@ainyc/canonry 4.34.0 → 4.35.0

package/dist/{chunk-7AF6B3L6.js → chunk-NLV4MZZF.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-5EBN7736.js";
+} from "./chunk-B3FBOECD.js";
 import {
   DEFAULT_RUN_HISTORY_LIMIT,
   IntelligenceService,
@@ -39,6 +39,7 @@ import {
   ccReleaseSyncs,
   competitors,
   crawlerEventsHourly,
+  createClient,
   createLogger,
   discoveryProbes,
   discoverySessions,
@@ -60,6 +61,7 @@ import {
   isBlogShapedQuery,
   isTrendBaseline,
   mapOpportunitiesToNextSteps,
+  migrate,
   notifications,
   parseJsonColumn,
   pickGroupRepresentative,
@@ -71,7 +73,7 @@ import {
   schedules,
   trafficSources,
   usageCounters
-} from "./chunk-7256SFYT.js";
+} from "./chunk-MLS5KJWK.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -90,6 +92,7 @@ import {
   DiscoveryCompetitorTypes,
   DiscoverySessionStatuses,
   MemorySources,
+  ProviderNames,
   RunKinds,
   RunStatuses,
   RunTriggers,
@@ -127,6 +130,7 @@ import {
   discoveryBucketSchema,
   discoveryPromoteRequestSchema,
   discoveryRunRequestSchema,
+  effectiveBrandNames,
   effectiveDomains,
   emptyCitationVisibility,
   extractAnswerMentions,
@@ -144,7 +148,9 @@ import {
   isBrowserProvider,
   keywordGenerateRequestSchema,
   locationContextSchema,
+  mentionStateFromAnswerMentioned,
   missingDependency,
+  normalizeProjectAliases,
   normalizeProjectDomain,
   normalizeUrlPath,
   notFound,
@@ -180,7 +186,7 @@ import {
   visibilityStateFromAnswerMentioned,
   windowCutoff,
   wordpressEnvSchema
-} from "./chunk-XW3F5EEW.js";
+} from "./chunk-EM5GVF3C.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -333,13 +339,146 @@ function trackEvent(event, properties, options) {
   }).finally(() => clearTimeout(timeout));
 }
 
+// src/update-check.ts
+import { createRequire as createRequire2 } from "module";
+var _require2 = createRequire2(import.meta.url);
+var { version: PKG_VERSION } = _require2("../package.json");
+var PKG_NAME = "@ainyc/canonry";
+var NPM_DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${PKG_NAME}/dist-tags`;
+var NPM_PACKAGE_URL = `https://www.npmjs.com/package/${PKG_NAME}`;
+var FETCH_TIMEOUT_MS = 1500;
+function isUpdateCheckEnabled() {
+  if (process.env.CANONRY_DISABLE_UPDATE_CHECK === "1") return false;
+  if (process.env.DO_NOT_TRACK === "1") return false;
+  if (process.env.CI) return false;
+  if (!configExists()) return true;
+  try {
+    const raw = loadConfigRaw();
+    return raw?.updateCheck !== false;
+  } catch {
+    return true;
+  }
+}
+function compareSemver(a, b) {
+  const parse = (v) => {
+    const core = v.split(/[-+]/)[0];
+    if (!core) return null;
+    const parts = core.split(".");
+    if (parts.length < 3) return null;
+    const nums = [];
+    for (let i = 0; i < 3; i++) {
+      const n = Number(parts[i]);
+      if (!Number.isInteger(n) || n < 0) return null;
+      nums.push(n);
+    }
+    return [nums[0], nums[1], nums[2]];
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] > pb[i]) return 1;
+    if (pa[i] < pb[i]) return -1;
+  }
+  return 0;
+}
+async function fetchLatestVersion(opts) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? FETCH_TIMEOUT_MS);
+  timeout.unref();
+  try {
+    const res = await fetch(NPM_DIST_TAGS_URL, {
+      signal: controller.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.latest !== "string") return null;
+    return data.latest;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function buildUpdateAvailable(current, latest) {
+  if (compareSemver(latest, current) <= 0) return null;
+  return {
+    current,
+    latest,
+    url: NPM_PACKAGE_URL,
+    upgradeCommand: `npm install -g ${PKG_NAME}`
+  };
+}
+async function checkLatestVersionForCli(opts) {
+  if (!isUpdateCheckEnabled()) return null;
+  if (!configExists()) return null;
+  const now = opts?.now ? opts.now() : /* @__PURE__ */ new Date();
+  const ttlMs = (opts?.ttlHours ?? 24) * 60 * 60 * 1e3;
+  let raw;
+  try {
+    raw = loadConfigRaw();
+  } catch {
+    return null;
+  }
+  if (!raw) return null;
+  const lastCheckedAt = raw.lastUpdateCheckAt ? Date.parse(raw.lastUpdateCheckAt) : NaN;
+  const cachedLatest = typeof raw.lastKnownLatestVersion === "string" ? raw.lastKnownLatestVersion : void 0;
+  if (Number.isFinite(lastCheckedAt) && now.getTime() - lastCheckedAt < ttlMs) {
+    if (!cachedLatest) return null;
+    return buildUpdateAvailable(PKG_VERSION, cachedLatest);
+  }
+  const latest = await fetchLatestVersion();
+  if (!latest) {
+    try {
+      saveConfigPatch({ lastUpdateCheckAt: now.toISOString() });
+    } catch {
+    }
+    return null;
+  }
+  try {
+    saveConfigPatch({
+      lastUpdateCheckAt: now.toISOString(),
+      lastKnownLatestVersion: latest
+    });
+  } catch {
+  }
+  return buildUpdateAvailable(PKG_VERSION, latest);
+}
+var memoryCache = null;
+var inFlight = null;
+function startBackgroundRefresh(getNow) {
+  if (inFlight) return;
+  inFlight = (async () => {
+    try {
+      const latest = await fetchLatestVersion();
+      memoryCache = { fetchedAt: getNow(), latest };
+    } catch {
+      memoryCache = { fetchedAt: getNow(), latest: null };
+    } finally {
+      inFlight = null;
+    }
+  })();
+}
+function checkLatestVersionForServer(opts) {
+  if (!isUpdateCheckEnabled()) return null;
+  const getNow = opts?.now ?? Date.now;
+  const ttl = opts?.ttlMs ?? 60 * 60 * 1e3;
+  const now = getNow();
+  if (!memoryCache || now - memoryCache.fetchedAt >= ttl) {
+    startBackgroundRefresh(getNow);
+  }
+  if (!memoryCache || !memoryCache.latest) return null;
+  return buildUpdateAvailable(PKG_VERSION, memoryCache.latest);
+}
+
 // src/server.ts
-import { createRequire as createRequire3 } from "module";
+import { createRequire as createRequire4 } from "module";
 import crypto34 from "crypto";
 import fs12 from "fs";
 import path14 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { eq as eq40 } from "drizzle-orm";
+import { eq as eq41 } from "drizzle-orm";
 import Fastify from "fastify";
 
 // ../api-routes/src/auth.ts
@@ -440,7 +579,11 @@ function resolveSnapshotMentionResult(snapshot, project) {
       canonicalDomain: project.canonicalDomain,
       ownedDomains: normalizeOwnedDomains(project.ownedDomains)
     });
-    return extractAnswerMentions(snapshot.answerText, project.displayName, domains);
+    const brandNames = effectiveBrandNames({
+      displayName: project.displayName,
+      aliases: normalizeOwnedDomains(project.aliases)
+    });
+    return extractAnswerMentions(snapshot.answerText, brandNames, domains);
   }
   if (typeof snapshot.answerMentioned === "boolean") {
     return { mentioned: snapshot.answerMentioned, matchedTerms: [] };
@@ -453,6 +596,9 @@ function resolveSnapshotAnswerMentioned(snapshot, project) {
 function resolveSnapshotVisibilityState(snapshot, project) {
   return visibilityStateFromAnswerMentioned(resolveSnapshotMentionResult(snapshot, project).mentioned);
 }
+function resolveSnapshotMentionState(snapshot, project) {
+  return mentionStateFromAnswerMentioned(resolveSnapshotMentionResult(snapshot, project).mentioned);
+}
 function resolveSnapshotMatchedTerms(snapshot, project) {
   return resolveSnapshotMentionResult(snapshot, project).matchedTerms;
 }
@@ -503,12 +649,16 @@ async function projectRoutes(app, opts) {
       });
     }
     const nextAutoExtractBacklinks = body.autoExtractBacklinks !== void 0 ? body.autoExtractBacklinks ? 1 : 0 : existing?.autoExtractBacklinks ?? 0;
+    const nextAliases = normalizeProjectAliases(body.displayName, body.aliases ?? []);
     if (existing) {
+      const prevAliases = parseJsonColumn(existing.aliases, []);
+      const aliasesChanged = !aliasArraysEqual(prevAliases, nextAliases);
       app.db.transaction((tx) => {
         tx.update(projects).set({
           displayName: body.displayName,
           canonicalDomain: body.canonicalDomain,
           ownedDomains: JSON.stringify(body.ownedDomains ?? []),
+          aliases: JSON.stringify(nextAliases),
           country: body.country,
           language: body.language,
           tags: JSON.stringify(body.tags ?? []),
@@ -530,6 +680,7 @@ async function projectRoutes(app, opts) {
         });
       });
       opts.onProjectUpserted?.(existing.id, name);
+      if (aliasesChanged) opts.onAliasesChanged?.(existing.id, name);
       const updated = app.db.select().from(projects).where(eq3(projects.id, existing.id)).get();
       return reply.status(200).send(formatProject(updated));
     }
@@ -541,6 +692,7 @@ async function projectRoutes(app, opts) {
         displayName: body.displayName,
         canonicalDomain: body.canonicalDomain,
         ownedDomains: JSON.stringify(body.ownedDomains ?? []),
+        aliases: JSON.stringify(nextAliases),
         country: body.country,
         language: body.language,
         tags: JSON.stringify(body.tags ?? []),
@@ -688,6 +840,7 @@ async function projectRoutes(app, opts) {
         displayName: project.displayName,
         canonicalDomain: project.canonicalDomain,
         ownedDomains: parseJsonColumn(project.ownedDomains, []),
+        aliases: parseJsonColumn(project.aliases, []),
         country: project.country,
         language: project.language,
         queries: qs.map((q) => q.query),
@@ -723,6 +876,7 @@ function formatProject(row) {
     displayName: row.displayName,
     canonicalDomain: row.canonicalDomain,
     ownedDomains: parseJsonColumn(row.ownedDomains, []),
+    aliases: parseJsonColumn(row.aliases, []),
     country: row.country,
     language: row.language,
     tags: parseJsonColumn(row.tags, []),
@@ -737,6 +891,13 @@ function formatProject(row) {
     updatedAt: row.updatedAt
   };
 }
+function aliasArraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].toLowerCase() !== b[i].toLowerCase()) return false;
+  }
+  return true;
+}
 
 // ../api-routes/src/queries.ts
 import crypto5 from "crypto";
@@ -1139,7 +1300,7 @@ function parseCompetitorBatch(value) {
 
 // ../api-routes/src/runs.ts
 import crypto8 from "crypto";
-import { eq as eq7, asc, desc, sql as sql2 } from "drizzle-orm";
+import { and as and2, eq as eq7, asc, desc, or as or2, sql as sql2 } from "drizzle-orm";
 
 // ../api-routes/src/run-queue.ts
 import crypto7 from "crypto";
@@ -1233,23 +1394,36 @@ async function runRoutes(app, opts) {
       if (projectLocations.length === 0) {
         throw validationError("No locations configured for this project");
       }
-      const newRuns = [];
-      for (const loc of projectLocations) {
-        const runId2 = crypto8.randomUUID();
-        app.db.insert(runs).values({
-          id: runId2,
-          projectId: project.id,
-          kind,
-          status: "queued",
-          trigger,
-          location: loc.label,
-          queries: queriesColumn,
-          createdAt: now
-        }).run();
-        newRuns.push({ runId: runId2, loc });
+      const result = app.db.transaction((tx) => {
+        const activeRun = tx.select({ id: runs.id }).from(runs).where(and2(
+          eq7(runs.projectId, project.id),
+          or2(eq7(runs.status, "queued"), eq7(runs.status, "running"))
+        )).get();
+        if (activeRun) {
+          return { conflict: true };
+        }
+        const inserted = [];
+        for (const loc of projectLocations) {
+          const runId2 = crypto8.randomUUID();
+          tx.insert(runs).values({
+            id: runId2,
+            projectId: project.id,
+            kind,
+            status: "queued",
+            trigger,
+            location: loc.label,
+            queries: queriesColumn,
+            createdAt: now
+          }).run();
+          inserted.push({ runId: runId2, loc });
+        }
+        return { conflict: false, inserted };
+      });
+      if (result.conflict) {
+        throw runInProgress(project.name);
       }
       const results = [];
-      for (const { runId: runId2, loc } of newRuns) {
+      for (const { runId: runId2, loc } of result.inserted) {
         writeAuditLog(app.db, {
           projectId: project.id,
           actor: "api",
@@ -1437,7 +1611,8 @@ function loadRunDetail(app, run) {
   const project = app.db.select({
     displayName: projects.displayName,
     canonicalDomain: projects.canonicalDomain,
-    ownedDomains: projects.ownedDomains
+    ownedDomains: projects.ownedDomains,
+    aliases: projects.aliases
   }).from(projects).where(eq7(projects.id, run.projectId)).get();
   const snapshots = app.db.select({
     id: querySnapshots.id,
@@ -1469,7 +1644,10 @@ function loadRunDetail(app, run) {
         provider: s.provider,
         citationState: s.citationState,
         answerMentioned,
+        // Legacy alias of `mentionState`, retained for backwards compatibility.
         visibilityState: project ? resolveSnapshotVisibilityState(s, project) : answerMentioned ? "visible" : "not-visible",
+        // Canonical vocabulary for answer-text presence; new consumers prefer this.
+        mentionState: project ? resolveSnapshotMentionState(s, project) : answerMentioned ? "mentioned" : "not-mentioned",
         answerText: s.answerText,
         citedDomains: parseJsonColumn(s.citedDomains, []),
         competitorOverlap: parseJsonColumn(s.competitorOverlap, []),
@@ -1487,7 +1665,7 @@ function loadRunDetail(app, run) {
 
 // ../api-routes/src/apply.ts
 import crypto10 from "crypto";
-import { and as and2, eq as eq8 } from "drizzle-orm";
+import { and as and3, eq as eq8 } from "drizzle-orm";
 
 // ../api-routes/src/schedule-utils.ts
 var DAY_MAP = {
@@ -1584,7 +1762,7 @@ import http from "http";
 import https from "https";
 import net from "net";
 var REQUEST_TIMEOUT_MS = 1e4;
-async function resolveWebhookTarget(raw) {
+async function resolveWebhookTarget(raw, options = {}) {
   let parsed;
   try {
     parsed = new URL(raw);
@@ -1605,7 +1783,7 @@ async function resolveWebhookTarget(raw) {
   if (addresses.length === 0) {
     return { ok: false, message: '"url" hostname could not be resolved' };
   }
-  const blocked = addresses.find((entry) => isBlockedAddress(entry.address));
+  const blocked = addresses.find((entry) => isBlockedAddress(entry.address, options));
   if (blocked) {
     return { ok: false, message: '"url" must not resolve to a private or loopback address' };
   }
@@ -1683,34 +1861,40 @@ async function resolveHostAddresses(hostname) {
     return [];
   }
 }
-function isBlockedAddress(address) {
+function isBlockedAddress(address, options) {
   const normalized = stripIpv6Brackets(address).toLowerCase();
   const family = net.isIP(normalized);
   if (family === 4) {
-    return isBlockedIpv4(normalized);
+    return isBlockedIpv4(normalized, options);
   }
   if (family === 6) {
     const mappedIpv4 = extractMappedIpv4(normalized);
     if (mappedIpv4) {
-      return isBlockedIpv4(mappedIpv4);
+      return isBlockedIpv4(mappedIpv4, options);
     }
-    return isBlockedIpv6(normalized);
+    return isBlockedIpv6(normalized, options);
   }
   return true;
 }
-function isBlockedIpv4(address) {
+function isBlockedIpv4(address, options) {
   const octets = address.split(".").map((part) => Number.parseInt(part, 10));
   if (octets.length !== 4 || octets.some(Number.isNaN)) {
     return true;
   }
   const [first, second] = octets;
+  if (first === 127 && !options.allowLoopback) {
+    return true;
+  }
   return first === 0 || first === 10 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 198 && (second === 18 || second === 19);
 }
-function isBlockedIpv6(address) {
+function isBlockedIpv6(address, options) {
   const normalized = address.split("%")[0].toLowerCase();
   if (normalized === "::") {
     return true;
   }
+  if (normalized === "::1") {
+    return !options.allowLoopback;
+  }
   const firstHextetText = normalized.split(":")[0] ?? "";
   const firstHextet = firstHextetText === "" ? 0 : Number.parseInt(firstHextetText, 16);
   if (Number.isNaN(firstHextet)) {
@@ -1741,6 +1925,7 @@ function stripIpv6Brackets(value) {
 
