@canonry/canonry 4.117.2 → 4.118.0

package/dist/{chunk-BMPIV35C.js → chunk-CMZIPFNQ.js}

@@ -1,7 +1,12 @@
 import {
+  ADS_WRITE_SCOPE,
   AGENT_PROVIDER_IDS,
   AI_ENGINE_DOMAINS,
   AI_PROVIDER_INFRA_DOMAINS,
+  AdsEntityStatuses,
+  AdsEntityTypes,
+  AdsOperationKinds,
+  AdsOperationStates,
   AiReferralTrafficClasses,
   AppError,
   BacklinkSources,
@@ -38,19 +43,29 @@ import {
   __export,
   absolutizeProjectUrl,
   actionConfidenceLabel,
+  adsAdCreateRequestSchema,
+  adsAdGroupCreateRequestSchema,
+  adsAdGroupUpdateRequestSchema,
+  adsAdUpdateRequestSchema,
+  adsCampaignCreateRequestSchema,
   adsCampaignListResponseSchema,
+  adsCampaignUpdateRequestSchema,
   adsConnectRequestSchema,
   adsConnectionStatusDtoSchema,
   adsCpcMicros,
   adsCtr,
   adsDisconnectResponseSchema,
+  adsImageUploadRequestSchema,
   adsInsightLevelSchema,
   adsInsightsResponseSchema,
+  adsOperationResponseSchema,
+  adsPauseRequestSchema,
   adsSummaryDtoSchema,
   adsSyncResponseSchema,
   agentProvidersResponseDtoSchema,
   aggregateHarvestedQueries,
   aiReferralClassCounts,
+  alreadyExists,
   apiKeyDtoSchema,
   apiKeyListDtoSchema,
   applyHarvestSemanticNovelty,
@@ -173,6 +188,7 @@ import {
   gscSitemapListResponseDtoSchema,
   gscUrlInspectionDtoSchema,
   hasLocationLabel,
+  healthSnapshotDtoSchema,
   hostOf,
   indexingRequestResponseDtoSchema,
   internalError,
@@ -283,10 +299,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-EZME2J2G.js";
+} from "./chunk-KEZWLP4O.js";
 
 // src/intelligence-service.ts
-import { eq as eq40, desc as desc18, asc as asc7, and as and31, ne as ne5, or as or6, inArray as inArray15, gte as gte8, lte as lte5 } from "drizzle-orm";
+import { eq as eq40, desc as desc18, asc as asc8, and as and31, ne as ne5, or as or6, inArray as inArray15, gte as gte9, lte as lte5 } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -302,6 +318,7 @@ __export(schema_exports, {
   adsCampaigns: () => adsCampaigns,
   adsConnections: () => adsConnections,
   adsInsightsDaily: () => adsInsightsDaily,
+  adsOperations: () => adsOperations,
   agentMemory: () => agentMemory,
   agentSessions: () => agentSessions,
   agentToolEvents: () => agentToolEvents,
@@ -1444,11 +1461,33 @@ var adsConnections = sqliteTable("ads_connections", {
 }, (table) => [
   uniqueIndex("idx_ads_conn_project").on(table.projectId)
 ]);
+var adsOperations = sqliteTable("ads_operations", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+  operationKey: text("operation_key").notNull(),
+  requestHash: text("request_hash").notNull(),
+  kind: text("kind").notNull(),
+  state: text("state").notNull(),
+  entityType: text("entity_type"),
+  entityId: text("entity_id"),
+  upstreamUpdatedAt: integer("upstream_updated_at"),
+  errorCode: text("error_code"),
+  errorMessage: text("error_message"),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  uniqueIndex("idx_ads_operations_project_key").on(table.projectId, table.operationKey),
+  index("idx_ads_operations_project_created").on(table.projectId, table.createdAt),
+  index("idx_ads_operations_project_state").on(table.projectId, table.state)
+]);
 var adsCampaigns = sqliteTable("ads_campaigns", {
   id: text("id").primaryKey(),
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
+  description: text("description"),
   status: text("status").notNull(),
+  startTime: integer("start_time"),
+  endTime: integer("end_time"),
   biddingType: text("bidding_type"),
   dailySpendLimitMicros: integer("daily_spend_limit_micros"),
   lifetimeSpendLimitMicros: integer("lifetime_spend_limit_micros"),
@@ -1465,6 +1504,7 @@ var adsAdGroups = sqliteTable("ads_ad_groups", {
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   campaignId: text("campaign_id").notNull().references(() => adsCampaigns.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
+  description: text("description"),
   status: text("status").notNull(),
   billingEventType: text("billing_event_type"),
   maxBidMicros: integer("max_bid_micros"),
@@ -3600,6 +3640,34 @@ var MIGRATION_VERSIONS = [
     run: (tx) => {
       relinkOrphanedSnapshotQueryIds(tx);
     }
+  },
+  {
+    version: 99,
+    name: "ads-operator-lifecycle",
+    statements: [
+      `ALTER TABLE ads_campaigns ADD COLUMN description TEXT`,
+      `ALTER TABLE ads_campaigns ADD COLUMN start_time INTEGER`,
+      `ALTER TABLE ads_campaigns ADD COLUMN end_time INTEGER`,
+      `ALTER TABLE ads_ad_groups ADD COLUMN description TEXT`,
+      `CREATE TABLE IF NOT EXISTS ads_operations (
+        id                    TEXT PRIMARY KEY,
+        project_id            TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        operation_key         TEXT NOT NULL,
+        request_hash          TEXT NOT NULL,
+        kind                  TEXT NOT NULL,
+        state                 TEXT NOT NULL,
+        entity_type           TEXT,
+        entity_id             TEXT,
+        upstream_updated_at   INTEGER,
+        error_code            TEXT,
+        error_message         TEXT,
+        created_at            TEXT NOT NULL,
+        updated_at            TEXT NOT NULL
+      )`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_ads_operations_project_key ON ads_operations(project_id, operation_key)`,
+      `CREATE INDEX IF NOT EXISTS idx_ads_operations_project_created ON ads_operations(project_id, created_at)`,
+      `CREATE INDEX IF NOT EXISTS idx_ads_operations_project_state ON ads_operations(project_id, state)`
+    ]
   }
 ];
 function rebuildBacklinkTableWithSource(tx, table) {
@@ -5948,6 +6016,14 @@ import fs8 from "fs";
 import crypto2 from "crypto";
 import { eq } from "drizzle-orm";
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function isAdsWriteOnlyKey(scopes) {
+  const writeGrants = scopes.filter((scope) => scope === "*" || scope === "write" || scope.endsWith(".write"));
+  return writeGrants.length === 1 && writeGrants[0] === ADS_WRITE_SCOPE;
+}
+function isAdsWriteRoute(url) {
+  const rest = projectRouteRest(url);
+  return rest !== null && rest.startsWith("ads/");
+}
 function requireScope(request, scope) {
   const key = request.apiKey;
   if (!key) return;
@@ -6100,6 +6176,9 @@ async function authPlugin(app, opts = {}) {
     if (isReadOnlyKey(scopes) && WRITE_METHODS.has(request.method)) {
       throw forbidden("This API key is read-only and cannot perform write operations.");
     }
+    if (isAdsWriteOnlyKey(scopes) && WRITE_METHODS.has(request.method) && !isAdsWriteRoute(url)) {
+      throw forbidden("This API key can only perform OpenAI Ads write operations.");
+    }
     enforceEmbedProjectTabs(request, opts.embedProjectTabs);
     if (key.projectId) {
       const match = url.match(/\/projects\/([^/?#]+)/);
@@ -7994,7 +8073,7 @@ function normalizeCompetitorList2(domains) {
 }
 
 // ../api-routes/src/history.ts
-import { and as and6, eq as eq10, desc as desc2, inArray as inArray3 } from "drizzle-orm";
+import { and as and6, asc as asc2, desc as desc2, eq as eq10, gte as gte2, inArray as inArray3 } from "drizzle-orm";
 
