@ainyc/canonry 4.31.0 → 4.33.0

package/dist/{chunk-PUTJHEVR.js → chunk-JJHBPITI.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-5STLZRGB.js";
+} from "./chunk-5EBN7736.js";
 import {
   DEFAULT_RUN_HISTORY_LIMIT,
   IntelligenceService,
@@ -70,7 +70,7 @@ import {
   schedules,
   trafficSources,
   usageCounters
-} from "./chunk-U3YKRV47.js";
+} from "./chunk-BJXHETQW.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -162,6 +162,7 @@ import {
   reportHorizonLabel,
   reportSeverityLabel,
   resolveConfigSpecQueries,
+  resolveLocations,
   resolveSnapshotRequestQueries,
   runInProgress,
   runNotCancellable,
@@ -171,13 +172,14 @@ import {
   serializeRunError,
   snapshotRequestSchema,
   summarizeCheckResults,
+  trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   unsupportedKind,
   validationError,
   visibilityStateFromAnswerMentioned,
   windowCutoff,
   wordpressEnvSchema
-} from "./chunk-HTNC6AWN.js";
+} from "./chunk-XW3F5EEW.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -10234,6 +10236,38 @@ var routeCatalog = [
       502: { description: "WordPress plugin endpoint probe failed (bad credentials, unreachable host, etc.)." }
     }
   },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/connect/vercel",
+    summary: "Connect a Vercel traffic source",
+    description: "Probes Vercel's internal `request-logs` endpoint with the supplied API token (single page, 60-minute window) before persisting. On success, stores the token in `~/.canonry/config.yaml` and creates / updates the project's active Vercel `traffic_sources` row. A probe failure (bad token, wrong project / team id, unreachable host) surfaces as 502 with the upstream status in the message so the caller learns about it up front instead of at the first sync. The project id, team id, and environment are stored as non-secret config on the row; only the API token lives in the credential file.",
+    tags: ["traffic"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: {
+        "application/json": {
+          schema: {
+            type: "object",
+            required: ["projectId", "teamId", "token"],
+            properties: {
+              projectId: { ...stringSchema, description: "Vercel project id (e.g. `prj_...`) \u2014 from the Vercel dashboard or `.vercel/project.json`." },
+              teamId: { ...stringSchema, description: "Vercel team / owner id (e.g. `team_...`)." },
+              token: { ...stringSchema, description: "Vercel API token (personal access token). Stored in `~/.canonry/config.yaml`, never the DB or response." },
+              environment: { type: "string", enum: ["production", "preview"], description: "Which deployment environment's request logs to pull. Default: `production`." },
+              displayName: stringSchema
+            }
+          }
+        }
+      }
+    },
+    responses: {
+      200: { description: "Traffic source DTO returned." },
+      400: { description: "Invalid Vercel connection request." },
+      404: { description: "Project not found." },
+      502: { description: "Vercel request-logs endpoint probe failed (bad token, wrong project / team id, unreachable host, etc.)." }
+    }
+  },
   {
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/sync",
@@ -10366,7 +10400,12 @@ var routeCatalog = [
             properties: {
               icpDescription: { type: "string", description: "Free-text ICP. Required if the project does not have spec.icpDescription stored." },
               dedupThreshold: { type: "number", description: "Cosine similarity threshold for clustering. Defaults to 0.85." },
-              maxProbes: { type: "integer", description: "Max canonical queries to probe in this session. Default 100, hard cap 500." }
+              maxProbes: { type: "integer", description: "Max canonical queries to probe in this session. Default 100, hard cap 500." },
+              locations: {
+                type: "array",
+                items: { type: "string" },
+                description: "Optional override of the project location labels used to geo-constrain seed generation. Each label must match a configured project location; an unknown label is a 400. Omit to use every project location."
