@canonry/canonry 4.143.0 → 4.145.0

package/dist/{chunk-TJ6SDLXL.js → chunk-XNAJXSZ2.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-3G5B3IMZ.js";
+} from "./chunk-MBLATP5L.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -27,6 +27,7 @@ import {
   agentSessions,
   agentToolEvents,
   aiUserFetchEventsHourly,
+  anyUsersExist,
   apiKeys,
   apiRoutes,
   auditLog,
@@ -97,6 +98,7 @@ import {
   llmUsageEvents,
   loadDuckdb,
   markSessionFailed,
+  measurementRunCompleteness,
   migrate,
   nextRunFromCron,
   notifications,
@@ -115,6 +117,7 @@ import {
   researchRunQueries,
   researchRuns,
   resolveDestination,
+  resolveTrustProxy,
   resolveVercelSyncDeadlineMs,
   resolveWebhookTarget,
   runs,
@@ -123,7 +126,7 @@ import {
   siteAuditSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-VN3CI6K6.js";
+} from "./chunk-GTBCGJNT.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -181,6 +184,7 @@ import {
   embedClientConfigForRequest,
   factorStatusFromScore,
   filterCapturedCitedUrls,
+  forbidden,
   formatIsoDateInTimeZone,
   frameAncestorsHeaderValue,
   hostMatchesAnyDomain,
@@ -193,11 +197,14 @@ import {
   isVertexGroundingRedirect,
   mapWithConcurrency,
   normalizeIdTokens,
+  normalizeMeasurementExecutionQueryText,
   normalizeServedModel,
   normalizeUrlPath,
   notFound,
+  parseMeasurementRunManifestV1,
   parseOriginList,
   providerError,
+  providerSupportsLocationContext,
   registrableDomain,
   resolveSnapshotRequestQueries,
   serializeForInlineScript,
@@ -210,7 +217,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-KUPTGRME.js";
+} from "./chunk-EFBTZ6ZT.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -917,6 +924,8 @@ var geminiAdapter = {
   name: "gemini",
   displayName: "Gemini",
   mode: "api",
+  // normalize.ts folds the location into the prompt the model receives.
+  supportsLocationContext: true,
   keyUrl: "https://aistudio.google.com/apikey",
   // Upstream model list: https://ai.google.dev/gemini-api/docs/models
   modelRegistry: {
@@ -1265,6 +1274,8 @@ var openaiAdapter = {
   name: "openai",
   displayName: "OpenAI",
   mode: "api",
+  // normalize.ts sets `user_location` on the web_search tool.
+  supportsLocationContext: true,
   keyUrl: "https://platform.openai.com/api-keys",
   // Upstream model list: https://platform.openai.com/docs/models
   modelRegistry: {
@@ -1656,6 +1667,8 @@ var claudeAdapter = {
   name: "claude",
   displayName: "Claude",
   mode: "api",
+  // normalize.ts sets `user_location` on the web_search tool.
+  supportsLocationContext: true,
   keyUrl: "https://platform.claude.com/settings/keys",
   // Upstream model list: https://platform.claude.com/docs/en/about-claude/models/overview
   modelRegistry: {
@@ -1901,6 +1914,8 @@ var localAdapter = {
   name: "local",
   displayName: "Local",
   mode: "api",
+  // normalize.ts folds the location into the system message.
+  supportsLocationContext: true,
   modelRegistry: {
     defaultModel: "llama3",
     validationPattern: /./,
@@ -2444,6 +2459,9 @@ var cdpChatgptAdapter = {
   name: "cdp:chatgpt",
   displayName: "ChatGPT (Browser)",
   mode: "browser",
+  // The browser session's own geolocation decides; the configured location
+  // never reaches the request, so a row from this adapter claims no place.
