@canonry/canonry 4.159.0 → 4.161.0

package/dist/{chunk-5AFWHKKI.js → chunk-J27J2DF6.js}

@@ -499,6 +499,7 @@ import {
   segmentCrawlerHits,
   serializeRunError,
   settingsDtoSchema,
+  shiftIsoCalendarDate,
   siteAuditLivePageHealthSchema,
   siteAuditPageFactorSchema,
   siteAuditPagesResponseSchema,
@@ -577,10 +578,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-ZL3VY435.js";
+} from "./chunk-EXDO7EPL.js";
 
 // src/intelligence-service.ts
-import { eq as eq58, desc as desc26, asc as asc11, and as and46, ne as ne7, or as or12, inArray as inArray20, gte as gte14, lte as lte11 } from "drizzle-orm";
+import { eq as eq59, desc as desc26, asc as asc11, and as and47, ne as ne7, or as or13, inArray as inArray21, gte as gte14, lte as lte12 } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -641,6 +642,7 @@ __export(schema_exports, {
   googleConnections: () => googleConnections,
   gscCoverageSnapshots: () => gscCoverageSnapshots,
   gscDailyTotals: () => gscDailyTotals,
+  gscDataWatermarks: () => gscDataWatermarks,
   gscQueryDailyTotals: () => gscQueryDailyTotals,
   gscSearchData: () => gscSearchData,
   gscUrlInspections: () => gscUrlInspections,
@@ -1141,6 +1143,12 @@ var gscSearchData = sqliteTable("gsc_search_data", {
   index("idx_gsc_search_query").on(table.query),
   index("idx_gsc_search_run").on(table.syncRunId)
 ]);
+var gscDataWatermarks = sqliteTable("gsc_data_watermarks", {
+  projectId: text("project_id").primaryKey().references(() => projects.id, { onDelete: "cascade" }),
+  dataThroughDate: text("data_through_date").notNull(),
+  syncedThroughDate: text("synced_through_date"),
+  updatedAt: text("updated_at").notNull()
+});
 var gscDailyTotals = sqliteTable("gsc_daily_totals", {
   id: text("id").primaryKey(),
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
@@ -2152,6 +2160,16 @@ var trafficSources = sqliteTable("traffic_sources", {
   // `traffic.source.worker-version` doctor check. NULL until the first
   // event arrives or for source types that don't forward versioned events.
   lastWorkerVersion: text("last_worker_version"),
+  // Pull adapters use this durable, owner-bound lease to prevent a manual
+  // sync and the scheduler from consuming the same source concurrently.
+  // Both fields are nullable so pre-lease sources remain immediately valid.
+  syncLeaseOwner: text("sync_lease_owner"),
+  syncLeaseExpiresAt: text("sync_lease_expires_at"),
+  // Residual Queue depth returned by Cloudflare after the most recent bounded
+  // pull. NULL means a queue-backed source has not observed backlog yet; zero
+  // is an explicit observation that the Queue was drained at that instant.
+  queueBacklogCount: integer("queue_backlog_count"),
+  queueBacklogObservedAt: text("queue_backlog_observed_at"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (table) => [
@@ -6005,7 +6023,7 @@ var MIGRATION_VERSIONS = [
     // Push-receive traffic sources (currently only `cloudflare`) need a
     // per-source bearer for the Worker to authenticate against canonry's
     // ingest endpoint, plus a place to remember the deployed Worker version.
-    // Durable receipts are transport-neutral: direct push and a future Queue
+    // Durable receipts are transport-neutral: direct push and Queue pull
     // pull consumer both claim an event in the same transaction as rollups.
     // Cleartext credentials remain outside the database.
     //
@@ -6145,6 +6163,47 @@ var MIGRATION_VERSIONS = [
       `CREATE INDEX IF NOT EXISTS idx_site_crawl_pages_live_preview
         ON site_crawl_pages(project_id, run_id, attempt_id, audit_state, audit_score, node_key)`
     ]
+  },
+  {
+    version: 135,
+    name: "traffic-source-sync-lease",
+    // A source-scoped lease serializes external pull consumers. Nullable
+    // fields preserve every existing source and let an older binary continue
+    // to insert source rows without knowing about leases.
+    statements: [
+      `ALTER TABLE traffic_sources ADD COLUMN sync_lease_owner TEXT`,
+      `ALTER TABLE traffic_sources ADD COLUMN sync_lease_expires_at TEXT`
+    ]
+  },
+  {
+    version: 136,
+    name: "traffic-source-queue-backlog",
+    // Persist Cloudflare's residual Queue depth so a bounded successful drain
+    // cannot hide that work remains. NULL preserves every legacy source and
+    // distinguishes "not observed" from an observed empty Queue.
+    statements: [
+      `ALTER TABLE traffic_sources ADD COLUMN queue_backlog_count INTEGER`,
+      `ALTER TABLE traffic_sources ADD COLUMN queue_backlog_observed_at TEXT`
+    ]
+  },
+  {
+    version: 137,
+    name: "gsc-data-watermark",
+    // The furthest GSC reporting date this project has EVER observed.
+    //
+    // `MAX(date)` over the stored rows is not a frontier: Search Analytics
+    // returns no row for a day with no data, so a quiet tail makes the observed
+    // max walk BACKWARD and drags every anchored window back with it. This
+    // column is monotonic — a sync may only advance it — so a zero-traffic
+    // stretch can never move the frontier the wrong way.
+    statements: [
+      `CREATE TABLE IF NOT EXISTS gsc_data_watermarks (
+        project_id          TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+        data_through_date   TEXT NOT NULL,
+        synced_through_date TEXT,
+        updated_at          TEXT NOT NULL
+      )`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -12162,13 +12221,13 @@ function parseRunTriggerRequest(value) {
     }))
   });
 }
-function parseListLimit(raw, defaultValue, max) {
+function parseListLimit(raw, defaultValue, max2) {
   if (raw === void 0) return defaultValue;
   const parsed = Number(raw);
   if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
     throw validationError('"limit" must be a positive integer');
   }
-  return Math.min(parsed, max);
+  return Math.min(parsed, max2);
 }
 function parseListKind(raw) {
   if (raw === void 0 || raw === "") return null;
@@ -14587,9 +14646,9 @@ function parseHeader(records) {
     }
     indices.set(name, index2);
   }
-  for (const required of ["property", "group"]) {
-    if (!indices.has(required)) {
-      csvError("csv-header-missing", `CSV is missing the required "${required}" header.`, 400, { header: required });
+  for (const required2 of ["property", "group"]) {
+    if (!indices.has(required2)) {
+      csvError("csv-header-missing", `CSV is missing the required "${required2}" header.`, 400, { header: required2 });
     }
   }
   return { indices, length: header.fields.length };
@@ -18544,7 +18603,7 @@ function validateCron(expr) {
   }
   return true;
 }
-function validateCronField(field, min, max) {
+function validateCronField(field, min, max2) {
   if (field === "*") return true;
   const segments = field.split(",");
   for (const segment of segments) {
@@ -18560,7 +18619,7 @@ function validateCronField(field, min, max) {
     if (rangeParts.length > 2) return false;
     for (const part of rangeParts) {
       const num = parseInt(part, 10);
-      if (isNaN(num) || num < min || num > max) return false;
+      if (isNaN(num) || num < min || num > max2) return false;
     }
   }
   return true;
@@ -19380,16 +19439,16 @@ function addAuditHistoryFilters(filters, query) {
   if (query.actor) filters.push(eq22(auditLog.actor, query.actor));
   if (query.entityType) filters.push(eq22(auditLog.entityType, query.entityType));
 }
-function parseBoundedInt(value, fallback, max) {
+function parseBoundedInt(value, fallback, max2) {
   const parsed = Number.parseInt(value ?? "", 10);
   if (!Number.isFinite(parsed) || parsed < 0) return fallback;
-  return Math.min(parsed, max);
+  return Math.min(parsed, max2);
 }
-function parseOptionalPositiveInt(value, max) {
+function parseOptionalPositiveInt(value, max2) {
   if (value == null) return void 0;
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
-  return Math.min(parsed, max);
+  return Math.min(parsed, max2);
 }
 
 // ../api-routes/src/analytics.ts
@@ -21136,7 +21195,47 @@ function winnabilityClassRank(winnabilityClass) {
 }
 
 // ../api-routes/src/gsc-totals.ts
-import { and as and21, asc as asc4, eq as eq27, sql as sql8 } from "drizzle-orm";
+import { and as and21, asc as asc4, eq as eq27, sql as sql8, max } from "drizzle-orm";
+var WINDOW_DAYS = { "7d": 7, "30d": 30, "90d": 90 };
+function resolveGscWindowRange(window, latestDataDate, today) {
+  if (window === "all") {
+    return {
+      startDate: null,
+      endDate: latestDataDate,
+      latestDataDate,
+      daysSinceLatestData: gscDaysSinceLatestData(latestDataDate, today)
+    };
+  }
+  return resolveGscWindowDays(WINDOW_DAYS[window], latestDataDate, today);
+}
+function resolveGscWindowDays(days, latestDataDate, today) {
+  if (latestDataDate === null) {
+    return {
+      startDate: shiftIsoCalendarDate(today, -days),
+      endDate: null,
+      latestDataDate: null,
+      daysSinceLatestData: null
+    };
+  }
+  return {
+    startDate: shiftIsoCalendarDate(latestDataDate, -(days - 1)),
+    endDate: latestDataDate,
+    latestDataDate,
+    daysSinceLatestData: gscDaysSinceLatestData(latestDataDate, today)
+  };
+}
+function gscDaysSinceLatestData(latestDataDate, today) {
+  if (latestDataDate === null) return null;
+  return Math.max(0, Math.round(
+    (Date.parse(`${today}T00:00:00Z`) - Date.parse(`${latestDataDate}T00:00:00Z`)) / 864e5
+  ));
+}
+function readLatestGscDataDate(db, projectId) {
+  const watermark = db.select({ through: gscDataWatermarks.dataThroughDate }).from(gscDataWatermarks).where(eq27(gscDataWatermarks.projectId, projectId)).get()?.through ?? null;
+  const property = db.select({ latest: max(gscDailyTotals.date) }).from(gscDailyTotals).where(eq27(gscDailyTotals.projectId, projectId)).get()?.latest ?? null;
+  const dimensioned = db.select({ latest: max(gscSearchData.date) }).from(gscSearchData).where(eq27(gscSearchData.projectId, projectId)).get()?.latest ?? null;
+  return [watermark, property, dimensioned].filter((d) => d !== null).reduce((maxDate, d) => maxDate === null || d > maxDate ? d : maxDate, null);
+}
 function readGscDailyTotals(db, projectId, startDate, endDate) {
   const rows = db.select({
     date: gscDailyTotals.date,
@@ -22395,7 +22494,7 @@ function renderWhatsChanged(report, audience) {
 }
 function renderProviderBars(rates) {
   if (rates.length === 0) return "";
-  const max = Math.max(...rates.map((r) => r.citationRate), 100);
+  const max2 = Math.max(...rates.map((r) => r.citationRate), 100);
   const width = 600;
   const height = Math.max(rates.length * 32 + 24, 80);
   const labelWidth = 80;
@@ -22404,7 +22503,7 @@ function renderProviderBars(rates) {
   const bars = rates.map((r, i) => {
     const y = i * 32 + padding;
     const barHeight = 22;
-    const w = max > 0 ? r.citationRate / max * barWidth : 0;
+    const w = max2 > 0 ? r.citationRate / max2 * barWidth : 0;
     const color = COLORS.series[i % COLORS.series.length];
     return `
       <text x="${labelWidth - 8}" y="${y + 16}" fill="${COLORS.textMuted}" font-size="11" text-anchor="end">${escapeHtml(r.provider)}</text>
@@ -22454,14 +22553,14 @@ function renderCitationScorecard(report) {
 }
 function renderLandscapeBars(data, heading, ariaLabel) {
   if (data.length <= 1) return "";
-  const max = Math.max(...data.map((d) => d.count), 1);
+  const max2 = Math.max(...data.map((d) => d.count), 1);
   const width = 600;
   const height = data.length * 28 + 16;
   const labelWidth = 160;
   const bars = data.map((d, i) => {
     const y = i * 28 + 8;
     const barHeight = 18;
-    const w = d.count / max * (width - labelWidth - 60);
+    const w = d.count / max2 * (width - labelWidth - 60);
     const color = d.isProject ? COLORS.accent : COLORS.series[(i + 1) % COLORS.series.length];
     return `
       <text x="${labelWidth - 8}" y="${y + 13}" fill="${COLORS.textMuted}" font-size="11" text-anchor="end">${escapeHtml(d.label)}</text>
@@ -22552,9 +22651,9 @@ function renderCategoryBars(buckets) {
   if (buckets.length === 0) return "";
   const total = buckets.reduce((s, b) => s + b.count, 0);
   if (total === 0) return "";
-  const max = Math.max(...buckets.map((b) => b.count), 1);
+  const max2 = Math.max(...buckets.map((b) => b.count), 1);
   const rows = buckets.map((b) => {
-    const pct = b.count / max * 100;
+    const pct = b.count / max2 * 100;
     const tone = SOURCE_CATEGORY_TONE[b.category] ?? "neutral";
     const color = tone === "negative" ? COLORS.negative : tone === "caution" ? COLORS.caution : COLORS.accent;
     return `
@@ -22630,11 +22729,11 @@ function renderLineChart(points, color, title, height = 200) {
   const padY = 24;
   const usableW = width - padX * 2;
   const usableH = height - padY * 2;
-  const max = Math.max(...points.map((p) => p.y), 1);
+  const max2 = Math.max(...points.map((p) => p.y), 1);
   const stepX = points.length > 1 ? usableW / (points.length - 1) : 0;
   const xy = points.map((p, i) => ({
     x: padX + i * stepX,
-    y: padY + usableH - p.y / max * usableH,
+    y: padY + usableH - p.y / max2 * usableH,
     raw: p
   }));
   const path8 = xy.map((p, i) => `${i === 0 ? "M" : "L"} ${p.x.toFixed(1)} ${p.y.toFixed(1)}`).join(" ");
@@ -22647,7 +22746,7 @@ function renderLineChart(points, color, title, height = 200) {
     <h3>${escapeHtml(title)}</h3>
     <svg viewBox="0 0 ${width} ${height}" width="100%" preserveAspectRatio="xMinYMin meet" role="img" aria-label="${escapeHtml(title)} line chart">
       <line x1="${padX}" y1="${padY + usableH}" x2="${padX + usableW}" y2="${padY + usableH}" stroke="${COLORS.border}" stroke-width="1" />
-      <text x="${padX - 6}" y="${(padY + 4).toFixed(1)}" fill="${COLORS.textFaint}" font-size="9" text-anchor="end">${formatNumber(max)}</text>
+      <text x="${padX - 6}" y="${(padY + 4).toFixed(1)}" fill="${COLORS.textFaint}" font-size="9" text-anchor="end">${formatNumber(max2)}</text>
       <text x="${padX - 6}" y="${(padY + usableH).toFixed(1)}" fill="${COLORS.textFaint}" font-size="9" text-anchor="end">0</text>
       <path d="${path8}" stroke="${color}" stroke-width="2" fill="none" />
       ${dots}
@@ -27339,7 +27438,12 @@ function summarizeTransitionsFromSnapshots(latest, previous, since) {
   return { since, gained, lost, emerging };
 }
 function buildSuggestedQueriesFromGsc(app, projectId, trackedQueries) {
-  const cutoff = new Date(Date.now() - 28 * 24 * 60 * 60 * 1e3).toISOString().slice(0, 10);
+  const suggestionWindow = resolveGscWindowDays(
+    28,
+    readLatestGscDataDate(app.db, projectId),
+    (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)
+  );
+  const cutoff = suggestionWindow.startDate ?? "";
   const dimensionedRows = app.db.select({
     date: gscSearchData.date,
     query: gscSearchData.query,
@@ -27352,11 +27456,14 @@ function buildSuggestedQueriesFromGsc(app, projectId, trackedQueries) {
   }).from(gscSearchData).where(and28(
     eq34(gscSearchData.projectId, projectId),
     sql12`${gscSearchData.date} >= ${cutoff}`,
+    // Same upper bound as the accurate source below. The merge picks a source
+    // PER DAY, so an asymmetric range would let a dimensioned-only day past
+    // the window's end into a basket the other source cannot balance.
+    sql12`${gscSearchData.date} <= ${suggestionWindow.endDate ?? "9999-12-31"}`,
     sql12`${gscSearchData.impressions} > 0`
   )).groupBy(gscSearchData.date, gscSearchData.query).all();
-  const todayIso = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const merged = mergeGscQueryTotalsWithFallback(
-    readGscQueryDailyRows(app.db, projectId, cutoff, todayIso),
+    readGscQueryDailyRows(app.db, projectId, cutoff, suggestionWindow.endDate ?? "9999-12-31"),
     dimensionedRows.map((r) => ({
       date: r.date,
       query: r.query,
@@ -30818,6 +30925,12 @@ var routeCatalog = [
       nameParameter,
       { name: "startDate", in: "query", description: "Filter by start date.", schema: stringSchema },
       { name: "endDate", in: "query", description: "Filter by end date.", schema: stringSchema },
+      {
+        name: "days",
+        in: "query",
+        description: "Relative span in days, resolved server-side against the last published GSC date. Prefer this over client-computed start/end dates: those bypass the published-day anchoring and are pinned to the caller's clock rather than Google's Pacific calendar.",
+        schema: stringSchema
+      },
       { name: "query", in: "query", description: "Filter by search query.", schema: stringSchema },
       { name: "page", in: "query", description: "Filter by page URL.", schema: stringSchema },
       {
@@ -33469,7 +33582,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/traffic/connect/cloudflare",
     summary: "Connect a Cloudflare Worker traffic source",
-    description: "Creates or updates a Cloudflare `direct-push` traffic source and returns a secret-free ES-module Worker plus Wrangler configuration. Per-source bearer and HMAC credentials remain in Canonry's credential store and are installed as Worker secret bindings; neither secret appears in source, TOML, API, or MCP output. Reconnect is idempotent: it reuses a matching source and credentials, preserves omitted metadata, and emits the current deployment package. Wrangler deploys the Worker without a route. The operator must attach the exact site route manually and set its Request limit failure mode to Fail open. No upstream probe is performed at connect time.",
+    description: "Creates or updates a Cloudflare `direct-push` or `queue-pull` traffic source and returns a secret-free ES-module Worker plus Wrangler configuration. Direct bearer/HMAC credentials and the Queue API token remain in Canonry's local credential store; none appears in source, TOML, DB config, response, or MCP output. Reconnect is idempotent by source mode. A different mode is staged paused when another project traffic source is active, and requires the explicit activation operation after deployment. Wrangler deploys the Worker without a route; the operator attaches the exact site route manually with Request limit failure mode set to Fail open.",
     tags: ["traffic"],
     parameters: [nameParameter],
     requestBody: {
@@ -33513,11 +33626,27 @@ var routeCatalog = [
       429: errorResponse("The per-IP or authenticated-source ingest request budget was exceeded.")
     }
   },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/traffic/sources/{id}/activate",
+    summary: "Activate a staged traffic source",
+    description: "Explicit single-team cutover. Atomically pauses every sibling project traffic source and connects the selected Cloudflare, Cloud Run, WordPress, or Vercel source after validating its local credential. Pull delivery creates or repoints the one project traffic-sync schedule; Cloudflare direct push removes it. Deployment and provider-side routing remain separate operator actions.",
+    tags: ["traffic"],
+    parameters: [
+      nameParameter,
+      { name: "id", in: "path", required: true, description: "Staged traffic source ID.", schema: stringSchema }
+    ],
+    responses: {
+      200: jsonResponse("Activated traffic source DTO returned.", "TrafficSourceDto"),
+      400: errorResponse("Source is archived, unsupported, or cannot be activated."),
+      404: errorResponse("Project or traffic source not found.")
+    }
+  },
   {
     method: "post",
     path: "/api/v1/projects/{name}/traffic/sources/{id}/sync",
     summary: "Trigger a sync run for a traffic source",
-    description: "Pulls request logs from the configured Cloud Run service for the lookback window, classifies crawler hits / AI-referral sessions, and upserts hourly buckets and a bounded sample tail.",
+    description: "Pulls from the selected Cloud Run, WordPress, Vercel, or Cloudflare Queue source, classifies crawler hits / user fetches / AI-referral sessions, and commits hourly buckets plus a bounded sample tail. Queue pull uses a durable source lease and acknowledges each Cloudflare message only after its event receipts and rollups commit.",
     tags: ["traffic"],
     parameters: [
       nameParameter,
@@ -33530,7 +33659,7 @@ var routeCatalog = [
           schema: {
             type: "object",
             properties: {
-              sinceMinutes: { ...integerSchema, description: "Lookback window in minutes (default 60)." }
+              sinceMinutes: { ...integerSchema, description: "Optional lookback for time-window sources; Cloudflare Queue pull ignores it." }
             }
           }
         }
@@ -33539,8 +33668,9 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Sync summary returned.", "TrafficSyncResponse"),
       400: errorResponse("Invalid sync request or missing credentials."),
+      409: errorResponse("Another Queue sync currently owns the source lease."),
       404: errorResponse("Project or traffic source not found."),
-      502: errorResponse("Upstream Cloud Run pull or auth-token resolution failed.")
+      502: errorResponse("Upstream pull, acknowledgement, or credential resolution failed.")
     }
   },
   {
@@ -34966,8 +35096,8 @@ var SEVERITY_ICONS = {
   [AlertSeverities.success]: "\u2705",
   [AlertSeverities.info]: "\u{1F4CA}"
 };
-function clamp(value, max) {
-  return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
+function clamp(value, max2) {
+  return value.length <= max2 ? value : `${value.slice(0, max2 - 1)}\u2026`;
 }
 function absoluteLink(url) {
   if (!url) return void 0;
@@ -35356,6 +35486,7 @@ var INDEXING_SCOPE = "https://www.googleapis.com/auth/indexing";
 var GSC_API_BASE = "https://www.googleapis.com/webmasters/v3";
 var URL_INSPECTION_API = "https://searchconsole.googleapis.com/v1/urlInspection/index:inspect";
 var GSC_MAX_ROWS_PER_REQUEST = 25e3;
+var GSC_REPORTING_TIME_ZONE = "America/Los_Angeles";
 var GSC_DATA_LAG_DAYS = 3;
 var INDEXING_API_BASE = "https://indexing.googleapis.com/v3";
 var INDEXING_API_DAILY_LIMIT = 200;
@@ -36399,11 +36530,11 @@ async function fetchDailyTotals(accessToken, propertyId, days) {
   ga4Log("info", "fetch-daily-totals.done", { propertyId, days: syncDays, rows: rows.length });
   return rows;
 }
-var WINDOW_DAYS = { "7d": 7, "30d": 30, "90d": 90 };
+var WINDOW_DAYS2 = { "7d": 7, "30d": 30, "90d": 90 };
 async function fetchWindowSummary(accessToken, propertyId, windowKey) {
   validateAccessToken2(accessToken);
   validatePropertyId(propertyId);
-  const days = WINDOW_DAYS[windowKey];
+  const days = WINDOW_DAYS2[windowKey];
   if (!days) {
     throw new GA4ApiError(`Unsupported windowKey "${windowKey}" \u2014 must be 7d, 30d, or 90d`, 400);
   }
@@ -36978,6 +37109,26 @@ function stableStringify3(value) {
 }
 