 // ../api-routes/src/notification-redaction.ts
 var REDACTED_URL = {
@@ -8040,12 +8119,16 @@ function redactNotificationDiff(value) {
 async function historyRoutes(app) {
   app.get("/projects/:name/history", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(auditLog).where(eq10(auditLog.projectId, project.id)).orderBy(desc2(auditLog.createdAt)).all();
+    const filters = [eq10(auditLog.projectId, project.id)];
+    addAuditHistoryFilters(filters, request.query);
+    const rows = app.db.select().from(auditLog).where(and6(...filters)).orderBy(desc2(auditLog.createdAt)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
   });
   app.get("/history", async (request, reply) => {
     const scopedProjectId = request.apiKey?.projectId;
-    const rows = app.db.select().from(auditLog).where(scopedProjectId ? eq10(auditLog.projectId, scopedProjectId) : void 0).orderBy(desc2(auditLog.createdAt)).all();
+    const filters = scopedProjectId ? [eq10(auditLog.projectId, scopedProjectId)] : [];
+    addAuditHistoryFilters(filters, request.query);
+    const rows = app.db.select().from(auditLog).where(filters.length > 0 ? and6(...filters) : void 0).orderBy(desc2(auditLog.createdAt)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
   });
   app.get("/projects/:name/snapshots", async (request, reply) => {
@@ -8101,7 +8184,8 @@ async function historyRoutes(app) {
   app.get("/projects/:name/timeline", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const projectQueries = app.db.select().from(queries).where(eq10(queries.projectId, project.id)).all();
-    const projectRuns = app.db.select().from(runs).where(and6(eq10(runs.projectId, project.id), notProbeRun())).orderBy(runs.createdAt).all();
+    const requestedLimit = parseOptionalPositiveInt(request.query.limit, 100);
+    const projectRuns = requestedLimit == null ? app.db.select().from(runs).where(and6(eq10(runs.projectId, project.id), notProbeRun())).orderBy(asc2(runs.createdAt)).all() : app.db.select().from(runs).where(and6(eq10(runs.projectId, project.id), notProbeRun())).orderBy(desc2(runs.createdAt)).limit(requestedLimit).all().reverse();
     if (projectRuns.length === 0 || projectQueries.length === 0) {
       return reply.send([]);
     }
@@ -8251,29 +8335,23 @@ async function historyRoutes(app) {
     }).from(querySnapshots).leftJoin(queries, eq10(querySnapshots.queryId, queries.id)).where(eq10(querySnapshots.runId, run2)).all();
     const map1 = /* @__PURE__ */ new Map();
     for (const s of snaps1) {
-      const resolved = {
-        ...s,
-        resolvedAnswerMentioned: resolveSnapshotAnswerMentioned(s, project),
-        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project),
-        resolvedMentionState: resolveSnapshotMentionState(s, project)
-      };
       const existing = map1.get(s.queryId);
-      if (!existing || !existing.resolvedAnswerMentioned && resolved.resolvedAnswerMentioned || existing.resolvedAnswerMentioned === resolved.resolvedAnswerMentioned && resolved.citationState === CitationStates.cited) {
-        map1.set(s.queryId, resolved);
-      }
+      map1.set(s.queryId, {
+        ...s,
+        query: existing?.query ?? s.query,
+        citationState: existing?.citationState === CitationStates.cited || s.citationState === CitationStates.cited ? CitationStates.cited : CitationStates["not-cited"],
+        resolvedAnswerMentioned: (existing?.resolvedAnswerMentioned ?? false) || resolveSnapshotAnswerMentioned(s, project)
+      });
     }
     const map2 = /* @__PURE__ */ new Map();
     for (const s of snaps2) {
-      const resolved = {
-        ...s,
-        resolvedAnswerMentioned: resolveSnapshotAnswerMentioned(s, project),
-        resolvedVisibilityState: resolveSnapshotVisibilityState(s, project),
-        resolvedMentionState: resolveSnapshotMentionState(s, project)
-      };
       const existing = map2.get(s.queryId);
-      if (!existing || !existing.resolvedAnswerMentioned && resolved.resolvedAnswerMentioned || existing.resolvedAnswerMentioned === resolved.resolvedAnswerMentioned && resolved.citationState === CitationStates.cited) {
-        map2.set(s.queryId, resolved);
-      }
+      map2.set(s.queryId, {
+        ...s,
+        query: existing?.query ?? s.query,
+        citationState: existing?.citationState === CitationStates.cited || s.citationState === CitationStates.cited ? CitationStates.cited : CitationStates["not-cited"],
+        resolvedAnswerMentioned: (existing?.resolvedAnswerMentioned ?? false) || resolveSnapshotAnswerMentioned(s, project)
+      });
     }
     const allQueryIds = /* @__PURE__ */ new Set([...map1.keys(), ...map2.keys()]);
     const diff = [...allQueryIds].map((qId) => {
@@ -8287,10 +8365,10 @@ async function historyRoutes(app) {
         run1AnswerMentioned: s1?.resolvedAnswerMentioned ?? null,
         run2AnswerMentioned: s2?.resolvedAnswerMentioned ?? null,
         // Legacy aliases — same data as run{1,2}MentionState below.
-        run1VisibilityState: s1?.resolvedVisibilityState ?? null,
-        run2VisibilityState: s2?.resolvedVisibilityState ?? null,
-        run1MentionState: s1?.resolvedMentionState ?? null,
-        run2MentionState: s2?.resolvedMentionState ?? null,
+        run1VisibilityState: s1 ? visibilityStateFromAnswerMentioned(s1.resolvedAnswerMentioned) : null,
+        run2VisibilityState: s2 ? visibilityStateFromAnswerMentioned(s2.resolvedAnswerMentioned) : null,
+        run1MentionState: s1 ? mentionStateFromAnswerMentioned(s1.resolvedAnswerMentioned) : null,
+        run2MentionState: s2 ? mentionStateFromAnswerMentioned(s2.resolvedAnswerMentioned) : null,
         changed: (s1?.citationState ?? null) !== (s2?.citationState ?? null),
         visibilityChanged: (s1?.resolvedAnswerMentioned ?? null) !== (s2?.resolvedAnswerMentioned ?? null)
       };
@@ -8307,9 +8385,28 @@ function formatAuditEntry(row) {
     entityType: row.entityType,
     entityId: row.entityId,
     diff: row.diff ? row.entityType === "notification" ? redactNotificationDiff(parseJsonColumn(row.diff, null)) : parseJsonColumn(row.diff, null) : null,
+    userAgent: row.userAgent,
+    actorSession: row.actorSession,
     createdAt: row.createdAt
   };
 }
+function addAuditHistoryFilters(filters, query) {
+  if (query.since && !Number.isNaN(Date.parse(query.since))) filters.push(gte2(auditLog.createdAt, query.since));
+  if (query.action) filters.push(eq10(auditLog.action, query.action));
+  if (query.actor) filters.push(eq10(auditLog.actor, query.actor));
+  if (query.entityType) filters.push(eq10(auditLog.entityType, query.entityType));
+}
+function parseBoundedInt(value, fallback, max) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  if (!Number.isFinite(parsed) || parsed < 0) return fallback;
+  return Math.min(parsed, max);
+}
+function parseOptionalPositiveInt(value, max) {
+  if (value == null) return void 0;
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+  return Math.min(parsed, max);
+}
 
 // ../api-routes/src/analytics.ts
 import { and as and7, eq as eq11, desc as desc3, inArray as inArray4 } from "drizzle-orm";
@@ -8973,7 +9070,7 @@ async function intelligenceRoutes(app) {
 }
 
 // ../api-routes/src/report.ts
-import { and as and12, desc as desc7, eq as eq16, gte as gte2, inArray as inArray7, lt, lte, ne as ne2, or as or3, sql as sql7 } from "drizzle-orm";
+import { and as and12, desc as desc7, eq as eq16, gte as gte3, inArray as inArray7, lt, lte, ne as ne2, or as or3, sql as sql7 } from "drizzle-orm";
 
 // ../api-routes/src/content.ts
 import crypto12 from "crypto";
@@ -9709,7 +9806,7 @@ function winnabilityClassRank(winnabilityClass) {
 }
 