+  supportsLocationContext: false,
   modelRegistry: {
     defaultModel: "chatgpt-web",
     validationPattern: /./,
@@ -2798,6 +2816,8 @@ var perplexityAdapter = {
   name: "perplexity",
   displayName: "Perplexity",
   mode: "api",
+  // normalize.ts folds the location into the prompt the model receives.
+  supportsLocationContext: true,
   keyUrl: "https://www.perplexity.ai/settings/api",
   // Upstream model list: https://docs.perplexity.ai/guides/model-cards
   modelRegistry: {
@@ -3281,6 +3301,15 @@ var ProviderExecutionGate = class {
     }
   }
 };
+var sharedGates = /* @__PURE__ */ new Map();
+function getSharedProviderExecutionGate(providerName, maxConcurrency, maxPerMinute) {
+  const key = providerName.trim().toLocaleLowerCase("en");
+  const existing = sharedGates.get(key);
+  if (existing) return existing;
+  const gate = new ProviderExecutionGate(maxConcurrency, maxPerMinute);
+  sharedGates.set(key, gate);
+  return gate;
+}
 
 // src/usage-quota.ts
 import crypto3 from "crypto";
@@ -3421,6 +3450,35 @@ async function runWithConcurrency(items, limit, worker) {
   await Promise.all(Array.from({ length: cap }, next));
 }
 var PROVIDER_FANOUT_DEFAULT = 8;
+function resolvePlanExecution(run, projectQueries) {
+  if (!run.measurementPlanVersionId || !run.measurementManifest) return null;
+  const manifest = parseMeasurementRunManifestV1(run.measurementManifest);
+  const queryIdByText = /* @__PURE__ */ new Map();
+  for (const row of projectQueries) {
+    const key = normalizeMeasurementExecutionQueryText(row.query);
+    if (!queryIdByText.has(key)) queryIdByText.set(key, row.id);
+  }
+  const unitsByProvider = /* @__PURE__ */ new Map();
+  const nodes = /* @__PURE__ */ new Set();
+  for (const slot of manifest.expectedSlots) {
+    nodes.add(slot.executionId);
+    const units = unitsByProvider.get(slot.provider) ?? [];
+    units.push({
+      executionId: slot.executionId,
+      queryText: slot.queryText,
+      context: slot.context,
+      queryId: queryIdByText.get(normalizeMeasurementExecutionQueryText(slot.queryText)) ?? null,
+      requestedModel: slot.requestedModel
+    });
+    unitsByProvider.set(slot.provider, units);
+  }
+  return {
+    manifest,
+    unitsByProvider,
+    nodeCount: nodes.size,
+    maxUnitsPerProvider: Math.max(0, ...[...unitsByProvider.values()].map((units) => units.length))
+  };
+}
 function resolveProviderFanout() {
   const raw = process.env.CANONRY_PROVIDER_FANOUT;
   if (!raw) return PROVIDER_FANOUT_DEFAULT;
@@ -3504,6 +3562,7 @@ var JobRunner = class {
     let runLocation;
     let activeProviders = [];
     let projectQueries = [];
+    let planExecution = null;
     let runTrigger;
     let canonicalDomain;
     const providerDispatchCounts = /* @__PURE__ */ new Map();
@@ -3545,17 +3604,24 @@ var JobRunner = class {
           runLocation = projectLocations.find((l) => l.label === project.defaultLocation);
         }
       }
-      const projectProviders = providerOverride ?? project.providers;
-      activeProviders = this.registry.getForProject(projectProviders).map((entry) => {
-        const model = project.providerModels[entry.adapter.name];
-        return model === void 0 ? entry : { ...entry, config: { ...entry.config, model } };
-      });
+      const scopedQueryNames = existingRun.queries;
+      projectQueries = scopedQueryNames ? this.db.select().from(queries).where(and2(eq2(queries.projectId, projectId), inArray(queries.query, scopedQueryNames))).all() : this.db.select().from(queries).where(eq2(queries.projectId, projectId)).all();
+      planExecution = resolvePlanExecution(existingRun, projectQueries);
+      if (planExecution) {
+        const plan = planExecution;
+        const manifestProviders = [...plan.unitsByProvider.keys()];
+        activeProviders = manifestProviders.map((name) => this.registry.get(name)).filter((entry) => entry !== void 0);