 // ../api-routes/src/google.ts
+function resolveReportedWindow(resolved, startDate, endDate) {
+  const start = startDate ?? resolved.startDate;
+  const end = endDate ?? resolved.endDate;
+  if (start === null || end === null || start <= end) {
+    return { ...resolved, startDate: start, endDate: end };
+  }
+  return {
+    ...resolved,
+    startDate: startDate ? start : null,
+    endDate: endDate ? end : null
+  };
+}
+function assertForwardRange(startDate, endDate) {
+  if (startDate && endDate && startDate > endDate) {
+    throw validationError(`startDate "${startDate}" is after endDate "${endDate}".`);
+  }
+}
+function gscToday() {
+  return formatIsoDateInTimeZone((/* @__PURE__ */ new Date()).toISOString(), GSC_REPORTING_TIME_ZONE);
+}
 var GOOGLE_OAUTH_COMPLETE_MESSAGE = "canonry:google-oauth-complete";
 function googleOAuthSuccessHtml(type) {
   const message = JSON.stringify({
@@ -37408,11 +37559,19 @@ async function googleRoutes(app, opts) {
       );
     }
     const orderBy = parsedOrderBy.data;
-    const cutoffDate = !startDate ? windowCutoff(parseWindow(request.query.window))?.slice(0, 10) ?? null : null;
+    assertForwardRange(startDate, endDate);
+    const daysParam = request.query.days === void 0 ? null : Number(request.query.days);
+    if (daysParam !== null && (!Number.isInteger(daysParam) || daysParam < 1)) {
+      throw validationError('"days" must be a positive integer');
+    }
+    const latestDataDate = readLatestGscDataDate(app.db, project.id);
+    const resolvedWindow = daysParam === null ? resolveGscWindowRange(parseWindow(request.query.window), latestDataDate, gscToday()) : resolveGscWindowDays(daysParam, latestDataDate, gscToday());
+    const cutoffDate = startDate ? null : resolvedWindow.startDate;
+    const effectiveEndDate = endDate ?? (daysParam === null ? void 0 : resolvedWindow.endDate ?? void 0);
     const conditions = [eq39(gscSearchData.projectId, project.id)];
     if (startDate) conditions.push(sql13`${gscSearchData.date} >= ${startDate}`);
     else if (cutoffDate) conditions.push(sql13`${gscSearchData.date} >= ${cutoffDate}`);
-    if (endDate) conditions.push(sql13`${gscSearchData.date} <= ${endDate}`);
+    if (effectiveEndDate) conditions.push(sql13`${gscSearchData.date} <= ${effectiveEndDate}`);
     if (query) conditions.push(sql13`${gscSearchData.query} LIKE ${"%" + escapeLikePattern(query) + "%"} ESCAPE '\\'`);
     if (page) conditions.push(sql13`${gscSearchData.page} LIKE ${"%" + escapeLikePattern(page) + "%"} ESCAPE '\\'`);
     const limitVal = Math.max(parseInt(limit ?? "500", 10) || 0, 1);
@@ -37449,9 +37608,15 @@ async function googleRoutes(app, opts) {
   app.get("/projects/:name/google/gsc/performance/daily", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const { startDate, endDate } = request.query;
-    const cutoffDate = !startDate ? windowCutoff(parseWindow(request.query.window))?.slice(0, 10) ?? null : null;
+    assertForwardRange(startDate, endDate);
+    const resolvedWindow = resolveGscWindowRange(
+      parseWindow(request.query.window),
+      readLatestGscDataDate(app.db, project.id),
+      gscToday()
+    );
+    const cutoffDate = startDate ? null : resolvedWindow.startDate;
     const windowStart = startDate ?? cutoffDate ?? "";
-    const windowEnd = endDate ?? "9999-12-31";
+    const windowEnd = endDate ?? resolvedWindow.endDate ?? "9999-12-31";
     const dailyTotals = readGscDailyTotals(app.db, project.id, windowStart, windowEnd);
     const conditions = [eq39(gscSearchData.projectId, project.id)];
     if (startDate) conditions.push(sql13`${gscSearchData.date} >= ${startDate}`);
@@ -37485,13 +37650,30 @@ async function googleRoutes(app, opts) {
         ctr: totalImpressions > 0 ? totalClicks / totalImpressions : 0,
         days: daily.length
       },
-      daily
+      daily,
+      // The period actually returned. An explicit start/end wins over the
+      // label, so echo what was used rather than what the window would have
+      // chosen — a caller must be able to label the data it got.
+      //
+      // Mixing one explicit bound with the computed opposite one can invert the
+      // range (an explicit `startDate` of 2030-01-01 against a computed
+      // `endDate` of 2026-01-06), which would describe a period that cannot
+      // contain the rows beside it. When only one side is given, the other is
+      // dropped rather than reported reversed: an absent bound is honest about
+      // being unspecified, a reversed pair is not.
+      window: resolveReportedWindow(resolvedWindow, startDate, endDate)
     };
   });
   app.get("/projects/:name/google/gsc/top-pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const { startDate, endDate, limit } = request.query;
-    const cutoffDate = !startDate ? windowCutoff(parseWindow(request.query.window))?.slice(0, 10) ?? null : null;
+    assertForwardRange(startDate, endDate);
+    const resolvedWindow = resolveGscWindowRange(
+      parseWindow(request.query.window),
+      readLatestGscDataDate(app.db, project.id),
+      gscToday()
+    );
+    const cutoffDate = startDate ? null : resolvedWindow.startDate;
     const conditions = [eq39(gscSearchData.projectId, project.id)];
     if (startDate) conditions.push(sql13`${gscSearchData.date} >= ${startDate}`);
     else if (cutoffDate) conditions.push(sql13`${gscSearchData.date} >= ${cutoffDate}`);
@@ -37503,7 +37685,7 @@ async function googleRoutes(app, opts) {
       impressions: sql13`COALESCE(SUM(${gscSearchData.impressions}), 0)`
     }).from(gscSearchData).where(and30(...conditions)).groupBy(gscSearchData.page).orderBy(desc17(sql13`SUM(${gscSearchData.clicks})`), desc17(sql13`SUM(${gscSearchData.impressions})`)).limit(limitVal).all();
     const windowStart = startDate ?? cutoffDate ?? "";
-    const windowEnd = endDate ?? "9999-12-31";
+    const windowEnd = endDate ?? resolvedWindow.endDate ?? "9999-12-31";
     const dailyTotals = readGscDailyTotals(app.db, project.id, windowStart, windowEnd);
     const totalClicks = dailyTotals.reduce((sum, d) => sum + d.clicks, 0);
     const totalImpressions = dailyTotals.reduce((sum, d) => sum + d.impressions, 0);
@@ -41728,7 +41910,7 @@ function assertGenericReconciliationKind(row) {
 }
 function claimOperationForReconciliation(app, row, leaseOwner, now, leaseMs, policy, enforceBackoff) {
   const nowIso = now.toISOString();
-  const leaseExpiresAt = new Date(now.getTime() + leaseMs).toISOString();
+  const leaseExpiresAt2 = new Date(now.getTime() + leaseMs).toISOString();
   const pendingCutoff = new Date(now.getTime() - policy.pendingMinIdleMs).toISOString();
   const backoffMs = policy.backoffBaseMs * 2 ** Math.max(0, row.reconcileAttempts - 1);
   const unknownCutoff = new Date(now.getTime() - backoffMs).toISOString();
@@ -41745,7 +41927,7 @@ function claimOperationForReconciliation(app, row, leaseOwner, now, leaseMs, pol
   const claimed = app.db.update(adsOperations).set({
     state: AdsOperationStates.reconciling,
     leaseOwner,
-    leaseExpiresAt,
+    leaseExpiresAt: leaseExpiresAt2,
     reconcileAttempts: sql15`${adsOperations.reconcileAttempts} + 1`,
     updatedAt: nowIso
   }).where(and32(
@@ -47936,12 +48118,16 @@ async function backlinksRoutes(app, opts) {
 // ../api-routes/src/traffic.ts
 import crypto40 from "crypto";
 import { isIP } from "net";
+import { isDeepStrictEqual } from "util";
 import { Agent as UndiciAgent } from "undici";
-import { and as and39, desc as desc22, eq as eq47, gte as gte11, lte as lte10, sql as sql19 } from "drizzle-orm";
+import { and as and40, desc as desc22, eq as eq48, gte as gte11, lte as lte11, sql as sql19 } from "drizzle-orm";
 
 // ../api-routes/src/traffic-limits.ts
 var VERCEL_MAX_SYNC_WINDOW_MS = 24 * 60 * 6e4;
 var DEFAULT_VERCEL_SYNC_DEADLINE_MS = 4 * 6e4;
+var CLOUDFLARE_QUEUE_BATCH_SIZE = 100;
+var DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES = 10;
+var DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET = CLOUDFLARE_QUEUE_BATCH_SIZE * DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES;
 var MIN_VERCEL_SYNC_DEADLINE_MS = 3e4;
 var MAX_VERCEL_SYNC_DEADLINE_MS = 15 * 6e4;
 var TRAFFIC_SOURCE_MAX_CATCHUP_MS = {
@@ -51869,7 +52055,8 @@ var CLOUDFLARE_WORKER_BINDINGS = {
   ingestUrl: "CANONRY_INGEST_URL",
   workerVersion: "CANONRY_WORKER_VERSION",
   bearerToken: "CANONRY_BEARER_TOKEN",
-  hmacSecret: "CANONRY_HMAC_SECRET"
+  hmacSecret: "CANONRY_HMAC_SECRET",
+  trafficQueue: "CANONRY_TRAFFIC_QUEUE"
 };
 var CLOUDFLARE_DIRECT_PUSH_SECRET_BINDINGS = [
   CLOUDFLARE_WORKER_BINDINGS.bearerToken,
@@ -51910,6 +52097,110 @@ function jsArray(values) {
 function generateWorkerScript(opts) {
   const botScoreMax = opts.botScoreMaxForward ?? DEFAULT_BOT_SCORE_MAX_FORWARD;
   const canonicalJsonFunction = canonicalizeCloudflareJson.toString();
+  const directPushDelivery = opts.deliveryMode === "direct-push" ? `
+function toHex(buffer) {
+  const bytes = new Uint8Array(buffer)
+  let out = ''
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, '0')
+  }
+  return out
+}
+
+async function signBody(secret, timestamp, body) {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+  const sig = await crypto.subtle.sign(
+    'HMAC',
+    key,
+    new TextEncoder().encode(timestamp + '.' + body),
+  )
+  return toHex(sig)
+}
+
+function isRetryableStatus(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function cancelUnusedResponseBody(response) {
+  try {
+    if (response.body) await response.body.cancel()
+  } catch (_) {
+    // The ingest response body is unused. Cancellation failure is non-fatal.
+  }
+}
+
+async function withRetry(operation) {
+  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+    let response
+    try {
+      response = await operation()
+    } catch (error) {
+      if (attempt === RETRY_DELAYS_MS.length) throw error
+      await sleep(RETRY_DELAYS_MS[attempt])
+      continue
+    }
+
+    const status = response.status
+    const ok = response.ok
+    await cancelUnusedResponseBody(response)
+    if (ok) return
+    if (!isRetryableStatus(status) || attempt === RETRY_DELAYS_MS.length) {
+      throw new Error('Canonry ingest returned HTTP ' + status)
+    }
+    await sleep(RETRY_DELAYS_MS[attempt])
+  }
+}
+` : "";
+  const directPushDeliveryAdapter = opts.deliveryMode === "direct-push" ? `
+async function deliverViaDirectPush(env, batch) {
+  const sourceId = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.sourceId)})
+  const ingestUrl = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.ingestUrl}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.ingestUrl)})
+  const bearerToken = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.bearerToken}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.bearerToken)})
+  const hmacSecret = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.hmacSecret}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.hmacSecret)})
+  const body = canonicalizeJson(batch)
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const signature = await signBody(hmacSecret, timestamp, body)
+
+  await withRetry(() => fetch(ingestUrl, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'Authorization': 'Bearer ' + bearerToken,
+      'X-Canonry-Timestamp': timestamp,
+      'X-Canonry-Signature': signature,
+      'X-Canonry-Worker-Version': batch.workerVersion,
+      'X-Canonry-Source-Id': sourceId,
+    },
+    body,
+  }))
+}
+` : "";
+  const queuePullDeliveryAdapter = opts.deliveryMode === "queue-pull" ? `
+function requireQueueBinding(value, name) {
+  if (value && typeof value.send === 'function') return value
+  throw new Error('Missing required Worker binding: ' + name)
+}
+
+async function deliverViaQueue(env, batch) {
+  const queue = requireQueueBinding(env.${CLOUDFLARE_WORKER_BINDINGS.trafficQueue}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.trafficQueue)})
+  await queue.send(batch, { contentType: 'json' })
+}
+` : "";
+  const deliveryModeBranch = opts.deliveryMode === "direct-push" ? `if (deliveryMode === 'direct-push') {
+    return deliverViaDirectPush(env, batch)
+  }` : `if (deliveryMode === 'queue-pull') {
+    return deliverViaQueue(env, batch)
+  }`;
   return `${CLOUDFLARE_WORKER_GENERATED_MARKER}
 // worker version: ${opts.workerVersion}
 // bot-list version: ${opts.botList.version}
@@ -51999,68 +52290,7 @@ function shouldForward(request) {
   return botSignals(request.cf)
 }
 
-function toHex(buffer) {
-  const bytes = new Uint8Array(buffer)
-  let out = ''
-  for (let i = 0; i < bytes.length; i++) {
-    out += bytes[i].toString(16).padStart(2, '0')
-  }
-  return out
-}
-
-async function signBody(secret, timestamp, body) {
-  const key = await crypto.subtle.importKey(
-    'raw',
-    new TextEncoder().encode(secret),
-    { name: 'HMAC', hash: 'SHA-256' },
-    false,
-    ['sign'],
-  )
-  const sig = await crypto.subtle.sign(
-    'HMAC',
-    key,
-    new TextEncoder().encode(timestamp + '.' + body),
-  )
-  return toHex(sig)
-}
-
-function isRetryableStatus(status) {
-  return status === 408 || status === 425 || status === 429 || status >= 500
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-async function cancelUnusedResponseBody(response) {
-  try {
-    if (response.body) await response.body.cancel()
-  } catch (_) {
-    // The ingest response body is unused. Cancellation failure is non-fatal.
-  }
-}
-
-async function withRetry(operation) {
-  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
-    let response
-    try {
-      response = await operation()
-    } catch (error) {
-      if (attempt === RETRY_DELAYS_MS.length) throw error
-      await sleep(RETRY_DELAYS_MS[attempt])
-      continue
-    }
-
-    const status = response.status
-    const ok = response.ok
-    await cancelUnusedResponseBody(response)
-    if (ok) return
-    if (!isRetryableStatus(status) || attempt === RETRY_DELAYS_MS.length) {
-      throw new Error('Canonry ingest returned HTTP ' + status)
-    }
-    await sleep(RETRY_DELAYS_MS[attempt])
-  }
-}
+${directPushDelivery}
 
 function pickCf(cf) {
   if (!cf) return null
@@ -52099,34 +52329,11 @@ function buildEdgeEventBatch(env, request, status, observedAt) {
   }
 }
 
