@canonry/canonry 4.156.0 → 4.158.0

package/dist/{chunk-ABNN2ZVR.js → chunk-YP4K2KXH.js}

@@ -35,6 +35,7 @@ import {
   CheckScopes,
   CheckStatuses,
   CitationStates,
+  CloudflareTrafficDeliveryModes,
   ContentActions,
   DEFAULT_DISCOVERY_PROMOTE_BUCKETS,
   DEFAULT_DISCOVERY_PROMOTE_COMPETITOR_TYPES,
@@ -81,6 +82,8 @@ import {
   SITE_HEALTH_PATH_DEFAULT_MAX_DEPTH,
   SITE_HEALTH_PATH_MAX_DEPTH,
   SITE_HEALTH_PATH_MAX_VISITED_NODES,
+  SITE_HEALTH_SCANS_DEFAULT_LIMIT,
+  SITE_HEALTH_SCANS_MAX_LIMIT,
   SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_EDGES,
   SITE_HEALTH_SUBGRAPH_DEFAULT_MAX_NODES,
   SITE_HEALTH_SUBGRAPH_MAX_EDGES,
@@ -197,6 +200,9 @@ import {
   classifySkillFile,
   classifySurfaceFromCategory,
   classifyTrafficPath,
+  cloudflareTrafficSourceConfigSchema,
+  cloudflareWorkerIngestRequestSchema,
+  cloudflareWorkerIngestResponseSchema,
   clusterByCosine,
   coerceSkillManifest,
   compactDateToIso,
@@ -504,6 +510,8 @@ import {
   siteCrawlSummarySchema,
   siteHealthChangesResponseSchema,
   siteHealthPathResponseSchema,
+  siteHealthScansResponseSchema,
+  siteHealthStateSchema,
   siteHealthSubgraphResponseSchema,
   snapshotDiffResponseSchema,
   snapshotListResponseSchema,
@@ -520,6 +528,8 @@ import {
   textContainsBrandAlias,
   textContainsDomain,
   trafficBackfillResponseSchema,
+  trafficConnectCloudflareRequestSchema,
+  trafficConnectCloudflareResponseSchema,
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventsResponseSchema,
@@ -553,10 +563,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-AMPT2EP7.js";
+} from "./chunk-DEVAEC2S.js";
 
 // src/intelligence-service.ts
-import { eq as eq57, desc as desc26, asc as asc11, and as and45, ne as ne7, or as or12, inArray as inArray20, gte as gte13, lte as lte10 } from "drizzle-orm";
+import { eq as eq58, desc as desc26, asc as asc11, and as and46, ne as ne7, or as or12, inArray as inArray20, gte as gte14, lte as lte11 } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -657,6 +667,7 @@ __export(schema_exports, {
   siteCrawlPages: () => siteCrawlPages,
   siteCrawlRunRequests: () => siteCrawlRunRequests,
   siteCrawlSnapshots: () => siteCrawlSnapshots,
+  trafficEventReceipts: () => trafficEventReceipts,
   trafficSources: () => trafficSources,
   usageCounters: () => usageCounters,
   userSessions: () => userSessions,
@@ -2048,12 +2059,31 @@ var trafficSources = sqliteTable("traffic_sources", {
   lastEventIds: text("last_event_ids", { mode: "json" }).$type(),
   archivedAt: text("archived_at"),
   configJson: text("config_json", { mode: "json" }).$type().notNull().default({}),
+  // sha256 hex of the per-source bearer token issued at connect time. Only
+  // populated for push-receive source types (currently `cloudflare`); pull
+  // adapters leave this NULL. The cleartext bearer + HMAC secret never live
+  // in the DB — they go to `~/.canonry/config.yaml` under the per-type
+  // connections block.
+  ingestTokenHash: text("ingest_token_hash"),
+  // Semver reported by the most recent forwarded event. Drives the
+  // `traffic.source.worker-version` doctor check. NULL until the first
+  // event arrives or for source types that don't forward versioned events.
+  lastWorkerVersion: text("last_worker_version"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (table) => [
   index("idx_traffic_sources_project").on(table.projectId),
   index("idx_traffic_sources_project_status").on(table.projectId, table.status)
 ]);
+var trafficEventReceipts = sqliteTable("traffic_event_receipts", {
+  sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
+  eventId: text("event_id").notNull(),
+  receivedAt: text("received_at").notNull(),
+  expiresAt: text("expires_at").notNull()
+}, (table) => [
+  primaryKey({ columns: [table.sourceId, table.eventId] }),
+  index("idx_traffic_event_receipts_expires").on(table.sourceId, table.expiresAt)
+]);
 var crawlerEventsHourly = sqliteTable("crawler_events_hourly", {
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
@@ -5753,6 +5783,32 @@ var MIGRATION_VERSIONS = [
       `CREATE INDEX IF NOT EXISTS idx_site_crawl_graph_edges_target_node
         ON site_crawl_graph_edges(project_id, run_id, attempt_id, target_node_key)`
     ]
+  },
+  {
+    version: 129,
+    name: "traffic-ingest-foundation",
+    // Push-receive traffic sources (currently only `cloudflare`) need a
+    // per-source bearer for the Worker to authenticate against canonry's
+    // ingest endpoint, plus a place to remember the deployed Worker version.
+    // Durable receipts are transport-neutral: direct push and a future Queue
+    // pull consumer both claim an event in the same transaction as rollups.
+    // Cleartext credentials remain outside the database.
+    //
+    // Idempotent: `ALTER TABLE ADD COLUMN` errors with "duplicate column
+    // name" on retry, which the runner already swallows.
+    statements: [
+      `ALTER TABLE traffic_sources ADD COLUMN ingest_token_hash TEXT`,
+      `ALTER TABLE traffic_sources ADD COLUMN last_worker_version TEXT`,
+      `CREATE TABLE IF NOT EXISTS traffic_event_receipts (
+        source_id  TEXT NOT NULL REFERENCES traffic_sources(id) ON DELETE CASCADE,
+        event_id   TEXT NOT NULL,
+        received_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        PRIMARY KEY (source_id, event_id)
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_traffic_event_receipts_expires
+        ON traffic_event_receipts(source_id, expires_at)`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -8560,6 +8616,7 @@ function shouldSkipAuth(url) {
   if (url.endsWith("/session") || url.endsWith("/session/setup")) return true;
   if (url.endsWith("/auth/session") || url.endsWith("/auth/login") || url.endsWith("/auth/logout")) return true;
   if (url.endsWith("/auth/sessions")) return true;
+  if (url.endsWith("/traffic/cloudflare/ingest")) return true;
   return false;
 }
 var USERS_READ_SCOPE = "users.read";
@@ -8625,7 +8682,7 @@ function isOverviewRead(url) {
 }
 function isTechnicalAeoRead(url) {
   const rest = projectRouteRest(url);
-  return rest === "technical-aeo" || rest === "technical-aeo/pages" || rest === "technical-aeo/trend" || rest === "technical-aeo/crawl" || rest === "technical-aeo/graph" || rest === "technical-aeo/subgraph" || rest === "technical-aeo/path" || rest === "technical-aeo/changes" || rest === "technical-aeo/crawl/pages/audit" || rest === "technical-aeo/crawl/pages" || rest === "technical-aeo/structure" || rest === "technical-aeo/internal-links" || rest === "technical-aeo/internal-links/neighbors" || rest === "technical-aeo/dead-links";
+  return rest === "technical-aeo" || rest === "technical-aeo/pages" || rest === "technical-aeo/trend" || rest === "technical-aeo/crawl" || rest === "technical-aeo/graph" || rest === "technical-aeo/subgraph" || rest === "technical-aeo/path" || rest === "technical-aeo/changes" || rest === "technical-aeo/crawl/pages/audit" || rest === "technical-aeo/crawl/pages" || rest === "technical-aeo/runs" || rest === "technical-aeo/structure" || rest === "technical-aeo/internal-links" || rest === "technical-aeo/internal-links/neighbors" || rest === "technical-aeo/dead-links";
 }
 function isReportRead(url) {
   const rest = projectRouteRest(url);
@@ -27359,13 +27416,18 @@ var SCHEMA_TABLE = {
   SiteCrawlSummaryDto: siteCrawlSummarySchema,
   SiteHealthChangesResponseDto: siteHealthChangesResponseSchema,
   SiteHealthPathResponseDto: siteHealthPathResponseSchema,
+  SiteHealthScansResponseDto: siteHealthScansResponseSchema,
   SiteHealthSubgraphResponseDto: siteHealthSubgraphResponseSchema,
   SnapshotDiffResponse: snapshotDiffResponseSchema,
   SnapshotListResponse: snapshotListResponseSchema,
   SnapshotReportDto: snapshotReportSchema,
   SourceBreakdownDto: sourceBreakdownDtoSchema,
   TelemetryEventAcceptedDto: telemetryEventAcceptedDtoSchema,
+  CloudflareWorkerIngestRequest: cloudflareWorkerIngestRequestSchema,
+  CloudflareWorkerIngestResponse: cloudflareWorkerIngestResponseSchema,
   TrafficBackfillResponse: trafficBackfillResponseSchema,
+  TrafficConnectCloudflareRequest: trafficConnectCloudflareRequestSchema,
+  TrafficConnectCloudflareResponse: trafficConnectCloudflareResponseSchema,
   TrafficEventsResponse: trafficEventsResponseSchema,
   TrafficSourceDetailDto: trafficSourceDetailDtoSchema,
   TrafficSourceDto: trafficSourceDtoSchema,
@@ -32933,6 +32995,54 @@ var routeCatalog = [
       502: errorResponse("Vercel request-logs endpoint probe failed (bad token, wrong project / team id, unreachable host, etc.).")
     }
   },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/connect/cloudflare",
+    summary: "Connect a Cloudflare Worker traffic source",
+    description: "Creates or updates a Cloudflare `direct-push` traffic source and returns a secret-free ES-module Worker plus Wrangler configuration. Per-source bearer and HMAC credentials remain in Canonry's credential store and are installed as Worker secret bindings; neither secret appears in source, TOML, API, or MCP output. Reconnect is idempotent: it reuses a matching source and credentials, preserves omitted metadata, and emits the current deployment package. Wrangler deploys the Worker without a route. The operator must attach the exact site route manually and set its Request limit failure mode to Fail open. No upstream probe is performed at connect time.",
+    tags: ["traffic"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: false,
+      content: {
+        "application/json": {
+          schema: { $ref: "#/components/schemas/TrafficConnectCloudflareRequest" }
+        }
+      }
+    },
+    responses: {
+      200: jsonResponse("Connect response with generated Worker script.", "TrafficConnectCloudflareResponse"),
+      400: errorResponse("Invalid Cloudflare connection request or credential storage not configured."),
+      404: errorResponse("Project not found.")
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/cloudflare/ingest",
+    summary: "Ingest a batch of Cloudflare Worker events",
+    description: "Direct-push protocol endpoint. The customer Worker sends selected edge-event batches authenticated by a per-source bearer and HMAC-SHA256 over `${timestamp}.${canonicalJson(payload)}`; object keys are sorted recursively before signing. The global cnry_* bearer does not apply. Headers: `Authorization: Bearer <per-source-token>`, `X-Canonry-Timestamp` (unix seconds), `X-Canonry-Signature` (hex HMAC), `X-Canonry-Source-Id`, and `X-Canonry-Worker-Version`. Authentication completes before project resolution and every auth/path/source mismatch returns the same 401. Accepted event ids are claimed durably in the same transaction as shared crawler, user-fetch, and paid/organic referral rollups.",
+    tags: ["traffic"],
+    auth: false,
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: {
+        "application/json": {
+          schema: { $ref: "#/components/schemas/CloudflareWorkerIngestRequest" }
+        }
+      }
+    },
+    responses: {
+      200: jsonResponse(
+        "Ingest acknowledged; droppedEvents includes normalization failures and durable-receipt duplicates.",
+        "CloudflareWorkerIngestResponse"
+      ),
+      400: errorResponse("Invalid ingest payload."),
+      401: errorResponse("Authentication failed (bearer, signature, timestamp, or source id mismatch)."),
+      413: errorResponse("The ingest payload exceeds 256 KiB."),
+      429: errorResponse("The per-IP or authenticated-source ingest request budget was exceeded.")
+    }
+  },
   {
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/sync",
@@ -33291,7 +33401,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Persisted crawl summary returned.", "SiteCrawlSummaryDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33308,7 +33418,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Bounded Site Health graph projection returned.", "SiteCrawlGraphResponseDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33403,6 +33513,7 @@ var routeCatalog = [
       { name: "inventoryEligible", in: "query", description: "Filter Canonry technical inventory eligibility (`true` or `false`).", schema: booleanSchema },
       { name: "fetchState", in: "query", description: "Filter by persisted fetch state.", schema: stringSchema },
       { name: "indexabilityState", in: "query", description: "Filter by crawler-derived indexability state; this is not Google index coverage.", schema: stringSchema },
+      { name: "healthState", in: "query", description: "Filter by the derived Site Health state shared with the dashboard and agents. Unlike `indexabilityState` this folds fetch state, canonical identity, and the crawler reasons into one decision, so `hidden` also covers redirects, robots blocks, non-HTML, and canonical-away pages. Values: `eligible`, `hidden`, `failed`, `unchecked`.", schema: { type: "string", enum: ["eligible", "hidden", "failed", "unchecked"] } },
       { name: "auditState", in: "query", description: "Filter by audit state.", schema: stringSchema },
       { name: "sort", in: "query", description: "Sort order. Defaults to `url`.", schema: { type: "string", enum: ["url", "path", "score-asc", "score-desc"] } },
       crawlCursorParameter,
@@ -33410,7 +33521,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Crawl pages returned.", "SiteCrawlPagesResponseDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33428,7 +33539,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Immediate crawl children returned.", "SiteCrawlStructureResponseDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33448,7 +33559,7 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Internal crawl links returned.", "SiteCrawlInternalLinksResponseDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33467,7 +33578,7 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Bounded internal-link neighborhood returned.", "SiteCrawlNeighborsResponseDto"),
       400: errorResponse("A nodeKey or URL is required."),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
     }
   },
   {
@@ -33484,7 +33595,22 @@ var routeCatalog = [
     ],
     responses: {
       200: jsonResponse("Dead-link status and findings returned.", "SiteCrawlDeadLinksResponseDto"),
-      404: errorResponse("Project or crawl-bearing site-audit run not found.")
+      404: errorResponse("Project or site-audit run not found. A known run that published no crawl returns 200 with the no-crawl state instead.")
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/technical-aeo/runs",
+    summary: "List Site Health scan history",
+    description: "Returns every non-probe `site-audit` run for the project, newest first, including runs still queued or running and runs that failed. `hasCrawlData` says whether that scan published a page and internal-link crawl: a legacy score-only scan is listed with `hasCrawlData=false` rather than hidden, and the crawl-scoped reads answer it with their no-crawl state instead of a 404.",
+    tags: ["technical-aeo"],
+    parameters: [
+      nameParameter,
+      { name: "limit", in: "query", description: "Max scans returned (most recent first). Defaults to 20; max 100.", schema: { type: "integer", minimum: 1, maximum: 100 } }
+    ],
+    responses: {
+      200: jsonResponse("Site Health scan history returned.", "SiteHealthScansResponseDto"),
+      404: errorResponse("Project not found.")
     }
   },
   {
@@ -46811,7 +46937,7 @@ async function queryBacklinks(opts) {
   const reversed = opts.targets.map(reverseDomain);
   const targetList = reversed.map(quote).join(", ");
   const limitClause = opts.limitPerTarget ? `QUALIFY row_number() OVER (PARTITION BY t.target_rev_domain ORDER BY v.num_hosts DESC) <= ${Math.floor(opts.limitPerTarget)}` : "";
-  const sql21 = `
+  const sql22 = `
     WITH vertices AS (
       SELECT * FROM read_csv(
         ${quote(opts.vertexPath)},
@@ -46847,7 +46973,7 @@ async function queryBacklinks(opts) {
   const conn = await instance.connect();
   let rows;
   try {
-    const reader = await conn.runAndReadAll(sql21);
+    const reader = await conn.runAndReadAll(sql22);
     rows = reader.getRowObjects();
   } finally {
     conn.disconnectSync?.();
@@ -47303,9 +47429,10 @@ async function backlinksRoutes(app, opts) {
 }
 
 // ../api-routes/src/traffic.ts
-import crypto39 from "crypto";
+import crypto40 from "crypto";
+import { isIP } from "net";
 import { Agent as UndiciAgent } from "undici";
-import { and as and38, desc as desc22, eq as eq46, gte as gte10, lte as lte9, sql as sql18 } from "drizzle-orm";
+import { and as and39, desc as desc22, eq as eq47, gte as gte11, lte as lte10, sql as sql19 } from "drizzle-orm";
 
 // ../api-routes/src/traffic-limits.ts
 var VERCEL_MAX_SYNC_WINDOW_MS = 24 * 60 * 6e4;
@@ -50089,6 +50216,39 @@ var DEFAULT_AI_CRAWLER_RULES = [
     userAgentPatterns: [/Amazonbot\//i]
   }
 ];
+var DEFAULT_AI_CRAWLER_USER_AGENT_SUBSTRINGS = [
+  "GPTBot/",
+  "OAI-SearchBot/",
+  "ChatGPT-User/",
+  "ClaudeBot/",
+  "Claude-Web/",
+  "Claude-SearchBot/",
+  "Claude-User/",
+  "anthropic-ai",
+  "PerplexityBot/",
+  "Google-Extended",
+  "Google-Agent",
+  "Bytespider",
+  "Applebot-Extended",
+  "Applebot/",
+  "meta-externalagent",
+  "CCBot/",
+  "cohere-ai",
+  "Diffbot",
+  "MistralAI-User/",
+  "MistralBot/",
+  "DeepSeekBot",
+  "xAI-Bot/",
+  "Grok-Bot/",
+  "GrokBot/",
+  "Googlebot",
+  "bingbot/",
+  "DuckDuckBot",
+  "YandexBot/",
+  "Baiduspider",
+  "Amazonbot/",
+  "Perplexity-User/"
+];
 var DEFAULT_AI_REFERRER_RULES = [
   { domain: AI_ENGINE_DOMAINS.chatgpt, operator: "OpenAI", product: "ChatGPT" },
   { domain: LEGACY_CHATGPT_DOMAIN, operator: "OpenAI", product: "ChatGPT" },
@@ -51109,6 +51269,716 @@ async function drainVercelTrafficEvents(options) {
   return { events, subWindowCount, effectiveStartMs, retentionClamped, truncatedSliceCount, truncatedSliceStartsMs, deadlineSkippedSliceCount: deadlineSkippedSliceStartsMs.length, deadlineSkippedSliceStartsMs, drainedThroughMs: cursorMs, deadlineReached };
 }
 