+              }
             }
           }
         }
@@ -17607,13 +17646,194 @@ async function listWordpressTrafficEvents(options) {
   };
 }
 
+// ../integration-vercel/src/normalize.ts
+function numberOrNull2(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  return value;
+}
+function resolveStatus(row) {
+  if (typeof row.statusCode === "number" && row.statusCode >= 100) {
+    return row.statusCode;
+  }
+  const events = row.events ?? [];
+  for (let i = events.length - 1; i >= 0; i -= 1) {
+    const status = events[i]?.httpStatus;
+    if (typeof status === "number" && status >= 100) return status;
+  }
+  return null;
+}
+function serializeSearchParams(params) {
+  if (!params) return null;
+  const entries = Object.entries(params).filter(
+    (entry) => typeof entry[1] === "string"
+  );
+  if (entries.length === 0) return null;
+  return new URLSearchParams(entries).toString();
+}
+function emptyToNull(value) {
+  if (typeof value !== "string" || value.trim() === "") return null;
+  return value;
+}
+function stringLabels(input) {
+  return Object.fromEntries(
+    Object.entries(input).filter(
+      (entry) => typeof entry[1] === "string" && entry[1] !== ""
+    )
+  );
+}
+function normalizeVercelLogRow(row) {
+  const path15 = row.requestPath;
+  if (!path15) return null;
+  const observedAt = row.timestamp;
+  if (!observedAt) return null;
+  const requestId = row.requestId;
+  if (!requestId) return null;
+  const host = emptyToNull(row.domain);
+  const queryString = serializeSearchParams(row.requestSearchParams);
+  const requestUrl = host ? `https://${host}${path15}${queryString ? `?${queryString}` : ""}` : null;
+  return {
+    sourceType: TrafficSourceTypes.vercel,
+    evidenceKind: TrafficEvidenceKinds["raw-request"],
+    confidence: TrafficEventConfidences.observed,
+    eventId: `vercel:${observedAt}:${requestId}`,
+    observedAt,
+    method: row.requestMethod ?? null,
+    requestUrl,
+    host,
+    path: path15,
+    queryString,
+    status: resolveStatus(row),
+    userAgent: emptyToNull(row.clientUserAgent),
+    // The request-logs endpoint does not expose a client IP; UA-only matches
+    // stay `claimed_unverified` in the classifier.
+    remoteIp: null,
+    referer: emptyToNull(row.requestReferer),
+    latencyMs: numberOrNull2(row.requestDurationMs),
+    requestSizeBytes: null,
+    responseSizeBytes: null,
+    providerResource: {
+      type: "vercel_deployment",
+      labels: stringLabels({
+        deploymentId: row.deploymentId,
+        environment: row.environment,
+        region: row.clientRegion
+      })
+    },
+    providerLabels: stringLabels({
+      branch: row.branch,
+      cache: row.cache
+    })
+  };
+}
+
+// ../integration-vercel/src/client.ts
+var VERCEL_REQUEST_LOGS_URL = "https://vercel.com/api/logs/request-logs";
+var DEFAULT_ENVIRONMENT = "production";
+var DEFAULT_MAX_PAGES3 = 1;
+var DEFAULT_TIMEOUT_MS3 = 3e4;
+var VercelLogsApiError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "VercelLogsApiError";
+  }
+};
+function trimRequired2(name, value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new VercelLogsApiError(`${name} is required`, 400);
+  }
+  return trimmed;
+}
+function normalizeMaxPages3(maxPages) {
+  if (maxPages === void 0) return DEFAULT_MAX_PAGES3;
+  if (!Number.isInteger(maxPages) || maxPages < 1) {
+    throw new VercelLogsApiError("maxPages must be a positive integer", 400);
+  }
+  return maxPages;
+}
+function toEpochMs(label, value) {
+  const ms = value instanceof Date ? value.getTime() : typeof value === "number" ? value : new Date(value).getTime();
+  if (!Number.isFinite(ms)) {
+    throw new VercelLogsApiError(`${label} must be a valid date`, 400);
+  }
+  return String(Math.trunc(ms));
+}
+async function readErrorBody3(response) {
+  const text = await response.text().catch(() => "");
+  if (!text) return void 0;
+  return text.length <= 500 ? text : `${text.slice(0, 500)}... [truncated]`;
