@ainyc/canonry 1.0.0

package/dist/chunk-ONZDY6Q4.js

@@ -0,0 +1,3706 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/config.ts
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { parse, stringify } from "yaml";
+function getConfigDir() {
+  return path.join(os.homedir(), ".canonry");
+}
+function getConfigPath() {
+  return path.join(getConfigDir(), "config.yaml");
+}
+function loadConfig() {
+  const configPath = getConfigPath();
+  if (!fs.existsSync(configPath)) {
+    throw new Error(
+      `Config not found at ${configPath}. Run "canonry init" to create one.`
+    );
+  }
+  const raw = fs.readFileSync(configPath, "utf-8");
+  const parsed = parse(raw);
+  if (!parsed.apiUrl || !parsed.database || !parsed.apiKey) {
+    throw new Error(
+      `Invalid config at ${configPath}. Required fields: apiUrl, database, apiKey`
+    );
+  }
+  if (parsed.geminiApiKey && !parsed.providers?.gemini) {
+    parsed.providers = {
+      ...parsed.providers,
+      gemini: {
+        apiKey: parsed.geminiApiKey,
+        model: parsed.geminiModel,
+        quota: parsed.geminiQuota
+      }
+    };
+  }
+  const hasProvider = parsed.providers && (parsed.providers.gemini?.apiKey || parsed.providers.openai?.apiKey || parsed.providers.claude?.apiKey || parsed.providers.local?.baseUrl);
+  if (!hasProvider) {
+    throw new Error(
+      `No providers configured at ${configPath}. At least one provider is required.`
+    );
+  }
+  return parsed;
+}
+function saveConfig(config) {
+  const configDir = getConfigDir();
+  if (!fs.existsSync(configDir)) {
+    fs.mkdirSync(configDir, { recursive: true });
+  }
+  const yaml = stringify(config);
+  fs.writeFileSync(getConfigPath(), yaml, { encoding: "utf-8", mode: 384 });
+}
+function configExists() {
+  return fs.existsSync(getConfigPath());
+}
+
+// src/server.ts
+import fs2 from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
+import Fastify from "fastify";
+
+// ../api-routes/src/auth.ts
+import crypto from "crypto";
+import { eq } from "drizzle-orm";
+
+// ../db/src/client.ts
+import { mkdirSync } from "fs";
+import { dirname } from "path";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+
+// ../db/src/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  apiKeys: () => apiKeys,
+  auditLog: () => auditLog,
+  competitors: () => competitors,
+  keywords: () => keywords,
+  notifications: () => notifications,
+  projects: () => projects,
+  querySnapshots: () => querySnapshots,
+  runs: () => runs,
+  schedules: () => schedules,
+  usageCounters: () => usageCounters
+});
+import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+var projects = sqliteTable("projects", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull().unique(),
+  displayName: text("display_name").notNull(),
+  canonicalDomain: text("canonical_domain").notNull(),
+  country: text("country").notNull(),
+  language: text("language").notNull(),
+  tags: text("tags").notNull().default("[]"),
+  labels: text("labels").notNull().default("{}"),
+  providers: text("providers").notNull().default("[]"),
+  configSource: text("config_source").notNull().default("cli"),
+  configRevision: integer("config_revision").notNull().default(1),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+});
+var keywords = sqliteTable("keywords", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  keyword: text("keyword").notNull(),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_keywords_project").on(table.projectId),
+  uniqueIndex("idx_keywords_project_keyword").on(table.projectId, table.keyword)
+]);
+var competitors = sqliteTable("competitors", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  domain: text("domain").notNull(),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_competitors_project").on(table.projectId),
+  uniqueIndex("idx_competitors_project_domain").on(table.projectId, table.domain)
+]);
+var runs = sqliteTable("runs", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  kind: text("kind").notNull().default("answer-visibility"),
+  status: text("status").notNull().default("queued"),
+  trigger: text("trigger").notNull().default("manual"),
+  startedAt: text("started_at"),
+  finishedAt: text("finished_at"),
+  error: text("error"),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_runs_project").on(table.projectId),
+  index("idx_runs_status").on(table.status)
+]);
+var querySnapshots = sqliteTable("query_snapshots", {
+  id: text("id").primaryKey(),
+  runId: text("run_id").notNull().references(() => runs.id, { onDelete: "cascade" }),
+  keywordId: text("keyword_id").notNull().references(() => keywords.id, { onDelete: "cascade" }),
+  provider: text("provider").notNull().default("gemini"),
+  citationState: text("citation_state").notNull(),
+  answerText: text("answer_text"),
+  citedDomains: text("cited_domains").notNull().default("[]"),
+  competitorOverlap: text("competitor_overlap").notNull().default("[]"),
+  rawResponse: text("raw_response"),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_snapshots_run").on(table.runId),
+  index("idx_snapshots_keyword").on(table.keywordId)
+]);
+var auditLog = sqliteTable("audit_log", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").references(() => projects.id, { onDelete: "cascade" }),
+  actor: text("actor").notNull(),
+  action: text("action").notNull(),
+  entityType: text("entity_type").notNull(),
+  entityId: text("entity_id"),
+  diff: text("diff"),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_audit_log_project").on(table.projectId),
+  index("idx_audit_log_created").on(table.createdAt)
+]);
+var apiKeys = sqliteTable("api_keys", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  keyHash: text("key_hash").notNull().unique(),
+  keyPrefix: text("key_prefix").notNull(),
+  scopes: text("scopes").notNull().default('["*"]'),
+  createdAt: text("created_at").notNull(),
+  lastUsedAt: text("last_used_at"),
+  revokedAt: text("revoked_at")
+}, (table) => [
+  index("idx_api_keys_prefix").on(table.keyPrefix)
+]);
+var schedules = sqliteTable("schedules", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  cronExpr: text("cron_expr").notNull(),
+  preset: text("preset"),
+  timezone: text("timezone").notNull().default("UTC"),
+  enabled: integer("enabled").notNull().default(1),
+  providers: text("providers").notNull().default("[]"),
+  lastRunAt: text("last_run_at"),
+  nextRunAt: text("next_run_at"),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_schedules_project").on(table.projectId)
+]);
+var notifications = sqliteTable("notifications", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  channel: text("channel").notNull(),
+  config: text("config").notNull(),
+  webhookSecret: text("webhook_secret"),
+  enabled: integer("enabled").notNull().default(1),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  index("idx_notifications_project").on(table.projectId)
+]);
+var usageCounters = sqliteTable("usage_counters", {
+  id: text("id").primaryKey(),
+  scope: text("scope").notNull(),
+  period: text("period").notNull(),
+  metric: text("metric").notNull(),
+  count: integer("count").notNull().default(0),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_usage_scope_period_metric").on(table.scope, table.period, table.metric),
+  index("idx_usage_scope_period").on(table.scope, table.period)
+]);
+
+// ../db/src/client.ts
+function createClient(databasePath) {
+  mkdirSync(dirname(databasePath), { recursive: true });
+  const sqlite = new Database(databasePath);
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.pragma("foreign_keys = ON");
+  return drizzle(sqlite, { schema: schema_exports });
+}
+
+// ../db/src/migrate.ts
+import { sql } from "drizzle-orm";
+var MIGRATION_SQL = `
+CREATE TABLE IF NOT EXISTS projects (
+  id                TEXT PRIMARY KEY,
+  name              TEXT NOT NULL UNIQUE,
+  display_name      TEXT NOT NULL,
+  canonical_domain  TEXT NOT NULL,
+  country           TEXT NOT NULL,
+  language          TEXT NOT NULL,
+  tags              TEXT NOT NULL DEFAULT '[]',
+  labels            TEXT NOT NULL DEFAULT '{}',
+  providers         TEXT NOT NULL DEFAULT '[]',
+  config_source     TEXT NOT NULL DEFAULT 'cli',
+  config_revision   INTEGER NOT NULL DEFAULT 1,
+  created_at        TEXT NOT NULL,
+  updated_at        TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS keywords (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  keyword     TEXT NOT NULL,
+  created_at  TEXT NOT NULL,
+  UNIQUE(project_id, keyword)
+);
+
+CREATE TABLE IF NOT EXISTS competitors (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  domain      TEXT NOT NULL,
+  created_at  TEXT NOT NULL,
+  UNIQUE(project_id, domain)
+);
+
+CREATE TABLE IF NOT EXISTS runs (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  kind        TEXT NOT NULL DEFAULT 'answer-visibility',
+  status      TEXT NOT NULL DEFAULT 'queued',
+  trigger     TEXT NOT NULL DEFAULT 'manual',
+  started_at  TEXT,
+  finished_at TEXT,
+  error       TEXT,
+  created_at  TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS query_snapshots (
+  id                  TEXT PRIMARY KEY,
+  run_id              TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+  keyword_id          TEXT NOT NULL REFERENCES keywords(id) ON DELETE CASCADE,
+  provider            TEXT NOT NULL DEFAULT 'gemini',
+  citation_state      TEXT NOT NULL,
+  answer_text         TEXT,
+  cited_domains       TEXT NOT NULL DEFAULT '[]',
+  competitor_overlap  TEXT NOT NULL DEFAULT '[]',
+  raw_response        TEXT,
+  created_at          TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT REFERENCES projects(id) ON DELETE CASCADE,
+  actor       TEXT NOT NULL,
+  action      TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  entity_id   TEXT,
+  diff        TEXT,
+  created_at  TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS api_keys (
+  id          TEXT PRIMARY KEY,
+  name        TEXT NOT NULL,
+  key_hash    TEXT NOT NULL UNIQUE,
+  key_prefix  TEXT NOT NULL,
+  scopes      TEXT NOT NULL DEFAULT '["*"]',
+  created_at  TEXT NOT NULL,
+  last_used_at TEXT,
+  revoked_at  TEXT
+);
+
+CREATE TABLE IF NOT EXISTS usage_counters (
+  id          TEXT PRIMARY KEY,
+  scope       TEXT NOT NULL,
+  period      TEXT NOT NULL,
+  metric      TEXT NOT NULL,
+  count       INTEGER NOT NULL DEFAULT 0,
+  updated_at  TEXT NOT NULL,
+  UNIQUE(scope, period, metric)
+);
+
+CREATE INDEX IF NOT EXISTS idx_keywords_project ON keywords(project_id);
+CREATE INDEX IF NOT EXISTS idx_competitors_project ON competitors(project_id);
+CREATE INDEX IF NOT EXISTS idx_runs_project ON runs(project_id);
+CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+CREATE INDEX IF NOT EXISTS idx_snapshots_run ON query_snapshots(run_id);
+CREATE INDEX IF NOT EXISTS idx_snapshots_keyword ON query_snapshots(keyword_id);
+CREATE INDEX IF NOT EXISTS idx_audit_log_project ON audit_log(project_id);
+CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at);
+CREATE TABLE IF NOT EXISTS schedules (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  cron_expr   TEXT NOT NULL,
+  preset      TEXT,
+  timezone    TEXT NOT NULL DEFAULT 'UTC',
+  enabled     INTEGER NOT NULL DEFAULT 1,
+  providers   TEXT NOT NULL DEFAULT '[]',
+  last_run_at TEXT,
+  next_run_at TEXT,
+  created_at  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL,
+  UNIQUE(project_id)
+);
+
+CREATE TABLE IF NOT EXISTS notifications (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  channel     TEXT NOT NULL,
+  config      TEXT NOT NULL,
+  enabled     INTEGER NOT NULL DEFAULT 1,
+  created_at  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(key_prefix);
+CREATE INDEX IF NOT EXISTS idx_usage_scope_period ON usage_counters(scope, period);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_schedules_project ON schedules(project_id);
+CREATE INDEX IF NOT EXISTS idx_notifications_project ON notifications(project_id);
+`;
+var MIGRATIONS = [
+  // v2: Add providers column to projects for multi-provider support
+  `ALTER TABLE projects ADD COLUMN providers TEXT NOT NULL DEFAULT '[]'`,
+  // v3: Add webhook_secret column to notifications for HMAC signing
+  `ALTER TABLE notifications ADD COLUMN webhook_secret TEXT`
+];
+function migrate(db) {
+  const statements = MIGRATION_SQL.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+  for (const statement of statements) {
+    db.run(sql.raw(statement));
+  }
+  for (const migration of MIGRATIONS) {
+    try {
+      db.run(sql.raw(migration));
+    } catch {
+    }
+  }
+}
+
+// ../contracts/src/config-schema.ts
+import { z as z3 } from "zod";
+
+// ../contracts/src/provider.ts
+import { z } from "zod";
+var providerQuotaPolicySchema = z.object({
+  maxConcurrency: z.number().int().positive(),
+  maxRequestsPerMinute: z.number().int().positive(),
+  maxRequestsPerDay: z.number().int().positive()
+});
+var providerNameSchema = z.enum(["gemini", "openai", "claude", "local"]);
+
+// ../contracts/src/notification.ts
+import { z as z2 } from "zod";
+var notificationEventSchema = z2.enum([
+  "citation.lost",
+  "citation.gained",
+  "run.completed",
+  "run.failed"
+]);
+var notificationDtoSchema = z2.object({
+  id: z2.string(),
+  projectId: z2.string(),
+  channel: z2.literal("webhook"),
+  url: z2.string().url(),
+  events: z2.array(notificationEventSchema),
+  enabled: z2.boolean().default(true),
+  webhookSecret: z2.string().optional(),
+  createdAt: z2.string(),
+  updatedAt: z2.string()
+});
+
+// ../contracts/src/config-schema.ts
+var configMetadataSchema = z3.object({
+  name: z3.string().min(1).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, {
+    message: "Name must be a lowercase slug (letters, numbers, hyphens)"
+  }),
+  labels: z3.record(z3.string(), z3.string()).optional().default({})
+});
+var configScheduleSchema = z3.object({
+  preset: z3.string().optional(),
+  cron: z3.string().optional(),
+  timezone: z3.string().optional().default("UTC"),
+  providers: z3.array(providerNameSchema).optional().default([])
+}).refine(
+  (data) => data.preset && !data.cron || !data.preset && data.cron,
+  { message: 'Exactly one of "preset" or "cron" must be provided' }
+).optional();
+var configNotificationSchema = z3.object({
+  channel: z3.literal("webhook"),
+  url: z3.string().url(),
+  events: z3.array(notificationEventSchema).min(1)
+});
+var configSpecSchema = z3.object({
+  displayName: z3.string().min(1),
+  canonicalDomain: z3.string().min(1),
+  country: z3.string().length(2),
+  language: z3.string().min(2),
+  keywords: z3.array(z3.string().min(1)).optional().default([]),
+  competitors: z3.array(z3.string().min(1)).optional().default([]),
+  providers: z3.array(providerNameSchema).optional().default([]),
+  schedule: configScheduleSchema,
+  notifications: z3.array(configNotificationSchema).optional().default([])
+});
+var projectConfigSchema = z3.object({
+  apiVersion: z3.literal("canonry/v1"),
+  kind: z3.literal("Project"),
+  metadata: configMetadataSchema,
+  spec: configSpecSchema
+});
+
+// ../contracts/src/errors.ts
+var AppError = class extends Error {
+  code;
+  statusCode;
+  details;
+  constructor(code, message, statusCode, details) {
+    super(message);
+    this.name = "AppError";
+    this.code = code;
+    this.statusCode = statusCode;