+// ../integration-cloudflare-worker/src/canonical-json.ts
+function canonicalizeCloudflareJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Cloudflare canonical JSON does not support non-finite numbers");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item2) => canonicalizeCloudflareJson(item2)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const fields = [];
+    for (const key of Object.keys(record).sort()) {
+      const fieldValue = record[key];
+      if (fieldValue === void 0) continue;
+      fields.push(`${JSON.stringify(key)}:${canonicalizeCloudflareJson(fieldValue)}`);
+    }
+    return `{${fields.join(",")}}`;
+  }
+  throw new TypeError(`Cloudflare canonical JSON does not support ${typeof value}`);
+}
+
+// ../integration-cloudflare-worker/src/normalize.ts
+function emptyToNull2(value) {
+  if (value === null || value.trim() === "") return null;
+  return value;
+}
+function maybeLabel(value) {
+  if (value === null) return void 0;
+  if (typeof value === "string" && value === "") return void 0;
+  return String(value);
+}
+function buildProviderLabels(cf) {
+  if (!cf) return {};
+  const candidates = {
+    verifiedBot: maybeLabel(cf.verifiedBot),
+    botScore: maybeLabel(cf.botScore),
+    country: maybeLabel(cf.country),
+    asn: maybeLabel(cf.asn),
+    asOrganization: maybeLabel(cf.asOrganization)
+  };
+  return Object.fromEntries(
+    Object.entries(candidates).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+}
+function normalizeCloudflareEdgeEvent(event) {
+  if (!event.path) return null;
+  if (!event.observedAt) return null;
+  if (!event.eventId) return null;
+  const host = emptyToNull2(event.host);
+  const path8 = event.path;
+  const queryString = emptyToNull2(event.queryString);
+  const requestUrl = host ? `https://${host}${path8}${queryString ? `?${queryString}` : ""}` : null;
+  return {
+    sourceType: TrafficSourceTypes.cloudflare,
+    evidenceKind: TrafficEvidenceKinds["raw-request"],
+    confidence: TrafficEventConfidences.observed,
+    eventId: `cloudflare-worker:${event.eventId}`,
+    observedAt: event.observedAt,
+    method: emptyToNull2(event.method),
+    requestUrl,
+    host,
+    path: path8,
+    queryString,
+    status: event.status,
+    userAgent: emptyToNull2(event.userAgent),
+    remoteIp: emptyToNull2(event.remoteIp),
+    referer: emptyToNull2(event.referer),
+    latencyMs: null,
+    requestSizeBytes: null,
+    responseSizeBytes: null,
+    providerResource: {
+      type: "cloudflare_zone",
+      labels: {}
+    },
+    providerLabels: buildProviderLabels(event.cf)
+  };
+}
+var normalizeCloudflareWorkerEvent = normalizeCloudflareEdgeEvent;
+
+// ../integration-cloudflare-worker/src/types.ts
+var CLOUDFLARE_WORKER_BINDINGS = {
+  deliveryMode: "CANONRY_DELIVERY_MODE",
+  sourceId: "CANONRY_SOURCE_ID",
+  ingestUrl: "CANONRY_INGEST_URL",
+  workerVersion: "CANONRY_WORKER_VERSION",
+  bearerToken: "CANONRY_BEARER_TOKEN",
+  hmacSecret: "CANONRY_HMAC_SECRET"
+};
+var CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS = [
+  CLOUDFLARE_WORKER_BINDINGS.bearerToken,
+  CLOUDFLARE_WORKER_BINDINGS.hmacSecret
+];
+var CLOUDFLARE_WORKER_GENERATED_MARKER = "// canonry traffic Worker \u2014 generated; do not edit by hand";
+var CLOUDFLARE_WRANGLER_GENERATED_MARKER = "# canonry traffic Worker configuration \u2014 generated; do not edit by hand";
+
+// ../integration-cloudflare-worker/src/script.ts
+var DEFAULT_BOT_LIST = {
+  version: "2026-08-09",
+  uaKeywords: [
+    ...DEFAULT_AI_CRAWLER_USER_AGENT_SUBSTRINGS,
+    // Preserve a small forward-looking machine-traffic net. The shared
+    // classifier still drops unknown products after delivery.
+    "bot",
+    "crawler",
+    "spider"
+  ],
+  refererDomains: DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain),
+  utmSourceTokens: [
+    .../* @__PURE__ */ new Set([
+      ...DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain),
+      ...DEFAULT_AI_REFERRER_RULES.map((rule) => rule.domain.split(".")[0]),
+      // Legacy chat.openai.com referrals classify from their first label.
+      "chat"
+    ])
+  ]
+};
+var DEFAULT_BOT_SCORE_MAX_FORWARD = 30;
+var WORKER_COMPATIBILITY_DATE = "2026-05-01";
+function jsString(value) {
+  return JSON.stringify(value);
+}
+function jsArray(values) {
+  return `[${values.map((v) => jsString(v)).join(", ")}]`;
+}
+function generateWorkerScript(opts) {
+  const botScoreMax = opts.botScoreMaxForward ?? DEFAULT_BOT_SCORE_MAX_FORWARD;
+  const canonicalJsonFunction = canonicalizeCloudflareJson.toString();
+  return `${CLOUDFLARE_WORKER_GENERATED_MARKER}
+// worker version: ${opts.workerVersion}
+// bot-list version: ${opts.botList.version}
+// delivery mode: ${opts.deliveryMode}
+
+const UA_KEYWORDS = ${jsArray(opts.botList.uaKeywords)}
+const REFERER_DOMAINS = ${jsArray(opts.botList.refererDomains)}
+const UTM_SOURCE_TOKENS = ${jsArray(opts.botList.utmSourceTokens)}
+const BOT_SCORE_MAX_FORWARD = ${String(botScoreMax)}
+const RETRY_DELAYS_MS = [250, 1000]
+const canonicalizeJson = (${canonicalJsonFunction})
+
+function requireBinding(value, name) {
+  if (typeof value === 'string' && value.length > 0) return value
+  throw new Error('Missing required Worker binding: ' + name)
+}
+
+function lower(value) {
+  return typeof value === 'string' ? value.toLowerCase() : ''
+}
+
+function uaMatches(ua) {
+  const lc = lower(ua)
+  if (!lc) return false
+  for (const kw of UA_KEYWORDS) {
+    if (lc.indexOf(lower(kw)) !== -1) return true
+  }
+  return false
+}
+
+function hostMatchesKnownDomain(host) {
+  let normalized = lower(host)
+  if (normalized.startsWith('www.')) normalized = normalized.slice(4)
+  if (normalized.endsWith('.')) normalized = normalized.slice(0, -1)
+  if (!normalized) return false
+  for (const domain of REFERER_DOMAINS) {
+    if (normalized === domain || normalized.endsWith('.' + domain)) return true
+  }
+  return false
+}
+
+function refererMatches(referer) {
+  if (!referer) return false
+  try {
+    return hostMatchesKnownDomain(new URL(referer).hostname)
+  } catch (_) {
+    return false
+  }
+}
+
+function utmSourceMatches(value) {
+  let normalized = lower(value).trim()
+  if (normalized.startsWith('www.')) normalized = normalized.slice(4)
+  if (normalized.endsWith('.')) normalized = normalized.slice(0, -1)
+  if (!normalized) return false
+  if (hostMatchesKnownDomain(normalized)) return true
+  return UTM_SOURCE_TOKENS.indexOf(normalized) !== -1
+}
+
+function urlUtmMatches(value) {
+  if (!value) return false
+  try {
+    return utmSourceMatches(new URL(value).searchParams.get('utm_source'))
+  } catch (_) {
+    return false
+  }
+}
+
+function botSignals(cf) {
+  if (!cf) return false
+  const bm = cf.botManagement
+  if (bm) {
+    if (bm.verifiedBot === true) return true
+    if (typeof bm.score === 'number' && bm.score < BOT_SCORE_MAX_FORWARD) return true
+  }
+  if (typeof cf.botScore === 'number' && cf.botScore < BOT_SCORE_MAX_FORWARD) return true
+  return false
+}
+
+function shouldForward(request) {
+  const ua = request.headers.get('user-agent') || ''
+  if (uaMatches(ua)) return true
+  if (urlUtmMatches(request.url)) return true
+  const referer = request.headers.get('referer') || ''
+  if (refererMatches(referer)) return true
+  if (urlUtmMatches(referer)) return true
+  return botSignals(request.cf)
+}
+
+function toHex(buffer) {
+  const bytes = new Uint8Array(buffer)
+  let out = ''
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, '0')
+  }
+  return out
+}
+
+async function signBody(secret, timestamp, body) {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+  const sig = await crypto.subtle.sign(
+    'HMAC',
+    key,
+    new TextEncoder().encode(timestamp + '.' + body),
+  )
+  return toHex(sig)
+}
+
+function isRetryableStatus(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function cancelUnusedResponseBody(response) {
+  try {
+    if (response.body) await response.body.cancel()
+  } catch (_) {
+    // The ingest response body is unused. Cancellation failure is non-fatal.
+  }
+}
+
+async function withRetry(operation) {
+  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+    let response
+    try {
+      response = await operation()
+    } catch (error) {
+      if (attempt === RETRY_DELAYS_MS.length) throw error
+      await sleep(RETRY_DELAYS_MS[attempt])
+      continue
+    }
+
+    const status = response.status
+    const ok = response.ok
+    await cancelUnusedResponseBody(response)
+    if (ok) return
+    if (!isRetryableStatus(status) || attempt === RETRY_DELAYS_MS.length) {
+      throw new Error('Canonry ingest returned HTTP ' + status)
+    }
+    await sleep(RETRY_DELAYS_MS[attempt])
+  }
+}
+
+function pickCf(cf) {
+  if (!cf) return null
+  const bm = cf.botManagement || {}
+  return {
+    verifiedBot: typeof bm.verifiedBot === 'boolean' ? bm.verifiedBot : null,
+    botScore: typeof bm.score === 'number' ? bm.score : (typeof cf.botScore === 'number' ? cf.botScore : null),
+    country: typeof cf.country === 'string' ? cf.country : null,
+    asn: typeof cf.asn === 'number' ? cf.asn : null,
+    asOrganization: typeof cf.asOrganization === 'string' ? cf.asOrganization : null,
+  }
+}
+
+function buildEdgeEvent(request, status, observedAt) {
+  const url = new URL(request.url)
+  return {
+    eventId: request.headers.get('cf-ray') || crypto.randomUUID(),
+    observedAt,
+    method: request.method || null,
+    host: url.hostname || null,
+    path: url.pathname || '/',
+    queryString: url.search ? url.search.slice(1) : null,
+    status: typeof status === 'number' ? status : null,
+    userAgent: request.headers.get('user-agent') || null,
+    remoteIp: request.headers.get('cf-connecting-ip') || null,
+    referer: request.headers.get('referer') || null,
+    cf: pickCf(request.cf),
+  }
+}
+
+function buildEdgeEventBatch(env, request, status, observedAt) {
+  return {
+    schemaVersion: 1,
+    workerVersion: requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.workerVersion}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.workerVersion)}),
+    events: [buildEdgeEvent(request, status, observedAt)],
+  }
+}
+
+async function deliverViaDirectPush(env, batch) {
+  const sourceId = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.sourceId)})
+  const ingestUrl = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.ingestUrl}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.ingestUrl)})
+  const bearerToken = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.bearerToken}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.bearerToken)})
+  const hmacSecret = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.hmacSecret}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.hmacSecret)})
+  const body = canonicalizeJson(batch)
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const signature = await signBody(hmacSecret, timestamp, body)
+
+  await withRetry(() => fetch(ingestUrl, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'Authorization': 'Bearer ' + bearerToken,
+      'X-Canonry-Timestamp': timestamp,
+      'X-Canonry-Signature': signature,
+      'X-Canonry-Worker-Version': batch.workerVersion,
+      'X-Canonry-Source-Id': sourceId,
+    },
+    body,
+  }))
+}
+
+async function deliverEdgeEventBatch(env, batch) {
+  const deliveryMode = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.deliveryMode}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.deliveryMode)})
+  if (deliveryMode === 'direct-push') {
+    return deliverViaDirectPush(env, batch)
+  }
+  throw new Error('Unsupported Canonry delivery mode: ' + deliveryMode)
+}
+
+async function deliverSelectedRequest(env, request, status, observedAt) {
+  try {
+    const batch = buildEdgeEventBatch(env, request, status, observedAt)
+    await deliverEdgeEventBatch(env, batch)
+  } catch (err) {
+    // Delivery is statistical and must never mask the customer response.
+    // Emit binding names and source id only; never emit secret values.
+    console.warn('Canonry traffic delivery failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+  }
+}
+
+function shouldForwardSafely(env, request) {
+  try {
+    return shouldForward(request)
+  } catch (err) {
+    console.warn('Canonry traffic filter failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+    return false
+  }
+}
+
+function scheduleSelectedRequest(ctx, env, request, status, observedAt) {
+  try {
+    ctx.waitUntil(deliverSelectedRequest(env, request, status, observedAt))
+  } catch (err) {
+    console.warn('Canonry traffic delivery scheduling failed', {
+      sourceId: typeof env.${CLOUDFLARE_WORKER_BINDINGS.sourceId} === 'string'
+        ? env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}
+        : null,
+      message: err instanceof Error ? err.message : String(err),
+    })
+  }
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    const observedAt = new Date().toISOString()
+    const shouldLog = shouldForwardSafely(env, request)
+    let response
+    try {
+      response = await fetch(request)
+    } catch (err) {
+      if (shouldLog) {
+        scheduleSelectedRequest(ctx, env, request, null, observedAt)
+      }
+      throw err
+    }
+    if (shouldLog) {
+      scheduleSelectedRequest(ctx, env, request, response.status, observedAt)
+    }
+    return response
+  },
+}
+`;
+}
+function generateWranglerToml(opts) {
+  const hostname = opts.hostname.trim().toLowerCase().replace(/\.$/, "");
+  const accountConfig = opts.accountId ? `account_id = ${jsString(opts.accountId)}
+` : "";
+  const zoneHint = opts.zoneId ? `# Target zone id: ${jsString(opts.zoneId)}
+` : "# Target zone id was not provided. Select the canonical site zone.\n";
+  return `${CLOUDFLARE_WRANGLER_GENERATED_MARKER}
+name = "canonry-traffic-${opts.sourceId}"
+${accountConfig}main = "worker.js"
+compatibility_date = "${WORKER_COMPATIBILITY_DATE}"
+workers_dev = false
+
+[vars]
+${CLOUDFLARE_WORKER_BINDINGS.deliveryMode} = ${jsString(opts.deliveryMode)}
+${CLOUDFLARE_WORKER_BINDINGS.sourceId} = ${jsString(opts.sourceId)}
+${CLOUDFLARE_WORKER_BINDINGS.ingestUrl} = ${jsString(opts.ingestUrl)}
+${CLOUDFLARE_WORKER_BINDINGS.workerVersion} = ${jsString(opts.workerVersion)}
+
+[secrets]
+required = ${jsArray(CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS)}
+
+# Install required Worker secrets interactively or through Canonry's deploy
+# command. Never write their values into this file:
+${CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS.map((name) => `#   wrangler secret put ${name}`).join("\n")}
+
+# Deploy this Worker via:
+#   wrangler deploy
+# Canonry intentionally does not declare a route in this file.
+# After deploy, attach this exact route in the Cloudflare dashboard:
+#   ${hostname}/*
+${zoneHint}# Set the route Request limit failure mode to Fail open before activation.
+# Wrangler cannot configure this route toggle.
+`;
+}
+
+// ../integration-cloudflare-worker/src/verify.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_MAX_AGE_SECONDS = 300;
+function verifyRequestSignature(opts) {
+  const { timestamp, signature, secret } = opts;
+  if (timestamp === "" || !/^-?\d+$/.test(timestamp)) {
+    return { ok: false, reason: "timestamp_invalid" };
+  }
+  const ts = Number(timestamp);
+  if (!Number.isFinite(ts)) return { ok: false, reason: "timestamp_invalid" };
+  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const maxAge = opts.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+  if (Math.abs(now - ts) > maxAge) return { ok: false, reason: "timestamp_expired" };
+  if (signature === "" || !/^[0-9a-f]+$/i.test(signature)) {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let provided;
+  try {
+    provided = Buffer.from(signature, "hex");
+  } catch {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let bodies;
+  try {
+    if ("body" in opts) {
+      bodies = [opts.body];
+    } else {
+      const canonical = canonicalizeCloudflareJson(opts.payload);
+      const legacy = JSON.stringify(opts.payload);
+      bodies = [canonical];
+      if (opts.acceptLegacyJson !== false && typeof legacy === "string" && legacy !== canonical) {
+        bodies.push(legacy);
+      }
+    }
+  } catch {
+    return { ok: false, reason: "signature_invalid" };
+  }
+  let comparableLength = false;
+  for (const body of bodies) {
+    const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest();
+    if (provided.length !== expected.length) continue;
+    comparableLength = true;
+    if (timingSafeEqual(provided, expected)) return { ok: true };
+  }
+  if (!comparableLength) return { ok: false, reason: "signature_invalid" };
+  return { ok: false, reason: "signature_mismatch" };
+}
+
+// ../api-routes/src/traffic-event-ingest.ts
+import crypto39 from "crypto";
+import { and as and38, eq as eq46, gte as gte10, lt as lt7, lte as lte9, sql as sql18 } from "drizzle-orm";
+var DIRECT_PUSH_RECEIPT_TTL_MS = 10 * 6e4;
+function observedUtcHourBounds(observedAt) {
+  const instant = new Date(observedAt);
+  if (Number.isNaN(instant.getTime())) return null;
+  instant.setUTCMinutes(0, 0, 0);
+  const start = instant.toISOString();
+  instant.setUTCHours(instant.getUTCHours() + 1);
+  return { start, end: instant.toISOString() };
+}
+function writeTrafficEventBatch(opts) {
+  const expiresAt = new Date(Date.parse(opts.receivedAt) + opts.receiptTtlMs).toISOString();
+  let acceptedEvents = 0;
+  let duplicateEvents = 0;
+  let crawlerBucketRows = 0;
+  let aiUserFetchBucketRows = 0;
+  let aiReferralBucketRows = 0;
+  let sampleRows = 0;
+  opts.db.transaction((tx) => {
+    tx.update(trafficSources).set({ updatedAt: sql18`${trafficSources.updatedAt}` }).where(eq46(trafficSources.id, opts.sourceId)).run();
+    const source = tx.select().from(trafficSources).where(eq46(trafficSources.id, opts.sourceId)).get();
+    opts.validateSource(source);
+    tx.delete(trafficEventReceipts).where(and38(
+      eq46(trafficEventReceipts.sourceId, opts.sourceId),
+      lte9(trafficEventReceipts.expiresAt, opts.receivedAt)
+    )).run();
+    const claimedEvents = [];
+    for (const event of opts.events) {
+      const claim = tx.insert(trafficEventReceipts).values({
+        sourceId: opts.sourceId,
+        eventId: event.eventId,
+        receivedAt: opts.receivedAt,
+        expiresAt
+      }).onConflictDoNothing().run();
+      if (claim.changes === 1) claimedEvents.push(event);
+      else duplicateEvents += 1;
+    }
+    acceptedEvents = claimedEvents.length;
+    if (claimedEvents.length > 0) {
+      const report = buildTrafficProbeReport(claimedEvents, { sampleLimit: claimedEvents.length });
+      for (const bucket of report.crawlerEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(crawlerEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          botId: bucket.botId,
+          operator: bucket.operator,
+          verificationStatus: bucket.verificationStatus,
+          pathNormalized: bucket.pathNormalized,
+          status,
+          hits: bucket.hits,
+          sampledUserAgent: bucket.sampledUserAgent,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            crawlerEventsHourly.projectId,
+            crawlerEventsHourly.sourceId,
+            crawlerEventsHourly.tsHour,
+            crawlerEventsHourly.botId,
+            crawlerEventsHourly.verificationStatus,
+            crawlerEventsHourly.pathNormalized,
+            crawlerEventsHourly.status
+          ],
+          set: {
+            hits: sql18`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        crawlerBucketRows += 1;
+      }
+      for (const bucket of report.aiUserFetchEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(aiUserFetchEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          botId: bucket.botId,
+          operator: bucket.operator,
+          verificationStatus: bucket.verificationStatus,
+          pathNormalized: bucket.pathNormalized,
+          status,
+          hits: bucket.hits,
+          sampledUserAgent: bucket.sampledUserAgent,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            aiUserFetchEventsHourly.projectId,
+            aiUserFetchEventsHourly.sourceId,
+            aiUserFetchEventsHourly.tsHour,
+            aiUserFetchEventsHourly.botId,
+            aiUserFetchEventsHourly.verificationStatus,
+            aiUserFetchEventsHourly.pathNormalized,
+            aiUserFetchEventsHourly.status
+          ],
+          set: {
+            hits: sql18`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        aiUserFetchBucketRows += 1;
+      }
+      for (const bucket of report.aiReferralEventsHourly) {
+        const status = bucket.status ?? 0;
+        tx.insert(aiReferralEventsHourly).values({
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          tsHour: bucket.tsHour,
+          product: bucket.product,
+          operator: bucket.operator,
+          sourceDomain: bucket.sourceDomain,
+          evidenceType: bucket.evidenceType,
+          landingPathNormalized: bucket.landingPathNormalized,
+          status,
+          sessionsOrHits: bucket.hits,
+          paidSessionsOrHits: bucket.paidHits,
+          organicSessionsOrHits: bucket.organicHits,
+          usersEstimated: null,
+          createdAt: opts.receivedAt,
+          updatedAt: opts.receivedAt
+        }).onConflictDoUpdate({
+          target: [
+            aiReferralEventsHourly.projectId,
+            aiReferralEventsHourly.sourceId,
+            aiReferralEventsHourly.tsHour,
+            aiReferralEventsHourly.product,
+            aiReferralEventsHourly.sourceDomain,
+            aiReferralEventsHourly.evidenceType,
+            aiReferralEventsHourly.landingPathNormalized,
+            aiReferralEventsHourly.status
+          ],
+          set: {
+            sessionsOrHits: sql18`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+            paidSessionsOrHits: sql18`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+            organicSessionsOrHits: sql18`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+            updatedAt: opts.receivedAt
+          }
+        }).run();
+        aiReferralBucketRows += 1;
+      }
+      const hourlySampleLimit = Math.max(0, Math.floor(opts.sampleLimit));
+      const remainingSamplesByHour = /* @__PURE__ */ new Map();
+      for (const sample of report.samples) {
+        const hour = observedUtcHourBounds(sample.observedAt);
+        if (!hour || hourlySampleLimit === 0) continue;
+        let remaining = remainingSamplesByHour.get(hour.start);
+        if (remaining === void 0) {
+          const existing = tx.select({ total: sql18`COUNT(*)` }).from(rawEventSamples).where(and38(
+            eq46(rawEventSamples.sourceId, opts.sourceId),
+            gte10(rawEventSamples.ts, hour.start),
+            lt7(rawEventSamples.ts, hour.end)
+          )).get();
+          remaining = Math.max(0, hourlySampleLimit - Number(existing?.total ?? 0));
+        }
+        if (remaining === 0) {
+          remainingSamplesByHour.set(hour.start, 0);
+          continue;
+        }
+        const eventType = sample.crawler ? "crawler" : sample.aiUserFetch ? "ai_user_fetch" : sample.aiReferral ? "ai_referral" : "unknown";
+        const refererHost = (() => {
+          if (!sample.referer) return null;
+          try {
+            return new URL(sample.referer).hostname;
+          } catch {
+            return null;
+          }
+        })();
+        tx.insert(rawEventSamples).values({
+          id: crypto39.randomUUID(),
+          projectId: opts.projectId,
+          sourceId: opts.sourceId,
+          ts: sample.observedAt,
+          eventType,
+          ipHash: null,
+          userAgent: sample.userAgent,
+          pathNormalized: sample.pathNormalized,
+          status: sample.status,
+          refererHost,
+          classifierDetailsJson: {
+            crawler: sample.crawler,
+            aiUserFetch: sample.aiUserFetch,
+            aiReferral: sample.aiReferral
+          },
+          createdAt: opts.receivedAt
+        }).run();
+        sampleRows += 1;
+        remainingSamplesByHour.set(hour.start, remaining - 1);
+      }
+    }
+    tx.update(trafficSources).set(opts.sourceUpdate).where(eq46(trafficSources.id, opts.sourceId)).run();
+  });
+  return {
+    acceptedEvents,
+    duplicateEvents,
+    crawlerBucketRows,
+    aiUserFetchBucketRows,
+    aiReferralBucketRows,
+    sampleRows
+  };
+}
+
 // ../api-routes/src/traffic.ts
 var DEFAULT_SYNC_WINDOW_MINUTES = 43200;
 var DEFAULT_PAGE_SIZE3 = 1e3;
@@ -51125,6 +51995,126 @@ var DEFAULT_TRAFFIC_SYNC_CRON = "*/30 * * * *";
 var MAX_BACKFILL_DAYS = 90;
 var BACKFILL_MAX_PAGES = 1e3;
 var BACKFILL_SAMPLE_LIMIT = 500;
+var CLOUDFLARE_WORKER_VERSION = "1.0.0";
+var CLOUDFLARE_INGEST_BODY_LIMIT = 256 * 1024;
+var DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX = 6e3;
+var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+function sha256Hex3(value) {
+  return crypto40.createHash("sha256").update(value).digest("hex");
+}
+function hashCloudflareBearerToken(value) {
+  return sha256Hex3(value);
+}
+function timingSafeEqualHex(a, b) {
+  if (!a || !b) return false;
+  if (!SHA256_HEX_PATTERN.test(a) || !SHA256_HEX_PATTERN.test(b)) return false;
+  const left = Buffer.from(a, "hex");
+  const right = Buffer.from(b, "hex");
+  return left.length === right.length && crypto40.timingSafeEqual(left, right);
+}
+function parseDirectPushCloudflareSourceConfig(config) {
+  const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
+  return parsed.success ? parsed.data : null;
+}
+function isDirectPushCloudflareDeliveryMode(value) {
+  return value === CloudflareTrafficDeliveryModes["direct-push"];
+}
+function authenticateCloudflareIngest(request, store) {
+  if (!store) return null;
+  const authHeader = request.headers.authorization;
+  const sourceIdHeader = request.headers["x-canonry-source-id"];
+  const timestampHeader = request.headers["x-canonry-timestamp"];
+  const signatureHeader = request.headers["x-canonry-signature"];
+  const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+  const sourceId = typeof sourceIdHeader === "string" ? sourceIdHeader : "";
+  const timestamp = typeof timestampHeader === "string" ? timestampHeader : "";
+  const signature = typeof signatureHeader === "string" ? signatureHeader : "";
+  if (!bearerToken || !sourceId || !timestamp || !signature) return null;
+  const credential = store.getConnectionBySourceId(sourceId);
+  if (!credential || !isDirectPushCloudflareDeliveryMode(credential.deliveryMode)) return null;
+  const bearerHash = sha256Hex3(bearerToken);
+  if (!timingSafeEqualHex(bearerHash, sha256Hex3(credential.bearerToken))) return null;
+  if (!verifyRequestSignature({
+    timestamp,
+    signature,
+    payload: request.body,
+    secret: credential.hmacSecret
+  }).ok) return null;
+  return { bearerHash, credential };
+}
+function cloudflareIngestRateLimitKey(request, store, db) {
+  const authenticated = authenticateCloudflareIngest(request, store);
+  const params = request.params;
+  if (authenticated && typeof params.name === "string" && authenticated.credential.projectName === params.name) {
+    const source = db.select().from(trafficSources).where(eq47(trafficSources.id, authenticated.credential.sourceId)).get();
+    if (source && source.sourceType === TrafficSourceTypes.cloudflare && source.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(source.configJson) && timingSafeEqualHex(authenticated.bearerHash, source.ingestTokenHash)) {
+      return `cloudflare-source:${authenticated.credential.sourceId}`;
+    }
+  }
+  return `cloudflare-invalid:${request.ip}`;
+}
+function assertCloudflareIngestUrlIsPublicHttps(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw validationError("Cloudflare ingest URL must be a valid public HTTPS URL");
+  }
+  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  const octets = ipv4?.slice(1).map(Number);
+  const privateIpv4 = octets !== void 0 && (octets.some((part) => part > 255) || octets[0] === 0 || octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168);
+  const privateIpv6 = hostname.includes(":") && (hostname === "::1" || hostname.startsWith("fc") || hostname.startsWith("fd") || hostname.startsWith("fe8") || hostname.startsWith("fe9") || hostname.startsWith("fea") || hostname.startsWith("feb"));
+  const privateHostname = hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || privateIpv6 || privateIpv4;
+  if (url.protocol !== "https:" || privateHostname || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
+    throw validationError(
+      "Cloudflare ingest URL must be a credential-free public HTTPS URL without a query or fragment and reachable from the public Cloudflare edge; configure publicUrl to a public origin"
+    );
+  }
+}
+function normalizeDnsHostname(value) {
+  const normalized = value.trim().toLowerCase().replace(/\.+$/, "");
+  if (normalized.length === 0 || normalized.length > 253 || normalized.includes("*") || !normalized.includes(".")) return null;
+  const valid = normalized.split(".").every(
+    (label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)
+  );
+  return valid ? normalized : null;
+}
+function resolveCloudflareWorkerRouteHost(value) {
+  const trimmed = value.trim();
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+  if (hasScheme && !/^https?:\/\//i.test(trimmed)) {
+    throw validationError("Project canonicalDomain must use an HTTP or HTTPS URL");
+  }
+  let url;
+  try {
+    url = new URL(hasScheme ? trimmed : `https://${trimmed}`);
+  } catch {
+    throw validationError("Project canonicalDomain must resolve to one exact public hostname");
+  }
+  if (url.username.length > 0 || url.password.length > 0 || url.pathname !== "" && url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || url.port.length > 0) {
+    throw validationError(
+      "Project canonicalDomain must be a bare hostname or root HTTP(S) URL without credentials, a non-default port, path, query, or fragment"
+    );
+  }
+  const hostname = normalizeDnsHostname(url.hostname);
+  if (!hostname || isIP(hostname) !== 0) {
+    throw validationError("Project canonicalDomain must resolve to one exact public hostname without wildcards");
+  }
+  return hostname;
+}
+function normalizeCloudflareEventHost(value) {
+  if (!value || /[/:@?#*]/.test(value)) return null;
+  return normalizeDnsHostname(value);
+}
+function assertCloudflareIngestUrlOutsideWorkerRoute(ingestUrl, workerRouteHost) {
+  const ingestHost = normalizeDnsHostname(new URL(ingestUrl).hostname);
+  if (ingestHost && ingestHost === workerRouteHost) {
+    throw validationError(
+      "Cloudflare ingest URL hostname must be outside the generated Worker route hostname to prevent recursive ingestion"
+    );
+  }
+}
 function emptyTrafficSeriesPoint(bucket) {
   return { bucket, crawlerHits: 0, aiUserFetchHits: 0, aiReferralHits: 0 };
 }
@@ -51205,8 +52195,8 @@ async function runBackfillTask(options) {
     const failedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq46(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
+        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       });
     } catch {
     }
@@ -51221,7 +52211,7 @@ async function runBackfillTask(options) {
   if (allEvents.length === 0) {
     const finishedAt2 = (/* @__PURE__ */ new Date()).toISOString();
     try {
-      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: finishedAt2 }).where(eq46(runs.id, runId)).run();
+      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: finishedAt2 }).where(eq47(runs.id, runId)).run();
     } catch {
     }
     return;
@@ -51243,31 +52233,31 @@ async function runBackfillTask(options) {
   try {
     app.db.transaction((tx) => {
       tx.delete(crawlerEventsHourly).where(
-        and38(
-          eq46(crawlerEventsHourly.sourceId, sourceRow2.id),
-          gte10(crawlerEventsHourly.tsHour, windowStartIso),
-          lte9(crawlerEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(crawlerEventsHourly.sourceId, sourceRow2.id),
+          gte11(crawlerEventsHourly.tsHour, windowStartIso),
+          lte10(crawlerEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiUserFetchEventsHourly).where(
-        and38(
-          eq46(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
-          gte10(aiUserFetchEventsHourly.tsHour, windowStartIso),
-          lte9(aiUserFetchEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
+          gte11(aiUserFetchEventsHourly.tsHour, windowStartIso),
+          lte10(aiUserFetchEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiReferralEventsHourly).where(
-        and38(
-          eq46(aiReferralEventsHourly.sourceId, sourceRow2.id),
-          gte10(aiReferralEventsHourly.tsHour, windowStartIso),
-          lte9(aiReferralEventsHourly.tsHour, windowEndIso)
+        and39(
+          eq47(aiReferralEventsHourly.sourceId, sourceRow2.id),
+          gte11(aiReferralEventsHourly.tsHour, windowStartIso),
+          lte10(aiReferralEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(rawEventSamples).where(