 // ../api-routes/src/gsc-totals.ts
-import { and as and11, asc as asc2, eq as eq15, sql as sql6 } from "drizzle-orm";
+import { and as and11, asc as asc3, eq as eq15, sql as sql6 } from "drizzle-orm";
 function readGscDailyTotals(db, projectId, startDate, endDate) {
   const rows = db.select({
     date: gscDailyTotals.date,
@@ -9722,7 +9819,7 @@ function readGscDailyTotals(db, projectId, startDate, endDate) {
       sql6`${gscDailyTotals.date} >= ${startDate}`,
       sql6`${gscDailyTotals.date} <= ${endDate}`
     )
-  ).orderBy(asc2(gscDailyTotals.date)).all();
+  ).orderBy(asc3(gscDailyTotals.date)).all();
   return rows.map((r) => {
     const position = Number(r.position);
     return {
@@ -12189,7 +12286,7 @@ function buildGaSection(db, projectId, windowDays) {
     eq16(gaAiReferrals.sourceDimension, "session")
   ];
   if (snapshotStartDate && snapshotMaxDate) {
-    aiConditions.push(gte2(gaAiReferrals.date, snapshotStartDate));
+    aiConditions.push(gte3(gaAiReferrals.date, snapshotStartDate));
     aiConditions.push(lte(gaAiReferrals.date, snapshotMaxDate));
   }
   const aiSessionRows = db.select({
@@ -12406,7 +12503,7 @@ function buildServerActivity(db, projectId, windowDays) {
       and12(
         eq16(crawlerEventsHourly.projectId, projectId),
         eq16(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
-        gte2(crawlerEventsHourly.tsHour, windowStartIso),
+        gte3(crawlerEventsHourly.tsHour, windowStartIso),
         exclusiveEnd ? lt(crawlerEventsHourly.tsHour, windowEndIso) : lte(crawlerEventsHourly.tsHour, windowEndIso)
       )
     ).get()?.total ?? 0
@@ -12416,7 +12513,7 @@ function buildServerActivity(db, projectId, windowDays) {
       and12(
         eq16(crawlerEventsHourly.projectId, projectId),
         ne2(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
-        gte2(crawlerEventsHourly.tsHour, windowStartIso),
+        gte3(crawlerEventsHourly.tsHour, windowStartIso),
         exclusiveEnd ? lt(crawlerEventsHourly.tsHour, windowEndIso) : lte(crawlerEventsHourly.tsHour, windowEndIso)
       )
     ).get()?.total ?? 0
@@ -12430,7 +12527,7 @@ function buildServerActivity(db, projectId, windowDays) {
       and12(
         eq16(aiReferralEventsHourly.projectId, projectId),
         nonSubresourceReferralPathCondition(),
-        gte2(aiReferralEventsHourly.tsHour, windowStartIso),
+        gte3(aiReferralEventsHourly.tsHour, windowStartIso),
         exclusiveEnd ? lt(aiReferralEventsHourly.tsHour, windowEndIso) : lte(aiReferralEventsHourly.tsHour, windowEndIso)
       )
     ).get();
@@ -12440,7 +12537,7 @@ function buildServerActivity(db, projectId, windowDays) {
     db.select({ total: sql7`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
       and12(
         eq16(aiUserFetchEventsHourly.projectId, projectId),
-        gte2(aiUserFetchEventsHourly.tsHour, windowStartIso),
+        gte3(aiUserFetchEventsHourly.tsHour, windowStartIso),
         exclusiveEnd ? lt(aiUserFetchEventsHourly.tsHour, windowEndIso) : lte(aiUserFetchEventsHourly.tsHour, windowEndIso)
       )
     ).get()?.total ?? 0
@@ -12460,7 +12557,7 @@ function buildServerActivity(db, projectId, windowDays) {
   }).from(crawlerEventsHourly).where(
     and12(
       eq16(crawlerEventsHourly.projectId, projectId),
-      gte2(crawlerEventsHourly.tsHour, headlineStart),
+      gte3(crawlerEventsHourly.tsHour, headlineStart),
       lte(crawlerEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(crawlerEventsHourly.operator, crawlerEventsHourly.verificationStatus).all();
@@ -12471,7 +12568,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(crawlerEventsHourly.projectId, projectId),
       eq16(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
-      gte2(crawlerEventsHourly.tsHour, priorStart),
+      gte3(crawlerEventsHourly.tsHour, priorStart),
       lt(crawlerEventsHourly.tsHour, headlineStart)
     )
   ).groupBy(crawlerEventsHourly.operator).all();
@@ -12482,7 +12579,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
-      gte2(aiReferralEventsHourly.tsHour, headlineStart),
+      gte3(aiReferralEventsHourly.tsHour, headlineStart),
       lte(aiReferralEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(aiReferralEventsHourly.operator).all();
@@ -12492,7 +12589,7 @@ function buildServerActivity(db, projectId, windowDays) {
   }).from(aiUserFetchEventsHourly).where(
     and12(
       eq16(aiUserFetchEventsHourly.projectId, projectId),
-      gte2(aiUserFetchEventsHourly.tsHour, headlineStart),
+      gte3(aiUserFetchEventsHourly.tsHour, headlineStart),
       lte(aiUserFetchEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(aiUserFetchEventsHourly.operator).all();
@@ -12537,7 +12634,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(crawlerEventsHourly.projectId, projectId),
       eq16(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
-      gte2(crawlerEventsHourly.tsHour, headlineStart),
+      gte3(crawlerEventsHourly.tsHour, headlineStart),
       lte(crawlerEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(crawlerEventsHourly.pathNormalized).orderBy(desc7(sql7`SUM(${crawlerEventsHourly.hits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
@@ -12554,7 +12651,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
-      gte2(aiReferralEventsHourly.tsHour, headlineStart),
+      gte3(aiReferralEventsHourly.tsHour, headlineStart),
       lte(aiReferralEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(aiReferralEventsHourly.product).orderBy(desc7(sql7`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).all();
@@ -12571,7 +12668,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
-      gte2(aiReferralEventsHourly.tsHour, headlineStart),
+      gte3(aiReferralEventsHourly.tsHour, headlineStart),
       lte(aiReferralEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(aiReferralEventsHourly.landingPathNormalized).orderBy(desc7(sql7`SUM(${aiReferralEventsHourly.sessionsOrHits})`)).limit(SERVER_ACTIVITY_TOP_PATHS_LIMIT).all();
@@ -12587,7 +12684,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(crawlerEventsHourly.projectId, projectId),
       eq16(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
-      gte2(crawlerEventsHourly.tsHour, trendStart),
+      gte3(crawlerEventsHourly.tsHour, trendStart),
       lte(crawlerEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(sql7`SUBSTR(${crawlerEventsHourly.tsHour}, 1, 10)`).all();
@@ -12598,7 +12695,7 @@ function buildServerActivity(db, projectId, windowDays) {
     and12(
       eq16(aiReferralEventsHourly.projectId, projectId),
       nonSubresourceReferralPathCondition(),
-      gte2(aiReferralEventsHourly.tsHour, trendStart),
+      gte3(aiReferralEventsHourly.tsHour, trendStart),
       lte(aiReferralEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(sql7`SUBSTR(${aiReferralEventsHourly.tsHour}, 1, 10)`).all();
@@ -12608,7 +12705,7 @@ function buildServerActivity(db, projectId, windowDays) {
   }).from(aiUserFetchEventsHourly).where(
     and12(
       eq16(aiUserFetchEventsHourly.projectId, projectId),
-      gte2(aiUserFetchEventsHourly.tsHour, trendStart),
+      gte3(aiUserFetchEventsHourly.tsHour, trendStart),
       lte(aiUserFetchEventsHourly.tsHour, headlineEnd)
     )
   ).groupBy(sql7`SUBSTR(${aiUserFetchEventsHourly.tsHour}, 1, 10)`).all();
@@ -14243,7 +14340,7 @@ async function visibilityStatsRoutes(app) {
 }
 