 // ../api-routes/src/apply.ts
 async function applyRoutes(app, opts) {
+  const allowLoopback = opts?.allowLoopbackWebhooks === true;
   app.post("/apply", async (request, reply) => {
     const parsed = projectConfigSchema.safeParse(request.body);
     if (!parsed.success) {
@@ -1795,7 +1980,7 @@ async function applyRoutes(app, opts) {
     const hasNotifications = "notifications" in rawSpec;
     if (hasNotifications) {
       for (const notif of config.spec.notifications) {
-        const urlCheck = await resolveWebhookTarget(notif.url ?? "");
+        const urlCheck = await resolveWebhookTarget(notif.url ?? "", { allowLoopback });
         if (!urlCheck.ok) throw validationError(`Notification URL invalid: ${urlCheck.message}`);
       }
     }
@@ -1804,14 +1989,21 @@ async function applyRoutes(app, opts) {
     const configQueries = resolveConfigSpecQueries(config.spec);
     let projectId;
     let scheduleAction = null;
+    let aliasesChanged = false;
     app.db.transaction((tx) => {
       const existing = tx.select().from(projects).where(eq8(projects.name, name)).get();
+      const nextAliases = normalizeProjectAliases(config.spec.displayName, config.spec.aliases ?? []);
+      if (existing) {
+        const prevAliases = parseJsonColumn(existing.aliases, []);
+        aliasesChanged = !aliasArraysEqual2(prevAliases, nextAliases);
+      }
       if (existing) {
         projectId = existing.id;
         tx.update(projects).set({
           displayName: config.spec.displayName,
           canonicalDomain: config.spec.canonicalDomain,
           ownedDomains: JSON.stringify(config.spec.ownedDomains ?? []),
+          aliases: JSON.stringify(nextAliases),
           country: config.spec.country,
           language: config.spec.language,
           labels: JSON.stringify(config.metadata.labels),
@@ -1838,6 +2030,7 @@ async function applyRoutes(app, opts) {
           displayName: config.spec.displayName,
           canonicalDomain: config.spec.canonicalDomain,
           ownedDomains: JSON.stringify(config.spec.ownedDomains ?? []),
+          aliases: JSON.stringify(nextAliases),
           country: config.spec.country,
           language: config.spec.language,
           tags: "[]",
@@ -1896,7 +2089,7 @@ async function applyRoutes(app, opts) {
       });
       const AV_KIND = SchedulableRunKinds["answer-visibility"];
       if (resolvedSchedule) {
-        const existingSched = tx.select().from(schedules).where(and2(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).get();
+        const existingSched = tx.select().from(schedules).where(and3(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).get();
         if (existingSched) {
           tx.update(schedules).set({
             cronExpr: resolvedSchedule.cronExpr,
@@ -1922,9 +2115,9 @@ async function applyRoutes(app, opts) {
         }
         scheduleAction = "upsert";
       } else if (deleteSchedule) {
-        const existingSched = tx.select().from(schedules).where(and2(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).get();
+        const existingSched = tx.select().from(schedules).where(and3(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).get();
         if (existingSched) {
-          tx.delete(schedules).where(and2(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).run();
+          tx.delete(schedules).where(and3(eq8(schedules.projectId, projectId), eq8(schedules.kind, AV_KIND))).run();
           scheduleAction = "delete";
         }
       }
@@ -1957,6 +2150,9 @@ async function applyRoutes(app, opts) {
     if (!hasNotifications) {
       opts?.onProjectUpserted?.(projectId, config.metadata.name);
     }
+    if (aliasesChanged) {
+      opts?.onAliasesChanged?.(projectId, config.metadata.name);
+    }
     if ("google" in rawSpec && config.spec.google?.gsc?.propertyUrl) {
       opts?.onGoogleConnectionPropertyUpdated?.(config.spec.canonicalDomain, "gsc", config.spec.google.gsc.propertyUrl);
     }
@@ -1967,6 +2163,7 @@ async function applyRoutes(app, opts) {
       displayName: project.displayName,
       canonicalDomain: project.canonicalDomain,
       ownedDomains: parseJsonColumn(project.ownedDomains, []),
+      aliases: parseJsonColumn(project.aliases, []),
       country: project.country,
       language: project.language,
       tags: parseJsonColumn(project.tags, []),
@@ -1982,6 +2179,13 @@ async function applyRoutes(app, opts) {
     });
   });
 }
+function aliasArraysEqual2(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].toLowerCase() !== b[i].toLowerCase()) return false;
+  }
+  return true;
+}
 function normalizeCompetitorList2(domains) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
@@ -2089,6 +2293,7 @@ async function historyRoutes(app) {
         citationState: s.citationState,
         answerMentioned: resolveSnapshotAnswerMentioned(s, project),
         visibilityState: resolveSnapshotVisibilityState(s, project),
+        mentionState: resolveSnapshotMentionState(s, project),
         answerText: s.answerText,
         citedDomains: parseJsonColumn(s.citedDomains, []),
         competitorOverlap: parseJsonColumn(s.competitorOverlap, []),
@@ -2142,9 +2347,11 @@ async function historyRoutes(app) {
         const run = projectRuns.find((r) => r.id === snap.runId);
         let transition = snap.citationState === CitationStates.cited ? "cited" : "not-cited";
         let visibilityTransition = snap.answerMentioned ? "visible" : "not-visible";
+        let mentionTransition = snap.answerMentioned ? "mentioned" : "not-mentioned";
         if (idx === 0) {
           transition = "new";
           visibilityTransition = "new";
+          mentionTransition = "new";
         } else {
           const prev = snaps[idx - 1];
           if (prev.citationState === CitationStates["not-cited"] && snap.citationState === CitationStates.cited) {
@@ -2154,8 +2361,10 @@ async function historyRoutes(app) {
           }
           if (!prev.answerMentioned && snap.answerMentioned) {
             visibilityTransition = "emerging";
+            mentionTransition = "emerging";
           } else if (prev.answerMentioned && !snap.answerMentioned) {
             visibilityTransition = "lost";
+            mentionTransition = "lost";
           }
         }
         return {
@@ -2164,8 +2373,12 @@ async function historyRoutes(app) {
           citationState: snap.citationState,
           transition,
           answerMentioned: snap.answerMentioned,
+          // Legacy aliases of `mentionState` / `mentionTransition`.
           visibilityState: snap.answerMentioned ? "visible" : "not-visible",
           visibilityTransition,
+          // Canonical-vocabulary fields — new consumers prefer these.
+          mentionState: snap.answerMentioned ? "mentioned" : "not-mentioned",
+          mentionTransition,
           location: snap.location
         };
       });
@@ -2221,7 +2434,8 @@ async function historyRoutes(app) {
       const resolved = {
         ...s,
         resolvedAnswerMentioned: resolveSnapshotAnswerMentioned(s, project),
-        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project)
+        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project),
+        resolvedMentionState: resolveSnapshotMentionState(s, project)
       };
       const existing = map1.get(s.queryId);
       if (!existing || !existing.resolvedAnswerMentioned && resolved.resolvedAnswerMentioned || existing.resolvedAnswerMentioned === resolved.resolvedAnswerMentioned && resolved.citationState === CitationStates.cited) {
@@ -2233,7 +2447,8 @@ async function historyRoutes(app) {
       const resolved = {
         ...s,
         resolvedAnswerMentioned: resolveSnapshotAnswerMentioned(s, project),
-        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project)
+        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project),
+        resolvedMentionState: resolveSnapshotMentionState(s, project)
       };
       const existing = map2.get(s.queryId);
       if (!existing || !existing.resolvedAnswerMentioned && resolved.resolvedAnswerMentioned || existing.resolvedAnswerMentioned === resolved.resolvedAnswerMentioned && resolved.citationState === CitationStates.cited) {
@@ -2251,8 +2466,11 @@ async function historyRoutes(app) {
         run2State: s2?.citationState ?? null,
         run1AnswerMentioned: s1?.resolvedAnswerMentioned ?? null,
         run2AnswerMentioned: s2?.resolvedAnswerMentioned ?? null,
+        // Legacy aliases — same data as run{1,2}MentionState below.
         run1VisibilityState: s1?.resolvedVisibilityState ?? null,
         run2VisibilityState: s2?.resolvedVisibilityState ?? null,
+        run1MentionState: s1?.resolvedMentionState ?? null,
+        run2MentionState: s2?.resolvedMentionState ?? null,
         changed: (s1?.citationState ?? null) !== (s2?.citationState ?? null),
         visibilityChanged: (s1?.resolvedAnswerMentioned ?? null) !== (s2?.resolvedAnswerMentioned ?? null)
       };
@@ -2621,7 +2839,7 @@ function buildCategoryCounts(counts) {
 }
 
 // ../api-routes/src/intelligence.ts
-import { eq as eq11, desc as desc4, and as and3, inArray as inArray3 } from "drizzle-orm";
+import { eq as eq11, desc as desc4, and as and4, inArray as inArray3 } from "drizzle-orm";
 function emptyHealthSnapshot(projectId) {
   return {
     id: `no-data:${projectId}`,
@@ -2710,7 +2928,7 @@ async function intelligenceRoutes(app) {
     if (request.query.runId) {
       conditions.push(eq11(insights.runId, request.query.runId));
     }
-    const rows = app.db.select().from(insights).where(conditions.length === 1 ? conditions[0] : and3(...conditions)).orderBy(desc4(insights.createdAt)).all();
+    const rows = app.db.select().from(insights).where(conditions.length === 1 ? conditions[0] : and4(...conditions)).orderBy(desc4(insights.createdAt)).all();
     const showDismissed = request.query.dismissed === "true";
     const result = rows.filter((r) => showDismissed || !r.dismissed).map(mapInsightRow);
     return reply.send(result);
@@ -2734,7 +2952,7 @@ async function intelligenceRoutes(app) {
   });
   app.get("/projects/:name/health/latest", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const projectVisRuns = app.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(and3(
+    const projectVisRuns = app.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(and4(
       eq11(runs.projectId, project.id),
       eq11(runs.kind, RunKinds["answer-visibility"]),
       inArray3(runs.status, [RunStatuses.completed, RunStatuses.partial])
@@ -2742,7 +2960,7 @@ async function intelligenceRoutes(app) {
     const latestGroup = groupRunsByCreatedAt(projectVisRuns)[0] ?? [];
     const latestGroupRunIds = latestGroup.map((r) => r.id);
     if (latestGroupRunIds.length > 0) {
-      const groupRows = app.db.select().from(healthSnapshots).where(and3(
+      const groupRows = app.db.select().from(healthSnapshots).where(and4(
         eq11(healthSnapshots.projectId, project.id),
         inArray3(healthSnapshots.runId, latestGroupRunIds)
       )).all();
@@ -2766,7 +2984,7 @@ async function intelligenceRoutes(app) {
 }
 
 // ../api-routes/src/report.ts
-import { and as and5, desc as desc6, eq as eq13, gte, inArray as inArray5, lt, lte, ne, or as or2, sql as sql3 } from "drizzle-orm";
+import { and as and6, desc as desc6, eq as eq13, gte, inArray as inArray5, lt, lte, ne, or as or3, sql as sql3 } from "drizzle-orm";
 
 // ../api-routes/src/report-renderer.ts
 var COLORS = {
@@ -5002,7 +5220,7 @@ function renderReportHtml(report, opts = {}) {
 }
 
