@ainyc/canonry 4.33.1 → 4.35.0

package/dist/{chunk-BJXHETQW.js → chunk-MLS5KJWK.js}

@@ -8,7 +8,7 @@ import {
   categoryLabel,
   determineAnswerMentioned,
   normalizeProjectDomain
-} from "./chunk-XW3F5EEW.js";
+} from "./chunk-EM5GVF3C.js";
 
 // src/intelligence-service.ts
 import { eq, desc, asc, and, or, inArray } from "drizzle-orm";
@@ -68,6 +68,7 @@ var projects = sqliteTable("projects", {
   displayName: text("display_name").notNull(),
   canonicalDomain: text("canonical_domain").notNull(),
   ownedDomains: text("owned_domains").notNull().default("[]"),
+  aliases: text("aliases").notNull().default("[]"),
   country: text("country").notNull(),
   language: text("language").notNull(),
   tags: text("tags").notNull().default("[]"),
@@ -123,7 +124,14 @@ var runs = sqliteTable("runs", {
 var querySnapshots = sqliteTable("query_snapshots", {
   id: text("id").primaryKey(),
   runId: text("run_id").notNull().references(() => runs.id, { onDelete: "cascade" }),
-  queryId: text("query_id").notNull().references(() => queries.id, { onDelete: "cascade" }),
+  // `query_id` is nullable + `ON DELETE SET NULL` so historical snapshots
+  // outlive their queries row. Pre-v58 this FK cascaded — deleting a tracked
+  // query (PUT /queries replace, individual delete, `canonry apply` dropping
+  // one) silently wiped the entire citation history for that query. With SET
+  // NULL the snapshot survives; `queryText` keeps it self-describing when
+  // the queries row is gone.
+  queryId: text("query_id").references(() => queries.id, { onDelete: "set null" }),
+  queryText: text("query_text"),
   provider: text("provider").notNull().default("gemini"),
   model: text("model"),
   citationState: text("citation_state").notNull(),
@@ -146,7 +154,12 @@ var querySnapshots = sqliteTable("query_snapshots", {
 ]);
 var auditLog = sqliteTable("audit_log", {
   id: text("id").primaryKey(),
-  projectId: text("project_id").references(() => projects.id, { onDelete: "cascade" }),
+  // SET NULL (not CASCADE) so deleting a project preserves its audit trail.
+  // The DELETE /projects route writes a "project.deleted" row immediately
+  // before the delete — a CASCADE here would wipe that record before any
+  // reader could see it (the deletion would erase the only evidence it
+  // happened). Detached rows surface in audit queries with project_id=NULL.
+  projectId: text("project_id").references(() => projects.id, { onDelete: "set null" }),
   actor: text("actor").notNull(),
   action: text("action").notNull(),
   entityType: text("entity_type").notNull(),
@@ -1804,6 +1817,129 @@ var MIGRATION_VERSIONS = [
     statements: [
       `ALTER TABLE runs ADD COLUMN queries TEXT`
     ]
+  },
+  {
+    version: 58,
+    name: "snapshots-preserve-on-query-delete",
+    // The legacy `query_snapshots.query_id` FK was `ON DELETE CASCADE`, so a
+    // routine basket edit (PUT /queries replace, individual delete, `canonry
+    // apply` dropping a query) silently destroyed every historical citation
+    // snapshot for the removed queries — the regression history, transitions,
+    // and competitor-overlap evidence that are canonry's whole value.
+    //
+    // Fix: rebuild `query_snapshots` with `query_id` nullable + `ON DELETE
+    // SET NULL`, and add a denormalized `query_text` column populated from
+    // `queries.query` via the join. SQLite can't change FK or NOT NULL in
+    // place — same canonical table-rebuild pattern v53 used. All statements
+    // run inside the migration runner's single transaction.
+    //
+    // `run_id` keeps `ON DELETE CASCADE` — deleting a run legitimately
+    // removes its snapshots. Indexes are recreated on the renamed table.
