@ainyc/canonry 1.12.0 → 1.13.3

package/dist/{chunk-O4HLQBL7.js → chunk-JKIWFSYI.js}

@@ -63,6 +63,15 @@ Do not write config.yaml by hand; use "canonry init", "canonry settings", or "ca
     };
   }
   normalizeGoogleConfig(parsed);
+  const portOverride = process.env.CANONRY_PORT?.trim();
+  if (portOverride) {
+    try {
+      const url = new URL(parsed.apiUrl);
+      url.port = portOverride;
+      parsed.apiUrl = url.origin;
+    } catch {
+    }
+  }
   return parsed;
 }
 function saveConfig(config) {
@@ -151,7 +160,7 @@ function trackEvent(event, properties) {
 
 // src/server.ts
 import { createRequire as createRequire2 } from "module";
-import crypto16 from "crypto";
+import crypto18 from "crypto";
 import fs2 from "fs";
 import path2 from "path";
 import { fileURLToPath } from "url";
@@ -174,6 +183,7 @@ __export(schema_exports, {
   auditLog: () => auditLog,
   competitors: () => competitors,
   googleConnections: () => googleConnections,
+  gscCoverageSnapshots: () => gscCoverageSnapshots,
   gscSearchData: () => gscSearchData,
   gscUrlInspections: () => gscUrlInspections,
   keywords: () => keywords,
@@ -196,6 +206,8 @@ var projects = sqliteTable("projects", {
   tags: text("tags").notNull().default("[]"),
   labels: text("labels").notNull().default("{}"),
   providers: text("providers").notNull().default("[]"),
+  locations: text("locations").notNull().default("[]"),
+  defaultLocation: text("default_location"),
   configSource: text("config_source").notNull().default("cli"),
   configRevision: integer("config_revision").notNull().default(1),
   createdAt: text("created_at").notNull(),
@@ -225,6 +237,7 @@ var runs = sqliteTable("runs", {
   kind: text("kind").notNull().default("answer-visibility"),
   status: text("status").notNull().default("queued"),
   trigger: text("trigger").notNull().default("manual"),
+  location: text("location"),
   startedAt: text("started_at"),
   finishedAt: text("finished_at"),
   error: text("error"),
@@ -243,6 +256,7 @@ var querySnapshots = sqliteTable("query_snapshots", {
   answerText: text("answer_text"),
   citedDomains: text("cited_domains").notNull().default("[]"),
   competitorOverlap: text("competitor_overlap").notNull().default("[]"),
+  location: text("location"),
   rawResponse: text("raw_response"),
   createdAt: text("created_at").notNull()
 }, (table) => [
@@ -356,6 +370,19 @@ var gscUrlInspections = sqliteTable("gsc_url_inspections", {
   index("idx_gsc_inspect_run").on(table.syncRunId),
   index("idx_gsc_inspect_url_time").on(table.url, table.inspectedAt)
 ]);
+var gscCoverageSnapshots = sqliteTable("gsc_coverage_snapshots", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  syncRunId: text("sync_run_id").references(() => runs.id, { onDelete: "cascade" }),
+  date: text("date").notNull(),
+  indexed: integer("indexed").notNull().default(0),
+  notIndexed: integer("not_indexed").notNull().default(0),
+  reasonBreakdown: text("reason_breakdown").notNull().default("{}"),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  index("idx_gsc_coverage_snap_project_date").on(table.projectId, table.date),
+  index("idx_gsc_coverage_snap_run").on(table.syncRunId)
+]);
 var usageCounters = sqliteTable("usage_counters", {
   id: text("id").primaryKey(),
   scope: text("scope").notNull(),
@@ -573,7 +600,26 @@ var MIGRATIONS = [
   )`,
   `CREATE INDEX IF NOT EXISTS idx_gsc_inspect_project_url ON gsc_url_inspections(project_id, url)`,
   `CREATE INDEX IF NOT EXISTS idx_gsc_inspect_run ON gsc_url_inspections(sync_run_id)`,
-  `CREATE INDEX IF NOT EXISTS idx_gsc_inspect_url_time ON gsc_url_inspections(url, inspected_at)`
+  `CREATE INDEX IF NOT EXISTS idx_gsc_inspect_url_time ON gsc_url_inspections(url, inspected_at)`,
+  // v7: GSC coverage snapshots for historical tracking
+  `CREATE TABLE IF NOT EXISTS gsc_coverage_snapshots (
+    id              TEXT PRIMARY KEY,
+    project_id      TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+    sync_run_id     TEXT REFERENCES runs(id) ON DELETE CASCADE,
+    date            TEXT NOT NULL,
+    indexed         INTEGER NOT NULL DEFAULT 0,
+    not_indexed     INTEGER NOT NULL DEFAULT 0,
+    reason_breakdown TEXT NOT NULL DEFAULT '{}',
+    created_at      TEXT NOT NULL
+  )`,
+  `CREATE INDEX IF NOT EXISTS idx_gsc_coverage_snap_project_date ON gsc_coverage_snapshots(project_id, date)`,
+  `CREATE INDEX IF NOT EXISTS idx_gsc_coverage_snap_run ON gsc_coverage_snapshots(sync_run_id)`,
+  // v8: Location-aware sweeps — project locations + snapshot location tag
+  `ALTER TABLE projects ADD COLUMN locations TEXT NOT NULL DEFAULT '[]'`,
+  `ALTER TABLE projects ADD COLUMN default_location TEXT`,
+  `ALTER TABLE query_snapshots ADD COLUMN location TEXT`,
+  // v9: Add location column to runs for per-location run tracking
+  `ALTER TABLE runs ADD COLUMN location TEXT`
 ];
 function migrate(db) {
   const statements = MIGRATION_SQL.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
@@ -604,6 +650,13 @@ function parseProviderName(input) {
   const lower = input.trim().toLowerCase();
   return PROVIDER_NAMES.includes(lower) ? lower : void 0;
 }
+var locationContextSchema = z.object({
+  label: z.string().min(1),
+  city: z.string().min(1),
+  region: z.string().min(1),
+  country: z.string().length(2),
+  timezone: z.string().optional()
+});
 
 // ../contracts/src/notification.ts
 import { z as z2 } from "zod";
@@ -664,6 +717,8 @@ var configSpecSchema = z3.object({
   keywords: z3.array(z3.string().min(1)).optional().default([]),
   competitors: z3.array(z3.string().min(1)).optional().default([]),
   providers: z3.array(providerNameSchema).optional().default([]),
+  locations: z3.array(locationContextSchema).optional().default([]),
+  defaultLocation: z3.string().optional(),
   schedule: configScheduleSchema,
   notifications: z3.array(configNotificationSchema).optional().default([]),
   google: configGoogleSchema
@@ -806,6 +861,37 @@ var gscUrlInspectionDtoSchema = z4.object({
   inspectedAt: z4.string()
 });
 var indexTransitionSchema = z4.enum(["stable", "reindexed", "deindexed", "still-missing", "new"]);
+var gscDeindexedRowSchema = z4.object({
+  url: z4.string(),
+  previousState: z4.string().nullable(),
+  currentState: z4.string().nullable(),
+  transitionDate: z4.string()
+});
+var gscReasonGroupSchema = z4.object({
+  reason: z4.string(),
+  count: z4.number(),
+  urls: z4.array(gscUrlInspectionDtoSchema).default([])
+});
+var gscCoverageSummaryDtoSchema = z4.object({
+  summary: z4.object({
+    total: z4.number(),
+    indexed: z4.number(),
+    notIndexed: z4.number(),
+    deindexed: z4.number(),
+    percentage: z4.number()
+  }),
+  lastInspectedAt: z4.string().nullable(),
+  indexed: z4.array(gscUrlInspectionDtoSchema).default([]),
+  notIndexed: z4.array(gscUrlInspectionDtoSchema).default([]),
+  deindexed: z4.array(gscDeindexedRowSchema).default([]),
+  reasonGroups: z4.array(gscReasonGroupSchema).default([])
+});
+var gscCoverageSnapshotDtoSchema = z4.object({
+  date: z4.string(),
+  indexed: z4.number(),
+  notIndexed: z4.number(),
+  reasonBreakdown: z4.record(z4.string(), z4.number()).default({})
+});
 