 // ../api-routes/src/results-export.ts
-import { and as and15, asc as asc3, eq as eq19, gte as gte3, lte as lte2 } from "drizzle-orm";
+import { and as and15, asc as asc4, eq as eq19, gte as gte4, lte as lte2 } from "drizzle-orm";
 var CSV_COLUMNS = [
   "export_schema_version",
   "project_id",
@@ -14373,7 +14470,7 @@ async function resultsExportRoutes(app) {
       eq19(runs.projectId, project.id),
       eq19(runs.kind, RunKinds["answer-visibility"]),
       ...includeProbes ? [] : [notProbeRun()],
-      ...sinceIso ? [gte3(runs.createdAt, sinceIso)] : [],
+      ...sinceIso ? [gte4(runs.createdAt, sinceIso)] : [],
       ...untilIso ? [lte2(runs.createdAt, untilIso)] : []
     ];
     const rows = app.db.select({
@@ -14398,7 +14495,7 @@ async function resultsExportRoutes(app) {
       recommendedCompetitors: querySnapshots.recommendedCompetitors,
       answerText: querySnapshots.answerText,
       rawResponse: querySnapshots.rawResponse
-    }).from(querySnapshots).innerJoin(runs, eq19(querySnapshots.runId, runs.id)).leftJoin(queries, eq19(querySnapshots.queryId, queries.id)).where(and15(...conditions)).orderBy(asc3(runs.createdAt), asc3(runs.id), asc3(querySnapshots.createdAt), asc3(querySnapshots.id)).all();
+    }).from(querySnapshots).innerJoin(runs, eq19(querySnapshots.runId, runs.id)).leftJoin(queries, eq19(querySnapshots.queryId, queries.id)).where(and15(...conditions)).orderBy(asc4(runs.createdAt), asc4(runs.id), asc4(querySnapshots.createdAt), asc4(querySnapshots.id)).all();
     const records = rows.map((row) => {
       const evidence = readEvidence(row.rawResponse);
       const citationState = row.citationState === CitationStates.cited ? CitationStates.cited : CitationStates["not-cited"];
@@ -15166,6 +15263,7 @@ var SCHEMA_TABLE = {
   AdsConnectionStatusDto: adsConnectionStatusDtoSchema,
   AdsDisconnectResponse: adsDisconnectResponseSchema,
   AdsInsightsResponse: adsInsightsResponseSchema,
+  AdsOperationResponse: adsOperationResponseSchema,
   AdsSummaryDto: adsSummaryDtoSchema,
   AdsSyncResponse: adsSyncResponseSchema,
   ApiKeyDto: apiKeyDtoSchema,
@@ -15234,6 +15332,7 @@ var SCHEMA_TABLE = {
   GscSiteListResponseDto: gscSiteListResponseDtoSchema,
   GscSitemapListResponseDto: gscSitemapListResponseDtoSchema,
   GscUrlInspectionDto: gscUrlInspectionDtoSchema,
+  HealthSnapshotDto: healthSnapshotDtoSchema,
   IndexingRequestResponseDto: indexingRequestResponseDtoSchema,
   KeywordDto: keywordDtoSchema,
   LatestProjectRunDto: latestProjectRunDtoSchema,
@@ -15347,6 +15446,17 @@ var booleanSchema = { type: "boolean" };
 var integerSchema = { type: "integer" };
 var objectSchema = { type: "object", additionalProperties: true };
 var stringArraySchema = { type: "array", items: stringSchema };
+var adsOperationKeySchema = { type: "string", minLength: 8, maxLength: 128 };
+var adsCreativeRequestSchema = {
+  type: "object",
+  required: ["title", "body", "targetUrl", "fileId"],
+  properties: {
+    title: { type: "string", minLength: 3, maxLength: 50 },
+    body: { type: "string", minLength: 1, maxLength: 100 },
+    targetUrl: { type: "string", format: "uri" },
+    fileId: stringSchema
+  }
+};
 var googleConnectionTypeSchema = { type: "string", enum: ["gsc", "ga4", "gbp"] };
 var locationSchema = {
   type: "object",
@@ -16291,7 +16401,15 @@ var routeCatalog = [
     path: "/api/v1/projects/{name}/history",
     summary: "Get project audit history",
     tags: ["history"],
-    parameters: [nameParameter],
+    parameters: [
+      nameParameter,
+      limitQueryParameter,
+      offsetQueryParameter,
+      { name: "since", in: "query", description: "ISO 8601 lower bound.", schema: stringSchema },
+      { name: "action", in: "query", description: "Exact audit action filter.", schema: stringSchema },
+      { name: "actor", in: "query", description: "Exact actor filter.", schema: stringSchema },
+      { name: "entityType", in: "query", description: "Exact entity type filter.", schema: stringSchema }
+    ],
     responses: {
       200: jsonArrayResponse("Audit history returned.", "AuditLogEntry")
     }
@@ -16301,6 +16419,14 @@ var routeCatalog = [
     path: "/api/v1/history",
     summary: "Get global audit history",
     tags: ["history"],
+    parameters: [
+      limitQueryParameter,
+      offsetQueryParameter,
+      { name: "since", in: "query", description: "ISO 8601 lower bound.", schema: stringSchema },
+      { name: "action", in: "query", description: "Exact audit action filter.", schema: stringSchema },
+      { name: "actor", in: "query", description: "Exact actor filter.", schema: stringSchema },
+      { name: "entityType", in: "query", description: "Exact entity type filter.", schema: stringSchema }
+    ],
     responses: {
       200: jsonArrayResponse("Audit history returned.", "AuditLogEntry")
     }
@@ -16325,7 +16451,11 @@ var routeCatalog = [
     path: "/api/v1/projects/{name}/timeline",
     summary: "Get query timeline",
     tags: ["history"],
-    parameters: [nameParameter, locationQueryParameter],
+    parameters: [
+      nameParameter,
+      locationQueryParameter,
+      { name: "limit", in: "query", description: "Restrict each query timeline to snapshots from the most recent N project runs. Omit for full history.", schema: { ...integerSchema, minimum: 1, maximum: 100 } }
+    ],
     responses: {
       // TODO: Add `ProjectTimelineDto` Zod schema in contracts.
       200: rawJsonResponse("Timeline returned.", looseObjectSchema)
@@ -17446,6 +17576,7 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Connected; key validated against the upstream ad account.", "AdsConnectionStatusDto"),
       400: errorResponse("Missing/invalid key or credential storage unavailable."),
+      403: errorResponse("The key lacks ads.write."),
       404: errorResponse("Project not found.")
     }
   },
@@ -17457,6 +17588,7 @@ var routeCatalog = [
     parameters: [nameParameter],
     responses: {
       200: jsonResponse("Disconnected (idempotent).", "AdsDisconnectResponse"),
+      403: errorResponse("The key lacks ads.write."),
       404: errorResponse("Project not found.")
     }
   },
@@ -17471,6 +17603,288 @@ var routeCatalog = [
       404: errorResponse("Project not found.")
     }
   },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/ads/operations/{operationKey}",
+    summary: "Read a durable OpenAI Ads mutation receipt by operation key",
+    tags: ["ads"],
+    parameters: [
+      nameParameter,
+      { name: "operationKey", in: "path", required: true, description: "Caller-supplied idempotency key.", schema: adsOperationKeySchema }
+    ],
+    responses: {
+      200: jsonResponse("Operation receipt.", "AdsOperationResponse"),
+      404: errorResponse("Project or operation not found.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/files",
+    summary: "Upload an OpenAI Ads image from a public HTTPS URL",
+    tags: ["ads"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "imageUrl"],
+        properties: { operationKey: adsOperationKeySchema, imageUrl: { type: "string", format: "uri" } }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Upload receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/campaigns",
+    summary: "Create a paused OpenAI Ads campaign",
+    description: "The server always creates the campaign paused. Status is not accepted from the caller.",
+    tags: ["ads"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "name", "lifetimeSpendLimitMicros", "locationIds"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          description: stringSchema,
+          startTime: integerSchema,
+          endTime: integerSchema,
+          lifetimeSpendLimitMicros: { type: "integer", minimum: 1e6 },
+          locationIds: { type: "array", minItems: 1, maxItems: 100, items: stringSchema }
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Paused campaign creation receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ad-groups",
+    summary: "Create a paused OpenAI Ads ad group",
+    description: "The server fixes billing to impressions and always creates the ad group paused.",
+    tags: ["ads"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "campaignId", "name", "contextHints", "maxBidMicros"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          campaignId: stringSchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          description: stringSchema,
+          contextHints: { type: "array", minItems: 1, maxItems: 100, items: stringSchema },
+          maxBidMicros: { type: "integer", minimum: 1, maximum: 1e8 }
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Paused ad-group creation receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ads",
+    summary: "Create a paused OpenAI Ads chat-card ad",
+    description: "The server always creates the ad paused and fixes creative.type to chat_card.",
+    tags: ["ads"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "adGroupId", "name", "creative"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          adGroupId: stringSchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          creative: adsCreativeRequestSchema
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Paused ad creation receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/campaigns/{id}",
+    summary: "Update an OpenAI Ads campaign with optimistic concurrency",
+    description: "The campaign must already be paused. Pause and sync first, then pass the refreshed upstreamUpdatedAt. Activation remains human-only.",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Campaign ID.", schema: stringSchema }],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "expectedUpdatedAt"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          expectedUpdatedAt: integerSchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          description: { type: "string", nullable: true },
+          startTime: { type: "integer", nullable: true },
+          endTime: { type: "integer", nullable: true },
+          lifetimeSpendLimitMicros: { type: "integer", minimum: 1e6 },
+          locationIds: { type: "array", minItems: 1, maxItems: 100, items: stringSchema }
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Campaign update receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request, active entity, or stale expectedUpdatedAt."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ad-groups/{id}",
+    summary: "Update an OpenAI Ads ad group with optimistic concurrency",
+    description: "The ad group must already be paused. Pause and sync first, then pass the refreshed upstreamUpdatedAt. Activation remains human-only.",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Ad group ID.", schema: stringSchema }],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "expectedUpdatedAt"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          expectedUpdatedAt: integerSchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          description: { type: "string", nullable: true },
+          contextHints: { type: "array", minItems: 1, maxItems: 100, items: stringSchema },
+          maxBidMicros: { type: "integer", minimum: 1, maximum: 1e8 }
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Ad-group update receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request, active entity, or stale expectedUpdatedAt."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ads/{id}",
+    summary: "Update an OpenAI Ads chat-card ad with optimistic concurrency",
+    description: "The ad must already be paused. Pause and sync first, then pass the refreshed upstreamUpdatedAt. Activation remains human-only.",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Ad ID.", schema: stringSchema }],
+    requestBody: {
+      required: true,
+      content: { "application/json": { schema: {
+        type: "object",
+        required: ["operationKey", "expectedUpdatedAt"],
+        properties: {
+          operationKey: adsOperationKeySchema,
+          expectedUpdatedAt: integerSchema,
+          name: { type: "string", minLength: 3, maxLength: 1e3 },
+          creative: adsCreativeRequestSchema
+        }
+      } } }
+    },
+    responses: {
+      200: jsonResponse("Ad update receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request, active entity, or stale expectedUpdatedAt."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/campaigns/{id}/pause",
+    summary: "Pause an OpenAI Ads campaign",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Campaign ID.", schema: stringSchema }],
+    requestBody: { required: true, content: { "application/json": { schema: {
+      type: "object",
+      required: ["operationKey"],
+      properties: { operationKey: adsOperationKeySchema }
+    } } } },
+    responses: {
+      200: jsonResponse("Campaign pause receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ad-groups/{id}/pause",
+    summary: "Pause an OpenAI Ads ad group",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Ad group ID.", schema: stringSchema }],
+    requestBody: { required: true, content: { "application/json": { schema: {
+      type: "object",
+      required: ["operationKey"],
+      properties: { operationKey: adsOperationKeySchema }
+    } } } },
+    responses: {
+      200: jsonResponse("Ad-group pause receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/ads/ads/{id}/pause",
+    summary: "Pause an OpenAI Ads ad",
+    tags: ["ads"],
+    parameters: [nameParameter, { name: "id", in: "path", required: true, description: "Ad ID.", schema: stringSchema }],
+    requestBody: { required: true, content: { "application/json": { schema: {
+      type: "object",
+      required: ["operationKey"],
+      properties: { operationKey: adsOperationKeySchema }
+    } } } },
+    responses: {
+      200: jsonResponse("Ad pause receipt.", "AdsOperationResponse"),
+      400: errorResponse("Invalid request or ads connection unavailable."),
+      403: errorResponse("The key lacks ads.write."),
+      404: errorResponse("Project not found."),
+      409: errorResponse("Operation key was already used for a different request."),
+      502: errorResponse("Upstream outcome failed or is unknown.")
+    }
+  },
   {
     method: "post",
     path: "/api/v1/projects/{name}/ads/sync",
@@ -17480,13 +17894,14 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Sync run queued.", "AdsSyncResponse"),
       400: errorResponse("No ads connection for this project."),
+      403: errorResponse("The key lacks ads.write."),
       404: errorResponse("Project not found.")
     }
   },
   {
     method: "get",
     path: "/api/v1/projects/{name}/ads/campaigns",
-    summary: "Synced campaign snapshots with nested ad groups (context hints) and ads",
+    summary: "Synced campaign snapshots with lifecycle timestamps, targeting, nested ad groups, and ads",
     tags: ["ads"],
     parameters: [nameParameter],
     responses: {
@@ -18396,8 +18811,7 @@ var routeCatalog = [
     tags: ["intelligence"],
     parameters: [nameParameter],
     responses: {
-      // TODO: Add `HealthSnapshotDto` Zod schema in contracts.
-      200: rawJsonResponse("Health snapshot or no-data sentinel returned.", looseObjectSchema),
+      200: jsonResponse("Health snapshot or no-data sentinel returned.", "HealthSnapshotDto"),
       404: errorResponse("Project not found.")
     }
   },
@@ -18408,11 +18822,10 @@ var routeCatalog = [
     tags: ["intelligence"],
     parameters: [
       nameParameter,
-      { name: "limit", in: "query", description: "Max results.", schema: stringSchema }
+      { name: "limit", in: "query", description: "Max results.", schema: { ...integerSchema, minimum: 1, maximum: 100 } }
     ],
     responses: {
-      // TODO: Add `HealthSnapshotDto` Zod schema in contracts.
-      200: rawJsonResponse("Health history returned.", { type: "array", items: looseObjectSchema }),
+      200: jsonArrayResponse("Health history returned.", "HealthSnapshotDto"),
       404: errorResponse("Project not found.")
     }
   },
@@ -19313,22 +19726,26 @@ var routeCatalog = [
     method: "get",
     path: "/api/v1/projects/{name}/technical-aeo",
     summary: "Get the Technical AEO scorecard for a project",
-    description: "Returns the latest completed/partial site-audit: aggregate 0\u2013100 score, page counts, the full per-factor scorecard (site-level averages with pass/partial/fail distribution), cross-cutting issues, prioritized fixes, and the delta vs the previous audit. When the project has never been audited, `hasData` is false and the numeric fields are zeroed \u2014 render an onboarding state.",
+    description: "Returns the latest completed/partial site-audit, or the historical audit selected by `runId`: aggregate 0\u2013100 score, page counts, the full per-factor scorecard (site-level averages with pass/partial/fail distribution), cross-cutting issues, prioritized fixes, and the delta vs the audit immediately before it. When the project has never been audited, `hasData` is false and the numeric fields are zeroed \u2014 render an onboarding state.",
     tags: ["technical-aeo"],
-    parameters: [nameParameter],
+    parameters: [
+      nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest audit.", schema: stringSchema }
+    ],
     responses: {
       200: jsonResponse("Technical AEO scorecard returned.", "SiteAuditScoreDto"),
-      404: errorResponse("Project not found.")
+      404: errorResponse("Project or site-audit run not found.")
     }
   },
   {
     method: "get",
     path: "/api/v1/projects/{name}/technical-aeo/pages",
-    summary: "List audited pages from the latest site-audit run",
-    description: "Returns the per-page breakdown of the latest completed/partial site-audit run (paginated). Filter to `status=error` to surface unreachable pages; sort `score-asc` (default) to surface the worst-scoring pages first.",
+    summary: "List audited pages from a site-audit run",
+    description: "Returns the per-page breakdown of the latest completed/partial site-audit run, or the historical audit selected by `runId` (paginated). Filter to `status=error` to surface unreachable pages; sort `score-asc` (default) to surface the worst-scoring pages first.",
     tags: ["technical-aeo"],
     parameters: [
       nameParameter,
+      { name: "runId", in: "query", description: "Historical site-audit run ID. Omit for the latest audit.", schema: stringSchema },
       { name: "status", in: "query", description: "Filter by page audit status: `success` or `error`.", schema: { type: "string", enum: ["success", "error"] } },
       { name: "sort", in: "query", description: "Sort order: `score-asc` (default), `score-desc`, or `url`.", schema: { type: "string", enum: ["score-asc", "score-desc", "url"] } },
       limitQueryParameter,
@@ -19336,7 +19753,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Audited pages returned.", "SiteAuditPagesResponseDto"),
-      404: errorResponse("Project not found.")
+      404: errorResponse("Project or site-audit run not found.")
     }
   },
   {
@@ -23078,7 +23495,17 @@ async function googleRoutes(app, opts) {
 