-        and38(
-          eq46(rawEventSamples.sourceId, sourceRow2.id),
-          gte10(rawEventSamples.ts, windowStartIso),
-          lte9(rawEventSamples.ts, windowEndIso)
+        and39(
+          eq47(rawEventSamples.sourceId, sourceRow2.id),
+          gte11(rawEventSamples.ts, windowStartIso),
+          lte10(rawEventSamples.ts, windowEndIso)
         )
       ).run();
       for (const bucket of report.crawlerEventsHourly) {
@@ -51332,7 +52322,7 @@ async function runBackfillTask(options) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -51359,8 +52349,8 @@ async function runBackfillTask(options) {
         lastEventIds: newRingBuffer,
         ...skipRecovered ? { skippedThroughAt: null } : {},
         updatedAt: finishedAt
-      }).where(eq46(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq46(runs.id, runId)).run();
+      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
     });
   } catch (e) {
     markFailed(`Backfill rollup write failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -51405,6 +52395,11 @@ async function trafficRoutes(app, opts) {
   const pageSize = opts.defaultPageSize ?? DEFAULT_PAGE_SIZE3;
   const maxPages = opts.defaultMaxPages ?? DEFAULT_MAX_PAGES4;
   const sampleLimit = opts.defaultSampleLimit ?? DEFAULT_SAMPLE_LIMIT2;
+  const checkCloudflareSourceRateLimit = app.createRateLimit({
+    max: opts.cloudflareIngestRateLimitMax ?? DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX,
+    timeWindow: "1 minute",
+    keyGenerator: (request) => cloudflareIngestRateLimitKey(request, opts.cloudflareTrafficCredentialStore, app.db)
+  });
   app.post("/projects/:name/traffic/connect/cloud-run", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const body = request.body ?? {};
@@ -51442,7 +52437,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
     const config = {
       gcpProjectId,
       serviceName: serviceName ?? null,
@@ -51458,10 +52453,10 @@ async function trafficRoutes(app, opts) {
         lastError: null,
         configJson: config,
         updatedAt: now
-      }).where(eq46(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+      }).where(eq47(trafficSources.id, activeSource.id)).run();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto39.randomUUID();
+      const newId = crypto40.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -51476,7 +52471,7 @@ async function trafficRoutes(app, opts) {
         createdAt: now,
         updatedAt: now
       }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
     }
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -51528,7 +52523,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
     const config = { baseUrl, username };
     const fallbackName = displayName ?? `WordPress \xB7 ${new URL(baseUrl).host}`;
     let sourceRow2;
@@ -51539,10 +52534,10 @@ async function trafficRoutes(app, opts) {
         lastError: null,
         configJson: config,
         updatedAt: now
-      }).where(eq46(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+      }).where(eq47(trafficSources.id, activeSource.id)).run();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
     } else {
-      const newId = crypto39.randomUUID();
+      const newId = crypto40.randomUUID();
       app.db.insert(trafficSources).values({
         id: newId,
         projectId: project.id,
@@ -51557,7 +52552,7 @@ async function trafficRoutes(app, opts) {
         createdAt: now,
         updatedAt: now
       }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
     }
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -51611,7 +52606,7 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
     const config = { projectId, teamId, environment };
     const fallbackName = displayName ?? `Vercel \xB7 ${projectId}`;
     const { sourceRow: sourceRow2, scheduleCreated } = app.db.transaction((tx) => {
@@ -51623,10 +52618,10 @@ async function trafficRoutes(app, opts) {
           lastError: null,
           configJson: config,
           updatedAt: now
-        }).where(eq46(trafficSources.id, activeSource.id)).run();
-        row = tx.select().from(trafficSources).where(eq46(trafficSources.id, activeSource.id)).get();
+        }).where(eq47(trafficSources.id, activeSource.id)).run();
+        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
       } else {
-        const newId = crypto39.randomUUID();
+        const newId = crypto40.randomUUID();
         tx.insert(trafficSources).values({
           id: newId,
           projectId: project.id,
@@ -51649,18 +52644,18 @@ async function trafficRoutes(app, opts) {
           createdAt: now,
           updatedAt: now
         }).run();
-        row = tx.select().from(trafficSources).where(eq46(trafficSources.id, newId)).get();
+        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
       }
       const existingSchedule = tx.select().from(schedules).where(
-        and38(
-          eq46(schedules.projectId, project.id),
-          eq46(schedules.kind, SchedulableRunKinds["traffic-sync"])
+        and39(
+          eq47(schedules.projectId, project.id),
+          eq47(schedules.kind, SchedulableRunKinds["traffic-sync"])
         )
       ).get();
       let created = false;
       if (!existingSchedule) {
         tx.insert(schedules).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           kind: SchedulableRunKinds["traffic-sync"],
           cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
@@ -51701,9 +52696,256 @@ async function trafficRoutes(app, opts) {
     }
     return rowToDto(sourceRow2);
   });
+  app.post("/projects/:name/traffic/connect/cloudflare", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    if (!opts.cloudflareTrafficCredentialStore) {
+      throw validationError("Cloudflare traffic credential storage is not configured for this deployment");
+    }
+    if (!opts.cloudflareTrafficIngestUrl) {
+      throw validationError("Cloudflare ingest URL is not configured for this deployment");
+    }
+    const credentialStore = opts.cloudflareTrafficCredentialStore;
+    const parsed = trafficConnectCloudflareRequestSchema.safeParse(request.body ?? {});
+    if (!parsed.success) {
+      throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+    }
+    const { deliveryMode, displayName, zoneId, accountId } = parsed.data;
+    const workerRouteHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find(
+      (row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived
+    );
+    const sourceId = activeSource?.id ?? crypto40.randomUUID();
+    const parsedActiveConfig = activeSource ? parseDirectPushCloudflareSourceConfig(activeSource.configJson) : null;
+    if (activeSource && !parsedActiveConfig) {
+      throw validationError("Existing Cloudflare source is not configured for direct-push delivery");
+    }
+    const previousCredential = credentialStore.getConnection(project.name);
+    if (previousCredential && !isDirectPushCloudflareDeliveryMode(previousCredential.deliveryMode)) {
+      throw validationError(
+        `Cloudflare credential delivery mode "${previousCredential.deliveryMode}" does not match "${deliveryMode}"`
+      );
+    }
+    const reusableCredential = previousCredential?.sourceId === sourceId ? previousCredential : void 0;
+    const previousZoneId = reusableCredential?.zoneId ?? parsedActiveConfig?.zoneId ?? null;
+    const previousAccountId = reusableCredential?.accountId ?? parsedActiveConfig?.accountId ?? null;
+    const effectiveZoneId = zoneId ?? previousZoneId;
+    const effectiveAccountId = accountId ?? previousAccountId;
+    const bearerToken = reusableCredential?.bearerToken ?? `cnry_cfw_${crypto40.randomBytes(32).toString("hex")}`;
+    const hmacSecret = reusableCredential?.hmacSecret ?? crypto40.randomBytes(32).toString("hex");
+    const ingestTokenHash = sha256Hex3(bearerToken);
+    const ingestUrl = opts.cloudflareTrafficIngestUrl.replace("{name}", encodeURIComponent(project.name));
+    assertCloudflareIngestUrlIsPublicHttps(ingestUrl);
+    assertCloudflareIngestUrlOutsideWorkerRoute(ingestUrl, workerRouteHost);
+    const workerVersion = CLOUDFLARE_WORKER_VERSION;
+    const workerScript = generateWorkerScript({
+      deliveryMode,
+      workerVersion,
+      botList: DEFAULT_BOT_LIST
+    });
+    const wranglerToml = generateWranglerToml({
+      deliveryMode,
+      sourceId,
+      hostname: workerRouteHost,
+      ingestUrl,
+      workerVersion,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId
+    });
+    const config = {
+      schemaVersion: 1,
+      deliveryMode,
+      workerVersion,
+      expectedBotListVersion: DEFAULT_BOT_LIST.version,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId
+    };
+    const fallbackName = displayName ?? activeSource?.displayName ?? `Cloudflare \xB7 ${effectiveZoneId ?? sourceId.slice(0, 8)}`;
+    credentialStore.upsertConnection({
+      projectName: project.name,
+      deliveryMode,
+      sourceId,
+      bearerToken,
+      hmacSecret,
+      workerVersion,
+      expectedBotListVersion: DEFAULT_BOT_LIST.version,
+      zoneId: effectiveZoneId,
+      accountId: effectiveAccountId,
+      createdAt: previousCredential?.createdAt ?? activeSource?.createdAt ?? now,
+      updatedAt: now
+    });
+    let sourceRow2;
+    try {
+      if (activeSource) {
+        app.db.update(trafficSources).set({
+          displayName: fallbackName,
+          status: TrafficSourceStatuses.connected,
+          lastError: null,
+          configJson: config,
+          ingestTokenHash,
+          updatedAt: now
+        }).where(eq47(trafficSources.id, activeSource.id)).run();
+        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
+      } else {
+        app.db.insert(trafficSources).values({
+          id: sourceId,
+          projectId: project.id,
+          sourceType: TrafficSourceTypes.cloudflare,
+          displayName: fallbackName,
+          status: TrafficSourceStatuses.connected,
+          // Seed `lastSyncedAt` to NOW so the `traffic.source.recent-data`
+          // doctor check has a non-null baseline. Successful ingest advances
+          // it as the receiver's last-activity timestamp.
+          lastSyncedAt: now,
+          lastCursor: null,
+          lastError: null,
+          archivedAt: null,
+          configJson: config,
+          ingestTokenHash,
+          createdAt: now,
+          updatedAt: now
+        }).run();
+        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
+      }
+    } catch (err) {
+      try {
+        if (previousCredential) {
+          credentialStore.upsertConnection(previousCredential);
+        } else {
+          credentialStore.deleteConnection(project.name);
+        }
+      } catch {
+      }
+      throw err;
+    }
+    writeAuditLog(app.db, {
+      projectId: project.id,
+      actor: "api",
+      action: "traffic.cloudflare.connected",
+      entityType: "traffic_source",
+      entityId: sourceRow2.id
+    });
+    const routeInstruction = effectiveZoneId ? `  4. Deploy with \`wrangler deploy\`; wrangler.toml records zone ${effectiveZoneId} but does not claim a route` : "  4. Deploy with `wrangler deploy`; wrangler.toml intentionally does not claim a route";
+    const instructions = [
+      "Deploy this Worker to your Cloudflare zone:",
+      "  1. Save worker.js and wrangler.toml; neither file contains credentials",
+      "  2. Install the required bearer and HMAC Worker secret bindings locally; never paste their values into source or chat",
+      `  3. Inspect existing Cloudflare Worker routes first; confirm the generated \`${workerRouteHost}/*\` catch-all will not replace or collide with another Worker`,
+      routeInstruction,
+      `  5. In the Cloudflare Dashboard route form, select \`${workerRouteHost}/*\` and this Worker`,
+      "  6. Set Request limit failure mode to Fail open, then save the route; Wrangler cannot set this toggle",
+      "  7. Keep the Canonry ingest hostname outside this Worker route to avoid recursion",
+      "",
+      `Source id: ${sourceRow2.id}`,
+      "After deploy, check `canonry doctor --project " + project.name + "` to confirm events are arriving."
+    ].join("\n");
+    return {
+      sourceId: sourceRow2.id,
+      deliveryMode,
+      workerScript,
+      wranglerToml,
+      workerVersion,
+      instructions
+    };
+  });
+  app.post("/projects/:name/traffic/cloudflare/ingest", {
+    bodyLimit: CLOUDFLARE_INGEST_BODY_LIMIT,
+    preHandler: async (request, reply) => {
+      const key = cloudflareIngestRateLimitKey(
+        request,
+        opts.cloudflareTrafficCredentialStore,
+        app.db
+      );
+      if (key.startsWith("cloudflare-invalid:")) return;
+      const result = await checkCloudflareSourceRateLimit(request);
+      if (result.isAllowed || !result.isExceeded) return;
+      reply.header("retry-after", result.ttlInSeconds);
+      return reply.status(429).send({
+        statusCode: 429,
+        error: "Too Many Requests",
+        message: `Rate limit exceeded, retry in ${result.ttlInSeconds} second(s)`
+      });
+    },
+    config: {
+      rateLimit: {
+        hook: "onRequest",
+        max: opts.cloudflareIngestIpRateLimitMax ?? DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX,
+        timeWindow: "1 minute",
+        groupId: "cloudflare-direct-push-ip",
+        keyGenerator: (request) => `cloudflare-ingest-ip:${request.ip}`
+      }
+    }
+  }, async (request, reply) => {
+    const authenticated = authenticateCloudflareIngest(
+      request,
+      opts.cloudflareTrafficCredentialStore
+    );
+    if (!authenticated || authenticated.credential.projectName !== request.params.name || !isDirectPushCloudflareDeliveryMode(authenticated.credential.deliveryMode)) {
+      throw authRequired();
+    }
+    const { bearerHash, credential } = authenticated;
+    const sourceId = credential.sourceId;
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
+    if (!sourceRow2 || sourceRow2.sourceType !== TrafficSourceTypes.cloudflare || sourceRow2.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(sourceRow2.configJson) || !timingSafeEqualHex(bearerHash, sourceRow2.ingestTokenHash)) {
+      throw authRequired();
+    }
+    const project = resolveProject(app.db, request.params.name);
+    if (sourceRow2.projectId !== project.id) throw authRequired();
+    const parsed = cloudflareWorkerIngestRequestSchema.safeParse(request.body);
+    if (!parsed.success) {
+      throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+    }
+    const { workerVersion, events } = parsed.data;
+    const canonicalHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+    const wrongHostIndex = events.findIndex(
+      (event) => normalizeCloudflareEventHost(event.host) !== canonicalHost
+    );
+    if (wrongHostIndex !== -1) {
+      throw validationError(
+        `Cloudflare event at index ${wrongHostIndex} does not belong to project domain "${project.canonicalDomain}"`
+      );
+    }
+    const normalized = [];
+    let normalizationDrops = 0;
+    for (const event of events) {
+      const result = normalizeCloudflareWorkerEvent(event);
+      if (result) normalized.push(result);
+      else normalizationDrops += 1;
+    }
+    const receivedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const writeResult = writeTrafficEventBatch({
+      db: app.db,
+      projectId: project.id,
+      sourceId,
+      events: normalized,
+      receivedAt,
+      receiptTtlMs: DIRECT_PUSH_RECEIPT_TTL_MS,
+      sampleLimit,
+      validateSource: (latestRow) => {
+        if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
+          throw authRequired();
+        }
+      },
+      sourceUpdate: {
+        lastWorkerVersion: workerVersion,
+        lastSyncedAt: receivedAt,
+        lastError: null,
+        updatedAt: receivedAt
+      }
+    });
+    return reply.status(200).send({
+      acceptedEvents: writeResult.acceptedEvents,
+      droppedEvents: normalizationDrops + writeResult.duplicateEvents,
+      workerVersionAck: workerVersion,
+      crawlerBucketRows: writeResult.crawlerBucketRows,
+      aiUserFetchBucketRows: writeResult.aiUserFetchBucketRows,
+      aiReferralBucketRows: writeResult.aiReferralBucketRows,
+      sampleRows: writeResult.sampleRows
+    });
+  });
   app.post("/projects/:name/traffic/sources/:id/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
@@ -51715,7 +52957,7 @@ async function trafficRoutes(app, opts) {
     const windowEnd = /* @__PURE__ */ new Date();
     const startedAt = windowEnd.toISOString();
     const syncStartedAtMs = windowEnd.getTime();
-    const runId = crypto39.randomUUID();
+    const runId = crypto40.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -51729,8 +52971,8 @@ async function trafficRoutes(app, opts) {
     const markFailed = (msg, errorCode) => {
       const failedAt = (/* @__PURE__ */ new Date()).toISOString();
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq46(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
+        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       });
       try {
         opts.onTrafficSynced?.({
@@ -51811,7 +53053,7 @@ async function trafficRoutes(app, opts) {
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError(
           `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
         );
@@ -51860,12 +53102,12 @@ async function trafficRoutes(app, opts) {
       auditAction = "traffic.vercel.synced";
       const credentialStore = opts.vercelTrafficCredentialStore;
       if (!credentialStore) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError("Vercel traffic credential storage is not configured for this deployment");
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq46(runs.id, runId)).run();
+        app.db.delete(runs).where(eq47(runs.id, runId)).run();
         throw validationError(
           `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
         );
@@ -51883,7 +53125,7 @@ async function trafficRoutes(app, opts) {
       if (cappedStartMs > clampedStartMs) {
         const previousSkip = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
         const skippedThrough = Number.isFinite(previousSkip) ? new Date(Math.max(previousSkip, cappedStartMs)) : new Date(cappedStartMs);
-        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq47(trafficSources.id, sourceRow2.id)).run();
         request.log.warn(
           {
             sourceId: sourceRow2.id,
@@ -51968,7 +53210,7 @@ async function trafficRoutes(app, opts) {
     let aiReferralHitsCount = 0;
     let unknownHitsCount = 0;
     app.db.transaction((tx) => {
-      const latestRow = tx.select().from(trafficSources).where(eq46(trafficSources.id, sourceRow2.id)).get();
+      const latestRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
       const previousIds = latestRow.lastEventIds ?? [];
       const seenEventIds = new Set(previousIds);
       const dedupedEvents = seenEventIds.size === 0 ? allEvents : allEvents.filter((e) => !seenEventIds.has(e.eventId));
@@ -52016,7 +53258,7 @@ async function trafficRoutes(app, opts) {
             crawlerEventsHourly.status
           ],
           set: {
-            hits: sql18`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql19`${crawlerEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -52049,7 +53291,7 @@ async function trafficRoutes(app, opts) {
             aiUserFetchEventsHourly.status
           ],
           set: {
-            hits: sql18`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            hits: sql19`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
             sampledUserAgent: bucket.sampledUserAgent,
             updatedAt: finishedAt
           }
@@ -52089,9 +53331,9 @@ async function trafficRoutes(app, opts) {
           // colliding bucket adds its paid and organic arrivals to the ones
           // already there rather than overwriting a single label.
           set: {
-            sessionsOrHits: sql18`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
-            paidSessionsOrHits: sql18`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
-            organicSessionsOrHits: sql18`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
+            sessionsOrHits: sql19`${aiReferralEventsHourly.sessionsOrHits} + ${bucket.hits}`,
+            paidSessionsOrHits: sql19`${aiReferralEventsHourly.paidSessionsOrHits} + ${bucket.paidHits}`,
+            organicSessionsOrHits: sql19`${aiReferralEventsHourly.organicSessionsOrHits} + ${bucket.organicHits}`,
             updatedAt: finishedAt
           }
         }).run();
@@ -52108,7 +53350,7 @@ async function trafficRoutes(app, opts) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto39.randomUUID(),
+          id: crypto40.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sample.observedAt,
@@ -52156,8 +53398,8 @@ async function trafficRoutes(app, opts) {
       if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
         sourceUpdate.lastCursor = nextCursor ?? null;
       }
-      tx.update(trafficSources).set(sourceUpdate).where(eq46(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq46(runs.id, runId)).run();
+      tx.update(trafficSources).set(sourceUpdate).where(eq47(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
     });
     writeAuditLog(app.db, {
       projectId: project.id,
@@ -52209,7 +53451,7 @@ async function trafficRoutes(app, opts) {
   });
   app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
@@ -52359,7 +53601,7 @@ async function trafficRoutes(app, opts) {
       };
     }
     const startedAt = windowEnd.toISOString();
-    const runId = crypto39.randomUUID();
+    const runId = crypto40.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -52395,40 +53637,40 @@ async function trafficRoutes(app, opts) {
   function buildSourceDetail(projectId, row, since) {
     const crawlerPathRows = app.db.select({
       pathNormalized: crawlerEventsHourly.pathNormalized,
-      hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+      hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
     }).from(crawlerEventsHourly).where(
-      and38(
-        eq46(crawlerEventsHourly.sourceId, row.id),
-        gte10(crawlerEventsHourly.tsHour, since)
+      and39(
+        eq47(crawlerEventsHourly.sourceId, row.id),
+        gte11(crawlerEventsHourly.tsHour, since)
       )
     ).groupBy(crawlerEventsHourly.pathNormalized).all();
     const crawlerSegments = segmentCrawlerHits(
       crawlerPathRows.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
     );
     const crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
-    const aiUserFetchTotals = app.db.select({ total: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
-      and38(
-        eq46(aiUserFetchEventsHourly.sourceId, row.id),
-        gte10(aiUserFetchEventsHourly.tsHour, since)
+    const aiUserFetchTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+      and39(
+        eq47(aiUserFetchEventsHourly.sourceId, row.id),
+        gte11(aiUserFetchEventsHourly.tsHour, since)
       )
     ).get();
-    const aiTotals = app.db.select({ total: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-      and38(
-        eq46(aiReferralEventsHourly.sourceId, row.id),
-        gte10(aiReferralEventsHourly.tsHour, since)
+    const aiTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+      and39(
+        eq47(aiReferralEventsHourly.sourceId, row.id),
+        gte11(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
-    const sampleTotals = app.db.select({ total: sql18`COUNT(*)` }).from(rawEventSamples).where(
-      and38(
-        eq46(rawEventSamples.sourceId, row.id),
-        gte10(rawEventSamples.ts, since)
+    const sampleTotals = app.db.select({ total: sql19`COUNT(*)` }).from(rawEventSamples).where(
+      and39(
+        eq47(rawEventSamples.sourceId, row.id),
+        gte11(rawEventSamples.ts, since)
       )
     ).get();
     const latestRun = app.db.select().from(runs).where(
-      and38(
-        eq46(runs.projectId, projectId),
-        eq46(runs.kind, RunKinds["traffic-sync"]),
-        eq46(runs.sourceId, row.id)
+      and39(
+        eq47(runs.projectId, projectId),
+        eq47(runs.kind, RunKinds["traffic-sync"]),
+        eq47(runs.sourceId, row.id)
       )
     ).orderBy(desc22(runs.startedAt)).limit(1).get();
     return {
@@ -52459,7 +53701,7 @@ async function trafficRoutes(app, opts) {
         "`advanceToNow` must be `true`. There is no implicit reset."
       );
     }
-    const sourceRow2 = app.db.select().from(trafficSources).where(and38(eq46(trafficSources.projectId, project.id), eq46(trafficSources.id, request.params.id))).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(and39(eq47(trafficSources.projectId, project.id), eq47(trafficSources.id, request.params.id))).get();
     if (!sourceRow2) {
       throw notFound("traffic source", request.params.id);
     }
@@ -52476,7 +53718,7 @@ async function trafficRoutes(app, opts) {
         status: TrafficSourceStatuses.connected,
         lastError: null,
         updatedAt: now
-      }).where(eq46(trafficSources.id, sourceRow2.id)).run();
+      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
       writeAuditLog(tx, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
@@ -52484,20 +53726,20 @@ async function trafficRoutes(app, opts) {
         entityType: "traffic_source",
         entityId: sourceRow2.id
       }));
-      updatedRow = tx.select().from(trafficSources).where(eq46(trafficSources.id, sourceRow2.id)).get();
+      updatedRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
     });
     return buildSourceDetail(project.id, updatedRow, new Date(Date.now() - 24 * 60 * 6e4).toISOString());
   });
   app.get("/projects/:name/traffic/sources", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map(rowToDto);
     const response = { sources };
     return response;
   });
   app.get("/projects/:name/traffic/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq46(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const since = new Date(Date.now() - 24 * 60 * 6e4).toISOString();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map((row) => buildSourceDetail(project.id, row, since));
     const response = { sources };
@@ -52507,7 +53749,7 @@ async function trafficRoutes(app, opts) {
     "/projects/:name/traffic/sources/:id",
     async (request) => {
       const project = resolveProject(app.db, request.params.name);
-      const row = app.db.select().from(trafficSources).where(eq46(trafficSources.id, request.params.id)).get();
+      const row = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
       if (!row || row.projectId !== project.id) {
         throw notFound("Traffic source", request.params.id);
       }
@@ -52572,26 +53814,26 @@ async function trafficRoutes(app, opts) {
     const seriesByBucket = /* @__PURE__ */ new Map();
     if (kind === "all" || kind === TrafficEventKinds.crawler) {
       const crawlerFilters = [
-        eq46(crawlerEventsHourly.projectId, project.id),
-        gte10(crawlerEventsHourly.tsHour, sinceIso),
-        lte9(crawlerEventsHourly.tsHour, untilIso)
+        eq47(crawlerEventsHourly.projectId, project.id),
+        gte11(crawlerEventsHourly.tsHour, sinceIso),
+        lte10(crawlerEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) crawlerFilters.push(eq46(crawlerEventsHourly.sourceId, sourceIdParam));
-      const crawlerWhere = and38(...crawlerFilters);
+      if (sourceIdParam) crawlerFilters.push(eq47(crawlerEventsHourly.sourceId, sourceIdParam));
+      const crawlerWhere = and39(...crawlerFilters);
       const pathTotals = app.db.select({
         pathNormalized: crawlerEventsHourly.pathNormalized,
-        hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
-        rows: sql18`COUNT(*)`
+        hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerEventsHourly.pathNormalized).all();
       crawlerSegments = segmentCrawlerHits(
         pathTotals.map((r) => ({ pathNormalized: r.pathNormalized, hits: Number(r.hits) }))
       );
       crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
       totalEventRows += pathTotals.reduce((sum, row) => sum + Number(row.rows), 0);
-      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
+      const crawlerSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${crawlerEventsHourly.tsHour}, 1, 10)` : crawlerEventsHourly.tsHour;
       const crawlerSeries = app.db.select({
         bucket: crawlerSeriesBucket,
-        hits: sql18`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
+        hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
       }).from(crawlerEventsHourly).where(crawlerWhere).groupBy(crawlerSeriesBucket).all();
       for (const row of crawlerSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).crawlerHits = Number(row.hits);
@@ -52614,22 +53856,22 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-user-fetch"]) {
       const userFetchFilters = [
-        eq46(aiUserFetchEventsHourly.projectId, project.id),
-        gte10(aiUserFetchEventsHourly.tsHour, sinceIso),
-        lte9(aiUserFetchEventsHourly.tsHour, untilIso)
+        eq47(aiUserFetchEventsHourly.projectId, project.id),
+        gte11(aiUserFetchEventsHourly.tsHour, sinceIso),
+        lte10(aiUserFetchEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) userFetchFilters.push(eq46(aiUserFetchEventsHourly.sourceId, sourceIdParam));
-      const userFetchWhere = and38(...userFetchFilters);
+      if (sourceIdParam) userFetchFilters.push(eq47(aiUserFetchEventsHourly.sourceId, sourceIdParam));
+      const userFetchWhere = and39(...userFetchFilters);
       const total = app.db.select({
-        total: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
-        rows: sql18`COUNT(*)`
+        total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).get();
       aiUserFetchTotal = Number(total?.total ?? 0);
       totalEventRows += Number(total?.rows ?? 0);
-      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
+      const userFetchSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${aiUserFetchEventsHourly.tsHour}, 1, 10)` : aiUserFetchEventsHourly.tsHour;
       const userFetchSeries = app.db.select({
         bucket: userFetchSeriesBucket,
-        hits: sql18`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
+        hits: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`
       }).from(aiUserFetchEventsHourly).where(userFetchWhere).groupBy(userFetchSeriesBucket).all();
       for (const row of userFetchSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).aiUserFetchHits = Number(row.hits);
@@ -52651,17 +53893,17 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-referral"]) {
       const aiFilters = [
-        eq46(aiReferralEventsHourly.projectId, project.id),
-        gte10(aiReferralEventsHourly.tsHour, sinceIso),
-        lte9(aiReferralEventsHourly.tsHour, untilIso)
+        eq47(aiReferralEventsHourly.projectId, project.id),
+        gte11(aiReferralEventsHourly.tsHour, sinceIso),
+        lte10(aiReferralEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) aiFilters.push(eq46(aiReferralEventsHourly.sourceId, sourceIdParam));
-      const aiWhere = and38(...aiFilters);
+      if (sourceIdParam) aiFilters.push(eq47(aiReferralEventsHourly.sourceId, sourceIdParam));
+      const aiWhere = and39(...aiFilters);
       const total = app.db.select({
-        total: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
-        paid: sql18`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
-        organic: sql18`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`,
-        rows: sql18`COUNT(*)`
+        total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
+        paid: sql19`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
+        organic: sql19`COALESCE(SUM(${aiReferralEventsHourly.organicSessionsOrHits}), 0)`,
+        rows: sql19`COUNT(*)`
       }).from(aiReferralEventsHourly).where(aiWhere).get();
       aiReferralCounts = aiReferralClassCounts(
         Number(total?.total ?? 0),
@@ -52669,10 +53911,10 @@ async function trafficRoutes(app, opts) {
         Number(total?.organic ?? 0)
       );
       totalEventRows += Number(total?.rows ?? 0);
-      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql18`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
+      const referralSeriesBucket = granularity === TrafficSeriesGranularities.day ? sql19`substr(${aiReferralEventsHourly.tsHour}, 1, 10)` : aiReferralEventsHourly.tsHour;
       const referralSeries = app.db.select({
         bucket: referralSeriesBucket,
-        hits: sql18`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
+        hits: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`
       }).from(aiReferralEventsHourly).where(aiWhere).groupBy(referralSeriesBucket).all();
       for (const row of referralSeries) {
         trafficSeriesPoint(seriesByBucket, row.bucket).aiReferralHits = Number(row.hits);
@@ -52729,7 +53971,7 @@ async function trafficRoutes(app, opts) {
 }
 