+    this.details = details;
+  }
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.details ? { details: this.details } : {}
+      }
+    };
+  }
+};
+function notFound(entity, id) {
+  return new AppError("NOT_FOUND", `${entity} '${id}' not found`, 404);
+}
+function validationError(message, details) {
+  return new AppError("VALIDATION_ERROR", message, 400, details);
+}
+function authRequired() {
+  return new AppError("AUTH_REQUIRED", "Authentication required", 401);
+}
+function authInvalid() {
+  return new AppError("AUTH_INVALID", "Invalid API key", 401);
+}
+function runInProgress(projectName) {
+  return new AppError("RUN_IN_PROGRESS", `A run is already in progress for '${projectName}'`, 409);
+}
+function unsupportedKind(kind) {
+  return new AppError("UNSUPPORTED_KIND", `Kind '${kind}' is not supported in this version`, 400);
+}
+
+// ../contracts/src/project.ts
+import { z as z4 } from "zod";
+var configSourceSchema = z4.enum(["cli", "api", "config-file"]);
+var projectDtoSchema = z4.object({
+  id: z4.string(),
+  name: z4.string(),
+  displayName: z4.string().optional(),
+  canonicalDomain: z4.string(),
+  country: z4.string().length(2),
+  language: z4.string().min(2),
+  tags: z4.array(z4.string()).default([]),
+  labels: z4.record(z4.string(), z4.string()).default({}),
+  configSource: configSourceSchema.default("cli"),
+  configRevision: z4.number().int().positive().default(1),
+  createdAt: z4.string().optional(),
+  updatedAt: z4.string().optional()
+});
+
+// ../contracts/src/run.ts
+import { z as z5 } from "zod";
+var runStatusSchema = z5.enum(["queued", "running", "completed", "partial", "failed"]);
+var runKindSchema = z5.enum(["answer-visibility", "site-audit"]);
+var runTriggerSchema = z5.enum(["manual", "scheduled", "config-apply"]);
+var citationStateSchema = z5.enum(["cited", "not-cited"]);
+var computedTransitionSchema = z5.enum(["new", "cited", "lost", "emerging", "not-cited"]);
+var runDtoSchema = z5.object({
+  id: z5.string(),
+  projectId: z5.string(),
+  kind: runKindSchema,
+  status: runStatusSchema,
+  trigger: runTriggerSchema.default("manual"),
+  startedAt: z5.string().nullable().optional(),
+  finishedAt: z5.string().nullable().optional(),
+  error: z5.string().nullable().optional(),
+  createdAt: z5.string()
+});
+var groundingSourceSchema = z5.object({
+  uri: z5.string(),
+  title: z5.string()
+});
+var querySnapshotDtoSchema = z5.object({
+  id: z5.string(),
+  runId: z5.string(),
+  keywordId: z5.string(),
+  keyword: z5.string().optional(),
+  provider: providerNameSchema,
+  citationState: citationStateSchema,
+  transition: computedTransitionSchema.optional(),
+  answerText: z5.string().nullable().optional(),
+  citedDomains: z5.array(z5.string()).default([]),
+  competitorOverlap: z5.array(z5.string()).default([]),
+  groundingSources: z5.array(groundingSourceSchema).default([]),
+  searchQueries: z5.array(z5.string()).default([]),
+  model: z5.string().nullable().optional(),
+  createdAt: z5.string()
+});
+var auditLogEntrySchema = z5.object({
+  id: z5.string(),
+  projectId: z5.string().nullable().optional(),
+  actor: z5.string(),
+  action: z5.string(),
+  entityType: z5.string(),
+  entityId: z5.string().nullable().optional(),
+  diff: z5.unknown().optional(),
+  createdAt: z5.string()
+});
+
+// ../contracts/src/schedule.ts
+import { z as z6 } from "zod";
+var scheduleDtoSchema = z6.object({
+  id: z6.string(),
+  projectId: z6.string(),
+  cronExpr: z6.string(),
+  preset: z6.string().nullable().optional(),
+  timezone: z6.string().default("UTC"),
+  enabled: z6.boolean().default(true),
+  providers: z6.array(providerNameSchema).default([]),
+  lastRunAt: z6.string().nullable().optional(),
+  nextRunAt: z6.string().nullable().optional(),
+  createdAt: z6.string(),
+  updatedAt: z6.string()
+});
+
+// ../api-routes/src/auth.ts
+function hashKey(key) {
+  return crypto.createHash("sha256").update(key).digest("hex");
+}
+var SKIP_PATHS = ["/health"];
+function shouldSkipAuth(url) {
+  if (SKIP_PATHS.includes(url)) return true;
+  if (url.endsWith("/openapi.json")) return true;
+  return false;
+}
+async function authPlugin(app) {
+  app.addHook("onRequest", async (request, reply) => {
+    const url = request.url.split("?")[0];
+    if (shouldSkipAuth(url)) return;
+    const header = request.headers.authorization;
+    if (!header) {
+      const err = authRequired();
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const parts = header.split(" ");
+    if (parts.length !== 2 || parts[0] !== "Bearer") {
+      const err = authRequired();
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const token = parts[1];
+    const hash = hashKey(token);
+    const key = app.db.select().from(apiKeys).where(eq(apiKeys.keyHash, hash)).get();
+    if (!key || key.revokedAt) {
+      const err = authInvalid();
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    app.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(apiKeys.id, key.id)).run();
+  });
+}
+
+// ../api-routes/src/projects.ts
+import crypto3 from "crypto";
+import { eq as eq3 } from "drizzle-orm";
+
+// ../api-routes/src/helpers.ts
+import crypto2 from "crypto";
+import { eq as eq2, and } from "drizzle-orm";
+function resolveProject(db, name) {
+  const project = db.select().from(projects).where(eq2(projects.name, name)).get();
+  if (!project) {
+    throw notFound("Project", name);
+  }
+  return project;
+}
+function writeAuditLog(db, entry) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  db.insert(auditLog).values({
+    id: crypto2.randomUUID(),
+    projectId: entry.projectId ?? null,
+    actor: entry.actor,
+    action: entry.action,
+    entityType: entry.entityType,
+    entityId: entry.entityId ?? null,
+    diff: entry.diff != null ? JSON.stringify(entry.diff) : null,
+    createdAt: now
+  }).run();
+}
+
+// ../api-routes/src/projects.ts
+async function projectRoutes(app, opts) {
+  app.put("/projects/:name", async (request, reply) => {
+    const { name } = request.params;
+    const body = request.body;
+    if (!body || !body.displayName || !body.canonicalDomain || !body.country || !body.language) {
+      const err = validationError("Missing required fields: displayName, canonicalDomain, country, language");
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = app.db.select().from(projects).where(eq3(projects.name, name)).get();
+    if (existing) {
+      app.db.update(projects).set({
+        displayName: body.displayName,
+        canonicalDomain: body.canonicalDomain,
+        country: body.country,
+        language: body.language,
+        tags: JSON.stringify(body.tags ?? []),
+        labels: JSON.stringify(body.labels ?? {}),
+        providers: JSON.stringify(body.providers ?? []),
+        configSource: body.configSource ?? "api",
+        configRevision: existing.configRevision + 1,
+        updatedAt: now
+      }).where(eq3(projects.id, existing.id)).run();
+      writeAuditLog(app.db, {
+        projectId: existing.id,
+        actor: "api",
+        action: "project.updated",
+        entityType: "project",
+        entityId: existing.id
+      });
+      const updated = app.db.select().from(projects).where(eq3(projects.id, existing.id)).get();
+      return reply.status(200).send(formatProject(updated));
+    }
+    const id = crypto3.randomUUID();
+    app.db.insert(projects).values({
+      id,
+      name,
+      displayName: body.displayName,
+      canonicalDomain: body.canonicalDomain,
+      country: body.country,
+      language: body.language,
+      tags: JSON.stringify(body.tags ?? []),
+      labels: JSON.stringify(body.labels ?? {}),
+      providers: JSON.stringify(body.providers ?? []),
+      configSource: body.configSource ?? "api",
+      configRevision: 1,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    writeAuditLog(app.db, {
+      projectId: id,
+      actor: "api",
+      action: "project.created",
+      entityType: "project",
+      entityId: id
+    });
+    const created = app.db.select().from(projects).where(eq3(projects.id, id)).get();
+    return reply.status(201).send(formatProject(created));
+  });
+  app.get("/projects", async (_request, reply) => {
+    const rows = app.db.select().from(projects).all();
+    return reply.send(rows.map(formatProject));
+  });
+  app.get("/projects/:name", async (request, reply) => {
+    try {
+      const project = resolveProject(app.db, request.params.name);
+      return reply.send(formatProject(project));
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+  });
+  app.delete("/projects/:name", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "project.deleted",
+      entityType: "project",
+      entityId: project.id
+    });
+    app.db.delete(projects).where(eq3(projects.id, project.id)).run();
+    opts.onProjectDeleted?.(project.id);
+    return reply.status(204).send();
+  });
+  app.get("/projects/:name/export", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    const kws = app.db.select().from(keywords).where(eq3(keywords.projectId, project.id)).all();
+    const comps = app.db.select().from(competitors).where(eq3(competitors.projectId, project.id)).all();
+    const schedule = app.db.select().from(schedules).where(eq3(schedules.projectId, project.id)).get();
+    const notificationRows = app.db.select().from(notifications).where(eq3(notifications.projectId, project.id)).all();
+    const config = {
+      apiVersion: "canonry/v1",
+      kind: "Project",
+      metadata: {
+        name: project.name,
+        labels: JSON.parse(project.labels)
+      },
+      spec: {
+        displayName: project.displayName,
+        canonicalDomain: project.canonicalDomain,
+        country: project.country,
+        language: project.language,
+        keywords: kws.map((k) => k.keyword),
+        competitors: comps.map((c) => c.domain),
+        providers: JSON.parse(project.providers || "[]"),
+        notifications: notificationRows.map((row) => {
+          const cfg = JSON.parse(row.config);
+          return {
+            channel: row.channel,
+            url: cfg.url,
+            events: cfg.events
+          };
+        }),
+        ...schedule ? {
+          schedule: {
+            ...schedule.preset ? { preset: schedule.preset } : { cron: schedule.cronExpr },
+            timezone: schedule.timezone,
+            providers: JSON.parse(schedule.providers || "[]")
+          }
+        } : {}
+      }
+    };
+    return reply.send(config);
+  });
+}
+function formatProject(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    displayName: row.displayName,
+    canonicalDomain: row.canonicalDomain,
+    country: row.country,
+    language: row.language,
+    tags: JSON.parse(row.tags),
+    labels: JSON.parse(row.labels),
+    providers: JSON.parse(row.providers || "[]"),
+    configSource: row.configSource,
+    configRevision: row.configRevision,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+
+// ../api-routes/src/keywords.ts
+import crypto4 from "crypto";
+import { eq as eq4 } from "drizzle-orm";
+async function keywordRoutes(app) {
+  app.get("/projects/:name/keywords", async (request, reply) => {
+    const project = resolveProjectSafe(app, request.params.name, reply);
+    if (!project) return;
+    const rows = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, keyword: r.keyword, createdAt: r.createdAt })));
+  });
+  app.put("/projects/:name/keywords", async (request, reply) => {
+    const project = resolveProjectSafe(app, request.params.name, reply);
+    if (!project) return;
+    const body = request.body;
+    if (!body || !Array.isArray(body.keywords)) {
+      const err = validationError('Body must contain a "keywords" array');
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.transaction((tx) => {
+      tx.delete(keywords).where(eq4(keywords.projectId, project.id)).run();
+      for (const kw of body.keywords) {
+        tx.insert(keywords).values({
+          id: crypto4.randomUUID(),
+          projectId: project.id,
+          keyword: kw,
+          createdAt: now
+        }).run();
+      }
+      writeAuditLog(tx, {
+        projectId: project.id,
+        actor: "api",
+        action: "keywords.replaced",
+        entityType: "keyword",
+        diff: { keywords: body.keywords }
+      });
+    });
+    const rows = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, keyword: r.keyword, createdAt: r.createdAt })));
+  });
+  app.post("/projects/:name/keywords", async (request, reply) => {
+    const project = resolveProjectSafe(app, request.params.name, reply);
+    if (!project) return;
+    const body = request.body;
+    if (!body || !Array.isArray(body.keywords)) {
+      const err = validationError('Body must contain a "keywords" array');
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    const existingSet = new Set(existing.map((k) => k.keyword));
+    const added = [];
+    for (const kw of body.keywords) {
+      if (!existingSet.has(kw)) {
+        app.db.insert(keywords).values({
+          id: crypto4.randomUUID(),
+          projectId: project.id,
+          keyword: kw,
+          createdAt: now
+        }).run();
+        added.push(kw);
+        existingSet.add(kw);
+      }
+    }
+    if (added.length > 0) {
+      writeAuditLog(app.db, {
+        projectId: project.id,
+        actor: "api",
+        action: "keywords.appended",
+        entityType: "keyword",
+        diff: { added }
+      });
+    }
+    const rows = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, keyword: r.keyword, createdAt: r.createdAt })));
+  });
+}
+function resolveProjectSafe(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/competitors.ts
+import crypto5 from "crypto";
+import { eq as eq5 } from "drizzle-orm";
+async function competitorRoutes(app) {
+  app.get("/projects/:name/competitors", async (request, reply) => {
+    const project = resolveProjectSafe2(app, request.params.name, reply);
+    if (!project) return;
+    const rows = app.db.select().from(competitors).where(eq5(competitors.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, domain: r.domain, createdAt: r.createdAt })));
+  });
+  app.put("/projects/:name/competitors", async (request, reply) => {
+    const project = resolveProjectSafe2(app, request.params.name, reply);
+    if (!project) return;
+    const body = request.body;
+    if (!body || !Array.isArray(body.competitors)) {
+      const err = validationError('Body must contain a "competitors" array');
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.transaction((tx) => {
+      tx.delete(competitors).where(eq5(competitors.projectId, project.id)).run();
+      for (const domain of body.competitors) {
+        tx.insert(competitors).values({
+          id: crypto5.randomUUID(),
+          projectId: project.id,
+          domain,
+          createdAt: now
+        }).run();
+      }
+      writeAuditLog(tx, {
+        projectId: project.id,
+        actor: "api",
+        action: "competitors.replaced",
+        entityType: "competitor",
+        diff: { competitors: body.competitors }
+      });
+    });
+    const rows = app.db.select().from(competitors).where(eq5(competitors.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, domain: r.domain, createdAt: r.createdAt })));
