@ainyc/canonry 4.51.0 → 4.51.2

package/dist/{chunk-FDR3G6SB.js → chunk-WBO5S3IX.js}

@@ -2,10 +2,11 @@ import {
   ApiClient,
   canonryMcpTools,
   configExists,
+  getConfigPath,
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-GGXU5VKI.js";
+} from "./chunk-HMZKIOLG.js";
 import {
   DEFAULT_RUN_HISTORY_LIMIT,
   IntelligenceService,
@@ -82,7 +83,7 @@ import {
   smoothedRunDelta,
   trafficSources,
   usageCounters
-} from "./chunk-DLDLDWH4.js";
+} from "./chunk-QZ5XSM6C.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -247,6 +248,7 @@ import {
   runInProgress,
   runNotCancellable,
   runTriggerRequestSchema,
+  runtimeStateMissing,
   schedulableRunKindSchema,
   scheduleDtoSchema,
   scheduleUpsertRequestSchema,
@@ -282,7 +284,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-2ARCCG5E.js";
+} from "./chunk-FYGBW3SM.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -571,12 +573,15 @@ function checkLatestVersionForServer(opts) {
 // src/server.ts
 import { createRequire as createRequire4 } from "module";
 import crypto35 from "crypto";
-import fs13 from "fs";
+import fs15 from "fs";
 import path15 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { eq as eq42 } from "drizzle-orm";
 import Fastify from "fastify";
 
+// ../api-routes/src/index.ts
+import fs8 from "fs";
+
 // ../api-routes/src/auth.ts
 import crypto2 from "crypto";
 import { eq } from "drizzle-orm";
@@ -669,9 +674,22 @@ function writeAuditLog(db, entry) {
     entityType: entry.entityType,
     entityId: entry.entityId ?? null,
     diff: entry.diff != null ? JSON.stringify(entry.diff) : null,
+    userAgent: entry.userAgent ?? null,
+    actorSession: entry.actorSession ?? null,
     createdAt: now
   }).run();
 }
+function auditFromRequest(request, entry) {
+  const ua = request.headers["user-agent"];
+  const userAgent = Array.isArray(ua) ? ua.join(", ") : ua ?? null;
+  const sess = request.headers["x-canonry-actor-session"];
+  const actorSession = Array.isArray(sess) ? sess.join(", ") : sess ?? null;
+  return {
+    ...entry,
+    userAgent: entry.userAgent ?? userAgent,
+    actorSession: entry.actorSession ?? actorSession
+  };
+}
 function resolveSnapshotMentionResult(snapshot, project) {
   if (snapshot.answerText) {
     const domains = effectiveDomains({
@@ -1023,6 +1041,12 @@ function aliasArraysEqual(a, b) {
 // ../api-routes/src/queries.ts
 import crypto5 from "crypto";
 import { eq as eq4, inArray, sql as sql3 } from "drizzle-orm";
+function preserveSnapshotQueryText(tx, projectId, queryIds) {
+  const candidates = queryIds && queryIds.length > 0 ? tx.select({ id: queries.id, text: queries.query }).from(queries).where(inArray(queries.id, queryIds)).all() : tx.select({ id: queries.id, text: queries.query }).from(queries).where(eq4(queries.projectId, projectId)).all();
+  for (const q of candidates) {
+    tx.update(querySnapshots).set({ queryText: q.text }).where(eq4(querySnapshots.queryId, q.id)).run();
+  }
+}
 async function queryRoutes(app, opts) {
   app.get("/projects/:name/queries", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
@@ -1037,6 +1061,7 @@ async function queryRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     app.db.transaction((tx) => {
+      preserveSnapshotQueryText(tx, project.id);
       tx.delete(queries).where(eq4(queries.projectId, project.id)).run();
       for (const q of body.queries) {
         tx.insert(queries).values({
@@ -1047,13 +1072,13 @@ async function queryRoutes(app, opts) {
           createdAt: now
         }).run();
       }
-      writeAuditLog(tx, {
+      writeAuditLog(tx, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
         action: "queries.replaced",
         entityType: "query",
         diff: { queries: body.queries }
-      });
+      }));
     });
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
     return reply.send(rows.map((r) => ({ id: r.id, query: r.query, createdAt: r.createdAt })));
@@ -1099,16 +1124,17 @@ async function queryRoutes(app, opts) {
     const idsToDelete = existing.filter((q) => toDelete.has(q.query)).map((q) => q.id);
     if (idsToDelete.length > 0) {
       app.db.transaction((tx) => {
+        preserveSnapshotQueryText(tx, project.id, idsToDelete);
         for (const id of idsToDelete) {
           tx.delete(queries).where(eq4(queries.id, id)).run();
         }
-        writeAuditLog(tx, {
+        writeAuditLog(tx, auditFromRequest(request, {
           projectId: project.id,
           actor: "api",
           action: "queries.deleted",
           entityType: "query",
           diff: { deleted: body.queries.filter((q) => existing.some((e) => e.query === q)) }
-        });
+        }));
       });
     }
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
@@ -1138,13 +1164,13 @@ async function queryRoutes(app, opts) {
       }
     }
     if (added.length > 0) {
-      writeAuditLog(app.db, {
+      writeAuditLog(app.db, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
         action: "queries.appended",
         entityType: "query",
         diff: { added }
-      });
+      }));
     }
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
     return reply.send(rows.map((r) => ({ id: r.id, query: r.query, createdAt: r.createdAt })));
@@ -1202,6 +1228,7 @@ async function queryRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     app.db.transaction((tx) => {
+      preserveSnapshotQueryText(tx, project.id);
       tx.delete(queries).where(eq4(queries.projectId, project.id)).run();
       for (const keyword of body.keywords) {
         tx.insert(queries).values({
@@ -1212,13 +1239,13 @@ async function queryRoutes(app, opts) {
           createdAt: now
         }).run();
       }
-      writeAuditLog(tx, {
+      writeAuditLog(tx, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
         action: "queries.replaced",
         entityType: "query",
         diff: { queries: body.keywords }
-      });
+      }));
     });
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
     return reply.send(rows.map((r) => ({ id: r.id, keyword: r.query, createdAt: r.createdAt })));
@@ -1234,16 +1261,17 @@ async function queryRoutes(app, opts) {
     const idsToDelete = existing.filter((q) => toDelete.has(q.query)).map((q) => q.id);
     if (idsToDelete.length > 0) {
       app.db.transaction((tx) => {
+        preserveSnapshotQueryText(tx, project.id, idsToDelete);
         for (const id of idsToDelete) {
           tx.delete(queries).where(eq4(queries.id, id)).run();
         }
-        writeAuditLog(tx, {
+        writeAuditLog(tx, auditFromRequest(request, {
           projectId: project.id,
           actor: "api",
           action: "queries.deleted",
           entityType: "query",
           diff: { deleted: body.keywords.filter((keyword) => existing.some((e) => e.query === keyword)) }
-        });
+        }));
       });
     }
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
@@ -1273,13 +1301,13 @@ async function queryRoutes(app, opts) {
       }
     }
     if (added.length > 0) {
-      writeAuditLog(app.db, {
+      writeAuditLog(app.db, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
         action: "queries.appended",
         entityType: "query",
         diff: { added }
-      });
+      }));
     }
     const rows = app.db.select().from(queries).where(eq4(queries.projectId, project.id)).all();
     return reply.send(rows.map((r) => ({ id: r.id, keyword: r.query, createdAt: r.createdAt })));
@@ -1639,8 +1667,10 @@ async function runRoutes(app, opts) {
     const limit = parseListLimit(request.query.limit, 500, 5e3);
     const since = parseListSince(request.query.since);
     const includeProbe = request.query.includeProbe === "1" || request.query.includeProbe === "true";
+    const kind = parseListKind(request.query.kind);
     const filters = [gte(runs.createdAt, since)];
     if (!includeProbe) filters.push(notProbeRun());
+    if (kind) filters.push(eq7(runs.kind, kind));
     const rows = app.db.select().from(runs).where(and2(...filters)).orderBy(desc(runs.createdAt), desc(runs.id)).limit(limit).all();
     return reply.send(rows.map(formatRun));
   });
@@ -1749,6 +1779,14 @@ function parseListLimit(raw, defaultValue, max) {
   }
   return Math.min(parsed, max);
 }
+function parseListKind(raw) {
+  if (raw === void 0 || raw === "") return null;
+  const validKinds = Object.values(RunKinds);
+  if (!validKinds.includes(raw)) {
+    throw validationError(`"kind" must be one of: ${validKinds.join(", ")}`);
+  }
+  return raw;
+}
 function parseListSince(raw) {
   if (raw === void 0) {
     const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3);
@@ -2495,9 +2533,24 @@ async function historyRoutes(app) {
       ...snapshot,
       answerMentioned: resolveSnapshotAnswerMentioned(snapshot, project)
     }));
+    const queryByText = /* @__PURE__ */ new Map();
+    for (const q of projectQueries) queryByText.set(q.query, q);
+    function resolveSnapQueryId(snap) {
+      if (snap.queryId) return snap.queryId;
+      if (snap.queryText) {
+        const match = queryByText.get(snap.queryText);
+        if (match) return match.id;
+      }
+      return null;
+    }
+    const allSnapshotsResolved = allSnapshots.map((s) => ({
+      ...s,
+      resolvedQueryId: resolveSnapQueryId(s)
+    }));
     const deduped = /* @__PURE__ */ new Map();
-    for (const snap of allSnapshots) {
-      const key = `${snap.runId}:${snap.queryId}`;
+    for (const snap of allSnapshotsResolved) {
+      if (!snap.resolvedQueryId) continue;
+      const key = `${snap.runId}:${snap.resolvedQueryId}`;
       const existing = deduped.get(key);
       if (!existing || !existing.answerMentioned && snap.answerMentioned || existing.answerMentioned === snap.answerMentioned && snap.citationState === CitationStates.cited) {
         deduped.set(key, snap);
@@ -2505,15 +2558,17 @@ async function historyRoutes(app) {
     }
     const dedupedSnapshots = [...deduped.values()];
     const rawByQueryProvider = /* @__PURE__ */ new Map();
-    for (const snap of allSnapshots) {
-      const key = `${snap.queryId}::${snap.provider}`;
+    for (const snap of allSnapshotsResolved) {
+      if (!snap.resolvedQueryId) continue;
+      const key = `${snap.resolvedQueryId}::${snap.provider}`;
       const arr = rawByQueryProvider.get(key);
       if (arr) arr.push(snap);
       else rawByQueryProvider.set(key, [snap]);
     }
     const rawByQueryModel = /* @__PURE__ */ new Map();
-    for (const snap of allSnapshots) {
-      const key = `${snap.queryId}::${snap.provider}:${snap.model ?? "unknown"}`;
+    for (const snap of allSnapshotsResolved) {
+      if (!snap.resolvedQueryId) continue;
+      const key = `${snap.resolvedQueryId}::${snap.provider}:${snap.model ?? "unknown"}`;
       const arr = rawByQueryModel.get(key);
       if (arr) arr.push(snap);
       else rawByQueryModel.set(key, [snap]);
@@ -2560,7 +2615,7 @@ async function historyRoutes(app) {
       });
     }
     const timeline = projectQueries.map((q) => {
-      const qSnapshots = dedupedSnapshots.filter((s) => s.queryId === q.id).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+      const qSnapshots = dedupedSnapshots.filter((s) => s.resolvedQueryId === q.id).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
       const runEntries = computeTransitions(qSnapshots);
       const providerRuns = {};
       const providerKeys = [...rawByQueryProvider.keys()].filter((k) => k.startsWith(`${q.id}::`));
@@ -8387,6 +8442,39 @@ var scheduleKindQueryParameter = {
   description: 'Schedulable run kind. Defaults to "answer-visibility" for backward compatibility.',
   schema: { type: "string", enum: ["answer-visibility", "traffic-sync"] }
 };
+var runsListKindQueryParameter = {
+  name: "kind",
+  in: "query",
+  description: "Restrict results to a single run kind. Without this filter, integration syncs (bing-inspect, gsc-sync, ga-sync) can fill the default 500-row cap within minutes on busy projects and push answer-visibility runs out of the response.",
+  schema: {
+    type: "string",
+    enum: [
+      "answer-visibility",
+      "site-audit",
+      "gsc-sync",
+      "inspect-sitemap",
+      "ga-sync",
+      "bing-inspect",
+      "bing-inspect-sitemap",
+      "backlink-extract",
+      "traffic-sync",
+      "aeo-discover-seed",
+      "aeo-discover-probe"
+    ]
+  }
+};
+var runsListSinceQueryParameter = {
+  name: "since",
+  in: "query",
+  description: "Only return runs with created_at >= this ISO 8601 timestamp. Defaults to 30 days ago.",
+  schema: stringSchema
+};
+var runsListIncludeProbeQueryParameter = {
+  name: "includeProbe",
+  in: "query",
+  description: 'Set to "1" or "true" to include probe runs. Probes are excluded by default because they are operator/agent test runs and must not pollute dashboard aggregates.',
+  schema: stringSchema
+};
 var reportAudienceQueryParameter = {
   name: "audience",
   in: "query",
@@ -8970,6 +9058,12 @@ var routeCatalog = [
     path: "/api/v1/runs",
     summary: "List all runs",
     tags: ["runs"],
+    parameters: [
+      limitQueryParameter,
+      runsListSinceQueryParameter,
+      runsListIncludeProbeQueryParameter,
+      runsListKindQueryParameter
+    ],
     responses: {
       200: jsonArrayResponse("Runs returned.", "RunDto")
     }
@@ -12540,6 +12634,9 @@ var GA4_DEFAULT_SYNC_DAYS = 30;
 var GA4_MAX_SYNC_DAYS = 90;
 var GA4_REQUEST_TIMEOUT_MS = 3e4;
 var GA4_MAX_PAGES = 50;
+var GA4_MAX_CONCURRENT_REQUESTS = 4;
+var GA4_MAX_RETRIES = 3;
+var GA4_INITIAL_RETRY_DELAY_MS = 1e3;
 var GA4_DIMENSIONS = {
   date: "date",
   landingPagePlusQueryString: "landingPagePlusQueryString",
@@ -12560,10 +12657,14 @@ var GA4_METRICS = {
 // ../integration-google-analytics/src/types.ts
 var GA4ApiError = class extends Error {
   status;
-  constructor(message, status) {
+  /** Seconds the GA4 API asked us to wait before retrying. Populated from the
+   *  `Retry-After` response header on 429 and 5xx responses when present. */
+  retryAfterSeconds;
+  constructor(message, status, retryAfterSeconds) {
     super(message);
     this.name = "GA4ApiError";
     this.status = status;
+    if (retryAfterSeconds !== void 0) this.retryAfterSeconds = retryAfterSeconds;
   }
 };
 
