@canonry/canonry 4.153.0 → 4.154.0

package/dist/{chunk-YV4VKT4M.js → chunk-X5I7CAXH.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-LNJF7LL5.js";
+} from "./chunk-ANSQ6JNO.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -126,7 +126,7 @@ import {
   siteAuditSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-VTL2WOIO.js";
+} from "./chunk-IFZS2TXV.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -218,7 +218,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-SKTXCZZD.js";
+} from "./chunk-NNW7TJUZ.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -549,7 +549,7 @@ function checkLatestVersionForServer(opts) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto23 from "crypto";
+import crypto24 from "crypto";
 import fs8 from "fs";
 import path9 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -5553,7 +5553,7 @@ async function executeAdsSync(db, runId, projectId, opts) {
 }
 
 // src/gsc-inspect-sitemap.ts
-import crypto9 from "crypto";
+import crypto10 from "crypto";
 import { eq as eq7 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
@@ -5652,6 +5652,30 @@ async function parseSitemapRecursive(url, urls, visited, depth, isChild) {
   LOC_REGEX.lastIndex = 0;
 }
 
+// src/inspect-rate-gate.ts
+import crypto9 from "crypto";
+var gates = /* @__PURE__ */ new Map();
+function sharedRateGate(key) {
+  let entry = gates.get(key);
+  if (!entry) {
+    entry = { chain: Promise.resolve() };
+    gates.set(key, entry);
+  }
+  const held = entry;
+  return {
+    take(delayMs, sleep3) {
+      const wait = held.chain.then(() => sleep3(delayMs));
+      held.chain = wait.catch(() => {
+      });
+      return wait;
+    }
+  };
+}
+function credentialGateKey(prefix, secret) {
+  const digest = crypto9.createHash("sha256").update(secret).digest("hex").slice(0, 12);
+  return `${prefix}:${digest}`;
+}
+
 // src/gsc-inspect-paced.ts
 var INSPECT_BASE_DELAY_MS = 1e3;
 var INSPECT_MAX_CONCURRENCY = 5;
@@ -5670,41 +5694,43 @@ function isRetryableGscInspectError(err) {
 function defaultSleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function inspectUrlsPaced(urls, cb, deps = {}) {
+async function inspectUrlsPaced(urls, cb, deps) {
   const sleep3 = deps.sleep ?? defaultSleep;
   const jitter = deps.jitter ?? Math.random;
   const concurrency = Math.max(1, Math.min(deps.concurrency ?? INSPECT_MAX_CONCURRENCY, urls.length || 1));
   const isRetryable = deps.isRetryable ?? isRetryableGscInspectError;
+  const spacingMs = deps.spacingMs ?? INSPECT_BASE_DELAY_MS;
+  const maxRetries = deps.maxRetries ?? INSPECT_MAX_RETRIES;
   let inspected = 0;
   let errors = 0;
   let consecutiveRetryableFailures = 0;
   let nextIndex = 0;
   let aborted = false;
   let abortError;
-  let ratePromise = Promise.resolve();
-  const takeRateSlot = () => {
-    const wait = ratePromise.then(() => sleep3(INSPECT_BASE_DELAY_MS + jitter() * INSPECT_PACING_JITTER_MS));
-    ratePromise = wait;
-    return wait;
-  };
+  const gate = sharedRateGate(deps.rateGateKey);
+  const takeRateSlot = () => gate.take(spacingMs + jitter() * INSPECT_PACING_JITTER_MS, sleep3);
   async function worker() {
     for (; ; ) {
       if (aborted) return;
       const index = nextIndex++;
       if (index >= urls.length) return;
       const url = urls[index];
-      if (index > 0) await takeRateSlot();
+      await takeRateSlot();
       if (aborted) return;
       try {
-        const result = await withRetry(() => cb.inspectOne(url), {
-          maxRetries: INSPECT_MAX_RETRIES,
-          baseDelayMs: INSPECT_BASE_DELAY_MS,
+        let attempt = 0;
+        const result = await withRetry(async () => {
+          if (attempt++ > 0) await takeRateSlot();
+          return cb.inspectOne(url);
+        }, {
+          maxRetries,
+          baseDelayMs: spacingMs,
           maxDelayMs: INSPECT_MAX_BACKOFF_MS,
           isRetryable,
           sleep: sleep3,
-          onRetry: ({ attempt, delayMs, err }) => deps.log?.info("inspect.retry", {
+          onRetry: ({ attempt: attempt2, delayMs, err }) => deps.log?.info("inspect.retry", {
             url,
-            attempt,