+  });
+}
+function resolveProjectSafe2(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/runs.ts
+import { eq as eq7, asc } from "drizzle-orm";
+
+// ../api-routes/src/run-queue.ts
+import crypto6 from "crypto";
+import { and as and2, eq as eq6, or } from "drizzle-orm";
+function queueRunIfProjectIdle(db, params) {
+  const createdAt = params.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const kind = params.kind ?? "answer-visibility";
+  const trigger = params.trigger ?? "manual";
+  const runId = crypto6.randomUUID();
+  return db.transaction((tx) => {
+    const activeRun = tx.select().from(runs).where(
+      and2(
+        eq6(runs.projectId, params.projectId),
+        or(eq6(runs.status, "queued"), eq6(runs.status, "running"))
+      )
+    ).get();
+    if (activeRun) {
+      return { conflict: true, activeRunId: activeRun.id };
+    }
+    tx.insert(runs).values({
+      id: runId,
+      projectId: params.projectId,
+      kind,
+      status: "queued",
+      trigger,
+      createdAt
+    }).run();
+    return { conflict: false, runId };
+  });
+}
+
+// ../api-routes/src/runs.ts
+async function runRoutes(app, opts) {
+  app.post("/projects/:name/runs", async (request, reply) => {
+    const project = resolveProjectSafe3(app, request.params.name, reply);
+    if (!project) return;
+    const kind = request.body?.kind ?? "answer-visibility";
+    if (kind !== "answer-visibility") {
+      const err = unsupportedKind(kind);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const trigger = request.body?.trigger ?? "manual";
+    const rawProviders = request.body?.providers;
+    const validProviders = ["gemini", "openai", "claude", "local"];
+    if (rawProviders?.length) {
+      const invalid = rawProviders.filter((p) => !validProviders.includes(p));
+      if (invalid.length) {
+        return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: `Invalid provider(s): ${invalid.join(", ")}. Must be one of: ${validProviders.join(", ")}` } });
+      }
+    }
+    const providers = rawProviders?.length ? rawProviders : void 0;
+    const queueResult = queueRunIfProjectIdle(app.db, {
+      createdAt: now,
+      kind,
+      projectId: project.id,
+      trigger
+    });
+    if (queueResult.conflict) {
+      const err = runInProgress(project.name);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const runId = queueResult.runId;
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "run.created",
+      entityType: "run",
+      entityId: runId
+    });
+    const run = app.db.select().from(runs).where(eq7(runs.id, runId)).get();
+    if (opts.onRunCreated) {
+      opts.onRunCreated(runId, project.id, providers);
+    }
+    return reply.status(201).send(formatRun(run));
+  });
+  app.get("/projects/:name/runs", async (request, reply) => {
+    const project = resolveProjectSafe3(app, request.params.name, reply);
+    if (!project) return;
+    const rows = app.db.select().from(runs).where(eq7(runs.projectId, project.id)).orderBy(asc(runs.createdAt)).all();
+    return reply.send(rows.map(formatRun));
+  });
+  app.get("/runs", async (_request, reply) => {
+    const rows = app.db.select().from(runs).all();
+    return reply.send(rows.map(formatRun));
+  });
+  app.get("/runs/:id", async (request, reply) => {
+    const run = app.db.select().from(runs).where(eq7(runs.id, request.params.id)).get();
+    if (!run) {
+      return reply.status(404).send({ error: { code: "NOT_FOUND", message: `Run '${request.params.id}' not found` } });
+    }
+    const snapshots = app.db.select({
+      id: querySnapshots.id,
+      runId: querySnapshots.runId,
+      keywordId: querySnapshots.keywordId,
+      keyword: keywords.keyword,
+      provider: querySnapshots.provider,
+      citationState: querySnapshots.citationState,
+      answerText: querySnapshots.answerText,
+      citedDomains: querySnapshots.citedDomains,
+      competitorOverlap: querySnapshots.competitorOverlap,
+      rawResponse: querySnapshots.rawResponse,
+      createdAt: querySnapshots.createdAt
+    }).from(querySnapshots).leftJoin(keywords, eq7(querySnapshots.keywordId, keywords.id)).where(eq7(querySnapshots.runId, run.id)).all();
+    return reply.send({
+      ...formatRun(run),
+      snapshots: snapshots.map((s) => ({
+        id: s.id,
+        runId: s.runId,
+        keywordId: s.keywordId,
+        keyword: s.keyword,
+        provider: s.provider,
+        citationState: s.citationState,
+        answerText: s.answerText,
+        citedDomains: tryParseJson(s.citedDomains, []),
+        competitorOverlap: tryParseJson(s.competitorOverlap, []),
+        ...parseSnapshotRawResponse(s.rawResponse),
+        createdAt: s.createdAt
+      }))
+    });
+  });
+}
+function formatRun(row) {
+  return {
+    id: row.id,
+    projectId: row.projectId,
+    kind: row.kind,
+    status: row.status,
+    trigger: row.trigger,
+    startedAt: row.startedAt,
+    finishedAt: row.finishedAt,
+    error: row.error,
+    createdAt: row.createdAt
+  };
+}
+function parseSnapshotRawResponse(raw) {
+  const parsed = tryParseJson(raw ?? "{}", {});
+  return {
+    groundingSources: parsed.groundingSources ?? [],
+    searchQueries: parsed.searchQueries ?? [],
+    model: parsed.model ?? null
+  };
+}
+function tryParseJson(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+function resolveProjectSafe3(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/apply.ts
+import crypto8 from "crypto";
+import { eq as eq8 } from "drizzle-orm";
+
+// ../api-routes/src/schedule-utils.ts
+var DAY_MAP = {
+  sun: "0",
+  mon: "1",
+  tue: "2",
+  wed: "3",
+  thu: "4",
+  fri: "5",
+  sat: "6"
+};
+function resolvePreset(preset) {
+  if (preset === "daily") return "0 6 * * *";
+  if (preset === "weekly") return "0 6 * * 1";
+  if (preset === "twice-daily") return "0 6,18 * * *";
+  const dailyMatch = preset.match(/^daily@(\d{1,2})$/);
+  if (dailyMatch) {
+    const hour = parseInt(dailyMatch[1], 10);
+    if (hour < 0 || hour > 23) throw new Error(`Invalid hour in preset: ${preset}`);
+    return `0 ${hour} * * *`;
+  }
+  const weeklyDayMatch = preset.match(/^weekly@([a-z]{3})$/);
+  if (weeklyDayMatch) {
+    const day = DAY_MAP[weeklyDayMatch[1]];
+    if (day === void 0) throw new Error(`Invalid day in preset: ${preset}`);
+    return `0 6 * * ${day}`;
+  }
+  const weeklyDayHourMatch = preset.match(/^weekly@([a-z]{3})@(\d{1,2})$/);
+  if (weeklyDayHourMatch) {
+    const day = DAY_MAP[weeklyDayHourMatch[1]];
+    const hour = parseInt(weeklyDayHourMatch[2], 10);
+    if (day === void 0) throw new Error(`Invalid day in preset: ${preset}`);
+    if (hour < 0 || hour > 23) throw new Error(`Invalid hour in preset: ${preset}`);
+    return `0 ${hour} * * ${day}`;
+  }
+  throw new Error(`Unknown schedule preset: ${preset}`);
+}
+function validateCron(expr) {
+  const parts = expr.trim().split(/\s+/);
+  if (parts.length !== 5) return false;
+  const ranges = [
+    { min: 0, max: 59 },
+    // minute
+    { min: 0, max: 23 },
+    // hour
+    { min: 1, max: 31 },
+    // day of month
+    { min: 1, max: 12 },
+    // month
+    { min: 0, max: 7 }
+    // day of week (0 and 7 = Sunday)
+  ];
+  for (let i = 0; i < 5; i++) {
+    if (!validateCronField(parts[i], ranges[i].min, ranges[i].max)) {
+      return false;
+    }
+  }
+  return true;
+}
+function validateCronField(field, min, max) {
+  if (field === "*") return true;
+  const segments = field.split(",");
+  for (const segment of segments) {
+    const stepParts = segment.split("/");
+    if (stepParts.length > 2) return false;
+    if (stepParts.length === 2) {
+      const step = parseInt(stepParts[1], 10);
+      if (isNaN(step) || step < 1) return false;
+    }
+    const base = stepParts[0];
+    if (base === "*") continue;
+    const rangeParts = base.split("-");
+    if (rangeParts.length > 2) return false;
+    for (const part of rangeParts) {
+      const num = parseInt(part, 10);
+      if (isNaN(num) || num < min || num > max) return false;
+    }
+  }
+  return true;
+}
+function isValidTimezone(tz) {
+  try {
+    Intl.DateTimeFormat(void 0, { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ../api-routes/src/webhooks.ts
+import crypto7 from "crypto";
+import dns from "dns/promises";
+import http from "http";
+import https from "https";
+import net from "net";
+var REQUEST_TIMEOUT_MS = 1e4;
+async function resolveWebhookTarget(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { ok: false, message: '"url" must be a valid URL' };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { ok: false, message: '"url" must use http or https scheme' };
+  }
+  if (parsed.username || parsed.password) {
+    return { ok: false, message: '"url" must not include credentials' };
+  }
+  const lookupHost = stripIpv6Brackets(parsed.hostname);
+  if (!lookupHost) {
+    return { ok: false, message: '"url" must include a hostname' };
+  }
+  const addresses = await resolveHostAddresses(lookupHost);
+  if (addresses.length === 0) {
+    return { ok: false, message: '"url" hostname could not be resolved' };
+  }
+  const blocked = addresses.find((entry) => isBlockedAddress(entry.address));
+  if (blocked) {
+    return { ok: false, message: '"url" must not resolve to a private or loopback address' };
+  }
+  return {
+    ok: true,
+    target: {
+      url: parsed,
+      address: addresses[0].address,
+      family: addresses[0].family
+    }
+  };
+}
+async function deliverWebhook(target, payload, webhookSecret) {
+  const body = JSON.stringify(payload);
+  const isHttps = target.url.protocol === "https:";
+  const port = target.url.port ? Number(target.url.port) : isHttps ? 443 : 80;
+  const path3 = `${target.url.pathname}${target.url.search}`;
+  const headers = {
+    "Content-Length": String(Buffer.byteLength(body)),
+    "Content-Type": "application/json",
+    "Host": target.url.host,
+    "User-Agent": "Canonry/0.1.0"
+  };
+  if (webhookSecret) {
+    headers["X-Canonry-Signature"] = "sha256=" + crypto7.createHmac("sha256", webhookSecret).update(body).digest("hex");
+  }
+  return await new Promise((resolve) => {
+    const requestOptions = {
+      family: target.family,
+      headers,
+      hostname: target.address,
+      method: "POST",
+      path: path3,
+      port,
+      timeout: REQUEST_TIMEOUT_MS
+    };
+    if (isHttps) {
+      requestOptions.servername = stripIpv6Brackets(target.url.hostname);
+    }
+    const request = (isHttps ? https.request : http.request)(requestOptions, (response) => {
+      response.resume();
+      response.on("end", () => {
+        resolve({ status: response.statusCode ?? 0, error: null });
+      });
+    });
+    request.on("timeout", () => {
+      request.destroy(new Error(`Request timed out after ${REQUEST_TIMEOUT_MS}ms`));
+    });
+    request.on("error", (error) => {
+      resolve({ status: 0, error: error.message });
+    });
+    request.end(body);
+  });
+}
+async function resolveHostAddresses(hostname) {
+  const family = net.isIP(hostname);
+  if (family === 4 || family === 6) {
+    return [{ address: hostname, family }];
+  }
+  try {
+    const records = await dns.lookup(hostname, { all: true, verbatim: true });
+    const unique = /* @__PURE__ */ new Map();
+    for (const record of records) {
+      if (record.family !== 4 && record.family !== 6) continue;
+      unique.set(`${record.family}:${record.address}`, {
+        address: record.address,
+        family: record.family
+      });
+    }
+    return [...unique.values()];
+  } catch {
+    return [];
+  }
+}
+function isBlockedAddress(address) {
+  const normalized = stripIpv6Brackets(address).toLowerCase();
+  const family = net.isIP(normalized);
+  if (family === 4) {
+    return isBlockedIpv4(normalized);
+  }
+  if (family === 6) {
+    const mappedIpv4 = extractMappedIpv4(normalized);
+    if (mappedIpv4) {
+      return isBlockedIpv4(mappedIpv4);
+    }
+    return isBlockedIpv6(normalized);
+  }
+  return true;
+}
+function isBlockedIpv4(address) {
+  const octets = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (octets.length !== 4 || octets.some(Number.isNaN)) {
+    return true;
+  }
+  const [first, second] = octets;
+  return first === 0 || first === 10 || first === 127 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 198 && (second === 18 || second === 19);
+}
+function isBlockedIpv6(address) {
+  const normalized = address.split("%")[0].toLowerCase();
+  if (normalized === "::" || normalized === "::1") {
+    return true;
+  }
+  const firstHextetText = normalized.split(":")[0] ?? "";
+  const firstHextet = firstHextetText === "" ? 0 : Number.parseInt(firstHextetText, 16);
+  if (Number.isNaN(firstHextet)) {
+    return true;
+  }
+  return firstHextet >= 64512 && firstHextet <= 65023 || firstHextet >= 65152 && firstHextet <= 65215;
+}
+function extractMappedIpv4(address) {
+  const normalized = address.toLowerCase();
+  if (!normalized.startsWith("::ffff:")) {
+    return null;
+  }
+  const remainder = normalized.slice("::ffff:".length);
+  if (net.isIP(remainder) === 4) {
+    return remainder;
+  }
+  const parts = remainder.split(":");
+  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
+    return null;
+  }
+  const high = Number.parseInt(parts[0], 16);
+  const low = Number.parseInt(parts[1], 16);
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function stripIpv6Brackets(value) {
+  return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+}
+
+// ../api-routes/src/apply.ts
+async function applyRoutes(app, opts) {
+  app.post("/apply", async (request, reply) => {
+    const parsed = projectConfigSchema.safeParse(request.body);
+    if (!parsed.success) {
+      const err = validationError("Invalid project config", {
+        issues: parsed.error.issues.map((i) => ({ path: i.path.join("."), message: i.message }))
+      });
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const config = parsed.data;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const name = config.metadata.name;
+    const existing = app.db.select().from(projects).where(eq8(projects.name, name)).get();
+    let projectId;
+    if (existing) {
+      projectId = existing.id;
+      app.db.update(projects).set({
+        displayName: config.spec.displayName,
+        canonicalDomain: config.spec.canonicalDomain,
+        country: config.spec.country,
+        language: config.spec.language,
+        labels: JSON.stringify(config.metadata.labels),
+        providers: JSON.stringify(config.spec.providers ?? []),
+        configSource: "config-file",
+        configRevision: existing.configRevision + 1,
+        updatedAt: now
+      }).where(eq8(projects.id, existing.id)).run();
+      writeAuditLog(app.db, {
+        projectId,
+        actor: "api",
+        action: "project.applied",
+        entityType: "project",
+        entityId: projectId
+      });
+    } else {
+      projectId = crypto8.randomUUID();
+      app.db.insert(projects).values({
+        id: projectId,
+        name,
+        displayName: config.spec.displayName,
+        canonicalDomain: config.spec.canonicalDomain,
+        country: config.spec.country,
+        language: config.spec.language,
+        tags: "[]",
+        labels: JSON.stringify(config.metadata.labels),