 // ../api-routes/src/ads.ts
 import crypto20 from "crypto";
-import { eq as eq25, and as and19, asc as asc4, gte as gte4, lte as lte3, inArray as inArray12 } from "drizzle-orm";
+import { eq as eq25, and as and19, asc as asc5, gte as gte5, lte as lte3, inArray as inArray12 } from "drizzle-orm";
+var AdsPausedPostconditionError = class extends Error {
+  constructor(entityId) {
+    super("OpenAI Ads API did not confirm the required paused state");
+    this.entityId = entityId;
+    this.name = "AdsPausedPostconditionError";
+  }
+  entityId;
+  code = "ADS_PAUSED_POSTCONDITION_FAILED";
+  status = 502;
+};
 function statusDto(row) {
   if (!row) return { connected: false };
   return {
@@ -23099,15 +23526,185 @@ function creativeDto(raw) {
     type: typeof c.type === "string" ? c.type : null,
     title: typeof c.title === "string" ? c.title : null,
     body: typeof c.body === "string" ? c.body : null,
-    targetUrl: typeof c.target_url === "string" ? c.target_url : null
+    targetUrl: typeof c.target_url === "string" ? c.target_url : null,
+    fileId: typeof c.file_id === "string" ? c.file_id : null
+  };
+}
+function locationIdsDto(raw) {
+  if (!raw || typeof raw !== "object") return [];
+  const locations = raw.locations;
+  if (!locations || typeof locations !== "object") return [];
+  const include = locations.include;
+  if (!Array.isArray(include)) return [];
+  return include.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const id = entry.id;
+    return typeof id === "string" && id.length > 0 ? [id] : [];
+  });
+}
+function operationDto(row) {
+  return {
+    id: row.id,
+    operationKey: row.operationKey,
+    kind: row.kind,
+    state: row.state,
+    entityType: row.entityType,
+    entityId: row.entityId,
+    upstreamUpdatedAt: row.upstreamUpdatedAt,
+    errorCode: row.errorCode,
+    errorMessage: row.errorMessage,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
   };
 }
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    const child = value[key];
+    if (child !== void 0) out[key] = canonicalize(child);
+  }
+  return out;
+}
+function requestHash(value) {
+  return crypto20.createHash("sha256").update(JSON.stringify(canonicalize(value))).digest("hex");
+}
+function errorDetails(err) {
+  const candidate = err;
+  const status = typeof candidate.status === "number" ? candidate.status : void 0;
+  const knownClientFailure = err instanceof AppError || status !== void 0 && status >= 400 && status < 500 && status !== 408 && status !== 429;
+  const rawCode = typeof candidate.code === "string" ? candidate.code : err instanceof AppError ? err.code : "upstream_error";
+  const code = rawCode.replace(/[^\w.:-]/g, "_").slice(0, 100) || "upstream_error";
+  const message = err instanceof AppError ? err.message.slice(0, 500) : knownClientFailure ? "OpenAI Ads API rejected the operation" : "OpenAI Ads API outcome could not be confirmed";
+  return {
+    state: knownClientFailure ? AdsOperationStates.failed : AdsOperationStates.unknown,
+    code,
+    message,
+    entityId: typeof candidate.entityId === "string" ? candidate.entityId.slice(0, 200) : void 0
+  };
+}
+function resolveAdsOperator(opts, projectName) {
+  const apiKey = opts.adsCredentialStore?.getConnection(projectName)?.apiKey;
+  if (!apiKey) {
+    throw validationError('No ads connection for this project. Run "canonry ads connect" first.');
+  }
+  if (!opts.adsOperator) {
+    throw validationError("Ads lifecycle operations are not configured for this deployment");
+  }
+  return { apiKey, operator: opts.adsOperator };
+}
+async function executeAdsOperation(app, request, input) {
+  const hash = requestHash({ kind: input.kind, entityType: input.entityType, payload: input.payload });
+  const existing = app.db.select().from(adsOperations).where(and19(
+    eq25(adsOperations.projectId, input.projectId),
+    eq25(adsOperations.operationKey, input.operationKey)
+  )).get();
+  if (existing) {
+    if (existing.requestHash !== hash) {
+      throw alreadyExists("Ads operation key", input.operationKey);
+    }
+    return { operation: operationDto(existing), replayed: true };
+  }
+  const id = crypto20.randomUUID();
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  app.db.insert(adsOperations).values({
+    id,
+    projectId: input.projectId,
+    operationKey: input.operationKey,
+    requestHash: hash,
+    kind: input.kind,
+    state: AdsOperationStates.pending,
+    entityType: input.entityType,
+    createdAt,
+    updatedAt: createdAt
+  }).run();
+  let result;
+  try {
+    result = await input.run();
+    if (input.expectedStatus !== void 0 && result.status !== input.expectedStatus) {
+      if (input.remediateStatus) result = await input.remediateStatus(result);
+      if (result.status !== input.expectedStatus) {
+        throw new AdsPausedPostconditionError(result.id);
+      }
+    }
+    const succeededResult = result;
+    const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.transaction((tx) => {
+      tx.update(adsOperations).set({
+        state: AdsOperationStates.succeeded,
+        entityId: succeededResult.id,
+        upstreamUpdatedAt: succeededResult.updatedAt ?? null,
+        updatedAt
+      }).where(eq25(adsOperations.id, id)).run();
+      writeAuditLog(tx, auditFromRequest(request, {
+        projectId: input.projectId,
+        actor: "api",
+        action: `ads.${input.kind}.succeeded`,
+        entityType: input.entityType,
+        entityId: succeededResult.id,
+        diff: { operationId: id, operationKey: input.operationKey }
+      }));
+    });
+    const row = app.db.select().from(adsOperations).where(eq25(adsOperations.id, id)).get();
+    return { operation: operationDto(row), replayed: false };
+  } catch (err) {
+    const failure = errorDetails(err);
+    const entityId = failure.entityId ?? result?.id;
+    const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    app.db.transaction((tx) => {
+      tx.update(adsOperations).set({
+        state: failure.state,
+        entityId,
+        errorCode: failure.code,
+        errorMessage: failure.message,
+        updatedAt
+      }).where(eq25(adsOperations.id, id)).run();
+      writeAuditLog(tx, auditFromRequest(request, {
+        projectId: input.projectId,
+        actor: "api",
+        action: `ads.${input.kind}.${failure.state}`,
+        entityType: input.entityType,
+        entityId: entityId ?? id,
+        diff: { operationId: id, operationKey: input.operationKey, errorCode: failure.code }
+      }));
+    });
+    if (err instanceof AppError) throw err;
+    throw providerError("OpenAI Ads API mutation failed", {
+      operationId: id,
+      operationKey: input.operationKey,
+      state: failure.state,
+      code: failure.code
+    });
+  }
+}
+function parseBody(schema, value) {
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) throw validationError("Invalid ads operation request", { issues: parsed.error.issues });
+  return parsed.data;
+}
+function assertExpectedUpdatedAt(entity, expected) {
+  if (entity.updatedAt !== expected) {
+    throw validationError("The upstream ad entity changed since it was reviewed", {
+      expectedUpdatedAt: expected,
+      actualUpdatedAt: entity.updatedAt
+    });
+  }
+}
+function assertPausedForUpdate(entity) {
+  if (entity.status !== AdsEntityStatuses.paused) {
+    throw validationError("Pause the upstream ad entity before updating it", {
+      actualStatus: entity.status
+    });
+  }
+}
 async function adsRoutes(app, opts) {
   app.post(
     "/projects/:name/ads/connect",
     async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
       const project = resolveProject(app.db, request.params.name);
-      const parsed = adsConnectRequestSchema.safeParse(request.body ?? {});
+      const parsed = adsConnectRequestSchema.safeParse(request.body);
       if (!parsed.success) throw validationError('"apiKey" is required');
       if (!opts.adsCredentialStore || !opts.verifyAdsAccount) {
         throw validationError("Ads credential storage is not configured for this deployment");
@@ -23165,6 +23762,7 @@ async function adsRoutes(app, opts) {
     }
   );
   app.delete("/projects/:name/ads/connection", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
     const project = resolveProject(app.db, request.params.name);
     const row = app.db.select().from(adsConnections).where(eq25(adsConnections.projectId, project.id)).get();
     if (row) {
@@ -23188,7 +23786,221 @@ async function adsRoutes(app, opts) {
     const row = app.db.select().from(adsConnections).where(eq25(adsConnections.projectId, project.id)).get();
     return statusDto(row);
   });
+  app.get(
+    "/projects/:name/ads/operations/:operationKey",
+    async (request) => {
+      const project = resolveProject(app.db, request.params.name);
+      const row = app.db.select().from(adsOperations).where(and19(
+        eq25(adsOperations.projectId, project.id),
+        eq25(adsOperations.operationKey, request.params.operationKey)
+      )).get();
+      if (!row) throw notFound("Ads operation", request.params.operationKey);
+      const response = { operation: operationDto(row), replayed: true };
+      return response;
+    }
+  );
+  app.post("/projects/:name/ads/files", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
+    const project = resolveProject(app.db, request.params.name);
+    const body = parseBody(adsImageUploadRequestSchema, request.body);
+    const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+    return executeAdsOperation(app, request, {
+      projectId: project.id,
+      operationKey: body.operationKey,
+      kind: AdsOperationKinds.image_upload,
+      entityType: AdsEntityTypes.file,
+      payload: { imageUrl: body.imageUrl },
+      run: async () => {
+        const result = await operator.uploadImage(apiKey, body.imageUrl);
