read. Make sure GOOGLE_SERVICE_ACCOUNT_JSON contains the complete key file, including \"-----BEGIN PRIVATE KEY-----\"."
+			});
+		}
+		const res = await this.fetchImpl(this.key.token_uri ?? "https://oauth2.googleapis.com/token", {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+				assertion
+			}).toString()
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok || !body.access_token) {
+			const detail = [body.error, body.error_description].filter(Boolean).join(": ");
+			throw new GscApiError({
+				kind: "auth",
+				status: res.status,
+				reason: body.error,
+				googleMessage: detail,
+				retryable: res.status >= 500,
+				advice: body.error === "invalid_grant" ? "Google refused the service-account token (invalid_grant). Usually the key was deleted in Google Cloud, or this server’s clock is off by more than a few minutes. Create a new key and update GOOGLE_SERVICE_ACCOUNT_JSON." : `Could not obtain a Google access token for the service account ${this.key.client_email}. Check that the key is valid and not disabled.`
+			});
+		}
+		this.cached = {
+			token: body.access_token,
+			expiresAt: this.now() + (body.expires_in ?? 3600) * 1e3
+		};
+		return body.access_token;
+	}
+};
+async function importPkcs8(pem) {
+	const der = base64ToBytes(pem.replace(/-----(BEGIN|END) PRIVATE KEY-----/g, "").replace(/\s+/g, ""));
+	return crypto.subtle.importKey("pkcs8", der, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+}
+/**
+* A signed-in Google user's credentials (OAuth mode). Uses the access token carried in GSClaw's own
+* token while it is fresh, then refreshes with the user's refresh token, sharing results across
+* requests on this instance.
+*/
+var UserTokenSource = class {
+	identity;
+	scopes;
+	opts;
+	inflight;
+	constructor(email, scopes, opts) {
+		this.identity = {
+			kind: "user",
+			email
+		};
+		this.scopes = scopes;
+		this.opts = opts;
+	}
+	nowMs() {
+		return this.opts.now ? this.opts.now() : Date.now();
+	}
+	async getAccessToken() {
+		const now = this.nowMs();
+		const { accessToken, expiresAt, cache, sub } = this.opts;
+		if (accessToken && expiresAt && expiresAt * 1e3 - EXPIRY_MARGIN_MS > now) return accessToken;
+		const cached = cache.get(sub);
+		if (cached && cached.expiresAt * 1e3 - EXPIRY_MARGIN_MS > now) return cached.token;
+		this.inflight ??= this.opts.refresh(this.opts.refreshToken).then((fresh) => {
+			cache.set(sub, {
+				token: fresh.accessToken,
+				expiresAt: fresh.expiresAt
+			});
+			return fresh.accessToken;
+		}).finally(() => {
+			this.inflight = void 0;
+		});
+		return this.inflight;
+	}
+	invalidate() {
+		this.opts.accessToken = void 0;
+		this.opts.cache.delete(this.opts.sub);
+	}
+};
+//#endregion
+//#region package.json
+var version = "0.1.0";
+//#endregion
+//#region src/core/version.ts
+const NAME = "gsclaw";
+const VERSION = version;
+const REPO_URL = "https://github.com/tuyakhov/gsclaw";
+//#endregion
+//#region src/core/pages.ts
+const escape = (s) => s.replace(/[&<>"']/g, (c) => ({
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+})[c]);
+const HTML_SECURITY_HEADERS = {
+	"content-type": "text/html; charset=utf-8",
+	"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+	"x-content-type-options": "nosniff",
+	"referrer-policy": "no-referrer",
+	"x-frame-options": "DENY",
+	"cache-control": "no-store"
+};
+function layout(title, body) {
+	return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex"><title>${escape(title)}</title>
+<style>
+:root{color-scheme:light dark;--fg:#1c1b1a;--muted:#6b6862;--bg:#faf9f7;--card:#fff;--line:#e6e3de;--accent:#0d9488;--accent-text:#fff}
+@media (prefers-color-scheme:dark){:root{--fg:#ecebe8;--muted:#a19e98;--bg:#151413;--card:#1e1d1b;--line:#33312e;--accent:#2dd4bf;--accent-text:#062b27}}
+body{margin:0;font:16px/1.55 system-ui,-apple-system,"Segoe UI",sans-serif;background:var(--bg);color:var(--fg);display:grid;place-items:center;min-height:100vh;padding:16px;box-sizing:border-box}
+main{max-width:560px;width:100%;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:28px}
+h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:.5rem 0;color:var(--muted)}a{color:var(--accent)}
+ul{padding-left:1.2rem}li{margin:.35rem 0}code{font-size:.9em}
+form{display:grid;gap:10px;margin-top:16px}label{font-weight:600;font-size:.9rem}
+input{font:inherit;height:40px;padding:0 12px;border:1px solid var(--line);border-radius:8px;background:var(--bg);color:var(--fg)}
+.actions{display:flex;gap:8px;flex-wrap:wrap;margin-top:4px}
+button,.button{font:inherit;font-weight:600;height:40px;border-radius:8px;padding:0 16px;border:1px solid var(--line);background:var(--card);color:var(--fg);cursor:pointer;text-decoration:none;display:inline-flex;align-items:center}
+.primary{background:var(--accent);border-color:var(--accent);color:var(--accent-text)}
+.client{background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:12px 14px;margin:14px 0;color:var(--fg)}
+.client small{display:block;color:var(--muted)}.warn{color:#b45309}.error{color:#b91c1c;margin:0}
+</style></head><body><main>${body}</main></body></html>`;
+}
+/** Minimal public page: confirms the server runs, reveals nothing about its configuration. */
+function runningPage() {
+	return layout("GSClaw", `<h1>GSClaw is running</h1>
+<p>This is a Google Search Console MCP server. Connect it from your AI client; the endpoint requires authentication.</p>
+<p><a href="${REPO_URL}#readme">Documentation</a></p>`);
+}
+/** Shown on serverless deployments that are missing configuration (names only, never values). */
+function setupPage(issues) {
+	return layout("GSClaw setup required", `<h1>GSClaw needs configuration</h1>
+<p>This deployment is not configured yet, so it refuses to serve requests. Set these environment variables in your hosting dashboard and redeploy:</p>
+<ul>${issues.map((i) => `<li>${i.variable ? `<code>${escape(i.variable)}</code> ` : ""}${escape(i.message)}</li>`).join("")}</ul>
+<p><a href="${REPO_URL}/blob/main/docs/setup.md">Setup guide</a> · v${escape(VERSION)}</p>`);
+}
+//#endregion
+//#region src/core/principal.ts
+/** GSClaw's own OAuth scopes (what a client may do), mapped to Google scopes internally. */
+const SCOPE_READ = "gsc:read";
+const SCOPE_WRITE = "gsc:write";
+const OWNER = {
+	kind: "owner",
+	sub: "owner",
+	scopes: [SCOPE_READ, SCOPE_WRITE],
+	via: "static_token"
+};
+//#endregion
+//#region src/core/ratelimit.ts
+/**
+* Per-key token bucket (in memory, per instance). Refills `perMinute` tokens per minute with a
+* burst of the same size. A limit of 0 disables limiting.
+*/
+var RateLimiter = class {
+	perMinute;
+	now;
+	buckets = /* @__PURE__ */ new Map();
+	constructor(perMinute, now = Date.now) {
+		this.perMinute = perMinute;
+		this.now = now;
+	}
+	check(key) {
+		if (this.perMinute <= 0) return { ok: true };
+		const now = this.now();
+		const ratePerMs = this.perMinute / 6e4;
+		const bucket = this.buckets.get(key) ?? {
+			tokens: this.perMinute,
+			updated: now
+		};
+		bucket.tokens = Math.min(this.perMinute, bucket.tokens + (now - bucket.updated) * ratePerMs);
+		bucket.updated = now;
+		if (bucket.tokens >= 1) {
+			bucket.tokens -= 1;
+			this.buckets.set(key, bucket);
+			this.prune(now);
+			return { ok: true };
+		}
+		this.buckets.set(key, bucket);
+		return {
+			ok: false,
+			retryAfterSeconds: Math.ceil((1 - bucket.tokens) / ratePerMs / 1e3)
+		};
+	}
+	prune(now) {
+		if (this.buckets.size <= 1e3) return;
+		for (const [key, bucket] of this.buckets) if (now - bucket.updated > 12e4) this.buckets.delete(key);
+	}
+};
+//#endregion
+//#region src/core/session.ts
+const SESSION_COOKIE = "gsclaw_session";
+function parseCookies(header) {
+	const out = {};
+	if (!header) return out;
+	for (const part of header.split(";")) {
+		const i = part.indexOf("=");
+		if (i < 0) continue;
+		const name = part.slice(0, i).trim();
+		if (name) out[name] = part.slice(i + 1).trim();
+	}
+	return out;
+}
+/**
+* httpOnly + SameSite=Strict always. `Secure` everywhere except plain-http loopback development,
+* where some browsers would otherwise drop the cookie. Strict is enough even after the cross-site
+* return from Google sign-in: the HTML shell needs no cookie, and every API call is same-origin.
+*/
+function sessionCookie(value, opts) {
+	const attrs = [
+		`${SESSION_COOKIE}=${value}`,
+		"Path=/",
+		"HttpOnly",
+		"SameSite=Strict",
+		`Max-Age=${opts.maxAge ?? 604800}`
+	];
+	if (opts.secure) attrs.push("Secure");
+	return attrs.join("; ");
+}
+function clearedSessionCookie(secure) {
+	return sessionCookie("", {
+		secure,
+		maxAge: 0
+	});
+}
+const STATE_COOKIE = "gsclaw_oauth_state";
+/**
+* Binds a Google sign-in to the browser that started it (login-CSRF protection). SameSite=Lax, not
+* Strict: it has to ride along on Google's cross-site redirect back to the callback, its only path.
+*/
+function stateCookie(value, opts) {
+	const attrs = [
+		`${STATE_COOKIE}=${value}`,
+		"Path=/oauth/google/callback",
+		"HttpOnly",
+		"SameSite=Lax",
+		`Max-Age=${opts.maxAge}`
+	];
+	if (opts.secure) attrs.push("Secure");
+	return attrs.join("; ");
+}
+//#endregion
+//#region src/core/oauth/clients.ts
+/** Redirect hosts of popular remote-MCP clients. Extend with GSCLAW_OAUTH_REDIRECT_HOSTS. */
+const DEFAULT_REDIRECT_HOSTS = [
+	"claude.ai",
+	"claude.com",
+	"chatgpt.com",
+	"cursor.com",
+	"www.cursor.com",
+	"vscode.dev",
+	"insiders.vscode.dev"
+];
+const LOOPBACK$1 = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+const DCR_TTL_SECONDS = 31536e4;
+var OAuthError = class extends Error {
+	error;
+	status;
+	constructor(error, message, status = 400) {
+		super(message);
+		this.error = error;
+		this.status = status;
+	}
+};
+/**
+* Loopback http redirects (desktop and CLI clients) are always allowed; https redirects must go to
+* a known client host or one listed in GSCLAW_OAUTH_REDIRECT_HOSTS ("*" allows any https host).
+*/
+function redirectUriAllowed(uri, extraHosts) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.hash || url.username || url.password) return false;
+	if (url.protocol === "http:") return LOOPBACK$1.has(url.hostname);
+	if (url.protocol !== "https:") return false;
+	if (extraHosts.includes("*")) return true;
+	return [...DEFAULT_REDIRECT_HOSTS, ...extraHosts].includes(url.hostname.toLowerCase());
+}
+/** Loopback redirect URIs match regardless of port (RFC 8252 §7.3). */
+function redirectUriMatches(registered, requested) {
+	if (registered === requested) return true;
+	try {
+		const a = new URL(registered);
+		const b = new URL(requested);
+		return a.protocol === "http:" && LOOPBACK$1.has(a.hostname) && a.hostname === b.hostname && a.protocol === b.protocol && a.pathname === b.pathname && a.search === b.search;
+	} catch {
+		return false;
+	}
+}
+/** RFC 7591 registration. The returned client_id *is* the registration. */
+async function registerClient(body, sealer, extraHosts) {
+	const meta = body && typeof body === "object" ? body : {};
+	const requested = meta.redirect_uris;
+	if (!Array.isArray(requested) || requested.length === 0 || requested.length > 10) throw new OAuthError("invalid_redirect_uri", "redirect_uris must be a non-empty array.");
+	const redirectUris = [];
+	for (const uri of requested) {
+		if (typeof uri !== "string" || !redirectUriAllowed(uri, extraHosts)) throw new OAuthError("invalid_redirect_uri", `Redirect URI not allowed: ${String(uri).slice(0, 200)}. Use a loopback URI or a known client; the deployment owner can allow more hosts with GSCLAW_OAUTH_REDIRECT_HOSTS.`);
+		redirectUris.push(uri);
+	}
+	if ((meta.token_endpoint_auth_method ?? "none") !== "none") throw new OAuthError("invalid_client_metadata", "Only public clients are supported (token_endpoint_auth_method \"none\").");
+	const name = typeof meta.client_name === "string" && meta.client_name.trim() ? meta.client_name.trim().slice(0, 100) : "MCP client";
+	return {
+		client_id: await sealer.seal("client", {
+			n: name,
+			r: redirectUris
+		}, DCR_TTL_SECONDS),
+		client_id_issued_at: Math.floor(Date.now() / 1e3),
+		client_name: name,
+		redirect_uris: redirectUris,
+		grant_types: ["authorization_code", "refresh_token"],
+		response_types: ["code"],
+		token_endpoint_auth_method: "none"
+	};
+}
+const cimdCache = /* @__PURE__ */ new Map();
+/** Refuses obviously internal targets. Workers cannot resolve DNS, so hostnames are allowed. */
+function publicHttpsUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.hash) return null;
+	const host = url.hostname.toLowerCase();
+	if (LOOPBACK$1.has(host) || host.endsWith(".localhost") || host.endsWith(".internal") || host.endsWith(".local")) return null;
+	if (/^\[/.test(host)) return null;
+	const ipv4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(host);
+	if (ipv4) {
+		const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
+		if (a === 10 || a === 127 || a === 0 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168) return null;
+	}
+	return url;
+}
+/** Fetches and validates a Client ID Metadata Document, cached for 10 minutes per instance. */
+async function resolveCimd(clientId, fetchImpl, extraHosts) {
+	const cached = cimdCache.get(clientId);
+	if (cached && cached.expiresAt > Date.now()) return cached.client;
+	const url = publicHttpsUrl(clientId);
+	if (!url) throw new OAuthError("invalid_client", "client_id URL must be a public https URL.");
+	let doc;
+	try {
+		const res = await fetchImpl(url.href, {
+			headers: { accept: "application/json" },
+			redirect: "error",
+			signal: AbortSignal.timeout(5e3)
+		});
+		const text = await res.text();
+		if (!res.ok || text.length > 65536) throw new Error(`HTTP ${res.status}`);
+		doc = JSON.parse(text);
+	} catch {
+		throw new OAuthError("invalid_client", "Could not fetch the client metadata document.");
+	}
+	if (doc.client_id !== clientId) throw new OAuthError("invalid_client", "Client metadata client_id does not match its URL.");
+	const redirectUris = Array.isArray(doc.redirect_uris) ? doc.redirect_uris.filter((u) => typeof u === "string") : [];
+	if (redirectUris.length === 0) throw new OAuthError("invalid_client", "Client metadata has no redirect_uris.");
+	if (typeof doc.client_name !== "string" || !doc.client_name.trim()) throw new OAuthError("invalid_client", "Client metadata has no client_name.");
+	const client = {
+		clientId,
+		name: doc.client_name.trim().slice(0, 100),
+		redirectUris: redirectUris.filter((u) => redirectUriAllowed(u, extraHosts)),
+		type: "cimd"
+	};
+	cimdCache.set(clientId, {
+		client,
+		expiresAt: Date.now() + 6e5
+	});
+	return client;
+}
+/** Looks up a client by ID: a sealed DCR registration or a CIMD URL. */
+async function resolveClient(clientId, deps) {
+	if (clientId.startsWith("https://")) return resolveCimd(clientId, deps.fetch, deps.extraHosts);
+	const sealed = await deps.sealer.open("client", clientId);
+	if (!sealed) throw new OAuthError("invalid_client", "Unknown client. Re-register the client (remove and re-add the connector).", 401);
+	return {
+		clientId,
+		name: sealed.n,
+		redirectUris: sealed.r.filter((u) => redirectUriAllowed(u, deps.extraHosts)),
+		type: "dcr"
+	};
+}
+//#endregion
+//#region src/core/oauth/google.ts
+const GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+function googleAuthUrl(cfg, opts) {
+	const params = new URLSearchParams({
+		client_id: cfg.clientId,
+		redirect_uri: opts.redirectUri,
+		response_type: "code",
+		scope: [
+			"openid",
+			"email",
+			...opts.scopes
+		].join(" "),
+		access_type: "offline",
+		prompt: "consent select_account",
+		include_granted_scopes: "false",
+		state: opts.state,
+		code_challenge: opts.codeChallenge,
+		code_challenge_method: "S256"
+	});
+	if (opts.loginHint) params.set("login_hint", opts.loginHint);
+	return `${GOOGLE_AUTH_URL}?${params.toString()}`;
+}
+async function tokenRequest(fetchImpl, body, nowSeconds) {
+	const res = await fetchImpl(GOOGLE_TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(body).toString()
+	});
+	const data = await res.json().catch(() => ({}));
+	if (!res.ok || !data.access_token) throw new GscApiError({
+		kind: "auth",
+		status: res.status,
+		reason: data.error,
+		googleMessage: [data.error, data.error_description].filter(Boolean).join(": "),
+		advice: data.error === "invalid_grant" ? "Your Google authorization has expired or was revoked. Sign in to GSClaw again." : "Google rejected the sign-in. Check GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET and the authorized redirect URI."
+	});
+	return {
+		accessToken: data.access_token,
+		expiresAt: nowSeconds + (data.expires_in ?? 3600),
+		refreshToken: data.refresh_token,
+		scope: (data.scope ?? "").split(" ").filter(Boolean),
+		idToken: data.id_token
+	};
+}
+function exchangeGoogleCode(cfg, opts) {
+	return tokenRequest(opts.fetch, {
+		grant_type: "authorization_code",
+		code: opts.code,
+		redirect_uri: opts.redirectUri,
+		client_id: cfg.clientId,
+		client_secret: cfg.clientSecret,
+		code_verifier: opts.codeVerifier
+	}, opts.nowSeconds);
+}
+function refreshGoogleToken(cfg, opts) {
+	return tokenRequest(opts.fetch, {
+		grant_type: "refresh_token",
+		refresh_token: opts.refreshToken,
+		client_id: cfg.clientId,
+		client_secret: cfg.clientSecret
+	}, opts.nowSeconds);
+}
+/**
+* Reads the identity from Google's ID token. The token was received directly from Google's token
+* endpoint over TLS (not via the browser), so OpenID Connect allows skipping signature validation;
+* we still check issuer, audience and expiry.
+*/
+function identityFromIdToken(idToken, cfg, nowSeconds) {
+	if (!idToken) return null;
+	try {
+		const payload = JSON.parse(new TextDecoder().decode(base64ToBytes(idToken.split(".")[1] ?? "")));
+		if (payload.iss !== "https://accounts.google.com" && payload.iss !== "accounts.google.com") return null;
+		if (payload.aud !== cfg.clientId) return null;
+		if (!payload.exp || payload.exp < nowSeconds - 300) return null;
+		if (!payload.sub || !payload.email) return null;
+		return {
+			sub: payload.sub,
+			email: payload.email.toLowerCase(),
+			emailVerified: payload.email_verified === true
+		};
+	} catch {
+		return null;
+	}
+}
+/** True when the allowlists permit this identity (no lists configured = everyone). */
+function isAllowed(identity, cfg) {
+	if (cfg.allowedEmails.length === 0 && cfg.allowedDomains.length === 0) return true;
+	if (!identity.emailVerified) return false;
+	if (cfg.allowedEmails.includes(identity.email)) return true;
+	const domain = identity.email.split("@")[1] ?? "";
+	return cfg.allowedDomains.includes(domain);
+}
+//#endregion
+//#region src/core/oauth/pages.ts
+function hostOf(uri) {
+	try {
+		const url = new URL(uri);
+		return url.protocol === "http:" ? `${url.hostname} (an app on this computer)` : url.host;
+	} catch {
+		return uri;
+	}
+}
+/**
+* HTML headers for consent pages. Browsers apply `form-action` to the redirect that follows a form
+* submission, so the client's redirect origin must be allowed alongside 'self'.
