@ainyc/canonry 4.72.4 → 4.75.0

package/dist/{chunk-SRBO33HB.js → chunk-QY5WZWU4.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-ZUBBADMR.js";
+} from "./chunk-WFMEK34V.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -94,8 +94,10 @@ import {
   resolveWebhookTarget,
   runs,
   schedules,
+  siteAuditPages,
+  siteAuditSnapshots,
   usageCounters
-} from "./chunk-HOKVBMOD.js";
+} from "./chunk-JUWU2DV6.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -125,6 +127,7 @@ import {
   agentMemoryDeleteRequestSchema,
   agentMemoryUpsertRequestSchema,
   authInvalid,
+  authRequired,
   buildRunErrorFromMessages,
   classifySkillFile,
   coerceSkillManifest,
@@ -133,6 +136,7 @@ import {
   determineAnswerMentioned,
   effectiveBrandNames,
   effectiveDomains,
+  factorStatusFromScore,
   isAgentProviderId,
   isBrowserProvider,
   isRetryableHttpError,
@@ -145,7 +149,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-JXFNERK4.js";
+} from "./chunk-JNAKRK77.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -433,11 +437,11 @@ function checkLatestVersionForServer(opts) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto17 from "crypto";
+import crypto18 from "crypto";
 import fs8 from "fs";
 import path9 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { and as and13, eq as eq17 } from "drizzle-orm";
+import { and as and13, eq as eq18 } from "drizzle-orm";
 import Fastify from "fastify";
 import os5 from "os";
 
@@ -4065,31 +4069,10 @@ import { eq as eq4, and as and4 } from "drizzle-orm";
 var log4 = createLogger("SitemapParser");
 var LOC_REGEX = /<loc>([^<]+)<\/loc>/gi;
 var SITEMAP_TAG_REGEX = /<sitemap>[\s\S]*?<\/sitemap>/gi;
-var PRIVATE_IP_PATTERNS = [
-  /^169\.254\./,
-  // link-local (AWS metadata endpoint etc.)
-  /^10\./,
-  // private class A
-  /^172\.(1[6-9]|2\d|3[01])\./,
-  // private class B
-  /^192\.168\./
-  // private class C
-];
-function validateSitemapUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid sitemap URL: ${url}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`Sitemap URL must use http or https protocol: ${url}`);
-  }
-  const host = parsed.hostname.toLowerCase();
-  for (const pattern of PRIVATE_IP_PATTERNS) {
-    if (pattern.test(host)) {
-      throw new Error(`Sitemap URL points to a private or reserved IP range: ${url}`);
-    }
+async function validateSitemapUrl(url) {
+  const check = await resolveWebhookTarget(url, { allowLoopback: true });
+  if (!check.ok) {
+    throw new Error(`Sitemap URL rejected: ${check.message.replace(/^"url" /, "")} (${url})`);
   }
 }
 async function readSitemapBody(res) {
@@ -4119,9 +4102,9 @@ async function parseSitemapRecursive(url, urls, visited, depth, isChild) {
   if (depth > 3) return;
   if (visited.has(url)) return;
   visited.add(url);
-  validateSitemapUrl(url);
   let res;
   try {
+    await validateSitemapUrl(url);
     res = await fetch(url);
   } catch (err) {
     if (!isChild) throw err;
@@ -5162,8 +5145,166 @@ function buildDiscoveryInsightTitle(input) {
   return parts.join(" \u2022 ");
 }
 
+// src/execute-site-audit.ts
+import crypto12 from "crypto";
+import { eq as eq10 } from "drizzle-orm";
+import { runSitemapAudit } from "@ainyc/aeo-audit";
+var log11 = createLogger("SiteAudit");
+var SITE_AUDIT_DEFAULT_PAGE_LIMIT = 500;
+var SITE_AUDIT_MAX_PAGE_LIMIT = 2e3;
+function toHomepageUrl(canonicalDomain) {
+  const trimmed = canonicalDomain.trim().replace(/\/+$/, "");
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
+async function assertSiteAuditUrlAllowed(rawUrl, field) {
+  const check = await resolveWebhookTarget(rawUrl);
+  if (!check.ok) {
+    throw new Error(`${field} ${check.message.replace(/^"url" /, "")}`);
+  }
+}
+function clampSiteAuditLimit(limit) {
+  if (limit == null || !Number.isFinite(limit)) return SITE_AUDIT_DEFAULT_PAGE_LIMIT;
+  return Math.max(1, Math.min(SITE_AUDIT_MAX_PAGE_LIMIT, Math.floor(limit)));
+}
+function toPageFactor(factor) {
+  return {
+    id: factor.id,
+    name: factor.name,
+    weight: factor.weight,
+    score: factor.score
+  };
+}
+function computeFactorAverages(pages) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const page of pages) {
+    if (page.status !== "success" || !page.factors) continue;
+    for (const factor of page.factors) {
+      let entry = byId.get(factor.id);
+      if (!entry) {
+        entry = { name: factor.name, weight: factor.weight, scores: [], pass: 0, partial: 0, fail: 0 };
+        byId.set(factor.id, entry);
+      }
+      entry.scores.push(factor.score);
+      const status = factorStatusFromScore(factor.score);
+      if (status === "pass") entry.pass++;
+      else if (status === "partial") entry.partial++;
+      else entry.fail++;
+    }
+  }
+  const summaries = [];
+  for (const [id, entry] of byId) {
+    const avgScore = entry.scores.length ? Math.round(entry.scores.reduce((sum, score) => sum + score, 0) / entry.scores.length) : 0;
+    summaries.push({
+      id,
+      name: entry.name,
+      weight: entry.weight,
+      avgScore,
+      status: factorStatusFromScore(avgScore),
+      pagesPassing: entry.pass,
+      pagesPartial: entry.partial,
+      pagesFailing: entry.fail
+    });
+  }
+  summaries.sort((a, b) => b.weight - a.weight || a.name.localeCompare(b.name));
+  return summaries;
+}
+async function executeSiteAudit(db, runId, projectId, opts = {}) {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  db.update(runs).set({ status: "running", startedAt }).where(eq10(runs.id, runId)).run();
+  try {
+    const project = db.select().from(projects).where(eq10(projects.id, projectId)).get();
+    if (!project) {
+      throw new Error(`Project not found: ${projectId}`);
+    }
+    const homepageUrl = toHomepageUrl(project.canonicalDomain);
+    const limit = clampSiteAuditLimit(opts.limit);
+    log11.info("start", { runId, projectId, homepageUrl, sitemapUrl: opts.sitemapUrl ?? null, limit });
+    await assertSiteAuditUrlAllowed(homepageUrl, "canonicalDomain");
+    if (opts.sitemapUrl) await assertSiteAuditUrlAllowed(opts.sitemapUrl, "sitemapUrl");
+    const report = await runSitemapAudit(homepageUrl, { sitemapUrl: opts.sitemapUrl, limit });
+    const successCount = report.pages.filter((page) => page.status === "success").length;
+    const pagesErrored = report.pages.filter((page) => page.status === "error").length;
+    const auditable = report.pagesDiscovered - report.pagesSkipped;
+    if (auditable > report.pagesAudited) {
+      log11.info("truncated", {
+        runId,
+        projectId,
+        auditable,
+        audited: report.pagesAudited,
+        dropped: auditable - report.pagesAudited,
+        limit
+      });
+    }
+    if (successCount === 0) {
+      throw new Error(
+        `Site audit could not successfully audit any of ${report.pagesAudited} page(s) from ${report.sitemapUrl}.`
+      );
+    }
+    const factorAverages = computeFactorAverages(report.pages);
+    const status = pagesErrored === 0 ? "completed" : "partial";
+    const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    db.transaction((tx) => {
+      tx.insert(siteAuditSnapshots).values({
+        id: crypto12.randomUUID(),
+        projectId,
+        runId,
+        sitemapUrl: report.sitemapUrl,
+        auditedAt: report.auditedAt,
+        aggregateScore: report.aggregateScore,
+        pagesDiscovered: report.pagesDiscovered,
+        pagesAudited: report.pagesAudited,
+        pagesSkipped: report.pagesSkipped,
+        pagesErrored,
+        factorAverages,
+        // aeo-audit v3 enriches these (topIssues, avgGrade-free); keep only the
+        // fields our DTO exposes so the stored JSON stays lean.