+        return { id: result.fileId };
+      }
+    });
+  });
+  app.post("/projects/:name/ads/campaigns", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
+    const project = resolveProject(app.db, request.params.name);
+    const body = parseBody(adsCampaignCreateRequestSchema, request.body);
+    const { operationKey, ...providerInput } = body;
+    const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+    return executeAdsOperation(app, request, {
+      projectId: project.id,
+      operationKey,
+      kind: AdsOperationKinds.campaign_create,
+      entityType: AdsEntityTypes.campaign,
+      payload: providerInput,
+      expectedStatus: AdsEntityStatuses.paused,
+      remediateStatus: (result) => operator.pauseCampaign(apiKey, result.id),
+      run: async () => operator.createCampaign(apiKey, providerInput)
+    });
+  });
+  app.post("/projects/:name/ads/ad-groups", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
+    const project = resolveProject(app.db, request.params.name);
+    const body = parseBody(adsAdGroupCreateRequestSchema, request.body);
+    const { operationKey, ...providerInput } = body;
+    const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+    return executeAdsOperation(app, request, {
+      projectId: project.id,
+      operationKey,
+      kind: AdsOperationKinds.ad_group_create,
+      entityType: AdsEntityTypes.ad_group,
+      payload: providerInput,
+      expectedStatus: AdsEntityStatuses.paused,
+      remediateStatus: (result) => operator.pauseAdGroup(apiKey, result.id),
+      run: async () => operator.createAdGroup(apiKey, providerInput)
+    });
+  });
+  app.post("/projects/:name/ads/ads", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
+    const project = resolveProject(app.db, request.params.name);
+    const body = parseBody(adsAdCreateRequestSchema, request.body);
+    const { operationKey, ...providerInput } = body;
+    const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+    return executeAdsOperation(app, request, {
+      projectId: project.id,
+      operationKey,
+      kind: AdsOperationKinds.ad_create,
+      entityType: AdsEntityTypes.ad,
+      payload: providerInput,
+      expectedStatus: AdsEntityStatuses.paused,
+      remediateStatus: (result) => operator.pauseAd(apiKey, result.id),
+      run: async () => operator.createAd(apiKey, providerInput)
+    });
+  });
+  app.post(
+    "/projects/:name/ads/campaigns/:id",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsCampaignUpdateRequestSchema, request.body);
+      const { operationKey, expectedUpdatedAt, ...update } = body;
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey,
+        kind: AdsOperationKinds.campaign_update,
+        entityType: AdsEntityTypes.campaign,
+        payload: { id: request.params.id, expectedUpdatedAt, update },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseCampaign(apiKey, result.id),
+        run: async () => {
+          const current = await operator.getCampaign(apiKey, request.params.id);
+          assertExpectedUpdatedAt(current, expectedUpdatedAt);
+          assertPausedForUpdate(current);
+          return operator.updateCampaign(apiKey, request.params.id, update);
+        }
+      });
+    }
+  );
+  app.post(
+    "/projects/:name/ads/ad-groups/:id",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsAdGroupUpdateRequestSchema, request.body);
+      const { operationKey, expectedUpdatedAt, ...update } = body;
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey,
+        kind: AdsOperationKinds.ad_group_update,
+        entityType: AdsEntityTypes.ad_group,
+        payload: { id: request.params.id, expectedUpdatedAt, update },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseAdGroup(apiKey, result.id),
+        run: async () => {
+          const current = await operator.getAdGroup(apiKey, request.params.id);
+          assertExpectedUpdatedAt(current, expectedUpdatedAt);
+          assertPausedForUpdate(current);
+          return operator.updateAdGroup(apiKey, request.params.id, update);
+        }
+      });
+    }
+  );
+  app.post(
+    "/projects/:name/ads/ads/:id",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsAdUpdateRequestSchema, request.body);
+      const { operationKey, expectedUpdatedAt, ...update } = body;
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey,
+        kind: AdsOperationKinds.ad_update,
+        entityType: AdsEntityTypes.ad,
+        payload: { id: request.params.id, expectedUpdatedAt, update },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseAd(apiKey, result.id),
+        run: async () => {
+          const current = await operator.getAd(apiKey, request.params.id);
+          assertExpectedUpdatedAt(current, expectedUpdatedAt);
+          assertPausedForUpdate(current);
+          return operator.updateAd(apiKey, request.params.id, update);
+        }
+      });
+    }
+  );
+  app.post(
+    "/projects/:name/ads/campaigns/:id/pause",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsPauseRequestSchema, request.body);
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey: body.operationKey,
+        kind: AdsOperationKinds.campaign_pause,
+        entityType: AdsEntityTypes.campaign,
+        payload: { id: request.params.id },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseCampaign(apiKey, result.id),
+        run: async () => operator.pauseCampaign(apiKey, request.params.id)
+      });
+    }
+  );
+  app.post(
+    "/projects/:name/ads/ad-groups/:id/pause",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsPauseRequestSchema, request.body);
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey: body.operationKey,
+        kind: AdsOperationKinds.ad_group_pause,
+        entityType: AdsEntityTypes.ad_group,
+        payload: { id: request.params.id },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseAdGroup(apiKey, result.id),
+        run: async () => operator.pauseAdGroup(apiKey, request.params.id)
+      });
+    }
+  );
+  app.post(
+    "/projects/:name/ads/ads/:id/pause",
+    async (request) => {
+      requireScope(request, ADS_WRITE_SCOPE);
+      const project = resolveProject(app.db, request.params.name);
+      const body = parseBody(adsPauseRequestSchema, request.body);
+      const { apiKey, operator } = resolveAdsOperator(opts, project.name);
+      return executeAdsOperation(app, request, {
+        projectId: project.id,
+        operationKey: body.operationKey,
+        kind: AdsOperationKinds.ad_pause,
+        entityType: AdsEntityTypes.ad,
+        payload: { id: request.params.id },
+        expectedStatus: AdsEntityStatuses.paused,
+        remediateStatus: (result) => operator.pauseAd(apiKey, result.id),
+        run: async () => operator.pauseAd(apiKey, request.params.id)
+      });
+    }
+  );
   app.post("/projects/:name/ads/sync", async (request) => {
+    requireScope(request, ADS_WRITE_SCOPE);
     const project = resolveProject(app.db, request.params.name);
     const row = app.db.select().from(adsConnections).where(eq25(adsConnections.projectId, project.id)).get();
     if (!row) {
@@ -23229,7 +24041,9 @@ async function adsRoutes(app, opts) {
         name: ad.name,
         status: ad.status,
         reviewStatus: ad.reviewStatus,
-        creative: creativeDto(ad.creative)
+        creative: creativeDto(ad.creative),
+        upstreamUpdatedAt: ad.upstreamUpdatedAt,
+        syncedAt: ad.syncedAt
       };
       const list = adsByGroup.get(ad.adGroupId) ?? [];
       list.push(dto);
@@ -23241,11 +24055,14 @@ async function adsRoutes(app, opts) {
         id: group.id,
         campaignId: group.campaignId,
         name: group.name,
+        description: group.description,
         status: group.status,
         billingEventType: group.billingEventType,
         maxBidMicros: group.maxBidMicros,
         contextHints: group.contextHints,
-        ads: adsByGroup.get(group.id) ?? []
+        ads: adsByGroup.get(group.id) ?? [],
+        upstreamUpdatedAt: group.upstreamUpdatedAt,
+        syncedAt: group.syncedAt
       };
       const list = groupsByCampaign.get(group.campaignId) ?? [];
       list.push(dto);
@@ -23254,11 +24071,17 @@ async function adsRoutes(app, opts) {
     const campaigns = campaignRows.map((campaign) => ({
       id: campaign.id,
       name: campaign.name,
+      description: campaign.description,
       status: campaign.status,
+      startTime: campaign.startTime,
+      endTime: campaign.endTime,
       biddingType: campaign.biddingType,
       dailySpendLimitMicros: campaign.dailySpendLimitMicros,
       lifetimeSpendLimitMicros: campaign.lifetimeSpendLimitMicros,
-      adGroups: groupsByCampaign.get(campaign.id) ?? []
+      locationIds: locationIdsDto(campaign.targeting),
+      adGroups: groupsByCampaign.get(campaign.id) ?? [],
+      upstreamUpdatedAt: campaign.upstreamUpdatedAt,
+      syncedAt: campaign.syncedAt
     }));
     const response = { campaigns };
     return response;
@@ -23277,9 +24100,9 @@ async function adsRoutes(app, opts) {
     const conditions = [eq25(adsInsightsDaily.projectId, project.id)];
     if (parsedLevel) conditions.push(eq25(adsInsightsDaily.level, parsedLevel));
     if (entityId) conditions.push(eq25(adsInsightsDaily.entityId, entityId));
-    if (from) conditions.push(gte4(adsInsightsDaily.date, from));
+    if (from) conditions.push(gte5(adsInsightsDaily.date, from));
     if (to) conditions.push(lte3(adsInsightsDaily.date, to));
-    const rows = app.db.select().from(adsInsightsDaily).where(and19(...conditions)).orderBy(asc4(adsInsightsDaily.date)).all();
+    const rows = app.db.select().from(adsInsightsDaily).where(and19(...conditions)).orderBy(asc5(adsInsightsDaily.date)).all();
     const dtoRows = rows.map((row) => ({
       level: row.level,
       entityId: row.entityId,
@@ -26768,7 +27591,7 @@ async function wordpressRoutes(app, opts) {
 