+*/
+function consentHeaders(redirectUri, extraOrigins = []) {
+	const origins = [...extraOrigins];
+	try {
+		origins.push(new URL(redirectUri).origin);
+	} catch {}
+	return {
+		...HTML_SECURITY_HEADERS,
+		"content-security-policy": HTML_SECURITY_HEADERS["content-security-policy"].replace("form-action 'self'", ["form-action 'self'", ...origins].join(" "))
+	};
+}
+function clientBlock(info) {
+	return `<div class="client"><strong>${escape(info.clientName)}</strong>
+<small>will receive access at ${escape(hostOf(info.redirectUri))}</small></div>`;
+}
+function access(info) {
+	return info.canWrite ? "read your Search Console data and submit or remove sitemaps" : "read your Search Console data (read-only)";
+}
+/** Service-account mode: the owner confirms with the deployment's access token. */
+function ownerConsentPage(info) {
+	return layout("Connect to GSClaw", `<h1>Allow access to GSClaw?</h1>
+${clientBlock(info)}
+<p>This app wants to ${access(info)} through this GSClaw deployment. Only continue if you started this connection.</p>
+<form method="post" action="/oauth/authorize">
+<input type="hidden" name="request" value="${escape(info.request)}">
+<label for="token">Access token</label>
+<input id="token" name="token" type="password" autocomplete="current-password" required autofocus>
+${info.error ? `<p class="error" role="alert">${escape(info.error)}</p>` : ""}
+<div class="actions">
+<button class="primary" type="submit" name="decision" value="allow">Allow</button>
+<button type="submit" name="decision" value="deny" formnovalidate>Deny</button>
+</div>
+</form>`);
+}
+/** OAuth mode: confirm the client, then continue to Google sign-in. */
+function googleConsentPage(info) {
+	return layout("Connect to GSClaw", `<h1>Allow access to GSClaw?</h1>
+${clientBlock(info)}
+<p>This app wants to ${access(info)} through this GSClaw deployment. Sign in with the Google account that has access to your Search Console properties.</p>
+<form method="post" action="/oauth/authorize">
+<input type="hidden" name="request" value="${escape(info.request)}">
+<div class="actions">
+<button class="primary" type="submit" name="decision" value="allow">Continue with Google</button>
+<button type="submit" name="decision" value="deny">Deny</button>
+</div>
+</form>`);
+}
+function oauthErrorPage(title, message) {
+	return layout("GSClaw sign-in", `<h1>${escape(title)}</h1><p>${escape(message)}</p>`);
+}
+//#endregion
+//#region src/core/oauth/server.ts
+const REQUEST_TTL = 900;
+const CODE_TTL = 60;
+const ACCESS_TTL = 3600;
+const REFRESH_TTL = 7776e3;
+const SESSION_TTL = 604800;
+const CORS = {
+	"access-control-allow-origin": "*",
+	"access-control-allow-methods": "GET, POST, OPTIONS",
+	"access-control-allow-headers": "authorization, content-type, mcp-protocol-version"
+};
+function json$2(body, status = 200, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store",
+			pragma: "no-cache",
+			...CORS,
+			...headers
+		}
+	});
+}
+function html$1(body, status = 200, headers = HTML_SECURITY_HEADERS) {
+	return new Response(body, {
+		status,
+		headers
+	});
+}
+function redirect(location, headers = {}) {
+	return new Response(null, {
+		status: 302,
+		headers: {
+			location,
+			"cache-control": "no-store",
+			...headers
+		}
+	});
+}
+function withParams(uri, params) {
+	const url = new URL(uri);
+	for (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, v);
+	return url.href;
+}
+async function readForm(request) {
+	const type = request.headers.get("content-type") ?? "";
+	const text = await request.text();
+	if (type.includes("application/json")) try {
+		const body = JSON.parse(text);
+		return Object.fromEntries(Object.entries(body).map(([k, v]) => [k, typeof v === "string" ? v : String(v)]));
+	} catch {
+		return {};
+	}
+	return Object.fromEntries(new URLSearchParams(text));
+}
+function toPrincipal(p, extra) {
+	return {
+		kind: p.k,
+		sub: p.sub,
+		email: p.email,
+		...extra,
+		google: p.g ? {
+			accessToken: p.g.at,
+			expiresAt: p.g.ex,
+			refreshToken: p.g.rt,
+			scope: p.g.sc
+		} : void 0
+	};
+}
+function createOAuthServer(deps) {
+	const { config, sealer, logger } = deps;
+	const nowSeconds = () => Math.floor(deps.now().getTime() / 1e3);
+	const consentLimiter = new RateLimiter(10);
+	const scopesSupported = config.allowWrites ? [SCOPE_READ, SCOPE_WRITE] : [SCOPE_READ];
+	const google = config.googleOAuth;
+	const clientDeps = {
+		sealer,
+		fetch: deps.fetch,
+		extraHosts: config.oauthRedirectHosts
+	};
+	const resourceUrl = (base) => `${base}/mcp`;
+	const metadataUrl = (base) => `${base}/.well-known/oauth-protected-resource/mcp`;
+	function grantedScopes(requested) {
+		const wanted = (requested ?? "").split(/\s+/).filter((s) => scopesSupported.includes(s));
+		const scopes = new Set(wanted.length > 0 ? wanted : [SCOPE_READ]);
+		scopes.add(SCOPE_READ);
+		return [...scopes];
+	}
+	const googleScopeFor = (scopes) => scopes.includes("gsc:write") ? SCOPE_READWRITE : SCOPE_READONLY;
+	function protectedResourceMetadata(base) {
+		return {
+			resource: resourceUrl(base),
+			authorization_servers: [base],
+			scopes_supported: scopesSupported,
+			bearer_methods_supported: ["header"],
+			resource_name: "GSClaw",
+			resource_documentation: "https://github.com/tuyakhov/gsclaw#readme"
+		};
+	}
+	function authorizationServerMetadata(base) {
+		return {
+			issuer: base,
+			authorization_endpoint: `${base}/oauth/authorize`,
+			token_endpoint: `${base}/oauth/token`,
+			registration_endpoint: `${base}/oauth/register`,
+			scopes_supported: scopesSupported,
+			response_types_supported: ["code"],
+			response_modes_supported: ["query"],
+			grant_types_supported: ["authorization_code", "refresh_token"],
+			token_endpoint_auth_methods_supported: ["none"],
+			code_challenge_methods_supported: ["S256"],
+			client_id_metadata_document_supported: true,
+			authorization_response_iss_parameter_supported: true,
+			service_documentation: "https://github.com/tuyakhov/gsclaw#readme"
+		};
+	}
+	/**
+	* The allowlist applies to every request, not just sign-in, so removing someone from
+	* ALLOWED_GOOGLE_EMAILS/DOMAINS (and redeploying) cuts off their existing tokens and sessions too.
+	*/
+	const stillAllowed = (p) => p.k !== "user" || !google || isAllowed({
+		sub: p.sub,
+		email: p.email ?? "",
+		emailVerified: p.ev === true
+	}, google);
+	async function issueCode(req, p, base) {
+		const code = await sealer.seal("code", {
+			cid: req.cid,
+			cn: req.cn,
+			ru: req.ru,
+			cc: req.cc,
+			sc: req.sc,
+			res: req.res,
+			p
+		}, CODE_TTL);
+		logger.info("oauth code issued", {
+			client: req.cn,
+			kind: p.k
+		});
+		return redirect(withParams(req.ru, {
+			code,
+			state: req.st,
+			iss: base
+		}));
+	}
+	const clientError = (req, error, description, base) => redirect(withParams(req.ru, {
+		error,
+		error_description: description,
+		state: req.st,
+		iss: base
+	}));
+	async function startGoogle(target, scopes, base) {
+		const state = {
+			...target,
+			v: randomToken(32),
+			b: randomToken(24)
+		};
+		const challenge = base64UrlEncode(await sha256(state.v));
+		const sealedState = await sealer.seal("state", state, REQUEST_TTL);
+		const secure = new URL(base).protocol === "https:";
+		return redirect(googleAuthUrl(google, {
+			redirectUri: `${base}/oauth/google/callback`,
+			scopes: [googleScopeFor(scopes)],
+			state: sealedState,
+			codeChallenge: challenge
+		}), { "set-cookie": stateCookie(state.b, {
+			secure,
+			maxAge: REQUEST_TTL
+		}) });
+	}
+	/** GET /oauth/authorize: validate, then show the consent page. */
+	async function authorize(url, base) {
+		const q = url.searchParams;
+		const clientId = q.get("client_id");
+		if (!clientId) return html$1(oauthErrorPage("Invalid request", "client_id is missing."), 400);
+		let client;
+		try {
+			client = await resolveClient(clientId, clientDeps);
+		} catch (error) {
+			return html$1(oauthErrorPage("Unknown app", error instanceof Error ? error.message : "Unknown client."), 400);
+		}
+		const requested = q.get("redirect_uri") ?? (client.redirectUris.length === 1 ? client.redirectUris[0] : "");
+		if (!client.redirectUris.some((r) => redirectUriMatches(r, requested))) return html$1(oauthErrorPage("Invalid redirect", "The redirect_uri is not registered for this app."), 400);
+		const req = {
+			cid: clientId,
+			cn: client.name,
+			ru: requested,
+			cc: q.get("code_challenge") ?? "",
+			st: q.get("state") ?? void 0,
+			sc: grantedScopes(q.get("scope")),
+			res: resourceUrl(base)
+		};
+		if (q.get("response_type") !== "code") return clientError(req, "unsupported_response_type", "Only response_type=code is supported.", base);
+		if (!req.cc || q.get("code_challenge_method") !== "S256") return clientError(req, "invalid_request", "PKCE with code_challenge_method=S256 is required.", base);
+		const resource = q.get("resource");
+		if (resource && resource.replace(/\/$/, "") !== req.res) return clientError(req, "invalid_target", `This server's resource is ${req.res}.`, base);
+		const sealedReq = await sealer.seal("request", req, REQUEST_TTL);
+		const info = {
+			clientName: client.name,
+			redirectUri: req.ru,
+			request: sealedReq,
+			canWrite: req.sc.includes(SCOPE_WRITE)
+		};
+		return config.authMode === "oauth" ? html$1(googleConsentPage(info), 200, consentHeaders(req.ru, ["https://accounts.google.com"])) : html$1(ownerConsentPage(info), 200, consentHeaders(req.ru));
+	}
+	/** POST /oauth/authorize: the consent decision. */
+	async function decide(request, base) {
+		const form = await readForm(request);
+		const req = await sealer.open("request", form.request);
+		if (!req) return html$1(oauthErrorPage("Sign-in expired", "This sign-in page expired. Start the connection again from your app."), 400);
+		if (form.decision !== "allow") return clientError(req, "access_denied", "The request was denied.", base);
+		if (config.authMode === "oauth") return startGoogle({ req }, req.sc, base);
+		const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "local";
+		const info = {
+			clientName: req.cn,
+			redirectUri: req.ru,
+			request: form.request,
+			canWrite: req.sc.includes(SCOPE_WRITE)
+		};
+		if (!consentLimiter.check(ip).ok) return html$1(ownerConsentPage({
+			...info,
+			error: "Too many attempts. Wait a minute and try again."
+		}), 429, consentHeaders(req.ru));
+		if (!form.token || !await timingSafeEqual(form.token.trim(), config.accessToken)) {
+			logger.warn("oauth owner consent: wrong access token");
+			return html$1(ownerConsentPage({
+				...info,
+				error: "That access token is not correct."
+			}), 401, consentHeaders(req.ru));
+		}
+		return issueCode(req, {
+			k: "owner",
+			sub: "owner"
+		}, base);
+	}
+	/** GET /oauth/google/callback (OAuth mode): finish Google sign-in for an MCP client or the dashboard. */
+	async function googleCallback(request, url, base) {
+		const state = await sealer.open("state", url.searchParams.get("state"));
+		const bound = parseCookies(request.headers.get("cookie"))[STATE_COOKIE];
+		if (!state || !google || !bound || !await timingSafeEqual(bound, state.b)) return html$1(oauthErrorPage("Sign-in expired", "This sign-in expired or was started in a different browser. Please start again."), 400);
+		const fail = (error, description, dashCode) => state.req ? clientError(state.req, error, description, base) : redirect(`/?login_error=${dashCode}`);
+		if (url.searchParams.get("error") || !url.searchParams.get("code")) return fail("access_denied", "Google sign-in was cancelled.", "cancelled");
+		let tokens;
+		try {
+			tokens = await exchangeGoogleCode(google, {
+				code: url.searchParams.get("code"),
+				redirectUri: `${base}/oauth/google/callback`,
+				codeVerifier: state.v,
+				fetch: deps.fetch,
+				nowSeconds: nowSeconds()
+			});
+		} catch (error) {
+			logger.warn("google code exchange failed", { error });
+			return fail("server_error", "Google sign-in failed.", "google_error");
+		}
+		const identity = identityFromIdToken(tokens.idToken, google, nowSeconds());
+		if (!identity) return fail("server_error", "Google did not return a verified identity.", "google_error");
+		if (!isAllowed(identity, google)) {
+			logger.warn("google account not allowed", { domain: identity.email.split("@")[1] });
+			return fail("access_denied", `${identity.email} is not allowed to use this GSClaw deployment.`, "not_allowed");
+		}
+		const needed = state.req ? googleScopeFor(state.req.sc) : SCOPE_READONLY;
+		if (!(tokens.scope.includes(needed) || needed === "https://www.googleapis.com/auth/webmasters.readonly" && tokens.scope.includes("https://www.googleapis.com/auth/webmasters"))) return fail("access_denied", "Search Console access was not granted. Try again and keep the Search Console permission ticked.", "scope");
+		if (!tokens.refreshToken) return fail("server_error", "Google did not return a refresh token. Remove GSClaw from your Google account’s third-party access and try again.", "google_error");
+		const p = {
+			k: "user",
+			sub: identity.sub,
+			email: identity.email,
+			ev: identity.emailVerified,
+			g: {
+				at: tokens.accessToken,
+				ex: tokens.expiresAt,
+				rt: tokens.refreshToken,
+				sc: tokens.scope
+			}
+		};
+		if (state.dash) return redirect("/", { "set-cookie": sessionCookie(await sealer.seal("session", { p }, SESSION_TTL), {
+			secure: new URL(base).protocol === "https:",
+			maxAge: SESSION_TTL
+		}) });
+		return issueCode(state.req, p, base);
+	}
+	async function issueTokens(t, p) {
+		let ttl = ACCESS_TTL;
+		if (p.g?.ex) ttl = Math.max(300, Math.min(ACCESS_TTL, p.g.ex - nowSeconds() - 120));
+		const access = await sealer.seal("access", {
+			...t,
+			p
+		}, ttl);
+		const refreshPrincipal = p.g ? {
+			...p,
+			g: {
+				rt: p.g.rt,
+				sc: p.g.sc
+			}
+		} : p;
+		const refresh = await sealer.seal("refresh", {
+			...t,
+			p: refreshPrincipal
+		}, REFRESH_TTL);
+		return json$2({
+			access_token: access,
+			token_type: "Bearer",
+			expires_in: ttl,
+			refresh_token: refresh,
+			scope: t.sc.join(" ")
+		});
+	}
+	/** POST /oauth/token */
+	async function token(request) {
+		const form = await readForm(request);
+		const basic = request.headers.get("authorization");
+		let clientId = form.client_id;
+		if (!clientId && basic?.startsWith("Basic ")) try {
+			clientId = decodeURIComponent(atob(basic.slice(6)).split(":")[0] ?? "");
+		} catch {
+			clientId = void 0;
+		}
+		const err = (error, description, status = 400) => json$2({
+			error,
+			error_description: description
+		}, status);
+		if (form.grant_type === "authorization_code") {
+			const code = await sealer.open("code", form.code);
+			if (!code) return err("invalid_grant", "The authorization code is invalid or expired.");
+			if (code.cid !== clientId) return err("invalid_grant", "The code was issued to another client.");
+			if (!form.redirect_uri || !redirectUriMatches(code.ru, form.redirect_uri)) return err("invalid_grant", "redirect_uri does not match.");
+			if (!form.code_verifier || base64UrlEncode(await sha256(form.code_verifier)) !== code.cc) return err("invalid_grant", "PKCE verification failed.");
+			if (form.resource && form.resource.replace(/\/$/, "") !== code.res) return err("invalid_target", "Unknown resource.");
+			return issueTokens({
+				cid: code.cid,
+				cn: code.cn,
+				sc: code.sc,
+				aud: code.res
+			}, code.p);
+		}
+		if (form.grant_type === "refresh_token") {
+			const rt = await sealer.open("refresh", form.refresh_token);
+			if (!rt) return err("invalid_grant", "The refresh token is invalid or expired.");
+			if (clientId && clientId !== rt.cid) return err("invalid_grant", "The refresh token was issued to another client.");
+			if (!stillAllowed(rt.p)) return err("invalid_grant", "This Google account is no longer allowed to use GSClaw.");
+			let scopes = rt.sc;
+			if (form.scope) {
+				const narrowed = form.scope.split(/\s+/).filter((s) => rt.sc.includes(s));
+				if (narrowed.length === 0) return err("invalid_scope", "Requested scope exceeds the original grant.");
+				scopes = narrowed;
+			}
+			let p = rt.p;
+			if (p.g && google) try {
+				const fresh = await refreshGoogleToken(google, {
+					refreshToken: p.g.rt,
+					fetch: deps.fetch,
+					nowSeconds: nowSeconds()
+				});
+				p = {
+					...p,
+					g: {
+						at: fresh.accessToken,
+						ex: fresh.expiresAt,
+						rt: fresh.refreshToken ?? p.g.rt,
+						sc: p.g.sc
+					}
+				};
+			} catch (error) {
+				if (error instanceof GscApiError && error.reason === "invalid_grant") return err("invalid_grant", "Google access was revoked or expired. Sign in again.");
+				return err("temporarily_unavailable", "Could not refresh Google credentials. Try again.", 503);
+			}
+			return issueTokens({
+				cid: rt.cid,
+				cn: rt.cn,
+				sc: scopes,
+				aud: rt.aud
+			}, p);
+		}
+		return err("unsupported_grant_type", "Use authorization_code or refresh_token.");
+	}
+	return {
+		resourceUrl,
+		/** WWW-Authenticate value for /mcp 401s (RFC 9728 discovery). */
+		challenge(base, error) {
+			const parts = [`resource_metadata="${metadataUrl(base)}"`, `scope="${scopesSupported.join(" ")}"`];
+			if (error) parts.push(`error="${error}"`);
+			return `Bearer ${parts.join(", ")}`;
+		},
+		/** Validates a GSClaw-issued access token for this resource. */
+		async verifyAccessToken(token, base) {
+			const t = await sealer.open("access", token);
+			if (!t || t.aud !== resourceUrl(base)) return null;
+			if (config.authMode === "oauth" !== (t.p.k === "user") || !stillAllowed(t.p)) return null;
+			return toPrincipal(t.p, {
+				scopes: t.sc,
+				via: "oauth",
+				clientId: t.cid,
+				clientName: t.cn
+			});
+		},
+		/** Reads a dashboard session cookie value. */
+		async openSession(value) {
+			const s = await sealer.open("session", value);
+			if (!s) return null;
+			if (config.authMode === "oauth" !== (s.p.k === "user") || !stillAllowed(s.p)) return null;
+			return toPrincipal(s.p, {
+				scopes: [SCOPE_READ],
+				via: "session"
+			});
+		},
+		async ownerSession() {
+			return sealer.seal("session", { p: {
+				k: "owner",
+				sub: "owner"
+			} }, SESSION_TTL);
+		},
+		/** Routes /.well-known/* and /oauth/*; returns null for anything else. */
+		async handle(request, url, path, base) {
+			const method = request.method;
+			if (!path.startsWith("/.well-known/") && !path.startsWith("/oauth/")) return null;
+			if (method === "OPTIONS") return new Response(null, {
+				status: 204,
+				headers: CORS
+			});
+			try {
+				if (path === "/.well-known/oauth-protected-resource" || path === "/.well-known/oauth-protected-resource/mcp") return json$2(protectedResourceMetadata(base));
+				if (path === "/.well-known/oauth-authorization-server" || path === "/.well-known/oauth-authorization-server/mcp") return json$2(authorizationServerMetadata(base));
+				if (path === "/oauth/register" && method === "POST") return json$2(await registerClient(await request.json().catch(() => null), sealer, config.oauthRedirectHosts), 201);
+				if (path === "/oauth/authorize" && method === "GET") return authorize(url, base);
+				if (path === "/oauth/authorize" && method === "POST") return decide(request, base);
+				if (path === "/oauth/token" && method === "POST") return token(request);
+				if (path === "/oauth/google/callback" && method === "GET") return googleCallback(request, url, base);
+				if (path === "/oauth/google/start" && method === "GET" && google) return startGoogle({ dash: true }, [SCOPE_READ], base);
+			} catch (error) {
+				if (error instanceof OAuthError) return json$2({
+					error: error.error,
+					error_description: error.message
+				}, error.status);
+				throw error;
+			}
+			return json$2({ error: "not_found" }, 404);
+		}
+	};
+}
+//#endregion
+//#region src/core/update-check.ts
+const RELEASES_URL = "https://api.github.com/repos/tuyakhov/gsclaw/releases/latest";
+const CACHE_MS = 216e5;
+let cached;
+/** Compares dotted numeric versions; pre-release suffixes are ignored. */
+function isNewer(candidate, current) {
+	const parse = (v) => v.replace(/^v/, "").split("-")[0].split(".").map((n) => Number(n) || 0);
+	const a = parse(candidate);
+	const b = parse(current);
+	for (let i = 0; i < Math.max(a.length, b.length); i++) {
+		const diff = (a[i] ?? 0) - (b[i] ?? 0);
+		if (diff !== 0) return diff > 0;
+	}
+	return false;
+}
+/**
+* Latest published GSClaw release (cached for 6 hours per instance). Any failure (offline,
+* rate-limited, no releases yet) yields null so the dashboard simply shows no notice.