 // ../api-routes/src/content-data.ts
-import { and as and4, eq as eq12, desc as desc5, inArray as inArray4 } from "drizzle-orm";
+import { and as and5, eq as eq12, desc as desc5, inArray as inArray4 } from "drizzle-orm";
 var RECENT_RUNS_WINDOW = 5;
 function loadOrchestratorInput(db, project, locationFilter = void 0) {
   const projectId = project.id;
@@ -5126,7 +5344,7 @@ function listCompetitorDomains(db, projectId) {
 }
 function listRecentAnswerVisibilityRunIds(db, projectId, limit, locationFilter) {
   const rows = db.select({ id: runs.id, location: runs.location }).from(runs).where(
-    and4(
+    and5(
       eq12(runs.projectId, projectId),
       eq12(runs.kind, RunKinds["answer-visibility"]),
       // Queued/running/failed/cancelled runs may have partial or no
@@ -5384,8 +5602,8 @@ function safeNum(value) {
   }
   return 0;
 }
-function categorizeQuery(query, projectDisplayName, canonicalDomain) {
-  return categorizeQueryByIntent(query, buildBrandTokens(canonicalDomain, projectDisplayName));
+function categorizeQuery(query, projectBrandNames, canonicalDomain) {
+  return categorizeQueryByIntent(query, buildBrandTokens(canonicalDomain, projectBrandNames));
 }
 function loadSnapshotsForRun(db, runId) {
   return loadSnapshotsForRunIds(db, [runId]);
@@ -5414,7 +5632,7 @@ function loadQueryLookup(db, projectId) {
   for (const row of rows) byId.set(row.id, row.query);
   return { byId };
 }
-function buildGscSection(db, projectId, projectDisplayName, canonicalDomain, trackedQueries) {
+function buildGscSection(db, projectId, projectBrandNames, canonicalDomain, trackedQueries) {
   const allRows = db.select().from(gscSearchData).where(eq13(gscSearchData.projectId, projectId)).all();
   if (allRows.length === 0) return null;
   let maxDate = "";
@@ -5449,11 +5667,11 @@ function buildGscSection(db, projectId, projectDisplayName, canonicalDomain, tra
     impressions: agg.impressions,
     ctr: agg.impressions > 0 ? agg.clicks / agg.impressions : 0,
     avgPosition: agg.impressions > 0 ? agg.weightedPositionSum / agg.impressions : 0,
-    category: categorizeQuery(query, projectDisplayName, canonicalDomain)
+    category: categorizeQuery(query, projectBrandNames, canonicalDomain)
   })).sort((a, b) => b.clicks - a.clicks).slice(0, TOP_QUERIES_LIMIT);
   const categoryAgg = /* @__PURE__ */ new Map();
   for (const [query, agg] of queryAgg) {
-    const cat = categorizeQuery(query, projectDisplayName, canonicalDomain);
+    const cat = categorizeQuery(query, projectBrandNames, canonicalDomain);
     const bucket = categoryAgg.get(cat) ?? { clicks: 0, impressions: 0 };
     bucket.clicks += agg.clicks;
     bucket.impressions += agg.impressions;
@@ -5471,7 +5689,7 @@ function buildGscSection(db, projectId, projectDisplayName, canonicalDomain, tra
   const trackedSet = new Set(trackedQueries.map((q) => q.toLowerCase()));
   const gscQuerySet = new Set([...queryAgg.keys()].map((q) => q.toLowerCase()));
   const trackedButNoGsc = trackedQueries.filter((q) => !gscQuerySet.has(q.toLowerCase())).sort();
-  const gscButNotTracked = [...queryAgg.entries()].filter(([q]) => !trackedSet.has(q.toLowerCase())).filter(([q]) => categorizeQuery(q, projectDisplayName, canonicalDomain) !== "brand").sort((a, b) => b[1].impressions - a[1].impressions).map(([q]) => q).slice(0, TOP_QUERIES_LIMIT);
+  const gscButNotTracked = [...queryAgg.entries()].filter(([q]) => !trackedSet.has(q.toLowerCase())).filter(([q]) => categorizeQuery(q, projectBrandNames, canonicalDomain) !== "brand").sort((a, b) => b[1].impressions - a[1].impressions).map(([q]) => q).slice(0, TOP_QUERIES_LIMIT);
   return {
     periodStart,
     periodEnd,
@@ -5488,7 +5706,7 @@ function buildGscSection(db, projectId, projectDisplayName, canonicalDomain, tra
 }
 function buildGaSection(db, projectId) {
   const windowSummary = db.select().from(gaTrafficWindowSummaries).where(
-    and5(
+    and6(
       eq13(gaTrafficWindowSummaries.projectId, projectId),
       eq13(gaTrafficWindowSummaries.windowKey, "30d")
     )
@@ -5666,7 +5884,7 @@ function nonSubresourceReferralPathCondition() {
 }
 function buildServerActivity(db, projectId) {
   const sourceRows = db.select({ id: trafficSources.id }).from(trafficSources).where(
-    and5(
+    and6(
       eq13(trafficSources.projectId, projectId),
       ne(trafficSources.status, TrafficSourceStatuses.archived)
     )
@@ -5682,7 +5900,7 @@ function buildServerActivity(db, projectId) {
   const trendStart = new Date(trendStartMs).toISOString();
   const sumVerifiedCrawlers = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
     db.select({ total: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-      and5(
+      and6(
         eq13(crawlerEventsHourly.projectId, projectId),
         eq13(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
         gte(crawlerEventsHourly.tsHour, windowStartIso),
@@ -5692,7 +5910,7 @@ function buildServerActivity(db, projectId) {
   );
   const sumUnverifiedCrawlers = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
     db.select({ total: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-      and5(
+      and6(
         eq13(crawlerEventsHourly.projectId, projectId),
         ne(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
         gte(crawlerEventsHourly.tsHour, windowStartIso),
@@ -5702,7 +5920,7 @@ function buildServerActivity(db, projectId) {
   );
   const sumReferrals = (windowStartIso, windowEndIso, exclusiveEnd = false) => Number(
     db.select({ total: sql3`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-      and5(
+      and6(
         eq13(aiReferralEventsHourly.projectId, projectId),
         nonSubresourceReferralPathCondition(),
         gte(aiReferralEventsHourly.tsHour, windowStartIso),
@@ -5721,7 +5939,7 @@ function buildServerActivity(db, projectId) {
     verificationStatus: crawlerEventsHourly.verificationStatus,
     hits: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
   }).from(crawlerEventsHourly).where(
-    and5(
+    and6(
       eq13(crawlerEventsHourly.projectId, projectId),
       gte(crawlerEventsHourly.tsHour, headlineStart),
       lte(crawlerEventsHourly.tsHour, headlineEnd)
@@ -5731,7 +5949,7 @@ function buildServerActivity(db, projectId) {
     operator: crawlerEventsHourly.operator,
     hits: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
   }).from(crawlerEventsHourly).where(
-    and5(
+    and6(
       eq13(crawlerEventsHourly.projectId, projectId),
       eq13(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
       gte(crawlerEventsHourly.tsHour, priorStart),
@@ -5742,7 +5960,7 @@ function buildServerActivity(db, projectId) {
     operator: aiReferralEventsHourly.operator,
     hits: sql3`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
   }).from(aiReferralEventsHourly).where(
-    and5(
+    and6(
       eq13(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
       gte(aiReferralEventsHourly.tsHour, headlineStart),
@@ -5783,7 +6001,7 @@ function buildServerActivity(db, projectId) {
     hits: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
     operators: sql3`COUNT(DISTINCT ${crawlerEventsHourly.operator})`
   }).from(crawlerEventsHourly).where(
-    and5(
+    and6(
       eq13(crawlerEventsHourly.projectId, projectId),
       eq13(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
       gte(crawlerEventsHourly.tsHour, headlineStart),
@@ -5800,7 +6018,7 @@ function buildServerActivity(db, projectId) {
     arrivals: sql3`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
     landingPaths: sql3`COUNT(DISTINCT ${aiReferralEventsHourly.landingPathNormalized})`
   }).from(aiReferralEventsHourly).where(
-    and5(
+    and6(
       eq13(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
       gte(aiReferralEventsHourly.tsHour, headlineStart),
@@ -5817,7 +6035,7 @@ function buildServerActivity(db, projectId) {
     arrivals: sql3`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
     products: sql3`COUNT(DISTINCT ${aiReferralEventsHourly.product})`
   }).from(aiReferralEventsHourly).where(
-    and5(
+    and6(
       eq13(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
       gte(aiReferralEventsHourly.tsHour, headlineStart),
@@ -5833,7 +6051,7 @@ function buildServerActivity(db, projectId) {
     date: sql3`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`,
     hits: sql3`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
   }).from(crawlerEventsHourly).where(
-    and5(
+    and6(
       eq13(crawlerEventsHourly.projectId, projectId),
       eq13(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
       gte(crawlerEventsHourly.tsHour, trendStart),
@@ -5844,7 +6062,7 @@ function buildServerActivity(db, projectId) {
     date: sql3`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`,
     hits: sql3`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
   }).from(aiReferralEventsHourly).where(
-    and5(
+    and6(
       eq13(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
       gte(aiReferralEventsHourly.tsHour, trendStart),
@@ -5919,7 +6137,7 @@ function buildIndexingHealth(db, projectId) {
   return null;
 }
 function buildCitationsTrend(db, projectId, queryLookup, locationFilter) {
-  const visibilityRuns = db.select().from(runs).where(and5(eq13(runs.projectId, projectId), eq13(runs.kind, RunKinds["answer-visibility"]))).all().filter((r) => locationFilter === void 0 || (r.location ?? null) === locationFilter);
+  const visibilityRuns = db.select().from(runs).where(and6(eq13(runs.projectId, projectId), eq13(runs.kind, RunKinds["answer-visibility"]))).all().filter((r) => locationFilter === void 0 || (r.location ?? null) === locationFilter);
   const totalQueries = queryLookup.byId.size;
   const points = [];
   for (const run of visibilityRuns) {
@@ -5965,14 +6183,14 @@ function buildCitationsTrend(db, projectId, queryLookup, locationFilter) {
 }
 function buildInsightList(db, projectId, locationFilter) {
   const recentRunIds = db.select({ id: runs.id, location: runs.location }).from(runs).where(
-    and5(
+    and6(
       eq13(runs.projectId, projectId),
       eq13(runs.kind, RunKinds["answer-visibility"]),
-      or2(eq13(runs.status, RunStatuses.completed), eq13(runs.status, RunStatuses.partial))
+      or3(eq13(runs.status, RunStatuses.completed), eq13(runs.status, RunStatuses.partial))
     )
   ).orderBy(desc6(runs.createdAt)).all().filter((r) => locationFilter === void 0 || (r.location ?? null) === locationFilter).slice(0, INSIGHT_LOOKBACK_RUNS).map((r) => r.id);
   if (recentRunIds.length === 0) return [];
-  const rows = db.select().from(insights).where(and5(eq13(insights.projectId, projectId), inArray5(insights.runId, recentRunIds))).orderBy(desc6(insights.createdAt)).all();
+  const rows = db.select().from(insights).where(and6(eq13(insights.projectId, projectId), inArray5(insights.runId, recentRunIds))).orderBy(desc6(insights.createdAt)).all();
   const severityRank = { critical: 0, high: 1, medium: 2, low: 3 };
   const flat = rows.filter((r) => !r.dismissed).map((r) => {
     const recommendation = parseJsonColumn(r.recommendation, null);
@@ -6160,7 +6378,8 @@ function buildReportActionPlan(input) {
   }
   for (const [index, opportunity] of input.contentOpportunities.slice(0, 2).entries()) {
     const verb = contentActionVerb(opportunity.action);
-    const target = opportunity.ourBestPage?.url ?? `a new page for "${opportunity.query}"`;
+    const bestPageUrl = opportunity.ourBestPage?.url;
+    const hasUsablePage = !!bestPageUrl && bestPageUrl !== "/" && bestPageUrl.trim() !== "";
     const evidence = [
       `Opportunity score ${Math.round(opportunity.score)} with ${opportunity.actionConfidence} confidence`,
       `Demand source: ${opportunity.demandSource}`
@@ -6169,17 +6388,22 @@ function buildReportActionPlan(input) {
       evidence.push(`${opportunity.winningCompetitor.domain} is the current winning cited source`);
     }
     if (opportunity.ourBestPage) {
-      evidence.push(`Best matching owned page: ${opportunity.ourBestPage.url}`);
+      if (bestPageUrl === "/") {
+        evidence.push("No topical page yet \u2014 homepage is the closest slug match");
+      } else {
+        evidence.push(`Best matching owned page: ${bestPageUrl}`);
+      }
     } else {
       evidence.push("No matching owned page was found");
     }
+    const targetIsExistingPage = opportunity.action !== "create" && hasUsablePage;
     actions.push({
       audience: "both",
       priority: 20 + index,
       horizon: opportunity.actionConfidence === "high" ? "short-term" : "medium-term",
       category: "content",
       title: `${verb} content for "${opportunity.query}"`,
-      action: opportunity.ourBestPage ? `${verb} ${target} so it directly answers the tracked query and cites the strongest supporting evidence.` : `${verb} ${target} that directly answers the query and earns citations from AI answer engines.`,
+      action: targetIsExistingPage ? `${verb} the existing page so it directly answers the tracked query and cites the strongest supporting evidence.` : `${verb} a new page for "${opportunity.query}" that directly answers the query and earns citations from AI answer engines.`,
       why: opportunity.drivers.length > 0 ? opportunity.drivers : ["Canonry ranked this as a content opportunity from search-demand and citation evidence."],
       evidence,
       successMetric: `A future check cites ${input.canonicalDomain} for "${opportunity.query}" and the matching GSC query/page improves.`,
@@ -6524,6 +6748,11 @@ function buildProjectReport(db, projectName) {
   const competitorDomains = competitorRows.map((c) => c.domain);
   const ownedDomains = parseJsonColumn(project.ownedDomains, []);
   const projectDomains = [project.canonicalDomain, ...ownedDomains];
+  const projectAliases = parseJsonColumn(project.aliases, []);
+  const projectBrandNames = effectiveBrandNames({
+    displayName: project.displayName,
+    aliases: projectAliases
+  });
   const citationScorecard = buildCitationScorecard(latestSnapshots, queryLookup);
   const competitorLandscape = buildCompetitorLandscape(
     latestSnapshots,
@@ -6534,7 +6763,7 @@ function buildProjectReport(db, projectName) {
   const mentionLandscape = buildMentionLandscape(
     latestSnapshots,
     competitorDomains,
-    project.displayName,
+    projectBrandNames,
     projectDomains,
     queryLookup
   );
@@ -6543,7 +6772,7 @@ function buildProjectReport(db, projectName) {
   const gscSection = buildGscSection(
     db,
     project.id,
-    project.displayName,
+    projectBrandNames,
     project.canonicalDomain,
     trackedQueries
   );
@@ -6899,7 +7128,7 @@ function normalizeDomain2(domain) {
 }
 
 // ../api-routes/src/composites.ts
-import { eq as eq15, and as and6, desc as desc7, sql as sql4, like, or as or3, inArray as inArray7 } from "drizzle-orm";
+import { eq as eq15, and as and7, desc as desc7, sql as sql4, like, or as or4, inArray as inArray7 } from "drizzle-orm";
 var TOP_INSIGHT_LIMIT = 5;
 var SEARCH_HIT_HARD_LIMIT = 50;
 var SEARCH_SNIPPET_RADIUS = 80;
@@ -7013,9 +7242,9 @@ async function compositeRoutes(app) {
       rawResponse: querySnapshots.rawResponse,
       createdAt: querySnapshots.createdAt
     }).from(querySnapshots).innerJoin(queries, eq15(querySnapshots.queryId, queries.id)).where(
-      and6(
+      and7(
         eq15(queries.projectId, project.id),
-        or3(
+        or4(
           sql4`${querySnapshots.answerText} LIKE ${pattern} ESCAPE '\\'`,
           sql4`${querySnapshots.citedDomains} LIKE ${pattern} ESCAPE '\\'`,
           sql4`${querySnapshots.rawResponse} LIKE ${pattern} ESCAPE '\\'`,
@@ -7024,9 +7253,9 @@ async function compositeRoutes(app) {
       )
     ).orderBy(desc7(querySnapshots.createdAt)).limit(limit + 1).all());
     const insightMatches = app.db.select().from(insights).where(
-      and6(
+      and7(
         eq15(insights.projectId, project.id),
-        or3(
+        or4(
           like(insights.title, pattern),
           like(insights.query, pattern),
           sql4`${insights.recommendation} LIKE ${pattern} ESCAPE '\\'`,
@@ -7354,6 +7583,7 @@ function formatProject2(row) {
     displayName: row.displayName,
     canonicalDomain: row.canonicalDomain,
     ownedDomains: parseJsonColumn(row.ownedDomains, []),
+    aliases: parseJsonColumn(row.aliases, []),
     country: row.country,
     language: row.language,
     tags: parseJsonColumn(row.tags, []),
@@ -7656,6 +7886,7 @@ var routeCatalog = [
               displayName: stringSchema,
               canonicalDomain: stringSchema,
               ownedDomains: stringArraySchema,
+              aliases: stringArraySchema,
               country: stringSchema,
               language: stringSchema,
               tags: stringArraySchema,
@@ -10875,7 +11106,7 @@ async function telemetryRoutes(app, opts) {
 
 // ../api-routes/src/schedules.ts
 import crypto11 from "crypto";
-import { and as and7, eq as eq16 } from "drizzle-orm";
+import { and as and8, eq as eq16 } from "drizzle-orm";
 function parseKindParam(raw) {
   if (raw === void 0 || raw === null || raw === "") return SchedulableRunKinds["answer-visibility"];
   const parsed = schedulableRunKindSchema.safeParse(raw);
@@ -10941,7 +11172,7 @@ async function scheduleRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const enabledInt = enabled === false ? 0 : 1;
-    const existing = app.db.select().from(schedules).where(and7(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
+    const existing = app.db.select().from(schedules).where(and8(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
     if (existing) {
       app.db.update(schedules).set({
         cronExpr,
@@ -10975,13 +11206,13 @@ async function scheduleRoutes(app, opts) {
       diff: { kind, cronExpr, preset, timezone, providers, sourceId }
     });
     opts.onScheduleUpdated?.("upsert", project.id, kind);
-    const schedule = app.db.select().from(schedules).where(and7(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
+    const schedule = app.db.select().from(schedules).where(and8(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
     return reply.status(existing ? 200 : 201).send(formatSchedule(schedule));
   });
   app.get("/projects/:name/schedule", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const kind = parseKindParam(request.query?.kind);
-    const schedule = app.db.select().from(schedules).where(and7(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
+    const schedule = app.db.select().from(schedules).where(and8(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
     if (!schedule) {
       throw notFound("Schedule", `${request.params.name} (kind=${kind})`);
     }
@@ -10990,7 +11221,7 @@ async function scheduleRoutes(app, opts) {
   app.delete("/projects/:name/schedule", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const kind = parseKindParam(request.query?.kind);
-    const schedule = app.db.select().from(schedules).where(and7(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
+    const schedule = app.db.select().from(schedules).where(and8(eq16(schedules.projectId, project.id), eq16(schedules.kind, kind))).get();
     if (!schedule) {
       throw notFound("Schedule", `${request.params.name} (kind=${kind})`);
     }
@@ -11029,7 +11260,8 @@ function formatSchedule(row) {
 import crypto12 from "crypto";
 import { eq as eq17 } from "drizzle-orm";
 var VALID_EVENTS = ["citation.lost", "citation.gained", "run.completed", "run.failed", "insight.critical", "insight.high"];
-async function notificationRoutes(app) {
+async function notificationRoutes(app, opts = {}) {
+  const allowLoopback = opts.allowLoopbackWebhooks === true;
   app.get("/notifications/events", async (_request, reply) => {
     return reply.send(VALID_EVENTS);
   });
@@ -11037,7 +11269,7 @@ async function notificationRoutes(app) {
     const project = resolveProject(app.db, request.params.name);
     const { channel, url, events, source } = request.body ?? {};
     if (channel !== "webhook") throw validationError('Only "webhook" channel is supported');
-    const urlCheck = await resolveWebhookTarget(url ?? "");
+    const urlCheck = await resolveWebhookTarget(url ?? "", { allowLoopback });
     if (!urlCheck.ok) throw validationError(urlCheck.message);
     if (!events?.length) throw validationError('"events" must be a non-empty array');
     const invalid = events.filter((e) => !VALID_EVENTS.includes(e));
@@ -11098,7 +11330,7 @@ async function notificationRoutes(app) {
       throw notFound("Notification", request.params.id);
     }
     const config = parseJsonColumn(notification.config, { url: "", events: [] });
-    const urlCheck = await resolveWebhookTarget(config.url);
+    const urlCheck = await resolveWebhookTarget(config.url, { allowLoopback });
     if (!urlCheck.ok) throw validationError(`Stored webhook URL is invalid: ${urlCheck.message}`);
     const payload = {
       source: "canonry",
@@ -11146,7 +11378,7 @@ function formatNotification(row) {
 
 // ../api-routes/src/google.ts
 import crypto14 from "crypto";
-import { eq as eq18, and as and8, desc as desc8, sql as sql5 } from "drizzle-orm";
+import { eq as eq18, and as and9, desc as desc8, sql as sql5 } from "drizzle-orm";
 
 // ../integration-google/src/constants.ts
 var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
@@ -12156,7 +12388,23 @@ async function getValidToken(store, domain, connectionType, clientId, clientSecr
   };
 }
 async function googleRoutes(app, opts) {
-  const stateSecret = opts.googleStateSecret ?? "insecure-default-secret";
+  if (opts.googleStateSecret === void 0) {
+    app.log.warn(
+      "googleStateSecret is not configured \u2014 Google OAuth routes will not be registered. Set GOOGLE_STATE_SECRET to enable Google integrations."
+    );
+    return;
+  }
+  if (opts.googleStateSecret === "") {
+    throw new Error(
+      "googleStateSecret is empty. Set a non-empty secret (e.g. `openssl rand -hex 32`) via the GOOGLE_STATE_SECRET environment variable."
+    );
+  }
+  if (opts.googleStateSecret === "insecure-default-secret") {
+    throw new Error(
+      "googleStateSecret is set to the legacy insecure default. Generate a real secret (e.g. `openssl rand -hex 32`) and set GOOGLE_STATE_SECRET."
+    );
+  }
+  const stateSecret = opts.googleStateSecret;
   function getAuthConfig() {
     return opts.getGoogleAuthConfig?.() ?? {};
   }
@@ -12363,7 +12611,7 @@ async function googleRoutes(app, opts) {
     if (page) conditions.push(sql5`${gscSearchData.page} LIKE ${"%" + page + "%"}`);
     const limitVal = Math.max(parseInt(limit ?? "500", 10) || 0, 1);
     const offsetVal = Math.max(parseInt(offset ?? "0", 10) || 0, 0);
-    const rows = app.db.select().from(gscSearchData).where(and8(...conditions)).orderBy(desc8(gscSearchData.date)).limit(limitVal).offset(offsetVal).all();
+    const rows = app.db.select().from(gscSearchData).where(and9(...conditions)).orderBy(desc8(gscSearchData.date)).limit(limitVal).offset(offsetVal).all();
     return rows.map((r) => ({
       date: r.date,
       query: r.query,
@@ -12437,7 +12685,7 @@ async function googleRoutes(app, opts) {
     const { url, limit } = request.query;
     const conditions = [eq18(gscUrlInspections.projectId, project.id)];
     if (url) conditions.push(eq18(gscUrlInspections.url, url));
-    const rows = app.db.select().from(gscUrlInspections).where(and8(...conditions)).orderBy(desc8(gscUrlInspections.inspectedAt)).limit(parseInt(limit ?? "100", 10)).all();
+    const rows = app.db.select().from(gscUrlInspections).where(and9(...conditions)).orderBy(desc8(gscUrlInspections.inspectedAt)).limit(parseInt(limit ?? "100", 10)).all();
     return rows.map((r) => ({
       id: r.id,
       url: r.url,
@@ -12789,7 +13037,7 @@ async function googleRoutes(app, opts) {
 