@@ -12659,81 +12760,155 @@ async function getAccessToken(clientEmail, privateKey) {
 function escapeRegExp2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+var gaInFlight = 0;
+var gaWaitQueue = [];
+async function acquireGa4Slot() {
+  if (gaInFlight < GA4_MAX_CONCURRENT_REQUESTS) {
+    gaInFlight++;
+    return;
+  }
+  await new Promise((resolve) => gaWaitQueue.push(resolve));
+}
+function releaseGa4Slot() {
+  const next = gaWaitQueue.shift();
+  if (next) {
+    next();
+  } else {
+    gaInFlight--;
+  }
+}
+async function withGa4Limit(fn) {
+  await acquireGa4Slot();
+  try {
+    return await fn();
+  } finally {
+    releaseGa4Slot();
+  }
+}
+function parseRetryAfter(headerValue) {
+  if (!headerValue) return void 0;
+  const trimmed = headerValue.trim();
+  const asNum = Number(trimmed);
+  if (Number.isFinite(asNum) && asNum >= 0) return asNum;
+  const asDate = Date.parse(trimmed);
+  if (!Number.isNaN(asDate)) {
+    const seconds = Math.max(0, (asDate - Date.now()) / 1e3);
+    return seconds;
+  }
+  return void 0;
+}
+function isRetryableGa4Error(err) {
+  if (err instanceof GA4ApiError) {
+    return err.status === 429 || err.status >= 500;
+  }
+  return false;
+}
+async function withGa4Retry(fn, errLabel) {
+  let lastError;
+  for (let attempt = 0; attempt <= GA4_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastError = err;
+      if (attempt >= GA4_MAX_RETRIES || !isRetryableGa4Error(err)) throw err;
+      const ga4Err = err;
+      const computedDelayMs = GA4_INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt);
+      const delayMs = ga4Err.retryAfterSeconds !== void 0 ? Math.max(0, ga4Err.retryAfterSeconds * 1e3) : computedDelayMs;
+      ga4Log("info", `${errLabel}.retry`, {
+        attempt: attempt + 1,
+        maxAttempts: GA4_MAX_RETRIES + 1,
+        status: ga4Err.status,
+        delayMs,
+        usedRetryAfter: ga4Err.retryAfterSeconds !== void 0
+      });
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+  throw lastError;
+}
 async function runReport(accessToken, propertyId, request) {
   validatePropertyId(propertyId);
   const safePropertyId = encodeURIComponent(propertyId);
   const url = `${GA4_DATA_API_BASE}/properties/${safePropertyId}:runReport`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${accessToken}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(request),
-    signal: AbortSignal.timeout(GA4_REQUEST_TIMEOUT_MS)
-  });
-  if (res.status === 401 || res.status === 403) {
-    const body = await res.text().catch(() => "");
-    let detail = "";
-    try {
-      const parsed = JSON.parse(body);
-      if (parsed.error?.status === "SERVICE_DISABLED") {
-        detail = " The Google Analytics Data API is not enabled for this GCP project. Enable it at: https://console.developers.google.com/apis/api/analyticsdata.googleapis.com/overview";
-      } else if (parsed.error?.message) {
-        detail = ` ${parsed.error.message}`;
+  return withGa4Limit(() => withGa4Retry(async () => {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(request),
+      signal: AbortSignal.timeout(GA4_REQUEST_TIMEOUT_MS)
+    });
+    if (res.status === 401 || res.status === 403) {
+      const body = await res.text().catch(() => "");
+      let detail = "";
+      try {
+        const parsed = JSON.parse(body);
+        if (parsed.error?.status === "SERVICE_DISABLED") {
+          detail = " The Google Analytics Data API is not enabled for this GCP project. Enable it at: https://console.developers.google.com/apis/api/analyticsdata.googleapis.com/overview";
+        } else if (parsed.error?.message) {
+          detail = ` ${parsed.error.message}`;
+        }
+      } catch {
+        if (body.length < 200) detail = ` ${body}`;
       }
-    } catch {
-      if (body.length < 200) detail = ` ${body}`;
+      ga4Log("error", "report.auth-failed", { propertyId, httpStatus: res.status });
+      throw new GA4ApiError(
+        `GA4 API authentication failed \u2014 check service account permissions.${detail}`,
+        res.status
+      );
     }
-    ga4Log("error", "report.auth-failed", { propertyId, httpStatus: res.status });
-    throw new GA4ApiError(
-      `GA4 API authentication failed \u2014 check service account permissions.${detail}`,
-      res.status
-    );
-  }
-  if (res.status === 429) {
-    ga4Log("error", "report.rate-limited", { propertyId });
-    throw new GA4ApiError("GA4 API rate limit exceeded", 429);
-  }
-  if (!res.ok) {
-    const body = await res.text();
-    ga4Log("error", "report.error", { propertyId, httpStatus: res.status });
-    const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-    throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status);
-  }
-  return await res.json();
+    if (res.status === 429) {
+      const retryAfterSeconds = parseRetryAfter(res.headers.get("retry-after"));
+      ga4Log("error", "report.rate-limited", { propertyId, retryAfterSeconds });
+      throw new GA4ApiError("GA4 API rate limit exceeded", 429, retryAfterSeconds);
+    }
+    if (!res.ok) {
+      const body = await res.text();
+      const retryAfterSeconds = res.status >= 500 ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
+      ga4Log("error", "report.error", { propertyId, httpStatus: res.status, retryAfterSeconds });
+      const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
+      throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status, retryAfterSeconds);
+    }
+    return await res.json();
+  }, "report"));
 }
 async function batchRunReports(accessToken, propertyId, requests) {
   const url = `${GA4_DATA_API_BASE}/properties/${propertyId}:batchRunReports`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${accessToken}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({ requests }),
-    signal: AbortSignal.timeout(GA4_REQUEST_TIMEOUT_MS)
-  });
-  if (res.status === 401 || res.status === 403) {
-    const body = await res.text().catch(() => "");
-    ga4Log("error", "batch-report.auth-failed", { propertyId, httpStatus: res.status });
-    throw new GA4ApiError(
-      `GA4 API authentication failed \u2014 check service account permissions. ${body}`,
-      res.status
-    );
-  }
-  if (res.status === 429) {
-    ga4Log("error", "batch-report.rate-limited", { propertyId });
-    throw new GA4ApiError("GA4 API rate limit exceeded", 429);
-  }
-  if (!res.ok) {
-    const body = await res.text();
-    ga4Log("error", "batch-report.error", { propertyId, httpStatus: res.status });
-    const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-    throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status);
-  }
-  const data = await res.json();
-  return data.reports;
+  return withGa4Limit(() => withGa4Retry(async () => {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ requests }),
+      signal: AbortSignal.timeout(GA4_REQUEST_TIMEOUT_MS)
+    });
+    if (res.status === 401 || res.status === 403) {
+      const body = await res.text().catch(() => "");
+      ga4Log("error", "batch-report.auth-failed", { propertyId, httpStatus: res.status });
+      throw new GA4ApiError(
+        `GA4 API authentication failed \u2014 check service account permissions. ${body}`,
+        res.status
+      );
+    }
+    if (res.status === 429) {
+      const retryAfterSeconds = parseRetryAfter(res.headers.get("retry-after"));
+      ga4Log("error", "batch-report.rate-limited", { propertyId, retryAfterSeconds });
+      throw new GA4ApiError("GA4 API rate limit exceeded", 429, retryAfterSeconds);
+    }
+    if (!res.ok) {
+      const body = await res.text();
+      const retryAfterSeconds = res.status >= 500 ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
+      ga4Log("error", "batch-report.error", { propertyId, httpStatus: res.status, retryAfterSeconds });
+      const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
+      throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status, retryAfterSeconds);
+    }
+    const data = await res.json();
+    return data.reports;
+  }, "batch-report"));
 }
 function formatDate2(d) {
   return d.toISOString().slice(0, 10);
@@ -17423,7 +17598,7 @@ async function queryBacklinks(opts) {
   const reversed = opts.targets.map(reverseDomain);
   const targetList = reversed.map(quote).join(", ");
   const limitClause = opts.limitPerTarget ? `QUALIFY row_number() OVER (PARTITION BY t.target_rev_domain ORDER BY v.num_hosts DESC) <= ${Math.floor(opts.limitPerTarget)}` : "";
-  const sql16 = `
+  const sql17 = `
     WITH vertices AS (
       SELECT * FROM read_csv(
         ${quote(opts.vertexPath)},
@@ -17459,7 +17634,7 @@ async function queryBacklinks(opts) {
   const conn = await instance.connect();
   let rows;
   try {
-    const reader = await conn.runAndReadAll(sql16);
+    const reader = await conn.runAndReadAll(sql17);
     rows = reader.getRowObjects();
   } finally {
     conn.disconnectSync?.();
@@ -18131,130 +18306,2384 @@ async function listCloudRunTrafficEvents(accessToken, options) {
   };
 }
 
-// ../integration-traffic/src/rules.ts
-var LEGACY_CHATGPT_DOMAIN = "chat.openai.com";
-var DEFAULT_AI_CRAWLER_RULES = [
-  {
-    id: "openai-gptbot",
-    operator: "OpenAI",
-    product: "GPTBot",
-    purpose: "training",
-    userAgentPatterns: [/GPTBot\//i]
-  },
-  {
-    id: "openai-searchbot",
-    operator: "OpenAI",
-    product: "OAI-SearchBot",
-    purpose: "search",
-    userAgentPatterns: [/OAI-SearchBot\//i]
-  },
-  {
-    id: "openai-chatgpt-user",
-    operator: "OpenAI",
-    product: "ChatGPT-User",
-    purpose: "user-agent",
-    userAgentPatterns: [/ChatGPT-User\//i]
-  },
-  {
-    id: "anthropic-claudebot",
-    operator: "Anthropic",
-    product: "ClaudeBot",
-    purpose: "training",
-    userAgentPatterns: [/ClaudeBot\//i, /Claude-Web\//i, /anthropic-ai/i]
-  },
-  {
-    id: "perplexity-bot",
-    operator: "Perplexity",
-    product: "PerplexityBot",
-    purpose: "search",
-    userAgentPatterns: [/PerplexityBot\//i]
-  },
-  {
-    id: "google-extended",
-    operator: "Google",
-    product: "Google-Extended",
-    purpose: "training-control",
-    userAgentPatterns: [/Google-Extended/i]
-  },
-  {
-    id: "bytespider",
-    operator: "ByteDance",
-    product: "Bytespider",
-    purpose: "training",
-    userAgentPatterns: [/Bytespider/i]
-  },
-  {
-    id: "applebot-extended",
-    operator: "Apple",
-    product: "Applebot-Extended",
-    purpose: "training",
-    userAgentPatterns: [/Applebot-Extended/i]
-  },
-  {
-    id: "meta-externalagent",
-    operator: "Meta",
-    product: "meta-externalagent",
-    purpose: "training",
-    userAgentPatterns: [/meta-externalagent/i]
-  },
-  {
-    id: "ccbot",
-    operator: "Common Crawl",
-    product: "CCBot",
-    purpose: "crawl",
-    userAgentPatterns: [/CCBot\//i]
-  },
-  {
-    id: "cohere-ai",
-    operator: "Cohere",
-    product: "cohere-ai",
-    purpose: "training",
-    userAgentPatterns: [/cohere-ai/i]
-  },
-  {
-    id: "diffbot",
-    operator: "Diffbot",
-    product: "Diffbot",
-    purpose: "crawl",
-    userAgentPatterns: [/Diffbot/i]
-  },
-  {
-    id: "mistral-ai",
-    operator: "Mistral AI",
-    product: "MistralAI-User",
-    purpose: "crawl",
-    userAgentPatterns: [/MistralAI/i]
-  }
-];
-var DEFAULT_AI_REFERRER_RULES = [
-  { domain: AI_ENGINE_DOMAINS.chatgpt, operator: "OpenAI", product: "ChatGPT" },
-  { domain: LEGACY_CHATGPT_DOMAIN, operator: "OpenAI", product: "ChatGPT" },
-  { domain: AI_ENGINE_DOMAINS.perplexity, operator: "Perplexity", product: "Perplexity" },
-  { domain: AI_ENGINE_DOMAINS.claude, operator: "Anthropic", product: "Claude" },
-  { domain: AI_ENGINE_DOMAINS.gemini, operator: "Google", product: "Gemini" },
-  { domain: AI_ENGINE_DOMAINS.copilotMicrosoft, operator: "Microsoft", product: "Copilot" },
-  { domain: AI_ENGINE_DOMAINS.phind, operator: "Phind", product: "Phind" },
-  { domain: AI_ENGINE_DOMAINS.you, operator: "You.com", product: "You.com" },
-  { domain: AI_ENGINE_DOMAINS.metaAi, operator: "Meta", product: "Meta AI" }
-];
+// ../integration-traffic/src/ip-ranges/anthropic.json
+var anthropic_default = {
+  _source: "ARIN RDAP \u2014 every network registered to Anthropic, PBC (handle AP-2440)",
+  _query: "https://rdap.arin.net/registry/entity/AP-2440",
+  _notes: "Anthropic does not publish a clean machine-readable IP-range JSON like Google or OpenAI do. These prefixes are taken straight from ARIN's authoritative allocation records (NOT bgp.tools' AS-based view, which can include misleading announcements \u2014 e.g. AS60808 is registered to Anthropic but announces 209.249.57.0/24 which actually belongs to Mitel Networks). 216.73.216.0/22 (AWS-ANTHROPIC) is the load-bearing prefix \u2014 empirical Cloud Run logs show 100% of real ClaudeBot traffic comes from there; the other two are Anthropic's own allocations for non-crawler infra (kept since the verification gate still requires a Claude-* UA match). Refresh by re-running the ARIN RDAP query above and replacing the prefix list.",
+  prefixes: [
+    { ipv4Prefix: "216.73.216.0/22" },
+    { ipv4Prefix: "160.79.104.0/21" },
+    { ipv6Prefix: "2607:6bc0::/32" }
+  ]
+};
 
