@ainyc/canonry 4.194.0 → 5.0.0

package/dist/{chunk-QVYGI6CL.js → chunk-UMU3IBXM.js}

@@ -280,6 +280,7 @@ import {
   deriveWinnabilityClass,
   describeError,
   determineAnswerMentioned,
+  diagnosticIdentity,
   discoveryBucketSchema,
   discoveryHarvestDtoSchema,
   discoveryPromotePreviewSchema,
@@ -382,6 +383,7 @@ import {
   hostOf,
   inclusiveDayCount,
   indexingRequestResponseDtoSchema,
+  integrationSettingsSummaryDtoSchema,
   internalError,
   intersectScopes,
   isBrowserProvider,
@@ -397,6 +399,7 @@ import {
   latestProjectRunDtoSchema,
   linearTrend,
   locationContextSchema,
+  logQuerySchema,
   loginRequestSchema,
   mapWithConcurrency,
   matchedAliasKeys,
@@ -512,6 +515,7 @@ import {
   normalizeProjectName,
   normalizeQueryText,
   normalizeSiteAuditRunRequest,
+  normalizeTelemetryStatus,
   normalizeUrlPath,
   normalizeUserName,
   notFound,
@@ -520,6 +524,8 @@ import {
   observeTemplateLinkEdges,
   onboardingTelemetryEventSchema,
   operationInProgress,
+  operationalLogEntryDtoSchema,
+  operationalLogListDtoSchema,
   orderLocationsDefaultFirst,
   organicEvidenceDtoSchema,
   organicEvidencePeriodSchema,
@@ -542,6 +548,7 @@ import {
   projectUpsertRequestSchema,
   providerAuthError,
   providerError,
+  providerSummaryEntryDtoSchema,
   queryDtoSchema,
   queryGenerateRequestSchema,
   queryTrackingCommitRequestSchema,
@@ -555,6 +562,8 @@ import {
   recommendationBriefDtoSchema,
   recommendationExplainRequestSchema,
   recommendationExplanationDtoSchema,
+  redactLogString,
+  redactLogValue,
   registrableDomain,
   relativeChangeRatio,
   reportActionCategoryLabel,
@@ -648,6 +657,7 @@ import {
   surfaceClassFromCompetitorType,
   surfaceClassLabel,
   telemetryEventAcceptedDtoSchema,
+  telemetryStatusDtoSchema,
   templateLinkRatio,
   templateLinkSource,
   templateLinkUbiquityAvailable,
@@ -692,10 +702,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-X5AE3GNC.js";
+} from "./chunk-3WODA4JF.js";
 
 // src/intelligence-service.ts
-import { eq as eq67, desc as desc29, asc as asc12, and as and57, ne as ne10, or as or15, inArray as inArray25, gte as gte18, lte as lte15, isNull as isNull12, sql as sql26, exists } from "drizzle-orm";
+import { eq as eq67, desc as desc29, asc as asc12, and as and57, ne as ne10, or as or16, inArray as inArray25, gte as gte18, lte as lte15, isNull as isNull12, sql as sql27, exists } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -795,6 +805,8 @@ __export(schema_exports, {
   researchRunQueries: () => researchRunQueries,
   researchRuns: () => researchRuns,
   runs: () => runs,
+  runtimeLogMetadata: () => runtimeLogMetadata,
+  runtimeLogs: () => runtimeLogs,
   schedules: () => schedules,
   simpleMeasurementDefinitions: () => simpleMeasurementDefinitions,
   siteAuditPages: () => siteAuditPages,
@@ -1158,10 +1170,9 @@ var auditLog = sqliteTable("audit_log", {
   // reader could see it (the deletion would erase the only evidence it
   // happened). Detached rows surface in audit queries with project_id=NULL.
   projectId: text("project_id").references(() => projects.id, { onDelete: "set null" }),
-  // High-level identity of the caller: 'api' for HTTP requests, 'scheduler'
-  // for cron-triggered work, 'cli' / 'agent' / 'mcp' for direct DB writes
-  // (where applicable). Coarse on purpose — narrower attribution lives in
-  // `userAgent` and `actorSession`.
+  // Authenticated user:<id> / api-key:<id> for HTTP callers; explicit business
+  // actors (scheduler, system, etc.) remain unchanged. Client hints below
+  // are untrusted correlation metadata, never authorization identities.
   actor: text("actor").notNull(),
   action: text("action").notNull(),
   entityType: text("entity_type").notNull(),
@@ -1178,11 +1189,46 @@ var auditLog = sqliteTable("audit_log", {
   // with its session id so post-mortems can group a related sequence of
   // mutations. NULL when the caller didn't provide one.
   actorSession: text("actor_session"),
+  // Stable credential id, intentionally not an FK: audit evidence must remain
+  // intelligible after a key is revoked or deleted.
+  credentialId: text("credential_id"),
+  // Server-issued request correlation id, separate from caller actorSession.
+  requestId: text("request_id"),
   createdAt: text("created_at").notNull()
 }, (table) => [
   index("idx_audit_log_project").on(table.projectId),
-  index("idx_audit_log_created").on(table.createdAt)
+  index("idx_audit_log_created").on(table.createdAt),
+  index("idx_audit_log_credential_created").on(table.credentialId, table.createdAt),
+  index("idx_audit_log_request_created").on(table.requestId, table.createdAt)
 ]);
+var runtimeLogs = sqliteTable("runtime_logs", {
+  sequence: integer("sequence").primaryKey(),
+  ts: text("ts").notNull(),
+  level: text("level").notNull(),
+  module: text("module").notNull(),
+  action: text("action").notNull(),
+  msg: text("msg"),
+  projectId: text("project_id"),
+  runId: text("run_id"),
+  actor: text("actor"),
+  requestId: text("request_id"),
+  context: text("context", { mode: "json" }).$type().notNull().default({}),
+  entryBytes: integer("entry_bytes").notNull()
+}, (table) => [
+  index("idx_runtime_logs_project_ts").on(table.projectId, table.ts, table.sequence),
+  index("idx_runtime_logs_run_ts").on(table.runId, table.ts, table.sequence),
+  index("idx_runtime_logs_actor_ts").on(table.actor, table.ts, table.sequence),
+  index("idx_runtime_logs_request_ts").on(table.requestId, table.ts, table.sequence),
+  index("idx_runtime_logs_module_level_ts").on(table.module, table.level, table.ts, table.sequence),
+  index("idx_runtime_logs_ts").on(table.ts, table.sequence)
+]);
+var runtimeLogMetadata = sqliteTable("runtime_log_metadata", {
+  id: text("id").primaryKey(),
+  cursorNamespace: text("cursor_namespace").notNull(),
+  nextSequence: integer("next_sequence").notNull(),
+  dropped: integer("dropped").notNull().default(0),
+  captureErrors: integer("capture_errors").notNull().default(0)
+});
 var apiKeys = sqliteTable("api_keys", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
@@ -7202,6 +7248,45 @@ var MIGRATION_VERSIONS = [
     statements: [
       `ALTER TABLE api_keys ADD COLUMN delegated_user_id TEXT REFERENCES users(id) ON DELETE CASCADE`
     ]
+  },
+  {
+    version: 155,
+    name: "durable-operational-logs",
+    statements: [
+      // Audit attribution is intentionally a plain nullable identity string:
+      // deleting/revoking a credential must not delete its historical trail.
+      `ALTER TABLE audit_log ADD COLUMN credential_id TEXT`,
+      `ALTER TABLE audit_log ADD COLUMN request_id TEXT`,
+      `CREATE INDEX IF NOT EXISTS idx_audit_log_credential_created ON audit_log(credential_id, created_at)`,
+      `CREATE INDEX IF NOT EXISTS idx_audit_log_request_created ON audit_log(request_id, created_at)`,
+      `CREATE TABLE IF NOT EXISTS runtime_logs (
+        sequence    INTEGER PRIMARY KEY,
+        ts          TEXT NOT NULL,
+        level       TEXT NOT NULL,
+        module      TEXT NOT NULL,
+        action      TEXT NOT NULL,
+        msg         TEXT,
+        project_id  TEXT,
+        run_id      TEXT,
+        actor       TEXT,
+        request_id  TEXT,
+        context     TEXT NOT NULL DEFAULT '{}',
+        entry_bytes INTEGER NOT NULL
+      )`,
+      `CREATE TABLE IF NOT EXISTS runtime_log_metadata (
+        id                TEXT PRIMARY KEY,
+        cursor_namespace  TEXT NOT NULL,
+        next_sequence     INTEGER NOT NULL,
+        dropped           INTEGER NOT NULL DEFAULT 0,
+        capture_errors    INTEGER NOT NULL DEFAULT 0
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_project_ts ON runtime_logs(project_id, ts, sequence)`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_run_ts ON runtime_logs(run_id, ts, sequence)`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_actor_ts ON runtime_logs(actor, ts, sequence)`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_request_ts ON runtime_logs(request_id, ts, sequence)`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_module_level_ts ON runtime_logs(module, level, ts, sequence)`,
+      `CREATE INDEX IF NOT EXISTS idx_runtime_logs_ts ON runtime_logs(ts, sequence)`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -7476,6 +7561,293 @@ function migrate(db, versions = MIGRATION_VERSIONS) {
   }
 }
 
+// ../db/src/operational-logs.ts
+import { createHash, randomUUID } from "crypto";
+import { sql as sql3 } from "drizzle-orm";
+var METADATA_ID = "runtime-log-store";
+var DEFAULT_MAX_ENTRIES = 1e4;
+var MAX_MAX_ENTRIES = 1e5;
+var DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+var MIN_MAX_AGE_MS = 1e3;
+var MAX_MAX_AGE_MS = 31 * 24 * 60 * 60 * 1e3;
+var MAX_ENTRY_BYTES = 8192;
+var OperationalLogStore = class {
+  constructor(db, options = {}) {
+    this.db = db;
+    this.maxEntries = boundedInteger(options.maxEntries ?? DEFAULT_MAX_ENTRIES, 1, MAX_MAX_ENTRIES, "maxEntries");
+    this.maxAgeMs = boundedInteger(options.maxAgeMs ?? DEFAULT_MAX_AGE_MS, MIN_MAX_AGE_MS, MAX_MAX_AGE_MS, "maxAgeMs");
+    this.retention = options.retention ?? "durable";
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.ensureMetadata();
+  }
+  db;
+  maxEntries;
+  maxAgeMs;
+  retention;
+  now;
+  localCaptureErrors = 0;
+  append(event) {
+    try {
+      const entry = projectEvent(event);
+      if (Buffer.byteLength(JSON.stringify(entry), "utf8") > MAX_ENTRY_BYTES) {
+        throw new RangeError(`Operational log entry exceeds ${MAX_ENTRY_BYTES} bytes.`);
+      }
+      this.withoutLockWait(() => this.db.transaction((tx) => {
+        this.prune(tx);
+        const metadata2 = readMetadata(tx);
+        tx.run(sql3`
+          INSERT INTO runtime_logs (
+            sequence, ts, level, module, action, msg, project_id, run_id, actor, request_id, context, entry_bytes
+          ) VALUES (
+            ${metadata2.nextSequence}, ${entry.ts}, ${entry.level}, ${entry.module}, ${entry.action}, ${entry.message ?? null},
+            ${entry.projectId ?? null}, ${entry.runId ?? null}, ${entry.context.actor ?? null}, ${entry.context.requestId ?? null},
+            ${JSON.stringify(entry.context)}, ${Buffer.byteLength(JSON.stringify(entry), "utf8")}
+          )
+        `);
+        tx.run(sql3`UPDATE runtime_log_metadata SET next_sequence = ${metadata2.nextSequence + 1} WHERE id = ${METADATA_ID}`);
+        this.prune(tx);
+      }));
+    } catch {
+      this.recordCaptureError();
+    }
+  }
+  list(query) {
+    const parsed = logQuerySchema.safeParse(query);
+    if (!parsed.success) throw validationError("Invalid operational logs query.", { issues: parsed.error.issues });
+    const filters = normalizeLogQuery(parsed.data);
+    this.withoutLockWait(() => this.db.transaction((tx) => {
+      this.prune(tx);
+    }));
+    const metadata2 = readMetadata(this.db);
+    const after = filters.cursor === void 0 ? 0 : this.parseCursor(filters.cursor, metadata2, filters);
+    if (filters.cursor !== void 0) this.assertCursorCurrent(after);
+    const where = buildWhere(filters, after);
+    const rows = this.db.all(sql3`
+      SELECT sequence, ts, level, module, action, msg,
+             project_id AS projectId, run_id AS runId, actor, request_id AS requestId, context
+        FROM runtime_logs
+       WHERE ${sql3.join(where, sql3` AND `)}
+       ORDER BY sequence ASC
+       LIMIT ${filters.limit}
+    `);
+    const countRows = this.db.all(sql3`
+      SELECT COUNT(*) AS count FROM runtime_logs WHERE ${sql3.join(where, sql3` AND `)}
+    `);
+    const matching = countRows[0]?.count;
+    if (!Number.isSafeInteger(matching) || matching < rows.length) throw new Error("Operational log storage returned an invalid count.");
+    const truncated = matching - rows.length;
+    return {
+      entries: rows.map((row) => this.toDto(row, metadata2.cursorNamespace, filters)),
+      nextCursor: truncated > 0 ? this.cursorFor(metadata2.cursorNamespace, rows.at(-1).sequence, filters) : null,
+      truncated,
+      dropped: metadata2.dropped,
+      retention: this.retention,
+      retentionPolicy: { maxEntries: this.maxEntries, maxAgeSeconds: Math.ceil(this.maxAgeMs / 1e3) },
+      captureErrors: metadata2.captureErrors + this.localCaptureErrors,
+      observedAt: this.now().toISOString()
+    };
+  }
+  ensureMetadata() {
+    const existing = this.db.all(sql3`SELECT id FROM runtime_log_metadata WHERE id = ${METADATA_ID}`);
+    if (existing.length > 0) return;
+    this.db.run(sql3`
+      INSERT OR IGNORE INTO runtime_log_metadata (id, cursor_namespace, next_sequence, dropped, capture_errors)
+      VALUES (${METADATA_ID}, ${randomUUID()}, 1, 0, 0)
+    `);
+  }
+  prune(db) {
+    const expiry = new Date(this.now().getTime() - this.maxAgeMs).toISOString();
+    db.run(sql3`DELETE FROM runtime_logs WHERE ts < ${expiry}`);
+    db.run(sql3`UPDATE runtime_log_metadata SET dropped = dropped + changes() WHERE id = ${METADATA_ID}`);
+    const metadata2 = readMetadata(db);
+    const firstRetainedSequence = Math.max(1, metadata2.nextSequence - this.maxEntries);
+    db.run(sql3`DELETE FROM runtime_logs WHERE sequence < ${firstRetainedSequence}`);
+    db.run(sql3`UPDATE runtime_log_metadata SET dropped = dropped + changes() WHERE id = ${METADATA_ID}`);
+  }
+  recordCaptureError() {
+    try {
+      this.withoutLockWait(() => this.db.run(sql3`UPDATE runtime_log_metadata SET capture_errors = capture_errors + 1 WHERE id = ${METADATA_ID}`));
+    } catch {
+      this.localCaptureErrors++;
+    }
+  }
+  /**
+   * Diagnostics must not spend the application's busy timeout waiting for a
+   * writer. All work here is synchronous, so restore the connection's exact
+   * policy before any other application work can run, including on failure.
+   */
+  withoutLockWait(work) {
+    const timeout = this.db.$client.pragma("busy_timeout", { simple: true });
+    try {
+      this.db.$client.pragma("busy_timeout = 0");
+      return work();
+    } finally {
+      this.db.$client.pragma(`busy_timeout = ${timeout}`);
+    }
+  }
+  parseCursor(cursor, metadata2, filters) {
+    let decoded;
+    try {
+      decoded = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+    } catch {
+      throw validationError("The operational-log cursor is invalid.");
+    }
+    if (!isCursorPayload(decoded)) throw validationError("The operational-log cursor is invalid.");
+    if (decoded.namespace !== metadata2.cursorNamespace) throw validationError("The operational-log cursor belongs to a different database.");
+    if (decoded.filters !== filterHash(filters)) throw validationError("The operational-log cursor does not match these query filters.");
+    if (decoded.sequence < 1 || decoded.sequence >= metadata2.nextSequence) throw validationError("The operational-log cursor is invalid.");
+    return decoded.sequence;
+  }
+  assertCursorCurrent(sequence) {
+    const rows = this.db.all(sql3`SELECT sequence FROM runtime_logs WHERE sequence = ${sequence}`);
+    if (rows.length === 0) throw validationError("The operational-log cursor is stale because retention evicted its entry.");
+  }
+  cursorFor(namespace, sequence, filters) {
+    return Buffer.from(JSON.stringify({ namespace, sequence, filters: filterHash(filters) }), "utf8").toString("base64url");
+  }
+  toDto(row, namespace, filters) {
+    const context = parseContext(row.context);
+    const entry = {
+      cursor: this.cursorFor(namespace, row.sequence, filters),
+      ts: redactLogString(row.ts),
+      level: redactLogString(row.level),
+      module: redactLogString(row.module),
+      action: redactLogString(row.action),
+      ...row.msg === null ? {} : { message: clip(redactLogString(row.msg), 4096) },
+      ...row.runId === null ? {} : { runId: clip(redactLogString(row.runId), 256) },
+      ...row.projectId === null ? {} : { projectId: clip(redactLogString(row.projectId), 256) },
+      context
+    };
+    return operationalLogEntryDtoSchema.parse(entry);
+  }
+};
+function projectEvent(event) {
+  const value = redactLogValue(event);
+  if (!isRecord(value)) throw new TypeError("Operational log event must be an object.");
+  const contextSource = isRecord(value.context) ? value.context : {};
+  const context = projectContext(value, contextSource);
+  const entry = {
+    ts: new Date(requiredString(value.ts, 64, "timestamp")).toISOString(),
+    level: requiredString(value.level, 16, "level"),
+    module: requiredString(value.module, 256, "module"),
+    action: requiredString(value.action, 256, "action"),
+    ...optionalString(value.msg, 4096) === void 0 ? {} : { message: optionalString(value.msg, 4096) },
+    ...context.runId === void 0 ? {} : { runId: context.runId },
+    ...context.projectId === void 0 ? {} : { projectId: context.projectId },
+    context
+  };
+  return operationalLogEntryDtoSchema.omit({ cursor: true }).parse(entry);
+}
+function projectContext(event, nested) {
+  const context = {};
+  for (const [key, max2] of ID_FIELDS) {
+    const raw = event[key] ?? nested[key];
+    const value = diagnosticIdentity(key, raw) ?? optionalString(raw, max2);
+    if (value !== void 0) context[key] = value;
+  }
+  for (const key of NUMBER_FIELDS) {
+    const value = event[key] ?? nested[key];
+    if (typeof value === "number" && Number.isFinite(value)) context[key] = value;
+  }
+  for (const key of BOOLEAN_FIELDS) {
+    const value = event[key] ?? nested[key];
+    if (typeof value === "boolean") context[key] = value;
+  }
+  const errorCode = optionalString(event.errorCode ?? nested.errorCode, 128);
+  if (errorCode !== void 0) context.errorCode = errorCode;
+  return context;
+}
+var ID_FIELDS = [
+  ["runId", 256],
+  ["projectId", 256],
+  ["requestId", 256],
+  ["actor", 512],
+  ["credentialId", 512],
+  ["userAgent", 512],
+  ["actorSession", 512],
+  ["operationId", 256],
+  ["jobId", 256],
+  ["taskId", 256],
+  ["traceId", 256],
+  ["method", 16],
+  ["route", 256]
+];
+var NUMBER_FIELDS = ["attempt", "count", "total", "progress", "httpStatus", "statusCode", "durationMs", "bytes", "retryAfterMs"];
+var BOOLEAN_FIELDS = ["retriable", "retrying", "cancelled", "success"];
+function buildWhere(query, after) {
+  const where = [sql3`sequence > ${after}`];
+  if (query.level !== void 0) where.push(sql3`level = ${query.level}`);
+  if (query.module !== void 0) where.push(sql3`module = ${query.module}`);
+  if (query.runId !== void 0) where.push(sql3`run_id = ${query.runId}`);
+  if (query.projectId !== void 0) where.push(sql3`project_id = ${query.projectId}`);
+  if (query.actor !== void 0) where.push(sql3`actor = ${query.actor}`);
+  if (query.requestId !== void 0) where.push(sql3`request_id = ${query.requestId}`);
+  if (query.since !== void 0) where.push(sql3`ts >= ${query.since}`);
+  if (query.until !== void 0) where.push(sql3`ts <= ${query.until}`);
+  return where;
+}
+function readMetadata(db) {
+  const rows = db.all(sql3`
+    SELECT cursor_namespace AS cursorNamespace, next_sequence AS nextSequence, dropped, capture_errors AS captureErrors
+      FROM runtime_log_metadata WHERE id = ${METADATA_ID}
+  `);
+  const metadata2 = rows[0];
+  if (metadata2 === void 0 || !Number.isSafeInteger(metadata2.nextSequence) || metadata2.nextSequence < 1) {
+    throw new Error("Operational log metadata is missing or corrupt.");
+  }
+  return metadata2;
+}
+function parseContext(value) {
+  const parsed = typeof value === "string" ? parseJsonColumn(value, void 0) : value;
+  const redacted = redactLogValue(parsed);
+  if (!isRecord(redacted)) throw new Error("Operational log context is corrupt.");
+  return redacted;
+}
+function filterHash(query) {
+  const stable = JSON.stringify({
+    level: query.level ?? null,
+    module: query.module ?? null,
+    runId: query.runId ?? null,
+    projectId: query.projectId ?? null,
+    actor: query.actor ?? null,
+    requestId: query.requestId ?? null,
+    since: query.since ?? null,
+    until: query.until ?? null
+  });
+  return createHash("sha256").update(stable).digest("base64url");
+}
+function normalizeLogQuery(query) {
+  return {
+    ...query,
+    ...query.since === void 0 ? {} : { since: new Date(query.since).toISOString() },
+    ...query.until === void 0 ? {} : { until: new Date(query.until).toISOString() }
+  };
+}
+function isCursorPayload(value) {
+  return isRecord(value) && typeof value.namespace === "string" && Number.isSafeInteger(value.sequence) && typeof value.filters === "string";
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requiredString(value, max2, label) {
+  const string = optionalString(value, max2);
+  if (string === void 0) throw new TypeError(`Operational log ${label} must be a non-empty string.`);
+  return string;
+}
+function optionalString(value, max2) {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  return clip(redactLogString(value), max2);
+}
+function clip(value, max2) {
+  return value.length <= max2 ? value : value.slice(0, max2);
+}
+function boundedInteger(value, min2, max2, label) {
+  if (!Number.isInteger(value) || value < min2 || value > max2) {
+    throw new RangeError(`${label} must be an integer from ${min2} to ${max2}.`);
+  }
+  return value;
+}
+
 // ../db/src/run-helpers.ts
 function groupRunsByCreatedAt(rows) {
   const groups = [];
@@ -7664,12 +8036,12 @@ function analyzeCause(regression, currentSnapshots) {
 }
 
 // ../intelligence/src/insights.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 var QUERY_LEVEL_PROVIDER = "all";
 function generateInsights(input) {
   const insights2 = [];
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = () => `ins_${randomUUID().slice(0, 8)}`;
+  const id = () => `ins_${randomUUID2().slice(0, 8)}`;
   for (const reg of input.regressions) {
     const cause = input.causes.get(`${reg.query}:${reg.provider}`);
     insights2.push({
@@ -11148,6 +11520,70 @@ async function authPlugin(app, opts = {}) {
   });
 }
 
+// ../api-routes/src/request-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestContext = new AsyncLocalStorage();
+var MAX_REQUEST_CONTEXT_LENGTH = 512;
+function getRequestContext(boundRequestId) {
+  const context = requestContext.getStore();
+  if (!context || context.completed && context.requestId !== boundRequestId) return void 0;
+  const { completed: _completed, ...safeContext } = context;
+  return safeContext;
+}
+function requestAuditIdentity(request) {
+  const principal = request.principal;
+  if (!principal) return {};
+  if (principal.delegatedUser) {
+    return {
+      actor: `user:${principal.delegatedUser.id}`,
+      credentialId: request.apiKey?.id ?? principal.id
+    };
+  }
+  if (principal.kind === "user") return { actor: `user:${principal.id}` };
+  return {
+    actor: `api-key:${principal.id}`,
+    credentialId: request.apiKey?.id ?? principal.id
+  };
+}
+function registerRequestContext(app) {
+  app.addHook("onRequest", (request, reply, done) => {
+    reply.header("x-request-id", request.id);
+    requestContext.run({
+      requestId: sanitizeRequestContext(request.id) ?? void 0,
+      userAgent: sanitizeRequestContext(request.headers["user-agent"]) ?? void 0,
+      actorSession: sanitizeRequestContext(request.headers["x-canonry-actor-session"]) ?? void 0,
+      method: request.method,
+      // Route template only, never a raw URL, query string, or route parameter.
+      route: request.routeOptions.url
+    }, done);
+  });
+  app.addHook("preHandler", (request, _reply, done) => {
+    populateIdentity(request);
+    done();
+  });
+  app.addHook("onError", (request, _reply, _error, done) => {
+    populateIdentity(request);
+    done();
+  });
+  app.addHook("onResponse", (request, reply, done) => {
+    populateIdentity(request);
+    const context = requestContext.getStore();
+    if (context) context.statusCode = reply.statusCode;
+    done();
+    if (context) context.completed = true;
+  });
+}
+function populateIdentity(request) {
+  const context = requestContext.getStore();
+  if (context) Object.assign(context, requestAuditIdentity(request));
+}
+function sanitizeRequestContext(value) {
+  const joined = Array.isArray(value) ? value.join(", ") : value;
+  if (!joined) return null;
+  const sanitized = redactLogString(joined).replace(/[\r\n]+/g, " ").trim().slice(0, MAX_REQUEST_CONTEXT_LENGTH);
+  return sanitized || null;
+}
+
 // ../api-routes/src/oauth.ts
 import crypto5 from "crypto";
 import { and, eq as eq3, isNull, lt } from "drizzle-orm";
@@ -11609,11 +12045,11 @@ function registerOAuthAdminRoutes(app, opts) {
 