+*/
+async function latestRelease(fetchImpl = (input, init) => fetch(input, init), now = Date.now()) {
+	if (cached && now - cached.at < CACHE_MS) return cached.latest;
+	let latest = null;
+	try {
+		const res = await fetchImpl(RELEASES_URL, {
+			headers: {
+				accept: "application/vnd.github+json",
+				"user-agent": `gsclaw/${VERSION}`
+			},
+			signal: AbortSignal.timeout(3e3)
+		});
+		if (res.ok) {
+			const body = await res.json();
+			if (typeof body.tag_name === "string") latest = body.tag_name.replace(/^v/, "");
+		}
+	} catch {
+		latest = null;
+	}
+	cached = {
+		at: now,
+		latest
+	};
+	return latest;
+}
+//#endregion
+//#region src/core/dashboard-api.ts
+function json$1(body, status = 200, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store",
+			...headers
+		}
+	});
+}
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/**
+* JSON API behind the dashboard. Every data endpoint runs the same tool implementations the MCP
+* server uses (`POST /api/tools/:name`) with the signed-in caller's own credentials, so the dashboard
+* and the AI always see identical numbers.
+*/
+function createDashboardApi(deps) {
+	const { config, runtime, logger, oauth } = deps;
+	const isOAuth = config.authMode === "oauth";
+	const publicOrigin = config.publicBaseUrl ? new URL(config.publicBaseUrl).origin : null;
+	const loginLimiter = new RateLimiter(10);
+	const isSecure = (url) => !(url.protocol === "http:" && LOOPBACK.has(url.hostname));
+	async function signedIn(request) {
+		return oauth.openSession(parseCookies(request.headers.get("cookie"))[SESSION_COOKIE]);
+	}
+	/** Same-origin check for state-changing requests (on top of SameSite=Strict cookies). */
+	function sameOrigin(request, url) {
+		const origin = request.headers.get("origin");
+		if (!origin) return true;
+		return origin === url.origin || origin === publicOrigin;
+	}
+	function clientKey(request) {
+		return request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "local";
+	}
+	async function readJson(request) {
+		if (!request.headers.get("content-type")?.includes("application/json")) return null;
+		try {
+			const body = await request.json();
+			return body && typeof body === "object" && !Array.isArray(body) ? body : null;
+		} catch {
+			return null;
+		}
+	}
+	async function login(request, url) {
+		if (isOAuth) return json$1({ error: "Use “Sign in with Google”." }, 400);
+		const limit = loginLimiter.check(clientKey(request));
+		if (!limit.ok) return json$1({ error: "Too many attempts. Wait a minute and try again." }, 429, { "retry-after": String(limit.retryAfterSeconds) });
+		const body = await readJson(request);
+		const token = typeof body?.token === "string" ? body.token.trim() : "";
+		if (!token || !await timingSafeEqual(token, config.accessToken)) {
+			logger.warn("dashboard login failed");
+			return json$1({ error: "That access token is not correct." }, 401);
+		}
+		return json$1({ ok: true }, 200, { "set-cookie": sessionCookie(await oauth.ownerSession(), {
+			secure: isSecure(url),
+			maxAge: SESSION_TTL
+		}) });
+	}
+	async function status(principal, request, url) {
+		const session = runtime.sessionFor(principal);
+		const started = Date.now();
+		let google;
+		try {
+			const properties = await listProperties(session.gsc, { fresh: true });
+			google = {
+				ok: true,
+				latency_ms: Date.now() - started,
+				properties
+			};
+		} catch (error) {
+			const { message, kind } = publicErrorMessage(error);
+			google = {
+				ok: false,
+				latency_ms: Date.now() - started,
+				error: message,
+				kind
+			};
+		}
+		const latest = await latestRelease(deps.fetch);
+		const base = deps.baseUrl(request, url);
+		const warnings = [];
+		if (!config.publicBaseUrl && !LOOPBACK.has(url.hostname)) warnings.push("PUBLIC_BASE_URL is not set and could not be detected; connection snippets use this page’s address.");
+		const g = config.googleOAuth;
+		const oauthInfo = g ? {
+			redirect_uri: `${base}/oauth/google/callback`,
+			allowed_domains: g.allowedDomains,
+			allowed_email_count: g.allowedEmails.length,
+			open_to_anyone: g.allowedDomains.length === 0 && g.allowedEmails.length === 0
+		} : null;
+		if (oauthInfo?.open_to_anyone) warnings.push("Anyone with a Google account can sign in (each person only sees their own properties). Set ALLOWED_GOOGLE_EMAILS or ALLOWED_GOOGLE_DOMAINS to restrict access.");
+		return json$1({
+			version: VERSION,
+			latest_version: latest,
+			update_available: latest !== null && isNewer(latest, VERSION),
+			platform: deps.platform,
+			auth_mode: config.authMode,
+			identity: session.gsc.identity,
+			writes_enabled: config.allowWrites,
+			secret_path_enabled: !isOAuth && config.secretPath,
+			public_base_url: config.publicBaseUrl ?? null,
+			rate_limit_per_minute: config.rateLimitPerMinute,
+			activity_persistent: runtime.activity.persistent,
+			oauth: oauthInfo,
+			google,
+			warnings
+		});
+	}
+	async function runTool(name, request, principal) {
+		const session = runtime.sessionFor(principal);
+		const tool = session.tools.find((t) => t.name === name && !t.write);
+		if (!tool) return json$1({ error: `Unknown tool: ${name}` }, 404);
+		const body = await readJson(request) ?? {};
+		const parsed = tool.input.safeParse(body);
+		if (!parsed.success) return json$1({ error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ") }, 400);
+		try {
+			return json$1({ result: await tool.run(session.ctx, parsed.data) });
+		} catch (error) {
+			const { message, kind } = publicErrorMessage(error);
+			if (kind === "internal") logger.error("dashboard tool failed", {
+				tool: name,
+				error
+			});
+			return json$1({
+				error: message,
+				kind
+			}, kind === "internal" ? 500 : 400);
+		}
+	}
+	return { async handle(request, url, path) {
+		const method = request.method;
+		if (method !== "GET" && method !== "HEAD" && !sameOrigin(request, url)) return json$1({ error: "Cross-origin request rejected." }, 403);
+		if (path === "/api/session") {
+			if (method === "GET") {
+				const principal = await signedIn(request);
+				return json$1({
+					authenticated: principal !== null,
+					auth_mode: config.authMode,
+					login: isOAuth ? "google" : "token",
+					email: principal?.email ?? null
+				});
+			}
+			if (method === "POST") return login(request, url);
+			if (method === "DELETE") return json$1({ ok: true }, 200, { "set-cookie": clearedSessionCookie(isSecure(url)) });
+			return json$1({ error: "Method not allowed" }, 405);
+		}
+		const principal = await signedIn(request);
+		if (!principal) return json$1({ error: "Sign in required." }, 401);
+		if (path === "/api/status" && method === "GET") return status(principal, request, url);
+		if (path === "/api/connect" && method === "GET") {
+			const base = deps.baseUrl(request, url);
+			return json$1({
+				base_url: base,
+				mcp_url: `${base}/mcp`,
+				auth_mode: config.authMode,
+				secret_path_enabled: !isOAuth && config.secretPath
+			});
+		}
+		if (path === "/api/connect/secret" && method === "GET") return isOAuth ? json$1({ error: "Not available in OAuth mode." }, 404) : json$1({ access_token: config.accessToken });
+		if (path === "/api/activity" && method === "GET") {
+			const entries = runtime.activity.list().filter((e) => !isOAuth || e.user === principal.email);
+			return json$1({
+				persistent: runtime.activity.persistent,
+				entries
+			});
+		}
+		const toolMatch = /^\/api\/tools\/([a-z_]+)$/.exec(path);
+		if (toolMatch && method === "POST") return runTool(toolMatch[1], request, principal);
+		return json$1({ error: "Not found" }, 404);
+	} };
+}
+//#endregion
+//#region src/core/seal.ts
+/** Short visible prefixes make tokens recognisable in logs and support tickets (never their content). */
+const SEAL_PREFIX = {
+	client: "gsc_client_",
+	state: "gsc_state_",
+	request: "gsc_req_",
+	code: "gsc_code_",
+	access: "gsc_at_",
+	refresh: "gsc_rt_",
+	session: "gsc_sess_"
+};
+function createSealer(secret, now = Date.now) {
+	const keys = /* @__PURE__ */ new Map();
+	const keyFor = (purpose) => {
+		let key = keys.get(purpose);
+		if (!key) {
+			key = (async () => {
+				const material = await crypto.subtle.importKey("raw", utf8(secret), "HKDF", false, ["deriveKey"]);
+				return crypto.subtle.deriveKey({
+					name: "HKDF",
+					hash: "SHA-256",
+					salt: utf8("gsclaw-seal-v1"),
+					info: utf8(`gsclaw:${purpose}`)
+				}, material, {
+					name: "AES-GCM",
+					length: 256
+				}, false, ["encrypt", "decrypt"]);
+			})();
+			keys.set(purpose, key);
+		}
+		return key;
+	};
+	return {
+		async seal(purpose, payload, ttlSeconds) {
+			const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+			const body = utf8(JSON.stringify({
+				...payload,
+				exp: Math.floor(now() / 1e3) + ttlSeconds
+			}));
+			const cipher = new Uint8Array(await crypto.subtle.encrypt({
+				name: "AES-GCM",
+				iv,
+				additionalData: utf8(purpose)
+			}, await keyFor(purpose), body));
+			const out = new Uint8Array(iv.length + cipher.length);
+			out.set(iv);
+			out.set(cipher, iv.length);
+			return SEAL_PREFIX[purpose] + base64UrlEncode(out);
+		},
+		async open(purpose, token) {
+			const prefix = SEAL_PREFIX[purpose];
+			if (!token?.startsWith(prefix) || token.length > 8192) return null;
+			try {
+				const bytes = base64ToBytes(token.slice(prefix.length));
+				if (bytes.length < 29) return null;
+				const plain = await crypto.subtle.decrypt({
+					name: "AES-GCM",
+					iv: bytes.subarray(0, 12),
+					additionalData: utf8(purpose)
+				}, await keyFor(purpose), bytes.subarray(12));
+				const payload = JSON.parse(new TextDecoder().decode(plain));
+				if (typeof payload.exp !== "number" || payload.exp <= Math.floor(now() / 1e3)) return null;
+				return payload;
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/core/dashboard-shell.ts
+/** Strict CSP: the dashboard only loads its own bundle and talks to its own API. */
+const DASHBOARD_HEADERS = {
+	"content-type": "text/html; charset=utf-8",
+	"content-security-policy": "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; manifest-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+	"x-content-type-options": "nosniff",
+	"referrer-policy": "no-referrer",
+	"x-frame-options": "DENY",
+	"cache-control": "no-store"
+};
+/**
+* The dashboard's HTML shell. It contains no data; the app behind it requires a session.
+* Assets have fixed names and are cache-busted with the version.
+*/
+function dashboardShell() {
+	const v = encodeURIComponent(VERSION);
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<meta name="color-scheme" content="light dark">
+<title>GSClaw</title>
+<link rel="icon" type="image/svg+xml" href="/assets/favicon.svg">
+<link rel="stylesheet" href="/assets/dashboard.css?v=${v}">
+<script type="module" src="/assets/dashboard.js?v=${v}"><\/script>
+</head>
+<body>
+<div id="app"><noscript>GSClaw's dashboard needs JavaScript.</noscript></div>
+</body>
+</html>`;
+}
+//#endregion
+//#region src/core/format.ts
+function round(value, decimals = 0) {
+	const f = 10 ** decimals;
+	return Math.round(value * f) / f;
+}
+function toMetrics(raw) {
+	const ctr = raw.ctr ?? (raw.impressions > 0 ? raw.clicks / raw.impressions : 0);
+	return {
+		clicks: round(raw.clicks),
+		impressions: round(raw.impressions),
+		ctr_pct: round(ctr * 100, 2),
+		position: raw.impressions > 0 && raw.position !== void 0 ? round(raw.position, 1) : null
+	};
+}
+function fmtInt(value) {
+	return Math.round(value).toLocaleString("en-US");
+}
+function fmtPct(pct) {
+	const abs = Math.abs(pct);
+	return `${abs > 0 && abs < 1 ? pct.toFixed(2) : pct.toFixed(1)}%`;
+}
+function fmtPos(position) {
+	return position === null ? "–" : position.toFixed(1);
+}
+function fmtSigned(value, format = fmtInt) {
+	if (value === 0) return format(0);
+	return value > 0 ? `+${format(value)}` : `-${format(Math.abs(value))}`;
+}
+/** Relative change in percent, or null when the base is zero. */
+function pctChange(current, previous) {
+	if (previous === 0) return null;
+	return round((current - previous) / previous * 100, 1);
+}
+function fmtChange(current, previous) {
+	const diff = current - previous;
+	const rel = pctChange(current, previous);
+	if (rel === null) return current === 0 ? "0" : `${fmtSigned(diff)} (new)`;
+	return `${fmtSigned(diff)} (${fmtSigned(rel, (v) => `${v.toFixed(1)}%`)})`;
+}
+function cell(value) {
+	if (value === null || value === void 0) return "";
+	return String(value).replace(/\|/g, "\\|").replace(/\s+/g, " ");
+}
+function mdTable(headers, rows) {
+	if (rows.length === 0) return "_No rows._";
+	return [
+		`| ${headers.join(" | ")} |`,
+		`|${headers.map(() => "---").join("|")}|`,
+		...rows.map((r) => `| ${r.map(cell).join(" | ")} |`)
+	].join("\n");
+}
+function omittedNote(shown, total, hint) {
+	if (total <= shown) return null;
+	return `_${fmtInt(total - shown)} more row(s) not shown (${fmtInt(shown)} of ${fmtInt(total)}). ${hint}_`;
+}
+/**
+* Shortens a page URL for display: same-host URLs become their path. The full URL is always kept
+* in structured output.
+*/
+function compactUrl(url, baseHost) {
+	try {
+		const u = new URL(url);
+		const path = `${u.pathname}${u.search}${u.hash}`;
+		if (baseHost && u.host === baseHost) return path;
+		return `${u.host}${path}`;
+	} catch {
+		return url;
+	}
+}
+/** Joins non-empty sections with blank lines. */
+function sections(...parts) {
+	return parts.filter((p) => Boolean(p)).join("\n\n");
+}
+/** Hard cap so a single tool result never blows past client limits (claude.ai: ~150K chars). */
+const MAX_TEXT_CHARS = 6e4;
+function capText(text, max = MAX_TEXT_CHARS) {
+	if (text.length <= max) return text;
+	return `${text.slice(0, max)}\n\n_[Output truncated at ${fmtInt(max)} characters. Narrow the query or lower \`limit\`.]_`;
+}
+//#endregion
+//#region src/core/prompts.ts
+const seoHealthCheckArgs = z.object({
+	site_url: z.string().describe("Property to review, e.g. 'sc-domain:example.com' or 'example.com'."),
+	date_range: z.enum([
+		"last_28_days",
+		"last_3_months",
+		"last_6_months"
+	]).optional().describe("Analysis period (default last_28_days)."),
+	brand_terms: z.string().optional().describe("Optional RE2 regex of brand queries to exclude from opportunity analysis, e.g. 'acme|acme corp'.")
+});
+function seoHealthCheckPrompt(args) {
+	const range = args.date_range ?? "last_28_days";
+	const brand = args.brand_terms ? `Pass exclude_queries: "${args.brand_terms}" to the opportunity tools so brand searches don't skew results.` : "If the site has obvious brand queries, mention that a brand-excluded view (exclude_queries) may change the picture.";
+	return `Run a complete SEO health check of the Search Console property "${args.site_url}" using the GSClaw tools. Period: ${range}.
+
+Work through these steps, calling the tools yourself:
+1. list_sites: confirm the exact property and that we have access.
+2. compare_periods (dimension "none", then "query" and "page", compare_to "previous_period"): overall trend and the biggest movers. If the period allows, also check compare_to "year_over_year" to separate seasonality from real change.
+3. striking_distance_keywords: the best quick-win queries ranking ~8–20.
+4. ctr_opportunities: high-impression queries whose CTR is below expectation for their position (title/description fixes).
+5. keyword_cannibalization: queries split across several pages.
+6. content_decay: pages in steady decline.
+7. list_sitemaps: sitemap errors/warnings and whether Google reads them.
+8. page_report or inspect_url for the 2–3 most important pages you found (top losers or top striking-distance pages), to check index status and canonicals.
+${brand}
+
+Then write a concise report:
+- **Summary**: 3–5 bullets on overall health and trend (with numbers).
+- **Prioritized actions**: a numbered list ordered by expected impact vs effort. For each: the page/query, the evidence (numbers from the tools), and the concrete fix.
+- **Technical issues**: indexing, canonical or sitemap problems, if any.
+- **Watch list**: things to re-check in 2–4 weeks.
+
+Remember: Search Console data lags ~2–3 days, positions are averages, and rare queries are anonymized. Don't invent numbers; cite only what the tools returned.`;
+}
+//#endregion
+//#region src/core/mcp.ts
+const SERVER_INSTRUCTIONS = `GSClaw gives you read access to Google Search Console (and sitemap writes only if the operator enabled them).