+      } else {
+        const projectProviders = providerOverride ?? project.providers;
+        activeProviders = this.registry.getForProject(projectProviders).map((entry) => {
+          const model = project.providerModels[entry.adapter.name];
+          return model === void 0 ? entry : { ...entry, config: { ...entry.config, model } };
+        });
+      }
       if (activeProviders.length === 0) {
         throw new Error("No providers configured. Add at least one provider API key.");
       }
       log.info("run.dispatch", { runId, providerCount: activeProviders.length, providers: activeProviders.map((p) => p.adapter.name) });
-      const scopedQueryNames = existingRun.queries;
-      projectQueries = scopedQueryNames ? this.db.select().from(queries).where(and2(eq2(queries.projectId, projectId), inArray(queries.query, scopedQueryNames))).all() : this.db.select().from(queries).where(eq2(queries.projectId, projectId)).all();
       const projectCompetitors = this.db.select().from(competitors).where(eq2(competitors.projectId, projectId)).all();
       const competitorDomains = projectCompetitors.map((c) => c.domain);
       const allDomains = effectiveDomains({
@@ -3569,12 +3635,12 @@ var JobRunner = class {
       const executionContext = {
         providerCount: activeProviders.length,
         providers: activeProviders.map((provider) => provider.adapter.name),
-        queryCount: projectQueries.length,
+        queryCount: planExecution?.nodeCount ?? projectQueries.length,
         ...runLocation ? { location: runLocation.label } : {},
         ...runTrigger ? { trigger: runTrigger } : {},
         ...canonicalDomain ? { canonicalDomain } : {}
       };
-      const queriesPerProvider = projectQueries.length;
+      const queriesPerProvider = planExecution?.maxUnitsPerProvider ?? projectQueries.length;
       const todayPeriod = getCurrentUsageDay();
       for (const p of activeProviders) {
         const providerScope = `${projectId}:${p.adapter.name}`;
@@ -3591,7 +3657,8 @@ var JobRunner = class {
       for (const provider of activeProviders) {
         executionGates.set(
           provider.adapter.name,
-          new ProviderExecutionGate(
+          getSharedProviderExecutionGate(
+            provider.adapter.name,
             provider.config.quotaPolicy.maxConcurrency,
             provider.config.quotaPolicy.maxRequestsPerMinute
           )
@@ -3756,21 +3823,194 @@ var JobRunner = class {
           }
         }
       };
+      const processNodeForProvider = async (registeredProvider, unit) => {
+        const { adapter, config: providerConfig } = registeredProvider;
+        const providerName = adapter.name;
+        const gate = executionGates.get(providerName);
+        if (!gate) {
+          throw new Error(`Missing execution gate for provider ${providerName}`);
+        }
+        const config = unit.requestedModel ? { ...providerConfig, model: unit.requestedModel } : providerConfig;
+        const requestedContext = unit.context;
+        const supportedContext = requestedContext && providerSupportsLocationContext(adapter) ? { status: "applied", resolved: requestedContext } : null;
+        try {
+          await gate.run(async () => {
+            this.throwIfRunCancelled(runId);
+            providerDispatchCounts.set(providerName, (providerDispatchCounts.get(providerName) ?? 0) + 1);
+            const raw = await adapter.executeTrackedQuery(
+              {
+                query: unit.queryText,
+                canonicalDomains: allDomains,
+                competitorDomains,
+                location: requestedContext ?? void 0
+              },
+              config
+            );
+            this.throwIfRunCancelled(runId);
+            const providerResult = adapter.normalizeResult(raw);
+            const rawGroundingSources = providerResult.groundingSources;