+        providers: JSON.stringify(config.spec.providers ?? []),
+        configSource: "config-file",
+        configRevision: 1,
+        createdAt: now,
+        updatedAt: now
+      }).run();
+      writeAuditLog(app.db, {
+        projectId,
+        actor: "api",
+        action: "project.created",
+        entityType: "project",
+        entityId: projectId
+      });
+    }
+    app.db.transaction((tx) => {
+      tx.delete(keywords).where(eq8(keywords.projectId, projectId)).run();
+      for (const kw of config.spec.keywords) {
+        tx.insert(keywords).values({
+          id: crypto8.randomUUID(),
+          projectId,
+          keyword: kw,
+          createdAt: now
+        }).run();
+      }
+      writeAuditLog(tx, {
+        projectId,
+        actor: "api",
+        action: "keywords.replaced",
+        entityType: "keyword",
+        diff: { keywords: config.spec.keywords }
+      });
+      tx.delete(competitors).where(eq8(competitors.projectId, projectId)).run();
+      for (const domain of config.spec.competitors) {
+        tx.insert(competitors).values({
+          id: crypto8.randomUUID(),
+          projectId,
+          domain,
+          createdAt: now
+        }).run();
+      }
+      writeAuditLog(tx, {
+        projectId,
+        actor: "api",
+        action: "competitors.replaced",
+        entityType: "competitor",
+        diff: { competitors: config.spec.competitors }
+      });
+    });
+    if (config.spec.schedule) {
+      const schedSpec = config.spec.schedule;
+      let cronExpr;
+      let preset = null;
+      if (schedSpec.preset) {
+        preset = schedSpec.preset;
+        try {
+          cronExpr = resolvePreset(schedSpec.preset);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: msg } });
+        }
+      } else if (schedSpec.cron) {
+        cronExpr = schedSpec.cron;
+        if (!validateCron(cronExpr)) {
+          return reply.status(400).send({
+            error: { code: "VALIDATION_ERROR", message: `Invalid cron expression in schedule: ${cronExpr}` }
+          });
+        }
+      } else {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: 'Schedule requires either "preset" or "cron"' }
+        });
+      }
+      const timezone = schedSpec.timezone ?? "UTC";
+      if (!isValidTimezone(timezone)) {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: `Invalid timezone: ${timezone}` }
+        });
+      }
+      const existingSched = app.db.select().from(schedules).where(eq8(schedules.projectId, projectId)).get();
+      if (existingSched) {
+        app.db.update(schedules).set({
+          cronExpr,
+          preset,
+          timezone,
+          providers: JSON.stringify(schedSpec.providers ?? []),
+          enabled: 1,
+          updatedAt: now
+        }).where(eq8(schedules.id, existingSched.id)).run();
+      } else {
+        app.db.insert(schedules).values({
+          id: crypto8.randomUUID(),
+          projectId,
+          cronExpr,
+          preset,
+          timezone,
+          enabled: 1,
+          providers: JSON.stringify(schedSpec.providers ?? []),
+          createdAt: now,
+          updatedAt: now
+        }).run();
+      }
+      opts?.onScheduleUpdated?.("upsert", projectId);
+    } else {
+      const existingSched = app.db.select().from(schedules).where(eq8(schedules.projectId, projectId)).get();
+      if (existingSched) {
+        app.db.delete(schedules).where(eq8(schedules.projectId, projectId)).run();
+        opts?.onScheduleUpdated?.("delete", projectId);
+      }
+    }
+    const rawSpec = request.body?.spec ?? {};
+    if ("notifications" in rawSpec) {
+      for (const notif of config.spec.notifications) {
+        const urlCheck = await resolveWebhookTarget(notif.url ?? "");
+        if (!urlCheck.ok) {
+          return reply.status(400).send({
+            error: { code: "VALIDATION_ERROR", message: `Notification URL invalid: ${urlCheck.message}` }
+          });
+        }
+      }
+      app.db.delete(notifications).where(eq8(notifications.projectId, projectId)).run();
+      for (const notif of config.spec.notifications) {
+        app.db.insert(notifications).values({
+          id: crypto8.randomUUID(),
+          projectId,
+          channel: notif.channel,
+          config: JSON.stringify({ url: notif.url, events: notif.events }),
+          webhookSecret: crypto8.randomBytes(32).toString("hex"),
+          enabled: 1,
+          createdAt: now,
+          updatedAt: now
+        }).run();
+      }
+      writeAuditLog(app.db, {
+        projectId,
+        actor: "api",
+        action: "notifications.replaced",
+        entityType: "notification",
+        diff: { notifications: config.spec.notifications }
+      });
+    }
+    const project = app.db.select().from(projects).where(eq8(projects.id, projectId)).get();
+    return reply.status(200).send({
+      id: project.id,
+      name: project.name,
+      displayName: project.displayName,
+      canonicalDomain: project.canonicalDomain,
+      country: project.country,
+      language: project.language,
+      tags: JSON.parse(project.tags),
+      labels: JSON.parse(project.labels),
+      providers: JSON.parse(project.providers || "[]"),
+      configSource: project.configSource,
+      configRevision: project.configRevision,
+      createdAt: project.createdAt,
+      updatedAt: project.updatedAt
+    });
+  });
+}
+
+// ../api-routes/src/history.ts
+import { eq as eq9, desc, inArray } from "drizzle-orm";
+async function historyRoutes(app) {
+  app.get("/projects/:name/history", async (request, reply) => {
+    const project = resolveProjectSafe4(app, request.params.name, reply);
+    if (!project) return;
+    const rows = app.db.select().from(auditLog).where(eq9(auditLog.projectId, project.id)).orderBy(desc(auditLog.createdAt)).all();
+    return reply.send(rows.map(formatAuditEntry));
+  });
+  app.get("/history", async (_request, reply) => {
+    const rows = app.db.select().from(auditLog).orderBy(desc(auditLog.createdAt)).all();
+    return reply.send(rows.map(formatAuditEntry));
+  });
+  app.get("/projects/:name/snapshots", async (request, reply) => {
+    const project = resolveProjectSafe4(app, request.params.name, reply);
+    if (!project) return;
+    const limit = parseInt(request.query.limit ?? "50", 10);
+    const offset = parseInt(request.query.offset ?? "0", 10);
+    const projectRuns = app.db.select({ id: runs.id }).from(runs).where(eq9(runs.projectId, project.id)).all();
+    if (projectRuns.length === 0) {
+      return reply.send({ snapshots: [], total: 0 });
+    }
+    const allSnapshots = app.db.select({
+      id: querySnapshots.id,
+      runId: querySnapshots.runId,
+      keywordId: querySnapshots.keywordId,
+      keyword: keywords.keyword,
+      provider: querySnapshots.provider,
+      citationState: querySnapshots.citationState,
+      answerText: querySnapshots.answerText,
+      citedDomains: querySnapshots.citedDomains,
+      competitorOverlap: querySnapshots.competitorOverlap,
+      createdAt: querySnapshots.createdAt
+    }).from(querySnapshots).leftJoin(keywords, eq9(querySnapshots.keywordId, keywords.id)).where(inArray(querySnapshots.runId, projectRuns.map((r) => r.id))).orderBy(desc(querySnapshots.createdAt)).all();
+    const total = allSnapshots.length;
+    const paged = allSnapshots.slice(offset, offset + limit);
+    return reply.send({
+      snapshots: paged.map((s) => ({
+        id: s.id,
+        runId: s.runId,
+        keywordId: s.keywordId,
+        keyword: s.keyword,
+        provider: s.provider,
+        citationState: s.citationState,
+        answerText: s.answerText,
+        citedDomains: tryParseJson2(s.citedDomains, []),
+        competitorOverlap: tryParseJson2(s.competitorOverlap, []),
+        createdAt: s.createdAt
+      })),
+      total
+    });
+  });
+  app.get("/projects/:name/timeline", async (request, reply) => {
+    const project = resolveProjectSafe4(app, request.params.name, reply);
+    if (!project) return;
+    const projectKeywords = app.db.select().from(keywords).where(eq9(keywords.projectId, project.id)).all();
+    const projectRuns = app.db.select().from(runs).where(eq9(runs.projectId, project.id)).orderBy(runs.createdAt).all();
+    if (projectRuns.length === 0 || projectKeywords.length === 0) {
+      return reply.send([]);
+    }
+    const runIds = new Set(projectRuns.map((r) => r.id));
+    const allSnapshots = app.db.select().from(querySnapshots).where(inArray(querySnapshots.runId, [...runIds])).all();
+    const deduped = /* @__PURE__ */ new Map();
+    for (const snap of allSnapshots) {
+      const key = `${snap.runId}:${snap.keywordId}`;
+      const existing = deduped.get(key);
+      if (!existing || snap.citationState === "cited") {
+        deduped.set(key, snap);
+      }
+    }
+    const dedupedSnapshots = [...deduped.values()];
+    const timeline = projectKeywords.map((kw) => {
+      const kwSnapshots = dedupedSnapshots.filter((s) => s.keywordId === kw.id).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+      const runEntries = kwSnapshots.map((snap, idx) => {
+        const run = projectRuns.find((r) => r.id === snap.runId);
+        let transition = snap.citationState === "cited" ? "cited" : "not-cited";
+        if (idx === 0) {
+          transition = "new";
+        } else {
+          const prev = kwSnapshots[idx - 1];
+          if (prev.citationState === "not-cited" && snap.citationState === "cited") {
+            transition = "emerging";
+          } else if (prev.citationState === "cited" && snap.citationState === "not-cited") {
+            transition = "lost";
+          }
+        }
+        return {
+          runId: snap.runId,
+          createdAt: run?.createdAt ?? snap.createdAt,
+          citationState: snap.citationState,
+          transition
+        };
+      });
+      return {
+        keyword: kw.keyword,
+        runs: runEntries
+      };
+    });
+    return reply.send(timeline);
+  });
+  app.get("/projects/:name/snapshots/diff", async (request, reply) => {
+    const project = resolveProjectSafe4(app, request.params.name, reply);
+    if (!project) return;
+    const { run1, run2 } = request.query;
+    if (!run1 || !run2) {
+      return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Both run1 and run2 query params are required" } });
+    }
+    const snaps1 = app.db.select({
+      keywordId: querySnapshots.keywordId,
+      keyword: keywords.keyword,
+      citationState: querySnapshots.citationState
+    }).from(querySnapshots).leftJoin(keywords, eq9(querySnapshots.keywordId, keywords.id)).where(eq9(querySnapshots.runId, run1)).all();
+    const snaps2 = app.db.select({
+      keywordId: querySnapshots.keywordId,
+      keyword: keywords.keyword,
+      citationState: querySnapshots.citationState
+    }).from(querySnapshots).leftJoin(keywords, eq9(querySnapshots.keywordId, keywords.id)).where(eq9(querySnapshots.runId, run2)).all();
+    const map1 = /* @__PURE__ */ new Map();
+    for (const s of snaps1) {
+      const existing = map1.get(s.keywordId);
+      if (!existing || s.citationState === "cited") map1.set(s.keywordId, s);
+    }
+    const map2 = /* @__PURE__ */ new Map();
+    for (const s of snaps2) {
+      const existing = map2.get(s.keywordId);
+      if (!existing || s.citationState === "cited") map2.set(s.keywordId, s);
+    }
+    const allKeywordIds = /* @__PURE__ */ new Set([...map1.keys(), ...map2.keys()]);
+    const diff = [...allKeywordIds].map((kwId) => {
+      const s1 = map1.get(kwId);
+      const s2 = map2.get(kwId);
+      return {
+        keywordId: kwId,
+        keyword: s2?.keyword ?? s1?.keyword ?? null,
+        run1State: s1?.citationState ?? null,
+        run2State: s2?.citationState ?? null,
+        changed: (s1?.citationState ?? null) !== (s2?.citationState ?? null)
+      };
+    });
+    return reply.send({ run1, run2, diff });
+  });
+}
+function formatAuditEntry(row) {
+  return {
+    id: row.id,
+    projectId: row.projectId,
+    actor: row.actor,
+    action: row.action,
+    entityType: row.entityType,
+    entityId: row.entityId,
+    diff: row.diff ? tryParseJson2(row.diff, null) : null,
+    createdAt: row.createdAt
+  };
+}
+function tryParseJson2(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+function resolveProjectSafe4(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/settings.ts
+async function settingsRoutes(app, opts) {
+  app.get("/settings", async () => ({
+    providers: opts.providerSummary ?? []
+  }));
+  app.put("/settings/providers/:name", async (request, reply) => {
+    const { name } = request.params;
+    const { apiKey, baseUrl, model } = request.body ?? {};
+    const validProviders = ["gemini", "openai", "claude", "local"];
+    if (!validProviders.includes(name)) {
+      return reply.status(400).send({ error: `Invalid provider: ${name}. Must be one of: ${validProviders.join(", ")}` });
+    }
+    if (name === "local") {
+      if (!baseUrl || typeof baseUrl !== "string") {
+        return reply.status(400).send({ error: "baseUrl is required for local provider" });
+      }
+    } else {
+      if (!apiKey || typeof apiKey !== "string") {
+        return reply.status(400).send({ error: "apiKey is required" });
+      }
+    }
+    if (model !== void 0) {
+      if (name === "gemini" && !model.startsWith("gemini-")) {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: `Invalid model "${model}" for provider "gemini" \u2014 model name must start with "gemini-" (e.g. gemini-2.5-flash)` }
+        });
+      }
+      if (name === "openai" && !/^(gpt-|o\d)/.test(model)) {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: `Invalid model "${model}" for provider "openai" \u2014 expected a GPT or o-series model name (e.g. gpt-4o, o3)` }
+        });
+      }
+      if (name === "claude" && !model.startsWith("claude-")) {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: `Invalid model "${model}" for provider "claude" \u2014 model name must start with "claude-" (e.g. claude-sonnet-4-6)` }
+        });
+      }
+    }
+    if (!opts.onProviderUpdate) {
+      return reply.status(501).send({ error: "Provider configuration updates are not supported in this deployment" });
+    }
+    const result = opts.onProviderUpdate(name, apiKey ?? "", model, baseUrl);
+    if (!result) {
+      return reply.status(500).send({ error: "Failed to update provider configuration" });
+    }
+    return result;
+  });
+}
+
+// ../api-routes/src/schedules.ts
+import crypto9 from "crypto";
+import { eq as eq10 } from "drizzle-orm";
+async function scheduleRoutes(app, opts) {
+  app.put("/projects/:name/schedule", async (request, reply) => {
+    const project = resolveProjectSafe5(app, request.params.name, reply);
+    if (!project) return;
+    const { preset, cron: cron2, timezone = "UTC", providers = [], enabled = true } = request.body ?? {};
+    if (!preset && !cron2 || preset && cron2) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: 'Exactly one of "preset" or "cron" must be provided' }
+      });
+    }
+    if (!isValidTimezone(timezone)) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: `Invalid timezone: ${timezone}` }
+      });
+    }
+    let cronExpr;
+    if (preset) {
+      try {