+- Start with list_sites to find the exact property; site_url also accepts a bare domain like "example.com".
+- Prefer the analysis tools (compare_periods, striking_distance_keywords, ctr_opportunities, keyword_cannibalization, content_decay, page_report) over raw search_analytics for common questions.
+- Dates are Pacific Time. Final data lags ~2–3 days; relative ranges end on the latest final day. Pass fresh=true for partial recent data.
+- Results show the top rows only and say how many were omitted; raise limit if you need more.
+- Search Console keeps ~16 months of data, and rare queries are anonymized.`;
+/** Builds a fresh MCP server instance (one per HTTP request or stdio connection). */
+function buildMcpServer(deps) {
+	const server = new McpServer({
+		name: NAME,
+		title: "GSClaw",
+		version: VERSION
+	}, { instructions: SERVER_INSTRUCTIONS });
+	for (const tool of deps.tools) server.registerTool(tool.name, {
+		title: tool.title,
+		description: tool.description,
+		inputSchema: tool.input,
+		annotations: {
+			title: tool.title,
+			...tool.annotations
+		}
+	}, async (args) => {
+		const started = Date.now();
+		const site = typeof args.site_url === "string" ? args.site_url : typeof args.url === "string" ? args.url : null;
+		try {
+			const result = await tool.run(deps.ctx, args);
+			const text = capText(tool.format(result, args));
+			deps.activity?.record({
+				time: (/* @__PURE__ */ new Date()).toISOString(),
+				client: deps.client,
+				tool: tool.name,
+				site,
+				ms: Date.now() - started,
+				ok: true,
+				user: deps.user
+			});
+			return {
+				content: [{
+					type: "text",
+					text
+				}],
+				structuredContent: result
+			};
+		} catch (error) {
+			const { message, kind } = publicErrorMessage(error);
+			if (kind === "internal") deps.logger.error("tool failed", {
+				tool: tool.name,
+				error
+			});
+			else deps.logger.info("tool returned error", {
+				tool: tool.name,
+				kind
+			});
+			deps.activity?.record({
+				time: (/* @__PURE__ */ new Date()).toISOString(),
+				client: deps.client,
+				tool: tool.name,
+				site,
+				ms: Date.now() - started,
+				ok: false,
+				error_kind: kind,
+				user: deps.user
+			});
+			return {
+				content: [{
+					type: "text",
+					text: message
+				}],
+				isError: true
+			};
+		}
+	});
+	server.registerPrompt("seo_health_check", {
+		title: "SEO health check",
+		description: "Full review of a Search Console property: trends, quick wins, CTR fixes, cannibalization, decaying content, sitemaps and indexing, ending in a prioritized action plan.",
+		argsSchema: seoHealthCheckArgs
+	}, (args) => ({ messages: [{
+		role: "user",
+		content: {
+			type: "text",
+			text: seoHealthCheckPrompt(args)
+		}
+	}] }));
+	return server;
+}
+//#endregion
+//#region src/core/cache.ts
+/**
+* Small in-memory LRU with TTL and a total weight budget (for example, number of rows held) so a
+* few huge responses cannot exhaust memory on small runtimes such as Cloudflare Workers.
+*/
+var LruCache = class {
+	opts;
+	map = /* @__PURE__ */ new Map();
+	totalWeight = 0;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	now() {
+		return this.opts.now ? this.opts.now() : Date.now();
+	}
+	get(key) {
+		const entry = this.map.get(key);
+		if (!entry) return void 0;
+		if (entry.expiresAt <= this.now()) {
+			this.delete(key);
+			return;
+		}
+		this.map.delete(key);
+		this.map.set(key, entry);
+		return entry.value;
+	}
+	set(key, value, ttlMs, weight = 1) {
+		if (ttlMs <= 0 || weight > this.opts.maxWeight) return;
+		this.delete(key);
+		this.map.set(key, {
+			value,
+			expiresAt: this.now() + ttlMs,
+			weight
+		});
+		this.totalWeight += weight;
+		while (this.map.size > this.opts.maxEntries || this.totalWeight > this.opts.maxWeight) {
+			const oldest = this.map.keys().next().value;
+			if (oldest === void 0) break;
+			this.delete(oldest);
+		}
+	}
+	delete(key) {
+		const entry = this.map.get(key);
+		if (!entry) return;
+		this.totalWeight -= entry.weight;
+		this.map.delete(key);
+	}
+	deleteWhere(predicate) {
+		for (const key of [...this.map.keys()]) if (predicate(key)) this.delete(key);
+	}
+	get size() {
+		return this.map.size;
+	}
+};
+//#endregion
+//#region src/core/gsc/client.ts
+const API_BASE = "https://searchconsole.googleapis.com";
+const WEBMASTERS = `${API_BASE}/webmasters/v3`;
+const INSPECT_URL = `${API_BASE}/v1/urlInspection/index:inspect`;
+/** Google's maximum page size for searchanalytics.query. */
+const PAGE_SIZE = 25e3;
+/** Weight budget is in rows, which keeps memory bounded on small runtimes (Workers: 128 MB). */
+function createResponseCache() {
+	return new LruCache({
+		maxEntries: 300,
+		maxWeight: 6e4
+	});
+}
+const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+var GscClient = class {
+	tokenSource;
+	logger;
+	fetchImpl;
+	cache;
+	cacheTtlMs;
+	maxRetries;
+	timeoutMs;
+	sleep;
+	constructor(opts) {
+		this.tokenSource = opts.tokenSource;
+		this.logger = opts.logger;
+		this.fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));
+		this.cache = opts.cache;
+		this.cacheTtlMs = opts.cacheTtlMs ?? 3e5;
+		this.maxRetries = opts.maxRetries ?? 3;
+		this.timeoutMs = opts.timeoutMs ?? 3e4;
+		this.sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	}
+	get identity() {
+		return this.tokenSource.identity;
+	}
+	get canWrite() {
+		return this.tokenSource.scopes.includes("https://www.googleapis.com/auth/webmasters");
+	}
+	/** `fresh` skips the cache read (used by the dashboard's live connectivity check). */
+	async listSites(opts = {}) {
+		return (await this.request({
+			method: "GET",
+			url: `${WEBMASTERS}/sites`,
+			cacheWeight: () => 1,
+			fresh: opts.fresh
+		})).siteEntry ?? [];
+	}
+	async searchAnalytics(siteUrl, body) {
+		return this.request({
+			method: "POST",
+			url: `${WEBMASTERS}/sites/${encodeURIComponent(siteUrl)}/searchAnalytics/query`,
+			body,
+			siteUrl,
+			cacheWeight: (d) => Math.max(1, d.rows?.length ?? 0)
+		});
+	}
+	/**
+	* Fetches up to `maxRows` rows, paging through `startRow` in 25,000-row pages. Google exposes at
+	* most ~50K rows per day per search type, so very large sites may still be truncated upstream.
+	*/
+	async searchAnalyticsAll(siteUrl, body, maxRows) {
+		const rows = [];
+		let metadata;
+		let startRow = 0;
+		for (;;) {
+			const rowLimit = Math.min(PAGE_SIZE, maxRows - rows.length);
+			const res = await this.searchAnalytics(siteUrl, {
+				...body,
+				rowLimit,
+				startRow
+			});
+			metadata ??= res.metadata;
+			const page = res.rows ?? [];
+			rows.push(...page);
+			if (page.length < rowLimit) return {
+				rows,
+				truncated: false,
+				metadata
+			};
+			if (rows.length >= maxRows) return {
+				rows,
+				truncated: true,
+				metadata
+			};
+			startRow += page.length;
+		}
+	}
+	async inspectUrl(siteUrl, inspectionUrl, languageCode = "en-US") {
+		return this.request({
+			method: "POST",
+			url: INSPECT_URL,
+			body: {
+				inspectionUrl,
+				siteUrl,
+				languageCode
+			},
+			siteUrl,
+			cacheWeight: () => 1
+		});
+	}
+	async listSitemaps(siteUrl, sitemapIndex) {
+		const query = sitemapIndex ? `?sitemapIndex=${encodeURIComponent(sitemapIndex)}` : "";
+		return (await this.request({
+			method: "GET",
+			url: `${WEBMASTERS}/sites/${encodeURIComponent(siteUrl)}/sitemaps${query}`,
+			siteUrl,
+			cacheWeight: () => 1
+		})).sitemap ?? [];
+	}
+	async getSitemap(siteUrl, feedpath) {
+		return this.request({
+			method: "GET",
+			url: `${WEBMASTERS}/sites/${encodeURIComponent(siteUrl)}/sitemaps/${encodeURIComponent(feedpath)}`,
+			siteUrl,
+			cacheWeight: () => 1
+		});
+	}
+	async submitSitemap(siteUrl, feedpath) {
+		await this.request({
+			method: "PUT",
+			url: `${WEBMASTERS}/sites/${encodeURIComponent(siteUrl)}/sitemaps/${encodeURIComponent(feedpath)}`,
+			siteUrl
+		});
+		this.invalidateSite(siteUrl);
+	}
+	async deleteSitemap(siteUrl, feedpath) {
+		await this.request({
+			method: "DELETE",
+			url: `${WEBMASTERS}/sites/${encodeURIComponent(siteUrl)}/sitemaps/${encodeURIComponent(feedpath)}`,
+			siteUrl
+		});
+		this.invalidateSite(siteUrl);
+	}
+	cacheKey(opts) {
+		return `${this.identity.email}\n${opts.method} ${opts.url}\n${opts.body ? JSON.stringify(opts.body) : ""}`;
+	}
+	invalidateSite(siteUrl) {
+		const marker = encodeURIComponent(siteUrl);
+		this.cache?.deleteWhere((key) => key.startsWith(`${this.identity.email}\n`) && key.includes(marker));
+	}
+	async request(opts) {
+		const useCache = this.cache && opts.cacheWeight && this.cacheTtlMs > 0;
+		const key = useCache ? this.cacheKey(opts) : "";
+		if (useCache && !opts.fresh) {
+			const hit = this.cache.get(key);
+			if (hit !== void 0) {
+				this.logger.debug("gsc cache hit", {
+					method: opts.method,
+					path: pathOf(opts.url)
+				});
+				return hit;
+			}
+		}
+		let refreshedToken = false;
+		for (let attempt = 0;; attempt++) {
+			const started = Date.now();
+			let res;
+			try {
+				const token = await this.tokenSource.getAccessToken();
+				res = await this.fetchImpl(opts.url, {
+					method: opts.method,
+					headers: {
+						authorization: `Bearer ${token}`,
+						...opts.body !== void 0 ? { "content-type": "application/json" } : {}
+					},
+					body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+					signal: AbortSignal.timeout(this.timeoutMs)
+				});
+			} catch (error) {
+				if (error instanceof GscApiError) {
+					if (error.retryable && attempt < this.maxRetries) {
+						await this.sleep(backoff(attempt));
+						continue;
+					}
+					throw error;
+				}
+				if (attempt < this.maxRetries) {
+					this.logger.warn("gsc network error, retrying", {
+						attempt,
+						error
+					});
+					await this.sleep(backoff(attempt));
+					continue;
+				}
+				throw new GscApiError({
+					kind: "network",
+					status: 0,
+					googleMessage: "",
+					retryable: true,
+					advice: "Could not reach the Google Search Console API (network error or timeout). Try again shortly."
+				});
+			}
+			this.logger.debug("gsc request", {
+				method: opts.method,
+				path: pathOf(opts.url),
+				status: res.status,
+				ms: Date.now() - started
+			});
+			if (res.ok) {
+				const text = await res.text();
+				const data = text ? JSON.parse(text) : {};
+				if (useCache) this.cache.set(key, data, this.cacheTtlMs, opts.cacheWeight(data));
+				return data;
+			}
+			const body = await res.json().catch(() => void 0);
+			if (res.status === 401 && !refreshedToken) {
+				refreshedToken = true;
+				this.tokenSource.invalidate();
+				continue;
+			}
+			const error = toGscApiError(res.status, body, {
+				identity: this.identity,
+				siteUrl: opts.siteUrl
+			});
+			if ((RETRYABLE_STATUS.has(res.status) || error.kind === "rate_limited" && error.retryable) && attempt < this.maxRetries) {
+				const retryAfter = Number(res.headers.get("retry-after"));
+				const delay = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter * 1e3, 1e4) : backoff(attempt);
+				this.logger.info("gsc retrying", {
+					status: res.status,
+					attempt,
+					delay
+				});
+				await this.sleep(delay);
+				continue;
+			}
+			throw error;
+		}
+	}
+};
+/** Exponential backoff with jitter: ~0.5s, 1s, 2s, 4s (+ up to 250ms). */
+function backoff(attempt) {
+	return 500 * 2 ** attempt + Math.floor(Math.random() * 250);
+}
+/** Path for logs, with the (possibly sensitive) site URL segment left encoded. */
+function pathOf(url) {
+	return url.replace(API_BASE, "");
+}
+//#endregion
+//#region src/core/analysis/compare.ts
+const EMPTY = {
+	clicks: 0,
+	impressions: 0
+};
+function metricChange(current, previous) {
+	return {
+		clicks: current.clicks - previous.clicks,
+		clicks_pct: pctChange(current.clicks, previous.clicks),
+		impressions: current.impressions - previous.impressions,
+		impressions_pct: pctChange(current.impressions, previous.impressions),
+		ctr_pp: round(current.ctr_pct - previous.ctr_pct, 2),
+		rank_improvement: current.position !== null && previous.position !== null ? round(previous.position - current.position, 1) : null
+	};
+}
+/** Full outer join of two keyed row sets with per-key deltas. */
+function compareRows(current, previous) {
+	const keys = /* @__PURE__ */ new Set([...current.keys(), ...previous.keys()]);
+	const rows = [];
+	for (const key of keys) {
+		const cur = toMetrics(current.get(key) ?? EMPTY);
+		const prev = toMetrics(previous.get(key) ?? EMPTY);
+		rows.push({
+			key,
+			current: cur,
+			previous: prev,
+			change: metricChange(cur, prev),
+			status: !previous.has(key) ? "new" : !current.has(key) ? "lost" : "both"
+		});
+	}
+	return rows;
+}
+function topGainers(rows, n) {
+	return rows.filter((r) => r.change.clicks > 0).sort((a, b) => b.change.clicks - a.change.clicks || b.change.impressions - a.change.impressions).slice(0, n);
+}
+function topLosers(rows, n) {
+	return rows.filter((r) => r.change.clicks < 0).sort((a, b) => a.change.clicks - b.change.clicks || a.change.impressions - b.change.impressions).slice(0, n);
+}
+function topByCurrentClicks(rows, n) {
+	return [...rows].filter((r) => r.status !== "lost").sort((a, b) => b.current.clicks - a.current.clicks || b.current.impressions - a.current.impressions).slice(0, n);
+}
+//#endregion
+//#region src/core/dates.ts
+const DATE_PRESETS = [
+	"last_7_days",
+	"last_28_days",
+	"last_3_months",
+	"last_6_months",
+	"last_12_months",
+	"last_16_months",
+	"previous_period"
+];
+const COMPARE_MODES = ["previous_period", "year_over_year"];
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function isValidDate(value) {
+	if (!DATE_RE.test(value)) return false;
+	const d = /* @__PURE__ */ new Date(`${value}T00:00:00Z`);
+	return !Number.isNaN(d.getTime()) && d.toISOString().slice(0, 10) === value;
+}
+const ptFormatter = new Intl.DateTimeFormat("en-CA", {
+	timeZone: "America/Los_Angeles",
+	year: "numeric",
+	month: "2-digit",
+	day: "2-digit"
+});
+function todayPT(now = /* @__PURE__ */ new Date()) {
+	return ptFormatter.format(now);
+}
+function toUtc(date) {
+	return /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+}
+function fromUtc(d) {
+	return d.toISOString().slice(0, 10);
+}
+function addDays(date, days) {
+	const d = toUtc(date);
+	d.setUTCDate(d.getUTCDate() + days);
+	return fromUtc(d);
+}
+/** Calendar month arithmetic that clamps to the end of shorter months (Mar 31 − 1 month = Feb 28). */
+function addMonths(date, months) {
+	const d = toUtc(date);
+	const day = d.getUTCDate();
+	d.setUTCDate(1);
+	d.setUTCMonth(d.getUTCMonth() + months);
+	const lastDay = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + 1, 0)).getUTCDate();
+	d.setUTCDate(Math.min(day, lastDay));
+	return fromUtc(d);
+}
+/** Inclusive number of days in a range. */
+function rangeLength(range) {
+	return Math.round((toUtc(range.endDate).getTime() - toUtc(range.startDate).getTime()) / 864e5) + 1;
+}
+function resolvePreset(preset, endDate) {
+	const lastDays = (n) => ({
+		startDate: addDays(endDate, -(n - 1)),
+		endDate
+	});
+	const lastMonths = (n) => ({
+		startDate: addDays(addMonths(endDate, -n), 1),
+		endDate
+	});
+	switch (preset) {
+		case "last_7_days": return lastDays(7);
+		case "last_28_days": return lastDays(28);
+		case "last_3_months": return lastMonths(3);
+		case "last_6_months": return lastMonths(6);
+		case "last_12_months": return lastMonths(12);
+		case "last_16_months": return lastMonths(16);
+		case "previous_period": return previousPeriod(lastDays(28));
+	}
+}
+/** The range of equal length immediately before `range`. */
+function previousPeriod(range) {
+	const length = rangeLength(range);
+	const endDate = addDays(range.startDate, -1);
+	return {
+		startDate: addDays(endDate, -(length - 1)),
+		endDate
+	};
+}
+/** The same calendar dates one year earlier. */
+function yearOverYear(range) {
+	return {
+		startDate: addMonths(range.startDate, -12),
+		endDate: addMonths(range.endDate, -12)
+	};
+}
+function comparisonRange(range, mode) {
+	return mode === "year_over_year" ? yearOverYear(range) : previousPeriod(range);
+}
+/** Oldest date Search Console still has data for, given today's date (PT). */
+function earliestAvailableDate(today) {
+	return addDays(addMonths(today, -16), 1);
+}
+/** Splits a range into `count` consecutive, equal-length windows ending at `endDate`. */
+function consecutiveWindows(endDate, count, days) {
+	const windows = [];
+	let end = endDate;
+	for (let i = 0; i < count; i++) {
+		const start = addDays(end, -(days - 1));
+		windows.unshift({
+			startDate: start,
+			endDate: end
+		});
+		end = addDays(start, -1);
+	}
+	return windows;
+}
+//#endregion
+//#region src/core/gsc/types.ts
+const SEARCH_TYPES = [
+	"web",
+	"image",
+	"video",
+	"news",
+	"discover",
+	"googleNews"
+];
+const DIMENSIONS = [
+	"query",
+	"page",
+	"country",
+	"device",
+	"date",
+	"searchAppearance",
+	"hour"
+];
+const FILTER_DIMENSIONS = [
+	"query",
+	"page",
+	"country",
+	"device",
+	"searchAppearance"
+];
+const FILTER_OPERATORS = [
+	"equals",
+	"notEquals",
+	"contains",
+	"notContains",
+	"includingRegex",
+	"excludingRegex"
+];
+const AGGREGATION_TYPES = [
+	"auto",
+	"byPage",
+	"byProperty",
+	"byNewsShowcasePanel"
+];
+//#endregion
+//#region src/core/tools/common.ts
+const siteUrlField = z.string().min(1).describe("Search Console property: 'sc-domain:example.com', 'https://www.example.com/', or just 'example.com' (matched against your properties; see list_sites).");
+const dateField = z.string().refine(isValidDate, "Use YYYY-MM-DD.").optional();
+const dateRangeFields = {
+	date_range: z.enum(DATE_PRESETS).default("last_28_days").describe("Relative period ending on the latest day with final data (Search Console lags ~2–3 days). previous_period = the 28 days before last_28_days."),
+	start_date: dateField.describe("Explicit start date YYYY-MM-DD (Pacific Time). Use together with end_date; overrides date_range."),
+	end_date: dateField.describe("Explicit end date YYYY-MM-DD (Pacific Time), inclusive."),
+	fresh: z.boolean().default(false).describe("Include fresh, still-changing data from the most recent ~2 days (dataState \"all\"). Default: final data only.")