+}
+async function listVercelTrafficEvents(options) {
+  const token = trimRequired2("token", options.token);
+  const projectId = trimRequired2("projectId", options.projectId);
+  const teamId = trimRequired2("teamId", options.teamId);
+  const environment = options.environment ?? DEFAULT_ENVIRONMENT;
+  const startDate = toEpochMs("startDate", options.startDate);
+  const endDate = toEpochMs("endDate", options.endDate);
+  const maxPages = normalizeMaxPages3(options.maxPages);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
+  let rawEntryCount = 0;
+  let skippedEntryCount = 0;
+  let hasMore = false;
+  const events = [];
+  for (let page = 0; page < maxPages; page += 1) {
+    const url = new URL(VERCEL_REQUEST_LOGS_URL);
+    url.searchParams.set("projectId", projectId);
+    url.searchParams.set("ownerId", teamId);
+    url.searchParams.set("teamId", teamId);
+    url.searchParams.set("page", String(page));
+    url.searchParams.set("startDate", startDate);
+    url.searchParams.set("endDate", endDate);
+    url.searchParams.set("environment", environment);
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json"
+      },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!response.ok) {
+      const body2 = await readErrorBody3(response);
+      throw new VercelLogsApiError(
+        `Vercel request-logs endpoint returned HTTP ${response.status}`,
+        response.status,
+        body2
+      );
+    }
+    const body = await response.json();
+    const rows = body.rows ?? [];
+    rawEntryCount += rows.length;
+    for (const row of rows) {
+      const event = normalizeVercelLogRow(row);
+      if (event) {
+        events.push(event);
+      } else {
+        skippedEntryCount += 1;
+      }
+    }
+    hasMore = Boolean(body.hasMoreRows);
+    if (!hasMore) break;
+  }
+  return {
+    events,
+    rawEntryCount,
+    skippedEntryCount,
+    hasMore,
+    endpoint: VERCEL_REQUEST_LOGS_URL
+  };
+}
+
 // ../api-routes/src/traffic.ts
 var DEFAULT_SYNC_WINDOW_MINUTES = 43200;
 var DEFAULT_PAGE_SIZE3 = 1e3;
-var DEFAULT_MAX_PAGES3 = 5;
+var DEFAULT_MAX_PAGES4 = 5;
 var DEFAULT_SAMPLE_LIMIT2 = 100;
 var DEFAULT_WP_PAGE_SIZE = 500;
 var DEFAULT_WP_MAX_PAGES = 20;
+var DEFAULT_VERCEL_MAX_PAGES = 50;
 var MAX_TRACKED_EVENT_IDS = 1e3;
 var DEFAULT_BACKFILL_DAYS = 30;
 var MAX_BACKFILL_DAYS = 30;
@@ -17794,9 +18014,11 @@ async function trafficRoutes(app, opts) {
   const pullEvents = opts.pullCloudRunEvents ?? listCloudRunTrafficEvents;
   const resolveAccessToken2 = opts.resolveCloudRunAccessToken ?? defaultResolveAccessToken;
   const pullWordpressEvents = opts.pullWordpressTrafficEvents ?? listWordpressTrafficEvents;
+  const pullVercelEvents = opts.pullVercelTrafficEvents ?? listVercelTrafficEvents;
+  const vercelMaxPages = opts.defaultVercelMaxPages ?? DEFAULT_VERCEL_MAX_PAGES;
   const syncWindowMinutes = opts.defaultSyncWindowMinutes ?? DEFAULT_SYNC_WINDOW_MINUTES;
   const pageSize = opts.defaultPageSize ?? DEFAULT_PAGE_SIZE3;
-  const maxPages = opts.defaultMaxPages ?? DEFAULT_MAX_PAGES3;
+  const maxPages = opts.defaultMaxPages ?? DEFAULT_MAX_PAGES4;
   const sampleLimit = opts.defaultSampleLimit ?? DEFAULT_SAMPLE_LIMIT2;
   app.post("/projects/:name/traffic/connect/cloud-run", async (request) => {
     const project = resolveProject(app.db, request.params.name);
@@ -17958,15 +18180,98 @@ async function trafficRoutes(app, opts) {
     });
     return rowToDto(sourceRow);
   });
+  app.post("/projects/:name/traffic/connect/vercel", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    if (!opts.vercelTrafficCredentialStore) {
+      throw validationError("Vercel traffic credential storage is not configured for this deployment");
+    }
+    const credentialStore = opts.vercelTrafficCredentialStore;
+    const parsed = trafficConnectVercelRequestSchema.safeParse(request.body ?? {});
+    if (!parsed.success) {
+      throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+    }