+            const normalized = {
+              ...providerResult,
+              groundingSources: Array.isArray(rawGroundingSources) ? rawGroundingSources : []
+            };
+            let citedUrlCapture;
+            try {
+              citedUrlCapture = await captureCitedUrls(providerName, rawGroundingSources);
+            } catch (err) {
+              citedUrlCapture = {
+                citedUrls: [],
+                captureStatus: "failed",
+                sourceCount: normalized.groundingSources.length,
+                resolvedCount: 0,
+                captureVersion: CITED_URL_CAPTURE_VERSION
+              };
+              log.warn("query.cited-url-capture-failed", {
+                runId,
+                provider: providerName,
+                query: unit.queryText,
+                error: err instanceof Error ? err.message : String(err)
+              });
+            }
+            this.throwIfRunCancelled(runId);
+            const citationState = determineCitationState(normalized, allDomains);
+            const answerMentioned = determineAnswerMentioned(
+              normalized.answerText,
+              allBrandNames,
+              allDomains
+            );
+            const overlap = computeCompetitorOverlap(normalized, competitorDomains);
+            const extractedCompetitors = extractRecommendedCompetitors(
+              normalized.answerText,
+              allDomains,
+              normalized.citedDomains,
+              competitorDomains,
+              allBrandNames
+            );
+            const snapshotId = crypto4.randomUUID();
+            let screenshotRelPath = null;
+            if (raw.screenshotPath && fs2.existsSync(raw.screenshotPath)) {
+              const screenshotDir = path3.join(os3.homedir(), ".canonry", "screenshots", runId);
+              if (!fs2.existsSync(screenshotDir)) fs2.mkdirSync(screenshotDir, { recursive: true });
+              const destPath = path3.join(screenshotDir, `${snapshotId}.png`);
+              fs2.renameSync(raw.screenshotPath, destPath);
+              screenshotRelPath = `${runId}/${snapshotId}.png`;
+            }
+            this.db.insert(querySnapshots).values({
+              id: snapshotId,
+              runId,
+              queryId: unit.queryId,
+              queryText: unit.queryText,
+              provider: providerName,
+              // `model` is what was REQUESTED and `served_model` is what
+              // answered. The manifest froze the request, so it is the
+              // authority here: an adapter that reports its own default rather
+              // than what it was handed would otherwise overwrite the identity
+              // the revision recorded, and nothing would show that it moved.
+              model: unit.requestedModel ?? raw.model,
+              servedModel: raw.servedModel ?? null,
+              citationState,
+              answerMentioned,
+              answerText: normalized.answerText,
+              citedDomains: normalized.citedDomains,
+              citedUrls: citedUrlCapture.citedUrls,
+              captureStatus: citedUrlCapture.captureStatus,
+              sourceCount: citedUrlCapture.sourceCount,
+              resolvedCount: citedUrlCapture.resolvedCount,
+              captureVersion: citedUrlCapture.captureVersion,
+              retrievalStatus: normalized.retrievalStatus,
+              retrievalContract: raw.retrievalContract,
+              competitorOverlap: overlap,
+              recommendedCompetitors: extractedCompetitors,
+              // Only claim the geography the provider actually honoured. A
+              // requested-but-unsupported context stores `location: null` —
+              // "no claim" — rather than the label we asked for, mirroring
+              // `supportedContext` itself: this field is never non-null when
+              // that one is null.