+    statements: [
+      `CREATE TABLE IF NOT EXISTS query_snapshots_v58 (
+         id                       TEXT PRIMARY KEY,
+         run_id                   TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+         query_id                 TEXT REFERENCES queries(id) ON DELETE SET NULL,
+         query_text               TEXT,
+         provider                 TEXT NOT NULL DEFAULT 'gemini',
+         model                    TEXT,
+         citation_state           TEXT NOT NULL,
+         answer_mentioned         INTEGER,
+         answer_text              TEXT,
+         cited_domains            TEXT NOT NULL DEFAULT '[]',
+         competitor_overlap       TEXT NOT NULL DEFAULT '[]',
+         recommended_competitors  TEXT NOT NULL DEFAULT '[]',
+         location                 TEXT,
+         screenshot_path          TEXT,
+         raw_response             TEXT,
+         created_at               TEXT NOT NULL
+       )`,
+      // Backfill `query_text` from joined queries.query so existing snapshots
+      // stay readable even if their query is later deleted.
+      //
+      // IMPORTANT: we use `q.id` (the JOINED queries.id), not `qs.query_id`.
+      // Production DBs may already contain snapshots whose `qs.query_id`
+      // dangles — a queries row was hard-deleted at some point without
+      // cascading (PRAGMA foreign_keys was OFF, or pre-FK schema). Copying
+      // `qs.query_id` directly would re-introduce those dangling refs into
+      // the new table, which now validates them at INSERT (the new FK still
+      // requires query_id values to match queries.id when non-null). Reading
+      // through the LEFT JOIN forces every value to be either a valid `q.id`
+      // or NULL — pre-existing orphans land with NULL `query_id` / NULL
+      // `query_text`, preserving the snapshot row instead of failing the
+      // migration. The May 2026 azcoatings DB had 459 such pre-existing
+      // orphans; without this guard, migrate() throws SQLITE_CONSTRAINT_FOREIGNKEY.
+      `INSERT INTO query_snapshots_v58 (
+         id, run_id, query_id, query_text, provider, model, citation_state,
+         answer_mentioned, answer_text, cited_domains, competitor_overlap,
+         recommended_competitors, location, screenshot_path, raw_response,
+         created_at
+       )
+       SELECT qs.id, qs.run_id, q.id, q.query, qs.provider, qs.model,
+              qs.citation_state, qs.answer_mentioned, qs.answer_text,
+              qs.cited_domains, qs.competitor_overlap, qs.recommended_competitors,
+              qs.location, qs.screenshot_path, qs.raw_response, qs.created_at
+       FROM query_snapshots qs
+       LEFT JOIN queries q ON q.id = qs.query_id`,
+      `DROP TABLE query_snapshots`,
+      `ALTER TABLE query_snapshots_v58 RENAME TO query_snapshots`,
+      // Recreate the indexes that didn't survive the rename.
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_run ON query_snapshots(run_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_query ON query_snapshots(query_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_citation_state ON query_snapshots(citation_state)`,
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_provider_model ON query_snapshots(provider, model)`,
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_location ON query_snapshots(location)`,
+      `CREATE INDEX IF NOT EXISTS idx_snapshots_created_at ON query_snapshots(created_at)`
+    ]
+  },
+  {
+    version: 59,
+    name: "projects-aliases",
+    statements: [
+      `ALTER TABLE projects ADD COLUMN aliases TEXT NOT NULL DEFAULT '[]'`
+    ]
+  },
+  {
+    version: 60,
+    name: "audit-log-preserve-on-project-delete",
+    // The legacy `audit_log.project_id` FK was `ON DELETE CASCADE`, so any
+    // `DELETE /projects/:name` call cascade-wiped every audit row for that
+    // project — including the `project.deleted` row the route handler had
+    // just written in the same path. The deletion erased the only record
+    // that the deletion happened, defeating the entire purpose of the
+    // audit log.
+    //
+    // Fix: rebuild `audit_log` with `project_id` as `ON DELETE SET NULL`.
+    // Existing rows survive verbatim; future deletions detach audit rows
+    // from the project (project_id=NULL) instead of erasing them. SQLite
+    // can't change FK behavior in place — same canonical table-rebuild
+    // pattern v58 used for `query_snapshots`.
