@canonry/canonry 4.153.0 → 4.154.1

package/dist/{chunk-VTL2WOIO.js → chunk-KRMLGFY3.js}

@@ -521,7 +521,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-SKTXCZZD.js";
+} from "./chunk-NNW7TJUZ.js";
 
 // src/intelligence-service.ts
 import { eq as eq57, desc as desc26, asc as asc11, and as and45, ne as ne7, or as or11, inArray as inArray19, gte as gte13, lte as lte10 } from "drizzle-orm";
@@ -22384,15 +22384,19 @@ function loadQueryLookup(db, projectId) {
   return { byId };
 }
 function buildGscSection(db, projectId, projectBrandNames, canonicalDomain, trackedQueries, windowDays2) {
-  const allRows = db.select().from(gscSearchData).where(eq28(gscSearchData.projectId, projectId)).all();
-  const allDailyTotals = readGscDailyTotals(db, projectId, "", "9999-12-31");
-  let maxDate = "";
-  for (const r of allRows) if (r.date > maxDate) maxDate = r.date;
-  for (const r of allDailyTotals) if (r.date > maxDate) maxDate = r.date;
+  const maxSearch = db.select({ m: sql9`MAX(${gscSearchData.date})` }).from(gscSearchData).where(eq28(gscSearchData.projectId, projectId)).get()?.m ?? "";
+  const maxDaily = db.select({ m: sql9`MAX(${gscDailyTotals.date})` }).from(gscDailyTotals).where(eq28(gscDailyTotals.projectId, projectId)).get()?.m ?? "";
+  const maxDate = maxSearch > maxDaily ? maxSearch : maxDaily;
   if (!maxDate) return null;
   const startDate = windowStartDate(maxDate, windowDays2);
-  const rows = allRows.filter((r) => r.date >= startDate && r.date <= maxDate);
-  const dailyTotals = allDailyTotals.filter((r) => r.date >= startDate && r.date <= maxDate);
+  const rows = db.select().from(gscSearchData).where(
+    and22(
+      eq28(gscSearchData.projectId, projectId),
+      gte5(gscSearchData.date, startDate),
+      lte3(gscSearchData.date, maxDate)
+    )
+  ).all();
+  const dailyTotals = readGscDailyTotals(db, projectId, startDate, maxDate);
   if (rows.length === 0 && dailyTotals.length === 0) return null;
   let dimensionedClicks = 0;
   const queryDayAgg = /* @__PURE__ */ new Map();
@@ -22492,12 +22496,16 @@ function buildGaSection(db, projectId, windowDays2) {
     )
   ).limit(1).get() : void 0;
   const fallbackSummary = windowSummary ? null : db.select().from(gaTrafficSummaries).where(eq28(gaTrafficSummaries.projectId, projectId)).orderBy(desc12(gaTrafficSummaries.syncedAt)).limit(1).get();
-  const allSnapshotRows = db.select().from(gaTrafficSnapshots).where(eq28(gaTrafficSnapshots.projectId, projectId)).all();
-  if (!windowSummary && !fallbackSummary && allSnapshotRows.length === 0) return null;
-  let snapshotMaxDate = "";
-  for (const r of allSnapshotRows) if (r.date > snapshotMaxDate) snapshotMaxDate = r.date;
+  const snapshotMaxDate = db.select({ m: sql9`MAX(${gaTrafficSnapshots.date})` }).from(gaTrafficSnapshots).where(eq28(gaTrafficSnapshots.projectId, projectId)).get()?.m ?? "";
+  if (!windowSummary && !fallbackSummary && !snapshotMaxDate) return null;
   const snapshotStartDate = snapshotMaxDate ? windowStartDate(snapshotMaxDate, windowDays2) : "";
-  const snapshotRows = snapshotStartDate ? allSnapshotRows.filter((r) => r.date >= snapshotStartDate && r.date <= snapshotMaxDate) : allSnapshotRows;
+  const snapshotRows = snapshotStartDate ? db.select().from(gaTrafficSnapshots).where(
+    and22(
+      eq28(gaTrafficSnapshots.projectId, projectId),
+      gte5(gaTrafficSnapshots.date, snapshotStartDate),
+      lte3(gaTrafficSnapshots.date, snapshotMaxDate)
+    )
+  ).all() : db.select().from(gaTrafficSnapshots).where(eq28(gaTrafficSnapshots.projectId, projectId)).all();
   const totalSessions = windowSummary?.totalSessions ?? fallbackSummary?.totalSessions ?? snapshotRows.reduce((s, r) => s + r.sessions, 0);
   const totalUsers = windowSummary?.totalUsers ?? fallbackSummary?.totalUsers ?? snapshotRows.reduce((s, r) => s + r.users, 0);
   const totalOrganicSessions = windowSummary?.totalOrganicSessions ?? fallbackSummary?.totalOrganicSessions ?? snapshotRows.reduce((s, r) => s + r.organicSessions, 0);
@@ -35501,8 +35509,9 @@ function isSitemapOwnedByProperty(sitemapUrl, propertyId, canonicalDomain) {
 function signState(payload, secret) {
   return crypto29.createHmac("sha256", secret).update(payload).digest("hex");
 }
+var OAUTH_STATE_MAX_AGE_MS = 15 * 60 * 1e3;
 function buildSignedState(data, secret) {
-  const payload = JSON.stringify(data);
+  const payload = JSON.stringify({ ...data, issuedAt: Date.now() });
   const sig = signState(payload, secret);
   return Buffer.from(JSON.stringify({ payload, sig })).toString("base64url");
 }
@@ -35511,7 +35520,10 @@ function verifySignedState(encoded, secret) {
     const { payload, sig } = JSON.parse(Buffer.from(encoded, "base64url").toString());
     const expected = signState(payload, secret);
     if (!crypto29.timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"))) return null;
-    return JSON.parse(payload);
+    const parsed = JSON.parse(payload);
+    const issuedAt = typeof parsed.issuedAt === "number" ? parsed.issuedAt : null;
+    if (issuedAt === null || Date.now() - issuedAt > OAUTH_STATE_MAX_AGE_MS) return null;
+    return parsed;
   } catch {
     return null;
   }
@@ -41797,9 +41809,12 @@ async function adsRoutes(app, opts) {
 }
 