-async function deliverViaDirectPush(env, batch) {
-  const sourceId = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.sourceId}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.sourceId)})
-  const ingestUrl = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.ingestUrl}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.ingestUrl)})
-  const bearerToken = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.bearerToken}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.bearerToken)})
-  const hmacSecret = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.hmacSecret}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.hmacSecret)})
-  const body = canonicalizeJson(batch)
-  const timestamp = String(Math.floor(Date.now() / 1000))
-  const signature = await signBody(hmacSecret, timestamp, body)
-
-  await withRetry(() => fetch(ingestUrl, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      'Authorization': 'Bearer ' + bearerToken,
-      'X-Canonry-Timestamp': timestamp,
-      'X-Canonry-Signature': signature,
-      'X-Canonry-Worker-Version': batch.workerVersion,
-      'X-Canonry-Source-Id': sourceId,
-    },
-    body,
-  }))
-}
+${directPushDeliveryAdapter}${queuePullDeliveryAdapter}
 
 async function deliverEdgeEventBatch(env, batch) {
   const deliveryMode = requireBinding(env.${CLOUDFLARE_WORKER_BINDINGS.deliveryMode}, ${jsString(CLOUDFLARE_WORKER_BINDINGS.deliveryMode)})
-  if (deliveryMode === 'direct-push') {
-    return deliverViaDirectPush(env, batch)
-  }
+  ${deliveryModeBranch}
   throw new Error('Unsupported Canonry delivery mode: ' + deliveryMode)
 }
 
@@ -52200,6 +52407,31 @@ function generateWranglerToml(opts) {
 ` : "";
   const zoneHint = opts.zoneId ? `# Target zone id: ${jsString(opts.zoneId)}
 ` : "# Target zone id was not provided. Select the canonical site zone.\n";
+  if (opts.deliveryMode === "queue-pull") {
+    return `${CLOUDFLARE_WRANGLER_GENERATED_MARKER}
+name = "canonry-traffic-${opts.sourceId}"
+${accountConfig}main = "worker.js"
+compatibility_date = "${WORKER_COMPATIBILITY_DATE}"
+workers_dev = false
+
+[vars]
+${CLOUDFLARE_WORKER_BINDINGS.deliveryMode} = ${jsString(opts.deliveryMode)}
+${CLOUDFLARE_WORKER_BINDINGS.sourceId} = ${jsString(opts.sourceId)}
+${CLOUDFLARE_WORKER_BINDINGS.workerVersion} = ${jsString(opts.workerVersion)}
+
+[[queues.producers]]
+queue = ${jsString(opts.queueName)}
+binding = ${jsString(CLOUDFLARE_WORKER_BINDINGS.trafficQueue)}
+
+# Deploy this Worker via:
+#   wrangler deploy
+# Canonry intentionally does not declare a route in this file.
+# After deploy, attach this exact route in the Cloudflare dashboard:
+#   ${hostname}/*
+${zoneHint}# Set the route Request limit failure mode to Fail open before activation.
+# Wrangler cannot configure this route toggle.
+`;
+  }
   return `${CLOUDFLARE_WRANGLER_GENERATED_MARKER}
 name = "canonry-traffic-${opts.sourceId}"
 ${accountConfig}main = "worker.js"
@@ -52277,6 +52509,365 @@ function verifyRequestSignature(opts) {
   return { ok: false, reason: "signature_mismatch" };
 }
 
+// ../integration-cloudflare-queue/src/client.ts
+var DEFAULT_API_BASE_URL = "https://api.cloudflare.com/client/v4";
+var DEFAULT_TIMEOUT_MS4 = 3e4;
+var DEFAULT_MAX_RETRIES2 = 3;
+var DEFAULT_RETRY_BASE_DELAY_MS = 1e3;
+var MAX_RETRY_DELAY_MS = 3e4;
+var MAX_PULL_BATCH_SIZE = 100;
+var MAX_VISIBILITY_TIMEOUT_MS = 12 * 60 * 6e4;
+var CloudflareQueueApiError = class extends Error {
+  constructor(message, status, retryAfter) {
+    super(message);
+    this.status = status;
+    this.retryAfter = retryAfter;
+    this.name = "CloudflareQueueApiError";
+  }
+  status;
+  retryAfter;
+};
+function required(value, label) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new CloudflareQueueApiError(`${label} is required`, 400);
+  return trimmed;
+}
+function positiveInteger(value, label, maximum) {
+  if (!Number.isInteger(value) || value < 1 || maximum !== void 0 && value > maximum) {
+    const range = maximum === void 0 ? "a positive integer" : `an integer from 1 to ${maximum}`;
+    throw new CloudflareQueueApiError(`${label} must be ${range}`, 400);
+  }
+  return value;
+}
+function nonNegativeInteger(value, label) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new CloudflareQueueApiError(`${label} must be a non-negative integer`, 502);
+  }
+  return value;
+}
+function resolveOptions(options) {
+  const apiBaseUrl = (options.apiBaseUrl ?? DEFAULT_API_BASE_URL).replace(/\/$/, "");
+  try {
+    new URL(apiBaseUrl);
+  } catch {
+    throw new CloudflareQueueApiError("apiBaseUrl must be a valid URL", 400);
+  }
+  return {
+    accountId: required(options.accountId, "accountId"),
+    queueId: required(options.queueId, "queueId"),
+    apiToken: required(options.apiToken, "apiToken"),
+    fetchImpl: options.fetchImpl ?? fetch,
+    apiBaseUrl,
+    timeoutMs: positiveInteger(options.timeoutMs ?? DEFAULT_TIMEOUT_MS4, "timeoutMs"),
+    maxRetries: nonNegativeInteger(options.maxRetries ?? DEFAULT_MAX_RETRIES2, "maxRetries"),
+    retryBaseDelayMs: positiveInteger(options.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS, "retryBaseDelayMs"),
+    sleep: options.sleep
+  };
+}
+function queueMessagesUrl(options, action) {
+  return `${options.apiBaseUrl}/accounts/${encodeURIComponent(options.accountId)}/queues/${encodeURIComponent(options.queueId)}/messages/${action}`;
+}
+function requestSignal(timeoutMs, signal) {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  return signal ? AbortSignal.any([timeout, signal]) : timeout;
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError" || error instanceof Error && error.name === "TimeoutError";
+}
+function isRetryableQueueError(error) {
+  if (isAbortError(error)) return false;
+  if (error instanceof CloudflareQueueApiError) {
+    return error.status === 429 || error.status >= 500;
+  }
+  return true;
+}
+function retryAfterDelay(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  const at = Date.parse(trimmed);
+  return Number.isNaN(at) ? void 0 : Math.max(0, at - Date.now());
+}
+async function withQueueRetry(attempt, options) {
+  let lastError;
+  for (let attemptNumber = 0; attemptNumber <= options.maxRetries; attemptNumber += 1) {
+    try {
+      return await attempt();
+    } catch (error) {
+      lastError = error;
+      if (attemptNumber >= options.maxRetries || !isRetryableQueueError(error)) throw error;
+      const defaultDelayMs = options.retryBaseDelayMs * Math.pow(2, attemptNumber);
+      const requestedDelayMs = error instanceof CloudflareQueueApiError ? retryAfterDelay(error.retryAfter) ?? defaultDelayMs : defaultDelayMs;
+      const delayMs = Math.min(requestedDelayMs, MAX_RETRY_DELAY_MS);
+      if (options.sleep) {
+        await options.sleep(delayMs);
+      } else if (delayMs > 0) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+  }
+  throw lastError;
+}
+async function postJson(options, action, body, signal) {
+  return withQueueRetry(async () => {
+    let response;
+    try {
+      response = await options.fetchImpl(queueMessagesUrl(options, action), {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${options.apiToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body),
+        signal: requestSignal(options.timeoutMs, signal)
+      });
+    } catch (error) {
+      if (isAbortError(error)) {
+        throw new CloudflareQueueApiError("Cloudflare Queue request timed out or was aborted", 408);
+      }
+      throw new CloudflareQueueApiError("Cloudflare Queue request failed", 503);
+    }
+    if (!response.ok) {
+      throw new CloudflareQueueApiError(
+        `Cloudflare Queue ${action} failed with HTTP ${response.status}`,
+        response.status,
+        response.headers.get("retry-after") ?? void 0
+      );
+    }
+    try {
+      return await response.json();
+    } catch {
+      throw new CloudflareQueueApiError(`Cloudflare Queue ${action} returned invalid JSON`, 502);
+    }
+  }, {
+    maxRetries: options.maxRetries,
+    retryBaseDelayMs: options.retryBaseDelayMs,
+    sleep: options.sleep
+  });
+}
+function asRecord(value, label) {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CloudflareQueueApiError(`Cloudflare Queue ${label} is malformed`, 502);
+  }
+  return value;
+}
+function requiredString(record, key, label) {
+  const value = record[key];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CloudflareQueueApiError(`Cloudflare Queue ${label} is malformed`, 502);
+  }
+  return value;
+}
+function stringField(record, key, label) {
+  const value = record[key];
+  if (typeof value !== "string") {
+    throw new CloudflareQueueApiError(`Cloudflare Queue ${label} is malformed`, 502);
+  }
+  return value;
+}
+function metadata(record) {
+  const value = asRecord(record.metadata, "message metadata");
+  const parsed = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      throw new CloudflareQueueApiError("Cloudflare Queue message metadata is malformed", 502);
+    }
+    parsed[key] = entry;
+  }
+  return parsed;
+}
+function decodeBase64(value) {
+  if (!/^(?:[a-z0-9+/]{4})*(?:[a-z0-9+/]{2}==|[a-z0-9+/]{3}=)?$/i.test(value)) {
+    throw new CloudflareQueueApiError("Cloudflare Queue message body is malformed", 502);
+  }
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+function parseJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new CloudflareQueueApiError("Cloudflare Queue JSON message body is malformed", 502);
+  }
+}
+function decodeUtf8(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CloudflareQueueApiError("Cloudflare Queue JSON message body is malformed", 502);
+  }
+}
+function decodeJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return parseJson(decodeUtf8(decodeBase64(value)));
+  }
+}
+function safeMessageBase(record, leaseId) {
+  const rawMetadata = record.metadata;
+  const safeMetadata = {};
+  let metadataIsSafe = rawMetadata != null && typeof rawMetadata === "object" && !Array.isArray(rawMetadata);
+  if (metadataIsSafe) {
+    for (const [key, value] of Object.entries(rawMetadata)) {
+      if (typeof value !== "string") {
+        metadataIsSafe = false;
+        break;
+      }
+      safeMetadata[key] = value;
+    }
+  }
+  return {
+    id: typeof record.id === "string" && record.id.trim() ? record.id : "<malformed>",
+    leaseId,
+    timestampMs: Number.isInteger(record.timestamp_ms) && record.timestamp_ms >= 0 ? record.timestamp_ms : 0,
+    attempts: Number.isInteger(record.attempts) && record.attempts >= 0 ? record.attempts : 0,
+    metadata: metadataIsSafe ? safeMetadata : {}
+  };
+}
+function decodeMessage(record) {
+  const leaseId = requiredString(record, "lease_id", "message");
+  let base;
+  let rawBody;
+  try {
+    base = {
+      id: requiredString(record, "id", "message"),
+      leaseId,
+      timestampMs: nonNegativeInteger(record.timestamp_ms, "message timestamp_ms"),
+      attempts: nonNegativeInteger(record.attempts, "message attempts"),
+      metadata: metadata(record)
+    };
+    rawBody = stringField(record, "body", "message");
+  } catch (error) {
+    if (!(error instanceof CloudflareQueueApiError)) throw error;
+    return {
+      ...safeMessageBase(record, leaseId),
+      contentType: "poison",
+      reason: "malformed-envelope"
+    };
+  }
+  const contentType = base.metadata["CF-Content-Type"] ?? "json";
+  const poison = (reason) => ({
+    ...base,
+    contentType: "poison",
+    reason
+  });
+  if (contentType === "bytes") {
+    try {
+      return { ...base, contentType, body: decodeBase64(rawBody) };
+    } catch {
+      return poison("malformed-body");
+    }
+  }
+  if (contentType === "json") {
+    try {
+      return { ...base, contentType, body: decodeJson(rawBody) };
+    } catch {
+      return poison("malformed-body");
+    }
+  }
+  if (contentType === "text") {
+    return { ...base, contentType, body: rawBody };
+  }
+  return poison("unsupported-content-type");
+}
+function parsePullEnvelope(value) {
+  const envelope = asRecord(value, "pull response");
+  if (envelope.success !== true) {
+    throw new CloudflareQueueApiError("Cloudflare Queue pull was not successful", 502);
+  }
+  const result = asRecord(envelope.result, "pull result");
+  const messageBacklogCount = nonNegativeInteger(result.message_backlog_count, "message_backlog_count");
+  if (!Array.isArray(result.messages)) {
+    throw new CloudflareQueueApiError("Cloudflare Queue messages is malformed", 502);
+  }
+  if (result.messages.length > MAX_PULL_BATCH_SIZE) {
+    throw new CloudflareQueueApiError("Cloudflare Queue returned too many messages", 502);
+  }
+  const messages = [];
+  let skippedUnleasedMessageCount = 0;
+  for (const rawMessage of result.messages) {
+    if (rawMessage == null || typeof rawMessage !== "object" || Array.isArray(rawMessage)) {
+      skippedUnleasedMessageCount += 1;
+      continue;
+    }
+    const message = rawMessage;
+    if (typeof message.lease_id !== "string" || !message.lease_id.trim()) {
+      skippedUnleasedMessageCount += 1;
+      continue;
+    }
+    messages.push(decodeMessage(message));
+  }
+  return { messageBacklogCount, messages, skippedUnleasedMessageCount };
+}
+function optionalAckCount(record, key) {
+  if (!(key in record)) return void 0;
+  return nonNegativeInteger(record[key], `ack response ${key}`);
+}
+function ackWarningCount(value) {
+  if (value == null) return 0;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new CloudflareQueueApiError("Cloudflare Queue acknowledgement warnings are malformed", 502);
+  }
+  const warnings = value;
+  if (Object.values(warnings).some((warning) => typeof warning !== "string")) {
+    throw new CloudflareQueueApiError("Cloudflare Queue acknowledgement warnings are malformed", 502);
+  }
+  return Object.keys(warnings).length;
+}
+function parseAckEnvelope(value, expectedAckCount, expectedRetryCount) {
+  const envelope = asRecord(value, "ack response");
+  if (envelope.success !== true) {
+    throw new CloudflareQueueApiError("Cloudflare Queue acknowledgement was not successful", 502);
+  }
+  if (envelope.result == null) return 0;
+  const result = asRecord(envelope.result, "ack result");
+  const ackCount = optionalAckCount(result, "ackCount");
+  const retryCount = optionalAckCount(result, "retryCount");
+  if (ackCount !== void 0 && ackCount !== expectedAckCount || retryCount !== void 0 && retryCount !== expectedRetryCount) {
+    throw new CloudflareQueueApiError("Cloudflare Queue acknowledgement was incomplete", 502);
+  }
+  return ackWarningCount(result.warnings);
+}
+function normalizeRetries(retries) {
+  return (retries ?? []).map((retry) => {
+    const leaseId = required(retry.leaseId, "retry leaseId");
+    if (retry.delaySeconds !== void 0) {
+      nonNegativeInteger(retry.delaySeconds, "retry delaySeconds");
+    }
+    return { leaseId, ...retry.delaySeconds === void 0 ? {} : { delaySeconds: retry.delaySeconds } };
+  });
+}
+async function pullCloudflareQueueMessages(client, options = {}) {
+  const resolved = resolveOptions(client);
+  const body = {};
+  if (options.batchSize !== void 0) body.batch_size = positiveInteger(options.batchSize, "batchSize", MAX_PULL_BATCH_SIZE);
+  if (options.visibilityTimeoutMs !== void 0) {
+    body.visibility_timeout_ms = positiveInteger(
+      options.visibilityTimeoutMs,
+      "visibilityTimeoutMs",
+      MAX_VISIBILITY_TIMEOUT_MS
+    );
+  }
+  return parsePullEnvelope(await postJson(resolved, "pull", body, options.signal));
+}
+async function ackCloudflareQueueMessages(client, options) {
+  const resolved = resolveOptions(client);
+  const acknowledgedLeaseIds = (options.acks ?? []).map((leaseId) => required(leaseId, "ack leaseId"));
+  const retriedLeaseIds = normalizeRetries(options.retries);
+  if (acknowledgedLeaseIds.length === 0 && retriedLeaseIds.length === 0) {
+    throw new CloudflareQueueApiError("at least one acknowledgement or retry is required", 400);
+  }
+  const envelope = await postJson(resolved, "ack", {
+    acks: acknowledgedLeaseIds.map((lease_id) => ({ lease_id })),
+    retries: retriedLeaseIds.map(({ leaseId, delaySeconds }) => ({
+      lease_id: leaseId,
+      ...delaySeconds === void 0 ? {} : { delay_seconds: delaySeconds }
+    }))
+  }, options.signal);
+  const warningCount = parseAckEnvelope(envelope, acknowledgedLeaseIds.length, retriedLeaseIds.length);
+  return { acknowledgedLeaseIds, retriedLeaseIds, warningCount };
+}
+
 // ../api-routes/src/traffic-event-ingest.ts
 import crypto39 from "crypto";
 import { and as and38, eq as eq46, gte as gte10, lt as lt7, lte as lte9, sql as sql18 } from "drizzle-orm";
@@ -52297,6 +52888,11 @@ function writeTrafficEventBatch(opts) {
   let aiUserFetchBucketRows = 0;
   let aiReferralBucketRows = 0;
   let sampleRows = 0;
+  let selfTrafficExcluded = 0;
+  let crawlerHits = 0;
+  let aiUserFetchHits = 0;
+  let aiReferralHits = 0;
+  let unknownHits = 0;
   opts.db.transaction((tx) => {
     tx.update(trafficSources).set({ updatedAt: sql18`${trafficSources.updatedAt}` }).where(eq46(trafficSources.id, opts.sourceId)).run();
     const source = tx.select().from(trafficSources).where(eq46(trafficSources.id, opts.sourceId)).get();
@@ -52319,6 +52915,11 @@ function writeTrafficEventBatch(opts) {
     acceptedEvents = claimedEvents.length;
     if (claimedEvents.length > 0) {
       const report = buildTrafficProbeReport(claimedEvents, { sampleLimit: claimedEvents.length });
+      selfTrafficExcluded = report.totals.selfTrafficExcluded;
+      crawlerHits = report.totals.crawlerHits;
+      aiUserFetchHits = report.totals.aiUserFetchHits;
+      aiReferralHits = report.totals.aiReferralHits;
+      unknownHits = report.totals.unknownHits;
       for (const bucket of report.crawlerEventsHourly) {
         const status = bucket.status ?? 0;
         tx.insert(crawlerEventsHourly).values({
@@ -52477,6 +53078,11 @@ function writeTrafficEventBatch(opts) {
   return {
     acceptedEvents,
     duplicateEvents,
+    selfTrafficExcluded,
+    crawlerHits,
+    aiUserFetchHits,
+    aiReferralHits,
+    unknownHits,
     crawlerBucketRows,
     aiUserFetchBucketRows,
     aiReferralBucketRows,
@@ -52484,6 +53090,46 @@ function writeTrafficEventBatch(opts) {
   };
 }
 