-// ../integration-traffic/src/classifier.ts
-function normalizeHost(host) {
-  return host.trim().toLowerCase().replace(/^www\./, "");
-}
-function hostMatches(host, domain) {
-  const normalizedHost = normalizeHost(host);
-  const normalizedDomain = normalizeHost(domain);
-  return normalizedHost === normalizedDomain || normalizedHost.endsWith(`.${normalizedDomain}`);
-}
-function utmTokenMatchesDomain(utmSource, domain) {
-  if (hostMatches(utmSource, domain)) return true;
-  const normalizedUtm = normalizeHost(utmSource);
-  const firstLabel = normalizeHost(domain).split(".")[0];
-  return Boolean(firstLabel) && normalizedUtm === firstLabel;
-}
-function hostFromUrl(value) {
-  if (!value) return null;
+// ../integration-traffic/src/ip-ranges/bingbot.json
+var bingbot_default = {
+  _source: "https://www.bing.com/toolbox/bingbot.json",
+  creationTime: "2024-01-03T10:00:00.121331",
+  prefixes: [
+    {
+      ipv4Prefix: "157.55.39.0/24"
+    },
+    {
+      ipv4Prefix: "207.46.13.0/24"
+    },
+    {
+      ipv4Prefix: "40.77.167.0/24"
+    },
+    {
+      ipv4Prefix: "13.66.139.0/24"
+    },
+    {
+      ipv4Prefix: "13.66.144.0/24"
+    },
+    {
+      ipv4Prefix: "52.167.144.0/24"
+    },
+    {
+      ipv4Prefix: "13.67.10.16/28"
+    },
+    {
+      ipv4Prefix: "13.69.66.240/28"
+    },
+    {
+      ipv4Prefix: "13.71.172.224/28"
+    },
+    {
+      ipv4Prefix: "139.217.52.0/28"
+    },
+    {
+      ipv4Prefix: "191.233.204.224/28"
+    },
+    {
+      ipv4Prefix: "20.36.108.32/28"
+    },
+    {
+      ipv4Prefix: "20.43.120.16/28"
+    },
+    {
+      ipv4Prefix: "40.79.131.208/28"
+    },
+    {
+      ipv4Prefix: "40.79.186.176/28"
+    },
+    {
+      ipv4Prefix: "52.231.148.0/28"
+    },
+    {
+      ipv4Prefix: "20.79.107.240/28"
+    },
+    {
+      ipv4Prefix: "51.105.67.0/28"
+    },
+    {
+      ipv4Prefix: "20.125.163.80/28"
+    },
+    {
+      ipv4Prefix: "40.77.188.0/22"
+    },
+    {
+      ipv4Prefix: "65.55.210.0/24"
+    },
+    {
+      ipv4Prefix: "199.30.24.0/23"
+    },
+    {
+      ipv4Prefix: "40.77.202.0/24"
+    },
+    {
+      ipv4Prefix: "40.77.139.0/25"
+    },
+    {
+      ipv4Prefix: "20.74.197.0/28"
+    },
+    {
+      ipv4Prefix: "20.15.133.160/27"
+    },
+    {
+      ipv4Prefix: "40.77.177.0/24"
+    },
+    {
+      ipv4Prefix: "40.77.178.0/23"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/chatgpt-user.json
+var chatgpt_user_default = {
+  _source: "https://openai.com/chatgpt-user.json",
+  creationTime: "2026-05-17T23:03:25.747192",
+  prefixes: [
+    {
+      ipv4Prefix: "104.210.139.192/28"
+    },
+    {
+      ipv4Prefix: "104.210.139.224/28"
+    },
+    {
+      ipv4Prefix: "13.65.138.112/28"
+    },
+    {
+      ipv4Prefix: "13.65.138.96/28"
+    },
+    {
+      ipv4Prefix: "13.67.72.16/28"
+    },
+    {
+      ipv4Prefix: "13.70.107.160/28"
+    },
+    {
+      ipv4Prefix: "13.71.2.208/28"
+    },
+    {
+      ipv4Prefix: "13.76.115.224/28"
+    },
+    {
+      ipv4Prefix: "13.76.115.240/28"
+    },
+    {
+      ipv4Prefix: "13.76.116.80/28"
+    },
+    {
+      ipv4Prefix: "13.76.32.208/28"
+    },
+    {
+      ipv4Prefix: "13.83.167.128/28"
+    },
+    {
+      ipv4Prefix: "13.83.237.176/28"
+    },
+    {
+      ipv4Prefix: "132.196.82.48/28"
+    },
+    {
+      ipv4Prefix: "135.119.134.128/28"
+    },
+    {
+      ipv4Prefix: "135.119.134.192/28"
+    },
+    {
+      ipv4Prefix: "135.220.73.208/28"
+    },
+    {
+      ipv4Prefix: "135.220.73.240/28"
+    },
+    {
+      ipv4Prefix: "135.237.131.208/28"
+    },
+    {
+      ipv4Prefix: "135.237.133.48/28"
+    },
+    {
+      ipv4Prefix: "137.135.191.176/28"
+    },
+    {
+      ipv4Prefix: "138.91.30.48/28"
+    },
+    {
+      ipv4Prefix: "138.91.46.96/28"
+    },
+    {
+      ipv4Prefix: "168.63.252.240/28"
+    },
+    {
+      ipv4Prefix: "172.170.8.208/28"
+    },
+    {
+      ipv4Prefix: "172.171.4.176/28"
+    },
+    {
+      ipv4Prefix: "172.178.140.144/28"
+    },
+    {
+      ipv4Prefix: "172.178.141.112/28"
+    },
+    {
+      ipv4Prefix: "172.178.141.128/28"
+    },
+    {
+      ipv4Prefix: "172.183.143.224/28"
+    },
+    {
+      ipv4Prefix: "172.183.222.128/28"
+    },
+    {
+      ipv4Prefix: "172.196.40.208/28"
+    },
+    {
+      ipv4Prefix: "172.202.102.112/28"
+    },
+    {
+      ipv4Prefix: "172.204.16.64/28"
+    },
+    {
+      ipv4Prefix: "172.204.27.16/28"
+    },
+    {
+      ipv4Prefix: "172.212.159.64/28"
+    },
+    {
+      ipv4Prefix: "172.212.172.160/28"
+    },
+    {
+      ipv4Prefix: "172.213.11.144/28"
+    },
+    {
+      ipv4Prefix: "172.213.12.112/28"
+    },
+    {
+      ipv4Prefix: "172.213.21.112/28"
+    },
+    {
+      ipv4Prefix: "172.213.21.144/28"
+    },
+    {
+      ipv4Prefix: "172.213.21.16/28"
+    },
+    {
+      ipv4Prefix: "172.215.218.96/28"
+    },
+    {
+      ipv4Prefix: "191.233.1.112/28"
+    },
+    {
+      ipv4Prefix: "191.233.1.128/28"
+    },
+    {
+      ipv4Prefix: "191.233.1.224/28"
+    },
+    {
+      ipv4Prefix: "191.233.194.32/28"
+    },
+    {
+      ipv4Prefix: "191.233.196.112/28"
+    },
+    {
+      ipv4Prefix: "191.233.199.160/28"
+    },
+    {
+      ipv4Prefix: "191.233.2.0/28"
+    },
+    {
+      ipv4Prefix: "191.234.167.128/28"
+    },
+    {
+      ipv4Prefix: "191.235.66.16/28"
+    },
+    {
+      ipv4Prefix: "191.235.98.144/28"
+    },
+    {
+      ipv4Prefix: "191.235.99.80/28"
+    },
+    {
+      ipv4Prefix: "191.237.249.64/28"
+    },
+    {
+      ipv4Prefix: "191.239.245.16/28"
+    },
+    {
+      ipv4Prefix: "20.0.53.96/28"
+    },
+    {
+      ipv4Prefix: "20.102.212.144/28"
+    },
+    {
+      ipv4Prefix: "20.113.218.16/28"
+    },
+    {
+      ipv4Prefix: "20.113.225.112/28"
+    },
+    {
+      ipv4Prefix: "20.125.112.224/28"
+    },
+    {
+      ipv4Prefix: "20.125.144.144/28"
+    },
+    {
+      ipv4Prefix: "20.161.75.208/28"
+    },
+    {
+      ipv4Prefix: "20.168.7.192/28"
+    },
+    {
+      ipv4Prefix: "20.168.7.240/28"
+    },
+    {
+      ipv4Prefix: "20.169.72.112/28"
+    },
+    {
+      ipv4Prefix: "20.169.72.96/28"
+    },
+    {
+      ipv4Prefix: "20.169.73.176/28"
+    },
+    {
+      ipv4Prefix: "20.169.73.32/28"
+    },
+    {
+      ipv4Prefix: "20.169.73.64/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.112/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.128/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.144/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.160/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.176/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.192/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.208/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.48/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.64/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.80/28"
+    },
+    {
+      ipv4Prefix: "20.169.78.96/28"
+    },
+    {
+      ipv4Prefix: "20.169.86.224/28"
+    },
+    {
+      ipv4Prefix: "20.169.86.240/28"
+    },
+    {
+      ipv4Prefix: "20.169.87.112/28"
+    },
+    {
+      ipv4Prefix: "20.17.108.96/28"
+    },
+    {
+      ipv4Prefix: "20.172.29.32/28"
+    },
+    {
+      ipv4Prefix: "20.193.233.240/28"
+    },
+    {
+      ipv4Prefix: "20.193.50.32/28"
+    },
+    {
+      ipv4Prefix: "20.194.0.208/28"
+    },
+    {
+      ipv4Prefix: "20.194.1.0/28"
+    },
+    {
+      ipv4Prefix: "20.194.157.176/28"
+    },
+    {
+      ipv4Prefix: "20.198.67.96/28"
+    },
+    {
+      ipv4Prefix: "20.199.211.160/28"
+    },
+    {
+      ipv4Prefix: "20.203.245.32/28"
+    },
+    {
+      ipv4Prefix: "20.204.24.240/28"
+    },
+    {
+      ipv4Prefix: "20.206.107.192/28"
+    },
+    {
+      ipv4Prefix: "20.210.154.128/28"
+    },
+    {
+      ipv4Prefix: "20.210.174.208/28"
+    },
+    {
+      ipv4Prefix: "20.210.211.192/28"
+    },
+    {
+      ipv4Prefix: "20.215.187.208/28"
+    },
+    {
+      ipv4Prefix: "20.215.188.192/28"
+    },
+    {
+      ipv4Prefix: "20.215.214.16/28"
+    },
+    {
+      ipv4Prefix: "20.215.219.128/28"
+    },
+    {
+      ipv4Prefix: "20.215.219.160/28"
+    },
+    {
+      ipv4Prefix: "20.215.219.208/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.112/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.128/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.144/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.160/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.176/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.192/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.208/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.64/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.80/28"
+    },
+    {
+      ipv4Prefix: "20.215.220.96/28"
+    },
+    {
+      ipv4Prefix: "20.226.32.80/28"
+    },
+    {
+      ipv4Prefix: "20.227.140.32/28"
+    },
+    {
+      ipv4Prefix: "20.228.106.176/28"
+    },
+    {
+      ipv4Prefix: "20.235.75.208/28"
+    },
+    {
+      ipv4Prefix: "20.235.87.224/28"
+    },
+    {
+      ipv4Prefix: "20.249.63.208/28"
+    },
+    {
+      ipv4Prefix: "20.27.94.128/28"
+    },
+    {
+      ipv4Prefix: "20.42.250.32/28"
+    },
+    {
+      ipv4Prefix: "20.45.178.144/28"
+    },
+    {
+      ipv4Prefix: "20.55.229.144/28"
+    },
+    {
+      ipv4Prefix: "20.57.199.192/28"
+    },
+    {
+      ipv4Prefix: "20.63.221.64/28"
+    },
+    {
+      ipv4Prefix: "20.97.189.96/28"
+    },
+    {
+      ipv4Prefix: "23.102.140.144/28"
+    },
+    {
+      ipv4Prefix: "23.102.141.32/28"
+    },
+    {
+      ipv4Prefix: "23.97.109.224/28"
+    },
+    {
+      ipv4Prefix: "23.98.142.176/28"
+    },
+    {
+      ipv4Prefix: "23.98.179.16/28"
+    },
+    {
+      ipv4Prefix: "23.98.186.176/28"
+    },
+    {
+      ipv4Prefix: "23.98.186.192/28"
+    },
+    {
+      ipv4Prefix: "23.98.186.64/28"
+    },
+    {
+      ipv4Prefix: "23.98.186.96/28"
+    },
+    {
+      ipv4Prefix: "4.151.119.48/28"
+    },
+    {
+      ipv4Prefix: "4.151.241.240/28"
+    },
+    {
+      ipv4Prefix: "4.151.71.176/28"
+    },
+    {
+      ipv4Prefix: "4.189.118.208/28"
+    },
+    {
+      ipv4Prefix: "4.189.119.48/28"
+    },
+    {
+      ipv4Prefix: "4.196.118.112/28"
+    },
+    {
+      ipv4Prefix: "4.196.198.80/28"
+    },
+    {
+      ipv4Prefix: "4.197.115.112/28"
+    },
+    {
+      ipv4Prefix: "4.197.19.176/28"
+    },
+    {
+      ipv4Prefix: "4.197.22.112/28"
+    },
+    {
+      ipv4Prefix: "4.197.64.0/28"
+    },
+    {
+      ipv4Prefix: "4.197.64.16/28"
+    },
+    {
+      ipv4Prefix: "4.197.64.48/28"
+    },
+    {
+      ipv4Prefix: "4.197.64.64/28"
+    },
+    {
+      ipv4Prefix: "4.198.72.16/28"
+    },
+    {
+      ipv4Prefix: "4.205.128.176/28"
+    },
+    {
+      ipv4Prefix: "4.226.226.32/28"
+    },
+    {
+      ipv4Prefix: "40.116.73.208/28"
+    },
+    {
+      ipv4Prefix: "40.122.235.112/28"
+    },
+    {
+      ipv4Prefix: "40.67.183.160/28"
+    },
+    {
+      ipv4Prefix: "40.67.183.176/28"
+    },
+    {
+      ipv4Prefix: "40.75.14.224/28"
+    },
+    {
+      ipv4Prefix: "40.81.134.128/28"
+    },
+    {
+      ipv4Prefix: "40.81.134.144/28"
+    },
+    {
+      ipv4Prefix: "40.81.234.144/28"
+    },
+    {
+      ipv4Prefix: "40.84.181.32/28"
+    },
+    {
+      ipv4Prefix: "40.84.221.208/28"
+    },
+    {
+      ipv4Prefix: "40.84.221.224/28"
+    },
+    {
+      ipv4Prefix: "48.193.44.32/28"
+    },
+    {
+      ipv4Prefix: "51.107.70.192/28"
+    },
+    {
+      ipv4Prefix: "51.116.2.64/28"
+    },
+    {
+      ipv4Prefix: "51.116.2.80/28"
+    },
+    {
+      ipv4Prefix: "51.8.155.48/28"
+    },
+    {
+      ipv4Prefix: "51.8.155.64/28"
+    },
+    {
+      ipv4Prefix: "51.8.155.80/28"
+    },
+    {
+      ipv4Prefix: "52.148.129.32/28"
+    },
+    {
+      ipv4Prefix: "52.153.130.48/28"
+    },
+    {
+      ipv4Prefix: "52.153.130.64/28"
+    },
+    {
+      ipv4Prefix: "52.154.22.48/28"
+    },
+    {
+      ipv4Prefix: "52.156.77.144/28"
+    },
+    {
+      ipv4Prefix: "52.159.227.32/28"
+    },
+    {
+      ipv4Prefix: "52.159.249.96/28"
+    },
+    {
+      ipv4Prefix: "52.165.212.16/28"
+    },
+    {
+      ipv4Prefix: "52.165.212.32/28"
+    },
+    {
+      ipv4Prefix: "52.165.212.48/28"
+    },
+    {
+      ipv4Prefix: "52.172.129.160/28"
+    },
+    {
+      ipv4Prefix: "52.172.251.112/28"
+    },
+    {
+      ipv4Prefix: "52.173.123.0/28"
+    },
+    {
+      ipv4Prefix: "52.173.219.112/28"
+    },
+    {
+      ipv4Prefix: "52.173.219.96/28"
+    },
+    {
+      ipv4Prefix: "52.173.221.16/28"
+    },
+    {
+      ipv4Prefix: "52.173.221.176/28"
+    },
+    {
+      ipv4Prefix: "52.173.221.208/28"
+    },
+    {
+      ipv4Prefix: "52.173.234.16/28"
+    },
+    {
+      ipv4Prefix: "52.173.234.80/28"
+    },
+    {
+      ipv4Prefix: "52.173.235.80/28"
+    },
+    {
+      ipv4Prefix: "52.176.139.176/28"
+    },
+    {
+      ipv4Prefix: "52.187.246.128/28"
+    },
+    {
+      ipv4Prefix: "52.190.137.144/28"
+    },
+    {
+      ipv4Prefix: "52.190.137.16/28"
+    },
+    {
+      ipv4Prefix: "52.190.139.48/28"
+    },
+    {
+      ipv4Prefix: "52.190.142.64/28"
+    },
+    {
+      ipv4Prefix: "52.190.190.16/28"
+    },
+    {
+      ipv4Prefix: "52.225.75.208/28"
+    },
+    {
+      ipv4Prefix: "52.230.163.32/28"
+    },
+    {
+      ipv4Prefix: "52.230.164.176/28"
+    },
+    {
+      ipv4Prefix: "52.231.30.48/28"
+    },
+    {
+      ipv4Prefix: "52.231.34.176/28"
+    },
+    {
+      ipv4Prefix: "52.231.39.144/28"
+    },
+    {
+      ipv4Prefix: "52.231.39.192/28"
+    },
+    {
+      ipv4Prefix: "52.231.49.48/28"
+    },
+    {
+      ipv4Prefix: "52.231.50.64/28"
+    },
+    {
+      ipv4Prefix: "52.236.94.144/28"
+    },
+    {
+      ipv4Prefix: "52.241.146.208/28"
+    },
+    {
+      ipv4Prefix: "52.242.132.224/28"
+    },
+    {
+      ipv4Prefix: "52.242.132.240/28"
+    },
+    {
+      ipv4Prefix: "52.242.245.208/28"
+    },
+    {
+      ipv4Prefix: "52.252.113.240/28"
+    },
+    {
+      ipv4Prefix: "52.255.109.112/28"
+    },
+    {
+      ipv4Prefix: "52.255.109.128/28"
+    },
+    {
+      ipv4Prefix: "52.255.109.144/28"
+    },
+    {
+      ipv4Prefix: "52.255.109.80/28"
+    },
+    {
+      ipv4Prefix: "52.255.109.96/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.0/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.112/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.16/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.32/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.48/28"
+    },
+    {
+      ipv4Prefix: "52.255.111.80/28"
+    },
+    {
+      ipv4Prefix: "57.151.131.224/28"
+    },
+    {
+      ipv4Prefix: "57.154.174.112/28"
+    },
+    {
+      ipv4Prefix: "57.154.175.0/28"
+    },
+    {
+      ipv4Prefix: "57.154.187.32/28"
+    },
+    {
+      ipv4Prefix: "68.154.28.96/28"
+    },
+    {
+      ipv4Prefix: "68.218.30.112/28"
+    },
+    {
+      ipv4Prefix: "68.220.57.64/28"
+    },
+    {
+      ipv4Prefix: "68.221.67.160/28"
+    },
+    {
+      ipv4Prefix: "68.221.67.192/28"
+    },
+    {
+      ipv4Prefix: "68.221.67.224/28"
+    },
+    {
+      ipv4Prefix: "68.221.67.240/28"
+    },
+    {
+      ipv4Prefix: "68.221.75.16/28"
+    },
+    {
+      ipv4Prefix: "70.153.76.16/28"
+    },
+    {
+      ipv4Prefix: "74.226.253.160/28"
+    },
+    {
+      ipv4Prefix: "74.249.86.176/28"
+    },
+    {
+      ipv4Prefix: "74.7.35.112/28"
+    },
+    {
+      ipv4Prefix: "74.7.35.48/28"
+    },
+    {
+      ipv4Prefix: "74.7.36.64/28"
+    },
+    {
+      ipv4Prefix: "74.7.36.80/28"
+    },
+    {
+      ipv4Prefix: "74.7.36.96/28"
+    },
+    {
+      ipv4Prefix: "85.211.241.128/28"
+    },
+    {
+      ipv4Prefix: "9.160.163.224/28"
+    },
+    {
+      ipv4Prefix: "9.160.164.128/28"
+    },
+    {
+      ipv4Prefix: "9.234.96.192/28"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/googlebot.json
+var googlebot_default = {
+  _source: "https://developers.google.com/static/search/apis/ipranges/googlebot.json",
+  creationTime: "2026-05-18T14:46:14.000000",
+  prefixes: [
+    {
+      ipv6Prefix: "2001:4860:4801:10::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:11::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:12::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:13::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:14::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:15::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:16::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:17::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:18::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:19::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1e::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:1f::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:20::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:21::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:22::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:23::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:24::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:25::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:26::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:27::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:28::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:29::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2e::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:2f::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:30::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:31::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:32::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:33::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:34::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:35::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:36::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:37::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:38::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:39::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3e::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:3f::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:40::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:41::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:42::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:44::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:45::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:46::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:47::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:48::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:49::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:4a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:4b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:4c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:4d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:4e::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:50::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:51::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:52::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:53::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:54::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:55::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:56::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:57::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:58::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:59::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:60::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:61::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:62::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:63::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:64::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:65::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:66::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:67::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:68::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:69::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6e::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:6f::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:70::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:71::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:72::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:73::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:74::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:75::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:76::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:77::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:78::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:79::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:7a::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:7b::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:7c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:7d::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:80::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:81::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:82::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:83::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:84::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:85::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:86::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:87::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:88::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:90::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:91::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:92::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:93::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:94::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:95::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:96::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:97::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a0::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a1::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a2::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a3::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a4::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a5::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a6::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a7::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a8::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:a9::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:aa::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:ab::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:ac::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:ad::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:ae::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b0::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b1::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b2::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b3::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b4::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b5::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:b6::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:c::/64"
+    },
+    {
+      ipv6Prefix: "2001:4860:4801:f::/64"
+    },
+    {
+      ipv4Prefix: "192.178.4.0/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.128/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.160/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.192/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.224/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.32/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.64/27"
+    },
+    {
+      ipv4Prefix: "192.178.4.96/27"
+    },
+    {
+      ipv4Prefix: "192.178.5.0/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.0/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.128/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.160/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.192/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.224/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.32/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.64/27"
+    },
+    {
+      ipv4Prefix: "192.178.6.96/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.0/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.128/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.160/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.192/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.224/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.32/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.64/27"
+    },
+    {
+      ipv4Prefix: "192.178.7.96/27"
+    },
+    {
+      ipv4Prefix: "34.100.182.96/28"
+    },
+    {
+      ipv4Prefix: "34.101.50.144/28"
+    },
+    {
+      ipv4Prefix: "34.118.254.0/28"
+    },
+    {
+      ipv4Prefix: "34.118.66.0/28"
+    },
+    {
+      ipv4Prefix: "34.126.178.96/28"
+    },
+    {
+      ipv4Prefix: "34.146.150.144/28"
+    },
+    {
+      ipv4Prefix: "34.147.110.144/28"
+    },
+    {
+      ipv4Prefix: "34.151.74.144/28"
+    },
+    {
+      ipv4Prefix: "34.152.50.64/28"
+    },
+    {
+      ipv4Prefix: "34.154.114.144/28"
+    },
+    {
+      ipv4Prefix: "34.155.98.32/28"
+    },
+    {
+      ipv4Prefix: "34.165.18.176/28"
+    },
+    {
+      ipv4Prefix: "34.175.160.64/28"
+    },
+    {
+      ipv4Prefix: "34.176.130.16/28"
+    },
+    {
+      ipv4Prefix: "34.22.85.0/27"
+    },
+    {
+      ipv4Prefix: "34.64.82.64/28"
+    },
+    {
+      ipv4Prefix: "34.65.242.112/28"
+    },
+    {
+      ipv4Prefix: "34.80.50.80/28"
+    },
+    {
+      ipv4Prefix: "34.88.194.0/28"
+    },
+    {
+      ipv4Prefix: "34.89.10.80/28"
+    },
+    {
+      ipv4Prefix: "34.89.198.80/28"
+    },
+    {
+      ipv4Prefix: "34.96.162.48/28"
+    },
+    {
+      ipv4Prefix: "35.247.243.240/28"
+    },
+    {
+      ipv4Prefix: "66.249.64.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.64.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.65.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.66.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.67.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.67.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.67.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.68.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.69.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.70.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.71.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.72.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.73.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.74.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.75.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.76.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.77.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.64/27"
+    },
+    {
+      ipv4Prefix: "66.249.78.96/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.0/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.128/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.160/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.192/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.224/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.32/27"
+    },
+    {
+      ipv4Prefix: "66.249.79.64/27"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/gptbot.json
+var gptbot_default = {
+  _source: "https://openai.com/gptbot.json",
+  creationTime: "2025-10-30T11:00:00.000000",
+  prefixes: [
+    {
+      ipv4Prefix: "132.196.86.0/24"
+    },
+    {
+      ipv4Prefix: "172.182.202.0/25"
+    },
+    {
+      ipv4Prefix: "172.182.204.0/24"
+    },
+    {
+      ipv4Prefix: "172.182.207.0/25"
+    },
+    {
+      ipv4Prefix: "172.182.214.0/24"
+    },
+    {
+      ipv4Prefix: "172.182.215.0/24"
+    },
+    {
+      ipv4Prefix: "20.125.66.80/28"
+    },
+    {
+      ipv4Prefix: "20.171.206.0/24"
+    },
+    {
+      ipv4Prefix: "20.171.207.0/24"
+    },
+    {
+      ipv4Prefix: "4.227.36.0/25"
+    },
+    {
+      ipv4Prefix: "52.230.152.0/24"
+    },
+    {
+      ipv4Prefix: "74.7.175.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.227.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.227.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.228.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.230.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.241.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.241.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.242.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.243.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.244.0/25"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/oai-searchbot.json
+var oai_searchbot_default = {
+  _source: "https://openai.com/searchbot.json",
+  creationTime: "2026-01-02T11:00:00.000000",
+  prefixes: [
+    {
+      ipv4Prefix: "104.210.140.128/28"
+    },
+    {
+      ipv4Prefix: "135.234.64.0/24"
+    },
+    {
+      ipv4Prefix: "172.182.193.224/28"
+    },
+    {
+      ipv4Prefix: "172.182.193.80/28"
+    },
+    {
+      ipv4Prefix: "172.182.194.144/28"
+    },
+    {
+      ipv4Prefix: "172.182.194.32/28"
+    },
+    {
+      ipv4Prefix: "172.182.195.48/28"
+    },
+    {
+      ipv4Prefix: "172.182.209.208/28"
+    },
+    {
+      ipv4Prefix: "172.182.211.192/28"
+    },
+    {
+      ipv4Prefix: "172.182.213.192/28"
+    },
+    {
+      ipv4Prefix: "172.182.224.0/28"
+    },
+    {
+      ipv4Prefix: "172.203.190.128/28"
+    },
+    {
+      ipv4Prefix: "20.14.99.96/28"
+    },
+    {
+      ipv4Prefix: "20.168.18.32/28"
+    },
+    {
+      ipv4Prefix: "20.169.6.224/28"
+    },
+    {
+      ipv4Prefix: "20.169.7.48/28"
+    },
+    {
+      ipv4Prefix: "20.169.77.0/25"
+    },
+    {
+      ipv4Prefix: "20.171.123.64/28"
+    },
+    {
+      ipv4Prefix: "20.171.53.224/28"
+    },
+    {
+      ipv4Prefix: "20.25.151.224/28"
+    },
+    {
+      ipv4Prefix: "20.42.10.176/28"
+    },
+    {
+      ipv4Prefix: "4.227.36.0/25"
+    },
+    {
+      ipv4Prefix: "40.67.175.0/25"
+    },
+    {
+      ipv4Prefix: "40.90.214.16/28"
+    },
+    {
+      ipv4Prefix: "51.8.102.0/24"
+    },
+    {
+      ipv4Prefix: "74.7.175.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.228.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.228.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.229.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.229.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.230.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.241.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.242.128/25"
+    },
+    {
+      ipv4Prefix: "74.7.243.0/25"
+    },
+    {
+      ipv4Prefix: "74.7.244.0/25"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/perplexity-user.json
+var perplexity_user_default = {
+  _source: "https://www.perplexity.ai/perplexity-user.json",
+  creationTime: "2025-10-17T10:17:00.000000",
+  prefixes: [
+    {
+      ipv4Prefix: "44.208.221.197/32"
+    },
+    {
+      ipv4Prefix: "34.193.163.52/32"
+    },
+    {
+      ipv4Prefix: "18.97.21.0/30"
+    },
+    {
+      ipv4Prefix: "18.97.43.80/29"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-ranges/perplexitybot.json
+var perplexitybot_default = {
+  _source: "https://www.perplexity.ai/perplexitybot.json",
+  creationTime: "2025-02-07T16:56:00.000000",
+  prefixes: [
+    {
+      ipv4Prefix: "107.20.236.150/32"
+    },
+    {
+      ipv4Prefix: "3.224.62.45/32"
+    },
+    {
+      ipv4Prefix: "18.210.92.235/32"
+    },
+    {
+      ipv4Prefix: "3.222.232.239/32"
+    },
+    {
+      ipv4Prefix: "3.211.124.183/32"
+    },
+    {
+      ipv4Prefix: "3.231.139.107/32"
+    },
+    {
+      ipv4Prefix: "18.97.1.228/30"
+    },
+    {
+      ipv4Prefix: "18.97.9.96/29"
+    }
+  ]
+};
+
+// ../integration-traffic/src/ip-verify.ts
+var RULE_ID_TO_RANGES = {
+  // OpenAI — three separate published lists (training crawler vs
+  // user-on-behalf fetcher vs search engine; OpenAI maintains the
+  // split because the IPs really do differ between products).
+  // src: https://openai.com/gptbot.json
+  "openai-gptbot": gptbot_default,
+  // src: https://openai.com/chatgpt-user.json
+  "openai-chatgpt-user": chatgpt_user_default,
+  // src: https://openai.com/searchbot.json
+  "openai-searchbot": oai_searchbot_default,
+  // Search engines.
+  // src: https://developers.google.com/static/search/apis/ipranges/googlebot.json
+  // (also covers Gemini grounding — Google doesn't publish a
+  // separate Gemini list; Google-Extended traffic comes from the
+  // same Googlebot ranges)
+  "googlebot": googlebot_default,
+  // src: https://www.bing.com/toolbox/bingbot.json
+  // (also covers Copilot grounding — Microsoft routes Copilot's
+  // web fetches through bingbot infrastructure)
+  "bingbot": bingbot_default,
+  // Perplexity — split between crawler and user-on-behalf fetcher,
+  // same shape as OpenAI's split.
+  // src: https://www.perplexity.ai/perplexitybot.json
+  "perplexity-bot": perplexitybot_default,
+  // src: https://www.perplexity.ai/perplexity-user.json
+  "perplexity-user": perplexity_user_default,
+  // Anthropic — no machine-readable JSON published. The bundled
+  // anthropic.json is the set of networks registered to Anthropic,
+  // PBC at ARIN (the authoritative allocation record). Maintained by
+  // hand; refresh by re-querying the ARIN entity below. The crawler
+  // block is AWS-ANTHROPIC 216.73.216.0/22 — empirical Cloud Run
+  // logs show all real ClaudeBot traffic comes from there. Same raw
+  // set is shared across every Claude-* UA the classifier emits.
+  // src: https://rdap.arin.net/registry/entity/AP-2440
+  "anthropic-claudebot": anthropic_default
+};
+var CACHE = (() => {
+  const cache = /* @__PURE__ */ new Map();
+  for (const [ruleId, raw] of Object.entries(RULE_ID_TO_RANGES)) {
+    const parsed = [];
+    for (const entry of raw.prefixes) {
+      const cidr = entry.ipv4Prefix ?? entry.ipv6Prefix;
+      if (!cidr) continue;
+      const p = parseCidr(cidr);
+      if (p) parsed.push(p);
+    }
+    cache.set(ruleId, parsed);
+  }
+  return cache;
+})();
+function parseIp(ip) {
+  if (!ip) return null;
+  const mappedMatch = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
+  if (mappedMatch) return parseIp(mappedMatch[1]);
+  if (ip.includes(":")) {
+    const sides = ip.split("::");
+    if (sides.length > 2) return null;
+    const left = sides[0].length > 0 ? sides[0].split(":") : [];
+    const right = sides.length === 2 && sides[1].length > 0 ? sides[1].split(":") : [];
+    const groupCount = left.length + right.length;
+    if (groupCount > 8) return null;
+    if (sides.length === 1 && groupCount !== 8) return null;
+    const fill = 8 - groupCount;
+    const groups = [...left, ...new Array(fill).fill("0"), ...right];
+    let addr2 = 0n;
+    for (const g of groups) {
+      if (g.length === 0 || g.length > 4) return null;
+      const n = Number.parseInt(g, 16);
+      if (!Number.isFinite(n) || n < 0 || n > 65535) return null;
+      addr2 = addr2 << 16n | BigInt(n);
+    }
+    return { version: 6, addr: addr2 };
+  }
+  const octets = ip.split(".");
+  if (octets.length !== 4) return null;
+  let addr = 0n;
+  for (const o of octets) {
+    if (o.length === 0 || o.length > 3) return null;
+    const n = Number.parseInt(o, 10);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    addr = addr << 8n | BigInt(n);
+  }
+  return { version: 4, addr };
+}
+function parseCidr(cidr) {
+  const [ipPart, prefixStr] = cidr.split("/");
+  if (!ipPart || !prefixStr) return null;
+  const prefix = Number.parseInt(prefixStr, 10);
+  if (!Number.isInteger(prefix)) return null;
+  const parsed = parseIp(ipPart);
+  if (!parsed) return null;
+  const totalBits = parsed.version === 4 ? 32 : 128;
+  if (prefix < 0 || prefix > totalBits) return null;
+  const allOnes = (1n << BigInt(totalBits)) - 1n;
+  const mask = allOnes >> BigInt(totalBits - prefix) << BigInt(totalBits - prefix);
+  return {
+    version: parsed.version,
+    network: parsed.addr & mask,
+    mask
+  };
+}
+function verifyIpForRule(ip, ruleId) {
+  if (!ip) return false;
+  const ranges = CACHE.get(ruleId);
+  if (!ranges || ranges.length === 0) return false;
+  const parsed = parseIp(ip);
+  if (!parsed) return false;
+  for (const cidr of ranges) {
+    if (parsed.version !== cidr.version) continue;
+    if ((parsed.addr & cidr.mask) === cidr.network) return true;
+  }
+  return false;
+}
+
+// ../integration-traffic/src/rules.ts
+var LEGACY_CHATGPT_DOMAIN = "chat.openai.com";
+var DEFAULT_AI_CRAWLER_RULES = [
+  {
+    id: "openai-gptbot",
+    operator: "OpenAI",
+    product: "GPTBot",
+    purpose: "training",
+    userAgentPatterns: [/GPTBot\//i]
+  },
+  {
+    id: "openai-searchbot",
+    operator: "OpenAI",
+    product: "OAI-SearchBot",
+    purpose: "search",
+    userAgentPatterns: [/OAI-SearchBot\//i]
+  },
+  {
+    id: "openai-chatgpt-user",
+    operator: "OpenAI",
+    product: "ChatGPT-User",
+    purpose: "user-agent",
+    userAgentPatterns: [/ChatGPT-User\//i]
+  },
+  {
+    id: "anthropic-claudebot",
+    operator: "Anthropic",
+    product: "ClaudeBot",
+    purpose: "training",
+    // Anthropic ships several Claude-* crawlers (ClaudeBot for training,
+    // Claude-Web for chat fetches, Claude-SearchBot for search). The
+    // `Claude-` prefix + `Bot/` suffix is the stable shape — pattern is
+    // permissive enough to catch new Claude-* variants as Anthropic
+    // adds them, without matching unrelated UAs that happen to mention
+    // "claude".
+    userAgentPatterns: [
+      /ClaudeBot\//i,
+      /Claude-Web\//i,
+      /Claude-SearchBot\//i,
+      /Claude-[A-Z]+Bot\//i,
+      /anthropic-ai/i
+    ]
+  },
+  {
+    id: "perplexity-bot",
+    operator: "Perplexity",
+    product: "PerplexityBot",
+    purpose: "search",
+    userAgentPatterns: [/PerplexityBot\//i]
+  },
+  {
+    // User-initiated fetches when a Perplexity user opens a citation
+    // link. Separate from PerplexityBot (crawl) — different ranges and
+    // different operational signal. Perplexity publishes both UA
+    // patterns at perplexity.ai/perplexity-user.json.
+    id: "perplexity-user",
+    operator: "Perplexity",
+    product: "Perplexity-User",
+    purpose: "user-agent",
+    userAgentPatterns: [/Perplexity-User\//i]
+  },
+  {
+    id: "google-extended",
+    operator: "Google",
+    product: "Google-Extended",
+    purpose: "training-control",
+    userAgentPatterns: [/Google-Extended/i]
+  },
+  {
+    id: "bytespider",
+    operator: "ByteDance",
+    product: "Bytespider",
+    purpose: "training",
+    userAgentPatterns: [/Bytespider/i]
+  },
+  {
+    id: "applebot-extended",
+    operator: "Apple",
+    product: "Applebot-Extended",
+    purpose: "training",
+    userAgentPatterns: [/Applebot-Extended/i]
+  },
+  {
+    // Apple's general crawler (separate from Applebot-Extended, which is
+    // the training-opt-out signaling UA). Both indexes pages for Apple
+    // services (Siri/Spotlight); only Applebot-Extended is gated by
+    // training-data opt-out.
+    id: "applebot",
+    operator: "Apple",
+    product: "Applebot",
+    purpose: "crawl",
+    userAgentPatterns: [/Applebot\//i]
+  },
+  {
+    id: "meta-externalagent",
+    operator: "Meta",
+    product: "meta-externalagent",
+    purpose: "training",
+    userAgentPatterns: [/meta-externalagent/i]
+  },
+  {
+    id: "ccbot",
+    operator: "Common Crawl",
+    product: "CCBot",
+    purpose: "crawl",
+    userAgentPatterns: [/CCBot\//i]
+  },
+  {
+    id: "cohere-ai",
+    operator: "Cohere",
+    product: "cohere-ai",
+    purpose: "training",
+    userAgentPatterns: [/cohere-ai/i]
+  },
+  {
+    id: "diffbot",
+    operator: "Diffbot",
+    product: "Diffbot",
+    purpose: "crawl",
+    userAgentPatterns: [/Diffbot/i]
+  },
+  {
+    id: "mistral-ai",
+    operator: "Mistral AI",
+    product: "MistralAI-User",
+    purpose: "crawl",
+    // Mistral ships both `MistralAI-User/*` (chat-on-behalf-of-user
+    // fetches) and `MistralBot/*` (general crawler). Earlier rule only
+    // matched `MistralAI` and missed the bot — caught on 2026-05-18
+    // when canonry.ai/canonry-landing's classification chart went flat
+    // and the bot UA was sitting in the `unknown` bucket.
+    userAgentPatterns: [/MistralAI/i, /MistralBot/i]
+  },
+  {
+    id: "deepseek",
+    operator: "DeepSeek",
+    product: "DeepSeekBot",
+    purpose: "training",
+    userAgentPatterns: [/DeepSeekBot/i]
+  },
+  // Classic search-engine crawlers. Not strictly "AI" by training origin,
+  // but the same audience: machine traffic indexing the site for query
+  // surfaces. Operators tracking AI visibility want this signal too —
+  // SERP indexing is the upstream that feeds AI answer engines (Bing
+  // powers ChatGPT search; Google powers Gemini grounding). Classified
+  // alongside LLM crawlers; the dashboard's "AI crawler hits" label is
+  // imprecise here but functionally correct (these are still bots, not
+  // humans).
+  {
+    id: "googlebot",
+    operator: "Google",
+    product: "Googlebot",
+    purpose: "search",
+    // Googlebot has Smartphone / Desktop / Image / News / Video variants.
+    // All match the `Googlebot/` prefix on first appearance in the UA.
+    // Excludes `Googlebot-Image` etc. that ride a `Googlebot-` prefix —
+    // they also match `Googlebot/` in their UA strings.
+    userAgentPatterns: [/Googlebot[/-]/i]
+  },
+  {
+    id: "bingbot",
+    operator: "Microsoft",
+    product: "bingbot",
+    purpose: "search",
+    userAgentPatterns: [/bingbot\//i]
+  },
+  {
+    id: "duckduckbot",
+    operator: "DuckDuckGo",
+    product: "DuckDuckBot",
+    purpose: "search",
+    userAgentPatterns: [/DuckDuckBot/i]
+  },
+  {
+    id: "yandexbot",
+    operator: "Yandex",
+    product: "YandexBot",
+    purpose: "search",
+    userAgentPatterns: [/YandexBot\//i]
+  },
+  {
+    id: "baiduspider",
+    operator: "Baidu",
+    product: "Baiduspider",
+    purpose: "search",
+    userAgentPatterns: [/Baiduspider/i]
+  },
+  {
+    id: "amazonbot",
+    operator: "Amazon",
+    product: "Amazonbot",
+    purpose: "crawl",
+    userAgentPatterns: [/Amazonbot\//i]
+  }
+];
+var DEFAULT_AI_REFERRER_RULES = [
+  { domain: AI_ENGINE_DOMAINS.chatgpt, operator: "OpenAI", product: "ChatGPT" },
+  { domain: LEGACY_CHATGPT_DOMAIN, operator: "OpenAI", product: "ChatGPT" },
+  { domain: AI_ENGINE_DOMAINS.perplexity, operator: "Perplexity", product: "Perplexity" },
+  { domain: AI_ENGINE_DOMAINS.claude, operator: "Anthropic", product: "Claude" },
+  { domain: AI_ENGINE_DOMAINS.gemini, operator: "Google", product: "Gemini" },
+  { domain: AI_ENGINE_DOMAINS.copilotMicrosoft, operator: "Microsoft", product: "Copilot" },
+  { domain: AI_ENGINE_DOMAINS.phind, operator: "Phind", product: "Phind" },
+  { domain: AI_ENGINE_DOMAINS.you, operator: "You.com", product: "You.com" },
+  { domain: AI_ENGINE_DOMAINS.metaAi, operator: "Meta", product: "Meta AI" }
+];
+
+// ../integration-traffic/src/classifier.ts
+function normalizeHost(host) {
+  return host.trim().toLowerCase().replace(/^www\./, "");
+}
+function hostMatches(host, domain) {
+  const normalizedHost = normalizeHost(host);
+  const normalizedDomain = normalizeHost(domain);
+  return normalizedHost === normalizedDomain || normalizedHost.endsWith(`.${normalizedDomain}`);
+}
+function utmTokenMatchesDomain(utmSource, domain) {
+  if (hostMatches(utmSource, domain)) return true;
+  const normalizedUtm = normalizeHost(utmSource);
+  const firstLabel = normalizeHost(domain).split(".")[0];
+  return Boolean(firstLabel) && normalizedUtm === firstLabel;
+}
+function hostFromUrl(value) {
+  if (!value) return null;
   try {
     return normalizeHost(new URL(value).hostname);
   } catch {
@@ -18280,12 +20709,13 @@ function classifyCrawler(event) {
   if (!userAgent) return null;
   for (const rule of DEFAULT_AI_CRAWLER_RULES) {
     if (rule.userAgentPatterns.some((pattern) => pattern.test(userAgent))) {
+      const verified = verifyIpForRule(event.remoteIp, rule.id);
       return {
         botId: rule.id,
         operator: rule.operator,
         product: rule.product,
         purpose: rule.purpose,
-        verificationStatus: "claimed_unverified",
+        verificationStatus: verified ? "verified" : "claimed_unverified",
         matchedUserAgent: userAgent
       };
     }
@@ -20736,6 +23166,79 @@ var providersConfiguredCheck = {
 };
 var PROVIDERS_CHECKS = [providersConfiguredCheck];
 