 // ../api-routes/src/bing.ts
-import crypto33 from "crypto";
+import crypto34 from "crypto";
 import { eq as eq42, and as and33, desc as desc19 } from "drizzle-orm";
 
+// ../integration-bing/src/bing-client.ts
+import crypto33 from "crypto";
+
 // ../integration-bing/src/constants.ts
 var BING_WMT_API_BASE = "https://ssl.bing.com/webmaster/api.svc/json";
 var BING_SUBMIT_URL_BATCH_LIMIT = 500;
@@ -41808,6 +41823,7 @@ var BING_REQUEST_TIMEOUT_MS = 3e4;
 var BING_MAX_RETRIES = 4;
 var BING_RETRY_BASE_DELAY_MS = 2e3;
 var BING_RETRY_MAX_DELAY_MS = 3e4;
+var BING_THROTTLE_COOLDOWN_MS = 10 * 60 * 1e3;
 
 // ../integration-bing/src/types.ts
 var BING_THROTTLE_ERROR_CODES = /* @__PURE__ */ new Set([4, 5]);
@@ -41947,26 +41963,58 @@ async function bingFetchOnce(apiKey, endpoint, opts) {
     throw new BingApiError("Bing API returned invalid JSON", 502);
   }
 }
+var throttleCooldownUntil = /* @__PURE__ */ new Map();
+var cooldownNow = () => Date.now();
+function cooldownKey(apiKey) {
+  return crypto33.createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
+}
+function throttleCooldownRemainingMs(apiKey) {
+  const until = throttleCooldownUntil.get(cooldownKey(apiKey));
+  if (until == null) return 0;
+  const remaining = until - cooldownNow();
+  if (remaining <= 0) {
+    throttleCooldownUntil.delete(cooldownKey(apiKey));
+    return 0;
+  }
+  return remaining;
+}
+function openThrottleCooldown(apiKey) {
+  throttleCooldownUntil.set(cooldownKey(apiKey), cooldownNow() + BING_THROTTLE_COOLDOWN_MS);
+  bingClientLog("error", "http.cooldown-open", { cooldownMs: BING_THROTTLE_COOLDOWN_MS });
+}
 async function bingFetch(apiKey, endpoint, opts) {
   const isIdempotent = (opts?.method ?? "GET") === "GET";
-  return withRetry(() => bingFetchOnce(apiKey, endpoint, opts), {
-    maxRetries: BING_MAX_RETRIES,
-    baseDelayMs: BING_RETRY_BASE_DELAY_MS,
-    maxDelayMs: BING_RETRY_MAX_DELAY_MS,
-    isRetryable: (err) => {
-      if (err instanceof BingApiError && err.isThrottle) return true;
-      return isIdempotent && isRetryableHttpError(err);
-    },
-    computeDelayMs: (_attempt, err, defaultMs) => retryAfterDelayMs(err) ?? defaultMs,
-    onRetry: ({ attempt, err, delayMs }) => {
-      bingClientLog("warn", "http.retry", {
-        endpoint,
-        attempt,
-        delayMs: Math.round(delayMs),
-        throttled: err instanceof BingApiError ? err.isThrottle : false
-      });
-    }
-  });
+  const cooling = throttleCooldownRemainingMs(apiKey);
+  if (cooling > 0) {
+    bingClientLog("warn", "http.cooldown-skip", { endpoint, remainingMs: cooling });
+    throw new BingApiError(
+      `Bing API key is in a throttle cooldown for another ${Math.ceil(cooling / 1e3)}s; the account was still throttled after a full retry budget, so this call was not attempted.`,