+        crossCuttingIssues: report.crossCuttingIssues.map((issue) => ({
+          factorId: issue.factorId,
+          factorName: issue.factorName,
+          avgScore: issue.avgScore,
+          affectedPages: issue.affectedPages,
+          totalPages: issue.totalPages,
+          affectedPct: issue.totalPages > 0 ? Math.round(issue.affectedPages / issue.totalPages * 100) : 0,
+          topRecommendations: issue.topRecommendations
+        })),
+        // v3 prioritizedFixes are structured PrioritizedFix objects; persist the
+        // ready-to-display one-line summary to keep the DTO a string list.
+        prioritizedFixes: report.prioritizedFixes.map((fix) => fix.summary),
+        createdAt: finishedAt
+      }).run();
+      for (const page of report.pages) {
+        tx.insert(siteAuditPages).values({
+          id: crypto12.randomUUID(),
+          projectId,
+          runId,
+          url: page.url,
+          overallScore: page.overallScore,
+          status: page.status,
+          error: page.error ?? null,
+          factors: (page.factors ?? []).map(toPageFactor),
+          createdAt: finishedAt
+        }).run();
+      }
+      tx.update(runs).set({ status, finishedAt }).where(eq10(runs.id, runId)).run();
+    });
+    log11.info("completed", {
+      runId,
+      projectId,
+      status,
+      score: report.aggregateScore,
+      audited: report.pagesAudited,
+      errored: pagesErrored
+    });
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq10(runs.id, runId)).run();
+    log11.error("failed", { runId, projectId, error: errorMsg });
+    throw err;
+  }
+}
+
 // src/commands/backfill.ts
-import { and as and9, eq as eq10, inArray as inArray4, isNull, sql as sql4 } from "drizzle-orm";
+import { and as and9, eq as eq11, inArray as inArray4, isNull, sql as sql4 } from "drizzle-orm";
 var SNAPSHOT_BATCH_SIZE = 500;
 async function backfillAnswerVisibilityCommand(opts) {
   const config = loadConfig();
@@ -5171,7 +5312,7 @@ async function backfillAnswerVisibilityCommand(opts) {
   migrate(db);
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq10(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq11(projects.name, projectFilter)).all() : db.select().from(projects).all();
   let examined = 0;
   let updated = 0;
   let wouldUpdate = 0;
@@ -5180,9 +5321,9 @@ async function backfillAnswerVisibilityCommand(opts) {
   let providerErrors = 0;
   if (scopedProjects.length > 0) {
     const runRows = projectFilter ? db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(and9(
-      eq10(runs.kind, RunKinds["answer-visibility"]),
+      eq11(runs.kind, RunKinds["answer-visibility"]),
       inArray4(runs.projectId, scopedProjects.map((project) => project.id))
-    )).all() : db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(eq10(runs.kind, RunKinds["answer-visibility"])).all();
+    )).all() : db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(eq11(runs.kind, RunKinds["answer-visibility"])).all();
     const runIdsByProject = /* @__PURE__ */ new Map();
     for (const run of runRows) {
       const existing = runIdsByProject.get(run.projectId);
@@ -5190,7 +5331,7 @@ async function backfillAnswerVisibilityCommand(opts) {
       else runIdsByProject.set(run.projectId, [run.id]);
     }
     for (const project of scopedProjects) {
-      const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq10(competitors.projectId, project.id)).all().map((row) => row.domain);
+      const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq11(competitors.projectId, project.id)).all().map((row) => row.domain);
       const runIds = runIdsByProject.get(project.id) ?? [];
       if (runIds.length === 0) continue;
       const projectDomains = effectiveDomains({
@@ -5278,7 +5419,7 @@ async function backfillAnswerVisibilityCommand(opts) {
           } else {
             db.transaction((tx) => {
               for (const update of pendingUpdates) {
-                tx.update(querySnapshots).set(update.patch).where(eq10(querySnapshots.id, update.id)).run();
+                tx.update(querySnapshots).set(update.patch).where(eq11(querySnapshots.id, update.id)).run();
               }
             });
             updated += pendingUpdates.length;
@@ -5327,7 +5468,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
 function backfillNormalizedPaths(db, opts) {
   const baseConditions = [];
   if (opts?.projectId) {
-    baseConditions.push(eq10(gaTrafficSnapshots.projectId, opts.projectId));
+    baseConditions.push(eq11(gaTrafficSnapshots.projectId, opts.projectId));
   }
   const rows = db.select({
     id: gaTrafficSnapshots.id,
@@ -5348,7 +5489,7 @@ function backfillNormalizedPaths(db, opts) {
           unchanged++;
           continue;
         }
-        tx.update(gaTrafficSnapshots).set({ landingPageNormalized: next }).where(eq10(gaTrafficSnapshots.id, row.id)).run();
+        tx.update(gaTrafficSnapshots).set({ landingPageNormalized: next }).where(eq11(gaTrafficSnapshots.id, row.id)).run();
         updated++;
       }
     });
@@ -5362,7 +5503,7 @@ async function backfillNormalizedPathsCommand(opts) {
   const projectFilter = opts?.project?.trim();
   let projectId;
   if (projectFilter) {
-    const project = db.select({ id: projects.id }).from(projects).where(eq10(projects.name, projectFilter)).get();
+    const project = db.select({ id: projects.id }).from(projects).where(eq11(projects.name, projectFilter)).get();
     if (!project) {
       const result2 = {
         project: projectFilter,
@@ -5399,7 +5540,7 @@ async function backfillNormalizedPathsCommand(opts) {
 function backfillAiReferralPaths(db, opts) {
   const baseConditions = [];
   if (opts?.projectId) {
-    baseConditions.push(eq10(gaAiReferrals.projectId, opts.projectId));
+    baseConditions.push(eq11(gaAiReferrals.projectId, opts.projectId));
   }
   const rows = db.select({
     id: gaAiReferrals.id,
@@ -5420,7 +5561,7 @@ function backfillAiReferralPaths(db, opts) {
           unchanged++;
           continue;
         }
-        tx.update(gaAiReferrals).set({ landingPageNormalized: next }).where(eq10(gaAiReferrals.id, row.id)).run();
+        tx.update(gaAiReferrals).set({ landingPageNormalized: next }).where(eq11(gaAiReferrals.id, row.id)).run();
         updated++;
       }
     });
@@ -5434,7 +5575,7 @@ async function backfillAiReferralPathsCommand(opts) {
   const projectFilter = opts?.project?.trim();
   let projectId;
   if (projectFilter) {
-    const project = db.select({ id: projects.id }).from(projects).where(eq10(projects.name, projectFilter)).get();
+    const project = db.select({ id: projects.id }).from(projects).where(eq11(projects.name, projectFilter)).get();
     if (!project) {
       const result2 = {
         project: projectFilter,
@@ -5470,10 +5611,10 @@ async function backfillAiReferralPathsCommand(opts) {
 }
 function backfillProjectAnswerMentions(db, projectId, opts) {
   const isDryRun = opts?.dryRun === true;
-  const project = db.select().from(projects).where(eq10(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq11(projects.id, projectId)).get();
   if (!project) return { examined: 0, updated: 0, mentioned: 0 };
-  const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq10(competitors.projectId, projectId)).all().map((row) => row.domain);
-  const runRows = db.select({ id: runs.id }).from(runs).where(and9(eq10(runs.kind, RunKinds["answer-visibility"]), eq10(runs.projectId, projectId))).all();
+  const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq11(competitors.projectId, projectId)).all().map((row) => row.domain);