+        cronExpr = resolvePreset(preset);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: msg } });
+      }
+    } else {
+      cronExpr = cron2;
+      if (!validateCron(cronExpr)) {
+        return reply.status(400).send({
+          error: { code: "VALIDATION_ERROR", message: `Invalid cron expression: ${cronExpr}` }
+        });
+      }
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const enabledInt = enabled === false ? 0 : 1;
+    const existing = app.db.select().from(schedules).where(eq10(schedules.projectId, project.id)).get();
+    if (existing) {
+      app.db.update(schedules).set({
+        cronExpr,
+        preset: preset ?? null,
+        timezone,
+        providers: JSON.stringify(providers),
+        enabled: enabledInt,
+        updatedAt: now
+      }).where(eq10(schedules.id, existing.id)).run();
+    } else {
+      app.db.insert(schedules).values({
+        id: crypto9.randomUUID(),
+        projectId: project.id,
+        cronExpr,
+        preset: preset ?? null,
+        timezone,
+        enabled: enabledInt,
+        providers: JSON.stringify(providers),
+        createdAt: now,
+        updatedAt: now
+      }).run();
+    }
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: existing ? "schedule.updated" : "schedule.created",
+      entityType: "schedule",
+      diff: { cronExpr, preset, timezone, providers }
+    });
+    opts.onScheduleUpdated?.("upsert", project.id);
+    const schedule = app.db.select().from(schedules).where(eq10(schedules.projectId, project.id)).get();
+    return reply.status(existing ? 200 : 201).send(formatSchedule(schedule));
+  });
+  app.get("/projects/:name/schedule", async (request, reply) => {
+    const project = resolveProjectSafe5(app, request.params.name, reply);
+    if (!project) return;
+    const schedule = app.db.select().from(schedules).where(eq10(schedules.projectId, project.id)).get();
+    if (!schedule) {
+      return reply.status(404).send({ error: { code: "NOT_FOUND", message: `No schedule for project '${request.params.name}'` } });
+    }
+    return reply.send(formatSchedule(schedule));
+  });
+  app.delete("/projects/:name/schedule", async (request, reply) => {
+    const project = resolveProjectSafe5(app, request.params.name, reply);
+    if (!project) return;
+    const schedule = app.db.select().from(schedules).where(eq10(schedules.projectId, project.id)).get();
+    if (!schedule) {
+      return reply.status(404).send({ error: { code: "NOT_FOUND", message: `No schedule for project '${request.params.name}'` } });
+    }
+    app.db.delete(schedules).where(eq10(schedules.id, schedule.id)).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "schedule.deleted",
+      entityType: "schedule",
+      entityId: schedule.id
+    });
+    opts.onScheduleUpdated?.("delete", project.id);
+    return reply.status(204).send();
+  });
+}
+function formatSchedule(row) {
+  return {
+    id: row.id,
+    projectId: row.projectId,
+    cronExpr: row.cronExpr,
+    preset: row.preset,
+    timezone: row.timezone,
+    enabled: row.enabled === 1,
+    providers: JSON.parse(row.providers),
+    lastRunAt: row.lastRunAt,
+    nextRunAt: row.nextRunAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function resolveProjectSafe5(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/notifications.ts
+import crypto10 from "crypto";
+import { eq as eq11 } from "drizzle-orm";
+var VALID_EVENTS = ["citation.lost", "citation.gained", "run.completed", "run.failed"];
+async function notificationRoutes(app) {
+  app.post("/projects/:name/notifications", async (request, reply) => {
+    const project = resolveProjectSafe6(app, request.params.name, reply);
+    if (!project) return;
+    const { channel, url, events } = request.body ?? {};
+    if (channel !== "webhook") {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: 'Only "webhook" channel is supported' }
+      });
+    }
+    const urlCheck = await resolveWebhookTarget(url ?? "");
+    if (!urlCheck.ok) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: urlCheck.message }
+      });
+    }
+    if (!events?.length) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: '"events" must be a non-empty array' }
+      });
+    }
+    const invalid = events.filter((e) => !VALID_EVENTS.includes(e));
+    if (invalid.length) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: `Invalid event(s): ${invalid.join(", ")}. Must be one of: ${VALID_EVENTS.join(", ")}` }
+      });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const id = crypto10.randomUUID();
+    const webhookSecret = crypto10.randomBytes(32).toString("hex");
+    app.db.insert(notifications).values({
+      id,
+      projectId: project.id,
+      channel: "webhook",
+      config: JSON.stringify({ url, events }),
+      webhookSecret,
+      enabled: 1,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "notification.created",
+      entityType: "notification",
+      entityId: id,
+      diff: { channel, url, events }
+    });
+    return reply.status(201).send({
+      ...formatNotification(app.db.select().from(notifications).where(eq11(notifications.id, id)).get()),
+      webhookSecret
+    });
+  });
+  app.get("/projects/:name/notifications", async (request, reply) => {
+    const project = resolveProjectSafe6(app, request.params.name, reply);
+    if (!project) return;
+    const rows = app.db.select().from(notifications).where(eq11(notifications.projectId, project.id)).all();
+    return reply.send(rows.map(formatNotification));
+  });
+  app.delete("/projects/:name/notifications/:id", async (request, reply) => {
+    const project = resolveProjectSafe6(app, request.params.name, reply);
+    if (!project) return;
+    const notification = app.db.select().from(notifications).where(eq11(notifications.id, request.params.id)).get();
+    if (!notification || notification.projectId !== project.id) {
+      return reply.status(404).send({
+        error: { code: "NOT_FOUND", message: `Notification '${request.params.id}' not found` }
+      });
+    }
+    app.db.delete(notifications).where(eq11(notifications.id, notification.id)).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "notification.deleted",
+      entityType: "notification",
+      entityId: notification.id
+    });
+    return reply.status(204).send();
+  });
+  app.post("/projects/:name/notifications/:id/test", async (request, reply) => {
+    const project = resolveProjectSafe6(app, request.params.name, reply);
+    if (!project) return;
+    const notification = app.db.select().from(notifications).where(eq11(notifications.id, request.params.id)).get();
+    if (!notification || notification.projectId !== project.id) {
+      return reply.status(404).send({
+        error: { code: "NOT_FOUND", message: `Notification '${request.params.id}' not found` }
+      });
+    }
+    const config = JSON.parse(notification.config);
+    const urlCheck = await resolveWebhookTarget(config.url);
+    if (!urlCheck.ok) {
+      return reply.status(400).send({
+        error: { code: "VALIDATION_ERROR", message: `Stored webhook URL is invalid: ${urlCheck.message}` }
+      });
+    }
+    const payload = {
+      source: "canonry",
+      event: "run.completed",
+      project: { name: project.name, canonicalDomain: project.canonicalDomain },
+      run: { id: "test-run-id", status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      transitions: [
+        { keyword: "test keyword", from: "not-cited", to: "cited", provider: "gemini" }
+      ],
+      dashboardUrl: `/projects/${project.name}`
+    };
+    request.log.info(`[Notification test] POST ${config.url}`);
+    const { status, error } = await deliverWebhook(urlCheck.target, payload, notification.webhookSecret ?? null);
+    request.log.info(`[Notification test] Response: HTTP ${status} from ${config.url}`);
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "notification.tested",
+      entityType: "notification",
+      entityId: notification.id,
+      diff: { status, error }
+    });
+    if (error) {
+      return reply.status(502).send({ error: { code: "DELIVERY_FAILED", message: error } });
+    }
+    return reply.send({ status, ok: status >= 200 && status < 300 });
+  });
+}
+function formatNotification(row) {
+  const config = JSON.parse(row.config);
+  return {
+    id: row.id,
+    projectId: row.projectId,
+    channel: "webhook",
+    url: config.url,
+    events: config.events,
+    enabled: row.enabled === 1,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function resolveProjectSafe6(app, name, reply) {
+  try {
+    return resolveProject(app.db, name);
+  } catch (e) {
+    if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+      const err = e;
+      reply.status(err.statusCode).send(err.toJSON());
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ../api-routes/src/index.ts
+async function apiRoutes(app, opts) {
+  app.decorate("db", opts.db);
+  if (!opts.skipAuth) {
+    await app.register(authPlugin);
+  }
+  await app.register(async (api) => {
+    await api.register(projectRoutes, {
+      onProjectDeleted: opts.onProjectDeleted
+    });
+    await api.register(keywordRoutes);
+    await api.register(competitorRoutes);
+    await api.register(runRoutes, { onRunCreated: opts.onRunCreated });
+    await api.register(applyRoutes, {
+      onScheduleUpdated: opts.onScheduleUpdated
+    });
+    await api.register(historyRoutes);
+    await api.register(settingsRoutes, {
+      providerSummary: opts.providerSummary,
+      onProviderUpdate: opts.onProviderUpdate
+    });
+    await api.register(scheduleRoutes, {
+      onScheduleUpdated: opts.onScheduleUpdated
+    });
+    await api.register(notificationRoutes);
+  }, { prefix: "/api/v1" });
+}
+
+// ../provider-gemini/src/normalize.ts
+import { GoogleGenerativeAI } from "@google/generative-ai";
+var DEFAULT_MODEL = "gemini-2.5-flash";
+function resolveModel(config) {
+  const m = config.model;
+  if (!m) return DEFAULT_MODEL;
+  if (m.startsWith("gemini-")) return m;
+  console.warn(
+    `[provider-gemini] Invalid model name "${m}" \u2014 this provider uses the Gemini AI Studio API (generativelanguage.googleapis.com) which only accepts "gemini-*" model names. Falling back to ${DEFAULT_MODEL}.`
+  );
+  return DEFAULT_MODEL;
+}
+function validateConfig(config) {
+  if (!config.apiKey || config.apiKey.length === 0) {
+    return { ok: false, provider: "gemini", message: "missing api key" };
+  }
+  const model = resolveModel(config);
+  const warning = config.model && !config.model.startsWith("gemini-") ? ` (invalid model "${config.model}" replaced with default)` : "";
+  return {
+    ok: true,
+    provider: "gemini",
+    message: `config valid${warning}`,
+    model
+  };
+}
+async function healthcheck(config) {
+  const validation = validateConfig(config);
+  if (!validation.ok) return validation;
+  try {
+    const genAI = new GoogleGenerativeAI(config.apiKey);
+    const model = genAI.getGenerativeModel({ model: resolveModel(config) });
+    const result = await model.generateContent('Say "ok"');
+    const text2 = result.response.text();
+    return {
+      ok: text2.length > 0,
+      provider: "gemini",
+      message: text2.length > 0 ? "gemini api key verified" : "empty response from gemini",
+      model: config.model ?? DEFAULT_MODEL
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      provider: "gemini",
+      message: err instanceof Error ? err.message : String(err),
+      model: config.model ?? DEFAULT_MODEL
+    };
+  }
+}
+async function executeTrackedQuery(input) {
+  const model = resolveModel(input.config);
+  const genAI = new GoogleGenerativeAI(input.config.apiKey);
+  const generativeModel = genAI.getGenerativeModel({
+    model,
+    tools: [{ googleSearch: {} }]
+  });
+  const prompt = buildPrompt(input.keyword);
+  const result = await generativeModel.generateContent(prompt);
+  const response = result.response;
+  const groundingMetadata = extractGroundingMetadata(response);
+  const searchQueries = extractSearchQueries(response);
+  return {
+    provider: "gemini",
+    rawResponse: responseToRecord(response),
+    model,
+    groundingSources: groundingMetadata,
+    searchQueries
+  };
+}
+function normalizeResult(raw) {
+  const answerText = extractAnswerText(raw.rawResponse);
+  const citedDomains = extractCitedDomains(raw);
+  return {
+    provider: "gemini",
+    answerText,
+    citedDomains,
+    groundingSources: raw.groundingSources,
+    searchQueries: raw.searchQueries
+  };
+}
+function buildPrompt(keyword) {
+  return keyword;
+}
+function extractAnswerText(rawResponse) {
+  try {
+    const candidates = rawResponse.candidates;
+    if (!candidates || candidates.length === 0) return "";
+    const parts = candidates[0]?.content?.parts;
+    if (!parts || parts.length === 0) return "";
+    return parts.map((p) => p.text ?? "").join("");
+  } catch {
+    return "";
+  }
+}
+function extractGroundingMetadata(response) {
+  try {
+    const candidate = response.candidates?.[0];
+    if (!candidate) return [];
+    const metadata = candidate.groundingMetadata;
+    if (!metadata) return [];
+    const chunks = metadata.groundingChunks;
+    if (!chunks) return [];
+    return chunks.filter((chunk) => chunk.web?.uri).map((chunk) => ({
+      uri: chunk.web.uri,
+      title: chunk.web?.title ?? ""
+    }));
+  } catch {
+    return [];
+  }
+}
+function extractSearchQueries(response) {
+  try {
+    const candidate = response.candidates?.[0];
+    return candidate?.groundingMetadata?.webSearchQueries ?? [];
+  } catch {
+    return [];
+  }
+}
+function extractCitedDomains(raw) {
+  const domains = /* @__PURE__ */ new Set();
+  for (const source of raw.groundingSources) {
+    const domain = extractDomainFromUri(source.uri);
+    if (domain) {
+      domains.add(domain);
+      continue;
+    }
+    if (source.title) {
+      const titleDomain = extractDomainFromTitle(source.title);
+      if (titleDomain) domains.add(titleDomain);
+    }
+  }
+  return [...domains];
+}
+function extractDomainFromTitle(title) {
+  const trimmed = title.trim().toLowerCase();
+  if (/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z]{2,})+$/.test(trimmed)) {
+    return trimmed.replace(/^www\./, "");
+  }
+  return null;
+}
+function extractDomainFromUri(uri) {
+  try {
+    const url = new URL(uri);
+    const hostname = url.hostname.replace(/^www\./, "");
+    if (hostname === "vertexaisearch.cloud.google.com") {
+      const redirectPath = url.pathname.replace(/^\/grounding-api-redirect\//, "");
+      if (redirectPath && redirectPath !== url.pathname) {
+        try {
+          const decoded = decodeURIComponent(redirectPath);
+          if (decoded.startsWith("http")) {
+            const realUrl = new URL(decoded);
+            return realUrl.hostname.replace(/^www\./, "");
+          }
+        } catch {
+        }
+      }
+      return null;
+    }
+    return hostname;
+  } catch {
+    return null;
+  }
+}
+function responseToRecord(response) {
+  try {
+    const candidates = response.candidates?.map((c) => ({
+      content: c.content,
+      finishReason: c.finishReason,
+      groundingMetadata: c.groundingMetadata ? {
+        webSearchQueries: c.groundingMetadata.webSearchQueries,
