@ainyc/canonry 4.155.0 → 4.157.0

package/dist/{chunk-VOL2BSM5.js → chunk-MEBL4EJO.js}

@@ -35,6 +35,7 @@ import {
   CheckScopes,
   CheckStatuses,
   CitationStates,
+  CloudflareTrafficDeliveryModes,
   ContentActions,
   DEFAULT_DISCOVERY_PROMOTE_BUCKETS,
   DEFAULT_DISCOVERY_PROMOTE_COMPETITOR_TYPES,
@@ -72,9 +73,23 @@ import {
   RunKinds,
   RunStatuses,
   RunTriggers,
+  SITE_CRAWL_GRAPH_DEFAULT_MAX_EDGES,
+  SITE_CRAWL_GRAPH_DEFAULT_MAX_NODES,
+  SITE_CRAWL_GRAPH_MAX_EDGES,
+  SITE_CRAWL_GRAPH_MAX_NODES,
+  SITE_HEALTH_CHANGES_DEFAULT_LIMIT,
+  SITE_HEALTH_CHANGES_MAX_LIMIT,
+  SITE_HEALTH_PATH_DEFAULT_MAX_DEPTH,
+  SITE_HEALTH_PATH_MAX_DEPTH,
+  SITE_HEALTH_PATH_MAX_VISITED_NODES,
+  SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_EDGES,
+  SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_NODES,
+  SITE_HEALTH_SUBGRAPH_MAX_EDGES,
+  SITE_HEALTH_SUBGRAPH_MAX_NODES,
   SKILL_MANIFEST_FILENAME,
   SchedulableRunKinds,
   SiteAuditTrendDirections,
+  SiteCrawlFetchedStates,
   TrafficEventConfidences,
   TrafficEventKinds,
   TrafficEvidenceKinds,
@@ -183,6 +198,9 @@ import {
   classifySkillFile,
   classifySurfaceFromCategory,
   classifyTrafficPath,
+  cloudflareTrafficSourceConfigSchema,
+  cloudflareWorkerIngestRequestSchema,
+  cloudflareWorkerIngestResponseSchema,
   clusterByCosine,
   coerceSkillManifest,
   compactDateToIso,
@@ -209,6 +227,7 @@ import {
   deltaPercent,
   deltaTone,
   deriveCitedUrlCandidates,
+  deriveSiteHealthState,
   deriveWinnabilityClass,
   determineAnswerMentioned,
   discoveryBucketSchema,
@@ -228,6 +247,7 @@ import {
   escapeLikePattern,
   evaluateModelPointerExposure,
   extractAnswerMentions,
+  factorStatusFromScore,
   filterBrandedSeedCandidates,
   filterCapturedCitedUrls,
   findDuplicateLocationLabels,
@@ -469,18 +489,26 @@ import {
   segmentCrawlerHits,
   serializeRunError,
   settingsDtoSchema,
+  siteAuditPageFactorSchema,
   siteAuditPagesResponseSchema,
   siteAuditRequestIdentity,
   siteAuditRunRequestSchema,
   siteAuditRunResponseSchema,
   siteAuditScoreSchema,
   siteAuditTrendResponseSchema,
+  siteCrawlAuditFactorSchema,
+  siteCrawlCriticalDefectSchema,
   siteCrawlDeadLinksResponseSchema,
+  siteCrawlGraphResponseSchema,
   siteCrawlInternalLinksResponseSchema,
   siteCrawlNeighborsResponseSchema,
+  siteCrawlPageAuditSchema,
   siteCrawlPagesResponseSchema,
   siteCrawlStructureResponseSchema,
   siteCrawlSummarySchema,
+  siteHealthChangesResponseSchema,
+  siteHealthPathResponseSchema,
+  siteHealthSubgraphResponseSchema,
   snapshotDiffResponseSchema,
   snapshotListResponseSchema,
   snapshotReportSchema,
@@ -496,6 +524,8 @@ import {
   textContainsBrandAlias,
   textContainsDomain,
   trafficBackfillResponseSchema,
+  trafficConnectCloudflareRequestSchema,
+  trafficConnectCloudflareResponseSchema,
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventsResponseSchema,
@@ -529,10 +559,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-VIKPFI6F.js";
+} from "./chunk-TRRVBTU5.js";
 
 // src/intelligence-service.ts
-import { eq as eq57, desc as desc26, asc as asc11, and as and45, ne as ne7, or as or12, inArray as inArray20, gte as gte13, lte as lte10 } from "drizzle-orm";
+import { eq as eq58, desc as desc26, asc as asc11, and as and46, ne as ne7, or as or12, inArray as inArray20, gte as gte14, lte as lte11 } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -627,9 +657,13 @@ __export(schema_exports, {
   siteCrawlEdges: () => siteCrawlEdges,
   siteCrawlEventReceipts: () => siteCrawlEventReceipts,
   siteCrawlFindings: () => siteCrawlFindings,
+  siteCrawlGraphEdges: () => siteCrawlGraphEdges,
+  siteCrawlGraphLayouts: () => siteCrawlGraphLayouts,
+  siteCrawlGraphNodes: () => siteCrawlGraphNodes,
   siteCrawlPages: () => siteCrawlPages,
   siteCrawlRunRequests: () => siteCrawlRunRequests,
   siteCrawlSnapshots: () => siteCrawlSnapshots,
+  trafficEventReceipts: () => trafficEventReceipts,
   trafficSources: () => trafficSources,
   usageCounters: () => usageCounters,
   userSessions: () => userSessions,
@@ -1251,6 +1285,8 @@ var siteCrawlSnapshots = sqliteTable("site_crawl_snapshots", {
   runId: text("run_id").notNull(),
   attemptId: text("attempt_id"),
   rootUrl: text("root_url").notNull(),
+  /** Original requested crawl root; null for snapshots written before v128. */
+  requestedRootUrl: text("requested_root_url"),
   crawlSchemaVersion: text("crawl_schema_version").notNull().default("1.0"),
   engineVersion: text("engine_version").notNull().default(""),
   normalizationVersion: text("normalization_version").notNull().default(""),
@@ -1361,12 +1397,116 @@ var siteCrawlEdges = sqliteTable("site_crawl_edges", {
   index("idx_site_crawl_edges_inbound").on(table.projectId, table.runId, table.attemptId, table.targetNodeKey, table.edgeKey),
   index("idx_site_crawl_edges_source_url").on(table.projectId, table.runId, table.attemptId, table.sourceUrl),
   index("idx_site_crawl_edges_target_url").on(table.projectId, table.runId, table.attemptId, table.targetUrl),
+  // Publish-time graph sampling filters this exact scope and consumes the
+  // highest-occurrence internal anchors first. The mixed-direction suffix
+  // avoids a million-row temporary ORDER BY at the maximum crawl budget.
+  index("idx_site_crawl_edges_graph_sample").on(
+    table.projectId,
+    table.runId,
+    table.attemptId,
+    table.internal,
+    table.relation,
+    sql`${table.occurrences} desc`,
+    table.edgeKey
+  ),
   foreignKey({
     name: "site_crawl_edges_attempt_fk",
     columns: [table.projectId, table.runId, table.attemptId],
     foreignColumns: [siteCrawlAttempts.projectId, siteCrawlAttempts.runId, siteCrawlAttempts.id]
   }).onDelete("cascade")
 ]);
+var siteCrawlGraphLayouts = sqliteTable("site_crawl_graph_layouts", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  runId: text("run_id").notNull(),
+  attemptId: text("attempt_id").notNull(),
+  state: text("state").notNull(),
+  layoutVersion: text("layout_version"),
+  failureCode: text("failure_code"),
+  totalNodes: integer("total_nodes").notNull().default(0),
+  totalEdges: integer("total_edges").notNull().default(0),
+  nodeCount: integer("node_count").notNull().default(0),
+  edgeCount: integer("edge_count").notNull().default(0),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_site_crawl_graph_layouts_attempt").on(table.projectId, table.runId, table.attemptId),
+  index("idx_site_crawl_graph_layouts_run").on(table.projectId, table.runId),
+  check("site_crawl_graph_layouts_state_check", sql`${table.state} in ('ready', 'unavailable')`),
+  foreignKey({
+    name: "site_crawl_graph_layouts_attempt_fk",
+    columns: [table.projectId, table.runId, table.attemptId],
+    foreignColumns: [siteCrawlAttempts.projectId, siteCrawlAttempts.runId, siteCrawlAttempts.id]
+  }).onDelete("cascade")
+]);
+var siteCrawlGraphNodes = sqliteTable("site_crawl_graph_nodes", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  runId: text("run_id").notNull(),
+  attemptId: text("attempt_id").notNull(),
+  nodeKey: text("node_key").notNull(),
+  sampleRank: integer("sample_rank").notNull(),
+  x: real("x").notNull(),
+  y: real("y").notNull(),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_site_crawl_graph_nodes_attempt_node").on(table.projectId, table.runId, table.attemptId, table.nodeKey),
+  uniqueIndex("idx_site_crawl_graph_nodes_attempt_rank").on(table.projectId, table.runId, table.attemptId, table.sampleRank),
+  index("idx_site_crawl_graph_nodes_read").on(table.projectId, table.runId, table.attemptId, table.sampleRank),
+  check("site_crawl_graph_nodes_rank_check", sql`${table.sampleRank} >= 0`),
+  foreignKey({
+    name: "site_crawl_graph_nodes_layout_fk",
+    columns: [table.projectId, table.runId, table.attemptId],
+    foreignColumns: [siteCrawlGraphLayouts.projectId, siteCrawlGraphLayouts.runId, siteCrawlGraphLayouts.attemptId]
+  }).onDelete("cascade"),
+  foreignKey({
+    name: "site_crawl_graph_nodes_page_fk",
+    columns: [table.projectId, table.runId, table.attemptId, table.nodeKey],
+    foreignColumns: [siteCrawlPages.projectId, siteCrawlPages.runId, siteCrawlPages.attemptId, siteCrawlPages.nodeKey]
+  }).onDelete("cascade")
+]);
+var siteCrawlGraphEdges = sqliteTable("site_crawl_graph_edges", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  runId: text("run_id").notNull(),
+  attemptId: text("attempt_id").notNull(),
+  edgeKey: text("edge_key").notNull(),
+  sampleRank: integer("sample_rank").notNull(),
+  sourceNodeKey: text("source_node_key").notNull(),
+  targetNodeKey: text("target_node_key").notNull(),
+  followable: integer("followable", { mode: "boolean" }).notNull(),
+  occurrences: integer("occurrences").notNull(),
+  createdAt: text("created_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_site_crawl_graph_edges_attempt_edge").on(table.projectId, table.runId, table.attemptId, table.edgeKey),
+  uniqueIndex("idx_site_crawl_graph_edges_attempt_rank").on(table.projectId, table.runId, table.attemptId, table.sampleRank),
+  index("idx_site_crawl_graph_edges_read").on(table.projectId, table.runId, table.attemptId, table.sampleRank),
+  // These FKs otherwise make a layout cascade scan graph edges once per node.
+  index("idx_site_crawl_graph_edges_source_node").on(table.projectId, table.runId, table.attemptId, table.sourceNodeKey),
+  index("idx_site_crawl_graph_edges_target_node").on(table.projectId, table.runId, table.attemptId, table.targetNodeKey),
+  check("site_crawl_graph_edges_rank_check", sql`${table.sampleRank} >= 0`),
+  check("site_crawl_graph_edges_occurrences_check", sql`${table.occurrences} > 0`),
+  foreignKey({
+    name: "site_crawl_graph_edges_layout_fk",
+    columns: [table.projectId, table.runId, table.attemptId],
+    foreignColumns: [siteCrawlGraphLayouts.projectId, siteCrawlGraphLayouts.runId, siteCrawlGraphLayouts.attemptId]
+  }).onDelete("cascade"),
+  foreignKey({
+    name: "site_crawl_graph_edges_source_node_fk",
+    columns: [table.projectId, table.runId, table.attemptId, table.sourceNodeKey],
+    foreignColumns: [siteCrawlGraphNodes.projectId, siteCrawlGraphNodes.runId, siteCrawlGraphNodes.attemptId, siteCrawlGraphNodes.nodeKey]
+  }).onDelete("cascade"),
+  foreignKey({
+    name: "site_crawl_graph_edges_target_node_fk",
+    columns: [table.projectId, table.runId, table.attemptId, table.targetNodeKey],
+    foreignColumns: [siteCrawlGraphNodes.projectId, siteCrawlGraphNodes.runId, siteCrawlGraphNodes.attemptId, siteCrawlGraphNodes.nodeKey]
+  }).onDelete("cascade"),
+  foreignKey({
+    name: "site_crawl_graph_edges_canonical_edge_fk",
+    columns: [table.projectId, table.runId, table.attemptId, table.edgeKey],
+    foreignColumns: [siteCrawlEdges.projectId, siteCrawlEdges.runId, siteCrawlEdges.attemptId, siteCrawlEdges.edgeKey]
+  }).onDelete("cascade")
+]);
 var siteCrawlFindings = sqliteTable("site_crawl_findings", {
   id: text("id").primaryKey(),
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
@@ -1915,12 +2055,31 @@ var trafficSources = sqliteTable("traffic_sources", {
   lastEventIds: text("last_event_ids", { mode: "json" }).$type(),
   archivedAt: text("archived_at"),
   configJson: text("config_json", { mode: "json" }).$type().notNull().default({}),
+  // sha256 hex of the per-source bearer token issued at connect time. Only
+  // populated for push-receive source types (currently `cloudflare`); pull
+  // adapters leave this NULL. The cleartext bearer + HMAC secret never live
+  // in the DB — they go to `~/.canonry/config.yaml` under the per-type
+  // connections block.
+  ingestTokenHash: text("ingest_token_hash"),
+  // Semver reported by the most recent forwarded event. Drives the
+  // `traffic.source.worker-version` doctor check. NULL until the first
+  // event arrives or for source types that don't forward versioned events.
+  lastWorkerVersion: text("last_worker_version"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (table) => [
   index("idx_traffic_sources_project").on(table.projectId),
   index("idx_traffic_sources_project_status").on(table.projectId, table.status)
 ]);
+var trafficEventReceipts = sqliteTable("traffic_event_receipts", {
+  sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
+  eventId: text("event_id").notNull(),
+  receivedAt: text("received_at").notNull(),
+  expiresAt: text("expires_at").notNull()
+}, (table) => [
+  primaryKey({ columns: [table.sourceId, table.eventId] }),
+  index("idx_traffic_event_receipts_expires").on(table.sourceId, table.expiresAt)
+]);
 var crawlerEventsHourly = sqliteTable("crawler_events_hourly", {
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
@@ -5526,6 +5685,126 @@ var MIGRATION_VERSIONS = [
       `CREATE INDEX IF NOT EXISTS idx_site_crawl_receipts_project_run
         ON site_crawl_event_receipts(project_id, run_id, attempt_id)`
     ]
+  },
+  {
+    // Graph coordinates are optional derived snapshot data. Separate tables
+    // preserve the canonical crawl-page shape and make a missing row the
+    // truthful compatibility signal for snapshots published before v127.
+    version: 127,
+    name: "site-crawl-persisted-graph-layout",
+    statements: [
+      `CREATE TABLE IF NOT EXISTS site_crawl_graph_layouts (
+        id             TEXT PRIMARY KEY,
+        project_id     TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        run_id         TEXT NOT NULL,
+        attempt_id     TEXT NOT NULL,
+        state          TEXT NOT NULL CHECK (state IN ('ready', 'unavailable')),
+        layout_version TEXT,
+        failure_code   TEXT,
+        total_nodes    INTEGER NOT NULL DEFAULT 0,
+        total_edges    INTEGER NOT NULL DEFAULT 0,
+        node_count     INTEGER NOT NULL DEFAULT 0,
+        edge_count     INTEGER NOT NULL DEFAULT 0,
+        created_at     TEXT NOT NULL,
+        updated_at     TEXT NOT NULL,
+        FOREIGN KEY (project_id, run_id, attempt_id)
+          REFERENCES site_crawl_attempts(project_id, run_id, id) ON DELETE CASCADE
+      )`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_site_crawl_graph_layouts_attempt
+        ON site_crawl_graph_layouts(project_id, run_id, attempt_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_layouts_run
+        ON site_crawl_graph_layouts(project_id, run_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_edges_graph_sample
+        ON site_crawl_edges(project_id, run_id, attempt_id, internal, relation, occurrences DESC, edge_key ASC)`,
+      `CREATE TABLE IF NOT EXISTS site_crawl_graph_nodes (
+        id          TEXT PRIMARY KEY,
+        project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        run_id      TEXT NOT NULL,
+        attempt_id  TEXT NOT NULL,
+        node_key    TEXT NOT NULL,
+        sample_rank INTEGER NOT NULL CHECK (sample_rank >= 0),
+        x           REAL NOT NULL,
+        y           REAL NOT NULL,
+        created_at  TEXT NOT NULL,
+        FOREIGN KEY (project_id, run_id, attempt_id)
+          REFERENCES site_crawl_graph_layouts(project_id, run_id, attempt_id) ON DELETE CASCADE,
+        FOREIGN KEY (project_id, run_id, attempt_id, node_key)
+          REFERENCES site_crawl_pages(project_id, run_id, attempt_id, node_key) ON DELETE CASCADE
+      )`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_site_crawl_graph_nodes_attempt_node
+        ON site_crawl_graph_nodes(project_id, run_id, attempt_id, node_key)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_site_crawl_graph_nodes_attempt_rank
+        ON site_crawl_graph_nodes(project_id, run_id, attempt_id, sample_rank)`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_nodes_read
+        ON site_crawl_graph_nodes(project_id, run_id, attempt_id, sample_rank)`,
+      `CREATE TABLE IF NOT EXISTS site_crawl_graph_edges (
+        id              TEXT PRIMARY KEY,
+        project_id      TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        run_id          TEXT NOT NULL,
+        attempt_id      TEXT NOT NULL,
+        edge_key        TEXT NOT NULL,
+        sample_rank     INTEGER NOT NULL CHECK (sample_rank >= 0),
+        source_node_key TEXT NOT NULL,
+        target_node_key TEXT NOT NULL,
+        followable      INTEGER NOT NULL,
+        occurrences     INTEGER NOT NULL CHECK (occurrences > 0),
+        created_at      TEXT NOT NULL,
+        FOREIGN KEY (project_id, run_id, attempt_id)
+          REFERENCES site_crawl_graph_layouts(project_id, run_id, attempt_id) ON DELETE CASCADE,
+        FOREIGN KEY (project_id, run_id, attempt_id, source_node_key)
+          REFERENCES site_crawl_graph_nodes(project_id, run_id, attempt_id, node_key) ON DELETE CASCADE,
+        FOREIGN KEY (project_id, run_id, attempt_id, target_node_key)
+          REFERENCES site_crawl_graph_nodes(project_id, run_id, attempt_id, node_key) ON DELETE CASCADE,
+        FOREIGN KEY (project_id, run_id, attempt_id, edge_key)
+          REFERENCES site_crawl_edges(project_id, run_id, attempt_id, edge_key) ON DELETE CASCADE
+      )`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_attempt_edge
+        ON site_crawl_graph_edges(project_id, run_id, attempt_id, edge_key)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_attempt_rank
+        ON site_crawl_graph_edges(project_id, run_id, attempt_id, sample_rank)`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_read
+        ON site_crawl_graph_edges(project_id, run_id, attempt_id, sample_rank)`
+    ]
+  },
+  {
+    // Keep the operator-requested root beside the terminal root without
+    // rewriting immutable historical snapshots. The edge indexes make layout
+    // cleanup/cascades linear at the graph's 20k/50k publish cap.
+    version: 128,
+    name: "site-crawl-requested-root-and-graph-edge-cleanup-indexes",
+    statements: [
+      `ALTER TABLE site_crawl_snapshots ADD COLUMN requested_root_url TEXT`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_source_node
+        ON site_crawl_graph_edges(project_id, run_id, attempt_id, source_node_key)`,
+      `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_target_node
+        ON site_crawl_graph_edges(project_id, run_id, attempt_id, target_node_key)`
+    ]
+  },
+  {
+    version: 129,
+    name: "traffic-ingest-foundation",
+    // Push-receive traffic sources (currently only `cloudflare`) need a
+    // per-source bearer for the Worker to authenticate against canonry's
+    // ingest endpoint, plus a place to remember the deployed Worker version.
+    // Durable receipts are transport-neutral: direct push and a future Queue
+    // pull consumer both claim an event in the same transaction as rollups.
+    // Cleartext credentials remain outside the database.
+    //
+    // Idempotent: `ALTER TABLE ADD COLUMN` errors with "duplicate column
+    // name" on retry, which the runner already swallows.
+    statements: [
+      `ALTER TABLE traffic_sources ADD COLUMN ingest_token_hash TEXT`,
+      `ALTER TABLE traffic_sources ADD COLUMN last_worker_version TEXT`,
+      `CREATE TABLE IF NOT EXISTS traffic_event_receipts (
+        source_id  TEXT NOT NULL REFERENCES traffic_sources(id) ON DELETE CASCADE,
+        event_id   TEXT NOT NULL,
+        received_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, event_id)
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_traffic_event_receipts_expires
+        ON traffic_event_receipts(source_id, expires_at)`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -7465,7 +7744,7 @@ function buildMentionShare(snapshots, options) {
     competitorCounts.set(competitor.domain, 0);
     competitorAliases.set(
       competitor.domain,
-      competitor.brandTokens.filter((alias) => brandKeyFromText(alias).length >= 3)
+      competitor.brandTokens.filter((alias2) => brandKeyFromText(alias2).length >= 3)
     );
   }
   for (const snap of snapshots) {
@@ -8333,6 +8612,7 @@ function shouldSkipAuth(url) {
   if (url.endsWith("/session") || url.endsWith("/session/setup")) return true;
   if (url.endsWith("/auth/session") || url.endsWith("/auth/login") || url.endsWith("/auth/logout")) return true;
   if (url.endsWith("/auth/sessions")) return true;
+  if (url.endsWith("/traffic/cloudflare/ingest")) return true;
   return false;
 }
 var USERS_READ_SCOPE = "users.read";
@@ -8398,7 +8678,7 @@ function isOverviewRead(url) {
 }
 function isTechnicalAeoRead(url) {
   const rest = projectRouteRest(url);
-  return rest === "technical-aeo" || rest === "technical-aeo/pages" || rest === "technical-aeo/trend" || rest === "technical-aeo/crawl" || rest === "technical-aeo/crawl/pages" || rest === "technical-aeo/structure" || rest === "technical-aeo/internal-links" || rest === "technical-aeo/internal-links/neighbors" || rest === "technical-aeo/dead-links";
+  return rest === "technical-aeo" || rest === "technical-aeo/pages" || rest === "technical-aeo/trend" || rest === "technical-aeo/crawl" || rest === "technical-aeo/graph" || rest === "technical-aeo/subgraph" || rest === "technical-aeo/path" || rest === "technical-aeo/changes" || rest === "technical-aeo/crawl/pages/audit" || rest === "technical-aeo/crawl/pages" || rest === "technical-aeo/structure" || rest === "technical-aeo/internal-links" || rest === "technical-aeo/internal-links/neighbors" || rest === "technical-aeo/dead-links";
 }
 function isReportRead(url) {
   const rest = projectRouteRest(url);
@@ -9766,9 +10046,9 @@ function aliasMatchesAt(textWords, aliasWords, start) {
 }
 function containsAnyAlias(answerText, aliases) {
   const textWords = words(answerText);
-  const candidates = aliases.map(words).filter((alias) => alias.length > 0);
+  const candidates = aliases.map(words).filter((alias2) => alias2.length > 0);
   for (let start = 0; start < textWords.length; start++) {
-    if (candidates.some((alias) => aliasMatchesAt(textWords, alias, start))) return true;
+    if (candidates.some((alias2) => aliasMatchesAt(textWords, alias2, start))) return true;
   }
   return false;
 }
@@ -9776,9 +10056,9 @@ function mentionedTargets(answerText, targets) {
   const result = /* @__PURE__ */ new Set();
   if (answerText === null) return result;
   const textWords = words(answerText);
-  const aliases = targets.flatMap((target) => target.aliases.map((alias) => ({ targetId: target.id, words: words(alias) }))).filter((alias) => alias.words.length > 0);
+  const aliases = targets.flatMap((target) => target.aliases.map((alias2) => ({ targetId: target.id, words: words(alias2) }))).filter((alias2) => alias2.words.length > 0);
   for (let start = 0; start < textWords.length; ) {
-    const matches = aliases.filter((alias) => aliasMatchesAt(textWords, alias.words, start));
+    const matches = aliases.filter((alias2) => aliasMatchesAt(textWords, alias2.words, start));
     if (matches.length === 0) {
       start++;
       continue;
@@ -9862,7 +10142,7 @@ function prepareReport(input) {
   }
   const answers = [];
   const mentionableIds = new Set(
-    input.targets.filter((target) => target.aliases.some((alias) => words(alias).length > 0)).map((target) => target.id)
+    input.targets.filter((target) => target.aliases.some((alias2) => words(alias2).length > 0)).map((target) => target.id)
   );
   for (const observation of observationsBySlot.values()) {
     const edges = [...edgesByExecution.get(observation.slot.executionId) ?? []].sort((left, right) => compareText(left.id, right.id));
@@ -9985,7 +10265,7 @@ function targetCoverageRate(targetIds, slots, edges, prepared) {
 }
 function mentionRate(target, slots, prepared) {
   const numerator = slots.filter((slot) => prepared.observationsBySlot.get(slot.id)?.mentionedTargetIds.has(target.id)).length;
-  if (target.aliases.every((alias) => words(alias).length === 0)) {
+  if (target.aliases.every((alias2) => words(alias2).length === 0)) {
     return { numerator: null, denominator: null, rate: null, reason: "aliasless" };
   }
   if (slots.length === 0) return { numerator: null, denominator: null, rate: null, reason: "no-population" };
@@ -10013,11 +10293,11 @@ function buildSovForSlots(slots, competitors2, projectBrandNames, projectDomain,
     let reason = null;
     if (selected.length === 0) reason = "no-population";
     else if (!status.complete || !status.answerComplete) reason = "incomplete";
-    else if (projectBrandNames.every((alias) => words(alias).length === 0)) reason = "no-project-aliases";
+    else if (projectBrandNames.every((alias2) => words(alias2).length === 0)) reason = "no-project-aliases";
     else if (sortedCompetitors.length === 0) reason = "no-competitors";
     return rows.map((row) => {
       if (reason !== null) return { domain: row.domain, own: row.own, presentIn: null, of: null, reason };
-      if (row.aliases.every((alias) => words(alias).length === 0)) {
+      if (row.aliases.every((alias2) => words(alias2).length === 0)) {
         return { domain: row.domain, own: row.own, presentIn: null, of: null, reason: "aliasless" };
       }
       const presentIn = selected.filter((slot) => {
@@ -10167,7 +10447,7 @@ function mentionedForEdge(observation, edge, mentionableIds) {
   return observation.mentionedTargetIds.has(edge.targetId);
 }
 function mentionableTargets(input, targetIds) {
-  return input.targets.filter((target) => targetIds.has(target.id) && target.aliases.some((alias) => words(alias).length > 0));
+  return input.targets.filter((target) => targetIds.has(target.id) && target.aliases.some((alias2) => words(alias2).length > 0));
 }
 function scopeMentionRate(input, targetIds, slots, answered, prepared) {
   const mentionable = mentionableTargets(input, targetIds);
@@ -10193,7 +10473,7 @@ function indexedScopeCitationRate(slots, edges, indexes) {
   return { numerator, denominator: basis.length, rate: numerator / basis.length };
 }
 function targetMentionRate(targets, slots, answered, indexes) {
-  const mentionable = targets?.filter((target) => target.aliases.some((alias) => words(alias).length > 0)) ?? [];
+  const mentionable = targets?.filter((target) => target.aliases.some((alias2) => words(alias2).length > 0)) ?? [];
   if (mentionable.length === 0) return unavailable("aliasless");
   if (slots.length === 0) return unavailable("no-population");
   if (answered.length === 0) return unavailable("evidence-incomplete");
@@ -10209,7 +10489,7 @@ function presenceIn(slots, aliases, prepared) {
 }
 function scopeBrandPresence(input, slots, answered, prepared) {
   if (slots.length === 0) return unavailable("no-population");
-  if (input.projectBrandNames.every((alias) => words(alias).length === 0)) return unavailable("no-project-aliases");
+  if (input.projectBrandNames.every((alias2) => words(alias2).length === 0)) return unavailable("no-project-aliases");
   if (answered.length === 0) return unavailable("evidence-incomplete");
   const numerator = presenceIn(answered, input.projectBrandNames, prepared);
   return { numerator, denominator: answered.length, rate: numerator / answered.length };
@@ -10508,8 +10788,8 @@ function reportInput(revision, plan, manifest, snapshots, legacy) {
       label: group.label,
       targetIds: group.targetKeys,
       competitors: (group.competitors ?? []).map((domain) => {
-        const alias = brandLabelFromDomain(domain);
-        return { domain, aliases: brandKeyFromText(alias).length >= 4 ? [alias] : [] };
+        const alias2 = brandLabelFromDomain(domain);
+        return { domain, aliases: brandKeyFromText(alias2).length >= 4 ? [alias2] : [] };
       })
     })),
     expectedSlots: slots,
@@ -12029,7 +12309,7 @@ function compileRules(input) {
   const aliases = (input.rules.aliases ?? []).map(
     (rule, index2) => compileRouteRule(rule, `rules.aliases[${index2}]`, ownedHosts)
   );
-  if (aliases.some((alias) => alias.host === primary.host)) {
+  if (aliases.some((alias2) => alias2.host === primary.host)) {
     throw new MeasurementDiscoveryConfigurationError("alias rules must use another owned host");
   }
   const excludedSlugSuffixes = sortedUnique3(
@@ -12947,14 +13227,14 @@ function compileMeasurementDraft(authoring, context) {
       matcherClaims.set(identity, target.stableKey);
       matchers.push(matcher);
     });
-    target.aliases.forEach((alias, aliasIndex) => {
-      const identity = measurementMentionAliasKey(alias);
+    target.aliases.forEach((alias2, aliasIndex) => {
+      const identity = measurementMentionAliasKey(alias2);
       if (!identity) return;
       const claimedBy = aliasClaims.get(identity);
       if (claimedBy !== void 0 && claimedBy !== target.stableKey) {
         sink.fail(
           "target-alias-ambiguous",
-          `Target alias normalizes to the same mention identity claimed by Target ${claimedBy}: ${alias}`,
+          `Target alias normalizes to the same mention identity claimed by Target ${claimedBy}: ${alias2}`,
           ["targets", targetIndex, "aliases", aliasIndex]
         );
         return;
@@ -27123,17 +27403,26 @@ var SCHEMA_TABLE = {
   SiteAuditScoreDto: siteAuditScoreSchema,
   SiteAuditTrendResponseDto: siteAuditTrendResponseSchema,
   SiteCrawlDeadLinksResponseDto: siteCrawlDeadLinksResponseSchema,
+  SiteCrawlGraphResponseDto: siteCrawlGraphResponseSchema,
   SiteCrawlInternalLinksResponseDto: siteCrawlInternalLinksResponseSchema,
   SiteCrawlNeighborsResponseDto: siteCrawlNeighborsResponseSchema,
+  SiteCrawlPageAuditDto: siteCrawlPageAuditSchema,
   SiteCrawlPagesResponseDto: siteCrawlPagesResponseSchema,
   SiteCrawlStructureResponseDto: siteCrawlStructureResponseSchema,
   SiteCrawlSummaryDto: siteCrawlSummarySchema,
+  SiteHealthChangesResponseDto: siteHealthChangesResponseSchema,
+  SiteHealthPathResponseDto: siteHealthPathResponseSchema,
+  SiteHealthSubgraphResponseDto: siteHealthSubgraphResponseSchema,
   SnapshotDiffResponse: snapshotDiffResponseSchema,
   SnapshotListResponse: snapshotListResponseSchema,
   SnapshotReportDto: snapshotReportSchema,
   SourceBreakdownDto: sourceBreakdownDtoSchema,
   TelemetryEventAcceptedDto: telemetryEventAcceptedDtoSchema,
+  CloudflareWorkerIngestRequest: cloudflareWorkerIngestRequestSchema,
+  CloudflareWorkerIngestResponse: cloudflareWorkerIngestResponseSchema,
   TrafficBackfillResponse: trafficBackfillResponseSchema,
+  TrafficConnectCloudflareRequest: trafficConnectCloudflareRequestSchema,
+  TrafficConnectCloudflareResponse: trafficConnectCloudflareResponseSchema,
   TrafficEventsResponse: trafficEventsResponseSchema,
   TrafficSourceDetailDto: trafficSourceDetailDtoSchema,
   TrafficSourceDto: trafficSourceDtoSchema,
@@ -32701,6 +32990,54 @@ var routeCatalog = [
       502: errorResponse("Vercel request-logs endpoint probe failed (bad token, wrong project / team id, unreachable host, etc.).")
     }
   },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/connect/cloudflare",
+    summary: "Connect a Cloudflare Worker traffic source",
+    description: "Creates or updates a Cloudflare `direct-push` traffic source and returns a secret-free ES-module Worker plus Wrangler configuration. Per-source bearer and HMAC credentials remain in Canonry's credential store and are installed as Worker secret bindings; neither secret appears in source, TOML, API, or MCP output. Reconnect is idempotent: it reuses a matching source and credentials, preserves omitted metadata, and emits the current deployment package. Wrangler deploys the Worker without a route. The operator must attach the exact site route manually and set its Request limit failure mode to Fail open. No upstream probe is performed at connect time.",
+    tags: ["traffic"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: false,
+      content: {
+        "application/json": {
+          schema: { $ref: "#/components/schemas/TrafficConnectCloudflareRequest" }
+        }
+      }
+    },
+    responses: {
+      200: jsonResponse("Connect response with generated Worker script.", "TrafficConnectCloudflareResponse"),
+      400: errorResponse("Invalid Cloudflare connection request or credential storage not configured."),
+      404: errorResponse("Project not found.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/cloudflare/ingest",
+    summary: "Ingest a batch of Cloudflare Worker events",
+    description: "Direct-push protocol endpoint. The customer Worker sends selected edge-event batches authenticated by a per-source bearer and HMAC-SHA256 over `${timestamp}.${canonicalJson(payload)}`; object keys are sorted recursively before signing. The global cnry_* bearer does not apply. Headers: `Authorization: Bearer <per-source-token>`, `X-Canonry-Timestamp` (unix seconds), `X-Canonry-Signature` (hex HMAC), `X-Canonry-Source-Id`, and `X-Canonry-Worker-Version`. Authentication completes before project resolution and every auth/path/source mismatch returns the same 401. Accepted event ids are claimed durably in the same transaction as shared crawler, user-fetch, and paid/organic referral rollups.",
+    tags: ["traffic"],
+    auth: false,
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: {
+        "application/json": {
+          schema: { $ref: "#/components/schemas/CloudflareWorkerIngestRequest" }
+        }
+      }
+    },
+    responses: {
+      200: jsonResponse(
+        "Ingest acknowledged; droppedEvents includes normalization failures and durable-receipt duplicates.",
+        "CloudflareWorkerIngestResponse"
+      ),
+      400: errorResponse("Invalid ingest payload."),
+      401: errorResponse("Authentication failed (bearer, signature, timestamp, or source id mismatch)."),
+      413: errorResponse("The ingest payload exceeds 256 KiB."),
+      429: errorResponse("The per-IP or authenticated-source ingest request budget was exceeded.")
+    }
+  },
   {
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/sync",
@@ -33062,6 +33399,103 @@ var routeCatalog = [
       404: errorResponse("Project or crawl-bearing site-audit run not found.")
     }
   },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/graph",
+    summary: "Get a persisted Site Health graph projection",
+    description: "Returns the deterministic graph projection computed once when the latest complete or selected historical crawl was published. ForceAtlas2 positions and the exact internal-anchor edge sample are persisted, so reads run no layout physics and never rescan the crawl edge table. The response is bounded to 20,000 nodes / 50,000 edges; `layout`, `omittedNodes`, `omittedEdges`, and `sampled` disclose legacy/unavailable layouts and intentional truncation.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest complete crawl.", schema: stringSchema },
+      { name: "maxNodes", in: "query", description: "Maximum graph nodes. Defaults to and is capped at 20,000.", schema: { type: "integer", minimum: 1, maximum: 2e4 } },
+      { name: "maxEdges", in: "query", description: "Maximum graph edges. Defaults to and is capped at 50,000.", schema: { type: "integer", minimum: 1, maximum: 5e4 } }
+    ],
+    responses: {
+      200: jsonResponse("Bounded Site Health graph projection returned.", "SiteCrawlGraphResponseDto"),
+      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/subgraph",
+    summary: "Get a bounded canonical Site Health neighborhood",
+    description: "Agent-oriented canonical crawl neighborhood around one page. Reads full crawl page/link rows rather than the sampled visualization, excludes layout coordinates, and returns snapshot completeness/termination. When a hard bound is reached, countAccuracy=lower-bound makes totalNodes, totalEdges, omittedNodes, and omittedEdges explicit minimums rather than false exact totals.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest complete crawl.", schema: stringSchema },
+      { name: "nodeKey", in: "query", description: "Focus page canonical node key. Omit nodeKey and url to use the crawl root.", schema: stringSchema },
+      { name: "url", in: "query", description: "Focus page canonical URL. Omit nodeKey and url to use the crawl root.", schema: stringSchema },
+      { name: "hops", in: "query", description: "Undirected neighborhood radius. Defaults to 1; maximum 3.", schema: { type: "integer", minimum: 0, maximum: 3 } },
+      { name: "maxNodes", in: "query", description: "Maximum canonical nodes. Defaults to 25; maximum 200.", schema: { type: "integer", minimum: 1, maximum: 200 } },
+      { name: "maxEdges", in: "query", description: "Maximum canonical edges. Defaults to 50; maximum 500.", schema: { type: "integer", minimum: 1, maximum: 500 } }
+    ],
+    responses: {
+      200: jsonResponse("Bounded canonical Site Health neighborhood returned.", "SiteHealthSubgraphResponseDto"),
+      404: errorResponse("Project, crawl-bearing run, or focus page not found.")
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/path",
+    summary: "Find a directed internal-link path between pages",
+    description: "Returns the shortest directed path over followable internal anchor links. The source defaults to the crawl root; the target must be identified by toNodeKey or toUrl. Exploration is bounded to 5,000 nodes and returns an explicit unreachable or truncated state. Snapshot complete and termination provenance prevents an unreachable result from a selected partial crawl being mistaken for a site-wide claim.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest complete crawl.", schema: stringSchema },
+      { name: "fromNodeKey", in: "query", description: "Source canonical node key. Omit both source selectors to start at the crawl root.", schema: stringSchema },
+      { name: "fromUrl", in: "query", description: "Source canonical URL. Omit both source selectors to start at the crawl root.", schema: stringSchema },
+      { name: "toNodeKey", in: "query", description: "Target canonical node key. Required when toUrl is omitted.", schema: stringSchema },
+      { name: "toUrl", in: "query", description: "Target canonical URL. Required when toNodeKey is omitted.", schema: stringSchema },
+      { name: "maxDepth", in: "query", description: "Maximum directed link depth. Defaults to 12; maximum 24.", schema: { type: "integer", minimum: 1, maximum: 24 } }
+    ],
+    responses: {
+      200: jsonResponse("Directed internal-link path result returned.", "SiteHealthPathResponseDto"),
+      400: errorResponse("A target selector is required."),
+      404: errorResponse("Project, crawl-bearing run, source page, or target page not found.")
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/changes",
+    summary: "Compare canonical Site Health snapshots",
+    description: "Returns exact page and internal-link additions, removals, and semantic field changes between immutable complete crawl snapshots. Omitted toRunId selects the latest complete crawl; omitted fromRunId selects the complete crawl immediately before the target. ForceAtlas2 positions are presentation data and never count as a change. The first page includes exact post-filter summary counts; cursor pages set summary and total to null so they never repeat full snapshot joins or trust caller-carried counts. Results use a snapshot- and filter-bound keyset cursor.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "fromRunId", in: "query", description: "Baseline complete crawl. Omit for the complete crawl immediately before the target.", schema: stringSchema },
+      { name: "toRunId", in: "query", description: "Target complete crawl. Omit for the latest complete crawl.", schema: stringSchema },
+      { name: "scope", in: "query", description: "Restrict records and first-page summary counts to pages, links, or both.", schema: { type: "string", enum: ["all", "pages", "links"], default: "all" } },
+      { name: "change", in: "query", description: "Restrict records and first-page summary counts to one change kind.", schema: { type: "string", enum: ["all", "added", "removed", "changed"], default: "all" } },
+      { name: "cursor", in: "query", description: "Opaque keyset cursor bound to both run IDs and the selected filters.", schema: stringSchema },
+      { name: "limit", in: "query", description: "Maximum change records. Defaults to 25; maximum 100.", schema: { type: "integer", minimum: 1, maximum: 100 } }
+    ],
+    responses: {
+      200: jsonResponse("Canonical Site Health snapshot comparison returned.", "SiteHealthChangesResponseDto"),
+      400: errorResponse("Invalid filters, run direction, or cursor context."),
+      404: errorResponse("Project or selected crawl-bearing run not found.")
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/crawl/pages/audit",
+    summary: "Get exact audit evidence for one persisted crawl page",
+    description: "Returns one page score with the exact weighted-factor findings, recommendations, applicability, and independent critical defects persisted for the selected crawl. Exactly one of nodeKey or url is required. The discriminated state preserves crawl completeness and termination provenance, distinguishes a page that was not audited from one that was not found, and marks legacy score-only rows without fabricating missing evidence. This one-page read keeps verbose evidence out of the bounded interactive graph projection.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest complete crawl.", schema: stringSchema },
+      { name: "nodeKey", in: "query", description: "Exact canonical crawl node key. Required when url is omitted.", schema: stringSchema },
+      { name: "url", in: "query", description: "Exact persisted crawl URL. Required when nodeKey is omitted.", schema: stringSchema }
+    ],
+    responses: {
+      200: jsonResponse("Page audit evidence state returned.", "SiteCrawlPageAuditDto"),
+      400: errorResponse("Exactly one page selector is required."),
+      404: errorResponse("Project or explicitly selected crawl-bearing run not found.")
+    }
+  },
   {
     method: "get",
     path: "/api/v1/projects/{name}/technical-aeo/crawl/pages",
@@ -46482,7 +46916,7 @@ async function queryBacklinks(opts) {
   const reversed = opts.targets.map(reverseDomain);
   const targetList = reversed.map(quote).join(", ");
   const limitClause = opts.limitPerTarget ? `QUALIFY row_number() OVER (PARTITION BY t.target_rev_domain ORDER BY v.num_hosts DESC) <= ${Math.floor(opts.limitPerTarget)}` : "";
-  const sql20 = `
+  const sql22 = `
     WITH vertices AS (
       SELECT * FROM read_csv(
         ${quote(opts.vertexPath)},
@@ -46518,7 +46952,7 @@ async function queryBacklinks(opts) {
   const conn = await instance.connect();
   let rows;
   try {
-    const reader = await conn.runAndReadAll(sql20);
+    const reader = await conn.runAndReadAll(sql22);
     rows = reader.getRowObjects();
   } finally {
     conn.disconnectSync?.();
@@ -46974,9 +47408,10 @@ async function backlinksRoutes(app, opts) {
 }
 