 // ../api-routes/src/backlinks.ts
 import crypto24 from "crypto";
-import { and as and24, asc as asc5, desc as desc14, eq as eq29, sql as sql11 } from "drizzle-orm";
+import { and as and24, asc as asc6, desc as desc14, eq as eq29, sql as sql11 } from "drizzle-orm";
 
 // ../integration-commoncrawl/src/constants.ts
 import os2 from "os";
@@ -27527,7 +28350,7 @@ async function backlinksRoutes(app, opts) {
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
       const source = parseSourceParam(request.query.source);
-      const rows = app.db.select().from(backlinkSummaries).where(and24(eq29(backlinkSummaries.projectId, project.id), eq29(backlinkSummaries.source, source))).orderBy(asc5(backlinkSummaries.queriedAt)).all();
+      const rows = app.db.select().from(backlinkSummaries).where(and24(eq29(backlinkSummaries.projectId, project.id), eq29(backlinkSummaries.source, source))).orderBy(asc6(backlinkSummaries.queriedAt)).all();
       const response = rows.map((r) => ({
         release: r.release,
         totalLinkingDomains: r.totalLinkingDomains,
@@ -27583,7 +28406,7 @@ async function backlinksRoutes(app, opts) {
 // ../api-routes/src/traffic.ts
 import crypto26 from "crypto";
 import { Agent as UndiciAgent } from "undici";
-import { and as and25, desc as desc15, eq as eq30, gte as gte5, lte as lte4, sql as sql12 } from "drizzle-orm";
+import { and as and25, desc as desc15, eq as eq30, gte as gte6, lte as lte4, sql as sql12 } from "drizzle-orm";
 