 // ../contracts/src/project.ts
 import { z as z5 } from "zod";
@@ -820,6 +906,8 @@ var projectDtoSchema = z5.object({
   language: z5.string().min(2),
   tags: z5.array(z5.string()).default([]),
   labels: z5.record(z5.string(), z5.string()).default({}),
+  locations: z5.array(locationContextSchema).default([]),
+  defaultLocation: z5.string().nullable().optional(),
   configSource: configSourceSchema.default("cli"),
   configRevision: z5.number().int().positive().default(1),
   createdAt: z5.string().optional(),
@@ -853,7 +941,7 @@ function effectiveDomains(project) {
 // ../contracts/src/run.ts
 import { z as z6 } from "zod";
 var runStatusSchema = z6.enum(["queued", "running", "completed", "partial", "failed"]);
-var runKindSchema = z6.enum(["answer-visibility", "site-audit", "gsc-sync"]);
+var runKindSchema = z6.enum(["answer-visibility", "site-audit", "gsc-sync", "inspect-sitemap"]);
 var runTriggerSchema = z6.enum(["manual", "scheduled", "config-apply"]);
 var citationStateSchema = z6.enum(["cited", "not-cited"]);
 var computedTransitionSchema = z6.enum(["new", "cited", "lost", "emerging", "not-cited"]);
@@ -863,6 +951,7 @@ var runDtoSchema = z6.object({
   kind: runKindSchema,
   status: runStatusSchema,
   trigger: runTriggerSchema.default("manual"),
+  location: z6.string().nullable().optional(),
   startedAt: z6.string().nullable().optional(),
   finishedAt: z6.string().nullable().optional(),
   error: z6.string().nullable().optional(),
@@ -886,6 +975,7 @@ var querySnapshotDtoSchema = z6.object({
   groundingSources: z6.array(groundingSourceSchema).default([]),
   searchQueries: z6.array(z6.string()).default([]),
   model: z6.string().nullable().optional(),
+  location: z6.string().nullable().optional(),
   createdAt: z6.string()
 });
 var auditLogEntrySchema = z6.object({
@@ -1004,6 +1094,8 @@ async function projectRoutes(app, opts) {
         tags: JSON.stringify(body.tags ?? []),
         labels: JSON.stringify(body.labels ?? {}),
         providers: JSON.stringify(body.providers ?? []),
+        locations: JSON.stringify(body.locations ?? JSON.parse(existing.locations || "[]")),
+        defaultLocation: body.defaultLocation !== void 0 ? body.defaultLocation ?? null : existing.defaultLocation,
         configSource: body.configSource ?? "api",
         configRevision: existing.configRevision + 1,
         updatedAt: now
@@ -1030,6 +1122,8 @@ async function projectRoutes(app, opts) {
       tags: JSON.stringify(body.tags ?? []),
       labels: JSON.stringify(body.labels ?? {}),
       providers: JSON.stringify(body.providers ?? []),
+      locations: JSON.stringify(body.locations ?? []),
+      defaultLocation: body.defaultLocation ?? null,
       configSource: body.configSource ?? "api",
       configRevision: 1,
       createdAt: now,
@@ -1083,6 +1177,131 @@ async function projectRoutes(app, opts) {
     opts.onProjectDeleted?.(project.id);
     return reply.status(204).send();
   });
+  app.post("/projects/:name/locations", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    const parsed = locationContextSchema.safeParse(request.body);
+    if (!parsed.success) {
+      const err = validationError(parsed.error.issues.map((i) => i.message).join(", "));
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const location = parsed.data;
+    const existing = JSON.parse(project.locations || "[]");
+    if (existing.some((l) => l.label === location.label)) {
+      const err = validationError(`Location "${location.label}" already exists`);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    existing.push(location);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.update(projects).set({
+      locations: JSON.stringify(existing),
+      updatedAt: now
+    }).where(eq3(projects.id, project.id)).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "location.added",
+      entityType: "location",
+      entityId: location.label
+    });
+    return reply.status(201).send(location);
+  });
+  app.get("/projects/:name/locations", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    const locations = JSON.parse(project.locations || "[]");
+    return reply.send({
+      locations,
+      defaultLocation: project.defaultLocation
+    });
+  });
+  app.delete("/projects/:name/locations/:label", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    const label = decodeURIComponent(request.params.label);
+    const existing = JSON.parse(project.locations || "[]");
+    const filtered = existing.filter((l) => l.label !== label);
+    if (filtered.length === existing.length) {
+      const err = validationError(`Location "${label}" not found`);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const updates = {
+      locations: JSON.stringify(filtered),
+      updatedAt: now
+    };
+    if (project.defaultLocation === label) {
+      updates.defaultLocation = null;
+    }
+    app.db.update(projects).set(updates).where(eq3(projects.id, project.id)).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "location.removed",
+      entityType: "location",
+      entityId: label
+    });
+    return reply.status(204).send();
+  });
+  app.put("/projects/:name/locations/default", async (request, reply) => {
+    let project;
+    try {
+      project = resolveProject(app.db, request.params.name);
+    } catch (e) {
+      if (e && typeof e === "object" && "statusCode" in e && "toJSON" in e) {
+        const err = e;
+        return reply.status(err.statusCode).send(err.toJSON());
+      }
+      throw e;
+    }
+    const label = request.body?.label;
+    if (!label) {
+      const err = validationError("label is required");
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const existing = JSON.parse(project.locations || "[]");
+    if (!existing.some((l) => l.label === label)) {
+      const err = validationError(`Location "${label}" not found. Add it first.`);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.update(projects).set({
+      defaultLocation: label,
+      updatedAt: now
+    }).where(eq3(projects.id, project.id)).run();
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "location.default-set",
+      entityType: "location",
+      entityId: label
+    });
+    return reply.send({ defaultLocation: label });
+  });
   app.get("/projects/:name/export", async (request, reply) => {
     let project;
     try {
@@ -1114,6 +1333,8 @@ async function projectRoutes(app, opts) {
         keywords: kws.map((k) => k.keyword),
         competitors: comps.map((c) => c.domain),
         providers: JSON.parse(project.providers || "[]"),
+        locations: JSON.parse(project.locations || "[]"),
+        ...project.defaultLocation ? { defaultLocation: project.defaultLocation } : {},
         notifications: notificationRows.map((row) => {
           const cfg = JSON.parse(row.config);
           return {
@@ -1146,6 +1367,8 @@ function formatProject(row) {
     tags: JSON.parse(row.tags),
     labels: JSON.parse(row.labels),
     providers: JSON.parse(row.providers || "[]"),
+    locations: JSON.parse(row.locations || "[]"),
+    defaultLocation: row.defaultLocation,
     configSource: row.configSource,
     configRevision: row.configRevision,
     createdAt: row.createdAt,
@@ -1193,6 +1416,34 @@ async function keywordRoutes(app, opts) {
     const rows = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
     return reply.send(rows.map((r) => ({ id: r.id, keyword: r.keyword, createdAt: r.createdAt })));
   });
+  app.delete("/projects/:name/keywords", async (request, reply) => {
+    const project = resolveProjectSafe(app, request.params.name, reply);
+    if (!project) return;
+    const body = request.body;
+    if (!body || !Array.isArray(body.keywords) || body.keywords.length === 0) {
+      const err = validationError('Body must contain a non-empty "keywords" array');
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const existing = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    const toDelete = new Set(body.keywords);
+    const idsToDelete = existing.filter((k) => toDelete.has(k.keyword)).map((k) => k.id);
+    if (idsToDelete.length > 0) {
+      app.db.transaction((tx) => {
+        for (const id of idsToDelete) {
+          tx.delete(keywords).where(eq4(keywords.id, id)).run();
+        }
+        writeAuditLog(tx, {
+          projectId: project.id,
+          actor: "api",
+          action: "keywords.deleted",
+          entityType: "keyword",
+          diff: { deleted: body.keywords.filter((kw) => existing.some((e) => e.keyword === kw)) }
+        });
+      });
+    }
+    const rows = app.db.select().from(keywords).where(eq4(keywords.projectId, project.id)).all();
+    return reply.send(rows.map((r) => ({ id: r.id, keyword: r.keyword, createdAt: r.createdAt })));
+  });
   app.post("/projects/:name/keywords", async (request, reply) => {
     const project = resolveProjectSafe(app, request.params.name, reply);
     if (!project) return;
@@ -1337,6 +1588,7 @@ function resolveProjectSafe2(app, name, reply) {
 }
 