 // ../api-routes/src/traffic.ts
-import crypto39 from "crypto";
+import crypto40 from "crypto";
+import { isIP } from "net";
 import { Agent as UndiciAgent } from "undici";
-import { and as and38, desc as desc22, eq as eq46, gte as gte10, lte as lte9, sql as sql18 } from "drizzle-orm";
+import { and as and39, desc as desc22, eq as eq47, gte as gte11, lte as lte10, sql as sql19 } from "drizzle-orm";
 
 // ../api-routes/src/traffic-limits.ts
 var VERCEL_MAX_SYNC_WINDOW_MS = 24 * 60 * 6e4;
@@ -49760,6 +50195,39 @@ var DEFAULT_AI_CRAWLER_RULES = [
     userAgentPatterns: [/Amazonbot\//i]
   }
 ];
+var DEFAULT_AI_CRAWLER_USER_AGENT_SUBSTRINGS = [
+  "GPTBot/",
+  "OAI-SearchBot/",
+  "ChatGPT-User/",
+  "ClaudeBot/",
+  "Claude-Web/",
+  "Claude-SearchBot/",
+  "Claude-User/",
+  "anthropic-ai",
+  "PerplexityBot/",
+  "Google-Extended",
+  "Google-Agent",
+  "Bytespider",
+  "Applebot-Extended",
+  "Applebot/",
+  "meta-externalagent",
+  "CCBot/",
+  "cohere-ai",
+  "Diffbot",
+  "MistralAI-User/",
+  "MistralBot/",
+  "DeepSeekBot",
+  "xAI-Bot/",
+  "Grok-Bot/",
+  "GrokBot/",
+  "Googlebot",
+  "bingbot/",
+  "DuckDuckBot",
+  "YandexBot/",
+  "Baiduspider",
+  "Amazonbot/",
+  "Perplexity-User/"
+];
 var DEFAULT_AI_REFERRER_RULES = [
   { domain: AI_ENGINE_DOMAINS.chatgpt, operator: "OpenAI", product: "ChatGPT" },
   { domain: LEGACY_CHATGPT_DOMAIN, operator: "OpenAI", product: "ChatGPT" },
@@ -50780,6 +51248,716 @@ async function drainVercelTrafficEvents(options) {
   return { events, subWindowCount, effectiveStartMs, retentionClamped, truncatedSliceCount, truncatedSliceStartsMs, deadlineSkippedSliceCount: deadlineSkippedSliceStartsMs.length, deadlineSkippedSliceStartsMs, drainedThroughMs: cursorMs, deadlineReached };
 }
 