 // ../integration-cloud-run/src/auth.ts
 import crypto25 from "crypto";
@@ -31490,28 +32313,28 @@ async function runBackfillTask(options) {
       tx.delete(crawlerEventsHourly).where(
         and25(
           eq30(crawlerEventsHourly.sourceId, sourceRow.id),
-          gte5(crawlerEventsHourly.tsHour, windowStartIso),
+          gte6(crawlerEventsHourly.tsHour, windowStartIso),
           lte4(crawlerEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiUserFetchEventsHourly).where(
         and25(
           eq30(aiUserFetchEventsHourly.sourceId, sourceRow.id),
-          gte5(aiUserFetchEventsHourly.tsHour, windowStartIso),
+          gte6(aiUserFetchEventsHourly.tsHour, windowStartIso),
           lte4(aiUserFetchEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiReferralEventsHourly).where(
         and25(
           eq30(aiReferralEventsHourly.sourceId, sourceRow.id),
-          gte5(aiReferralEventsHourly.tsHour, windowStartIso),
+          gte6(aiReferralEventsHourly.tsHour, windowStartIso),
           lte4(aiReferralEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(rawEventSamples).where(
         and25(
           eq30(rawEventSamples.sourceId, sourceRow.id),
-          gte5(rawEventSamples.ts, windowStartIso),
+          gte6(rawEventSamples.ts, windowStartIso),
           lte4(rawEventSamples.ts, windowEndIso)
         )
       ).run();
@@ -32625,7 +33448,7 @@ async function trafficRoutes(app, opts) {
     }).from(crawlerEventsHourly).where(
       and25(
         eq30(crawlerEventsHourly.sourceId, row.id),
-        gte5(crawlerEventsHourly.tsHour, since)
+        gte6(crawlerEventsHourly.tsHour, since)
       )
     ).groupBy(crawlerEventsHourly.pathNormalized).all();
     const crawlerSegments = segmentCrawlerHits(
@@ -32635,19 +33458,19 @@ async function trafficRoutes(app, opts) {
     const aiUserFetchTotals = app.db.select({ total: sql12`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
       and25(
         eq30(aiUserFetchEventsHourly.sourceId, row.id),
-        gte5(aiUserFetchEventsHourly.tsHour, since)
+        gte6(aiUserFetchEventsHourly.tsHour, since)
       )
     ).get();
     const aiTotals = app.db.select({ total: sql12`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
       and25(
         eq30(aiReferralEventsHourly.sourceId, row.id),
-        gte5(aiReferralEventsHourly.tsHour, since)
+        gte6(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
     const sampleTotals = app.db.select({ total: sql12`COUNT(*)` }).from(rawEventSamples).where(
       and25(
         eq30(rawEventSamples.sourceId, row.id),
-        gte5(rawEventSamples.ts, since)
+        gte6(rawEventSamples.ts, since)
       )
     ).get();
     const latestRun = app.db.select().from(runs).where(
@@ -32786,7 +33609,7 @@ async function trafficRoutes(app, opts) {
     if (kind === "all" || kind === TrafficEventKinds.crawler) {
       const crawlerFilters = [
         eq30(crawlerEventsHourly.projectId, project.id),
-        gte5(crawlerEventsHourly.tsHour, sinceIso),
+        gte6(crawlerEventsHourly.tsHour, sinceIso),
         lte4(crawlerEventsHourly.tsHour, untilIso)
       ];
       if (sourceIdParam) crawlerFilters.push(eq30(crawlerEventsHourly.sourceId, sourceIdParam));
@@ -32818,7 +33641,7 @@ async function trafficRoutes(app, opts) {
     if (kind === "all" || kind === TrafficEventKinds["ai-user-fetch"]) {
       const userFetchFilters = [
         eq30(aiUserFetchEventsHourly.projectId, project.id),
-        gte5(aiUserFetchEventsHourly.tsHour, sinceIso),
+        gte6(aiUserFetchEventsHourly.tsHour, sinceIso),
         lte4(aiUserFetchEventsHourly.tsHour, untilIso)
       ];
       if (sourceIdParam) userFetchFilters.push(eq30(aiUserFetchEventsHourly.sourceId, sourceIdParam));
@@ -32843,7 +33666,7 @@ async function trafficRoutes(app, opts) {
     if (kind === "all" || kind === TrafficEventKinds["ai-referral"]) {
       const aiFilters = [
         eq30(aiReferralEventsHourly.projectId, project.id),
-        gte5(aiReferralEventsHourly.tsHour, sinceIso),
+        gte6(aiReferralEventsHourly.tsHour, sinceIso),
         lte4(aiReferralEventsHourly.tsHour, untilIso)
       ];
       if (sourceIdParam) aiFilters.push(eq30(aiReferralEventsHourly.sourceId, sourceIdParam));
@@ -34461,7 +35284,7 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and28, eq as eq36, gte as gte6, ne as ne4, sql as sql13 } from "drizzle-orm";
+import { and as and28, eq as eq36, gte as gte7, ne as ne4, sql as sql13 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function skippedNoProject5() {
@@ -34558,7 +35381,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql13`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and28(
           eq36(crawlerEventsHourly.projectId, ctx.project.id),
-          gte6(crawlerEventsHourly.tsHour, warnCutoff)
+          gte7(crawlerEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
@@ -34566,7 +35389,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql13`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and28(
           eq36(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte6(aiReferralEventsHourly.tsHour, warnCutoff)
+          gte7(aiReferralEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
@@ -34582,7 +35405,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql13`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and28(
           eq36(crawlerEventsHourly.projectId, ctx.project.id),
-          gte6(crawlerEventsHourly.tsHour, failCutoff)
+          gte7(crawlerEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
@@ -34590,7 +35413,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql13`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and28(
           eq36(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte6(aiReferralEventsHourly.tsHour, failCutoff)
+          gte7(aiReferralEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
@@ -35005,7 +35828,7 @@ async function doctorRoutes(app, opts) {
 
 // ../api-routes/src/discovery/routes.ts
 import crypto28 from "crypto";
-import { and as and29, desc as desc16, eq as eq37, gte as gte7, inArray as inArray13, isNull, or as or5 } from "drizzle-orm";
+import { and as and29, desc as desc16, eq as eq37, gte as gte8, inArray as inArray13, isNull, or as or5 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -35065,7 +35888,7 @@ async function discoveryRoutes(app, opts) {
           DiscoverySessionStatuses.seeding,
           DiscoverySessionStatuses.probing
         ]),
-        gte7(discoverySessions.createdAt, ageFloorIso)
+        gte8(discoverySessions.createdAt, ageFloorIso)
       )).orderBy(desc16(discoverySessions.createdAt)).get();
       if (existing && existing.runId) {
         return { reused: true, sessionId: existing.id, runId: existing.runId };
@@ -35685,7 +36508,7 @@ function dedupeStrings(input) {
 
 // ../api-routes/src/technical-aeo.ts
 import crypto30 from "crypto";
-import { and as and30, asc as asc6, count, desc as desc17, eq as eq39, inArray as inArray14 } from "drizzle-orm";
+import { and as and30, asc as asc7, count, desc as desc17, eq as eq39, inArray as inArray14, lt as lt2 } from "drizzle-orm";
 var SURFACEABLE_STATUSES = [RunStatuses.completed, RunStatuses.partial];
 function emptyScore(projectName) {
   return {
@@ -35717,16 +36540,20 @@ function parsePositiveInt(value, fallback, max) {
 async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq39(siteAuditSnapshots.runId, runs.id)).where(and30(
+    const baseFilters = [
       eq39(siteAuditSnapshots.projectId, project.id),
       eq39(runs.kind, RunKinds["site-audit"]),
       inArray14(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
-    )).orderBy(desc17(siteAuditSnapshots.createdAt)).limit(2).all();
-    const latest = rows[0];
-    if (!latest) return emptyScore(project.name);
+    ];
+    const targetFilters = request.query.runId ? [...baseFilters, eq39(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
+    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq39(siteAuditSnapshots.runId, runs.id)).where(and30(...targetFilters)).orderBy(desc17(siteAuditSnapshots.createdAt)).limit(1).get();
+    if (!latest) {
+      if (request.query.runId) throw notFound("Site audit run", request.query.runId);
+      return emptyScore(project.name);
+    }
     const snap = latest.snap;
-    const previous = rows[1]?.snap ?? null;
+    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq39(siteAuditSnapshots.runId, runs.id)).where(and30(...baseFilters, lt2(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc17(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
     const deltaScore = previous ? snap.aggregateScore - previous.aggregateScore : null;
     const trend = deltaScore == null ? null : deltaScore > 0 ? SiteAuditTrendDirections.up : deltaScore < 0 ? SiteAuditTrendDirections.down : SiteAuditTrendDirections.flat;
     return {
@@ -35752,12 +36579,17 @@ async function technicalAeoRoutes(app, opts) {
   });
   app.get("/projects/:name/technical-aeo/pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq39(siteAuditSnapshots.runId, runs.id)).where(and30(
+    const targetFilters = [
       eq39(siteAuditSnapshots.projectId, project.id),
       eq39(runs.kind, RunKinds["site-audit"]),
       inArray14(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
-    )).orderBy(desc17(siteAuditSnapshots.createdAt)).limit(1).get();
+    ];
+    if (request.query.runId) targetFilters.push(eq39(siteAuditSnapshots.runId, request.query.runId));
+    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq39(siteAuditSnapshots.runId, runs.id)).where(and30(...targetFilters)).orderBy(desc17(siteAuditSnapshots.createdAt)).limit(1).get();
+    if (!latest && request.query.runId) {
+      throw notFound("Site audit run", request.query.runId);
+    }
     if (!latest) {
       return { project: project.name, runId: null, auditedAt: null, total: 0, pages: [] };
     }
@@ -35769,7 +36601,7 @@ async function technicalAeoRoutes(app, opts) {
     const total = totalRow?.value ?? 0;
     const limit = parsePositiveInt(request.query.limit, 100, 500);
     const offset = parsePositiveInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER);
-    const orderBy = request.query.sort === "score-desc" ? desc17(siteAuditPages.overallScore) : request.query.sort === "url" ? asc6(siteAuditPages.url) : asc6(siteAuditPages.overallScore);
+    const orderBy = request.query.sort === "score-desc" ? desc17(siteAuditPages.overallScore) : request.query.sort === "url" ? asc7(siteAuditPages.url) : asc7(siteAuditPages.overallScore);
     const rows = app.db.select().from(siteAuditPages).where(where).orderBy(orderBy).limit(limit).offset(offset).all();
     const pages = rows.map((row) => ({
       url: row.url,
@@ -35944,7 +36776,8 @@ async function apiRoutes(app, opts) {
     await api.register(adsRoutes, {
       adsCredentialStore: opts.adsCredentialStore,
       verifyAdsAccount: opts.verifyAdsAccount,
-      onAdsSyncRequested: opts.onAdsSyncRequested
+      onAdsSyncRequested: opts.onAdsSyncRequested,
+      adsOperator: opts.adsOperator
     });
     await api.register(bingRoutes, {
       bingConnectionStore: opts.bingConnectionStore,
@@ -36492,7 +37325,7 @@ var IntelligenceService = class {
     const selected = this.db.select().from(gbpLocations).where(and31(
       eq40(gbpLocations.projectId, projectId),
       eq40(gbpLocations.selected, true),
-      gte8(gbpLocations.syncedAt, windowStart),
+      gte9(gbpLocations.syncedAt, windowStart),
       lte5(gbpLocations.syncedAt, windowEnd)
     )).all();
     if (selected.length === 0) {
@@ -36706,7 +37539,7 @@ var IntelligenceService = class {
         // Backfill must not replay probe runs as if they were real sweeps.
         ne5(runs.trigger, RunTriggers.probe)
       )
-    ).orderBy(asc7(runs.finishedAt)).all();
+    ).orderBy(asc8(runs.finishedAt)).all();
     let startIdx = 0;
     let endIdx = allRuns.length;
     if (opts?.fromRunId) {