+  const runRows = db.select({ id: runs.id }).from(runs).where(and9(eq11(runs.kind, RunKinds["answer-visibility"]), eq11(runs.projectId, projectId))).all();
   const runIds = runRows.map((r) => r.id);
   let examined = 0;
   let updated = 0;
@@ -5545,7 +5686,7 @@ function backfillProjectAnswerMentions(db, projectId, opts) {
       } else {
         db.transaction((tx) => {
           for (const update of pendingUpdates) {
-            tx.update(querySnapshots).set(update.patch).where(eq10(querySnapshots.id, update.id)).run();
+            tx.update(querySnapshots).set(update.patch).where(eq11(querySnapshots.id, update.id)).run();
           }
         });
         updated += pendingUpdates.length;
@@ -5560,7 +5701,7 @@ async function backfillAnswerMentionsCommand(opts) {
   migrate(db);
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq10(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq11(projects.name, projectFilter)).all() : db.select().from(projects).all();
   let examined = 0;
   let updated = 0;
   let wouldUpdate = 0;
@@ -5620,7 +5761,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-CSW4R4I7.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-L2A5MFB4.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -5779,7 +5920,7 @@ async function backfillSnapshotAttributionCommand(opts) {
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
-  const project = db.select().from(projects).where(eq10(projects.name, opts.project)).get();
+  const project = db.select().from(projects).where(eq11(projects.name, opts.project)).get();
   if (!project) {
     throw new Error(`Project "${opts.project}" not found`);
   }
@@ -5791,7 +5932,7 @@ async function backfillSnapshotAttributionCommand(opts) {
 `);
   }
   const events = db.select({ createdAt: auditLog.createdAt, action: auditLog.action, diff: auditLog.diff }).from(auditLog).where(and9(
-    eq10(auditLog.projectId, project.id),
+    eq11(auditLog.projectId, project.id),
     inArray4(auditLog.action, ["keywords.appended", "keywords.deleted", "queries.appended", "queries.deleted", "queries.replaced"])
   )).orderBy(auditLog.createdAt).all();
   const history = replayQueryAuditLog(events);
@@ -5799,8 +5940,8 @@ async function backfillSnapshotAttributionCommand(opts) {
     runId: runs.id,
     createdAt: runs.createdAt,
     location: runs.location
-  }).from(runs).innerJoin(querySnapshots, eq10(querySnapshots.runId, runs.id)).where(and9(
-    eq10(runs.projectId, project.id),
+  }).from(runs).innerJoin(querySnapshots, eq11(querySnapshots.runId, runs.id)).where(and9(
+    eq11(runs.projectId, project.id),
     isNull(querySnapshots.queryId),
     isNull(querySnapshots.queryText)
   )).groupBy(runs.id).orderBy(runs.createdAt).all();
@@ -5823,7 +5964,7 @@ async function backfillSnapshotAttributionCommand(opts) {
       createdAt: querySnapshots.createdAt,
       answerText: querySnapshots.answerText
     }).from(querySnapshots).where(and9(
-      eq10(querySnapshots.runId, run.runId),
+      eq11(querySnapshots.runId, run.runId),
       isNull(querySnapshots.queryId),
       isNull(querySnapshots.queryText)
     )).orderBy(querySnapshots.provider, querySnapshots.createdAt).all();
@@ -5889,7 +6030,7 @@ async function backfillSnapshotAttributionCommand(opts) {
   if (!isDryRun && updates.length > 0) {
     db.transaction((tx) => {
       for (const u of updates) {
-        tx.update(querySnapshots).set({ queryText: u.queryText }).where(eq10(querySnapshots.id, u.id)).run();
+        tx.update(querySnapshots).set({ queryText: u.queryText }).where(eq11(querySnapshots.id, u.id)).run();
       }
     });
   }
@@ -5963,7 +6104,7 @@ async function backfillTrafficClassificationCommand(opts) {
   const projectFilter = opts?.project?.trim();
   const isDryRun = opts?.dryRun === true;
   const isJson = isMachineFormat(opts?.format);
-  const scopedProjects = projectFilter ? db.select().from(projects).where(eq10(projects.name, projectFilter)).all() : db.select().from(projects).all();
+  const scopedProjects = projectFilter ? db.select().from(projects).where(eq11(projects.name, projectFilter)).all() : db.select().from(projects).all();
   if (scopedProjects.length === 0) {
     if (projectFilter && !isJson) {
       process.stderr.write(`No project named "${projectFilter}".
@@ -5989,7 +6130,7 @@ async function backfillTrafficClassificationCommand(opts) {
     byBot: {}
   };
   const unknownCountRow = db.select({ n: sql4`count(*)` }).from(rawEventSamples).where(and9(
-    eq10(rawEventSamples.eventType, "unknown"),
+    eq11(rawEventSamples.eventType, "unknown"),
     inArray4(rawEventSamples.projectId, projectIds)
   )).get();
   result.unknownBefore = Number(unknownCountRow?.n ?? 0);
@@ -6002,7 +6143,7 @@ async function backfillTrafficClassificationCommand(opts) {
     pathNormalized: rawEventSamples.pathNormalized,
     status: rawEventSamples.status
   }).from(rawEventSamples).where(and9(
-    eq10(rawEventSamples.eventType, "unknown"),
+    eq11(rawEventSamples.eventType, "unknown"),
     inArray4(rawEventSamples.projectId, projectIds)
   )).all();
   result.examined = unknownSamples.length;
@@ -6041,7 +6182,7 @@ async function backfillTrafficClassificationCommand(opts) {
     result.reclassified++;
     result.byBot[classified.botId] = (result.byBot[classified.botId] ?? 0) + 1;
     if (isDryRun) continue;
-    db.update(rawEventSamples).set({ eventType: userFetch ? TrafficEventKinds["ai-user-fetch"] : TrafficEventKinds.crawler }).where(eq10(rawEventSamples.id, snap.id)).run();
+    db.update(rawEventSamples).set({ eventType: userFetch ? TrafficEventKinds["ai-user-fetch"] : TrafficEventKinds.crawler }).where(eq11(rawEventSamples.id, snap.id)).run();
     const tsHour = new Date(snap.ts);
     tsHour.setUTCMinutes(0, 0, 0);
     if (userFetch) {
@@ -6106,7 +6247,7 @@ async function backfillTrafficClassificationCommand(opts) {
   }
   if (!isDryRun) {
     const afterRow = db.select({ n: sql4`count(*)` }).from(rawEventSamples).where(and9(
-      eq10(rawEventSamples.eventType, "unknown"),
+      eq11(rawEventSamples.eventType, "unknown"),
       inArray4(rawEventSamples.projectId, projectIds)
     )).get();
     result.unknownAfter = Number(afterRow?.n ?? 0);
@@ -6141,7 +6282,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
 }
 
 // src/commands/skills.ts
-import crypto12 from "crypto";
+import crypto13 from "crypto";
 import fs4 from "fs";
 import os4 from "os";
 import path5 from "path";
@@ -6196,7 +6337,7 @@ function walkRelative(dir, prefix = "") {
   return out.sort();
 }
 function sha256File(filePath) {
-  return crypto12.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
+  return crypto13.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
 }
 function readSkillManifest(skillDir) {
   try {
@@ -6519,10 +6660,10 @@ var ProviderRegistry = class {
 };
 
 // src/scheduler.ts
-import crypto13 from "crypto";
+import crypto14 from "crypto";
 import cron from "node-cron";
-import { and as and10, eq as eq11 } from "drizzle-orm";
-var log11 = createLogger("Scheduler");
+import { and as and10, eq as eq12, inArray as inArray5 } from "drizzle-orm";
+var log12 = createLogger("Scheduler");
 function taskKey(projectId, kind) {
   return `${projectId}::${kind}`;
 }
@@ -6536,16 +6677,16 @@ var Scheduler = class {
   }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq11(schedules.enabled, true)).all();
+    const allSchedules = this.db.select().from(schedules).where(eq12(schedules.enabled, true)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