+// ../integration-cloudflare-worker/src/canonical-json.ts
+function canonicalizeCloudflareJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Cloudflare canonical JSON does not support non-finite numbers");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item2) => canonicalizeCloudflareJson(item2)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const fields = [];
+    for (const key of Object.keys(record).sort()) {
+      const fieldValue = record[key];
+      if (fieldValue === void 0) continue;
+      fields.push(`${JSON.stringify(key)}:${canonicalizeCloudflareJson(fieldValue)}`);
+    }
+    return `{${fields.join(",")}}`;
+  }
+  throw new TypeError(`Cloudflare canonical JSON does not support ${typeof value}`);
+}
+
+// ../integration-cloudflare-worker/src/normalize.ts
+function emptyToNull2(value) {
+  if (value === null || value.trim() === "") return null;
+  return value;
+}
+function maybeLabel(value) {
+  if (value === null) return void 0;
+  if (typeof value === "string" && value === "") return void 0;
+  return String(value);
+}
+function buildProviderLabels(cf) {
+  if (!cf) return {};
+  const candidates = {
+    verifiedBot: maybeLabel(cf.verifiedBot),
+    botScore: maybeLabel(cf.botScore),
+    country: maybeLabel(cf.country),
+    asn: maybeLabel(cf.asn),
+    asOrganization: maybeLabel(cf.asOrganization)
+  };
+  return Object.fromEntries(
+    Object.entries(candidates).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+}
+function normalizeCloudflareEdgeEvent(event) {
+  if (!event.path) return null;
+  if (!event.observedAt) return null;
+  if (!event.eventId) return null;
+  const host = emptyToNull2(event.host);
+  const path8 = event.path;
+  const queryString = emptyToNull2(event.queryString);
+  const requestUrl = host ? `https://${host}${path8}${queryString ? `?${queryString}` : ""}` : null;
+  return {
+    sourceType: TrafficSourceTypes.cloudflare,
+    evidenceKind: TrafficEvidenceKinds["raw-request"],
+    confidence: TrafficEventConfidences.observed,
+    eventId: `cloudflare-worker:${event.eventId}`,
+    observedAt: event.observedAt,
+    method: emptyToNull2(event.method),
+    requestUrl,
+    host,
+    path: path8,
+    queryString,
+    status: event.status,
+    userAgent: emptyToNull2(event.userAgent),
+    remoteIp: emptyToNull2(event.remoteIp),
+    referer: emptyToNull2(event.referer),
+    latencyMs: null,
+    requestSizeBytes: null,
+    responseSizeBytes: null,
+    providerResource: {
+      type: "cloudflare_zone",
+      labels: {}
+    },
+    providerLabels: buildProviderLabels(event.cf)
+  };
+}
+var normalizeCloudflareWorkerEvent = normalizeCloudflareEdgeEvent;
+
+// ../integration-cloudflare-worker/src/types.ts
+var CLOUDFLARE_WORKER_BINDINGS = {
+  deliveryMode: "CANONRY_DELIVERY_MODE",
+  sourceId: "CANONRY_SOURCE_ID",
+  ingestUrl: "CANONRY_INGEST_URL",
+  workerVersion: "CANONRY_WORKER_VERSION",
+  bearerToken: "CANONRY_BEARER_TOKEN",
+  hmacSecret: "CANONRY_HMAC_SECRET"
+};
+var CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS = [
+  CLOUDFLARE_WORKER_BINDINGS.bearerToken,
+  CLOUDFLARE_WORKER_BINDINGS.hmacSecret
+];
+var CLOUDFLARE_WORKER_GENERATED_MARKER = "// canonry traffic Worker \u2014 generated; do not edit by hand";
+var CLOUDFLARE_WRANGLER_GENERATED_MARKER = "# canonry traffic Worker configuration \u2014 generated; do not edit by hand";
+
+// ../integration-cloudflare-worker/src/script.ts
+var DEFAULT_BOT_LIST = {
+  version: "2026-08-09",
+  uaKeywords: [
+    ...DEFAULT_AI_CRAWLER_USER_AGENT_SUBSTRINGS,
+    // Preserve a small forward-looking machine-traffic net. The shared
+    // classifier still drops unknown products after delivery.
+    "bot",
+    "crawler",
+    "spider"
+  ],
+  refererDomains: DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain),
+  utmSourceTokens: [
+    .../* @__PURE__ */ new Set([
+      ...DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain),
+      ...DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain.split(".")[0]),
+      // Legacy chat.openai.com referrals classify from their first label.
+      "chat"
+    ])
+  ]
+};
+var DEFAULT_BOT_SCORE_MAX_FORWARD = 30;
+var WORKER_COMPATIBILITY_DATE = "2026-05-01";
+function jsString(value) {
+  return JSON.stringify(value);
+}
+function jsArray(values) {
+  return `[${values.map((v) => jsString(v)).join(", ")}]`;
+}
+function generateWorkerScript(opts) {
+  const botScoreMax = opts.botScoreMaxForward ?? DEFAULT_BOT_SCORE_MAX_FORWARD;
+  const canonicalJsonFunction = canonicalizeCloudflareJson.toString();
+  return `${CLOUDFLARE_WORKER_GENERATED_MARKER}
+// worker version: ${opts.workerVersion}
+// bot-list version: ${opts.botList.version}
+// delivery mode: ${opts.deliveryMode}
+
+const UA_KEYWORDS = ${jsArray(opts.botList.uaKeywords)}
+const REFERER_DOMAINS = ${jsArray(opts.botList.refererDomains)}
+const UTM_SOURCE_TOKENS = ${jsArray(opts.botList.utmSourceTokens)}
+const BOT_SCORE_MAX_FORWARD = ${String(botScoreMax)}
+const RETRY_DELAYS_MS = [250, 1000]
+const canonicalizeJson = (${canonicalJsonFunction})
+
+function requireBinding(value, name) {
+  if (typeof value === 'string' && value.length > 0) return value
+  throw new Error('Missing required Worker binding: ' + name)
+}
+
+function lower(value) {
+  return typeof value === 'string' ? value.toLowerCase() : ''
+}
+
+function uaMatches(ua) {
+  const lc = lower(ua)
+  if (!lc) return false
+  for (const kw of UA_KEYWORDS) {
+    if (lc.indexOf(lower(kw)) !== -1) return true
+  }
+  return false
+}
+
+function hostMatchesKnownDomain(host) {
+  let normalized = lower(host)
+  if (normalized.startsWith('www.')) normalized = normalized.slice(4)
+  if (normalized.endsWith('.')) normalized = normalized.slice(0, -1)
+  if (!normalized) return false
+  for (const domain of REFERER_DOMAINS) {
+    if (normalized === domain || normalized.endsWith('.' + domain)) return true
+  }
+  return false
+}
+
+function refererMatches(referer) {
+  if (!referer) return false
+  try {
+    return hostMatchesKnownDomain(new URL(referer).hostname)
+  } catch (_) {
+    return false
+  }
+}
+
+function utmSourceMatches(value) {
+  let normalized = lower(value).trim()
+  if (normalized.startsWith('www.')) normalized = normalized.slice(4)
+  if (normalized.endsWith('.')) normalized = normalized.slice(0, -1)
+  if (!normalized) return false
+  if (hostMatchesKnownDomain(normalized)) return true
+  return UTM_SOURCE_TOKENS.indexOf(normalized) !== -1
+}
+
+function urlUtmMatches(value) {
+  if (!value) return false
+  try {
+    return utmSourceMatches(new URL(value).searchParams.get('utm_source'))
+  } catch (_) {
+    return false
+  }
+}
+
+function botSignals(cf) {
+  if (!cf) return false
+  const bm = cf.botManagement
+  if (bm) {
+    if (bm.verifiedBot === true) return true
+    if (typeof bm.score === 'number' && bm.score < BOT_SCORE_MAX_FORWARD) return true
+  }
+  if (typeof cf.botScore === 'number' && cf.botScore < BOT_SCORE_MAX_FORWARD) return true
+  return false
+}
+
+function shouldForward(request) {
+  const ua = request.headers.get('user-agent') || ''
+  if (uaMatches(ua)) return true
+  if (urlUtmMatches(request.url)) return true
+  const referer = request.headers.get('referer') || ''
+  if (refererMatches(referer)) return true
+  if (urlUtmMatches(referer)) return true
+  return botSignals(request.cf)
+}
+
+function toHex(buffer) {
+  const bytes = new Uint8Array(buffer)
+  let out = ''
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, '0')
+  }
+  return out
+}
+
+async function signBody(secret, timestamp, body) {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+  const sig = await crypto.subtle.sign(
+    'HMAC',
+    key,
+    new TextEncoder().encode(timestamp + '.' + body),
+  )
+  return toHex(sig)
+}
+
+function isRetryableStatus(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function cancelUnusedResponseBody(response) {
+  try {
+    if (response.body) await response.body.cancel()
+  } catch (_) {
+    // The ingest response body is unused. Cancellation failure is non-fatal.
+  }
+}
+
+async function withRetry(operation) {
+  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+    let response
+    try {
+      response = await operation()
+    } catch (error) {
+      if (attempt === RETRY_DELAYS_MS.length) throw error
+      await sleep(RETRY_DELAYS_MS[attempt])
+      continue
+    }
+
+    const status = response.status
+    const ok = response.ok
+    await cancelUnusedResponseBody(response)
+    if (ok) return
+    if (!isRetryableStatus(status) || attempt === RETRY_DELAYS_MS.length) {
+      throw new Error('Canonry ingest returned HTTP ' + status)
+    }
+    await sleep(RETRY_DELAYS_MS[attempt])
+  }
+}
+
+function pickCf(cf) {
+  if (!cf) return null
+  const bm = cf.botManagement || {}
+  return {
+    verifiedBot: typeof bm.verifiedBot === 'boolean' ? bm.verifiedBot : null,
+    botScore: typeof bm.score === 'number' ? bm.score : (typeof cf.botScore === 'number' ? cf.botScore : null),
+    country: typeof cf.country === 'string' ? cf.country : null,
+    asn: typeof cf.asn === 'number' ? cf.asn : null,
+    asOrganization: typeof cf.asOrganization === 'string' ? cf.asOrganization : null,
+  }
+}
+
+function buildEdgeEvent(request, status, observedAt) {
+  const url = new URL(request.url)
+  return {
+    eventId: request.headers.get('cf-ray') || crypto.randomUUID(),
+    observedAt,
+    method: request.method || null,
+    host: url.hostname || null,
+    path: url.pathname || '/',
+    queryString: url.search ? url.search.slice(1) : null,
+    status: typeof status === 'number' ? status : null,
+    userAgent: request.headers.get('user-agent') || null,
+    remoteIp: request.headers.get('cf-connecting-ip') || null,
+    referer: request.headers.get('referer') || null,
+    cf: pickCf(request.cf),
+  }
+}
+
+function buildEdgeEventBatch(env, request, status, observedAt) {
+  return {
+    schemaVersion: 1,
+    workerVersion: requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.workerVersion}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.workerVersion)}),
+    events: [buildEdgeEvent(request, status, observedAt)],
+  }
+}
+
+async function deliverViaDirectPush(env, batch) {
+  const sourceId = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.sourceId)})
+  const ingestUrl = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.ingestUrl}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.ingestUrl)})
+  const bearerToken = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.bearerToken}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.bearerToken)})
+  const hmacSecret = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.hmacSecret}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.hmacSecret)})
+  const body = canonicalizeJson(batch)
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const signature = await signBody(hmacSecret, timestamp, body)
+
+  await withRetry(() => fetch(ingestUrl, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'Authorization': 'Bearer ' + bearerToken,
+      'X-Canonry-Timestamp': timestamp,
+      'X-Canonry-Signature': signature,
+      'X-Canonry-Worker-Version': batch.workerVersion,
+      'X-Canonry-Source-Id': sourceId,
+    },
+    body,
+  }))
+}
+
+async function deliverEdgeEventBatch(env, batch) {
+  const deliveryMode = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.deliveryMode}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.deliveryMode)})
+  if (deliveryMode === 'direct-push') {
+    return deliverViaDirectPush(env, batch)
+  }
+  throw new Error('Unsupported Canonry delivery mode: ' + deliveryMode)
+}
+
+async function deliverSelectedRequest(env, request, status, observedAt) {
+  try {
+    const batch = buildEdgeEventBatch(env, request, status, observedAt)
+    await deliverEdgeEventBatch(env, batch)
+  } catch (err) {
+    // Delivery is statistical and must never mask the customer response.
+    // Emit binding names and source id only; never emit secret values.
+    console.warn('Canonry traffic delivery failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+  }
+}
+
+function shouldForwardSafely(env, request) {
+  try {
+    return shouldForward(request)
+  } catch (err) {
+    console.warn('Canonry traffic filter failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+    return false
+  }
+}
+
+function scheduleSelectedRequest(ctx, env, request, status, observedAt) {
+  try {
+    ctx.waitUntil(deliverSelectedRequest(env, request, status, observedAt))
+  } catch (err) {
+    console.warn('Canonry traffic delivery scheduling failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+  }
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    const observedAt = new Date().toISOString()
+    const shouldLog = shouldForwardSafely(env, request)
+    let response
+    try {
+      response = await fetch(request)
+    } catch (err) {
+      if (shouldLog) {
+        scheduleSelectedRequest(ctx, env, request, null, observedAt)
+      }
+      throw err
+    }
+    if (shouldLog) {
+      scheduleSelectedRequest(ctx, env, request, response.status, observedAt)
+    }
+    return response
+  },
+}
+`;
+}
+function generateWranglerToml(opts) {
+  const hostname = opts.hostname.trim().toLowerCase().replace(/\.$/, "");
+  const accountConfig = opts.accountId ? `account_id = ${jsString(opts.accountId)}
+` : "";
+  const zoneHint = opts.zoneId ? `# Target zone id: ${jsString(opts.zoneId)}
+` : "# Target zone id was not provided. Select the canonical site zone.\n";
+  return `${CLOUDFLARE_WRANGLER_GENERATED_MARKER}
+name = "canonry-traffic-${opts.sourceId}"
+${accountConfig}main = "worker.js"
+compatibility_date = "${WORKER_COMPATIBILITY_DATE}"
+workers_dev = false
+
+[vars]
+${CLOUDFLARE_WORKER_BINDINGS.deliveryMode} = ${jsString(opts.deliveryMode)}
+${CLOUDFLARE_WORKER_BINDINGS.sourceId} = ${jsString(opts.sourceId)}
+${CLOUDFLARE_WORKER_BINDINGS.ingestUrl} = ${jsString(opts.ingestUrl)}
+${CLOUDFLARE_WORKER_BINDINGS.workerVersion} = ${jsString(opts.workerVersion)}
+
+[secrets]
+required = ${jsArray(CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS)}
+
+# Install required Worker secrets interactively or through Canonry's deploy
+# command. Never write their values into this file:
+${CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS.map((name) => `#   wrangler secret put ${name}`).join("\n")}
+
+# Deploy this Worker via:
+#   wrangler deploy
+# Canonry intentionally does not declare a route in this file.
+# After deploy, attach this exact route in the Cloudflare dashboard:
+#   ${hostname}/*
+${zoneHint}# Set the route Request limit failure mode to Fail open before activation.
+# Wrangler cannot configure this route toggle.
+`;
+}
+
+// ../integration-cloudflare-worker/src/verify.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_MAX_AGE_SECONDS = 300;
+function verifyRequestSignature(opts) {
+  const { timestamp, signature, secret } = opts;
+  if (timestamp === "" || !/^-?\d+$/.test(timestamp)) {
+    return { ok: false, reason: "timestamp_invalid" };
+  }
+  const ts = Number(timestamp);
+  if (!Number.isFinite(ts)) return { ok: false, reason: "timestamp_invalid" };
+  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const maxAge = opts.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+  if (Math.abs(now - ts) > maxAge) return { ok: false, reason: "timestamp_expired" };
+  if (signature === "" || !/^[0-9a-f]+$/i.test(signature)) {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let provided;
+  try {
+    provided = Buffer.from(signature, "hex");
+  } catch {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let bodies;
+  try {
+    if ("body" in opts) {
+      bodies = [opts.body];
+    } else {
+      const canonical = canonicalizeCloudflareJson(opts.payload);
+      const legacy = JSON.stringify(opts.payload);
+      bodies = [canonical];
+      if (opts.acceptLegacyJson !== false && typeof legacy === "string" && legacy !== canonical) {
+        bodies.push(legacy);
+      }
+    }
+  } catch {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let comparableLength = false;
+  for (const body of bodies) {
+    const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest();
+    if (provided.length !== expected.length) continue;
+    comparableLength = true;
+    if (timingSafeEqual(provided, expected)) return { ok: true };
+  }
+  if (!comparableLength) return { ok: false, reason: "signature_invalid" };
+  return { ok: false, reason: "signature_mismatch" };
+}
+
+// ../api-routes/src/traffic-event-ingest.ts
+import crypto39 from "crypto";
+import { and as and38, eq as eq46, gte as gte10, lt as lt7, lte as lte9, sql as sql18 } from "drizzle-orm";
+var DIRECT_PUSH_RECEIPT_TTL_MS = 10 * 6e4;
+function observedUtcHourBounds(observedAt) {
+  const instant = new Date(observedAt);
+  if (Number.isNaN(instant.getTime())) return null;
+  instant.setUTCMinutes(0, 0, 0);
+  const start = instant.toISOString();
+  instant.setUTCHours(instant.getUTCHours() + 1);
+  return { start, end: instant.toISOString() };
+}
+function writeTrafficEventBatch(opts) {
+  const expiresAt = new Date(Date.parse(opts.receivedAt) + opts.receiptTtlMs).toISOString();
+  let acceptedEvents = 0;
+  let duplicateEvents = 0;
+  let crawlerBucketRows = 0;
+  let aiUserFetchBucketRows = 0;
+  let aiReferralBucketRows = 0;
+  let sampleRows = 0;
+  opts.db.transaction((tx) => {
+    tx.update(trafficSources).set({ updatedAt: sql18`${trafficSources.updatedAt}` }).where(eq46(trafficSources.id, opts.sourceId)).run();
+    const source = tx.select().from(trafficSources).where(eq46(trafficSources.id, opts.sourceId)).get();
+    opts.validateSource(source);
+    tx.delete(trafficEventReceipts).where(and38(
+      eq46(trafficEventReceipts.sourceId, opts.sourceId),
+      lte9(trafficEventReceipts.expiresAt, opts.receivedAt)
+    )).run();
+    const claimedEvents = [];
+    for (const event of opts.events) {
+      const claim = tx.insert(trafficEventReceipts).values({
+        sourceId: opts.sourceId,
+        eventId: event.eventId,
+        receivedAt: opts.receivedAt,
+        expiresAt
+      }).onConflictDoNothing().run();
+      if (claim.changes === 1) claimedEvents.push(event);
+      else duplicateEvents += 1;
+    }
+    acceptedEvents = claimedEvents.length;
+    if (claimedEvents.length > 0) {
+      const report = buildTrafficProbeReport(claimedEvents, { sampleLimit: claimedEvents.length });
+      for (const bucket of report.crawlerEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(crawlerEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          botId: bucket.botId,
+          operator: bucket.operator,
+          verificationStatus: bucket.verificationStatus,
+          pathNormalized: bucket.pathNormalized,
+          status,
+          hits: bucket.hits,
+          sampledUserAgent: bucket.sampledUserAgent,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            crawlerEventsHourly.projectId,
+            crawlerEventsHourly.sourceId,
+            crawlerEventsHourly.tsHour,
+            crawlerEventsHourly.botId,
+            crawlerEventsHourly.verificationStatus,
+            crawlerEventsHourly.pathNormalized,
+            crawlerEventsHourly.status
+          ],
+          set: {
+            hits: sql18`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        crawlerBucketRows += 1;
+      }
+      for (const bucket of report.aiUserFetchEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(aiUserFetchEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          botId: bucket.botId,
+          operator: bucket.operator,
+          verificationStatus: bucket.verificationStatus,
+          pathNormalized: bucket.pathNormalized,
+          status,
+          hits: bucket.hits,
+          sampledUserAgent: bucket.sampledUserAgent,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            aiUserFetchEventsHourly.projectId,
+            aiUserFetchEventsHourly.sourceId,
+            aiUserFetchEventsHourly.tsHour,
+            aiUserFetchEventsHourly.botId,
+            aiUserFetchEventsHourly.verificationStatus,
+            aiUserFetchEventsHourly.pathNormalized,
+            aiUserFetchEventsHourly.status
+          ],
+          set: {
+            hits: sql18`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        aiUserFetchBucketRows += 1;
+      }
+      for (const bucket of report.aiReferralEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(aiReferralEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          product: bucket.product,
+          operator: bucket.operator,
+          sourceDomain: bucket.sourceDomain,
+          evidenceType: bucket.evidenceType,
+          landingPathNormalized: bucket.landingPathNormalized,
+          status,
+          sessionsOrHits: bucket.hits,
+          paidSessionsOrHits: bucket.paidHits,
+          organicSessionsOrHits: bucket.organicHits,
+          usersEstimated: null,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            aiReferralEventsHourly.projectId,
+            aiReferralEventsHourly.sourceId,
+            aiReferralEventsHourly.tsHour,
+            aiReferralEventsHourly.product,
+            aiReferralEventsHourly.sourceDomain,
+            aiReferralEventsHourly.evidenceType,
+            aiReferralEventsHourly.landingPathNormalized,
+            aiReferralEventsHourly.status
+          ],
+          set: {
+            sessionsOrHits: sql18`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+            paidSessionsOrHits: sql18`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+            organicSessionsOrHits: sql18`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        aiReferralBucketRows += 1;
+      }
+      const hourlySampleLimit = Math.max(0, Math.floor(opts.sampleLimit));
+      const remainingSamplesByHour = /* @__PURE__ */ new Map();
+      for (const sample of report.samples) {
+        const hour = observedUtcHourBounds(sample.observedAt);
+        if (!hour || hourlySampleLimit === 0) continue;
+        let remaining = remainingSamplesByHour.get(hour.start);
+        if (remaining === void 0) {
+          const existing = tx.select({ total: sql18`COUNT(*)` }).from(rawEventSamples).where(and38(
+            eq46(rawEventSamples.sourceId, opts.sourceId),
+            gte10(rawEventSamples.ts, hour.start),
+            lt7(rawEventSamples.ts, hour.end)
+          )).get();
+          remaining = Math.max(0, hourlySampleLimit - Number(existing?.total ?? 0));
+        }
+        if (remaining === 0) {
+          remainingSamplesByHour.set(hour.start, 0);
+          continue;
+        }
+        const eventType = sample.crawler ? "crawler" : sample.aiUserFetch ? "ai_user_fetch" : sample.aiReferral ? "ai_referral" : "unknown";
+        const refererHost = (() => {
+          if (!sample.referer) return null;
+          try {
+            return new URL(sample.referer).hostname;
+          } catch {
+            return null;
+          }
+        })();
+        tx.insert(rawEventSamples).values({
+          id: crypto39.randomUUID(),
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          ts: sample.observedAt,
+          eventType,
+          ipHash: null,
+          userAgent: sample.userAgent,
+          pathNormalized: sample.pathNormalized,
+          status: sample.status,
+          refererHost,
+          classifierDetailsJson: {
+            crawler: sample.crawler,
+            aiUserFetch: sample.aiUserFetch,
+            aiReferral: sample.aiReferral
+          },
+          createdAt: opts.receivedAt
+        }).run();
+        sampleRows += 1;
+        remainingSamplesByHour.set(hour.start, remaining - 1);
+      }
+    }
+    tx.update(trafficSources).set(opts.sourceUpdate).where(eq46(trafficSources.id, opts.sourceId)).run();
+  });
+  return {
+    acceptedEvents,
+    duplicateEvents,
+    crawlerBucketRows,
+    aiUserFetchBucketRows,
+    aiReferralBucketRows,
+    sampleRows
+  };
+}
+
 // ../api-routes/src/traffic.ts
 var DEFAULT_SYNC_WINDOW_MINUTES = 43200;
 var DEFAULT_PAGE_SIZE3 = 1e3;
@@ -50796,6 +51974,126 @@ var DEFAULT_TRAFFIC_SYNC_CRON = "*/30 * * * *";
 var MAX_BACKFILL_DAYS = 90;
 var BACKFILL_MAX_PAGES = 1e3;
 var BACKFILL_SAMPLE_LIMIT = 500;
+var CLOUDFLARE_WORKER_VERSION = "1.0.0";
+var CLOUDFLARE_INGEST_BODY_LIMIT = 256 * 1024;
+var DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX = 6e3;
+var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+function sha256Hex3(value) {
+  return crypto40.createHash("sha256").update(value).digest("hex");
+}
+function hashCloudflareBearerToken(value) {
+  return sha256Hex3(value);
+}
+function timingSafeEqualHex(a, b) {
+  if (!a || !b) return false;
+  if (!SHA256_HEX_PATTERN.test(a) || !SHA256_HEX_PATTERN.test(b)) return false;
+  const left = Buffer.from(a, "hex");
+  const right = Buffer.from(b, "hex");
+  return left.length === right.length && crypto40.timingSafeEqual(left, right);
+}
+function parseDirectPushCloudflareSourceConfig(config) {
+  const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
+  return parsed.success ? parsed.data : null;
+}
+function isDirectPushCloudflareDeliveryMode(value) {
+  return value === CloudflareTrafficDeliveryModes["direct-push"];
+}
+function authenticateCloudflareIngest(request, store) {
+  if (!store) return null;
+  const authHeader = request.headers.authorization;
+  const sourceIdHeader = request.headers["x-canonry-source-id"];
+  const timestampHeader = request.headers["x-canonry-timestamp"];
+  const signatureHeader = request.headers["x-canonry-signature"];
+  const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+  const sourceId = typeof sourceIdHeader === "string" ? sourceIdHeader : "";
+  const timestamp = typeof timestampHeader === "string" ? timestampHeader : "";
+  const signature = typeof signatureHeader === "string" ? signatureHeader : "";
+  if (!bearerToken || !sourceId || !timestamp || !signature) return null;
+  const credential = store.getConnectionBySourceId(sourceId);
+  if (!credential || !isDirectPushCloudflareDeliveryMode(credential.deliveryMode)) return null;
+  const bearerHash = sha256Hex3(bearerToken);
+  if (!timingSafeEqualHex(bearerHash, sha256Hex3(credential.bearerToken))) return null;
+  if (!verifyRequestSignature({
+    timestamp,
+    signature,
+    payload: request.body,
+    secret: credential.hmacSecret
+  }).ok) return null;
+  return { bearerHash, credential };
+}
+function cloudflareIngestRateLimitKey(request, store, db) {
+  const authenticated = authenticateCloudflareIngest(request, store);
+  const params = request.params;
+  if (authenticated && typeof params.name === "string" && authenticated.credential.projectName === params.name) {
+    const source = db.select().from(trafficSources).where(eq47(trafficSources.id, authenticated.credential.sourceId)).get();
+    if (source && source.sourceType === TrafficSourceTypes.cloudflare && source.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(source.configJson) && timingSafeEqualHex(authenticated.bearerHash, source.ingestTokenHash)) {
+      return `cloudflare-source:${authenticated.credential.sourceId}`;
+    }
+  }
+  return `cloudflare-invalid:${request.ip}`;
+}
+function assertCloudflareIngestUrlIsPublicHttps(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw validationError("Cloudflare ingest URL must be a valid public HTTPS URL");
+  }
+  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  const octets = ipv4?.slice(1).map(Number);
+  const privateIpv4 = octets !== void 0 && (octets.some((part) => part > 255) || octets[0] === 0 || octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168);
+  const privateIpv6 = hostname.includes(":") && (hostname === "::1" || hostname.startsWith("fc") || hostname.startsWith("fd") || hostname.startsWith("fe8") || hostname.startsWith("fe9") || hostname.startsWith("fea") || hostname.startsWith("feb"));
+  const privateHostname = hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || privateIpv6 || privateIpv4;
+  if (url.protocol !== "https:" || privateHostname || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
+    throw validationError(
+      "Cloudflare ingest URL must be a credential-free public HTTPS URL without a query or fragment and reachable from the public Cloudflare edge; configure publicUrl to a public origin"
+    );
+  }
+}
+function normalizeDnsHostname(value) {
+  const normalized = value.trim().toLowerCase().replace(/\.+$/, "");
+  if (normalized.length === 0 || normalized.length > 253 || normalized.includes("*") || !normalized.includes(".")) return null;
+  const valid = normalized.split(".").every(
+    (label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)
+  );
+  return valid ? normalized : null;
+}
+function resolveCloudflareWorkerRouteHost(value) {
+  const trimmed = value.trim();
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+  if (hasScheme && !/^https?:\/\//i.test(trimmed)) {
+    throw validationError("Project canonicalDomain must use an HTTP or HTTPS URL");
+  }
+  let url;
+  try {
+    url = new URL(hasScheme ? trimmed : `https://${trimmed}`);
+  } catch {
+    throw validationError("Project canonicalDomain must resolve to one exact public hostname");
+  }
+  if (url.username.length > 0 || url.password.length > 0 || url.pathname !== "" && url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || url.port.length > 0) {
+    throw validationError(
+      "Project canonicalDomain must be a bare hostname or root HTTP(S) URL without credentials, a non-default port, path, query, or fragment"
+    );
+  }
+  const hostname = normalizeDnsHostname(url.hostname);
+  if (!hostname || isIP(hostname) !== 0) {
+    throw validationError("Project canonicalDomain must resolve to one exact public hostname without wildcards");
+  }
+  return hostname;
+}
+function normalizeCloudflareEventHost(value) {
+  if (!value || /[/:@?#*]/.test(value)) return null;
+  return normalizeDnsHostname(value);
+}
+function assertCloudflareIngestUrlOutsideWorkerRoute(ingestUrl, workerRouteHost) {
+  const ingestHost = normalizeDnsHostname(new URL(ingestUrl).hostname);
+  if (ingestHost && ingestHost === workerRouteHost) {
+    throw validationError(
+      "Cloudflare ingest URL hostname must be outside the generated Worker route hostname to prevent recursive ingestion"
+    );
+  }
+}
 function emptyTrafficSeriesPoint(bucket) {
   return { bucket, crawlerHits: 0, aiUserFetchHits: 0, aiReferralHits: 0 };
 }
@@ -50876,8 +52174,8 @@ async function runBackfillTask(options) {
     const failedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq46(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
+        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       });
     } catch {
     }
@@ -50892,7 +52190,7 @@ async function runBackfillTask(options) {
   if (allEvents.length === 0) {
     const finishedAt2 = (/* @__PURE__ */ new Date()).toISOString();
     try {
-      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: finishedAt2 }).where(eq46(runs.id, runId)).run();
+      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: finishedAt2 }).where(eq47(runs.id, runId)).run();
     } catch {
     }
     return;
@@ -50914,31 +52212,31 @@ async function runBackfillTask(options) {
   try {
     app.db.transaction((tx) => {
       tx.delete(crawlerEventsHourly).where(
-        and38(
-          eq46(crawlerEventsHourly.sourceId, sourceRow2.id),
-          gte10(crawlerEventsHourly.tsHour, windowStartIso),
-          lte9(crawlerEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(crawlerEventsHourly.sourceId, sourceRow2.id),
+          gte11(crawlerEventsHourly.tsHour, windowStartIso),
+          lte10(crawlerEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiUserFetchEventsHourly).where(
-        and38(
-          eq46(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
-          gte10(aiUserFetchEventsHourly.tsHour, windowStartIso),
-          lte9(aiUserFetchEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
+          gte11(aiUserFetchEventsHourly.tsHour, windowStartIso),
+          lte10(aiUserFetchEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiReferralEventsHourly).where(