+              location: supportedContext ? requestedContext?.label ?? null : null,
+              measurementExecutionId: unit.executionId,
+              requestedContext,
+              supportedContext,
+              screenshotPath: screenshotRelPath,
+              rawResponse: JSON.stringify({
+                model: raw.model,
+                servedModel: raw.servedModel ?? null,
+                groundingSources: normalized.groundingSources,
+                searchQueries: normalized.searchQueries,
+                apiResponse: raw.rawResponse
+              }),
+              createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            }).run();
+            totalSnapshotsInserted++;
+            log.info("query.citation", {
+              runId,
+              provider: providerName,
+              query: unit.queryText,
+              executionId: unit.executionId,
+              location: requestedContext?.label ?? null,
+              citationState,
+              answerMentioned
+            });
+          });
+        } catch (err) {
+          if (err instanceof RunCancelledError) {
+            throw err;
+          }
+          const msg = err instanceof Error ? err.message : String(err);
+          const stack = err instanceof Error ? err.stack : void 0;
+          log.error("query.failed", { runId, provider: providerName, query: unit.queryText, executionId: unit.executionId, error: msg, stack });
+          if (!providerErrors.has(providerName)) {
+            providerErrors.set(providerName, msg);
+          }
+        }
+      };
       providerCallStart = Date.now();
-      await runWithConcurrency(apiProviders, resolveProviderFanout(), async (registeredProvider) => {
-        await Promise.all(projectQueries.map(async (q) => {
-          await processQueryForProvider(registeredProvider, q);
-        }));
-      });
-      for (const registeredProvider of browserProviders) {
-        for (const q of projectQueries) {
-          await processQueryForProvider(registeredProvider, q);
+      if (planExecution) {
+        const plan = planExecution;
+        const unitsFor = (provider) => plan.unitsByProvider.get(provider.adapter.name.trim().toLocaleLowerCase("en")) ?? [];
+        log.info("run.plan-dispatch", {
+          runId,
+          expectedSlots: plan.manifest.expectedSlots.length,
+          executionNodes: plan.nodeCount,
+          providers: [...plan.unitsByProvider.keys()]
+        });
+        await runWithConcurrency(apiProviders, resolveProviderFanout(), async (registeredProvider) => {
+          await Promise.all(unitsFor(registeredProvider).map(async (unit) => {
+            await processNodeForProvider(registeredProvider, unit);
+          }));
+        });
+        for (const registeredProvider of browserProviders) {
+          for (const unit of unitsFor(registeredProvider)) {
+            await processNodeForProvider(registeredProvider, unit);
+          }
+        }
+      } else {
+        await runWithConcurrency(apiProviders, resolveProviderFanout(), async (registeredProvider) => {
+          await Promise.all(projectQueries.map(async (q) => {
+            await processQueryForProvider(registeredProvider, q);
+          }));
+        });
+        for (const registeredProvider of browserProviders) {
+          for (const q of projectQueries) {
+            await processQueryForProvider(registeredProvider, q);
+          }
         }
       }
       providerCallEnd = Date.now();
       this.throwIfRunCancelled(runId);
-      const allFailed = totalSnapshotsInserted === 0 && providerErrors.size > 0;
-      const someFailed = providerErrors.size > 0;
+      if (planExecution) {
+        for (const [provider, units] of planExecution.unitsByProvider) {
+          const providerName = provider;
+          const dispatched = providerDispatchCounts.get(providerName) ?? 0;
+          if (dispatched >= units.length || providerErrors.has(providerName)) continue;
+          providerErrors.set(
+            providerName,
+            `${units.length - dispatched} expected measurement(s) did not run: no ${provider} provider was available to this worker.`
+          );
+        }
+      }
+      const planShortfall = planExecution ? Math.max(0, planExecution.manifest.expectedSlots.length - totalSnapshotsInserted) : 0;