+    statements: [
+      `CREATE TABLE IF NOT EXISTS audit_log_v60 (
+         id           TEXT PRIMARY KEY,
+         project_id   TEXT REFERENCES projects(id) ON DELETE SET NULL,
+         actor        TEXT NOT NULL,
+         action       TEXT NOT NULL,
+         entity_type  TEXT NOT NULL,
+         entity_id    TEXT,
+         diff         TEXT,
+         created_at   TEXT NOT NULL
+       )`,
+      // LEFT JOIN guard mirrors v58: if a pre-existing row carries a
+      // dangling project_id (from a pre-FK era or a write with
+      // PRAGMA foreign_keys=OFF), the join nulls it out rather than
+      // failing the migration on the new FK validation.
+      `INSERT INTO audit_log_v60 (
+         id, project_id, actor, action, entity_type, entity_id, diff, created_at
+       )
+       SELECT a.id, p.id, a.actor, a.action, a.entity_type, a.entity_id, a.diff, a.created_at
+       FROM audit_log a
+       LEFT JOIN projects p ON p.id = a.project_id`,
+      `DROP TABLE audit_log`,
+      `ALTER TABLE audit_log_v60 RENAME TO audit_log`,
+      `CREATE INDEX IF NOT EXISTS idx_audit_log_project ON audit_log(project_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at)`
+    ]
   }
 ];
 function isDuplicateColumnError(err) {
@@ -1987,20 +2123,32 @@ function pickGroupRepresentative(group) {
   return best;
 }
 
+// ../db/src/snapshot-helpers.ts
+function filterTrackedSnapshots(rows) {
+  return rows.filter((r) => r.queryId !== null);
+}
+
 // ../intelligence/src/regressions.ts
+function snapshotKey(snap) {
+  const loc = snap.location ?? "__none__";
+  return JSON.stringify([snap.query, snap.provider, loc]);
+}
 function detectRegressions(currentRun, previousRun) {
+  if ((currentRun.location ?? null) !== (previousRun.location ?? null)) {
+    return [];
+  }
   const regressions = [];
   const previousCited = /* @__PURE__ */ new Map();
   for (const snap of previousRun.snapshots) {
     if (snap.cited) {
-      previousCited.set(`${snap.query}:${snap.provider}`, {
+      previousCited.set(snapshotKey(snap), {
         citationUrl: snap.citationUrl,
         position: snap.position
       });
     }
   }
   for (const snap of currentRun.snapshots) {
-    const key = `${snap.query}:${snap.provider}`;
+    const key = snapshotKey(snap);
     if (!snap.cited && previousCited.has(key)) {
       const prev = previousCited.get(key);
       regressions.push({
@@ -2017,16 +2165,23 @@ function detectRegressions(currentRun, previousRun) {
 }
 
 // ../intelligence/src/gains.ts
+function snapshotKey2(snap) {
+  const loc = snap.location ?? "__none__";
+  return JSON.stringify([snap.query, snap.provider, loc]);
+}
 function detectGains(currentRun, previousRun) {
+  if ((currentRun.location ?? null) !== (previousRun.location ?? null)) {
+    return [];
+  }
   const gains = [];
   const previousCited = /* @__PURE__ */ new Set();
   for (const snap of previousRun.snapshots) {
     if (snap.cited) {
-      previousCited.add(`${snap.query}:${snap.provider}`);
+      previousCited.add(snapshotKey2(snap));
     }
   }
   for (const snap of currentRun.snapshots) {
-    const key = `${snap.query}:${snap.provider}`;
+    const key = snapshotKey2(snap);
     if (snap.cited && !previousCited.has(key)) {
       gains.push({
         query: snap.query,
@@ -2087,17 +2242,26 @@ function computeHealthTrend(runs2) {
 
 // ../intelligence/src/causes.ts
 function analyzeCause(regression, currentSnapshots) {