-        and38(
-          eq46(aiReferralEventsHourly.sourceId, sourceRow2.id),
-          gte10(aiReferralEventsHourly.tsHour, windowStartIso),
-          lte9(aiReferralEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(aiReferralEventsHourly.sourceId, sourceRow2.id),
+          gte11(aiReferralEventsHourly.tsHour, windowStartIso),
+          lte10(aiReferralEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(rawEventSamples).where(
-        and38(
-          eq46(rawEventSamples.sourceId, sourceRow2.id),
-          gte10(rawEventSamples.ts, windowStartIso),
-          lte9(rawEventSamples.ts, windowEndIso)
+        and39(
+          eq47(rawEventSamples.sourceId, sourceRow2.id),
+          gte11(rawEventSamples.ts, windowStartIso),
+          lte10(rawEventSamples.ts, windowEndIso)
         )
       ).run();
       for (const bucket of report.crawlerEventsHourly) {
@@ -51003,7 +52301,7 @@ async function runBackfillTask(options) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -51030,8 +52328,8 @@ async function runBackfillTask(options) {
         lastEventIds: newRingBuffer,
         ...skipRecovered ? { skippedThroughAt: null } : {},
         updatedAt: finishedAt
-      }).where(eq46(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq46(runs.id, runId)).run();
+      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
     });
   } catch (e) {
     markFailed(`Backfill rollup write failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -51076,6 +52374,11 @@ async function trafficRoutes(app, opts) {
   const pageSize = opts.defaultPageSize ?? DEFAULT_PAGE_SIZE3;
   const maxPages = opts.defaultMaxPages ?? DEFAULT_MAX_PAGES4;
   const sampleLimit = opts.defaultSampleLimit ?? DEFAULT_SAMPLE_LIMIT2;
+  const checkCloudflareSourceRateLimit = app.createRateLimit({
+    max: opts.cloudflareIngestRateLimitMax ?? DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX,
+    timeWindow: "1 minute",
+    keyGenerator: (request) => cloudflareIngestRateLimitKey(request, opts.cloudflareTrafficCredentialStore, app.db)
+  });
   app.post("/projects/:name/traffic/connect/cloud-run", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const body = request.body ?? {};
@@ -51113,7 +52416,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
     const config = {
       gcpProjectId,
       serviceName: serviceName ?? null,
@@ -51129,10 +52432,10 @@ async function trafficRoutes(app, opts) {
         lastError: null,
         configJson: config,
         updatedAt: now
-      }).where(eq46(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+      }).where(eq47(trafficSources.id, activeSource.id)).run();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto39.randomUUID();
+      const newId = crypto40.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -51147,7 +52450,7 @@ async function trafficRoutes(app, opts) {
         createdAt: now,
         updatedAt: now
       }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
     }
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -51199,7 +52502,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
     const config = { baseUrl, username };
     const fallbackName = displayName ?? `WordPress \xB7 ${new URL(baseUrl).host}`;
     let sourceRow2;
@@ -51210,10 +52513,10 @@ async function trafficRoutes(app, opts) {
         lastError: null,
         configJson: config,
         updatedAt: now
-      }).where(eq46(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+      }).where(eq47(trafficSources.id, activeSource.id)).run();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto39.randomUUID();
+      const newId = crypto40.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -51228,7 +52531,7 @@ async function trafficRoutes(app, opts) {
         createdAt: now,
         updatedAt: now
       }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
     }
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -51282,7 +52585,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
     const config = { projectId, teamId, environment };
     const fallbackName = displayName ?? `Vercel \xB7 ${projectId}`;
     const { sourceRow: sourceRow2, scheduleCreated } = app.db.transaction((tx) => {
@@ -51294,10 +52597,10 @@ async function trafficRoutes(app, opts) {
           lastError: null,
           configJson: config,
           updatedAt: now
-        }).where(eq46(trafficSources.id, activeSource.id)).run();
-        row = tx.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+        }).where(eq47(trafficSources.id, activeSource.id)).run();
+        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
       } else {
-        const newId = crypto39.randomUUID();
+        const newId = crypto40.randomUUID();
         tx.insert(trafficSources).values({
           id: newId,
           projectId: project.id,
@@ -51320,18 +52623,18 @@ async function trafficRoutes(app, opts) {
           createdAt: now,
           updatedAt: now
         }).run();
-        row = tx.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
       }
       const existingSchedule = tx.select().from(schedules).where(
-        and38(
-          eq46(schedules.projectId, project.id),
-          eq46(schedules.kind, SchedulableRunKinds["traffic-sync"])
+        and39(
+          eq47(schedules.projectId, project.id),
+          eq47(schedules.kind, SchedulableRunKinds["traffic-sync"])
         )
       ).get();
       let created = false;
       if (!existingSchedule) {
         tx.insert(schedules).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           kind: SchedulableRunKinds["traffic-sync"],
           cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
@@ -51372,9 +52675,256 @@ async function trafficRoutes(app, opts) {
     }
     return rowToDto(sourceRow2);
   });
+  app.post("/projects/:name/traffic/connect/cloudflare", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    if (!opts.cloudflareTrafficCredentialStore) {
+      throw validationError("Cloudflare traffic credential storage is not configured for this deployment");
+    }
+    if (!opts.cloudflareTrafficIngestUrl) {
+      throw validationError("Cloudflare ingest URL is not configured for this deployment");
+    }
+    const credentialStore = opts.cloudflareTrafficCredentialStore;
+    const parsed = trafficConnectCloudflareRequestSchema.safeParse(request.body ?? {});
+    if (!parsed.success) {
+      throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+    }
+    const { deliveryMode, displayName, zoneId, accountId } = parsed.data;
+    const workerRouteHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find(
+      (row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived
+    );
+    const sourceId = activeSource?.id ?? crypto40.randomUUID();
+    const parsedActiveConfig = activeSource ? parseDirectPushCloudflareSourceConfig(activeSource.configJson) : null;
+    if (activeSource && !parsedActiveConfig) {
+      throw validationError("Existing Cloudflare source is not configured for direct-push delivery");
+    }
+    const previousCredential = credentialStore.getConnection(project.name);
+    if (previousCredential && !isDirectPushCloudflareDeliveryMode(previousCredential.deliveryMode)) {
+      throw validationError(
+        `Cloudflare credential delivery mode "${previousCredential.deliveryMode}" does not match "${deliveryMode}"`
+      );
+    }
+    const reusableCredential = previousCredential?.sourceId === sourceId ? previousCredential : void 0;
+    const previousZoneId = reusableCredential?.zoneId ?? parsedActiveConfig?.zoneId ?? null;
+    const previousAccountId = reusableCredential?.accountId ?? parsedActiveConfig?.accountId ?? null;
+    const effectiveZoneId = zoneId ?? previousZoneId;
+    const effectiveAccountId = accountId ?? previousAccountId;
+    const bearerToken = reusableCredential?.bearerToken ?? `cnry_cfw_${crypto40.randomBytes(32).toString("hex")}`;
+    const hmacSecret = reusableCredential?.hmacSecret ?? crypto40.randomBytes(32).toString("hex");
+    const ingestTokenHash = sha256Hex3(bearerToken);
+    const ingestUrl = opts.cloudflareTrafficIngestUrl.replace("{name}", encodeURIComponent(project.name));
+    assertCloudflareIngestUrlIsPublicHttps(ingestUrl);
+    assertCloudflareIngestUrlOutsideWorkerRoute(ingestUrl, workerRouteHost);
+    const workerVersion = CLOUDFLARE_WORKER_VERSION;
+    const workerScript = generateWorkerScript({
+      deliveryMode,
+      workerVersion,
+      botList: DEFAULT_BOT_LIST
+    });
+    const wranglerToml = generateWranglerToml({
+      deliveryMode,
+      sourceId,
+      hostname: workerRouteHost,
+      ingestUrl,
+      workerVersion,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId
+    });
+    const config = {
+      schemaVersion: 1,
+      deliveryMode,
+      workerVersion,
+      expectedBotListVersion: DEFAULT_BOT_LIST.version,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId
+    };
+    const fallbackName = displayName ?? activeSource?.displayName ?? `Cloudflare \xB7 ${effectiveZoneId ?? sourceId.slice(0, 8)}`;
+    credentialStore.upsertConnection({
+      projectName: project.name,
+      deliveryMode,
+      sourceId,
+      bearerToken,
+      hmacSecret,
+      workerVersion,
+      expectedBotListVersion: DEFAULT_BOT_LIST.version,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId,
+      createdAt: previousCredential?.createdAt ?? activeSource?.createdAt ?? now,
+      updatedAt: now
+    });
+    let sourceRow2;
+    try {
+      if (activeSource) {
+        app.db.update(trafficSources).set({
+          displayName: fallbackName,
+          status: TrafficSourceStatuses.connected,
+          lastError: null,
+          configJson: config,
+          ingestTokenHash,
+          updatedAt: now
+        }).where(eq47(trafficSources.id, activeSource.id)).run();
+        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
+      } else {
+        app.db.insert(trafficSources).values({
+          id: sourceId,
+          projectId: project.id,
+          sourceType: TrafficSourceTypes.cloudflare,
+          displayName: fallbackName,
+          status: TrafficSourceStatuses.connected,
+          // Seed `lastSyncedAt` to NOW so the `traffic.source.recent-data`
+          // doctor check has a non-null baseline. Successful ingest advances
+          // it as the receiver's last-activity timestamp.
+          lastSyncedAt: now,
+          lastCursor: null,
+          lastError: null,
+          archivedAt: null,
+          configJson: config,
+          ingestTokenHash,
+          createdAt: now,
+          updatedAt: now
+        }).run();
+        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
+      }
+    } catch (err) {
+      try {
+        if (previousCredential) {
+          credentialStore.upsertConnection(previousCredential);
+        } else {
+          credentialStore.deleteConnection(project.name);
+        }
+      } catch {
+      }
+      throw err;
+    }
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "traffic.cloudflare.connected",
+      entityType: "traffic_source",
+      entityId: sourceRow2.id
+    });
+    const routeInstruction = effectiveZoneId ? `  4. Deploy with \`wrangler deploy\`; wrangler.toml records zone ${effectiveZoneId} but does not claim a route` : "  4. Deploy with `wrangler deploy`; wrangler.toml intentionally does not claim a route";
+    const instructions = [
+      "Deploy this Worker to your Cloudflare zone:",
+      "  1. Save worker.js and wrangler.toml; neither file contains credentials",
+      "  2. Install the required bearer and HMAC Worker secret bindings locally; never paste their values into source or chat",
+      `  3. Inspect existing Cloudflare Worker routes first; confirm the generated \`${workerRouteHost}/*\` catch-all will not replace or collide with another Worker`,
+      routeInstruction,
+      `  5. In the Cloudflare Dashboard route form, select \`${workerRouteHost}/*\` and this Worker`,
+      "  6. Set Request limit failure mode to Fail open, then save the route; Wrangler cannot set this toggle",
+      "  7. Keep the Canonry ingest hostname outside this Worker route to avoid recursion",
+      "",
+      `Source id: ${sourceRow2.id}`,
+      "After deploy, check `canonry doctor --project " + project.name + "` to confirm events are arriving."
+    ].join("\n");
+    return {
+      sourceId: sourceRow2.id,
+      deliveryMode,
+      workerScript,
+      wranglerToml,
+      workerVersion,
+      instructions
+    };
+  });
+  app.post("/projects/:name/traffic/cloudflare/ingest", {
+    bodyLimit: CLOUDFLARE_INGEST_BODY_LIMIT,
+    preHandler: async (request, reply) => {
+      const key = cloudflareIngestRateLimitKey(
+        request,
+        opts.cloudflareTrafficCredentialStore,
+        app.db
+      );
+      if (key.startsWith("cloudflare-invalid:")) return;
+      const result = await checkCloudflareSourceRateLimit(request);
+      if (result.isAllowed || !result.isExceeded) return;
+      reply.header("retry-after", result.ttlInSeconds);
+      return reply.status(429).send({
+        statusCode: 429,
+        error: "Too Many Requests",
+        message: `Rate limit exceeded, retry in ${result.ttlInSeconds} second(s)`
+      });
+    },
+    config: {
+      rateLimit: {
+        hook: "onRequest",
+        max: opts.cloudflareIngestIpRateLimitMax ?? DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX,
+        timeWindow: "1 minute",
+        groupId: "cloudflare-direct-push-ip",
+        keyGenerator: (request) => `cloudflare-ingest-ip:${request.ip}`
+      }
+    }
+  }, async (request, reply) => {
+    const authenticated = authenticateCloudflareIngest(
+      request,
+      opts.cloudflareTrafficCredentialStore
+    );
+    if (!authenticated || authenticated.credential.projectName !== request.params.name || !isDirectPushCloudflareDeliveryMode(authenticated.credential.deliveryMode)) {
+      throw authRequired();
+    }
+    const { bearerHash, credential } = authenticated;
+    const sourceId = credential.sourceId;
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
+    if (!sourceRow2 || sourceRow2.sourceType !== TrafficSourceTypes.cloudflare || sourceRow2.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(sourceRow2.configJson) || !timingSafeEqualHex(bearerHash, sourceRow2.ingestTokenHash)) {
+      throw authRequired();
+    }
+    const project = resolveProject(app.db, request.params.name);
+    if (sourceRow2.projectId !== project.id) throw authRequired();
+    const parsed = cloudflareWorkerIngestRequestSchema.safeParse(request.body);
+    if (!parsed.success) {
+      throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+    }
+    const { workerVersion, events } = parsed.data;
+    const canonicalHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+    const wrongHostIndex = events.findIndex(
+      (event) => normalizeCloudflareEventHost(event.host) !== canonicalHost
+    );
+    if (wrongHostIndex !== -1) {
+      throw validationError(
+        `Cloudflare event at index ${wrongHostIndex} does not belong to project domain "${project.canonicalDomain}"`
+      );
+    }
+    const normalized = [];
+    let normalizationDrops = 0;
+    for (const event of events) {
+      const result = normalizeCloudflareWorkerEvent(event);
+      if (result) normalized.push(result);
+      else normalizationDrops += 1;
+    }
+    const receivedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const writeResult = writeTrafficEventBatch({
+      db: app.db,
+      projectId: project.id,
+      sourceId,
+      events: normalized,
+      receivedAt,
+      receiptTtlMs: DIRECT_PUSH_RECEIPT_TTL_MS,
+      sampleLimit,
+      validateSource: (latestRow) => {
+        if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
+          throw authRequired();
+        }
+      },
+      sourceUpdate: {
+        lastWorkerVersion: workerVersion,
+        lastSyncedAt: receivedAt,
+        lastError: null,
+        updatedAt: receivedAt
+      }
+    });
+    return reply.status(200).send({
+      acceptedEvents: writeResult.acceptedEvents,
+      droppedEvents: normalizationDrops + writeResult.duplicateEvents,
+      workerVersionAck: workerVersion,
+      crawlerBucketRows: writeResult.crawlerBucketRows,
+      aiUserFetchBucketRows: writeResult.aiUserFetchBucketRows,
+      aiReferralBucketRows: writeResult.aiReferralBucketRows,
+      sampleRows: writeResult.sampleRows
+    });
+  });
   app.post("/projects/:name/traffic/sources/:id/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
@@ -51386,7 +52936,7 @@ async function trafficRoutes(app, opts) {
     const windowEnd = /* @__PURE__ */ new Date();
     const startedAt = windowEnd.toISOString();
     const syncStartedAtMs = windowEnd.getTime();
-    const runId = crypto39.randomUUID();
+    const runId = crypto40.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -51400,8 +52950,8 @@ async function trafficRoutes(app, opts) {
     const markFailed = (msg, errorCode) => {
       const failedAt = (/* @__PURE__ */ new Date()).toISOString();
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq46(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
+        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       });
       try {
         opts.onTrafficSynced?.({
@@ -51482,7 +53032,7 @@ async function trafficRoutes(app, opts) {
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError(
           `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
         );
@@ -51531,12 +53081,12 @@ async function trafficRoutes(app, opts) {
       auditAction = "traffic.vercel.synced";
       const credentialStore = opts.vercelTrafficCredentialStore;
       if (!credentialStore) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError("Vercel traffic credential storage is not configured for this deployment");
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError(
           `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
         );
@@ -51554,7 +53104,7 @@ async function trafficRoutes(app, opts) {
       if (cappedStartMs > clampedStartMs) {
         const previousSkip = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
         const skippedThrough = Number.isFinite(previousSkip) ? new Date(Math.max(previousSkip, cappedStartMs)) : new Date(cappedStartMs);
-        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq47(trafficSources.id, sourceRow2.id)).run();
         request.log.warn(
           {
             sourceId: sourceRow2.id,
@@ -51639,7 +53189,7 @@ async function trafficRoutes(app, opts) {
     let aiReferralHitsCount = 0;
     let unknownHitsCount = 0;
     app.db.transaction((tx) => {
-      const latestRow = tx.select().from(trafficSources).where(eq46(trafficSources.id, sourceRow2.id)).get();
+      const latestRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
       const previousIds = latestRow.lastEventIds ?? [];
       const seenEventIds = new Set(previousIds);
       const dedupedEvents = seenEventIds.size === 0 ? allEvents : allEvents.filter((e) => !seenEventIds.has(e.eventId));
@@ -51687,7 +53237,7 @@ async function trafficRoutes(app, opts) {
             crawlerEventsHourly.status
           ],
           set: {
-            hits: sql18`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql19`${crawlerEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -51720,7 +53270,7 @@ async function trafficRoutes(app, opts) {
             aiUserFetchEventsHourly.status
           ],
           set: {
-            hits: sql18`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql19`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -51760,9 +53310,9 @@ async function trafficRoutes(app, opts) {
           // colliding bucket adds its paid and organic arrivals to the ones
           // already there rather than overwriting a single label.
           set: {
-            sessionsOrHits: sql18`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
-            paidSessionsOrHits: sql18`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
-            organicSessionsOrHits: sql18`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+            sessionsOrHits: sql19`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+            paidSessionsOrHits: sql19`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+            organicSessionsOrHits: sql19`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
             updatedAt: finishedAt
           }
         }).run();
@@ -51779,7 +53329,7 @@ async function trafficRoutes(app, opts) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -51827,8 +53377,8 @@ async function trafficRoutes(app, opts) {
       if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
         sourceUpdate.lastCursor = nextCursor ?? null;
       }
-      tx.update(trafficSources).set(sourceUpdate).where(eq46(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq46(runs.id, runId)).run();
+      tx.update(trafficSources).set(sourceUpdate).where(eq47(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
     });
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -51880,7 +53430,7 @@ async function trafficRoutes(app, opts) {
   });
   app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
@@ -52030,7 +53580,7 @@ async function trafficRoutes(app, opts) {
       };
     }
     const startedAt = windowEnd.toISOString();
-    const runId = crypto39.randomUUID();
+    const runId = crypto40.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -52066,40 +53616,40 @@ async function trafficRoutes(app, opts) {
   function buildSourceDetail(projectId, row, since) {
     const crawlerPathRows = app.db.select({
       pathNormalized: crawlerEventsHourly.pathNormalized,
-      hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+      hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
     }).from(crawlerEventsHourly).where(
-      and38(
-        eq46(crawlerEventsHourly.sourceId, row.id),
-        gte10(crawlerEventsHourly.tsHour, since)
+      and39(
+        eq47(crawlerEventsHourly.sourceId, row.id),
+        gte11(crawlerEventsHourly.tsHour, since)
       )
     ).groupBy(crawlerEventsHourly.pathNormalized).all();
     const crawlerSegments = segmentCrawlerHits(
       crawlerPathRows.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
     );
     const crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
-    const aiUserFetchTotals = app.db.select({ total: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
-      and38(
-        eq46(aiUserFetchEventsHourly.sourceId, row.id),
-        gte10(aiUserFetchEventsHourly.tsHour, since)
+    const aiUserFetchTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+      and39(
+        eq47(aiUserFetchEventsHourly.sourceId, row.id),
+        gte11(aiUserFetchEventsHourly.tsHour, since)
       )
     ).get();
-    const aiTotals = app.db.select({ total: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-      and38(
-        eq46(aiReferralEventsHourly.sourceId, row.id),
-        gte10(aiReferralEventsHourly.tsHour, since)
+    const aiTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+      and39(
+        eq47(aiReferralEventsHourly.sourceId, row.id),
+        gte11(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
-    const sampleTotals = app.db.select({ total: sql18`COUNT(*)` }).from(rawEventSamples).where(
-      and38(
-        eq46(rawEventSamples.sourceId, row.id),
-        gte10(rawEventSamples.ts, since)
+    const sampleTotals = app.db.select({ total: sql19`COUNT(*)` }).from(rawEventSamples).where(
+      and39(
+        eq47(rawEventSamples.sourceId, row.id),
+        gte11(rawEventSamples.ts, since)
       )
     ).get();
     const latestRun = app.db.select().from(runs).where(
-      and38(
-        eq46(runs.projectId, projectId),
-        eq46(runs.kind, RunKinds["traffic-sync"]),
-        eq46(runs.sourceId, row.id)
+      and39(
+        eq47(runs.projectId, projectId),
+        eq47(runs.kind, RunKinds["traffic-sync"]),
+        eq47(runs.sourceId, row.id)
       )
     ).orderBy(desc22(runs.startedAt)).limit(1).get();
     return {
@@ -52130,7 +53680,7 @@ async function trafficRoutes(app, opts) {
         "`advanceToNow` must be `true`. There is no implicit reset."
       );
     }
-    const sourceRow2 = app.db.select().from(trafficSources).where(and38(eq46(trafficSources.projectId, project.id), eq46(trafficSources.id, request.params.id))).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(and39(eq47(trafficSources.projectId, project.id), eq47(trafficSources.id, request.params.id))).get();
     if (!sourceRow2) {
       throw notFound("traffic source", request.params.id);
     }
@@ -52147,7 +53697,7 @@ async function trafficRoutes(app, opts) {
         status: TrafficSourceStatuses.connected,
         lastError: null,
         updatedAt: now
-      }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       writeAuditLog(tx, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
@@ -52155,20 +53705,20 @@ async function trafficRoutes(app, opts) {
         entityType: "traffic_source",
         entityId: sourceRow2.id
       }));
-      updatedRow = tx.select().from(trafficSources).where(eq46(trafficSources.id, sourceRow2.id)).get();
+      updatedRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
     });
     return buildSourceDetail(project.id, updatedRow, new Date(Date.now() - 24 * 60 * 6e4).toISOString());
   });
   app.get("/projects/:name/traffic/sources", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map(rowToDto);
     const response = { sources };
     return response;
   });
   app.get("/projects/:name/traffic/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const since = new Date(Date.now() - 24 * 60 * 6e4).toISOString();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map((row) => buildSourceDetail(project.id, row, since));
     const response = { sources };
@@ -52178,7 +53728,7 @@ async function trafficRoutes(app, opts) {
     "/projects/:name/traffic/sources/:id",
     async (request) => {
       const project = resolveProject(app.db, request.params.name);
-      const row = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+      const row = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
       if (!row || row.projectId !== project.id) {
         throw notFound("Traffic source", request.params.id);
       }
@@ -52243,26 +53793,26 @@ async function trafficRoutes(app, opts) {
     const seriesByBucket = /* @__PURE__ */ new Map();
     if (kind === "all" || kind === TrafficEventKinds.crawler) {
       const crawlerFilters = [
-        eq46(crawlerEventsHourly.projectId, project.id),
-        gte10(crawlerEventsHourly.tsHour, sinceIso),
-        lte9(crawlerEventsHourly.tsHour, untilIso)
+        eq47(crawlerEventsHourly.projectId, project.id),
+        gte11(crawlerEventsHourly.tsHour, sinceIso),
+        lte10(crawlerEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) crawlerFilters.push(eq46(crawlerEventsHourly.sourceId, sourceIdParam));
-      const crawlerWhere = and38(...crawlerFilters);
+      if (sourceIdParam) crawlerFilters.push(eq47(crawlerEventsHourly.sourceId, sourceIdParam));
+      const crawlerWhere = and39(...crawlerFilters);
       const pathTotals = app.db.select({
         pathNormalized: crawlerEventsHourly.pathNormalized,
-        hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
-        rows: sql18`COUNT(*)`
+        hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerEventsHourly.pathNormalized).all();
       crawlerSegments = segmentCrawlerHits(
         pathTotals.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
       );
       crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
       totalEventRows += pathTotals.reduce((sum, row) => sum + Number(row.rows), 0);
-      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
+      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
       const crawlerSeries = app.db.select({
         bucket: crawlerSeriesBucket,
-        hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+        hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
       }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerSeriesBucket).all();
       for (const row of crawlerSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).crawlerHits = Number(row.hits);
@@ -52285,22 +53835,22 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-user-fetch"]) {
       const userFetchFilters = [
-        eq46(aiUserFetchEventsHourly.projectId, project.id),
-        gte10(aiUserFetchEventsHourly.tsHour, sinceIso),
-        lte9(aiUserFetchEventsHourly.tsHour, untilIso)
+        eq47(aiUserFetchEventsHourly.projectId, project.id),
+        gte11(aiUserFetchEventsHourly.tsHour, sinceIso),
+        lte10(aiUserFetchEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) userFetchFilters.push(eq46(aiUserFetchEventsHourly.sourceId, sourceIdParam));
-      const userFetchWhere = and38(...userFetchFilters);
+      if (sourceIdParam) userFetchFilters.push(eq47(aiUserFetchEventsHourly.sourceId, sourceIdParam));
+      const userFetchWhere = and39(...userFetchFilters);
       const total = app.db.select({
-        total: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
-        rows: sql18`COUNT(*)`
+        total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).get();
       aiUserFetchTotal = Number(total?.total ?? 0);
       totalEventRows += Number(total?.rows ?? 0);
-      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
+      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
       const userFetchSeries = app.db.select({
         bucket: userFetchSeriesBucket,
-        hits: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
+        hits: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).groupBy(userFetchSeriesBucket).all();
       for (const row of userFetchSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).aiUserFetchHits = Number(row.hits);
@@ -52322,17 +53872,17 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-referral"]) {
       const aiFilters = [
-        eq46(aiReferralEventsHourly.projectId, project.id),
-        gte10(aiReferralEventsHourly.tsHour, sinceIso),
-        lte9(aiReferralEventsHourly.tsHour, untilIso)
+        eq47(aiReferralEventsHourly.projectId, project.id),
+        gte11(aiReferralEventsHourly.tsHour, sinceIso),
+        lte10(aiReferralEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) aiFilters.push(eq46(aiReferralEventsHourly.sourceId, sourceIdParam));
-      const aiWhere = and38(...aiFilters);
+      if (sourceIdParam) aiFilters.push(eq47(aiReferralEventsHourly.sourceId, sourceIdParam));
+      const aiWhere = and39(...aiFilters);
       const total = app.db.select({
-        total: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-        paid: sql18`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
-        organic: sql18`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`,
-        rows: sql18`COUNT(*)`
+        total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+        paid: sql19`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
+        organic: sql19`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(aiReferralEventsHourly).where(aiWhere).get();
       aiReferralCounts = aiReferralClassCounts(
         Number(total?.total ?? 0),
@@ -52340,10 +53890,10 @@ async function trafficRoutes(app, opts) {
         Number(total?.organic ?? 0)
       );
       totalEventRows += Number(total?.rows ?? 0);
-      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
+      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
       const referralSeries = app.db.select({
         bucket: referralSeriesBucket,
-        hits: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
+        hits: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
       }).from(aiReferralEventsHourly).where(aiWhere).groupBy(referralSeriesBucket).all();
       for (const row of referralSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).aiReferralHits = Number(row.hits);
@@ -52400,7 +53950,7 @@ async function trafficRoutes(app, opts) {
 }
 