+// ../api-routes/src/doctor/checks/runtime-state.ts
+import fs7 from "fs";
+var dbFilePresentCheck = {
+  id: "db.file.present",
+  category: CheckCategories.database,
+  scope: CheckScopes.global,
+  title: "Database file present",
+  run: (ctx) => {
+    const path16 = ctx.runtimeStatePaths?.databasePath;
+    if (!path16) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "db.file.path-not-wired",
+        summary: "No database file path configured for this deployment (cloud DB).",
+        remediation: null
+      };
+    }
+    if (!fs7.existsSync(path16)) {
+      return {
+        status: CheckStatuses.fail,
+        code: "db.file.missing",
+        summary: `Database file at \`${path16}\` has been deleted while the daemon is running.`,
+        remediation: "Restart `canonry serve` so a fresh database is created and migrations re-run. Until you do, the daemon will keep serving stale data from a deleted-but-open file handle and writes will be lost.",
+        details: { path: path16 }
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "db.file.present",
+      summary: `Database file present at \`${path16}\`.`,
+      remediation: null,
+      details: { path: path16 }
+    };
+  }
+};
+var configFilePresentCheck = {
+  id: "config.file.present",
+  category: CheckCategories.config,
+  scope: CheckScopes.global,
+  title: "Config file present",
+  run: (ctx) => {
+    const path16 = ctx.runtimeStatePaths?.configPath;
+    if (!path16) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "config.file.path-not-wired",
+        summary: "No config file path configured for this deployment.",
+        remediation: null
+      };
+    }
+    if (!fs7.existsSync(path16)) {
+      return {
+        status: CheckStatuses.fail,
+        code: "config.file.missing",
+        summary: `Config file at \`${path16}\` has been deleted while the daemon is running.`,
+        remediation: "Restart `canonry serve` after the file is restored (provider keys, OAuth tokens, and integration credentials live in this file; the in-memory copy is read-only until restart).",
+        details: { path: path16 }
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "config.file.present",
+      summary: `Config file present at \`${path16}\`.`,
+      remediation: null,
+      details: { path: path16 }
+    };
+  }
+};
+var RUNTIME_STATE_CHECKS = [
+  dbFilePresentCheck,
+  configFilePresentCheck
+];
+
 // ../api-routes/src/doctor/checks/traffic-source.ts
 import { and as and20, eq as eq25, gte as gte4, ne as ne4, sql as sql11 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
@@ -21041,6 +23544,9 @@ var TRAFFIC_SOURCE_CHECKS = [
 