+        groundingChunks: c.groundingMetadata.groundingChunks
+      } : void 0
+    }));
+    return {
+      candidates: candidates ?? [],
+      usageMetadata: response.usageMetadata ?? null
+    };
+  } catch {
+    return { error: "failed to serialize response" };
+  }
+}
+
+// ../provider-gemini/src/adapter.ts
+function toGeminiConfig(config) {
+  return {
+    apiKey: config.apiKey ?? "",
+    model: config.model,
+    quotaPolicy: config.quotaPolicy
+  };
+}
+var geminiAdapter = {
+  name: "gemini",
+  validateConfig(config) {
+    const result = validateConfig(toGeminiConfig(config));
+    return {
+      ok: result.ok,
+      provider: "gemini",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async healthcheck(config) {
+    const result = await healthcheck(toGeminiConfig(config));
+    return {
+      ok: result.ok,
+      provider: "gemini",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async executeTrackedQuery(input, config) {
+    const raw = await executeTrackedQuery({
+      keyword: input.keyword,
+      canonicalDomains: input.canonicalDomains,
+      competitorDomains: input.competitorDomains,
+      config: toGeminiConfig(config)
+    });
+    return {
+      provider: "gemini",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+  },
+  normalizeResult(raw) {
+    const geminiRaw = {
+      provider: "gemini",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+    const normalized = normalizeResult(geminiRaw);
+    return {
+      provider: "gemini",
+      answerText: normalized.answerText,
+      citedDomains: normalized.citedDomains,
+      groundingSources: normalized.groundingSources,
+      searchQueries: normalized.searchQueries
+    };
+  }
+};
+
+// ../provider-openai/src/normalize.ts
+import OpenAI from "openai";
+var DEFAULT_MODEL2 = "gpt-4o";
+function validateConfig2(config) {
+  if (!config.apiKey || config.apiKey.length === 0) {
+    return { ok: false, provider: "openai", message: "missing api key" };
+  }
+  return {
+    ok: true,
+    provider: "openai",
+    message: "config valid",
+    model: config.model ?? DEFAULT_MODEL2
+  };
+}
+async function healthcheck2(config) {
+  const validation = validateConfig2(config);
+  if (!validation.ok) return validation;
+  try {
+    const client = new OpenAI({ apiKey: config.apiKey });
+    const response = await client.responses.create({
+      model: config.model ?? DEFAULT_MODEL2,
+      input: 'Say "ok"'
+    });
+    const text2 = extractResponseText(response);
+    return {
+      ok: text2.length > 0,
+      provider: "openai",
+      message: text2.length > 0 ? "openai api key verified" : "empty response from openai",
+      model: config.model ?? DEFAULT_MODEL2
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      provider: "openai",
+      message: err instanceof Error ? err.message : String(err),
+      model: config.model ?? DEFAULT_MODEL2
+    };
+  }
+}
+async function executeTrackedQuery2(input) {
+  const model = input.config.model ?? DEFAULT_MODEL2;
+  const client = new OpenAI({ apiKey: input.config.apiKey });
+  const response = await client.responses.create({
+    model,
+    tools: [{ type: "web_search_preview" }],
+    tool_choice: "required",
+    input: buildPrompt2(input.keyword)
+  });
+  const groundingSources = extractGroundingSources(response);
+  const searchQueries = extractSearchQueries2(response);
+  return {
+    provider: "openai",
+    rawResponse: responseToRecord2(response),
+    model,
+    groundingSources,
+    searchQueries
+  };
+}
+function normalizeResult2(raw) {
+  const answerText = extractAnswerTextFromRaw(raw.rawResponse);
+  const citedDomains = extractCitedDomains2(raw);
+  return {
+    provider: "openai",
+    answerText,
+    citedDomains,
+    groundingSources: raw.groundingSources,
+    searchQueries: raw.searchQueries
+  };
+}
+function buildPrompt2(keyword) {
+  return `Search the web for "${keyword}" and provide a comprehensive, factual answer. Include relevant sources.`;
+}
+function extractResponseText(response) {
+  try {
+    const parts = [];
+    for (const item of response.output) {
+      if (item.type === "message") {
+        for (const content of item.content) {
+          if (content.type === "output_text") {
+            parts.push(content.text);
+          }
+        }
+      }
+    }
+    return parts.join("");
+  } catch {
+    return "";
+  }
+}
+function extractGroundingSources(response) {
+  const sources = [];
+  try {
+    for (const item of response.output) {
+      if (item.type === "message") {
+        for (const content of item.content) {
+          if (content.type === "output_text" && content.annotations) {
+            for (const annotation of content.annotations) {
+              if (annotation.type === "url_citation") {
+                sources.push({
+                  uri: annotation.url,
+                  title: annotation.title ?? ""
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  return sources;
+}
+function extractSearchQueries2(response) {
+  const queries = [];
+  try {
+    for (const item of response.output) {
+      if (item.type === "web_search_call" && "query" in item) {
+        queries.push(item.query);
+      }
+    }
+  } catch {
+  }
+  return queries;
+}
+function extractAnswerTextFromRaw(rawResponse) {
+  try {
+    const output = rawResponse.output;
+    if (!output) return "";
+    const parts = [];
+    for (const item of output) {
+      if (item.type === "message" && item.content) {
+        for (const content of item.content) {
+          if (content.type === "output_text" && content.text) {
+            parts.push(content.text);
+          }
+        }
+      }
+    }
+    return parts.join("");
+  } catch {
+    return "";
+  }
+}
+function extractCitedDomains2(raw) {
+  const domains = /* @__PURE__ */ new Set();
+  for (const source of raw.groundingSources) {
+    const domain = extractDomainFromUri2(source.uri);
+    if (domain) domains.add(domain);
+  }
+  return [...domains];
+}
+function extractDomainFromUri2(uri) {
+  try {
+    const url = new URL(uri);
+    return url.hostname.replace(/^www\./, "");
+  } catch {
+    return null;
+  }
+}
+function responseToRecord2(response) {
+  try {
+    return JSON.parse(JSON.stringify(response));
+  } catch {
+    return { error: "failed to serialize response" };
+  }
+}
+
+// ../provider-openai/src/adapter.ts
+function toOpenAIConfig(config) {
+  return {
+    apiKey: config.apiKey ?? "",
+    model: config.model,
+    quotaPolicy: config.quotaPolicy
+  };
+}
+var openaiAdapter = {
+  name: "openai",
+  validateConfig(config) {
+    const result = validateConfig2(toOpenAIConfig(config));
+    return {
+      ok: result.ok,
+      provider: "openai",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async healthcheck(config) {
+    const result = await healthcheck2(toOpenAIConfig(config));
+    return {
+      ok: result.ok,
+      provider: "openai",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async executeTrackedQuery(input, config) {
+    const raw = await executeTrackedQuery2({
+      keyword: input.keyword,
+      canonicalDomains: input.canonicalDomains,
+      competitorDomains: input.competitorDomains,
+      config: toOpenAIConfig(config)
+    });
+    return {
+      provider: "openai",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+  },
+  normalizeResult(raw) {
+    const openaiRaw = {
+      provider: "openai",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+    const normalized = normalizeResult2(openaiRaw);
+    return {
+      provider: "openai",
+      answerText: normalized.answerText,
+      citedDomains: normalized.citedDomains,
+      groundingSources: normalized.groundingSources,
+      searchQueries: normalized.searchQueries
+    };
+  }
+};
+
+// ../provider-claude/src/normalize.ts
+import Anthropic from "@anthropic-ai/sdk";
+var DEFAULT_MODEL3 = "claude-sonnet-4-6";
+function validateConfig3(config) {
+  if (!config.apiKey || config.apiKey.length === 0) {
+    return { ok: false, provider: "claude", message: "missing api key" };
+  }
+  return {
+    ok: true,
+    provider: "claude",
+    message: "config valid",
+    model: config.model ?? DEFAULT_MODEL3
+  };
+}
+async function healthcheck3(config) {
+  const validation = validateConfig3(config);
+  if (!validation.ok) return validation;
+  try {
+    const client = new Anthropic({ apiKey: config.apiKey });
+    const response = await client.messages.create({
+      model: config.model ?? DEFAULT_MODEL3,
+      max_tokens: 32,
+      messages: [{ role: "user", content: 'Say "ok"' }]
+    });
+    const text2 = extractTextFromResponse(response);
+    return {
+      ok: text2.length > 0,
+      provider: "claude",
+      message: text2.length > 0 ? "claude api key verified" : "empty response from claude",
+      model: config.model ?? DEFAULT_MODEL3
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      provider: "claude",
+      message: err instanceof Error ? err.message : String(err),
+      model: config.model ?? DEFAULT_MODEL3
+    };
+  }
+}
+async function executeTrackedQuery3(input) {
+  const model = input.config.model ?? DEFAULT_MODEL3;
+  const client = new Anthropic({ apiKey: input.config.apiKey });
+  const response = await client.messages.create({
+    model,
+    max_tokens: 4096,
+    tools: [
+      {
+        type: "web_search_20250305",
+        name: "web_search",
+        max_uses: 5
+      }
+    ],
+    messages: [{ role: "user", content: input.keyword }]
+  });
+  const groundingSources = extractGroundingSources2(response);
+  const searchQueries = extractSearchQueries3(response);
+  return {
+    provider: "claude",
+    rawResponse: responseToRecord3(response),
+    model,
+    groundingSources,
+    searchQueries
+  };
+}
+function normalizeResult3(raw) {
+  const answerText = extractAnswerTextFromRaw2(raw.rawResponse);
+  const citedDomains = extractCitedDomains3(raw);
+  return {
+    provider: "claude",
+    answerText,
+    citedDomains,
+    groundingSources: raw.groundingSources,
+    searchQueries: raw.searchQueries
+  };
+}
+function extractTextFromResponse(response) {
+  try {
+    const parts = [];
+    for (const block of response.content) {
+      if (block.type === "text") {
+        parts.push(block.text);
+      }
+    }
+    return parts.join("");
+  } catch {
+    return "";
+  }
+}
+function extractGroundingSources2(response) {
+  const sources = [];
+  try {
+    for (const block of response.content) {
+      if (block.type === "web_search_tool_result" && Array.isArray(block.content)) {
+        for (const result of block.content) {
+          if (result.type === "web_search_result") {
+            sources.push({
+              uri: result.url,
+              title: result.title ?? ""
+            });
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  return sources;
+}
+function extractSearchQueries3(response) {
+  const queries = [];
+  try {
+    for (const block of response.content) {
+      if (block.type === "server_tool_use" && block.name === "web_search") {
+        const input = block.input;
+        if (input.query) {
+          queries.push(input.query);
+        }
+      }
+    }
+  } catch {
+  }
+  return queries;
+}
+function extractAnswerTextFromRaw2(rawResponse) {
+  try {
+    const content = rawResponse.content;
+    if (!content) return "";
+    const parts = [];
+    for (const block of content) {
+      if (block.type === "text" && block.text) {
+        parts.push(block.text);
+      }
+    }
+    return parts.join("");
+  } catch {
+    return "";
+  }
+}
+function extractCitedDomains3(raw) {
+  const domains = /* @__PURE__ */ new Set();
+  for (const source of raw.groundingSources) {
+    const domain = extractDomainFromUri3(source.uri);
+    if (domain) domains.add(domain);
+  }
+  return [...domains];
+}
+function extractDomainFromUri3(uri) {
+  try {
+    const url = new URL(uri);
+    return url.hostname.replace(/^www\./, "");
+  } catch {
+    return null;
+  }
+}
+function responseToRecord3(response) {
+  try {
+    return JSON.parse(JSON.stringify(response));
+  } catch {
+    return { error: "failed to serialize response" };
+  }
+}
+
+// ../provider-claude/src/adapter.ts
+function toClaudeConfig(config) {
+  return {
+    apiKey: config.apiKey ?? "",
+    model: config.model,
+    quotaPolicy: config.quotaPolicy
+  };
+}
+var claudeAdapter = {
+  name: "claude",
+  validateConfig(config) {
+    const result = validateConfig3(toClaudeConfig(config));
+    return {
+      ok: result.ok,
+      provider: "claude",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async healthcheck(config) {
+    const result = await healthcheck3(toClaudeConfig(config));
+    return {
+      ok: result.ok,
+      provider: "claude",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async executeTrackedQuery(input, config) {
+    const raw = await executeTrackedQuery3({
+      keyword: input.keyword,
+      canonicalDomains: input.canonicalDomains,
+      competitorDomains: input.competitorDomains,
+      config: toClaudeConfig(config)
+    });
+    return {
+      provider: "claude",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+  },
+  normalizeResult(raw) {
+    const claudeRaw = {
+      provider: "claude",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+    const normalized = normalizeResult3(claudeRaw);
+    return {
+      provider: "claude",
+      answerText: normalized.answerText,
+      citedDomains: normalized.citedDomains,
+      groundingSources: normalized.groundingSources,
+      searchQueries: normalized.searchQueries
+    };
+  }
+};
+
+// ../provider-local/src/normalize.ts
+import OpenAI2 from "openai";
+var DEFAULT_MODEL4 = "llama3";
+function validateConfig4(config) {
+  if (!config.baseUrl || config.baseUrl.length === 0) {
+    return { ok: false, provider: "local", message: "missing base URL" };
+  }
+  return {
+    ok: true,
+    provider: "local",
+    message: "config valid",
+    model: config.model ?? DEFAULT_MODEL4
+  };
+}
+async function healthcheck4(config) {
+  const validation = validateConfig4(config);
+  if (!validation.ok) return validation;
+  try {
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey || "not-needed"
+    });
+    const models = await client.models.list();
+    const modelList = [];
+    for await (const m of models) {
+      modelList.push(m.id);
+      if (modelList.length >= 5) break;
+    }
+    return {
+      ok: true,
+      provider: "local",
+      message: `connected, ${modelList.length} model(s) available`,
+      model: config.model ?? DEFAULT_MODEL4
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      provider: "local",
+      message: err instanceof Error ? err.message : String(err),
+      model: config.model ?? DEFAULT_MODEL4
+    };
+  }
+}
+async function executeTrackedQuery4(input) {
+  const model = input.config.model ?? DEFAULT_MODEL4;
+  const client = new OpenAI2({
+    baseURL: input.config.baseUrl,
+    apiKey: input.config.apiKey || "not-needed"
+  });
+  const response = await client.chat.completions.create({
+    model,
+    messages: [
+      {
+        role: "system",
+        content: "You are a helpful assistant. Provide comprehensive, factual answers. When mentioning websites or services, include their domain names."