 // ../api-routes/src/doctor/checks/agent.ts
-import crypto40 from "crypto";
+import crypto41 from "crypto";
 import fs6 from "fs";
 import path7 from "path";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -52631,7 +54181,7 @@ function isInstalled(dir) {
 }
 function hashInstalledFile(filePath) {
   try {
-    return crypto40.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
+    return crypto41.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
   } catch {
     return void 0;
   }
@@ -52646,7 +54196,7 @@ function readInstalledManifest(skillDir) {
 var AGENT_CHECKS = [skillsInstalledCheck, skillsCurrentCheck];
 
 // ../api-routes/src/doctor/checks/backlinks.ts
-import { and as and39, eq as eq47 } from "drizzle-orm";
+import { and as and40, eq as eq48 } from "drizzle-orm";
 function skippedNoProject() {
   return {
     status: CheckStatuses.skipped,
@@ -52662,8 +54212,8 @@ var BACKLINKS_CHECKS = [
     title: "Backlinks source connected",
     run: (ctx) => {
       if (!ctx.project) return skippedNoProject();
-      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq47(projects.id, ctx.project.id)).get();
-      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq47(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
+      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq48(projects.id, ctx.project.id)).get();
+      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq48(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
       const ccConnected = projectRow?.autoExtract === true && !!readySync;
       const connected = [];
       if (ccConnected) connected.push(BacklinkSources.commoncrawl);
@@ -52676,9 +54226,9 @@ var BACKLINKS_CHECKS = [
           details: { commoncrawl: ccConnected }
         };
       }
-      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and39(
-        eq47(backlinkSummaries.projectId, ctx.project.id),
-        eq47(backlinkSummaries.source, BacklinkSources.commoncrawl)
+      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and40(
+        eq48(backlinkSummaries.projectId, ctx.project.id),
+        eq48(backlinkSummaries.source, BacklinkSources.commoncrawl)
       )).limit(1).get() : false;
       return {
         status: CheckStatuses.ok,
@@ -52838,7 +54388,7 @@ var BING_AUTH_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/content.ts
-import { eq as eq48 } from "drizzle-orm";
+import { eq as eq49 } from "drizzle-orm";
 var WINNABILITY_COVERAGE_WARN_THRESHOLD = 0.8;
 var UNCLASSIFIED_DOMAIN_SAMPLE_LIMIT = 10;
 function skippedNoProject2() {
@@ -52851,7 +54401,7 @@ function skippedNoProject2() {
 }
 function loadProject(ctx) {
   if (!ctx.project) return null;
-  return ctx.db.select().from(projects).where(eq48(projects.id, ctx.project.id)).get() ?? null;
+  return ctx.db.select().from(projects).where(eq49(projects.id, ctx.project.id)).get() ?? null;
 }
 function percent(value) {
   return Math.round(value * 100);
@@ -52943,7 +54493,7 @@ var CONTENT_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/ads.ts
-import { eq as eq49 } from "drizzle-orm";
+import { eq as eq50 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS = 7;
 var RECENT_SYNC_FAIL_DAYS = 30;
 var adsConnectionCheck = {
@@ -52960,7 +54510,7 @@ var adsConnectionCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq49(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -53010,7 +54560,7 @@ var adsRecentSyncCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq49(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -53201,7 +54751,7 @@ var ga4ConnectionCheck = {
 var GA_AUTH_CHECKS = [ga4ConnectionCheck];
 
 // ../api-routes/src/doctor/checks/gbp-auth.ts
-import { and as and40, eq as eq50 } from "drizzle-orm";
+import { and as and41, eq as eq51 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS2 = 7;
 var RECENT_SYNC_FAIL_DAYS2 = 30;
 function skippedNoProject3() {
@@ -53434,7 +54984,7 @@ var recentSyncCheck = {
   title: "GBP recent sync",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject3();
-    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and40(eq50(gbpLocations.projectId, ctx.project.id), eq50(gbpLocations.selected, true))).all();
+    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and41(eq51(gbpLocations.projectId, ctx.project.id), eq51(gbpLocations.selected, true))).all();
     if (selected.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -53494,7 +55044,7 @@ var GBP_AUTH_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/places.ts
-import { eq as eq51 } from "drizzle-orm";
+import { eq as eq52 } from "drizzle-orm";
 var apiKeyCheck = {
   id: "gbp.places.api-key",
   category: CheckCategories.auth,
@@ -53539,7 +55089,7 @@ var apiKeyCheck = {
         details: { tier: cfg.tier }
       };
     }
-    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq51(gbpLocations.projectId, ctx.project.id)).all();
+    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq52(gbpLocations.projectId, ctx.project.id)).all();
     const selected = rows.filter((r) => r.selected);
     const locationsWithPlaceId = selected.filter((r) => Boolean(r.placeId)).length;
     const details = {
@@ -54054,9 +55604,25 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and41, eq as eq52, gte as gte11, ne as ne6, sql as sql19 } from "drizzle-orm";
+import { and as and42, eq as eq53, gte as gte12, ne as ne6, sql as sql20 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
+function isCloudflareDirectPush(source) {
+  if (source.sourceType !== TrafficSourceTypes.cloudflare) return false;
+  const deliveryMode = source.configJson.deliveryMode;
+  return deliveryMode === void 0 || deliveryMode === CloudflareTrafficDeliveryModes["direct-push"];
+}
+function recentDataRemediation(sources, lastSyncedAt) {
+  const hasCloudflare = sources.some(isCloudflareDirectPush);
+  const hasPullSource = sources.some((source) => !isCloudflareDirectPush(source));
+  if (hasCloudflare && !hasPullSource) {
+    return "Confirm the Cloudflare Worker is deployed on the zone route and forwarding to canonry; reconnect Cloudflare to regenerate the Worker if needed.";
+  }
+  if (hasCloudflare && hasPullSource) {
+    return "Run `canonry traffic sync <project>` for pull-based sources, and confirm the Cloudflare Worker is deployed on the zone route and forwarding to canonry.";
+  }
+  return lastSyncedAt ? `Last sync: ${lastSyncedAt}. Run \`canonry traffic sync <project>\` to refresh, or check the source connection.` : "Run `canonry traffic sync <project>` to pull recent events.";
+}
 function skippedNoProject5() {
   return {
     status: CheckStatuses.skipped,
@@ -54068,8 +55634,8 @@ function skippedNoProject5() {
 function loadProbes(ctx) {
   if (!ctx.project) return [];
   const rows = ctx.db.select().from(trafficSources).where(
-    and41(
-      eq52(trafficSources.projectId, ctx.project.id),
+    and42(
+      eq53(trafficSources.projectId, ctx.project.id),
       ne6(trafficSources.status, TrafficSourceStatuses.archived)
     )
   ).all();
@@ -54081,6 +55647,8 @@ function loadProbes(ctx) {
     displayName: r.displayName,
     status: r.status,
     lastSyncedAt: r.lastSyncedAt,
+    lastWorkerVersion: r.lastWorkerVersion,
+    ingestTokenHash: r.ingestTokenHash,
     skippedThroughAt: r.skippedThroughAt,
     lastError: r.lastError,
     configJson: r.configJson
@@ -54149,52 +55717,74 @@ var recentDataCheck = {
     const warnCutoff = new Date(now.getTime() - RECENT_DATA_WARN_DAYS * 24 * 60 * 6e4).toISOString();
     const failCutoff = new Date(now.getTime() - RECENT_DATA_FAIL_DAYS * 24 * 60 * 6e4).toISOString();
     const recentCrawlers = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and41(
-          eq52(crawlerEventsHourly.projectId, ctx.project.id),
-          gte11(crawlerEventsHourly.tsHour, warnCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+        and42(
+          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+          gte12(crawlerEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
     const recentReferrals = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and41(
-          eq52(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte11(aiReferralEventsHourly.tsHour, warnCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+        and42(
+          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+          gte12(aiReferralEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
-    if (recentCrawlers > 0 || recentReferrals > 0) {
+    const recentUserFetches = Number(
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+        and42(
+          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          gte12(aiUserFetchEventsHourly.tsHour, warnCutoff)
+        )
+      ).get()?.total ?? 0
+    );
+    if (recentCrawlers > 0 || recentUserFetches > 0 || recentReferrals > 0) {
       return {
         status: CheckStatuses.ok,
         code: "traffic.recent-data.fresh",
-        summary: `${recentCrawlers} crawler hit(s) and ${recentReferrals} AI-referral arrival(s) in the last ${RECENT_DATA_WARN_DAYS} days.`,
-        details: { crawlerHits: recentCrawlers, referralArrivals: recentReferrals, windowDays: RECENT_DATA_WARN_DAYS }
+        summary: `${recentCrawlers} crawler hit(s), ${recentUserFetches} AI user-fetch hit(s), and ${recentReferrals} AI-referral arrival(s) in the last ${RECENT_DATA_WARN_DAYS} days.`,
+        details: {
+          crawlerHits: recentCrawlers,
+          aiUserFetchHits: recentUserFetches,
+          referralArrivals: recentReferrals,
+          windowDays: RECENT_DATA_WARN_DAYS
+        }
       };
     }
     const olderCrawlers = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and41(
-          eq52(crawlerEventsHourly.projectId, ctx.project.id),
-          gte11(crawlerEventsHourly.tsHour, failCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+        and42(
+          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+          gte12(crawlerEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const olderReferrals = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and41(
-          eq52(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte11(aiReferralEventsHourly.tsHour, failCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+        and42(
+          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+          gte12(aiReferralEventsHourly.tsHour, failCutoff)
+        )
+      ).get()?.total ?? 0
+    );
+    const olderUserFetches = Number(
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+        and42(
+          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          gte12(aiUserFetchEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const lastSyncedAt = sources.map((s) => s.lastSyncedAt).filter(Boolean).sort().at(-1) ?? null;
-    if (olderCrawlers > 0 || olderReferrals > 0 || lastSyncedAt) {
+    const hasOlderData = olderCrawlers > 0 || olderUserFetches > 0 || olderReferrals > 0;
+    if (hasOlderData || lastSyncedAt) {
       return {
         status: CheckStatuses.warn,
         code: "traffic.recent-data.stale",
-        summary: `No crawler hits or AI-referral sessions in the last ${RECENT_DATA_WARN_DAYS} days, though older data exists.`,
-        remediation: lastSyncedAt ? `Last sync: ${lastSyncedAt}. Run \`canonry traffic sync <project>\` to refresh, or check the source connection.` : "Run `canonry traffic sync <project>` to pull recent events.",
+        summary: hasOlderData ? `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days, though older data exists.` : `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days.`,
+        remediation: recentDataRemediation(sources, lastSyncedAt),
         details: { lastSyncedAt, sourceCount: sources.length }
       };
     }
@@ -54392,7 +55982,15 @@ var syncLagCheck = {
   title: "Traffic source sync lag",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject5();
-    const sources = loadProbes(ctx);
+    const allSources = loadProbes(ctx);
+    const sources = allSources.filter((source) => !isCloudflareDirectPush(source));
+    if (allSources.length > 0 && sources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.sync-lag.push-only",
+        summary: "Only push traffic sources are connected \u2014 pull sync lag does not apply."
+      };
+    }
     if (sources.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -54482,10 +56080,68 @@ var syncLagCheck = {
     };
   }
 };
+var workerVersionCheck = {
+  id: "traffic.source.worker-version",
+  category: CheckCategories.integrations,
+  scope: CheckScopes.project,
+  title: "Cloudflare Worker version",
+  run: (ctx) => {
+    if (!ctx.project) return skippedNoProject5();
+    const sources = loadProbes(ctx).filter(isCloudflareDirectPush);
+    if (sources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.worker-version.not-applicable",
+        summary: "No Cloudflare direct-push source is connected."
+      };
+    }
+    const measured = sources.map((source) => {
+      const expected = source.configJson.workerVersion;
+      const expectedVersion = typeof expected === "string" && expected.length > 0 ? expected : null;
+      const observedVersion = source.lastWorkerVersion;
+      const state = observedVersion === null ? "waiting-for-first-event" : expectedVersion !== null && observedVersion === expectedVersion ? "current" : "stale";
+      return {
+        sourceId: source.id,
+        displayName: source.displayName,
+        expectedVersion,
+        observedVersion,
+        state
+      };
+    });
+    const details = { sources: measured };
+    const stale = measured.filter((source) => source.state === "stale");
+    if (stale.length > 0) {
+      return {
+        status: CheckStatuses.warn,
+        code: "traffic.worker-version.stale",
+        summary: `${stale.length} Cloudflare Worker source(s) report a version that differs from the generated version.`,
+        remediation: "Redeploy the generated Worker from the credential-owning host. Use `canonry traffic connect cloudflare <project> --zone-id <id> --deploy --confirm-route --confirm-fail-open`, then attach the route manually.",
+        details
+      };
+    }
+    const waiting = measured.filter((source) => source.state === "waiting-for-first-event");
+    if (waiting.length > 0) {
+      return {
+        status: CheckStatuses.warn,
+        code: "traffic.worker-version.waiting-for-first-event",
+        summary: `${waiting.length} Cloudflare Worker source(s) have not delivered an event yet.`,
+        remediation: "Send a smoke-test request through the Worker. Then run `canonry doctor --project <project>` again.",
+        details
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "traffic.worker-version.current",
+      summary: "All Cloudflare direct-push Workers report the generated version.",
+      details
+    };
+  }
+};
 var TRAFFIC_SOURCE_CHECKS = [
   sourceConnectedCheck,
   recentDataCheck,
   syncLagCheck,
+  workerVersionCheck,
   credentialsCheck,
   scopesCheck3,
   cacheBlindSpotCheck
@@ -54704,8 +56360,8 @@ async function doctorRoutes(app, opts) {
 }
 
 // ../api-routes/src/discovery/routes.ts
-import crypto41 from "crypto";
-import { and as and42, desc as desc23, eq as eq53, gte as gte12, inArray as inArray18, isNull as isNull4, or as or10 } from "drizzle-orm";
+import crypto42 from "crypto";
+import { and as and43, desc as desc23, eq as eq54, gte as gte13, inArray as inArray18, isNull as isNull4, or as or10 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -54739,13 +56395,13 @@ async function discoveryRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const ageFloorIso = new Date(Date.now() - MAX_INFLIGHT_DISCOVERY_AGE_MS).toISOString();
     const decision = app.db.transaction((tx) => {
-      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and42(
-        eq53(discoverySessions.projectId, project.id),
-        eq53(discoverySessions.icpDescription, icpDescription),
+      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and43(
+        eq54(discoverySessions.projectId, project.id),
+        eq54(discoverySessions.icpDescription, icpDescription),
         // Buyer is part of session identity: it changes the seed prompt's
         // semantics, so a request with a different (or no) buyer must start
         // its own session, never adopt another buyer's probes.
-        parsed.data.buyerDescription == null ? isNull4(discoverySessions.buyerDescription) : eq53(discoverySessions.buyerDescription, parsed.data.buyerDescription),
+        parsed.data.buyerDescription == null ? isNull4(discoverySessions.buyerDescription) : eq54(discoverySessions.buyerDescription, parsed.data.buyerDescription),
         // Locations are identity too: a different service-area subset seeds
         // and probes a different geo, so it must never reuse another geo's
         // session. resolveLocations is deterministic (project-config order),
@@ -54755,23 +56411,23 @@ async function discoveryRoutes(app, opts) {
         // locations a NULL row's subset is unknowable, so it conservatively
         // never reuses — a one-time, bounded (2h window) non-reuse after
         // upgrade, never a wrong reuse.
-        locations.length === 0 ? or10(isNull4(discoverySessions.locations), eq53(discoverySessions.locations, locations)) : eq53(discoverySessions.locations, locations),
+        locations.length === 0 ? or10(isNull4(discoverySessions.locations), eq54(discoverySessions.locations, locations)) : eq54(discoverySessions.locations, locations),
         // Seed provider set is identity: a different phrasing distribution
         // must never reuse another set's session. Null (= Gemini-only
         // default, including explicit ['gemini']) matches legacy rows.
-        seedProviders == null ? isNull4(discoverySessions.seedProviders) : eq53(discoverySessions.seedProviders, seedProviders),
+        seedProviders == null ? isNull4(discoverySessions.seedProviders) : eq54(discoverySessions.seedProviders, seedProviders),
         inArray18(discoverySessions.status, [
           DiscoverySessionStatuses.queued,
           DiscoverySessionStatuses.seeding,
           DiscoverySessionStatuses.probing
         ]),
-        gte12(discoverySessions.createdAt, ageFloorIso)
+        gte13(discoverySessions.createdAt, ageFloorIso)
       )).orderBy(desc23(discoverySessions.createdAt)).get();
       if (existing && existing.runId) {
         return { reused: true, sessionId: existing.id, runId: existing.runId };
       }
-      const sessionId = crypto41.randomUUID();
-      const runId = crypto41.randomUUID();
+      const sessionId = crypto42.randomUUID();
+      const runId = crypto42.randomUUID();
       tx.insert(discoverySessions).values({
         id: sessionId,
         projectId: project.id,
@@ -54835,7 +56491,7 @@ async function discoveryRoutes(app, opts) {
       const project = resolveProject(app.db, request.params.name);
       const parsedLimit = parseInt(request.query.limit ?? "", 10);
       const limit = Number.isNaN(parsedLimit) || parsedLimit <= 0 ? 50 : parsedLimit;
-      const rows = app.db.select().from(discoverySessions).where(eq53(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
+      const rows = app.db.select().from(discoverySessions).where(eq54(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
       return reply.send(rows.map(serializeSession));
     }
   );
@@ -54843,11 +56499,11 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
       const detail = {
         ...serializeSession(session),
         probes: probeRows.map(serializeProbe)
@@ -54859,7 +56515,7 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/harvest",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
@@ -54867,7 +56523,7 @@ async function discoveryRoutes(app, opts) {
       const minProbeHits = Number.isNaN(parsedFloor) || parsedFloor < 1 ? 1 : parsedFloor;
       const applyAnchor = request.query.anchor !== "false";
       const provider = session.seedProvider ?? "gemini";
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
       const extract = opts.harvestSearchQueries;
       const probesWithQueries = probeRows.map((row) => {
         if (!extract || !row.rawResponse) return { searchQueries: [] };
@@ -54878,7 +56534,7 @@ async function discoveryRoutes(app, opts) {
           return { searchQueries: [] };
         }
       });
-      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq53(queries.projectId, project.id)).all().map((r) => r.query);
+      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query);
       const anchorTerms = buildHarvestAnchorTerms(
         [session.icpDescription ?? "", ...trackedQueries],
         effectiveDomains(project)
@@ -54925,12 +56581,12 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/promote",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
-      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq53(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
+      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
       const seenCompetitors = new Set(existingCompetitors);
       const cited = /* @__PURE__ */ new Set();
       const aspirational = /* @__PURE__ */ new Set();
@@ -54959,7 +56615,7 @@ async function discoveryRoutes(app, opts) {
   );
   app.post("/projects/:name/discover/sessions/:id/promote", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+    const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
     if (!session || session.projectId !== project.id) {
       throw notFound("Discovery session", request.params.id);
     }
@@ -54982,7 +56638,7 @@ async function discoveryRoutes(app, opts) {
     const bucketSet = new Set(buckets);
     const includeCompetitors = parsed.data.includeCompetitors ?? true;
     const competitorTypes = parsed.data.competitorTypes ?? DEFAULT_DISCOVERY_PROMOTE_COMPETITOR_TYPES;
-    const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+    const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
     const candidateQueries = /* @__PURE__ */ new Set();
     for (const probe of probeRows) {
       if (!probe.bucket) continue;
@@ -54990,7 +56646,7 @@ async function discoveryRoutes(app, opts) {
       if (bucket.success && bucketSet.has(bucket.data)) candidateQueries.add(probe.query);
     }
     const existingQueries = new Set(
-      app.db.select({ query: queries.query }).from(queries).where(eq53(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
+      app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
     );
     const promotedQueries = [];
     const skippedQueries = [];
@@ -55006,7 +56662,7 @@ async function discoveryRoutes(app, opts) {
     const skippedCompetitors = [];
     if (includeCompetitors) {
       const existingCompetitors = new Set(
-        app.db.select({ domain: competitors.domain }).from(competitors).where(eq53(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
+        app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
       );
       const competitorMap = parseCompetitorMap(session.competitorMap);
       for (const entry of selectEligibleCompetitors(competitorMap, competitorTypes)) {
@@ -55025,7 +56681,7 @@ async function discoveryRoutes(app, opts) {
       app.db.transaction((tx) => {
         for (const query of promotedQueries) {
           tx.insert(queries).values({
-            id: crypto41.randomUUID(),
+            id: crypto42.randomUUID(),
             projectId: project.id,
             query,
             provenance,
@@ -55034,7 +56690,7 @@ async function discoveryRoutes(app, opts) {
         }
         for (const domain of promotedCompetitors) {
           tx.insert(competitors).values({
-            id: crypto41.randomUUID(),
+            id: crypto42.randomUUID(),
             projectId: project.id,
             domain,
             provenance,
@@ -55124,8 +56780,8 @@ function selectEligibleCompetitors(competitorMap, competitorTypes) {
 }
 
 // ../api-routes/src/discovery/orchestrate.ts
-import crypto42 from "crypto";
-import { eq as eq54 } from "drizzle-orm";
+import crypto43 from "crypto";
+import { eq as eq55 } from "drizzle-orm";
 var DEFAULT_MAX_PROBES = 100;
 var ABSOLUTE_MAX_PROBES = 500;
 function classifyProbeBucket(input) {
@@ -55212,7 +56868,7 @@ async function executeDiscovery(opts) {
     status: DiscoverySessionStatuses.seeding,
     dedupThreshold,
     startedAt
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   const seedResult = await opts.deps.seed({
     project: opts.project,
     icpDescription: opts.icpDescription,
@@ -55273,7 +56929,7 @@ async function executeDiscovery(opts) {
     dedupBandPairFraction: dedupStats.bandPairFraction,
     dedupPairsTotal: dedupStats.pairsTotal,
     warning
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   const probeLocation = opts.locations?.[0];
   const probeResults = await mapWithConcurrency(
     probedCanonicals,
@@ -55292,7 +56948,7 @@ async function executeDiscovery(opts) {
     probeRows.push({ citedDomains: probe.citedDomains, bucket });
     buckets[bucket]++;
     return {
-      id: crypto42.randomUUID(),
+      id: crypto43.randomUUID(),
       sessionId: opts.sessionId,
       projectId: opts.project.id,
       query: probedCanonicals[index2],
@@ -55327,7 +56983,7 @@ async function executeDiscovery(opts) {
     wastedCount: buckets["wasted-surface"],
     competitorMap,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   upsertDomainClassifications(opts.db, opts.project.id, opts.sessionId, competitorMap);
   return {
     buckets,
@@ -55344,7 +57000,7 @@ function upsertDomainClassifications(db, projectId, sessionId, competitorMap) {
     const domain = hostOf(entry.domain) ?? "";
     if (!domain) continue;
     db.insert(domainClassifications).values({
-      id: crypto42.randomUUID(),
+      id: crypto43.randomUUID(),
       projectId,
       domain,
       competitorType: entry.competitorType,
@@ -55367,7 +57023,7 @@ function markSessionFailed(db, sessionId, error) {
     status: DiscoverySessionStatuses.failed,
     error,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq54(discoverySessions.id, sessionId)).run();
+  }).where(eq55(discoverySessions.id, sessionId)).run();
 }
 function dedupeStrings(input) {
   const seen = /* @__PURE__ */ new Set();
@@ -55384,8 +57040,16 @@ function dedupeStrings(input) {
 }
 