 // ../api-routes/src/projects.ts
 import crypto7 from "crypto";
-import { and as and2, eq as eq5, sql as sql4 } from "drizzle-orm";
+import { and as and2, eq as eq5, sql as sql5 } from "drizzle-orm";
 
 // ../api-routes/src/helpers.ts
 import crypto6 from "crypto";
-import { eq as eq4, ne, sql as sql3 } from "drizzle-orm";
+import { eq as eq4, ne, sql as sql4 } from "drizzle-orm";
 function notProbeRun() {
   return ne(runs.trigger, RunTriggers.probe);
 }
@@ -11625,29 +12061,37 @@ function resolveProject(db, name) {
   return project;
 }
 function writeAuditLog(db, entry) {
+  const context = getRequestContext();
+  const actor = entry.actor === "api" ? context?.actor ?? entry.actor : entry.actor;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   db.insert(auditLog).values({
     id: crypto6.randomUUID(),
     projectId: entry.projectId ?? null,
-    actor: entry.actor,
+    actor,
     action: entry.action,
     entityType: entry.entityType,
     entityId: entry.entityId ?? null,
     diff: entry.diff != null ? JSON.stringify(entry.diff) : null,
-    userAgent: entry.userAgent ?? null,
-    actorSession: entry.actorSession ?? null,
+    userAgent: sanitizeRequestContext(entry.userAgent ?? context?.userAgent),
+    actorSession: sanitizeRequestContext(entry.actorSession ?? context?.actorSession),
+    requestId: entry.requestId ?? context?.requestId ?? null,
+    credentialId: entry.credentialId ?? context?.credentialId ?? null,
     createdAt: now
   }).run();
 }
 function auditFromRequest(request, entry) {
-  const ua = request.headers["user-agent"];
-  const userAgent = Array.isArray(ua) ? ua.join(", ") : ua ?? null;
-  const sess = request.headers["x-canonry-actor-session"];
-  const actorSession = Array.isArray(sess) ? sess.join(", ") : sess ?? null;
+  const userAgent = sanitizeRequestContext(request.headers["user-agent"]);
+  const actorSession = sanitizeRequestContext(request.headers["x-canonry-actor-session"]);
+  const identity = requestAuditIdentity(request);
+  const context = getRequestContext();
+  const actor = entry.actor === "api" ? identity.actor ?? entry.actor : entry.actor;
   return {
     ...entry,
-    userAgent: entry.userAgent ?? userAgent,
-    actorSession: entry.actorSession ?? actorSession
+    actor,
+    credentialId: entry.credentialId ?? identity.credentialId ?? context?.credentialId ?? null,
+    userAgent: sanitizeRequestContext(entry.userAgent ?? userAgent),
+    actorSession: sanitizeRequestContext(entry.actorSession ?? actorSession),
+    requestId: entry.requestId ?? context?.requestId ?? null
   };
 }
 function resolveSnapshotMentionResult(snapshot, project) {
@@ -11727,18 +12171,32 @@ async function settingsRoutes(app, opts) {
         validProviders: validNames
       });
     }
-    if (name === "local") {
-      if (!baseUrl || typeof baseUrl !== "string") {
+    if (apiKey !== void 0 && (typeof apiKey !== "string" || !apiKey.trim())) {
+      throw validationError("apiKey must be a non-empty string when provided");
+    }
+    if (baseUrl !== void 0 && (typeof baseUrl !== "string" || !baseUrl.trim())) {
+      throw validationError("baseUrl must be a non-empty string when provided");
+    }
+    if (model !== void 0 && (typeof model !== "string" || !model.trim())) {
+      throw validationError("model must be a non-empty string when provided");
+    }
+    if (apiKey === void 0 && baseUrl === void 0 && model === void 0 && quota === void 0) {
+      throw validationError("at least one provider setting must be supplied");
+    }
+    const existing = (opts.providerSummary ?? []).find((provider) => provider.name === name);
+    const configured = Boolean(existing?.configured);
+    if (!configured && name === "local") {
+      if (!baseUrl) {
         throw validationError("baseUrl is required for local provider");
       }
-    } else if (name === "gemini" && !apiKey) {
+    } else if (!configured && name === "gemini" && !apiKey) {
       const geminiSummary = (opts.providerSummary ?? []).find((p) => p.name === "gemini");
       if (!geminiSummary?.vertexConfigured) {
         throw validationError(
           "apiKey is required for Gemini unless Vertex AI is configured (set GEMINI_VERTEX_PROJECT env var or vertexProject in config file)"
         );
       }
-    } else {
+    } else if (!configured) {
       if (!apiKey || typeof apiKey !== "string") {
         throw validationError("apiKey is required");
       }
@@ -11757,6 +12215,9 @@ async function settingsRoutes(app, opts) {
       if (typeof quota !== "object" || quota === null) {
         throw validationError("quota must be an object");
       }
+      if (Object.keys(quota).length === 0) {
+        throw validationError("quota must include at least one field");
+      }
       for (const [key, val] of Object.entries(quota)) {
         if (!["maxConcurrency", "maxRequestsPerMinute", "maxRequestsPerDay"].includes(key)) {
           throw validationError(`Unknown quota field: ${key}`);
@@ -11766,7 +12227,12 @@ async function settingsRoutes(app, opts) {
         }
       }
     }
-    const result = opts.onProviderUpdate(name, apiKey ?? "", model, baseUrl, quota);
+    const { actor, userAgent, actorSession, requestId, credentialId } = auditFromRequest(request, {
+      actor: "api",
+      action: "provider.updated",
+      entityType: "provider"
+    });
+    const result = opts.onProviderUpdate(name, apiKey ?? "", model, baseUrl, quota, { actor, userAgent, actorSession, requestId, credentialId });
     if (!result) {
       throw internalError("Failed to update provider configuration");
     }
@@ -12092,12 +12558,12 @@ async function projectRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const pid = project.id;
     const count4 = (n) => n ?? 0;
-    const queryCount = app.db.select({ n: sql4`count(*)` }).from(queries).where(eq5(queries.projectId, pid)).get();
-    const competitorCount = app.db.select({ n: sql4`count(*)` }).from(competitors).where(eq5(competitors.projectId, pid)).get();
-    const runCount = app.db.select({ n: sql4`count(*)` }).from(runs).where(eq5(runs.projectId, pid)).get();
-    const snapshotCount = app.db.select({ n: sql4`count(*)` }).from(querySnapshots).innerJoin(runs, eq5(querySnapshots.runId, runs.id)).where(eq5(runs.projectId, pid)).get();
-    const insightCount = app.db.select({ n: sql4`count(*)` }).from(insights).where(eq5(insights.projectId, pid)).get();
-    const auditLogCount = app.db.select({ n: sql4`count(*)` }).from(auditLog).where(eq5(auditLog.projectId, pid)).get();
+    const queryCount = app.db.select({ n: sql5`count(*)` }).from(queries).where(eq5(queries.projectId, pid)).get();
+    const competitorCount = app.db.select({ n: sql5`count(*)` }).from(competitors).where(eq5(competitors.projectId, pid)).get();
+    const runCount = app.db.select({ n: sql5`count(*)` }).from(runs).where(eq5(runs.projectId, pid)).get();
+    const snapshotCount = app.db.select({ n: sql5`count(*)` }).from(querySnapshots).innerJoin(runs, eq5(querySnapshots.runId, runs.id)).where(eq5(runs.projectId, pid)).get();
+    const insightCount = app.db.select({ n: sql5`count(*)` }).from(insights).where(eq5(insights.projectId, pid)).get();
+    const auditLogCount = app.db.select({ n: sql5`count(*)` }).from(auditLog).where(eq5(auditLog.projectId, pid)).get();
     return reply.send({
       project: { id: project.id, name: project.name },
       cascadeRows: {
@@ -12312,7 +12778,7 @@ function aliasArraysEqual(a, b) {
 
 // ../api-routes/src/queries.ts
 import crypto10 from "crypto";
-import { and as and5, eq as eq8, inArray as inArray2, sql as sql5 } from "drizzle-orm";
+import { and as and5, eq as eq8, inArray as inArray2, sql as sql6 } from "drizzle-orm";
 
 // ../api-routes/src/query-replace.ts
 import crypto9 from "crypto";
@@ -12675,9 +13141,9 @@ async function queryRoutes(app, opts) {
     let snapshotsDetached = 0;
     let affectedQueries = 0;
     if (removedIds.length > 0) {
-      const snapshotCount = app.db.select({ n: sql5`count(*)` }).from(querySnapshots).where(inArray2(querySnapshots.queryId, removedIds)).get();
+      const snapshotCount = app.db.select({ n: sql6`count(*)` }).from(querySnapshots).where(inArray2(querySnapshots.queryId, removedIds)).get();
       snapshotsDetached = snapshotCount?.n ?? 0;
-      const distinctAffected = app.db.select({ n: sql5`count(distinct ${querySnapshots.queryId})` }).from(querySnapshots).where(inArray2(querySnapshots.queryId, removedIds)).get();
+      const distinctAffected = app.db.select({ n: sql6`count(distinct ${querySnapshots.queryId})` }).from(querySnapshots).where(inArray2(querySnapshots.queryId, removedIds)).get();
       affectedQueries = distinctAffected?.n ?? 0;
     }
     return reply.send({
@@ -13199,7 +13665,7 @@ function shareOfVoiceFromLandscape(landscape, queryClass) {
 }
 
 // ../api-routes/src/measurement-overview.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { and as and8, eq as eq13 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-report.ts
@@ -14586,7 +15052,7 @@ function overviewFilterFingerprint(query) {
     to: query.to ?? null,
     search: query.search === void 0 ? null : normalizedText(query.search)
   };
-  return createHash("sha256").update(JSON.stringify(filters)).digest("base64url");
+  return createHash2("sha256").update(JSON.stringify(filters)).digest("base64url");
 }
 function overviewAggregateFingerprint(query) {
   const filters = {
@@ -14599,11 +15065,11 @@ function overviewAggregateFingerprint(query) {
     from: query.from ?? null,
     to: query.to ?? null
   };
-  return createHash("sha256").update(JSON.stringify(filters)).digest("base64url");
+  return createHash2("sha256").update(JSON.stringify(filters)).digest("base64url");
 }
 function overviewEvidenceFingerprint(snapshots) {
   const canonical = [...snapshots].sort((left, right) => left.id.localeCompare(right.id)).map((snapshot) => JSON.stringify(snapshot)).join("\n");
-  return createHash("sha256").update(canonical).digest("base64url");
+  return createHash2("sha256").update(canonical).digest("base64url");
 }
 function compareLabels(left, right) {
   const leftLabel = normalizedText(left.label);
@@ -15455,7 +15921,7 @@ function mergePins(...collections) {
 
 // ../api-routes/src/runs.ts
 import crypto14 from "crypto";
-import { and as and12, eq as eq17, asc, desc as desc3, inArray as inArray5, or as or2, sql as sql6 } from "drizzle-orm";
+import { and as and12, eq as eq17, asc, desc as desc3, inArray as inArray5, or as or2, sql as sql7 } from "drizzle-orm";
 import { gte as gte3 } from "drizzle-orm";
 
 // ../api-routes/src/run-queue.ts
@@ -16031,7 +16497,7 @@ async function runRoutes(app, opts) {
   });
   app.get("/projects/:name/runs/latest", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const countRow = app.db.select({ count: sql6`count(*)` }).from(runs).where(and12(eq17(runs.projectId, project.id), notProbeRun())).get();
+    const countRow = app.db.select({ count: sql7`count(*)` }).from(runs).where(and12(eq17(runs.projectId, project.id), notProbeRun())).get();
     const totalRuns = countRow?.count ?? 0;
     const latestRun = app.db.select().from(runs).where(and12(eq17(runs.projectId, project.id), notProbeRun())).orderBy(desc3(runs.createdAt), desc3(runs.id)).limit(1).get();
     if (!latestRun) {
@@ -20962,7 +21428,7 @@ async function measurementDiscoveryV2Routes(app) {
 }
 
 // ../api-routes/src/measurement-property-evidence.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { and as and16, eq as eq21 } from "drizzle-orm";
 function parseEvidenceQuery(raw) {
   const candidate = { ...raw, ...raw.limit === void 0 ? {} : { limit: Number(raw.limit) } };
@@ -20982,11 +21448,11 @@ function filterFingerprint(query) {
     provider: query.provider === void 0 ? null : normalizedText2(query.provider),
     location: query.location === void 0 ? null : normalizedText2(query.location)
   };
-  return createHash2("sha256").update(JSON.stringify(filters)).digest("base64url");
+  return createHash3("sha256").update(JSON.stringify(filters)).digest("base64url");
 }
 function evidenceFingerprintOf(snapshots) {
   const canonical = [...snapshots].sort((left, right) => left.id.localeCompare(right.id)).map((snapshot) => JSON.stringify(snapshot)).join("\n");
-  return createHash2("sha256").update(canonical).digest("base64url");
+  return createHash3("sha256").update(canonical).digest("base64url");
 }
 function sourceRowKey(row) {
   return [row.expectedSlotId, row.usageEdgeId, row.sourceUrl].join("\0");
@@ -21153,7 +21619,7 @@ async function measurementPropertyEvidenceRoutes(app) {
 import { and as and18, desc as desc6, eq as eq23, inArray as inArray8, lt as lt3, or as or3 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-question-reads.ts
-import { and as and17, eq as eq22, getTableColumns, inArray as inArray7, sql as sql7 } from "drizzle-orm";
+import { and as and17, eq as eq22, getTableColumns, inArray as inArray7, sql as sql8 } from "drizzle-orm";
 var DEFAULT_LIMIT2 = 50;
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   RunStatuses.completed,
@@ -21272,7 +21738,7 @@ function selectedQuestionSnapshots(db, runId, manifest, scope) {
     conditions.push(inArray7(querySnapshots.measurementExecutionId, executionIds));
   }
   if (scope?.provider !== void 0) {
-    conditions.push(sql7`lower(trim(${querySnapshots.provider})) = ${normalizeText(scope.provider)}`);
+    conditions.push(sql8`lower(trim(${querySnapshots.provider})) = ${normalizeText(scope.provider)}`);
   }
   return db.select(measurementQuestionSnapshotColumns).from(querySnapshots).where(and17(...conditions)).all();
 }
@@ -22227,11 +22693,11 @@ async function measurementPortfolioReadRoutes(app) {
 }
 
 // ../api-routes/src/visibility-report.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { and as and19, desc as desc7, eq as eq24, gte as gte4, inArray as inArray9, isNotNull, isNull as isNull4, lte as lte4, ne as ne3 } from "drizzle-orm";
 
 // ../api-routes/src/visibility-report-reader.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var VisibilityReportCursorError = class extends Error {
   constructor(message) {
     super(message);
@@ -22606,7 +23072,7 @@ function breakdown(candidates, definition, populationTargetKeys = selectedTarget
   return { properties, groups };
 }
 function fingerprint(value) {
-  return createHash3("sha256").update(JSON.stringify(value)).digest("base64url");
+  return createHash4("sha256").update(JSON.stringify(value)).digest("base64url");
 }
 function cursorOf2(cursor) {
   return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
@@ -23099,11 +23565,11 @@ function stableSimpleDefinitionId(definition) {
     // not freeze a competitor set, whereas a newly captured empty list did.
     competitors: definition.competitors === void 0 ? null : [...definition.competitors].map((competitor) => ({ domain: competitor.domain, label: competitor.label, aliases: [...competitor.aliases].sort() })).sort((left, right) => left.domain.localeCompare(right.domain, "en"))
   };
-  return `simple:${createHash4("sha256").update(JSON.stringify(source)).digest("hex")}`;
+  return `simple:${createHash5("sha256").update(JSON.stringify(source)).digest("hex")}`;
 }
 function simpleModelFingerprint(definition) {
   const engines = [...definition.engines].map((engine) => ({ provider: normalizedText3(engine.provider), requestedModel: engine.requestedModel })).sort((left, right) => left.provider.localeCompare(right.provider, "en"));
-  return `simple-model:${createHash4("sha256").update(JSON.stringify(engines)).digest("hex")}`;
+  return `simple-model:${createHash5("sha256").update(JSON.stringify(engines)).digest("hex")}`;
 }
 function frozenSimpleRun(run, definition, snapshots, includeEvidence = true) {
   const matcher = compileBrandAliases(effectiveBrandNames({
@@ -25626,7 +26092,7 @@ function normalizeCompetitorList2(domains) {
 }
 
 // ../api-routes/src/history.ts
-import { and as and22, asc as asc3, count, desc as desc9, eq as eq27, gte as gte5, inArray as inArray11 } from "drizzle-orm";
+import { and as and22, asc as asc3, count, desc as desc9, eq as eq27, gte as gte5, inArray as inArray11, like, or as or4 } from "drizzle-orm";
 
 // ../api-routes/src/notification-redaction.ts
 var REDACTED_URL = {
@@ -25697,7 +26163,7 @@ async function historyRoutes(app) {
       if (input.confirm) {
         tx.delete(researchRuns).where(and22(eq27(researchRuns.projectId, project.id), inArray11(researchRuns.id, input.researchRunIds))).run();
         tx.delete(runs).where(and22(eq27(runs.projectId, project.id), inArray11(runs.id, input.runIds))).run();
-        writeAuditLog(tx, { projectId: project.id, actor: request.principal ? `${request.principal.kind}:${request.principal.id}` : "api", action: "results.cleared", entityType: "project", entityId: project.id, diff: result, userAgent: request.headers["user-agent"] });
+        writeAuditLog(tx, { projectId: project.id, actor: "api", action: "results.cleared", entityType: "project", entityId: project.id, diff: result });
       }
       return result;
     });
@@ -25706,14 +26172,14 @@ async function historyRoutes(app) {
     const project = resolveProject(app.db, request.params.name);
     const filters = [eq27(auditLog.projectId, project.id)];
     addAuditHistoryFilters(filters, request.query);
-    const rows = app.db.select().from(auditLog).where(and22(...filters)).orderBy(desc9(auditLog.createdAt)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
+    const rows = app.db.select().from(auditLog).where(and22(...filters)).orderBy(desc9(auditLog.createdAt), desc9(auditLog.id)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
   });
   app.get("/history", async (request, reply) => {
     const scopedProjectId = request.apiKey?.projectId;
     const filters = scopedProjectId ? [eq27(auditLog.projectId, scopedProjectId)] : [];
     addAuditHistoryFilters(filters, request.query);
-    const rows = app.db.select().from(auditLog).where(filters.length > 0 ? and22(...filters) : void 0).orderBy(desc9(auditLog.createdAt)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
+    const rows = app.db.select().from(auditLog).where(filters.length > 0 ? and22(...filters) : void 0).orderBy(desc9(auditLog.createdAt), desc9(auditLog.id)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
   });
   app.get("/projects/:name/snapshots", async (request, reply) => {
@@ -26004,13 +26470,20 @@ function formatAuditEntry(row) {
     diff: row.diff ? row.entityType === "notification" ? redactNotificationDiff(parseJsonColumn(row.diff, null)) : parseJsonColumn(row.diff, null) : null,
     userAgent: row.userAgent,
     actorSession: row.actorSession,
+    requestId: row.requestId,
+    credentialId: row.credentialId,
     createdAt: row.createdAt
   };
 }
 function addAuditHistoryFilters(filters, query) {
   if (query.since && !Number.isNaN(Date.parse(query.since))) filters.push(gte5(auditLog.createdAt, query.since));
   if (query.action) filters.push(eq27(auditLog.action, query.action));
-  if (query.actor) filters.push(eq27(auditLog.actor, query.actor));
+  if (query.actor === "api") filters.push(or4(
+    eq27(auditLog.actor, "api"),
+    like(auditLog.actor, "api-key:%"),
+    like(auditLog.actor, "user:%")
+  ));
+  else if (query.actor) filters.push(eq27(auditLog.actor, query.actor));
   if (query.entityType) filters.push(eq27(auditLog.entityType, query.entityType));
 }
 function parseBoundedInt(value, fallback, max2) {
@@ -26819,7 +27292,7 @@ function buildCategoryCounts(counts2) {
 }
 
 // ../api-routes/src/intelligence.ts
-import { eq as eq29, desc as desc11, and as and24, inArray as inArray13, like } from "drizzle-orm";
+import { eq as eq29, desc as desc11, and as and24, inArray as inArray13, like as like2 } from "drizzle-orm";
 var SEVERITY_RANK = { low: 0, medium: 1, high: 2, critical: 3 };
 function severitiesAtOrAbove(min2) {
   const floor = SEVERITY_RANK[min2];
@@ -26944,7 +27417,7 @@ async function intelligenceRoutes(app) {
     const typeFilter = request.query.type?.trim();
     if (typeFilter) {
       conditions.push(
-        typeFilter.endsWith("*") ? like(insights.type, `${typeFilter.slice(0, -1)}%`) : eq29(insights.type, typeFilter)
+        typeFilter.endsWith("*") ? like2(insights.type, `${typeFilter.slice(0, -1)}%`) : eq29(insights.type, typeFilter)
       );
     }
     const severityFilter = request.query.severity?.trim();
@@ -27019,16 +27492,16 @@ async function intelligenceRoutes(app) {
 }
 
 // ../api-routes/src/ai-referral-status.ts
-import { and as and25, sql as sql8 } from "drizzle-orm";
-var REDIRECT_LIST = sql8.join([...LOCATION_REDIRECT_STATUSES].map((s) => sql8`${s}`), sql8`, `);
+import { and as and25, sql as sql9 } from "drizzle-orm";
+var REDIRECT_LIST = sql9.join([...LOCATION_REDIRECT_STATUSES].map((s) => sql9`${s}`), sql9`, `);
 function referralLandedCondition() {
-  return sql8`${aiReferralEventsHourly.status} NOT IN (${REDIRECT_LIST})`;
+  return sql9`${aiReferralEventsHourly.status} NOT IN (${REDIRECT_LIST})`;
 }
 function countableReferralCondition() {
   return and25(nonSubresourceReferralPathCondition(), referralLandedCondition());
 }
 function nonSubresourceReferralPathCondition() {
-  return sql8`
+  return sql9`
     LOWER(${aiReferralEventsHourly.landingPathNormalized}) NOT LIKE '/_next/static/%'
     AND LOWER(${aiReferralEventsHourly.landingPathNormalized}) NOT LIKE '/assets/%'
     AND LOWER(${aiReferralEventsHourly.landingPathNormalized}) NOT LIKE '/static/%'
@@ -27052,7 +27525,7 @@ function nonSubresourceReferralPathCondition() {
 }
 
 // ../api-routes/src/report.ts
-import { and as and29, desc as desc14, eq as eq33, gte as gte8, inArray as inArray15, lt as lt5, lte as lte6, ne as ne5, or as or4, sql as sql10 } from "drizzle-orm";
+import { and as and29, desc as desc14, eq as eq33, gte as gte8, inArray as inArray15, lt as lt5, lte as lte6, ne as ne5, or as or5, sql as sql11 } from "drizzle-orm";
 
 // ../api-routes/src/content.ts
 import crypto23 from "crypto";
@@ -27062,7 +27535,7 @@ import { and as and28, desc as desc13, eq as eq32 } from "drizzle-orm";
 import { and as and27, eq as eq31, desc as desc12, gte as gte7, inArray as inArray14, lte as lte5 } from "drizzle-orm";
 