 // ../api-routes/src/runs.ts
+import crypto8 from "crypto";
 import { eq as eq7, asc } from "drizzle-orm";
 
 // ../api-routes/src/run-queue.ts
@@ -1363,6 +1615,7 @@ function queueRunIfProjectIdle(db, params) {
       kind,
       status: "queued",
       trigger,
+      location: params.location ?? null,
       createdAt
     }).run();
     return { conflict: false, runId };
@@ -1391,11 +1644,60 @@ async function runRoutes(app, opts) {
       rawProviders.splice(0, rawProviders.length, ...parsed.filter(Boolean));
     }
     const providers = rawProviders?.length ? rawProviders : void 0;
+    let resolvedLocation;
+    const projectLocations = JSON.parse(project.locations || "[]");
+    if (request.body?.noLocation) {
+      resolvedLocation = null;
+    } else if (request.body?.allLocations) {
+    } else if (request.body?.location) {
+      const loc = projectLocations.find((l) => l.label === request.body.location);
+      if (!loc) {
+        return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: `Location "${request.body.location}" not found. Configure it first.` } });
+      }
+      resolvedLocation = loc;
+    }
+    if (request.body?.allLocations) {
+      if (projectLocations.length === 0) {
+        return reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "No locations configured for this project" } });
+      }
+      const newRuns = [];
+      for (const loc of projectLocations) {
+        const runId2 = crypto8.randomUUID();
+        app.db.insert(runs).values({
+          id: runId2,
+          projectId: project.id,
+          kind,
+          status: "queued",
+          trigger,
+          location: loc.label,
+          createdAt: now
+        }).run();
+        newRuns.push({ runId: runId2, loc });
+      }
+      const results = [];
+      for (const { runId: runId2, loc } of newRuns) {
+        writeAuditLog(app.db, {
+          projectId: project.id,
+          actor: "api",
+          action: "run.created",
+          entityType: "run",
+          entityId: runId2
+        });
+        const r = app.db.select().from(runs).where(eq7(runs.id, runId2)).get();
+        if (opts.onRunCreated) {
+          opts.onRunCreated(runId2, project.id, providers, loc);
+        }
+        results.push({ ...formatRun(r), location: loc.label });
+      }
+      return reply.status(207).send(results);
+    }
+    const locationLabel = resolvedLocation?.label ?? null;
     const queueResult = queueRunIfProjectIdle(app.db, {
       createdAt: now,
       kind,
       projectId: project.id,
-      trigger
+      trigger,
+      location: locationLabel
     });
     if (queueResult.conflict) {
       const err = runInProgress(project.name);
@@ -1411,7 +1713,7 @@ async function runRoutes(app, opts) {
     });
     const run = app.db.select().from(runs).where(eq7(runs.id, runId)).get();
     if (opts.onRunCreated) {
-      opts.onRunCreated(runId, project.id, providers);
+      opts.onRunCreated(runId, project.id, providers, resolvedLocation);
     }
     return reply.status(201).send(formatRun(run));
   });
@@ -1490,6 +1792,7 @@ async function runRoutes(app, opts) {
       answerText: querySnapshots.answerText,
       citedDomains: querySnapshots.citedDomains,
       competitorOverlap: querySnapshots.competitorOverlap,
+      location: querySnapshots.location,
       rawResponse: querySnapshots.rawResponse,
       createdAt: querySnapshots.createdAt
     }).from(querySnapshots).leftJoin(keywords, eq7(querySnapshots.keywordId, keywords.id)).where(eq7(querySnapshots.runId, run.id)).all();
@@ -1508,6 +1811,7 @@ async function runRoutes(app, opts) {
           citedDomains: tryParseJson(s.citedDomains, []),
           competitorOverlap: tryParseJson(s.competitorOverlap, []),
           model: s.model ?? rawParsed.model,
+          location: s.location,
           groundingSources: rawParsed.groundingSources,
           searchQueries: rawParsed.searchQueries,
           createdAt: s.createdAt
@@ -1523,6 +1827,7 @@ function formatRun(row) {
     kind: row.kind,
     status: row.status,
     trigger: row.trigger,
+    location: row.location,
     startedAt: row.startedAt,
     finishedAt: row.finishedAt,
     error: row.error,
@@ -1558,7 +1863,7 @@ function resolveProjectSafe3(app, name, reply) {
 }
 
 // ../api-routes/src/apply.ts
-import crypto9 from "crypto";
+import crypto10 from "crypto";
 import { eq as eq8 } from "drizzle-orm";
 
 // ../api-routes/src/schedule-utils.ts
@@ -1650,7 +1955,7 @@ function isValidTimezone(tz) {
 }
 
 // ../api-routes/src/webhooks.ts
-import crypto8 from "crypto";
+import crypto9 from "crypto";
 import dns from "dns/promises";
 import http from "http";
 import https from "https";
@@ -1702,7 +2007,7 @@ async function deliverWebhook(target, payload, webhookSecret) {
     "User-Agent": "Canonry/0.1.0"
   };
   if (webhookSecret) {
-    headers["X-Canonry-Signature"] = "sha256=" + crypto8.createHmac("sha256", webhookSecret).update(body).digest("hex");
+    headers["X-Canonry-Signature"] = "sha256=" + crypto9.createHmac("sha256", webhookSecret).update(body).digest("hex");
   }
   return await new Promise((resolve) => {
     const requestOptions = {
@@ -1833,6 +2138,8 @@ async function applyRoutes(app, opts) {
         language: config.spec.language,
         labels: JSON.stringify(config.metadata.labels),
         providers: JSON.stringify(config.spec.providers ?? []),
+        locations: JSON.stringify(config.spec.locations ?? []),
+        defaultLocation: config.spec.defaultLocation ?? null,
         configSource: "config-file",
         configRevision: existing.configRevision + 1,
         updatedAt: now
@@ -1845,7 +2152,7 @@ async function applyRoutes(app, opts) {
         entityId: projectId
       });
     } else {
-      projectId = crypto9.randomUUID();
+      projectId = crypto10.randomUUID();
       app.db.insert(projects).values({
         id: projectId,
         name,
@@ -1857,6 +2164,8 @@ async function applyRoutes(app, opts) {
         tags: "[]",
         labels: JSON.stringify(config.metadata.labels),
         providers: JSON.stringify(config.spec.providers ?? []),
+        locations: JSON.stringify(config.spec.locations ?? []),
+        defaultLocation: config.spec.defaultLocation ?? null,
         configSource: "config-file",
         configRevision: 1,
         createdAt: now,
@@ -1874,7 +2183,7 @@ async function applyRoutes(app, opts) {
       tx.delete(keywords).where(eq8(keywords.projectId, projectId)).run();
       for (const kw of config.spec.keywords) {
         tx.insert(keywords).values({
-          id: crypto9.randomUUID(),
+          id: crypto10.randomUUID(),
           projectId,
           keyword: kw,
           createdAt: now
@@ -1890,7 +2199,7 @@ async function applyRoutes(app, opts) {
       tx.delete(competitors).where(eq8(competitors.projectId, projectId)).run();
       for (const domain of config.spec.competitors) {
         tx.insert(competitors).values({
-          id: crypto9.randomUUID(),
+          id: crypto10.randomUUID(),
           projectId,
           domain,
           createdAt: now
@@ -1946,7 +2255,7 @@ async function applyRoutes(app, opts) {
         }).where(eq8(schedules.id, existingSched.id)).run();
       } else {
         app.db.insert(schedules).values({
-          id: crypto9.randomUUID(),
+          id: crypto10.randomUUID(),
           projectId,
           cronExpr,
           preset,
@@ -1978,11 +2287,11 @@ async function applyRoutes(app, opts) {
       app.db.delete(notifications).where(eq8(notifications.projectId, projectId)).run();
       for (const notif of config.spec.notifications) {
         app.db.insert(notifications).values({
-          id: crypto9.randomUUID(),
+          id: crypto10.randomUUID(),
           projectId,
           channel: notif.channel,
           config: JSON.stringify({ url: notif.url, events: notif.events }),
-          webhookSecret: crypto9.randomBytes(32).toString("hex"),
+          webhookSecret: crypto10.randomBytes(32).toString("hex"),
           enabled: 1,
           createdAt: now,
           updatedAt: now
@@ -2011,6 +2320,8 @@ async function applyRoutes(app, opts) {
       tags: JSON.parse(project.tags),
       labels: JSON.parse(project.labels),
       providers: JSON.parse(project.providers || "[]"),
+      locations: JSON.parse(project.locations || "[]"),
+      defaultLocation: project.defaultLocation,
       configSource: project.configSource,
       configRevision: project.configRevision,
       createdAt: project.createdAt,
@@ -2052,10 +2363,13 @@ async function historyRoutes(app) {
       answerText: querySnapshots.answerText,
       citedDomains: querySnapshots.citedDomains,
       competitorOverlap: querySnapshots.competitorOverlap,
+      location: querySnapshots.location,
       createdAt: querySnapshots.createdAt
     }).from(querySnapshots).leftJoin(keywords, eq9(querySnapshots.keywordId, keywords.id)).where(inArray(querySnapshots.runId, projectRuns.map((r) => r.id))).orderBy(desc(querySnapshots.createdAt)).all();
-    const total = allSnapshots.length;
-    const paged = allSnapshots.slice(offset, offset + limit);
+    const locationFilter = request.query.location;
+    const filtered = locationFilter !== void 0 ? allSnapshots.filter((s) => s.location === (locationFilter || null)) : allSnapshots;
+    const total = filtered.length;
+    const paged = filtered.slice(offset, offset + limit);
     return reply.send({
       snapshots: paged.map((s) => ({
         id: s.id,
@@ -2068,6 +2382,7 @@ async function historyRoutes(app) {
         answerText: s.answerText,
         citedDomains: tryParseJson2(s.citedDomains, []),
         competitorOverlap: tryParseJson2(s.competitorOverlap, []),
+        location: s.location,
         createdAt: s.createdAt
       })),
       total
@@ -2082,7 +2397,9 @@ async function historyRoutes(app) {
       return reply.send([]);
     }
     const runIds = new Set(projectRuns.map((r) => r.id));
-    const allSnapshots = app.db.select().from(querySnapshots).where(inArray(querySnapshots.runId, [...runIds])).all();
+    const rawSnapshots = app.db.select().from(querySnapshots).where(inArray(querySnapshots.runId, [...runIds])).all();
+    const timelineLocationFilter = request.query.location;
+    const allSnapshots = timelineLocationFilter !== void 0 ? rawSnapshots.filter((s) => s.location === (timelineLocationFilter || null)) : rawSnapshots;
     const deduped = /* @__PURE__ */ new Map();
     for (const snap of allSnapshots) {
       const key = `${snap.runId}:${snap.keywordId}`;
@@ -2991,7 +3308,7 @@ async function telemetryRoutes(app, opts) {
 }
 