+// ../api-routes/src/traffic-sync-lease.ts
+import { and as and39, eq as eq47, isNull as isNull4, lte as lte10, or as or10 } from "drizzle-orm";
+function leaseExpiresAt(now, ttlMs) {
+  const nowMs = Date.parse(now);
+  if (!Number.isFinite(nowMs)) throw new RangeError("Traffic sync lease now must be an ISO instant");
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) throw new RangeError("Traffic sync lease ttlMs must be positive");
+  return new Date(nowMs + ttlMs).toISOString();
+}
+function tryClaimTrafficSyncLease(input) {
+  const expiresAt = leaseExpiresAt(input.now, input.ttlMs);
+  return input.db.transaction((tx) => {
+    const changed = tx.update(trafficSources).set({
+      syncLeaseOwner: input.owner,
+      syncLeaseExpiresAt: expiresAt,
+      updatedAt: input.now
+    }).where(and39(
+      eq47(trafficSources.id, input.sourceId),
+      or10(
+        isNull4(trafficSources.syncLeaseOwner),
+        lte10(trafficSources.syncLeaseExpiresAt, input.now),
+        eq47(trafficSources.syncLeaseOwner, input.owner)
+      )
+    )).run();
+    return changed.changes === 1;
+  }, { behavior: "immediate" });
+}
+function releaseTrafficSyncLease(input) {
+  return input.db.transaction((tx) => {
+    const changed = tx.update(trafficSources).set({
+      syncLeaseOwner: null,
+      syncLeaseExpiresAt: null,
+      updatedAt: input.now
+    }).where(and39(
+      eq47(trafficSources.id, input.sourceId),
+      eq47(trafficSources.syncLeaseOwner, input.owner)
+    )).run();
+    return changed.changes === 1;
+  }, { behavior: "immediate" });
+}
+
 // ../api-routes/src/traffic.ts
 var DEFAULT_SYNC_WINDOW_MINUTES = 43200;
 var DEFAULT_PAGE_SIZE3 = 1e3;
@@ -52502,6 +53148,9 @@ var BACKFILL_MAX_PAGES = 1e3;
 var BACKFILL_SAMPLE_LIMIT = 500;
 var CLOUDFLARE_WORKER_VERSION = "1.0.0";
 var CLOUDFLARE_INGEST_BODY_LIMIT = 256 * 1024;
+var CLOUDFLARE_QUEUE_RECEIPT_TTL_MS = 14 * 24 * 60 * 6e4 + 10 * 6e4;
+var CLOUDFLARE_QUEUE_VISIBILITY_TIMEOUT_MS = 5 * 6e4;
+var CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS = 5 * 6e4;
 var DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX = 6e3;
 var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
 function sha256Hex3(value) {
@@ -52519,7 +53168,11 @@ function timingSafeEqualHex(a, b) {
 }
 function parseDirectPushCloudflareSourceConfig(config) {
   const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
-  return parsed.success ? parsed.data : null;
+  return parsed.success && parsed.data.deliveryMode === CloudflareTrafficDeliveryModes["direct-push"] ? parsed.data : null;
+}
+function parseQueuePullCloudflareSourceConfig(config) {
+  const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
+  return parsed.success && parsed.data.deliveryMode === CloudflareTrafficDeliveryModes["queue-pull"] ? parsed.data : null;
 }
 function isDirectPushCloudflareDeliveryMode(value) {
   return value === CloudflareTrafficDeliveryModes["direct-push"];
@@ -52536,7 +53189,7 @@ function authenticateCloudflareIngest(request, store) {
   const signature = typeof signatureHeader === "string" ? signatureHeader : "";
   if (!bearerToken || !sourceId || !timestamp || !signature) return null;
   const credential = store.getConnectionBySourceId(sourceId);
-  if (!credential || !isDirectPushCloudflareDeliveryMode(credential.deliveryMode)) return null;
+  if (!credential || credential.deliveryMode !== "direct-push") return null;
   const bearerHash = sha256Hex3(bearerToken);
   if (!timingSafeEqualHex(bearerHash, sha256Hex3(credential.bearerToken))) return null;
   if (!verifyRequestSignature({
@@ -52551,8 +53204,8 @@ function cloudflareIngestRateLimitKey(request, store, db) {
   const authenticated = authenticateCloudflareIngest(request, store);
   const params = request.params;
   if (authenticated && typeof params.name === "string" && authenticated.credential.projectName === params.name) {
-    const source = db.select().from(trafficSources).where(eq47(trafficSources.id, authenticated.credential.sourceId)).get();
-    if (source && source.sourceType === TrafficSourceTypes.cloudflare && source.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(source.configJson) && timingSafeEqualHex(authenticated.bearerHash, source.ingestTokenHash)) {
+    const source = db.select().from(trafficSources).where(eq48(trafficSources.id, authenticated.credential.sourceId)).get();
+    if (source && source.sourceType === TrafficSourceTypes.cloudflare && source.status === TrafficSourceStatuses.connected && parseDirectPushCloudflareSourceConfig(source.configJson) && timingSafeEqualHex(authenticated.bearerHash, source.ingestTokenHash)) {
       return `cloudflare-source:${authenticated.credential.sourceId}`;
     }
   }
@@ -52663,6 +53316,8 @@ function rowToDto(row) {
     lastCursor: row.lastCursor ?? null,
     lastError: row.lastError ?? null,
     skippedThroughAt: row.skippedThroughAt ?? null,
+    queueBacklogCount: row.queueBacklogCount ?? null,
+    queueBacklogObservedAt: row.queueBacklogObservedAt ?? null,
     archivedAt: row.archivedAt ?? null,
     config: parseSourceConfig(row),
     createdAt: row.createdAt,
@@ -52680,6 +53335,44 @@ async function defaultResolveAccessToken(record) {
     "OAuth-mode Cloud Run sync is not yet supported in v1. Provide a service-account key file."
   );
 }
+function hasConnectedTrafficSourceSibling(db, projectId, sourceId) {
+  return db.select().from(trafficSources).where(eq48(trafficSources.projectId, projectId)).all().some((row) => row.id !== sourceId && row.status === TrafficSourceStatuses.connected);
+}
+function isAuthoritativeTrafficSource(db, source) {
+  return (source.status === TrafficSourceStatuses.connected || source.status === TrafficSourceStatuses.error) && !hasConnectedTrafficSourceSibling(db, source.projectId, source.id);
+}
+function trafficConnectStatus(tx, projectId, existingSource) {
+  return existingSource?.status === TrafficSourceStatuses.paused || hasConnectedTrafficSourceSibling(tx, projectId, existingSource?.id ?? "") ? TrafficSourceStatuses.paused : TrafficSourceStatuses.connected;
+}
+function isSameTrafficSourceGeneration(current, started) {
+  return isDeepStrictEqual(current.configJson, started.configJson) && current.updatedAt === started.updatedAt && current.lastSyncedAt === started.lastSyncedAt;
+}
+function bindTrafficSyncSchedule(tx, projectId, sourceId, now, createIfMissing = true) {
+  const schedule = tx.select().from(schedules).where(and40(
+    eq48(schedules.projectId, projectId),
+    eq48(schedules.kind, SchedulableRunKinds["traffic-sync"])
+  )).get();
+  if (schedule) {
+    if (schedule.sourceId === sourceId) return { changed: false, created: false };
+    tx.update(schedules).set({ sourceId, updatedAt: now }).where(eq48(schedules.id, schedule.id)).run();
+    return { changed: true, created: false };
+  }
+  if (!createIfMissing) return { changed: false, created: false };
+  tx.insert(schedules).values({
+    id: crypto40.randomUUID(),
+    projectId,
+    kind: SchedulableRunKinds["traffic-sync"],
+    cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
+    preset: null,
+    timezone: "UTC",
+    enabled: true,
+    providers: [],
+    sourceId,
+    createdAt: now,
+    updatedAt: now
+  }).run();
+  return { changed: true, created: true };
+}
 function vercelRetentionClampError(requestedStartMs, effectiveStartMs) {
   return new Error(
     `Vercel request-logs retention starts at ${new Date(effectiveStartMs).toISOString()}, after requested start ${new Date(requestedStartMs).toISOString()}; refusing to advance because historical traffic would be skipped`
@@ -52700,8 +53393,11 @@ async function runBackfillTask(options) {
     const failedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq48(runs.id, runId)).run();
+        const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+        if (latestSource && isAuthoritativeTrafficSource(tx, latestSource) && isSameTrafficSourceGeneration(latestSource, sourceRow2)) {
+          tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq48(trafficSources.id, sourceRow2.id)).run();
+        }
       });
     } catch {
     }
@@ -52716,7 +53412,15 @@ async function runBackfillTask(options) {
   if (allEvents.length === 0) {
     const finishedAt2 = (/* @__PURE__ */ new Date()).toISOString();
     try {
-      app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: finishedAt2 }).where(eq47(runs.id, runId)).run();
+      app.db.transaction((tx) => {
+        const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+        const stillAuthoritative = latestSource && isAuthoritativeTrafficSource(tx, latestSource) && isSameTrafficSourceGeneration(latestSource, sourceRow2);
+        tx.update(runs).set(stillAuthoritative ? { status: RunStatuses.completed, finishedAt: finishedAt2 } : {
+          status: RunStatuses.failed,
+          error: "Traffic source was deactivated or reconfigured during backfill",
+          finishedAt: finishedAt2
+        }).where(eq48(runs.id, runId)).run();
+      });
     } catch {
     }
     return;
@@ -52736,33 +53440,42 @@ async function runBackfillTask(options) {
   const currentLastSyncedMs = sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY;
   const nextLastSyncedAt = Math.max(currentLastSyncedMs, windowEnd.getTime()) === windowEnd.getTime() ? windowEndIso : sourceRow2.lastSyncedAt;
   try {
-    app.db.transaction((tx) => {
+    const commitOutcome = app.db.transaction((tx) => {
+      const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+      if (!latestSource || !isAuthoritativeTrafficSource(tx, latestSource) || !isSameTrafficSourceGeneration(latestSource, sourceRow2)) {
+        tx.update(runs).set({
+          status: RunStatuses.failed,
+          error: "Traffic source was deactivated or reconfigured during backfill",
+          finishedAt
+        }).where(eq48(runs.id, runId)).run();
+        return "source-inactive";
+      }
       tx.delete(crawlerEventsHourly).where(
-        and39(
-          eq47(crawlerEventsHourly.sourceId, sourceRow2.id),
+        and40(
+          eq48(crawlerEventsHourly.sourceId, sourceRow2.id),
           gte11(crawlerEventsHourly.tsHour, windowStartIso),
-          lte10(crawlerEventsHourly.tsHour, windowEndIso)
+          lte11(crawlerEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiUserFetchEventsHourly).where(
-        and39(
-          eq47(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
+        and40(
+          eq48(aiUserFetchEventsHourly.sourceId, sourceRow2.id),
           gte11(aiUserFetchEventsHourly.tsHour, windowStartIso),
-          lte10(aiUserFetchEventsHourly.tsHour, windowEndIso)
+          lte11(aiUserFetchEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(aiReferralEventsHourly).where(
-        and39(
-          eq47(aiReferralEventsHourly.sourceId, sourceRow2.id),
+        and40(
+          eq48(aiReferralEventsHourly.sourceId, sourceRow2.id),
           gte11(aiReferralEventsHourly.tsHour, windowStartIso),
-          lte10(aiReferralEventsHourly.tsHour, windowEndIso)
+          lte11(aiReferralEventsHourly.tsHour, windowEndIso)
         )
       ).run();
       tx.delete(rawEventSamples).where(
-        and39(
-          eq47(rawEventSamples.sourceId, sourceRow2.id),
+        and40(
+          eq48(rawEventSamples.sourceId, sourceRow2.id),
           gte11(rawEventSamples.ts, windowStartIso),
-          lte10(rawEventSamples.ts, windowEndIso)
+          lte11(rawEventSamples.ts, windowEndIso)
         )
       ).run();
       for (const bucket of report.crawlerEventsHourly) {
@@ -52854,9 +53567,11 @@ async function runBackfillTask(options) {
         lastEventIds: newRingBuffer,
         ...skipRecovered ? { skippedThroughAt: null } : {},
         updatedAt: finishedAt
-      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
+      }).where(eq48(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq48(runs.id, runId)).run();
+      return "committed";
     });
+    if (commitOutcome === "source-inactive") return;
   } catch (e) {
     markFailed(`Backfill rollup write failed: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -52866,6 +53581,12 @@ async function trafficRoutes(app, opts) {
   const resolveAccessToken2 = opts.resolveCloudRunAccessToken ?? defaultResolveAccessToken;
   const pullWordpressEvents = opts.pullWordpressTrafficEvents ?? listWordpressTrafficEvents;
   const pullVercelEvents = opts.pullVercelTrafficEvents ?? listVercelTrafficEvents;
+  const pullQueueMessages = opts.pullCloudflareQueueMessages ?? pullCloudflareQueueMessages;
+  const ackQueueMessages = opts.ackCloudflareQueueMessages ?? ackCloudflareQueueMessages;
+  const cloudflareQueueMaxBatches = opts.cloudflareQueueMaxBatches ?? DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES;
+  if (!Number.isInteger(cloudflareQueueMaxBatches) || cloudflareQueueMaxBatches < 1 || cloudflareQueueMaxBatches > 50) {
+    throw new RangeError("cloudflareQueueMaxBatches must be an integer from 1 to 50");
+  }
   const allowLoopback = opts.allowLoopbackWebhooks === true;
   async function assertWordpressTargetAllowed(baseUrl) {
     const check2 = await resolveWebhookTarget(baseUrl, { allowLoopback });
@@ -52905,6 +53626,45 @@ async function trafficRoutes(app, opts) {
     timeWindow: "1 minute",
     keyGenerator: (request) => cloudflareIngestRateLimitKey(request, opts.cloudflareTrafficCredentialStore, app.db)
   });
+  function validateTrafficSourceCredential(source, projectName) {
+    if (source.sourceType === TrafficSourceTypes.cloudflare) {
+      const config = cloudflareTrafficSourceConfigSchema.safeParse(source.configJson);
+      if (!config.success) throw validationError("Cloudflare source configuration is invalid");
+      const credential = opts.cloudflareTrafficCredentialStore?.getConnectionBySourceId(source.id);
+      if (config.data.deliveryMode === CloudflareTrafficDeliveryModes["queue-pull"]) {
+        if (!credential || credential.deliveryMode !== "queue-pull" || credential.projectName !== projectName || typeof credential.apiToken !== "string" || credential.apiToken.trim().length === 0 || credential.accountId !== config.data.accountId || credential.queueId !== config.data.queueId || credential.queueName !== config.data.queueName || credential.retentionSeconds !== config.data.retentionSeconds) {
+          throw validationError("Cloudflare Queue credential is not configured for this source");
+        }
+        return { usesPullSchedule: true };
+      }
+      if (!credential || credential.deliveryMode !== "direct-push" || credential.projectName !== projectName || !credential.bearerToken || !credential.hmacSecret || !source.ingestTokenHash || !timingSafeEqualHex(sha256Hex3(credential.bearerToken), source.ingestTokenHash)) {
+        throw validationError("Cloudflare direct-push credential is not configured for this source");
+      }
+      return { usesPullSchedule: false };
+    }
+    if (source.sourceType === TrafficSourceTypes["cloud-run"]) {
+      const credential = opts.cloudRunCredentialStore?.getConnection(projectName);
+      if (!credential || credential.authMode !== TrafficSourceAuthModes["service-account"] || !credential.clientEmail?.trim() || !credential.privateKey?.trim() || credential.gcpProjectId !== source.configJson.gcpProjectId || source.configJson.authMode !== TrafficSourceAuthModes["service-account"] || (credential.serviceName ?? null) !== (source.configJson.serviceName ?? null) || (credential.location ?? null) !== (source.configJson.location ?? null)) {
+        throw validationError("Cloud Run credential is not configured for this source");
+      }
+      return { usesPullSchedule: true };
+    }
+    if (source.sourceType === TrafficSourceTypes.wordpress) {
+      const credential = opts.wordpressTrafficCredentialStore?.getConnection(projectName);
+      if (!credential || typeof credential.applicationPassword !== "string" || !credential.applicationPassword.trim() || credential.baseUrl !== source.configJson.baseUrl || credential.username !== source.configJson.username) {
+        throw validationError("WordPress traffic credential is not configured for this source");
+      }
+      return { usesPullSchedule: true };
+    }
+    if (source.sourceType === TrafficSourceTypes.vercel) {
+      const credential = opts.vercelTrafficCredentialStore?.getConnection(projectName);
+      if (!credential || typeof credential.token !== "string" || !credential.token.trim() || credential.projectId !== source.configJson.projectId || credential.teamId !== source.configJson.teamId || credential.environment !== source.configJson.environment) {
+        throw validationError("Vercel traffic credential is not configured for this source");
+      }
+      return { usesPullSchedule: true };
+    }
+    throw validationError(`Traffic source type "${source.sourceType}" cannot be activated`);
+  }
   app.post("/projects/:name/traffic/connect/cloud-run", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const body = request.body ?? {};
@@ -52942,7 +53702,6 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
     const config = {
       gcpProjectId,
       serviceName: serviceName ?? null,
@@ -52950,41 +53709,50 @@ async function trafficRoutes(app, opts) {
       authMode: TrafficSourceAuthModes["service-account"]
     };
     const fallbackName = displayName ?? `Cloud Run \xB7 ${gcpProjectId}${serviceName ? ` / ${serviceName}` : ""}`;
-    let sourceRow2;
-    if (activeSource) {
-      app.db.update(trafficSources).set({
-        displayName: fallbackName,
-        status: TrafficSourceStatuses.connected,
-        lastError: null,
-        configJson: config,
-        updatedAt: now
-      }).where(eq47(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
-    } else {
-      const newId = crypto40.randomUUID();
-      app.db.insert(trafficSources).values({
-        id: newId,
+    const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
+      const activeSource = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
+      const sourceId = activeSource?.id ?? crypto40.randomUUID();
+      const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
+      if (activeSource) {
+        tx.update(trafficSources).set({
+          displayName: fallbackName,
+          status: sourceStatus,
+          lastError: null,
+          configJson: config,
+          updatedAt: now
+        }).where(eq48(trafficSources.id, sourceId)).run();
+      } else {
+        tx.insert(trafficSources).values({
+          id: sourceId,
+          projectId: project.id,
+          sourceType: TrafficSourceTypes["cloud-run"],
+          displayName: fallbackName,
+          status: sourceStatus,
+          lastSyncedAt: null,
+          lastCursor: null,
+          lastError: null,
+          archivedAt: null,
+          configJson: config,
+          createdAt: now,
+          updatedAt: now
+        }).run();
+      }
+      const scheduleBinding = sourceStatus === TrafficSourceStatuses.connected ? bindTrafficSyncSchedule(tx, project.id, sourceId, now, false) : { changed: false, created: false };
+      writeAuditLog(tx, {
         projectId: project.id,
-        sourceType: TrafficSourceTypes["cloud-run"],
-        displayName: fallbackName,
-        status: TrafficSourceStatuses.connected,
-        lastSyncedAt: null,
-        lastCursor: null,
-        lastError: null,
-        archivedAt: null,
-        configJson: config,
-        createdAt: now,
-        updatedAt: now
-      }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
+        actor: "api",
+        action: "traffic.cloud-run.connected",
+        entityType: "traffic_source",
+        entityId: sourceId
+      });
+      return {
+        sourceRow: tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceId)).get(),
+        scheduleChanged: scheduleBinding.changed
+      };
+    }, { behavior: "immediate" });
+    if (scheduleChanged) {
+      opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
-    writeAuditLog(app.db, {
-      projectId: project.id,
-      actor: "api",
-      action: "traffic.cloud-run.connected",
-      entityType: "traffic_source",
-      entityId: sourceRow2.id
-    });
     return rowToDto(sourceRow2);
   });
   app.post("/projects/:name/traffic/connect/wordpress", async (request) => {
@@ -53028,44 +53796,52 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
     const config = { baseUrl, username };
     const fallbackName = displayName ?? `WordPress \xB7 ${new URL(baseUrl).host}`;
-    let sourceRow2;
-    if (activeSource) {
-      app.db.update(trafficSources).set({
-        displayName: fallbackName,
-        status: TrafficSourceStatuses.connected,
-        lastError: null,
-        configJson: config,
-        updatedAt: now
-      }).where(eq47(trafficSources.id, activeSource.id)).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
-    } else {
-      const newId = crypto40.randomUUID();
-      app.db.insert(trafficSources).values({
-        id: newId,
+    const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
+      const activeSource = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
+      const sourceId = activeSource?.id ?? crypto40.randomUUID();
+      const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
+      if (activeSource) {
+        tx.update(trafficSources).set({
+          displayName: fallbackName,
+          status: sourceStatus,
+          lastError: null,
+          configJson: config,
+          updatedAt: now
+        }).where(eq48(trafficSources.id, sourceId)).run();
+      } else {
+        tx.insert(trafficSources).values({
+          id: sourceId,
+          projectId: project.id,
+          sourceType: TrafficSourceTypes.wordpress,
+          displayName: fallbackName,
+          status: sourceStatus,
+          lastSyncedAt: null,
+          lastCursor: null,
+          lastError: null,
+          archivedAt: null,
+          configJson: config,
+          createdAt: now,
+          updatedAt: now
+        }).run();
+      }
+      const scheduleBinding = sourceStatus === TrafficSourceStatuses.connected ? bindTrafficSyncSchedule(tx, project.id, sourceId, now, false) : { changed: false, created: false };
+      writeAuditLog(tx, {
         projectId: project.id,
-        sourceType: TrafficSourceTypes.wordpress,
-        displayName: fallbackName,
-        status: TrafficSourceStatuses.connected,
-        lastSyncedAt: null,
-        lastCursor: null,
-        lastError: null,
-        archivedAt: null,
-        configJson: config,
-        createdAt: now,
-        updatedAt: now
-      }).run();
-      sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
+        actor: "api",
+        action: "traffic.wordpress.connected",
+        entityType: "traffic_source",
+        entityId: sourceId
+      });
+      return {
+        sourceRow: tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceId)).get(),
+        scheduleChanged: scheduleBinding.changed
+      };
+    }, { behavior: "immediate" });
+    if (scheduleChanged) {
+      opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
-    writeAuditLog(app.db, {
-      projectId: project.id,
-      actor: "api",
-      action: "traffic.wordpress.connected",
-      entityType: "traffic_source",
-      entityId: sourceRow2.id
-    });
     return rowToDto(sourceRow2);
   });
   app.post("/projects/:name/traffic/connect/vercel", async (request) => {
@@ -53111,20 +53887,21 @@ async function trafficRoutes(app, opts) {
       createdAt: existing?.createdAt ?? now,
       updatedAt: now
     });
-    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.vercel && row.status !== TrafficSourceStatuses.archived);
     const config = { projectId, teamId, environment };
     const fallbackName = displayName ?? `Vercel \xB7 ${projectId}`;
-    const { sourceRow: sourceRow2, scheduleCreated } = app.db.transaction((tx) => {
+    const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
+      const activeSource = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row2) => row2.sourceType === TrafficSourceTypes.vercel && row2.status !== TrafficSourceStatuses.archived);
+      const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
       let row;
       if (activeSource) {
         tx.update(trafficSources).set({
           displayName: fallbackName,
-          status: TrafficSourceStatuses.connected,
+          status: sourceStatus,
           lastError: null,
           configJson: config,
           updatedAt: now
-        }).where(eq47(trafficSources.id, activeSource.id)).run();
-        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
+        }).where(eq48(trafficSources.id, activeSource.id)).run();
+        row = tx.select().from(trafficSources).where(eq48(trafficSources.id, activeSource.id)).get();
       } else {
         const newId = crypto40.randomUUID();
         tx.insert(trafficSources).values({
@@ -53132,7 +53909,7 @@ async function trafficRoutes(app, opts) {
           projectId: project.id,
           sourceType: TrafficSourceTypes.vercel,
           displayName: fallbackName,
-          status: TrafficSourceStatuses.connected,
+          status: sourceStatus,
           // Seed lastSyncedAt to NOW so the first sync uses a tight window.
           // Leaving this null would make the first sync fall back to
           // DEFAULT_SYNC_WINDOW_MINUTES (30 days) — which exceeds Vercel's
@@ -53149,31 +53926,9 @@ async function trafficRoutes(app, opts) {
           createdAt: now,
           updatedAt: now
         }).run();
-        row = tx.select().from(trafficSources).where(eq47(trafficSources.id, newId)).get();
-      }
-      const existingSchedule = tx.select().from(schedules).where(
-        and39(
-          eq47(schedules.projectId, project.id),
-          eq47(schedules.kind, SchedulableRunKinds["traffic-sync"])
-        )
-      ).get();
-      let created = false;
-      if (!existingSchedule) {
-        tx.insert(schedules).values({
-          id: crypto40.randomUUID(),
-          projectId: project.id,
-          kind: SchedulableRunKinds["traffic-sync"],
-          cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
-          preset: null,
-          timezone: "UTC",
-          enabled: true,
-          providers: [],
-          sourceId: row.id,
-          createdAt: now,
-          updatedAt: now
-        }).run();
-        created = true;
+        row = tx.select().from(trafficSources).where(eq48(trafficSources.id, newId)).get();
       }
+      const scheduleBinding = sourceStatus === TrafficSourceStatuses.connected ? bindTrafficSyncSchedule(tx, project.id, row.id, now) : { changed: false, created: false };
       writeAuditLog(tx, {
         projectId: project.id,
         actor: "api",
@@ -53181,7 +53936,7 @@ async function trafficRoutes(app, opts) {
         entityType: "traffic_source",
         entityId: row.id
       });
-      if (created) {
+      if (scheduleBinding.created) {
         writeAuditLog(tx, {
           projectId: project.id,
           actor: "api",
@@ -53194,9 +53949,9 @@ async function trafficRoutes(app, opts) {
           }
         });
       }
-      return { sourceRow: row, scheduleCreated: created };
-    });
-    if (scheduleCreated) {
+      return { sourceRow: row, scheduleChanged: scheduleBinding.changed };
+    }, { behavior: "immediate" });
+    if (scheduleChanged) {
       opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
     return rowToDto(sourceRow2);
@@ -53206,27 +53961,159 @@ async function trafficRoutes(app, opts) {
     if (!opts.cloudflareTrafficCredentialStore) {
       throw validationError("Cloudflare traffic credential storage is not configured for this deployment");
     }
-    if (!opts.cloudflareTrafficIngestUrl) {
-      throw validationError("Cloudflare ingest URL is not configured for this deployment");
-    }
     const credentialStore = opts.cloudflareTrafficCredentialStore;
     const parsed = trafficConnectCloudflareRequestSchema.safeParse(request.body ?? {});
     if (!parsed.success) {
       throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
     }
+    if (parsed.data.deliveryMode === CloudflareTrafficDeliveryModes["queue-pull"]) {
+      const { displayName: displayName2, zoneId: zoneId2, accountId: accountId2, queueId, queueName, retentionSeconds, apiToken } = parsed.data;
+      const workerRouteHost2 = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+      const now2 = (/* @__PURE__ */ new Date()).toISOString();
+      const cloudflareSources = app.db.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().filter((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived);
+      const sameModeSource = cloudflareSources.find((row) => parseQueuePullCloudflareSourceConfig(row.configJson));
+      const sourceId2 = sameModeSource?.id ?? crypto40.randomUUID();
+      const previousCredential2 = credentialStore.getConnectionBySourceId(sourceId2);
+      const workerVersion2 = CLOUDFLARE_WORKER_VERSION;
+      const workerScript2 = generateWorkerScript({
+        deliveryMode: "queue-pull",
+        workerVersion: workerVersion2,
+        botList: DEFAULT_BOT_LIST
+      });
+      const wranglerToml2 = generateWranglerToml({
+        deliveryMode: "queue-pull",
+        sourceId: sourceId2,
+        hostname: workerRouteHost2,
+        workerVersion: workerVersion2,
+        queueName,
+        zoneId: zoneId2 ?? null,
+        accountId: accountId2
+      });
+      const config2 = {
+        schemaVersion: 1,
+        deliveryMode: "queue-pull",
+        workerVersion: workerVersion2,
+        expectedBotListVersion: DEFAULT_BOT_LIST.version,
+        zoneId: zoneId2 ?? null,
+        accountId: accountId2,
+        queueId,
+        queueName,
+        retentionSeconds
+      };
+      const nextCredential = {
+        projectName: project.name,
+        sourceId: sourceId2,
+        deliveryMode: "queue-pull",
+        apiToken,
+        accountId: accountId2,
+        queueId,
+        queueName,
+        retentionSeconds,
+        workerVersion: workerVersion2,
+        expectedBotListVersion: DEFAULT_BOT_LIST.version,
+        zoneId: zoneId2 ?? null,
+        createdAt: previousCredential2?.createdAt ?? now2,
+        updatedAt: now2
+      };
+      credentialStore.upsertConnection(nextCredential);
+      let sourceRow3;
+      let scheduleChanged = false;
+      try {
+        const result = app.db.transaction((tx) => {
+          const currentSameModeSource = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived && parseQueuePullCloudflareSourceConfig(row.configJson) !== null);
+          if ((currentSameModeSource?.id ?? null) !== (sameModeSource?.id ?? null)) {
+            throw operationInProgress("Cloudflare Queue source changed during connect; retry");
+          }
+          const status = trafficConnectStatus(tx, project.id, currentSameModeSource);
+          if (currentSameModeSource) {
+            const queueConfigChanged = !isDeepStrictEqual(currentSameModeSource.configJson, config2);
+            tx.update(trafficSources).set({
+              displayName: displayName2 ?? currentSameModeSource.displayName,
+              status,
+              lastError: null,
+              configJson: config2,
+              ingestTokenHash: null,
+              ...queueConfigChanged ? {
+                queueBacklogCount: null,
+                queueBacklogObservedAt: null
+              } : {},
+              updatedAt: now2
+            }).where(eq48(trafficSources.id, sourceId2)).run();
+          } else {
+            tx.insert(trafficSources).values({
+              id: sourceId2,
+              projectId: project.id,
+              sourceType: TrafficSourceTypes.cloudflare,
+              displayName: displayName2 ?? `Cloudflare Queue \xB7 ${queueName}`,
+              status,
+              lastSyncedAt: null,
+              lastCursor: null,
+              lastError: null,
+              archivedAt: null,
+              configJson: config2,
+              ingestTokenHash: null,
+              createdAt: now2,
+              updatedAt: now2
+            }).run();
+          }
+          const changed = status === TrafficSourceStatuses.connected ? bindTrafficSyncSchedule(tx, project.id, sourceId2, now2).changed : false;
+          return {
+            row: tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceId2)).get(),
+            scheduleChanged: changed
+          };
+        }, { behavior: "immediate" });
+        sourceRow3 = result.row;
+        scheduleChanged = result.scheduleChanged;
+      } catch (error) {
+        if (previousCredential2) credentialStore.upsertConnection(previousCredential2);
+        else credentialStore.deleteConnectionBySourceId?.(sourceId2);
+        throw error;
+      }
+      writeAuditLog(app.db, {
+        projectId: project.id,
+        actor: "api",
+        action: "traffic.cloudflare.queue-connected",
+        entityType: "traffic_source",
+        entityId: sourceId2
+      });
+      if (scheduleChanged) {
+        opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
+      }
+      return {
+        sourceId: sourceId2,
+        deliveryMode: "queue-pull",
+        activationRequired: sourceRow3.status !== TrafficSourceStatuses.connected,
+        accountId: accountId2,
+        queueId,
+        queueName,
+        retentionSeconds,
+        workerScript: workerScript2,
+        wranglerToml: wranglerToml2,
+        workerVersion: workerVersion2,
+        instructions: [
+          "Deploy this Worker to your Cloudflare zone:",
+          "  1. Save worker.js and wrangler.toml; neither file contains Queue credentials",
+          `  2. Enable the Queue HTTP pull consumer: wrangler queues consumer http add ${queueName}`,
+          `  3. Attach ${workerRouteHost2}/* in the Cloudflare Dashboard with Fail open`,
+          `  4. Canonry pulls Queue ${queueName}; activate this source after the route is live.`,
+          `Source id: ${sourceRow3.id}`
+        ].join("\n")
+      };
+    }
+    if (!opts.cloudflareTrafficIngestUrl) {
+      throw validationError("Cloudflare ingest URL is not configured for this deployment");
+    }
     const { deliveryMode, displayName, zoneId, accountId } = parsed.data;
     const workerRouteHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const activeSource = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).all().find(
-      (row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived
-    );
+    const activeSource = app.db.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(row.configJson) !== null);
     const sourceId = activeSource?.id ?? crypto40.randomUUID();
     const parsedActiveConfig = activeSource ? parseDirectPushCloudflareSourceConfig(activeSource.configJson) : null;
     if (activeSource && !parsedActiveConfig) {
       throw validationError("Existing Cloudflare source is not configured for direct-push delivery");
     }
-    const previousCredential = credentialStore.getConnection(project.name);
-    if (previousCredential && !isDirectPushCloudflareDeliveryMode(previousCredential.deliveryMode)) {
+    const previousCredential = activeSource ? credentialStore.getConnectionBySourceId(activeSource.id) : void 0;
+    if (previousCredential && previousCredential.deliveryMode !== "direct-push") {
       throw validationError(
         `Cloudflare credential delivery mode "${previousCredential.deliveryMode}" does not match "${deliveryMode}"`
       );
@@ -53280,44 +54167,67 @@ async function trafficRoutes(app, opts) {
       updatedAt: now
     });
     let sourceRow2;
+    let scheduleRemoved = false;
     try {
-      if (activeSource) {
-        app.db.update(trafficSources).set({
-          displayName: fallbackName,
-          status: TrafficSourceStatuses.connected,
-          lastError: null,
-          configJson: config,
-          ingestTokenHash,
-          updatedAt: now
-        }).where(eq47(trafficSources.id, activeSource.id)).run();
-        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, activeSource.id)).get();
-      } else {
-        app.db.insert(trafficSources).values({
-          id: sourceId,
-          projectId: project.id,
-          sourceType: TrafficSourceTypes.cloudflare,
-          displayName: fallbackName,
-          status: TrafficSourceStatuses.connected,
-          // Seed `lastSyncedAt` to NOW so the `traffic.source.recent-data`
-          // doctor check has a non-null baseline. Successful ingest advances
-          // it as the receiver's last-activity timestamp.
-          lastSyncedAt: now,
-          lastCursor: null,
-          lastError: null,
-          archivedAt: null,
-          configJson: config,
-          ingestTokenHash,
-          createdAt: now,
-          updatedAt: now
-        }).run();
-        sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
-      }
+      const result = app.db.transaction((tx) => {
+        const currentActiveSource = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().find((row2) => row2.sourceType === TrafficSourceTypes.cloudflare && row2.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(row2.configJson) !== null);
+        if ((currentActiveSource?.id ?? null) !== (activeSource?.id ?? null)) {
+          throw operationInProgress("Cloudflare direct-push source changed during connect; retry");