 // ../api-routes/src/bing.ts
 import crypto15 from "crypto";
-import { eq as eq19, and as and9, desc as desc9 } from "drizzle-orm";
+import { eq as eq19, and as and10, desc as desc9 } from "drizzle-orm";
 
 // ../integration-bing/src/constants.ts
 var BING_WMT_API_BASE = "https://ssl.bing.com/webmaster/api.svc/json";
@@ -13203,7 +13451,7 @@ async function bingRoutes(app, opts) {
     requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
     const { url, limit } = request.query;
-    const whereClause = url ? and9(eq19(bingUrlInspections.projectId, project.id), eq19(bingUrlInspections.url, url)) : eq19(bingUrlInspections.projectId, project.id);
+    const whereClause = url ? and10(eq19(bingUrlInspections.projectId, project.id), eq19(bingUrlInspections.url, url)) : eq19(bingUrlInspections.projectId, project.id);
     const filtered = app.db.select().from(bingUrlInspections).where(whereClause).orderBy(desc9(bingUrlInspections.inspectedAt)).limit(Math.max(1, Math.min(parseInt(limit ?? "100", 10) || 100, 1e3))).all();
     return filtered.map((r) => ({
       id: r.id,
@@ -13435,7 +13683,7 @@ async function bingRoutes(app, opts) {
 import fs from "fs";
 import path from "path";
 import os2 from "os";
-import { eq as eq20, and as and10 } from "drizzle-orm";
+import { eq as eq20, and as and11 } from "drizzle-orm";
 function getScreenshotDir() {
   return path.join(os2.homedir(), ".canonry", "screenshots");
 }
@@ -13508,7 +13756,7 @@ async function cdpRoutes(app, opts) {
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
       const { runId } = request.params;
-      const run = app.db.select().from(runs).where(and10(eq20(runs.id, runId), eq20(runs.projectId, project.id))).get();
+      const run = app.db.select().from(runs).where(and11(eq20(runs.id, runId), eq20(runs.projectId, project.id))).get();
       if (!run) {
         const err = notFound("Run", runId);
         return reply.code(err.statusCode).send(err.toJSON());
@@ -13605,7 +13853,7 @@ async function cdpRoutes(app, opts) {
 
 // ../api-routes/src/ga.ts
 import crypto16 from "crypto";
-import { eq as eq21, desc as desc10, and as and11, sql as sql6 } from "drizzle-orm";
+import { eq as eq21, desc as desc10, and as and12, sql as sql6 } from "drizzle-orm";
 function gaLog(level, action, ctx) {
   const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), level, module: "GA4Routes", action, ...ctx };
   const stream = level === "error" ? process.stderr : process.stdout;
@@ -13900,7 +14148,7 @@ async function ga4Routes(app, opts) {
       app.db.transaction((tx) => {
         if (syncTraffic) {
           tx.delete(gaTrafficSnapshots).where(
-            and11(
+            and12(
               eq21(gaTrafficSnapshots.projectId, project.id),
               sql6`${gaTrafficSnapshots.date} >= ${summary.periodStart}`,
               sql6`${gaTrafficSnapshots.date} <= ${summary.periodEnd}`
@@ -13924,7 +14172,7 @@ async function ga4Routes(app, opts) {
         }
         if (syncAi) {
           tx.delete(gaAiReferrals).where(
-            and11(
+            and12(
               eq21(gaAiReferrals.projectId, project.id),
               sql6`${gaAiReferrals.date} >= ${summary.periodStart}`,
               sql6`${gaAiReferrals.date} <= ${summary.periodEnd}`
@@ -13950,7 +14198,7 @@ async function ga4Routes(app, opts) {
         }
         if (syncSocial) {
           tx.delete(gaSocialReferrals).where(
-            and11(
+            and12(
               eq21(gaSocialReferrals.projectId, project.id),
               sql6`${gaSocialReferrals.date} >= ${summary.periodStart}`,
               sql6`${gaSocialReferrals.date} <= ${summary.periodEnd}`
@@ -14054,7 +14302,7 @@ async function ga4Routes(app, opts) {
       totalDirectSessions: gaTrafficWindowSummaries.totalDirectSessions,
       totalUsers: gaTrafficWindowSummaries.totalUsers
     }).from(gaTrafficWindowSummaries).where(
-      and11(
+      and12(
         eq21(gaTrafficWindowSummaries.projectId, project.id),
         eq21(gaTrafficWindowSummaries.windowKey, window)
       )
@@ -14063,7 +14311,7 @@ async function ga4Routes(app, opts) {
       totalSessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)`,
       totalOrganicSessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)`,
       totalUsers: sql6`COALESCE(SUM(${gaTrafficSnapshots.users}), 0)`
-    }).from(gaTrafficSnapshots).where(and11(...snapshotConditions)).get() : null;
+    }).from(gaTrafficSnapshots).where(and12(...snapshotConditions)).get() : null;
     const summaryRow = cutoffDate ? windowSummaryRow ?? snapshotTotalsRow : app.db.select({
       totalSessions: gaTrafficSummaries.totalSessions,
       totalOrganicSessions: gaTrafficSummaries.totalOrganicSessions,
@@ -14071,7 +14319,7 @@ async function ga4Routes(app, opts) {
     }).from(gaTrafficSummaries).where(eq21(gaTrafficSummaries.projectId, project.id)).get();
     const directTotalRow = windowSummaryRow ? { totalDirectSessions: windowSummaryRow.totalDirectSessions } : app.db.select({
       totalDirectSessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`
-    }).from(gaTrafficSnapshots).where(and11(...snapshotConditions)).get();
+    }).from(gaTrafficSnapshots).where(and12(...snapshotConditions)).get();
     const summaryMeta = app.db.select({
       periodStart: gaTrafficSummaries.periodStart,
       periodEnd: gaTrafficSummaries.periodEnd
@@ -14082,14 +14330,14 @@ async function ga4Routes(app, opts) {
       organicSessions: sql6`SUM(${gaTrafficSnapshots.organicSessions})`,
       directSessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)`,
       users: sql6`SUM(${gaTrafficSnapshots.users})`
-    }).from(gaTrafficSnapshots).where(and11(...snapshotConditions)).groupBy(sql6`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql6`SUM(${gaTrafficSnapshots.sessions}) DESC`).limit(limit).all();
+    }).from(gaTrafficSnapshots).where(and12(...snapshotConditions)).groupBy(sql6`COALESCE(${gaTrafficSnapshots.landingPageNormalized}, ${gaTrafficSnapshots.landingPage})`).orderBy(sql6`SUM(${gaTrafficSnapshots.sessions}) DESC`).limit(limit).all();
     const aiReferralRows = app.db.select({
       source: gaAiReferrals.source,
       medium: gaAiReferrals.medium,
       sourceDimension: gaAiReferrals.sourceDimension,
       sessions: sql6`SUM(${gaAiReferrals.sessions})`,
       users: sql6`SUM(${gaAiReferrals.users})`
-    }).from(gaAiReferrals).where(and11(...aiConditions)).groupBy(gaAiReferrals.source, gaAiReferrals.medium, gaAiReferrals.sourceDimension).all();
+    }).from(gaAiReferrals).where(and12(...aiConditions)).groupBy(gaAiReferrals.source, gaAiReferrals.medium, gaAiReferrals.sourceDimension).all();
     const aiReferralLandingPageRows = app.db.select({
       source: gaAiReferrals.source,
       medium: gaAiReferrals.medium,
@@ -14097,7 +14345,7 @@ async function ga4Routes(app, opts) {
       landingPage: sql6`COALESCE(${gaAiReferrals.landingPageNormalized}, ${gaAiReferrals.landingPage})`,
       sessions: sql6`SUM(${gaAiReferrals.sessions})`,
       users: sql6`SUM(${gaAiReferrals.users})`
-    }).from(gaAiReferrals).where(and11(...aiConditions)).groupBy(
+    }).from(gaAiReferrals).where(and12(...aiConditions)).groupBy(
       gaAiReferrals.source,
       gaAiReferrals.medium,
       gaAiReferrals.sourceDimension,
@@ -14134,7 +14382,7 @@ async function ga4Routes(app, opts) {
       channelGroup: gaAiReferrals.channelGroup,
       sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)`,
       users: sql6`COALESCE(SUM(${gaAiReferrals.users}), 0)`
-    }).from(gaAiReferrals).where(and11(...aiConditions, eq21(gaAiReferrals.sourceDimension, "session"))).groupBy(gaAiReferrals.channelGroup).all();
+    }).from(gaAiReferrals).where(and12(...aiConditions, eq21(gaAiReferrals.sourceDimension, "session"))).groupBy(gaAiReferrals.channelGroup).all();
     const aiSessionsByChannelGroup = /* @__PURE__ */ new Map();
     let aiBySessionUsers = 0;
     for (const row of aiBySessionRows) {
@@ -14148,11 +14396,11 @@ async function ga4Routes(app, opts) {
       channelGroup: gaSocialReferrals.channelGroup,
       sessions: sql6`SUM(${gaSocialReferrals.sessions})`,
       users: sql6`SUM(${gaSocialReferrals.users})`
-    }).from(gaSocialReferrals).where(and11(...socialConditions)).groupBy(gaSocialReferrals.source, gaSocialReferrals.medium, gaSocialReferrals.channelGroup).orderBy(sql6`SUM(${gaSocialReferrals.sessions}) DESC`).all();
+    }).from(gaSocialReferrals).where(and12(...socialConditions)).groupBy(gaSocialReferrals.source, gaSocialReferrals.medium, gaSocialReferrals.channelGroup).orderBy(sql6`SUM(${gaSocialReferrals.sessions}) DESC`).all();
     const socialTotals = app.db.select({
       sessions: sql6`SUM(${gaSocialReferrals.sessions})`,
       users: sql6`SUM(${gaSocialReferrals.users})`
-    }).from(gaSocialReferrals).where(and11(...socialConditions)).get();
+    }).from(gaSocialReferrals).where(and12(...socialConditions)).get();
     const latestSync = app.db.select({ syncedAt: gaTrafficSummaries.syncedAt }).from(gaTrafficSummaries).where(eq21(gaTrafficSummaries.projectId, project.id)).orderBy(desc10(gaTrafficSummaries.syncedAt)).limit(1).get();
     const total = summaryRow?.totalSessions ?? 0;
     const totalDirectSessions = directTotalRow?.totalDirectSessions ?? 0;
@@ -14243,7 +14491,7 @@ async function ga4Routes(app, opts) {
       sourceDimension: gaAiReferrals.sourceDimension,
       sessions: sql6`SUM(${gaAiReferrals.sessions})`,
       users: sql6`SUM(${gaAiReferrals.users})`
-    }).from(gaAiReferrals).where(and11(...conditions)).groupBy(
+    }).from(gaAiReferrals).where(and12(...conditions)).groupBy(
       gaAiReferrals.date,
       gaAiReferrals.source,
       gaAiReferrals.medium,
@@ -14265,7 +14513,7 @@ async function ga4Routes(app, opts) {
       channelGroup: gaSocialReferrals.channelGroup,
       sessions: gaSocialReferrals.sessions,
       users: gaSocialReferrals.users
-    }).from(gaSocialReferrals).where(and11(...conditions)).orderBy(gaSocialReferrals.date).all();
+    }).from(gaSocialReferrals).where(and12(...conditions)).orderBy(gaSocialReferrals.date).all();
     return rows;
   });
   app.get("/projects/:name/ga/social-referral-trend", async (request, _reply) => {
@@ -14278,7 +14526,7 @@ async function ga4Routes(app, opts) {
       d.setDate(d.getDate() - n);
       return fmt(d);
     };
-    const sumSocial = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and11(
+    const sumSocial = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and12(
       eq21(gaSocialReferrals.projectId, project.id),
       sql6`${gaSocialReferrals.date} >= ${from}`,
       sql6`${gaSocialReferrals.date} < ${to}`
@@ -14291,7 +14539,7 @@ async function ga4Routes(app, opts) {
     const sourceCurrent = app.db.select({
       source: gaSocialReferrals.source,
       sessions: sql6`SUM(${gaSocialReferrals.sessions})`
-    }).from(gaSocialReferrals).where(and11(
+    }).from(gaSocialReferrals).where(and12(
       eq21(gaSocialReferrals.projectId, project.id),
       sql6`${gaSocialReferrals.date} >= ${daysAgo2(7)}`,
       sql6`${gaSocialReferrals.date} < ${fmt(today)}`
@@ -14299,7 +14547,7 @@ async function ga4Routes(app, opts) {
     const sourcePrev = app.db.select({
       source: gaSocialReferrals.source,
       sessions: sql6`SUM(${gaSocialReferrals.sessions})`
-    }).from(gaSocialReferrals).where(and11(
+    }).from(gaSocialReferrals).where(and12(
       eq21(gaSocialReferrals.projectId, project.id),
       sql6`${gaSocialReferrals.date} >= ${daysAgo2(14)}`,
       sql6`${gaSocialReferrals.date} < ${daysAgo2(7)}`
@@ -14341,16 +14589,16 @@ async function ga4Routes(app, opts) {
       return fmt(d);
     };
     const pct = (cur, prev) => prev === 0 ? null : Math.round((cur - prev) / prev * 100);
-    const sumTotal = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)` }).from(gaTrafficSnapshots).where(and11(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumOrganic = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)` }).from(gaTrafficSnapshots).where(and11(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumDirect = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)` }).from(gaTrafficSnapshots).where(and11(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
-    const sumAi = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and11(
+    const sumTotal = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.sessions}), 0)` }).from(gaTrafficSnapshots).where(and12(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumOrganic = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.organicSessions}), 0)` }).from(gaTrafficSnapshots).where(and12(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumDirect = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaTrafficSnapshots.directSessions}), 0)` }).from(gaTrafficSnapshots).where(and12(eq21(gaTrafficSnapshots.projectId, project.id), sql6`${gaTrafficSnapshots.date} >= ${from}`, sql6`${gaTrafficSnapshots.date} < ${to}`)).get();
+    const sumAi = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and12(
       eq21(gaAiReferrals.projectId, project.id),
       sql6`${gaAiReferrals.date} >= ${from}`,
       sql6`${gaAiReferrals.date} < ${to}`,
       eq21(gaAiReferrals.sourceDimension, "session")
     )).get();
-    const sumSocial = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and11(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${from}`, sql6`${gaSocialReferrals.date} < ${to}`)).get();
+    const sumSocial = (from, to) => app.db.select({ sessions: sql6`COALESCE(SUM(${gaSocialReferrals.sessions}), 0)` }).from(gaSocialReferrals).where(and12(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${from}`, sql6`${gaSocialReferrals.date} < ${to}`)).get();
     const todayStr = fmt(today);
     const buildTrend = (sum) => {
       const c7 = sum(daysAgo2(7), todayStr)?.sessions ?? 0;
@@ -14359,13 +14607,13 @@ async function ga4Routes(app, opts) {
       const p30 = sum(daysAgo2(60), daysAgo2(30))?.sessions ?? 0;
       return { sessions7d: c7, sessionsPrev7d: p7, trend7dPct: pct(c7, p7), sessions30d: c30, sessionsPrev30d: p30, trend30dPct: pct(c30, p30) };
     };
-    const aiSourceCurrent = app.db.select({ source: gaAiReferrals.source, sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and11(
+    const aiSourceCurrent = app.db.select({ source: gaAiReferrals.source, sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and12(
       eq21(gaAiReferrals.projectId, project.id),
       sql6`${gaAiReferrals.date} >= ${daysAgo2(7)}`,
       sql6`${gaAiReferrals.date} < ${todayStr}`,
       eq21(gaAiReferrals.sourceDimension, "session")
     )).groupBy(gaAiReferrals.source).all();
-    const aiSourcePrev = app.db.select({ source: gaAiReferrals.source, sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and11(
+    const aiSourcePrev = app.db.select({ source: gaAiReferrals.source, sessions: sql6`COALESCE(SUM(${gaAiReferrals.sessions}), 0)` }).from(gaAiReferrals).where(and12(
       eq21(gaAiReferrals.projectId, project.id),
       sql6`${gaAiReferrals.date} >= ${daysAgo2(14)}`,
       sql6`${gaAiReferrals.date} < ${daysAgo2(7)}`,
@@ -14385,8 +14633,8 @@ async function ga4Routes(app, opts) {
       }
       return mover;
     };
-    const socialSourceCurrent = app.db.select({ source: gaSocialReferrals.source, sessions: sql6`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and11(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${daysAgo2(7)}`, sql6`${gaSocialReferrals.date} < ${todayStr}`)).groupBy(gaSocialReferrals.source).all();
-    const socialSourcePrev = app.db.select({ source: gaSocialReferrals.source, sessions: sql6`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and11(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${daysAgo2(14)}`, sql6`${gaSocialReferrals.date} < ${daysAgo2(7)}`)).groupBy(gaSocialReferrals.source).all();
+    const socialSourceCurrent = app.db.select({ source: gaSocialReferrals.source, sessions: sql6`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and12(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${daysAgo2(7)}`, sql6`${gaSocialReferrals.date} < ${todayStr}`)).groupBy(gaSocialReferrals.source).all();
+    const socialSourcePrev = app.db.select({ source: gaSocialReferrals.source, sessions: sql6`SUM(${gaSocialReferrals.sessions})` }).from(gaSocialReferrals).where(and12(eq21(gaSocialReferrals.projectId, project.id), sql6`${gaSocialReferrals.date} >= ${daysAgo2(14)}`, sql6`${gaSocialReferrals.date} < ${daysAgo2(7)}`)).groupBy(gaSocialReferrals.source).all();
     return {
       total: buildTrend(sumTotal),
       organic: buildTrend(sumOrganic),
@@ -14408,7 +14656,7 @@ async function ga4Routes(app, opts) {
       sessions: sql6`SUM(${gaTrafficSnapshots.sessions})`,
       organicSessions: sql6`SUM(${gaTrafficSnapshots.organicSessions})`,
       users: sql6`SUM(${gaTrafficSnapshots.users})`
-    }).from(gaTrafficSnapshots).where(and11(...conditions)).groupBy(gaTrafficSnapshots.date).orderBy(gaTrafficSnapshots.date).all();
+    }).from(gaTrafficSnapshots).where(and12(...conditions)).groupBy(gaTrafficSnapshots.date).orderBy(gaTrafficSnapshots.date).all();
     return rows.map((r) => ({
       date: r.date,
       sessions: r.sessions ?? 0,
@@ -16061,7 +16309,7 @@ async function wordpressRoutes(app, opts) {
 