 // ../api-routes/src/doctor/registry.ts
 var ALL_CHECKS = [
+  // Runtime-state checks run first so file-system gone errors surface
+  // before any auth/integration checks try to touch the (orphaned) DB.
+  ...RUNTIME_STATE_CHECKS,
   ...GOOGLE_AUTH_CHECKS,
   ...BING_AUTH_CHECKS,
   ...GA_AUTH_CHECKS,
@@ -21131,7 +23637,8 @@ async function doctorRoutes(app, opts) {
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
       redirectUri,
       providerSummary: opts.providerSummary,
-      trafficSourceValidators: opts.trafficSourceValidators
+      trafficSourceValidators: opts.trafficSourceValidators,
+      runtimeStatePaths: opts.runtimeStatePaths
     };
     return runChecks(ctx, ALL_CHECKS, { checkIds });
   });
@@ -21152,7 +23659,8 @@ async function doctorRoutes(app, opts) {
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
       redirectUri,
       providerSummary: opts.providerSummary,
-      trafficSourceValidators: opts.trafficSourceValidators
+      trafficSourceValidators: opts.trafficSourceValidators,
+      runtimeStatePaths: opts.runtimeStatePaths
     };
     return runChecks(ctx, ALL_CHECKS, { checkIds });
   });
@@ -21641,6 +24149,21 @@ async function apiRoutes(app, opts) {
       }
     });
   });
+  if (opts.runtimeStatePaths) {
+    const { databasePath, configPath } = opts.runtimeStatePaths;
+    const isDiagnosticUrl = (url) => url === "/health" || /\/doctor(?:\?|$)/.test(url);
+    app.addHook("onRequest", async (request) => {
+      if (isDiagnosticUrl(request.url)) return;
+      const missing = [];
+      if (!fs8.existsSync(databasePath)) missing.push(`database file \`${databasePath}\``);
+      if (configPath && !fs8.existsSync(configPath)) missing.push(`config file \`${configPath}\``);
+      if (missing.length === 0) return;
+      throw runtimeStateMissing(
+        `Runtime state missing: ${missing.join(" and ")}. Restart \`canonry serve\` so a fresh state is created (the daemon's open file handles still point at the deleted inode, so writes are being lost).`,
+        { missing }
+      );
+    });
+  }
   await app.register(async (api) => {
     if (!opts.skipAuth) {
       await authPlugin(api, {
@@ -21764,7 +24287,8 @@ async function apiRoutes(app, opts) {
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
       publicUrl: opts.publicUrl,
       providerSummary: opts.providerSummary,
-      trafficSourceValidators: buildTrafficSourceValidators(opts)
+      trafficSourceValidators: buildTrafficSourceValidators(opts),
+      runtimeStatePaths: opts.runtimeStatePaths
     });
     if (opts.registerAuthenticatedRoutes) {
       await opts.registerAuthenticatedRoutes(api);
@@ -21950,7 +24474,7 @@ async function withRetry(fn, options = {}) {
 }
 