+};
+const searchTypeField = z.enum(SEARCH_TYPES).default("web").describe("Search type. Discover and Google News have no query or position data.");
+const filterSchema = z.object({
+	dimension: z.enum(FILTER_DIMENSIONS),
+	operator: z.enum(FILTER_OPERATORS).default("equals").describe("equals/notEquals are case-sensitive; contains/notContains are not; regex uses RE2 syntax."),
+	expression: z.string().min(1).max(4096).describe("Value to match. Countries are ISO 3166-1 alpha-3 (e.g. USA); devices are DESKTOP, MOBILE, TABLET.")
+});
+const filtersField = z.array(filterSchema).max(20).optional().describe("Filters, all ANDed together.");
+function limitField(defaultValue, max = 500) {
+	return z.number().int().min(1).max(max).default(defaultValue).describe(`How many rows to show (top N, default ${defaultValue}). Results always say how many more exist.`);
+}
+/**
+* Latest date that already has final data, found with a cheap date-grouped query (cached by the
+* client). Falls back to today − 3 days for properties with no recent data.
+*/
+async function latestFinalDate(ctx, siteUrl, searchType) {
+	const today = todayPT(ctx.now());
+	const dates = ((await ctx.gsc.searchAnalytics(siteUrl, {
+		startDate: addDays(today, -10),
+		endDate: today,
+		dimensions: ["date"],
+		type: searchType,
+		dataState: "final",
+		rowLimit: 15
+	})).rows ?? []).map((r) => r.keys?.[0]).filter((d) => Boolean(d));
+	return dates.length > 0 ? dates.sort().at(-1) : addDays(today, -3);
+}
+async function resolveWindow(ctx, property, input, searchType = "web") {
+	const today = todayPT(ctx.now());
+	const dataState = input.fresh ? "all" : "final";
+	if (input.start_date || input.end_date) {
+		if (!input.start_date || !input.end_date) throw new UserFacingError("Provide both start_date and end_date, or neither (to use date_range).");
+		if (input.start_date > input.end_date) throw new UserFacingError("start_date must be on or before end_date.");
+		if (input.end_date > today) throw new UserFacingError(`end_date cannot be in the future (today is ${today} Pacific Time).`);
+		const earliest = earliestAvailableDate(today);
+		if (input.end_date < earliest) throw new UserFacingError(`Search Console only keeps ~16 months of data; the earliest available date is about ${earliest}.`);
+		return {
+			startDate: input.start_date < earliest ? earliest : input.start_date,
+			endDate: input.end_date,
+			dataState,
+			label: `${input.start_date} → ${input.end_date}`
+		};
+	}
+	const endDate = input.fresh ? today : await latestFinalDate(ctx, property.site_url, searchType);
+	const range = resolvePreset(input.date_range, endDate);
+	const earliest = earliestAvailableDate(today);
+	return {
+		...range,
+		startDate: range.startDate < earliest ? earliest : range.startDate,
+		dataState,
+		label: input.date_range
+	};
+}
+function windowNote(window) {
+	const state = window.dataState === "all" ? "includes fresh data; the last ~2 days are incomplete and will still change" : "final data only; Search Console lags ~2–3 days";
+	return `_${window.startDate} → ${window.endDate} (Pacific Time, ${state})._`;
+}
+function toFilterGroups(filters) {
+	if (!filters || filters.length === 0) return void 0;
+	return [{
+		groupType: "and",
+		filters
+	}];
+}
+/** All rows for a window and dimension set (auto-paginated, capped by GSCLAW_MAX_ROWS). */
+async function fetchRows(ctx, siteUrl, range, dimensions, opts = {}) {
+	return ctx.gsc.searchAnalyticsAll(siteUrl, {
+		startDate: range.startDate,
+		endDate: range.endDate,
+		dimensions,
+		type: opts.type ?? "web",
+		dimensionFilterGroups: toFilterGroups(opts.filters),
+		dataState: opts.dataState ?? "final"
+	}, Math.min(opts.maxRows ?? ctx.config.maxRows, ctx.config.maxRows));
+}
+/** Property totals for a window (a single dimensionless row). */
+async function fetchTotals(ctx, siteUrl, range, opts = {}) {
+	return (await ctx.gsc.searchAnalytics(siteUrl, {
+		startDate: range.startDate,
+		endDate: range.endDate,
+		type: opts.type ?? "web",
+		dimensionFilterGroups: toFilterGroups(opts.filters),
+		dataState: opts.dataState ?? "final",
+		rowLimit: 1
+	})).rows?.[0] ?? {
+		clicks: 0,
+		impressions: 0
+	};
+}
+/** Keyed rows for one dimension, e.g. query → metrics. */
+async function fetchKeyed(ctx, siteUrl, range, dimension, opts = {}) {
+	const { rows, truncated } = await fetchRows(ctx, siteUrl, range, [dimension], opts);
+	return {
+		rows: new Map(rows.map((r) => [r.keys?.[0] ?? "", r])),
+		truncated
+	};
+}
+/** Adds an excludingRegex query filter when a pattern is given (e.g. to drop branded queries). */
+function withQueryExclusion(filters, pattern) {
+	if (!pattern) return filters;
+	return [...filters ?? [], {
+		dimension: "query",
+		operator: "excludingRegex",
+		expression: pattern
+	}];
+}
+const excludeQueriesField = z.string().max(4096).optional().describe("RE2 regex of queries to exclude, e.g. your brand: 'acme|acme corp'.");
+async function propertyFor(ctx, siteUrl) {
+	return resolveProperty(ctx.gsc, siteUrl);
+}
+/** Host used to shorten page URLs in text output (URL-prefix properties only). */
+function displayHost(siteUrl) {
+	if (siteUrl.startsWith("sc-domain:")) return void 0;
+	try {
+		return new URL(siteUrl).host;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/core/tools/types.ts
+function defineTool(def) {
+	return def;
+}
+const READ_ONLY = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: false
+};
+//#endregion
+//#region src/core/tools/compare.ts
+const COMPARE_DIMENSIONS = [
+	"query",
+	"page",
+	"country",
+	"device",
+	"searchAppearance",
+	"none"
+];
+const COMPARE_VIEWS = [
+	"movers",
+	"top",
+	"all"
+];
+const comparePeriods = defineTool({
+	name: "compare_periods",
+	title: "Compare periods (gainers & losers)",
+	description: "Compares a period with the previous period or the same dates last year: property totals with deltas, plus the top gaining and losing queries/pages/countries/devices by clicks. Use for \"what changed?\", traffic drops, and month-over-month or year-over-year reports. dimension \"none\" returns totals only.",
+	input: z.object({
+		site_url: siteUrlField,
+		...dateRangeFields,
+		compare_to: z.enum(COMPARE_MODES).default("previous_period").describe("previous_period (same length, right before) or year_over_year (same dates last year)."),
+		dimension: z.enum(COMPARE_DIMENSIONS).default("query"),
+		view: z.enum(COMPARE_VIEWS).default("movers").describe("movers = top gainers + losers; top = biggest rows now with deltas; all = both."),
+		filters: filtersField,
+		search_type: searchTypeField,
+		limit: limitField(10, 100)
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const current = await resolveWindow(ctx, property, input, input.search_type);
+		const previous = comparisonRange(current, input.compare_to);
+		const earliest = earliestAvailableDate(todayPT(ctx.now()));
+		if (previous.startDate < earliest) throw new UserFacingError(`The comparison period would start ${previous.startDate}, but Search Console only keeps ~16 months of data (earliest ≈ ${earliest}). Use a shorter date_range or compare_to "previous_period".`);
+		const opts = {
+			type: input.search_type,
+			filters: input.filters,
+			dataState: current.dataState
+		};
+		const dimension = input.dimension === "none" ? null : input.dimension;
+		const [curTotals, prevTotals, curRows, prevRows] = await Promise.all([
+			fetchTotals(ctx, property.site_url, current, opts),
+			fetchTotals(ctx, property.site_url, previous, opts),
+			dimension ? fetchKeyed(ctx, property.site_url, current, dimension, opts) : null,
+			dimension ? fetchKeyed(ctx, property.site_url, previous, dimension, opts) : null
+		]);
+		const rows = curRows && prevRows ? compareRows(curRows.rows, prevRows.rows) : [];
+		const cur = toMetrics(curTotals);
+		const prev = toMetrics(prevTotals);
+		const wantTop = input.view !== "movers";
+		const wantMovers = input.view !== "top";
+		return {
+			site_url: property.site_url,
+			dimension: input.dimension,
+			compare_to: input.compare_to,
+			current: {
+				startDate: current.startDate,
+				endDate: current.endDate
+			},
+			previous,
+			data_state: current.dataState,
+			totals: {
+				current: cur,
+				previous: prev,
+				change: metricChange(cur, prev)
+			},
+			top: wantTop ? topByCurrentClicks(rows, input.limit) : [],
+			gainers: wantMovers ? topGainers(rows, input.limit) : [],
+			losers: wantMovers ? topLosers(rows, input.limit) : [],
+			new_count: rows.filter((r) => r.status === "new").length,
+			lost_count: rows.filter((r) => r.status === "lost").length,
+			compared_count: rows.length,
+			truncated: Boolean(curRows?.truncated || prevRows?.truncated)
+		};
+	},
+	format(r) {
+		const t = r.totals;
+		const host = displayHost(r.site_url);
+		const label = (key) => r.dimension === "page" ? compactUrl(key, host) : key;
+		const totals = mdTable([
+			"Metric",
+			"Current",
+			"Previous",
+			"Change"
+		], [
+			[
+				"Clicks",
+				fmtInt(t.current.clicks),
+				fmtInt(t.previous.clicks),
+				fmtChange(t.current.clicks, t.previous.clicks)
+			],
+			[
+				"Impressions",
+				fmtInt(t.current.impressions),
+				fmtInt(t.previous.impressions),
+				fmtChange(t.current.impressions, t.previous.impressions)
+			],
+			[
+				"CTR",
+				fmtPct(t.current.ctr_pct),
+				fmtPct(t.previous.ctr_pct),
+				`${fmtSigned(t.change.ctr_pp, (v) => v.toFixed(2))} pp`
+			],
+			[
+				"Avg position",
+				fmtPos(t.current.position),
+				fmtPos(t.previous.position),
+				positionChange(t.change.rank_improvement)
+			]
+		]);
+		const table = (title, rows) => rows.length === 0 ? null : sections(`**${title}**`, mdTable([
+			r.dimension,
+			"Clicks",
+			"Δ clicks",
+			"Impr.",
+			"Δ impr.",
+			"Pos.",
+			"Δ pos."
+		], rows.map((row) => [
+			label(row.key),
+			fmtInt(row.current.clicks),
+			fmtChange(row.current.clicks, row.previous.clicks),
+			fmtInt(row.current.impressions),
+			fmtSigned(row.change.impressions),
+			fmtPos(row.current.position),
+			positionChange(row.change.rank_improvement)
+		])));
+		return sections(`**${r.site_url}: ${r.current.startDate} → ${r.current.endDate} vs ${r.previous.startDate} → ${r.previous.endDate}** (${r.compare_to === "year_over_year" ? "year over year" : "previous period"}, ${r.data_state} data)`, totals, table(`Top ${r.dimension} values now`, r.top), table("Top gainers (by clicks)", r.gainers), table("Top losers (by clicks)", r.losers), r.dimension !== "none" ? `_${fmtInt(r.compared_count)} ${r.dimension} values compared: ${fmtInt(r.new_count)} new, ${fmtInt(r.lost_count)} no longer appearing.${r.truncated ? " Row cap reached; the long tail is not included." : ""}_` : null);
+	}
+});
+function positionChange(improvement) {
+	if (improvement === null) return "–";
+	if (improvement === 0) return "0";
+	return improvement > 0 ? `↑${improvement.toFixed(1)}` : `↓${Math.abs(improvement).toFixed(1)}`;
+}
+//#endregion
+//#region src/core/analysis/decay.ts
+/**
+* Pages whose clicks fell steadily across consecutive windows: at least `minBaselineClicks` in the
+* first window, at least `minDeclinePct` lower in the last one, and falling in all but at most one
+* window-to-window step.
+*/
+function findContentDecay(series, windows, opts) {
+	const out = [];
+	const requiredDeclines = Math.max(1, windows - 2);
+	for (const [page, values] of series) {
+		const metrics = Array.from({ length: windows }, (_, i) => toMetrics(values[i] ?? {
+			clicks: 0,
+			impressions: 0
+		}));
+		const clicks = metrics.map((m) => m.clicks);
+		const baseline = clicks[0];
+		const latest = clicks.at(-1);
+		if (baseline < opts.minBaselineClicks) continue;
+		const declinePct = (baseline - latest) / baseline * 100;
+		if (declinePct < opts.minDeclinePct) continue;
+		let declines = 0;
+		for (let i = 1; i < clicks.length; i++) if (clicks[i] < clicks[i - 1]) declines++;
+		if (declines < requiredDeclines) continue;
+		const first = metrics[0];
+		const last = metrics.at(-1);
+		const positionDrop = first.position !== null && last.position !== null ? last.position - first.position : 0;
+		const impressionDrop = first.impressions ? (first.impressions - last.impressions) / first.impressions : 0;
+		const ctrDrop = first.ctr_pct ? (first.ctr_pct - last.ctr_pct) / first.ctr_pct : 0;
+		let cause = "mixed";
+		if (positionDrop >= 1.5) cause = "ranking_loss";
+		else if (impressionDrop >= .2 && Math.abs(positionDrop) < 1) cause = "lower_demand";
+		else if (ctrDrop >= .2 && Math.abs(positionDrop) < 1) cause = "lower_ctr";
+		out.push({
+			page,
+			clicks,
+			impressions: metrics.map((m) => m.impressions),
+			position: metrics.map((m) => m.position),
+			baseline_clicks: baseline,
+			latest_clicks: latest,
+			lost_clicks: baseline - latest,
+			decline_pct: round(declinePct, 1),
+			declines,
+			likely_cause: cause
+		});
+	}
+	return out.sort((a, b) => b.lost_clicks - a.lost_clicks);
+}
+//#endregion
+//#region src/core/tools/content-decay.ts
+const CAUSE_LABEL = {
+	ranking_loss: "rankings dropped",
+	lower_demand: "fewer impressions (demand/seasonality)",
+	lower_ctr: "CTR fell (SERP/snippet change)",
+	mixed: "mixed"
+};
+const contentDecay = defineTool({
+	name: "content_decay",
+	title: "Content decay",
+	description: "Finds pages whose clicks declined steadily over consecutive windows (default 4 × 28 days), not just one bad week. For each page: clicks per window, total decline, position trend and a likely cause (ranking loss, lower demand, lower CTR).",
+	input: z.object({
+		site_url: siteUrlField,
+		windows: z.number().int().min(3).max(8).default(4).describe("Number of consecutive windows to compare."),
+		window_days: z.number().int().min(7).max(91).default(28).describe("Length of each window in days."),
+		min_baseline_clicks: z.number().int().min(1).default(20).describe("Minimum clicks in the oldest window."),
+		min_decline_pct: z.number().min(1).max(100).default(25).describe("Minimum drop from the oldest to the newest window, in percent."),
+		exclude_queries: excludeQueriesField,
+		limit: limitField(20)
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const windows = consecutiveWindows(await latestFinalDate(ctx, property.site_url, "web"), input.windows, input.window_days);
+		const earliest = earliestAvailableDate(todayPT(ctx.now()));
+		if (windows[0].startDate < earliest) throw new UserFacingError(`${input.windows} × ${input.window_days} days reaches back to ${windows[0].startDate}, beyond Search Console's ~16 months of data. Use fewer or shorter windows.`);
+		const filters = input.exclude_queries ? [{
+			dimension: "query",
+			operator: "excludingRegex",
+			expression: input.exclude_queries
+		}] : void 0;
+		const results = await Promise.all(windows.map((w) => fetchKeyed(ctx, property.site_url, w, "page", { filters })));
+		const series = /* @__PURE__ */ new Map();
+		results.forEach((result, i) => {
+			for (const [page, metrics] of result.rows) {
+				const url = page.split("#")[0];
+				const list = series.get(url) ?? new Array(windows.length).fill(void 0);
+				const prev = list[i];
+				list[i] = prev ? mergeMetrics(prev, metrics) : metrics;
+				series.set(url, list);
+			}
+		});
+		const matches = findContentDecay(series, windows.length, {
+			minBaselineClicks: input.min_baseline_clicks,
+			minDeclinePct: input.min_decline_pct
+		});
+		return {
+			site_url: property.site_url,
+			windows,
+			min_baseline_clicks: input.min_baseline_clicks,
+			min_decline_pct: input.min_decline_pct,
+			total_matches: matches.length,
+			rows: matches.slice(0, input.limit),
+			truncated: results.some((r) => r.truncated)
+		};
+	},
+	format(r) {
+		const host = displayHost(r.site_url);
+		const span = `${r.windows[0].startDate} → ${r.windows.at(-1).endDate}, ${r.windows.length} windows`;
+		if (r.total_matches === 0) return `No decaying pages on ${r.site_url} (${span}; ≥${r.min_baseline_clicks} clicks in the first window and ≥${r.min_decline_pct}% sustained decline).`;
+		return sections(`**${fmtInt(r.total_matches)} decaying pages** on ${r.site_url} (${span})`, mdTable([
+			"Page",
+			"Clicks per window",
+			"Decline",
+			"Position",
+			"Likely cause"
+		], r.rows.map((row) => [
+			compactUrl(row.page, host),
+			row.clicks.map(fmtInt).join(" → "),
+			`-${fmtInt(row.lost_clicks)} (-${row.decline_pct}%)`,
+			`${fmtPos(row.position[0] ?? null)} → ${fmtPos(row.position.at(-1) ?? null)}`,
+			CAUSE_LABEL[row.likely_cause]
+		])), omittedNote(r.rows.length, r.total_matches, "Raise `limit` to see more."), r.truncated ? "_Row cap reached in at least one window; small pages may be missing._" : null);
+	}
+});
+function mergeMetrics(a, b) {
+	const impressions = a.impressions + b.impressions;
+	return {
+		clicks: a.clicks + b.clicks,
+		impressions,
+		position: impressions ? ((a.position ?? 0) * a.impressions + (b.position ?? 0) * b.impressions) / impressions : void 0
+	};
+}
+//#endregion
+//#region src/core/tools/inspection.ts
+const urlField = z.string().url().describe("Full URL of the page to inspect (must belong to the property).");
+const optionalSiteField = z.string().optional().describe("Property that contains the URL. Optional: inferred from your properties when omitted.");
+/** Finds the most specific readable property that contains `url`. */
+async function propertyForUrl(gsc, url, siteUrl) {
+	if (siteUrl) {
+		const property = await resolveProperty(gsc, siteUrl);
+		if (!propertyCoversUrl(property, url)) throw new UserFacingError(`${url} is not inside the property '${property.site_url}'.`);
+		return property;
+	}
+	const properties = (await listProperties(gsc)).filter((p) => p.has_access && propertyCoversUrl(p, url));
+	properties.sort((a, b) => Number(b.type === "url_prefix") - Number(a.type === "url_prefix") || b.site_url.length - a.site_url.length);
+	const best = properties[0];
+	if (!best) throw new UserFacingError(`None of your Search Console properties contains ${url}. Run list_sites to check.`, "not_found");
+	return best;
+}
+function summarizeInspection(url, siteUrl, result) {
+	const idx = result?.indexStatusResult ?? {};
+	const google = idx.googleCanonical ?? null;
+	const user = idx.userCanonical ?? null;
+	const issues = (list) => (list ?? []).map((i) => `${i.severity ? `${i.severity}: ` : ""}${i.issueMessage ?? i.message ?? "issue"}`);
+	return {
+		url,
+		site_url: siteUrl,
+		verdict: idx.verdict ?? "VERDICT_UNSPECIFIED",
+		coverage_state: idx.coverageState ?? null,
+		indexing_state: idx.indexingState ?? null,
+		robots_txt_state: idx.robotsTxtState ?? null,
+		page_fetch_state: idx.pageFetchState ?? null,
+		last_crawl_time: idx.lastCrawlTime ?? null,
+		crawled_as: idx.crawledAs ?? null,
+		google_canonical: google,
+		user_canonical: user,
+		canonical_mismatch: Boolean(google && user && google !== user),
+		sitemaps: idx.sitemap ?? [],
+		referring_urls: (idx.referringUrls ?? []).slice(0, 10),
+		mobile_usability: result?.mobileUsabilityResult ? {
+			verdict: result.mobileUsabilityResult.verdict ?? "VERDICT_UNSPECIFIED",
+			issues: issues(result.mobileUsabilityResult.issues)
+		} : null,
+		rich_results: result?.richResultsResult ? {
+			verdict: result.richResultsResult.verdict ?? "VERDICT_UNSPECIFIED",
+			items: (result.richResultsResult.detectedItems ?? []).flatMap((d) => (d.items ?? [{}]).map((item) => ({
+				type: d.richResultType ?? "unknown",
+				name: item.name ?? null,
+				issues: issues(item.issues)
+			})))
+		} : null,
+		inspection_link: result?.inspectionResultLink ?? null
+	};
+}
+async function inspectOne(ctx, url, siteUrl, languageCode) {
+	const property = await propertyForUrl(ctx.gsc, url, siteUrl);
+	const res = await ctx.gsc.inspectUrl(property.site_url, url, languageCode);
+	return summarizeInspection(url, property.site_url, res.inspectionResult);
+}
+function formatInspection(s) {
+	const lines = [
+		`**URL Inspection** for ${s.url}`,
+		`- Verdict: **${s.verdict}**${s.coverage_state ? ` — ${s.coverage_state}` : ""}`,
+		`- Indexing: ${s.indexing_state ?? "unknown"} · robots.txt: ${s.robots_txt_state ?? "unknown"} · fetch: ${s.page_fetch_state ?? "unknown"}`,
+		`- Last crawl: ${s.last_crawl_time ?? "never / unknown"}${s.crawled_as ? ` (${s.crawled_as.toLowerCase()} crawler)` : ""}`,
+		`- Canonical — Google: ${s.google_canonical ?? "n/a"} · declared: ${s.user_canonical ?? "n/a"}${s.canonical_mismatch ? " ⚠️ **mismatch**" : ""}`