+            attempt: attempt2,
             delayMs: Math.round(delayMs),
             error: err instanceof Error ? err.message : String(err)
           })
@@ -5801,7 +5827,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
           const rich = ir.richResultsResult;
           const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
           db.insert(gscUrlInspections).values({
-            id: crypto9.randomUUID(),
+            id: crypto10.randomUUID(),
             projectId,
             syncRunId: runId,
             url: pageUrl,
@@ -5825,6 +5851,12 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
         }
       },
       {
+        // Google meters URL Inspection per PROPERTY, so every sweep on this
+        // property queues behind one clock. Latent rather than urgent here (a
+        // property has one project today), but the per-call gate had the same
+        // defect Bing was bitten by, and a manual sweep racing the chained
+        // coverage refresh is exactly the overlap it fails on.
+        rateGateKey: `gsc:${propertyId}`,
         log: {
           info: (action, ctx) => log6.info(action, { runId, projectId, ...ctx }),
           error: (action, ctx) => log6.error(action, { runId, projectId, ...ctx })
@@ -5853,9 +5885,20 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/bing-inspect-sitemap.ts
-import crypto10 from "crypto";
+import crypto11 from "crypto";
 import { eq as eq8, desc as desc3 } from "drizzle-orm";
 var log7 = createLogger("BingInspectSitemap");
+var BING_INSPECT_SPACING_MS = 2e3;
+function describeError(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (err == null) return "unknown error";
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return "unserializable error";
+  }
+}
 function parseBingDate(value) {
   if (!value) return null;
   const match = /\/Date\((-?\d+)(?:[-+]\d+)?\)\//.exec(value);
@@ -5957,7 +6000,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
             derivedInIndex = false;
           }
           db.insert(bingUrlInspections).values({
-            id: crypto10.randomUUID(),
+            id: crypto11.randomUUID(),
             projectId,
             url: pageUrl,
             httpCode,
@@ -5984,7 +6027,23 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
           });
         }
       },
-      { isRetryable: isRetryableHttpError, concurrency: 1, log: log7, ...opts.pacedDeps }
+      {
+        isRetryable: isRetryableHttpError,
+        concurrency: 1,
+        // Bing meters the ACCOUNT, and one API key serves every project here,
+        // so all sweeps on that key must queue behind one clock. Without this
+        // the daily `data-refresh` fired three sweeps in the same millisecond,
+        // each politely pacing itself and collectively tripling the rate.
+        rateGateKey: credentialGateKey("bing", conn.apiKey),
+        spacingMs: BING_INSPECT_SPACING_MS,
+        // The Bing client already retries (BING_MAX_RETRIES, Retry-After aware).
+        // Retrying again here MULTIPLIED it: 5 client attempts x 4 driver
+        // attempts = 20 requests for one throttled URL, so the breaker's
+        // five-failure budget spent ~100 requests and inspected nothing.
+        maxRetries: 0,
+        log: log7,
+        ...opts.pacedDeps
+      }
     );
     if (outcome.aborted) {
       log7.error("inspect.circuit-break", {
@@ -5995,6 +6054,12 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
         note: "Bing inspection stopped early after sustained failures; the remaining pages were not attempted."
       });
     }
+    if (outcome.aborted && inspected === 0) {
+      const detail = describeError(outcome.abortError);
+      throw new Error(
+        `Bing inspection failed for every URL attempted (${errors} of ${targetUrls.length}); coverage was left unchanged rather than re-dated from stored inspections. Last error: ${detail}`
+      );
+    }
     const allInspections = db.select().from(bingUrlInspections).where(eq8(bingUrlInspections.projectId, projectId)).orderBy(desc3(bingUrlInspections.inspectedAt)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     const definitiveByUrl = /* @__PURE__ */ new Map();