+        }
+        const sourceStatus = trafficConnectStatus(tx, project.id, currentActiveSource);
+        let row;
+        if (currentActiveSource) {
+          tx.update(trafficSources).set({
+            displayName: fallbackName,
+            status: sourceStatus,
+            lastError: null,
+            configJson: config,
+            ingestTokenHash,
+            updatedAt: now
+          }).where(eq48(trafficSources.id, currentActiveSource.id)).run();
+          row = tx.select().from(trafficSources).where(eq48(trafficSources.id, currentActiveSource.id)).get();
+        } else {
+          tx.insert(trafficSources).values({
+            id: sourceId,
+            projectId: project.id,
+            sourceType: TrafficSourceTypes.cloudflare,
+            displayName: fallbackName,
+            status: sourceStatus,
+            // Seed `lastSyncedAt` to NOW so the `traffic.source.recent-data`
+            // doctor check has a non-null baseline. Successful ingest advances
+            // it as the receiver's last-activity timestamp.
+            lastSyncedAt: now,
+            lastCursor: null,
+            lastError: null,
+            archivedAt: null,
+            configJson: config,
+            ingestTokenHash,
+            createdAt: now,
+            updatedAt: now
+          }).run();
+          row = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceId)).get();
+        }
+        let removed = false;
+        if (row.status === TrafficSourceStatuses.connected) {
+          const schedule = tx.select().from(schedules).where(and40(
+            eq48(schedules.projectId, project.id),
+            eq48(schedules.kind, SchedulableRunKinds["traffic-sync"])
+          )).get();
+          if (schedule) {
+            tx.delete(schedules).where(eq48(schedules.id, schedule.id)).run();
+            removed = true;
+          }
+        }
+        return { row, scheduleRemoved: removed };
+      }, { behavior: "immediate" });
+      sourceRow2 = result.row;
+      scheduleRemoved = result.scheduleRemoved;
     } catch (err) {
       try {
         if (previousCredential) {
           credentialStore.upsertConnection(previousCredential);
         } else {
-          credentialStore.deleteConnection(project.name);
+          credentialStore.deleteConnectionBySourceId?.(sourceId);
         }
       } catch {
       }
@@ -53330,6 +54240,9 @@ async function trafficRoutes(app, opts) {
       entityType: "traffic_source",
       entityId: sourceRow2.id
     });
+    if (scheduleRemoved) {
+      opts.onScheduleUpdated?.("delete", project.id, SchedulableRunKinds["traffic-sync"]);
+    }
     const routeInstruction = effectiveZoneId ? `  4. Deploy with \`wrangler deploy\`; wrangler.toml records zone ${effectiveZoneId} but does not claim a route` : "  4. Deploy with `wrangler deploy`; wrangler.toml intentionally does not claim a route";
     const instructions = [
       "Deploy this Worker to your Cloudflare zone:",
@@ -53347,12 +54260,65 @@ async function trafficRoutes(app, opts) {
     return {
       sourceId: sourceRow2.id,
       deliveryMode,
+      activationRequired: sourceRow2.status !== TrafficSourceStatuses.connected,
       workerScript,
       wranglerToml,
       workerVersion,
       instructions
     };
   });
+  app.post("/projects/:name/traffic/sources/:id/activate", async (request) => {
+    const project = resolveProject(app.db, request.params.name);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = app.db.transaction((tx) => {
+      const target = tx.select().from(trafficSources).where(eq48(trafficSources.id, request.params.id)).get();
+      if (!target || target.projectId !== project.id || target.status === TrafficSourceStatuses.archived) {
+        throw notFound("Traffic source", request.params.id);
+      }
+      const { usesPullSchedule } = validateTrafficSourceCredential(target, project.name);
+      const siblings = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all();
+      for (const sibling of siblings) {
+        if (sibling.id === target.id || sibling.status === TrafficSourceStatuses.archived) continue;
+        tx.update(trafficSources).set({
+          status: TrafficSourceStatuses.paused,
+          updatedAt: now
+        }).where(eq48(trafficSources.id, sibling.id)).run();
+      }
+      tx.update(trafficSources).set({
+        status: TrafficSourceStatuses.connected,
+        lastError: null,
+        archivedAt: null,
+        updatedAt: now
+      }).where(eq48(trafficSources.id, target.id)).run();
+      let scheduleAction = null;
+      if (usesPullSchedule) {
+        bindTrafficSyncSchedule(tx, project.id, target.id, now);
+        scheduleAction = "upsert";
+      } else {
+        const schedule = tx.select().from(schedules).where(and40(
+          eq48(schedules.projectId, project.id),
+          eq48(schedules.kind, SchedulableRunKinds["traffic-sync"])
+        )).get();
+        if (schedule) {
+          tx.delete(schedules).where(eq48(schedules.id, schedule.id)).run();
+          scheduleAction = "delete";
+        }
+      }
+      const source = tx.select().from(trafficSources).where(eq48(trafficSources.id, target.id)).get();
+      writeAuditLog(tx, {
+        projectId: project.id,
+        actor: "api",
+        action: "traffic.source.activated",
+        entityType: "traffic_source",
+        entityId: target.id
+      });
+      return { source, scheduleAction };
+    });
+    if (result.scheduleAction) {
+      opts.onScheduleUpdated?.(result.scheduleAction, project.id, SchedulableRunKinds["traffic-sync"]);
+    }
+    return rowToDto(result.source);
+  });
   app.post("/projects/:name/traffic/cloudflare/ingest", {
     bodyLimit: CLOUDFLARE_INGEST_BODY_LIMIT,
     preHandler: async (request, reply) => {
@@ -53390,8 +54356,8 @@ async function trafficRoutes(app, opts) {
     }
     const { bearerHash, credential } = authenticated;
     const sourceId = credential.sourceId;
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, sourceId)).get();
-    if (!sourceRow2 || sourceRow2.sourceType !== TrafficSourceTypes.cloudflare || sourceRow2.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(sourceRow2.configJson) || !timingSafeEqualHex(bearerHash, sourceRow2.ingestTokenHash)) {
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq48(trafficSources.id, sourceId)).get();
+    if (!sourceRow2 || sourceRow2.sourceType !== TrafficSourceTypes.cloudflare || sourceRow2.status !== TrafficSourceStatuses.connected || !parseDirectPushCloudflareSourceConfig(sourceRow2.configJson) || !timingSafeEqualHex(bearerHash, sourceRow2.ingestTokenHash)) {
       throw authRequired();
     }
     const project = resolveProject(app.db, request.params.name);
@@ -53427,7 +54393,7 @@ async function trafficRoutes(app, opts) {
       receiptTtlMs: DIRECT_PUSH_RECEIPT_TTL_MS,
       sampleLimit,
       validateSource: (latestRow) => {
-        if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status === TrafficSourceStatuses.archived || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
+        if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status !== TrafficSourceStatuses.connected || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
           throw authRequired();
         }
       },
@@ -53450,15 +54416,259 @@ async function trafficRoutes(app, opts) {
   });
   app.post("/projects/:name/traffic/sources/:id/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq48(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
+    const queueConfig = sourceRow2.sourceType === TrafficSourceTypes.cloudflare ? parseQueuePullCloudflareSourceConfig(sourceRow2.configJson) : null;
+    if (queueConfig) {
+      if (sourceRow2.status !== TrafficSourceStatuses.connected) {
+        throw validationError("Cloudflare Queue source must be active before it can sync");
+      }
+      const credential = opts.cloudflareTrafficCredentialStore?.getConnectionBySourceId(sourceRow2.id);
+      if (!credential || credential.deliveryMode !== "queue-pull" || credential.projectName !== project.name || typeof credential.apiToken !== "string" || credential.apiToken.trim().length === 0 || credential.accountId !== queueConfig.accountId || credential.queueId !== queueConfig.queueId || credential.queueName !== queueConfig.queueName || credential.retentionSeconds !== queueConfig.retentionSeconds) {
+        throw validationError("Cloudflare Queue credential is not configured for this source");
+      }
+      const queueClient = {
+        accountId: credential.accountId,
+        queueId: credential.queueId,
+        apiToken: credential.apiToken
+      };
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const leaseOwner = crypto40.randomUUID();
+      if (!tryClaimTrafficSyncLease({
+        db: app.db,
+        sourceId: sourceRow2.id,
+        owner: leaseOwner,
+        now,
+        ttlMs: CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS
+      })) {
+        throw operationInProgress("Cloudflare Queue source sync is already in progress", { sourceId: sourceRow2.id });
+      }
+      const runId2 = crypto40.randomUUID();
+      const startedAt2 = (/* @__PURE__ */ new Date()).toISOString();
+      const startedMs = Date.now();
+      try {
+        app.db.insert(runs).values({
+          id: runId2,
+          projectId: project.id,
+          kind: RunKinds["traffic-sync"],
+          status: RunStatuses.running,
+          trigger: RunTriggers.manual,
+          sourceId: sourceRow2.id,
+          startedAt: startedAt2,
+          createdAt: startedAt2
+        }).run();
+        let acceptedEvents = 0;
+        let selfTrafficExcluded = 0;
+        let crawlerHits = 0;
+        let aiUserFetchHits = 0;
+        let aiReferralHits = 0;
+        let unknownHits = 0;
+        let crawlerBucketRows2 = 0;
+        let aiUserFetchBucketRows2 = 0;
+        let aiReferralBucketRows2 = 0;
+        let sampleRows2 = 0;
+        let committedAt = startedAt2;
+        let remainingBacklogCount = 0;
+        const canonicalHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
+        for (let batch = 0; batch < cloudflareQueueMaxBatches; batch += 1) {
+          if (!tryClaimTrafficSyncLease({
+            db: app.db,
+            sourceId: sourceRow2.id,
+            owner: leaseOwner,
+            now: (/* @__PURE__ */ new Date()).toISOString(),
+            ttlMs: CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS
+          })) throw new Error("Queue sync lease was lost");
+          const pulled = await pullQueueMessages(queueClient, {
+            batchSize: CLOUDFLARE_QUEUE_BATCH_SIZE,
+            visibilityTimeoutMs: CLOUDFLARE_QUEUE_VISIBILITY_TIMEOUT_MS
+          });
+          remainingBacklogCount = pulled.messageBacklogCount;
+          if (pulled.skippedUnleasedMessageCount > 0) {
+            request.log.warn({
+              sourceId: sourceRow2.id,
+              skippedUnleasedMessageCount: pulled.skippedUnleasedMessageCount
+            }, "Skipped unacknowledgeable Cloudflare Queue messages; they remain eligible for redelivery");
+          }
+          const validLeases = [];
+          const poisonLeases = [];
+          const normalized = [];
+          let workerVersion = null;
+          for (const message of pulled.messages) {
+            if (message.contentType === "poison") {
+              poisonLeases.push(message.leaseId);
+              request.log.warn(
+                { sourceId: sourceRow2.id, messageId: message.id, reason: message.reason },
+                "Dropping malformed Cloudflare Queue message"
+              );
+              continue;
+            }
+            if (message.contentType !== "json") {
+              poisonLeases.push(message.leaseId);
+              request.log.warn({
+                sourceId: sourceRow2.id,
+                messageId: message.id,
+                contentType: message.contentType,
+                reason: "unsupported-content-type"
+              }, "Dropping Cloudflare Queue message with an unsupported content type");
+              continue;
+            }
+            const parsedBatch = cloudflareWorkerIngestRequestSchema.safeParse(message.body);
+            if (!parsedBatch.success) {
+              poisonLeases.push(message.leaseId);
+              request.log.warn(
+                { sourceId: sourceRow2.id, messageId: message.id },
+                "Dropping Cloudflare Queue message with an invalid Canonry batch"
+              );
+              continue;
+            }
+            if (parsedBatch.data.events.some((event) => normalizeCloudflareEventHost(event.host) !== canonicalHost)) {
+              poisonLeases.push(message.leaseId);
+              request.log.warn(
+                { sourceId: sourceRow2.id, messageId: message.id },
+                "Dropping Cloudflare Queue message for another host"
+              );
+              continue;
+            }
+            workerVersion = parsedBatch.data.workerVersion;
+            for (const event of parsedBatch.data.events) {
+              const normalizedEvent = normalizeCloudflareWorkerEvent(event);
+              if (normalizedEvent) normalized.push(normalizedEvent);
+            }
+            validLeases.push(message.leaseId);
+          }
+          committedAt = (/* @__PURE__ */ new Date()).toISOString();
+          const writeResult = writeTrafficEventBatch({
+            db: app.db,
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            events: normalized,
+            receivedAt: committedAt,
+            receiptTtlMs: CLOUDFLARE_QUEUE_RECEIPT_TTL_MS,
+            sampleLimit,
+            validateSource: (latest) => {
+              if (!latest || latest.projectId !== project.id || latest.status !== TrafficSourceStatuses.connected || latest.syncLeaseOwner !== leaseOwner || !isDeepStrictEqual(latest.configJson, sourceRow2.configJson)) {
+                throw validationError("Cloudflare Queue source is no longer active");
+              }
+            },
+            sourceUpdate: {
+              status: TrafficSourceStatuses.connected,
+              lastSyncedAt: committedAt,
+              lastError: null,
+              queueBacklogCount: remainingBacklogCount,
+              queueBacklogObservedAt: committedAt,
+              ...workerVersion ? { lastWorkerVersion: workerVersion } : {},
+              updatedAt: committedAt
+            }
+          });
+          if (validLeases.length > 0 || poisonLeases.length > 0) {
+            if (!tryClaimTrafficSyncLease({
+              db: app.db,
+              sourceId: sourceRow2.id,
+              owner: leaseOwner,
+              now: (/* @__PURE__ */ new Date()).toISOString(),
+              ttlMs: CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS
+            })) throw new Error("Queue sync lease was lost before acknowledgement");
+            const latestSource = app.db.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+            if (!latestSource || latestSource.projectId !== project.id || latestSource.status !== TrafficSourceStatuses.connected || latestSource.syncLeaseOwner !== leaseOwner || !isDeepStrictEqual(latestSource.configJson, sourceRow2.configJson)) {
+              throw validationError("Cloudflare Queue source was reconfigured before acknowledgement");
+            }
+            const ackResult = await ackQueueMessages(queueClient, { acks: [...validLeases, ...poisonLeases] });
+            if (ackResult.warningCount > 0) {
+              request.log.warn({
+                sourceId: sourceRow2.id,
+                warningCount: ackResult.warningCount
+              }, "Cloudflare Queue acknowledgement completed with warnings");
+            }
+          }
+          acceptedEvents += writeResult.acceptedEvents;
+          selfTrafficExcluded += writeResult.selfTrafficExcluded;
+          crawlerHits += writeResult.crawlerHits;
+          aiUserFetchHits += writeResult.aiUserFetchHits;
+          aiReferralHits += writeResult.aiReferralHits;
+          unknownHits += writeResult.unknownHits;
+          crawlerBucketRows2 += writeResult.crawlerBucketRows;
+          aiUserFetchBucketRows2 += writeResult.aiUserFetchBucketRows;
+          aiReferralBucketRows2 += writeResult.aiReferralBucketRows;
+          sampleRows2 += writeResult.sampleRows;
+          const pulledEnvelopeCount = pulled.messages.length + pulled.skippedUnleasedMessageCount;
+          if (pulledEnvelopeCount < CLOUDFLARE_QUEUE_BATCH_SIZE || remainingBacklogCount === 0) break;
+        }
+        app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: committedAt }).where(eq48(runs.id, runId2)).run();
+        writeAuditLog(app.db, {
+          projectId: project.id,
+          actor: "api",
+          action: "traffic.cloudflare.queue-synced",
+          entityType: "traffic_source",
+          entityId: sourceRow2.id
+        });
+        try {
+          opts.onTrafficSynced?.({
+            status: "completed",
+            sourceType: sourceRow2.sourceType,
+            sourceId: sourceRow2.id,
+            pulledEvents: acceptedEvents,
+            selfTrafficExcluded,
+            crawlerHits,
+            aiUserFetchHits,
+            aiReferralHits,
+            durationMs: Date.now() - startedMs
+          });
+        } catch {
+        }
+        const response2 = {
+          sourceId: sourceRow2.id,
+          runId: runId2,
+          syncedAt: committedAt,
+          pulledEvents: acceptedEvents,
+          selfTrafficExcluded,
+          crawlerHits,
+          aiUserFetchHits,
+          aiReferralHits,
+          unknownHits,
+          crawlerBucketRows: crawlerBucketRows2,
+          aiUserFetchBucketRows: aiUserFetchBucketRows2,
+          aiReferralBucketRows: aiReferralBucketRows2,
+          sampleRows: sampleRows2,
+          remainingBacklogCount,
+          windowStart: startedAt2,
+          windowEnd: committedAt
+        };
+        return response2;
+      } catch (error) {
+        const failedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const safeError = error instanceof CloudflareQueueApiError ? error.message : "Cloudflare Queue sync failed; retry the active source.";
+        app.db.transaction((tx) => {
+          tx.update(runs).set({ status: RunStatuses.failed, error: safeError, finishedAt: failedAt }).where(eq48(runs.id, runId2)).run();
+          const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+          if (latestSource && latestSource.status === TrafficSourceStatuses.connected && latestSource.syncLeaseOwner === leaseOwner && isDeepStrictEqual(latestSource.configJson, sourceRow2.configJson)) {
+            tx.update(trafficSources).set({ lastError: safeError, updatedAt: failedAt }).where(and40(
+              eq48(trafficSources.id, sourceRow2.id),
+              eq48(trafficSources.status, TrafficSourceStatuses.connected),
+              eq48(trafficSources.syncLeaseOwner, leaseOwner)
+            )).run();
+          }
+        });
+        throw providerError(safeError);
+      } finally {
+        releaseTrafficSyncLease({
+          db: app.db,
+          sourceId: sourceRow2.id,
+          owner: leaseOwner,
+          now: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    }
     if (sourceRow2.sourceType !== TrafficSourceTypes["cloud-run"] && sourceRow2.sourceType !== TrafficSourceTypes.wordpress && sourceRow2.sourceType !== TrafficSourceTypes.vercel) {
       throw validationError(
         `Sync for source type "${sourceRow2.sourceType}" is not implemented yet \u2014 only cloud-run, wordpress, and vercel are supported in v1.`
       );
     }
+    const hasConnectedSibling = sourceRow2.status === TrafficSourceStatuses.error && app.db.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().some((row) => row.id !== sourceRow2.id && row.status === TrafficSourceStatuses.connected);
+    if (sourceRow2.status === TrafficSourceStatuses.paused || sourceRow2.status === TrafficSourceStatuses.archived || hasConnectedSibling) {
+      throw validationError("Traffic source must be active before it can sync");
+    }
     const windowEnd = /* @__PURE__ */ new Date();
     const startedAt = windowEnd.toISOString();
     const syncStartedAtMs = windowEnd.getTime();
@@ -53476,8 +54686,11 @@ async function trafficRoutes(app, opts) {
     const markFailed = (msg, errorCode) => {
       const failedAt = (/* @__PURE__ */ new Date()).toISOString();
       app.db.transaction((tx) => {
-        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq47(runs.id, runId)).run();
-        tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+        tx.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: failedAt }).where(eq48(runs.id, runId)).run();
+        const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+        if (latestSource?.status === TrafficSourceStatuses.connected && isDeepStrictEqual(latestSource.configJson, sourceRow2.configJson) && latestSource.updatedAt === sourceRow2.updatedAt && latestSource.lastSyncedAt === sourceRow2.lastSyncedAt) {
+          tx.update(trafficSources).set({ status: TrafficSourceStatuses.error, lastError: msg, updatedAt: failedAt }).where(eq48(trafficSources.id, sourceRow2.id)).run();
+        }
       });
       try {
         opts.onTrafficSynced?.({
@@ -53558,7 +54771,7 @@ async function trafficRoutes(app, opts) {
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq47(runs.id, runId)).run();
+        app.db.delete(runs).where(eq48(runs.id, runId)).run();
         throw validationError(
           `No WordPress credential found for project "${project.name}". Run "canonry traffic connect wordpress" first.`
         );
@@ -53607,12 +54820,12 @@ async function trafficRoutes(app, opts) {
       auditAction = "traffic.vercel.synced";
       const credentialStore = opts.vercelTrafficCredentialStore;
       if (!credentialStore) {
-        app.db.delete(runs).where(eq47(runs.id, runId)).run();
+        app.db.delete(runs).where(eq48(runs.id, runId)).run();
         throw validationError("Vercel traffic credential storage is not configured for this deployment");
       }
       const credential = credentialStore.getConnection(project.name);
       if (!credential) {
-        app.db.delete(runs).where(eq47(runs.id, runId)).run();
+        app.db.delete(runs).where(eq48(runs.id, runId)).run();
         throw validationError(
           `No Vercel credential found for project "${project.name}". Run "canonry traffic connect vercel" first.`
         );
@@ -53630,7 +54843,7 @@ async function trafficRoutes(app, opts) {
       if (cappedStartMs > clampedStartMs) {
         const previousSkip = sourceRow2.skippedThroughAt ? Date.parse(sourceRow2.skippedThroughAt) : Number.NaN;
         const skippedThrough = Number.isFinite(previousSkip) ? new Date(Math.max(previousSkip, cappedStartMs)) : new Date(cappedStartMs);
-        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+        app.db.update(trafficSources).set({ skippedThroughAt: skippedThrough.toISOString() }).where(eq48(trafficSources.id, sourceRow2.id)).run();
         request.log.warn(
           {
             sourceId: sourceRow2.id,
@@ -53714,8 +54927,18 @@ async function trafficRoutes(app, opts) {
     let aiUserFetchHitsCount = 0;
     let aiReferralHitsCount = 0;
     let unknownHitsCount = 0;
-    app.db.transaction((tx) => {
-      const latestRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
+    const commitOutcome = app.db.transaction((tx) => {
+      const latestRow = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+      const latestHasConnectedSibling = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().some((row) => row.id !== sourceRow2.id && row.status === TrafficSourceStatuses.connected);
+      if (!latestRow || latestRow.status !== TrafficSourceStatuses.connected && latestRow.status !== TrafficSourceStatuses.error || latestHasConnectedSibling || !isDeepStrictEqual(latestRow.configJson, sourceRow2.configJson) || latestRow.updatedAt !== sourceRow2.updatedAt || latestRow.lastSyncedAt !== sourceRow2.lastSyncedAt) {
+        const abortedAt = (/* @__PURE__ */ new Date()).toISOString();
+        tx.update(runs).set({
+          status: RunStatuses.failed,
+          error: "Traffic source was deactivated or reconfigured during sync",
+          finishedAt: abortedAt
+        }).where(eq48(runs.id, runId)).run();
+        return "source-inactive";
+      }
       const previousIds = latestRow.lastEventIds ?? [];
       const seenEventIds = new Set(previousIds);
       const dedupedEvents = seenEventIds.size === 0 ? allEvents : allEvents.filter((e) => !seenEventIds.has(e.eventId));
@@ -53892,7 +55115,7 @@ async function trafficRoutes(app, opts) {
         // stuck if you first disabled the schedule and drained the in-flight run.
         lastSyncedAt: new Date(
           Math.max(
-            sourceRow2.lastSyncedAt ? new Date(sourceRow2.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY,
+            latestRow.lastSyncedAt ? new Date(latestRow.lastSyncedAt).getTime() : Number.NEGATIVE_INFINITY,
             effectiveWindowEnd.getTime()
           )
         ).toISOString(),
@@ -53903,9 +55126,13 @@ async function trafficRoutes(app, opts) {
       if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
         sourceUpdate.lastCursor = nextCursor ?? null;
       }
-      tx.update(trafficSources).set(sourceUpdate).where(eq47(trafficSources.id, sourceRow2.id)).run();
-      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq47(runs.id, runId)).run();
+      tx.update(trafficSources).set(sourceUpdate).where(eq48(trafficSources.id, sourceRow2.id)).run();
+      tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq48(runs.id, runId)).run();
+      return "committed";
     });
+    if (commitOutcome === "source-inactive") {
+      throw validationError("Traffic source is no longer active; discarded the in-flight sync");
+    }
     writeAuditLog(app.db, {
       projectId: project.id,
       actor: "api",
@@ -53956,7 +55183,7 @@ async function trafficRoutes(app, opts) {
   });
   app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const sourceRow2 = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
+    const sourceRow2 = app.db.select().from(trafficSources).where(eq48(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
       throw notFound("Traffic source", request.params.id);
     }
@@ -53965,6 +55192,9 @@ async function trafficRoutes(app, opts) {
         `Backfill for source type "${sourceRow2.sourceType}" is not implemented yet \u2014 only cloud-run, wordpress, and vercel are supported in v1.`
       );
     }
+    if (!isAuthoritativeTrafficSource(app.db, sourceRow2)) {
+      throw validationError("Traffic source must be active before it can backfill");
+    }
     const requestedDays = request.body?.days ?? DEFAULT_BACKFILL_DAYS;
     if (!Number.isInteger(requestedDays) || requestedDays <= 0) {
       throw validationError('"days" must be a positive integer');
@@ -54107,16 +55337,22 @@ async function trafficRoutes(app, opts) {
     }
     const startedAt = windowEnd.toISOString();
     const runId = crypto40.randomUUID();
-    app.db.insert(runs).values({
-      id: runId,
-      projectId: project.id,
-      kind: RunKinds["traffic-sync"],
-      status: RunStatuses.running,
-      trigger: RunTriggers.backfill,
-      sourceId: sourceRow2.id,
-      startedAt,
-      createdAt: startedAt
-    }).run();
+    app.db.transaction((tx) => {
+      const latestSource = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
+      if (!latestSource || !isAuthoritativeTrafficSource(tx, latestSource) || !isSameTrafficSourceGeneration(latestSource, sourceRow2)) {
+        throw validationError("Traffic source must remain active and unchanged before it can backfill");
+      }
+      tx.insert(runs).values({
+        id: runId,
+        projectId: project.id,
+        kind: RunKinds["traffic-sync"],
+        status: RunStatuses.running,
+        trigger: RunTriggers.backfill,
+        sourceId: sourceRow2.id,
+        startedAt,
+        createdAt: startedAt
+      }).run();
+    });
     void runBackfillTask({
       app,
       runId,
@@ -54144,8 +55380,8 @@ async function trafficRoutes(app, opts) {
       pathNormalized: crawlerEventsHourly.pathNormalized,
       hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`
     }).from(crawlerEventsHourly).where(
-      and39(
-        eq47(crawlerEventsHourly.sourceId, row.id),
+      and40(
+        eq48(crawlerEventsHourly.sourceId, row.id),
         gte11(crawlerEventsHourly.tsHour, since)
       )
     ).groupBy(crawlerEventsHourly.pathNormalized).all();
@@ -54154,28 +55390,28 @@ async function trafficRoutes(app, opts) {
     );
     const crawlerTotal = crawlerSegments.content + crawlerSegments.sitemap + crawlerSegments.robots + crawlerSegments.asset + crawlerSegments.other;
     const aiUserFetchTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
-      and39(
-        eq47(aiUserFetchEventsHourly.sourceId, row.id),
+      and40(
+        eq48(aiUserFetchEventsHourly.sourceId, row.id),
         gte11(aiUserFetchEventsHourly.tsHour, since)
       )
     ).get();
     const aiTotals = app.db.select({ total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-      and39(
-        eq47(aiReferralEventsHourly.sourceId, row.id),
+      and40(
+        eq48(aiReferralEventsHourly.sourceId, row.id),
         gte11(aiReferralEventsHourly.tsHour, since)
       )
     ).get();
     const sampleTotals = app.db.select({ total: sql19`COUNT(*)` }).from(rawEventSamples).where(
-      and39(
-        eq47(rawEventSamples.sourceId, row.id),
+      and40(
+        eq48(rawEventSamples.sourceId, row.id),
         gte11(rawEventSamples.ts, since)
       )
     ).get();
     const latestRun = app.db.select().from(runs).where(
-      and39(
-        eq47(runs.projectId, projectId),
-        eq47(runs.kind, RunKinds["traffic-sync"]),
-        eq47(runs.sourceId, row.id)
+      and40(
+        eq48(runs.projectId, projectId),
+        eq48(runs.kind, RunKinds["traffic-sync"]),
+        eq48(runs.sourceId, row.id)
       )
     ).orderBy(desc22(runs.startedAt)).limit(1).get();
     return {
@@ -54206,24 +55442,36 @@ async function trafficRoutes(app, opts) {
         "`advanceToNow` must be `true`. There is no implicit reset."
       );
     }
-    const sourceRow2 = app.db.select().from(trafficSources).where(and39(eq47(trafficSources.projectId, project.id), eq47(trafficSources.id, request.params.id))).get();
-    if (!sourceRow2) {
-      throw notFound("traffic source", request.params.id);
-    }
-    if (sourceRow2.status === TrafficSourceStatuses.archived) {
-      throw validationError(
-        `Traffic source "${sourceRow2.id}" is archived. Re-connect via "canonry traffic connect ..." to start tracking it again.`
-      );
-    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let updatedRow;
     app.db.transaction((tx) => {
+      const sourceRow2 = tx.select().from(trafficSources).where(and40(eq48(trafficSources.projectId, project.id), eq48(trafficSources.id, request.params.id))).get();
+      if (!sourceRow2) {
+        throw notFound("traffic source", request.params.id);
+      }
+      if (sourceRow2.status === TrafficSourceStatuses.archived) {
+        throw validationError(
+          `Traffic source "${sourceRow2.id}" is archived. Re-connect via "canonry traffic connect ..." to start tracking it again.`
+        );
+      }
+      if (sourceRow2.status === TrafficSourceStatuses.paused) {
+        throw validationError(
+          `Traffic source "${sourceRow2.id}" is staged. Activate it explicitly instead of resetting it.`
+        );
+      }
+      const hasConnectedSibling = tx.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).all().some((row) => row.id !== sourceRow2.id && row.status === TrafficSourceStatuses.connected);
+      if (hasConnectedSibling) {
+        throw validationError(
+          `Traffic source "${sourceRow2.id}" is not authoritative. Activate it explicitly instead of resetting it.`
+        );
+      }
+      validateTrafficSourceCredential(sourceRow2, project.name);
       tx.update(trafficSources).set({
         lastSyncedAt: now,
         status: TrafficSourceStatuses.connected,
         lastError: null,
         updatedAt: now
-      }).where(eq47(trafficSources.id, sourceRow2.id)).run();
+      }).where(eq48(trafficSources.id, sourceRow2.id)).run();
       writeAuditLog(tx, auditFromRequest(request, {
         projectId: project.id,
         actor: "api",
@@ -54231,20 +55479,20 @@ async function trafficRoutes(app, opts) {
         entityType: "traffic_source",
         entityId: sourceRow2.id
       }));
-      updatedRow = tx.select().from(trafficSources).where(eq47(trafficSources.id, sourceRow2.id)).get();
+      updatedRow = tx.select().from(trafficSources).where(eq48(trafficSources.id, sourceRow2.id)).get();
     });
     return buildSourceDetail(project.id, updatedRow, new Date(Date.now() - 24 * 60 * 6e4).toISOString());
   });
   app.get("/projects/:name/traffic/sources", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map(rowToDto);
     const response = { sources };
     return response;
   });
   app.get("/projects/:name/traffic/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const rows = app.db.select().from(trafficSources).where(eq47(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
+    const rows = app.db.select().from(trafficSources).where(eq48(trafficSources.projectId, project.id)).orderBy(desc22(trafficSources.createdAt)).all();
     const since = new Date(Date.now() - 24 * 60 * 6e4).toISOString();
     const sources = rows.filter((row) => row.status !== TrafficSourceStatuses.archived).map((row) => buildSourceDetail(project.id, row, since));
     const response = { sources };
@@ -54254,7 +55502,7 @@ async function trafficRoutes(app, opts) {
     "/projects/:name/traffic/sources/:id",
     async (request) => {
       const project = resolveProject(app.db, request.params.name);
-      const row = app.db.select().from(trafficSources).where(eq47(trafficSources.id, request.params.id)).get();
+      const row = app.db.select().from(trafficSources).where(eq48(trafficSources.id, request.params.id)).get();
       if (!row || row.projectId !== project.id) {
         throw notFound("Traffic source", request.params.id);
       }
@@ -54319,12 +55567,12 @@ async function trafficRoutes(app, opts) {
     const seriesByBucket = /* @__PURE__ */ new Map();
     if (kind === "all" || kind === TrafficEventKinds.crawler) {
       const crawlerFilters = [
-        eq47(crawlerEventsHourly.projectId, project.id),
+        eq48(crawlerEventsHourly.projectId, project.id),
         gte11(crawlerEventsHourly.tsHour, sinceIso),
-        lte10(crawlerEventsHourly.tsHour, untilIso)
+        lte11(crawlerEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) crawlerFilters.push(eq47(crawlerEventsHourly.sourceId, sourceIdParam));
-      const crawlerWhere = and39(...crawlerFilters);
+      if (sourceIdParam) crawlerFilters.push(eq48(crawlerEventsHourly.sourceId, sourceIdParam));
+      const crawlerWhere = and40(...crawlerFilters);
       const pathTotals = app.db.select({
         pathNormalized: crawlerEventsHourly.pathNormalized,
         hits: sql19`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)`,
@@ -54361,12 +55609,12 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-user-fetch"]) {
       const userFetchFilters = [
-        eq47(aiUserFetchEventsHourly.projectId, project.id),
+        eq48(aiUserFetchEventsHourly.projectId, project.id),
         gte11(aiUserFetchEventsHourly.tsHour, sinceIso),
-        lte10(aiUserFetchEventsHourly.tsHour, untilIso)
+        lte11(aiUserFetchEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) userFetchFilters.push(eq47(aiUserFetchEventsHourly.sourceId, sourceIdParam));
-      const userFetchWhere = and39(...userFetchFilters);
+      if (sourceIdParam) userFetchFilters.push(eq48(aiUserFetchEventsHourly.sourceId, sourceIdParam));
+      const userFetchWhere = and40(...userFetchFilters);
       const total = app.db.select({
         total: sql19`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)`,
         rows: sql19`COUNT(*)`
@@ -54398,12 +55646,12 @@ async function trafficRoutes(app, opts) {
     }
     if (kind === "all" || kind === TrafficEventKinds["ai-referral"]) {
       const aiFilters = [
-        eq47(aiReferralEventsHourly.projectId, project.id),
+        eq48(aiReferralEventsHourly.projectId, project.id),
         gte11(aiReferralEventsHourly.tsHour, sinceIso),
-        lte10(aiReferralEventsHourly.tsHour, untilIso)
+        lte11(aiReferralEventsHourly.tsHour, untilIso)
       ];
-      if (sourceIdParam) aiFilters.push(eq47(aiReferralEventsHourly.sourceId, sourceIdParam));
-      const aiWhere = and39(...aiFilters);
+      if (sourceIdParam) aiFilters.push(eq48(aiReferralEventsHourly.sourceId, sourceIdParam));
+      const aiWhere = and40(...aiFilters);
       const total = app.db.select({
         total: sql19`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)`,
         paid: sql19`COALESCE(SUM(${aiReferralEventsHourly.paidSessionsOrHits}), 0)`,
@@ -54722,7 +55970,7 @@ function readInstalledManifest(skillDir) {
 var AGENT_CHECKS = [skillsInstalledCheck, skillsCurrentCheck];
 