       if (missedRunAt && new Date(missedRunAt) < /* @__PURE__ */ new Date()) {
-        log11.info("run.catch-up", { projectId: schedule.projectId, kind: schedule.kind, missedRunAt });
+        log12.info("run.catch-up", { projectId: schedule.projectId, kind: schedule.kind, missedRunAt });
         this.triggerRun(schedule.id, schedule.projectId, schedule.kind);
       }
     }
-    log11.info("started", { scheduleCount: allSchedules.length });
+    log12.info("started", { scheduleCount: allSchedules.length });
   }
   /** Stop all cron tasks for graceful shutdown. */
   stop() {
@@ -6566,7 +6707,7 @@ var Scheduler = class {
       this.stopTask(key, existing, "Stopped");
       this.tasks.delete(key);
     }
-    const schedule = this.db.select().from(schedules).where(and10(eq11(schedules.projectId, projectId), eq11(schedules.kind, kind))).get();
+    const schedule = this.db.select().from(schedules).where(and10(eq12(schedules.projectId, projectId), eq12(schedules.kind, kind))).get();
     if (schedule && schedule.enabled) {
       this.registerCronTask(schedule);
     }
@@ -6589,13 +6730,13 @@ var Scheduler = class {
   stopTask(key, task, verb) {
     void task.stop();
     void task.destroy();
-    log11.info(`task.${verb.toLowerCase()}`, { key });
+    log12.info(`task.${verb.toLowerCase()}`, { key });
   }
   registerCronTask(schedule) {
     const { id: scheduleId, projectId, cronExpr, timezone } = schedule;
     const kind = schedule.kind;
     if (!cron.validate(cronExpr)) {
-      log11.error("cron.invalid", { projectId, kind, cronExpr });
+      log12.error("cron.invalid", { projectId, kind, cronExpr });
       return;
     }
     const task = cron.schedule(cronExpr, () => {
@@ -6607,51 +6748,51 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: nextRunFromCron(cronExpr, timezone),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq11(schedules.id, scheduleId)).run();
+    }).where(eq12(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
-    log11.info("cron.registered", { projectId, kind, schedule: label, timezone });
+    log12.info("cron.registered", { projectId, kind, schedule: label, timezone });
   }
   triggerRun(scheduleId, projectId, kind) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const currentSchedule = this.db.select().from(schedules).where(eq11(schedules.id, scheduleId)).get();
+      const currentSchedule = this.db.select().from(schedules).where(eq12(schedules.id, scheduleId)).get();
       if (!currentSchedule || !currentSchedule.enabled) {
-        log11.warn("schedule.stale", { scheduleId, projectId, kind, msg: "schedule no longer exists or is disabled" });
+        log12.warn("schedule.stale", { scheduleId, projectId, kind, msg: "schedule no longer exists or is disabled" });
         this.remove(projectId, kind);
         return;
       }
       const nextRunAt = nextRunFromCron(currentSchedule.cronExpr, currentSchedule.timezone);
-      const project = this.db.select().from(projects).where(eq11(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq12(projects.id, projectId)).get();
       if (!project) {
-        log11.error("project.not-found", { projectId, kind, msg: "skipping scheduled run" });
+        log12.error("project.not-found", { projectId, kind, msg: "skipping scheduled run" });
         this.remove(projectId, kind);
         return;
       }
       if (kind === SchedulableRunKinds["traffic-sync"]) {
         const sourceId = currentSchedule.sourceId;
         if (!sourceId) {
-          log11.warn("traffic-sync.missing-source", { scheduleId, projectId });
+          log12.warn("traffic-sync.missing-source", { scheduleId, projectId });
           return;
         }
         if (!this.callbacks.onTrafficSyncRequested) {
-          log11.warn("traffic-sync.no-callback", { scheduleId, projectId, msg: "host did not register onTrafficSyncRequested" });
+          log12.warn("traffic-sync.no-callback", { scheduleId, projectId, msg: "host did not register onTrafficSyncRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq11(schedules.id, currentSchedule.id)).run();
-        log11.info("traffic-sync.triggered", { projectName: project.name, sourceId });
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
+        log12.info("traffic-sync.triggered", { projectName: project.name, sourceId });
         this.callbacks.onTrafficSyncRequested(project.name, sourceId);
         return;
       }
       if (kind === SchedulableRunKinds["gbp-sync"]) {
         if (!this.callbacks.onGbpSyncRequested) {
-          log11.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
+          log12.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
           return;
         }
-        const runId2 = crypto13.randomUUID();
+        const runId2 = crypto14.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -6664,45 +6805,78 @@ var Scheduler = class {
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq11(schedules.id, currentSchedule.id)).run();
-        log11.info("gbp-sync.triggered", { runId: runId2, projectName: project.name });
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
+        log12.info("gbp-sync.triggered", { runId: runId2, projectName: project.name });
         this.callbacks.onGbpSyncRequested(runId2, projectId);
         return;
       }
       if (kind === SchedulableRunKinds["data-refresh"]) {
         if (!this.callbacks.onDataRefreshRequested) {
-          log11.warn("data-refresh.no-callback", { scheduleId, projectId, msg: "host did not register onDataRefreshRequested" });
+          log12.warn("data-refresh.no-callback", { scheduleId, projectId, msg: "host did not register onDataRefreshRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq11(schedules.id, currentSchedule.id)).run();
-        log11.info("data-refresh.triggered", { projectName: project.name });
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
+        log12.info("data-refresh.triggered", { projectName: project.name });
         this.callbacks.onDataRefreshRequested(project.name);
         return;
       }
       if (kind === SchedulableRunKinds["backlinks-sync"]) {
         if (!this.callbacks.onBacklinksSyncRequested) {
-          log11.warn("backlinks-sync.no-callback", { scheduleId, projectId, msg: "host did not register onBacklinksSyncRequested" });
+          log12.warn("backlinks-sync.no-callback", { scheduleId, projectId, msg: "host did not register onBacklinksSyncRequested" });
           return;
         }
         this.db.update(schedules).set({
           lastRunAt: now,
           nextRunAt,
           updatedAt: now
-        }).where(eq11(schedules.id, currentSchedule.id)).run();
-        log11.info("backlinks-sync.triggered", { projectName: project.name });
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
+        log12.info("backlinks-sync.triggered", { projectName: project.name });
         this.callbacks.onBacklinksSyncRequested(project.name);
         return;
       }
+      if (kind === SchedulableRunKinds["site-audit"]) {
+        if (!this.callbacks.onSiteAuditRequested) {
+          log12.warn("site-audit.no-callback", { scheduleId, projectId, msg: "host did not register onSiteAuditRequested" });
+          return;
+        }
+        const active = this.db.select({ id: runs.id }).from(runs).where(and10(
+          eq12(runs.projectId, projectId),
+          eq12(runs.kind, RunKinds["site-audit"]),
+          inArray5(runs.status, [RunStatuses.queued, RunStatuses.running])
+        )).get();
+        if (active) {
+          log12.info("site-audit.skipped-active", { projectName: project.name, activeRunId: active.id });