@@ -6019,7 +6084,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const snapNow = (/* @__PURE__ */ new Date()).toISOString();
     db.insert(bingCoverageSnapshots).values({
-      id: crypto10.randomUUID(),
+      id: crypto11.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -6037,8 +6102,9 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
         syncRunId: runId
       }
     }).run();
-    const status = errors === sitemapUrls.length ? RunStatuses.failed : errors > 0 ? RunStatuses.partial : RunStatuses.completed;
-    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq8(runs.id, runId)).run();
+    const status = errors > 0 && errors >= targetUrls.length ? RunStatuses.failed : errors > 0 || outcome.aborted ? RunStatuses.partial : RunStatuses.completed;
+    const degradedReason = status === RunStatuses.completed ? null : outcome.aborted ? `Stopped early after sustained failures; ${targetUrls.length - inspected} of ${targetUrls.length} pages were not inspected.` : `${errors} of ${targetUrls.length} pages could not be inspected.`;
+    db.update(runs).set({ status, error: degradedReason, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq8(runs.id, runId)).run();
     log7.info("inspect.completed", {
       runId,
       projectId,
@@ -6059,24 +6125,42 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/coverage-refresh.ts
-import crypto11 from "crypto";
+import crypto12 from "crypto";
 import { and as and6, desc as desc4, eq as eq9, inArray as inArray3 } from "drizzle-orm";
 var log8 = createLogger("CoverageRefresh");
 var COVERAGE_REFRESH_MIN_INTERVAL_MS = 60 * 60 * 1e3;
+var COVERAGE_REFRESH_MANUAL_MIN_INTERVAL_MS = 2 * 60 * 1e3;
 var ACTIVE_OR_DONE_STATUSES = [
   RunStatuses.queued,
   RunStatuses.running,
   RunStatuses.completed,
   RunStatuses.partial
 ];
+var IN_FLIGHT_STATUSES = [RunStatuses.queued, RunStatuses.running];
+function runWasUserInitiated(db, runId) {
+  const row = db.select({ trigger: runs.trigger }).from(runs).where(eq9(runs.id, runId)).get();
+  return row?.trigger === RunTriggers.manual;
+}
 var defaultDeps = { executeInspectSitemap };
-async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps, nowMs = Date.now()) {
+async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps, nowMs = Date.now(), opts = {}) {
   const project = db.select({ canonicalDomain: projects.canonicalDomain }).from(projects).where(eq9(projects.id, projectId)).get();
   if (!project) return null;
   const { clientId, clientSecret } = getGoogleAuthConfig(config);
   if (!clientId || !clientSecret) return null;
   const conn = getGoogleConnection(config, project.canonicalDomain, "gsc");
   if (!conn?.refreshToken || !conn.propertyId) return null;
+  const inFlight2 = db.select({ createdAt: runs.createdAt }).from(runs).where(
+    and6(
+      eq9(runs.projectId, projectId),
+      eq9(runs.kind, RunKinds["inspect-sitemap"]),
+      inArray3(runs.status, IN_FLIGHT_STATUSES)
+    )
+  ).orderBy(desc4(runs.createdAt)).limit(1).get();
+  if (inFlight2) {
+    log8.info("skip.in-flight", { projectId });
+    return null;
+  }
+  const windowMs = opts.userInitiated ? COVERAGE_REFRESH_MANUAL_MIN_INTERVAL_MS : COVERAGE_REFRESH_MIN_INTERVAL_MS;
   const recent = db.select({ createdAt: runs.createdAt }).from(runs).where(
     and6(
       eq9(runs.projectId, projectId),
@@ -6086,12 +6170,12 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
   ).orderBy(desc4(runs.createdAt)).limit(1).get();
   if (recent) {
     const ageMs = nowMs - Date.parse(recent.createdAt);
-    if (Number.isFinite(ageMs) && ageMs < COVERAGE_REFRESH_MIN_INTERVAL_MS) {
-      log8.info("skip.recent", { projectId, ageMs });
+    if (Number.isFinite(ageMs) && ageMs < windowMs) {
+      log8.info("skip.recent", { projectId, ageMs, windowMs, userInitiated: opts.userInitiated === true });
       return null;
     }
   }
-  const runId = crypto11.randomUUID();
+  const runId = crypto12.randomUUID();
   db.insert(runs).values({
     id: runId,
     projectId,
@@ -6114,7 +6198,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
 }
 