 // ../api-routes/src/backlinks.ts
 import crypto18 from "crypto";
-import { and as and13, asc as asc2, desc as desc11, eq as eq22, sql as sql7 } from "drizzle-orm";
+import { and as and14, asc as asc2, desc as desc11, eq as eq22, sql as sql7 } from "drizzle-orm";
 
 // ../integration-commoncrawl/src/constants.ts
 import os3 from "os";
@@ -16236,7 +16484,7 @@ function parseContentLength2(value) {
 
 // ../integration-commoncrawl/src/plugin-resolver.ts
 import fs3 from "fs";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import path4 from "path";
 function pluginDirFor(pkgJson) {
   return path4.dirname(pkgJson);
@@ -16255,7 +16503,7 @@ function loadDuckdb(opts = {}) {
     );
   }
   try {
-    const pluginRequire = createRequire2(duckdbPkg);
+    const pluginRequire = createRequire3(duckdbPkg);
     return pluginRequire("@duckdb/node-api");
   } catch {
     throw missingDependency(
@@ -16458,7 +16706,7 @@ function pruneCachedRelease(release, opts = {}) {
 }
 
 // ../api-routes/src/backlinks-filter.ts
-import { and as and12, ne as ne2, notLike } from "drizzle-orm";
+import { and as and13, ne as ne2, notLike } from "drizzle-orm";
 var BACKLINK_FILTER_PATTERNS = [
   "*.google.com",
   "*.googleusercontent.com",
@@ -16481,7 +16729,7 @@ function backlinkCrawlerExclusionClause() {
       conditions.push(ne2(backlinkDomains.linkingDomain, pattern));
     }
   }
-  const combined = and12(...conditions);
+  const combined = and13(...conditions);
   if (!combined) throw new Error("BACKLINK_FILTER_PATTERNS is unexpectedly empty");
   return combined;
 }
@@ -16542,7 +16790,7 @@ function mapRunRow(row) {
   };
 }
 function latestSummaryForProject(db, projectId, release) {
-  const condition = release ? and13(eq22(backlinkSummaries.projectId, projectId), eq22(backlinkSummaries.release, release)) : eq22(backlinkSummaries.projectId, projectId);
+  const condition = release ? and14(eq22(backlinkSummaries.projectId, projectId), eq22(backlinkSummaries.release, release)) : eq22(backlinkSummaries.projectId, projectId);
   return db.select().from(backlinkSummaries).where(condition).orderBy(desc11(backlinkSummaries.queriedAt)).limit(1).get();
 }
 function parseExcludeCrawlers(value) {
@@ -16551,11 +16799,11 @@ function parseExcludeCrawlers(value) {
   return lower === "1" || lower === "true" || lower === "yes";
 }
 function computeFilteredSummary(db, base) {
-  const baseDomainCondition = and13(
+  const baseDomainCondition = and14(
     eq22(backlinkDomains.projectId, base.projectId),
     eq22(backlinkDomains.release, base.release)
   );
-  const filteredCondition = and13(baseDomainCondition, backlinkCrawlerExclusionClause());
+  const filteredCondition = and14(baseDomainCondition, backlinkCrawlerExclusionClause());
   const unfilteredAgg = db.select({
     count: sql7`count(*)`,
     total: sql7`coalesce(sum(${backlinkDomains.numHosts}), 0)`
@@ -16731,11 +16979,11 @@ async function backlinksRoutes(app, opts) {
     const limit = Math.min(Math.max(parseInt(request.query.limit ?? "50", 10) || 50, 1), 500);
     const offset = Math.max(parseInt(request.query.offset ?? "0", 10) || 0, 0);
     const excludeCrawlers = parseExcludeCrawlers(request.query.excludeCrawlers);
-    const baseDomainCondition = and13(
+    const baseDomainCondition = and14(
       eq22(backlinkDomains.projectId, project.id),
       eq22(backlinkDomains.release, targetRelease)
     );
-    const domainCondition = excludeCrawlers ? and13(baseDomainCondition, backlinkCrawlerExclusionClause()) : baseDomainCondition;
+    const domainCondition = excludeCrawlers ? and14(baseDomainCondition, backlinkCrawlerExclusionClause()) : baseDomainCondition;
     const totalRow = app.db.select({ count: sql7`count(*)` }).from(backlinkDomains).where(domainCondition).get();
     const rows = app.db.select({
       linkingDomain: backlinkDomains.linkingDomain,
@@ -16771,7 +17019,7 @@ async function backlinksRoutes(app, opts) {
 
 // ../api-routes/src/traffic.ts
 import crypto20 from "crypto";
-import { and as and14, desc as desc12, eq as eq23, gte as gte2, lte as lte2, sql as sql8 } from "drizzle-orm";
+import { and as and15, desc as desc12, eq as eq23, gte as gte2, lte as lte2, sql as sql8 } from "drizzle-orm";
 
 // ../integration-cloud-run/src/auth.ts
 import crypto19 from "crypto";
@@ -17839,7 +18087,7 @@ var DEFAULT_WP_MAX_PAGES = 20;
 var DEFAULT_VERCEL_MAX_PAGES = 50;
 var MAX_TRACKED_EVENT_IDS = 1e3;
 var DEFAULT_BACKFILL_DAYS = 30;
-var MAX_BACKFILL_DAYS = 30;
+var MAX_BACKFILL_DAYS = 90;
 var BACKFILL_MAX_PAGES = 1e3;
 var BACKFILL_SAMPLE_LIMIT = 500;
 function parseSourceConfig(row) {
@@ -17919,21 +18167,21 @@ async function runBackfillTask(options) {
   try {
     app.db.transaction((tx) => {
       tx.delete(crawlerEventsHourly).where(
-        and14(
+        and15(
           eq23(crawlerEventsHourly.sourceId, sourceRow.id),
           gte2(crawlerEventsHourly.tsHour, windowStartIso),
           lte2(crawlerEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiReferralEventsHourly).where(
-        and14(
+        and15(
           eq23(aiReferralEventsHourly.sourceId, sourceRow.id),
           gte2(aiReferralEventsHourly.tsHour, windowStartIso),
           lte2(aiReferralEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(rawEventSamples).where(
-        and14(
+        and15(
           eq23(rawEventSamples.sourceId, sourceRow.id),
           gte2(rawEventSamples.ts, windowStartIso),
           lte2(rawEventSamples.ts, windowEndIso)
@@ -18356,7 +18604,8 @@ async function trafficRoutes(app, opts) {
           endTime: windowEnd.toISOString(),
           pageSize,
           maxPages,
-          firstSync: isFirstSync
+          firstSync: isFirstSync,
+          requestUrlSubstrings: [project.canonicalDomain]
         });
         allEvents = page.events;
       } catch (e) {
@@ -18682,7 +18931,8 @@ async function trafficRoutes(app, opts) {
           // ring-buffer reseed at the end takes the most-recent IDs from the
           // dedupedEvents anyway.
           firstSync: false,
-          orderBy: "timestamp asc"
+          orderBy: "timestamp asc",
+          requestUrlSubstrings: [project.canonicalDomain]
         });
         return page.events;
       };
@@ -18795,25 +19045,25 @@ async function trafficRoutes(app, opts) {
   });
   function buildSourceDetail(projectId, row, since) {
     const crawlerTotals = app.db.select({ total: sql8`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-      and14(
+      and15(
         eq23(crawlerEventsHourly.sourceId, row.id),
         gte2(crawlerEventsHourly.tsHour, since)
       )
     ).get();
     const aiTotals = app.db.select({ total: sql8`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-      and14(
+      and15(
         eq23(aiReferralEventsHourly.sourceId, row.id),
         gte2(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
     const sampleTotals = app.db.select({ total: sql8`COUNT(*)` }).from(rawEventSamples).where(
-      and14(
+      and15(
         eq23(rawEventSamples.sourceId, row.id),
         gte2(rawEventSamples.ts, since)
       )
     ).get();
     const latestRun = app.db.select().from(runs).where(
-      and14(
+      and15(
         eq23(runs.projectId, projectId),
         eq23(runs.kind, RunKinds["traffic-sync"]),
         eq23(runs.sourceId, row.id)
@@ -18907,7 +19157,7 @@ async function trafficRoutes(app, opts) {
         lte2(crawlerEventsHourly.tsHour, untilIso)
       ];
       if (sourceIdParam) crawlerFilters.push(eq23(crawlerEventsHourly.sourceId, sourceIdParam));
-      const crawlerWhere = and14(...crawlerFilters);
+      const crawlerWhere = and15(...crawlerFilters);
       const total = app.db.select({ total: sql8`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(crawlerWhere).get();
       crawlerTotal = Number(total?.total ?? 0);
       const rows = app.db.select().from(crawlerEventsHourly).where(crawlerWhere).orderBy(desc12(crawlerEventsHourly.tsHour)).limit(limit).all();
@@ -18932,7 +19182,7 @@ async function trafficRoutes(app, opts) {
         lte2(aiReferralEventsHourly.tsHour, untilIso)
       ];
       if (sourceIdParam) aiFilters.push(eq23(aiReferralEventsHourly.sourceId, sourceIdParam));
-      const aiWhere = and14(...aiFilters);
+      const aiWhere = and15(...aiFilters);
       const total = app.db.select({ total: sql8`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(aiWhere).get();
       aiReferralTotal = Number(total?.total ?? 0);
       const rows = app.db.select().from(aiReferralEventsHourly).where(aiWhere).orderBy(desc12(aiReferralEventsHourly.tsHour)).limit(limit).all();
@@ -19587,7 +19837,7 @@ var providersConfiguredCheck = {
 var PROVIDERS_CHECKS = [providersConfiguredCheck];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and15, eq as eq24, gte as gte3, ne as ne3, sql as sql9 } from "drizzle-orm";
+import { and as and16, eq as eq24, gte as gte3, ne as ne3, sql as sql9 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function skippedNoProject2() {
@@ -19601,7 +19851,7 @@ function skippedNoProject2() {
 function loadProbes(ctx) {
   if (!ctx.project) return [];
   const rows = ctx.db.select().from(trafficSources).where(
-    and15(
+    and16(
       eq24(trafficSources.projectId, ctx.project.id),
       ne3(trafficSources.status, TrafficSourceStatuses.archived)
     )
@@ -19682,7 +19932,7 @@ var recentDataCheck = {
     const failCutoff = new Date(now.getTime() - RECENT_DATA_FAIL_DAYS * 24 * 60 * 6e4).toISOString();
     const recentCrawlers = Number(
       ctx.db.select({ total: sql9`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and15(
+        and16(
           eq24(crawlerEventsHourly.projectId, ctx.project.id),
           gte3(crawlerEventsHourly.tsHour, warnCutoff)
         )
@@ -19690,7 +19940,7 @@ var recentDataCheck = {
     );
     const recentReferrals = Number(
       ctx.db.select({ total: sql9`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and15(
+        and16(
           eq24(aiReferralEventsHourly.projectId, ctx.project.id),
           gte3(aiReferralEventsHourly.tsHour, warnCutoff)
         )
@@ -19706,7 +19956,7 @@ var recentDataCheck = {
     }
     const olderCrawlers = Number(
       ctx.db.select({ total: sql9`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and15(
+        and16(
           eq24(crawlerEventsHourly.projectId, ctx.project.id),
           gte3(crawlerEventsHourly.tsHour, failCutoff)
         )
@@ -19714,7 +19964,7 @@ var recentDataCheck = {
     );
     const olderReferrals = Number(
       ctx.db.select({ total: sql9`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and15(
+        and16(
           eq24(aiReferralEventsHourly.projectId, ctx.project.id),
           gte3(aiReferralEventsHourly.tsHour, failCutoff)
         )
@@ -20012,7 +20262,7 @@ async function doctorRoutes(app, opts) {
 
 // ../api-routes/src/discovery/routes.ts
 import crypto21 from "crypto";
-import { and as and16, desc as desc13, eq as eq25, gte as gte4, inArray as inArray8 } from "drizzle-orm";
+import { and as and17, desc as desc13, eq as eq25, gte as gte4, inArray as inArray8 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -20044,7 +20294,7 @@ async function discoveryRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const ageFloorIso = new Date(Date.now() - MAX_INFLIGHT_DISCOVERY_AGE_MS).toISOString();
     const decision = app.db.transaction((tx) => {
-      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and16(
+      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and17(
         eq25(discoverySessions.projectId, project.id),
         eq25(discoverySessions.icpDescription, icpDescription),
         inArray8(discoverySessions.status, [
@@ -20508,6 +20758,7 @@ async function apiRoutes(app, opts) {
     await api.register(projectRoutes, {
       onProjectDeleted: opts.onProjectDeleted,
       onProjectUpserted: opts.onProjectUpserted,
+      onAliasesChanged: opts.onAliasesChanged,
       validProviderNames: opts.providerAdapters?.map((a) => a.name)
     });
     await api.register(queryRoutes, {
@@ -20522,7 +20773,9 @@ async function apiRoutes(app, opts) {
     await api.register(applyRoutes, {
       onScheduleUpdated: opts.onScheduleUpdated,
       onProjectUpserted: opts.onProjectUpserted,
+      onAliasesChanged: opts.onAliasesChanged,
       validProviderNames: opts.providerAdapters?.map((a) => a.name),
+      allowLoopbackWebhooks: opts.allowLoopbackWebhooks,
       onGoogleConnectionPropertyUpdated: (domain, connectionType, propertyId) => {
         opts.googleConnectionStore?.updateConnection(domain, connectionType, {
           propertyId,
@@ -20553,7 +20806,9 @@ async function apiRoutes(app, opts) {
       onScheduleUpdated: opts.onScheduleUpdated,
       validProviderNames: opts.providerAdapters?.map((a) => a.name)
     });
-    await api.register(notificationRoutes);
+    await api.register(notificationRoutes, {
+      allowLoopbackWebhooks: opts.allowLoopbackWebhooks
+    });
     await api.register(telemetryRoutes, {
       getTelemetryStatus: opts.getTelemetryStatus,
       setTelemetryEnabled: opts.setTelemetryEnabled
@@ -20808,7 +21063,7 @@ function isVertexConfig(config) {
 function resolveModel(config) {
   return config.model || DEFAULT_MODEL;
 }
-function createClient(config) {
+function createClient2(config) {
   if (isVertexConfig(config)) {
     return new GoogleGenAI({
       vertexai: true,
@@ -20848,7 +21103,7 @@ async function healthcheck(config) {
   if (!validation.ok) return validation;
   try {
     const model = resolveModel(config);
-    const client = createClient(config);
+    const client = createClient2(config);
     const result = await withRetry(
       () => client.models.generateContent({
         model,
@@ -20875,7 +21130,7 @@ async function healthcheck(config) {
 async function executeTrackedQuery(input) {
   const model = resolveModel(input.config);
   const prompt = buildPrompt(input.query, input.location);
-  const client = createClient(input.config);
+  const client = createClient2(input.config);
   try {
     const result = await withRetry(
       () => client.models.generateContent({
@@ -21040,7 +21295,7 @@ function extractDomainFromUri(uri) {
 }
 async function generateText(prompt, config) {
   const model = resolveModel(config);
-  const client = createClient(config);
+  const client = createClient2(config);
   const result = await withRetry(
     () => client.models.generateContent({
       model,
@@ -23360,7 +23615,7 @@ import crypto24 from "crypto";
 import fs7 from "fs";
 import path9 from "path";
 import os5 from "os";
-import { and as and17, eq as eq27, inArray as inArray9, sql as sql10 } from "drizzle-orm";
+import { and as and18, eq as eq27, inArray as inArray9, sql as sql10 } from "drizzle-orm";
 