+          this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq12(schedules.id, currentSchedule.id)).run();
+          return;
+        }
+        const runId2 = crypto14.randomUUID();
+        this.db.insert(runs).values({
+          id: runId2,
+          projectId,
+          kind: RunKinds["site-audit"],
+          status: RunStatuses.queued,
+          trigger: RunTriggers.scheduled,
+          createdAt: now
+        }).run();
+        this.db.update(schedules).set({
+          lastRunAt: now,
+          nextRunAt,
+          updatedAt: now
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
+        log12.info("site-audit.triggered", { runId: runId2, projectName: project.name });
+        this.callbacks.onSiteAuditRequested(runId2, projectId);
+        return;
+      }
       const projectLocations = project.locations;
       let resolvedLocation;
       if (project.defaultLocation) {
         const loc = projectLocations.find((l) => l.label === project.defaultLocation);
         if (!loc) {
-          log11.warn("default-location.stale", { scheduleId, projectId, label: project.defaultLocation });
+          log12.warn("default-location.stale", { scheduleId, projectId, label: project.defaultLocation });
           return;
         }
         resolvedLocation = loc;
@@ -6716,11 +6890,11 @@ var Scheduler = class {
         location: locationLabel
       });
       if (queueResult.conflict) {
-        log11.info("run.skipped-active", { projectName: project.name, activeRunId: queueResult.activeRunId });
+        log12.info("run.skipped-active", { projectName: project.name, activeRunId: queueResult.activeRunId });
         this.db.update(schedules).set({
           nextRunAt,
           updatedAt: now
-        }).where(eq11(schedules.id, currentSchedule.id)).run();
+        }).where(eq12(schedules.id, currentSchedule.id)).run();
         return;
       }
       const runId = queueResult.runId;
@@ -6728,19 +6902,19 @@ var Scheduler = class {
         lastRunAt: now,
         nextRunAt,
         updatedAt: now
-      }).where(eq11(schedules.id, currentSchedule.id)).run();
+      }).where(eq12(schedules.id, currentSchedule.id)).run();
       const scheduleProviders = currentSchedule.providers;
       const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
-      log11.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
+      log12.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
       this.callbacks.onRunCreated(runId, projectId, providers, resolvedLocation);
     } catch (err) {
-      log11.error("trigger.error", { scheduleId, projectId, kind, error: err instanceof Error ? err.message : String(err) });
+      log12.error("trigger.error", { scheduleId, projectId, kind, error: err instanceof Error ? err.message : String(err) });
     }
   }
 };
 
 // src/data-refresh.ts
-var log12 = createLogger("DataRefresh");
+var log13 = createLogger("DataRefresh");
 async function refreshAllIntegrations(client, projectName) {
   const integrations = [
     { name: "gsc", run: () => client.gscSync(projectName, {}) },
@@ -6752,19 +6926,19 @@ async function refreshAllIntegrations(client, projectName) {
   results.forEach((result, idx) => {
     const integration = integrations[idx].name;
     if (result.status === "fulfilled") {
-      log12.info("integration.refreshed", { projectName, integration });
+      log13.info("integration.refreshed", { projectName, integration });
     } else {
       const reason = result.reason;
       const message = reason instanceof Error ? reason.message : String(reason);
-      log12.warn("integration.refresh-failed", { projectName, integration, error: message });
+      log13.warn("integration.refresh-failed", { projectName, integration, error: message });
     }
   });
 }
 
 // src/notifier.ts
-import { eq as eq12, desc as desc5, and as and11, inArray as inArray5, or } from "drizzle-orm";
-import crypto14 from "crypto";
-var log13 = createLogger("Notifier");
+import { eq as eq13, desc as desc5, and as and11, inArray as inArray6, or } from "drizzle-orm";
+import crypto15 from "crypto";
+var log14 = createLogger("Notifier");
 var Notifier = class {
   db;
   serverUrl;
@@ -6774,26 +6948,26 @@ var Notifier = class {
   }
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
-    log13.info("run.completed", { runId, projectId });
-    const notifs = this.db.select().from(notifications).where(eq12(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    log14.info("run.completed", { runId, projectId });
+    const notifs = this.db.select().from(notifications).where(eq13(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) {
-      log13.info("notifications.none-enabled", { projectId });
+      log14.info("notifications.none-enabled", { projectId });
       return;
     }
-    log13.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq12(runs.id, runId)).get();
+    log14.info("notifications.found", { projectId, count: notifs.length });
+    const run = this.db.select().from(runs).where(eq13(runs.id, runId)).get();
     if (!run) {
-      log13.error("run.not-found", { runId, msg: "skipping notification dispatch" });
+      log14.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq12(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq13(projects.id, projectId)).get();
     if (!project) {
-      log13.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
+      log14.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
     }
     const transitions = this.computeTransitions(runId, projectId);
     const events = [];
-    log13.info("run.status", { runId: run.id, status: run.status, projectId });
+    log14.info("run.status", { runId: run.id, status: run.status, projectId });
     if (run.status === "completed" || run.status === "partial") {
       events.push("run.completed");
     }
@@ -6809,7 +6983,7 @@ var Notifier = class {
       if (!config.url) continue;
       const subscribedEvents = config.events;
       const matchingEvents = events.filter((e) => subscribedEvents.includes(e));
-      log13.info("notification.match", { notificationId: notif.id, subscribedEvents, matchedEvents: matchingEvents });
+      log14.info("notification.match", { notificationId: notif.id, subscribedEvents, matchedEvents: matchingEvents });
       if (matchingEvents.length === 0) continue;
       for (const event of matchingEvents) {
         const relevantTransitions = event === "citation.lost" ? lostTransitions : event === "citation.gained" ? gainedTransitions : transitions;
@@ -6833,11 +7007,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq12(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    const notifs = this.db.select().from(notifications).where(eq13(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq12(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq13(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq12(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq13(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = notif.config;
@@ -6867,12 +7041,12 @@ var Notifier = class {
     }
   }
   computeTransitions(runId, projectId) {
-    const thisRun = this.db.select().from(runs).where(eq12(runs.id, runId)).get();
+    const thisRun = this.db.select().from(runs).where(eq13(runs.id, runId)).get();
     if (!thisRun) return [];
     const groupSiblings = this.db.select().from(runs).where(and11(
-      eq12(runs.projectId, projectId),
-      eq12(runs.kind, thisRun.kind),
-      eq12(runs.createdAt, thisRun.createdAt)
+      eq13(runs.projectId, projectId),