 // src/commoncrawl-sync.ts
-import crypto12 from "crypto";
+import crypto13 from "crypto";
 import path4 from "path";
 import { and as and7, eq as eq10, sql as sql4 } from "drizzle-orm";
 var log9 = createLogger("CommonCrawlSync");
@@ -6189,7 +6273,7 @@ async function executeReleaseSync(db, syncId, opts) {
         if (!projectIds) continue;
         for (const projectId of projectIds) {
           expanded.push({
-            id: crypto12.randomUUID(),
+            id: crypto13.randomUUID(),
             projectId,
             releaseSyncId: syncId,
             release,
@@ -6209,7 +6293,7 @@ async function executeReleaseSync(db, syncId, opts) {
         const projectRows = rowsByProject.get(p.id) ?? [];
         const summary = computeSummary(projectRows);
         tx.insert(backlinkSummaries).values({
-          id: crypto12.randomUUID(),
+          id: crypto13.randomUUID(),
           projectId: p.id,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -6306,7 +6390,7 @@ function computeSummary(rows) {
 }
 
 // src/backlink-extract.ts
-import crypto13 from "crypto";
+import crypto14 from "crypto";
 import fs3 from "fs";
 import { and as and8, desc as desc5, eq as eq11 } from "drizzle-orm";
 var log10 = createLogger("BacklinkExtract");
@@ -6362,7 +6446,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       ).run();
       if (rows.length > 0) {
         const values = rows.map((r) => ({
-          id: crypto13.randomUUID(),
+          id: crypto14.randomUUID(),
           projectId,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -6376,7 +6460,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       }
       const summary = computeSummary2(rows);
       tx.insert(backlinkSummaries).values({
-        id: crypto13.randomUUID(),
+        id: crypto14.randomUUID(),
         projectId,
         releaseSyncId: syncId,
         source: BacklinkSources.commoncrawl,
@@ -6419,7 +6503,7 @@ function computeSummary2(rows) {
 }
 
 // src/discovery-run.ts
-import crypto14 from "crypto";
+import crypto15 from "crypto";
 import { and as and9, eq as eq12 } from "drizzle-orm";
 var log11 = createLogger("DiscoveryRun");
 var DEFAULT_SEED_COUNT = 30;
@@ -6774,7 +6858,7 @@ function writeDiscoveryInsight(db, input) {
       eq12(insights.dismissed, false)
     )).run();
     tx.insert(insights).values({
-      id: crypto14.randomUUID(),
+      id: crypto15.randomUUID(),
       projectId: input.projectId,
       runId: input.runId,
       type: "discovery.basket-divergence",
@@ -6810,7 +6894,7 @@ function buildDiscoveryInsightTitle(input) {
 }
 
 // src/execute-site-audit.ts
-import crypto15 from "crypto";
+import crypto16 from "crypto";
 import { eq as eq13 } from "drizzle-orm";
 import { runSitemapAudit } from "@ainyc/aeo-audit";
 var log12 = createLogger("SiteAudit");
@@ -6909,7 +6993,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
     db.transaction((tx) => {
       tx.insert(siteAuditSnapshots).values({
-        id: crypto15.randomUUID(),
+        id: crypto16.randomUUID(),
         projectId,
         runId,
         sitemapUrl: report.sitemapUrl,
@@ -6938,7 +7022,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       }).run();
       for (const page of report.pages) {
         tx.insert(siteAuditPages).values({
-          id: crypto15.randomUUID(),
+          id: crypto16.randomUUID(),
           projectId,
           runId,
           url: page.url,
@@ -7432,7 +7516,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-APPDGUH6.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-B5AETQ5N.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -7953,7 +8037,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
 }
 