+      429
+    );
+  }
+  try {
+    return await withRetry(() => bingFetchOnce(apiKey, endpoint, opts), {
+      maxRetries: BING_MAX_RETRIES,
+      baseDelayMs: BING_RETRY_BASE_DELAY_MS,
+      maxDelayMs: BING_RETRY_MAX_DELAY_MS,
+      isRetryable: (err) => {
+        if (err instanceof BingApiError && err.isThrottle) return true;
+        return isIdempotent && isRetryableHttpError(err);
+      },
+      computeDelayMs: (_attempt, err, defaultMs) => retryAfterDelayMs(err) ?? defaultMs,
+      onRetry: ({ attempt, err, delayMs }) => {
+        bingClientLog("warn", "http.retry", {
+          endpoint,
+          attempt,
+          delayMs: Math.round(delayMs),
+          throttled: err instanceof BingApiError ? err.isThrottle : false
+        });
+      }
+    });
+  } catch (err) {
+    if (err instanceof BingApiError && err.isThrottle) openThrottleCooldown(apiKey);
+    throw err;
+  }
 }
 async function getSites(apiKey) {
   validateApiKey(apiKey);
@@ -42237,7 +42285,7 @@ async function bingRoutes(app, opts) {
       const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
       const now = (/* @__PURE__ */ new Date()).toISOString();
       app.db.insert(bingCoverageSnapshots).values({
-        id: crypto33.randomUUID(),
+        id: crypto34.randomUUID(),
         projectId: project.id,
         syncRunId: snapshotRunId,
         date: snapshotDate,
@@ -42308,7 +42356,7 @@ async function bingRoutes(app, opts) {
       throw validationError("url is required");
     }
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto33.randomUUID();
+    const runId = crypto34.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -42329,7 +42377,7 @@ async function bingRoutes(app, opts) {
         discoveryDate: result.DiscoveryDate ?? null
       });
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const id = crypto33.randomUUID();
+      const id = crypto34.randomUUID();
       const httpCode = result.HttpStatus ?? result.HttpCode ?? null;
       const lastCrawledDate = parseBingDate(result.LastCrawledDate);
       const inIndexDate = parseBingDate(result.InIndexDate);
@@ -42399,7 +42447,7 @@ async function bingRoutes(app, opts) {
       throw validationError('No Bing site configured. Run "canonry bing set-site <project> <url>" first.');
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto33.randomUUID();
+    const runId = crypto34.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -42684,7 +42732,7 @@ async function cdpRoutes(app, opts) {
 }
 
 // ../api-routes/src/ga.ts
-import crypto34 from "crypto";
+import crypto35 from "crypto";
 import { eq as eq44, desc as desc20, and as and35, sql as sql16 } from "drizzle-orm";
 