 // ../api-routes/src/gsc-totals.ts
-import { and as and26, asc as asc4, eq as eq30, sql as sql9, max, min } from "drizzle-orm";
+import { and as and26, asc as asc4, eq as eq30, sql as sql10, max, min } from "drizzle-orm";
 var WINDOW_DAYS = { "7d": 7, "30d": 30, "90d": 90 };
 function resolveGscWindowRange(window, latestDataDate, today) {
   if (window === "all") {
@@ -27117,8 +27590,8 @@ function readGscDailyTotals(db, projectId, startDate, endDate) {
   }).from(gscDailyTotals).where(
     and26(
       eq30(gscDailyTotals.projectId, projectId),
-      sql9`${gscDailyTotals.date} >= ${startDate}`,
-      sql9`${gscDailyTotals.date} <= ${endDate}`
+      sql10`${gscDailyTotals.date} >= ${startDate}`,
+      sql10`${gscDailyTotals.date} <= ${endDate}`
     )
   ).orderBy(asc4(gscDailyTotals.date)).all();
   return rows.map((r) => {
@@ -27147,8 +27620,8 @@ function readGscQueryDailyRows(db, projectId, startDate, endDate) {
   }).from(gscQueryDailyTotals).where(
     and26(
       eq30(gscQueryDailyTotals.projectId, projectId),
-      sql9`${gscQueryDailyTotals.date} >= ${startDate}`,
-      sql9`${gscQueryDailyTotals.date} <= ${endDate}`
+      sql10`${gscQueryDailyTotals.date} >= ${startDate}`,
+      sql10`${gscQueryDailyTotals.date} <= ${endDate}`
     )
   ).all();
   return rows.map((r) => {
@@ -30509,8 +30982,8 @@ function loadQueryLookup(db, projectId) {
   return { byId };
 }
 function buildGscSection(db, projectId, projectBrandNames, canonicalDomain, trackedQueries, windowDays2) {
-  const maxSearch = db.select({ m: sql10`MAX(${gscSearchData.date})` }).from(gscSearchData).where(eq33(gscSearchData.projectId, projectId)).get()?.m ?? "";
-  const maxDaily = db.select({ m: sql10`MAX(${gscDailyTotals.date})` }).from(gscDailyTotals).where(eq33(gscDailyTotals.projectId, projectId)).get()?.m ?? "";
+  const maxSearch = db.select({ m: sql11`MAX(${gscSearchData.date})` }).from(gscSearchData).where(eq33(gscSearchData.projectId, projectId)).get()?.m ?? "";
+  const maxDaily = db.select({ m: sql11`MAX(${gscDailyTotals.date})` }).from(gscDailyTotals).where(eq33(gscDailyTotals.projectId, projectId)).get()?.m ?? "";
   const maxDate = maxSearch > maxDaily ? maxSearch : maxDaily;
   if (!maxDate) return null;
   const startDate = windowStartDate(maxDate, windowDays2);
@@ -30621,7 +31094,7 @@ function buildGaSection(db, projectId, windowDays2) {
   ).limit(1).get() : void 0;
   const fallbackSummary = windowSummary ? null : db.select().from(gaTrafficSummaries).where(eq33(gaTrafficSummaries.projectId, projectId)).orderBy(desc14(gaTrafficSummaries.syncedAt)).limit(1).get();
   const matchingFallbackSummary = fallbackSummary && inclusiveDayCount(fallbackSummary.periodStart, fallbackSummary.periodEnd) === windowDays2 ? fallbackSummary : null;
-  const snapshotMaxDate = db.select({ m: sql10`MAX(${gaTrafficSnapshots.date})` }).from(gaTrafficSnapshots).where(eq33(gaTrafficSnapshots.projectId, projectId)).get()?.m ?? "";
+  const snapshotMaxDate = db.select({ m: sql11`MAX(${gaTrafficSnapshots.date})` }).from(gaTrafficSnapshots).where(eq33(gaTrafficSnapshots.projectId, projectId)).get()?.m ?? "";
   if (!windowSummary && !matchingFallbackSummary && !snapshotMaxDate) return null;
   const summaryPeriod = windowSummary ?? matchingFallbackSummary;
   const snapshotMaxInWindow = summaryPeriod?.periodEnd || snapshotMaxDate;
@@ -30663,7 +31136,7 @@ function buildGaSection(db, projectId, windowDays2) {
   const aiSessionRows = db.select({
     trafficClass: gaAiReferrals.trafficClass,
     channelGroup: gaAiReferrals.channelGroup,
-    sessions: sql10`COALESCE(SUM(${gaAiReferrals.sessions}), 0)`
+    sessions: sql11`COALESCE(SUM(${gaAiReferrals.sessions}), 0)`
   }).from(gaAiReferrals).where(and29(...aiConditions)).groupBy(gaAiReferrals.trafficClass, gaAiReferrals.channelGroup).all();
   let paidAiSessions = 0;
   let organicAiSessions = 0;
@@ -30762,8 +31235,8 @@ function buildAiReferrals(db, projectId, windowDays2) {
   const window = resolveAiReferralWindow(db, projectId, windowDays2);
   const rows = db.select().from(gaAiReferrals).where(and29(
     eq33(gaAiReferrals.projectId, projectId),
-    sql10`${gaAiReferrals.date} >= ${window.start}`,
-    sql10`${gaAiReferrals.date} <= ${window.end}`
+    sql11`${gaAiReferrals.date} >= ${window.start}`,
+    sql11`${gaAiReferrals.date} <= ${window.end}`
   )).all();
   if (rows.length === 0) return null;
   const dimSessionsByTuple = /* @__PURE__ */ new Map();
@@ -30848,7 +31321,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   const priorStart = new Date(priorStartMs).toISOString();
   const trendStart = new Date(trendStartMs).toISOString();
   const sumVerifiedCrawlers = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
-    db.select({ total: sql10`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+    db.select({ total: sql11`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
       and29(
         eq33(crawlerEventsHourly.projectId, projectId),
         eq33(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
@@ -30858,7 +31331,7 @@ function buildServerActivity(db, projectId, windowDays2) {
     ).get()?.total ?? 0
   );
   const sumUnverifiedCrawlers = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
-    db.select({ total: sql10`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+    db.select({ total: sql11`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
       and29(
         eq33(crawlerEventsHourly.projectId, projectId),
         ne5(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
@@ -30869,9 +31342,9 @@ function buildServerActivity(db, projectId, windowDays2) {
   );
   const sumReferrals = (windowStartIso, windowEndIso, exclusiveEnd = false) => {
     const row = db.select({
-      total: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-      paid: sql10`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
-      organic: sql10`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`
+      total: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+      paid: sql11`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
+      organic: sql11`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`
     }).from(aiReferralEventsHourly).where(
       and29(
         eq33(aiReferralEventsHourly.projectId, projectId),
@@ -30883,7 +31356,7 @@ function buildServerActivity(db, projectId, windowDays2) {
     return aiReferralClassCounts(Number(row?.total ?? 0), Number(row?.paid ?? 0), Number(row?.organic ?? 0));
   };
   const sumUserFetches = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
-    db.select({ total: sql10`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+    db.select({ total: sql11`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
       and29(
         eq33(aiUserFetchEventsHourly.projectId, projectId),
         gte8(aiUserFetchEventsHourly.tsHour, windowStartIso),
@@ -30899,7 +31372,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   const userFetchPrior = sumUserFetches(priorStart, headlineStart, true);
   const referralCurrent = sumReferrals(headlineStart, headlineEnd);
   const referralAllCurrent = Number(
-    db.select({ total: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+    db.select({ total: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
       and29(
         eq33(aiReferralEventsHourly.projectId, projectId),
         nonSubresourceReferralPathCondition(),
@@ -30913,7 +31386,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   const crawlerByOperatorRows = db.select({
     operator: crawlerEventsHourly.operator,
     verificationStatus: crawlerEventsHourly.verificationStatus,
-    hits: sql10`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+    hits: sql11`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
   }).from(crawlerEventsHourly).where(
     and29(
       eq33(crawlerEventsHourly.projectId, projectId),
@@ -30923,7 +31396,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   ).groupBy(crawlerEventsHourly.operator, crawlerEventsHourly.verificationStatus).all();
   const crawlerByOperatorPriorRows = db.select({
     operator: crawlerEventsHourly.operator,
-    hits: sql10`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+    hits: sql11`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
   }).from(crawlerEventsHourly).where(
     and29(
       eq33(crawlerEventsHourly.projectId, projectId),
@@ -30933,7 +31406,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   ).groupBy(crawlerEventsHourly.operator).all();
   const referralByOperatorRows = db.select({
     operator: aiReferralEventsHourly.operator,
-    hits: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
+    hits: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
   }).from(aiReferralEventsHourly).where(
     and29(
       eq33(aiReferralEventsHourly.projectId, projectId),
@@ -30944,7 +31417,7 @@ function buildServerActivity(db, projectId, windowDays2) {
   ).groupBy(aiReferralEventsHourly.operator).all();
   const userFetchByOperatorRows = db.select({
     operator: aiUserFetchEventsHourly.operator,
-    hits: sql10`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
+    hits: sql11`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
   }).from(aiUserFetchEventsHourly).where(
     and29(
       eq33(aiUserFetchEventsHourly.projectId, projectId),
@@ -30987,16 +31460,16 @@ function buildServerActivity(db, projectId, windowDays2) {
   );
   const topPathsRows = db.select({
     path: crawlerEventsHourly.pathNormalized,
-    verifiedHits: sql10`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} = ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
-    unverifiedHits: sql10`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} <> ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
-    operators: sql10`COUNT(DISTINCT ${crawlerEventsHourly.operator})`
+    verifiedHits: sql11`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} = ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
+    unverifiedHits: sql11`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} <> ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
+    operators: sql11`COUNT(DISTINCT ${crawlerEventsHourly.operator})`
   }).from(crawlerEventsHourly).where(
     and29(
       eq33(crawlerEventsHourly.projectId, projectId),
       gte8(crawlerEventsHourly.tsHour, headlineStart),
       lte6(crawlerEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(crawlerEventsHourly.pathNormalized).orderBy(desc14(sql10`SUM(${crawlerEventsHourly.hits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
+  ).groupBy(crawlerEventsHourly.pathNormalized).orderBy(desc14(sql11`SUM(${crawlerEventsHourly.hits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
   const topCrawledPaths = topPathsRows.map((r) => ({
     path: r.path,
     verifiedHits: Number(r.verifiedHits),
@@ -31005,8 +31478,8 @@ function buildServerActivity(db, projectId, windowDays2) {
   }));
   const referralProductsRows = db.select({
     product: aiReferralEventsHourly.product,
-    arrivals: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-    landingPaths: sql10`COUNT(DISTINCT ${aiReferralEventsHourly.landingPathNormalized})`
+    arrivals: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+    landingPaths: sql11`COUNT(DISTINCT ${aiReferralEventsHourly.landingPathNormalized})`
   }).from(aiReferralEventsHourly).where(
     and29(
       eq33(aiReferralEventsHourly.projectId, projectId),
@@ -31014,7 +31487,7 @@ function buildServerActivity(db, projectId, windowDays2) {
       gte8(aiReferralEventsHourly.tsHour, headlineStart),
       lte6(aiReferralEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(aiReferralEventsHourly.product).orderBy(desc14(sql10`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).all();
+  ).groupBy(aiReferralEventsHourly.product).orderBy(desc14(sql11`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).all();
   const referralProducts = referralProductsRows.map((r) => ({
     product: r.product,
     arrivals: Number(r.arrivals),
@@ -31022,8 +31495,8 @@ function buildServerActivity(db, projectId, windowDays2) {
   }));
   const topReferralRows = db.select({
     path: aiReferralEventsHourly.landingPathNormalized,
-    arrivals: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-    products: sql10`COUNT(DISTINCT ${aiReferralEventsHourly.product})`
+    arrivals: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+    products: sql11`COUNT(DISTINCT ${aiReferralEventsHourly.product})`
   }).from(aiReferralEventsHourly).where(
     and29(
       eq33(aiReferralEventsHourly.projectId, projectId),
@@ -31031,26 +31504,26 @@ function buildServerActivity(db, projectId, windowDays2) {
       gte8(aiReferralEventsHourly.tsHour, headlineStart),
       lte6(aiReferralEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(aiReferralEventsHourly.landingPathNormalized).orderBy(desc14(sql10`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
+  ).groupBy(aiReferralEventsHourly.landingPathNormalized).orderBy(desc14(sql11`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
   const topReferralLandingPaths = topReferralRows.map((r) => ({
     path: r.path,
     arrivals: Number(r.arrivals),
     distinctProducts: Number(r.products)
   }));
   const crawlerTrendRows = db.select({
-    date: sql10`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`,
-    verifiedHits: sql10`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} = ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
-    unverifiedHits: sql10`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} <> ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`
+    date: sql11`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`,
+    verifiedHits: sql11`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} = ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`,
+    unverifiedHits: sql11`COALESCE(SUM(CASE WHEN ${crawlerEventsHourly.verificationStatus} <> ${VerificationStatuses.verified} THEN ${crawlerEventsHourly.hits} ELSE 0 END), 0)`
   }).from(crawlerEventsHourly).where(
     and29(
       eq33(crawlerEventsHourly.projectId, projectId),
       gte8(crawlerEventsHourly.tsHour, trendStart),
       lte6(crawlerEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(sql10`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`).all();
+  ).groupBy(sql11`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`).all();
   const referralTrendRows = db.select({
-    date: sql10`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`,
-    hits: sql10`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
+    date: sql11`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`,
+    hits: sql11`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
   }).from(aiReferralEventsHourly).where(
     and29(
       eq33(aiReferralEventsHourly.projectId, projectId),
@@ -31058,17 +31531,17 @@ function buildServerActivity(db, projectId, windowDays2) {
       gte8(aiReferralEventsHourly.tsHour, trendStart),
       lte6(aiReferralEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(sql10`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`).all();
+  ).groupBy(sql11`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`).all();
   const userFetchTrendRows = db.select({
-    date: sql10`SUBSTR(${aiUserFetchEventsHourly.tsHour}, 1, 10)`,
-    hits: sql10`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
+    date: sql11`SUBSTR(${aiUserFetchEventsHourly.tsHour}, 1, 10)`,
+    hits: sql11`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
   }).from(aiUserFetchEventsHourly).where(
     and29(
       eq33(aiUserFetchEventsHourly.projectId, projectId),
       gte8(aiUserFetchEventsHourly.tsHour, trendStart),
       lte6(aiUserFetchEventsHourly.tsHour, headlineEnd)
     )
-  ).groupBy(sql10`SUBSTR(${aiUserFetchEventsHourly.tsHour}, 1, 10)`).all();
+  ).groupBy(sql11`SUBSTR(${aiUserFetchEventsHourly.tsHour}, 1, 10)`).all();
   const emptyTrendEntry = () => ({ verifiedCrawlerHits: 0, unverifiedCrawlerHits: 0, userFetchHits: 0, referralArrivals: 0 });
   const dailyTrendMap = /* @__PURE__ */ new Map();
   for (const r of crawlerTrendRows) {
@@ -31219,7 +31692,7 @@ function buildInsightList(db, projectId, locationFilter) {
     and29(
       eq33(runs.projectId, projectId),
       eq33(runs.kind, RunKinds["answer-visibility"]),
-      or4(eq33(runs.status, RunStatuses.completed), eq33(runs.status, RunStatuses.partial)),
+      or5(eq33(runs.status, RunStatuses.completed), eq33(runs.status, RunStatuses.partial)),
       notProbeRun()
     )
   ).orderBy(desc14(runs.createdAt)).all().filter((r) => locationFilter === void 0 || (r.location ?? null) === locationFilter).slice(0, INSIGHT_LOOKBACK_RUNS).map((r) => r.id);
@@ -32101,10 +32574,10 @@ async function reportRoutes(app) {
 }
 
 // ../api-routes/src/organic-evidence.ts
-import { and as and31, desc as desc15, eq as eq35, gte as gte10, lte as lte8, or as or6, sql as sql12 } from "drizzle-orm";
+import { and as and31, desc as desc15, eq as eq35, gte as gte10, lte as lte8, or as or7, sql as sql13 } from "drizzle-orm";
 
 // ../api-routes/src/ga-measurement-analysis.ts
-import { and as and30, eq as eq34, gte as gte9, lte as lte7, or as or5, sql as sql11 } from "drizzle-orm";
+import { and as and30, eq as eq34, gte as gte9, lte as lte7, or as or6, sql as sql12 } from "drizzle-orm";
 var UNKNOWN_LANDING_PAGE = "(not set)";
 function addDays(date, offset) {
   const value = /* @__PURE__ */ new Date(`${date}T00:00:00.000Z`);
@@ -32276,24 +32749,24 @@ function buildGaMeasurementAnalysis(db, projectName, options = {}) {
   const scopedConditions = (hostColumn, normalizedPathColumn, rawPathColumn) => {
     const conditions = [];
     if (parsedHostScope.data === "marketing") {
-      const lowerHost = sql11`lower(${hostColumn})`;
-      const normalizedHost2 = sql11`case when ${lowerHost} like 'www.%' then substr(${lowerHost}, 5) else ${lowerHost} end`;
-      conditions.push(or5(...marketingHosts.flatMap((host) => [
-        sql11`${normalizedHost2} = ${host}`,
-        sql11`${normalizedHost2} like ${`%.${host}`}`
+      const lowerHost = sql12`lower(${hostColumn})`;
+      const normalizedHost2 = sql12`case when ${lowerHost} like 'www.%' then substr(${lowerHost}, 5) else ${lowerHost} end`;
+      conditions.push(or6(...marketingHosts.flatMap((host) => [
+        sql12`${normalizedHost2} = ${host}`,
+        sql12`${normalizedHost2} like ${`%.${host}`}`
       ])));
     }
     if (pathPrefix && pathPrefix !== "/") {
-      const rawPath = sql11`case when instr(${rawPathColumn}, '?') = 0 then ${rawPathColumn} else substr(${rawPathColumn}, 1, instr(${rawPathColumn}, '?') - 1) end`;
-      const landingPath = sql11`case when trim(coalesce(${normalizedPathColumn}, '')) = '' then ${rawPath} else ${normalizedPathColumn} end`;
-      conditions.push(or5(sql11`${landingPath} = ${pathPrefix}`, sql11`${landingPath} like ${`${pathPrefix}/%`}`));
+      const rawPath = sql12`case when instr(${rawPathColumn}, '?') = 0 then ${rawPathColumn} else substr(${rawPathColumn}, 1, instr(${rawPathColumn}, '?') - 1) end`;
+      const landingPath = sql12`case when trim(coalesce(${normalizedPathColumn}, '')) = '' then ${rawPath} else ${normalizedPathColumn} end`;
+      conditions.push(or6(sql12`${landingPath} = ${pathPrefix}`, sql12`${landingPath} like ${`${pathPrefix}/%`}`));
     }
     return conditions;
   };
   const acquisitionScope = scopedConditions(gaAcquisitionDaily.hostName, gaAcquisitionDaily.landingPageNormalized, gaAcquisitionDaily.landingPage);
   const leadLandingScope = scopedConditions(gaLeadEventsDaily.hostName, gaLeadEventsDaily.landingPageNormalized, gaLeadEventsDaily.landingPage);
-  const acquisitionAnchor = db.select({ date: sql11`max(${gaAcquisitionDaily.date})` }).from(gaAcquisitionDaily).where(and30(eq34(gaAcquisitionDaily.projectId, project.id), ...acquisitionScope)).get()?.date ?? null;
-  const leadAnchor = db.select({ date: sql11`max(${gaLeadEventsDaily.date})` }).from(gaLeadEventsDaily).where(and30(eq34(gaLeadEventsDaily.projectId, project.id), or5(
+  const acquisitionAnchor = db.select({ date: sql12`max(${gaAcquisitionDaily.date})` }).from(gaAcquisitionDaily).where(and30(eq34(gaAcquisitionDaily.projectId, project.id), ...acquisitionScope)).get()?.date ?? null;
+  const leadAnchor = db.select({ date: sql12`max(${gaLeadEventsDaily.date})` }).from(gaLeadEventsDaily).where(and30(eq34(gaLeadEventsDaily.projectId, project.id), or6(
     eq34(gaLeadEventsDaily.attributionScope, "channel"),
     and30(eq34(gaLeadEventsDaily.attributionScope, "landing-page"), ...leadLandingScope)
   ))).get()?.date ?? null;
@@ -32302,7 +32775,7 @@ function buildGaMeasurementAnalysis(db, projectName, options = {}) {
   const gaStartDate = gaPeriods[0]?.startDate;
   const acquisitionRows = gaStartDate ? db.select().from(gaAcquisitionDaily).where(and30(eq34(gaAcquisitionDaily.projectId, project.id), gte9(gaAcquisitionDaily.date, gaStartDate), lte7(gaAcquisitionDaily.date, gaAnchor))).all() : [];
   const leadRows = gaStartDate ? db.select().from(gaLeadEventsDaily).where(and30(eq34(gaLeadEventsDaily.projectId, project.id), gte9(gaLeadEventsDaily.date, gaStartDate), lte7(gaLeadEventsDaily.date, gaAnchor))).all() : [];
-  const engagementAnchor = db.select({ date: sql11`max(${gaDailyTotals.date})` }).from(gaDailyTotals).where(eq34(gaDailyTotals.projectId, project.id)).get()?.date ?? null;
+  const engagementAnchor = db.select({ date: sql12`max(${gaDailyTotals.date})` }).from(gaDailyTotals).where(eq34(gaDailyTotals.projectId, project.id)).get()?.date ?? null;
   const engagementPeriodWindow = engagementAnchor ? buildPeriods(engagementAnchor, days) : [];
   const engagementStartDate = engagementPeriodWindow[0]?.startDate;
   const engagementRows = engagementStartDate ? db.select().from(gaDailyTotals).where(and30(
@@ -32311,15 +32784,15 @@ function buildGaMeasurementAnalysis(db, projectName, options = {}) {
     lte7(gaDailyTotals.date, engagementAnchor)
   )).all() : [];
   const engagementAvailableFrom = db.select({
-    date: sql11`min(${gaDailyTotals.date})`
+    date: sql12`min(${gaDailyTotals.date})`
   }).from(gaDailyTotals).where(and30(
     eq34(gaDailyTotals.projectId, project.id),
-    or5(
-      sql11`${gaDailyTotals.engagementRate} is not null`,
-      sql11`${gaDailyTotals.newUsers} is not null`
+    or6(
+      sql12`${gaDailyTotals.engagementRate} is not null`,
+      sql12`${gaDailyTotals.newUsers} is not null`
     )
   )).get()?.date ?? null;
-  const gscAnchor = db.select({ date: sql11`max(${gscDailyTotals.date})` }).from(gscDailyTotals).where(eq34(gscDailyTotals.projectId, project.id)).get()?.date ?? null;
+  const gscAnchor = db.select({ date: sql12`max(${gscDailyTotals.date})` }).from(gscDailyTotals).where(eq34(gscDailyTotals.projectId, project.id)).get()?.date ?? null;
   const gscPeriods = gscAnchor ? buildPeriods(gscAnchor, days) : [];
   const gscStartDate = gscPeriods[0]?.startDate;
   const propertyRows = gscStartDate ? db.select().from(gscDailyTotals).where(and30(eq34(gscDailyTotals.projectId, project.id), gte9(gscDailyTotals.date, gscStartDate), lte7(gscDailyTotals.date, gscAnchor))).all() : [];
@@ -32646,22 +33119,22 @@ function buildOrganicEvidence(db, projectName, periodDays) {
   const nativeStartDate = nativeAcquisition.periods[0]?.startDate;
   const nativeEndDate = nativeAcquisition.periods.at(-1)?.endDate;
   const gscCoverage = aggregateCoverage(db.select({
-    startDate: sql12`min(${gscDailyTotals.date})`,
-    endDate: sql12`max(${gscDailyTotals.date})`,
-    observedDays: sql12`count(distinct ${gscDailyTotals.date})`
+    startDate: sql13`min(${gscDailyTotals.date})`,
+    endDate: sql13`max(${gscDailyTotals.date})`,
+    observedDays: sql13`count(distinct ${gscDailyTotals.date})`
   }).from(gscDailyTotals).where(eq35(gscDailyTotals.projectId, project.id)).get());
   const legacyGaCoverage = aggregateCoverage(db.select({
-    startDate: sql12`min(${gaTrafficSnapshots.date})`,
-    endDate: sql12`max(${gaTrafficSnapshots.date})`,
-    observedDays: sql12`count(distinct ${gaTrafficSnapshots.date})`
+    startDate: sql13`min(${gaTrafficSnapshots.date})`,
+    endDate: sql13`max(${gaTrafficSnapshots.date})`,
+    observedDays: sql13`count(distinct ${gaTrafficSnapshots.date})`
   }).from(gaTrafficSnapshots).where(eq35(gaTrafficSnapshots.projectId, project.id)).get());
   const nativeCoverage = nativeAcquisitionActive && normalizedMarketingHosts.length ? aggregateCoverage(db.select({
-    startDate: sql12`min(${gaAcquisitionDaily.date})`,
-    endDate: sql12`max(${gaAcquisitionDaily.date})`,
-    observedDays: sql12`count(distinct ${gaAcquisitionDaily.date})`
+    startDate: sql13`min(${gaAcquisitionDaily.date})`,
+    endDate: sql13`max(${gaAcquisitionDaily.date})`,
+    observedDays: sql13`count(distinct ${gaAcquisitionDaily.date})`
   }).from(gaAcquisitionDaily).where(and31(
     eq35(gaAcquisitionDaily.projectId, project.id),
-    or6(...normalizedMarketingHosts.map((candidate) => sql12`lower(trim(${gaAcquisitionDaily.hostName})) = ${candidate} or lower(trim(${gaAcquisitionDaily.hostName})) like ${`%.${candidate}`}`))
+    or7(...normalizedMarketingHosts.map((candidate) => sql13`lower(trim(${gaAcquisitionDaily.hostName})) = ${candidate} or lower(trim(${gaAcquisitionDaily.hostName})) like ${`%.${candidate}`}`))
   )).get()) : null;
   const gaCoverage = nativeAcquisitionActive ? nativeCoverage : legacyGaCoverage;
   const asOfDate = gscCoverage?.endDate ?? gaCoverage?.endDate ?? null;
@@ -32791,7 +33264,7 @@ function buildOrganicEvidence(db, projectName, periodDays) {
   const allCrawlers = db.select().from(crawlerEventsHourly).where(and31(eq35(crawlerEventsHourly.projectId, project.id), gte10(crawlerEventsHourly.tsHour, serverStart), lte8(crawlerEventsHourly.tsHour, serverEnd))).all();
   const allFetches = db.select().from(aiUserFetchEventsHourly).where(and31(eq35(aiUserFetchEventsHourly.projectId, project.id), gte10(aiUserFetchEventsHourly.tsHour, serverStart), lte8(aiUserFetchEventsHourly.tsHour, serverEnd))).all();
   const allReferrals = db.select().from(aiReferralEventsHourly).where(and31(eq35(aiReferralEventsHourly.projectId, project.id), countableReferralCondition(), gte10(aiReferralEventsHourly.tsHour, serverStart), lte8(aiReferralEventsHourly.tsHour, serverEnd))).all();
-  const [serverCoverageRow] = db.all(sql12`
+  const [serverCoverageRow] = db.all(sql13`
     select
       min(day) as startDate,
       max(day) as endDate,
@@ -33890,15 +34363,15 @@ function renderResultsExportCsv(report) {
   ].map(csvCell).join(","));
   return [CSV_COLUMNS.join(","), ...rows].join("\r\n") + "\r\n";
 }
-function filenameFor(projectName, format) {
+function filenameFor(projectName, format2) {
   const safeName = projectName.replace(/[^\w.-]+/gi, "_") || "project";
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  return `canonry-results-${safeName}-${date}.${format}`;
+  return `canonry-results-${safeName}-${date}.${format2}`;
 }
 async function resultsExportRoutes(app) {
   app.get("/projects/:name/results/export", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const format = parseFormat(request.query.format);
+    const format2 = parseFormat(request.query.format);
     const includeProbes = parseBoolean(request.query.includeProbes, "includeProbes");
     const { sinceIso, untilIso } = parseDateBounds(request.query.since, request.query.until);
     const conditions = [
@@ -33990,10 +34463,10 @@ async function resultsExportRoutes(app) {
       recordCount: records.length,
       records
     };
-    reply.header("Content-Disposition", `attachment; filename="${filenameFor(project.name, format)}"`);
+    reply.header("Content-Disposition", `attachment; filename="${filenameFor(project.name, format2)}"`);
     reply.header("Cache-Control", "private, no-store");
     reply.header("X-Content-Type-Options", "nosniff");
-    if (format === "csv") {
+    if (format2 === "csv") {
       reply.type("text/csv; charset=utf-8");
       return reply.send(renderResultsExportCsv(dto));
     }
@@ -34003,7 +34476,7 @@ async function resultsExportRoutes(app) {
 }
 