 // ../provider-gemini/src/normalize.ts
-var DEFAULT_MODEL = "gemini-3-flash";
+var DEFAULT_MODEL = "gemini-2.5-flash";
 function isVertexConfig(config) {
   return !!config.vertexProject;
 }
@@ -22287,15 +24811,14 @@ var geminiAdapter = {
   keyUrl: "https://aistudio.google.com/apikey",
   // Upstream model list: https://ai.google.dev/gemini-api/docs/models
   modelRegistry: {
-    defaultModel: "gemini-3-flash",
+    defaultModel: "gemini-2.5-flash",
     validationPattern: /./,
-    validationHint: "any valid Google model name (e.g. gemini-3-flash, learnlm-1.5-pro-experimental)",
+    validationHint: "any valid Google model name (e.g. gemini-2.5-flash, learnlm-1.5-pro-experimental)",
     knownModels: [
-      { id: "gemini-3.1-pro-preview", displayName: "Gemini 3.1 Pro (Preview)", tier: "flagship" },
-      { id: "gemini-3-flash", displayName: "Gemini 3 Flash", tier: "standard" },
-      { id: "gemini-3-flash-preview", displayName: "Gemini 3 Flash (Preview)", tier: "standard" },
-      { id: "gemini-3.1-flash-lite-preview", displayName: "Gemini 3.1 Flash-Lite (Preview)", tier: "economy" },
-      { id: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", tier: "standard" }
+      { id: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", tier: "flagship" },
+      { id: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", tier: "standard" },
+      { id: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash-Lite", tier: "economy" },
+      { id: "gemini-2.0-flash", displayName: "Gemini 2.0 Flash", tier: "standard" }
     ]
   },
   validateConfig(config) {
@@ -23711,12 +26234,12 @@ function sleep2(ms) {
 }
 