 // ../api-routes/src/ga-session-history.ts
@@ -42886,7 +42934,7 @@ function persistAcquisitionMeasurement(db, input) {
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaAcquisitionDaily).values({
-        id: crypto34.randomUUID(),
+        id: crypto35.randomUUID(),
         projectId: input.projectId,
         date: row.date,
         channelGroup: row.channelGroup,
@@ -42928,7 +42976,7 @@ function persistLeadMeasurement(db, input) {
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaLeadEventsDaily).values({
-        id: crypto34.randomUUID(),
+        id: crypto35.randomUUID(),
         projectId: input.projectId,
         date: row.date,
         eventName: row.eventName,
@@ -43208,7 +43256,7 @@ async function ga4Routes(app, opts) {
     const leadDays = measurementState?.leadSyncedAt != null ? Math.min(Math.max(1, days), 90) : 90;
     const leadEventNames = project.measurement.leadEventNames;
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto34.randomUUID();
+    const runId = crypto35.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -43262,7 +43310,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of rows) {
             tx.insert(gaTrafficSnapshots).values({
-              id: crypto34.randomUUID(),
+              id: crypto35.randomUUID(),
               projectId: project.id,
               date: row.date,
               landingPage: row.landingPage,
@@ -43285,7 +43333,7 @@ async function ga4Routes(app, opts) {
         ).run();
         for (const row of dailyTotals) {
           tx.insert(gaDailyTotals).values({
-            id: crypto34.randomUUID(),
+            id: crypto35.randomUUID(),
             projectId: project.id,
             date: row.date,
             sessions: row.sessions,
@@ -43311,7 +43359,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of aiReferrals) {
             tx.insert(gaAiReferrals).values({
-              id: crypto34.randomUUID(),
+              id: crypto35.randomUUID(),
               projectId: project.id,
               date: row.date,
               source: row.source,
@@ -43343,7 +43391,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of socialReferrals) {
             tx.insert(gaSocialReferrals).values({
-              id: crypto34.randomUUID(),
+              id: crypto35.randomUUID(),
               projectId: project.id,
               date: row.date,
               source: row.source,
@@ -43359,7 +43407,7 @@ async function ga4Routes(app, opts) {
         if (syncSummary) {
           tx.delete(gaTrafficSummaries).where(eq44(gaTrafficSummaries.projectId, project.id)).run();
           tx.insert(gaTrafficSummaries).values({
-            id: crypto34.randomUUID(),
+            id: crypto35.randomUUID(),
             projectId: project.id,
             periodStart: summary.periodStart,
             periodEnd: summary.periodEnd,
@@ -43372,7 +43420,7 @@ async function ga4Routes(app, opts) {
           tx.delete(gaTrafficWindowSummaries).where(eq44(gaTrafficWindowSummaries.projectId, project.id)).run();
           for (const ws of windowSummaries) {
             tx.insert(gaTrafficWindowSummaries).values({
-              id: crypto34.randomUUID(),
+              id: crypto35.randomUUID(),
               projectId: project.id,
               windowKey: ws.windowKey,
               periodStart: ws.periodStart,
@@ -44053,7 +44101,7 @@ function parseSchemaPageEntry(entry) {
 }
 
 // ../integration-wordpress/src/wordpress-client.ts
-import crypto35 from "crypto";
+import crypto36 from "crypto";
 function validateUsername(username) {
   if (!username || typeof username !== "string" || username.trim().length === 0) {
     throw new WordpressApiError("AUTH_INVALID", "Username is required and must be a non-empty string", 400);
@@ -44273,7 +44321,7 @@ function buildSnippet(content) {
   return `${text2.slice(0, 157)}...`;
 }
 function contentHash(content) {
-  return crypto35.createHash("sha256").update(content).digest("hex");
+  return crypto36.createHash("sha256").update(content).digest("hex");
 }
 function buildAmbiguousSlugMessage(slug, pages) {
   const candidates = pages.map((page) => {
@@ -45573,7 +45621,7 @@ async function wordpressRoutes(app, opts) {
 }
 
 // ../api-routes/src/backlinks.ts
-import crypto36 from "crypto";
+import crypto37 from "crypto";
 import { and as and37, asc as asc9, desc as desc21, eq as eq45, sql as sql17 } from "drizzle-orm";
 
 // ../integration-commoncrawl/src/constants.ts
@@ -46210,7 +46258,7 @@ async function backlinksRoutes(app, opts) {
       const refreshed = app.db.select().from(ccReleaseSyncs).where(eq45(ccReleaseSyncs.id, existing.id)).get();
       return reply.status(200).send(mapSyncRow(refreshed));
     }
-    const id = crypto36.randomUUID();
+    const id = crypto37.randomUUID();
     app.db.insert(ccReleaseSyncs).values({
       id,
       release,
@@ -46267,7 +46315,7 @@ async function backlinksRoutes(app, opts) {
       throw validationError("Invalid release id");
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto36.randomUUID();
+    const runId = crypto37.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -46356,7 +46404,7 @@ async function backlinksRoutes(app, opts) {
 }
 