+      eq13(runs.kind, thisRun.kind),
+      eq13(runs.createdAt, thisRun.createdAt)
     )).all();
     const stillPending = groupSiblings.some((r) => r.status === "queued" || r.status === "running");
     if (stillPending) return [];
@@ -6888,7 +7062,7 @@ var Notifier = class {
       return candidate.id > best.id ? candidate : best;
     });
     if (winner.id !== runId) return [];
-    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq12(projects.id, projectId)).get();
+    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq13(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectLocations?.locations ?? []).length
@@ -6896,9 +7070,9 @@ var Notifier = class {
     const RECENT_FETCH_LIMIT = Math.max(8, locationCount * 4);
     const recentRuns = this.db.select().from(runs).where(
       and11(
-        eq12(runs.projectId, projectId),
-        eq12(runs.kind, thisRun.kind),
-        or(eq12(runs.status, "completed"), eq12(runs.status, "partial"))
+        eq13(runs.projectId, projectId),
+        eq13(runs.kind, thisRun.kind),
+        or(eq13(runs.status, "completed"), eq13(runs.status, "partial"))
       )
     ).orderBy(desc5(runs.createdAt), desc5(runs.id)).limit(RECENT_FETCH_LIMIT).all();
     const groups = groupRunsByCreatedAt(recentRuns);
@@ -6915,13 +7089,13 @@ var Notifier = class {
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(queries, eq12(querySnapshots.queryId, queries.id)).where(inArray5(querySnapshots.runId, currentRunIds)).all();
+    }).from(querySnapshots).leftJoin(queries, eq13(querySnapshots.queryId, queries.id)).where(inArray6(querySnapshots.runId, currentRunIds)).all();
     const previousSnapshots = this.db.select({
       queryId: querySnapshots.queryId,
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).where(inArray5(querySnapshots.runId, previousRunIds)).all();
+    }).from(querySnapshots).where(inArray6(querySnapshots.runId, previousRunIds)).all();
     const prevMap = /* @__PURE__ */ new Map();
     for (const s of previousSnapshots) {
       if (s.queryId == null) continue;
@@ -6948,23 +7122,23 @@ var Notifier = class {
     const targetLabel = redactNotificationUrl(url).urlDisplay;
     const targetCheck = await resolveWebhookTarget(url);
     if (!targetCheck.ok) {
-      log13.error("webhook.ssrf-blocked", { url: targetLabel, reason: targetCheck.message });
+      log14.error("webhook.ssrf-blocked", { url: targetLabel, reason: targetCheck.message });
       this.logDelivery(projectId, notificationId, payload.event, "failed", `SSRF: ${targetCheck.message}`);
       return;
     }
-    log13.info("webhook.send", { event: payload.event, url: targetLabel });
+    log14.info("webhook.send", { event: payload.event, url: targetLabel });
     const maxRetries = 3;
     const delays = [1e3, 4e3, 16e3];
     for (let attempt = 0; attempt < maxRetries; attempt++) {
       try {
         const response = await deliverWebhook(targetCheck.target, payload, webhookSecret);
         if (response.status >= 200 && response.status < 300) {
-          log13.info("webhook.delivered", { event: payload.event, url: targetLabel, httpStatus: response.status });
+          log14.info("webhook.delivered", { event: payload.event, url: targetLabel, httpStatus: response.status });
           this.logDelivery(projectId, notificationId, payload.event, "sent", null);
           return;
         }
         const errorDetail = response.error ?? `HTTP ${response.status}`;
-        log13.warn("webhook.attempt-failed", { event: payload.event, url: targetLabel, attempt: attempt + 1, maxRetries, httpStatus: response.status, error: errorDetail });
+        log14.warn("webhook.attempt-failed", { event: payload.event, url: targetLabel, attempt: attempt + 1, maxRetries, httpStatus: response.status, error: errorDetail });
         if (attempt === maxRetries - 1) {
           this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
         }
@@ -6972,7 +7146,7 @@ var Notifier = class {
         const errorDetail = err instanceof Error ? err.message : String(err);
         if (attempt === maxRetries - 1) {
           this.logDelivery(projectId, notificationId, payload.event, "failed", errorDetail);
-          log13.error("webhook.exhausted", { event: payload.event, url: targetLabel, maxRetries, error: errorDetail });
+          log14.error("webhook.exhausted", { event: payload.event, url: targetLabel, maxRetries, error: errorDetail });
         }
       }
       if (attempt < maxRetries - 1) {
@@ -6982,7 +7156,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto14.randomUUID(),
+      id: crypto15.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -6995,8 +7169,8 @@ var Notifier = class {
 };
 
 // src/run-coordinator.ts
-import { eq as eq13 } from "drizzle-orm";
-var log14 = createLogger("RunCoordinator");
+import { eq as eq14 } from "drizzle-orm";
+var log15 = createLogger("RunCoordinator");
 var RunCoordinator = class {
   constructor(db, notifier, intelligenceService, onInsightsGenerated, onAeroEvent) {
     this.db = db;
@@ -7006,10 +7180,10 @@ var RunCoordinator = class {
     this.onAeroEvent = onAeroEvent;
   }
   async onRunCompleted(runId, projectId) {
-    const runRow = this.db.select().from(runs).where(eq13(runs.id, runId)).get();
+    const runRow = this.db.select().from(runs).where(eq14(runs.id, runId)).get();
     const kind = runRow?.kind ?? RunKinds["answer-visibility"];
     if (runRow?.trigger === RunTriggers.probe) {
-      log14.info("probe.skip-side-effects", { runId, projectId, kind });
+      log15.info("probe.skip-side-effects", { runId, projectId, kind });
       return;
     }
     let insightCount = 0;
@@ -7026,12 +7200,12 @@ var RunCoordinator = class {
             try {
               await this.onInsightsGenerated(runId, projectId, result);
             } catch (err) {
-              log14.error("insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+              log15.error("insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
             }
           }
         }
       } catch (err) {
-        log14.error("intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log15.error("intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     } else if (kind === RunKinds["gbp-sync"]) {
       try {
@@ -7044,17 +7218,17 @@ var RunCoordinator = class {
           try {
             await this.onInsightsGenerated(runId, projectId, analysisResultFromInsights(gbpInsights));
           } catch (err) {
-            log14.error("gbp-insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+            log15.error("gbp-insight-webhook.failed", { runId, error: err instanceof Error ? err.message : String(err) });
           }
         }
       } catch (err) {
-        log14.error("gbp-intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log15.error("gbp-intelligence.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     }
     try {
       await this.notifier.onRunCompleted(runId, projectId);
     } catch (err) {
-      log14.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+      log15.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
     }
     if (this.onAeroEvent) {
       try {
@@ -7067,7 +7241,7 @@ var RunCoordinator = class {
         };
         await this.onAeroEvent(ctx);
       } catch (err) {
-        log14.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+        log15.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
       }
     }
   }
@@ -7082,7 +7256,7 @@ var RunCoordinator = class {
    * so the Aero queue is never starved of a follow-up.