+    const { projectId, teamId, token, displayName } = parsed.data;
+    const environment = parsed.data.environment ?? "production";
+    const probeEnd = Date.now();
+    try {
+      await pullVercelEvents({
+        token,
+        projectId,
+        teamId,
+        environment,
+        startDate: probeEnd - 60 * 6e4,
+        endDate: probeEnd,
+        maxPages: 1
+      });
+    } catch (e) {
+      if (e instanceof VercelLogsApiError) {
+        throw providerError(
+          `Vercel traffic probe failed (HTTP ${e.status}): ${e.message}${e.body ? ` \u2014 ${e.body}` : ""}`
+        );
+      }
+      const msg = e instanceof Error ? e.message : String(e);
+      throw providerError(`Vercel traffic probe failed: ${msg}`);
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = credentialStore.getConnection(project.name);
+    credentialStore.upsertConnection({
+      projectName: project.name,
+      projectId,
+      teamId,
+      token,
+      environment,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now
+    });
+    const activeSource = app.db.select().from(trafficSources).where(eq23(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
+    const config = { projectId, teamId, environment };
+    const fallbackName = displayName ?? `Vercel \xB7 ${projectId}`;
+    let sourceRow;
+    if (activeSource) {
+      app.db.update(trafficSources).set({
+        displayName: fallbackName,
+        status: TrafficSourceStatuses.connected,
+        lastError: null,
+        configJson: JSON.stringify(config),
+        updatedAt: now
+      }).where(eq23(trafficSources.id, activeSource.id)).run();
+      sourceRow = app.db.select().from(trafficSources).where(eq23(trafficSources.id, activeSource.id)).get();
+    } else {
+      const newId = crypto20.randomUUID();
+      app.db.insert(trafficSources).values({
+        id: newId,
+        projectId: project.id,
+        sourceType: TrafficSourceTypes.vercel,
+        displayName: fallbackName,
+        status: TrafficSourceStatuses.connected,
+        lastSyncedAt: null,
+        lastCursor: null,
+        lastError: null,
+        archivedAt: null,
+        configJson: JSON.stringify(config),
+        createdAt: now,
+        updatedAt: now
+      }).run();
+      sourceRow = app.db.select().from(trafficSources).where(eq23(trafficSources.id, newId)).get();
+    }
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "traffic.vercel.connected",
+      entityType: "traffic_source",
+      entityId: sourceRow.id
+    });
+    return rowToDto(sourceRow);
+  });
   app.post("/projects/:name/traffic/sources/:id/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const sourceRow = app.db.select().from(trafficSources).where(eq23(trafficSources.id, request.params.id)).get();
     if (!sourceRow || sourceRow.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
-    if (sourceRow.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow.sourceType !== TrafficSourceTypes.wordpress) {
+    if (sourceRow.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow.sourceType !== TrafficSourceTypes.wordpress && sourceRow.sourceType !== TrafficSourceTypes.vercel) {
       throw validationError(
-        `Sync for source type "${sourceRow.sourceType}" is not implemented yet \u2014 only cloud-run and wordpress are supported in v1.`
+        `Sync for source type "${sourceRow.sourceType}" is not implemented yet \u2014 only cloud-run, wordpress, and vercel are supported in v1.`
       );
     }
     const windowEnd = /* @__PURE__ */ new Date();
@@ -18056,7 +18361,7 @@ async function trafficRoutes(app, opts) {
         markFailed(msg, "PROVIDER_PULL");
         throw providerError(`Cloud Run pull failed: ${msg}`);
       }
-    } else {
+    } else if (sourceRow.sourceType === TrafficSourceTypes.wordpress) {
       auditAction = "traffic.wordpress.synced";
       const credentialStore = opts.wordpressTrafficCredentialStore;
       if (!credentialStore) {