 // ../api-routes/src/composites.ts
-import { eq as eq39, and as and35, desc as desc17, sql as sql13, like as like2, or as or7, inArray as inArray18 } from "drizzle-orm";
+import { eq as eq39, and as and35, desc as desc17, sql as sql14, like as like3, or as or8, inArray as inArray18 } from "drizzle-orm";
 var TOP_INSIGHT_LIMIT = 5;
 var SEARCH_HIT_HARD_LIMIT = 50;
 var SEARCH_SNIPPET_RADIUS = 80;
@@ -34200,23 +34673,23 @@ async function compositeRoutes(app) {
     }).from(querySnapshots).innerJoin(queries, eq39(querySnapshots.queryId, queries.id)).where(
       and35(
         eq39(queries.projectId, project.id),
-        or7(
-          sql13`${querySnapshots.answerText} LIKE ${pattern} ESCAPE '\\'`,
-          sql13`${querySnapshots.citedDomains} LIKE ${pattern} ESCAPE '\\'`,
-          sql13`${querySnapshots.citedUrls} LIKE ${pattern} ESCAPE '\\'`,
-          sql13`${querySnapshots.rawResponse} LIKE ${pattern} ESCAPE '\\'`,
-          like2(queries.query, pattern)
+        or8(
+          sql14`${querySnapshots.answerText} LIKE ${pattern} ESCAPE '\\'`,
+          sql14`${querySnapshots.citedDomains} LIKE ${pattern} ESCAPE '\\'`,
+          sql14`${querySnapshots.citedUrls} LIKE ${pattern} ESCAPE '\\'`,
+          sql14`${querySnapshots.rawResponse} LIKE ${pattern} ESCAPE '\\'`,
+          like3(queries.query, pattern)
         )
       )
     ).orderBy(desc17(querySnapshots.createdAt)).limit(limit + 1).all());
     const insightMatches = app.db.select().from(insights).where(
       and35(
         eq39(insights.projectId, project.id),
-        or7(
-          like2(insights.title, pattern),
-          like2(insights.query, pattern),
-          sql13`${insights.recommendation} LIKE ${pattern} ESCAPE '\\'`,
-          sql13`${insights.cause} LIKE ${pattern} ESCAPE '\\'`
+        or8(
+          like3(insights.title, pattern),
+          like3(insights.query, pattern),
+          sql14`${insights.recommendation} LIKE ${pattern} ESCAPE '\\'`,
+          sql14`${insights.cause} LIKE ${pattern} ESCAPE '\\'`
         )
       )
     ).orderBy(desc17(insights.createdAt)).limit(limit + 1).all();
@@ -34439,20 +34912,20 @@ function buildSuggestedQueriesFromGsc(app, projectId, trackedQueries) {
   const dimensionedRows = app.db.select({
     date: gscSearchData.date,
     query: gscSearchData.query,
-    impressions: sql13`COALESCE(SUM(${gscSearchData.impressions}), 0)`,
-    clicks: sql13`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
+    impressions: sql14`COALESCE(SUM(${gscSearchData.impressions}), 0)`,
+    clicks: sql14`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
     // Weighted average: SUM(position * impressions) / SUM(impressions).
     // NULLIF guards the degenerate impressions=0 case (SQLite returns NULL,
     // which the JS coerces to 0 — caught by the impression floor anyway).
-    avgPosition: sql13`COALESCE(SUM(${gscSearchData.position} * ${gscSearchData.impressions}) * 1.0 / NULLIF(SUM(${gscSearchData.impressions}), 0), 0)`
+    avgPosition: sql14`COALESCE(SUM(${gscSearchData.position} * ${gscSearchData.impressions}) * 1.0 / NULLIF(SUM(${gscSearchData.impressions}), 0), 0)`
   }).from(gscSearchData).where(and35(
     eq39(gscSearchData.projectId, projectId),
-    sql13`${gscSearchData.date} >= ${cutoff}`,
+    sql14`${gscSearchData.date} >= ${cutoff}`,
     // Same upper bound as the accurate source below. The merge picks a source
     // PER DAY, so an asymmetric range would let a dimensioned-only day past
     // the window's end into a basket the other source cannot balance.
-    sql13`${gscSearchData.date} <= ${suggestionWindow.endDate ?? "9999-12-31"}`,
-    sql13`${gscSearchData.impressions} > 0`
+    sql14`${gscSearchData.date} <= ${suggestionWindow.endDate ?? "9999-12-31"}`,
+    sql14`${gscSearchData.impressions} > 0`
   )).groupBy(gscSearchData.date, gscSearchData.query).all();
   const merged = mergeGscQueryTotalsWithFallback(
     readGscQueryDailyRows(app.db, projectId, cutoff, suggestionWindow.endDate ?? "9999-12-31"),
@@ -34890,6 +35363,7 @@ var SCHEMA_TABLE = {
   GtmWorkspaceListResponse: gtmWorkspaceListResponseSchema,
   HealthSnapshotDto: healthSnapshotDtoSchema,
   IndexingRequestResponseDto: indexingRequestResponseDtoSchema,
+  IntegrationSettingsSummaryDto: integrationSettingsSummaryDtoSchema,
   KeywordDto: keywordDtoSchema,
   LatestProjectRunDto: latestProjectRunDtoSchema,
   LocationContext: locationContextSchema,
@@ -34970,6 +35444,7 @@ var SCHEMA_TABLE = {
   ProjectOverviewDto: projectOverviewDtoSchema,
   ProjectReportDto: projectReportDtoSchema,
   ProjectSearchResponseDto: projectSearchResponseSchema,
+  ProviderSummaryEntryDto: providerSummaryEntryDtoSchema,
   QueryDto: queryDtoSchema,
   ResultsExportDto: resultsExportDtoSchema,
   RunDetailDto: runDetailDtoSchema,
@@ -35003,6 +35478,8 @@ var SCHEMA_TABLE = {
   SnapshotRequest: z.object(snapshotRequestInputSchema.shape).omit({ phrases: true }),
   SourceBreakdownDto: sourceBreakdownDtoSchema,
   TelemetryEventAcceptedDto: telemetryEventAcceptedDtoSchema,
+  TelemetryStatusDto: telemetryStatusDtoSchema,
+  OperationalLogListDto: operationalLogListDtoSchema,
   CloudflareWorkerIngestRequest: cloudflareWorkerIngestRequestSchema,
   CloudflareWorkerIngestResponse: cloudflareWorkerIngestResponseSchema,
   TrafficBackfillResponse: trafficBackfillResponseSchema,
@@ -37427,6 +37904,7 @@ var routeCatalog = [
     method: "put",
     path: "/api/v1/settings/providers/{name}",
     summary: "Update provider settings",
+    description: "Requires settings.write. Already configured providers accept model or quota changes without resubmitting credentials. An unconfigured provider still requires its connection credentials.",
     tags: ["settings"],
     parameters: [providerNameParameter],
     requestBody: {
@@ -37446,9 +37924,9 @@ var routeCatalog = [
       }
     },
     responses: {
-      // TODO: Add `ProviderSettingsDto` Zod schema in contracts.
-      200: rawJsonResponse("Provider updated.", looseObjectSchema),
+      200: jsonResponse("Provider updated.", "ProviderSummaryEntryDto"),
       400: errorResponse("Invalid provider settings."),
+      403: errorResponse("The credential lacks settings.write."),
       501: errorResponse("Provider updates are not supported.")
     }
   },
@@ -37473,8 +37951,7 @@ var routeCatalog = [
       }
     },
     responses: {
-      // TODO: Add `GoogleSettingsDto` Zod schema in contracts.
-      200: rawJsonResponse("Google settings updated.", looseObjectSchema),
+      200: jsonResponse("Google settings updated.", "IntegrationSettingsSummaryDto"),
       400: errorResponse("Invalid Google settings."),
       501: errorResponse("Google settings updates are not supported.")
     }
@@ -37865,14 +38342,34 @@ var routeCatalog = [
       502: errorResponse("Notification delivery failed.")
     }
   },
+  {
+    method: "get",
+    path: "/api/v1/operations/logs",
+    summary: "Read bounded, redacted runtime logs",
+    description: "Requires logs.read (or wildcard), an admin role for user sessions, and an instance-wide credential. Includes application and HTTP diagnostics, separate from audit history. File-backed hosts retain logs across restarts; inspect retention, retentionPolicy, dropped, and captureErrors. Filters apply before pagination and must remain unchanged when resuming a cursor. Cursors expire on retention eviction.",
+    tags: ["operations"],
+    parameters: [
+      { name: "limit", in: "query", required: false, description: "Maximum entries (default 100).", schema: { type: "integer", minimum: 1, maximum: 200, default: 100 } },
+      { name: "cursor", in: "query", required: false, description: "Opaque cursor bound to the log store and query filters.", schema: { type: "string", minLength: 1, maxLength: 512 } },
+      { name: "level", in: "query", required: false, description: "Exact log level.", schema: { type: "string", enum: ["trace", "debug", "info", "warn", "error", "fatal"] } },
+      ...["module", "runId", "projectId", "actor", "requestId"].map((name) => ({ name, in: "query", required: false, description: `Exact ${name} filter (does not grant project-scoped log access).`, schema: { type: "string", minLength: 1, maxLength: name === "actor" ? 512 : 256 } })),
+      ...["since", "until"].map((name) => ({ name, in: "query", required: false, description: `Inclusive ${name} event timestamp.`, schema: { type: "string", format: "date-time" } }))
+    ],
+    responses: {
+      200: jsonResponse("Runtime log page with retention and capture-loss metadata.", "OperationalLogListDto"),
+      400: errorResponse("Invalid filters or expired cursor."),
+      401: errorResponse("Authentication required."),
+      403: errorResponse("Instance logs.read permission required."),
+      501: errorResponse("This deployment does not provide operational logs.")
+    }
+  },
   {
     method: "get",
     path: "/api/v1/telemetry",
     summary: "Get telemetry status",
     tags: ["telemetry"],
     responses: {
-      // TODO: Add `TelemetryStatusDto` Zod schema in contracts.
-      200: rawJsonResponse("Telemetry status returned.", looseObjectSchema),
+      200: jsonResponse("Telemetry status returned.", "TelemetryStatusDto"),
       501: errorResponse("Telemetry status is not available.")
     }
   },
@@ -37880,6 +38377,7 @@ var routeCatalog = [
     method: "put",
     path: "/api/v1/telemetry",
     summary: "Update telemetry status",
+    description: "Requires settings.write. The response reports the configured preference and effective state; deployment/environment opt-outs take precedence.",
     tags: ["telemetry"],
     requestBody: {
       required: true,
@@ -37896,9 +38394,9 @@ var routeCatalog = [
       }
     },
     responses: {
-      // TODO: Add `TelemetryStatusDto` Zod schema in contracts.
-      200: rawJsonResponse("Telemetry updated.", looseObjectSchema),
+      200: jsonResponse("Telemetry updated.", "TelemetryStatusDto"),
       400: errorResponse("Invalid telemetry request."),
+      403: errorResponse("The credential lacks settings.write."),
       501: errorResponse("Telemetry configuration is not available.")
     }
   },
@@ -42517,13 +43015,10 @@ async function telemetryRoutes(app, opts) {
     if (!opts.getTelemetryStatus) {
       throw notImplemented("Telemetry status is not available in this deployment");
     }
-    const status = opts.getTelemetryStatus();
-    return {
-      enabled: status.enabled,
-      anonymousId: status.anonymousId ? status.anonymousId.slice(0, 8) + "..." : void 0
-    };
+    return normalizeTelemetryStatus(opts.getTelemetryStatus());
   });
   app.put("/telemetry", async (request) => {
+    requireScope(request, SETTINGS_WRITE_SCOPE);
     if (!opts.setTelemetryEnabled) {
       throw notImplemented("Telemetry configuration is not available in this deployment");
     }
@@ -42533,10 +43028,24 @@ async function telemetryRoutes(app, opts) {
     }
     opts.setTelemetryEnabled(enabled);
     const status = opts.getTelemetryStatus?.();
-    return {
-      enabled: status?.enabled ?? enabled,
-      anonymousId: status?.anonymousId ? status.anonymousId.slice(0, 8) + "..." : void 0
-    };
+    const effective = normalizeTelemetryStatus(status ?? { enabled });
+    if (app.hasDecorator("db")) {
+      try {
+        writeAuditLog(app.db, auditFromRequest(request, {
+          actor: "api",
+          action: "telemetry.updated",
+          entityType: "telemetry",
+          diff: {
+            target: effective.target,
+            configuredEnabled: effective.configuredEnabled,
+            reason: effective.reason
+          }
+        }));
+      } catch {
+        app.log.warn({ action: "telemetry.updated" }, "Telemetry setting audit write failed");
+      }
+    }
+    return effective;
   });
   app.post("/telemetry/onboarding", async (request, reply) => {
     const parsed = onboardingTelemetryEventSchema.safeParse(request.body);
@@ -42553,6 +43062,25 @@ async function telemetryRoutes(app, opts) {
   });
 }
 
+// ../api-routes/src/operational-logs.ts
+async function operationalLogsRoutes(app, opts = {}) {
+  app.get("/operations/logs", async (request) => {
+    requireAdminSession(request);
+    requireScope(request, "logs.read");
+    if (request.apiKey?.projectId) {
+      throw forbidden("This API key is scoped to one project and cannot read instance operational diagnostics.");
+    }
+    const parsed = logQuerySchema.safeParse(request.query);
+    if (!parsed.success) {
+      throw validationError("Invalid operational logs query.", { issues: parsed.error.issues });
+    }
+    if (!opts.listOperationalLogs) {
+      throw notImplemented("Operational logs are not available in this deployment.");
+    }
+    return operationalLogListDtoSchema.parse(await opts.listOperationalLogs(parsed.data));
+  });
+}
+
 // ../api-routes/src/schedules.ts
 import crypto26 from "crypto";
 import { and as and36, asc as asc7, eq as eq42 } from "drizzle-orm";
@@ -43095,7 +43623,7 @@ function formatNotification(row) {
 
 // ../api-routes/src/google.ts
 import crypto32 from "crypto";
-import { eq as eq44, and as and37, desc as desc19, sql as sql14, inArray as inArray19 } from "drizzle-orm";
+import { eq as eq44, and as and37, desc as desc19, sql as sql15, inArray as inArray19 } from "drizzle-orm";
 
 // ../api-routes/src/gsc-period-comparison.ts
 var DAY_MS = 864e5;
@@ -45524,11 +46052,11 @@ async function googleRoutes(app, opts) {
     const cutoffDate = startDate ? null : resolvedWindow.startDate;
     const effectiveEndDate = endDate ?? (daysParam === null ? void 0 : resolvedWindow.endDate ?? void 0);
     const conditions = [eq44(gscSearchData.projectId, project.id)];
-    if (startDate) conditions.push(sql14`${gscSearchData.date} >= ${startDate}`);
-    else if (cutoffDate) conditions.push(sql14`${gscSearchData.date} >= ${cutoffDate}`);
-    if (effectiveEndDate) conditions.push(sql14`${gscSearchData.date} <= ${effectiveEndDate}`);
-    if (query) conditions.push(sql14`${gscSearchData.query} LIKE ${"%" + escapeLikePattern(query) + "%"} ESCAPE '\\'`);
-    if (page3) conditions.push(sql14`${gscSearchData.page} LIKE ${"%" + escapeLikePattern(page3) + "%"} ESCAPE '\\'`);
+    if (startDate) conditions.push(sql15`${gscSearchData.date} >= ${startDate}`);
+    else if (cutoffDate) conditions.push(sql15`${gscSearchData.date} >= ${cutoffDate}`);
+    if (effectiveEndDate) conditions.push(sql15`${gscSearchData.date} <= ${effectiveEndDate}`);
+    if (query) conditions.push(sql15`${gscSearchData.query} LIKE ${"%" + escapeLikePattern(query) + "%"} ESCAPE '\\'`);
+    if (page3) conditions.push(sql15`${gscSearchData.page} LIKE ${"%" + escapeLikePattern(page3) + "%"} ESCAPE '\\'`);
     const limitVal = Math.max(parseInt(limit ?? "500", 10) || 0, 1);
     const offsetVal = Math.max(parseInt(offset ?? "0", 10) || 0, 0);
     const orderColumns = {
@@ -45537,8 +46065,8 @@ async function googleRoutes(app, opts) {
       date: [desc19(gscSearchData.date), desc19(gscSearchData.clicks), gscSearchData.query]
     }[orderBy];
     const rows = app.db.select().from(gscSearchData).where(and37(...conditions)).orderBy(...orderColumns).limit(limitVal).offset(offsetVal).all();
-    const totalMatching = app.db.select({ total: sql14`COUNT(*)` }).from(gscSearchData).where(and37(...conditions)).get()?.total ?? 0;
-    const latestAvailableDate = app.db.select({ latest: sql14`MAX(${gscSearchData.date})` }).from(gscSearchData).where(eq44(gscSearchData.projectId, project.id)).get()?.latest ?? null;
+    const totalMatching = app.db.select({ total: sql15`COUNT(*)` }).from(gscSearchData).where(and37(...conditions)).get()?.total ?? 0;
+    const latestAvailableDate = app.db.select({ latest: sql15`MAX(${gscSearchData.date})` }).from(gscSearchData).where(eq44(gscSearchData.projectId, project.id)).get()?.latest ?? null;
     return {
       rows: rows.map((r) => ({
         date: r.date,
@@ -45582,12 +46110,12 @@ async function googleRoutes(app, opts) {
     const fetchStart = priorWindowIsSynced ? priorPeriodStart : windowStart;
     const dailyTotals = readGscDailyTotals(app.db, project.id, fetchStart, windowEnd);
     const conditions = [eq44(gscSearchData.projectId, project.id)];
-    if (fetchStart) conditions.push(sql14`${gscSearchData.date} >= ${fetchStart}`);
-    if (endDate) conditions.push(sql14`${gscSearchData.date} <= ${endDate}`);
+    if (fetchStart) conditions.push(sql15`${gscSearchData.date} >= ${fetchStart}`);
+    if (endDate) conditions.push(sql15`${gscSearchData.date} <= ${endDate}`);
     const dimensionedRows = app.db.select({
       date: gscSearchData.date,
-      clicks: sql14`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
-      impressions: sql14`COALESCE(SUM(${gscSearchData.impressions}), 0)`
+      clicks: sql15`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
+      impressions: sql15`COALESCE(SUM(${gscSearchData.impressions}), 0)`
     }).from(gscSearchData).where(and37(...conditions)).groupBy(gscSearchData.date).orderBy(gscSearchData.date).all();
     const propertyDates = new Set(dailyTotals.map((d) => d.date));
     const comparisonDaily = mergeGscDailyTotalsWithFallback(
@@ -45685,23 +46213,23 @@ async function googleRoutes(app, opts) {
     );
     const cutoffDate = startDate ? null : resolvedWindow.startDate;
     const conditions = [eq44(gscSearchData.projectId, project.id)];
-    if (startDate) conditions.push(sql14`${gscSearchData.date} >= ${startDate}`);
-    else if (cutoffDate) conditions.push(sql14`${gscSearchData.date} >= ${cutoffDate}`);
-    if (endDate) conditions.push(sql14`${gscSearchData.date} <= ${endDate}`);
+    if (startDate) conditions.push(sql15`${gscSearchData.date} >= ${startDate}`);
+    else if (cutoffDate) conditions.push(sql15`${gscSearchData.date} >= ${cutoffDate}`);
+    if (endDate) conditions.push(sql15`${gscSearchData.date} <= ${endDate}`);
     const limitVal = Math.max(parseInt(limit ?? "50", 10) || 0, 1);
     const rows = app.db.select({
       page: gscSearchData.page,
-      clicks: sql14`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
-      impressions: sql14`COALESCE(SUM(${gscSearchData.impressions}), 0)`
-    }).from(gscSearchData).where(and37(...conditions)).groupBy(gscSearchData.page).orderBy(desc19(sql14`SUM(${gscSearchData.clicks})`), desc19(sql14`SUM(${gscSearchData.impressions})`)).limit(limitVal).all();
+      clicks: sql15`COALESCE(SUM(${gscSearchData.clicks}), 0)`,
+      impressions: sql15`COALESCE(SUM(${gscSearchData.impressions}), 0)`
+    }).from(gscSearchData).where(and37(...conditions)).groupBy(gscSearchData.page).orderBy(desc19(sql15`SUM(${gscSearchData.clicks})`), desc19(sql15`SUM(${gscSearchData.impressions})`)).limit(limitVal).all();
     const windowStart = startDate ?? cutoffDate ?? "";
     const windowEnd = endDate ?? resolvedWindow.endDate ?? "9999-12-31";
     const dailyTotals = readGscDailyTotals(app.db, project.id, windowStart, windowEnd);
     const totalClicks = dailyTotals.reduce((sum, d) => sum + d.clicks, 0);
     const totalImpressions = dailyTotals.reduce((sum, d) => sum + d.impressions, 0);
     const rankedSpan = app.db.select({
-      first: sql14`MIN(${gscSearchData.date})`,
-      last: sql14`MAX(${gscSearchData.date})`
+      first: sql15`MIN(${gscSearchData.date})`,
+      last: sql15`MAX(${gscSearchData.date})`
     }).from(gscSearchData).where(and37(...conditions)).get();
     const coveredFrom = dailyTotals.length > 0 ? dailyTotals[0].date : null;
     const coveredThrough = dailyTotals.length > 0 ? dailyTotals[dailyTotals.length - 1].date : null;
@@ -46670,7 +47198,7 @@ async function googleRoutes(app, opts) {
 