-  const currentSnap = currentSnapshots.find(
-    (s) => s.query === regression.query && s.provider === regression.provider && !s.cited && s.competitorDomains && s.competitorDomains.length > 0
+  const matchingSnaps = currentSnapshots.filter(
+    (s) => s.query === regression.query && s.provider === regression.provider && !s.cited
   );
-  if (currentSnap) {
-    const competitor = currentSnap.competitorDomains[0];
+  const withCompetitor = matchingSnaps.find((s) => s.competitorDomains?.length);
+  if (withCompetitor) {
+    const competitor = withCompetitor.competitorDomains[0];
     return {
       cause: "competitor_gain",
       competitorDomain: competitor,
       details: `Competitor ${competitor} now cited for "${regression.query}" on ${regression.provider}`
     };
   }
+  const withCited = matchingSnaps.find((s) => s.citedDomains?.length);
+  if (withCited) {
+    const top = withCited.citedDomains.slice(0, 3);
+    return {
+      cause: "third_party_displacement",
+      details: `${regression.provider} now grounds on ${top.join(", ")} for "${regression.query}" \u2014 none are tracked competitors.`
+    };
+  }
   return {
     cause: "unknown",
     details: `No specific cause identified for loss of "${regression.query}" on ${regression.provider}`
@@ -2540,10 +2704,13 @@ function buildDrivers(input) {
   if (input.action === "create" && input.position === null) {
     drivers.push("no existing page");
   }
-  if (input.position !== null && input.position > 30) {
-    drivers.push(`page ranks #${input.position} (effectively invisible)`);
-  } else if (input.position !== null && input.position > 10) {
-    drivers.push(`page ranks #${input.position}`);
+  if (input.position !== null) {
+    const positionDisplay = Math.round(input.position);
+    if (input.position > 30) {
+      drivers.push(`page ranks #${positionDisplay} (effectively invisible)`);
+    } else if (input.position > 10) {
+      drivers.push(`page ranks #${positionDisplay}`);
+    }
   }
   if (input.action === "add-schema") {
     drivers.push("cited by LLMs but lacks structured data");
@@ -2814,7 +2981,7 @@ function classifyRegressionSeverity(signals) {
 }
 
 // ../intelligence/src/insight-grouping.ts
-function groupInsights(insights2, keyFn = (i) => `${i.query} ${i.provider} ${i.type}`) {
+function groupInsights(insights2, keyFn = (i) => JSON.stringify([i.query, i.provider, i.type])) {
   const order = [];
   const buckets = /* @__PURE__ */ new Map();
   for (const i of insights2) {
@@ -2846,14 +3013,15 @@ var MIN_BRAND_TOKEN_LENGTH = 3;
 function compact(value) {
   return value.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function buildBrandTokens(canonicalDomain, displayName) {
+function buildBrandTokens(canonicalDomain, brandNames = []) {
   const seen = /* @__PURE__ */ new Set();
   const stem = canonicalDomain.toLowerCase().replace(/\.[a-z]{2,}$/, "");
   const stemCompact = compact(stem);
   if (stemCompact.length >= MIN_BRAND_TOKEN_LENGTH) seen.add(stemCompact);
-  if (displayName) {
-    const displayCompact = compact(displayName);
-    if (displayCompact.length >= MIN_BRAND_TOKEN_LENGTH) seen.add(displayCompact);
+  for (const name of brandNames) {
+    if (!name) continue;
+    const nameCompact = compact(name);
+    if (nameCompact.length >= MIN_BRAND_TOKEN_LENGTH) seen.add(nameCompact);
   }
   return [...seen];
 }
@@ -3000,7 +3168,7 @@ function extractHostFromUri(uri) {
 }
 