 // ../api-routes/src/schedules.ts
-import crypto10 from "crypto";
+import crypto11 from "crypto";
 import { eq as eq10 } from "drizzle-orm";
 async function scheduleRoutes(app, opts) {
   app.put("/projects/:name/schedule", async (request, reply) => {
@@ -3038,7 +3355,7 @@ async function scheduleRoutes(app, opts) {
       }).where(eq10(schedules.id, existing.id)).run();
     } else {
       app.db.insert(schedules).values({
-        id: crypto10.randomUUID(),
+        id: crypto11.randomUUID(),
         projectId: project.id,
         cronExpr,
         preset: preset ?? null,
@@ -3117,7 +3434,7 @@ function resolveProjectSafe5(app, name, reply) {
 }
 
 // ../api-routes/src/notifications.ts
-import crypto11 from "crypto";
+import crypto12 from "crypto";
 import { eq as eq11 } from "drizzle-orm";
 var VALID_EVENTS = ["citation.lost", "citation.gained", "run.completed", "run.failed"];
 async function notificationRoutes(app) {
@@ -3151,8 +3468,8 @@ async function notificationRoutes(app) {
       });
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const id = crypto11.randomUUID();
-    const webhookSecret = crypto11.randomBytes(32).toString("hex");
+    const id = crypto12.randomUUID();
+    const webhookSecret = crypto12.randomBytes(32).toString("hex");
     app.db.insert(notifications).values({
       id,
       projectId: project.id,
@@ -3271,7 +3588,7 @@ function resolveProjectSafe6(app, name, reply) {
 }
 
 // ../api-routes/src/google.ts
-import crypto12 from "crypto";
+import crypto13 from "crypto";
 import { eq as eq12, and as and3, desc as desc2, sql as sql2 } from "drizzle-orm";
 
 // ../integration-google/src/constants.ts
@@ -3430,7 +3747,7 @@ async function inspectUrl(accessToken, inspectionUrl, siteUrl) {
 