@@ -18097,6 +18402,53 @@ async function trafficRoutes(app, opts) {
         markFailed(msg, "PROVIDER_PULL");
         throw providerError(`WordPress pull failed: ${msg}`);
       }
+    } else {
+      auditAction = "traffic.vercel.synced";
+      const credentialStore = opts.vercelTrafficCredentialStore;
+      if (!credentialStore) {
+        app.db.delete(runs).where(eq23(runs.id, runId)).run();
+        throw validationError("Vercel traffic credential storage is not configured for this deployment");
+      }
+      const credential = credentialStore.getConnection(project.name);
+      if (!credential) {
+        app.db.delete(runs).where(eq23(runs.id, runId)).run();
+        throw validationError(
+          `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
+        );
+      }
+      const config = parseSourceConfig(sourceRow);
+      const vercelProjectId = config.projectId ?? credential.projectId;
+      const vercelTeamId = config.teamId ?? credential.teamId;
+      const vercelEnvironment = config.environment ?? credential.environment;
+      const requestedMinutes = request.body?.sinceMinutes;
+      const windowMinutes = Number.isFinite(requestedMinutes) && requestedMinutes && requestedMinutes > 0 ? Math.floor(requestedMinutes) : syncWindowMinutes;
+      const requestedStartMs = windowEnd.getTime() - windowMinutes * 6e4;
+      const lastSyncedMs = sourceRow.lastSyncedAt ? new Date(sourceRow.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
+      windowStart = new Date(
+        Math.min(windowEnd.getTime(), Math.max(requestedStartMs, lastSyncedMs))
+      );
+      let page;
+      try {
+        page = await pullVercelEvents({
+          token: credential.token,
+          projectId: vercelProjectId,
+          teamId: vercelTeamId,
+          environment: vercelEnvironment,
+          startDate: windowStart.getTime(),
+          endDate: windowEnd.getTime(),
+          maxPages: vercelMaxPages
+        });
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        markFailed(msg, "PROVIDER_PULL");
+        throw providerError(`Vercel pull failed: ${msg}`);
+      }
+      if (page.hasMore) {
+        const msg = `Vercel sync window exceeded the ${vercelMaxPages}-page budget \u2014 narrow the window with --since-minutes or run a backfill`;
+        markFailed(msg, "PROVIDER_PULL");
+        throw providerError(`Vercel pull failed: ${msg}`);
+      }
+      allEvents = page.events;
     }
     let crawlerBucketRows = 0;
     let aiReferralBucketRows = 0;
@@ -18281,9 +18633,9 @@ async function trafficRoutes(app, opts) {
     if (!sourceRow || sourceRow.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
-    if (sourceRow.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow.sourceType !== TrafficSourceTypes.wordpress) {
+    if (sourceRow.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow.sourceType !== TrafficSourceTypes.wordpress && sourceRow.sourceType !== TrafficSourceTypes.vercel) {
       throw validationError(
-        `Backfill for source type "${sourceRow.sourceType}" is not implemented yet \u2014 only cloud-run and wordpress are supported in v1.`
+        `Backfill for source type "${sourceRow.sourceType}" is not implemented yet \u2014 only cloud-run, wordpress, and vercel are supported in v1.`
       );
     }
     const requestedDays = request.body?.days ?? DEFAULT_BACKFILL_DAYS;
@@ -18331,7 +18683,7 @@ async function trafficRoutes(app, opts) {
         });
         return page.events;
       };
-    } else {
+    } else if (sourceRow.sourceType === TrafficSourceTypes.wordpress) {
       const credentialStore = opts.wordpressTrafficCredentialStore;
       if (!credentialStore) {
         throw validationError("WordPress traffic credential storage is not configured for this deployment");
@@ -18370,6 +18722,39 @@ async function trafficRoutes(app, opts) {
         }
         return collected;
       };
+    } else {
+      const credentialStore = opts.vercelTrafficCredentialStore;