 // src/run-telemetry.ts
 import crypto23 from "crypto";
@@ -23467,11 +23722,15 @@ function computeCompetitorOverlap(normalized, competitorDomains) {
 function escapeRegExp5(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function extractRecommendedCompetitors(answerText, ownDomains, citedDomains, competitorDomains) {
+function extractRecommendedCompetitors(answerText, ownDomains, citedDomains, competitorDomains, ownBrandNames = []) {
   if (!answerText || answerText.length < 20) return [];
   const ownBrandKeys = new Set(
     ownDomains.flatMap((domain) => collectBrandKeysFromDomain(domain))
   );
+  for (const name of ownBrandNames) {
+    const key = brandKeyFromText(name);
+    if (key.length >= 4) ownBrandKeys.add(key);
+  }
   const knownCompetitorKeys = new Set(
     [...citedDomains, ...competitorDomains].flatMap((domain) => collectBrandKeysFromDomain(domain)).filter((key) => !ownBrandKeys.has(key))
   );
@@ -23739,7 +23998,7 @@ var JobRunner = class {
         throw new Error(`Run ${runId} is not executable from status '${existingRun.status}'`);
       }
       if (existingRun.status === "queued") {
-        this.db.update(runs).set({ status: "running", startedAt: now }).where(and17(eq27(runs.id, runId), eq27(runs.status, "queued"))).run();
+        this.db.update(runs).set({ status: "running", startedAt: now }).where(and18(eq27(runs.id, runId), eq27(runs.status, "queued"))).run();
       }
       this.throwIfRunCancelled(runId);
       const project = this.db.select().from(projects).where(eq27(projects.id, projectId)).get();
@@ -23764,13 +24023,17 @@ var JobRunner = class {
       }
       log.info("run.dispatch", { runId, providerCount: activeProviders.length, providers: activeProviders.map((p) => p.adapter.name) });
       const scopedQueryNames = parseJsonColumn(existingRun.queries, null);
-      projectQueries = scopedQueryNames ? this.db.select().from(queries).where(and17(eq27(queries.projectId, projectId), inArray9(queries.query, scopedQueryNames))).all() : this.db.select().from(queries).where(eq27(queries.projectId, projectId)).all();
+      projectQueries = scopedQueryNames ? this.db.select().from(queries).where(and18(eq27(queries.projectId, projectId), inArray9(queries.query, scopedQueryNames))).all() : this.db.select().from(queries).where(eq27(queries.projectId, projectId)).all();
       const projectCompetitors = this.db.select().from(competitors).where(eq27(competitors.projectId, projectId)).all();
       const competitorDomains = projectCompetitors.map((c) => c.domain);
       const allDomains = effectiveDomains({
         canonicalDomain: project.canonicalDomain,
         ownedDomains: parseJsonColumn(project.ownedDomains, [])
       });
+      const allBrandNames = effectiveBrandNames({
+        displayName: project.displayName,
+        aliases: parseJsonColumn(project.aliases, [])
+      });
       const executionContext = {
         providerCount: activeProviders.length,
         providers: activeProviders.map((provider) => provider.adapter.name),
@@ -23831,7 +24094,7 @@ var JobRunner = class {
             const citationState = determineCitationState(normalized, allDomains);
             const answerMentioned = determineAnswerMentioned(
               normalized.answerText,
-              project.displayName,
+              allBrandNames,
               allDomains
             );
             const overlap = computeCompetitorOverlap(normalized, competitorDomains);
@@ -23839,7 +24102,8 @@ var JobRunner = class {
               normalized.answerText,
               allDomains,
               normalized.citedDomains,
-              competitorDomains
+              competitorDomains,
+              allBrandNames
             );
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs7.existsSync(raw.screenshotPath)) {
@@ -24102,7 +24366,7 @@ function buildPhases(input) {
 
 // src/gsc-sync.ts
 import crypto25 from "crypto";
-import { eq as eq28, and as and18, sql as sql11 } from "drizzle-orm";
+import { eq as eq28, and as and19, sql as sql11 } from "drizzle-orm";
 var log2 = createLogger("GscSync");
 function formatDate3(d) {
   return d.toISOString().split("T")[0];
@@ -24154,7 +24418,7 @@ async function executeGscSync(db, runId, projectId, opts) {
     });
     log2.info("fetch.complete", { runId, projectId, rowCount: rows.length });
     db.delete(gscSearchData).where(
-      and18(
+      and19(
         eq28(gscSearchData.projectId, projectId),
         sql11`${gscSearchData.date} >= ${startDate}`,
         sql11`${gscSearchData.date} <= ${endDate}`
@@ -24243,7 +24507,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = formatDate3(/* @__PURE__ */ new Date());
-    db.delete(gscCoverageSnapshots).where(and18(eq28(gscCoverageSnapshots.projectId, projectId), eq28(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and19(eq28(gscCoverageSnapshots.projectId, projectId), eq28(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
       id: crypto25.randomUUID(),
       projectId,
@@ -24266,7 +24530,7 @@ async function executeGscSync(db, runId, projectId, opts) {
 
 // src/gsc-inspect-sitemap.ts
 import crypto26 from "crypto";
-import { eq as eq29, and as and19 } from "drizzle-orm";
+import { eq as eq29, and as and20 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
 var log3 = createLogger("SitemapParser");
@@ -24482,7 +24746,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    db.delete(gscCoverageSnapshots).where(and19(eq29(gscCoverageSnapshots.projectId, projectId), eq29(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and20(eq29(gscCoverageSnapshots.projectId, projectId), eq29(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
       id: crypto26.randomUUID(),
       projectId,
@@ -24693,7 +24957,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
 // src/commoncrawl-sync.ts
 import crypto28 from "crypto";
 import path10 from "path";
-import { and as and20, eq as eq31, sql as sql12 } from "drizzle-orm";
+import { and as and21, eq as eq31, sql as sql12 } from "drizzle-orm";
 var log6 = createLogger("CommonCrawlSync");
 var INSERT_CHUNK_SIZE = 1e4;
 function defaultDeps() {
@@ -24884,7 +25148,7 @@ function computeSummary(rows) {
 // src/backlink-extract.ts
 import crypto29 from "crypto";
 import fs8 from "fs";
-import { and as and21, desc as desc15, eq as eq32 } from "drizzle-orm";
+import { and as and22, desc as desc15, eq as eq32 } from "drizzle-orm";
 var log7 = createLogger("BacklinkExtract");
 function defaultDeps2() {
   return {
@@ -24930,7 +25194,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
     const targetDomain = project.canonicalDomain;
     db.transaction((tx) => {
       tx.delete(backlinkDomains).where(
-        and21(eq32(backlinkDomains.projectId, projectId), eq32(backlinkDomains.release, release))
+        and22(eq32(backlinkDomains.projectId, projectId), eq32(backlinkDomains.release, release))
       ).run();
       if (rows.length > 0) {
         const values = rows.map((r) => ({
@@ -25001,9 +25265,10 @@ function computeSummary2(rows) {
 
 // src/discovery-run.ts
 import crypto30 from "crypto";
-import { eq as eq33 } from "drizzle-orm";
+import { and as and23, eq as eq33 } from "drizzle-orm";
 var log8 = createLogger("DiscoveryRun");
 var DEFAULT_SEED_COUNT = 30;
+var QUERIES_PER_INTENT_BUCKET = 6;
 async function executeDiscoveryRun(opts) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   opts.db.update(runs).set({ status: RunStatuses.running, startedAt }).where(eq33(runs.id, opts.runId)).run();
@@ -25208,6 +25473,7 @@ function buildLocationConstraint(locations) {
 }
 function buildSeedPrompt(input) {
   const locationConstraint = buildLocationConstraint(input.locations ?? []);
+  const currentYear = (/* @__PURE__ */ new Date()).getFullYear();
   return [
     "You are an AEO (Answer Engine Optimization) analyst expanding a tracked-query basket for a customer.",
     "",
@@ -25215,14 +25481,15 @@ function buildSeedPrompt(input) {
     `ICP: ${input.icpDescription}`,
     ...locationConstraint.length > 0 ? ["", ...locationConstraint] : [],
     "",
-    "Brainstorm a wide set of queries a member of this ICP would type into an AI answer engine (Gemini, ChatGPT, Perplexity) when they are about to make a decision in this space. Aim for 30+ candidates covering:",
-    ' - Comparison queries ("best X for Y")',
-    " - Specific feature / capability queries",
-    " - Pricing / vendor-shortlist queries",
-    " - Workflow / how-to queries",
-    " - Adjacent jobs-to-be-done queries",
+    "Brainstorm queries a member of this ICP would type into an AI answer engine (Gemini, ChatGPT, Perplexity). Generate candidates across the five intent buckets below \u2014 these are SEMANTICALLY DISTINCT search intents, not stylistic variants. A query should fit one bucket cleanly. Diversity across buckets is the point: it keeps the list from collapsing into near-synonyms of a single intent.",
+    "",
+    ' 1. Informational \u2014 the searcher wants to understand a concept, market, or problem. Templates: "what is X", "how does X work", "X explained", "why X matters".',
+    ` 2. Commercial \u2014 the searcher is researching category leaders before a purchase. Templates: "best X for Y", "top X ${currentYear}", "leading X providers", "X for [use case]".`,
+    ' 3. Navigational \u2014 the searcher is looking for a specific brand, place, or directory. Templates: "X near me", "X reviews", "X website", "X directory".',
+    ' 4. Comparative \u2014 the searcher is weighing named alternatives head-to-head. Templates: "X vs Y", "X or Y for Z", "alternatives to X".',
+    ' 5. Transactional \u2014 the searcher is ready to act on a purchase or booking. Templates: "book X", "X pricing", "X discount code", "buy X online".',
     "",
-    "Return ONE query per line. Plain text only \u2014 no numbering, bullets, quotes, or commentary."
+    `Generate EXACTLY ${QUERIES_PER_INTENT_BUCKET} queries per bucket \u2014 ${QUERIES_PER_INTENT_BUCKET * 5} total. Return ONE query per line. Plain text only \u2014 no numbering, bullets, quotes, bucket labels, or commentary.`
   ].join("\n");
 }
 function parseQueryLines(text, max) {
@@ -25257,33 +25524,40 @@ function writeDiscoveryInsight(db, input) {
     aspirational: buckets.aspirational,
     totalProbes
   });
-  db.insert(insights).values({
-    id: crypto30.randomUUID(),
-    projectId: input.projectId,
-    runId: input.runId,
-    type: "discovery.basket-divergence",
-    severity,
-    title,
-    // query/provider fields don't fit the visibility-snapshot model for a
-    // session-level insight. Use the session marker so the
-    // (query, provider) index stays distinct across sessions; PR 5 will
-    // formalize a session-scoped insight subtype.
-    query: `discovery:${input.sessionId}`,
-    provider: input.seedProvider,
-    recommendation: JSON.stringify({
-      action: "review-discovered-basket",
-      summary: `Run \`canonry discover show ${input.sessionId} --format json\` to inspect the per-query breakdown, then \`canonry discover promote <project> ${input.sessionId}\` to merge cited + aspirational findings into the project.`,
-      bucketCounts: buckets,
-      topCompetitors
-    }),
-    cause: JSON.stringify({
-      sessionId: input.sessionId,
-      totalProbes,
-      seedProvider: input.seedProvider
-    }),
-    dismissed: false,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).run();
+  db.transaction((tx) => {
+    tx.update(insights).set({ dismissed: true }).where(and23(
+      eq33(insights.projectId, input.projectId),
+      eq33(insights.type, "discovery.basket-divergence"),
+      eq33(insights.dismissed, false)
+    )).run();
+    tx.insert(insights).values({
+      id: crypto30.randomUUID(),
+      projectId: input.projectId,
+      runId: input.runId,
+      type: "discovery.basket-divergence",
+      severity,
+      title,
+      // query/provider fields don't fit the visibility-snapshot model for
+      // a session-level insight. Use the session marker so the
+      // (query, provider) index stays distinct across sessions; PR 5 will
+      // formalize a session-scoped insight subtype.
+      query: `discovery:${input.sessionId}`,
+      provider: input.seedProvider,
+      recommendation: JSON.stringify({
+        action: "review-discovered-basket",
+        summary: `Run \`canonry discover show ${input.sessionId} --format json\` to inspect the per-query breakdown, then \`canonry discover promote <project> ${input.sessionId}\` to merge cited + aspirational findings into the project.`,
+        bucketCounts: buckets,
+        topCompetitors
+      }),
+      cause: JSON.stringify({
+        sessionId: input.sessionId,
+        totalProbes,
+        seedProvider: input.seedProvider
+      }),
+      dismissed: false,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
+  });
 }
 function buildDiscoveryInsightTitle(input) {
   const parts = [];
@@ -25294,6 +25568,512 @@ function buildDiscoveryInsightTitle(input) {
   return parts.join(" \u2022 ");
 }
 