 // ../api-routes/src/doctor/checks/agent.ts
-import crypto40 from "crypto";
+import crypto41 from "crypto";
 import fs6 from "fs";
 import path7 from "path";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -52960,7 +54202,7 @@ function isInstalled(dir) {
 }
 function hashInstalledFile(filePath) {
   try {
-    return crypto40.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
+    return crypto41.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
   } catch {
     return void 0;
   }
@@ -52975,7 +54217,7 @@ function readInstalledManifest(skillDir) {
 var AGENT_CHECKS = [skillsInstalledCheck, skillsCurrentCheck];
 
 // ../api-routes/src/doctor/checks/backlinks.ts
-import { and as and39, eq as eq47 } from "drizzle-orm";
+import { and as and40, eq as eq48 } from "drizzle-orm";
 function skippedNoProject() {
   return {
     status: CheckStatuses.skipped,
@@ -52991,8 +54233,8 @@ var BACKLINKS_CHECKS = [
     title: "Backlinks source connected",
     run: (ctx) => {
       if (!ctx.project) return skippedNoProject();
-      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq47(projects.id, ctx.project.id)).get();
-      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq47(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
+      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq48(projects.id, ctx.project.id)).get();
+      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq48(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
       const ccConnected = projectRow?.autoExtract === true && !!readySync;
       const connected = [];
       if (ccConnected) connected.push(BacklinkSources.commoncrawl);
@@ -53005,9 +54247,9 @@ var BACKLINKS_CHECKS = [
           details: { commoncrawl: ccConnected }
         };
       }
-      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and39(
-        eq47(backlinkSummaries.projectId, ctx.project.id),
-        eq47(backlinkSummaries.source, BacklinkSources.commoncrawl)
+      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and40(
+        eq48(backlinkSummaries.projectId, ctx.project.id),
+        eq48(backlinkSummaries.source, BacklinkSources.commoncrawl)
       )).limit(1).get() : false;
       return {
         status: CheckStatuses.ok,
@@ -53167,7 +54409,7 @@ var BING_AUTH_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/content.ts
-import { eq as eq48 } from "drizzle-orm";
+import { eq as eq49 } from "drizzle-orm";
 var WINNABILITY_COVERAGE_WARN_THRESHOLD = 0.8;
 var UNCLASSIFIED_DOMAIN_SAMPLE_LIMIT = 10;
 function skippedNoProject2() {
@@ -53180,7 +54422,7 @@ function skippedNoProject2() {
 }
 function loadProject(ctx) {
   if (!ctx.project) return null;
-  return ctx.db.select().from(projects).where(eq48(projects.id, ctx.project.id)).get() ?? null;
+  return ctx.db.select().from(projects).where(eq49(projects.id, ctx.project.id)).get() ?? null;
 }
 function percent(value) {
   return Math.round(value * 100);
@@ -53272,7 +54514,7 @@ var CONTENT_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/ads.ts
-import { eq as eq49 } from "drizzle-orm";
+import { eq as eq50 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS = 7;
 var RECENT_SYNC_FAIL_DAYS = 30;
 var adsConnectionCheck = {
@@ -53289,7 +54531,7 @@ var adsConnectionCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq49(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -53339,7 +54581,7 @@ var adsRecentSyncCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq49(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -53530,7 +54772,7 @@ var ga4ConnectionCheck = {
 var GA_AUTH_CHECKS = [ga4ConnectionCheck];
 