 // ../api-routes/src/traffic.ts
-import crypto38 from "crypto";
+import crypto39 from "crypto";
 import { Agent as UndiciAgent } from "undici";
 import { and as and38, desc as desc22, eq as eq46, gte as gte10, lte as lte9, sql as sql18 } from "drizzle-orm";
 
@@ -46377,7 +46425,7 @@ function resolveVercelSyncDeadlineMs(env = process.env) {
 }
 
 // ../integration-cloud-run/src/auth.ts
-import crypto37 from "crypto";
+import crypto38 from "crypto";
 var GOOGLE_TOKEN_URL3 = "https://oauth2.googleapis.com/token";
 var CLOUD_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
 var TOKEN_REQUEST_TIMEOUT_MS = 3e4;
@@ -46408,7 +46456,7 @@ function createServiceAccountJwt2(clientEmail, privateKey, scope) {
   const headerB64 = encode(header);
   const payloadB64 = encode(payload);
   const signingInput = `${headerB64}.${payloadB64}`;
-  const sign = crypto37.createSign("RSA-SHA256");
+  const sign = crypto38.createSign("RSA-SHA256");
   sign.update(signingInput);
   const signature = sign.sign(privateKey, "base64url");
   return `${signingInput}.${signature}`;
@@ -50385,7 +50433,7 @@ async function runBackfillTask(options) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto38.randomUUID(),
+          id: crypto39.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -50514,7 +50562,7 @@ async function trafficRoutes(app, opts) {
       }).where(eq46(trafficSources.id, activeSource.id)).run();
       sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto38.randomUUID();
+      const newId = crypto39.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -50595,7 +50643,7 @@ async function trafficRoutes(app, opts) {
       }).where(eq46(trafficSources.id, activeSource.id)).run();
       sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto38.randomUUID();
+      const newId = crypto39.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -50679,7 +50727,7 @@ async function trafficRoutes(app, opts) {
         }).where(eq46(trafficSources.id, activeSource.id)).run();
         row = tx.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
       } else {
-        const newId = crypto38.randomUUID();
+        const newId = crypto39.randomUUID();
         tx.insert(trafficSources).values({
           id: newId,
           projectId: project.id,
@@ -50713,7 +50761,7 @@ async function trafficRoutes(app, opts) {
       let created = false;
       if (!existingSchedule) {
         tx.insert(schedules).values({
-          id: crypto38.randomUUID(),
+          id: crypto39.randomUUID(),
           projectId: project.id,
           kind: SchedulableRunKinds["traffic-sync"],
           cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
@@ -50768,7 +50816,7 @@ async function trafficRoutes(app, opts) {
     const windowEnd = /* @__PURE__ */ new Date();
     const startedAt = windowEnd.toISOString();
     const syncStartedAtMs = windowEnd.getTime();
-    const runId = crypto38.randomUUID();
+    const runId = crypto39.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -51161,7 +51209,7 @@ async function trafficRoutes(app, opts) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto38.randomUUID(),
+          id: crypto39.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -51412,7 +51460,7 @@ async function trafficRoutes(app, opts) {
       };
     }
     const startedAt = windowEnd.toISOString();
-    const runId = crypto38.randomUUID();
+    const runId = crypto39.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -51782,7 +51830,7 @@ async function trafficRoutes(app, opts) {
 }
 
 // ../api-routes/src/doctor/checks/agent.ts
-import crypto39 from "crypto";
+import crypto40 from "crypto";
 import fs6 from "fs";
 import path7 from "path";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -52013,7 +52061,7 @@ function isInstalled(dir) {
 }
 function hashInstalledFile(filePath) {
   try {
-    return crypto39.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
+    return crypto40.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
   } catch {
     return void 0;
   }
@@ -54086,7 +54134,7 @@ async function doctorRoutes(app, opts) {
 }
 