 // ../api-routes/src/google.ts
 function signState(payload, secret) {
-  return crypto12.createHmac("sha256", secret).update(payload).digest("hex");
+  return crypto13.createHmac("sha256", secret).update(payload).digest("hex");
 }
 function buildSignedState(data, secret) {
   const payload = JSON.stringify(data);
@@ -3441,7 +3758,7 @@ function verifySignedState(encoded, secret) {
   try {
     const { payload, sig } = JSON.parse(Buffer.from(encoded, "base64url").toString());
     const expected = signState(payload, secret);
-    if (!crypto12.timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"))) return null;
+    if (!crypto13.timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"))) return null;
     return JSON.parse(payload);
   } catch {
     return null;
@@ -3667,7 +3984,7 @@ async function googleRoutes(app, opts) {
       return reply.status(err.statusCode).send(err.toJSON());
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto12.randomUUID();
+    const runId = crypto13.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -3729,7 +4046,7 @@ async function googleRoutes(app, opts) {
     const mob = ir.mobileUsabilityResult;
     const rich = ir.richResultsResult;
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const id = crypto12.randomUUID();
+    const id = crypto13.randomUUID();
     app.db.insert(gscUrlInspections).values({
       id,
       projectId: project.id,
@@ -3803,7 +4120,7 @@ async function googleRoutes(app, opts) {
       if (inspections.length < 2) continue;
       const latest = inspections[0];
       const previous = inspections[1];
-      if (previous.indexingState?.toUpperCase() === "INDEXED" && latest.indexingState?.toUpperCase() !== "INDEXED") {
+      if (previous.indexingState === "INDEXING_ALLOWED" && latest.indexingState !== "INDEXING_ALLOWED") {
         deindexed.push({
           url,
           previousState: previous.indexingState,
@@ -3814,6 +4131,138 @@ async function googleRoutes(app, opts) {
     }
     return deindexed;
   });
+  app.get("/projects/:name/google/gsc/coverage", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const allInspections = app.db.select().from(gscUrlInspections).where(eq12(gscUrlInspections.projectId, project.id)).orderBy(desc2(gscUrlInspections.inspectedAt)).all();
+    const latestByUrl = /* @__PURE__ */ new Map();
+    const historyByUrl = /* @__PURE__ */ new Map();
+    for (const row of allInspections) {
+      if (!latestByUrl.has(row.url)) {
+        latestByUrl.set(row.url, row);
+      }
+      const history = historyByUrl.get(row.url);
+      if (history) {
+        history.push(row);
+      } else {
+        historyByUrl.set(row.url, [row]);
+      }
+    }
+    const indexedUrls = [];
+    const notIndexedUrls = [];
+    let lastInspectedAt = null;
+    for (const [, row] of latestByUrl) {
+      if (row.indexingState === "INDEXING_ALLOWED") {
+        indexedUrls.push(row);
+      } else {
+        notIndexedUrls.push(row);
+      }
+      if (!lastInspectedAt || row.inspectedAt > lastInspectedAt) {
+        lastInspectedAt = row.inspectedAt;
+      }
+    }
+    const deindexedUrls = [];
+    for (const [url, history] of historyByUrl) {
+      if (history.length < 2) continue;
+      const latest = history[0];
+      const previous = history[1];
+      if (previous.indexingState === "INDEXING_ALLOWED" && latest.indexingState !== "INDEXING_ALLOWED") {
+        deindexedUrls.push({
+          url,
+          previousState: previous.indexingState,
+          currentState: latest.indexingState,
+          transitionDate: latest.inspectedAt
+        });
+      }
+    }
+    const total = latestByUrl.size;
+    const indexed = indexedUrls.length;
+    const notIndexed = notIndexedUrls.length;
+    const formatRow = (r) => ({
+      id: r.id,
+      url: r.url,
+      indexingState: r.indexingState,
+      verdict: r.verdict,
+      coverageState: r.coverageState,
+      pageFetchState: r.pageFetchState,
+      robotsTxtState: r.robotsTxtState,
+      crawlTime: r.crawlTime,
+      lastCrawlResult: r.lastCrawlResult,
+      isMobileFriendly: r.isMobileFriendly === 1 ? true : r.isMobileFriendly === 0 ? false : null,
+      richResults: JSON.parse(r.richResults),
+      inspectedAt: r.inspectedAt
+    });
+    const reasonMap = /* @__PURE__ */ new Map();
+    for (const row of notIndexedUrls) {
+      const reason = row.coverageState ?? "Unknown";
+      const existing = reasonMap.get(reason);
+      if (existing) {
+        existing.push(row);
+      } else {
+        reasonMap.set(reason, [row]);
+      }
+    }
+    const reasonGroups = Array.from(reasonMap.entries()).map(([reason, urls]) => ({
+      reason,
+      count: urls.length,
+      urls: urls.map(formatRow)
+    })).sort((a, b) => b.count - a.count);
+    return {
+      summary: {
+        total,
+        indexed,
+        notIndexed,
+        deindexed: deindexedUrls.length,
+        percentage: total > 0 ? Math.round(indexed / total * 1e3) / 10 : 0
+      },
+      lastInspectedAt,
+      indexed: indexedUrls.map(formatRow),
+      notIndexed: notIndexedUrls.map(formatRow),
+      deindexed: deindexedUrls,
+      reasonGroups
+    };
+  });
+  app.get("/projects/:name/google/gsc/coverage/history", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const parsed = parseInt(request.query.limit ?? "90", 10);
+    const limit = Number.isNaN(parsed) || parsed <= 0 ? 90 : parsed;
+    const rows = app.db.select().from(gscCoverageSnapshots).where(eq12(gscCoverageSnapshots.projectId, project.id)).orderBy(desc2(gscCoverageSnapshots.date)).limit(limit).all();
+    return rows.map((r) => ({
+      date: r.date,
+      indexed: r.indexed,
+      notIndexed: r.notIndexed,
+      reasonBreakdown: JSON.parse(r.reasonBreakdown)
+    })).reverse();
+  });
+  app.post("/projects/:name/google/gsc/inspect-sitemap", async (request, reply) => {
+    const store = requireConnectionStore(reply);
+    if (!store) return;
+    const project = resolveProject(app.db, request.params.name);
+    const conn = store.getConnection(project.canonicalDomain, "gsc");
+    if (!conn) {
+      const err = validationError('No GSC connection found for this domain. Run "canonry google connect" first.');
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    if (!conn.propertyId) {
+      const err = validationError("No GSC property configured for this connection");
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const runId = crypto13.randomUUID();
+    app.db.insert(runs).values({
+      id: runId,
+      projectId: project.id,
+      kind: "inspect-sitemap",
+      status: "queued",
+      trigger: "manual",
+      createdAt: now
+    }).run();
+    const { sitemapUrl } = request.body ?? {};
+    if (opts.onInspectSitemapRequested) {
+      opts.onInspectSitemapRequested(runId, project.id, { sitemapUrl: sitemapUrl ?? void 0 });
+    }
+    const run = app.db.select().from(runs).where(eq12(runs.id, runId)).get();
+    return run;
+  });
   app.put("/projects/:name/google/connections/:type/property", async (request, reply) => {
     const store = requireConnectionStore(reply);
     if (!store) return;
@@ -3881,7 +4330,8 @@ async function apiRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       googleStateSecret: opts.googleStateSecret,
       publicUrl: opts.publicUrl,
-      onGscSyncRequested: opts.onGscSyncRequested
+      onGscSyncRequested: opts.onGscSyncRequested,
+      onInspectSitemapRequested: opts.onInspectSitemapRequested
     });
   }, { prefix: "/api/v1" });
 }
@@ -3941,7 +4391,7 @@ async function executeTrackedQuery(input) {
     model,
     tools: [{ googleSearch: {} }]
   });
-  const prompt = buildPrompt(input.keyword);
+  const prompt = buildPrompt(input.keyword, input.location);
   const result = await generativeModel.generateContent(prompt);
   const response = result.response;
   const groundingMetadata = extractGroundingMetadata(response);
@@ -3965,7 +4415,10 @@ function normalizeResult(raw) {
     searchQueries: raw.searchQueries
   };
 }
-function buildPrompt(keyword) {
+function buildPrompt(keyword, location) {
+  if (location) {
+    return `${keyword} (searching from ${location.city}, ${location.region}, ${location.country})`;
+  }
   return keyword;
 }
 function extractAnswerText(rawResponse) {
@@ -4107,7 +4560,8 @@ var geminiAdapter = {
       keyword: input.keyword,
       canonicalDomains: input.canonicalDomains,
       competitorDomains: input.competitorDomains,
-      config: toGeminiConfig(config)
+      config: toGeminiConfig(config),
+      location: input.location
     });
     return {
       provider: "gemini",
@@ -4181,9 +4635,19 @@ async function healthcheck2(config) {
 async function executeTrackedQuery2(input) {
   const model = input.config.model ?? DEFAULT_MODEL2;
   const client = new OpenAI({ apiKey: input.config.apiKey });
+  const webSearchTool = { type: "web_search_preview" };
+  if (input.location) {
+    webSearchTool.user_location = {
+      type: "approximate",
+      city: input.location.city,
+      region: input.location.region,
+      country: input.location.country,
+      ...input.location.timezone ? { timezone: input.location.timezone } : {}
+    };
+  }
   const response = await client.responses.create({
     model,
-    tools: [{ type: "web_search_preview" }],
+    tools: [webSearchTool],
     tool_choice: "required",
     input: buildPrompt2(input.keyword)
   });
@@ -4348,7 +4812,8 @@ var openaiAdapter = {
       keyword: input.keyword,
       canonicalDomains: input.canonicalDomains,
       competitorDomains: input.competitorDomains,
-      config: toOpenAIConfig(config)
+      config: toOpenAIConfig(config),
+      location: input.location
     });
     return {
       provider: "openai",
@@ -4423,16 +4888,24 @@ async function healthcheck3(config) {
 async function executeTrackedQuery3(input) {
   const model = input.config.model ?? DEFAULT_MODEL3;
   const client = new Anthropic({ apiKey: input.config.apiKey });
+  const webSearchTool = {
+    type: "web_search_20250305",
+    name: "web_search",
+    max_uses: 5
+  };
+  if (input.location) {
+    webSearchTool.user_location = {
+      type: "approximate",
+      city: input.location.city,
+      region: input.location.region,
+      country: input.location.country,
+      ...input.location.timezone ? { timezone: input.location.timezone } : {}
+    };
+  }
   const response = await client.messages.create({
     model,
     max_tokens: 4096,
-    tools: [
-      {
-        type: "web_search_20250305",
-        name: "web_search",
-        max_uses: 5
-      }
-    ],
+    tools: [webSearchTool],
     messages: [{ role: "user", content: input.keyword }]
   });
   const groundingSources = extractGroundingSources2(response);
@@ -4585,7 +5058,8 @@ var claudeAdapter = {
       keyword: input.keyword,
       canonicalDomains: input.canonicalDomains,
       competitorDomains: input.competitorDomains,
-      config: toClaudeConfig(config)
+      config: toClaudeConfig(config),
+      location: input.location
     });
     return {
       provider: "claude",
@@ -4675,7 +5149,7 @@ async function executeTrackedQuery4(input) {
       },
       {
         role: "user",
-        content: buildPrompt3(input.keyword)
+        content: buildPrompt3(input.keyword, input.location)
       }
     ]
   });
@@ -4698,8 +5172,9 @@ function normalizeResult4(raw) {
     searchQueries: raw.searchQueries
   };
 }
-function buildPrompt3(keyword) {
-  return `Based on your training knowledge, what websites, services, or organizations are commonly associated with "${keyword}"? List the most relevant ones and include their domain names (e.g. example.com) where you know them.`;
+function buildPrompt3(keyword, location) {
+  const locationContext = location ? ` The user is searching from ${location.city}, ${location.region}, ${location.country}.` : "";
+  return `Based on your training knowledge, what websites, services, or organizations are commonly associated with "${keyword}"?${locationContext} List the most relevant ones and include their domain names (e.g. example.com) where you know them.`;
 }
 function extractAnswerText2(rawResponse) {
   try {
@@ -4770,7 +5245,8 @@ var localAdapter = {
       keyword: input.keyword,
       canonicalDomains: input.canonicalDomains,
       competitorDomains: input.competitorDomains,
-      config: toLocalConfig(config)
+      config: toLocalConfig(config),
+      location: input.location
     });
     return {
       provider: "local",
@@ -4874,7 +5350,7 @@ function removeGoogleConnection(config, domain, connectionType) {
 }
 