 // ../api-routes/src/google-marketing.ts
 import crypto33 from "crypto";
-import { and as and38, desc as desc20, eq as eq45, isNull as isNull6, lt as lt6, ne as ne6, or as or8, sql as sql15 } from "drizzle-orm";
+import { and as and38, desc as desc20, eq as eq45, isNull as isNull6, lt as lt6, ne as ne6, or as or9, sql as sql16 } from "drizzle-orm";
 import { z as z4 } from "zod";
 var snapshotPageQuerySchema = z4.object({
   limit: z4.coerce.number().int().min(1).max(GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX).optional(),
@@ -47621,7 +48149,7 @@ async function googleMarketingRoutes(app, opts) {
                 selectedCustomerCurrencyCode: null,
                 selectedCustomerTimeZone: null,
                 selectedCustomerStatus: null,
-                selectionGeneration: sql15`${googleAdsConnections.selectionGeneration} + 1`,
+                selectionGeneration: sql16`${googleAdsConnections.selectionGeneration} + 1`,
                 scopes: tokens.scopes,
                 lastValidatedAt: now,
                 lastCustomerSnapshotId: null,
@@ -47652,7 +48180,7 @@ async function googleMarketingRoutes(app, opts) {
                 selectedContainerPublicId: null,
                 selectedWorkspaceId: null,
                 selectedWorkspaceName: null,
-                selectionGeneration: sql15`${gtmConnections.selectionGeneration} + 1`,
+                selectionGeneration: sql16`${gtmConnections.selectionGeneration} + 1`,
                 scopes: tokens.scopes,
                 lastValidatedAt: now,
                 lastSnapshotAt: null,
@@ -47803,7 +48331,7 @@ async function googleMarketingRoutes(app, opts) {
         selectedCustomerStatus: customerChanged ? null : existing.selectedCustomerStatus,
         // A same-value write still starts a new selection generation. Do not
         // let timestamp equality reuse append-only evidence from before it.
-        selectionGeneration: sql15`${googleAdsConnections.selectionGeneration} + 1`,
+        selectionGeneration: sql16`${googleAdsConnections.selectionGeneration} + 1`,
         lastValidatedAt: now,
         lastCustomerSnapshotId: null,
         lastInventorySnapshotAt: null,
@@ -47847,7 +48375,7 @@ async function googleMarketingRoutes(app, opts) {
         selectedContainerPublicId: containerChanged ? null : existing.selectedContainerPublicId,
         selectedWorkspaceId,
         selectedWorkspaceName: workspaceChanged ? null : existing.selectedWorkspaceName,
-        selectionGeneration: sql15`${gtmConnections.selectionGeneration} + 1`,
+        selectionGeneration: sql16`${gtmConnections.selectionGeneration} + 1`,
         lastValidatedAt: now,
         // Every selection write starts a new evidence generation, including a
         // same-value reselection. The timestamp alone cannot order a prior
@@ -47885,7 +48413,7 @@ async function googleMarketingRoutes(app, opts) {
       const existing = tx.select().from(runs).where(and38(
         eq45(runs.projectId, project.id),
         eq45(runs.kind, RunKinds["google-ads-sync"]),
-        or8(eq45(runs.status, RunStatuses.queued), eq45(runs.status, RunStatuses.running))
+        or9(eq45(runs.status, RunStatuses.queued), eq45(runs.status, RunStatuses.running))
       )).orderBy(desc20(runs.createdAt)).get();
       if (existing) {
         run = existing;
@@ -47921,7 +48449,7 @@ async function googleMarketingRoutes(app, opts) {
       const existing = tx.select().from(runs).where(and38(
         eq45(runs.projectId, project.id),
         eq45(runs.kind, RunKinds["gtm-sync"]),
-        or8(eq45(runs.status, RunStatuses.queued), eq45(runs.status, RunStatuses.running))
+        or9(eq45(runs.status, RunStatuses.queued), eq45(runs.status, RunStatuses.running))
       )).orderBy(desc20(runs.createdAt)).get();
       if (existing) {
         run = existing;
@@ -47951,7 +48479,7 @@ async function googleMarketingRoutes(app, opts) {
     const cursor = decodeSnapshotCursor(query.cursor);
     const conditions = [eq45(googleAdsRawSnapshots.projectId, project.id)];
     if (cursor) {
-      conditions.push(or8(
+      conditions.push(or9(
         lt6(googleAdsRawSnapshots.capturedAt, cursor.capturedAt),
         and38(eq45(googleAdsRawSnapshots.capturedAt, cursor.capturedAt), lt6(googleAdsRawSnapshots.id, cursor.id))
       ));
@@ -47959,7 +48487,7 @@ async function googleMarketingRoutes(app, opts) {
     const limit = query.limit ?? 50;
     const rows = app.db.select().from(googleAdsRawSnapshots).where(and38(...conditions)).orderBy(desc20(googleAdsRawSnapshots.capturedAt), desc20(googleAdsRawSnapshots.id)).limit(limit + 1).all();
     const page3 = rows.slice(0, limit);
-    const total = app.db.select({ total: sql15`COUNT(*)`.mapWith(Number).as("total") }).from(googleAdsRawSnapshots).where(eq45(googleAdsRawSnapshots.projectId, project.id)).get();
+    const total = app.db.select({ total: sql16`COUNT(*)`.mapWith(Number).as("total") }).from(googleAdsRawSnapshots).where(eq45(googleAdsRawSnapshots.projectId, project.id)).get();
     return {
       snapshots: page3.map(toGoogleAdsSnapshotMetadata),
       nextCursor: rows.length > limit && page3.length > 0 ? encodeSnapshotCursor({ capturedAt: page3.at(-1).capturedAt, id: page3.at(-1).id }) : null,
@@ -47983,7 +48511,7 @@ async function googleMarketingRoutes(app, opts) {
     const cursor = decodeSnapshotCursor(query.cursor);
     const conditions = [eq45(gtmRawSnapshots.projectId, project.id)];
     if (cursor) {
-      conditions.push(or8(
+      conditions.push(or9(
         lt6(gtmRawSnapshots.capturedAt, cursor.capturedAt),
         and38(eq45(gtmRawSnapshots.capturedAt, cursor.capturedAt), lt6(gtmRawSnapshots.id, cursor.id))
       ));
@@ -47991,7 +48519,7 @@ async function googleMarketingRoutes(app, opts) {
     const limit = query.limit ?? 50;
     const rows = app.db.select().from(gtmRawSnapshots).where(and38(...conditions)).orderBy(desc20(gtmRawSnapshots.capturedAt), desc20(gtmRawSnapshots.id)).limit(limit + 1).all();
     const page3 = rows.slice(0, limit);
-    const total = app.db.select({ total: sql15`COUNT(*)`.mapWith(Number).as("total") }).from(gtmRawSnapshots).where(eq45(gtmRawSnapshots.projectId, project.id)).get();
+    const total = app.db.select({ total: sql16`COUNT(*)`.mapWith(Number).as("total") }).from(gtmRawSnapshots).where(eq45(gtmRawSnapshots.projectId, project.id)).get();
     return {
       snapshots: page3.map(toGtmSnapshotMetadata),
       nextCursor: rows.length > limit && page3.length > 0 ? encodeSnapshotCursor({ capturedAt: page3.at(-1).capturedAt, id: page3.at(-1).id }) : null,
@@ -48026,7 +48554,7 @@ async function googleMarketingRoutes(app, opts) {
           selectedCustomerCurrencyCode: null,
           selectedCustomerTimeZone: null,
           selectedCustomerStatus: null,
-          selectionGeneration: sql15`${googleAdsConnections.selectionGeneration} + 1`,
+          selectionGeneration: sql16`${googleAdsConnections.selectionGeneration} + 1`,
           scopes: [],
           lastValidatedAt: null,
           lastCustomerSnapshotId: null,
@@ -48065,7 +48593,7 @@ async function googleMarketingRoutes(app, opts) {
           selectedContainerPublicId: null,
           selectedWorkspaceId: null,
           selectedWorkspaceName: null,
-          selectionGeneration: sql15`${gtmConnections.selectionGeneration} + 1`,
+          selectionGeneration: sql16`${gtmConnections.selectionGeneration} + 1`,
           scopes: [],
           lastValidatedAt: null,
           lastSnapshotAt: null,
@@ -48260,7 +48788,7 @@ async function googleMarketingRoutes(app, opts) {
 
 // ../api-routes/src/ads.ts
 import crypto36 from "crypto";
-import { eq as eq47, and as and40, asc as asc9, desc as desc21, gt as gt3, gte as gte12, lt as lt7, lte as lte11, ne as ne7, inArray as inArray20, or as or10, isNull as isNull8, isNotNull as isNotNull4, sql as sql17 } from "drizzle-orm";
+import { eq as eq47, and as and40, asc as asc9, desc as desc21, gt as gt3, gte as gte12, lt as lt7, lte as lte11, ne as ne7, inArray as inArray20, or as or11, isNull as isNull8, isNotNull as isNotNull4, sql as sql18 } from "drizzle-orm";
 
 // ../api-routes/src/ads-activation.ts
 import crypto34 from "crypto";
@@ -49646,7 +50174,7 @@ async function executeApprovedAdsActivation(dependencies, request) {
 
 // ../api-routes/src/ads-activation-routes.ts
 import crypto35 from "crypto";
-import { and as and39, asc as asc8, eq as eq46, gt as gt2, isNotNull as isNotNull3, isNull as isNull7, lte as lte10, or as or9, sql as sql16 } from "drizzle-orm";
+import { and as and39, asc as asc8, eq as eq46, gt as gt2, isNotNull as isNotNull3, isNull as isNull7, lte as lte10, or as or10, sql as sql17 } from "drizzle-orm";
 var MAX_ACTIVATION_GRANT_LIFETIME_MS = 24 * 60 * 60 * 1e3;
 var ACTIVATION_LEASE_MS = 5 * 6e4;
 var ACTIVATION_REVOCATION_SETTLEMENT_MS = ACTIVATION_LEASE_MS;
@@ -49772,7 +50300,7 @@ function createActivationStore(app, request) {
         }).where(and39(
           eq46(adsOperations.id, existing.id),
           eq46(adsOperations.state, AdsOperationStates.pending),
-          or9(
+          or10(
             isNull7(adsOperations.leaseOwner),
             eq46(adsOperations.leaseOwner, input.leaseOwner),
             isNull7(adsOperations.leaseExpiresAt),
@@ -50190,35 +50718,35 @@ async function executeActivationGrant(app, opts, request, project, executorApiKe
   return activationResponse(opts, result.grant, result.operation);
 }
 function selectWatchdogOperations(app, nowIso, batchSize, allowLiveRevocationLease) {
-  const leaseAvailable = or9(
+  const leaseAvailable = or10(
     isNull7(adsOperations.leaseOwner),
     isNull7(adsOperations.leaseExpiresAt),
     lte10(adsOperations.leaseExpiresAt, nowIso)
   );
-  const campaignHasMutationEvidence = or9(
+  const campaignHasMutationEvidence = or10(
     eq46(adsOperationSteps.state, AdsOperationStepStates.executing),
     eq46(adsOperationSteps.state, AdsOperationStepStates.active),
     eq46(adsOperationSteps.state, AdsOperationStepStates.rollback_executing),
     eq46(adsOperationSteps.state, AdsOperationStepStates.rollback_failed),
     eq46(adsOperationSteps.state, AdsOperationStepStates.unknown)
   );
-  const eligibleState = allowLiveRevocationLease ? or9(
+  const eligibleState = allowLiveRevocationLease ? or10(
     eq46(adsOperations.state, AdsOperationStates.unknown),
     and39(
       eq46(adsOperations.state, AdsOperationStates.pending),
-      or9(
+      or10(
         isNotNull3(adsActivationGrants.revocationRequestedAt),
         and39(leaseAvailable, campaignHasMutationEvidence)
       )
     )
   ) : and39(
-    or9(
+    or10(
       eq46(adsOperations.state, AdsOperationStates.unknown),
       eq46(adsOperations.state, AdsOperationStates.pending)
     ),
     leaseAvailable
   );
-  const freshRevocationPriority = sql16`CASE
+  const freshRevocationPriority = sql17`CASE
     WHEN ${adsActivationGrants.revocationRequestedAt} IS NOT NULL
       AND (
         ${adsOperations.lastReconciledAt} IS NULL
@@ -50356,7 +50884,7 @@ async function containUrgentAdsActivationCampaignsOnce(app, opts) {
       lastReconciledAt: (/* @__PURE__ */ new Date()).toISOString()
     }).where(and39(
       eq46(adsOperations.id, operation.id),
-      or9(
+      or10(
         eq46(adsOperations.state, AdsOperationStates.unknown),
         eq46(adsOperations.state, AdsOperationStates.pending)
       )
@@ -50382,11 +50910,11 @@ async function sweepStaleAdsActivationsOnce(app, opts) {
           updatedAt: nowIso
         }).where(and39(
           eq46(adsOperations.id, operation.id),
-          or9(
+          or10(
             eq46(adsOperations.state, AdsOperationStates.unknown),
             and39(
               eq46(adsOperations.state, AdsOperationStates.pending),
-              or9(
+              or10(
                 isNull7(adsOperations.leaseOwner),
                 isNull7(adsOperations.leaseExpiresAt),
                 lte10(adsOperations.leaseExpiresAt, nowIso)
@@ -50419,11 +50947,11 @@ async function sweepStaleAdsActivationsOnce(app, opts) {
     const failedAt = (/* @__PURE__ */ new Date()).toISOString();
     app.db.update(adsOperations).set({ updatedAt: failedAt }).where(and39(
       eq46(adsOperations.id, operation.id),
-      or9(
+      or10(
         eq46(adsOperations.state, AdsOperationStates.unknown),
         and39(
           eq46(adsOperations.state, AdsOperationStates.pending),
-          or9(
+          or10(
             isNull7(adsOperations.leaseOwner),
             isNull7(adsOperations.leaseExpiresAt),
             lte10(adsOperations.leaseExpiresAt, failedAt)
@@ -51609,13 +52137,13 @@ function claimOperationForReconciliation(app, row, leaseOwner, now, leaseMs, pol
     enforceBackoff ? lte11(adsOperations.updatedAt, unknownCutoff) : void 0
   ) : and40(
     eq47(adsOperations.state, AdsOperationStates.reconciling),
-    or10(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
+    or11(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
   );
   const claimed = app.db.update(adsOperations).set({
     state: AdsOperationStates.reconciling,
     leaseOwner,
     leaseExpiresAt: leaseExpiresAt2,
-    reconcileAttempts: sql17`${adsOperations.reconcileAttempts} + 1`,
+    reconcileAttempts: sql18`${adsOperations.reconcileAttempts} + 1`,
     updatedAt: nowIso
   }).where(and40(
     eq47(adsOperations.id, row.id),
@@ -51931,28 +52459,28 @@ async function sweepAdsOperationsOnce(app, opts, config) {
       );
     }
   );
-  const retryableStateWhere = or10(
+  const retryableStateWhere = or11(
     and40(
       eq47(adsOperations.state, AdsOperationStates.pending),
       lte11(adsOperations.updatedAt, pendingCutoff)
     ),
     and40(
       eq47(adsOperations.state, AdsOperationStates.unknown),
-      or10(...unknownRetryWindows)
+      or11(...unknownRetryWindows)
     ),
     and40(
       eq47(adsOperations.state, AdsOperationStates.reconciling),
-      or10(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
+      or11(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
     )
   );
   const staleReconcileWhere = and40(
     lt7(adsOperations.reconcileAttempts, config.policy.maxAttempts),
     ne7(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
-    or10(
+    or11(
       eq47(adsOperations.reconcileStrategy, AdsReconcileStrategies.known_entity),
       and40(
         eq47(adsOperations.reconcileStrategy, AdsReconcileStrategies.create_fingerprint),
-        or10(
+        or11(
           isNotNull4(adsOperations.entityId),
           inArray20(adsOperations.state, [
             AdsOperationStates.pending,
@@ -51966,7 +52494,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
   const exhaustedRows = app.db.select().from(adsOperations).where(and40(
     ne7(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
     gte12(adsOperations.reconcileAttempts, config.policy.maxAttempts),
-    or10(
+    or11(
       and40(
         eq47(adsOperations.state, AdsOperationStates.pending),
         lte11(adsOperations.updatedAt, pendingCutoff)
@@ -51974,10 +52502,10 @@ async function sweepAdsOperationsOnce(app, opts, config) {
       eq47(adsOperations.state, AdsOperationStates.unknown),
       and40(
         eq47(adsOperations.state, AdsOperationStates.reconciling),
-        or10(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
+        or11(isNull8(adsOperations.leaseExpiresAt), lte11(adsOperations.leaseExpiresAt, nowIso))
       )
     ),
-    or10(
+    or11(
       isNull8(adsOperations.errorCode),
       ne7(adsOperations.errorCode, ADS_RECONCILIATION_QUARANTINED)
     )
@@ -52325,7 +52853,7 @@ async function adsRoutes(app, opts) {
     const rows = app.db.select().from(adsOperations).where(and40(
       eq47(adsOperations.projectId, project.id),
       inArray20(adsOperations.state, parsed.data.state),
-      cursor ? or10(
+      cursor ? or11(
         gt3(adsOperations.createdAt, cursor.createdAt),
         and40(
           eq47(adsOperations.createdAt, cursor.createdAt),
@@ -54214,7 +54742,7 @@ async function cdpRoutes(app, opts) {
 
 // ../api-routes/src/ga.ts
 import crypto39 from "crypto";
-import { eq as eq50, desc as desc23, and as and43, sql as sql18 } from "drizzle-orm";
+import { eq as eq50, desc as desc23, and as and43, sql as sql19 } from "drizzle-orm";
 