+      },
+      {
+        role: "user",
+        content: buildPrompt3(input.keyword)
+      }
+    ]
+  });
+  return {
+    provider: "local",
+    rawResponse: JSON.parse(JSON.stringify(response)),
+    model,
+    groundingSources: [],
+    searchQueries: []
+  };
+}
+function normalizeResult4(raw) {
+  const answerText = extractAnswerText2(raw.rawResponse);
+  const citedDomains = extractDomainMentions(answerText);
+  return {
+    provider: "local",
+    answerText,
+    citedDomains,
+    groundingSources: raw.groundingSources,
+    searchQueries: raw.searchQueries
+  };
+}
+function buildPrompt3(keyword) {
+  return `Based on your training knowledge, what websites, services, or organizations are commonly associated with "${keyword}"? List the most relevant ones and include their domain names (e.g. example.com) where you know them.`;
+}
+function extractAnswerText2(rawResponse) {
+  try {
+    const choices = rawResponse.choices;
+    if (!choices?.length) return "";
+    return choices[0].message?.content ?? "";
+  } catch {
+    return "";
+  }
+}
+function extractDomainMentions(text2) {
+  const domains = /* @__PURE__ */ new Set();
+  const urlPattern = /https?:\/\/([a-zA-Z0-9][-a-zA-Z0-9]*(?:\.[a-zA-Z0-9][-a-zA-Z0-9]*)+)/g;
+  let match;
+  while ((match = urlPattern.exec(text2)) !== null) {
+    domains.add(match[1].replace(/^www\./, "").toLowerCase());
+  }
+  const domainPattern = /(?:^|[\s(["'])((?:[a-zA-Z0-9][-a-zA-Z0-9]*\.)+(?:com|org|net|io|co|dev|ai|app|edu|gov|biz|info|tech|health|dental|legal|law|med|uk|us|ca|au|de|fr|es|it|nl|se|no|dk|fi|jp|cn|kr|br|mx|ru|in|sg|nz|za)(?:\.[a-zA-Z]{2})?)(?:[\s).,;/"']|$)/g;
+  while ((match = domainPattern.exec(text2)) !== null) {
+    domains.add(match[1].replace(/^www\./, "").toLowerCase());
+  }
+  return [...domains];
+}
+
+// ../provider-local/src/adapter.ts
+function toLocalConfig(config) {
+  return {
+    baseUrl: config.baseUrl ?? "",
+    apiKey: config.apiKey,
+    model: config.model,
+    quotaPolicy: config.quotaPolicy
+  };
+}
+var localAdapter = {
+  name: "local",
+  validateConfig(config) {
+    const result = validateConfig4(toLocalConfig(config));
+    return {
+      ok: result.ok,
+      provider: "local",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async healthcheck(config) {
+    const result = await healthcheck4(toLocalConfig(config));
+    return {
+      ok: result.ok,
+      provider: "local",
+      message: result.message,
+      model: result.model
+    };
+  },
+  async executeTrackedQuery(input, config) {
+    const raw = await executeTrackedQuery4({
+      keyword: input.keyword,
+      canonicalDomains: input.canonicalDomains,
+      competitorDomains: input.competitorDomains,
+      config: toLocalConfig(config)
+    });
+    return {
+      provider: "local",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+  },
+  normalizeResult(raw) {
+    const localRaw = {
+      provider: "local",
+      rawResponse: raw.rawResponse,
+      model: raw.model,
+      groundingSources: raw.groundingSources,
+      searchQueries: raw.searchQueries
+    };
+    const normalized = normalizeResult4(localRaw);
+    return {
+      provider: "local",
+      answerText: normalized.answerText,
+      citedDomains: normalized.citedDomains,
+      groundingSources: normalized.groundingSources,
+      searchQueries: normalized.searchQueries
+    };
+  }
+};
+
+// src/job-runner.ts
+import crypto11 from "crypto";
+import { eq as eq12 } from "drizzle-orm";
+var JobRunner = class {
+  db;
+  registry;
+  onRunCompleted;
+  constructor(db, registry) {
+    this.db = db;
+    this.registry = registry;
+  }
+  async executeRun(runId, projectId, providerOverride) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      this.db.update(runs).set({ status: "running", startedAt: now }).where(eq12(runs.id, runId)).run();
+      const project = this.db.select().from(projects).where(eq12(projects.id, projectId)).get();
+      if (!project) {
+        throw new Error(`Project ${projectId} not found`);
+      }
+      const projectProviders = providerOverride ?? JSON.parse(project.providers || "[]");
+      const activeProviders = this.registry.getForProject(projectProviders);
+      if (activeProviders.length === 0) {
+        throw new Error("No providers configured. Add at least one provider API key.");
+      }
+      console.log(`[JobRunner] Run ${runId}: dispatching to ${activeProviders.length} providers: ${activeProviders.map((p) => p.adapter.name).join(", ")}`);
+      const projectKeywords = this.db.select().from(keywords).where(eq12(keywords.projectId, projectId)).all();
+      const projectCompetitors = this.db.select().from(competitors).where(eq12(competitors.projectId, projectId)).all();
+      const competitorDomains = projectCompetitors.map((c) => c.domain);
+      const queriesPerProvider = projectKeywords.length;
+      const todayPeriod = getCurrentPeriod();
+      for (const p of activeProviders) {
+        const providerScope = `${projectId}:${p.adapter.name}`;
+        const providerUsage = this.db.select().from(usageCounters).where(eq12(usageCounters.scope, providerScope)).all().filter((r) => r.period === todayPeriod && r.metric === "queries").reduce((sum, r) => sum + r.count, 0);
+        const limit = p.config.quotaPolicy.maxRequestsPerDay;
+        if (providerUsage + queriesPerProvider > limit) {
+          throw new Error(
+            `Daily quota exceeded for ${p.adapter.name}: ${providerUsage} queries used today, limit is ${limit}. This run needs ${queriesPerProvider} more.`
+          );
+        }
+      }
+      const minuteWindows = /* @__PURE__ */ new Map();
+      for (const p of activeProviders) {
+        minuteWindows.set(p.adapter.name, []);
+      }
+      const providerErrors = /* @__PURE__ */ new Map();
+      let totalSnapshotsInserted = 0;
+      for (const kw of projectKeywords) {
+        const providerPromises = activeProviders.map(async (registeredProvider) => {
+          const { adapter, config } = registeredProvider;
+          const providerName = adapter.name;
+          try {
+            await this.waitForRateLimit(
+              minuteWindows.get(providerName),
+              config.quotaPolicy.maxRequestsPerMinute
+            );
+            const raw = await adapter.executeTrackedQuery(
+              {
+                keyword: kw.keyword,
+                canonicalDomains: [project.canonicalDomain],
+                competitorDomains
+              },
+              config
+            );
+            const normalized = adapter.normalizeResult(raw);
+            console.log(`[JobRunner] ${providerName}: "${kw.keyword}" citedDomains=${JSON.stringify(normalized.citedDomains)}, groundingSources=${JSON.stringify(normalized.groundingSources.map((s) => s.uri))}, canonical="${project.canonicalDomain}"`);
+            const citationState = determineCitationState(normalized, project.canonicalDomain);
+            const overlap = computeCompetitorOverlap(normalized, competitorDomains);
+            this.db.insert(querySnapshots).values({
+              id: crypto11.randomUUID(),
+              runId,
+              keywordId: kw.id,
+              provider: providerName,
+              citationState,
+              answerText: normalized.answerText,
+              citedDomains: JSON.stringify(normalized.citedDomains),
+              competitorOverlap: JSON.stringify(overlap),
+              rawResponse: JSON.stringify({
+                model: raw.model,
+                groundingSources: normalized.groundingSources,
+                searchQueries: normalized.searchQueries,
+                apiResponse: raw.rawResponse
+              }),
+              createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            }).run();
+            totalSnapshotsInserted++;
+            console.log(`[JobRunner] ${providerName}: keyword "${kw.keyword}" \u2192 ${citationState}`);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[JobRunner] ${providerName}: keyword "${kw.keyword}" FAILED: ${msg}`);
+            providerErrors.set(providerName, msg);
+          }
+        });
+        await Promise.all(providerPromises);
+      }
+      const allFailed = totalSnapshotsInserted === 0 && providerErrors.size > 0;
+      const someFailed = providerErrors.size > 0;
+      if (allFailed) {
+        const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
+        this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq12(runs.id, runId)).run();
+      } else if (someFailed) {
+        const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
+        this.db.update(runs).set({ status: "partial", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq12(runs.id, runId)).run();
+      } else {
+        this.db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq12(runs.id, runId)).run();
+      }
+      for (const p of activeProviders) {
+        this.incrementUsage(`${projectId}:${p.adapter.name}`, "queries", queriesPerProvider);
+      }
+      this.incrementUsage(projectId, "runs", 1);
+      if (this.onRunCompleted) {
+        this.onRunCompleted(runId, projectId).catch((err) => {
+          console.error("[JobRunner] Notification callback failed:", err);
+        });
+      }
+    } catch (err) {
+      const errorMessage = err instanceof Error ? err.message : String(err);
+      this.db.update(runs).set({
+        status: "failed",
+        finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        error: errorMessage
+      }).where(eq12(runs.id, runId)).run();
+      if (this.onRunCompleted) {
+        this.onRunCompleted(runId, projectId).catch((notifErr) => {
+          console.error("[JobRunner] Notification callback failed:", notifErr);
+        });
+      }
+    }
+  }
+  async waitForRateLimit(window, maxPerMinute) {
+    const now = Date.now();
+    const windowStart = now - 6e4;
+    while (window.length > 0 && window[0] < windowStart) {
+      window.shift();
+    }
+    if (window.length >= maxPerMinute) {
+      const oldestInWindow = window[0];
+      const waitMs = oldestInWindow + 6e4 - now + 50;
+      await new Promise((resolve) => setTimeout(resolve, waitMs));
+      const nowAfterWait = Date.now();
+      const newWindowStart = nowAfterWait - 6e4;
+      while (window.length > 0 && window[0] < newWindowStart) {
+        window.shift();
+      }
+    }
+    window.push(Date.now());
+  }
+  incrementUsage(scope, metric, count) {
+    const now = /* @__PURE__ */ new Date();
+    const period = `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
+    const id = crypto11.randomUUID();
+    const existing = this.db.select().from(usageCounters).where(eq12(usageCounters.scope, scope)).all().find((r) => r.period === period && r.metric === metric);
+    if (existing) {
+      this.db.update(usageCounters).set({ count: existing.count + count, updatedAt: now.toISOString() }).where(eq12(usageCounters.id, existing.id)).run();
+    } else {
+      this.db.insert(usageCounters).values({
+        id,
+        scope,
+        period,
+        metric,
+        count,
+        updatedAt: now.toISOString()
+      }).run();
+    }
+  }
+};
+function getCurrentPeriod() {
+  const d = /* @__PURE__ */ new Date();
+  return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+function normalizeDomain(input) {
+  let domain = input;
+  try {
+    if (domain.includes("://")) {
+      domain = new URL(domain).hostname;
+    }
+  } catch {
+  }
+  return domain.replace(/^www\./, "");
+}
+function domainMatches(domain, canonicalDomain) {
+  const normalized = normalizeDomain(canonicalDomain);
+  const d = normalizeDomain(domain);
+  return d === normalized || d.endsWith(`.${normalized}`);
+}
+function determineCitationState(normalized, canonicalDomain) {
+  const bareDomain = normalizeDomain(canonicalDomain);
+  if (normalized.citedDomains.some((d) => domainMatches(d, bareDomain))) {
+    return "cited";
+  }
+  const lowerDomain = bareDomain.toLowerCase();
+  for (const source of normalized.groundingSources) {
+    try {
+      const uri = source.uri.toLowerCase();
+      if (uri.includes(lowerDomain)) {
+        return "cited";
+      }
+    } catch {
+    }
+    if (source.title) {
+      const titleLower = source.title.toLowerCase().replace(/^www\./, "");
+      if (titleLower === lowerDomain || titleLower.endsWith(`.${lowerDomain}`)) {
+        return "cited";
+      }
+    }
+  }
+  return "not-cited";
+}
+function computeCompetitorOverlap(normalized, competitorDomains) {
+  const overlapSet = /* @__PURE__ */ new Set();
+  for (const d of normalized.citedDomains) {
+    for (const cd of competitorDomains) {
+      if (domainMatches(d, cd)) {
+        overlapSet.add(cd);
+      }
+    }
+  }
+  for (const source of normalized.groundingSources) {
+    const uri = source.uri.toLowerCase();
+    for (const cd of competitorDomains) {
+      if (uri.includes(cd.toLowerCase())) {
+        overlapSet.add(cd);
+      }
+    }
+  }
+  if (normalized.answerText) {
+    const lowerAnswer = normalized.answerText.toLowerCase();
+    for (const cd of competitorDomains) {
+      if (lowerAnswer.includes(cd.toLowerCase())) {
+        overlapSet.add(cd);
+      }
+      const brand = cd.split(".")[0];
+      if (brand && brand.length >= 4 && new RegExp(`\\b${brand}\\b`, "i").test(lowerAnswer)) {
+        overlapSet.add(cd);
+      }
+    }
+  }
+  return [...overlapSet];
+}
+
+// src/provider-registry.ts
+var ProviderRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  register(adapter, config) {
+    this.providers.set(adapter.name, { adapter, config });
+  }
+  get(name) {
+    return this.providers.get(name);
+  }
+  getAll() {
+    return [...this.providers.values()];
+  }
+  getForProject(projectProviders) {
+    if (projectProviders.length === 0) {
+      return this.getAll();
+    }
+    const result = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const name of projectProviders) {
+      if (seen.has(name)) continue;
+      seen.add(name);
+      const provider = this.providers.get(name);
+      if (provider) {
+        result.push(provider);
+      }
+    }
+    return result;
+  }
+  get size() {
+    return this.providers.size;
+  }
+  async healthcheckAll() {
+    const results = /* @__PURE__ */ new Map();
+    const entries = [...this.providers.entries()];
+    const checks = entries.map(async ([name, { adapter, config }]) => {
+      const result = await adapter.healthcheck(config);
+      results.set(name, result);
+    });
+    await Promise.all(checks);
+    return results;
+  }
+};
+
+// src/scheduler.ts
+import cron from "node-cron";
+import { eq as eq13 } from "drizzle-orm";
+var Scheduler = class {
+  db;
+  callbacks;
+  tasks = /* @__PURE__ */ new Map();
+  constructor(db, callbacks) {
+    this.db = db;
+    this.callbacks = callbacks;
+  }
+  /** Load all enabled schedules from DB and register cron jobs. */
+  start() {
+    const allSchedules = this.db.select().from(schedules).where(eq13(schedules.enabled, 1)).all();
+    for (const schedule of allSchedules) {
+      const missedRunAt = schedule.nextRunAt;
+      this.registerCronTask(schedule);
+      if (missedRunAt && new Date(missedRunAt) < /* @__PURE__ */ new Date()) {
+        console.log(`[Scheduler] Catch-up run for project ${schedule.projectId} (missed ${missedRunAt})`);
+        this.triggerRun(schedule.id, schedule.projectId);
+      }
+    }
+    console.log(`[Scheduler] Started with ${allSchedules.length} schedule(s)`);
+  }
+  /** Stop all cron tasks for graceful shutdown. */
+  stop() {
+    for (const [projectId, task] of this.tasks) {
+      task.stop();
+      console.log(`[Scheduler] Stopped task for project ${projectId}`);
+    }
+    this.tasks.clear();
+  }
+  /** Add or update a cron registration at runtime (called when schedule API is used). */
+  upsert(projectId) {
+    const existing = this.tasks.get(projectId);
+    if (existing) {
+      existing.stop();
+      this.tasks.delete(projectId);
+    }
+    const schedule = this.db.select().from(schedules).where(eq13(schedules.projectId, projectId)).get();
+    if (schedule && schedule.enabled === 1) {
+      this.registerCronTask(schedule);
+    }
+  }
+  /** Remove a cron registration (called when schedule is deleted). */
+  remove(projectId) {
+    const existing = this.tasks.get(projectId);