 // ../api-routes/src/doctor/checks/gbp-auth.ts
-import { and as and40, eq as eq50 } from "drizzle-orm";
+import { and as and41, eq as eq51 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS2 = 7;
 var RECENT_SYNC_FAIL_DAYS2 = 30;
 function skippedNoProject3() {
@@ -53763,7 +55005,7 @@ var recentSyncCheck = {
   title: "GBP recent sync",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject3();
-    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and40(eq50(gbpLocations.projectId, ctx.project.id), eq50(gbpLocations.selected, true))).all();
+    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and41(eq51(gbpLocations.projectId, ctx.project.id), eq51(gbpLocations.selected, true))).all();
     if (selected.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -53823,7 +55065,7 @@ var GBP_AUTH_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/places.ts
-import { eq as eq51 } from "drizzle-orm";
+import { eq as eq52 } from "drizzle-orm";
 var apiKeyCheck = {
   id: "gbp.places.api-key",
   category: CheckCategories.auth,
@@ -53868,7 +55110,7 @@ var apiKeyCheck = {
         details: { tier: cfg.tier }
       };
     }
-    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq51(gbpLocations.projectId, ctx.project.id)).all();
+    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq52(gbpLocations.projectId, ctx.project.id)).all();
     const selected = rows.filter((r) => r.selected);
     const locationsWithPlaceId = selected.filter((r) => Boolean(r.placeId)).length;
     const details = {
@@ -54383,9 +55625,25 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and41, eq as eq52, gte as gte11, ne as ne6, sql as sql19 } from "drizzle-orm";
+import { and as and42, eq as eq53, gte as gte12, ne as ne6, sql as sql20 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
+function isCloudflareDirectPush(source) {
+  if (source.sourceType !== TrafficSourceTypes.cloudflare) return false;
+  const deliveryMode = source.configJson.deliveryMode;
+  return deliveryMode === void 0 || deliveryMode === CloudflareTrafficDeliveryModes["direct-push"];
+}
+function recentDataRemediation(sources, lastSyncedAt) {
+  const hasCloudflare = sources.some(isCloudflareDirectPush);
+  const hasPullSource = sources.some((source) => !isCloudflareDirectPush(source));
+  if (hasCloudflare && !hasPullSource) {
+    return "Confirm the Cloudflare Worker is deployed on the zone route and forwarding to canonry; reconnect Cloudflare to regenerate the Worker if needed.";
+  }
+  if (hasCloudflare && hasPullSource) {
+    return "Run `canonry traffic sync <project>` for pull-based sources, and confirm the Cloudflare Worker is deployed on the zone route and forwarding to canonry.";
+  }
+  return lastSyncedAt ? `Last sync: ${lastSyncedAt}. Run \`canonry traffic sync <project>\` to refresh, or check the source connection.` : "Run `canonry traffic sync <project>` to pull recent events.";
+}
 function skippedNoProject5() {
   return {
     status: CheckStatuses.skipped,
@@ -54397,8 +55655,8 @@ function skippedNoProject5() {
 function loadProbes(ctx) {
   if (!ctx.project) return [];
   const rows = ctx.db.select().from(trafficSources).where(
-    and41(
-      eq52(trafficSources.projectId, ctx.project.id),
+    and42(
+      eq53(trafficSources.projectId, ctx.project.id),
       ne6(trafficSources.status, TrafficSourceStatuses.archived)
     )
   ).all();
@@ -54410,6 +55668,8 @@ function loadProbes(ctx) {
     displayName: r.displayName,
     status: r.status,
     lastSyncedAt: r.lastSyncedAt,
+    lastWorkerVersion: r.lastWorkerVersion,
+    ingestTokenHash: r.ingestTokenHash,
     skippedThroughAt: r.skippedThroughAt,
     lastError: r.lastError,
     configJson: r.configJson
@@ -54478,52 +55738,74 @@ var recentDataCheck = {
     const warnCutoff = new Date(now.getTime() - RECENT_DATA_WARN_DAYS * 24 * 60 * 6e4).toISOString();
     const failCutoff = new Date(now.getTime() - RECENT_DATA_FAIL_DAYS * 24 * 60 * 6e4).toISOString();
     const recentCrawlers = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and41(
-          eq52(crawlerEventsHourly.projectId, ctx.project.id),
-          gte11(crawlerEventsHourly.tsHour, warnCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+        and42(
+          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+          gte12(crawlerEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
     const recentReferrals = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and41(
-          eq52(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte11(aiReferralEventsHourly.tsHour, warnCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+        and42(
+          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+          gte12(aiReferralEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
-    if (recentCrawlers > 0 || recentReferrals > 0) {
+    const recentUserFetches = Number(
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+        and42(
+          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          gte12(aiUserFetchEventsHourly.tsHour, warnCutoff)
+        )
+      ).get()?.total ?? 0
+    );
+    if (recentCrawlers > 0 || recentUserFetches > 0 || recentReferrals > 0) {
       return {
         status: CheckStatuses.ok,
         code: "traffic.recent-data.fresh",
-        summary: `${recentCrawlers} crawler hit(s) and ${recentReferrals} AI-referral arrival(s) in the last ${RECENT_DATA_WARN_DAYS} days.`,
-        details: { crawlerHits: recentCrawlers, referralArrivals: recentReferrals, windowDays: RECENT_DATA_WARN_DAYS }
+        summary: `${recentCrawlers} crawler hit(s), ${recentUserFetches} AI user-fetch hit(s), and ${recentReferrals} AI-referral arrival(s) in the last ${RECENT_DATA_WARN_DAYS} days.`,
+        details: {
+          crawlerHits: recentCrawlers,
+          aiUserFetchHits: recentUserFetches,
+          referralArrivals: recentReferrals,
+          windowDays: RECENT_DATA_WARN_DAYS
+        }
       };
     }
     const olderCrawlers = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and41(
-          eq52(crawlerEventsHourly.projectId, ctx.project.id),
-          gte11(crawlerEventsHourly.tsHour, failCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
+        and42(
+          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+          gte12(crawlerEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const olderReferrals = Number(
-      ctx.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and41(
-          eq52(aiReferralEventsHourly.projectId, ctx.project.id),
-          gte11(aiReferralEventsHourly.tsHour, failCutoff)
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
+        and42(
+          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+          gte12(aiReferralEventsHourly.tsHour, failCutoff)
+        )
+      ).get()?.total ?? 0
+    );
+    const olderUserFetches = Number(
+      ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
+        and42(
+          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          gte12(aiUserFetchEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const lastSyncedAt = sources.map((s) => s.lastSyncedAt).filter(Boolean).sort().at(-1) ?? null;
-    if (olderCrawlers > 0 || olderReferrals > 0 || lastSyncedAt) {
+    const hasOlderData = olderCrawlers > 0 || olderUserFetches > 0 || olderReferrals > 0;
+    if (hasOlderData || lastSyncedAt) {
       return {
         status: CheckStatuses.warn,
         code: "traffic.recent-data.stale",
-        summary: `No crawler hits or AI-referral sessions in the last ${RECENT_DATA_WARN_DAYS} days, though older data exists.`,
-        remediation: lastSyncedAt ? `Last sync: ${lastSyncedAt}. Run \`canonry traffic sync <project>\` to refresh, or check the source connection.` : "Run `canonry traffic sync <project>` to pull recent events.",
+        summary: hasOlderData ? `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days, though older data exists.` : `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days.`,
+        remediation: recentDataRemediation(sources, lastSyncedAt),
         details: { lastSyncedAt, sourceCount: sources.length }
       };
     }
@@ -54721,7 +56003,15 @@ var syncLagCheck = {
   title: "Traffic source sync lag",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject5();
-    const sources = loadProbes(ctx);
+    const allSources = loadProbes(ctx);
+    const sources = allSources.filter((source) => !isCloudflareDirectPush(source));
+    if (allSources.length > 0 && sources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.sync-lag.push-only",
+        summary: "Only push traffic sources are connected \u2014 pull sync lag does not apply."
+      };
+    }
     if (sources.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -54811,10 +56101,68 @@ var syncLagCheck = {
     };
   }
 };
+var workerVersionCheck = {
+  id: "traffic.source.worker-version",
+  category: CheckCategories.integrations,
+  scope: CheckScopes.project,
+  title: "Cloudflare Worker version",
+  run: (ctx) => {
+    if (!ctx.project) return skippedNoProject5();
+    const sources = loadProbes(ctx).filter(isCloudflareDirectPush);
+    if (sources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.worker-version.not-applicable",
+        summary: "No Cloudflare direct-push source is connected."
+      };
+    }
+    const measured = sources.map((source) => {
+      const expected = source.configJson.workerVersion;
+      const expectedVersion = typeof expected === "string" && expected.length > 0 ? expected : null;
+      const observedVersion = source.lastWorkerVersion;
+      const state = observedVersion === null ? "waiting-for-first-event" : expectedVersion !== null && observedVersion === expectedVersion ? "current" : "stale";
+      return {
+        sourceId: source.id,
+        displayName: source.displayName,
+        expectedVersion,
+        observedVersion,
+        state
+      };
+    });
+    const details = { sources: measured };
+    const stale = measured.filter((source) => source.state === "stale");
+    if (stale.length > 0) {
+      return {
+        status: CheckStatuses.warn,
+        code: "traffic.worker-version.stale",
+        summary: `${stale.length} Cloudflare Worker source(s) report a version that differs from the generated version.`,
+        remediation: "Redeploy the generated Worker from the credential-owning host. Use `canonry traffic connect cloudflare <project> --zone-id <id> --deploy --confirm-route --confirm-fail-open`, then attach the route manually.",
+        details
+      };
+    }
+    const waiting = measured.filter((source) => source.state === "waiting-for-first-event");
+    if (waiting.length > 0) {
+      return {
+        status: CheckStatuses.warn,
+        code: "traffic.worker-version.waiting-for-first-event",
+        summary: `${waiting.length} Cloudflare Worker source(s) have not delivered an event yet.`,
+        remediation: "Send a smoke-test request through the Worker. Then run `canonry doctor --project <project>` again.",
+        details
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "traffic.worker-version.current",
+      summary: "All Cloudflare direct-push Workers report the generated version.",
+      details
+    };
+  }
+};
 var TRAFFIC_SOURCE_CHECKS = [
   sourceConnectedCheck,
   recentDataCheck,
   syncLagCheck,
+  workerVersionCheck,
   credentialsCheck,
   scopesCheck3,
   cacheBlindSpotCheck
@@ -55033,8 +56381,8 @@ async function doctorRoutes(app, opts) {
 }
 
 // ../api-routes/src/discovery/routes.ts
-import crypto41 from "crypto";
-import { and as and42, desc as desc23, eq as eq53, gte as gte12, inArray as inArray18, isNull as isNull4, or as or10 } from "drizzle-orm";
+import crypto42 from "crypto";
+import { and as and43, desc as desc23, eq as eq54, gte as gte13, inArray as inArray18, isNull as isNull4, or as or10 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -55068,13 +56416,13 @@ async function discoveryRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const ageFloorIso = new Date(Date.now() - MAX_INFLIGHT_DISCOVERY_AGE_MS).toISOString();
     const decision = app.db.transaction((tx) => {
-      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and42(
-        eq53(discoverySessions.projectId, project.id),
-        eq53(discoverySessions.icpDescription, icpDescription),
+      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and43(
+        eq54(discoverySessions.projectId, project.id),
+        eq54(discoverySessions.icpDescription, icpDescription),
         // Buyer is part of session identity: it changes the seed prompt's
         // semantics, so a request with a different (or no) buyer must start
         // its own session, never adopt another buyer's probes.
-        parsed.data.buyerDescription == null ? isNull4(discoverySessions.buyerDescription) : eq53(discoverySessions.buyerDescription, parsed.data.buyerDescription),
+        parsed.data.buyerDescription == null ? isNull4(discoverySessions.buyerDescription) : eq54(discoverySessions.buyerDescription, parsed.data.buyerDescription),
         // Locations are identity too: a different service-area subset seeds
         // and probes a different geo, so it must never reuse another geo's
         // session. resolveLocations is deterministic (project-config order),
@@ -55084,23 +56432,23 @@ async function discoveryRoutes(app, opts) {
         // locations a NULL row's subset is unknowable, so it conservatively
         // never reuses — a one-time, bounded (2h window) non-reuse after
         // upgrade, never a wrong reuse.
-        locations.length === 0 ? or10(isNull4(discoverySessions.locations), eq53(discoverySessions.locations, locations)) : eq53(discoverySessions.locations, locations),
+        locations.length === 0 ? or10(isNull4(discoverySessions.locations), eq54(discoverySessions.locations, locations)) : eq54(discoverySessions.locations, locations),
         // Seed provider set is identity: a different phrasing distribution
         // must never reuse another set's session. Null (= Gemini-only
         // default, including explicit ['gemini']) matches legacy rows.
-        seedProviders == null ? isNull4(discoverySessions.seedProviders) : eq53(discoverySessions.seedProviders, seedProviders),
+        seedProviders == null ? isNull4(discoverySessions.seedProviders) : eq54(discoverySessions.seedProviders, seedProviders),
         inArray18(discoverySessions.status, [
           DiscoverySessionStatuses.queued,
           DiscoverySessionStatuses.seeding,
           DiscoverySessionStatuses.probing
         ]),
-        gte12(discoverySessions.createdAt, ageFloorIso)
+        gte13(discoverySessions.createdAt, ageFloorIso)
       )).orderBy(desc23(discoverySessions.createdAt)).get();
       if (existing && existing.runId) {
         return { reused: true, sessionId: existing.id, runId: existing.runId };
       }
-      const sessionId = crypto41.randomUUID();
-      const runId = crypto41.randomUUID();
+      const sessionId = crypto42.randomUUID();
+      const runId = crypto42.randomUUID();
       tx.insert(discoverySessions).values({
         id: sessionId,
         projectId: project.id,
@@ -55164,7 +56512,7 @@ async function discoveryRoutes(app, opts) {
       const project = resolveProject(app.db, request.params.name);
       const parsedLimit = parseInt(request.query.limit ?? "", 10);
       const limit = Number.isNaN(parsedLimit) || parsedLimit <= 0 ? 50 : parsedLimit;
-      const rows = app.db.select().from(discoverySessions).where(eq53(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
+      const rows = app.db.select().from(discoverySessions).where(eq54(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
       return reply.send(rows.map(serializeSession));
     }
   );
@@ -55172,11 +56520,11 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
       const detail = {
         ...serializeSession(session),
         probes: probeRows.map(serializeProbe)
@@ -55188,7 +56536,7 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/harvest",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
@@ -55196,7 +56544,7 @@ async function discoveryRoutes(app, opts) {
       const minProbeHits = Number.isNaN(parsedFloor) || parsedFloor < 1 ? 1 : parsedFloor;
       const applyAnchor = request.query.anchor !== "false";
       const provider = session.seedProvider ?? "gemini";
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
       const extract = opts.harvestSearchQueries;
       const probesWithQueries = probeRows.map((row) => {
         if (!extract || !row.rawResponse) return { searchQueries: [] };
@@ -55207,7 +56555,7 @@ async function discoveryRoutes(app, opts) {
           return { searchQueries: [] };
         }
       });
-      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq53(queries.projectId, project.id)).all().map((r) => r.query);
+      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query);
       const anchorTerms = buildHarvestAnchorTerms(
         [session.icpDescription ?? "", ...trackedQueries],
         effectiveDomains(project)
@@ -55254,12 +56602,12 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/promote",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
-      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq53(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
+      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
+      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
       const seenCompetitors = new Set(existingCompetitors);
       const cited = /* @__PURE__ */ new Set();
       const aspirational = /* @__PURE__ */ new Set();
@@ -55288,7 +56636,7 @@ async function discoveryRoutes(app, opts) {
   );
   app.post("/projects/:name/discover/sessions/:id/promote", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const session = app.db.select().from(discoverySessions).where(eq53(discoverySessions.id, request.params.id)).get();
+    const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
     if (!session || session.projectId !== project.id) {
       throw notFound("Discovery session", request.params.id);
     }
@@ -55311,7 +56659,7 @@ async function discoveryRoutes(app, opts) {
     const bucketSet = new Set(buckets);
     const includeCompetitors = parsed.data.includeCompetitors ?? true;
     const competitorTypes = parsed.data.competitorTypes ?? DEFAULT_DISCOVERY_PROMOTE_COMPETITOR_TYPES;
-    const probeRows = app.db.select().from(discoveryProbes).where(eq53(discoveryProbes.sessionId, session.id)).all();
+    const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
     const candidateQueries = /* @__PURE__ */ new Set();
     for (const probe of probeRows) {
       if (!probe.bucket) continue;
@@ -55319,7 +56667,7 @@ async function discoveryRoutes(app, opts) {
       if (bucket.success && bucketSet.has(bucket.data)) candidateQueries.add(probe.query);
     }
     const existingQueries = new Set(
-      app.db.select({ query: queries.query }).from(queries).where(eq53(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
+      app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
     );
     const promotedQueries = [];
     const skippedQueries = [];
@@ -55335,7 +56683,7 @@ async function discoveryRoutes(app, opts) {
     const skippedCompetitors = [];
     if (includeCompetitors) {
       const existingCompetitors = new Set(
-        app.db.select({ domain: competitors.domain }).from(competitors).where(eq53(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
+        app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
       );
       const competitorMap = parseCompetitorMap(session.competitorMap);
       for (const entry of selectEligibleCompetitors(competitorMap, competitorTypes)) {
@@ -55354,7 +56702,7 @@ async function discoveryRoutes(app, opts) {
       app.db.transaction((tx) => {
         for (const query of promotedQueries) {
           tx.insert(queries).values({
-            id: crypto41.randomUUID(),
+            id: crypto42.randomUUID(),
             projectId: project.id,
             query,
             provenance,
@@ -55363,7 +56711,7 @@ async function discoveryRoutes(app, opts) {
         }
         for (const domain of promotedCompetitors) {
           tx.insert(competitors).values({
-            id: crypto41.randomUUID(),
+            id: crypto42.randomUUID(),
             projectId: project.id,
             domain,
             provenance,
@@ -55453,8 +56801,8 @@ function selectEligibleCompetitors(competitorMap, competitorTypes) {
 }
 
 // ../api-routes/src/discovery/orchestrate.ts
-import crypto42 from "crypto";
-import { eq as eq54 } from "drizzle-orm";
+import crypto43 from "crypto";
+import { eq as eq55 } from "drizzle-orm";
 var DEFAULT_MAX_PROBES = 100;
 var ABSOLUTE_MAX_PROBES = 500;
 function classifyProbeBucket(input) {
@@ -55541,7 +56889,7 @@ async function executeDiscovery(opts) {
     status: DiscoverySessionStatuses.seeding,
     dedupThreshold,
     startedAt
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   const seedResult = await opts.deps.seed({
     project: opts.project,
     icpDescription: opts.icpDescription,
@@ -55602,7 +56950,7 @@ async function executeDiscovery(opts) {
     dedupBandPairFraction: dedupStats.bandPairFraction,
     dedupPairsTotal: dedupStats.pairsTotal,
     warning
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   const probeLocation = opts.locations?.[0];
   const probeResults = await mapWithConcurrency(
     probedCanonicals,
@@ -55621,7 +56969,7 @@ async function executeDiscovery(opts) {
     probeRows.push({ citedDomains: probe.citedDomains, bucket });
     buckets[bucket]++;
     return {
-      id: crypto42.randomUUID(),
+      id: crypto43.randomUUID(),
       sessionId: opts.sessionId,
       projectId: opts.project.id,
       query: probedCanonicals[index2],
@@ -55656,7 +57004,7 @@ async function executeDiscovery(opts) {
     wastedCount: buckets["wasted-surface"],
     competitorMap,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq54(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
   upsertDomainClassifications(opts.db, opts.project.id, opts.sessionId, competitorMap);
   return {
     buckets,
@@ -55673,7 +57021,7 @@ function upsertDomainClassifications(db, projectId, sessionId, competitorMap) {
     const domain = hostOf(entry.domain) ?? "";
     if (!domain) continue;
     db.insert(domainClassifications).values({
-      id: crypto42.randomUUID(),
+      id: crypto43.randomUUID(),
       projectId,
       domain,
       competitorType: entry.competitorType,
@@ -55696,7 +57044,7 @@ function markSessionFailed(db, sessionId, error) {
     status: DiscoverySessionStatuses.failed,
     error,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq54(discoverySessions.id, sessionId)).run();
+  }).where(eq55(discoverySessions.id, sessionId)).run();
 }
 function dedupeStrings(input) {
   const seen = /* @__PURE__ */ new Set();
@@ -55713,8 +57061,8 @@ function dedupeStrings(input) {
 }
 