 // ../api-routes/src/ga-session-history.ts
 function buildSessionHistory(landingPageDays, dailyTotals) {
@@ -54247,8 +54775,8 @@ function formatSharePct(numerator, total) {
 }
 function dateRangeConditions(column, range) {
   const conditions = [];
-  if (range.startDate) conditions.push(sql18`${column} >= ${range.startDate}`);
-  if (range.endDate) conditions.push(sql18`${column} <= ${range.endDate}`);
+  if (range.startDate) conditions.push(sql19`${column} >= ${range.startDate}`);
+  if (range.endDate) conditions.push(sql19`${column} <= ${range.endDate}`);
   return conditions;
 }
 var SOCIAL_CHANNEL_GROUPS2 = /* @__PURE__ */ new Set(["Organic Social", "Paid Social"]);
@@ -54308,8 +54836,8 @@ function persistAcquisitionMeasurement(db, input) {
   db.transaction((tx) => {
     tx.delete(gaAcquisitionDaily).where(and43(
       eq50(gaAcquisitionDaily.projectId, input.projectId),
-      sql18`${gaAcquisitionDaily.date} >= ${startDate}`,
-      sql18`${gaAcquisitionDaily.date} <= ${endDate}`
+      sql19`${gaAcquisitionDaily.date} >= ${startDate}`,
+      sql19`${gaAcquisitionDaily.date} <= ${endDate}`
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaAcquisitionDaily).values({
@@ -54350,8 +54878,8 @@ function persistLeadMeasurement(db, input) {
   db.transaction((tx) => {
     tx.delete(gaLeadEventsDaily).where(and43(
       eq50(gaLeadEventsDaily.projectId, input.projectId),
-      sql18`${gaLeadEventsDaily.date} >= ${startDate}`,
-      sql18`${gaLeadEventsDaily.date} <= ${endDate}`
+      sql19`${gaLeadEventsDaily.date} >= ${startDate}`,
+      sql19`${gaLeadEventsDaily.date} <= ${endDate}`
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaLeadEventsDaily).values({
@@ -54726,8 +55254,8 @@ async function ga4Routes(app, opts) {
           tx.delete(gaTrafficSnapshots).where(
             and43(
               eq50(gaTrafficSnapshots.projectId, project.id),
-              sql18`${gaTrafficSnapshots.date} >= ${summary2.periodStart}`,
-              sql18`${gaTrafficSnapshots.date} <= ${summary2.periodEnd}`
+              sql19`${gaTrafficSnapshots.date} >= ${summary2.periodStart}`,
+              sql19`${gaTrafficSnapshots.date} <= ${summary2.periodEnd}`
             )
           ).run();
           for (const row of rows) {
@@ -54749,8 +55277,8 @@ async function ga4Routes(app, opts) {
         tx.delete(gaDailyTotals).where(
           and43(
             eq50(gaDailyTotals.projectId, project.id),
-            sql18`${gaDailyTotals.date} >= ${summary2.periodStart}`,
-            sql18`${gaDailyTotals.date} <= ${summary2.periodEnd}`
+            sql19`${gaDailyTotals.date} >= ${summary2.periodStart}`,
+            sql19`${gaDailyTotals.date} <= ${summary2.periodEnd}`
           )
         ).run();
         for (const row of dailyTotals) {
@@ -54775,8 +55303,8 @@ async function ga4Routes(app, opts) {
           tx.delete(gaAiReferrals).where(
             and43(
               eq50(gaAiReferrals.projectId, project.id),
-              sql18`${gaAiReferrals.date} >= ${summary2.periodStart}`,
-              sql18`${gaAiReferrals.date} <= ${summary2.periodEnd}`
+              sql19`${gaAiReferrals.date} >= ${summary2.periodStart}`,
+              sql19`${gaAiReferrals.date} <= ${summary2.periodEnd}`
             )
           ).run();
           for (const row of aiReferrals) {
@@ -54807,8 +55335,8 @@ async function ga4Routes(app, opts) {
           tx.delete(gaSocialReferrals).where(
             and43(
               eq50(gaSocialReferrals.projectId, project.id),
-              sql18`${gaSocialReferrals.date} >= ${summary2.periodStart}`,
-              sql18`${gaSocialReferrals.date} <= ${summary2.periodEnd}`
+              sql19`${gaSocialReferrals.date} >= ${summary2.periodStart}`,
+              sql19`${gaSocialReferrals.date} <= ${summary2.periodEnd}`
             )
           ).run();
           for (const row of socialReferrals) {
@@ -54990,9 +55518,9 @@ async function ga4Routes(app, opts) {
       totalUsers: gaTrafficSummaries.totalUsers
     }).from(gaTrafficSummaries).where(eq50(gaTrafficSummaries.projectId, project.id)).get();
     const retainedBounds = [
-      app.db.select({ min: sql18`MIN(${gaTrafficSnapshots.date})`, max: sql18`MAX(${gaTrafficSnapshots.date})` }).from(gaTrafficSnapshots).where(eq50(gaTrafficSnapshots.projectId, project.id)).get(),
-      app.db.select({ min: sql18`MIN(${gaAiReferrals.date})`, max: sql18`MAX(${gaAiReferrals.date})` }).from(gaAiReferrals).where(eq50(gaAiReferrals.projectId, project.id)).get(),
-      app.db.select({ min: sql18`MIN(${gaSocialReferrals.date})`, max: sql18`MAX(${gaSocialReferrals.date})` }).from(gaSocialReferrals).where(eq50(gaSocialReferrals.projectId, project.id)).get()
+      app.db.select({ min: sql19`MIN(${gaTrafficSnapshots.date})`, max: sql19`MAX(${gaTrafficSnapshots.date})` }).from(gaTrafficSnapshots).where(eq50(gaTrafficSnapshots.projectId, project.id)).get(),
+      app.db.select({ min: sql19`MIN(${gaAiReferrals.date})`, max: sql19`MAX(${gaAiReferrals.date})` }).from(gaAiReferrals).where(eq50(gaAiReferrals.projectId, project.id)).get(),
+      app.db.select({ min: sql19`MIN(${gaSocialReferrals.date})`, max: sql19`MAX(${gaSocialReferrals.date})` }).from(gaSocialReferrals).where(eq50(gaSocialReferrals.projectId, project.id)).get()
     ];
     const retainedDates = retainedBounds.flatMap((bound) => [bound?.min, bound?.max]).filter((date) => Boolean(date));
     const projectSummaryCoversAll = Boolean(
@@ -55006,9 +55534,9 @@ async function ga4Routes(app, opts) {
     const socialConditions = [eq50(gaSocialReferrals.projectId, project.id), ...dateRangeConditions(gaSocialReferrals.date, measuredRange)];
     const snapshotTotalsRow = !denominatorRow ? (() => {
       const summed = app.db.select({
-        totalSessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)`,
-        totalOrganicSessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)`,
-        totalUsers: sql18`COALESCE(SUM(${gaTrafficSnapshots.users}), 0)`
+        totalSessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)`,
+        totalOrganicSessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)`,
+        totalUsers: sql19`COALESCE(SUM(${gaTrafficSnapshots.users}), 0)`
       }).from(gaTrafficSnapshots).where(and43(...snapshotConditions)).get();
       return {
         totalSessions: summed?.totalSessions ?? 0,
@@ -55021,35 +55549,35 @@ async function ga4Routes(app, opts) {
     })() : null;
     const summaryRow = denominatorRow ?? snapshotTotalsRow;
     const directTotalRow = windowSummaryRow ? { totalDirectSessions: windowSummaryRow.totalDirectSessions } : app.db.select({
-      totalDirectSessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`
+      totalDirectSessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`
     }).from(gaTrafficSnapshots).where(and43(...snapshotConditions)).get();
     const rows = app.db.select({
-      landingPage: sql18`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`,
-      sessions: sql18`SUM(${gaTrafficSnapshots.sessions})`,
-      organicSessions: sql18`SUM(${gaTrafficSnapshots.organicSessions})`,
-      directSessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`,
-      users: sql18`SUM(${gaTrafficSnapshots.users})`
-    }).from(gaTrafficSnapshots).where(and43(...snapshotConditions)).groupBy(sql18`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql18`SUM(${gaTrafficSnapshots.sessions}) DESC`).limit(limit).all();
+      landingPage: sql19`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`,
+      sessions: sql19`SUM(${gaTrafficSnapshots.sessions})`,
+      organicSessions: sql19`SUM(${gaTrafficSnapshots.organicSessions})`,
+      directSessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`,
+      users: sql19`SUM(${gaTrafficSnapshots.users})`
+    }).from(gaTrafficSnapshots).where(and43(...snapshotConditions)).groupBy(sql19`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql19`SUM(${gaTrafficSnapshots.sessions}) DESC`).limit(limit).all();
     const aiReferralRows = app.db.select({
       source: gaAiReferrals.source,
       medium: gaAiReferrals.medium,
       trafficClass: gaAiReferrals.trafficClass,
       sourceDimension: gaAiReferrals.sourceDimension,
-      sessions: sql18`SUM(${gaAiReferrals.sessions})`
+      sessions: sql19`SUM(${gaAiReferrals.sessions})`
     }).from(gaAiReferrals).where(and43(...aiConditions)).groupBy(gaAiReferrals.source, gaAiReferrals.medium, gaAiReferrals.trafficClass, gaAiReferrals.sourceDimension).all();
     const aiReferralLandingPageRows = app.db.select({
       source: gaAiReferrals.source,
       medium: gaAiReferrals.medium,
       trafficClass: gaAiReferrals.trafficClass,
       sourceDimension: gaAiReferrals.sourceDimension,
-      landingPage: sql18`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`,
-      sessions: sql18`SUM(${gaAiReferrals.sessions})`
+      landingPage: sql19`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`,
+      sessions: sql19`SUM(${gaAiReferrals.sessions})`
     }).from(gaAiReferrals).where(and43(...aiConditions)).groupBy(
       gaAiReferrals.source,
       gaAiReferrals.medium,
       gaAiReferrals.trafficClass,
       gaAiReferrals.sourceDimension,
-      sql18`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`
+      sql19`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`
     ).all();
     const aiRowsForTotals = app.db.select({
       date: gaAiReferrals.date,
@@ -55075,10 +55603,10 @@ async function ga4Routes(app, opts) {
       // is GA's COUNT DISTINCT at that grain, so summing over the window's
       // dates counts a returning visitor once per day they returned. Same
       // conclusion the AI-referral surfaces reached in 4.135.0.
-      sessions: sql18`SUM(${gaSocialReferrals.sessions})`
-    }).from(gaSocialReferrals).where(and43(...socialConditions)).groupBy(gaSocialReferrals.source, gaSocialReferrals.medium, gaSocialReferrals.channelGroup).orderBy(sql18`SUM(${gaSocialReferrals.sessions}) DESC`).all();
+      sessions: sql19`SUM(${gaSocialReferrals.sessions})`
+    }).from(gaSocialReferrals).where(and43(...socialConditions)).groupBy(gaSocialReferrals.source, gaSocialReferrals.medium, gaSocialReferrals.channelGroup).orderBy(sql19`SUM(${gaSocialReferrals.sessions}) DESC`).all();
     const socialTotals = app.db.select({
-      sessions: sql18`SUM(${gaSocialReferrals.sessions})`
+      sessions: sql19`SUM(${gaSocialReferrals.sessions})`
     }).from(gaSocialReferrals).where(and43(...socialConditions)).get();
     const latestSync = app.db.select({ syncedAt: gaTrafficSummaries.syncedAt }).from(gaTrafficSummaries).where(eq50(gaTrafficSummaries.projectId, project.id)).orderBy(desc23(gaTrafficSummaries.syncedAt)).limit(1).get();
     const total = summaryRow?.totalSessions ?? 0;
@@ -55193,20 +55721,20 @@ async function ga4Routes(app, opts) {
       source: gaAiReferrals.source,
       medium: gaAiReferrals.medium,
       trafficClass: gaAiReferrals.trafficClass,
-      landingPage: sql18`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`,
+      landingPage: sql19`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`,
       sourceDimension: gaAiReferrals.sourceDimension,
       // No `users`: ga-ai-referral-aggregation states the rule for this
       // table, that there is no grain at which the stored users column may be
       // added up. ga4AiReferralDtoSchema.users was deprecated for this in
       // 4.135.0; the history endpoint kept emitting one.
-      sessions: sql18`SUM(${gaAiReferrals.sessions})`
+      sessions: sql19`SUM(${gaAiReferrals.sessions})`
     }).from(gaAiReferrals).where(and43(...conditions)).groupBy(
       gaAiReferrals.date,
       gaAiReferrals.source,
       gaAiReferrals.medium,
       gaAiReferrals.trafficClass,
       gaAiReferrals.sourceDimension,
-      sql18`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`
+      sql19`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`
     ).orderBy(gaAiReferrals.date).all();
     return rows;
   });
@@ -55251,10 +55779,10 @@ async function ga4Routes(app, opts) {
       d.setDate(d.getDate() - n);
       return fmt(d);
     };
-    const sumSocial = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and43(
+    const sumSocial = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and43(
       eq50(gaSocialReferrals.projectId, project.id),
-      sql18`${gaSocialReferrals.date} >= ${from}`,
-      sql18`${gaSocialReferrals.date} < ${to}`
+      sql19`${gaSocialReferrals.date} >= ${from}`,
+      sql19`${gaSocialReferrals.date} < ${to}`
     )).get();
     const current7d = sumSocial(daysAgo(7), fmt(today));
     const prev7d = sumSocial(daysAgo(14), daysAgo(7));
@@ -55262,19 +55790,19 @@ async function ga4Routes(app, opts) {
     const prev30d = sumSocial(daysAgo(60), daysAgo(30));
     const sourceCurrent = app.db.select({
       source: gaSocialReferrals.source,
-      sessions: sql18`SUM(${gaSocialReferrals.sessions})`
+      sessions: sql19`SUM(${gaSocialReferrals.sessions})`
     }).from(gaSocialReferrals).where(and43(
       eq50(gaSocialReferrals.projectId, project.id),
-      sql18`${gaSocialReferrals.date} >= ${daysAgo(7)}`,
-      sql18`${gaSocialReferrals.date} < ${fmt(today)}`
+      sql19`${gaSocialReferrals.date} >= ${daysAgo(7)}`,
+      sql19`${gaSocialReferrals.date} < ${fmt(today)}`
     )).groupBy(gaSocialReferrals.source).all();
     const sourcePrev = app.db.select({
       source: gaSocialReferrals.source,
-      sessions: sql18`SUM(${gaSocialReferrals.sessions})`
+      sessions: sql19`SUM(${gaSocialReferrals.sessions})`
     }).from(gaSocialReferrals).where(and43(
       eq50(gaSocialReferrals.projectId, project.id),
-      sql18`${gaSocialReferrals.date} >= ${daysAgo(14)}`,
-      sql18`${gaSocialReferrals.date} < ${daysAgo(7)}`
+      sql19`${gaSocialReferrals.date} >= ${daysAgo(14)}`,
+      sql19`${gaSocialReferrals.date} < ${daysAgo(7)}`
     )).groupBy(gaSocialReferrals.source).all();
     const prevMap = new Map(sourcePrev.map((r) => [r.source, r.sessions]));
     let biggestMover = null;
@@ -55312,16 +55840,16 @@ async function ga4Routes(app, opts) {
       d.setDate(d.getDate() - n);
       return fmt(d);
     };
-    const sumTotal = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql18`${gaTrafficSnapshots.date} >= ${from}`, sql18`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumOrganic = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql18`${gaTrafficSnapshots.date} >= ${from}`, sql18`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumDirect = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql18`${gaTrafficSnapshots.date} >= ${from}`, sql18`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumAi = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
+    const sumTotal = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql19`${gaTrafficSnapshots.date} >= ${from}`, sql19`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumOrganic = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql19`${gaTrafficSnapshots.date} >= ${from}`, sql19`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumDirect = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)` }).from(gaTrafficSnapshots).where(and43(eq50(gaTrafficSnapshots.projectId, project.id), sql19`${gaTrafficSnapshots.date} >= ${from}`, sql19`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumAi = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
       eq50(gaAiReferrals.projectId, project.id),
-      sql18`${gaAiReferrals.date} >= ${from}`,
-      sql18`${gaAiReferrals.date} < ${to}`,
+      sql19`${gaAiReferrals.date} >= ${from}`,
+      sql19`${gaAiReferrals.date} < ${to}`,
       eq50(gaAiReferrals.sourceDimension, "session")
     )).get();
-    const sumSocial = (from, to) => app.db.select({ sessions: sql18`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql18`${gaSocialReferrals.date} >= ${from}`, sql18`${gaSocialReferrals.date} < ${to}`)).get();
+    const sumSocial = (from, to) => app.db.select({ sessions: sql19`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql19`${gaSocialReferrals.date} >= ${from}`, sql19`${gaSocialReferrals.date} < ${to}`)).get();
     const todayStr = fmt(today);
     const buildTrend = (sum) => {
       const c7 = sum(daysAgo(7), todayStr)?.sessions ?? 0;
@@ -55330,16 +55858,16 @@ async function ga4Routes(app, opts) {
       const p30 = sum(daysAgo(60), daysAgo(30))?.sessions ?? 0;
       return { sessions7d: c7, sessionsPrev7d: p7, trend7dPct: deltaPercent(c7, p7), sessions30d: c30, sessionsPrev30d: p30, trend30dPct: deltaPercent(c30, p30) };
     };
-    const aiSourceCurrent = app.db.select({ source: gaAiReferrals.source, sessions: sql18`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
+    const aiSourceCurrent = app.db.select({ source: gaAiReferrals.source, sessions: sql19`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
       eq50(gaAiReferrals.projectId, project.id),
-      sql18`${gaAiReferrals.date} >= ${daysAgo(7)}`,
-      sql18`${gaAiReferrals.date} < ${todayStr}`,
+      sql19`${gaAiReferrals.date} >= ${daysAgo(7)}`,
+      sql19`${gaAiReferrals.date} < ${todayStr}`,
       eq50(gaAiReferrals.sourceDimension, "session")
     )).groupBy(gaAiReferrals.source).all();
-    const aiSourcePrev = app.db.select({ source: gaAiReferrals.source, sessions: sql18`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
+    const aiSourcePrev = app.db.select({ source: gaAiReferrals.source, sessions: sql19`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and43(
       eq50(gaAiReferrals.projectId, project.id),
-      sql18`${gaAiReferrals.date} >= ${daysAgo(14)}`,
-      sql18`${gaAiReferrals.date} < ${daysAgo(7)}`,
+      sql19`${gaAiReferrals.date} >= ${daysAgo(14)}`,
+      sql19`${gaAiReferrals.date} < ${daysAgo(7)}`,
       eq50(gaAiReferrals.sourceDimension, "session")
     )).groupBy(gaAiReferrals.source).all();
     const findBiggestMover = (current, prev) => {
@@ -55356,8 +55884,8 @@ async function ga4Routes(app, opts) {
       }
       return mover;
     };
-    const socialSourceCurrent = app.db.select({ source: gaSocialReferrals.source, sessions: sql18`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql18`${gaSocialReferrals.date} >= ${daysAgo(7)}`, sql18`${gaSocialReferrals.date} < ${todayStr}`)).groupBy(gaSocialReferrals.source).all();
-    const socialSourcePrev = app.db.select({ source: gaSocialReferrals.source, sessions: sql18`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql18`${gaSocialReferrals.date} >= ${daysAgo(14)}`, sql18`${gaSocialReferrals.date} < ${daysAgo(7)}`)).groupBy(gaSocialReferrals.source).all();
+    const socialSourceCurrent = app.db.select({ source: gaSocialReferrals.source, sessions: sql19`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql19`${gaSocialReferrals.date} >= ${daysAgo(7)}`, sql19`${gaSocialReferrals.date} < ${todayStr}`)).groupBy(gaSocialReferrals.source).all();
+    const socialSourcePrev = app.db.select({ source: gaSocialReferrals.source, sessions: sql19`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and43(eq50(gaSocialReferrals.projectId, project.id), sql19`${gaSocialReferrals.date} >= ${daysAgo(14)}`, sql19`${gaSocialReferrals.date} < ${daysAgo(7)}`)).groupBy(gaSocialReferrals.source).all();
     return {
       total: buildTrend(sumTotal),
       organic: buildTrend(sumOrganic),
@@ -55375,9 +55903,9 @@ async function ga4Routes(app, opts) {
     const conditions = [eq50(gaTrafficSnapshots.projectId, project.id), ...dateRangeConditions(gaTrafficSnapshots.date, range)];
     const rows = app.db.select({
       date: gaTrafficSnapshots.date,
-      sessions: sql18`SUM(${gaTrafficSnapshots.sessions})`,
-      organicSessions: sql18`SUM(${gaTrafficSnapshots.organicSessions})`,
-      users: sql18`SUM(${gaTrafficSnapshots.users})`
+      sessions: sql19`SUM(${gaTrafficSnapshots.sessions})`,
+      organicSessions: sql19`SUM(${gaTrafficSnapshots.organicSessions})`,
+      users: sql19`SUM(${gaTrafficSnapshots.users})`
     }).from(gaTrafficSnapshots).where(and43(...conditions)).groupBy(gaTrafficSnapshots.date).orderBy(gaTrafficSnapshots.date).all();
     const totalConditions = [eq50(gaDailyTotals.projectId, project.id), ...dateRangeConditions(gaDailyTotals.date, range)];
     const totals = app.db.select({ date: gaDailyTotals.date, users: gaDailyTotals.users }).from(gaDailyTotals).where(and43(...totalConditions)).all();
@@ -55395,11 +55923,11 @@ async function ga4Routes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     requireGa4Connection(opts, project.name, project.canonicalDomain);
     const trafficPages = app.db.select({
-      landingPage: sql18`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`,
-      sessions: sql18`SUM(${gaTrafficSnapshots.sessions})`,
-      organicSessions: sql18`SUM(${gaTrafficSnapshots.organicSessions})`,
-      users: sql18`SUM(${gaTrafficSnapshots.users})`
-    }).from(gaTrafficSnapshots).where(eq50(gaTrafficSnapshots.projectId, project.id)).groupBy(sql18`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql18`SUM(${gaTrafficSnapshots.sessions}) DESC`).all();
+      landingPage: sql19`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`,
+      sessions: sql19`SUM(${gaTrafficSnapshots.sessions})`,
+      organicSessions: sql19`SUM(${gaTrafficSnapshots.organicSessions})`,
+      users: sql19`SUM(${gaTrafficSnapshots.users})`
+    }).from(gaTrafficSnapshots).where(eq50(gaTrafficSnapshots.projectId, project.id)).groupBy(sql19`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql19`SUM(${gaTrafficSnapshots.sessions}) DESC`).all();
     return {
       pages: trafficPages.map((r) => ({
         landingPage: r.landingPage,
@@ -57054,7 +57582,7 @@ async function wordpressRoutes(app, opts) {
 
 // ../api-routes/src/backlinks.ts
 import crypto41 from "crypto";
-import { and as and45, asc as asc10, desc as desc24, eq as eq51, sql as sql19 } from "drizzle-orm";
+import { and as and45, asc as asc10, desc as desc24, eq as eq51, sql as sql20 } from "drizzle-orm";
 
 // ../integration-commoncrawl/src/constants.ts
 import os2 from "os";
@@ -57151,7 +57679,7 @@ function parseContentLength(value) {
 }
 
 // ../integration-commoncrawl/src/downloader.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { createWriteStream } from "fs";
 import fs2 from "fs/promises";
 import path3 from "path";
@@ -57177,7 +57705,7 @@ async function downloadFile(opts) {
     throw new Error(`HTTP ${res.status} ${res.statusText} for ${opts.url}`);
   }
   const total = parseContentLength2(res.headers.get("content-length"));
-  const hasher = createHash5("sha256");
+  const hasher = createHash6("sha256");
   let bytes = 0;
   const hashAndCount = new Transform({
     transform(chunk, _enc, cb) {
@@ -57198,7 +57726,7 @@ async function downloadFile(opts) {
   return { bytes, sha256: sha2564, cached: false, elapsedMs: Date.now() - start };
 }
 async function hashFile(filePath) {
-  const hasher = createHash5("sha256");
+  const hasher = createHash6("sha256");
   const handle = await fs2.open(filePath, "r");
   try {
     const stream = handle.createReadStream();
@@ -57344,7 +57872,7 @@ async function queryBacklinks(opts) {
   const reversed = opts.targets.map(reverseDomain);
   const targetList = reversed.map(quote).join(", ");
   const limitClause = opts.limitPerTarget ? `QUALIFY row_number() OVER (PARTITION BY t.target_rev_domain ORDER BY v.num_hosts DESC) <= ${Math.floor(opts.limitPerTarget)}` : "";
-  const sql27 = `
+  const sql28 = `
     WITH vertices AS (
       SELECT * FROM read_csv(
         ${quote(opts.vertexPath)},
@@ -57380,7 +57908,7 @@ async function queryBacklinks(opts) {
   const conn = await instance.connect();
   let rows;
   try {
-    const reader = await conn.runAndReadAll(sql27);
+    const reader = await conn.runAndReadAll(sql28);
     rows = reader.getRowObjects();
   } finally {
     conn.disconnectSync?.();
@@ -57570,12 +58098,12 @@ function computeFilteredSummary(db, base) {
   );
   const filteredCondition = and45(baseDomainCondition, backlinkCrawlerExclusionClause());
   const unfilteredAgg = db.select({
-    count: sql19`count(*)`,
-    total: sql19`coalesce(sum(${backlinkDomains.numHosts}), 0)`
+    count: sql20`count(*)`,
+    total: sql20`coalesce(sum(${backlinkDomains.numHosts}), 0)`
   }).from(backlinkDomains).where(baseDomainCondition).get();
   const filteredAgg = db.select({
-    count: sql19`count(*)`,
-    total: sql19`coalesce(sum(${backlinkDomains.numHosts}), 0)`
+    count: sql20`count(*)`,
+    total: sql20`coalesce(sum(${backlinkDomains.numHosts}), 0)`
   }).from(backlinkDomains).where(filteredCondition).get();
   const top10Rows = db.select({ numHosts: backlinkDomains.numHosts }).from(backlinkDomains).where(filteredCondition).orderBy(desc24(backlinkDomains.numHosts)).limit(10).all();
   const totalLinkingDomains = Number(filteredAgg?.count ?? 0);
@@ -57601,7 +58129,7 @@ function buildSourceAvailability(db, projectId, source, connected, excludeCrawle
   const summary2 = db.select().from(backlinkSummaries).where(and45(eq51(backlinkSummaries.projectId, projectId), eq51(backlinkSummaries.source, source))).orderBy(desc24(backlinkSummaries.queriedAt)).limit(1).get();
   let totalLinkingDomains = summary2?.totalLinkingDomains ?? 0;
   if (summary2 && excludeCrawlers) {
-    const filtered = db.select({ count: sql19`count(*)` }).from(backlinkDomains).where(and45(
+    const filtered = db.select({ count: sql20`count(*)` }).from(backlinkDomains).where(and45(
       eq51(backlinkDomains.projectId, projectId),
       eq51(backlinkDomains.source, source),
       eq51(backlinkDomains.release, summary2.release),
@@ -57789,7 +58317,7 @@ async function backlinksRoutes(app, opts) {
       eq51(backlinkDomains.release, targetRelease)
     );
     const domainCondition = excludeCrawlers ? and45(baseDomainCondition, backlinkCrawlerExclusionClause()) : baseDomainCondition;
-    const totalRow = app.db.select({ count: sql19`count(*)` }).from(backlinkDomains).where(domainCondition).get();
+    const totalRow = app.db.select({ count: sql20`count(*)` }).from(backlinkDomains).where(domainCondition).get();
     const rows = app.db.select({
       linkingDomain: backlinkDomains.linkingDomain,
       numHosts: backlinkDomains.numHosts,
@@ -57840,7 +58368,7 @@ import crypto44 from "crypto";
 import { isIP } from "net";
 import { isDeepStrictEqual } from "util";
 import { Agent as UndiciAgent } from "undici";
-import { and as and49, desc as desc25, eq as eq55, gte as gte14, inArray as inArray21, lte as lte14, sql as sql22 } from "drizzle-orm";
+import { and as and49, desc as desc25, eq as eq55, gte as gte14, inArray as inArray21, lte as lte14, sql as sql23 } from "drizzle-orm";
 
 // ../api-routes/src/cloudflare-worker-version.ts
 var CURRENT_CLOUDFLARE_WORKER_VERSION = "1.0.1";
@@ -71858,8 +72386,8 @@ var perplexitybot_default = {
 };
 
 // ../integration-traffic/src/ip-range-manifest.ts
-import { createHash as createHash6 } from "crypto";
-function isRecord(value) {
+import { createHash as createHash7 } from "crypto";
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stableJson2(value, seen2 = /* @__PURE__ */ new Set()) {
@@ -71928,7 +72456,7 @@ function parseCidr(cidr) {
   };
 }
 function canonicalPrefixKey(entry) {
-  if (isRecord(entry)) {
+  if (isRecord2(entry)) {
     const hasIpv4 = Object.hasOwn(entry, "ipv4Prefix");
     const hasIpv6 = Object.hasOwn(entry, "ipv6Prefix");
     if (hasIpv4 !== hasIpv6) {
@@ -71948,12 +72476,12 @@ function canonicalPrefixKey(entry) {
   return `invalid:${stableJson2(entry)}`;
 }
 function ipRangeManifestContentHash(value) {
-  const prefixes = isRecord(value) ? value.prefixes : void 0;
+  const prefixes = isRecord2(value) ? value.prefixes : void 0;
   const canonical = Array.isArray(prefixes) ? prefixes.map(canonicalPrefixKey).sort() : [`invalid-prefixes:${stableJson2(prefixes)}`];
-  return createHash6("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return createHash7("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function validateIpRangeManifestPayload(value) {
-  if (!isRecord(value)) return { ok: false, error: "response must be a JSON object" };
+  if (!isRecord2(value)) return { ok: false, error: "response must be a JSON object" };
   const creationTime = value.creationTime;
   if (typeof creationTime !== "string" || creationTime.trim().length === 0) {
     return { ok: false, error: "response missing `creationTime` version" };
@@ -71963,7 +72491,7 @@ function validateIpRangeManifestPayload(value) {
   }
   const prefixes = [];
   for (const [index2, entry] of value.prefixes.entries()) {
-    if (!isRecord(entry)) {
+    if (!isRecord2(entry)) {
       return { ok: false, error: `prefixes[${index2}] must be an object` };
     }
     const hasIpv4 = Object.hasOwn(entry, "ipv4Prefix");
@@ -72951,7 +73479,7 @@ function incrementBucket(map, key, fields) {
 }
 
 // ../integration-wordpress-traffic/src/client.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // ../integration-wordpress-traffic/src/normalize.ts
 function trimOrNull(value) {
@@ -73049,7 +73577,7 @@ async function readErrorBody2(response) {
   if (!text2) return void 0;
   return text2.length <= 500 ? text2 : `${text2.slice(0, 500)}... [truncated]`;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseRequestedBoundary(name, value) {
@@ -73069,7 +73597,7 @@ function parseRequestedWindow(options) {
   return { since, until };
 }
 function parseSiteMetadata(value) {
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord3(value)) return void 0;
   return {
     url: typeof value.url === "string" ? value.url : void 0,
     anonymous_id: typeof value.anonymous_id === "string" ? value.anonymous_id : void 0,
@@ -73084,7 +73612,7 @@ function invalidResponse(message) {
   );
 }
 function parseResponseBody(value) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     throw invalidResponse("expected an object body");
   }
   if (!Array.isArray(value.events)) {
@@ -73117,7 +73645,7 @@ async function readResponseJson(response) {
 }
 function assertEntryIsWithinRequestedWindow(entry, window) {
   if (!window.since && !window.until) return;
-  const observedAt = isRecord2(entry) && typeof entry.observed_at === "string" ? entry.observed_at : void 0;
+  const observedAt = isRecord3(entry) && typeof entry.observed_at === "string" ? entry.observed_at : void 0;
   const observedAtMs = observedAt === void 0 ? Number.NaN : Date.parse(observedAt);
   const outsideWindow = !Number.isFinite(observedAtMs) || window.since !== void 0 && observedAtMs < window.since.timestampMs || window.until !== void 0 && observedAtMs >= window.until.timestampMs;
   if (!outsideWindow) return;
@@ -73153,7 +73681,7 @@ async function listWordpressTrafficEvents(options) {
     if (options.until !== void 0 && options.until !== "") {
       url.searchParams.set("until", options.until);
     }
-    url.searchParams.set("_cb", randomUUID2());
+    url.searchParams.set("_cb", randomUUID3());
     const fetchInit = {
       method: "GET",
       headers: {
@@ -73180,7 +73708,7 @@ async function listWordpressTrafficEvents(options) {
     rawEntryCount += entries.length;
     for (const entry of entries) {
       assertEntryIsWithinRequestedWindow(entry, requestedWindow);
-      if (!isRecord2(entry)) {
+      if (!isRecord3(entry)) {
         skippedEntryCount += 1;
         continue;
       }
@@ -74292,7 +74820,7 @@ function asRecord(value, label) {
   }
   return value;
 }
-function requiredString(record, key, label) {
+function requiredString2(record, key, label) {
   const value = record[key];
   if (typeof value !== "string" || !value.trim()) {
     throw new CloudflareQueueApiError(`Cloudflare Queue ${label} is malformed`, 502);
@@ -74366,12 +74894,12 @@ function safeMessageBase(record, leaseId) {
   };
 }
 function decodeMessage(record) {
-  const leaseId = requiredString(record, "lease_id", "message");
+  const leaseId = requiredString2(record, "lease_id", "message");
   let base;
   let rawBody;
   try {
     base = {
-      id: requiredString(record, "id", "message"),
+      id: requiredString2(record, "id", "message"),
       leaseId,
       timestampMs: nonNegativeInteger(record.timestamp_ms, "message timestamp_ms"),
       attempts: nonNegativeInteger(record.attempts, "message attempts"),
@@ -74511,10 +75039,10 @@ async function ackCloudflareQueueMessages(client, options) {
 
 // ../api-routes/src/traffic-event-ingest.ts
 import crypto43 from "crypto";
-import { and as and47, eq as eq53, gte as gte13, lt as lt9, lte as lte12, sql as sql21 } from "drizzle-orm";
+import { and as and47, eq as eq53, gte as gte13, lt as lt9, lte as lte12, sql as sql22 } from "drizzle-orm";
 