+	];
+	if (s.sitemaps.length) lines.push(`- In sitemaps: ${s.sitemaps.join(", ")}`);
+	if (s.rich_results) {
+		const items = s.rich_results.items.map((i) => `${i.type}${i.name ? ` (${i.name})` : ""}${i.issues.length ? `: ${i.issues.join("; ")}` : ""}`).join(" · ");
+		lines.push(`- Rich results: ${s.rich_results.verdict}${items ? ` — ${items}` : ""}`);
+	}
+	if (s.mobile_usability) lines.push(`- Mobile usability (deprecated report): ${s.mobile_usability.verdict}${s.mobile_usability.issues.length ? ` — ${s.mobile_usability.issues.join("; ")}` : ""}`);
+	if (s.inspection_link) lines.push(`- Open in Search Console: ${s.inspection_link}`);
+	lines.push("_URL Inspection reports the indexed version; it is not a live test._");
+	return lines.join("\n");
+}
+const inspectUrl = defineTool({
+	name: "inspect_url",
+	title: "Inspect URL (index status)",
+	description: "Shows Google's index status for one URL: verdict, coverage state, robots.txt and fetch status, last crawl, Google-selected vs declared canonical, sitemaps and rich results. Uses the URL Inspection API (quota: 2,000/day and 600/min per property).",
+	input: z.object({
+		url: urlField,
+		site_url: optionalSiteField,
+		language_code: z.string().default("en-US").describe("Language for issue messages (BCP-47).")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		return inspectOne(ctx, input.url, input.site_url, input.language_code);
+	},
+	format: formatInspection
+});
+async function mapWithConcurrency(items, concurrency, fn) {
+	const results = new Array(items.length);
+	let next = 0;
+	const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+		while (next < items.length) {
+			const i = next++;
+			results[i] = await fn(items[i]);
+		}
+	});
+	await Promise.all(workers);
+	return results;
+}
+const batchInspectUrls = defineTool({
+	name: "batch_inspect_urls",
+	title: "Inspect many URLs",
+	description: "Runs URL Inspection on a list of URLs with limited concurrency and summarizes index status (verdicts, coverage states, canonical mismatches). Each URL costs one URL Inspection call (2,000/day and 600/min per property), so keep batches focused.",
+	input: z.object({
+		urls: z.array(z.string().url()).min(1).max(500).describe("URLs to inspect (the server caps the batch size; default cap 50)."),
+		site_url: optionalSiteField,
+		concurrency: z.number().int().min(1).max(10).default(5).describe("Parallel requests (max 10 ≈ the 600/min quota).")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const urls = [...new Set(input.urls)];
+		if (urls.length > ctx.config.batchInspectMax) throw new UserFacingError(`Too many URLs (${urls.length}). This server allows up to ${ctx.config.batchInspectMax} per batch (GSCLAW_BATCH_INSPECT_MAX) to protect the 2,000/day URL Inspection quota. Split the list.`);
+		const outcomes = await mapWithConcurrency(urls, input.concurrency, async (url) => {
+			try {
+				return {
+					ok: true,
+					value: await inspectOne(ctx, url, input.site_url)
+				};
+			} catch (error) {
+				return {
+					ok: false,
+					url,
+					error: publicErrorMessage(error).message.split("\n")[0]
+				};
+			}
+		});
+		const results = outcomes.flatMap((o) => o.ok ? [o.value] : []);
+		const errors = outcomes.flatMap((o) => o.ok ? [] : [{
+			url: o.url,
+			error: o.error
+		}]);
+		const count = (values) => values.reduce((acc, v) => {
+			const k = v ?? "unknown";
+			acc[k] = (acc[k] ?? 0) + 1;
+			return acc;
+		}, {});
+		return {
+			inspected: results.length,
+			failed: errors.length,
+			verdicts: count(results.map((r) => r.verdict)),
+			coverage: count(results.map((r) => r.coverage_state)),
+			canonical_mismatches: results.filter((r) => r.canonical_mismatch).length,
+			results,
+			errors
+		};
+	},
+	format(r) {
+		const host = r.results[0] ? displayHost(r.results[0].site_url) : void 0;
+		const summary = Object.entries(r.coverage).sort((a, b) => b[1] - a[1]).map(([state, n]) => `${n} × ${state}`).join(" · ");
+		const table = mdTable([
+			"URL",
+			"Verdict",
+			"Coverage",
+			"Last crawl",
+			"Canonical"
+		], r.results.map((s) => [
+			compactUrl(s.url, host),
+			s.verdict,
+			s.coverage_state,
+			s.last_crawl_time?.slice(0, 10) ?? "—",
+			s.canonical_mismatch ? `⚠️ Google chose ${compactUrl(s.google_canonical ?? "", host)}` : "ok"
+		]));
+		return sections(`**Inspected ${r.inspected} URL(s)**${r.failed ? `, ${r.failed} failed` : ""}. ${summary}`, r.canonical_mismatches ? `⚠️ ${r.canonical_mismatches} URL(s) where Google picked a different canonical.` : null, table, r.errors.length ? `**Errors:**\n${r.errors.map((e) => `- ${e.url}: ${e.error}`).join("\n")}` : null);
+	}
+});
+//#endregion
+//#region src/core/analysis/ctr-curve.ts
+/**
+* Approximate organic CTR by position (percent), compiled from public click-through-rate studies
+* of Google results. Real CTRs vary a lot by query intent, brand vs non-brand, device and SERP
+* features such as AI Overviews, which is why GSClaw prefers the site's own curve when it has
+* enough data.
+*/
+const INDUSTRY_CTR_CURVE = [
+	27,
+	15,
+	11,
+	8,
+	6,
+	4.6,
+	3.6,
+	2.9,
+	2.4,
+	2,
+	1.6,
+	1.4,
+	1.2,
+	1.1,
+	1,
+	.9,
+	.8,
+	.7,
+	.65,
+	.6
+];
+const MAX_CURVE_POSITION = INDUSTRY_CTR_CURVE.length;
+function median(values) {
+	const sorted = [...values].sort((a, b) => a - b);
+	const mid = Math.floor(sorted.length / 2);
+	return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
+/**
+* Builds a CTR-by-position curve. With `benchmark: 'site'`, each position bucket uses the median
+* CTR of the site's own rows (rows with at least `minImpressions`) when it has `minSamples` of
+* them, and the industry curve otherwise. The curve is forced to be non-increasing.
+*/
+function buildCtrCurve(rows, opts) {
+	const minImpressions = opts.minImpressions ?? 20;
+	const minSamples = opts.minSamples ?? 8;
+	const buckets = /* @__PURE__ */ new Map();
+	if (opts.benchmark === "site") for (const r of rows) {
+		if (r.impressions < minImpressions) continue;
+		const bucket = Math.round(r.position);
+		if (bucket < 1 || bucket > MAX_CURVE_POSITION) continue;
+		const list = buckets.get(bucket) ?? [];
+		list.push(r.clicks / r.impressions * 100);
+		buckets.set(bucket, list);
+	}
+	const curve = [];
+	for (let position = 1; position <= MAX_CURVE_POSITION; position++) {
+		const samples = buckets.get(position) ?? [];
+		const useSite = samples.length >= minSamples;
+		let ctr = useSite ? median(samples) : INDUSTRY_CTR_CURVE[position - 1];
+		const prev = curve.at(-1);
+		if (prev && ctr > prev.ctr_pct) ctr = prev.ctr_pct;
+		curve.push({
+			position,
+			ctr_pct: round(ctr, 2),
+			source: useSite ? "site" : "industry",
+			samples: samples.length
+		});
+	}
+	return curve;
+}
+/** Expected CTR (percent) at a fractional position, interpolating linearly between buckets. */
+function expectedCtr(curve, position) {
+	if (curve.length === 0) return 0;
+	if (position <= 1) return curve[0].ctr_pct;
+	if (position >= curve.length) return curve.at(-1).ctr_pct;
+	const lower = Math.floor(position);
+	const frac = position - lower;
+	const a = curve[lower - 1].ctr_pct;
+	return a + (curve[lower].ctr_pct - a) * frac;
+}
+//#endregion
+//#region src/core/analysis/opportunities.ts
+function groupByQuery(rows, mergeFragments) {
+	const byQuery = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const page = mergeFragments ? row.page.split("#")[0] : row.page;
+		const pages = byQuery.get(row.query) ?? /* @__PURE__ */ new Map();
+		const existing = pages.get(page);
+		if (existing) {
+			const impressions = existing.impressions + row.impressions;
+			pages.set(page, {
+				...existing,
+				clicks: existing.clicks + row.clicks,
+				impressions,
+				ctr: impressions ? (existing.clicks + row.clicks) / impressions : 0,
+				position: impressions ? (existing.position * existing.impressions + row.position * row.impressions) / impressions : existing.position
+			});
+		} else pages.set(page, {
+			...row,
+			page
+		});
+		byQuery.set(row.query, pages);
+	}
+	return byQuery;
+}
+function findStrikingDistance(rows, opts) {
+	const targetCtr = expectedCtr(opts.curve, opts.targetPosition) / 100;
+	const out = [];
+	for (const [query, pages] of groupByQuery(rows, true)) {
+		const sorted = [...pages.values()].sort((a, b) => b.impressions - a.impressions);
+		const primary = sorted[0];
+		if (primary.position < opts.minPosition || primary.position > opts.maxPosition) continue;
+		if (primary.impressions < opts.minImpressions) continue;
+		const metrics = toMetrics(primary);
+		out.push({
+			query,
+			page: primary.page,
+			...metrics,
+			other_pages: sorted.length - 1,
+			potential_extra_clicks: Math.max(0, Math.round(primary.impressions * targetCtr - primary.clicks))
+		});
+	}
+	return out.sort((a, b) => b.potential_extra_clicks - a.potential_extra_clicks || b.impressions - a.impressions);
+}
+function findCtrOpportunities(rows, opts) {
+	const out = [];
+	for (const row of rows) {
+		if (row.impressions < opts.minImpressions || row.position > opts.maxPosition) continue;
+		const expected = expectedCtr(opts.curve, row.position);
+		const actual = row.clicks / row.impressions * 100;
+		if (actual >= expected * opts.threshold) continue;
+		out.push({
+			key: row.key,
+			...toMetrics(row),
+			expected_ctr_pct: round(expected, 2),
+			ctr_gap_pp: round(actual - expected, 2),
+			missed_clicks: Math.round(row.impressions * (expected / 100) - row.clicks)
+		});
+	}
+	return out.sort((a, b) => b.missed_clicks - a.missed_clicks);
+}
+function findCannibalization(rows, opts) {
+	const out = [];
+	for (const [query, pages] of groupByQuery(rows, true)) {
+		if (pages.size < 2) continue;
+		const list = [...pages.values()];
+		const impressions = list.reduce((s, r) => s + r.impressions, 0);
+		if (impressions < opts.minImpressions) continue;
+		const shares = list.map((r) => ({
+			page: r.page,
+			...toMetrics(r),
+			share_pct: round(r.impressions / impressions * 100, 1)
+		})).sort((a, b) => b.impressions - a.impressions);
+		const competing = shares.filter((s) => s.share_pct >= opts.minSharePct);
+		if (competing.length < 2) continue;
+		out.push({
+			query,
+			clicks: list.reduce((s, r) => s + r.clicks, 0),
+			impressions,
+			contested_impressions: impressions - shares[0].impressions,
+			competing_pages: competing.length,
+			pages: shares.slice(0, opts.maxPagesShown ?? 5)
+		});
+	}
+	return out.sort((a, b) => b.contested_impressions - a.contested_impressions);
+}
+//#endregion
+//#region src/core/tools/opportunities.ts
+function toQueryPageRows(rows) {
+	return rows.map((r) => ({
+		query: r.keys?.[0] ?? "",
+		page: r.keys?.[1] ?? "",
+		clicks: r.clicks,
+		impressions: r.impressions,
+		ctr: r.ctr,
+		position: r.position
+	}));
+}
+async function queryPageRows(ctx, siteUrl, window, excludeQueries) {
+	const { rows, truncated } = await fetchRows(ctx, siteUrl, window, ["query", "page"], {
+		filters: withQueryExclusion(void 0, excludeQueries),
+		dataState: window.dataState
+	});
+	return {
+		rows: toQueryPageRows(rows),
+		truncated
+	};
+}
+const truncatedNote = (truncated) => truncated ? "_Row cap reached: only the top rows by clicks were analysed (raise GSCLAW_MAX_ROWS or shorten the date range)._" : null;
+const strikingDistanceKeywords = defineTool({
+	name: "striking_distance_keywords",
+	title: "Striking-distance keywords",
+	description: "Finds queries ranking just off the top spots (default average position 8–20) with meaningful impressions: the cheapest wins in SEO. Returns the ranking page, position, impressions and an estimate of extra clicks if the page reached position 3 (based on the site’s own CTR curve).",
+	input: z.object({
+		site_url: siteUrlField,
+		...dateRangeFields,
+		min_position: z.number().min(1).max(100).default(8),
+		max_position: z.number().min(1).max(100).default(20),
+		min_impressions: z.number().int().min(0).default(20).describe("Minimum impressions in the period."),
+		target_position: z.number().min(1).max(10).default(3).describe("Position used to estimate potential clicks."),
+		exclude_queries: excludeQueriesField,
+		limit: limitField(25)
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const window = await resolveWindow(ctx, property, input);
+		const { rows, truncated } = await queryPageRows(ctx, property.site_url, window, input.exclude_queries);
+		const curve = buildCtrCurve(rows, { benchmark: "site" });
+		const matches = findStrikingDistance(rows, {
+			minPosition: input.min_position,
+			maxPosition: input.max_position,
+			minImpressions: input.min_impressions,
+			targetPosition: input.target_position,
+			curve
+		});
+		return {
+			site_url: property.site_url,
+			start_date: window.startDate,
+			end_date: window.endDate,
+			data_state: window.dataState,
+			position_range: [input.min_position, input.max_position],
+			min_impressions: input.min_impressions,
+			target_position: input.target_position,
+			expected_ctr_at_target_pct: curve[Math.round(input.target_position) - 1]?.ctr_pct ?? 0,
+			total_matches: matches.length,
+			rows: matches.slice(0, input.limit),
+			truncated
+		};
+	},
+	format(r) {
+		const host = displayHost(r.site_url);
+		if (r.total_matches === 0) return `No striking-distance queries for ${r.site_url} (position ${r.position_range[0]}–${r.position_range[1]}, ≥${r.min_impressions} impressions, ${r.start_date} → ${r.end_date}). Try a longer date range or lower min_impressions.`;
+		return sections(`**${fmtInt(r.total_matches)} striking-distance queries** for ${r.site_url} (avg position ${r.position_range[0]}–${r.position_range[1]}, ≥${r.min_impressions} impressions)`, windowNote({
+			startDate: r.start_date,
+			endDate: r.end_date,
+			dataState: r.data_state === "all" ? "all" : "final",
+			label: ""
+		}), mdTable([
+			"Query",
+			"Ranking page",
+			"Pos.",
+			"Impr.",
+			"Clicks",
+			"CTR",
+			`+Clicks @#${r.target_position}`
+		], r.rows.map((row) => [
+			row.query,
+			compactUrl(row.page, host) + (row.other_pages ? ` (+${row.other_pages} other)` : ""),
+			fmtPos(row.position),
+			fmtInt(row.impressions),
+			fmtInt(row.clicks),
+			fmtPct(row.ctr_pct),
+			`+${fmtInt(row.potential_extra_clicks)}`
+		])), omittedNote(r.rows.length, r.total_matches, "Raise `limit` to see more."), `_Potential clicks assume ${fmtPct(r.expected_ctr_at_target_pct)} CTR at position ${r.target_position} (your site's CTR curve where data allows, otherwise an industry average). "+N other" = more pages competing for the query; see keyword_cannibalization._`, truncatedNote(r.truncated));
+	}
+});
+const ctrOpportunities = defineTool({
+	name: "ctr_opportunities",
+	title: "CTR opportunities",
+	description: "Finds queries or pages with many impressions but a CTR well below what their position usually earns: candidates for better titles, meta descriptions and rich results. Compares against a CTR-by-position curve (the site’s own by default, falling back to an industry curve) and returns the curve used plus estimated missed clicks.",
+	input: z.object({
+		site_url: siteUrlField,
+		...dateRangeFields,
+		dimension: z.enum(["query", "page"]).default("query"),
+		max_position: z.number().min(1).max(20).default(10).describe("Only consider rows ranking at or above this average position."),
+		min_impressions: z.number().int().min(0).default(100),
+		benchmark: z.enum(["site", "industry"]).default("site").describe("site = your own median CTR per position (industry values fill gaps); industry = a generic curve from public CTR studies."),
+		threshold_pct: z.number().min(1).max(100).default(60).describe("Flag rows whose CTR is below this % of the expected CTR (default 60%)."),
+		exclude_queries: excludeQueriesField,
+		limit: limitField(25)
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const window = await resolveWindow(ctx, property, input);
+		const { rows, truncated } = await fetchRows(ctx, property.site_url, window, [input.dimension], {
+			filters: withQueryExclusion(void 0, input.exclude_queries),
+			dataState: window.dataState
+		});
+		const keyed = rows.map((r) => ({
+			key: r.keys?.[0] ?? "",
+			...r
+		}));
+		const curve = buildCtrCurve(keyed, { benchmark: input.benchmark });
+		const matches = findCtrOpportunities(keyed, {
+			maxPosition: input.max_position,
+			minImpressions: input.min_impressions,
+			threshold: input.threshold_pct / 100,
+			curve
+		});
+		return {
+			site_url: property.site_url,
+			start_date: window.startDate,
+			end_date: window.endDate,
+			data_state: window.dataState,
+			dimension: input.dimension,
+			benchmark: input.benchmark,
+			threshold_pct: input.threshold_pct,
+			min_impressions: input.min_impressions,
+			max_position: input.max_position,
+			curve: curve.slice(0, Math.max(10, Math.ceil(input.max_position))),
+			total_matches: matches.length,
+			rows: matches.slice(0, input.limit),
+			truncated
+		};
+	},
+	format(r) {
+		const host = displayHost(r.site_url);
+		const curve = r.curve.map((p) => `#${p.position}: ${fmtPct(p.ctr_pct)}${p.source === "industry" ? "*" : ""}`).join(" · ");
+		if (r.total_matches === 0) return sections(`No CTR opportunities for ${r.site_url}: no ${r.dimension} with ≥${r.min_impressions} impressions at position ≤${r.max_position} has a CTR below ${r.threshold_pct}% of the expected value.`, `_Benchmark curve: ${curve}_`);
+		return sections(`**${fmtInt(r.total_matches)} ${r.dimension === "query" ? "queries" : "pages"} with below-expected CTR** for ${r.site_url} (CTR < ${r.threshold_pct}% of the ${r.benchmark} benchmark for their position)`, windowNote({
+			startDate: r.start_date,
+			endDate: r.end_date,
+			dataState: r.data_state === "all" ? "all" : "final",
+			label: ""
+		}), mdTable([
+			r.dimension === "page" ? "Page" : "Query",
+			"Pos.",
+			"Impr.",
+			"Clicks",
+			"CTR",
+			"Expected",
+			"Missed clicks"
+		], r.rows.map((row) => [
+			r.dimension === "page" ? compactUrl(row.key, host) : row.key,
+			fmtPos(row.position),
+			fmtInt(row.impressions),
+			fmtInt(row.clicks),
+			fmtPct(row.ctr_pct),
+			fmtPct(row.expected_ctr_pct),
+			fmtInt(row.missed_clicks)
+		])), omittedNote(r.rows.length, r.total_matches, "Raise `limit` to see more."), `_Benchmark CTR by position (${r.benchmark}; * = industry fallback): ${curve}. Branded queries inflate CTR at top positions; use exclude_queries for a non-brand view._`, truncatedNote(r.truncated));
+	}
+});
+const keywordCannibalization = defineTool({
+	name: "keyword_cannibalization",
+	title: "Keyword cannibalization",
+	description: "Finds queries where two or more of the site's pages each get a meaningful share of impressions, so they compete with each other. Returns each page's impression share, clicks and position. URL #fragments are merged into their page.",
+	input: z.object({
+		site_url: siteUrlField,
+		...dateRangeFields,
+		min_impressions: z.number().int().min(0).default(50).describe("Minimum total impressions for the query."),
+		min_share_pct: z.number().min(1).max(50).default(10).describe("A page counts as competing if it has at least this share of the query’s impressions."),
+		exclude_queries: excludeQueriesField,
+		limit: limitField(20)
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const window = await resolveWindow(ctx, property, input);
+		const { rows, truncated } = await queryPageRows(ctx, property.site_url, window, input.exclude_queries);
+		const matches = findCannibalization(rows, {
+			minImpressions: input.min_impressions,
+			minSharePct: input.min_share_pct
+		});
+		return {
+			site_url: property.site_url,
+			start_date: window.startDate,
+			end_date: window.endDate,
+			data_state: window.dataState,
+			min_impressions: input.min_impressions,
+			min_share_pct: input.min_share_pct,
+			total_matches: matches.length,
+			rows: matches.slice(0, input.limit),
+			truncated
+		};
+	},
+	format(r) {
+		const host = displayHost(r.site_url);
+		if (r.total_matches === 0) return `No cannibalization found for ${r.site_url}: no query with ≥${r.min_impressions} impressions has 2+ pages each above ${r.min_share_pct}% share (${r.start_date} → ${r.end_date}).`;
+		const blocks = r.rows.map((q) => sections(`**"${q.query}"** — ${fmtInt(q.impressions)} impr., ${fmtInt(q.clicks)} clicks, ${q.competing_pages} competing pages`, mdTable([
+			"Page",
+			"Share",
+			"Impr.",
+			"Clicks",
+			"Pos."