 // ../provider-cdp/src/screenshot.ts
-import fs7 from "fs";
+import fs9 from "fs";
 import path8 from "path";
 async function captureElementScreenshot(client, selector, outputPath) {
   const dir = path8.dirname(outputPath);
-  if (!fs7.existsSync(dir)) {
-    fs7.mkdirSync(dir, { recursive: true });
+  if (!fs9.existsSync(dir)) {
+    fs9.mkdirSync(dir, { recursive: true });
   }
   let clip;
   try {
@@ -23750,7 +26273,7 @@ async function captureElementScreenshot(client, selector, outputPath) {
   }
   const { data } = await client.Page.captureScreenshot(screenshotParams);
   const buffer = Buffer.from(data, "base64");
-  fs7.writeFileSync(outputPath, buffer);
+  fs9.writeFileSync(outputPath, buffer);
   return outputPath;
 }
 
@@ -24508,7 +27031,7 @@ function removeWordpressConnection(config, projectName) {
 
 // src/job-runner.ts
 import crypto25 from "crypto";
-import fs8 from "fs";
+import fs10 from "fs";
 import path10 from "path";
 import os5 from "os";
 import { and as and22, eq as eq28, inArray as inArray10, sql as sql12 } from "drizzle-orm";
@@ -25002,12 +27525,12 @@ var JobRunner = class {
               allBrandNames
             );
             let screenshotRelPath = null;
-            if (raw.screenshotPath && fs8.existsSync(raw.screenshotPath)) {
+            if (raw.screenshotPath && fs10.existsSync(raw.screenshotPath)) {
               const snapshotId = crypto25.randomUUID();
               const screenshotDir = path10.join(os5.homedir(), ".canonry", "screenshots", runId);
-              if (!fs8.existsSync(screenshotDir)) fs8.mkdirSync(screenshotDir, { recursive: true });
+              if (!fs10.existsSync(screenshotDir)) fs10.mkdirSync(screenshotDir, { recursive: true });
               const destPath = path10.join(screenshotDir, `${snapshotId}.png`);
-              fs8.renameSync(raw.screenshotPath, destPath);
+              fs10.renameSync(raw.screenshotPath, destPath);
               screenshotRelPath = `${runId}/${snapshotId}.png`;
               this.db.insert(querySnapshots).values({
                 id: snapshotId,
@@ -26045,7 +28568,7 @@ function computeSummary(rows) {
 
 // src/backlink-extract.ts
 import crypto30 from "crypto";
-import fs9 from "fs";
+import fs11 from "fs";
 import { and as and26, desc as desc16, eq as eq33 } from "drizzle-orm";
 var log7 = createLogger("BacklinkExtract");
 function defaultDeps2() {
@@ -26074,7 +28597,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
     if (!sync.vertexPath || !sync.edgesPath) {
       throw new Error(`Release ${sync.release} is missing cached file paths`);
     }
-    if (!fs9.existsSync(sync.vertexPath) || !fs9.existsSync(sync.edgesPath)) {
+    if (!fs11.existsSync(sync.vertexPath) || !fs11.existsSync(sync.edgesPath)) {
       throw new Error(
         `Cache for release ${sync.release} is missing from disk (expected at ${sync.vertexPath}). The sync record exists in the database, but the ~16 GB dump was deleted or never present on this machine. Re-sync this release from the Backlinks admin page to restore the cache.`
       );
@@ -26465,7 +28988,7 @@ function buildDiscoveryInsightTitle(input) {
 }
 
 // src/commands/backfill.ts
-import { and as and28, eq as eq35, inArray as inArray11 } from "drizzle-orm";
+import { and as and28, eq as eq35, inArray as inArray11, isNull, sql as sql15 } from "drizzle-orm";
 var SNAPSHOT_BATCH_SIZE = 500;
 async function backfillAnswerVisibilityCommand(opts) {
   const config = loadConfig();
@@ -26922,7 +29445,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-XMZEWLCW.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-2XL2M7QP.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -26970,6 +29493,247 @@ Backfill ${isDryRun ? "preview" : "complete"}.`);
     console.log(`             No DB writes performed. Re-run without --dry-run to apply.`);
   }
 }
+function replayQueryAuditLog(events) {
+  const active = [];
+  for (const ev of events) {
+    let diff;
+    try {
+      diff = ev.diff ? JSON.parse(ev.diff) : {};
+    } catch {
+      continue;
+    }
+    if (ev.action === "keywords.appended" || ev.action === "queries.appended") {
+      const added = Array.isArray(diff.added) ? diff.added : [];
+      for (const q of added) {
+        active.push({ text: q, addedAt: ev.createdAt, deletedAt: null });
+      }
+    } else if (ev.action === "keywords.deleted" || ev.action === "queries.deleted") {
+      const deleted = Array.isArray(diff.deleted) ? diff.deleted : [];
+      for (const q of deleted) {
+        for (let i = active.length - 1; i >= 0; i--) {
+          if (active[i].text === q && active[i].deletedAt === null) {
+            active[i].deletedAt = ev.createdAt;
+            break;
+          }
+        }
+      }
+    } else if (ev.action === "queries.replaced") {
+      const newSet = Array.isArray(diff.queries) ? diff.queries : [];
+      for (const e of active) {
+        if (e.deletedAt === null) e.deletedAt = ev.createdAt;
+      }
+      for (const q of newSet) {
+        active.push({ text: q, addedAt: ev.createdAt, deletedAt: null });
+      }
+    }
+  }
+  return active;
+}
+function activeQueriesAt(history, t) {
+  return history.filter((e) => e.addedAt <= t && (e.deletedAt === null || e.deletedAt > t)).map((e) => e.text);
+}
+var CONTENT_MATCH_STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "and",
+  "or",
+  "but",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "have",
+  "has",
+  "had",
+  "do",
+  "does",
+  "did",
+  "will",
+  "would",
+  "could",
+  "should",
+  "may",
+  "might",
+  "can",
+  "this",
+  "that",
+  "these",
+  "those",
+  "i",
+  "you",
+  "he",
+  "she",
+  "it",
+  "we",
+  "they",
+  "what",
+  "which",
+  "who",
+  "how",
+  "why",
+  "when",
+  "where",
+  "with",
+  "for",
+  "from",
+  "of",
+  "in",
+  "on",
+  "at",
+  "to",
+  "by",
+  "as",
+  "best",
+  "most"
+]);
+function tokenizeForMatch(s) {
+  return s.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((t) => t.length >= 3 && !CONTENT_MATCH_STOPWORDS.has(t));
+}
+function contentMatchScore(queryText, answerText) {
+  const queryTokens = [...new Set(tokenizeForMatch(queryText))];
+  if (queryTokens.length === 0) return 0;
+  const answerHead = answerText.slice(0, 300).toLowerCase();
+  const hit = queryTokens.filter((t) => answerHead.includes(t)).length;
+  return hit / queryTokens.length;
+}
+async function backfillSnapshotAttributionCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const project = db.select().from(projects).where(eq35(projects.name, opts.project)).get();
+  if (!project) {
+    throw new Error(`Project "${opts.project}" not found`);
+  }
+  const isJson = opts.format === "json";
+  const isDryRun = opts.dryRun === true;
+  if (!isJson) {
+    const mode = isDryRun ? " [DRY RUN \u2014 no writes]" : "";
+    process.stderr.write(`Recovering orphan snapshot attribution for "${project.name}"${mode}...
+`);
+  }
+  const events = db.select({ createdAt: auditLog.createdAt, action: auditLog.action, diff: auditLog.diff }).from(auditLog).where(and28(
+    eq35(auditLog.projectId, project.id),
+    inArray11(auditLog.action, ["keywords.appended", "keywords.deleted", "queries.appended", "queries.deleted", "queries.replaced"])
+  )).orderBy(auditLog.createdAt).all();
+  const history = replayQueryAuditLog(events);
+  const orphanRuns = db.select({
+    runId: runs.id,
+    createdAt: runs.createdAt,
+    location: runs.location
+  }).from(runs).innerJoin(querySnapshots, eq35(querySnapshots.runId, runs.id)).where(and28(
+    eq35(runs.projectId, project.id),
+    isNull(querySnapshots.queryId),
+    isNull(querySnapshots.queryText)
+  )).groupBy(runs.id).orderBy(runs.createdAt).all();
+  const result = {
+    project: project.name,
+    examinedRuns: orphanRuns.length,
+    orphanSnapshots: 0,
+    recoveredByPosition: 0,
+    recoveredByContent: 0,
+    unrecovered: 0,
+    dryRun: isDryRun,
+    perRun: []
+  };
+  const updates = [];
+  for (const run of orphanRuns) {
+    const activeAt = activeQueriesAt(history, run.createdAt);
+    const orphanSnaps = db.select({
+      id: querySnapshots.id,
+      provider: querySnapshots.provider,
+      createdAt: querySnapshots.createdAt,
+      answerText: querySnapshots.answerText
+    }).from(querySnapshots).where(and28(
+      eq35(querySnapshots.runId, run.runId),
+      isNull(querySnapshots.queryId),
+      isNull(querySnapshots.queryText)
+    )).orderBy(querySnapshots.provider, querySnapshots.createdAt).all();
+    const byProvider = /* @__PURE__ */ new Map();
+    for (const s of orphanSnaps) {
+      const arr = byProvider.get(s.provider);
+      if (arr) arr.push(s);
+      else byProvider.set(s.provider, [s]);
+    }
+    let runPosition = 0;
+    let runContent = 0;
+    let runUnrecovered = 0;
+    for (const [, snaps] of byProvider) {
+      if (snaps.length === activeAt.length) {
+        for (let i = 0; i < snaps.length; i++) {
+          updates.push({ id: snaps[i].id, queryText: activeAt[i] });
+          runPosition++;
+        }
+      } else if (snaps.length < activeAt.length) {
+        const LOOKAHEAD_LIMIT = 5;
+        let cidx = 0;
+        for (const snap of snaps) {
+          const answerText = snap.answerText ?? "";
+          let matchedIdx = -1;
+          for (let i = cidx; i < Math.min(activeAt.length, cidx + LOOKAHEAD_LIMIT); i++) {
+            if (contentMatchScore(activeAt[i], answerText) >= 1) {
+              matchedIdx = i;
+              break;
+            }
+          }
+          if (matchedIdx >= 0) {
+            updates.push({ id: snap.id, queryText: activeAt[matchedIdx] });
+            runContent++;
+            cidx = matchedIdx + 1;
+          } else {
+            runUnrecovered++;
+          }
+        }
+      } else {
+        runUnrecovered += snaps.length;
+      }
+    }
+    result.orphanSnapshots += orphanSnaps.length;
+    result.recoveredByPosition += runPosition;
+    result.recoveredByContent += runContent;
+    result.unrecovered += runUnrecovered;
+    result.perRun.push({
+      runId: run.runId,
+      runCreatedAt: run.createdAt,
+      activeQueryCount: activeAt.length,
+      orphanSnaps: orphanSnaps.length,
+      recoveredPosition: runPosition,
+      recoveredContent: runContent,
+      unrecovered: runUnrecovered
+    });
+    if (!isJson) {
+      process.stderr.write(
+        `  ${run.createdAt} loc=${run.location ?? "-"} \u2192 ${orphanSnaps.length} orphan; ${runPosition} position-matched, ${runContent} content-matched, ${runUnrecovered} unrecovered
+`
+      );
+    }
+  }
+  if (!isDryRun && updates.length > 0) {
+    db.transaction((tx) => {
+      for (const u of updates) {
+        tx.update(querySnapshots).set({ queryText: u.queryText }).where(eq35(querySnapshots.id, u.id)).run();
+      }
+    });
+  }
+  if (isJson) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(`
+Snapshot attribution ${isDryRun ? "preview" : "recovery"} complete.`);
+  console.log(`  Examined runs:        ${result.examinedRuns}`);
+  console.log(`  Orphan snapshots:     ${result.orphanSnapshots}`);
+  console.log(`  Position-matched:     ${result.recoveredByPosition}`);
+  console.log(`  Content-matched:      ${result.recoveredByContent}`);
+  console.log(`  Unrecovered:          ${result.unrecovered}`);
+  if (isDryRun) {
+    console.log(`
+No DB writes performed. Re-run without --dry-run to apply.`);
+  }
+}
 function reparseProviderSnapshot(provider, rawResponse) {
   const envelope = parseJsonColumn(rawResponse, {});
   const apiResponse = resolveStoredApiResponse(envelope);
@@ -27017,6 +29781,157 @@ function stringifyStoredSnapshotEnvelope(rawResponse, reparsed) {
     ...apiResponse ? { apiResponse } : {}
   });
 }
+async function backfillTrafficClassificationCommand(opts) {
+  const config = loadConfig();
+  const db = createClient(config.database);
+  migrate(db);
+  const projectFilter = opts?.project?.trim();
+  const isDryRun = opts?.dryRun === true;
+  const isJson = opts?.format === "json";
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq35(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  if (scopedProjects.length === 0) {
+    if (projectFilter && !isJson) {
+      process.stderr.write(`No project named "${projectFilter}".
+`);
+    }
+    if (isJson) console.log(JSON.stringify({ project: projectFilter ?? null, examined: 0, reclassified: 0 }));
+    return;
+  }
+  if (!isJson) {
+    const mode = isDryRun ? " [DRY RUN \u2014 no writes]" : "";
+    const scope = projectFilter ? `"${projectFilter}"` : "all projects";
+    process.stderr.write(`Re-classifying unknown traffic samples for ${scope}${mode}...
+`);
+  }
+  const projectIds = scopedProjects.map((p) => p.id);
+  const result = {
+    project: projectFilter ?? null,
+    examined: 0,
+    reclassified: 0,
+    unknownBefore: 0,
+    unknownAfter: 0,
+    dryRun: isDryRun,
+    byBot: {}
+  };
+  const unknownCountRow = db.select({ n: sql15`count(*)` }).from(rawEventSamples).where(and28(
+    eq35(rawEventSamples.eventType, "unknown"),
+    inArray11(rawEventSamples.projectId, projectIds)
+  )).get();
+  result.unknownBefore = Number(unknownCountRow?.n ?? 0);
+  const unknownSamples = db.select({
+    id: rawEventSamples.id,
+    projectId: rawEventSamples.projectId,
+    sourceId: rawEventSamples.sourceId,
+    ts: rawEventSamples.ts,
+    userAgent: rawEventSamples.userAgent,
+    pathNormalized: rawEventSamples.pathNormalized,
+    status: rawEventSamples.status
+  }).from(rawEventSamples).where(and28(
+    eq35(rawEventSamples.eventType, "unknown"),
+    inArray11(rawEventSamples.projectId, projectIds)
+  )).all();
+  result.examined = unknownSamples.length;
+  if (unknownSamples.length === 0) {
+    result.unknownAfter = result.unknownBefore;
+    emitTrafficClassificationReport(result, isJson);
+    return;
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  for (const snap of unknownSamples) {
+    if (!snap.userAgent) continue;
+    const probe = {
+      sourceType: TrafficSourceTypes["cloud-run"],
+      evidenceKind: TrafficEvidenceKinds["raw-request"],
+      confidence: TrafficEventConfidences.observed,
+      eventId: snap.id,
+      observedAt: snap.ts,
+      method: "GET",
+      requestUrl: `https://placeholder${snap.pathNormalized}`,
+      host: "placeholder",
+      path: snap.pathNormalized,
+      queryString: null,
+      status: snap.status ?? 200,
+      userAgent: snap.userAgent,
+      remoteIp: null,
+      referer: null,
+      latencyMs: null,
+      requestSizeBytes: null,
+      responseSizeBytes: null,
+      providerResource: { type: "cloud_run_revision", labels: {} },
+      providerLabels: {}
+    };
+    const classified = classifyCrawler(probe);
+    if (!classified) continue;
+    result.reclassified++;
+    result.byBot[classified.botId] = (result.byBot[classified.botId] ?? 0) + 1;
+    if (isDryRun) continue;
+    db.update(rawEventSamples).set({ eventType: TrafficEventKinds.crawler }).where(eq35(rawEventSamples.id, snap.id)).run();
+    const tsHour = new Date(snap.ts);
+    tsHour.setUTCMinutes(0, 0, 0);
+    db.insert(crawlerEventsHourly).values({
+      projectId: snap.projectId,
+      sourceId: snap.sourceId,
+      tsHour: tsHour.toISOString(),
+      botId: classified.botId,
+      operator: classified.operator,
+      verificationStatus: classified.verificationStatus,
+      pathNormalized: snap.pathNormalized,
+      status: snap.status ?? 200,
+      hits: 1,
+      sampledUserAgent: snap.userAgent,
+      createdAt: now,
+      updatedAt: now
+    }).onConflictDoUpdate({
+      target: [
+        crawlerEventsHourly.projectId,
+        crawlerEventsHourly.sourceId,
+        crawlerEventsHourly.tsHour,
+        crawlerEventsHourly.botId,
+        crawlerEventsHourly.verificationStatus,
+        crawlerEventsHourly.pathNormalized,
+        crawlerEventsHourly.status
+      ],
+      set: {
+        hits: sql15`${crawlerEventsHourly.hits} + 1`,
+        updatedAt: now
+      }
+    }).run();
+  }
+  if (!isDryRun) {
+    const afterRow = db.select({ n: sql15`count(*)` }).from(rawEventSamples).where(and28(
+      eq35(rawEventSamples.eventType, "unknown"),
+      inArray11(rawEventSamples.projectId, projectIds)
+    )).get();
+    result.unknownAfter = Number(afterRow?.n ?? 0);
+  } else {
+    result.unknownAfter = result.unknownBefore - result.reclassified;
+  }
+  emitTrafficClassificationReport(result, isJson);
+}
+function emitTrafficClassificationReport(result, isJson) {
+  if (isJson) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  const verb = result.dryRun ? "Would re-classify" : "Re-classified";
+  console.log(`
+Traffic classification ${result.dryRun ? "preview" : "recovery"} complete.`);
+  console.log(`  Examined unknowns:   ${result.examined}`);
+  console.log(`  ${verb}:        ${result.reclassified}`);
+  console.log(`  Unknown before:      ${result.unknownBefore}`);
+  console.log(`  Unknown after:       ${result.unknownAfter}`);
+  if (result.reclassified > 0) {
+    console.log(`  By bot:`);
+    const sorted = Object.entries(result.byBot).sort(([, a], [, b]) => b - a);
+    for (const [bot, count] of sorted) {
+      console.log(`    ${count.toString().padStart(5)}  ${bot}`);
+    }
+  }
+  if (result.dryRun) {
+    console.log(`
+No DB writes performed. Re-run without --dry-run to apply.`);
+  }
+}
 