 // ../api-routes/src/discovery/routes.ts
-import crypto40 from "crypto";
+import crypto41 from "crypto";
 import { and as and42, desc as desc23, eq as eq53, gte as gte12, inArray as inArray17, isNull as isNull4, or as or10 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
@@ -54152,8 +54200,8 @@ async function discoveryRoutes(app, opts) {
       if (existing && existing.runId) {
         return { reused: true, sessionId: existing.id, runId: existing.runId };
       }
-      const sessionId = crypto40.randomUUID();
-      const runId = crypto40.randomUUID();
+      const sessionId = crypto41.randomUUID();
+      const runId = crypto41.randomUUID();
       tx.insert(discoverySessions).values({
         id: sessionId,
         projectId: project.id,
@@ -54407,7 +54455,7 @@ async function discoveryRoutes(app, opts) {
       app.db.transaction((tx) => {
         for (const query of promotedQueries) {
           tx.insert(queries).values({
-            id: crypto40.randomUUID(),
+            id: crypto41.randomUUID(),
             projectId: project.id,
             query,
             provenance,
@@ -54416,7 +54464,7 @@ async function discoveryRoutes(app, opts) {
         }
         for (const domain of promotedCompetitors) {
           tx.insert(competitors).values({
-            id: crypto40.randomUUID(),
+            id: crypto41.randomUUID(),
             projectId: project.id,
             domain,
             provenance,
@@ -54506,7 +54554,7 @@ function selectEligibleCompetitors(competitorMap, competitorTypes) {
 }
 
 // ../api-routes/src/discovery/orchestrate.ts
-import crypto41 from "crypto";
+import crypto42 from "crypto";
 import { eq as eq54 } from "drizzle-orm";
 var DEFAULT_MAX_PROBES = 100;
 var ABSOLUTE_MAX_PROBES = 500;
@@ -54674,7 +54722,7 @@ async function executeDiscovery(opts) {
     probeRows.push({ citedDomains: probe.citedDomains, bucket });
     buckets[bucket]++;
     return {
-      id: crypto41.randomUUID(),
+      id: crypto42.randomUUID(),
       sessionId: opts.sessionId,
       projectId: opts.project.id,
       query: probedCanonicals[index2],
@@ -54726,7 +54774,7 @@ function upsertDomainClassifications(db, projectId, sessionId, competitorMap) {
     const domain = hostOf(entry.domain) ?? "";
     if (!domain) continue;
     db.insert(domainClassifications).values({
-      id: crypto41.randomUUID(),
+      id: crypto42.randomUUID(),
       projectId,
       domain,
       competitorType: entry.competitorType,
@@ -54766,7 +54814,7 @@ function dedupeStrings(input) {
 }
 
 // ../api-routes/src/technical-aeo.ts
-import crypto42 from "crypto";
+import crypto43 from "crypto";
 import { and as and43, asc as asc10, count, desc as desc24, eq as eq55, inArray as inArray18, lt as lt7 } from "drizzle-orm";
 var SURFACEABLE_STATUSES = [RunStatuses.completed, RunStatuses.partial];
 function emptyScore(projectName) {
@@ -54902,7 +54950,7 @@ async function technicalAeoRoutes(app, opts) {
       return { runId: existing.id, status: existing.status };
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto42.randomUUID();
+    const runId = crypto43.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -54920,7 +54968,7 @@ async function technicalAeoRoutes(app, opts) {
 }
 
 // ../api-routes/src/research.ts
-import crypto43 from "crypto";
+import crypto44 from "crypto";
 import { and as and44, desc as desc25, eq as eq56 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 async function researchRoutes(app, opts) {
@@ -54947,7 +54995,7 @@ async function researchRoutes(app, opts) {
     if (!adapter.modelValidationPattern.test(resolvedModel)) throw validationError(`Invalid resolved model "${resolvedModel}" for provider "${providerName}".`, { provider: providerName, model: resolvedModel, hint: adapter.modelValidationHint });
     if (new Set(input.queries.map((query) => query.toLocaleLowerCase())).size !== input.queries.length) throw validationError("Research queries must be unique within a batch.");
     const normalized = { queries: input.queries, provider: providerName, model: requestedModel, location: location ?? null };
-    const requestHash2 = crypto43.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+    const requestHash2 = crypto44.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const decision = app.db.transaction((tx) => {
       if (input.idempotencyKey) {
@@ -54957,9 +55005,9 @@ async function researchRoutes(app, opts) {
           return { reused: true, id: existing.id, shouldDispatch: existing.status === ResearchRunStatuses.queued };
         }
       }
-      const id = crypto43.randomUUID();
+      const id = crypto44.randomUUID();
       tx.insert(researchRuns).values({ id, projectId: project.id, status: ResearchRunStatuses.queued, provider: providerName, requestedModel, resolvedModel, location: location ?? null, totalQueries: input.queries.length, idempotencyKey: input.idempotencyKey ?? null, requestHash: input.idempotencyKey ? requestHash2 : null, createdAt: now }).run();
-      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto43.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
+      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto44.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
       writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       return { reused: false, id, shouldDispatch: true };
     });
@@ -55376,7 +55424,7 @@ function buildTrafficSourceValidators(opts) {
 }
 