+      const allFailed = totalSnapshotsInserted === 0 && (providerErrors.size > 0 || planShortfall > 0);
+      const someFailed = providerErrors.size > 0 || planShortfall > 0;
       if (allFailed) {
         const errorDetail = serializeRunError(buildRunErrorFromMessages(providerErrors));
         this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq2(runs.id, runId)).run();
@@ -3822,7 +4062,7 @@ var JobRunner = class {
       const executionContext = {
         providerCount: activeProviders.length,
         providers: activeProviders.map((provider) => provider.adapter.name),
-        queryCount: projectQueries.length,
+        queryCount: planExecution?.nodeCount ?? projectQueries.length,
         ...runLocation ? { location: runLocation.label } : {},
         ...runTrigger ? { trigger: runTrigger } : {},
         ...canonicalDomain ? { canonicalDomain } : {}
@@ -3916,11 +4156,13 @@ var JobRunner = class {
       finishedAt: runs.finishedAt,
       error: runs.error,
       trigger: runs.trigger,
-      queries: runs.queries
+      queries: runs.queries,
+      measurementPlanVersionId: runs.measurementPlanVersionId,
+      measurementManifest: runs.measurementManifest
     }).from(runs).where(eq2(runs.id, runId)).get();
   }
   isRunCancelled(runId) {
-    return this.getRunState(runId)?.status === "cancelled";
+    return this.db.select({ status: runs.status }).from(runs).where(eq2(runs.id, runId)).get()?.status === "cancelled";
   }
   throwIfRunCancelled(runId) {
     if (this.isRunCancelled(runId)) {
@@ -7178,7 +7420,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-V6JYDYGF.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-DVMEVHAG.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -8435,12 +8677,17 @@ var Scheduler = class {
         resolvedLocation = loc;
       }
       const locationLabel = resolvedLocation?.label ?? null;
+      const scheduleProviders = currentSchedule.providers;
+      const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
       const queueResult = queueRunIfProjectIdle(this.db, {
         createdAt: now,
         kind: "answer-visibility",
         projectId,
         trigger: "scheduled",
-        location: locationLabel
+        location: locationLabel,
+        providers,
+        runnableProviders: this.callbacks.getRunnableProviderNames?.(),
+        providerModels: this.callbacks.getEffectiveProviderModels?.()
       });
       if (queueResult.conflict) {
         log13.info("run.skipped-active", { projectName: project.name, activeRunId: queueResult.activeRunId });
@@ -8456,8 +8703,6 @@ var Scheduler = class {
         nextRunAt,
         updatedAt: now
       }).where(eq14(schedules.id, currentSchedule.id)).run();
-      const scheduleProviders = currentSchedule.providers;
-      const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
       log13.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
       this.callbacks.onRunCreated(runId, projectId, providers, resolvedLocation);
     } catch (err) {
@@ -8692,6 +8937,15 @@ var Notifier = class {
   computeTransitions(runId, projectId) {
     const thisRun = this.db.select().from(runs).where(eq15(runs.id, runId)).get();
     if (!thisRun) return [];
+    const completeness = measurementRunCompleteness(this.db, runId);
+    if (completeness.planned && !completeness.complete) {
+      log15.info("transitions.skipped-incomplete", {
+        runId,
+        executed: completeness.executed,
+        expected: completeness.expected
+      });
+      return [];
+    }
     const groupSiblings = this.db.select().from(runs).where(and12(
       eq15(runs.projectId, projectId),
       eq15(runs.kind, thisRun.kind),
@@ -8843,6 +9097,21 @@ var RunCoordinator = class {
       log16.info("probe.skip-side-effects", { runId, projectId, kind });
       return;
     }
+    const completeness = measurementRunCompleteness(this.db, runId);
+    if (completeness.planned && !completeness.complete) {
+      log16.info("measurement.incomplete-skip-derived", {
+        runId,
+        projectId,
+        executed: completeness.executed,
+        expected: completeness.expected
+      });
+      try {
+        await this.notifier.onRunCompleted(runId, projectId);
+      } catch (err) {
+        log16.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+      }
+      return;
+    }