 // src/job-runner.ts
-import crypto13 from "crypto";
+import crypto14 from "crypto";
 import { eq as eq13, inArray as inArray2 } from "drizzle-orm";
 var JobRunner = class {
   db;
@@ -4893,7 +5369,7 @@ var JobRunner = class {
       console.log(`[JobRunner] Recovered stale run ${run.id} (was ${run.status})`);
     }
   }
-  async executeRun(runId, projectId, providerOverride) {
+  async executeRun(runId, projectId, providerOverride, locationOverride) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const startTime = Date.now();
     try {
@@ -4902,6 +5378,17 @@ var JobRunner = class {
       if (!project) {
         throw new Error(`Project ${projectId} not found`);
       }
+      let runLocation;
+      if (locationOverride === null) {
+        runLocation = void 0;
+      } else if (locationOverride) {
+        runLocation = locationOverride;
+      } else {
+        const projectLocations = JSON.parse(project.locations || "[]");
+        if (project.defaultLocation && projectLocations.length > 0) {
+          runLocation = projectLocations.find((l) => l.label === project.defaultLocation);
+        }
+      }
       const projectProviders = providerOverride ?? JSON.parse(project.providers || "[]");
       const activeProviders = this.registry.getForProject(projectProviders);
       if (activeProviders.length === 0) {
@@ -4946,7 +5433,8 @@ var JobRunner = class {
               {
                 keyword: kw.keyword,
                 canonicalDomains: allDomains,
-                competitorDomains
+                competitorDomains,
+                location: runLocation
               },
               config
             );
@@ -4955,7 +5443,7 @@ var JobRunner = class {
             const citationState = determineCitationState(normalized, allDomains);
             const overlap = computeCompetitorOverlap(normalized, competitorDomains);
             this.db.insert(querySnapshots).values({
-              id: crypto13.randomUUID(),
+              id: crypto14.randomUUID(),
               runId,
               keywordId: kw.id,
               provider: providerName,
@@ -4964,6 +5452,7 @@ var JobRunner = class {
               answerText: normalized.answerText,
               citedDomains: JSON.stringify(normalized.citedDomains),
               competitorOverlap: JSON.stringify(overlap),
+              location: runLocation?.label ?? null,
               rawResponse: JSON.stringify({
                 model: raw.model,
                 groundingSources: normalized.groundingSources,
@@ -4999,7 +5488,8 @@ var JobRunner = class {
         providerCount: activeProviders.length,
         providers: activeProviders.map((p) => p.adapter.name),
         keywordCount: projectKeywords.length,
-        durationMs: Date.now() - startTime
+        durationMs: Date.now() - startTime,
+        ...runLocation ? { location: runLocation.label } : {}
       });
       for (const p of activeProviders) {
         this.incrementUsage(`${projectId}:${p.adapter.name}`, "queries", queriesPerProvider);
@@ -5052,7 +5542,7 @@ var JobRunner = class {
   incrementUsage(scope, metric, count) {
     const now = /* @__PURE__ */ new Date();
     const period = `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-    const id = crypto13.randomUUID();
+    const id = crypto14.randomUUID();
     const existing = this.db.select().from(usageCounters).where(eq13(usageCounters.scope, scope)).all().find((r) => r.period === period && r.metric === metric);
     if (existing) {
       this.db.update(usageCounters).set({ count: existing.count + count, updatedAt: now.toISOString() }).where(eq13(usageCounters.id, existing.id)).run();
@@ -5135,7 +5625,7 @@ function computeCompetitorOverlap(normalized, competitorDomains) {
 }
 
 // src/gsc-sync.ts
-import crypto14 from "crypto";
+import crypto15 from "crypto";
 import { eq as eq14, and as and4, sql as sql3 } from "drizzle-orm";
 function formatDate(d) {
   return d.toISOString().split("T")[0];
@@ -5200,7 +5690,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       for (const row of batch) {
         const [query, page, country, device, date] = row.keys;
         db.insert(gscSearchData).values({
-          id: crypto14.randomUUID(),
+          id: crypto15.randomUUID(),
           projectId,
           syncRunId: runId,
           date: date ?? "",
@@ -5234,7 +5724,7 @@ async function executeGscSync(db, runId, projectId, opts) {
         const rich = ir.richResultsResult;
         const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
         db.insert(gscUrlInspections).values({
-          id: crypto14.randomUUID(),
+          id: crypto15.randomUUID(),
           projectId,
           syncRunId: runId,
           url: pageUrl,
@@ -5255,8 +5745,40 @@ async function executeGscSync(db, runId, projectId, opts) {
         console.error(`[GSC Sync] Failed to inspect ${pageUrl}:`, err instanceof Error ? err.message : err);
       }
     }
+    const allInspections = db.select().from(gscUrlInspections).where(eq14(gscUrlInspections.projectId, projectId)).all();
+    const latestByUrl = /* @__PURE__ */ new Map();
+    for (const row of allInspections) {
+      const existing = latestByUrl.get(row.url);
+      if (!existing || row.inspectedAt > existing.inspectedAt) {
+        latestByUrl.set(row.url, row);
+      }
+    }
+    let snapIndexed = 0;
+    let snapNotIndexed = 0;
+    const reasonCounts = {};
+    for (const [, row] of latestByUrl) {
+      if (row.indexingState === "INDEXING_ALLOWED") {
+        snapIndexed++;
+      } else {
+        snapNotIndexed++;
+        const reason = row.coverageState ?? "Unknown";
+        reasonCounts[reason] = (reasonCounts[reason] ?? 0) + 1;
+      }
+    }
+    const snapshotDate = formatDate(/* @__PURE__ */ new Date());
+    db.delete(gscCoverageSnapshots).where(and4(eq14(gscCoverageSnapshots.projectId, projectId), eq14(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.insert(gscCoverageSnapshots).values({
+      id: crypto15.randomUUID(),
+      projectId,
+      syncRunId: runId,
+      date: snapshotDate,
+      indexed: snapIndexed,
+      notIndexed: snapNotIndexed,
+      reasonBreakdown: JSON.stringify(reasonCounts),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
     db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq14(runs.id, runId)).run();
-    console.log(`[GSC Sync] Completed. ${rows.length} search data rows, ${topPages.length} URL inspections.`);
+    console.log(`[GSC Sync] Completed. ${rows.length} search data rows, ${topPages.length} URL inspections, coverage snapshot: ${snapIndexed} indexed / ${snapNotIndexed} not-indexed.`);
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
     db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq14(runs.id, runId)).run();
@@ -5265,6 +5787,193 @@ async function executeGscSync(db, runId, projectId, opts) {
   }
 }
 