 // src/commands/skills.ts
-import crypto16 from "crypto";
+import crypto17 from "crypto";
 import fs4 from "fs";
 import os4 from "os";
 import path5 from "path";
@@ -8008,7 +8092,7 @@ function walkRelative(dir, prefix = "") {
   return out.sort();
 }
 function sha256File(filePath) {
-  return crypto16.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
+  return crypto17.createHash("sha256").update(fs4.readFileSync(filePath)).digest("hex");
 }
 function readSkillManifest(skillDir) {
   try {
@@ -8350,7 +8434,7 @@ var ProviderRegistry = class {
 };
 
 // src/scheduler.ts
-import crypto17 from "crypto";
+import crypto18 from "crypto";
 import cron from "node-cron";
 import { and as and11, eq as eq15, inArray as inArray5, notExists, sql as sql6 } from "drizzle-orm";
 var log13 = createLogger("Scheduler");
@@ -8393,7 +8477,7 @@ var Scheduler = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     for (const project of projectsWithoutHealth) {
       this.db.insert(schedules).values({
-        id: crypto17.randomUUID(),
+        id: crypto18.randomUUID(),
         projectId: project.id,
         kind: SchedulableRunKinds.doctor,
         cronExpr: DEFAULT_HEALTH_CRON,
@@ -8552,7 +8636,7 @@ var Scheduler = class {
           log13.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto18.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8585,7 +8669,7 @@ var Scheduler = class {
           this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq15(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto18.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8660,7 +8744,7 @@ var Scheduler = class {
           this.db.update(schedules).set({ nextRunAt, updatedAt: now }).where(eq15(schedules.id, currentSchedule.id)).run();
           return;
         }
-        const runId2 = crypto17.randomUUID();
+        const runId2 = crypto18.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -8748,7 +8832,7 @@ async function refreshAllIntegrations(client, projectName) {
 
 // src/notifier.ts
 import { eq as eq16, desc as desc6, and as and12, inArray as inArray6, or } from "drizzle-orm";
-import crypto18 from "crypto";
+import crypto19 from "crypto";
 var log15 = createLogger("Notifier");
 var Notifier = class {
   db;
@@ -9074,7 +9158,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto18.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -9236,7 +9320,7 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto22 from "crypto";
+import crypto23 from "crypto";
 import { eq as eq19 } from "drizzle-orm";
 
 // src/agent/session.ts
@@ -9980,7 +10064,7 @@ function buildAeroStateTools(ctx, opts = {}) {
 }
 
 // src/agent/llm-usage.ts
-import crypto19 from "crypto";
+import crypto20 from "crypto";
 var AeroLlmUsageFeatures = {
   turn: "aero.turn"
 };
@@ -9999,7 +10083,7 @@ function recordLlmUsageEvent(args) {
     const usage = args.message.usage;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     args.db.insert(llmUsageEvents).values({
-      id: crypto19.randomUUID(),
+      id: crypto20.randomUUID(),
       projectId: args.projectId,
       runId: args.runId,
       agentSessionId: args.agentSessionId,
@@ -10075,7 +10159,7 @@ function splitAeroAnthropicSystemCachePayload(payload, model) {
 }
 