     let insightCount = 0;
     let criticalOrHigh = 0;
     if (kind === RunKinds["answer-visibility"]) {
@@ -11298,70 +11567,6 @@ function formatAuditFactorScore(factor) {
 var log19 = createLogger("Snapshot");
 var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
 var SNAPSHOT_QUERY_COUNT = 6;
-var ProviderExecutionGate2 = class {
-  constructor(maxConcurrency, maxPerMinute) {
-    this.maxConcurrency = maxConcurrency;
-    this.maxPerMinute = maxPerMinute;
-  }
-  maxConcurrency;
-  maxPerMinute;
-  window = [];
-  waiters = [];
-  rateLimitChain = Promise.resolve();
-  inFlight = 0;
-  async run(task) {
-    await this.acquire();
-    try {
-      await this.waitForRateLimit();
-      return await task();
-    } finally {
-      this.release();
-    }
-  }
-  async acquire() {
-    if (this.inFlight < Math.max(1, this.maxConcurrency)) {
-      this.inFlight++;
-      return;
-    }
-    await new Promise((resolve) => {
-      this.waiters.push(resolve);
-    });
-    this.inFlight++;
-  }
-  release() {
-    this.inFlight = Math.max(0, this.inFlight - 1);
-    const next = this.waiters.shift();
-    next?.();
-  }
-  async waitForRateLimit() {
-    let releaseChain;
-    const previousChain = this.rateLimitChain;
-    this.rateLimitChain = new Promise((resolve) => {
-      releaseChain = resolve;
-    });
-    await previousChain;
-    try {
-      const now = Date.now();
-      const windowStart = now - 6e4;
-      while (this.window.length > 0 && this.window[0] < windowStart) {
-        this.window.shift();
-      }
-      if (this.window.length >= this.maxPerMinute) {
-        const oldestInWindow = this.window[0];
-        const waitMs = oldestInWindow + 6e4 - now + 50;
-        await new Promise((resolve) => setTimeout(resolve, waitMs));
-        const nowAfterWait = Date.now();
-        const newWindowStart = nowAfterWait - 6e4;
-        while (this.window.length > 0 && this.window[0] < newWindowStart) {
-          this.window.shift();
-        }
-      }
-      this.window.push(Date.now());
-    } finally {
-      releaseChain?.();
-    }
-  }
-};
 var SnapshotService = class {
   constructor(registry) {
     this.registry = registry;
@@ -11495,7 +11700,8 @@ var SnapshotService = class {
     for (const provider of ctx.providers) {
       gates.set(
         provider.adapter.name,
-        new ProviderExecutionGate2(
+        getSharedProviderExecutionGate(
+          provider.adapter.name,
           provider.config.quotaPolicy.maxConcurrency,
           provider.config.quotaPolicy.maxRequestsPerMinute
         )
@@ -11909,7 +12115,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
     const domains = effectiveDomains(project);
     const brands = effectiveBrandNames(project);
     const config = { ...provider.config, model: run.resolvedModel };
-    const gate = new ProviderExecutionGate(provider.config.quotaPolicy.maxConcurrency, provider.config.quotaPolicy.maxRequestsPerMinute);
+    const gate = getSharedProviderExecutionGate(run.provider, provider.config.quotaPolicy.maxConcurrency, provider.config.quotaPolicy.maxRequestsPerMinute);
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -11998,6 +12204,14 @@ var DEFAULT_QUOTA = {
 };
 var SESSION_COOKIE_NAME = "canonry_session";
 var SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+function effectiveProviderModels(registry) {
+  const models = {};
+  for (const provider of registry.getAll()) {
+    const model = provider.config.model ?? provider.adapter.modelRegistry.defaultModel;
+    if (model) models[provider.adapter.name] = model;
+  }
+  return models;
+}
 function parseBooleanEnv(value) {
   const normalized = value?.trim().toLowerCase();
   if (!normalized) return void 0;
@@ -12204,8 +12418,10 @@ async function createServer(opts) {
       }
     }
   } : true;
+  const trustProxy = resolveTrustProxy(process.env.CANONRY_TRUST_PROXY);
   const app = Fastify({
-    logger
+    logger,
+    trustProxy
   });
   const registry = new ProviderRegistry();
   const providers = opts.config.providers ?? {};
@@ -12606,6 +12822,10 @@ async function createServer(opts) {
         app.log.error({ runId, err }, "Scheduled job runner failed");
       });
     },
+    // Same source of truth the HTTP routes use, so a scheduled sweep resolves
+    // "all configured providers" exactly as a hand-triggered one does.