+// src/commands/backfill.ts
+import { and as and24, eq as eq34, inArray as inArray10 } from "drizzle-orm";
+var SNAPSHOT_BATCH_SIZE = 500;
+async function backfillAnswerVisibilityCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const projectFilter = opts?.project?.trim();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq34(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  let examined = 0;
+  let updated = 0;
+  let mentioned = 0;
+  let reparsed = 0;
+  let providerErrors = 0;
+  if (scopedProjects.length > 0) {
+    const runRows = projectFilter ? db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(and24(
+      eq34(runs.kind, RunKinds["answer-visibility"]),
+      inArray10(runs.projectId, scopedProjects.map((project) => project.id))
+    )).all() : db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(eq34(runs.kind, RunKinds["answer-visibility"])).all();
+    const runIdsByProject = /* @__PURE__ */ new Map();
+    for (const run of runRows) {
+      const existing = runIdsByProject.get(run.projectId);
+      if (existing) existing.push(run.id);
+      else runIdsByProject.set(run.projectId, [run.id]);
+    }
+    for (const project of scopedProjects) {
+      const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq34(competitors.projectId, project.id)).all().map((row) => row.domain);
+      const runIds = runIdsByProject.get(project.id) ?? [];
+      if (runIds.length === 0) continue;
+      const projectDomains = effectiveDomains({
+        canonicalDomain: project.canonicalDomain,
+        ownedDomains: parseJsonColumn(project.ownedDomains, [])
+      });
+      const projectBrandNames = effectiveBrandNames({
+        displayName: project.displayName,
+        aliases: parseJsonColumn(project.aliases, [])
+      });
+      for (let offset = 0; offset < runIds.length; offset += SNAPSHOT_BATCH_SIZE) {
+        const batchRunIds = runIds.slice(offset, offset + SNAPSHOT_BATCH_SIZE);
+        const snapshotRows = db.select({
+          id: querySnapshots.id,
+          provider: querySnapshots.provider,
+          citationState: querySnapshots.citationState,
+          answerMentioned: querySnapshots.answerMentioned,
+          answerText: querySnapshots.answerText,
+          citedDomains: querySnapshots.citedDomains,
+          competitorOverlap: querySnapshots.competitorOverlap,
+          recommendedCompetitors: querySnapshots.recommendedCompetitors,
+          rawResponse: querySnapshots.rawResponse
+        }).from(querySnapshots).where(inArray10(querySnapshots.runId, batchRunIds)).all();
+        const pendingUpdates = [];
+        for (const snapshot of snapshotRows) {
+          examined++;
+          const reparsedResult = reparseProviderSnapshot(snapshot.provider, snapshot.rawResponse);
+          if (reparsedResult) reparsed++;
+          if (reparsedResult?.providerError) providerErrors++;
+          const answerText = reparsedResult?.answerText ?? snapshot.answerText ?? "";
+          const nextValue = determineAnswerMentioned(answerText, projectBrandNames, projectDomains);
+          if (nextValue) mentioned++;
+          const nextPatch = {};
+          if (snapshot.answerMentioned !== nextValue) {
+            nextPatch.answerMentioned = nextValue;
+          }
+          if ((snapshot.answerText ?? "") !== answerText) {
+            nextPatch.answerText = answerText;
+          }
+          if (reparsedResult) {
+            const normalized = {
+              provider: snapshot.provider,
+              answerText,
+              citedDomains: reparsedResult.citedDomains,
+              groundingSources: reparsedResult.groundingSources,
+              searchQueries: reparsedResult.searchQueries
+            };
+            const nextCitationState = determineCitationState(normalized, projectDomains);
+            const nextCitedDomains = JSON.stringify(reparsedResult.citedDomains);
+            const nextCompetitorOverlap = JSON.stringify(
+              computeCompetitorOverlap(normalized, competitorDomains)
+            );
+            const nextRecommendedCompetitors = JSON.stringify(
+              extractRecommendedCompetitors(
+                normalized.answerText,
+                projectDomains,
+                normalized.citedDomains,
+                competitorDomains,
+                projectBrandNames
+              )
+            );
+            const nextRawResponse = stringifyStoredSnapshotEnvelope(
+              snapshot.rawResponse,
+              reparsedResult
+            );
+            if (snapshot.citationState !== nextCitationState) {
+              nextPatch.citationState = nextCitationState;
+            }
+            if (snapshot.citedDomains !== nextCitedDomains) {
+              nextPatch.citedDomains = nextCitedDomains;
+            }
+            if (snapshot.competitorOverlap !== nextCompetitorOverlap) {
+              nextPatch.competitorOverlap = nextCompetitorOverlap;
+            }
+            if (snapshot.recommendedCompetitors !== nextRecommendedCompetitors) {
+              nextPatch.recommendedCompetitors = nextRecommendedCompetitors;
+            }
+            if (snapshot.rawResponse !== nextRawResponse) {
+              nextPatch.rawResponse = nextRawResponse;
+            }
+          }
+          if (Object.keys(nextPatch).length > 0) {
+            pendingUpdates.push({ id: snapshot.id, patch: nextPatch });
+          }
+        }
+        if (pendingUpdates.length > 0) {
+          db.transaction((tx) => {
+            for (const update of pendingUpdates) {
+              tx.update(querySnapshots).set(update.patch).where(eq34(querySnapshots.id, update.id)).run();
+            }
+          });
+          updated += pendingUpdates.length;
+        }
+      }
+    }
+  }
+  const result = {
+    project: projectFilter ?? null,
+    projects: scopedProjects.length,
+    examined,
+    updated,
+    mentioned,
+    reparsed,
+    providerErrors
+  };
+  if (opts?.format === "json") {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log("Answer visibility backfill complete.\n");
+  if (projectFilter) {
+    console.log(`  Project:  ${projectFilter}`);
+  }
+  console.log(`  Projects: ${scopedProjects.length}`);
+  console.log(`  Examined:  ${examined}`);
+  console.log(`  Updated:   ${updated}`);
+  console.log(`  Mentioned: ${mentioned}`);
+  console.log(`  Reparsed:  ${reparsed}`);
+  console.log(`  Errors:    ${providerErrors}`);
+}
+function backfillNormalizedPaths(db, opts) {
+  const baseConditions = [];
+  if (opts?.projectId) {
+    baseConditions.push(eq34(gaTrafficSnapshots.projectId, opts.projectId));
+  }
+  const rows = db.select({
+    id: gaTrafficSnapshots.id,
+    landingPage: gaTrafficSnapshots.landingPage,
+    landingPageNormalized: gaTrafficSnapshots.landingPageNormalized
+  }).from(gaTrafficSnapshots).where(baseConditions.length > 0 ? and24(...baseConditions) : void 0).all();
+  let updated = 0;
+  let unchanged = 0;
+  if (rows.length > 0) {
+    db.transaction((tx) => {
+      for (const row of rows) {
+        const next = normalizeUrlPath(row.landingPage);
+        if (next === null) {
+          unchanged++;
+          continue;
+        }
+        if (row.landingPageNormalized === next) {
+          unchanged++;
+          continue;
+        }
+        tx.update(gaTrafficSnapshots).set({ landingPageNormalized: next }).where(eq34(gaTrafficSnapshots.id, row.id)).run();
+        updated++;
+      }
+    });
+  }
+  return { examined: rows.length, updated, unchanged };
+}
+async function backfillNormalizedPathsCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const projectFilter = opts?.project?.trim();
+  let projectId;
+  if (projectFilter) {
+    const project = db.select({ id: projects.id }).from(projects).where(eq34(projects.name, projectFilter)).get();
+    if (!project) {
+      const result2 = {
+        project: projectFilter,
+        examined: 0,
+        updated: 0,
+        unchanged: 0
+      };
+      if (opts?.format === "json") {
+        console.log(JSON.stringify(result2, null, 2));
+        return;
+      }
+      console.log(`Backfill normalized-paths: project "${projectFilter}" not found.`);
+      return;
+    }
+    projectId = project.id;
+  }
+  const { examined, updated, unchanged } = backfillNormalizedPaths(db, { projectId });
+  const result = {
+    project: projectFilter ?? null,
+    examined,
+    updated,
+    unchanged
+  };
+  if (opts?.format === "json") {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log("Normalized-path backfill complete.\n");
+  if (projectFilter) console.log(`  Project:   ${projectFilter}`);
+  console.log(`  Examined:  ${examined}`);
+  console.log(`  Updated:   ${updated}`);
+  console.log(`  Unchanged: ${unchanged}`);
+}
+function backfillAiReferralPaths(db, opts) {
+  const baseConditions = [];
+  if (opts?.projectId) {
+    baseConditions.push(eq34(gaAiReferrals.projectId, opts.projectId));
+  }
+  const rows = db.select({
+    id: gaAiReferrals.id,
+    landingPage: gaAiReferrals.landingPage,
+    landingPageNormalized: gaAiReferrals.landingPageNormalized
+  }).from(gaAiReferrals).where(baseConditions.length > 0 ? and24(...baseConditions) : void 0).all();
+  let updated = 0;
+  let unchanged = 0;
+  if (rows.length > 0) {
+    db.transaction((tx) => {
+      for (const row of rows) {
+        const next = normalizeUrlPath(row.landingPage);
+        if (next === null) {
+          unchanged++;
+          continue;
+        }
+        if (row.landingPageNormalized === next) {
+          unchanged++;
+          continue;
+        }
+        tx.update(gaAiReferrals).set({ landingPageNormalized: next }).where(eq34(gaAiReferrals.id, row.id)).run();
+        updated++;
+      }
+    });
+  }
+  return { examined: rows.length, updated, unchanged };
+}
+async function backfillAiReferralPathsCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const projectFilter = opts?.project?.trim();
+  let projectId;
+  if (projectFilter) {
+    const project = db.select({ id: projects.id }).from(projects).where(eq34(projects.name, projectFilter)).get();
+    if (!project) {
+      const result2 = {
+        project: projectFilter,
+        examined: 0,
+        updated: 0,
+        unchanged: 0
+      };
+      if (opts?.format === "json") {
+        console.log(JSON.stringify(result2, null, 2));
+        return;
+      }
+      console.log(`Backfill ai-referral-paths: project "${projectFilter}" not found.`);
+      return;
+    }
+    projectId = project.id;
+  }
+  const { examined, updated, unchanged } = backfillAiReferralPaths(db, { projectId });
+  const result = {
+    project: projectFilter ?? null,
+    examined,
+    updated,
+    unchanged
+  };
+  if (opts?.format === "json") {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log("AI referral landing-page backfill complete.\n");
+  if (projectFilter) console.log(`  Project:   ${projectFilter}`);
+  console.log(`  Examined:  ${examined}`);
+  console.log(`  Updated:   ${updated}`);
+  console.log(`  Unchanged: ${unchanged}`);
+}
+function backfillProjectAnswerMentions(db, projectId) {
+  const project = db.select().from(projects).where(eq34(projects.id, projectId)).get();
+  if (!project) return { examined: 0, updated: 0, mentioned: 0 };
+  const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq34(competitors.projectId, projectId)).all().map((row) => row.domain);
+  const runRows = db.select({ id: runs.id }).from(runs).where(and24(eq34(runs.kind, RunKinds["answer-visibility"]), eq34(runs.projectId, projectId))).all();
+  const runIds = runRows.map((r) => r.id);
+  let examined = 0;
+  let updated = 0;
+  let mentioned = 0;
+  if (runIds.length === 0) return { examined, updated, mentioned };
+  const projectDomains = effectiveDomains({
+    canonicalDomain: project.canonicalDomain,
+    ownedDomains: parseJsonColumn(project.ownedDomains, [])
+  });
+  const projectBrandNames = effectiveBrandNames({
+    displayName: project.displayName,
+    aliases: parseJsonColumn(project.aliases, [])
+  });
+  for (let offset = 0; offset < runIds.length; offset += SNAPSHOT_BATCH_SIZE) {
+    const batchRunIds = runIds.slice(offset, offset + SNAPSHOT_BATCH_SIZE);
+    const snapshotRows = db.select({
+      id: querySnapshots.id,
+      provider: querySnapshots.provider,
+      answerMentioned: querySnapshots.answerMentioned,
+      answerText: querySnapshots.answerText,
+      citedDomains: querySnapshots.citedDomains,
+      competitorOverlap: querySnapshots.competitorOverlap,
+      recommendedCompetitors: querySnapshots.recommendedCompetitors,
+      rawResponse: querySnapshots.rawResponse
+    }).from(querySnapshots).where(inArray10(querySnapshots.runId, batchRunIds)).all();
+    const pendingUpdates = [];
+    for (const snapshot of snapshotRows) {
+      examined++;
+      const answerText = snapshot.answerText ?? "";
+      const nextAnswerMentioned = determineAnswerMentioned(answerText, projectBrandNames, projectDomains);
+      if (nextAnswerMentioned) mentioned++;
+      const citedDomains = parseJsonColumn(snapshot.citedDomains, []);
+      const groundingSources = readStoredGroundingSources(snapshot.rawResponse);
+      const normalized = {
+        provider: snapshot.provider,
+        answerText,
+        citedDomains,
+        groundingSources,
+        searchQueries: []
+      };
+      const nextCompetitorOverlap = JSON.stringify(
+        computeCompetitorOverlap(normalized, competitorDomains)
+      );
+      const nextRecommendedCompetitors = JSON.stringify(
+        extractRecommendedCompetitors(
+          answerText,
+          projectDomains,
+          citedDomains,
+          competitorDomains,
+          projectBrandNames
+        )
+      );
+      const nextPatch = {};
+      if (snapshot.answerMentioned !== nextAnswerMentioned) {
+        nextPatch.answerMentioned = nextAnswerMentioned;
+      }
+      if (snapshot.competitorOverlap !== nextCompetitorOverlap) {
+        nextPatch.competitorOverlap = nextCompetitorOverlap;
+      }
+      if (snapshot.recommendedCompetitors !== nextRecommendedCompetitors) {
+        nextPatch.recommendedCompetitors = nextRecommendedCompetitors;
+      }
+      if (Object.keys(nextPatch).length > 0) {
+        pendingUpdates.push({ id: snapshot.id, patch: nextPatch });
+      }
+    }
+    if (pendingUpdates.length > 0) {
+      db.transaction((tx) => {
+        for (const update of pendingUpdates) {
+          tx.update(querySnapshots).set(update.patch).where(eq34(querySnapshots.id, update.id)).run();
+        }
+      });
+      updated += pendingUpdates.length;
+    }
+  }
+  return { examined, updated, mentioned };
+}
+async function backfillAnswerMentionsCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const projectFilter = opts?.project?.trim();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq34(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  let examined = 0;
+  let updated = 0;
+  let mentioned = 0;
+  for (const project of scopedProjects) {
+    const result2 = backfillProjectAnswerMentions(db, project.id);
+    examined += result2.examined;
+    updated += result2.updated;
+    mentioned += result2.mentioned;
+  }
+  const result = {
+    project: projectFilter ?? null,
+    projects: scopedProjects.length,
+    examined,
+    updated,
+    mentioned
+  };
+  if (opts?.format === "json") {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log("Answer mentions backfill complete.\n");
+  if (projectFilter) console.log(`  Project:   ${projectFilter}`);
+  console.log(`  Projects:  ${scopedProjects.length}`);
+  console.log(`  Examined:  ${examined}`);
+  console.log(`  Updated:   ${updated}`);
+  console.log(`  Mentioned: ${mentioned}`);
+}
+function readStoredGroundingSources(rawResponse) {
+  const envelope = parseJsonColumn(rawResponse, {});
+  const sources = envelope.groundingSources;
+  if (!Array.isArray(sources)) return [];
+  const result = [];
+  for (const source of sources) {
+    if (source && typeof source === "object") {
+      const uri = source.uri;
+      const title = source.title;
+      if (typeof uri === "string") {
+        result.push({ uri, title: typeof title === "string" ? title : "" });
+      }
+    }
+  }
+  return result;
+}
+async function backfillInsightsCommand(project, opts) {
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-WAJOEOJV.js");
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const service = new IntelligenceService2(db);
+  const isJson = opts?.format === "json";
+  if (!isJson) {
+    process.stderr.write(`Backfilling insights for "${project}"...
+`);
+  }
+  const result = service.backfill(project, {
+    fromRunId: opts?.fromRun,
+    toRunId: opts?.toRun
+  }, (info) => {
+    if (!isJson) {
+      process.stderr.write(`  [${info.index}/${info.total}] ${info.runId} \u2014 ${info.insights} insights
+`);
+    }
+  });
+  const output = {
+    project,
+    processed: result.processed,
+    skipped: result.skipped,
+    totalInsights: result.totalInsights
+  };
+  if (isJson) {
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+  console.log(`
+Backfill complete.`);
+  console.log(`  Processed: ${result.processed}`);
+  console.log(`  Skipped:   ${result.skipped}`);
+  console.log(`  Insights:  ${result.totalInsights}`);
+}
+function reparseProviderSnapshot(provider, rawResponse) {
+  const envelope = parseJsonColumn(rawResponse, {});
+  const apiResponse = resolveStoredApiResponse(envelope);
+  if (!apiResponse) return null;
+  switch (provider) {
+    case ProviderNames.openai:
+      return reparseStoredResult2(apiResponse);
+    case ProviderNames.claude:
+      return reparseStoredResult3(apiResponse);
+    case ProviderNames.gemini:
+      return reparseStoredResult(apiResponse);
+    case ProviderNames.perplexity:
+      return reparseStoredResult4(apiResponse);
+    default:
+      return null;
+  }
+}
+function resolveStoredApiResponse(parsed) {
+  const nested = parsed.apiResponse;
+  if (nested !== null && typeof nested === "object" && !Array.isArray(nested)) {
+    return nested;
+  }
+  if (looksLikeProviderApiResponse(parsed)) {
+    return parsed;
+  }
+  return null;
+}
+function looksLikeProviderApiResponse(value) {
+  return Array.isArray(value.output) || Array.isArray(value.content) || Array.isArray(value.candidates) || Array.isArray(value.choices);
+}
+function stringifyStoredSnapshotEnvelope(rawResponse, reparsed) {
+  const parsed = parseJsonColumn(rawResponse, {});
+  const apiResponse = resolveStoredApiResponse(parsed);
+  const envelope = apiResponse === parsed ? {} : { ...parsed };
+  delete envelope.answerText;
+  delete envelope.citedDomains;
+  delete envelope.competitorOverlap;
+  delete envelope.recommendedCompetitors;
+  delete envelope.providerError;
+  return JSON.stringify({
+    ...envelope,
+    groundingSources: reparsed.groundingSources,
+    searchQueries: reparsed.searchQueries,
+    ...reparsed.providerError ? { providerError: reparsed.providerError } : {},
+    ...apiResponse ? { apiResponse } : {}
+  });
+}
+
 // src/provider-registry.ts
 var ProviderRegistry = class {
   providers = /* @__PURE__ */ new Map();
@@ -25347,7 +26127,7 @@ var ProviderRegistry = class {
 
 // src/scheduler.ts
 import cron from "node-cron";
-import { and as and22, eq as eq34 } from "drizzle-orm";
+import { and as and25, eq as eq35 } from "drizzle-orm";
 var log9 = createLogger("Scheduler");
 function taskKey(projectId, kind) {
   return `${projectId}::${kind}`;
@@ -25362,7 +26142,7 @@ var Scheduler = class {
   }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq34(schedules.enabled, 1)).all();
+    const allSchedules = this.db.select().from(schedules).where(eq35(schedules.enabled, 1)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
@@ -25392,7 +26172,7 @@ var Scheduler = class {
       this.stopTask(key, existing, "Stopped");
       this.tasks.delete(key);
     }
-    const schedule = this.db.select().from(schedules).where(and22(eq34(schedules.projectId, projectId), eq34(schedules.kind, kind))).get();
+    const schedule = this.db.select().from(schedules).where(and25(eq35(schedules.projectId, projectId), eq35(schedules.kind, kind))).get();
     if (schedule && schedule.enabled === 1) {
       this.registerCronTask(schedule);
     }
@@ -25433,14 +26213,14 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: task.getNextRun()?.toISOString() ?? null,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq34(schedules.id, scheduleId)).run();
+    }).where(eq35(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
     log9.info("cron.registered", { projectId, kind, schedule: label, timezone });
   }
   triggerRun(scheduleId, projectId, kind) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const currentSchedule = this.db.select().from(schedules).where(eq34(schedules.id, scheduleId)).get();
+      const currentSchedule = this.db.select().from(schedules).where(eq35(schedules.id, scheduleId)).get();
       if (!currentSchedule || currentSchedule.enabled !== 1) {
         log9.warn("schedule.stale", { scheduleId, projectId, kind, msg: "schedule no longer exists or is disabled" });
         this.remove(projectId, kind);
@@ -25448,7 +26228,7 @@ var Scheduler = class {
       }
       const task = this.tasks.get(taskKey(projectId, kind));
       const nextRunAt = task?.getNextRun()?.toISOString() ?? null;
-      const project = this.db.select().from(projects).where(eq34(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq35(projects.id, projectId)).get();
       if (!project) {
         log9.error("project.not-found", { projectId, kind, msg: "skipping scheduled run" });
         this.remove(projectId, kind);
@@ -25468,7 +26248,7 @@ var Scheduler = class {
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq34(schedules.id, currentSchedule.id)).run();
+        }).where(eq35(schedules.id, currentSchedule.id)).run();
         log9.info("traffic-sync.triggered", { projectName: project.name, sourceId });
         this.callbacks.onTrafficSyncRequested(project.name, sourceId);
         return;
@@ -25496,7 +26276,7 @@ var Scheduler = class {
         this.db.update(schedules).set({
           nextRunAt,
           updatedAt: now
-        }).where(eq34(schedules.id, currentSchedule.id)).run();
+        }).where(eq35(schedules.id, currentSchedule.id)).run();
         return;
       }
       const runId = queueResult.runId;
@@ -25504,7 +26284,7 @@ var Scheduler = class {
         lastRunAt: now,
         nextRunAt,
         updatedAt: now
-      }).where(eq34(schedules.id, currentSchedule.id)).run();
+      }).where(eq35(schedules.id, currentSchedule.id)).run();
       const scheduleProviders = parseJsonColumn(currentSchedule.providers, []);
       const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
       log9.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
@@ -25516,7 +26296,7 @@ var Scheduler = class {
 };
 