+		], q.pages.map((p) => [
+			compactUrl(p.page, host),
+			fmtPct(p.share_pct),
+			fmtInt(p.impressions),
+			fmtInt(p.clicks),
+			fmtPos(p.position)
+		]))));
+		return sections(`**${fmtInt(r.total_matches)} cannibalized queries** for ${r.site_url} (sorted by impressions not going to the top page)`, windowNote({
+			startDate: r.start_date,
+			endDate: r.end_date,
+			dataState: r.data_state === "all" ? "all" : "final",
+			label: ""
+		}), ...blocks, omittedNote(r.rows.length, r.total_matches, "Raise `limit` to see more."), truncatedNote(r.truncated));
+	}
+});
+//#endregion
+//#region src/core/tools/page-report.ts
+/** Turns a path like '/pricing' into the page URL Search Console reports, using the page's own data. */
+async function resolvePageUrl(ctx, property, page, window) {
+	const direct = absolutePageUrl(property, page);
+	if (direct) return direct;
+	if (!page.startsWith("/")) throw new UserFacingError(`'${page}' is not a URL or a path starting with '/'.`);
+	const { rows } = await fetchRows(ctx, property.site_url, window, ["page"], {
+		filters: [{
+			dimension: "page",
+			operator: "contains",
+			expression: page
+		}],
+		maxRows: 1e3
+	});
+	const candidates = rows.map((r) => ({
+		url: r.keys?.[0] ?? "",
+		impressions: r.impressions
+	})).filter((c) => {
+		try {
+			return new URL(c.url).pathname === page;
+		} catch {
+			return false;
+		}
+	}).sort((a, b) => b.impressions - a.impressions);
+	if (!candidates[0]) throw new UserFacingError(`No page with path '${page}' has Search data on ${property.site_url} in this period. Pass the full URL (e.g. https://example.com${page}).`, "not_found");
+	return candidates[0].url;
+}
+const pageReport = defineTool({
+	name: "page_report",
+	title: "Page report",
+	description: "One-call report for a single page: clicks/impressions/CTR/position vs the previous period, a daily trend, the page's top queries with deltas, and its URL Inspection status (index state, canonical, last crawl).",
+	input: z.object({
+		page: z.string().min(1).describe("Full page URL, or a path like '/pricing' (then site_url is required)."),
+		site_url: z.string().optional().describe("Property. Optional when page is a full URL."),
+		...dateRangeFields,
+		compare_to: z.enum(COMPARE_MODES).default("previous_period"),
+		top_queries: limitField(15, 100),
+		include_inspection: z.boolean().default(true).describe("Also run URL Inspection (uses 1 of 2,000 daily inspections).")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		let property;
+		if (/^https?:\/\//i.test(input.page)) property = await propertyForUrl(ctx.gsc, input.page, input.site_url);
+		else if (input.site_url) property = await propertyFor(ctx, input.site_url);
+		else throw new UserFacingError("Pass site_url when page is a path.");
+		const current = await resolveWindow(ctx, property, input);
+		const previous = comparisonRange(current, input.compare_to);
+		const pageUrl = await resolvePageUrl(ctx, property, input.page, current);
+		const opts = {
+			filters: [{
+				dimension: "page",
+				operator: "equals",
+				expression: pageUrl
+			}],
+			dataState: current.dataState
+		};
+		const inspection = input.include_inspection ? inspectOne(ctx, pageUrl, property.site_url).then((value) => ({
+			value,
+			error: null
+		}), (error) => ({
+			value: null,
+			error: publicErrorMessage(error).message.split("\n")[0]
+		})) : Promise.resolve({
+			value: null,
+			error: null
+		});
+		const [curTotals, prevTotals, trendRows, curQueries, prevQueries, inspected] = await Promise.all([
+			fetchTotals(ctx, property.site_url, current, opts),
+			fetchTotals(ctx, property.site_url, previous, opts),
+			fetchRows(ctx, property.site_url, current, ["date"], opts),
+			fetchKeyed(ctx, property.site_url, current, "query", {
+				...opts,
+				maxRows: 5e3
+			}),
+			fetchKeyed(ctx, property.site_url, previous, "query", {
+				...opts,
+				maxRows: 5e3
+			}),
+			inspection
+		]);
+		const cur = toMetrics(curTotals);
+		const prev = toMetrics(prevTotals);
+		const queries = compareRows(curQueries.rows, prevQueries.rows);
+		return {
+			site_url: property.site_url,
+			page: pageUrl,
+			current: {
+				startDate: current.startDate,
+				endDate: current.endDate
+			},
+			previous,
+			compare_to: input.compare_to,
+			data_state: current.dataState,
+			totals: {
+				current: cur,
+				previous: prev,
+				change: metricChange(cur, prev)
+			},
+			trend: trendRows.rows.map((r) => ({
+				date: r.keys?.[0] ?? "",
+				...toMetrics(r)
+			})).sort((a, b) => a.date.localeCompare(b.date)),
+			top_queries: topByCurrentClicks(queries, input.top_queries),
+			query_count: curQueries.rows.size,
+			inspection: inspected.value,
+			inspection_error: inspected.error
+		};
+	},
+	format(r) {
+		const t = r.totals;
+		const weekly = summarizeTrend(r.trend);
+		return sections(`**Page report:** ${r.page}`, `_${r.current.startDate} → ${r.current.endDate} vs ${r.previous.startDate} → ${r.previous.endDate} (${r.compare_to === "year_over_year" ? "year over year" : "previous period"}, ${r.data_state} data)._`, mdTable([
+			"Metric",
+			"Current",
+			"Previous",
+			"Change"
+		], [
+			[
+				"Clicks",
+				fmtInt(t.current.clicks),
+				fmtInt(t.previous.clicks),
+				fmtChange(t.current.clicks, t.previous.clicks)
+			],
+			[
+				"Impressions",
+				fmtInt(t.current.impressions),
+				fmtInt(t.previous.impressions),
+				fmtChange(t.current.impressions, t.previous.impressions)
+			],
+			[
+				"CTR",
+				fmtPct(t.current.ctr_pct),
+				fmtPct(t.previous.ctr_pct),
+				`${t.change.ctr_pp >= 0 ? "+" : ""}${t.change.ctr_pp.toFixed(2)} pp`
+			],
+			[
+				"Avg position",
+				fmtPos(t.current.position),
+				fmtPos(t.previous.position),
+				positionChange(t.change.rank_improvement)
+			]
+		]), weekly ? `**Trend (clicks per 7 days, oldest → newest):** ${weekly}` : null, r.top_queries.length ? sections(`**Top queries** (${fmtInt(r.query_count)} total)`, mdTable([
+			"Query",
+			"Clicks",
+			"Δ clicks",
+			"Impr.",
+			"CTR",
+			"Pos.",
+			"Δ pos."
+		], r.top_queries.map((q) => [
+			q.key,
+			fmtInt(q.current.clicks),
+			fmtChange(q.current.clicks, q.previous.clicks),
+			fmtInt(q.current.impressions),
+			fmtPct(q.current.ctr_pct),
+			fmtPos(q.current.position),
+			positionChange(q.change.rank_improvement)
+		]))) : "_No query data for this page in the period._", r.inspection ? formatInspection(r.inspection) : r.inspection_error ? `_URL Inspection failed: ${r.inspection_error}_` : null);
+	}
+});
+function summarizeTrend(trend) {
+	if (trend.length < 7) return trend.length ? trend.map((d) => fmtInt(d.clicks)).join(" → ") : null;
+	const buckets = [];
+	for (let end = trend.length; end > 0; end -= 7) {
+		const slice = trend.slice(Math.max(0, end - 7), end);
+		if (slice.length === 7) buckets.unshift(slice.reduce((s, d) => s + d.clicks, 0));
+	}
+	return buckets.map(fmtInt).join(" → ");
+}
+//#endregion
+//#region src/core/tools/search-analytics.ts
+const SORT_KEYS = [
+	"clicks",
+	"impressions",
+	"ctr",
+	"position"
+];
+const searchAnalytics = defineTool({
+	name: "search_analytics",
+	title: "Search performance (raw query)",
+	description: "Queries Search Console performance data (clicks, impressions, CTR, average position) grouped by any dimensions, with filters (equals, contains, regex…), search type and aggregation type. Auto-paginates up to row_limit. Use for custom breakdowns; prefer the analysis tools (compare_periods, striking_distance_keywords, …) for common questions. Note: the API exposes only top rows (max ~50K/day/search type), and anonymized rare queries are omitted from query rows but included in totals.",
+	input: z.object({
+		site_url: siteUrlField,
+		...dateRangeFields,
+		dimensions: z.array(z.enum(DIMENSIONS)).max(5).default(["query"]).describe("Group by. searchAppearance cannot be combined with other dimensions. hour requires recent dates (last ~10 days) and switches to hourly data. Use [] for property totals."),
+		filters: filtersField,
+		search_type: searchTypeField,
+		aggregation_type: z.enum(AGGREGATION_TYPES).default("auto").describe("auto (default), byPage, byProperty (not with page dimension/filter), byNewsShowcasePanel."),
+		row_limit: z.number().int().min(1).max(5e5).default(1e3).describe("Rows to fetch from Google (auto-paginated in 25K pages; capped by the server’s GSCLAW_MAX_ROWS)."),
+		order_by: z.enum(SORT_KEYS).default("clicks").describe("Sort shown rows by this metric (position sorts ascending)."),
+		limit: limitField(25),
+		include_totals: z.boolean().default(true).describe("Also fetch property totals for the same filters (one extra request).")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		if (input.dimensions.includes("searchAppearance") && input.dimensions.length > 1) throw new UserFacingError("searchAppearance cannot be combined with other dimensions. Query searchAppearance alone first, then filter on one appearance and group by other dimensions.");
+		const property = await propertyFor(ctx, input.site_url);
+		const window = await resolveWindow(ctx, property, input, input.search_type);
+		const hourly = input.dimensions.includes("hour");
+		const base = {
+			startDate: window.startDate,
+			endDate: window.endDate,
+			type: input.search_type,
+			dimensionFilterGroups: toFilterGroups(input.filters),
+			aggregationType: input.aggregation_type,
+			dataState: hourly ? "hourly_all" : window.dataState
+		};
+		const maxRows = Math.min(input.row_limit, ctx.config.maxRows);
+		const [result, totalsRes] = await Promise.all([input.dimensions.length > 0 ? ctx.gsc.searchAnalyticsAll(property.site_url, {
+			...base,
+			dimensions: input.dimensions
+		}, maxRows) : Promise.resolve(null), input.include_totals || input.dimensions.length === 0 ? ctx.gsc.searchAnalytics(property.site_url, {
+			...base,
+			rowLimit: 1
+		}) : Promise.resolve(null)]);
+		const rows = (result?.rows ?? []).map((r) => ({
+			keys: Object.fromEntries(input.dimensions.map((d, i) => [d, r.keys?.[i] ?? ""])),
+			...toMetrics(r)
+		}));
+		sortRows(rows, input.order_by);
+		const totalRow = totalsRes?.rows?.[0];
+		const meta = result?.metadata ?? totalsRes?.metadata;
+		return {
+			site_url: property.site_url,
+			start_date: window.startDate,
+			end_date: window.endDate,
+			data_state: base.dataState ?? "final",
+			search_type: input.search_type,
+			dimensions: input.dimensions,
+			totals: totalRow ? toMetrics(totalRow) : totalsRes ? toMetrics({
+				clicks: 0,
+				impressions: 0
+			}) : null,
+			rows: rows.slice(0, input.limit),
+			total_rows: rows.length,
+			truncated: result?.truncated ?? false,
+			first_incomplete_date: meta?.first_incomplete_date ?? meta?.firstIncompleteDate
+		};
+	},
+	format(r) {
+		const host = displayHost(r.site_url);
+		const totals = r.totals ? `**Totals:** ${fmtInt(r.totals.clicks)} clicks · ${fmtInt(r.totals.impressions)} impressions · CTR ${fmtPct(r.totals.ctr_pct)} · avg position ${fmtPos(r.totals.position)}` : null;
+		const table = r.dimensions.length > 0 ? mdTable([
+			...r.dimensions,
+			"Clicks",
+			"Impr.",
+			"CTR",
+			"Pos."
+		], r.rows.map((row) => [
+			...r.dimensions.map((d) => d === "page" ? compactUrl(row.keys[d] ?? "", host) : row.keys[d]),
+			fmtInt(row.clicks),
+			fmtInt(row.impressions),
+			fmtPct(row.ctr_pct),
+			fmtPos(row.position)
+		])) : null;
+		return sections(`**Search analytics** for ${r.site_url} (${r.search_type}${r.dimensions.length ? `, by ${r.dimensions.join(" × ")}` : ""})`, windowNote({
+			startDate: r.start_date,
+			endDate: r.end_date,
+			dataState: r.data_state === "final" ? "final" : "all",
+			label: ""
+		}), totals, table, omittedNote(r.rows.length, r.total_rows, "Raise `limit` to see more, or add filters."), r.truncated ? `_Row cap reached (${fmtInt(r.total_rows)} rows fetched); more rows may exist. Raise row_limit or narrow filters/dates._` : null, r.first_incomplete_date ? `_Data from ${r.first_incomplete_date} onward is incomplete._` : null);
+	}
+});
+function sortRows(rows, key) {
+	const value = (r) => key === "ctr" ? r.ctr_pct : key === "position" ? -(r.position ?? Infinity) : r[key];
+	rows.sort((a, b) => value(b) - value(a));
+}
+//#endregion
+//#region src/core/tools/sites.ts
+const listSites = defineTool({
+	name: "list_sites",
+	title: "List Search Console properties",
+	description: "Lists every Search Console property this server can access, with its type (domain 'sc-domain:' vs URL-prefix) and permission level. Call this first to find the exact property to pass as site_url.",
+	input: z.object({}),
+	annotations: READ_ONLY,
+	async run(ctx) {
+		return {
+			identity: ctx.gsc.identity.email,
+			properties: await listProperties(ctx.gsc)
+		};
+	},
+	format(result) {
+		if (result.properties.length === 0) return `No Search Console properties are visible to ${result.identity}. Add it as a user on your properties: Search Console → Settings → Users and permissions → Add user.`;
+		const table = mdTable([
+			"Property",
+			"Type",
+			"Permission"
+		], result.properties.map((p) => [
+			p.site_url,
+			p.type === "domain" ? "domain" : "URL prefix",
+			p.has_access ? p.permission_level : "unverified (no data)"
+		]));
+		return sections(`**${result.properties.length} properties** visible to ${result.identity}:`, table);
+	}
+});
+//#endregion
+//#region src/core/tools/sitemaps.ts
+const num = (v) => v === void 0 ? 0 : Number(v) || 0;
+function summarizeSitemap(s) {
+	const contents = (s.contents ?? []).map((c) => ({
+		type: c.type ?? "web",
+		submitted: num(c.submitted)
+	}));
+	return {
+		path: s.path,
+		type: s.type ?? null,
+		is_index: Boolean(s.isSitemapsIndex),
+		is_pending: Boolean(s.isPending),
+		last_submitted: s.lastSubmitted ?? null,
+		last_downloaded: s.lastDownloaded ?? null,
+		errors: num(s.errors),
+		warnings: num(s.warnings),
+		submitted: contents.reduce((sum, c) => sum + c.submitted, 0),
+		contents
+	};
+}
+const INDEXED_NOTE = "_Google no longer reports per-sitemap indexed counts (the API field is deprecated). Use inspect_url / batch_inspect_urls to check index status of specific URLs._";
+function sitemapTable(sitemaps) {
+	return mdTable([
+		"Sitemap",
+		"Type",
+		"Submitted URLs",
+		"Errors",
+		"Warnings",
+		"Last read",
+		"Status"
+	], sitemaps.map((s) => [
+		s.path,
+		s.is_index ? "index" : s.type ?? "—",
+		fmtInt(s.submitted),
+		s.errors,
+		s.warnings,
+		s.last_downloaded?.slice(0, 10) ?? "never",
+		s.is_pending ? "pending" : s.errors > 0 ? "has errors" : "ok"
+	]));
+}
+const listSitemaps = defineTool({
+	name: "list_sitemaps",
+	title: "List sitemaps",
+	description: "Lists sitemaps submitted for a property with status, errors, warnings, submitted URL counts and when Google last read them. Pass sitemap_index to list the children of a sitemap index.",
+	input: z.object({
+		site_url: siteUrlField,
+		sitemap_index: z.string().url().optional().describe("Full URL of a sitemap index to list its child sitemaps.")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		const sitemaps = await ctx.gsc.listSitemaps(property.site_url, input.sitemap_index);
+		return {
+			site_url: property.site_url,
+			sitemaps: sitemaps.map(summarizeSitemap)
+		};
+	},
+	format(r) {
+		if (r.sitemaps.length === 0) return `No sitemaps are submitted for ${r.site_url}. Submit one in Search Console → Sitemaps (or with submit_sitemap if writes are enabled).`;
+		const withErrors = r.sitemaps.filter((s) => s.errors > 0).length;
+		return sections(`**${r.sitemaps.length} sitemap(s)** for ${r.site_url}${withErrors ? ` — ${withErrors} with errors` : ""}:`, sitemapTable(r.sitemaps), INDEXED_NOTE);
+	}
+});
+const getSitemap = defineTool({
+	name: "get_sitemap",
+	title: "Get sitemap details",
+	description: "Shows one sitemap: status, errors, warnings, submitted URL counts per content type and last download time.",
+	input: z.object({
+		site_url: siteUrlField,
+		sitemap_url: z.string().url().describe("Full sitemap URL exactly as submitted (see list_sitemaps).")