    */
   buildDiscoveryAeroContext(runId, projectId, status, error) {
-    const session = this.db.select().from(discoverySessions).where(eq13(discoverySessions.runId, runId)).get();
+    const session = this.db.select().from(discoverySessions).where(eq14(discoverySessions.runId, runId)).get();
     const competitorMap = session ? session.competitorMap : [];
     return {
       kind: RunKinds["aeo-discover-probe"],
@@ -7122,8 +7296,8 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto16 from "crypto";
-import { eq as eq15 } from "drizzle-orm";
+import crypto17 from "crypto";
+import { eq as eq16 } from "drizzle-orm";
 
 // src/agent/session.ts
 import fs7 from "fs";
@@ -7511,8 +7685,8 @@ function resolveSessionProviderAndModel(config, opts) {
 }
 
 // src/agent/memory-store.ts
-import crypto15 from "crypto";
-import { and as and12, desc as desc6, eq as eq14, like, sql as sql5 } from "drizzle-orm";
+import crypto16 from "crypto";
+import { and as and12, desc as desc6, eq as eq15, like, sql as sql5 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto(row) {
@@ -7526,7 +7700,7 @@ function rowToDto(row) {
   };
 }
 function listMemoryEntries(db, projectId, opts = {}) {
-  const query = db.select().from(agentMemory).where(eq14(agentMemory.projectId, projectId)).orderBy(desc6(agentMemory.updatedAt));
+  const query = db.select().from(agentMemory).where(eq15(agentMemory.projectId, projectId)).orderBy(desc6(agentMemory.updatedAt));
   const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
   return rows.map(rowToDto);
 }
@@ -7540,7 +7714,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto15.randomUUID();
+  const id = crypto16.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -7557,12 +7731,12 @@ function upsertMemoryEntry(db, args) {
       updatedAt: now
     }
   }).run();
-  const row = db.select().from(agentMemory).where(and12(eq14(agentMemory.projectId, args.projectId), eq14(agentMemory.key, args.key))).get();
+  const row = db.select().from(agentMemory).where(and12(eq15(agentMemory.projectId, args.projectId), eq15(agentMemory.key, args.key))).get();
   if (!row) throw new Error("memory upsert produced no row");
   return rowToDto(row);
 }
 function deleteMemoryEntry(db, projectId, key) {
-  const result = db.delete(agentMemory).where(and12(eq14(agentMemory.projectId, projectId), eq14(agentMemory.key, key))).run();
+  const result = db.delete(agentMemory).where(and12(eq15(agentMemory.projectId, projectId), eq15(agentMemory.key, key))).run();
   const changes = result.changes ?? 0;
   return changes > 0;
 }
@@ -7577,7 +7751,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto15.randomUUID();
+  const id = crypto16.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -7592,7 +7766,7 @@ function writeCompactionNote(db, args) {
     const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
     const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
       and12(
-        eq14(agentMemory.projectId, args.projectId),
+        eq15(agentMemory.projectId, args.projectId),
         like(agentMemory.key, `${sessionPrefix}%`)
       )
     ).orderBy(desc6(agentMemory.updatedAt)).all();
@@ -7600,7 +7774,7 @@ function writeCompactionNote(db, args) {
     if (stale.length > 0) {
       tx.delete(agentMemory).where(sql5`${agentMemory.id} IN (${sql5.join(stale.map((s) => sql5`${s}`), sql5`, `)})`).run();
     }
-    const row = tx.select().from(agentMemory).where(and12(eq14(agentMemory.projectId, args.projectId), eq14(agentMemory.key, key))).get();
+    const row = tx.select().from(agentMemory).where(and12(eq15(agentMemory.projectId, args.projectId), eq15(agentMemory.key, key))).get();
     if (row) inserted = rowToDto(row);
   });
   if (!inserted) throw new Error("compaction note write produced no row");
@@ -7733,7 +7907,7 @@ async function compactMessages(args) {
 }
 
 // src/agent/session-registry.ts
-var log15 = createLogger("SessionRegistry");
+var log16 = createLogger("SessionRegistry");
 var MAX_HYDRATE_NOTES = 20;
 var MAX_HYDRATE_BYTES = 32 * 1024;
 function escapeMemoryFragment(value) {
@@ -7782,7 +7956,7 @@ var SessionRegistry = class {
           modelProvider: effectiveProvider,
           modelId: effectiveModelId,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(eq15(agentSessions.projectId, projectId)).run();
+        }).where(eq16(agentSessions.projectId, projectId)).run();
       }
       const agent2 = createAeroSession({
         projectName,
@@ -7960,13 +8134,13 @@ ${lines.join("\n")}
       agent.state.messages = result.messages;
       agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
       this.save(projectName);
-      log15.info("compaction.completed", {
+      log16.info("compaction.completed", {
         projectName,
         removedCount: result.removedCount,
         summaryBytes: Buffer.byteLength(result.summary, "utf8")
       });
     } catch (err) {
-      log15.error("compaction.failed", {
+      log16.error("compaction.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -7996,7 +8170,7 @@ ${lines.join("\n")}
       modelProvider: nextProvider,
       modelId: nextModelId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq15(agentSessions.projectId, projectId)).run();
+    }).where(eq16(agentSessions.projectId, projectId)).run();
   }
   /** Persist a session's transcript back to the DB. Call after any run settles. */
   save(projectName) {
@@ -8063,7 +8237,7 @@ ${lines.join("\n")}
       await agent.prompt(msgs);
       this.save(projectName);
     } catch (err) {
-      log15.error("drain.failed", {
+      log16.error("drain.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -8158,17 +8332,17 @@ ${lines.join("\n")}
     return id;
   }
   tryResolveProjectId(projectName) {
-    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq15(projects.name, projectName)).get();
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq16(projects.name, projectName)).get();
     return row?.id;
   }
   loadRow(projectId) {
-    const row = this.opts.db.select().from(agentSessions).where(eq15(agentSessions.projectId, projectId)).get();
+    const row = this.opts.db.select().from(agentSessions).where(eq16(agentSessions.projectId, projectId)).get();
     return row ?? null;
   }
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: crypto16.randomUUID(),
+      id: crypto17.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -8181,14 +8355,14 @@ ${lines.join("\n")}
   }
   updateRow(projectId, patch) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq15(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq16(agentSessions.projectId, projectId)).run();
   }
 };
 
 // src/agent/agent-routes.ts
-import { eq as eq16 } from "drizzle-orm";
+import { eq as eq17 } from "drizzle-orm";
 function resolveProject(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq16(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq17(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -8197,7 +8371,7 @@ function registerAgentRoutes(app, opts) {
     "/projects/:name/agent/transcript",
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq16(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq17(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -8221,7 +8395,7 @@ function registerAgentRoutes(app, opts) {
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq16(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq17(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -8661,7 +8835,7 @@ function formatAuditFactorScore(factor) {
 }
 
 // src/snapshot-service.ts
-var log16 = createLogger("Snapshot");
+var log17 = createLogger("Snapshot");
 var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
 var SNAPSHOT_QUERY_COUNT = 6;
 var ProviderExecutionGate2 = class {
@@ -8804,13 +8978,12 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log16.warn("audit.failed", { homepageUrl, error: message });
+      log17.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
         auditedAt: (/* @__PURE__ */ new Date()).toISOString(),
         overallScore: 0,
-        overallGrade: "N/A",
         summary: `Technical audit unavailable: ${message}`,
         factors: []
       };
@@ -8834,7 +9007,7 @@ var SnapshotService = class {
           queries: parsedQueries
         };
       } catch (err) {
-        log16.warn("profile.generation-failed", {
+        log17.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -8976,7 +9149,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log16.warn("response.analysis-failed", {
+      log17.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9036,7 +9209,7 @@ function buildBatchAnalysisPrompt(ctx) {
     `Services: ${ctx.profile.services.join(", ") || "unknown"}`,
     `Category terms: ${ctx.profile.categoryTerms.join(", ") || "unknown"}`,
     `Manual competitor hints: ${ctx.manualCompetitors.join(", ") || "none"}`,
-    `Technical audit: ${ctx.audit.overallScore}/100 (${ctx.audit.overallGrade}) \u2014 ${ctx.audit.summary}`,
+    `Technical audit: ${ctx.audit.overallScore}/100 \u2014 ${ctx.audit.summary}`,
     "",
     "Responses JSON:",
     JSON.stringify(ctx.responses, null, 2)
@@ -9047,7 +9220,7 @@ function buildFallbackBatchAssessment(companyName, audit) {
     assessments: [],
     whatThisMeans: [
       `${companyName} needs category-level visibility, not just branded comprehension.`,
-      `The technical baseline is ${audit.overallScore}/100 (${audit.overallGrade}), so weak site signals may be making AI systems prefer better-structured alternatives.`