 // src/intelligence-service.ts
-import crypto44 from "crypto";
+import crypto45 from "crypto";
 
 // src/logger.ts
 var IS_TTY = process.stdout.isTTY === true;
@@ -56017,7 +56065,7 @@ var IntelligenceService = class {
         }).run();
       }
       tx.insert(healthSnapshots).values({
-        id: crypto44.randomUUID(),
+        id: crypto45.randomUUID(),
         projectId,
         runId,
         overallCitedRate: String(result.health.overallCitedRate),

package/dist/{chunk-SKTXCZZD.js → chunk-NNW7TJUZ.js}

@@ -4084,7 +4084,12 @@ var measurementOverviewResponseSchema = z5.object({
     )
   }).strict(),
   properties: measurementCursorPageSchema(measurementPropertyRowSchema),
-  /** Scope-wide outcome split. Counted over EVERY Property in scope, not the page. */
+  /**
+   * Outcome split over the whole RESULT SET, not the page — so paging through
+   * does not move it. It narrows with `search` exactly as `properties.totalEstimate`
+   * does, because both are computed from the same filtered rows; with no search
+   * that result set is the entire scope.
+   */
   outcomes: measurementOutcomeCountsSchema,
   flags: z5.object({ total: z5.number().int().nonnegative() }).strict(),
   namedShareOfVoice: measurementNamedShareOfVoiceSchema.optional()

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-YV4VKT4M.js";
+} from "./chunk-JOP2DGXL.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -50,7 +50,7 @@ import {
   saveConfigPatch,
   systemError,
   usageError
-} from "./chunk-LNJF7LL5.js";
+} from "./chunk-ANSQ6JNO.js";
 import {
   apiKeys,
   createClient,
@@ -58,7 +58,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-VTL2WOIO.js";
+} from "./chunk-KRMLGFY3.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -122,7 +122,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-SKTXCZZD.js";
+} from "./chunk-NNW7TJUZ.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -13163,6 +13163,8 @@ import fs14 from "fs";
 import path11 from "path";
 var CANONRY_PLUGIN_ID = "canonry@canonry";
 var REQUIRED_SKILLS = ["canonry", "aero"];
+var AGENT_PLUGINS_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+var AGENT_PLUGINS_MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
 function parseSemver(version) {
   const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-z.-]+))?(?:\+[0-9a-z.-]+)?$/i.exec(version);
   if (!match) return null;
@@ -13254,6 +13256,27 @@ function readCodexPluginConfigured(filePath) {
   }
 }
 function verifiedPluginVersion(root, client) {
+  if (client === "codex" && fs14.existsSync(path11.join(root, "plugin.json"))) {
+    const manifest2 = readJson(path11.join(root, "plugin.json"));
+    if (manifest2 && typeof manifest2 === "object") {
+      const plugin2 = manifest2;
+      if (plugin2.$schema === AGENT_PLUGINS_SCHEMA) {
+        if (plugin2.name !== "canonry" || typeof plugin2.version !== "string" || !parseSemver(plugin2.version)) {
+          return null;
+        }
+        const mcp2 = readJson(path11.join(root, "mcp.json"));
+        if (!mcp2 || typeof mcp2 !== "object") return null;
+        const portableMcp = mcp2;
+        if (portableMcp.$schema !== AGENT_PLUGINS_MCP_SCHEMA || portableMcp.mcpServers?.canonry?.type !== "stdio" || portableMcp.mcpServers.canonry.command !== "canonry-mcp") {
+          return null;
+        }
+        return REQUIRED_SKILLS.every((name) => fs14.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
+      }
+      if (typeof plugin2.$schema === "string" && plugin2.$schema.startsWith("https://agent-plugins.org/schemas/")) {
+        return null;
+      }
+    }
+  }
   const manifestDir = client === "claude-code" ? ".claude-plugin" : ".codex-plugin";
   const manifest = readJson(path11.join(root, manifestDir, "plugin.json"));
   if (!manifest || typeof manifest !== "object") return null;