 // ../api-routes/src/technical-aeo.ts
-import crypto43 from "crypto";
-import { and as and43, asc as asc10, count, desc as desc24, eq as eq55, inArray as inArray19, isNotNull as isNotNull3, lt as lt7, or as or11, sql as sql20 } from "drizzle-orm";
+import crypto44 from "crypto";
+import { and as and44, asc as asc10, count, desc as desc24, eq as eq56, inArray as inArray19, isNotNull as isNotNull3, lt as lt8, or as or11, sql as sql21 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 var FETCHED_SITE_CRAWL_STATES = /* @__PURE__ */ new Set([
   ...SiteCrawlFetchedStates,
@@ -55755,6 +57103,14 @@ function parseBoundedLimit(value, fallback, max) {
   const parsed = parsePositiveInt(value, fallback, max);
   return Math.max(1, parsed);
 }
+function parseSiteHealthState(value) {
+  if (value === void 0 || value === "") return null;
+  const allowed = siteHealthStateSchema.safeParse(value);
+  if (!allowed.success) {
+    throw validationError(`"healthState" must be one of: ${siteHealthStateSchema.options.join(", ")}`);
+  }
+  return allowed.data;
+}
 function parseBoolean2(value) {
   if (value === true || value === "true" || value === "1") return true;
   if (value === false || value === "false" || value === "0") return false;
@@ -55861,7 +57217,7 @@ function mapCrawlEdge(row) {
 }
 var graphSourceNode = alias(siteCrawlGraphNodes, "site_crawl_graph_source_node");
 var graphTargetNode = alias(siteCrawlGraphNodes, "site_crawl_graph_target_node");
-var PAGE_CHANGE_PREDICATE = sql20`(
+var PAGE_CHANGE_PREDICATE = sql21`(
   current.url IS NOT previous.url
   OR current.final_url IS NOT previous.final_url
   OR current.path IS NOT previous.path
@@ -55883,7 +57239,7 @@ var PAGE_CHANGE_PREDICATE = sql20`(
   OR current.link_score_raw IS NOT previous.link_score_raw
   OR current.link_score_normalized IS NOT previous.link_score_normalized
 )`;
-var LINK_CHANGE_PREDICATE = sql20`(
+var LINK_CHANGE_PREDICATE = sql21`(
   current.source_node_key IS NOT previous.source_node_key
   OR current.source_url IS NOT previous.source_url
   OR current.target_node_key IS NOT previous.target_node_key
@@ -55961,39 +57317,49 @@ function changedFields(before, after, fields) {
 async function technicalAeoRoutes(app, opts) {
   const resolveCrawl = (projectId, runId) => {
     const filters = [
-      eq55(siteCrawlSnapshots.projectId, projectId),
-      eq55(runs.projectId, projectId),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteCrawlSnapshots.projectId, projectId),
+      eq56(runs.projectId, projectId),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
     if (runId) {
-      filters.push(eq55(siteCrawlSnapshots.runId, runId));
+      filters.push(eq56(siteCrawlSnapshots.runId, runId));
     } else {
-      filters.push(eq55(siteCrawlSnapshots.complete, true), eq55(runs.status, RunStatuses.completed));
+      filters.push(eq56(siteCrawlSnapshots.complete, true), eq56(runs.status, RunStatuses.completed));
     }
-    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq55(siteCrawlSnapshots.runId, runs.id)).where(and43(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
   };
   const detailScopeFor = (projectId, snapshot) => snapshot.detailsAvailable && snapshot.attemptId ? { projectId, runId: snapshot.runId, attemptId: snapshot.attemptId } : null;
   const pageInScope = (scope, selector) => {
     if (!selector.nodeKey && !selector.url) return null;
-    return app.db.select().from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, scope.projectId),
-      eq55(siteCrawlPages.runId, scope.runId),
-      eq55(siteCrawlPages.attemptId, scope.attemptId),
-      selector.nodeKey ? eq55(siteCrawlPages.nodeKey, selector.nodeKey) : eq55(siteCrawlPages.url, selector.url)
+    return app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
+      selector.nodeKey ? eq56(siteCrawlPages.nodeKey, selector.nodeKey) : eq56(siteCrawlPages.url, selector.url)
     )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
   };
-  const rootPageInScope = (scope, rootUrl) => pageInScope(scope, { url: rootUrl }) ?? app.db.select().from(siteCrawlPages).where(and43(
-    eq55(siteCrawlPages.projectId, scope.projectId),
-    eq55(siteCrawlPages.runId, scope.runId),
-    eq55(siteCrawlPages.attemptId, scope.attemptId),
-    eq55(siteCrawlPages.depth, 0)
+  const rootPageInScope = (scope, rootUrl) => pageInScope(scope, { url: rootUrl }) ?? app.db.select().from(siteCrawlPages).where(and44(
+    eq56(siteCrawlPages.projectId, scope.projectId),
+    eq56(siteCrawlPages.runId, scope.runId),
+    eq56(siteCrawlPages.attemptId, scope.attemptId),
+    eq56(siteCrawlPages.depth, 0)
   )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
-  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(
-    eq55(siteAuditSnapshots.projectId, projectId),
-    eq55(runs.projectId, projectId),
-    eq55(runs.kind, RunKinds["site-audit"]),
+  const isSurfaceableAuditRun = (projectId, runId) => Boolean(app.db.select({ id: runs.id }).from(runs).where(and44(
+    eq56(runs.id, runId),
+    eq56(runs.projectId, projectId),
+    eq56(runs.kind, RunKinds["site-audit"]),
+    inArray19(runs.status, SURFACEABLE_STATUSES),
+    notProbeRun()
+  )).limit(1).get());
+  const assertKnownAuditRun = (projectId, runId) => {
+    if (runId && !isSurfaceableAuditRun(projectId, runId)) throw notFound("Site crawl run", runId);
+  };
+  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
+    eq56(siteAuditSnapshots.projectId, projectId),
+    eq56(runs.projectId, projectId),
+    eq56(runs.kind, RunKinds["site-audit"]),
     inArray19(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
@@ -56015,20 +57381,20 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const baseFilters = [
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    const targetFilters = request.query.runId ? [...baseFilters, eq55(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
-    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    const targetFilters = request.query.runId ? [...baseFilters, eq56(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
+    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest) {
       if (request.query.runId) throw notFound("Site audit run", request.query.runId);
       return emptyScore(project.name);
     }
     const snap = latest.snap;
-    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...baseFilters, lt7(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
+    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...baseFilters, lt8(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
     const deltaScore = previous ? snap.aggregateScore - previous.aggregateScore : null;
     const trend = deltaScore == null ? null : deltaScore > 0 ? SiteAuditTrendDirections.up : deltaScore < 0 ? SiteAuditTrendDirections.down : SiteAuditTrendDirections.flat;
     return {
@@ -56055,14 +57421,14 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo/pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const targetFilters = [
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    if (request.query.runId) targetFilters.push(eq55(siteAuditSnapshots.runId, request.query.runId));
-    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    if (request.query.runId) targetFilters.push(eq56(siteAuditSnapshots.runId, request.query.runId));
+    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest && request.query.runId) {
       throw notFound("Site audit run", request.query.runId);
     }
@@ -56070,9 +57436,9 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, runId: null, auditedAt: null, total: 0, pages: [] };
     }
     const statusFilter = request.query.status === "success" || request.query.status === "error" ? request.query.status : null;
-    const conds = [eq55(siteAuditPages.projectId, project.id), eq55(siteAuditPages.runId, latest.runId)];
-    if (statusFilter) conds.push(eq55(siteAuditPages.status, statusFilter));
-    const where = and43(...conds);
+    const conds = [eq56(siteAuditPages.projectId, project.id), eq56(siteAuditPages.runId, latest.runId)];
+    if (statusFilter) conds.push(eq56(siteAuditPages.status, statusFilter));
+    const where = and44(...conds);
     const totalRow = app.db.select({ value: count() }).from(siteAuditPages).where(where).get();
     const total = totalRow?.value ?? 0;
     const limit = parsePositiveInt(request.query.limit, 100, 500);
@@ -56096,10 +57462,10 @@ async function technicalAeoRoutes(app, opts) {
       auditedAt: siteAuditSnapshots.auditedAt,
       aggregateScore: siteAuditSnapshots.aggregateScore,
       pagesAudited: siteAuditSnapshots.pagesAudited
-    }).from(siteAuditSnapshots).innerJoin(runs, eq55(siteAuditSnapshots.runId, runs.id)).where(and43(
-      eq55(siteAuditSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
+    }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
+      eq56(siteAuditSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
       inArray19(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     )).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(limit).all();
@@ -56110,7 +57476,7 @@ async function technicalAeoRoutes(app, opts) {
     const target = resolveCrawl(project.id, request.query.runId);
     const legacyAuditAvailable = hasLegacyAudit(project.id);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return emptyCrawlSummary(project.name, legacyAuditAvailable);
     }
     const snapshot = target.snapshot;
@@ -56146,11 +57512,12 @@ async function technicalAeoRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return {
         project: project.name,
         hasCrawlData: false,
         runId: null,
+        rootNodeKey: null,
         layout: { state: "unavailable", version: null, reason: "no-crawl" },
         totalNodes: 0,
         totalEdges: 0,
@@ -56167,6 +57534,7 @@ async function technicalAeoRoutes(app, opts) {
         project: project.name,
         hasCrawlData: true,
         runId: snapshot.runId,
+        rootNodeKey: null,
         layout: { state: "unavailable", version: null, reason: "details-unavailable" },
         totalNodes: 0,
         totalEdges: 0,
@@ -56177,16 +57545,21 @@ async function technicalAeoRoutes(app, opts) {
         sampled: false
       };
     }
-    const persistedLayout = app.db.select().from(siteCrawlGraphLayouts).where(and43(
-      eq55(siteCrawlGraphLayouts.projectId, project.id),
-      eq55(siteCrawlGraphLayouts.runId, snapshot.runId),
-      eq55(siteCrawlGraphLayouts.attemptId, snapshot.attemptId)
+    const rootNodeKey = rootPageInScope(
+      { projectId: project.id, runId: snapshot.runId, attemptId: snapshot.attemptId },
+      snapshot.rootUrl
+    )?.nodeKey ?? null;
+    const persistedLayout = app.db.select().from(siteCrawlGraphLayouts).where(and44(
+      eq56(siteCrawlGraphLayouts.projectId, project.id),
+      eq56(siteCrawlGraphLayouts.runId, snapshot.runId),
+      eq56(siteCrawlGraphLayouts.attemptId, snapshot.attemptId)
     )).limit(1).get();
     if (!persistedLayout) {
       return {
         project: project.name,
         hasCrawlData: true,
         runId: snapshot.runId,
+        rootNodeKey,
         layout: { state: "unavailable", version: null, reason: "legacy-snapshot" },
         totalNodes: 0,
         totalEdges: 0,
@@ -56204,6 +57577,7 @@ async function technicalAeoRoutes(app, opts) {
         project: project.name,
         hasCrawlData: true,
         runId: snapshot.runId,
+        rootNodeKey,
         layout: {
           state: "unavailable",
           version: null,
@@ -56221,9 +57595,9 @@ async function technicalAeoRoutes(app, opts) {
     const maxNodes = parseBoundedLimit(request.query.maxNodes, SITE_CRAWL_GRAPH_DEFAULT_MAX_NODES, SITE_CRAWL_GRAPH_MAX_NODES);
     const maxEdges = parseBoundedLimit(request.query.maxEdges, SITE_CRAWL_GRAPH_DEFAULT_MAX_EDGES, SITE_CRAWL_GRAPH_MAX_EDGES);
     const graphScope = [
-      eq55(siteCrawlGraphNodes.projectId, project.id),
-      eq55(siteCrawlGraphNodes.runId, snapshot.runId),
-      eq55(siteCrawlGraphNodes.attemptId, snapshot.attemptId)
+      eq56(siteCrawlGraphNodes.projectId, project.id),
+      eq56(siteCrawlGraphNodes.runId, snapshot.runId),
+      eq56(siteCrawlGraphNodes.attemptId, snapshot.attemptId)
     ];
     const nodeRows = app.db.select({
       nodeKey: siteCrawlPages.nodeKey,
@@ -56242,12 +57616,12 @@ async function technicalAeoRoutes(app, opts) {
       linkScoreNormalized: siteCrawlPages.linkScoreNormalized,
       x: siteCrawlGraphNodes.x,
       y: siteCrawlGraphNodes.y
-    }).from(siteCrawlGraphNodes).innerJoin(siteCrawlPages, and43(
-      eq55(siteCrawlPages.projectId, siteCrawlGraphNodes.projectId),
-      eq55(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
-      eq55(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
-      eq55(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
-    )).where(and43(...graphScope, lt7(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc10(siteCrawlGraphNodes.sampleRank)).all();
+    }).from(siteCrawlGraphNodes).innerJoin(siteCrawlPages, and44(
+      eq56(siteCrawlPages.projectId, siteCrawlGraphNodes.projectId),
+      eq56(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
+      eq56(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
+      eq56(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
+    )).where(and44(...graphScope, lt8(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc10(siteCrawlGraphNodes.sampleRank)).all();
     const nodes = nodeRows.map(({ indexabilityReasons, canonicalNodeKey, ...row }) => ({
       ...row,
       healthState: deriveSiteHealthState({ ...row, indexabilityReasons, canonicalNodeKey })
@@ -56258,23 +57632,23 @@ async function technicalAeoRoutes(app, opts) {
       targetNodeKey: siteCrawlGraphEdges.targetNodeKey,
       followable: siteCrawlGraphEdges.followable,
       occurrences: siteCrawlGraphEdges.occurrences
-    }).from(siteCrawlGraphEdges).innerJoin(graphSourceNode, and43(
-      eq55(graphSourceNode.projectId, siteCrawlGraphEdges.projectId),
-      eq55(graphSourceNode.runId, siteCrawlGraphEdges.runId),
-      eq55(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
-      eq55(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
-      lt7(graphSourceNode.sampleRank, maxNodes)
-    )).innerJoin(graphTargetNode, and43(
-      eq55(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
-      eq55(graphTargetNode.runId, siteCrawlGraphEdges.runId),
-      eq55(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
-      eq55(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
-      lt7(graphTargetNode.sampleRank, maxNodes)
-    )).where(and43(
-      eq55(siteCrawlGraphEdges.projectId, project.id),
-      eq55(siteCrawlGraphEdges.runId, snapshot.runId),
-      eq55(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
-      lt7(siteCrawlGraphEdges.sampleRank, maxEdges)
+    }).from(siteCrawlGraphEdges).innerJoin(graphSourceNode, and44(
+      eq56(graphSourceNode.projectId, siteCrawlGraphEdges.projectId),
+      eq56(graphSourceNode.runId, siteCrawlGraphEdges.runId),
+      eq56(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq56(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
+      lt8(graphSourceNode.sampleRank, maxNodes)
+    )).innerJoin(graphTargetNode, and44(
+      eq56(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
+      eq56(graphTargetNode.runId, siteCrawlGraphEdges.runId),
+      eq56(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq56(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
+      lt8(graphTargetNode.sampleRank, maxNodes)
+    )).where(and44(
+      eq56(siteCrawlGraphEdges.projectId, project.id),
+      eq56(siteCrawlGraphEdges.runId, snapshot.runId),
+      eq56(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
+      lt8(siteCrawlGraphEdges.sampleRank, maxEdges)
     )).orderBy(asc10(siteCrawlGraphEdges.sampleRank)).all();
     const totalNodes = persistedLayout.totalNodes;
     const totalEdges = persistedLayout.totalEdges;
@@ -56284,6 +57658,7 @@ async function technicalAeoRoutes(app, opts) {
       project: project.name,
       hasCrawlData: true,
       runId: snapshot.runId,
+      rootNodeKey,
       layout: { state: "ready", version: persistedLayout.layoutVersion, computedAt: persistedLayout.createdAt },
       totalNodes,
       totalEdges,
@@ -56328,7 +57703,7 @@ async function technicalAeoRoutes(app, opts) {
       truncated: false
     });
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return empty("no-crawl", null, false, false, null);
     }
     const snapshot = target.snapshot;
@@ -56352,11 +57727,11 @@ async function technicalAeoRoutes(app, opts) {
     let frontier = [focus.nodeKey];
     let queryTruncated = false;
     for (let distance = 0; distance < hops && frontier.length > 0; distance += 1) {
-      const candidates = app.db.select().from(siteCrawlEdges).where(and43(
-        eq55(siteCrawlEdges.projectId, scope.projectId),
-        eq55(siteCrawlEdges.runId, scope.runId),
-        eq55(siteCrawlEdges.attemptId, scope.attemptId),
-        eq55(siteCrawlEdges.internal, true),
+      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
+        eq56(siteCrawlEdges.projectId, scope.projectId),
+        eq56(siteCrawlEdges.runId, scope.runId),
+        eq56(siteCrawlEdges.attemptId, scope.attemptId),
+        eq56(siteCrawlEdges.internal, true),
         isNotNull3(siteCrawlEdges.targetNodeKey),
         or11(
           inArray19(siteCrawlEdges.sourceNodeKey, frontier),
@@ -56393,19 +57768,19 @@ async function technicalAeoRoutes(app, opts) {
       frontier = [...next].sort();
     }
     const nodeKeys = [...distances.keys()];
-    const pageRows = nodeKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, scope.projectId),
-      eq55(siteCrawlPages.runId, scope.runId),
-      eq55(siteCrawlPages.attemptId, scope.attemptId),
+    const pageRows = nodeKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
       inArray19(siteCrawlPages.nodeKey, nodeKeys)
     )).all();
     const persistedNodeKeys = new Set(pageRows.map((row) => row.nodeKey));
     const outermostNodeKeys = pageRows.filter((row) => distances.get(row.nodeKey) === hops).map((row) => row.nodeKey);
-    const omittedOutermostEdge = outermostNodeKeys.length === 0 ? void 0 : app.db.select({ edgeKey: siteCrawlEdges.edgeKey }).from(siteCrawlEdges).where(and43(
-      eq55(siteCrawlEdges.projectId, scope.projectId),
-      eq55(siteCrawlEdges.runId, scope.runId),
-      eq55(siteCrawlEdges.attemptId, scope.attemptId),
-      eq55(siteCrawlEdges.internal, true),
+    const omittedOutermostEdge = outermostNodeKeys.length === 0 ? void 0 : app.db.select({ edgeKey: siteCrawlEdges.edgeKey }).from(siteCrawlEdges).where(and44(
+      eq56(siteCrawlEdges.projectId, scope.projectId),
+      eq56(siteCrawlEdges.runId, scope.runId),
+      eq56(siteCrawlEdges.attemptId, scope.attemptId),
+      eq56(siteCrawlEdges.internal, true),
       isNotNull3(siteCrawlEdges.targetNodeKey),
       inArray19(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
       inArray19(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
@@ -56454,7 +57829,7 @@ async function technicalAeoRoutes(app, opts) {
     }
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return {
         project: project.name,
         runId: null,
@@ -56502,22 +57877,22 @@ async function technicalAeoRoutes(app, opts) {
     let found = fromPage.nodeKey === toPage.nodeKey;
     let truncated = false;
     for (let depth = 0; depth < maxDepth && frontier.length > 0 && !found; depth += 1) {
-      const candidates = app.db.select().from(siteCrawlEdges).where(and43(
-        eq55(siteCrawlEdges.projectId, scope.projectId),
-        eq55(siteCrawlEdges.runId, scope.runId),
-        eq55(siteCrawlEdges.attemptId, scope.attemptId),
-        eq55(siteCrawlEdges.internal, true),
-        eq55(siteCrawlEdges.followable, true),
-        eq55(siteCrawlEdges.relation, "anchor"),
+      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
+        eq56(siteCrawlEdges.projectId, scope.projectId),
+        eq56(siteCrawlEdges.runId, scope.runId),
+        eq56(siteCrawlEdges.attemptId, scope.attemptId),
+        eq56(siteCrawlEdges.internal, true),
+        eq56(siteCrawlEdges.followable, true),
+        eq56(siteCrawlEdges.relation, "anchor"),
         isNotNull3(siteCrawlEdges.targetNodeKey),
         inArray19(siteCrawlEdges.sourceNodeKey, frontier)
       )).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(SITE_HEALTH_PATH_MAX_VISITED_NODES + 1).all();
       if (candidates.length > SITE_HEALTH_PATH_MAX_VISITED_NODES) truncated = true;
       const candidateTargetKeys = [...new Set(candidates.map((edge) => edge.targetNodeKey).filter((nodeKey) => nodeKey != null))];
-      const persistedTargetKeys = new Set(candidateTargetKeys.length === 0 ? [] : app.db.select({ nodeKey: siteCrawlPages.nodeKey }).from(siteCrawlPages).where(and43(
-        eq55(siteCrawlPages.projectId, scope.projectId),
-        eq55(siteCrawlPages.runId, scope.runId),
-        eq55(siteCrawlPages.attemptId, scope.attemptId),
+      const persistedTargetKeys = new Set(candidateTargetKeys.length === 0 ? [] : app.db.select({ nodeKey: siteCrawlPages.nodeKey }).from(siteCrawlPages).where(and44(
+        eq56(siteCrawlPages.projectId, scope.projectId),
+        eq56(siteCrawlPages.runId, scope.runId),
+        eq56(siteCrawlPages.attemptId, scope.attemptId),
         inArray19(siteCrawlPages.nodeKey, candidateTargetKeys)
       )).all().map((row) => row.nodeKey));
       const next = /* @__PURE__ */ new Set();
@@ -56560,10 +57935,10 @@ async function technicalAeoRoutes(app, opts) {
       pathEdges.unshift(step.edge);
       pathKeys.unshift(step.nodeKey);
     }
-    const pathRows = app.db.select().from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, scope.projectId),
-      eq55(siteCrawlPages.runId, scope.runId),
-      eq55(siteCrawlPages.attemptId, scope.attemptId),
+    const pathRows = app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
       inArray19(siteCrawlPages.nodeKey, pathKeys)
     )).all();
     const pageByKey = new Map(pathRows.map((row) => [row.nodeKey, row]));
@@ -56592,22 +57967,22 @@ async function technicalAeoRoutes(app, opts) {
       throw validationError("change must be all, added, removed, or changed");
     }
     const completeSnapshotFilters = [
-      eq55(siteCrawlSnapshots.projectId, project.id),
-      eq55(runs.projectId, project.id),
-      eq55(runs.kind, RunKinds["site-audit"]),
-      eq55(runs.status, RunStatuses.completed),
-      eq55(siteCrawlSnapshots.complete, true),
+      eq56(siteCrawlSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
+      eq56(runs.status, RunStatuses.completed),
+      eq56(siteCrawlSnapshots.complete, true),
       notProbeRun()
     ];
-    const afterTarget = request.query.toRunId ? resolveCrawl(project.id, request.query.toRunId) : app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq55(siteCrawlSnapshots.runId, runs.id)).where(and43(...completeSnapshotFilters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+    const afterTarget = request.query.toRunId ? resolveCrawl(project.id, request.query.toRunId) : app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...completeSnapshotFilters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
     if (request.query.toRunId && !afterTarget) throw notFound("Site crawl run", request.query.toRunId);
-    const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq55(siteCrawlSnapshots.runId, runs.id)).where(and43(
+    const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(
       ...completeSnapshotFilters,
       or11(
-        lt7(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
-        and43(
-          eq55(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
-          lt7(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
+        lt8(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+        and44(
+          eq56(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+          lt8(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
         )
       )
     )).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get() : void 0;
@@ -56684,9 +58059,9 @@ async function technicalAeoRoutes(app, opts) {
       const summary2 = { pages: zero2(), links: zero2() };
       if (scopeFilter !== "links") {
         if (includeAdded || includeChanged) {
-          const addedExpression = includeAdded ? sql20`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql20`0`;
-          const changedExpression = includeChanged ? sql20`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${PAGE_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql20`0`;
-          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql20`
+          const addedExpression = includeAdded ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const changedExpression = includeChanged ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${PAGE_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql21`
             SELECT ${addedExpression} AS added, ${changedExpression} AS changed
             FROM site_crawl_pages AS current
             LEFT JOIN site_crawl_pages AS previous
@@ -56702,7 +58077,7 @@ async function technicalAeoRoutes(app, opts) {
           summary2.pages.changed = Number(counts2.changed);
         }
         if (includeRemoved) {
-          const [counts2 = { removed: 0 }] = app.db.all(sql20`
+          const [counts2 = { removed: 0 }] = app.db.all(sql21`
             SELECT COUNT(*) AS removed
             FROM site_crawl_pages AS previous
             LEFT JOIN site_crawl_pages AS current
@@ -56720,9 +58095,9 @@ async function technicalAeoRoutes(app, opts) {
       }
       if (scopeFilter !== "pages") {
         if (includeAdded || includeChanged) {
-          const addedExpression = includeAdded ? sql20`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql20`0`;
-          const changedExpression = includeChanged ? sql20`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${LINK_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql20`0`;
-          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql20`
+          const addedExpression = includeAdded ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NULL THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const changedExpression = includeChanged ? sql21`COALESCE(SUM(CASE WHEN previous.id IS NOT NULL AND ${LINK_CHANGE_PREDICATE} THEN 1 ELSE 0 END), 0)` : sql21`0`;
+          const [counts2 = { added: 0, changed: 0 }] = app.db.all(sql21`
             SELECT ${addedExpression} AS added, ${changedExpression} AS changed
             FROM site_crawl_edges AS current
             LEFT JOIN site_crawl_edges AS previous
@@ -56740,7 +58115,7 @@ async function technicalAeoRoutes(app, opts) {
           summary2.links.changed = Number(counts2.changed);
         }
         if (includeRemoved) {
-          const [counts2 = { removed: 0 }] = app.db.all(sql20`
+          const [counts2 = { removed: 0 }] = app.db.all(sql21`
             SELECT COUNT(*) AS removed
             FROM site_crawl_edges AS previous
             LEFT JOIN site_crawl_edges AS current
@@ -56770,48 +58145,48 @@ async function technicalAeoRoutes(app, opts) {
       const includeRemoved = changeFilter === "all" || changeFilter === "removed";
       const table = entity === "page" ? "site_crawl_pages" : "site_crawl_edges";
       const keyColumn = entity === "page" ? "node_key" : "edge_key";
-      const internalCurrent = entity === "link" ? sql20`AND current.internal = 1` : sql20``;
-      const internalPreviousJoin = entity === "link" ? sql20`AND previous.internal = 1` : sql20``;
-      const internalPrevious = entity === "link" ? sql20`AND previous.internal = 1` : sql20``;
-      const internalCurrentJoin = entity === "link" ? sql20`AND current.internal = 1` : sql20``;
+      const internalCurrent = entity === "link" ? sql21`AND current.internal = 1` : sql21``;
+      const internalPreviousJoin = entity === "link" ? sql21`AND previous.internal = 1` : sql21``;
+      const internalPrevious = entity === "link" ? sql21`AND previous.internal = 1` : sql21``;
+      const internalCurrentJoin = entity === "link" ? sql21`AND current.internal = 1` : sql21``;
       const difference2 = entity === "page" ? PAGE_CHANGE_PREDICATE : LINK_CHANGE_PREDICATE;
-      const afterKind = changeFilter === "added" ? sql20`previous.id IS NULL` : changeFilter === "changed" ? sql20`previous.id IS NOT NULL AND ${difference2}` : sql20`previous.id IS NULL OR (previous.id IS NOT NULL AND ${difference2})`;
-      const afterRows = includeAfter ? app.db.all(sql20`
+      const afterKind = changeFilter === "added" ? sql21`previous.id IS NULL` : changeFilter === "changed" ? sql21`previous.id IS NOT NULL AND ${difference2}` : sql21`previous.id IS NULL OR (previous.id IS NOT NULL AND ${difference2})`;
+      const afterRows = includeAfter ? app.db.all(sql21`
         SELECT ${entity} AS entity,
           CASE WHEN previous.id IS NULL THEN 'added' ELSE 'changed' END AS change,
-          current.${sql20.raw(keyColumn)} AS key
-        FROM ${sql20.raw(table)} AS current
-        LEFT JOIN ${sql20.raw(table)} AS previous
+          current.${sql21.raw(keyColumn)} AS key
+        FROM ${sql21.raw(table)} AS current
+        LEFT JOIN ${sql21.raw(table)} AS previous
           ON previous.project_id = ${beforeScope.projectId}
           AND previous.run_id = ${beforeScope.runId}
           AND previous.attempt_id = ${beforeScope.attemptId}
           ${internalPreviousJoin}
-          AND previous.${sql20.raw(keyColumn)} = current.${sql20.raw(keyColumn)}
+          AND previous.${sql21.raw(keyColumn)} = current.${sql21.raw(keyColumn)}
         WHERE current.project_id = ${afterScope.projectId}
           AND current.run_id = ${afterScope.runId}
           AND current.attempt_id = ${afterScope.attemptId}
           ${internalCurrent}
-          AND current.${sql20.raw(keyColumn)} > ${afterKey}
+          AND current.${sql21.raw(keyColumn)} > ${afterKey}
           AND (${afterKind})
-        ORDER BY current.${sql20.raw(keyColumn)} ASC
+        ORDER BY current.${sql21.raw(keyColumn)} ASC
         LIMIT ${wanted2}
       `) : [];
-      const removedRows = includeRemoved ? app.db.all(sql20`
-        SELECT ${entity} AS entity, 'removed' AS change, previous.${sql20.raw(keyColumn)} AS key
-        FROM ${sql20.raw(table)} AS previous
-        LEFT JOIN ${sql20.raw(table)} AS current
+      const removedRows = includeRemoved ? app.db.all(sql21`
+        SELECT ${entity} AS entity, 'removed' AS change, previous.${sql21.raw(keyColumn)} AS key
+        FROM ${sql21.raw(table)} AS previous
+        LEFT JOIN ${sql21.raw(table)} AS current
           ON current.project_id = ${afterScope.projectId}
           AND current.run_id = ${afterScope.runId}
           AND current.attempt_id = ${afterScope.attemptId}
           ${internalCurrentJoin}
-          AND current.${sql20.raw(keyColumn)} = previous.${sql20.raw(keyColumn)}
+          AND current.${sql21.raw(keyColumn)} = previous.${sql21.raw(keyColumn)}
         WHERE previous.project_id = ${beforeScope.projectId}
           AND previous.run_id = ${beforeScope.runId}
           AND previous.attempt_id = ${beforeScope.attemptId}
           ${internalPrevious}
-          AND previous.${sql20.raw(keyColumn)} > ${afterKey}
+          AND previous.${sql21.raw(keyColumn)} > ${afterKey}
           AND current.id IS NULL
-        ORDER BY previous.${sql20.raw(keyColumn)} ASC
+        ORDER BY previous.${sql21.raw(keyColumn)} ASC
         LIMIT ${wanted2}
       `) : [];
       const merged = [];
@@ -56841,17 +58216,17 @@ async function technicalAeoRoutes(app, opts) {
     const visibleKeys = keyRows.slice(0, limit);
     const pageKeys = visibleKeys.filter((row) => row.entity === "page").map((row) => row.key);
     const linkKeys = visibleKeys.filter((row) => row.entity === "link").map((row) => row.key);
-    const pageRowsFor = (scope) => pageKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, scope.projectId),
-      eq55(siteCrawlPages.runId, scope.runId),
-      eq55(siteCrawlPages.attemptId, scope.attemptId),
+    const pageRowsFor = (scope) => pageKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, scope.projectId),
+      eq56(siteCrawlPages.runId, scope.runId),
+      eq56(siteCrawlPages.attemptId, scope.attemptId),
       inArray19(siteCrawlPages.nodeKey, pageKeys)
     )).all();
-    const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and43(
-      eq55(siteCrawlEdges.projectId, scope.projectId),
-      eq55(siteCrawlEdges.runId, scope.runId),
-      eq55(siteCrawlEdges.attemptId, scope.attemptId),
-      eq55(siteCrawlEdges.internal, true),
+    const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and44(
+      eq56(siteCrawlEdges.projectId, scope.projectId),
+      eq56(siteCrawlEdges.runId, scope.runId),
+      eq56(siteCrawlEdges.attemptId, scope.attemptId),
+      eq56(siteCrawlEdges.internal, true),
       inArray19(siteCrawlEdges.edgeKey, linkKeys)
     )).all();
     const beforePages = new Map(pageRowsFor(beforeScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
@@ -56926,7 +58301,7 @@ async function technicalAeoRoutes(app, opts) {
     }
     const target = resolveCrawl(project.id, runId);
     if (!target) {
-      if (runId) throw notFound("Site crawl run", runId);
+      assertKnownAuditRun(project.id, runId);
       return { state: "no-crawl", project: project.name, runId: null };
     }
     const snapshot = target.snapshot;
@@ -56967,7 +58342,7 @@ async function technicalAeoRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return { project: project.name, hasCrawlData: false, runId: null, total: 0, nextCursor: null, pages: [] };
     }
     const snapshot = target.snapshot;
@@ -56975,21 +58350,34 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, hasCrawlData: true, runId: snapshot.runId, total: 0, nextCursor: null, pages: [] };
     }
     const filters = [
-      eq55(siteCrawlPages.projectId, project.id),
-      eq55(siteCrawlPages.runId, snapshot.runId),
-      eq55(siteCrawlPages.attemptId, snapshot.attemptId)
+      eq56(siteCrawlPages.projectId, project.id),
+      eq56(siteCrawlPages.runId, snapshot.runId),
+      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
     ];
     const inventoryEligible = parseBoolean2(request.query.inventoryEligible);
-    if (inventoryEligible != null) filters.push(eq55(siteCrawlPages.inventoryEligible, inventoryEligible));
-    if (request.query.fetchState) filters.push(eq55(siteCrawlPages.fetchState, request.query.fetchState));
-    if (request.query.indexabilityState) filters.push(eq55(siteCrawlPages.indexabilityState, request.query.indexabilityState));
-    if (request.query.auditState) filters.push(eq55(siteCrawlPages.auditState, request.query.auditState));
-    const where = and43(...filters);
-    const total = app.db.select({ value: count() }).from(siteCrawlPages).where(where).get()?.value ?? 0;
+    if (inventoryEligible != null) filters.push(eq56(siteCrawlPages.inventoryEligible, inventoryEligible));
+    if (request.query.fetchState) filters.push(eq56(siteCrawlPages.fetchState, request.query.fetchState));
+    if (request.query.indexabilityState) filters.push(eq56(siteCrawlPages.indexabilityState, request.query.indexabilityState));
+    if (request.query.auditState) filters.push(eq56(siteCrawlPages.auditState, request.query.auditState));
+    const healthState = parseSiteHealthState(request.query.healthState);
+    const where = and44(...filters);
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
     const orderBy = request.query.sort === "score-desc" ? [desc24(siteCrawlPages.auditScore), asc10(siteCrawlPages.nodeKey)] : request.query.sort === "score-asc" ? [asc10(siteCrawlPages.auditScore), asc10(siteCrawlPages.nodeKey)] : request.query.sort === "path" ? [asc10(siteCrawlPages.path), asc10(siteCrawlPages.nodeKey)] : [asc10(siteCrawlPages.url), asc10(siteCrawlPages.nodeKey)];
-    const rows = app.db.select().from(siteCrawlPages).where(where).orderBy(...orderBy).limit(limit).offset(offset).all();
+    let total;
+    let rows;
+    if (healthState) {
+      const candidates = app.db.select().from(siteCrawlPages).where(where).orderBy(...orderBy).limit(MAX_STRUCTURE_SOURCE_ROWS + 1).all();
+      if (candidates.length > MAX_STRUCTURE_SOURCE_ROWS) {
+        throw validationError(`Persisted crawl exceeds the ${MAX_STRUCTURE_SOURCE_ROWS}-page health-state filter limit`);
+      }
+      const matching = candidates.filter((row) => deriveSiteHealthState(row) === healthState);
+      total = matching.length;
+      rows = matching.slice(offset, offset + limit);
+    } else {
+      total = app.db.select({ value: count() }).from(siteCrawlPages).where(where).get()?.value ?? 0;
+      rows = app.db.select().from(siteCrawlPages).where(where).orderBy(...orderBy).limit(limit).offset(offset).all();
+    }
     const nextOffset = offset + rows.length;
     return {
       project: project.name,
@@ -57005,7 +58393,7 @@ async function technicalAeoRoutes(app, opts) {
     const parentPath = normalizeParentPath(request.query.parentPath);
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return { project: project.name, hasCrawlData: false, runId: null, parentPath, nextCursor: null, children: [] };
     }
     const snapshot = target.snapshot;
@@ -57017,10 +58405,10 @@ async function technicalAeoRoutes(app, opts) {
       url: siteCrawlPages.url,
       inventoryEligible: siteCrawlPages.inventoryEligible,
       fetchState: siteCrawlPages.fetchState
-    }).from(siteCrawlPages).where(and43(
-      eq55(siteCrawlPages.projectId, project.id),
-      eq55(siteCrawlPages.runId, snapshot.runId),
-      eq55(siteCrawlPages.attemptId, snapshot.attemptId)
+    }).from(siteCrawlPages).where(and44(
+      eq56(siteCrawlPages.projectId, project.id),
+      eq56(siteCrawlPages.runId, snapshot.runId),
+      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
     )).limit(MAX_STRUCTURE_SOURCE_ROWS + 1).all();
     if (sourceRows.length > MAX_STRUCTURE_SOURCE_ROWS) {
       throw validationError(`Persisted crawl exceeds the ${MAX_STRUCTURE_SOURCE_ROWS}-page structure limit`);
@@ -57071,7 +58459,7 @@ async function technicalAeoRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return { project: project.name, hasCrawlData: false, runId: null, total: 0, nextCursor: null, edges: [] };
     }
     const snapshot = target.snapshot;
@@ -57079,16 +58467,16 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, hasCrawlData: true, runId: snapshot.runId, total: 0, nextCursor: null, edges: [] };
     }
     const filters = [
-      eq55(siteCrawlEdges.projectId, project.id),
-      eq55(siteCrawlEdges.runId, snapshot.runId),
-      eq55(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq55(siteCrawlEdges.internal, true)
+      eq56(siteCrawlEdges.projectId, project.id),
+      eq56(siteCrawlEdges.runId, snapshot.runId),
+      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq56(siteCrawlEdges.internal, true)
     ];
-    if (request.query.sourceUrl) filters.push(eq55(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
-    if (request.query.targetUrl) filters.push(eq55(siteCrawlEdges.targetUrl, request.query.targetUrl));
+    if (request.query.sourceUrl) filters.push(eq56(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
+    if (request.query.targetUrl) filters.push(eq56(siteCrawlEdges.targetUrl, request.query.targetUrl));
     const followable = parseBoolean2(request.query.followable);
-    if (followable != null) filters.push(eq55(siteCrawlEdges.followable, followable));
-    const where = and43(...filters);
+    if (followable != null) filters.push(eq56(siteCrawlEdges.followable, followable));
+    const where = and44(...filters);
     const total = app.db.select({ value: count() }).from(siteCrawlEdges).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
@@ -57110,7 +58498,7 @@ async function technicalAeoRoutes(app, opts) {
     }
     const target = resolveCrawl(project.id, request.query.runId);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return {
         project: project.name,
         hasCrawlData: false,
@@ -57138,16 +58526,16 @@ async function technicalAeoRoutes(app, opts) {
       };
     }
     const scope = [
-      eq55(siteCrawlEdges.projectId, project.id),
-      eq55(siteCrawlEdges.runId, snapshot.runId),
-      eq55(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq55(siteCrawlEdges.internal, true)
+      eq56(siteCrawlEdges.projectId, project.id),
+      eq56(siteCrawlEdges.runId, snapshot.runId),
+      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq56(siteCrawlEdges.internal, true)
     ];
-    const inboundMatch = request.query.nodeKey && request.query.url ? or11(eq55(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq55(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq55(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq55(siteCrawlEdges.targetUrl, request.query.url);
-    const outboundMatch = request.query.nodeKey && request.query.url ? or11(eq55(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq55(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq55(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq55(siteCrawlEdges.sourceUrl, request.query.url);
+    const inboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.targetUrl, request.query.url);
+    const outboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.sourceUrl, request.query.url);
     const limit = parseBoundedLimit(request.query.limit, 50, 100);
-    const inboundRows = app.db.select().from(siteCrawlEdges).where(and43(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
-    const outboundRows = app.db.select().from(siteCrawlEdges).where(and43(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const inboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const outboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
     return {
       project: project.name,
       hasCrawlData: true,
@@ -57165,7 +58553,7 @@ async function technicalAeoRoutes(app, opts) {
     const target = resolveCrawl(project.id, request.query.runId);
     const legacyAuditAvailable = hasLegacyAudit(project.id);
     if (!target) {
-      if (request.query.runId) throw notFound("Site crawl run", request.query.runId);
+      assertKnownAuditRun(project.id, request.query.runId);
       return { project: project.name, runId: null, state: "unavailable", legacyAuditAvailable };
     }
     const snapshot = target.snapshot;
@@ -57178,11 +58566,11 @@ async function technicalAeoRoutes(app, opts) {
     if (!snapshot.attemptId) {
       return { project: project.name, runId: snapshot.runId, state: "partial", checkDeadLinks: true, checked: snapshot.deadLinksChecked, found: snapshot.deadLinksFound, total: 0, nextCursor: null, deadLinks: [] };
     }
-    const where = and43(
-      eq55(siteCrawlFindings.projectId, project.id),
-      eq55(siteCrawlFindings.runId, snapshot.runId),
-      eq55(siteCrawlFindings.attemptId, snapshot.attemptId),
-      eq55(siteCrawlFindings.findingType, "dead-link")
+    const where = and44(
+      eq56(siteCrawlFindings.projectId, project.id),
+      eq56(siteCrawlFindings.runId, snapshot.runId),
+      eq56(siteCrawlFindings.attemptId, snapshot.attemptId),
+      eq56(siteCrawlFindings.findingType, "dead-link")
     );
     const total = app.db.select({ value: count() }).from(siteCrawlFindings).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
@@ -57211,6 +58599,38 @@ async function technicalAeoRoutes(app, opts) {
       deadLinks
     };
   });
+  app.get("/projects/:name/technical-aeo/runs", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const limit = parseBoundedLimit(request.query.limit, SITE_HEALTH_SCANS_DEFAULT_LIMIT, SITE_HEALTH_SCANS_MAX_LIMIT);
+    const rows = app.db.select({
+      runId: runs.id,
+      status: runs.status,
+      createdAt: runs.createdAt,
+      startedAt: runs.startedAt,
+      finishedAt: runs.finishedAt
+    }).from(runs).where(and44(
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
+      notProbeRun()
+    )).orderBy(desc24(runs.createdAt), desc24(runs.id)).limit(limit).all();
+    const runIds = rows.map((row) => row.runId);
+    const crawlRunIds = new Set(runIds.length === 0 ? [] : app.db.select({ runId: siteCrawlSnapshots.runId }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(
+      eq56(siteCrawlSnapshots.projectId, project.id),
+      eq56(runs.projectId, project.id),
+      eq56(runs.kind, RunKinds["site-audit"]),
+      inArray19(runs.status, SURFACEABLE_STATUSES),
+      notProbeRun(),
+      inArray19(siteCrawlSnapshots.runId, runIds)
+    )).all().map((row) => row.runId));
+    return {
+      project: project.name,
+      scans: rows.map((row) => ({
+        ...row,
+        status: row.status,
+        hasCrawlData: crawlRunIds.has(row.runId)
+      }))
+    };
+  });
   app.post("/projects/:name/technical-aeo/runs", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const parsed = siteAuditRunRequestSchema.safeParse(request.body ?? {});
@@ -57225,12 +58645,12 @@ async function technicalAeoRoutes(app, opts) {
         status: runs.status,
         identityKey: siteCrawlRunRequests.identityKey,
         effectiveOptions: siteCrawlRunRequests.effectiveOptions
-      }).from(runs).leftJoin(siteCrawlRunRequests, and43(
-        eq55(siteCrawlRunRequests.projectId, runs.projectId),
-        eq55(siteCrawlRunRequests.runId, runs.id)
-      )).where(and43(
-        eq55(runs.projectId, project.id),
-        eq55(runs.kind, RunKinds["site-audit"]),
+      }).from(runs).leftJoin(siteCrawlRunRequests, and44(
+        eq56(siteCrawlRunRequests.projectId, runs.projectId),
+        eq56(siteCrawlRunRequests.runId, runs.id)
+      )).where(and44(
+        eq56(runs.projectId, project.id),
+        eq56(runs.kind, RunKinds["site-audit"]),
         inArray19(runs.status, [RunStatuses.queued, RunStatuses.running])
       )).get();
       if (existing) {
@@ -57248,7 +58668,7 @@ async function technicalAeoRoutes(app, opts) {
         );
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const runId = crypto43.randomUUID();
+      const runId = crypto44.randomUUID();
       tx.insert(runs).values({
         id: runId,
         projectId: project.id,
@@ -57281,8 +58701,8 @@ async function technicalAeoRoutes(app, opts) {
 }
 