 // ../api-routes/src/doctor/checks/backlinks.ts
-import { and as and40, eq as eq48 } from "drizzle-orm";
+import { and as and41, eq as eq49 } from "drizzle-orm";
 function skippedNoProject() {
   return {
     status: CheckStatuses.skipped,
@@ -54738,8 +55986,8 @@ var BACKLINKS_CHECKS = [
     title: "Backlinks source connected",
     run: (ctx) => {
       if (!ctx.project) return skippedNoProject();
-      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq48(projects.id, ctx.project.id)).get();
-      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq48(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
+      const projectRow = ctx.db.select({ autoExtract: projects.autoExtractBacklinks }).from(projects).where(eq49(projects.id, ctx.project.id)).get();
+      const readySync = ctx.db.select({ id: ccReleaseSyncs.id }).from(ccReleaseSyncs).where(eq49(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).limit(1).get();
       const ccConnected = projectRow?.autoExtract === true && !!readySync;
       const connected = [];
       if (ccConnected) connected.push(BacklinkSources.commoncrawl);
@@ -54752,9 +56000,9 @@ var BACKLINKS_CHECKS = [
           details: { commoncrawl: ccConnected }
         };
       }
-      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and40(
-        eq48(backlinkSummaries.projectId, ctx.project.id),
-        eq48(backlinkSummaries.source, BacklinkSources.commoncrawl)
+      const ccHasData = ccConnected ? !!ctx.db.select({ id: backlinkSummaries.id }).from(backlinkSummaries).where(and41(
+        eq49(backlinkSummaries.projectId, ctx.project.id),
+        eq49(backlinkSummaries.source, BacklinkSources.commoncrawl)
       )).limit(1).get() : false;
       return {
         status: CheckStatuses.ok,
@@ -54914,7 +56162,7 @@ var BING_AUTH_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/content.ts
-import { eq as eq49 } from "drizzle-orm";
+import { eq as eq50 } from "drizzle-orm";
 var WINNABILITY_COVERAGE_WARN_THRESHOLD = 0.8;
 var UNCLASSIFIED_DOMAIN_SAMPLE_LIMIT = 10;
 function skippedNoProject2() {
@@ -54927,7 +56175,7 @@ function skippedNoProject2() {
 }
 function loadProject(ctx) {
   if (!ctx.project) return null;
-  return ctx.db.select().from(projects).where(eq49(projects.id, ctx.project.id)).get() ?? null;
+  return ctx.db.select().from(projects).where(eq50(projects.id, ctx.project.id)).get() ?? null;
 }
 function percent(value) {
   return Math.round(value * 100);
@@ -55019,7 +56267,7 @@ var CONTENT_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/ads.ts
-import { eq as eq50 } from "drizzle-orm";
+import { eq as eq51 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS = 7;
 var RECENT_SYNC_FAIL_DAYS = 30;
 var adsConnectionCheck = {
@@ -55036,7 +56284,7 @@ var adsConnectionCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq51(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -55086,7 +56334,7 @@ var adsRecentSyncCheck = {
         remediation: null
       };
     }
-    const row = ctx.db.select().from(adsConnections).where(eq50(adsConnections.projectId, ctx.project.id)).get();
+    const row = ctx.db.select().from(adsConnections).where(eq51(adsConnections.projectId, ctx.project.id)).get();
     if (!row) {
       return {
         status: CheckStatuses.skipped,
@@ -55277,7 +56525,7 @@ var ga4ConnectionCheck = {
 var GA_AUTH_CHECKS = [ga4ConnectionCheck];
 