+      if (!credentialStore) {
+        throw validationError("Vercel traffic credential storage is not configured for this deployment");
+      }
+      const credential = credentialStore.getConnection(project.name);
+      if (!credential) {
+        throw validationError(
+          `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
+        );
+      }
+      const config = parseSourceConfig(sourceRow);
+      const vercelProjectId = config.projectId ?? credential.projectId;
+      const vercelTeamId = config.teamId ?? credential.teamId;
+      const vercelEnvironment = config.environment ?? credential.environment;
+      pullErrorPrefix = "Vercel pull failed";
+      pullForBackfill = async () => {
+        const page = await pullVercelEvents({
+          token: credential.token,
+          projectId: vercelProjectId,
+          teamId: vercelTeamId,
+          environment: vercelEnvironment,
+          startDate: windowStart.getTime(),
+          endDate: windowEnd.getTime(),
+          maxPages: BACKFILL_MAX_PAGES
+        });
+        if (page.hasMore) {
+          throw new Error(
+            `backfill window exceeded the ${BACKFILL_MAX_PAGES}-page budget \u2014 narrow the window with --days`
+          );
+        }
+        return page.events;
+      };
     }
     const startedAt = windowEnd.toISOString();
     const runId = crypto20.randomUUID();
@@ -19643,6 +20028,10 @@ async function discoveryRoutes(app, opts) {
         "icpDescription is required. Pass it in the request body or store it on the project (spec.icpDescription)."
       );
     }
+    const locations = resolveLocations(
+      parseJsonColumn(project.locations, []),
+      parsed.data.locations
+    );
     if (!opts.onDiscoveryRunRequested) {
       throw validationError("Discovery is not available on this deployment.", {
         reason: "no-discovery-handler"
@@ -19684,7 +20073,8 @@ async function discoveryRoutes(app, opts) {
       projectId: project.id,
       icpDescription,
       dedupThreshold: parsed.data.dedupThreshold,
-      maxProbes: parsed.data.maxProbes
+      maxProbes: parsed.data.maxProbes,
+      locations
     });
     return reply.status(201).send({ runId, sessionId, status: "running" });
   });
@@ -19964,7 +20354,8 @@ async function executeDiscovery(opts) {
   }).where(eq26(discoverySessions.id, opts.sessionId)).run();
   const seedResult = await opts.deps.seed({
     project: opts.project,
-    icpDescription: opts.icpDescription
+    icpDescription: opts.icpDescription,
+    locations: opts.locations ?? []
   });
   const rawCandidates = dedupeStrings(seedResult.candidates);
   const seedCountRaw = rawCandidates.length;
@@ -20169,6 +20560,8 @@ async function apiRoutes(app, opts) {
       resolveCloudRunAccessToken: opts.resolveCloudRunAccessToken,
       wordpressTrafficCredentialStore: opts.wordpressTrafficCredentialStore,
       pullWordpressTrafficEvents: opts.pullWordpressTrafficEvents,
+      vercelTrafficCredentialStore: opts.vercelTrafficCredentialStore,
+      pullVercelTrafficEvents: opts.pullVercelTrafficEvents,
       onTrafficSynced: opts.onTrafficSynced
     });
     await api.register(backlinksRoutes, {
@@ -20282,6 +20675,54 @@ function buildTrafficSourceValidators(opts) {
       validateScopes: () => null
     };
   }
+  if (opts.vercelTrafficCredentialStore) {
+    const store = opts.vercelTrafficCredentialStore;
+    const pullEvents = opts.pullVercelTrafficEvents ?? listVercelTrafficEvents;
+    validators[TrafficSourceTypes.vercel] = {
+      validateCredentials: async (source) => {
+        const record = store.getConnection(source.projectName);
+        if (!record) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.missing",
+            summary: `No Vercel credential found in ~/.canonry/config.yaml for project "${source.projectName}".`,
+            remediation: "Re-run `canonry traffic connect vercel <project> --project-id <prj> --team-id <team> --token <token>`."