 // ../api-routes/src/raw-event-sample-retention.ts
-import { and as and46, eq as eq52, lt as lt8, sql as sql20 } from "drizzle-orm";
+import { and as and46, eq as eq52, lt as lt8, sql as sql21 } from "drizzle-orm";
 var RAW_EVENT_SAMPLE_RETENTION_MS = 30 * 24 * 60 * 6e4;
 var RAW_EVENT_SAMPLE_RETENTION_SWEEP_INTERVAL_MS = 24 * 60 * 6e4;
 var CANONICAL_UTC_TIMESTAMP_GLOB = "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9][0-9][0-9]Z";
@@ -74525,16 +75053,16 @@ function rawEventSampleRetentionCutoff(referenceAt) {
 }
 function deleteExpiredRawEventSamples(db, cutoff, sourceId) {
   const sourceScope = sourceId === void 0 ? void 0 : eq52(rawEventSamples.sourceId, sourceId);
-  db.delete(rawEventSamples).where(and46(sourceScope, sql20`julianday(${rawEventSamples.ts}) IS NULL`)).run();
+  db.delete(rawEventSamples).where(and46(sourceScope, sql21`julianday(${rawEventSamples.ts}) IS NULL`)).run();
   db.delete(rawEventSamples).where(and46(
     sourceScope,
-    sql20`${rawEventSamples.ts} GLOB ${CANONICAL_UTC_TIMESTAMP_GLOB}`,
+    sql21`${rawEventSamples.ts} GLOB ${CANONICAL_UTC_TIMESTAMP_GLOB}`,
     lt8(rawEventSamples.ts, cutoff)
   )).run();
   db.delete(rawEventSamples).where(and46(
     sourceScope,
-    sql20`${rawEventSamples.ts} NOT GLOB ${CANONICAL_UTC_TIMESTAMP_GLOB}`,
-    sql20`julianday(${rawEventSamples.ts}) < julianday(${cutoff})`
+    sql21`${rawEventSamples.ts} NOT GLOB ${CANONICAL_UTC_TIMESTAMP_GLOB}`,
+    sql21`julianday(${rawEventSamples.ts}) < julianday(${cutoff})`
   )).run();
 }
 function enforceRawEventSampleRetention(db, sourceId, referenceAt) {
@@ -74580,7 +75108,7 @@ function writeTrafficEventBatch(opts) {
   let aiReferralHits = 0;
   let unknownHits = 0;
   opts.db.transaction((tx) => {
-    tx.update(trafficSources).set({ updatedAt: sql21`${trafficSources.updatedAt}` }).where(eq53(trafficSources.id, opts.sourceId)).run();
+    tx.update(trafficSources).set({ updatedAt: sql22`${trafficSources.updatedAt}` }).where(eq53(trafficSources.id, opts.sourceId)).run();
     const source = tx.select().from(trafficSources).where(eq53(trafficSources.id, opts.sourceId)).get();
     opts.validateSource(source);
     const rawSampleCutoff = enforceRawEventSampleRetention(
@@ -74637,7 +75165,7 @@ function writeTrafficEventBatch(opts) {
             crawlerEventsHourly.status
           ],
           set: {
-            hits: sql21`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql22`${crawlerEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: opts.receivedAt
           }
@@ -74668,7 +75196,7 @@ function writeTrafficEventBatch(opts) {
               crawlerVerificationManifestsHourly.manifestId
             ],
             set: {
-              hits: sql21`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              hits: sql22`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
               manifestJson: bucket.verificationManifest,
               updatedAt: opts.receivedAt
             }
@@ -74702,7 +75230,7 @@ function writeTrafficEventBatch(opts) {
             aiUserFetchEventsHourly.status
           ],
           set: {
-            hits: sql21`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql22`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: opts.receivedAt
           }
@@ -74733,7 +75261,7 @@ function writeTrafficEventBatch(opts) {
               aiUserFetchVerificationManifestsHourly.manifestId
             ],
             set: {
-              hits: sql21`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              hits: sql22`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
               manifestJson: bucket.verificationManifest,
               updatedAt: opts.receivedAt
             }
@@ -74771,9 +75299,9 @@ function writeTrafficEventBatch(opts) {
             aiReferralEventsHourly.status
           ],
           set: {
-            sessionsOrHits: sql21`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
-            paidSessionsOrHits: sql21`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
-            organicSessionsOrHits: sql21`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+            sessionsOrHits: sql22`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+            paidSessionsOrHits: sql22`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+            organicSessionsOrHits: sql22`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
             updatedAt: opts.receivedAt
           }
         }).run();
@@ -74788,7 +75316,7 @@ function writeTrafficEventBatch(opts) {
         if (!hour || hourlySampleLimit === 0) continue;
         let remaining = remainingSamplesByHour.get(hour.start);
         if (remaining === void 0) {
-          const existing = tx.select({ total: sql21`COUNT(*)` }).from(rawEventSamples).where(and47(
+          const existing = tx.select({ total: sql22`COUNT(*)` }).from(rawEventSamples).where(and47(
             eq53(rawEventSamples.sourceId, opts.sourceId),
             gte13(rawEventSamples.ts, hour.start),
             lt9(rawEventSamples.ts, hour.end)
@@ -74848,7 +75376,7 @@ function writeTrafficEventBatch(opts) {
 }
 
 // ../api-routes/src/traffic-sync-lease.ts
-import { and as and48, eq as eq54, isNull as isNull9, lte as lte13, or as or11 } from "drizzle-orm";
+import { and as and48, eq as eq54, isNull as isNull9, lte as lte13, or as or12 } from "drizzle-orm";
 function leaseExpiresAt(now, ttlMs) {
   const nowMs = Date.parse(now);
   if (!Number.isFinite(nowMs)) throw new RangeError("Traffic sync lease now must be an ISO instant");
@@ -74863,7 +75391,7 @@ function tryClaimTrafficSyncLease(input) {
       syncLeaseExpiresAt: expiresAt
     }).where(and48(
       eq54(trafficSources.id, input.sourceId),
-      or11(
+      or12(
         isNull9(trafficSources.syncLeaseOwner),
         lte13(trafficSources.syncLeaseExpiresAt, input.now),
         eq54(trafficSources.syncLeaseOwner, input.owner)
@@ -75114,7 +75642,7 @@ function crawlerVerificationProvenance(db, projectId, events) {
     manifestId: crawlerVerificationManifestsHourly.manifestId,
     manifest: crawlerVerificationManifestsHourly.manifestJson,
     hits: crawlerVerificationManifestsHourly.hits
-  }).from(crawlerVerificationManifestsHourly).where(sql22`(
+  }).from(crawlerVerificationManifestsHourly).where(sql23`(
       ${crawlerVerificationManifestsHourly.projectId},
       ${crawlerVerificationManifestsHourly.sourceId},
       ${crawlerVerificationManifestsHourly.tsHour},
@@ -75148,7 +75676,7 @@ function aiUserFetchVerificationProvenance(db, projectId, events) {
     manifestId: aiUserFetchVerificationManifestsHourly.manifestId,
     manifest: aiUserFetchVerificationManifestsHourly.manifestJson,
     hits: aiUserFetchVerificationManifestsHourly.hits
-  }).from(aiUserFetchVerificationManifestsHourly).where(sql22`(
+  }).from(aiUserFetchVerificationManifestsHourly).where(sql23`(
       ${aiUserFetchVerificationManifestsHourly.projectId},
       ${aiUserFetchVerificationManifestsHourly.sourceId},
       ${aiUserFetchVerificationManifestsHourly.tsHour},
@@ -75412,7 +75940,7 @@ async function runBackfillTask(options) {
             crawlerEventsHourly.status
           ],
           set: {
-            hits: sql22`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql23`${crawlerEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -75443,7 +75971,7 @@ async function runBackfillTask(options) {
               crawlerVerificationManifestsHourly.manifestId
             ],
             set: {
-              hits: sql22`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              hits: sql23`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
               manifestJson: bucket.verificationManifest,
               updatedAt: finishedAt
             }
@@ -75476,7 +76004,7 @@ async function runBackfillTask(options) {
             aiUserFetchEventsHourly.status
           ],
           set: {
-            hits: sql22`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql23`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -75507,7 +76035,7 @@ async function runBackfillTask(options) {
               aiUserFetchVerificationManifestsHourly.manifestId
             ],
             set: {
-              hits: sql22`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              hits: sql23`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
               manifestJson: bucket.verificationManifest,
               updatedAt: finishedAt
             }
@@ -77111,7 +77639,7 @@ async function trafficRoutes(app, opts) {
               crawlerEventsHourly.status
             ],
             set: {
-              hits: sql22`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+              hits: sql23`${crawlerEventsHourly.hits} + ${bucket.hits}`,
               sampledUserAgent: bucket.sampledUserAgent,
               updatedAt: finishedAt
             }
@@ -77142,7 +77670,7 @@ async function trafficRoutes(app, opts) {
                 crawlerVerificationManifestsHourly.manifestId
               ],
               set: {
-                hits: sql22`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+                hits: sql23`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
                 manifestJson: bucket.verificationManifest,
                 updatedAt: finishedAt
               }
@@ -77176,7 +77704,7 @@ async function trafficRoutes(app, opts) {
               aiUserFetchEventsHourly.status
             ],
             set: {
-              hits: sql22`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+              hits: sql23`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
               sampledUserAgent: bucket.sampledUserAgent,
               updatedAt: finishedAt
             }
@@ -77207,7 +77735,7 @@ async function trafficRoutes(app, opts) {
                 aiUserFetchVerificationManifestsHourly.manifestId
               ],
               set: {
-                hits: sql22`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+                hits: sql23`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
                 manifestJson: bucket.verificationManifest,
                 updatedAt: finishedAt
               }
@@ -77248,9 +77776,9 @@ async function trafficRoutes(app, opts) {
             // colliding bucket adds its paid and organic arrivals to the ones
             // already there rather than overwriting a single label.
             set: {
-              sessionsOrHits: sql22`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
-              paidSessionsOrHits: sql22`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
-              organicSessionsOrHits: sql22`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+              sessionsOrHits: sql23`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+              paidSessionsOrHits: sql23`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+              organicSessionsOrHits: sql23`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
               updatedAt: finishedAt
             }
           }).run();
@@ -77543,7 +78071,7 @@ async function trafficRoutes(app, opts) {
   function buildSourceDetail(projectId, row, since) {
     const crawlerPathRows = app.db.select({
       pathNormalized: crawlerEventsHourly.pathNormalized,
-      hits: sql22`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+      hits: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
     }).from(crawlerEventsHourly).where(
       and49(
         eq55(crawlerEventsHourly.sourceId, row.id),
@@ -77554,23 +78082,23 @@ async function trafficRoutes(app, opts) {
       crawlerPathRows.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
     );
     const crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
-    const aiUserFetchTotals = app.db.select({ total: sql22`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+    const aiUserFetchTotals = app.db.select({ total: sql23`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
       and49(
         eq55(aiUserFetchEventsHourly.sourceId, row.id),
         gte14(aiUserFetchEventsHourly.tsHour, since)
       )
     ).get();
     const aiTotals = app.db.select({
-      total: sql22`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-      nonhop: sql22`COALESCE(SUM(CASE WHEN ${referralLandedCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
-      landed: sql22`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`
+      total: sql23`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+      nonhop: sql23`COALESCE(SUM(CASE WHEN ${referralLandedCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
+      landed: sql23`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`
     }).from(aiReferralEventsHourly).where(
       and49(
         eq55(aiReferralEventsHourly.sourceId, row.id),
         gte14(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
-    const sampleTotals = app.db.select({ total: sql22`COUNT(*)` }).from(rawEventSamples).where(
+    const sampleTotals = app.db.select({ total: sql23`COUNT(*)` }).from(rawEventSamples).where(
       and49(
         eq55(rawEventSamples.sourceId, row.id),
         gte14(rawEventSamples.ts, since)
@@ -77759,15 +78287,15 @@ async function trafficRoutes(app, opts) {
       const crawlerWhere = and49(...crawlerFilters);
       const pathTotals = app.db.select({
         pathNormalized: crawlerEventsHourly.pathNormalized,
-        hits: sql22`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
-        rows: sql22`COUNT(*)`
+        hits: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
+        rows: sql23`COUNT(*)`
       }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerEventsHourly.pathNormalized).all();
       crawlerSegments = segmentCrawlerHits(
         pathTotals.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
       );
       crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
       totalEventRows += pathTotals.reduce((sum, row) => sum + Number(row.rows), 0);
-      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql22`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
+      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql23`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
       const distinctPaths = pathTotals.map((r) => ({ pathNormalized: r.pathNormalized }));
       const contentPaths = [];
       const infraPaths = [];
@@ -77779,12 +78307,12 @@ async function trafficRoutes(app, opts) {
       const listed = useContentList ? contentPaths : infraPaths;
       const IN_LIST_CAP = 2e4;
       const listFitsInSql = listed.length <= IN_LIST_CAP;
-      const contentExpr = listed.length === 0 ? useContentList ? sql22`0` : sql22`${crawlerEventsHourly.hits}` : useContentList ? sql22`CASE WHEN ${inArray21(crawlerEventsHourly.pathNormalized, listed)} THEN ${crawlerEventsHourly.hits} ELSE 0 END` : sql22`CASE WHEN ${inArray21(crawlerEventsHourly.pathNormalized, listed)} THEN 0 ELSE ${crawlerEventsHourly.hits} END`;
+      const contentExpr = listed.length === 0 ? useContentList ? sql23`0` : sql23`${crawlerEventsHourly.hits}` : useContentList ? sql23`CASE WHEN ${inArray21(crawlerEventsHourly.pathNormalized, listed)} THEN ${crawlerEventsHourly.hits} ELSE 0 END` : sql23`CASE WHEN ${inArray21(crawlerEventsHourly.pathNormalized, listed)} THEN 0 ELSE ${crawlerEventsHourly.hits} END`;
       if (listFitsInSql) {
         const crawlerSeries = app.db.select({
           bucket: crawlerSeriesBucket,
-          hits: sql22`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
-          content: sql22`COALESCE(SUM(${contentExpr}), 0)`
+          hits: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
+          content: sql23`COALESCE(SUM(${contentExpr}), 0)`
         }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerSeriesBucket).all();
         for (const row of crawlerSeries) {
           const point = trafficSeriesPoint(seriesByBucket, String(row.bucket));
@@ -77796,7 +78324,7 @@ async function trafficRoutes(app, opts) {
         const grouped = app.db.select({
           bucket: crawlerSeriesBucket,
           pathNormalized: crawlerEventsHourly.pathNormalized,
-          hits: sql22`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+          hits: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
         }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerSeriesBucket, crawlerEventsHourly.pathNormalized).all();
         for (const row of grouped) {
           const point = trafficSeriesPoint(seriesByBucket, String(row.bucket));
@@ -77833,15 +78361,15 @@ async function trafficRoutes(app, opts) {
       if (sourceIdParam) userFetchFilters.push(eq55(aiUserFetchEventsHourly.sourceId, sourceIdParam));
       const userFetchWhere = and49(...userFetchFilters);
       const total = app.db.select({
-        total: sql22`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
-        rows: sql22`COUNT(*)`
+        total: sql23`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
+        rows: sql23`COUNT(*)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).get();
       aiUserFetchTotal = Number(total?.total ?? 0);
       totalEventRows += Number(total?.rows ?? 0);
-      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql22`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
+      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql23`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
       const userFetchSeries = app.db.select({
         bucket: userFetchSeriesBucket,
-        hits: sql22`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
+        hits: sql23`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).groupBy(userFetchSeriesBucket).all();
       for (const row of userFetchSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).aiUserFetchHits = Number(row.hits);
@@ -77872,12 +78400,12 @@ async function trafficRoutes(app, opts) {
       if (sourceIdParam) aiFilters.push(eq55(aiReferralEventsHourly.sourceId, sourceIdParam));
       const aiWhere = and49(...aiFilters);
       const total = app.db.select({
-        total: sql22`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-        nonhop: sql22`COALESCE(SUM(CASE WHEN ${referralLandedCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
-        landed: sql22`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
-        paid: sql22`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.paidSessionsOrHits} ELSE 0 END), 0)`,
-        organic: sql22`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.organicSessionsOrHits} ELSE 0 END), 0)`,
-        rows: sql22`COUNT(*)`
+        total: sql23`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+        nonhop: sql23`COALESCE(SUM(CASE WHEN ${referralLandedCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
+        landed: sql23`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`,
+        paid: sql23`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.paidSessionsOrHits} ELSE 0 END), 0)`,
+        organic: sql23`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.organicSessionsOrHits} ELSE 0 END), 0)`,
+        rows: sql23`COUNT(*)`
       }).from(aiReferralEventsHourly).where(aiWhere).get();
       aiReferralTotalHits = Number(total?.total ?? 0);
       aiReferralNonHopHits = Number(total?.nonhop ?? 0);
@@ -77888,11 +78416,11 @@ async function trafficRoutes(app, opts) {
         Number(total?.organic ?? 0)
       );
       totalEventRows += Number(total?.rows ?? 0);
-      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql22`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
+      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql23`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
       const referralSeries = app.db.select({
         bucket: referralSeriesBucket,
-        hits: sql22`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-        landed: sql22`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`
+        hits: sql23`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+        landed: sql23`COALESCE(SUM(CASE WHEN ${countableReferralCondition()} THEN ${aiReferralEventsHourly.sessionsOrHits} ELSE 0 END), 0)`
       }).from(aiReferralEventsHourly).where(aiWhere).groupBy(referralSeriesBucket).all();
       for (const row of referralSeries) {
         const point = trafficSeriesPoint(seriesByBucket, row.bucket);
@@ -77947,9 +78475,9 @@ async function trafficRoutes(app, opts) {
         const points = completeTrafficSeries(since, until, granularity, seriesByBucket);
         const coverageScope = (col, srcCol) => sourceIdParam ? and49(eq55(col, project.id), eq55(srcCol, sourceIdParam)) : eq55(col, project.id);
         const firsts = [
-          app.db.select({ v: sql22`MIN(${crawlerEventsHourly.tsHour})` }).from(crawlerEventsHourly).where(coverageScope(crawlerEventsHourly.projectId, crawlerEventsHourly.sourceId)).get()?.v,
-          app.db.select({ v: sql22`MIN(${aiUserFetchEventsHourly.tsHour})` }).from(aiUserFetchEventsHourly).where(coverageScope(aiUserFetchEventsHourly.projectId, aiUserFetchEventsHourly.sourceId)).get()?.v,
-          app.db.select({ v: sql22`MIN(${aiReferralEventsHourly.tsHour})` }).from(aiReferralEventsHourly).where(coverageScope(aiReferralEventsHourly.projectId, aiReferralEventsHourly.sourceId)).get()?.v
+          app.db.select({ v: sql23`MIN(${crawlerEventsHourly.tsHour})` }).from(crawlerEventsHourly).where(coverageScope(crawlerEventsHourly.projectId, crawlerEventsHourly.sourceId)).get()?.v,
+          app.db.select({ v: sql23`MIN(${aiUserFetchEventsHourly.tsHour})` }).from(aiUserFetchEventsHourly).where(coverageScope(aiUserFetchEventsHourly.projectId, aiUserFetchEventsHourly.sourceId)).get()?.v,
+          app.db.select({ v: sql23`MIN(${aiReferralEventsHourly.tsHour})` }).from(aiReferralEventsHourly).where(coverageScope(aiReferralEventsHourly.projectId, aiReferralEventsHourly.sourceId)).get()?.v
         ].filter((v) => typeof v === "string" && v.length > 0);
         const coverageStart = firsts.length ? firsts.slice().sort()[0] : null;
         const bucketStartMs = (bucket) => Date.parse(
@@ -79755,7 +80283,7 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and52, eq as eq61, gte as gte15, inArray as inArray22, ne as ne9, sql as sql23 } from "drizzle-orm";
+import { and as and52, eq as eq61, gte as gte15, inArray as inArray22, ne as ne9, sql as sql24 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function isCloudflareDirectPush(source) {
@@ -79900,7 +80428,7 @@ var recentDataCheck = {
     const warnCutoff = new Date(now.getTime() - RECENT_DATA_WARN_DAYS * 24 * 60 * 6e4).toISOString();
     const failCutoff = new Date(now.getTime() - RECENT_DATA_FAIL_DAYS * 24 * 60 * 6e4).toISOString();
     const recentCrawlers = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and52(
           eq61(crawlerEventsHourly.projectId, ctx.project.id),
           inArray22(crawlerEventsHourly.sourceId, activeSourceIds),
@@ -79909,7 +80437,7 @@ var recentDataCheck = {
       ).get()?.total ?? 0
     );
     const recentReferrals = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and52(
           eq61(aiReferralEventsHourly.projectId, ctx.project.id),
           inArray22(aiReferralEventsHourly.sourceId, activeSourceIds),
@@ -79918,7 +80446,7 @@ var recentDataCheck = {
       ).get()?.total ?? 0
     );
     const recentUserFetches = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
         and52(
           eq61(aiUserFetchEventsHourly.projectId, ctx.project.id),
           inArray22(aiUserFetchEventsHourly.sourceId, activeSourceIds),
@@ -79944,7 +80472,7 @@ var recentDataCheck = {
       };
     }
     const olderCrawlers = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and52(
           eq61(crawlerEventsHourly.projectId, ctx.project.id),
           inArray22(crawlerEventsHourly.sourceId, activeSourceIds),
@@ -79953,7 +80481,7 @@ var recentDataCheck = {
       ).get()?.total ?? 0
     );
     const olderReferrals = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and52(
           eq61(aiReferralEventsHourly.projectId, ctx.project.id),
           inArray22(aiReferralEventsHourly.sourceId, activeSourceIds),
@@ -79962,7 +80490,7 @@ var recentDataCheck = {
       ).get()?.total ?? 0
     );
     const olderUserFetches = Number(
-      ctx.db.select({ total: sql23`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+      ctx.db.select({ total: sql24`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
         and52(
           eq61(aiUserFetchEventsHourly.projectId, ctx.project.id),
           inArray22(aiUserFetchEventsHourly.sourceId, activeSourceIds),
@@ -80881,7 +81409,7 @@ async function doctorRoutes(app, opts) {
 
 // ../api-routes/src/discovery/routes.ts
 import crypto46 from "crypto";
-import { and as and53, desc as desc26, eq as eq62, gte as gte16, inArray as inArray23, isNull as isNull10, or as or12 } from "drizzle-orm";
+import { and as and53, desc as desc26, eq as eq62, gte as gte16, inArray as inArray23, isNull as isNull10, or as or13 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -80931,7 +81459,7 @@ async function discoveryRoutes(app, opts) {
         // locations a NULL row's subset is unknowable, so it conservatively
         // never reuses — a one-time, bounded (2h window) non-reuse after
         // upgrade, never a wrong reuse.
-        locations.length === 0 ? or12(isNull10(discoverySessions.locations), eq62(discoverySessions.locations, locations)) : eq62(discoverySessions.locations, locations),
+        locations.length === 0 ? or13(isNull10(discoverySessions.locations), eq62(discoverySessions.locations, locations)) : eq62(discoverySessions.locations, locations),
         // Seed provider set is identity: a different phrasing distribution
         // must never reuse another set's session. Null (= Gemini-only
         // default, including explicit ['gemini']) matches legacy rows.
@@ -81561,7 +82089,7 @@ function dedupeStrings(input) {
 