 // src/agent/tool-usage.ts
-import crypto20 from "crypto";
+import crypto21 from "crypto";
 var AeroToolEventStatuses = {
   success: "success",
   error: "error"
@@ -10138,7 +10222,7 @@ function createAeroToolUsageHooks(args) {
 function recordAgentToolEvent(args) {
   try {
     args.db.insert(agentToolEvents).values({
-      id: crypto20.randomUUID(),
+      id: crypto21.randomUUID(),
       projectId: args.projectId,
       agentSessionId: args.agentSessionId,
       toolCallId: args.toolCallId,
@@ -10365,7 +10449,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto21 from "crypto";
+import crypto22 from "crypto";
 import { and as and13, desc as desc7, eq as eq18, like, sql as sql7 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
@@ -10394,7 +10478,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto21.randomUUID();
+  const id = crypto22.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -10431,7 +10515,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto21.randomUUID();
+  const id = crypto22.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -10710,7 +10794,7 @@ var SessionRegistry = class {
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
     const systemPrompt = loadAeroSystemPrompt();
-    const sessionId = crypto22.randomUUID();
+    const sessionId = crypto23.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -11089,7 +11173,7 @@ ${lines.join("\n")}
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: params.id ?? crypto22.randomUUID(),
+      id: params.id ?? crypto23.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -11708,9 +11792,9 @@ var SnapshotService = class {
     };
   }
   async runSnapshotQueries(ctx) {
-    const gates = /* @__PURE__ */ new Map();
+    const gates2 = /* @__PURE__ */ new Map();
     for (const provider of ctx.providers) {
-      gates.set(
+      gates2.set(
         provider.adapter.name,
         getSharedProviderExecutionGate(
           provider.adapter.name,
@@ -11723,7 +11807,7 @@ var SnapshotService = class {
     return Promise.all(ctx.queries.map(async (query) => ({
       query,
       providerResults: await Promise.all(ctx.providers.map(async (provider) => {
-        const gate = gates.get(provider.adapter.name);
+        const gate = gates2.get(provider.adapter.name);
         return gate.run(async () => {
           try {
             const raw = await provider.adapter.executeTrackedQuery(
@@ -12265,14 +12349,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey(key) {
-  return crypto23.createHash("sha256").update(key).digest("hex");
+  return crypto24.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto23.randomBytes(16);
-  const derived = crypto23.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto24.randomBytes(16);
+  const derived = crypto24.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -12293,14 +12377,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto23.scryptSync(password, salt, expected.length, {
+    const derived = crypto24.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto23.timingSafeEqual(derived, expected),
+      ok: crypto24.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -12309,7 +12393,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto23.timingSafeEqual(candidate, expected);
+    const ok = crypto24.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -13045,7 +13129,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto23.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto24.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -13124,7 +13208,7 @@ async function createServer(opts) {
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto23.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto24.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -13148,7 +13232,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto23.randomBytes(32).toString("hex");
+    const sessionId = crypto24.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -13447,7 +13531,11 @@ async function createServer(opts) {
       executeGscSync(opts.db, runId, projectId, {
         ...syncOpts,
         config: opts.config
-      }).then(() => maybeRefreshGscCoverage(opts.db, opts.config, projectId)).catch((err) => {
+      }).then(
+        () => maybeRefreshGscCoverage(opts.db, opts.config, projectId, void 0, Date.now(), {
+          userInitiated: runWasUserInitiated(opts.db, runId)
+        })
+      ).catch((err) => {
         app.log.error({ runId, err }, "GSC sync failed");
       });
     },
@@ -13504,7 +13592,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto23.randomUUID();
+            const runId = crypto24.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -13631,7 +13719,14 @@ async function createServer(opts) {
       }).then(() => {
         const finished = opts.db.select({ status: runs.status }).from(runs).where(eq22(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
-          return maybeRefreshGscCoverage(opts.db, opts.config, projectId);
+          return maybeRefreshGscCoverage(
+            opts.db,
+            opts.config,
+            projectId,
+            void 0,
+            Date.now(),
+            { userInitiated: runWasUserInitiated(opts.db, runId) }
+          );
         }
         return null;
       }).catch((err) => {
@@ -13724,7 +13819,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto23.randomUUID(),
+            id: crypto24.randomUUID(),
             projectId,
             actor: "api",
             action: existing ? "provider.updated" : "provider.created",