 // ../api-routes/src/technical-aeo.ts
-import crypto43 from "crypto";
-import { and as and43, asc as asc10, count, desc as desc24, eq as eq55, inArray as inArray19, lt as lt7, or as or11 } from "drizzle-orm";
+import crypto44 from "crypto";
+import { and as and44, asc as asc10, count, desc as desc24, eq as eq56, inArray as inArray19, isNotNull as isNotNull3, lt as lt8, or as or11, sql as sql21 } from "drizzle-orm";
+import { alias } from "drizzle-orm/sqlite-core";
+var FETCHED_SITE_CRAWL_STATES = /* @__PURE__ */ new Set([
+  ...SiteCrawlFetchedStates,
+  // Snapshots published before the full-crawl contract used this aggregate
+  // state. Keep historical structure counts truthful without admitting it to
+  // the current crawler vocabulary.
+  "fetched"
+]);
 var SURFACEABLE_STATUSES = [RunStatuses.completed, RunStatuses.partial];
 function emptyScore(projectName) {
   return {
@@ -55478,7 +57142,32 @@ function mapCrawlPage(row) {
     inboundOccurrences: row.inboundOccurrences,
     outboundOccurrences: row.outboundOccurrences,
     linkScoreRaw: row.linkScoreRaw,
-    linkScoreNormalized: row.linkScoreNormalized
+    linkScoreNormalized: row.linkScoreNormalized,
+    healthState: deriveSiteHealthState(row)
+  };
+}
+function mapCrawlPageAuditEvidence(row) {
+  const fields = row.auditFields;
+  const rawFactors = Array.isArray(fields.factors) ? fields.factors : [];
+  const rawCriticalDefects = Array.isArray(fields.criticalDefects) ? fields.criticalDefects : [];
+  const parsedFactors = rawFactors.map((factor) => siteCrawlAuditFactorSchema.safeParse(factor));
+  const parsedCriticalDefects = rawCriticalDefects.map((defect) => siteCrawlCriticalDefectSchema.safeParse(defect));
+  const complete = fields.schemaVersion === "1.0" && Array.isArray(fields.factors) && Array.isArray(fields.criticalDefects) && parsedFactors.every((result) => result.success) && parsedCriticalDefects.every((result) => result.success);
+  const factors = parsedFactors.flatMap((result, index2) => {
+    if (result.success) return [result.data];
+    const legacy = siteAuditPageFactorSchema.safeParse(rawFactors[index2]);
+    return legacy.success ? [{
+      ...legacy.data,
+      status: factorStatusFromScore(legacy.data.score),
+      applicable: null,
+      findings: [],
+      recommendations: []
+    }] : [];
+  });
+  return {
+    evidenceState: complete ? "complete" : "scores-only",
+    factors,
+    criticalDefects: parsedCriticalDefects.flatMap((result) => result.success ? [result.data] : [])
   };
 }
 function mapCrawlEdge(row) {
@@ -55497,26 +57186,141 @@ function mapCrawlEdge(row) {
     anchors: row.anchors
   };
 }
+var graphSourceNode = alias(siteCrawlGraphNodes, "site_crawl_graph_source_node");
+var graphTargetNode = alias(siteCrawlGraphNodes, "site_crawl_graph_target_node");
+var PAGE_CHANGE_PREDICATE = sql21`(
+  current.url IS NOT previous.url
+  OR current.final_url IS NOT previous.final_url
+  OR current.path IS NOT previous.path
+  OR current.parent_path IS NOT previous.parent_path
+  OR current.discovery_source IS NOT previous.discovery_source
+  OR current.fetch_state IS NOT previous.fetch_state
+  OR current.http_status IS NOT previous.http_status
+  OR current.canonical_url IS NOT previous.canonical_url
+  OR current.indexability_state IS NOT previous.indexability_state
+  OR current.indexability_reasons IS NOT previous.indexability_reasons
+  OR current.audit_state IS NOT previous.audit_state
+  OR current.audit_score IS NOT previous.audit_score
+  OR current.inventory_eligible IS NOT previous.inventory_eligible
+  OR current.depth IS NOT previous.depth
+  OR current.inbound_unique_edges IS NOT previous.inbound_unique_edges
+  OR current.outbound_unique_edges IS NOT previous.outbound_unique_edges
+  OR current.inbound_occurrences IS NOT previous.inbound_occurrences
+  OR current.outbound_occurrences IS NOT previous.outbound_occurrences
+  OR current.link_score_raw IS NOT previous.link_score_raw
+  OR current.link_score_normalized IS NOT previous.link_score_normalized
+)`;
+var LINK_CHANGE_PREDICATE = sql21`(
+  current.source_node_key IS NOT previous.source_node_key
+  OR current.source_url IS NOT previous.source_url
+  OR current.target_node_key IS NOT previous.target_node_key
+  OR current.target_url IS NOT previous.target_url
+  OR current.relation IS NOT previous.relation
+  OR current.followable IS NOT previous.followable
+  OR current.occurrences IS NOT previous.occurrences
+  OR current.followable_occurrences IS NOT previous.followable_occurrences
+  OR current.nofollow_occurrences IS NOT previous.nofollow_occurrences
+  OR current.anchors IS NOT previous.anchors
+)`;
+function encodeSiteHealthChangesCursor(cursor) {
+  return Buffer.from(JSON.stringify(cursor)).toString("base64url");
+}
+function decodeSiteHealthChangesCursor(value, context) {
+  if (value == null || value === "") return null;
+  if (typeof value !== "string" || value.length > 2048) throw validationError("Invalid Site Health changes cursor");
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    const valid = parsed.v === 1 && parsed.fromRunId === context.fromRunId && parsed.toRunId === context.toRunId && parsed.scope === context.scope && parsed.change === context.change && (parsed.entity === "page" || parsed.entity === "link") && typeof parsed.key === "string" && parsed.key.length > 0 && parsed.key.length <= 2048;
+    if (!valid) throw new Error("context mismatch");
+    return parsed;
+  } catch {
+    throw validationError("Site Health changes cursor does not match this snapshot comparison and filter");
+  }
+}
+function compareChangeKeys(left, right) {
+  return Buffer.compare(Buffer.from(left.key), Buffer.from(right.key));
+}
+function valueChanged(before, after) {
+  if (Array.isArray(before) || Array.isArray(after) || before && typeof before === "object" || after && typeof after === "object") {
+    return JSON.stringify(before) !== JSON.stringify(after);
+  }
+  return before !== after;
+}
+var PAGE_CHANGE_FIELDS = [
+  "url",
+  "finalUrl",
+  "path",
+  "parentPath",
+  "discoverySource",
+  "fetchState",
+  "httpStatus",
+  "canonicalUrl",
+  "indexabilityState",
+  "indexabilityReasons",
+  "auditState",
+  "auditScore",
+  "inventoryEligible",
+  "depth",
+  "inboundUniqueEdges",
+  "outboundUniqueEdges",
+  "inboundOccurrences",
+  "outboundOccurrences",
+  "linkScoreRaw",
+  "linkScoreNormalized"
+];
+var LINK_CHANGE_FIELDS = [
+  "sourceNodeKey",
+  "sourceUrl",
+  "targetNodeKey",
+  "targetUrl",
+  "relation",
+  "internal",
+  "followable",
+  "occurrences",
+  "followableOccurrences",
+  "nofollowOccurrences",
+  "anchors"
+];
+function changedFields(before, after, fields) {
+  if (!before || !after) return [];
+  return fields.filter((field) => valueChanged(before[field], after[field])).map(String);
+}
 async function technicalAeoRoutes(app, opts) {
   const resolveCrawl = (projectId, runId) => {
     const filters = [
-      eq55(siteCrawlSnapshots.projectId, projectId),
-      eq55(runs.projectId, projectId),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteCrawlSnapshots.projectId, projectId),
+      eq56(runs.projectId, projectId),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
     if (runId) {
-      filters.push(eq55(siteCrawlSnapshots.runId, runId));
+      filters.push(eq56(siteCrawlSnapshots.runId, runId));
     } else {
-      filters.push(eq55(siteCrawlSnapshots.complete, true), eq55(runs.status, RunStatuses.completed));
-    }
-    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq55(siteCrawlSnapshots.runId, runs.id)).where(and43(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt)).limit(1).get();
-  };
-  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(
-    eq55(siteAuditSnapshots.projectId, projectId),
-    eq55(runs.projectId, projectId),
-    eq55(runs.kind, RunKinds["site-audit"]),
+      filters.push(eq56(siteCrawlSnapshots.complete, true), eq56(runs.status, RunStatuses.completed));
+    }
+    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+  };
+  const detailScopeFor = (projectId, snapshot) => snapshot.detailsAvailable && snapshot.attemptId ? { projectId, runId: snapshot.runId, attemptId: snapshot.attemptId } : null;
+  const pageInScope = (scope, selector) => {
+    if (!selector.nodeKey && !selector.url) return null;
+    return app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
+      selector.nodeKey ? eq56(siteCrawlPages.nodeKey, selector.nodeKey) : eq56(siteCrawlPages.url, selector.url)
+    )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
+  };
+  const rootPageInScope = (scope, rootUrl) => pageInScope(scope, { url: rootUrl }) ?? app.db.select().from(siteCrawlPages).where(and44(
+    eq56(siteCrawlPages.projectId, scope.projectId),
+    eq56(siteCrawlPages.runId, scope.runId),
+    eq56(siteCrawlPages.attemptId, scope.attemptId),
+    eq56(siteCrawlPages.depth, 0)
+  )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
+  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
+    eq56(siteAuditSnapshots.projectId, projectId),
+    eq56(runs.projectId, projectId),
+    eq56(runs.kind, RunKinds["site-audit"]),
     inArray19(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
@@ -55526,6 +57330,7 @@ async function technicalAeoRoutes(app, opts) {
     legacyAuditAvailable,
     runId: null,
     runStatus: null,
+    requestedRootUrl: null,
     rootUrl: null,
     effectiveOptions: {},
     complete: false,
@@ -55537,20 +57342,20 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const baseFilters = [
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    const targetFilters = request.query.runId ? [...baseFilters, eq55(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
-    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    const targetFilters = request.query.runId ? [...baseFilters, eq56(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
+    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest) {
       if (request.query.runId) throw notFound("Site audit run", request.query.runId);
       return emptyScore(project.name);
     }
     const snap = latest.snap;
-    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...baseFilters, lt7(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
+    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...baseFilters, lt8(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
     const deltaScore = previous ? snap.aggregateScore - previous.aggregateScore : null;
     const trend = deltaScore == null ? null : deltaScore > 0 ? SiteAuditTrendDirections.up : deltaScore < 0 ? SiteAuditTrendDirections.down : SiteAuditTrendDirections.flat;
     return {
@@ -55577,14 +57382,14 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo/pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const targetFilters = [
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    if (request.query.runId) targetFilters.push(eq55(siteAuditSnapshots.runId, request.query.runId));
-    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    if (request.query.runId) targetFilters.push(eq56(siteAuditSnapshots.runId, request.query.runId));
+    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest && request.query.runId) {
       throw notFound("Site audit run", request.query.runId);
     }
@@ -55592,9 +57397,9 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, runId: null, auditedAt: null, total: 0, pages: [] };
     }
     const statusFilter = request.query.status === "success" || request.query.status === "error" ? request.query.status : null;
-    const conds = [eq55(siteAuditPages.projectId, project.id), eq55(siteAuditPages.runId, latest.runId)];
-    if (statusFilter) conds.push(eq55(siteAuditPages.status, statusFilter));
-    const where = and43(...conds);
+    const conds = [eq56(siteAuditPages.projectId, project.id), eq56(siteAuditPages.runId, latest.runId)];
+    if (statusFilter) conds.push(eq56(siteAuditPages.status, statusFilter));
+    const where = and44(...conds);
     const totalRow = app.db.select({ value: count() }).from(siteAuditPages).where(where).get();
     const total = totalRow?.value ?? 0;
     const limit = parsePositiveInt(request.query.limit, 100, 500);
@@ -55618,10 +57423,10 @@ async function technicalAeoRoutes(app, opts) {
       auditedAt: siteAuditSnapshots.auditedAt,
       aggregateScore: siteAuditSnapshots.aggregateScore,
       pagesAudited: siteAuditSnapshots.pagesAudited
-    }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+    }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     )).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(limit).all();
@@ -55643,6 +57448,7 @@ async function technicalAeoRoutes(app, opts) {
       legacyAuditAvailable,
       runId: snapshot.runId,
       runStatus: target.runStatus,
+      requestedRootUrl: snapshot.requestedRootUrl,
       rootUrl: snapshot.rootUrl,
       crawlSchemaVersion: snapshot.crawlSchemaVersion,
       engineVersion: snapshot.engineVersion,
@@ -55663,6 +57469,827 @@ async function technicalAeoRoutes(app, opts) {
       deadLinks
     };
   });
+  app.get("/projects/:name/technical-aeo/graph", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const target = resolveCrawl(project.id, request.query.runId);
+    if (!target) {
+      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      return {
+        project: project.name,
+        hasCrawlData: false,
+        runId: null,
+        layout: { state: "unavailable", version: null, reason: "no-crawl" },
+        totalNodes: 0,
+        totalEdges: 0,
+        nodes: [],
+        edges: [],
+        omittedNodes: 0,
+        omittedEdges: 0,
+        sampled: false
+      };
+    }
+    const snapshot = target.snapshot;
+    if (!snapshot.detailsAvailable || !snapshot.attemptId) {
+      return {
+        project: project.name,
+        hasCrawlData: true,
+        runId: snapshot.runId,
+        layout: { state: "unavailable", version: null, reason: "details-unavailable" },
+        totalNodes: 0,
+        totalEdges: 0,
+        nodes: [],
+        edges: [],
+        omittedNodes: 0,
+        omittedEdges: 0,
+        sampled: false
+      };
+    }
+    const persistedLayout = app.db.select().from(siteCrawlGraphLayouts).where(and44(
+      eq56(siteCrawlGraphLayouts.projectId, project.id),
+      eq56(siteCrawlGraphLayouts.runId, snapshot.runId),
+      eq56(siteCrawlGraphLayouts.attemptId, snapshot.attemptId)
+    )).limit(1).get();
+    if (!persistedLayout) {
+      return {
+        project: project.name,
+        hasCrawlData: true,
+        runId: snapshot.runId,
+        layout: { state: "unavailable", version: null, reason: "legacy-snapshot" },
+        totalNodes: 0,
+        totalEdges: 0,
+        nodes: [],
+        edges: [],
+        omittedNodes: 0,
+        omittedEdges: 0,
+        sampled: false
+      };
+    }
+    if (persistedLayout.state !== "ready" || !persistedLayout.layoutVersion) {
+      const totalNodes2 = persistedLayout.totalNodes;
+      const totalEdges2 = persistedLayout.totalEdges;
+      return {
+        project: project.name,
+        hasCrawlData: true,
+        runId: snapshot.runId,
+        layout: {
+          state: "unavailable",
+          version: null,
+          reason: persistedLayout.failureCode === "empty-crawl" ? "empty-crawl" : "layout-failed"
+        },
+        totalNodes: totalNodes2,
+        totalEdges: totalEdges2,
+        nodes: [],
+        edges: [],
+        omittedNodes: totalNodes2,
+        omittedEdges: totalEdges2,
+        sampled: totalNodes2 > 0 || totalEdges2 > 0
+      };
+    }
+    const maxNodes = parseBoundedLimit(request.query.maxNodes, SITE_CRAWL_GRAPH_DEFAULT_MAX_NODES, SITE_CRAWL_GRAPH_MAX_NODES);
+    const maxEdges = parseBoundedLimit(request.query.maxEdges, SITE_CRAWL_GRAPH_DEFAULT_MAX_EDGES, SITE_CRAWL_GRAPH_MAX_EDGES);
+    const graphScope = [
+      eq56(siteCrawlGraphNodes.projectId, project.id),
+      eq56(siteCrawlGraphNodes.runId, snapshot.runId),
+      eq56(siteCrawlGraphNodes.attemptId, snapshot.attemptId)
+    ];
+    const nodeRows = app.db.select({
+      nodeKey: siteCrawlPages.nodeKey,
+      url: siteCrawlPages.url,
+      path: siteCrawlPages.path,
+      depth: siteCrawlPages.depth,
+      indexabilityState: siteCrawlPages.indexabilityState,
+      indexabilityReasons: siteCrawlPages.indexabilityReasons,
+      canonicalNodeKey: siteCrawlPages.canonicalNodeKey,
+      fetchState: siteCrawlPages.fetchState,
+      auditState: siteCrawlPages.auditState,
+      auditScore: siteCrawlPages.auditScore,
+      inventoryEligible: siteCrawlPages.inventoryEligible,
+      inboundUniqueEdges: siteCrawlPages.inboundUniqueEdges,
+      outboundUniqueEdges: siteCrawlPages.outboundUniqueEdges,
+      linkScoreNormalized: siteCrawlPages.linkScoreNormalized,
+      x: siteCrawlGraphNodes.x,
+      y: siteCrawlGraphNodes.y
+    }).from(siteCrawlGraphNodes).innerJoin(siteCrawlPages, and44(
+      eq56(siteCrawlPages.projectId, siteCrawlGraphNodes.projectId),
+      eq56(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
+      eq56(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
+      eq56(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
+    )).where(and44(...graphScope, lt8(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc10(siteCrawlGraphNodes.sampleRank)).all();
+    const nodes = nodeRows.map(({ indexabilityReasons, canonicalNodeKey, ...row }) => ({
+      ...row,
+      healthState: deriveSiteHealthState({ ...row, indexabilityReasons, canonicalNodeKey })
+    }));
+    const edges = app.db.select({
+      edgeKey: siteCrawlGraphEdges.edgeKey,
+      sourceNodeKey: siteCrawlGraphEdges.sourceNodeKey,
+      targetNodeKey: siteCrawlGraphEdges.targetNodeKey,
+      followable: siteCrawlGraphEdges.followable,
+      occurrences: siteCrawlGraphEdges.occurrences
+    }).from(siteCrawlGraphEdges).innerJoin(graphSourceNode, and44(
+      eq56(graphSourceNode.projectId, siteCrawlGraphEdges.projectId),
+      eq56(graphSourceNode.runId, siteCrawlGraphEdges.runId),
+      eq56(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq56(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
+      lt8(graphSourceNode.sampleRank, maxNodes)
+    )).innerJoin(graphTargetNode, and44(
+      eq56(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
+      eq56(graphTargetNode.runId, siteCrawlGraphEdges.runId),
+      eq56(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq56(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
+      lt8(graphTargetNode.sampleRank, maxNodes)
+    )).where(and44(
+      eq56(siteCrawlGraphEdges.projectId, project.id),
+      eq56(siteCrawlGraphEdges.runId, snapshot.runId),
+      eq56(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
+      lt8(siteCrawlGraphEdges.sampleRank, maxEdges)
+    )).orderBy(asc10(siteCrawlGraphEdges.sampleRank)).all();
+    const totalNodes = persistedLayout.totalNodes;
+    const totalEdges = persistedLayout.totalEdges;
+    const omittedNodes = Math.max(0, totalNodes - nodes.length);
+    const omittedEdges = Math.max(0, totalEdges - edges.length);
+    return {
+      project: project.name,
+      hasCrawlData: true,
+      runId: snapshot.runId,
+      layout: { state: "ready", version: persistedLayout.layoutVersion, computedAt: persistedLayout.createdAt },
+      totalNodes,
+      totalEdges,
+      nodes,
+      edges,
+      omittedNodes,
+      omittedEdges,
+      sampled: omittedNodes > 0 || omittedEdges > 0
+    };
+  });
+  app.get("/projects/:name/technical-aeo/subgraph", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const hops = Math.min(3, parsePositiveInt(request.query.hops, 1, 3));
+    const maxNodes = parseBoundedLimit(
+      request.query.maxNodes,
+      SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_NODES,
+      SITE_HEALTH_SUBGRAPH_MAX_NODES
+    );
+    const maxEdges = parseBoundedLimit(
+      request.query.maxEdges,
+      SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_EDGES,
+      SITE_HEALTH_SUBGRAPH_MAX_EDGES
+    );
+    const target = resolveCrawl(project.id, request.query.runId);
+    const empty = (state, runId, hasCrawlData, complete, termination) => ({
+      project: project.name,
+      hasCrawlData,
+      runId,
+      complete,
+      termination,
+      state,
+      focusNodeKey: null,
+      focusUrl: null,
+      hops,
+      totalNodes: 0,
+      totalEdges: 0,
+      nodes: [],
+      edges: [],
+      omittedNodes: 0,
+      omittedEdges: 0,
+      countAccuracy: state === "no-crawl" ? "exact" : "lower-bound",
+      truncated: false
+    });
+    if (!target) {
+      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      return empty("no-crawl", null, false, false, null);
+    }
+    const snapshot = target.snapshot;
+    const scope = detailScopeFor(project.id, snapshot);
+    if (!scope) return empty("details-unavailable", snapshot.runId, true, snapshot.complete, snapshot.termination);
+    const explicitFocus = Boolean(request.query.nodeKey || request.query.url);
+    const focus = explicitFocus ? pageInScope(scope, { nodeKey: request.query.nodeKey, url: request.query.url }) : rootPageInScope(scope, snapshot.rootUrl);
+    if (!focus) {
+      if (explicitFocus) throw notFound("Site crawl page", request.query.nodeKey ?? request.query.url);
+      return {
+        ...empty("details-unavailable", snapshot.runId, true, snapshot.complete, snapshot.termination),
+        truncated: false
+      };
+    }
+    const distances = /* @__PURE__ */ new Map([[focus.nodeKey, 0]]);
+    const directRelations = /* @__PURE__ */ new Map();
+    const edgeRows = /* @__PURE__ */ new Map();
+    const omittedNodeKeys = /* @__PURE__ */ new Set();
+    const omittedEdgeKeys = /* @__PURE__ */ new Set();
+    const seenEdgeKeys = /* @__PURE__ */ new Set();
+    let frontier = [focus.nodeKey];
+    let queryTruncated = false;
+    for (let distance = 0; distance < hops && frontier.length > 0; distance += 1) {
+      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
+        eq56(siteCrawlEdges.projectId, scope.projectId),
+        eq56(siteCrawlEdges.runId, scope.runId),
+        eq56(siteCrawlEdges.attemptId, scope.attemptId),
+        eq56(siteCrawlEdges.internal, true),
+        isNotNull3(siteCrawlEdges.targetNodeKey),
+        or11(
+          inArray19(siteCrawlEdges.sourceNodeKey, frontier),
+          inArray19(siteCrawlEdges.targetNodeKey, frontier)
+        )
+      )).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(maxEdges + maxNodes + 1).all();
+      if (candidates.length > maxEdges + maxNodes) queryTruncated = true;
+      const next = /* @__PURE__ */ new Set();
+      for (const edge of candidates.slice(0, maxEdges + maxNodes)) {
+        if (!edge.targetNodeKey || seenEdgeKeys.has(edge.edgeKey)) continue;
+        seenEdgeKeys.add(edge.edgeKey);
+        const sourceInFrontier = frontier.includes(edge.sourceNodeKey);
+        const neighborKey = sourceInFrontier ? edge.targetNodeKey : edge.sourceNodeKey;
+        if (!distances.has(neighborKey)) {
+          if (distances.size < maxNodes) {
+            distances.set(neighborKey, distance + 1);
+            next.add(neighborKey);
+          } else {
+            omittedNodeKeys.add(neighborKey);
+          }
+        }
+        if (distance === 0 && neighborKey !== focus.nodeKey) {
+          const direction = edge.sourceNodeKey === focus.nodeKey ? "outbound" : "inbound";
+          const prior = directRelations.get(neighborKey);
+          directRelations.set(neighborKey, prior && prior !== direction ? "both" : direction);
+        }
+        if (distances.has(edge.sourceNodeKey) && distances.has(edge.targetNodeKey)) {
+          if (edgeRows.size < maxEdges) edgeRows.set(edge.edgeKey, edge);
+          else omittedEdgeKeys.add(edge.edgeKey);
+        } else {
+          omittedEdgeKeys.add(edge.edgeKey);
+        }
+      }
+      frontier = [...next].sort();
+    }
+    const nodeKeys = [...distances.keys()];
+    const pageRows = nodeKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
+      inArray19(siteCrawlPages.nodeKey, nodeKeys)
+    )).all();
+    const persistedNodeKeys = new Set(pageRows.map((row) => row.nodeKey));
+    const outermostNodeKeys = pageRows.filter((row) => distances.get(row.nodeKey) === hops).map((row) => row.nodeKey);
+    const omittedOutermostEdge = outermostNodeKeys.length === 0 ? void 0 : app.db.select({ edgeKey: siteCrawlEdges.edgeKey }).from(siteCrawlEdges).where(and44(
+      eq56(siteCrawlEdges.projectId, scope.projectId),
+      eq56(siteCrawlEdges.runId, scope.runId),
+      eq56(siteCrawlEdges.attemptId, scope.attemptId),
+      eq56(siteCrawlEdges.internal, true),
+      isNotNull3(siteCrawlEdges.targetNodeKey),
+      inArray19(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
+      inArray19(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
+    )).limit(1).get();
+    if (omittedOutermostEdge && !seenEdgeKeys.has(omittedOutermostEdge.edgeKey)) {
+      omittedEdgeKeys.add(omittedOutermostEdge.edgeKey);
+    }
+    const nodes = pageRows.map((row) => ({
+      ...mapCrawlPage(row),
+      distance: distances.get(row.nodeKey) ?? 0,
+      relationToFocus: row.nodeKey === focus.nodeKey ? "focus" : directRelations.get(row.nodeKey) ?? "transitive"
+    })).sort((a, b) => a.distance - b.distance || a.nodeKey.localeCompare(b.nodeKey));
+    const edges = [...edgeRows.values()].filter((edge) => edge.targetNodeKey && persistedNodeKeys.has(edge.sourceNodeKey) && persistedNodeKeys.has(edge.targetNodeKey)).sort((a, b) => a.edgeKey.localeCompare(b.edgeKey)).map(mapCrawlEdge);
+    const omittedNodes = omittedNodeKeys.size + Math.max(0, distances.size - pageRows.length);
+    const omittedEdges = omittedEdgeKeys.size + (queryTruncated ? 1 : 0) + Math.max(0, edgeRows.size - edges.length);
+    const truncated = omittedNodes > 0 || omittedEdges > 0;
+    return {
+      project: project.name,
+      hasCrawlData: true,
+      runId: snapshot.runId,
+      complete: snapshot.complete,
+      termination: snapshot.termination,
+      state: "ready",
+      focusNodeKey: focus.nodeKey,
+      focusUrl: focus.url,
+      hops,
+      totalNodes: nodes.length + omittedNodes,
+      totalEdges: edges.length + omittedEdges,
+      nodes,
+      edges,
+      omittedNodes,
+      omittedEdges,
+      countAccuracy: truncated ? "lower-bound" : "exact",
+      truncated
+    };
+  });
+  app.get("/projects/:name/technical-aeo/path", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const maxDepth = parseBoundedLimit(
+      request.query.maxDepth,
+      SITE_HEALTH_PATH_DEFAULT_MAX_DEPTH,
+      SITE_HEALTH_PATH_MAX_DEPTH
+    );
+    if (!request.query.toNodeKey && !request.query.toUrl) {
+      throw validationError("toNodeKey or toUrl is required");
+    }
+    const target = resolveCrawl(project.id, request.query.runId);
+    if (!target) {
+      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      return {
+        project: project.name,
+        runId: null,
+        state: "no-crawl",
+        from: null,
+        to: null,
+        complete: false,
+        termination: null,
+        maxDepth,
+        visitedNodes: 0,
+        nodes: [],
+        edges: []
+      };
+    }
+    const snapshot = target.snapshot;
+    const scope = detailScopeFor(project.id, snapshot);
+    if (!scope) {
+      return {
+        project: project.name,
+        runId: snapshot.runId,
+        state: "details-unavailable",
+        from: null,
+        to: null,
+        complete: snapshot.complete,
+        termination: snapshot.termination,
+        maxDepth,
+        visitedNodes: 0,
+        nodes: [],
+        edges: []
+      };
+    }
+    const explicitFrom = Boolean(request.query.fromNodeKey || request.query.fromUrl);
+    const fromPage = explicitFrom ? pageInScope(scope, { nodeKey: request.query.fromNodeKey, url: request.query.fromUrl }) : rootPageInScope(scope, snapshot.rootUrl);
+    if (!fromPage) throw notFound("Site crawl page", request.query.fromNodeKey ?? request.query.fromUrl ?? snapshot.rootUrl);
+    const toPage = pageInScope(scope, { nodeKey: request.query.toNodeKey, url: request.query.toUrl });
+    if (!toPage) throw notFound("Site crawl page", request.query.toNodeKey ?? request.query.toUrl);
+    const reference = (row) => ({
+      nodeKey: row.nodeKey,
+      url: row.url,
+      path: row.path
+    });
+    const predecessor = /* @__PURE__ */ new Map();
+    const visited = /* @__PURE__ */ new Set([fromPage.nodeKey]);
+    let frontier = [fromPage.nodeKey];
+    let found = fromPage.nodeKey === toPage.nodeKey;
+    let truncated = false;
+    for (let depth = 0; depth < maxDepth && frontier.length > 0 && !found; depth += 1) {
+      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
+        eq56(siteCrawlEdges.projectId, scope.projectId),
+        eq56(siteCrawlEdges.runId, scope.runId),
+        eq56(siteCrawlEdges.attemptId, scope.attemptId),
+        eq56(siteCrawlEdges.internal, true),
+        eq56(siteCrawlEdges.followable, true),
+        eq56(siteCrawlEdges.relation, "anchor"),
+        isNotNull3(siteCrawlEdges.targetNodeKey),
+        inArray19(siteCrawlEdges.sourceNodeKey, frontier)
+      )).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(SITE_HEALTH_PATH_MAX_VISITED_NODES + 1).all();
+      if (candidates.length > SITE_HEALTH_PATH_MAX_VISITED_NODES) truncated = true;
+      const candidateTargetKeys = [...new Set(candidates.map((edge) => edge.targetNodeKey).filter((nodeKey) => nodeKey != null))];
+      const persistedTargetKeys = new Set(candidateTargetKeys.length === 0 ? [] : app.db.select({ nodeKey: siteCrawlPages.nodeKey }).from(siteCrawlPages).where(and44(
+        eq56(siteCrawlPages.projectId, scope.projectId),
+        eq56(siteCrawlPages.runId, scope.runId),
+        eq56(siteCrawlPages.attemptId, scope.attemptId),
+        inArray19(siteCrawlPages.nodeKey, candidateTargetKeys)
+      )).all().map((row) => row.nodeKey));
+      const next = /* @__PURE__ */ new Set();
+      for (const edge of candidates.slice(0, SITE_HEALTH_PATH_MAX_VISITED_NODES)) {
+        if (!edge.targetNodeKey || !persistedTargetKeys.has(edge.targetNodeKey) || visited.has(edge.targetNodeKey)) continue;
+        if (visited.size >= SITE_HEALTH_PATH_MAX_VISITED_NODES) {
+          truncated = true;
+          break;
+        }
+        visited.add(edge.targetNodeKey);
+        predecessor.set(edge.targetNodeKey, { nodeKey: edge.sourceNodeKey, edge });
+        next.add(edge.targetNodeKey);
+        if (edge.targetNodeKey === toPage.nodeKey) {
+          found = true;
+          break;
+        }
+      }
+      frontier = [...next].sort();
+    }
+    if (!found) {
+      return {
+        project: project.name,
+        runId: snapshot.runId,
+        complete: snapshot.complete,
+        termination: snapshot.termination,
+        state: truncated || frontier.length > 0 ? "truncated" : "unreachable",
+        from: reference(fromPage),
+        to: reference(toPage),
+        maxDepth,
+        visitedNodes: visited.size,
+        nodes: [],
+        edges: []
+      };
+    }
+    const pathKeys = [toPage.nodeKey];
+    const pathEdges = [];
+    while (pathKeys[0] !== fromPage.nodeKey) {
+      const step = predecessor.get(pathKeys[0]);
+      if (!step) break;
+      pathEdges.unshift(step.edge);
+      pathKeys.unshift(step.nodeKey);
+    }
+    const pathRows = app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
+      inArray19(siteCrawlPages.nodeKey, pathKeys)
+    )).all();
+    const pageByKey = new Map(pathRows.map((row) => [row.nodeKey, row]));
+    return {
+      project: project.name,
+      runId: snapshot.runId,
+      complete: snapshot.complete,
+      termination: snapshot.termination,
+      state: "found",
+      from: reference(fromPage),
+      to: reference(toPage),
+      maxDepth,
+      visitedNodes: visited.size,
+      nodes: pathKeys.map((key) => mapCrawlPage(pageByKey.get(key))),
+      edges: pathEdges.map(mapCrawlEdge)
+    };
+  });
+  app.get("/projects/:name/technical-aeo/changes", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const scopeFilter = request.query.scope ?? "all";
+    if (scopeFilter !== "all" && scopeFilter !== "pages" && scopeFilter !== "links") {
+      throw validationError("scope must be all, pages, or links");
+    }
+    const changeFilter = request.query.change ?? "all";
+    if (changeFilter !== "all" && changeFilter !== "added" && changeFilter !== "removed" && changeFilter !== "changed") {
+      throw validationError("change must be all, added, removed, or changed");
+    }
+    const completeSnapshotFilters = [
+      eq56(siteCrawlSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
+      eq56(runs.status, RunStatuses.completed),
+      eq56(siteCrawlSnapshots.complete, true),
+      notProbeRun()
+    ];
+    const afterTarget = request.query.toRunId ? resolveCrawl(project.id, request.query.toRunId) : app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...completeSnapshotFilters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+    if (request.query.toRunId && !afterTarget) throw notFound("Site crawl run", request.query.toRunId);
+    const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(
+      ...completeSnapshotFilters,
+      or11(
+        lt8(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+        and44(
+          eq56(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+          lt8(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
+        )
+      )
+    )).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get() : void 0;
+    if (request.query.fromRunId && !beforeTarget) throw notFound("Site crawl run", request.query.fromRunId);
+    if (!afterTarget) {
+      return { project: project.name, state: "unavailable", reason: "no-crawl", fromRunId: null, toRunId: null };
+    }
+    if (!beforeTarget) {
+      return {
+        project: project.name,
+        state: "unavailable",
+        reason: "insufficient-history",
+        fromRunId: null,
+        toRunId: afterTarget.snapshot.runId
+      };
+    }
+    const beforeSnapshot = beforeTarget.snapshot;
+    const afterSnapshot = afterTarget.snapshot;
+    if (beforeSnapshot.runId === afterSnapshot.runId) {
+      throw validationError("fromRunId and toRunId must identify different crawls");
+    }
+    const crawlOrder = beforeSnapshot.createdAt.localeCompare(afterSnapshot.createdAt);
+    if (crawlOrder > 0 || crawlOrder === 0 && beforeSnapshot.runId >= afterSnapshot.runId) {
+      throw validationError("fromRunId must identify a crawl earlier than toRunId");
+    }
+    if (!beforeSnapshot.complete || !afterSnapshot.complete || beforeTarget.runStatus !== RunStatuses.completed || afterTarget.runStatus !== RunStatuses.completed) {
+      return {
+        project: project.name,
+        state: "unavailable",
+        reason: "partial-not-comparable",
+        fromRunId: beforeSnapshot.runId,
+        toRunId: afterSnapshot.runId
+      };
+    }
+    const beforeScope = detailScopeFor(project.id, beforeSnapshot);
+    const afterScope = detailScopeFor(project.id, afterSnapshot);
+    if (!beforeScope || !afterScope) {
+      return {
+        project: project.name,
+        state: "unavailable",
+        reason: "details-unavailable",
+        fromRunId: beforeSnapshot.runId,
+        toRunId: afterSnapshot.runId
+      };
+    }
+    const versions = {
+      crawlSchema: [beforeSnapshot.crawlSchemaVersion, afterSnapshot.crawlSchemaVersion],
+      normalization: [beforeSnapshot.normalizationVersion, afterSnapshot.normalizationVersion],
+      indexability: [beforeSnapshot.indexabilityVersion, afterSnapshot.indexabilityVersion],
+      linkScore: [beforeSnapshot.linkScoreVersion, afterSnapshot.linkScoreVersion]
+    };
+    const mismatchedVersions = Object.entries(versions).filter(([, pair]) => pair[0] !== pair[1]).map(([name]) => name);
+    if (mismatchedVersions.length > 0) {
+      return {
+        project: project.name,
+        state: "incompatible",
+        reason: "incompatible-versions",
+        fromRunId: beforeSnapshot.runId,
+        toRunId: afterSnapshot.runId,
+        mismatchedVersions
+      };
+    }
+    const cursor = decodeSiteHealthChangesCursor(request.query.cursor, {
+      fromRunId: beforeSnapshot.runId,
+      toRunId: afterSnapshot.runId,
+      scope: scopeFilter,
+      change: changeFilter
+    });
+    const loadSummary = () => {
+      const includeAdded = changeFilter === "all" || changeFilter === "added";
+      const includeRemoved = changeFilter === "all" || changeFilter === "removed";
+      const includeChanged = changeFilter === "all" || changeFilter === "changed";
+      const zero2 = () => ({ added: 0, removed: 0, changed: 0 });
+      const summary2 = { pages: zero2(), links: zero2() };
+      if (scopeFilter !== "links") {
+        if (includeAdded || includeChanged) {
+          const addedExpression = includeAdded ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const changedExpression = includeChanged ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${PAGE_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql21`
+            SELECT ${addedExpression} AS added, ${changedExpression} AS changed
+            FROM site_crawl_pages AS current
+            LEFT JOIN site_crawl_pages AS previous
+              ON previous.project_id = ${beforeScope.projectId}
+              AND previous.run_id = ${beforeScope.runId}
+              AND previous.attempt_id = ${beforeScope.attemptId}
+              AND previous.node_key = current.node_key
+            WHERE current.project_id = ${afterScope.projectId}
+              AND current.run_id = ${afterScope.runId}
+              AND current.attempt_id = ${afterScope.attemptId}
+          `);
+          summary2.pages.added = Number(counts2.added);
+          summary2.pages.changed = Number(counts2.changed);
+        }
+        if (includeRemoved) {
+          const [counts2 = { removed: 0 }] = app.db.all(sql21`
+            SELECT COUNT(*) AS removed
+            FROM site_crawl_pages AS previous
+            LEFT JOIN site_crawl_pages AS current
+              ON current.project_id = ${afterScope.projectId}
+              AND current.run_id = ${afterScope.runId}
+              AND current.attempt_id = ${afterScope.attemptId}
+              AND current.node_key = previous.node_key
+            WHERE previous.project_id = ${beforeScope.projectId}
+              AND previous.run_id = ${beforeScope.runId}
+              AND previous.attempt_id = ${beforeScope.attemptId}
+              AND current.id IS NULL
+          `);
+          summary2.pages.removed = Number(counts2.removed);
+        }
+      }
+      if (scopeFilter !== "pages") {
+        if (includeAdded || includeChanged) {
+          const addedExpression = includeAdded ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const changedExpression = includeChanged ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${LINK_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql21`
+            SELECT ${addedExpression} AS added, ${changedExpression} AS changed
+            FROM site_crawl_edges AS current
+            LEFT JOIN site_crawl_edges AS previous
+              ON previous.project_id = ${beforeScope.projectId}
+              AND previous.run_id = ${beforeScope.runId}
+              AND previous.attempt_id = ${beforeScope.attemptId}
+              AND previous.internal = 1
+              AND previous.edge_key = current.edge_key
+            WHERE current.project_id = ${afterScope.projectId}
+              AND current.run_id = ${afterScope.runId}
+              AND current.attempt_id = ${afterScope.attemptId}
+              AND current.internal = 1
+          `);
+          summary2.links.added = Number(counts2.added);
+          summary2.links.changed = Number(counts2.changed);
+        }
+        if (includeRemoved) {
+          const [counts2 = { removed: 0 }] = app.db.all(sql21`
+            SELECT COUNT(*) AS removed
+            FROM site_crawl_edges AS previous
+            LEFT JOIN site_crawl_edges AS current
+              ON current.project_id = ${afterScope.projectId}
+              AND current.run_id = ${afterScope.runId}
+              AND current.attempt_id = ${afterScope.attemptId}
+              AND current.internal = 1
+              AND current.edge_key = previous.edge_key
+            WHERE previous.project_id = ${beforeScope.projectId}
+              AND previous.run_id = ${beforeScope.runId}
+              AND previous.attempt_id = ${beforeScope.attemptId}
+              AND previous.internal = 1
+              AND current.id IS NULL
+          `);
+          summary2.links.removed = Number(counts2.removed);
+        }
+      }
+      return summary2;
+    };
+    const summary = cursor ? null : loadSummary();
+    const limit = parseBoundedLimit(request.query.limit, SITE_HEALTH_CHANGES_DEFAULT_LIMIT, SITE_HEALTH_CHANGES_MAX_LIMIT);
+    const sumCounts = (counts2) => counts2.added + counts2.removed + counts2.changed;
+    const total = summary ? sumCounts(summary.pages) + sumCounts(summary.links) : null;
+    const collectEntity = (entity, afterKey, wanted2) => {
+      if (wanted2 <= 0) return [];
+      const includeAfter = changeFilter === "all" || changeFilter === "added" || changeFilter === "changed";
+      const includeRemoved = changeFilter === "all" || changeFilter === "removed";
+      const table = entity === "page" ? "site_crawl_pages" : "site_crawl_edges";
+      const keyColumn = entity === "page" ? "node_key" : "edge_key";
+      const internalCurrent = entity === "link" ? sql21`AND current.internal = 1` : sql21``;
+      const internalPreviousJoin = entity === "link" ? sql21`AND previous.internal = 1` : sql21``;
+      const internalPrevious = entity === "link" ? sql21`AND previous.internal = 1` : sql21``;
+      const internalCurrentJoin = entity === "link" ? sql21`AND current.internal = 1` : sql21``;
+      const difference2 = entity === "page" ? PAGE_CHANGE_PREDICATE : LINK_CHANGE_PREDICATE;
+      const afterKind = changeFilter === "added" ? sql21`previous.id IS NULL` : changeFilter === "changed" ? sql21`previous.id IS NOT NULL AND ${difference2}` : sql21`previous.id IS NULL OR (previous.id IS NOT NULL AND ${difference2})`;
+      const afterRows = includeAfter ? app.db.all(sql21`
+        SELECT ${entity} AS entity,
+          CASE WHEN previous.id IS NULL THEN 'added' ELSE 'changed' END AS change,
+          current.${sql21.raw(keyColumn)} AS key
+        FROM ${sql21.raw(table)} AS current
+        LEFT JOIN ${sql21.raw(table)} AS previous
+          ON previous.project_id = ${beforeScope.projectId}
+          AND previous.run_id = ${beforeScope.runId}
+          AND previous.attempt_id = ${beforeScope.attemptId}
+          ${internalPreviousJoin}
+          AND previous.${sql21.raw(keyColumn)} = current.${sql21.raw(keyColumn)}
+        WHERE current.project_id = ${afterScope.projectId}
+          AND current.run_id = ${afterScope.runId}
+          AND current.attempt_id = ${afterScope.attemptId}
+          ${internalCurrent}
+          AND current.${sql21.raw(keyColumn)} > ${afterKey}
+          AND (${afterKind})
+        ORDER BY current.${sql21.raw(keyColumn)} ASC
+        LIMIT ${wanted2}
+      `) : [];
+      const removedRows = includeRemoved ? app.db.all(sql21`
+        SELECT ${entity} AS entity, 'removed' AS change, previous.${sql21.raw(keyColumn)} AS key
+        FROM ${sql21.raw(table)} AS previous
+        LEFT JOIN ${sql21.raw(table)} AS current
+          ON current.project_id = ${afterScope.projectId}
+          AND current.run_id = ${afterScope.runId}
+          AND current.attempt_id = ${afterScope.attemptId}
+          ${internalCurrentJoin}
+          AND current.${sql21.raw(keyColumn)} = previous.${sql21.raw(keyColumn)}
+        WHERE previous.project_id = ${beforeScope.projectId}
+          AND previous.run_id = ${beforeScope.runId}
+          AND previous.attempt_id = ${beforeScope.attemptId}
+          ${internalPrevious}
+          AND previous.${sql21.raw(keyColumn)} > ${afterKey}
+          AND current.id IS NULL
+        ORDER BY previous.${sql21.raw(keyColumn)} ASC
+        LIMIT ${wanted2}
+      `) : [];
+      const merged = [];
+      let afterIndex = 0;
+      let removedIndex = 0;
+      while (merged.length < wanted2 && (afterIndex < afterRows.length || removedIndex < removedRows.length)) {
+        const afterRow = afterRows.at(afterIndex);
+        const removedRow = removedRows.at(removedIndex);
+        if (!removedRow || afterRow && compareChangeKeys(afterRow, removedRow) <= 0) {
+          merged.push(afterRow);
+          afterIndex += 1;
+        } else {
+          merged.push(removedRow);
+          removedIndex += 1;
+        }
+      }
+      return merged;
+    };
+    const keyRows = [];
+    const wanted = limit + 1;
+    if (scopeFilter !== "links" && cursor?.entity !== "link") {
+      keyRows.push(...collectEntity("page", cursor?.entity === "page" ? cursor.key : "", wanted));
+    }
+    if (keyRows.length < wanted && scopeFilter !== "pages") {
+      keyRows.push(...collectEntity("link", cursor?.entity === "link" ? cursor.key : "", wanted - keyRows.length));
+    }
+    const visibleKeys = keyRows.slice(0, limit);
+    const pageKeys = visibleKeys.filter((row) => row.entity === "page").map((row) => row.key);
+    const linkKeys = visibleKeys.filter((row) => row.entity === "link").map((row) => row.key);
+    const pageRowsFor = (scope) => pageKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
+      inArray19(siteCrawlPages.nodeKey, pageKeys)
+    )).all();
+    const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and44(
+      eq56(siteCrawlEdges.projectId, scope.projectId),
+      eq56(siteCrawlEdges.runId, scope.runId),
+      eq56(siteCrawlEdges.attemptId, scope.attemptId),
+      eq56(siteCrawlEdges.internal, true),
+      inArray19(siteCrawlEdges.edgeKey, linkKeys)
+    )).all();
+    const beforePages = new Map(pageRowsFor(beforeScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
+    const afterPages = new Map(pageRowsFor(afterScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
+    const beforeLinks = new Map(edgeRowsFor(beforeScope).map((row) => [row.edgeKey, mapCrawlEdge(row)]));
+    const afterLinks = new Map(edgeRowsFor(afterScope).map((row) => [row.edgeKey, mapCrawlEdge(row)]));
+    const changes = visibleKeys.map((row) => {
+      if (row.entity === "page") {
+        const before2 = beforePages.get(row.key) ?? null;
+        const after2 = afterPages.get(row.key) ?? null;
+        const pageChangedFields = changedFields(before2, after2, PAGE_CHANGE_FIELDS);
+        if (before2 && after2 && before2.healthState !== after2.healthState) pageChangedFields.push("healthState");
+        return {
+          entity: "page",
+          change: row.change,
+          key: row.key,
+          changedFields: pageChangedFields,
+          before: before2,
+          after: after2
+        };
+      }
+      const before = beforeLinks.get(row.key) ?? null;
+      const after = afterLinks.get(row.key) ?? null;
+      return {
+        entity: "link",
+        change: row.change,
+        key: row.key,
+        changedFields: changedFields(before, after, LINK_CHANGE_FIELDS),
+        before,
+        after
+      };
+    });
+    return {
+      project: project.name,
+      state: "ready",
+      fromRunId: beforeSnapshot.runId,
+      toRunId: afterSnapshot.runId,
+      versions: {
+        crawlSchema: afterSnapshot.crawlSchemaVersion,
+        normalization: afterSnapshot.normalizationVersion,
+        indexability: afterSnapshot.indexabilityVersion,
+        linkScore: afterSnapshot.linkScoreVersion
+      },
+      filters: { scope: scopeFilter, change: changeFilter },
+      summaryState: cursor ? "omitted-on-continuation" : "exact",
+      summary,
+      total,
+      nextCursor: keyRows.length > limit && visibleKeys.length > 0 ? encodeSiteHealthChangesCursor({
+        v: 1,
+        fromRunId: beforeSnapshot.runId,
+        toRunId: afterSnapshot.runId,
+        scope: scopeFilter,
+        change: changeFilter,
+        entity: visibleKeys.at(-1).entity,
+        key: visibleKeys.at(-1).key
+      }) : null,
+      changes
+    };
+  });
+  app.get("/projects/:name/technical-aeo/crawl/pages/audit", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const scalarQueryString = (value, name) => {
+      if (value === void 0) return void 0;
+      if (typeof value !== "string") throw validationError(`${name} must be provided once`);
+      return value;
+    };
+    const runId = scalarQueryString(request.query.runId, "runId");
+    const nodeKey = scalarQueryString(request.query.nodeKey, "nodeKey")?.trim();
+    const url = scalarQueryString(request.query.url, "url")?.trim();
+    if (Number(Boolean(nodeKey)) + Number(Boolean(url)) !== 1) {
+      throw validationError("Provide exactly one of nodeKey or url");
+    }
+    const target = resolveCrawl(project.id, runId);
+    if (!target) {
+      if (runId) throw notFound("Site crawl run", runId);
+      return { state: "no-crawl", project: project.name, runId: null };
+    }
+    const snapshot = target.snapshot;
+    const provenance = {
+      project: project.name,
+      runId: snapshot.runId,
+      complete: snapshot.complete,
+      termination: snapshot.termination
+    };
+    const scope = detailScopeFor(project.id, snapshot);
+    if (!scope) return { state: "details-unavailable", ...provenance };
+    const page = pageInScope(scope, nodeKey ? { nodeKey } : { url });
+    if (!page) return { state: "not-found", ...provenance };
+    const identity = {
+      nodeKey: page.nodeKey,
+      url: page.url,
+      auditState: page.auditState
+    };
+    if (page.auditScore == null) {
+      return {
+        state: "not-audited",
+        ...provenance,
+        ...identity,
+        auditScore: null,
+        factors: [],
+        criticalDefects: []
+      };
+    }
+    return {
+      state: "ready",
+      ...provenance,
+      ...identity,
+      auditScore: page.auditScore,
+      ...mapCrawlPageAuditEvidence(page)
+    };
+  });
   app.get("/projects/:name/technical-aeo/crawl/pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const target = resolveCrawl(project.id, request.query.runId);
@@ -55675,16 +58302,16 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, hasCrawlData: true, runId: snapshot.runId, total: 0, nextCursor: null, pages: [] };
     }
     const filters = [
-      eq55(siteCrawlPages.projectId, project.id),
-      eq55(siteCrawlPages.runId, snapshot.runId),
-      eq55(siteCrawlPages.attemptId, snapshot.attemptId)
+      eq56(siteCrawlPages.projectId, project.id),
+      eq56(siteCrawlPages.runId, snapshot.runId),
+      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
     ];
     const inventoryEligible = parseBoolean2(request.query.inventoryEligible);
-    if (inventoryEligible != null) filters.push(eq55(siteCrawlPages.inventoryEligible, inventoryEligible));
-    if (request.query.fetchState) filters.push(eq55(siteCrawlPages.fetchState, request.query.fetchState));
-    if (request.query.indexabilityState) filters.push(eq55(siteCrawlPages.indexabilityState, request.query.indexabilityState));
-    if (request.query.auditState) filters.push(eq55(siteCrawlPages.auditState, request.query.auditState));
-    const where = and43(...filters);
+    if (inventoryEligible != null) filters.push(eq56(siteCrawlPages.inventoryEligible, inventoryEligible));
+    if (request.query.fetchState) filters.push(eq56(siteCrawlPages.fetchState, request.query.fetchState));
+    if (request.query.indexabilityState) filters.push(eq56(siteCrawlPages.indexabilityState, request.query.indexabilityState));
+    if (request.query.auditState) filters.push(eq56(siteCrawlPages.auditState, request.query.auditState));
+    const where = and44(...filters);
     const total = app.db.select({ value: count() }).from(siteCrawlPages).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
@@ -55717,10 +58344,10 @@ async function technicalAeoRoutes(app, opts) {
       url: siteCrawlPages.url,
       inventoryEligible: siteCrawlPages.inventoryEligible,
       fetchState: siteCrawlPages.fetchState
-    }).from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, project.id),
-      eq55(siteCrawlPages.runId, snapshot.runId),
-      eq55(siteCrawlPages.attemptId, snapshot.attemptId)
+    }).from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, project.id),
+      eq56(siteCrawlPages.runId, snapshot.runId),
+      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
     )).limit(MAX_STRUCTURE_SOURCE_ROWS + 1).all();
     if (sourceRows.length > MAX_STRUCTURE_SOURCE_ROWS) {
       throw validationError(`Persisted crawl exceeds the ${MAX_STRUCTURE_SOURCE_ROWS}-page structure limit`);
@@ -55738,7 +58365,7 @@ async function technicalAeoRoutes(app, opts) {
       };
       child.pageCount++;
       if (row.inventoryEligible) child.inventoryEligibleCount++;
-      if (["html", "redirect", "non-html", "fetch-error", "fetched"].includes(row.fetchState)) child.fetchedCount++;
+      if (FETCHED_SITE_CRAWL_STATES.has(row.fetchState)) child.fetchedCount++;
       if (structureHierarchyPath(row.path) === childPath) {
         child.hasPage = true;
         if (child.url == null || row.url > child.url) child.url = row.url;
@@ -55779,16 +58406,16 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, hasCrawlData: true, runId: snapshot.runId, total: 0, nextCursor: null, edges: [] };
     }
     const filters = [
-      eq55(siteCrawlEdges.projectId, project.id),
-      eq55(siteCrawlEdges.runId, snapshot.runId),
-      eq55(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq55(siteCrawlEdges.internal, true)
+      eq56(siteCrawlEdges.projectId, project.id),
+      eq56(siteCrawlEdges.runId, snapshot.runId),
+      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq56(siteCrawlEdges.internal, true)
     ];
-    if (request.query.sourceUrl) filters.push(eq55(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
-    if (request.query.targetUrl) filters.push(eq55(siteCrawlEdges.targetUrl, request.query.targetUrl));
+    if (request.query.sourceUrl) filters.push(eq56(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
+    if (request.query.targetUrl) filters.push(eq56(siteCrawlEdges.targetUrl, request.query.targetUrl));
     const followable = parseBoolean2(request.query.followable);
-    if (followable != null) filters.push(eq55(siteCrawlEdges.followable, followable));
-    const where = and43(...filters);
+    if (followable != null) filters.push(eq56(siteCrawlEdges.followable, followable));
+    const where = and44(...filters);
     const total = app.db.select({ value: count() }).from(siteCrawlEdges).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
@@ -55838,16 +58465,16 @@ async function technicalAeoRoutes(app, opts) {
       };
     }
     const scope = [
-      eq55(siteCrawlEdges.projectId, project.id),
-      eq55(siteCrawlEdges.runId, snapshot.runId),
-      eq55(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq55(siteCrawlEdges.internal, true)
+      eq56(siteCrawlEdges.projectId, project.id),
+      eq56(siteCrawlEdges.runId, snapshot.runId),
+      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq56(siteCrawlEdges.internal, true)
     ];
-    const inboundMatch = request.query.nodeKey && request.query.url ? or11(eq55(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq55(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq55(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq55(siteCrawlEdges.targetUrl, request.query.url);
-    const outboundMatch = request.query.nodeKey && request.query.url ? or11(eq55(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq55(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq55(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq55(siteCrawlEdges.sourceUrl, request.query.url);
+    const inboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.targetUrl, request.query.url);
+    const outboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.sourceUrl, request.query.url);
     const limit = parseBoundedLimit(request.query.limit, 50, 100);
-    const inboundRows = app.db.select().from(siteCrawlEdges).where(and43(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
-    const outboundRows = app.db.select().from(siteCrawlEdges).where(and43(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const inboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const outboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
     return {
       project: project.name,
       hasCrawlData: true,
@@ -55878,11 +58505,11 @@ async function technicalAeoRoutes(app, opts) {
     if (!snapshot.attemptId) {
       return { project: project.name, runId: snapshot.runId, state: "partial", checkDeadLinks: true, checked: snapshot.deadLinksChecked, found: snapshot.deadLinksFound, total: 0, nextCursor: null, deadLinks: [] };
     }
-    const where = and43(
-      eq55(siteCrawlFindings.projectId, project.id),
-      eq55(siteCrawlFindings.runId, snapshot.runId),
-      eq55(siteCrawlFindings.attemptId, snapshot.attemptId),
-      eq55(siteCrawlFindings.findingType, "dead-link")
+    const where = and44(
+      eq56(siteCrawlFindings.projectId, project.id),
+      eq56(siteCrawlFindings.runId, snapshot.runId),
+      eq56(siteCrawlFindings.attemptId, snapshot.attemptId),
+      eq56(siteCrawlFindings.findingType, "dead-link")
     );
     const total = app.db.select({ value: count() }).from(siteCrawlFindings).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
@@ -55925,12 +58552,12 @@ async function technicalAeoRoutes(app, opts) {
         status: runs.status,
         identityKey: siteCrawlRunRequests.identityKey,
         effectiveOptions: siteCrawlRunRequests.effectiveOptions
-      }).from(runs).leftJoin(siteCrawlRunRequests, and43(
-        eq55(siteCrawlRunRequests.projectId, runs.projectId),
-        eq55(siteCrawlRunRequests.runId, runs.id)
-      )).where(and43(
-        eq55(runs.projectId, project.id),
-        eq55(runs.kind, RunKinds["site-audit"]),
+      }).from(runs).leftJoin(siteCrawlRunRequests, and44(
+        eq56(siteCrawlRunRequests.projectId, runs.projectId),
+        eq56(siteCrawlRunRequests.runId, runs.id)
+      )).where(and44(
+        eq56(runs.projectId, project.id),
+        eq56(runs.kind, RunKinds["site-audit"]),
         inArray19(runs.status, [RunStatuses.queued, RunStatuses.running])
       )).get();
       if (existing) {
@@ -55948,7 +58575,7 @@ async function technicalAeoRoutes(app, opts) {
         );
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const runId = crypto43.randomUUID();
+      const runId = crypto44.randomUUID();
       tx.insert(runs).values({
         id: runId,
         projectId: project.id,
@@ -55981,8 +58608,8 @@ async function technicalAeoRoutes(app, opts) {
 }
 