+      `The technical baseline is ${audit.overallScore}/100, so weak site signals may be making AI systems prefer better-structured alternatives.`
     ],
     recommendedActions: buildFallbackRecommendedActions(audit)
   };
@@ -9191,7 +9364,6 @@ function mapAuditReport(report) {
     finalUrl: report.finalUrl,
     auditedAt: report.auditedAt,
     overallScore: report.overallScore,
-    overallGrade: report.overallGrade,
     summary: report.summary,
     factors: report.factors.map(mapAuditFactor)
   };
@@ -9202,8 +9374,6 @@ function mapAuditFactor(factor) {
     name: factor.name,
     weight: factor.weight,
     score: factor.score,
-    grade: factor.grade,
-    status: factor.status,
     findings: factor.findings.map((finding) => ({
       type: finding.type,
       message: finding.message
@@ -9261,7 +9431,7 @@ function clipText(value, length) {
 // src/server.ts
 var _require3 = createRequire3(import.meta.url);
 var { version: PKG_VERSION2 } = _require3("../package.json");
-var log17 = createLogger("Server");
+var log18 = createLogger("Server");
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
   maxRequestsPerMinute: 10,
@@ -9291,14 +9461,14 @@ function summarizeProviderConfig(provider, config) {
   };
 }
 function hashApiKey(key) {
-  return crypto17.createHash("sha256").update(key).digest("hex");
+  return crypto18.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto17.randomBytes(16);
-  const derived = crypto17.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto18.randomBytes(16);
+  const derived = crypto18.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -9319,18 +9489,18 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto17.scryptSync(password, salt, expected.length, {
+    const derived = crypto18.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length) return { ok: false, needsRehash: false };
-    return { ok: crypto17.timingSafeEqual(derived, expected), needsRehash: false };
+    return { ok: crypto18.timingSafeEqual(derived, expected), needsRehash: false };
   }
   if (/^[a-f0-9]{64}$/i.test(storedHash)) {
     const candidate = Buffer.from(hashApiKey(password), "hex");
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length) return { ok: false, needsRehash: false };
-    const ok = crypto17.timingSafeEqual(candidate, expected);
+    const ok = crypto18.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -9389,7 +9559,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGoogle > 0) {
     saveConfigPatch({ google: config.google });
-    log17.info("credentials.migrated", { type: "google", count: migratedGoogle });
+    log18.info("credentials.migrated", { type: "google", count: migratedGoogle });
   }
   let migratedGa4 = 0;
   for (const row of rows.ga4) {
@@ -9407,9 +9577,16 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGa4 > 0) {
     saveConfigPatch({ ga4: config.ga4 });
-    log17.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
+    log18.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
   }
 }
+function isLoopbackBindHost(host) {
+  if (host == null || host === "") return true;
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (normalized === "localhost" || normalized === "::1") return true;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
+  return false;
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -9439,11 +9616,11 @@ async function createServer(opts) {
     applyLegacyCredentials(legacyRows, opts.config);
     dropLegacyCredentialColumns(opts.db);
   } catch (err) {
-    log17.warn("credentials.migration.failed", {
+    log18.warn("credentials.migration.failed", {
       error: err instanceof Error ? err.message : String(err)
     });
   }
-  log17.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
+  log18.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
     const p = providers[k];
     return p?.apiKey || p?.baseUrl || p?.vertexProject;
   }) });
@@ -9492,7 +9669,7 @@ async function createServer(opts) {
     intelligenceService,
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq17(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq18(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -9535,6 +9712,11 @@ async function createServer(opts) {
       app.log.error({ runId, err }, "GBP sync failed");
     });
   };
+  const runSiteAudit = (runId, projectId, auditOpts) => {
+    executeSiteAudit(opts.db, runId, projectId, auditOpts ?? {}).then(() => runCoordinator.onRunCompleted(runId, projectId)).catch((err) => {
+      app.log.error({ runId, err }, "Site audit failed");
+    });
+  };
   const scheduler = new Scheduler(opts.db, {
     onRunCreated: (runId, projectId, providers2, location) => {
       jobRunner.executeRun(runId, projectId, providers2, location).catch((err) => {
@@ -9560,8 +9742,8 @@ async function createServer(opts) {
         });
         if (!probed) return;
         const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(and13(
-          eq17(ccReleaseSyncs.release, probed.release),
-          eq17(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+          eq18(ccReleaseSyncs.release, probed.release),
+          eq18(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
         )).limit(1).get();
         if (alreadySynced) {
           app.log.info({ projectName, release: probed.release }, "Scheduled backlinks sync: already up to date, skipping");
@@ -9574,6 +9756,9 @@ async function createServer(opts) {
           );
         });
       })();
+    },
+    onSiteAuditRequested: (runId, projectId) => {
+      runSiteAudit(runId, projectId);
     }
   });
   const providerSummary = API_ADAPTERS.map((adapter) => ({
@@ -9691,7 +9876,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto17.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto18.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -9737,11 +9922,11 @@ async function createServer(opts) {
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq17(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq18(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto17.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto18.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -9765,7 +9950,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto17.randomBytes(32).toString("hex");
+    const sessionId = crypto18.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -9789,7 +9974,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq17(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq18(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -9804,6 +9989,15 @@ async function createServer(opts) {
     }));
     return true;
   };
+  const boundToLoopback = isLoopbackBindHost(opts.host);
+  const requestHasValidApiKey = (request) => {
+    const header = request.headers.authorization;
+    if (!header) return false;
+    const parts = header.split(" ");
+    if (parts.length !== 2 || parts[0] !== "Bearer") return false;
+    const key = opts.db.select().from(apiKeys).where(eq18(apiKeys.keyHash, hashApiKey(parts[1]))).get();
+    return Boolean(key && !key.revokedAt);
+  };
   app.get(apiPrefix + "/session", async (request, reply) => {
     const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
     return reply.send({
@@ -9812,6 +10006,10 @@ async function createServer(opts) {
     });
   });
   app.post(apiPrefix + "/session/setup", async (request, reply) => {
+    if (!boundToLoopback && !requestHasValidApiKey(request)) {
+      const err = authRequired("This server is network-reachable; setting the dashboard password requires a valid API key.");
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
     if (opts.config.dashboardPasswordHash) {
       const err = validationError("Dashboard password is already configured");
       return reply.status(err.statusCode).send(err.toJSON());
@@ -9851,12 +10049,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq17(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq18(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq17(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq18(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header("set-cookie", serializeSessionCookie({
         name: SESSION_COOKIE_NAME,
@@ -10010,7 +10208,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto17.randomUUID();
+            const runId = crypto18.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -10048,6 +10246,9 @@ async function createServer(opts) {
         app.log.error({ runId: input.runId, err }, "Discovery run failed");
       });
     },
+    onSiteAuditRequested: (runId, projectId, auditOpts) => {
+      runSiteAudit(runId, projectId, auditOpts);
+    },
     onBacklinksPruneCache: (release) => {
       try {
         pruneCachedRelease(release);
@@ -10093,7 +10294,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq17(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq18(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(opts.db, opts.config, projectId);
         }
@@ -10181,7 +10382,7 @@ async function createServer(opts) {
         const targetProjectIds = affectedProjectIds.length > 0 ? affectedProjectIds : [null];
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(targetProjectIds.map((projectId) => ({
-          id: crypto17.randomUUID(),
+          id: crypto18.randomUUID(),
           projectId,
           actor: "api",
           action: existing ? "provider.updated" : "provider.created",