+// src/gsc-inspect-sitemap.ts
+import crypto16 from "crypto";
+import { eq as eq15, and as and5 } from "drizzle-orm";
+
+// src/sitemap-parser.ts
+var LOC_REGEX = /<loc>\s*([^<]+?)\s*<\/loc>/gi;
+var SITEMAP_TAG_REGEX = /<sitemap>[\s\S]*?<\/sitemap>/gi;
+var PRIVATE_IP_PATTERNS = [
+  /^169\.254\./,
+  // link-local (AWS metadata endpoint etc.)
+  /^10\./,
+  // private class A
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  // private class B
+  /^192\.168\./
+  // private class C
+];
+function validateSitemapUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid sitemap URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Sitemap URL must use http or https protocol: ${url}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  for (const pattern of PRIVATE_IP_PATTERNS) {
+    if (pattern.test(host)) {
+      throw new Error(`Sitemap URL points to a private or reserved IP range: ${url}`);
+    }
+  }
+}
+async function fetchAndParseSitemap(sitemapUrl) {
+  const urls = /* @__PURE__ */ new Set();
+  await parseSitemapRecursive(sitemapUrl, urls, 0);
+  return [...urls];
+}
+async function parseSitemapRecursive(url, urls, depth) {
+  if (depth > 3) return;
+  validateSitemapUrl(url);
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch sitemap at ${url}: ${res.status} ${res.statusText}`);
+  }
+  const xml = await res.text();
+  const sitemapEntries = xml.match(SITEMAP_TAG_REGEX);
+  if (sitemapEntries) {
+    for (const entry of sitemapEntries) {
+      const locMatch = LOC_REGEX.exec(entry);
+      LOC_REGEX.lastIndex = 0;
+      if (locMatch?.[1]) {
+        await parseSitemapRecursive(locMatch[1], urls, depth + 1);
+      }
+    }
+    return;
+  }
+  let match;
+  while ((match = LOC_REGEX.exec(xml)) !== null) {
+    if (match[1]) {
+      urls.add(match[1]);
+    }
+  }
+  LOC_REGEX.lastIndex = 0;
+}
+
+// src/gsc-inspect-sitemap.ts
+async function executeInspectSitemap(db, runId, projectId, opts) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  db.update(runs).set({ status: "running", startedAt: now }).where(eq15(runs.id, runId)).run();
+  try {
+    const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
+    if (!googleClientId || !googleClientSecret) {
+      throw new Error("Google OAuth is not configured in the local Canonry config");
+    }
+    const project = db.select().from(projects).where(eq15(projects.id, projectId)).get();
+    if (!project) {
+      throw new Error(`Project not found: ${projectId}`);
+    }
+    const conn = getGoogleConnection(opts.config, project.canonicalDomain, "gsc");
+    if (!conn || !conn.refreshToken) {
+      throw new Error("No GSC connection found or connection is incomplete");
+    }
+    if (!conn.propertyId) {
+      throw new Error('No GSC property selected. Use "canonry google properties" to list available sites, then set one.');
+    }
+    let accessToken = conn.accessToken;
+    const expiresAt = conn.tokenExpiresAt ? new Date(conn.tokenExpiresAt).getTime() : 0;
+    if (Date.now() > expiresAt - 5 * 60 * 1e3) {
+      const tokens = await refreshAccessToken(googleClientId, googleClientSecret, conn.refreshToken);
+      accessToken = tokens.access_token;
+      patchGoogleConnection(opts.config, project.canonicalDomain, "gsc", {
+        accessToken: tokens.access_token,
+        tokenExpiresAt: new Date(Date.now() + tokens.expires_in * 1e3).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      saveConfig(opts.config);
+    }
+    const sitemapUrl = opts.sitemapUrl || `https://${project.canonicalDomain}/sitemap.xml`;
+    console.log(`[Inspect Sitemap] Fetching sitemap from ${sitemapUrl}`);
+    const urls = await fetchAndParseSitemap(sitemapUrl);
+    console.log(`[Inspect Sitemap] Found ${urls.length} URLs in sitemap`);
+    if (urls.length === 0) {
+      throw new Error("No URLs found in sitemap");
+    }
+    let inspected = 0;
+    let errors = 0;
+    for (const pageUrl of urls) {
+      try {
+        const result = await inspectUrl(accessToken, pageUrl, conn.propertyId);
+        const ir = result.inspectionResult;
+        const idx = ir.indexStatusResult;
+        const mob = ir.mobileUsabilityResult;
+        const rich = ir.richResultsResult;
+        const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
+        db.insert(gscUrlInspections).values({
+          id: crypto16.randomUUID(),
+          projectId,
+          syncRunId: runId,
+          url: pageUrl,
+          indexingState: idx?.indexingState ?? null,
+          verdict: idx?.verdict ?? null,
+          coverageState: idx?.coverageState ?? null,
+          pageFetchState: idx?.pageFetchState ?? null,
+          robotsTxtState: idx?.robotsTxtState ?? null,
+          crawlTime: idx?.lastCrawlTime ?? null,
+          lastCrawlResult: idx?.crawlResult ?? null,
+          isMobileFriendly: mob?.verdict === "PASS" ? 1 : mob?.verdict === "FAIL" ? 0 : null,
+          richResults: JSON.stringify(rich?.detectedItems?.map((d) => d.richResultType) ?? []),
+          referringUrls: JSON.stringify(idx?.referringUrls ?? []),
+          inspectedAt,
+          createdAt: inspectedAt
+        }).run();
+        inspected++;
+        console.log(`[Inspect Sitemap] ${inspected}/${urls.length} inspected: ${pageUrl}`);
+      } catch (err) {
+        errors++;
+        console.error(`[Inspect Sitemap] Failed to inspect ${pageUrl}:`, err instanceof Error ? err.message : err);
+      }
+      if (inspected + errors < urls.length) {
+        await new Promise((r) => setTimeout(r, 1e3));
+      }
+    }
+    const allInspections = db.select().from(gscUrlInspections).where(eq15(gscUrlInspections.projectId, projectId)).all();
+    const latestByUrl = /* @__PURE__ */ new Map();
+    for (const row of allInspections) {
+      const existing = latestByUrl.get(row.url);
+      if (!existing || row.inspectedAt > existing.inspectedAt) {
+        latestByUrl.set(row.url, row);
+      }
+    }
+    let snapIndexed = 0;
+    let snapNotIndexed = 0;
+    const reasonCounts = {};
+    for (const [, row] of latestByUrl) {
+      if (row.indexingState === "INDEXING_ALLOWED") {
+        snapIndexed++;
+      } else {
+        snapNotIndexed++;
+        const reason = row.coverageState ?? "Unknown";
+        reasonCounts[reason] = (reasonCounts[reason] ?? 0) + 1;
+      }
+    }
+    const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+    db.delete(gscCoverageSnapshots).where(and5(eq15(gscCoverageSnapshots.projectId, projectId), eq15(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.insert(gscCoverageSnapshots).values({
+      id: crypto16.randomUUID(),
+      projectId,
+      syncRunId: runId,
+      date: snapshotDate,
+      indexed: snapIndexed,
+      notIndexed: snapNotIndexed,
+      reasonBreakdown: JSON.stringify(reasonCounts),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
+    const status = errors > 0 && inspected > 0 ? "partial" : errors === urls.length ? "failed" : "completed";
+    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq15(runs.id, runId)).run();
+    console.log(`[Inspect Sitemap] Done. ${inspected} inspected, ${errors} errors out of ${urls.length} URLs. Coverage: ${snapIndexed} indexed / ${snapNotIndexed} not-indexed.`);
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq15(runs.id, runId)).run();
+    console.error(`[Inspect Sitemap] Failed:`, errorMsg);
+    throw err;
+  }
+}
+
 // src/provider-registry.ts
 var ProviderRegistry = class {
   providers = /* @__PURE__ */ new Map();
@@ -5310,7 +6019,7 @@ var ProviderRegistry = class {
 