 // ../api-routes/src/research.ts
-import crypto44 from "crypto";
-import { and as and44, desc as desc25, eq as eq56 } from "drizzle-orm";
+import crypto45 from "crypto";
+import { and as and45, desc as desc25, eq as eq57 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 async function researchRoutes(app, opts) {
   app.post("/projects/:name/research/runs", async (request, reply) => {
@@ -56008,19 +58635,19 @@ async function researchRoutes(app, opts) {
     if (!adapter.modelValidationPattern.test(resolvedModel)) throw validationError(`Invalid resolved model "${resolvedModel}" for provider "${providerName}".`, { provider: providerName, model: resolvedModel, hint: adapter.modelValidationHint });
     if (new Set(input.queries.map((query) => query.toLocaleLowerCase())).size !== input.queries.length) throw validationError("Research queries must be unique within a batch.");
     const normalized = { queries: input.queries, provider: providerName, model: requestedModel, location: location ?? null };
-    const requestHash2 = crypto44.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+    const requestHash2 = crypto45.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const decision = app.db.transaction((tx) => {
       if (input.idempotencyKey) {
-        const existing = tx.select().from(researchRuns).where(and44(eq56(researchRuns.projectId, project.id), eq56(researchRuns.idempotencyKey, input.idempotencyKey))).get();
+        const existing = tx.select().from(researchRuns).where(and45(eq57(researchRuns.projectId, project.id), eq57(researchRuns.idempotencyKey, input.idempotencyKey))).get();
         if (existing) {
           if (existing.requestHash !== requestHash2) throw alreadyExists("Research idempotency key", input.idempotencyKey);
           return { reused: true, id: existing.id, shouldDispatch: existing.status === ResearchRunStatuses.queued };
         }
       }
-      const id = crypto44.randomUUID();
+      const id = crypto45.randomUUID();
       tx.insert(researchRuns).values({ id, projectId: project.id, status: ResearchRunStatuses.queued, provider: providerName, requestedModel, resolvedModel, location: location ?? null, totalQueries: input.queries.length, idempotencyKey: input.idempotencyKey ?? null, requestHash: input.idempotencyKey ? requestHash2 : null, createdAt: now }).run();
-      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto44.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
+      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto45.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
       writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       return { reused: false, id, shouldDispatch: true };
     });
@@ -56033,7 +58660,7 @@ async function researchRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const requested = Number.parseInt(request.query.limit ?? "", 10);
     const limit = Number.isInteger(requested) && requested > 0 ? Math.min(requested, 100) : 20;
-    const runs2 = app.db.select().from(researchRuns).where(eq56(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
+    const runs2 = app.db.select().from(researchRuns).where(eq57(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
     return { runs: runs2 };
   });
   app.get("/projects/:name/research/runs/:runId", async (request) => {
@@ -56042,9 +58669,9 @@ async function researchRoutes(app, opts) {
   });
 }
 function getDetail(app, projectId, id) {
-  const row = app.db.select().from(researchRuns).where(and44(eq56(researchRuns.id, id), eq56(researchRuns.projectId, projectId))).get();
+  const row = app.db.select().from(researchRuns).where(and45(eq57(researchRuns.id, id), eq57(researchRuns.projectId, projectId))).get();
   if (!row) throw notFound("Research run", id);
-  const queries2 = app.db.select().from(researchRunQueries).where(eq56(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
+  const queries2 = app.db.select().from(researchRunQueries).where(eq57(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
   return { ...serializeRun(row), queries: queries2 };
 }
 function serializeRun(row) {
@@ -56254,6 +58881,11 @@ async function apiRoutes(app, opts) {
       vercelTrafficCredentialStore: opts.vercelTrafficCredentialStore,
       pullVercelTrafficEvents: opts.pullVercelTrafficEvents,
       vercelSyncDeadlineMs: opts.vercelSyncDeadlineMs,
+      cloudflareTrafficCredentialStore: opts.cloudflareTrafficCredentialStore,
+      cloudflareTrafficIngestUrl: opts.cloudflareTrafficIngestUrl,
+      cloudflareIngestRateLimitMax: opts.cloudflareIngestRateLimitMax,
+      cloudflareIngestIpRateLimitMax: opts.cloudflareIngestIpRateLimitMax,
+      defaultSampleLimit: opts.defaultTrafficSampleLimit,
       onTrafficSynced: opts.onTrafficSynced,
       onScheduleUpdated: opts.onScheduleUpdated,
       allowLoopbackWebhooks: opts.allowLoopbackWebhooks
@@ -56434,11 +59066,62 @@ function buildTrafficSourceValidators(opts) {
       validateScopes: () => null
     };
   }
+  if (opts.cloudflareTrafficCredentialStore) {
+    const store = opts.cloudflareTrafficCredentialStore;
+    validators[TrafficSourceTypes.cloudflare] = {
+      validateCredentials: (source) => {
+        const sourceMode = source.configJson.deliveryMode;
+        if (sourceMode !== void 0 && sourceMode !== "direct-push") return null;
+        const record = store.getConnection(source.projectName);
+        if (!record) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.missing",
+            summary: `No Cloudflare direct-push credential is stored for project "${source.projectName}".`,
+            remediation: "Re-run `canonry traffic connect cloudflare <project> --zone-id <id>` from the credential-owning host."
+          };
+        }
+        const recordMode = record.deliveryMode;
+        if (recordMode !== "direct-push") {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.mode-mismatch",
+            summary: `The stored Cloudflare credential mode does not match direct-push source "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source from the credential-owning host."
+          };
+        }
+        if (record.sourceId !== source.id) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.source-mismatch",
+            summary: `The stored Cloudflare credential belongs to a different source than "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source to pair the credential and source row."
+          };
+        }
+        const bearerToken = record.bearerToken;
+        const hmacSecret = record.hmacSecret;
+        if (typeof bearerToken !== "string" || bearerToken.length === 0 || typeof hmacSecret !== "string" || hmacSecret.length === 0 || !source.ingestTokenHash || hashCloudflareBearerToken(bearerToken) !== source.ingestTokenHash) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.bearer-mismatch",
+            summary: `The stored Cloudflare push credential does not match source "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source and redeploy the generated Worker secrets."
+          };
+        }
+        return {
+          status: CheckStatuses.ok,
+          code: "traffic.credentials.resolved",
+          summary: `Cloudflare direct-push credentials match source "${source.displayName}".`
+        };
+      },
+      validateScopes: () => null
+    };
+  }
   return Object.keys(validators).length > 0 ? validators : void 0;
 }
 