+          };
+        }
+        try {
+          const probeEnd = Date.now();
+          await pullEvents({
+            token: record.token,
+            projectId: record.projectId,
+            teamId: record.teamId,
+            environment: record.environment,
+            startDate: probeEnd - 60 * 6e4,
+            endDate: probeEnd,
+            maxPages: 1
+          });
+          return {
+            status: CheckStatuses.ok,
+            code: "traffic.credentials.resolved",
+            summary: `Vercel request-logs responds for "${source.displayName}" (project ${record.projectId}).`
+          };
+        } catch (e) {
+          const httpStatus = e instanceof VercelLogsApiError ? e.status : null;
+          const msg = e instanceof Error ? e.message : String(e);
+          return {
+            status: CheckStatuses.fail,
+            code: httpStatus === 401 || httpStatus === 403 ? "traffic.credentials.unauthorized" : "traffic.credentials.resolve-failed",
+            summary: httpStatus ? `Vercel request-logs returned HTTP ${httpStatus}: ${msg}.` : `Vercel request-logs probe failed: ${msg}.`,
+            remediation: "Verify the Vercel API token is unexpired and the project / team ids are correct. Vercel tokens can expire \u2014 re-connect the source with a fresh token if needed."
+          };
+        }
+      },
+      // Vercel API tokens have no granular per-resource scopes — a token
+      // inherits the user's team access, so there is no "missing scope"
+      // failure mode. Surface a skipped result so the framework stays
+      // uniform without producing a false signal.
+      validateScopes: () => null
+    };
+  }
   return Object.keys(validators).length > 0 ? validators : void 0;
 }
 
@@ -22799,8 +23240,40 @@ function removeWordpressTrafficConnection(config, projectName) {
   return true;
 }
 
-// src/wordpress-config.ts
+// src/vercel-traffic-config.ts
 function ensureConnections5(config) {
+  if (!config.vercelTraffic) config.vercelTraffic = {};
+  if (!config.vercelTraffic.connections) config.vercelTraffic.connections = [];
+  return config.vercelTraffic.connections;
+}
+function getVercelTrafficConnection(config, projectName) {
+  return (config.vercelTraffic?.connections ?? []).find((c) => c.projectName === projectName);
+}
+function upsertVercelTrafficConnection(config, connection) {
+  const connections = ensureConnections5(config);
+  const index = connections.findIndex((c) => c.projectName === connection.projectName);
+  if (index === -1) {
+    connections.push(connection);
+    return connection;
+  }
+  connections[index] = connection;
+  return connection;
+}
+function removeVercelTrafficConnection(config, projectName) {
+  const connections = config.vercelTraffic?.connections;
+  if (!connections?.length) return false;
+  const next = connections.filter((c) => c.projectName !== projectName);
+  if (next.length === connections.length) return false;
+  if (!config.vercelTraffic) return false;
+  config.vercelTraffic.connections = next;
+  if (next.length === 0) {
+    delete config.vercelTraffic;
+  }
+  return true;
+}
+
+// src/wordpress-config.ts
+function ensureConnections6(config) {
   if (!config.wordpress) config.wordpress = {};
   if (!config.wordpress.connections) config.wordpress.connections = [];
   return config.wordpress.connections;
@@ -22817,7 +23290,7 @@ function getWordpressConnection(config, projectName) {
   return (config.wordpress?.connections ?? []).find((connection) => connection.projectName === projectName);
 }
 function upsertWordpressConnection(config, connection) {
-  const connections = ensureConnections5(config);
+  const connections = ensureConnections6(config);
   const normalized = normalizeConnection(connection);