 // ../intelligence/src/mention-landscape.ts
-function buildMentionLandscape(snapshots, competitorDomains, projectDisplayName, projectDomains, queryLookup) {
+function buildMentionLandscape(snapshots, competitorDomains, projectBrandNames, projectDomains, queryLookup) {
   let projectMentionCount = 0;
   let totalAnswerSnapshots = 0;
   const competitorMap = /* @__PURE__ */ new Map();
@@ -3014,13 +3182,13 @@ function buildMentionLandscape(snapshots, competitorDomains, projectDisplayName,
     const q = queryLookup.byId.get(snap.queryId);
     const projectMentioned = snap.answerMentioned ?? determineAnswerMentioned(
       text2,
-      projectDisplayName,
+      [...projectBrandNames],
       [...projectDomains]
     );
     if (projectMentioned) projectMentionCount++;
     for (const competitor of competitorDomains) {
       const brand = brandLabelFromDomain(competitor);
-      const mentioned = determineAnswerMentioned(text2, brand, [competitor]);
+      const mentioned = determineAnswerMentioned(text2, brand ? [brand] : [], [competitor]);
       if (mentioned) {
         const entry = competitorMap.get(competitor);
         entry.count++;
@@ -3388,17 +3556,29 @@ var IntelligenceService = class {
       log.info("intelligence.skip", { runId, reason: "run not in recent completed list" });
       return null;
     }
-    const currentRun = this.buildRunData(runId, projectId, currentRunRecord.finishedAt ?? currentRunRecord.createdAt);
+    const currentRun = this.buildRunData(
+      runId,
+      projectId,
+      currentRunRecord.finishedAt ?? currentRunRecord.createdAt,
+      currentRunRecord.location ?? null
+    );
     if (currentRun.snapshots.length === 0) {
       log.info("intelligence.skip", { runId, reason: "no snapshots" });
       return null;
     }
     const orderedRecent = [...recentRuns].reverse();
-    const currentIdx = orderedRecent.findIndex((r) => r.id === runId);
-    const previousRunRecord = currentIdx > 0 ? orderedRecent[currentIdx - 1] : null;
-    const previousRun = previousRunRecord ? this.buildRunData(previousRunRecord.id, projectId, previousRunRecord.finishedAt ?? previousRunRecord.createdAt) : null;
+    const currentLocation = currentRunRecord.location ?? null;
+    const sameLocationOrdered = orderedRecent.filter((r) => (r.location ?? null) === currentLocation);
+    const currentLocIdx = sameLocationOrdered.findIndex((r) => r.id === runId);
+    const previousRunRecord = currentLocIdx > 0 ? sameLocationOrdered[currentLocIdx - 1] : null;
+    const previousRun = previousRunRecord ? this.buildRunData(
+      previousRunRecord.id,
+      projectId,
+      previousRunRecord.finishedAt ?? previousRunRecord.createdAt,
+      previousRunRecord.location ?? null
+    ) : null;
     const trackedCompetitors = this.loadTrackedCompetitors(projectId);
-    const history = orderedRecent.slice(0, currentIdx + 1).map((r) => r.id === runId ? currentRun : this.buildRunData(r.id, projectId, r.finishedAt ?? r.createdAt));
+    const history = sameLocationOrdered.slice(0, currentLocIdx + 1).map((r) => r.id === runId ? currentRun : this.buildRunData(r.id, projectId, r.finishedAt ?? r.createdAt, r.location ?? null));
     if (!previousRun) {
       const result2 = analyzeRuns(currentRun, currentRun, { trackedCompetitors, history });
       log.info("intelligence.analyzed", {
@@ -3433,13 +3613,23 @@ var IntelligenceService = class {
    * Used by backfill where we control the run ordering.