 // src/scheduler.ts
 import cron from "node-cron";
-import { eq as eq15 } from "drizzle-orm";
+import { eq as eq16 } from "drizzle-orm";
 var Scheduler = class {
   db;
   callbacks;
@@ -5321,7 +6030,7 @@ var Scheduler = class {
   }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq15(schedules.enabled, 1)).all();
+    const allSchedules = this.db.select().from(schedules).where(eq16(schedules.enabled, 1)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
@@ -5346,7 +6055,7 @@ var Scheduler = class {
       this.stopTask(projectId, existing, "Stopped");
       this.tasks.delete(projectId);
     }
-    const schedule = this.db.select().from(schedules).where(eq15(schedules.projectId, projectId)).get();
+    const schedule = this.db.select().from(schedules).where(eq16(schedules.projectId, projectId)).get();
     if (schedule && schedule.enabled === 1) {
       this.registerCronTask(schedule);
     }
@@ -5379,13 +6088,13 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: task.getNextRun()?.toISOString() ?? null,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq15(schedules.id, scheduleId)).run();
+    }).where(eq16(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
     console.log(`[Scheduler] Registered "${label}" (${timezone}) for project ${projectId}`);
   }
   triggerRun(scheduleId, projectId) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const currentSchedule = this.db.select().from(schedules).where(eq15(schedules.id, scheduleId)).get();
+    const currentSchedule = this.db.select().from(schedules).where(eq16(schedules.id, scheduleId)).get();
     if (!currentSchedule || currentSchedule.enabled !== 1) {
       console.log(`[Scheduler] Schedule ${scheduleId} no longer exists or is disabled, removing task for project ${projectId}`);
       this.remove(projectId);
@@ -5393,7 +6102,7 @@ var Scheduler = class {
     }
     const task = this.tasks.get(projectId);
     const nextRunAt = task?.getNextRun()?.toISOString() ?? null;
-    const project = this.db.select().from(projects).where(eq15(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq16(projects.id, projectId)).get();
     if (!project) {
       console.error(`[Scheduler] Project ${projectId} not found, skipping scheduled run`);
       this.remove(projectId);
@@ -5410,7 +6119,7 @@ var Scheduler = class {
       this.db.update(schedules).set({
         nextRunAt,
         updatedAt: now
-      }).where(eq15(schedules.id, currentSchedule.id)).run();
+      }).where(eq16(schedules.id, currentSchedule.id)).run();
       return;
     }
     const runId = queueResult.runId;
@@ -5418,7 +6127,7 @@ var Scheduler = class {
       lastRunAt: now,
       nextRunAt,
       updatedAt: now
-    }).where(eq15(schedules.id, currentSchedule.id)).run();
+    }).where(eq16(schedules.id, currentSchedule.id)).run();
     const scheduleProviders = JSON.parse(currentSchedule.providers);
     const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
     console.log(`[Scheduler] Triggered scheduled run ${runId} for project ${project.name}`);
@@ -5427,8 +6136,8 @@ var Scheduler = class {
 };
 
 // src/notifier.ts
-import { eq as eq16, desc as desc3, and as and5, or as or2 } from "drizzle-orm";
-import crypto15 from "crypto";
+import { eq as eq17, desc as desc3, and as and6, or as or2 } from "drizzle-orm";
+import crypto17 from "crypto";
 var Notifier = class {
   db;
   serverUrl;
@@ -5439,18 +6148,18 @@ var Notifier = class {
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
     console.log(`[Notifier] onRunCompleted: runId=${runId} projectId=${projectId}`);
-    const notifs = this.db.select().from(notifications).where(eq16(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq17(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) {
       console.log(`[Notifier] No enabled notifications for project ${projectId} \u2014 skipping`);
       return;
     }
     console.log(`[Notifier] Found ${notifs.length} enabled notification(s) for project ${projectId}`);
-    const run = this.db.select().from(runs).where(eq16(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq17(runs.id, runId)).get();
     if (!run) {
       console.error(`[Notifier] Run ${runId} not found \u2014 skipping notification dispatch`);
       return;
     }
-    const project = this.db.select().from(projects).where(eq16(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq17(projects.id, projectId)).get();
     if (!project) {
       console.error(`[Notifier] Project ${projectId} not found \u2014 skipping notification dispatch`);
       return;
@@ -5490,9 +6199,9 @@ var Notifier = class {
   }
   computeTransitions(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
-      and5(
-        eq16(runs.projectId, projectId),
-        or2(eq16(runs.status, "completed"), eq16(runs.status, "partial"))
+      and6(
+        eq17(runs.projectId, projectId),
+        or2(eq17(runs.status, "completed"), eq17(runs.status, "partial"))
       )
     ).orderBy(desc3(runs.createdAt)).limit(2).all();
     if (recentRuns.length < 2) return [];
@@ -5504,12 +6213,12 @@ var Notifier = class {
       keyword: keywords.keyword,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(keywords, eq16(querySnapshots.keywordId, keywords.id)).where(eq16(querySnapshots.runId, currentRunId)).all();
+    }).from(querySnapshots).leftJoin(keywords, eq17(querySnapshots.keywordId, keywords.id)).where(eq17(querySnapshots.runId, currentRunId)).all();
     const previousSnapshots = this.db.select({
       keywordId: querySnapshots.keywordId,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).where(eq16(querySnapshots.runId, previousRunId)).all();
+    }).from(querySnapshots).where(eq17(querySnapshots.runId, previousRunId)).all();
     const prevMap = /* @__PURE__ */ new Map();
     for (const s of previousSnapshots) {
       prevMap.set(`${s.keywordId}:${s.provider}`, s.citationState);
@@ -5566,7 +6275,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto15.randomUUID(),
+      id: crypto17.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -5697,6 +6406,14 @@ var DEFAULT_QUOTA = {
   maxRequestsPerMinute: 10,
   maxRequestsPerDay: 1e3
 };
+function summarizeProviderConfig(provider, config) {
+  return {
+    configured: Boolean(config?.apiKey || config?.baseUrl),
+    model: config?.model ?? null,
+    baseUrl: provider === "local" ? config?.baseUrl ?? null : null,
+    quota: { ...config?.quota ?? DEFAULT_QUOTA }
+  };
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -5781,7 +6498,7 @@ async function createServer(opts) {
     configured: Boolean(opts.config.google?.clientId && opts.config.google?.clientSecret)
   };
   const adapterMap = { gemini: geminiAdapter, openai: openaiAdapter, claude: claudeAdapter, local: localAdapter };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto16.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto18.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -5821,14 +6538,27 @@ async function createServer(opts) {
         app.log.error({ runId, err }, "GSC sync failed");
       });
     },
+    onInspectSitemapRequested: (runId, projectId, inspectOpts) => {
+      const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
+      if (!googleClientId || !googleClientSecret) {
+        app.log.error("Inspect sitemap requested but Google OAuth credentials are not configured");
+        return;
+      }
+      executeInspectSitemap(opts.db, runId, projectId, {
+        ...inspectOpts,
+        config: opts.config
+      }).catch((err) => {
+        app.log.error({ runId, err }, "Inspect sitemap failed");
+      });
+    },
     openApiInfo: {
       title: "Canonry API",
       version: PKG_VERSION
     },
     providerSummary,
     googleSettingsSummary,
-    onRunCreated: (runId, projectId, providers2) => {
-      jobRunner.executeRun(runId, projectId, providers2).catch((err) => {
+    onRunCreated: (runId, projectId, providers2, location) => {
+      jobRunner.executeRun(runId, projectId, providers2, location).catch((err) => {
         app.log.error({ runId, err }, "Job runner failed");
       });
     },
@@ -5837,6 +6567,7 @@ async function createServer(opts) {
       if (!(name in adapterMap)) return null;
       if (!opts.config.providers) opts.config.providers = {};
       const existing = opts.config.providers[name];
+      const beforeConfig = summarizeProviderConfig(name, existing);
       const mergedQuota = incomingQuota ? { ...existing?.quota ?? DEFAULT_QUOTA, ...incomingQuota } : existing?.quota;
       opts.config.providers[name] = {
         apiKey: apiKey || existing?.apiKey,
@@ -5864,6 +6595,33 @@ async function createServer(opts) {
         entry.model = model || registry.get(name)?.config.model;
         entry.quota = quota;
       }
+      const afterConfig = summarizeProviderConfig(name, opts.config.providers[name]);
+      if (JSON.stringify(beforeConfig) !== JSON.stringify(afterConfig)) {
+        const diff = JSON.stringify({
+          before: existing ? beforeConfig : null,
+          after: afterConfig
+        });
+        const affectedProjectIds = opts.db.select({ id: projects.id, providers: projects.providers }).from(projects).all().filter((project) => {
+          try {
+            const configuredProviders = JSON.parse(project.providers || "[]");
+            return configuredProviders.length === 0 || configuredProviders.includes(name);
+          } catch {
+            return false;
+          }
+        }).map((project) => project.id);
+        const targetProjectIds = affectedProjectIds.length > 0 ? affectedProjectIds : [null];
+        const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+        opts.db.insert(auditLog).values(targetProjectIds.map((projectId) => ({
+          id: crypto18.randomUUID(),
+          projectId,
+          actor: "api",
+          action: existing ? "provider.updated" : "provider.created",
+          entityType: "provider",
+          entityId: name,
+          diff,
+          createdAt
+        }))).run();
+      }
       return {
         name,
         model: entry?.model,