   const index = connections.findIndex((entry) => entry.projectName === connection.projectName);
   if (index === -1) {
@@ -24523,6 +24996,7 @@ async function executeDiscoveryRun(opts) {
       icpDescription: opts.icpDescription,
       dedupThreshold: opts.dedupThreshold,
       maxProbes: opts.maxProbes,
+      locations: opts.locations,
       deps
     });
     writeDiscoveryInsight(opts.db, {
@@ -24680,12 +25154,32 @@ function extractClassificationCategory(line) {
   }
   return null;
 }
+function formatLocationLine(location) {
+  return [location.city, location.region, location.country].map((part) => part.trim()).filter(Boolean).join(", ");
+}
+function buildLocationConstraint(locations) {
+  if (locations.length === 0) return [];
+  const formatted = locations.map(formatLocationLine);
+  if (locations.length === 1) {
+    return [
+      `The business serves ${formatted[0]}. Every query must be relevant to that service area \u2014 work the city or region into the query the way a real searcher would.`
+    ];
+  }
+  const perLocation = Math.max(1, Math.floor(DEFAULT_SEED_COUNT / locations.length));
+  return [
+    "The business serves these locations:",
+    ...formatted.map((line) => ` - ${line}`),
+    `Generate at least ${perLocation} queries for EACH service area listed above so coverage stays balanced \u2014 do not let one area dominate. Every query must be relevant to at least one of these service areas, working the city or region into the query the way a real searcher would.`
+  ];
+}
 function buildSeedPrompt(input) {
+  const locationConstraint = buildLocationConstraint(input.locations ?? []);
   return [
     "You are an AEO (Answer Engine Optimization) analyst expanding a tracked-query basket for a customer.",
     "",
     `Customer: ${input.project.name} (domains: ${input.project.canonicalDomains.join(", ")})`,
     `ICP: ${input.icpDescription}`,
+    ...locationConstraint.length > 0 ? ["", ...locationConstraint] : [],
     "",
     "Brainstorm a wide set of queries a member of this ICP would type into an AI answer engine (Gemini, ChatGPT, Perplexity) when they are about to make a decision in this space. Aim for 30+ candidates covering:",
     ' - Comparison queries ("best X for Y")',
@@ -27530,6 +28024,21 @@ async function createServer(opts) {
       return removed;
     }
   };
+  const vercelTrafficCredentialStore = {
+    getConnection: (projectName) => {
+      return getVercelTrafficConnection(opts.config, projectName);
+    },
+    upsertConnection: (record) => {
+      const updated = upsertVercelTrafficConnection(opts.config, record);
+      saveConfigPatch(opts.config);
+      return updated;
+    },
+    deleteConnection: (projectName) => {
+      const removed = removeVercelTrafficConnection(opts.config, projectName);
+      if (removed) saveConfigPatch(opts.config);
+      return removed;
+    }
+  };
   const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto34.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
@@ -27832,7 +28341,8 @@ async function createServer(opts) {
         projectId: input.projectId,
         icpDescription: input.icpDescription,
         dedupThreshold: input.dedupThreshold,
-        maxProbes: input.maxProbes
+        maxProbes: input.maxProbes,
+        locations: input.locations
       }).then(() => runCoordinator.onRunCompleted(input.runId, input.projectId)).catch((err) => {
         app.log.error({ runId: input.runId, err }, "Discovery run failed");
       });
@@ -27889,6 +28399,7 @@ async function createServer(opts) {
     ga4CredentialStore,
     cloudRunCredentialStore,
     wordpressTrafficCredentialStore,
+    vercelTrafficCredentialStore,
     onTrafficSynced: (event) => {
       trackEvent("traffic.synced", {
         status: event.status,