    */
   analyzeRunWithPrevious(runRecord, previousRunRecord, historyRecords) {
-    const currentRun = this.buildRunData(runRecord.id, runRecord.projectId, runRecord.finishedAt ?? runRecord.createdAt);
+    const currentRun = this.buildRunData(
+      runRecord.id,
+      runRecord.projectId,
+      runRecord.finishedAt ?? runRecord.createdAt,
+      runRecord.location ?? null
+    );
     if (currentRun.snapshots.length === 0) {
       return null;
     }
-    const previousRun = previousRunRecord ? this.buildRunData(previousRunRecord.id, previousRunRecord.projectId, previousRunRecord.finishedAt ?? previousRunRecord.createdAt) : null;
+    const previousRun = previousRunRecord ? this.buildRunData(
+      previousRunRecord.id,
+      previousRunRecord.projectId,
+      previousRunRecord.finishedAt ?? previousRunRecord.createdAt,
+      previousRunRecord.location ?? null
+    ) : null;
     const trackedCompetitors = this.loadTrackedCompetitors(runRecord.projectId);
-    const history = (historyRecords ?? []).map((r) => r.id === runRecord.id ? currentRun : this.buildRunData(r.id, r.projectId, r.finishedAt ?? r.createdAt));
+    const history = (historyRecords ?? []).map((r) => r.id === runRecord.id ? currentRun : this.buildRunData(r.id, r.projectId, r.finishedAt ?? r.createdAt, r.location ?? null));
     if (!previousRun) {
       const result2 = analyzeRuns(currentRun, currentRun, { trackedCompetitors, history });
       this.persistResult(this.emptyAnalysisResult(result2), runRecord.id, runRecord.projectId);
@@ -3483,10 +3673,12 @@ var IntelligenceService = class {
     let totalInsights = 0;
     for (let i = 0; i < targetRuns.length; i++) {
       const run = targetRuns[i];
-      const globalIdx = allRuns.indexOf(run);
-      const previousRun = globalIdx > 0 ? allRuns[globalIdx - 1] : null;
-      const historyStart = Math.max(0, globalIdx - (HISTORY_WINDOW_RUNS - 1));
-      const historyRecords = allRuns.slice(historyStart, globalIdx + 1);
+      const runLocation = run.location ?? null;
+      const sameLocationRuns = allRuns.filter((r) => (r.location ?? null) === runLocation);
+      const sameLocIdx = sameLocationRuns.indexOf(run);
+      const previousRun = sameLocIdx > 0 ? sameLocationRuns[sameLocIdx - 1] : null;
+      const historyStart = Math.max(0, sameLocIdx - (HISTORY_WINDOW_RUNS - 1));
+      const historyRecords = sameLocationRuns.slice(historyStart, sameLocIdx + 1);
       const result = this.analyzeRunWithPrevious(run, previousRun, historyRecords);
       if (result) {
         processed++;
@@ -3643,13 +3835,14 @@ var IntelligenceService = class {
       return { ...insight, severity };
     });
   }
-  buildRunData(runId, projectId, completedAt) {
+  buildRunData(runId, projectId, completedAt, location = null) {
     const rows = this.db.select({
       query: queries.query,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState,
       citedDomains: querySnapshots.citedDomains,
-      competitorOverlap: querySnapshots.competitorOverlap
+      competitorOverlap: querySnapshots.competitorOverlap,
+      snapshotLocation: querySnapshots.location
     }).from(querySnapshots).leftJoin(queries, eq(querySnapshots.queryId, queries.id)).where(eq(querySnapshots.runId, runId)).all();
     const snapshots = rows.map((r) => {
       const domains = parseJsonColumn(r.citedDomains, []);
@@ -3659,10 +3852,20 @@ var IntelligenceService = class {
         provider: r.provider,
         cited: r.citationState === CitationStates.cited,
         citationUrl: domains[0] ?? void 0,
-        competitorDomains: competitors2
+        // Snapshots carry their own location for downstream detectors. In
+        // practice every snapshot in a single runId shares the run's
+        // location; the per-row column is the same value duplicated, but
+        // we read it from the snapshot row so a stale runs.location can't
+        // mask snapshot truth.
+        location: r.snapshotLocation ?? location ?? null,
+        competitorDomains: competitors2,
+        // citedDomains is the FULL set (tracked competitors + third-party
+        // sources). Cause analysis uses it to name the displacing source
+        // when no tracked competitor appears in the response.
+        citedDomains: domains
       };
     });
-    return { runId, projectId, completedAt, snapshots };
+    return { runId, projectId, completedAt, location, snapshots };
   }
 };
 
@@ -3707,6 +3910,7 @@ export {
   migrate,
   groupRunsByCreatedAt,
   pickGroupRepresentative,
+  filterTrackedSnapshots,
   isBlogShapedQuery,
   buildInventory,
   buildContentTargetRows,