 // ../api-routes/src/research.ts
-import crypto44 from "crypto";
-import { and as and44, desc as desc25, eq as eq56 } from "drizzle-orm";
+import crypto45 from "crypto";
+import { and as and45, desc as desc25, eq as eq57 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 async function researchRoutes(app, opts) {
   app.post("/projects/:name/research/runs", async (request, reply) => {
@@ -57308,19 +58728,19 @@ async function researchRoutes(app, opts) {
     if (!adapter.modelValidationPattern.test(resolvedModel)) throw validationError(`Invalid resolved model "${resolvedModel}" for provider "${providerName}".`, { provider: providerName, model: resolvedModel, hint: adapter.modelValidationHint });
     if (new Set(input.queries.map((query) => query.toLocaleLowerCase())).size !== input.queries.length) throw validationError("Research queries must be unique within a batch.");
     const normalized = { queries: input.queries, provider: providerName, model: requestedModel, location: location ?? null };
-    const requestHash2 = crypto44.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+    const requestHash2 = crypto45.createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const decision = app.db.transaction((tx) => {
       if (input.idempotencyKey) {
-        const existing = tx.select().from(researchRuns).where(and44(eq56(researchRuns.projectId, project.id), eq56(researchRuns.idempotencyKey, input.idempotencyKey))).get();
+        const existing = tx.select().from(researchRuns).where(and45(eq57(researchRuns.projectId, project.id), eq57(researchRuns.idempotencyKey, input.idempotencyKey))).get();
         if (existing) {
           if (existing.requestHash !== requestHash2) throw alreadyExists("Research idempotency key", input.idempotencyKey);
           return { reused: true, id: existing.id, shouldDispatch: existing.status === ResearchRunStatuses.queued };
         }
       }
-      const id = crypto44.randomUUID();
+      const id = crypto45.randomUUID();
       tx.insert(researchRuns).values({ id, projectId: project.id, status: ResearchRunStatuses.queued, provider: providerName, requestedModel, resolvedModel, location: location ?? null, totalQueries: input.queries.length, idempotencyKey: input.idempotencyKey ?? null, requestHash: input.idempotencyKey ? requestHash2 : null, createdAt: now }).run();
-      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto44.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
+      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto45.randomUUID(), researchRunId: id, position, queryText: query, status: ResearchQueryStatuses.queued, requestedModel, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
       writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       return { reused: false, id, shouldDispatch: true };
     });
@@ -57333,7 +58753,7 @@ async function researchRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const requested = Number.parseInt(request.query.limit ?? "", 10);
     const limit = Number.isInteger(requested) && requested > 0 ? Math.min(requested, 100) : 20;
-    const runs2 = app.db.select().from(researchRuns).where(eq56(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
+    const runs2 = app.db.select().from(researchRuns).where(eq57(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
     return { runs: runs2 };
   });
   app.get("/projects/:name/research/runs/:runId", async (request) => {
@@ -57342,9 +58762,9 @@ async function researchRoutes(app, opts) {
   });
 }
 function getDetail(app, projectId, id) {
-  const row = app.db.select().from(researchRuns).where(and44(eq56(researchRuns.id, id), eq56(researchRuns.projectId, projectId))).get();
+  const row = app.db.select().from(researchRuns).where(and45(eq57(researchRuns.id, id), eq57(researchRuns.projectId, projectId))).get();
   if (!row) throw notFound("Research run", id);
-  const queries2 = app.db.select().from(researchRunQueries).where(eq56(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
+  const queries2 = app.db.select().from(researchRunQueries).where(eq57(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
   return { ...serializeRun(row), queries: queries2 };
 }
 function serializeRun(row) {
@@ -57554,6 +58974,11 @@ async function apiRoutes(app, opts) {
       vercelTrafficCredentialStore: opts.vercelTrafficCredentialStore,
       pullVercelTrafficEvents: opts.pullVercelTrafficEvents,
       vercelSyncDeadlineMs: opts.vercelSyncDeadlineMs,
+      cloudflareTrafficCredentialStore: opts.cloudflareTrafficCredentialStore,
+      cloudflareTrafficIngestUrl: opts.cloudflareTrafficIngestUrl,
+      cloudflareIngestRateLimitMax: opts.cloudflareIngestRateLimitMax,
+      cloudflareIngestIpRateLimitMax: opts.cloudflareIngestIpRateLimitMax,
+      defaultSampleLimit: opts.defaultTrafficSampleLimit,
       onTrafficSynced: opts.onTrafficSynced,
       onScheduleUpdated: opts.onScheduleUpdated,
       allowLoopbackWebhooks: opts.allowLoopbackWebhooks
@@ -57734,11 +59159,62 @@ function buildTrafficSourceValidators(opts) {
       validateScopes: () => null
     };
   }
+  if (opts.cloudflareTrafficCredentialStore) {
+    const store = opts.cloudflareTrafficCredentialStore;
+    validators[TrafficSourceTypes.cloudflare] = {
+      validateCredentials: (source) => {
+        const sourceMode = source.configJson.deliveryMode;
+        if (sourceMode !== void 0 && sourceMode !== "direct-push") return null;
+        const record = store.getConnection(source.projectName);
+        if (!record) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.missing",
+            summary: `No Cloudflare direct-push credential is stored for project "${source.projectName}".`,
+            remediation: "Re-run `canonry traffic connect cloudflare <project> --zone-id <id>` from the credential-owning host."
+          };
+        }
+        const recordMode = record.deliveryMode;
+        if (recordMode !== "direct-push") {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.mode-mismatch",
+            summary: `The stored Cloudflare credential mode does not match direct-push source "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source from the credential-owning host."
+          };
+        }
+        if (record.sourceId !== source.id) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.source-mismatch",
+            summary: `The stored Cloudflare credential belongs to a different source than "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source to pair the credential and source row."
+          };
+        }
+        const bearerToken = record.bearerToken;
+        const hmacSecret = record.hmacSecret;
+        if (typeof bearerToken !== "string" || bearerToken.length === 0 || typeof hmacSecret !== "string" || hmacSecret.length === 0 || !source.ingestTokenHash || hashCloudflareBearerToken(bearerToken) !== source.ingestTokenHash) {
+          return {
+            status: CheckStatuses.fail,
+            code: "traffic.credentials.bearer-mismatch",
+            summary: `The stored Cloudflare push credential does not match source "${source.displayName}".`,
+            remediation: "Reconnect the Cloudflare source and redeploy the generated Worker secrets."
+          };
+        }
+        return {
+          status: CheckStatuses.ok,
+          code: "traffic.credentials.resolved",
+          summary: `Cloudflare direct-push credentials match source "${source.displayName}".`
+        };
+      },
+      validateScopes: () => null
+    };
+  }
   return Object.keys(validators).length > 0 ? validators : void 0;
 }
 