 // src/provider-registry.ts
 var ProviderRegistry = class {
@@ -27569,7 +30484,7 @@ import crypto34 from "crypto";
 import { eq as eq40 } from "drizzle-orm";
 
 // src/agent/session.ts
-import fs12 from "fs";
+import fs14 from "fs";
 import path14 from "path";
 import { Agent } from "@mariozechner/pi-agent-core";
 import { registerBuiltInApiProviders } from "@mariozechner/pi-ai";
@@ -27710,7 +30625,7 @@ function buildAgentProvidersResponse(config) {
 }
 
 // src/agent/skill-paths.ts
-import fs10 from "fs";
+import fs12 from "fs";
 import path12 from "path";
 import { fileURLToPath } from "url";
 function resolveAeroSkillDir(pkgDir) {
@@ -27721,14 +30636,14 @@ function resolveAeroSkillDir(pkgDir) {
     path12.join(here, "../../../../skills/aero")
   ];
   for (const candidate of candidates) {
-    if (fs10.existsSync(path12.join(candidate, "SKILL.md"))) return candidate;
+    if (fs12.existsSync(path12.join(candidate, "SKILL.md"))) return candidate;
   }
   throw new Error(`Aero skill not found. Searched:
   ${candidates.join("\n  ")}`);
 }
 
 // src/agent/skill-tools.ts
-import fs11 from "fs";
+import fs13 from "fs";
 import path13 from "path";
 import { Type } from "@sinclair/typebox";
 var MAX_DOC_CHARS = 2e4;
@@ -27751,12 +30666,12 @@ function parseDescription(body) {
 }
 function scanSkillDocs(skillDir) {
   const refsDir = path13.join(skillDir ?? resolveAeroSkillDir(), "references");
-  if (!fs11.existsSync(refsDir)) return [];
+  if (!fs13.existsSync(refsDir)) return [];
   const entries = [];
-  for (const file of fs11.readdirSync(refsDir)) {
+  for (const file of fs13.readdirSync(refsDir)) {
     if (!file.endsWith(".md")) continue;
     const filePath = path13.join(refsDir, file);
-    const body = fs11.readFileSync(filePath, "utf-8");
+    const body = fs13.readFileSync(filePath, "utf-8");
     entries.push({
       slug: file.replace(/\.md$/, ""),
       description: parseDescription(body),
@@ -27800,7 +30715,7 @@ function buildReadSkillDocTool() {
         });
       }
       const filePath = path13.join(skillDir, "references", `${match.slug}.md`);
-      const content = fs11.readFileSync(filePath, "utf-8");
+      const content = fs13.readFileSync(filePath, "utf-8");
       if (content.length > MAX_DOC_CHARS) {
         return textResult({
           slug: match.slug,
@@ -27894,10 +30809,10 @@ function ensureBuiltinsRegistered() {
 }
 function loadAeroSystemPrompt(pkgDir) {
   const skillDir = resolveAeroSkillDir(pkgDir);
-  const skillBody = fs12.readFileSync(path14.join(skillDir, "SKILL.md"), "utf-8");
+  const skillBody = fs14.readFileSync(path14.join(skillDir, "SKILL.md"), "utf-8");
   const soulPath = path14.join(skillDir, "soul.md");
-  if (!fs12.existsSync(soulPath)) return skillBody;
-  const soulBody = fs12.readFileSync(soulPath, "utf-8");
+  if (!fs14.existsSync(soulPath)) return skillBody;
+  const soulBody = fs14.readFileSync(soulPath, "utf-8");
   return `${soulBody.trimEnd()}
 
 ---
@@ -27955,7 +30870,7 @@ function resolveSessionProviderAndModel(config, opts) {
 
 // src/agent/memory-store.ts
 import crypto33 from "crypto";
-import { and as and31, desc as desc18, eq as eq39, like as like2, sql as sql15 } from "drizzle-orm";
+import { and as and31, desc as desc18, eq as eq39, like as like2, sql as sql16 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto2(row) {
@@ -28041,7 +30956,7 @@ function writeCompactionNote(db, args) {
     ).orderBy(desc18(agentMemory.updatedAt)).all();
     const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
     if (stale.length > 0) {
-      tx.delete(agentMemory).where(sql15`${agentMemory.id} IN (${sql15.join(stale.map((s) => sql15`${s}`), sql15`, `)})`).run();
+      tx.delete(agentMemory).where(sql16`${agentMemory.id} IN (${sql16.join(stale.map((s) => sql16`${s}`), sql16`, `)})`).run();
     }
     const row = tx.select().from(agentMemory).where(and31(eq39(agentMemory.projectId, args.projectId), eq39(agentMemory.key, key))).get();
     if (row) inserted = rowToDto2(row);
@@ -29834,7 +32749,7 @@ async function createServer(opts) {
   jobRunner.onRunCompleted = (runId, projectId) => runCoordinator.onRunCompleted(runId, projectId);
   const snapshotService = new SnapshotService(registry);
   const orphanedOpenClawDir = path15.join(os6.homedir(), ".openclaw-aero");
-  if (fs13.existsSync(orphanedOpenClawDir)) {
+  if (fs15.existsSync(orphanedOpenClawDir)) {
     app.log.warn(
       { path: orphanedOpenClawDir },
       "OpenClaw gateway is no longer used. Remove ~/.openclaw-aero/ manually to reclaim the directory."
@@ -30181,6 +33096,24 @@ async function createServer(opts) {
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
     explainContentRecommendation,
+    // On-disk paths the daemon depends on. The api-routes plugin uses these
+    // to fail loud (HTTP 503) when the operator wipes the DB or config out
+    // from under a running serve — SQLite holds the inode open across
+    // `unlink`, so without this the daemon keeps serving stale data from
+    // an orphaned file and `rm ~/.canonry/data.db` silently does nothing.
+    //
+    // Only attach `configPath` if it actually exists at construction time:
+    // production always boots via `serveCommand`, which calls `loadConfig()`
+    // and would have thrown if the file were missing; tests that construct
+    // `createServer` directly (bypassing `loadConfig`) won't have written
+    // a config and shouldn't get 503s from a stub-missing file.
+    runtimeStatePaths: (() => {
+      const configPath = getConfigPath();
+      return {
+        databasePath: opts.config.database,
+        configPath: fs15.existsSync(configPath) ? configPath : null
+      };
+    })(),
     // Local canonry serve runs on the operator's machine, where pointing a
     // webhook at localhost (Discord test container, Pipedream-mock dev server,
     // etc.) is a legitimate workflow. Default to allowing it for the local
@@ -30553,7 +33486,7 @@ async function createServer(opts) {
   });
   const dirname = path15.dirname(fileURLToPath2(import.meta.url));
   const assetsDir = path15.join(dirname, "..", "assets");
-  if (fs13.existsSync(assetsDir)) {
+  if (fs15.existsSync(assetsDir)) {
     const indexPath = path15.join(assetsDir, "index.html");
     const injectConfig = (html) => {
       const clientConfig = {};
@@ -30586,8 +33519,8 @@ async function createServer(opts) {
       }
     });
     const serveIndex = (_request, reply) => {
-      if (fs13.existsSync(indexPath)) {
-        const html = fs13.readFileSync(indexPath, "utf-8");
+      if (fs15.existsSync(indexPath)) {
+        const html = fs15.readFileSync(indexPath, "utf-8");
         return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Dashboard not built" });
@@ -30607,8 +33540,8 @@ async function createServer(opts) {
       if (basePath && !url.startsWith(basePath)) {
         return reply.status(404).send({ error: "Not found", path: request.url });
       }
-      if (fs13.existsSync(indexPath)) {
-        const html = fs13.readFileSync(indexPath, "utf-8");
+      if (fs15.existsSync(indexPath)) {
+        const html = fs15.readFileSync(indexPath, "utf-8");
         return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Not found" });
@@ -30696,6 +33629,8 @@ export {
   backfillAiReferralPathsCommand,
   backfillAnswerMentionsCommand,
   backfillInsightsCommand,
+  backfillSnapshotAttributionCommand,
+  backfillTrafficClassificationCommand,
   renderReportHtml,
   setGoogleAuthConfig,
   formatAuditFactorScore,