 // src/intelligence-service.ts
-import crypto45 from "crypto";
+import crypto46 from "crypto";
 
 // src/logger.ts
 var IS_TTY = process.stdout.isTTY === true;
@@ -56544,7 +59227,7 @@ function extractRecommendedCompetitors(answerText, ownDomains, citedDomains, com
   }
   const ownKeys = new Set([...ownBrandAliases].map(brandKeyFromText));
   const knownCompetitorAliases = new Set(
-    [...citedDomains, ...competitorDomains].flatMap((domain) => collectBrandAliasesFromDomain(domain)).filter((alias) => !ownKeys.has(brandKeyFromText(alias)))
+    [...citedDomains, ...competitorDomains].flatMap((domain) => collectBrandAliasesFromDomain(domain)).filter((alias2) => !ownKeys.has(brandKeyFromText(alias2)))
   );
   if (knownCompetitorAliases.size === 0) return [];
   const candidatePatterns = [
@@ -56616,7 +59299,7 @@ function collectBrandAliasesFromDomain(domain) {
   return [...aliases];
 }
 function matchesBrandAlias(candidate, aliases) {
-  return [...aliases].some((alias) => textContainsBrandAlias(candidate, alias));
+  return [...aliases].some((alias2) => textContainsBrandAlias(candidate, alias2));
 }
 
 // src/intelligence-service.ts
@@ -56646,9 +59329,9 @@ var IntelligenceService = class {
    */
   analyzeAndPersist(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
-      and45(
-        eq57(runs.projectId, projectId),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, projectId),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Defensive: RunCoordinator already skips probes before this is
         // called, but if a future call site invokes analyzeAndPersist
         // directly for a probe, probes still must not pollute the
@@ -56730,7 +59413,7 @@ var IntelligenceService = class {
    * Returns the persisted insights so the coordinator can count critical/high.
    */
   analyzeAndPersistGbp(runId, projectId) {
-    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq57(runs.id, runId)).get();
+    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq58(runs.id, runId)).get();
     if (!runRow) {
       log.info("gbp-intelligence.skip", { runId, reason: "run not found" });
       this.persistGbpInsights(runId, projectId, [], []);
@@ -56738,11 +59421,11 @@ var IntelligenceService = class {
     }
     const windowStart = runRow.startedAt ?? runRow.createdAt;
     const windowEnd = runRow.finishedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-    const selected = this.db.select().from(gbpLocations).where(and45(
-      eq57(gbpLocations.projectId, projectId),
-      eq57(gbpLocations.selected, true),
-      gte13(gbpLocations.syncedAt, windowStart),
-      lte10(gbpLocations.syncedAt, windowEnd)
+    const selected = this.db.select().from(gbpLocations).where(and46(
+      eq58(gbpLocations.projectId, projectId),
+      eq58(gbpLocations.selected, true),
+      gte14(gbpLocations.syncedAt, windowStart),
+      lte11(gbpLocations.syncedAt, windowEnd)
     )).all();
     if (selected.length === 0) {
       log.info("gbp-intelligence.skip", { runId, reason: "no locations synced during run" });
@@ -56775,12 +59458,12 @@ var IntelligenceService = class {
   }
   /** Build the per-location signal bundle the GBP analyzer consumes. */
   buildGbpLocationSignals(projectId, locationName, displayName, fallbackDate) {
-    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and45(eq57(gbpDailyMetrics.projectId, projectId), eq57(gbpDailyMetrics.locationName, locationName))).all();
-    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and45(eq57(gbpPlaceActions.projectId, projectId), eq57(gbpPlaceActions.locationName, locationName))).all();
-    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and45(eq57(gbpLodgingSnapshots.projectId, projectId), eq57(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
-    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and45(eq57(gbpLocations.projectId, projectId), eq57(gbpLocations.locationName, locationName))).get();
+    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and46(eq58(gbpDailyMetrics.projectId, projectId), eq58(gbpDailyMetrics.locationName, locationName))).all();
+    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and46(eq58(gbpPlaceActions.projectId, projectId), eq58(gbpPlaceActions.locationName, locationName))).all();
+    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and46(eq58(gbpLodgingSnapshots.projectId, projectId), eq58(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
+    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and46(eq58(gbpLocations.projectId, projectId), eq58(gbpLocations.locationName, locationName))).get();
     const descriptionMissing = !(ownerRow?.description ?? "").trim();
-    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and45(eq57(gbpPlaceDetails.projectId, projectId), eq57(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
+    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and46(eq58(gbpPlaceDetails.projectId, projectId), eq58(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
     const placesAmenities = placeRow ? extractPlaceAmenities(placeRow.attributes) : [];
     const summary = buildGbpSummary({
       locationName,
@@ -56816,7 +59499,7 @@ var IntelligenceService = class {
   /** Build the month-over-month keyword series for a location from the
    *  accumulating gbp_keyword_monthly table (latest complete month vs prior). */
   buildGbpKeywordTrend(projectId, locationName) {
-    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and45(eq57(gbpKeywordMonthly.projectId, projectId), eq57(gbpKeywordMonthly.locationName, locationName))).all();
+    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and46(eq58(gbpKeywordMonthly.projectId, projectId), eq58(gbpKeywordMonthly.locationName, locationName))).all();
     if (rows.length === 0) return { recentMonth: null, priorMonth: null, points: [] };
     const months = [...new Set(rows.map((r) => r.month))].sort().reverse();
     const recentMonth = months[0] ?? null;
@@ -56847,7 +59530,7 @@ var IntelligenceService = class {
    */
   persistGbpInsights(runId, projectId, gbpInsights, coveredLocationNames) {
     const covered = new Set(coveredLocationNames);
-    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and45(eq57(insights.projectId, projectId), eq57(insights.provider, GBP_INSIGHT_PROVIDER))).all();
+    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and46(eq58(insights.projectId, projectId), eq58(insights.provider, GBP_INSIGHT_PROVIDER))).all();
     const staleIds = [];
     const dismissedSlots = /* @__PURE__ */ new Set();
     for (const row of existing) {
@@ -56858,7 +59541,7 @@ var IntelligenceService = class {
     }
     this.db.transaction((tx) => {
       for (const id of staleIds) {
-        tx.delete(insights).where(eq57(insights.id, id)).run();
+        tx.delete(insights).where(eq58(insights.id, id)).run();
       }
       for (const insight of gbpInsights) {
         const parsed = parseGbpInsightId(insight.id);
@@ -56936,7 +59619,7 @@ var IntelligenceService = class {
    *     create per run + aggregate). DB is left untouched.
    */
   backfill(projectName, opts, onProgress) {
-    const project = this.db.select().from(projects).where(eq57(projects.name, projectName)).get();
+    const project = this.db.select().from(projects).where(eq58(projects.name, projectName)).get();
     if (!project) {
       throw new Error(`Project "${projectName}" not found`);
     }
@@ -56949,9 +59632,9 @@ var IntelligenceService = class {
       sinceTimestamp = parsed;
     }
     const allRuns = this.db.select().from(runs).where(
-      and45(
-        eq57(runs.projectId, project.id),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, project.id),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Backfill must not replay probe runs as if they were real sweeps.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -57030,7 +59713,7 @@ var IntelligenceService = class {
     return { processed, skipped, totalInsights };
   }
   loadTrackedCompetitors(projectId) {
-    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq57(competitors.projectId, projectId)).all().map((r) => r.domain);
+    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq58(competitors.projectId, projectId)).all().map((r) => r.domain);
   }
   /**
    * Wipe transition signals from an analysis result while keeping health.
@@ -57051,15 +59734,15 @@ var IntelligenceService = class {
   }
   persistResult(result, runId, projectId) {
     const previouslyDismissed = /* @__PURE__ */ new Set();
-    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq57(insights.runId, runId)).all();
+    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq58(insights.runId, runId)).all();
     for (const row of existingInsights) {
       if (row.dismissed) {
         previouslyDismissed.add(`${row.query}:${row.provider}:${row.type}`);
       }
     }
     this.db.transaction((tx) => {
-      tx.delete(insights).where(eq57(insights.runId, runId)).run();
-      tx.delete(healthSnapshots).where(eq57(healthSnapshots.runId, runId)).run();
+      tx.delete(insights).where(eq58(insights.runId, runId)).run();
+      tx.delete(healthSnapshots).where(eq58(healthSnapshots.runId, runId)).run();
       const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const insight of result.insights) {
         const wasDismissed = previouslyDismissed.has(`${insight.query}:${insight.provider}:${insight.type}`);
@@ -57079,7 +59762,7 @@ var IntelligenceService = class {
         }).run();
       }
       tx.insert(healthSnapshots).values({
-        id: crypto45.randomUUID(),
+        id: crypto46.randomUUID(),
         projectId,
         runId,
         overallCitedRate: String(result.health.overallCitedRate),
@@ -57112,24 +59795,24 @@ var IntelligenceService = class {
   applySeverityTiering(rawInsights, excludeRunId, projectId) {
     const regressions = rawInsights.filter((i) => i.type === "regression");
     if (regressions.length === 0) return rawInsights;
-    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq57(gscSearchData.projectId, projectId)).all();
+    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq58(gscSearchData.projectId, projectId)).all();
     const gscConnected = gscRows.length > 0;
     const gscImpressionsByQuery = /* @__PURE__ */ new Map();
     for (const row of gscRows) {
       const key = row.query.toLowerCase();
       gscImpressionsByQuery.set(key, (gscImpressionsByQuery.get(key) ?? 0) + row.impressions);
     }
-    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq57(projects.id, projectId)).get();
+    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq58(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectRow?.locations ?? []).length
     );
     const ROWS_PER_GROUP_BUDGET = Math.max(2, locationCount);
     const recentRunRows = this.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(
-      and45(
-        eq57(runs.projectId, projectId),
-        eq57(runs.kind, RunKinds["answer-visibility"]),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, projectId),
+        eq58(runs.kind, RunKinds["answer-visibility"]),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Defensive — see top of file.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -57149,7 +59832,7 @@ var IntelligenceService = class {
     const haveHistory = recentRunIds.length > 0;
     const priorRegressionsByPair = /* @__PURE__ */ new Map();
     if (haveHistory) {
-      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and45(eq57(insights.type, "regression"), inArray20(insights.runId, recentRunIds))).all();
+      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and46(eq58(insights.type, "regression"), inArray20(insights.runId, recentRunIds))).all();
       const regressionGroups = /* @__PURE__ */ new Map();
       for (const row of priorRows) {
         if (!row.runId) continue;
@@ -57178,7 +59861,7 @@ var IntelligenceService = class {
     });
   }
   buildRunData(runId, projectId, completedAt, location = null) {
-    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq57(projects.id, projectId)).get();
+    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq58(projects.id, projectId)).get();
     const projectDomains = projectDomainRow ? effectiveDomains({
       canonicalDomain: projectDomainRow.canonicalDomain,
       ownedDomains: projectDomainRow.ownedDomains
@@ -57195,7 +59878,7 @@ var IntelligenceService = class {
       citedDomains: querySnapshots.citedDomains,
       competitorOverlap: querySnapshots.competitorOverlap,
       snapshotLocation: querySnapshots.location
-    }).from(querySnapshots).leftJoin(queries, eq57(querySnapshots.queryId, queries.id)).where(eq57(querySnapshots.runId, runId)).all();
+    }).from(querySnapshots).leftJoin(queries, eq58(querySnapshots.queryId, queries.id)).where(eq58(querySnapshots.runId, runId)).all();
     const snapshots = [];
     let orphanCount = 0;
     for (const r of rows) {
@@ -57260,6 +59943,9 @@ export {
   siteCrawlSnapshots,
   siteCrawlPages,
   siteCrawlEdges,
+  siteCrawlGraphLayouts,
+  siteCrawlGraphNodes,
+  siteCrawlGraphEdges,
   siteCrawlFindings,
   siteCrawlEventReceipts,
   bingCoverageSnapshots,
@@ -57355,6 +60041,12 @@ export {
   listCachedReleases,
   pruneCachedRelease,
   resolveVercelSyncDeadlineMs,
+  CLOUDFLARE_WORKER_BINDINGS,
+  CLOUDFLARE_WORKER_GENERATED_MARKER,
+  CLOUDFLARE_WRANGLER_GENERATED_MARKER,
+  DEFAULT_BOT_LIST,
+  generateWorkerScript,
+  generateWranglerToml,
   executeDiscovery,
   markSessionFailed,
   apiRoutes,