+	}),
+	annotations: READ_ONLY,
+	async run(ctx, input) {
+		const property = await propertyFor(ctx, input.site_url);
+		return {
+			site_url: property.site_url,
+			sitemap: summarizeSitemap(await ctx.gsc.getSitemap(property.site_url, input.sitemap_url))
+		};
+	},
+	format(r) {
+		const s = r.sitemap;
+		const contents = s.contents.map((c) => `${c.type}: ${fmtInt(c.submitted)}`).join(" · ");
+		return sections(`**Sitemap** ${s.path}`, [
+			`- Type: ${s.is_index ? "sitemap index" : s.type ?? "unknown"}${s.is_pending ? " (processing pending)" : ""}`,
+			`- Submitted URLs: ${fmtInt(s.submitted)}${contents ? ` (${contents})` : ""}`,
+			`- Errors: ${s.errors} · Warnings: ${s.warnings}`,
+			`- Last submitted: ${s.last_submitted ?? "unknown"} · Last read by Google: ${s.last_downloaded ?? "never"}`
+		].join("\n"), INDEXED_NOTE);
+	}
+});
+const WRITE_NOTE = "Requires GSCLAW_ALLOW_WRITES=true and Full (not Restricted) permission on the property.";
+//#endregion
+//#region src/core/tools/registry.ts
+/** Every tool, in the order clients list them. */
+const ALL_TOOLS = [
+	listSites,
+	searchAnalytics,
+	comparePeriods,
+	strikingDistanceKeywords,
+	ctrOpportunities,
+	keywordCannibalization,
+	contentDecay,
+	pageReport,
+	inspectUrl,
+	batchInspectUrls,
+	listSitemaps,
+	getSitemap,
+	defineTool({
+		name: "submit_sitemap",
+		title: "Submit sitemap (writes to Search Console)",
+		description: `MUTATES STATE: submits (or resubmits) a sitemap URL to Search Console for the property, asking Google to crawl it. ${WRITE_NOTE}`,
+		input: z.object({
+			site_url: siteUrlField,
+			sitemap_url: z.string().url().describe("Full sitemap URL to submit. Must be on the property.")
+		}),
+		annotations: {
+			readOnlyHint: false,
+			destructiveHint: false,
+			idempotentHint: true,
+			openWorldHint: false
+		},
+		write: true,
+		async run(ctx, input) {
+			const property = await propertyFor(ctx, input.site_url);
+			if (property.permission_level === "restricted") throw new UserFacingError(`Restricted users cannot submit sitemaps. Give ${ctx.gsc.identity.email} Full permission on '${property.site_url}' in Search Console → Settings → Users and permissions.`, "permission");
+			await ctx.gsc.submitSitemap(property.site_url, input.sitemap_url);
+			return {
+				site_url: property.site_url,
+				sitemap_url: input.sitemap_url,
+				submitted: true
+			};
+		},
+		format(r) {
+			return `Submitted ${r.sitemap_url} for ${r.site_url}. Google will fetch it shortly; check status later with get_sitemap.`;
+		}
+	}),
+	defineTool({
+		name: "delete_sitemap",
+		title: "Delete sitemap (writes to Search Console)",
+		description: `MUTATES STATE (destructive): removes a submitted sitemap from Search Console for the property. This does not delete the file from your site. ${WRITE_NOTE}`,
+		input: z.object({
+			site_url: siteUrlField,
+			sitemap_url: z.string().url().describe("Full sitemap URL to remove, exactly as listed by list_sitemaps.")
+		}),
+		annotations: {
+			readOnlyHint: false,
+			destructiveHint: true,
+			idempotentHint: true,
+			openWorldHint: false
+		},
+		write: true,
+		async run(ctx, input) {
+			const property = await propertyFor(ctx, input.site_url);
+			await ctx.gsc.deleteSitemap(property.site_url, input.sitemap_url);
+			return {
+				site_url: property.site_url,
+				sitemap_url: input.sitemap_url,
+				deleted: true
+			};
+		},
+		format(r) {
+			return `Removed ${r.sitemap_url} from Search Console for ${r.site_url}. The file on your site is unchanged.`;
+		}
+	})
+];
+/** Tools available for a request: write tools only when enabled and the credentials can write. */
+function availableTools(opts) {
+	return ALL_TOOLS.filter((tool) => !tool.write || opts.allowWrites && opts.canWrite);
+}
+//#endregion
+//#region src/core/runtime.ts
+function createRuntime(config, opts = {}) {
+	const logger = createLogger({
+		level: config.logLevel,
+		write: opts.logWriter,
+		base: opts.logFields
+	});
+	const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+	const cache = createResponseCache();
+	const userTokens = /* @__PURE__ */ new Map();
+	const sessionWith = (gsc, principal) => {
+		const canWrite = gsc.canWrite && (!principal || principal.scopes.includes("gsc:write"));
+		return {
+			gsc,
+			ctx: {
+				gsc,
+				config,
+				logger,
+				now
+			},
+			tools: availableTools({
+				allowWrites: config.allowWrites,
+				canWrite
+			})
+		};
+	};
+	let owner;
+	if (config.authMode === "service_account") {
+		if (!config.serviceAccount) throw new Error("Service-account mode requires a service account key.");
+		const scopes = [config.allowWrites ? SCOPE_READWRITE : SCOPE_READONLY];
+		owner = sessionWith(new GscClient({
+			tokenSource: new ServiceAccountTokenSource(config.serviceAccount, scopes, { fetch: opts.fetch }),
+			logger,
+			fetch: opts.fetch,
+			cache,
+			cacheTtlMs: config.cacheTtlSeconds * 1e3
+		}));
+	}
+	return {
+		config,
+		logger,
+		activity: new ActivityLog(),
+		owner,
+		sessionFor(principal) {
+			if (config.authMode === "service_account") return sessionWith(owner.gsc, principal);
+			const google = principal.google;
+			const oauth = config.googleOAuth;
+			if (principal.kind !== "user" || !google || !principal.email || !oauth) throw new Error("OAuth mode requires a signed-in Google user.");
+			const tokenSource = new UserTokenSource(principal.email, google.scope, {
+				sub: principal.sub,
+				accessToken: google.accessToken,
+				expiresAt: google.expiresAt,
+				refreshToken: google.refreshToken,
+				cache: userTokens,
+				now: () => now().getTime(),
+				refresh: async (refreshToken) => {
+					const fresh = await refreshGoogleToken(oauth, {
+						refreshToken,
+						fetch: opts.fetch ?? ((input, init) => fetch(input, init)),
+						nowSeconds: Math.floor(now().getTime() / 1e3)
+					});
+					return {
+						accessToken: fresh.accessToken,
+						expiresAt: fresh.expiresAt
+					};
+				}
+			});
+			return sessionWith(new GscClient({
+				tokenSource,
+				logger,
+				fetch: opts.fetch,
+				cache,
+				cacheTtlMs: config.cacheTtlSeconds * 1e3
+			}), principal);
+		}
+	};
+}
+//#endregion
+//#region src/core/app.ts
+const MAX_BODY_BYTES = 1e6;
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+const MCP_CORS_HEADERS = {
+	"access-control-allow-methods": "POST, GET, DELETE, OPTIONS",
+	"access-control-allow-headers": "authorization, content-type, accept, mcp-protocol-version, mcp-method, mcp-name, mcp-session-id, last-event-id",
+	"access-control-expose-headers": "www-authenticate, mcp-protocol-version, mcp-session-id",
+	"access-control-max-age": "600"
+};
+function json(body, status = 200, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store",
+			...headers
+		}
+	});
+}
+function html(body, status = 200) {
+	return new Response(body, {
+		status,
+		headers: HTML_SECURITY_HEADERS
+	});
+}
+/** Malformed percent-encoding must look like any other wrong secret (404), not a 500. */
+function safeDecode(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
+}
+/** Deployments are private endpoints; ask crawlers not to index them. */
+const robots = () => new Response("User-agent: *\nDisallow: /\n", { headers: {
+	"content-type": "text/plain; charset=utf-8",
+	"cache-control": "public, max-age=86400"
+} });
+const notFound = () => new Response("Not found", {
+	status: 404,
+	headers: { "content-type": "text/plain" }
+});
+function hostnameOf(hostHeader) {
+	if (!hostHeader) return null;
+	try {
+		return new URL(`http://${hostHeader}`).hostname;
+	} catch {
+		return null;
+	}
+}
+/** Builds the web-standard request handler shared by every adapter. */
+function createApp(env, platform) {
+	const loaded = loadConfig(env, { transport: "http" });
+	if (!loaded.ok) {
+		createLogger({
+			write: platform.logWriter,
+			base: { platform: platform.name }
+		}).error("configuration invalid; serving setup page only", { issues: loaded.errors.map((e) => `${e.variable ?? ""} ${e.message}`.trim()) });
+		return {
+			setupErrors: loaded.errors,
+			warnings: [],
+			runtime: null,
+			async fetch(request) {
+				const path = new URL(request.url).pathname;
+				if (path === "/healthz") return json({
+					status: "setup_required",
+					version: VERSION
+				}, 503);
+				if (path === "/robots.txt") return robots();
+				if (path === "/" && (request.method === "GET" || request.method === "HEAD")) return html(setupPage(loaded.errors), 503);
+				return json({
+					error: "setup_required",
+					error_description: "This GSClaw deployment is not configured."
+				}, 503);
+			}
+		};
+	}
+	const { config } = loaded;
+	const runtime = createRuntime(config, {
+		fetch: platform.fetch,
+		logWriter: platform.logWriter,
+		now: platform.now,
+		logFields: { platform: platform.name }
+	});
+	const { logger } = runtime;
+	for (const warning of loaded.warnings) logger.warn(warning);
+	const now = platform.now ?? (() => /* @__PURE__ */ new Date());
+	const oauth = createOAuthServer({
+		config,
+		sealer: createSealer(config.sealingSecret, () => now().getTime()),
+		logger,
+		fetch: platform.fetch ?? ((input, init) => fetch(input, init)),
+		now
+	});
+	const limiter = new RateLimiter(config.rateLimitPerMinute);
+	const publicOrigin = config.publicBaseUrl ? new URL(config.publicBaseUrl).origin : null;
+	/**
+	* Public base URL for OAuth metadata and token audiences: PUBLIC_BASE_URL (or the platform's
+	* detected URL), else the forwarded or request origin.
+	*/
+	const baseUrl = (request, url) => {
+		if (config.publicBaseUrl) return config.publicBaseUrl;
+		const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+		const host = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+		if (proto && host && /^https?$/.test(proto)) return `${proto}://${host}`;
+		return url.origin;
+	};
+	const dashboardApi = config.dashboard ? createDashboardApi({
+		config,
+		runtime,
+		oauth,
+		logger,
+		platform: platform.name,
+		fetch: platform.fetch,
+		now: platform.now,
+		baseUrl
+	}) : null;
+	const mcp = createMcpHandler(({ authInfo }) => {
+		const principal = authInfo?.extra?.principal;
+		const session = runtime.sessionFor(principal);
+		return buildMcpServer({
+			tools: session.tools,
+			ctx: session.ctx,
+			logger,
+			activity: runtime.activity,
+			client: typeof authInfo?.extra?.client === "string" ? authInfo.extra.client : "unknown",
+			user: principal.kind === "user" ? principal.email : void 0
+		});
+	}, {
+		legacy: "stateless",
+		responseMode: "auto",
+		onerror: (error) => logger.debug("mcp transport error", { error })
+	});
+	const originAllowed = (origin, requestUrl) => {
+		if (origin === requestUrl.origin || origin === publicOrigin) return true;
+		if (config.allowedOrigins.includes(origin)) return true;
+		if (platform.localOnly) {
+			const host = hostnameOf(origin.replace(/^https?:\/\//, ""));
+			return host !== null && LOOPBACK_HOSTS.has(host);
+		}
+		return false;
+	};
+	const corsHeaders = (origin) => origin ? {
+		"access-control-allow-origin": origin,
+		vary: "Origin",
+		...MCP_CORS_HEADERS
+	} : {};
+	/**
+	* Resolves the caller of /mcp. Service-account mode: the static access token, the secret path, or
+	* a GSClaw-issued OAuth token (owner sign-in). OAuth mode: a GSClaw-issued token for a Google user.
+	*/
+	async function authenticate(request, path, base) {
+		if (path !== "/mcp") {
+			const secret = path.slice(5);
+			if (config.authMode !== "service_account" || !config.secretPath || secret.includes("/") || !await timingSafeEqual(safeDecode(secret), config.accessToken)) return notFound();
+			return {
+				...OWNER,
+				via: "secret_path"
+			};
+		}
+		const header = request.headers.get("authorization") ?? "";
+		const token = /^Bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
+		if (token) {
+			if (config.authMode === "service_account" && await timingSafeEqual(token, config.accessToken)) return OWNER;
+			const principal = await oauth.verifyAccessToken(token, base);
+			if (principal) return principal;
+		}
+		return json({
+			error: "invalid_token",
+			error_description: `Missing or invalid credentials. ${config.authMode === "oauth" ? "Sign in with OAuth (your MCP client does this automatically)." : "Send 'Authorization: Bearer <GSCLAW_ACCESS_TOKEN>' or sign in with OAuth."}`
+		}, 401, { "www-authenticate": oauth.challenge(base, token ? "invalid_token" : void 0) });
+	}
+	async function handleMcp(request, url, path, log) {
+		const origin = request.headers.get("origin");
+		if (origin && !originAllowed(origin, url)) {
+			log.warn("rejected request from disallowed origin", { origin });
+			return json({
+				error: "forbidden",
+				error_description: "Origin not allowed. Add it to GSCLAW_ALLOWED_ORIGINS."
+			}, 403);
+		}
+		if (platform.localOnly) {
+			const host = hostnameOf(request.headers.get("host"));
+			if (!host || !LOOPBACK_HOSTS.has(host)) return json({
+				error: "forbidden",
+				error_description: "Invalid Host header."
+			}, 403);
+		}
+		if (request.method === "OPTIONS") return new Response(null, {
+			status: 204,
+			headers: corsHeaders(origin)
+		});
+		const principal = await authenticate(request, path, baseUrl(request, url));
+		if (principal instanceof Response) {
+			for (const [k, v] of Object.entries(corsHeaders(origin))) principal.headers.set(k, v);
+			return principal;
+		}
+		const limit = limiter.check(principal.sub);
+		if (!limit.ok) return json({
+			error: "rate_limited",
+			error_description: "Too many requests. Slow down and retry."
+		}, 429, {
+			"retry-after": String(limit.retryAfterSeconds),
+			...corsHeaders(origin)
+		});
+		if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) return json({ error: "payload_too_large" }, 413);
+		const body = request.method === "POST" ? await request.text() : void 0;
+		if (body && body.length > MAX_BODY_BYTES) return json({ error: "payload_too_large" }, 413);
+		const headers = new Headers(request.headers);
+		headers.delete("authorization");
+		headers.delete("cookie");
+		const clean = new Request(new URL("/mcp", url), {
+			method: request.method,
+			headers,
+			body
+		});
+		const response = await mcp.fetch(clean, { authInfo: {
+			token: "redacted",
+			clientId: principal.clientId ?? principal.sub,
+			scopes: principal.scopes,
+			extra: {
+				principal,
+				client: principal.clientName ?? clientLabel(request.headers.get("user-agent"))
+			}
+		} });
+		const out = new Response(response.body, response);
+		out.headers.set("cache-control", "no-store");
+		for (const [k, v] of Object.entries(corsHeaders(origin))) out.headers.set(k, v);
+		return out;
+	}
+	async function route(request, log) {
+		const url = new URL(request.url);
+		const path = url.pathname.length > 1 ? url.pathname.replace(/\/+$/, "") : url.pathname;
+		if (path === "/healthz") return json({
+			status: "ok",
+			version: VERSION
+		});
+		if (path === "/robots.txt") return robots();
+		if (path === "/mcp" || path.startsWith("/mcp/")) return handleMcp(request, url, path, log);
+		const oauthResponse = await oauth.handle(request, url, path, baseUrl(request, url));
+		if (oauthResponse) return oauthResponse;
+		const isRead = request.method === "GET" || request.method === "HEAD";
+		if (path === "/" && isRead) return dashboardApi ? new Response(dashboardShell(), { headers: DASHBOARD_HEADERS }) : html(runningPage());
+		if (path === "/api" || path.startsWith("/api/")) return dashboardApi ? dashboardApi.handle(request, url, path) : notFound();
+		if (isRead && platform.serveStatic) {
+			const file = await platform.serveStatic(request);
+			if (file) return file;
+		}
+		return notFound();
+	}
+	return {
+		setupErrors: [],
+		warnings: loaded.warnings,
+		runtime,
+		async fetch(request) {
+			const started = Date.now();
+			const url = new URL(request.url);
+			const logPath = url.pathname.startsWith("/mcp/") ? "/mcp/<secret>" : url.pathname;
+			const log = logger.child({
+				method: request.method,
+				path: logPath
+			});
+			let response;
+			try {
+				response = await route(request, log);
+			} catch (error) {
+				log.error("unhandled error", { error });
+				response = json({ error: "internal_error" }, 500);
+			}
+			if (logPath !== "/healthz") log.info("request", {
+				status: response.status,
+				ms: Date.now() - started
+			});
+			return response;
+		}
+	};
+}
+//#endregion
+export { VERSION as a, stderrWriter as c, REPO_URL as i, randomToken as l, createRuntime as n, formatConfigErrors as o, buildMcpServer as r, loadConfig as s, createApp as t };
+
+//# sourceMappingURL=app-DdGjQNXR.js.map