+    if (existing) {
+      existing.stop();
+      this.tasks.delete(projectId);
+      console.log(`[Scheduler] Removed task for project ${projectId}`);
+    }
+  }
+  registerCronTask(schedule) {
+    const { id: scheduleId, projectId, cronExpr, timezone } = schedule;
+    if (!cron.validate(cronExpr)) {
+      console.error(`[Scheduler] Invalid cron expression for project ${projectId}: ${cronExpr}`);
+      return;
+    }
+    const task = cron.schedule(cronExpr, () => {
+      this.triggerRun(scheduleId, projectId);
+    }, {
+      timezone
+    });
+    this.tasks.set(projectId, task);
+    this.db.update(schedules).set({
+      nextRunAt: task.getNextRun()?.toISOString() ?? null,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).where(eq13(schedules.id, scheduleId)).run();
+    const label = schedule.preset ?? cronExpr;
+    console.log(`[Scheduler] Registered "${label}" (${timezone}) for project ${projectId}`);
+  }
+  triggerRun(scheduleId, projectId) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const currentSchedule = this.db.select().from(schedules).where(eq13(schedules.id, scheduleId)).get();
+    if (!currentSchedule || currentSchedule.enabled !== 1) {
+      console.log(`[Scheduler] Schedule ${scheduleId} no longer exists or is disabled, removing task for project ${projectId}`);
+      this.remove(projectId);
+      return;
+    }
+    const task = this.tasks.get(projectId);
+    const nextRunAt = task?.getNextRun()?.toISOString() ?? null;
+    const project = this.db.select().from(projects).where(eq13(projects.id, projectId)).get();
+    if (!project) {
+      console.error(`[Scheduler] Project ${projectId} not found, skipping scheduled run`);
+      this.remove(projectId);
+      return;
+    }
+    const queueResult = queueRunIfProjectIdle(this.db, {
+      createdAt: now,
+      kind: "answer-visibility",
+      projectId,
+      trigger: "scheduled"
+    });
+    if (queueResult.conflict) {
+      console.log(`[Scheduler] Skipping scheduled run for ${project.name} \u2014 run ${queueResult.activeRunId} already active`);
+      this.db.update(schedules).set({
+        nextRunAt,
+        updatedAt: now
+      }).where(eq13(schedules.id, currentSchedule.id)).run();
+      return;
+    }
+    const runId = queueResult.runId;
+    this.db.update(schedules).set({
+      lastRunAt: now,
+      nextRunAt,
+      updatedAt: now
+    }).where(eq13(schedules.id, currentSchedule.id)).run();
+    const scheduleProviders = JSON.parse(currentSchedule.providers);
+    const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
+    console.log(`[Scheduler] Triggered scheduled run ${runId} for project ${project.name}`);
+    this.callbacks.onRunCreated(runId, projectId, providers);
+  }
+};
+
+// src/notifier.ts
+import { eq as eq14, desc as desc2, and as and3, or as or2 } from "drizzle-orm";
+import crypto12 from "crypto";
+var Notifier = class {
+  db;
+  serverUrl;
+  constructor(db, serverUrl) {
+    this.db = db;
+    this.serverUrl = serverUrl;
+  }
+  /** Called after a run completes (success, partial, or failed). */
+  async onRunCompleted(runId, projectId) {
+    console.log(`[Notifier] onRunCompleted: runId=${runId} projectId=${projectId}`);
+    const notifs = this.db.select().from(notifications).where(eq14(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    if (notifs.length === 0) {
+      console.log(`[Notifier] No enabled notifications for project ${projectId} \u2014 skipping`);
+      return;
+    }
+    console.log(`[Notifier] Found ${notifs.length} enabled notification(s) for project ${projectId}`);
+    const run = this.db.select().from(runs).where(eq14(runs.id, runId)).get();
+    if (!run) {
+      console.error(`[Notifier] Run ${runId} not found \u2014 skipping notification dispatch`);
+      return;
+    }
+    const project = this.db.select().from(projects).where(eq14(projects.id, projectId)).get();
+    if (!project) {
+      console.error(`[Notifier] Project ${projectId} not found \u2014 skipping notification dispatch`);
+      return;
+    }
+    const transitions = this.computeTransitions(runId, projectId);
+    const events = [];
+    console.log(`[Notifier] Run status: ${run.status}`);
+    if (run.status === "completed" || run.status === "partial") {
+      events.push("run.completed");
+    }
+    if (run.status === "failed") {
+      events.push("run.failed");
+    }
+    const lostTransitions = transitions.filter((t) => t.to === "not-cited" && t.from === "cited");
+    const gainedTransitions = transitions.filter((t) => t.to === "cited" && t.from === "not-cited");
+    if (lostTransitions.length > 0) events.push("citation.lost");
+    if (gainedTransitions.length > 0) events.push("citation.gained");
+    for (const notif of notifs) {
+      const config = JSON.parse(notif.config);
+      const subscribedEvents = config.events;
+      const matchingEvents = events.filter((e) => subscribedEvents.includes(e));
+      console.log(`[Notifier] Notification ${notif.id}: subscribed=${JSON.stringify(subscribedEvents)} matched=${JSON.stringify(matchingEvents)}`);
+      if (matchingEvents.length === 0) continue;
+      for (const event of matchingEvents) {
+        const relevantTransitions = event === "citation.lost" ? lostTransitions : event === "citation.gained" ? gainedTransitions : transitions;
+        const payload = {
+          source: "canonry",
+          event,
+          project: { name: project.name, canonicalDomain: project.canonicalDomain },
+          run: { id: run.id, status: run.status, finishedAt: run.finishedAt },
+          transitions: relevantTransitions,
+          dashboardUrl: `${this.serverUrl}/projects/${project.name}`
+        };
+        await this.sendWebhook(config.url, payload, notif.id, projectId, notif.webhookSecret ?? null);
+      }
+    }
+  }
+  computeTransitions(runId, projectId) {
+    const recentRuns = this.db.select().from(runs).where(
+      and3(
+        eq14(runs.projectId, projectId),
+        or2(eq14(runs.status, "completed"), eq14(runs.status, "partial"))
+      )
+    ).orderBy(desc2(runs.createdAt)).limit(2).all();
+    if (recentRuns.length < 2) return [];
+    const currentRunId = recentRuns[0].id;
+    const previousRunId = recentRuns[1].id;
+    if (currentRunId !== runId) return [];
+    const currentSnapshots = this.db.select({
+      keywordId: querySnapshots.keywordId,
+      keyword: keywords.keyword,
+      provider: querySnapshots.provider,
+      citationState: querySnapshots.citationState
+    }).from(querySnapshots).leftJoin(keywords, eq14(querySnapshots.keywordId, keywords.id)).where(eq14(querySnapshots.runId, currentRunId)).all();
+    const previousSnapshots = this.db.select({
+      keywordId: querySnapshots.keywordId,
+      provider: querySnapshots.provider,
+      citationState: querySnapshots.citationState
+    }).from(querySnapshots).where(eq14(querySnapshots.runId, previousRunId)).all();
+    const prevMap = /* @__PURE__ */ new Map();
+    for (const s of previousSnapshots) {
+      prevMap.set(`${s.keywordId}:${s.provider}`, s.citationState);
+    }
+    const transitions = [];
+    for (const s of currentSnapshots) {
+      const key = `${s.keywordId}:${s.provider}`;
+      const prevState = prevMap.get(key);
+      if (prevState && prevState !== s.citationState) {
+        transitions.push({
+          keyword: s.keyword ?? s.keywordId,
+          from: prevState,
+          to: s.citationState,
+          provider: s.provider
+        });
+      }
+    }
+    return transitions;
+  }
+  async sendWebhook(url, payload, notificationId, projectId, webhookSecret) {
+    const targetCheck = await resolveWebhookTarget(url);
+    if (!targetCheck.ok) {
+      console.error(`[Notifier] Webhook URL blocked by SSRF check: ${url}`);
+      this.logDelivery(projectId, notificationId, payload.event, "failed", `SSRF: ${targetCheck.message}`);
+      return;
+    }
+    console.log(`[Notifier] Sending webhook event="${payload.event}" to ${url}`);
+    const maxRetries = 3;
+    const delays = [1e3, 4e3, 16e3];
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+      try {
+        const response = await deliverWebhook(targetCheck.target, payload, webhookSecret);
+        if (response.status >= 200 && response.status < 300) {
+          console.log(`[Notifier] Webhook delivered: event="${payload.event}" status=${response.status}`);
+          this.logDelivery(projectId, notificationId, payload.event, "sent", null);
+          return;
+        }
+        const errorDetail = response.error ?? `HTTP ${response.status}`;
+        console.warn(`[Notifier] Webhook attempt ${attempt + 1}/${maxRetries} failed: ${errorDetail}`);
+        if (attempt === maxRetries - 1) {
+          this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
+        }
+      } catch (err) {
+        const errorDetail = err instanceof Error ? err.message : String(err);
+        if (attempt === maxRetries - 1) {
+          this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
+          console.error(`[Notifier] Failed to deliver webhook after ${maxRetries} attempts: ${errorDetail}`);
+        }
+      }
+      if (attempt < maxRetries - 1) {
+        await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
+      }
+    }
+  }
+  logDelivery(projectId, notificationId, event, status, error) {
+    this.db.insert(auditLog).values({
+      id: crypto12.randomUUID(),
+      projectId,
+      actor: "scheduler",
+      action: `notification.${status}`,
+      entityType: "notification",
+      entityId: notificationId,
+      diff: JSON.stringify({ event, error }),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
+  }
+};
+
+// src/server.ts
+var DEFAULT_QUOTA = {
+  maxConcurrency: 2,
+  maxRequestsPerMinute: 10,
+  maxRequestsPerDay: 1e3
+};
+async function createServer(opts) {
+  const app = Fastify({
+    logger: {
+      transport: {
+        target: "pino-pretty",
+        options: {
+          colorize: true,
+          translateTime: "HH:MM:ss",
+          ignore: "pid,hostname,reqId",
+          messageFormat: "{msg} {req.method} {req.url}"
+        }
+      }
+    }
+  });
+  const registry = new ProviderRegistry();
+  const providers = opts.config.providers ?? {};
+  if (opts.config.geminiApiKey && !providers.gemini) {
+    providers.gemini = {
+      apiKey: opts.config.geminiApiKey,
+      model: opts.config.geminiModel,
+      quota: opts.config.geminiQuota
+    };
+  }
+  console.log("[Server] Configured providers:", Object.keys(providers).filter((k) => {
+    const p = providers[k];
+    return p?.apiKey || p?.baseUrl;
+  }));
+  if (providers.gemini?.apiKey) {
+    registry.register(geminiAdapter, {
+      provider: "gemini",
+      apiKey: providers.gemini.apiKey,
+      model: providers.gemini.model,
+      quotaPolicy: providers.gemini.quota ?? DEFAULT_QUOTA
+    });
+  }
+  if (providers.openai?.apiKey) {
+    registry.register(openaiAdapter, {
+      provider: "openai",
+      apiKey: providers.openai.apiKey,
+      model: providers.openai.model,
+      quotaPolicy: providers.openai.quota ?? DEFAULT_QUOTA
+    });
+  }
+  if (providers.claude?.apiKey) {
+    registry.register(claudeAdapter, {
+      provider: "claude",
+      apiKey: providers.claude.apiKey,
+      model: providers.claude.model,
+      quotaPolicy: providers.claude.quota ?? DEFAULT_QUOTA
+    });
+  }
+  if (providers.local?.baseUrl) {
+    registry.register(localAdapter, {
+      provider: "local",
+      apiKey: providers.local.apiKey,
+      baseUrl: providers.local.baseUrl,
+      model: providers.local.model,
+      quotaPolicy: providers.local.quota ?? DEFAULT_QUOTA
+    });
+  }
+  const port = opts.config.port ?? 4100;
+  const serverUrl = `http://localhost:${port}`;
+  const jobRunner = new JobRunner(opts.db, registry);
+  const notifier = new Notifier(opts.db, serverUrl);
+  jobRunner.onRunCompleted = (runId, projectId) => notifier.onRunCompleted(runId, projectId);
+  const scheduler = new Scheduler(opts.db, {
+    onRunCreated: (runId, projectId, providers2) => {
+      jobRunner.executeRun(runId, projectId, providers2).catch((err) => {
+        app.log.error({ runId, err }, "Scheduled job runner failed");
+      });
+    }
+  });
+  const providerSummary = ["gemini", "openai", "claude", "local"].map((name) => ({
+    name,
+    model: registry.get(name)?.config.model,
+    configured: !!registry.get(name),
+    quota: registry.get(name)?.config.quotaPolicy
+  }));
+  const adapterMap = { gemini: geminiAdapter, openai: openaiAdapter, claude: claudeAdapter, local: localAdapter };
+  await app.register(apiRoutes, {
+    db: opts.db,
+    skipAuth: false,
+    providerSummary,
+    onRunCreated: (runId, projectId, providers2) => {
+      jobRunner.executeRun(runId, projectId, providers2).catch((err) => {
+        app.log.error({ runId, err }, "Job runner failed");
+      });
+    },
+    onProviderUpdate: (providerName, apiKey, model, baseUrl) => {
+      const name = providerName;
+      if (!(name in adapterMap)) return null;
+      if (!opts.config.providers) opts.config.providers = {};
+      const existing = opts.config.providers[name];
+      opts.config.providers[name] = {
+        apiKey: apiKey || existing?.apiKey,
+        baseUrl: baseUrl || existing?.baseUrl,
+        model: model || existing?.model,
+        quota: existing?.quota
+      };
+      try {
+        saveConfig(opts.config);
+      } catch (err) {
+        app.log.error({ err }, "Failed to save config");
+        return null;
+      }
+      const quota = opts.config.providers[name].quota ?? DEFAULT_QUOTA;
+      registry.register(adapterMap[name], {
+        provider: name,
+        apiKey: apiKey || existing?.apiKey,
+        baseUrl: baseUrl || existing?.baseUrl,
+        model: model || existing?.model,
+        quotaPolicy: quota
+      });
+      const entry = providerSummary.find((p) => p.name === name);
+      if (entry) {
+        entry.configured = true;
+        entry.model = model || registry.get(name)?.config.model;
+        entry.quota = quota;
+      }
+      return {
+        name,
+        model: entry?.model,
+        configured: true,
+        quota
+      };
+    },
+    onScheduleUpdated: (action, projectId) => {
+      if (action === "upsert") scheduler.upsert(projectId);
+      if (action === "delete") scheduler.remove(projectId);
+    },
+    onProjectDeleted: (projectId) => {
+      scheduler.remove(projectId);
+    }
+  });
+  const dirname2 = path2.dirname(fileURLToPath(import.meta.url));
+  const assetsDir = path2.join(dirname2, "..", "assets");
+  if (fs2.existsSync(assetsDir)) {
+    const indexPath = path2.join(assetsDir, "index.html");
+    const injectConfig = (html) => {
+      const configScript = `<script>window.__CANONRY_CONFIG__=${JSON.stringify({ apiKey: opts.config.apiKey })}</script>`;
+      return html.replace("</head>", `${configScript}</head>`);
+    };
+    const fastifyStatic = await import("@fastify/static");
+    await app.register(fastifyStatic.default, {
+      root: assetsDir,
+      prefix: "/",
+      wildcard: false,
+      // Don't serve index.html automatically — we handle it with config injection
+      serve: true,
+      index: false
+    });
+    app.get("/", (_request, reply) => {
+      if (fs2.existsSync(indexPath)) {
+        const html = fs2.readFileSync(indexPath, "utf-8");
+        return reply.type("text/html").send(injectConfig(html));
+      }
+      return reply.status(404).send({ error: "Dashboard not built" });
+    });
+    app.setNotFoundHandler((request, reply) => {
+      if (request.url.startsWith("/api/")) {
+        return reply.status(404).send({ error: "Not found", path: request.url });
+      }
+      if (fs2.existsSync(indexPath)) {
+        const html = fs2.readFileSync(indexPath, "utf-8");
+        return reply.type("text/html").send(injectConfig(html));
+      }
+      return reply.status(404).send({ error: "Not found" });
+    });
+  }
+  app.get("/health", async () => ({
+    status: "ok",
+    service: "canonry",
+    version: "0.1.0"
+  }));
+  scheduler.start();
+  app.addHook("onClose", async () => {
+    scheduler.stop();
+  });
+  return app;
+}
+
+export {
+  getConfigDir,
+  getConfigPath,
+  loadConfig,
+  saveConfig,
+  configExists,
+  apiKeys,
+  createClient,
+  migrate,
+  createServer
+};