 // ../api-routes/src/doctor/checks/gbp-auth.ts
-import { and as and41, eq as eq51 } from "drizzle-orm";
+import { and as and42, eq as eq52 } from "drizzle-orm";
 var RECENT_SYNC_WARN_DAYS2 = 7;
 var RECENT_SYNC_FAIL_DAYS2 = 30;
 function skippedNoProject3() {
@@ -55510,7 +56758,7 @@ var recentSyncCheck = {
   title: "GBP recent sync",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject3();
-    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and41(eq51(gbpLocations.projectId, ctx.project.id), eq51(gbpLocations.selected, true))).all();
+    const selected = ctx.db.select({ locationName: gbpLocations.locationName, syncedAt: gbpLocations.syncedAt }).from(gbpLocations).where(and42(eq52(gbpLocations.projectId, ctx.project.id), eq52(gbpLocations.selected, true))).all();
     if (selected.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -55570,7 +56818,7 @@ var GBP_AUTH_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/places.ts
-import { eq as eq52 } from "drizzle-orm";
+import { eq as eq53 } from "drizzle-orm";
 var apiKeyCheck = {
   id: "gbp.places.api-key",
   category: CheckCategories.auth,
@@ -55615,7 +56863,7 @@ var apiKeyCheck = {
         details: { tier: cfg.tier }
       };
     }
-    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq52(gbpLocations.projectId, ctx.project.id)).all();
+    const rows = ctx.db.select({ placeId: gbpLocations.placeId, selected: gbpLocations.selected }).from(gbpLocations).where(eq53(gbpLocations.projectId, ctx.project.id)).all();
     const selected = rows.filter((r) => r.selected);
     const locationsWithPlaceId = selected.filter((r) => Boolean(r.placeId)).length;
     const details = {
@@ -56130,7 +57378,7 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and42, eq as eq53, gte as gte12, ne as ne6, sql as sql20 } from "drizzle-orm";
+import { and as and43, eq as eq54, gte as gte12, inArray as inArray18, ne as ne6, sql as sql20 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function isCloudflareDirectPush(source) {
@@ -56138,6 +57386,12 @@ function isCloudflareDirectPush(source) {
   const deliveryMode = source.configJson.deliveryMode;
   return deliveryMode === void 0 || deliveryMode === CloudflareTrafficDeliveryModes["direct-push"];
 }
+function isCloudflareQueuePull(source) {
+  return source.sourceType === TrafficSourceTypes.cloudflare && source.configJson.deliveryMode === CloudflareTrafficDeliveryModes["queue-pull"];
+}
+function isActiveSource(source) {
+  return source.status !== TrafficSourceStatuses.paused;
+}
 function recentDataRemediation(sources, lastSyncedAt) {
   const hasCloudflare = sources.some(isCloudflareDirectPush);
   const hasPullSource = sources.some((source) => !isCloudflareDirectPush(source));
@@ -56160,8 +57414,8 @@ function skippedNoProject5() {
 function loadProbes(ctx) {
   if (!ctx.project) return [];
   const rows = ctx.db.select().from(trafficSources).where(
-    and42(
-      eq53(trafficSources.projectId, ctx.project.id),
+    and43(
+      eq54(trafficSources.projectId, ctx.project.id),
       ne6(trafficSources.status, TrafficSourceStatuses.archived)
     )
   ).all();
@@ -56176,6 +57430,8 @@ function loadProbes(ctx) {
     lastWorkerVersion: r.lastWorkerVersion,
     ingestTokenHash: r.ingestTokenHash,
     skippedThroughAt: r.skippedThroughAt,
+    queueBacklogCount: r.queueBacklogCount,
+    queueBacklogObservedAt: r.queueBacklogObservedAt,
     lastError: r.lastError,
     configJson: r.configJson
   }));
@@ -56197,30 +57453,40 @@ var sourceConnectedCheck = {
         details: { sourceCount: 0 }
       };
     }
-    const errored = sources.filter((s) => s.status === "error");
-    if (errored.length > 0 && errored.length === sources.length) {
+    const activeSources = sources.filter(isActiveSource);
+    if (activeSources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.source.paused",
+        summary: `${sources.length} traffic source(s) are paused or staged; none are actively ingesting.`,
+        remediation: "Activate the intended traffic source after its deployment smoke test succeeds.",
+        details: { sourceCount: sources.length, pausedIds: sources.map((s) => s.id) }
+      };
+    }
+    const errored = activeSources.filter((s) => s.status === "error");
+    if (errored.length > 0 && errored.length === activeSources.length) {
       return {
         status: CheckStatuses.fail,
         code: "traffic.source.all-errored",
-        summary: `All ${sources.length} traffic source(s) are in error state. No data is being ingested.`,
+        summary: `All ${activeSources.length} active traffic source(s) are in error state. No data is being ingested.`,
         remediation: errored[0].lastError ? `Latest error: "${errored[0].lastError}". Re-connect the source or run \`canonry traffic sync <project> --source <id>\` to retry.` : "Run `canonry traffic sources <project>` to inspect the failing source(s) and re-connect.",
-        details: { sourceCount: sources.length, erroredIds: errored.map((s) => s.id) }
+        details: { sourceCount: activeSources.length, pausedCount: sources.length - activeSources.length, erroredIds: errored.map((s) => s.id) }
       };
     }
     if (errored.length > 0) {
       return {
         status: CheckStatuses.warn,
         code: "traffic.source.partially-errored",
-        summary: `${errored.length} of ${sources.length} traffic source(s) are in error state.`,
+        summary: `${errored.length} of ${activeSources.length} active traffic source(s) are in error state.`,
         remediation: "Run `canonry traffic sources <project>` to inspect the failing sources individually.",
-        details: { sourceCount: sources.length, erroredIds: errored.map((s) => s.id) }
+        details: { sourceCount: activeSources.length, pausedCount: sources.length - activeSources.length, erroredIds: errored.map((s) => s.id) }
       };
     }
     return {
       status: CheckStatuses.ok,
       code: "traffic.source.connected",
-      summary: `${sources.length} traffic source(s) connected: ${sources.map((s) => s.displayName).join(", ")}.`,
-      details: { sourceCount: sources.length, sourceTypes: [...new Set(sources.map((s) => s.sourceType))] }
+      summary: `${activeSources.length} traffic source(s) connected: ${activeSources.map((s) => s.displayName).join(", ")}.`,
+      details: { sourceCount: activeSources.length, pausedCount: sources.length - activeSources.length, sourceTypes: [...new Set(activeSources.map((s) => s.sourceType))] }
     };
   }
 };
@@ -56239,29 +57505,43 @@ var recentDataCheck = {
         summary: "No traffic source connected \u2014 recent-data check skipped."
       };
     }
+    const activeSources = sources.filter(isActiveSource);
+    if (activeSources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.recent-data.no-active-source",
+        summary: "Only paused or staged traffic sources are configured \u2014 recent-data check skipped.",
+        remediation: "Activate the intended source after its deployment smoke test succeeds.",
+        details: { sourceCount: sources.length, pausedIds: sources.map((source) => source.id) }
+      };
+    }
+    const activeSourceIds = activeSources.map((source) => source.id);
     const now = /* @__PURE__ */ new Date();
     const warnCutoff = new Date(now.getTime() - RECENT_DATA_WARN_DAYS * 24 * 60 * 6e4).toISOString();
     const failCutoff = new Date(now.getTime() - RECENT_DATA_FAIL_DAYS * 24 * 60 * 6e4).toISOString();
     const recentCrawlers = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and42(
-          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(crawlerEventsHourly.projectId, ctx.project.id),
+          inArray18(crawlerEventsHourly.sourceId, activeSourceIds),
           gte12(crawlerEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
     const recentReferrals = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and42(
-          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(aiReferralEventsHourly.projectId, ctx.project.id),
+          inArray18(aiReferralEventsHourly.sourceId, activeSourceIds),
           gte12(aiReferralEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
     );
     const recentUserFetches = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
-        and42(
-          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          inArray18(aiUserFetchEventsHourly.sourceId, activeSourceIds),
           gte12(aiUserFetchEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
@@ -56281,37 +57561,40 @@ var recentDataCheck = {
     }
     const olderCrawlers = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
-        and42(
-          eq53(crawlerEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(crawlerEventsHourly.projectId, ctx.project.id),
+          inArray18(crawlerEventsHourly.sourceId, activeSourceIds),
           gte12(crawlerEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const olderReferrals = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
-        and42(
-          eq53(aiReferralEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(aiReferralEventsHourly.projectId, ctx.project.id),
+          inArray18(aiReferralEventsHourly.sourceId, activeSourceIds),
           gte12(aiReferralEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
     const olderUserFetches = Number(
       ctx.db.select({ total: sql20`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
-        and42(
-          eq53(aiUserFetchEventsHourly.projectId, ctx.project.id),
+        and43(
+          eq54(aiUserFetchEventsHourly.projectId, ctx.project.id),
+          inArray18(aiUserFetchEventsHourly.sourceId, activeSourceIds),
           gte12(aiUserFetchEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
     );
-    const lastSyncedAt = sources.map((s) => s.lastSyncedAt).filter(Boolean).sort().at(-1) ?? null;
+    const lastSyncedAt = activeSources.map((s) => s.lastSyncedAt).filter(Boolean).sort().at(-1) ?? null;
     const hasOlderData = olderCrawlers > 0 || olderUserFetches > 0 || olderReferrals > 0;
     if (hasOlderData || lastSyncedAt) {
       return {
         status: CheckStatuses.warn,
         code: "traffic.recent-data.stale",
         summary: hasOlderData ? `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days, though older data exists.` : `No crawler, AI user-fetch, or AI-referral hits in the last ${RECENT_DATA_WARN_DAYS} days.`,
-        remediation: recentDataRemediation(sources, lastSyncedAt),
-        details: { lastSyncedAt, sourceCount: sources.length }
+        remediation: recentDataRemediation(activeSources, lastSyncedAt),
+        details: { lastSyncedAt, sourceCount: activeSources.length, pausedCount: sources.length - activeSources.length }
       };
     }
     return {
@@ -56319,7 +57602,7 @@ var recentDataCheck = {
       code: "traffic.recent-data.empty",
       summary: `No traffic data in the last ${RECENT_DATA_FAIL_DAYS} days. The source is connected but isn't ingesting.`,
       remediation: "Verify the source's configuration with `canonry traffic sources <project>` and run a manual sync to confirm credentials + scopes are still valid.",
-      details: { sourceCount: sources.length }
+      details: { sourceCount: activeSources.length, pausedCount: sources.length - activeSources.length }
     };
   }
 };
@@ -56405,6 +57688,7 @@ function summarizePerSourceResults(fallbackId, fallbackLabel, results) {
     status: CheckStatuses.skipped,
     code: `traffic.${fallbackId}.all-skipped`,
     summary: `No source-type validator was available for any of the ${results.length} connected source(s).`,
+    remediation: skipped.find((result) => result.output.remediation)?.output.remediation,
     details: detail
   };
 }
@@ -56509,8 +57793,16 @@ var syncLagCheck = {
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject5();
     const allSources = loadProbes(ctx);
-    const sources = allSources.filter((source) => !isCloudflareDirectPush(source));
-    if (allSources.length > 0 && sources.length === 0) {
+    const activeSources = allSources.filter(isActiveSource);
+    if (allSources.length > 0 && activeSources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.sync-lag.no-active-source",
+        summary: "Only paused or staged traffic sources are configured \u2014 pull sync lag does not apply."
+      };
+    }
+    const sources = activeSources.filter((source) => !isCloudflareDirectPush(source));
+    if (activeSources.length > 0 && sources.length === 0) {
       return {
         status: CheckStatuses.skipped,
         code: "traffic.sync-lag.push-only",
@@ -56606,6 +57898,69 @@ var syncLagCheck = {
     };
   }
 };
+var queueBacklogCheck = {
+  id: "traffic.source.queue-backlog",
+  category: CheckCategories.integrations,
+  scope: CheckScopes.project,
+  title: "Cloudflare Queue backlog",
+  run: (ctx) => {
+    if (!ctx.project) return skippedNoProject5();
+    const sources = loadProbes(ctx).filter(
+      (source) => isActiveSource(source) && isCloudflareQueuePull(source)
+    );
+    if (sources.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.queue-backlog.not-applicable",
+        summary: "No active Cloudflare Queue pull source is connected."
+      };
+    }
+    const measured = sources.filter((source) => source.queueBacklogCount !== null && source.queueBacklogCount !== void 0);
+    const details = {
+      sources: sources.map((source) => ({
+        id: source.id,
+        displayName: source.displayName,
+        queueBacklogCount: source.queueBacklogCount ?? null,
+        queueBacklogObservedAt: source.queueBacklogObservedAt ?? null
+      }))
+    };
+    if (measured.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "traffic.queue-backlog.not-observed",
+        summary: "Cloudflare Queue backlog has not been observed yet.",
+        remediation: "Run `canonry traffic sync <project> --source <id>` to pull the Queue and record its residual depth.",
+        details
+      };
+    }
+    const remaining = measured.filter((source) => (source.queueBacklogCount ?? 0) > 0);
+    const total = remaining.reduce((sum, source) => sum + source.queueBacklogCount, 0);
+    if (total > DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET) {
+      return {
+        status: CheckStatuses.warn,
+        code: "traffic.queue-backlog.remaining",
+        summary: `${total.toLocaleString("en-US")} message(s) remained across ${remaining.length} Cloudflare Queue source(s) after the last bounded sync, exceeding the default ${DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET.toLocaleString("en-US")}-message drain budget.`,
+        remediation: "Run `canonry traffic sync <project> --source <id>` again. If the backlog stays above 1,000 messages, shorten the traffic-sync schedule interval.",
+        details
+      };
+    }
+    if (total > 0) {
+      return {
+        status: CheckStatuses.ok,
+        code: "traffic.queue-backlog.within-drain-budget",
+        summary: `${total.toLocaleString("en-US")} message(s) remained after the last bounded sync, within the default ${DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET.toLocaleString("en-US")}-message drain budget.`,
+        remediation: "If no new messages arrive, the next scheduled sync can drain this residual backlog. Run `canonry traffic sync <project> --source <id>` to accelerate it.",
+        details
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "traffic.queue-backlog.empty",
+      summary: "The last observed Cloudflare Queue backlog was empty.",
+      details
+    };
+  }
+};
 var workerVersionCheck = {
   id: "traffic.source.worker-version",
   category: CheckCategories.integrations,
@@ -56613,7 +57968,7 @@ var workerVersionCheck = {
   title: "Cloudflare Worker version",
   run: (ctx) => {
     if (!ctx.project) return skippedNoProject5();
-    const sources = loadProbes(ctx).filter(isCloudflareDirectPush);
+    const sources = loadProbes(ctx).filter((source) => isActiveSource(source) && isCloudflareDirectPush(source));
     if (sources.length === 0) {
       return {
         status: CheckStatuses.skipped,
@@ -56667,6 +58022,7 @@ var TRAFFIC_SOURCE_CHECKS = [
   sourceConnectedCheck,
   recentDataCheck,
   syncLagCheck,
+  queueBacklogCheck,
   workerVersionCheck,
   credentialsCheck,
   scopesCheck3,
@@ -56887,7 +58243,7 @@ async function doctorRoutes(app, opts) {
 