 // src/notifier.ts
-import { eq as eq35, desc as desc16, and as and23, inArray as inArray10, or as or4 } from "drizzle-orm";
+import { eq as eq36, desc as desc16, and as and26, inArray as inArray11, or as or5 } from "drizzle-orm";
 import crypto31 from "crypto";
 var log10 = createLogger("Notifier");
 var Notifier = class {
@@ -25529,18 +26309,18 @@ var Notifier = class {
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
     log10.info("run.completed", { runId, projectId });
-    const notifs = this.db.select().from(notifications).where(eq35(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq36(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) {
       log10.info("notifications.none-enabled", { projectId });
       return;
     }
     log10.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq35(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq36(runs.id, runId)).get();
     if (!run) {
       log10.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq35(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq36(projects.id, projectId)).get();
     if (!project) {
       log10.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
@@ -25587,11 +26367,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq35(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq36(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq35(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq36(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq35(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq36(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = parseJsonColumn(notif.config, { url: "", events: [] });
@@ -25621,12 +26401,12 @@ var Notifier = class {
     }
   }
   computeTransitions(runId, projectId) {
-    const thisRun = this.db.select().from(runs).where(eq35(runs.id, runId)).get();
+    const thisRun = this.db.select().from(runs).where(eq36(runs.id, runId)).get();
     if (!thisRun) return [];
-    const groupSiblings = this.db.select().from(runs).where(and23(
-      eq35(runs.projectId, projectId),
-      eq35(runs.kind, thisRun.kind),
-      eq35(runs.createdAt, thisRun.createdAt)
+    const groupSiblings = this.db.select().from(runs).where(and26(
+      eq36(runs.projectId, projectId),
+      eq36(runs.kind, thisRun.kind),
+      eq36(runs.createdAt, thisRun.createdAt)
     )).all();
     const stillPending = groupSiblings.some((r) => r.status === "queued" || r.status === "running");
     if (stillPending) return [];
@@ -25642,17 +26422,17 @@ var Notifier = class {
       return candidate.id > best.id ? candidate : best;
     });
     if (winner.id !== runId) return [];
-    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq35(projects.id, projectId)).get();
+    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq36(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       parseJsonColumn(projectLocations?.locations ?? null, []).length
     );
     const RECENT_FETCH_LIMIT = Math.max(8, locationCount * 4);
     const recentRuns = this.db.select().from(runs).where(
-      and23(
-        eq35(runs.projectId, projectId),
-        eq35(runs.kind, thisRun.kind),
-        or4(eq35(runs.status, "completed"), eq35(runs.status, "partial"))
+      and26(
+        eq36(runs.projectId, projectId),
+        eq36(runs.kind, thisRun.kind),
+        or5(eq36(runs.status, "completed"), eq36(runs.status, "partial"))
       )
     ).orderBy(desc16(runs.createdAt), desc16(runs.id)).limit(RECENT_FETCH_LIMIT).all();
     const groups = groupRunsByCreatedAt(recentRuns);
@@ -25669,13 +26449,13 @@ var Notifier = class {
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(queries, eq35(querySnapshots.queryId, queries.id)).where(inArray10(querySnapshots.runId, currentRunIds)).all();
+    }).from(querySnapshots).leftJoin(queries, eq36(querySnapshots.queryId, queries.id)).where(inArray11(querySnapshots.runId, currentRunIds)).all();
     const previousSnapshots = this.db.select({
       queryId: querySnapshots.queryId,
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).where(inArray10(querySnapshots.runId, previousRunIds)).all();
+    }).from(querySnapshots).where(inArray11(querySnapshots.runId, previousRunIds)).all();
     const prevMap = /* @__PURE__ */ new Map();
     for (const s of previousSnapshots) {
       if (s.queryId == null) continue;
@@ -25749,7 +26529,7 @@ var Notifier = class {
 };
 
 // src/run-coordinator.ts
-import { eq as eq36 } from "drizzle-orm";
+import { eq as eq37 } from "drizzle-orm";
 var log11 = createLogger("RunCoordinator");
 var RunCoordinator = class {
   constructor(db, notifier, intelligenceService, onInsightsGenerated, onAeroEvent) {
@@ -25760,7 +26540,7 @@ var RunCoordinator = class {
     this.onAeroEvent = onAeroEvent;
   }
   async onRunCompleted(runId, projectId) {
-    const runRow = this.db.select().from(runs).where(eq36(runs.id, runId)).get();
+    const runRow = this.db.select().from(runs).where(eq37(runs.id, runId)).get();
     const kind = runRow?.kind ?? RunKinds["answer-visibility"];
     let insightCount = 0;
     let criticalOrHigh = 0;
@@ -25815,7 +26595,7 @@ var RunCoordinator = class {
    * so the Aero queue is never starved of a follow-up.
    */
   buildDiscoveryAeroContext(runId, projectId, status, error) {
-    const session = this.db.select().from(discoverySessions).where(eq36(discoverySessions.runId, runId)).get();
+    const session = this.db.select().from(discoverySessions).where(eq37(discoverySessions.runId, runId)).get();
     const competitorMap = session ? parseJsonColumn(session.competitorMap, []) : [];
     return {
       kind: RunKinds["aeo-discover-probe"],
@@ -25838,7 +26618,7 @@ var RunCoordinator = class {
 
 // src/agent/session-registry.ts
 import crypto33 from "crypto";
-import { eq as eq38 } from "drizzle-orm";
+import { eq as eq39 } from "drizzle-orm";
 
 // src/agent/session.ts
 import fs11 from "fs";
@@ -26188,7 +26968,7 @@ function resolveSessionProviderAndModel(config, opts) {
 
 // src/agent/memory-store.ts
 import crypto32 from "crypto";
-import { and as and24, desc as desc17, eq as eq37, like as like2, sql as sql13 } from "drizzle-orm";
+import { and as and27, desc as desc17, eq as eq38, like as like2, sql as sql13 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto2(row) {
@@ -26202,7 +26982,7 @@ function rowToDto2(row) {
   };
 }
 function listMemoryEntries(db, projectId, opts = {}) {
-  const query = db.select().from(agentMemory).where(eq37(agentMemory.projectId, projectId)).orderBy(desc17(agentMemory.updatedAt));
+  const query = db.select().from(agentMemory).where(eq38(agentMemory.projectId, projectId)).orderBy(desc17(agentMemory.updatedAt));
   const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
   return rows.map(rowToDto2);
 }
@@ -26233,12 +27013,12 @@ function upsertMemoryEntry(db, args) {
       updatedAt: now
     }
   }).run();
-  const row = db.select().from(agentMemory).where(and24(eq37(agentMemory.projectId, args.projectId), eq37(agentMemory.key, args.key))).get();
+  const row = db.select().from(agentMemory).where(and27(eq38(agentMemory.projectId, args.projectId), eq38(agentMemory.key, args.key))).get();
   if (!row) throw new Error("memory upsert produced no row");
   return rowToDto2(row);
 }
 function deleteMemoryEntry(db, projectId, key) {
-  const result = db.delete(agentMemory).where(and24(eq37(agentMemory.projectId, projectId), eq37(agentMemory.key, key))).run();
+  const result = db.delete(agentMemory).where(and27(eq38(agentMemory.projectId, projectId), eq38(agentMemory.key, key))).run();
   const changes = result.changes ?? 0;
   return changes > 0;
 }
@@ -26267,8 +27047,8 @@ function writeCompactionNote(db, args) {
     }).run();
     const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
     const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
-      and24(
-        eq37(agentMemory.projectId, args.projectId),
+      and27(
+        eq38(agentMemory.projectId, args.projectId),
         like2(agentMemory.key, `${sessionPrefix}%`)
       )
     ).orderBy(desc17(agentMemory.updatedAt)).all();
@@ -26276,7 +27056,7 @@ function writeCompactionNote(db, args) {
     if (stale.length > 0) {
       tx.delete(agentMemory).where(sql13`${agentMemory.id} IN (${sql13.join(stale.map((s) => sql13`${s}`), sql13`, `)})`).run();
     }
-    const row = tx.select().from(agentMemory).where(and24(eq37(agentMemory.projectId, args.projectId), eq37(agentMemory.key, key))).get();
+    const row = tx.select().from(agentMemory).where(and27(eq38(agentMemory.projectId, args.projectId), eq38(agentMemory.key, key))).get();
     if (row) inserted = rowToDto2(row);
   });
   if (!inserted) throw new Error("compaction note write produced no row");
@@ -26458,7 +27238,7 @@ var SessionRegistry = class {
           modelProvider: effectiveProvider,
           modelId: effectiveModelId,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(eq38(agentSessions.projectId, projectId)).run();
+        }).where(eq39(agentSessions.projectId, projectId)).run();
       }
       const agent2 = createAeroSession({
         projectName,
@@ -26672,7 +27452,7 @@ ${lines.join("\n")}
       modelProvider: nextProvider,
       modelId: nextModelId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq38(agentSessions.projectId, projectId)).run();
+    }).where(eq39(agentSessions.projectId, projectId)).run();
   }
   /** Persist a session's transcript back to the DB. Call after any run settles. */
   save(projectName) {
@@ -26834,11 +27614,11 @@ ${lines.join("\n")}
     return id;
   }
   tryResolveProjectId(projectName) {
-    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq38(projects.name, projectName)).get();
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq39(projects.name, projectName)).get();
     return row?.id;
   }
   loadRow(projectId) {
-    const row = this.opts.db.select().from(agentSessions).where(eq38(agentSessions.projectId, projectId)).get();
+    const row = this.opts.db.select().from(agentSessions).where(eq39(agentSessions.projectId, projectId)).get();
     return row ?? null;
   }
   insertRow(params) {
@@ -26857,14 +27637,14 @@ ${lines.join("\n")}
   }
   updateRow(projectId, patch) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq38(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq39(agentSessions.projectId, projectId)).run();
   }
 };
 
 // src/agent/agent-routes.ts
-import { eq as eq39 } from "drizzle-orm";
+import { eq as eq40 } from "drizzle-orm";
 function resolveProject2(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq39(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq40(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -26873,7 +27653,7 @@ function registerAgentRoutes(app, opts) {
     "/projects/:name/agent/transcript",
     async (request) => {
       const project = resolveProject2(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq39(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq40(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -26897,7 +27677,7 @@ function registerAgentRoutes(app, opts) {
     async (request) => {
       const project = resolveProject2(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq39(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq40(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -27015,7 +27795,7 @@ import { runAeoAudit } from "@ainyc/aeo-audit";
 
 // src/site-fetch.ts
 import https2 from "https";
-var FETCH_TIMEOUT_MS = 1e4;
+var FETCH_TIMEOUT_MS2 = 1e4;
 var MAX_TEXT_LENGTH = 4e3;
 var MAX_BODY_BYTES = 512e3;
 var USER_AGENT = "Canonry/1.0 (site-analysis)";
@@ -27040,7 +27820,7 @@ function fetchWithPinnedAddress(target) {
         port,
         path: path15,
         method: "GET",
-        timeout: FETCH_TIMEOUT_MS,
+        timeout: FETCH_TIMEOUT_MS2,
         servername: target.url.hostname,
         // SNI for TLS
         headers: {
@@ -27361,7 +28141,7 @@ var SnapshotService = class {
               provider: provider.adapter.name,
               displayName: provider.adapter.displayName,
               model: raw.model,
-              mentioned: determineAnswerMentioned(normalized.answerText, ctx.companyName, answerVisibilityDomains),
+              mentioned: determineAnswerMentioned(normalized.answerText, [ctx.companyName], answerVisibilityDomains),
               cited: citesTargetDomain(normalized.citedDomains, normalized.groundingSources, ctx.domain),
               describedAccurately: "unknown",
               accuracyNotes: null,
@@ -27728,8 +28508,8 @@ function clipText(value, length) {
 }
 
 // src/server.ts
-var _require2 = createRequire3(import.meta.url);
-var { version: PKG_VERSION } = _require2("../package.json");
+var _require3 = createRequire4(import.meta.url);
+var { version: PKG_VERSION2 } = _require3("../package.json");
 var log14 = createLogger("Server");
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
@@ -27920,7 +28700,7 @@ async function createServer(opts) {
     intelligenceService,
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq40(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq41(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -28121,7 +28901,7 @@ async function createServer(opts) {
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq40(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq41(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
@@ -28173,7 +28953,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq40(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq41(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -28230,12 +29010,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq40(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq41(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq40(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq41(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header("set-cookie", serializeSessionCookie({
         name: SESSION_COOKIE_NAME,
@@ -28289,6 +29069,12 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    // Local canonry serve runs on the operator's machine, where pointing a
+    // webhook at localhost (Discord test container, Pipedream-mock dev server,
+    // etc.) is a legitimate workflow. Default to allowing it for the local
+    // installer; cloud deployments inherit the secure default of `false` by
+    // not passing this option. Override with CANONRY_ALLOW_LOOPBACK_WEBHOOKS=0.
+    allowLoopbackWebhooks: process.env.CANONRY_ALLOW_LOOPBACK_WEBHOOKS !== "0",
     // Local-only Aero agent routes. Registered here so they inherit api-routes'
     // auth plugin — bare `registerAgentRoutes(app, ...)` would skip auth.
     registerAuthenticatedRoutes: async (scope) => {
@@ -28409,7 +29195,7 @@ async function createServer(opts) {
     discoverLatestRelease,
     openApiInfo: {
       title: "Canonry API",
-      version: PKG_VERSION,
+      version: PKG_VERSION2,
       includeCanonryLocal: true
     },
     providerSummary,
@@ -28556,6 +29342,19 @@ async function createServer(opts) {
     onProjectDeleted: (projectId) => {
       scheduler.removeAllForProject(projectId);
     },
+    onAliasesChanged: (projectId, projectName) => {
+      setImmediate(() => {
+        try {
+          const result = backfillProjectAnswerMentions(opts.db, projectId);
+          app.log.info(
+            { projectId, projectName, ...result },
+            "aliases changed \u2014 recomputed mention fields on historical snapshots"
+          );
+        } catch (err) {
+          app.log.error({ err, projectId, projectName }, "alias-triggered backfill failed");
+        }
+      });
+    },
     getTelemetryStatus: () => {
       const enabled = isTelemetryEnabled();
       return {
@@ -28689,16 +29488,21 @@ async function createServer(opts) {
       return reply.status(404).send({ error: "Not found" });
     });
   }
-  const healthHandler = async () => ({
-    status: "ok",
-    service: "canonry",
-    version: PKG_VERSION,
-    ...basePath ? { basePath: basePath.replace(/\/$/, "") } : {}
-  });
+  const healthHandler = () => {
+    const update = checkLatestVersionForServer();
+    return {
+      status: "ok",
+      service: "canonry",
+      version: PKG_VERSION2,
+      ...basePath ? { basePath: basePath.replace(/\/$/, "") } : {},
+      ...update ? { updateAvailable: update } : {}
+    };
+  };
   app.get("/health", healthHandler);
   if (basePath) {
     app.get(`${basePath}health`, healthHandler);
   }
+  checkLatestVersionForServer();
   scheduler.start();
   app.addHook("onClose", async () => {
     scheduler.stop();
@@ -28759,16 +29563,17 @@ export {
   showFirstRunNotice,
   detectAndTrackUpgrade,
   trackEvent,
-  reparseStoredResult2 as reparseStoredResult,
-  reparseStoredResult3 as reparseStoredResult2,
-  reparseStoredResult as reparseStoredResult3,
-  reparseStoredResult4,
-  determineCitationState,
-  computeCompetitorOverlap,
-  extractRecommendedCompetitors,
+  backfillAnswerVisibilityCommand,
+  backfillNormalizedPaths,
+  backfillNormalizedPathsCommand,
+  backfillAiReferralPaths,
+  backfillAiReferralPathsCommand,
+  backfillAnswerMentionsCommand,
+  backfillInsightsCommand,
   renderReportHtml,
   setGoogleAuthConfig,
   formatAuditFactorScore,
+  checkLatestVersionForCli,
   listAgentProviders,
   coerceAgentProvider,
   createServer