 // src/intelligence-service.ts
-import crypto45 from "crypto";
+import crypto46 from "crypto";
 
 // src/logger.ts
 var IS_TTY = process.stdout.isTTY === true;
@@ -57946,9 +59422,9 @@ var IntelligenceService = class {
    */
   analyzeAndPersist(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
-      and45(
-        eq57(runs.projectId, projectId),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, projectId),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Defensive: RunCoordinator already skips probes before this is
         // called, but if a future call site invokes analyzeAndPersist
         // directly for a probe, probes still must not pollute the
@@ -58030,7 +59506,7 @@ var IntelligenceService = class {
    * Returns the persisted insights so the coordinator can count critical/high.
    */
   analyzeAndPersistGbp(runId, projectId) {
-    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq57(runs.id, runId)).get();
+    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq58(runs.id, runId)).get();
     if (!runRow) {
       log.info("gbp-intelligence.skip", { runId, reason: "run not found" });
       this.persistGbpInsights(runId, projectId, [], []);
@@ -58038,11 +59514,11 @@ var IntelligenceService = class {
     }
     const windowStart = runRow.startedAt ?? runRow.createdAt;
     const windowEnd = runRow.finishedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-    const selected = this.db.select().from(gbpLocations).where(and45(
-      eq57(gbpLocations.projectId, projectId),
-      eq57(gbpLocations.selected, true),
-      gte13(gbpLocations.syncedAt, windowStart),
-      lte10(gbpLocations.syncedAt, windowEnd)
+    const selected = this.db.select().from(gbpLocations).where(and46(
+      eq58(gbpLocations.projectId, projectId),
+      eq58(gbpLocations.selected, true),
+      gte14(gbpLocations.syncedAt, windowStart),
+      lte11(gbpLocations.syncedAt, windowEnd)
     )).all();
     if (selected.length === 0) {
       log.info("gbp-intelligence.skip", { runId, reason: "no locations synced during run" });
@@ -58075,12 +59551,12 @@ var IntelligenceService = class {
   }
   /** Build the per-location signal bundle the GBP analyzer consumes. */
   buildGbpLocationSignals(projectId, locationName, displayName, fallbackDate) {
-    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and45(eq57(gbpDailyMetrics.projectId, projectId), eq57(gbpDailyMetrics.locationName, locationName))).all();
-    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and45(eq57(gbpPlaceActions.projectId, projectId), eq57(gbpPlaceActions.locationName, locationName))).all();
-    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and45(eq57(gbpLodgingSnapshots.projectId, projectId), eq57(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
-    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and45(eq57(gbpLocations.projectId, projectId), eq57(gbpLocations.locationName, locationName))).get();
+    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and46(eq58(gbpDailyMetrics.projectId, projectId), eq58(gbpDailyMetrics.locationName, locationName))).all();
+    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and46(eq58(gbpPlaceActions.projectId, projectId), eq58(gbpPlaceActions.locationName, locationName))).all();
+    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and46(eq58(gbpLodgingSnapshots.projectId, projectId), eq58(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
+    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and46(eq58(gbpLocations.projectId, projectId), eq58(gbpLocations.locationName, locationName))).get();
     const descriptionMissing = !(ownerRow?.description ?? "").trim();
-    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and45(eq57(gbpPlaceDetails.projectId, projectId), eq57(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
+    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and46(eq58(gbpPlaceDetails.projectId, projectId), eq58(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
     const placesAmenities = placeRow ? extractPlaceAmenities(placeRow.attributes) : [];
     const summary = buildGbpSummary({
       locationName,
@@ -58116,7 +59592,7 @@ var IntelligenceService = class {
   /** Build the month-over-month keyword series for a location from the
    *  accumulating gbp_keyword_monthly table (latest complete month vs prior). */
   buildGbpKeywordTrend(projectId, locationName) {
-    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and45(eq57(gbpKeywordMonthly.projectId, projectId), eq57(gbpKeywordMonthly.locationName, locationName))).all();
+    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and46(eq58(gbpKeywordMonthly.projectId, projectId), eq58(gbpKeywordMonthly.locationName, locationName))).all();
     if (rows.length === 0) return { recentMonth: null, priorMonth: null, points: [] };
     const months = [...new Set(rows.map((r) => r.month))].sort().reverse();
     const recentMonth = months[0] ?? null;
@@ -58147,7 +59623,7 @@ var IntelligenceService = class {
    */
   persistGbpInsights(runId, projectId, gbpInsights, coveredLocationNames) {
     const covered = new Set(coveredLocationNames);
-    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and45(eq57(insights.projectId, projectId), eq57(insights.provider, GBP_INSIGHT_PROVIDER))).all();
+    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and46(eq58(insights.projectId, projectId), eq58(insights.provider, GBP_INSIGHT_PROVIDER))).all();
     const staleIds = [];
     const dismissedSlots = /* @__PURE__ */ new Set();
     for (const row of existing) {
@@ -58158,7 +59634,7 @@ var IntelligenceService = class {
     }
     this.db.transaction((tx) => {
       for (const id of staleIds) {
-        tx.delete(insights).where(eq57(insights.id, id)).run();
+        tx.delete(insights).where(eq58(insights.id, id)).run();
       }
       for (const insight of gbpInsights) {
         const parsed = parseGbpInsightId(insight.id);
@@ -58236,7 +59712,7 @@ var IntelligenceService = class {
    *     create per run + aggregate). DB is left untouched.
    */
   backfill(projectName, opts, onProgress) {
-    const project = this.db.select().from(projects).where(eq57(projects.name, projectName)).get();
+    const project = this.db.select().from(projects).where(eq58(projects.name, projectName)).get();
     if (!project) {
       throw new Error(`Project "${projectName}" not found`);
     }
@@ -58249,9 +59725,9 @@ var IntelligenceService = class {
       sinceTimestamp = parsed;
     }
     const allRuns = this.db.select().from(runs).where(
-      and45(
-        eq57(runs.projectId, project.id),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, project.id),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Backfill must not replay probe runs as if they were real sweeps.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -58330,7 +59806,7 @@ var IntelligenceService = class {
     return { processed, skipped, totalInsights };
   }
   loadTrackedCompetitors(projectId) {
-    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq57(competitors.projectId, projectId)).all().map((r) => r.domain);
+    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq58(competitors.projectId, projectId)).all().map((r) => r.domain);
   }
   /**
    * Wipe transition signals from an analysis result while keeping health.
@@ -58351,15 +59827,15 @@ var IntelligenceService = class {
   }
   persistResult(result, runId, projectId) {
     const previouslyDismissed = /* @__PURE__ */ new Set();
-    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq57(insights.runId, runId)).all();
+    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq58(insights.runId, runId)).all();
     for (const row of existingInsights) {
       if (row.dismissed) {
         previouslyDismissed.add(`${row.query}:${row.provider}:${row.type}`);
       }
     }
     this.db.transaction((tx) => {
-      tx.delete(insights).where(eq57(insights.runId, runId)).run();
-      tx.delete(healthSnapshots).where(eq57(healthSnapshots.runId, runId)).run();
+      tx.delete(insights).where(eq58(insights.runId, runId)).run();
+      tx.delete(healthSnapshots).where(eq58(healthSnapshots.runId, runId)).run();
       const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const insight of result.insights) {
         const wasDismissed = previouslyDismissed.has(`${insight.query}:${insight.provider}:${insight.type}`);
@@ -58379,7 +59855,7 @@ var IntelligenceService = class {
         }).run();
       }
       tx.insert(healthSnapshots).values({
-        id: crypto45.randomUUID(),
+        id: crypto46.randomUUID(),
         projectId,
         runId,
         overallCitedRate: String(result.health.overallCitedRate),
@@ -58412,24 +59888,24 @@ var IntelligenceService = class {
   applySeverityTiering(rawInsights, excludeRunId, projectId) {
     const regressions = rawInsights.filter((i) => i.type === "regression");
     if (regressions.length === 0) return rawInsights;
-    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq57(gscSearchData.projectId, projectId)).all();
+    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq58(gscSearchData.projectId, projectId)).all();
     const gscConnected = gscRows.length > 0;
     const gscImpressionsByQuery = /* @__PURE__ */ new Map();
     for (const row of gscRows) {
       const key = row.query.toLowerCase();
       gscImpressionsByQuery.set(key, (gscImpressionsByQuery.get(key) ?? 0) + row.impressions);
     }
-    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq57(projects.id, projectId)).get();
+    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq58(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectRow?.locations ?? []).length
     );
     const ROWS_PER_GROUP_BUDGET = Math.max(2, locationCount);
     const recentRunRows = this.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(
-      and45(
-        eq57(runs.projectId, projectId),
-        eq57(runs.kind, RunKinds["answer-visibility"]),
-        or12(eq57(runs.status, "completed"), eq57(runs.status, "partial")),
+      and46(
+        eq58(runs.projectId, projectId),
+        eq58(runs.kind, RunKinds["answer-visibility"]),
+        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
         // Defensive — see top of file.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -58449,7 +59925,7 @@ var IntelligenceService = class {
     const haveHistory = recentRunIds.length > 0;
     const priorRegressionsByPair = /* @__PURE__ */ new Map();
     if (haveHistory) {
-      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and45(eq57(insights.type, "regression"), inArray20(insights.runId, recentRunIds))).all();
+      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and46(eq58(insights.type, "regression"), inArray20(insights.runId, recentRunIds))).all();
       const regressionGroups = /* @__PURE__ */ new Map();
       for (const row of priorRows) {
         if (!row.runId) continue;
@@ -58478,7 +59954,7 @@ var IntelligenceService = class {
     });
   }
   buildRunData(runId, projectId, completedAt, location = null) {
-    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq57(projects.id, projectId)).get();
+    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq58(projects.id, projectId)).get();
     const projectDomains = projectDomainRow ? effectiveDomains({
       canonicalDomain: projectDomainRow.canonicalDomain,
       ownedDomains: projectDomainRow.ownedDomains
@@ -58495,7 +59971,7 @@ var IntelligenceService = class {
       citedDomains: querySnapshots.citedDomains,
       competitorOverlap: querySnapshots.competitorOverlap,
       snapshotLocation: querySnapshots.location
-    }).from(querySnapshots).leftJoin(queries, eq57(querySnapshots.queryId, queries.id)).where(eq57(querySnapshots.runId, runId)).all();
+    }).from(querySnapshots).leftJoin(queries, eq58(querySnapshots.queryId, queries.id)).where(eq58(querySnapshots.runId, runId)).all();
     const snapshots = [];
     let orphanCount = 0;
     for (const r of rows) {
@@ -58658,6 +60134,12 @@ export {
   listCachedReleases,
   pruneCachedRelease,
   resolveVercelSyncDeadlineMs,
+  CLOUDFLARE_WORKER_BINDINGS,
+  CLOUDFLARE_WORKER_GENERATED_MARKER,
+  CLOUDFLARE_WRANGLER_GENERATED_MARKER,
+  DEFAULT_BOT_LIST,
+  generateWorkerScript,
+  generateWranglerToml,
   executeDiscovery,
   markSessionFailed,
   apiRoutes,