+    getRunnableProviderNames: () => registry.getAll().map((provider) => provider.adapter.name),
+    getEffectiveProviderModels: () => effectiveProviderModels(registry),
     onTrafficSyncRequested: (projectName, sourceId) => {
       aeroClient.trafficSync(projectName, sourceId).catch((err) => {
         app.log.error(
@@ -12967,7 +13187,12 @@ async function createServer(opts) {
     const key = opts.db.select().from(apiKeys).where(eq21(apiKeys.keyHash, hashApiKey(parts[1]))).get();
     return Boolean(key && !key.revokedAt);
   };
+  const namedAccountsInUse = () => anyUsersExist(opts.db);
+  const NAMED_ACCOUNTS_MESSAGE = "This install uses named accounts. Sign in with your name and password.";
   app.get(apiPrefix + "/session", async (request, reply) => {
+    if (namedAccountsInUse()) {
+      return reply.send({ authenticated: false, setupRequired: false });
+    }
     if (!dashboardRequirePassword) {
       return reply.send({ authenticated: true, setupRequired: false });
     }
@@ -12978,6 +13203,10 @@ async function createServer(opts) {
     });
   });
   app.post(apiPrefix + "/session/setup", async (request, reply) => {
+    if (namedAccountsInUse()) {
+      const err = forbidden(NAMED_ACCOUNTS_MESSAGE);
+      return reply.status(err.statusCode).send(err.toJSON());
+    }
     if (!dashboardRequirePassword) {
       return reply.send({ authenticated: true, setupRequired: false });
     }
@@ -13005,6 +13234,10 @@ async function createServer(opts) {
     return reply.send({ authenticated: true });
   });
   app.post(apiPrefix + "/session", async (request, reply) => {
+    if (namedAccountsInUse()) {
+      const err2 = forbidden(NAMED_ACCOUNTS_MESSAGE);
+      return reply.status(err2.statusCode).send(err2.toJSON());
+    }
     if (!dashboardRequirePassword) {
       return reply.send({ authenticated: true, setupRequired: false });
     }
@@ -13117,6 +13350,21 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    // Named-account sessions ride the same cookie path as the older dashboard
+    // cookie, so a sub-path mount behaves the same for both. `secure` is only
+    // forced ON: the config flag knows an https public URL when there is one,
+    // but it cannot see a reverse proxy terminating TLS in front of a
+    // plain-http bind. Passing `false` there would mark the cookie insecure on
+    // exactly the deployment that needs it most, so an unset flag defers to
+    // how the request actually arrived.
+    userSessionCookie: {
+      path: sessionCookiePath,
+      ...sessionCookieSecure ? { secure: true } : {}
+    },
+    // Whether an operator has declared which hops to believe. The per-caller
+    // sign-in budget depends on this being the truth rather than something
+    // inferred from a header the caller controls.
+    trustProxyConfigured: trustProxy !== false,
     ...embed.enabled && embed.projectTabs ? { embedProjectTabs: embed.projectTabs } : {},
     explainContentRecommendation,
     briefContentRecommendation,
@@ -13405,6 +13653,7 @@ async function createServer(opts) {
       });
     },
     getRunnableProviderNames: () => registry.getAll().map((provider) => provider.adapter.name),
+    getEffectiveProviderModels: () => effectiveProviderModels(registry),
     onProviderUpdate: (providerName, apiKey, model, baseUrl, incomingQuota) => {
       const name = providerName;
       if (!adapterMap[name]) return null;