 // ../api-routes/src/technical-aeo.ts
 import crypto48 from "crypto";
-import { and as and54, asc as asc11, count as count2, desc as desc27, eq as eq64, inArray as inArray24, isNotNull as isNotNull5, isNull as isNull11, lt as lt10, or as or13, sql as sql24 } from "drizzle-orm";
+import { and as and54, asc as asc11, count as count2, desc as desc27, eq as eq64, inArray as inArray24, isNotNull as isNotNull5, isNull as isNull11, lt as lt10, or as or14, sql as sql25 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 var FETCHED_SITE_CRAWL_STATES = /* @__PURE__ */ new Set([
   ...SiteCrawlFetchedStates,
@@ -81780,7 +82308,7 @@ function linkKindFilter(linkKind) {
 }
 var graphSourceNode = alias(siteCrawlGraphNodes, "site_crawl_graph_source_node");
 var graphTargetNode = alias(siteCrawlGraphNodes, "site_crawl_graph_target_node");
-var PAGE_CHANGE_PREDICATE = sql24`(
+var PAGE_CHANGE_PREDICATE = sql25`(
   current.url IS NOT previous.url
   OR current.final_url IS NOT previous.final_url
   OR current.path IS NOT previous.path
@@ -81802,7 +82330,7 @@ var PAGE_CHANGE_PREDICATE = sql24`(
   OR current.link_score_raw IS NOT previous.link_score_raw
   OR current.link_score_normalized IS NOT previous.link_score_normalized
 )`;
-var LINK_CHANGE_PREDICATE = sql24`(
+var LINK_CHANGE_PREDICATE = sql25`(
   current.source_node_key IS NOT previous.source_node_key
   OR current.source_url IS NOT previous.source_url
   OR current.target_node_key IS NOT previous.target_node_key
@@ -82331,7 +82859,7 @@ async function technicalAeoRoutes(app, opts) {
         eq64(siteCrawlEdges.attemptId, scope.attemptId),
         eq64(siteCrawlEdges.internal, true),
         isNotNull5(siteCrawlEdges.targetNodeKey),
-        or13(
+        or14(
           inArray24(siteCrawlEdges.sourceNodeKey, frontier),
           inArray24(siteCrawlEdges.targetNodeKey, frontier)
         )
@@ -82578,7 +83106,7 @@ async function technicalAeoRoutes(app, opts) {
     if (request.query.toRunId && !afterTarget) throw notFound("Site crawl run", request.query.toRunId);
     const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq64(siteCrawlSnapshots.runId, runs.id)).where(and54(
       ...completeSnapshotFilters,
-      or13(
+      or14(
         lt10(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
         and54(
           eq64(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
@@ -82659,9 +83187,9 @@ async function technicalAeoRoutes(app, opts) {
       const summary3 = { pages: zero2(), links: zero2() };
       if (scopeFilter !== "links") {
         if (includeAdded || includeChanged) {
-          const addedExpression = includeAdded ? sql24`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql24`0`;
-          const changedExpression = includeChanged ? sql24`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${PAGE_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql24`0`;
-          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql24`
+          const addedExpression = includeAdded ? sql25`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql25`0`;
+          const changedExpression = includeChanged ? sql25`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${PAGE_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql25`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql25`
             SELECT ${addedExpression} AS added, ${changedExpression} AS changed
             FROM site_crawl_pages AS current
             LEFT JOIN site_crawl_pages AS previous
@@ -82677,7 +83205,7 @@ async function technicalAeoRoutes(app, opts) {
           summary3.pages.changed = Number(counts2.changed);
         }
         if (includeRemoved) {
-          const [counts2 = { removed: 0 }] = app.db.all(sql24`
+          const [counts2 = { removed: 0 }] = app.db.all(sql25`
             SELECT COUNT(*) AS removed
             FROM site_crawl_pages AS previous
             LEFT JOIN site_crawl_pages AS current
@@ -82695,9 +83223,9 @@ async function technicalAeoRoutes(app, opts) {
       }
       if (scopeFilter !== "pages") {
         if (includeAdded || includeChanged) {
-          const addedExpression = includeAdded ? sql24`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql24`0`;
-          const changedExpression = includeChanged ? sql24`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${LINK_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql24`0`;
-          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql24`
+          const addedExpression = includeAdded ? sql25`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql25`0`;
+          const changedExpression = includeChanged ? sql25`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${LINK_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql25`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql25`
             SELECT ${addedExpression} AS added, ${changedExpression} AS changed
             FROM site_crawl_edges AS current
             LEFT JOIN site_crawl_edges AS previous
@@ -82715,7 +83243,7 @@ async function technicalAeoRoutes(app, opts) {
           summary3.links.changed = Number(counts2.changed);
         }
         if (includeRemoved) {
-          const [counts2 = { removed: 0 }] = app.db.all(sql24`
+          const [counts2 = { removed: 0 }] = app.db.all(sql25`
             SELECT COUNT(*) AS removed
             FROM site_crawl_edges AS previous
             LEFT JOIN site_crawl_edges AS current
@@ -82745,48 +83273,48 @@ async function technicalAeoRoutes(app, opts) {
       const includeRemoved = changeFilter === "all" || changeFilter === "removed";
       const table = entity === "page" ? "site_crawl_pages" : "site_crawl_edges";
       const keyColumn = entity === "page" ? "node_key" : "edge_key";
-      const internalCurrent = entity === "link" ? sql24`AND current.internal = 1` : sql24``;
-      const internalPreviousJoin = entity === "link" ? sql24`AND previous.internal = 1` : sql24``;
-      const internalPrevious = entity === "link" ? sql24`AND previous.internal = 1` : sql24``;
-      const internalCurrentJoin = entity === "link" ? sql24`AND current.internal = 1` : sql24``;
+      const internalCurrent = entity === "link" ? sql25`AND current.internal = 1` : sql25``;
+      const internalPreviousJoin = entity === "link" ? sql25`AND previous.internal = 1` : sql25``;
+      const internalPrevious = entity === "link" ? sql25`AND previous.internal = 1` : sql25``;
+      const internalCurrentJoin = entity === "link" ? sql25`AND current.internal = 1` : sql25``;
       const difference2 = entity === "page" ? PAGE_CHANGE_PREDICATE : LINK_CHANGE_PREDICATE;
-      const afterKind = changeFilter === "added" ? sql24`previous.id IS NULL` : changeFilter === "changed" ? sql24`previous.id IS NOT NULL AND ${difference2}` : sql24`previous.id IS NULL OR (previous.id IS NOT NULL AND ${difference2})`;
-      const afterRows = includeAfter ? app.db.all(sql24`
+      const afterKind = changeFilter === "added" ? sql25`previous.id IS NULL` : changeFilter === "changed" ? sql25`previous.id IS NOT NULL AND ${difference2}` : sql25`previous.id IS NULL OR (previous.id IS NOT NULL AND ${difference2})`;
+      const afterRows = includeAfter ? app.db.all(sql25`
         SELECT ${entity} AS entity,
           CASE WHEN previous.id IS NULL THEN 'added' ELSE 'changed' END AS change,
-          current.${sql24.raw(keyColumn)} AS key
-        FROM ${sql24.raw(table)} AS current
-        LEFT JOIN ${sql24.raw(table)} AS previous
+          current.${sql25.raw(keyColumn)} AS key
+        FROM ${sql25.raw(table)} AS current
+        LEFT JOIN ${sql25.raw(table)} AS previous
           ON previous.project_id = ${beforeScope.projectId}
           AND previous.run_id = ${beforeScope.runId}
           AND previous.attempt_id = ${beforeScope.attemptId}
           ${internalPreviousJoin}
-          AND previous.${sql24.raw(keyColumn)} = current.${sql24.raw(keyColumn)}
+          AND previous.${sql25.raw(keyColumn)} = current.${sql25.raw(keyColumn)}
         WHERE current.project_id = ${afterScope.projectId}
           AND current.run_id = ${afterScope.runId}
           AND current.attempt_id = ${afterScope.attemptId}
           ${internalCurrent}
-          AND current.${sql24.raw(keyColumn)} > ${afterKey}
+          AND current.${sql25.raw(keyColumn)} > ${afterKey}
           AND (${afterKind})
-        ORDER BY current.${sql24.raw(keyColumn)} ASC
+        ORDER BY current.${sql25.raw(keyColumn)} ASC
         LIMIT ${wanted2}
       `) : [];
-      const removedRows = includeRemoved ? app.db.all(sql24`
-        SELECT ${entity} AS entity, 'removed' AS change, previous.${sql24.raw(keyColumn)} AS key
-        FROM ${sql24.raw(table)} AS previous
-        LEFT JOIN ${sql24.raw(table)} AS current
+      const removedRows = includeRemoved ? app.db.all(sql25`
+        SELECT ${entity} AS entity, 'removed' AS change, previous.${sql25.raw(keyColumn)} AS key
+        FROM ${sql25.raw(table)} AS previous
+        LEFT JOIN ${sql25.raw(table)} AS current
           ON current.project_id = ${afterScope.projectId}
           AND current.run_id = ${afterScope.runId}
           AND current.attempt_id = ${afterScope.attemptId}
           ${internalCurrentJoin}
-          AND current.${sql24.raw(keyColumn)} = previous.${sql24.raw(keyColumn)}
+          AND current.${sql25.raw(keyColumn)} = previous.${sql25.raw(keyColumn)}
         WHERE previous.project_id = ${beforeScope.projectId}
           AND previous.run_id = ${beforeScope.runId}
           AND previous.attempt_id = ${beforeScope.attemptId}
           ${internalPrevious}
-          AND previous.${sql24.raw(keyColumn)} > ${afterKey}
+          AND previous.${sql25.raw(keyColumn)} > ${afterKey}
           AND current.id IS NULL
-        ORDER BY previous.${sql24.raw(keyColumn)} ASC
+        ORDER BY previous.${sql25.raw(keyColumn)} ASC
         LIMIT ${wanted2}
       `) : [];
       const merged = [];
@@ -83175,8 +83703,8 @@ async function technicalAeoRoutes(app, opts) {
       eq64(siteCrawlEdges.internal, true),
       linkKindFilter(linkKind)
     ];
-    const inboundMatch = request.query.nodeKey && request.query.url ? or13(eq64(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq64(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq64(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq64(siteCrawlEdges.targetUrl, request.query.url);
-    const outboundMatch = request.query.nodeKey && request.query.url ? or13(eq64(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq64(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq64(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq64(siteCrawlEdges.sourceUrl, request.query.url);
+    const inboundMatch = request.query.nodeKey && request.query.url ? or14(eq64(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq64(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq64(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq64(siteCrawlEdges.targetUrl, request.query.url);
+    const outboundMatch = request.query.nodeKey && request.query.url ? or14(eq64(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq64(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq64(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq64(siteCrawlEdges.sourceUrl, request.query.url);
     const limit = parseBoundedLimit(request.query.limit, 50, 100);
     const inboundRows = app.db.select().from(siteCrawlEdges).where(and54(...scope, inboundMatch)).orderBy(asc11(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
     const outboundRows = app.db.select().from(siteCrawlEdges).where(and54(...scope, outboundMatch)).orderBy(asc11(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
@@ -83226,7 +83754,7 @@ async function technicalAeoRoutes(app, opts) {
       // a fabricated broken link shown to a client is not worth the saved
       // predicate. Applied to `total` as well as the rows, or the count would
       // promise a page the list cannot fill.
-      isNotNull5(sql24`json_extract(${siteCrawlFindings.evidence}, '$.statusCode')`)
+      isNotNull5(sql25`json_extract(${siteCrawlFindings.evidence}, '$.statusCode')`)
     );
     const total = app.db.select({ value: count2() }).from(siteCrawlFindings).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
@@ -83471,7 +83999,7 @@ async function technicalAeoRoutes(app, opts) {
 // ../api-routes/src/research.ts
 import crypto49 from "crypto";
 import { z as z5 } from "zod";
-import { and as and55, count as count3, desc as desc28, eq as eq65, gte as gte17, lt as lt11, or as or14, sql as sql25 } from "drizzle-orm";
+import { and as and55, count as count3, desc as desc28, eq as eq65, gte as gte17, lt as lt11, or as or15, sql as sql26 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 var BATCH_RECEIPT_PREFIX = "__canonry_research_batch__:";
 async function researchRoutes(app, opts) {
@@ -83533,7 +84061,7 @@ async function researchRoutes(app, opts) {
           eq65(researchRuns.projectId, project.id),
           gte17(researchRuns.createdAt, start),
           lt11(researchRuns.createdAt, end),
-          sql25`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
+          sql26`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
         )).get()?.value ?? 0;
         if (used >= viewerDailyRunLimit) {
           throw researchDailyLimitExceeded(project.name, viewerDailyRunLimit, date);
@@ -83542,7 +84070,7 @@ async function researchRoutes(app, opts) {
       const id = crypto49.randomUUID();
       tx.insert(researchRuns).values({ id, projectId: project.id, status: ResearchRunStatuses.queued, provider: providerName, requestedModel: requestedModel2, resolvedModel, location: location ?? null, totalQueries: input.queries.length, scope, template, idempotencyKey: input.idempotencyKey ?? null, requestHash: input.idempotencyKey ? requestHash2 : null, initiatedBy, createdAt: now }).run();
       for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto49.randomUUID(), researchRunId: id, position, queryText: query, queryClass: queryClasses[position] ?? null, status: ResearchQueryStatuses.queued, requestedModel: requestedModel2, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
-      writeAuditLog(tx, { projectId: project.id, actor: initiatedBy ? `${initiatedBy.kind}:${initiatedBy.id}` : "api", action: "research.created", entityType: "research_run", entityId: id });
+      writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       return { reused: false, id, shouldDispatch: true };
     });
     const result = getDetail(app, project.id, decision.id);
@@ -83588,7 +84116,7 @@ async function researchRoutes(app, opts) {
           eq65(researchRuns.projectId, project.id),
           gte17(researchRuns.createdAt, start),
           lt11(researchRuns.createdAt, end),
-          sql25`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
+          sql26`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
         )).get()?.value ?? 0;
         if (used + prepared.length > viewerDailyRunLimit) throw researchDailyLimitExceeded(project.name, viewerDailyRunLimit, date);
       }
@@ -83626,7 +84154,7 @@ async function researchRoutes(app, opts) {
           searchQueries: [],
           createdAt: now
         }).run();
-        writeAuditLog(tx, { projectId: project.id, actor: initiatedBy ? `${initiatedBy.kind}:${initiatedBy.id}` : "api", action: "research.created", entityType: "research_run", entityId: id });
+        writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       }
       return { ids };
     });
@@ -83641,7 +84169,7 @@ async function researchRoutes(app, opts) {
     const cursor = request.query.cursor ? parseResearchCursor(request.query.cursor, project.id) : null;
     const rows = app.db.select().from(researchRuns).where(and55(
       eq65(researchRuns.projectId, project.id),
-      cursor ? or14(lt11(researchRuns.createdAt, cursor.createdAt), and55(eq65(researchRuns.createdAt, cursor.createdAt), lt11(researchRuns.id, cursor.id))) : void 0
+      cursor ? or15(lt11(researchRuns.createdAt, cursor.createdAt), and55(eq65(researchRuns.createdAt, cursor.createdAt), lt11(researchRuns.id, cursor.id))) : void 0
     )).orderBy(desc28(researchRuns.createdAt), desc28(researchRuns.id)).limit(limit + 1).all();
     const runs2 = rows.slice(0, limit).map(serializeRun);
     const last = runs2.at(-1);
@@ -83929,6 +84457,7 @@ async function apiRoutes(app, opts) {
     });
   }
   await app.register(async (api) => {
+    registerRequestContext(api);
     await api.register(rateLimit, {
       global: false,
       hook: "preHandler",
@@ -84050,6 +84579,7 @@ async function apiRoutes(app, opts) {
     await api.register(notificationRoutes, {
       allowLoopbackWebhooks: opts.allowLoopbackWebhooks
     });
+    await api.register(operationalLogsRoutes, { listOperationalLogs: opts.listOperationalLogs });
     await api.register(telemetryRoutes, {
       getTelemetryStatus: opts.getTelemetryStatus,
       setTelemetryEnabled: opts.setTelemetryEnabled,
@@ -84407,42 +84937,260 @@ function buildTrafficSourceValidators(opts) {
 // src/intelligence-service.ts
 import crypto51 from "crypto";
 
-// src/logger.ts
+// ../api-routes/src/runtime-logger.ts
+import { format } from "util";
 var IS_TTY = process.stdout.isTTY === true;
-function formatTTY(entry) {
-  const { ts, level, module, action, msg, ...ctx } = entry;
-  const time = ts.slice(11, 19);
-  const levelTag = level === "error" ? "\x1B[31mERR\x1B[0m" : level === "warn" ? "\x1B[33mWRN\x1B[0m" : "\x1B[36mINF\x1B[0m";
-  const ctxParts = Object.entries(ctx).filter(([, v]) => v !== void 0 && v !== null).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
-  const msgPart = msg ? ` ${msg}` : "";
-  const ctxPart = ctxParts ? ` ${ctxParts}` : "";
-  return `${time} ${levelTag} [${module}] ${action}${msgPart}${ctxPart}`;
-}
-function emit(entry) {
-  const stream = entry.level === "error" ? process.stderr : process.stdout;
-  if (IS_TTY) {
-    stream.write(formatTTY(entry) + "\n");
-  } else {
-    stream.write(JSON.stringify(entry) + "\n");
-  }
+var MAX_IDENTITY_LENGTH = 512;
+var RESERVED_FIELDS = /* @__PURE__ */ new Set([
+  "ts",
+  "level",
+  "module",
+  "action",
+  "msg",
+  "requestId",
+  "actor",
+  "credentialId",
+  "userAgent",
+  "actorSession",
+  "__runtimeRequestId"
+]);
+var listeners = /* @__PURE__ */ new Set();
+function addLogListener(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
 }
 function createLogger(module) {
-  function log2(level, action, ctx) {
-    const entry = {
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      level,
-      module,
-      action,
-      ...ctx
-    };
-    emit(entry);
+  const emit = (level, action, context) => {
+    const msg = context ? safeProperty(context, "msg") : void 0;
+    emitRuntimeLog({ level, module, action, context, ...typeof msg === "string" ? { msg } : {} });
+  };
+  return {
+    info: (action, ctx) => emit("info", action, ctx),
+    warn: (action, ctx) => emit("warn", action, ctx),
+    error: (action, ctx) => emit("error", action, ctx)
+  };
+}
+function createFastifyLogger(options = {}) {
+  return buildFastifyLogger(options.module ?? "HTTP", options.enabled !== false, {});
+}
+var LEVELS = { trace: 10, debug: 20, info: 30, warn: 40, error: 50, fatal: 60, silent: Infinity };
+function buildFastifyLogger(module, enabled, bindings, inheritedLevel = "info") {
+  let level = inheritedLevel;
+  const emit = (severity, args) => {
+    if (LEVELS[severity] >= LEVELS[level]) logFastify(severity, module, enabled, bindings, args);
+  };
+  const logger = {
+    get level() {
+      return level;
+    },
+    set level(value) {
+      if (Object.hasOwn(LEVELS, value)) level = value;
+    },
+    trace: (...args) => emit("trace", args),
+    debug: (...args) => emit("debug", args),
+    info: (...args) => emit("info", args),
+    warn: (...args) => emit("warn", args),
+    error: (...args) => emit("error", args),
+    fatal: (...args) => emit("fatal", args),
+    silent: () => void 0,
+    child: (childBindings) => buildFastifyLogger(module, enabled, mergeBindings(bindings, childBindings), level)
+  };
+  return logger;
+}
+function logFastify(level, module, enabled, bindings, args) {
+  const { context, msg } = normalizePinoArgs(args);
+  emitRuntimeLog({
+    level,
+    module,
+    action: `fastify.${level}`,
+    msg,
+    context: { ...bindings, ...context },
+    trustedRequestId: asBoundString(bindings.__runtimeRequestId),
+    enabled
+  });
+}
+function normalizePinoArgs(args) {
+  const first = args[0];
+  const second = args[1];
+  if (typeof first === "string") return { context: {}, msg: safeFormat(first, args.slice(1)) };
+  if (first instanceof Error) {
+    return { context: { err: first }, msg: typeof second === "string" ? safeFormat(second, args.slice(2)) : void 0 };
+  }
+  if (isObject(first)) {
+    return { context: copyOwnData(first), msg: typeof second === "string" ? safeFormat(second, args.slice(2)) : void 0 };
+  }
+  return { context: {}, msg: typeof second === "string" ? safeFormat(second, args.slice(2)) : void 0 };
+}
+function emitRuntimeLog({
+  level,
+  module,
+  action,
+  msg,
+  context,
+  trustedRequestId,
+  enabled = true
+}) {
+  const safeContext = sanitizeContext(context);
+  const error = safeContext.err ?? safeContext.error;
+  const errorMessage = typeof error === "string" ? error : isRecord4(error) && typeof error.message === "string" ? error.message : void 0;
+  const message = errorMessage && errorMessage !== msg ? [msg, errorMessage].filter(Boolean).join(": ") : msg;
+  const entry = {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    module: boundText(module, "Runtime"),
+    action: boundText(action, "log"),
+    ...message === void 0 ? {} : { msg: redactLogString(message) },
+    ...safeContext,
+    ...trustedAttribution(getRequestContext(trustedRequestId), trustedRequestId)
+  };
+  if (enabled) writeEntry(entry);
+  for (const listener of listeners) {
+    try {
+      listener(entry);
+    } catch {
+    }
+  }
+}
+function sanitizeContext(context) {
+  if (!context) return {};
+  const output = {};
+  for (const key of safeKeys(context).slice(0, 100)) {
+    if (RESERVED_FIELDS.has(key)) continue;
+    const value = safeProperty(context, key);
+    if (key === "req" || key === "request") {
+      Object.assign(output, normalizeRequest(value));
+      continue;
+    }
+    if (key === "res" || key === "reply") {
+      Object.assign(output, normalizeReply(value));
+      continue;
+    }
+    if (key === "responseTime" || key === "duration") {
+      if (typeof value === "number" && Number.isFinite(value)) output.durationMs = value;
+      continue;
+    }
+    output[key] = value;
   }
+  delete output.__runtimeRequestId;
+  const redacted = redactLogValue(output);
+  return isRecord4(redacted) ? redacted : {};
+}
+function trustedAttribution(context, trustedRequestId) {
+  const requestId = boundOptional(context?.requestId) ?? trustedRequestId;
+  const actor = diagnosticIdentity("actor", context?.actor);
+  const credentialId = diagnosticIdentity("credentialId", context?.credentialId);
+  const userAgent = boundOptional(context?.userAgent);
+  const actorSession = boundOptional(context?.actorSession);
+  const method = boundOptional(context?.method);
+  const route = boundOptional(context?.route);
   return {
-    info: (action, ctx) => log2("info", action, ctx),
-    warn: (action, ctx) => log2("warn", action, ctx),
-    error: (action, ctx) => log2("error", action, ctx)
+    ...requestId ? { requestId } : {},
+    ...actor ? { actor } : {},
+    ...credentialId ? { credentialId } : {},
+    ...userAgent ? { userAgent } : {},
+    ...actorSession ? { actorSession } : {},
+    ...method ? { method } : {},
+    ...route ? { route } : {},
+    ...context?.statusCode === void 0 ? {} : { statusCode: context.statusCode }
   };
 }
+function mergeBindings(parent, child) {
+  const merged = { ...parent };
+  if (!isObject(child)) return merged;
+  for (const key of safeKeys(child).slice(0, 100)) {
+    const value = safeProperty(child, key);
+    if (key === "req" || key === "request") Object.assign(merged, normalizeRequest(value));
+    else if (key === "res" || key === "reply") Object.assign(merged, normalizeReply(value));
+    else if (key === "reqId") {
+      merged.reqId = value;
+      merged.__runtimeRequestId = value;
+    } else if (!RESERVED_FIELDS.has(key)) merged[key] = value;
+  }
+  return merged;
+}
+function normalizeRequest(value) {
+  if (!isObject(value)) return {};
+  const id = asBoundString(safeProperty(value, "id"));
+  const method = asBoundString(safeProperty(value, "method"));
+  const routeOptions = safeProperty(value, "routeOptions");
+  const route = isObject(routeOptions) ? asBoundString(safeProperty(routeOptions, "url")) : void 0;
+  return {
+    ...id ? { reqId: id, __runtimeRequestId: id } : {},
+    ...method ? { method } : {},
+    ...route ? { route } : {}
+  };
+}
+function normalizeReply(value) {
+  if (!isObject(value)) return {};
+  const statusCode = safeProperty(value, "statusCode");
+  return typeof statusCode === "number" && Number.isFinite(statusCode) ? { statusCode } : {};
+}
+function writeEntry(entry) {
+  const stream = entry.level === "error" || entry.level === "fatal" ? process.stderr : process.stdout;
+  const line = IS_TTY ? formatTTY(entry) : JSON.stringify(entry);
+  try {
+    stream.write(`${line}
+`);
+  } catch {
+  }
+}
+function formatTTY(entry) {
+  const { ts, level, module, action, msg, ...context } = entry;
+  const levelTag = level === "fatal" || level === "error" ? "ERR" : level === "warn" ? "WRN" : "INF";
+  const parts = safeKeys(context).map((key) => `${key}=${safeDisplay(safeProperty(context, key))}`);
+  return `${ts.slice(11, 19)} ${levelTag} [${module}] ${action}${msg ? ` ${msg}` : ""}${parts.length ? ` ${parts.join(" ")}` : ""}`;
+}
+function safeDisplay(value) {
+  try {
+    return typeof value === "string" ? value : JSON.stringify(value);
+  } catch {
+    return "[UNSERIALIZABLE]";
+  }
+}
+function safeFormat(message, args) {
+  try {
+    return args.length ? format(message, ...args) : message;
+  } catch {
+    return message;
+  }
+}
+function isObject(value) {
+  return value !== null && typeof value === "object";
+}
+function isRecord4(value) {
+  return isObject(value) && !Array.isArray(value);
+}
+function safeKeys(value) {
+  try {
+    return Object.keys(value);
+  } catch {
+    return [];
+  }
+}
+function safeProperty(value, key) {
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor && "value" in descriptor ? descriptor.value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function copyOwnData(value) {
+  const output = {};
+  for (const key of safeKeys(value)) output[key] = safeProperty(value, key);
+  return output;
+}
+function boundText(value, fallback) {
+  return boundOptional(value) ?? fallback;
+}
+function asBoundString(value) {
+  return typeof value === "string" ? boundOptional(value) : void 0;
+}
+function boundOptional(value) {
+  if (typeof value !== "string") return void 0;
+  const redacted = redactLogString(value).replace(/[\r\n]+/g, " ").trim().slice(0, MAX_IDENTITY_LENGTH);
+  return redacted || void 0;
+}
 
 // src/citation-utils.ts
 function pickProjectCitedDomain(citedDomains, projectDomains) {
@@ -84590,13 +85338,13 @@ function matchesBrandAlias(candidate, aliases) {
 var RECURRENCE_LOOKBACK_RUNS = 5;
 var HISTORY_WINDOW_RUNS = Math.max(PERSISTENT_GAP_THRESHOLD, 5);
 var log = createLogger("IntelligenceService");
-var runChronologyKey = sql26`coalesce(${runs.finishedAt}, ${runs.createdAt})`;
+var runChronologyKey = sql27`coalesce(${runs.finishedAt}, ${runs.createdAt})`;
 function analyzableRunPredicates(projectId) {
   return [
     eq67(runs.projectId, projectId),
     // Only this kind writes query_snapshots.
     eq67(runs.kind, RunKinds["answer-visibility"]),
-    or15(eq67(runs.status, RunStatuses.completed), eq67(runs.status, RunStatuses.partial)),
+    or16(eq67(runs.status, RunStatuses.completed), eq67(runs.status, RunStatuses.partial)),
     // Defensive: RunCoordinator already skips probes before analyzeAndPersist
     // is called, but a future call site invoking it directly for a probe must
     // still not pollute the intelligence window.
@@ -84658,7 +85406,7 @@ var IntelligenceService = class {
         // MEASUREMENT: only runs that actually wrote snapshots — see above.
         // Index seek on idx_snapshots_run, short-circuited on the first row.
         exists(
-          this.db.select({ one: sql26`1` }).from(querySnapshots).where(eq67(querySnapshots.runId, runs.id))
+          this.db.select({ one: sql27`1` }).from(querySnapshots).where(eq67(querySnapshots.runId, runs.id))
         )
       )
     ).orderBy(desc29(runs.finishedAt), desc29(runs.createdAt)).limit(HISTORY_WINDOW_RUNS).all();
@@ -85186,7 +85934,7 @@ var IntelligenceService = class {
       and57(
         eq67(runs.projectId, projectId),
         eq67(runs.kind, RunKinds["answer-visibility"]),
-        or15(eq67(runs.status, "completed"), eq67(runs.status, "partial")),
+        or16(eq67(runs.status, "completed"), eq67(runs.status, "partial")),
         // Defensive — see top of file.
         ne10(runs.trigger, RunTriggers.probe)
       )
@@ -85369,6 +86117,7 @@ export {
   extractLegacyCredentials,
   dropLegacyCredentialColumns,
   migrate,
+  OperationalLogStore,
   groupRunsByCreatedAt,
   classifyCrawler,
   classifyAiUserFetch,
@@ -85450,6 +86199,8 @@ export {
   markSessionFailed,
   captureSimpleMeasurementDefinition,
   apiRoutes,
+  addLogListener,
   createLogger,
+  createFastifyLogger,
   IntelligenceService
 };