 // ../api-routes/src/discovery/routes.ts
 import crypto42 from "crypto";
-import { and as and43, desc as desc23, eq as eq54, gte as gte13, inArray as inArray18, isNull as isNull4, or as or10 } from "drizzle-orm";
+import { and as and44, desc as desc23, eq as eq55, gte as gte13, inArray as inArray19, isNull as isNull5, or as or11 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -56921,13 +58277,13 @@ async function discoveryRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const ageFloorIso = new Date(Date.now() - MAX_INFLIGHT_DISCOVERY_AGE_MS).toISOString();
     const decision = app.db.transaction((tx) => {
-      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and43(
-        eq54(discoverySessions.projectId, project.id),
-        eq54(discoverySessions.icpDescription, icpDescription),
+      const existing = tx.select({ id: discoverySessions.id, runId: discoverySessions.runId }).from(discoverySessions).where(and44(
+        eq55(discoverySessions.projectId, project.id),
+        eq55(discoverySessions.icpDescription, icpDescription),
         // Buyer is part of session identity: it changes the seed prompt's
         // semantics, so a request with a different (or no) buyer must start
         // its own session, never adopt another buyer's probes.
-        parsed.data.buyerDescription == null ? isNull4(discoverySessions.buyerDescription) : eq54(discoverySessions.buyerDescription, parsed.data.buyerDescription),
+        parsed.data.buyerDescription == null ? isNull5(discoverySessions.buyerDescription) : eq55(discoverySessions.buyerDescription, parsed.data.buyerDescription),
         // Locations are identity too: a different service-area subset seeds
         // and probes a different geo, so it must never reuse another geo's
         // session. resolveLocations is deterministic (project-config order),
@@ -56937,12 +58293,12 @@ async function discoveryRoutes(app, opts) {
         // locations a NULL row's subset is unknowable, so it conservatively
         // never reuses — a one-time, bounded (2h window) non-reuse after
         // upgrade, never a wrong reuse.
-        locations.length === 0 ? or10(isNull4(discoverySessions.locations), eq54(discoverySessions.locations, locations)) : eq54(discoverySessions.locations, locations),
+        locations.length === 0 ? or11(isNull5(discoverySessions.locations), eq55(discoverySessions.locations, locations)) : eq55(discoverySessions.locations, locations),
         // Seed provider set is identity: a different phrasing distribution
         // must never reuse another set's session. Null (= Gemini-only
         // default, including explicit ['gemini']) matches legacy rows.
-        seedProviders == null ? isNull4(discoverySessions.seedProviders) : eq54(discoverySessions.seedProviders, seedProviders),
-        inArray18(discoverySessions.status, [
+        seedProviders == null ? isNull5(discoverySessions.seedProviders) : eq55(discoverySessions.seedProviders, seedProviders),
+        inArray19(discoverySessions.status, [
           DiscoverySessionStatuses.queued,
           DiscoverySessionStatuses.seeding,
           DiscoverySessionStatuses.probing
@@ -57017,7 +58373,7 @@ async function discoveryRoutes(app, opts) {
       const project = resolveProject(app.db, request.params.name);
       const parsedLimit = parseInt(request.query.limit ?? "", 10);
       const limit = Number.isNaN(parsedLimit) || parsedLimit <= 0 ? 50 : parsedLimit;
-      const rows = app.db.select().from(discoverySessions).where(eq54(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
+      const rows = app.db.select().from(discoverySessions).where(eq55(discoverySessions.projectId, project.id)).orderBy(desc23(discoverySessions.createdAt)).limit(limit).all();
       return reply.send(rows.map(serializeSession));
     }
   );
@@ -57025,11 +58381,11 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq55(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq55(discoveryProbes.sessionId, session.id)).all();
       const detail = {
         ...serializeSession(session),
         probes: probeRows.map(serializeProbe)
@@ -57041,7 +58397,7 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/harvest",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq55(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
@@ -57049,7 +58405,7 @@ async function discoveryRoutes(app, opts) {
       const minProbeHits = Number.isNaN(parsedFloor) || parsedFloor < 1 ? 1 : parsedFloor;
       const applyAnchor = request.query.anchor !== "false";
       const provider = session.seedProvider ?? "gemini";
-      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
+      const probeRows = app.db.select().from(discoveryProbes).where(eq55(discoveryProbes.sessionId, session.id)).all();
       const extract = opts.harvestSearchQueries;
       const probesWithQueries = probeRows.map((row) => {
         if (!extract || !row.rawResponse) return { searchQueries: [] };
@@ -57060,7 +58416,7 @@ async function discoveryRoutes(app, opts) {
           return { searchQueries: [] };
         }
       });
-      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query);
+      const trackedQueries = app.db.select({ query: queries.query }).from(queries).where(eq55(queries.projectId, project.id)).all().map((r) => r.query);
       const anchorTerms = buildHarvestAnchorTerms(
         [session.icpDescription ?? "", ...trackedQueries],
         effectiveDomains(project)
@@ -57107,12 +58463,12 @@ async function discoveryRoutes(app, opts) {
     "/projects/:name/discover/sessions/:id/promote",
     async (request, reply) => {
       const project = resolveProject(app.db, request.params.name);
-      const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
+      const session = app.db.select().from(discoverySessions).where(eq55(discoverySessions.id, request.params.id)).get();
       if (!session || session.projectId !== project.id) {
         throw notFound("Discovery session", request.params.id);
       }
-      const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
-      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
+      const probeRows = app.db.select().from(discoveryProbes).where(eq55(discoveryProbes.sessionId, session.id)).all();
+      const existingCompetitors = app.db.select({ domain: competitors.domain }).from(competitors).where(eq55(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase());
       const seenCompetitors = new Set(existingCompetitors);
       const cited = /* @__PURE__ */ new Set();
       const aspirational = /* @__PURE__ */ new Set();
@@ -57141,7 +58497,7 @@ async function discoveryRoutes(app, opts) {
   );
   app.post("/projects/:name/discover/sessions/:id/promote", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
-    const session = app.db.select().from(discoverySessions).where(eq54(discoverySessions.id, request.params.id)).get();
+    const session = app.db.select().from(discoverySessions).where(eq55(discoverySessions.id, request.params.id)).get();
     if (!session || session.projectId !== project.id) {
       throw notFound("Discovery session", request.params.id);
     }
@@ -57164,7 +58520,7 @@ async function discoveryRoutes(app, opts) {
     const bucketSet = new Set(buckets);
     const includeCompetitors = parsed.data.includeCompetitors ?? true;
     const competitorTypes = parsed.data.competitorTypes ?? DEFAULT_DISCOVERY_PROMOTE_COMPETITOR_TYPES;
-    const probeRows = app.db.select().from(discoveryProbes).where(eq54(discoveryProbes.sessionId, session.id)).all();
+    const probeRows = app.db.select().from(discoveryProbes).where(eq55(discoveryProbes.sessionId, session.id)).all();
     const candidateQueries = /* @__PURE__ */ new Set();
     for (const probe of probeRows) {
       if (!probe.bucket) continue;
@@ -57172,7 +58528,7 @@ async function discoveryRoutes(app, opts) {
       if (bucket.success && bucketSet.has(bucket.data)) candidateQueries.add(probe.query);
     }
     const existingQueries = new Set(
-      app.db.select({ query: queries.query }).from(queries).where(eq54(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
+      app.db.select({ query: queries.query }).from(queries).where(eq55(queries.projectId, project.id)).all().map((r) => r.query.toLowerCase())
     );
     const promotedQueries = [];
     const skippedQueries = [];
@@ -57188,7 +58544,7 @@ async function discoveryRoutes(app, opts) {
     const skippedCompetitors = [];
     if (includeCompetitors) {
       const existingCompetitors = new Set(
-        app.db.select({ domain: competitors.domain }).from(competitors).where(eq54(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
+        app.db.select({ domain: competitors.domain }).from(competitors).where(eq55(competitors.projectId, project.id)).all().map((r) => r.domain.toLowerCase())
       );
       const competitorMap = parseCompetitorMap(session.competitorMap);
       for (const entry of selectEligibleCompetitors(competitorMap, competitorTypes)) {
@@ -57307,7 +58663,7 @@ function selectEligibleCompetitors(competitorMap, competitorTypes) {
 
 // ../api-routes/src/discovery/orchestrate.ts
 import crypto43 from "crypto";
-import { eq as eq55 } from "drizzle-orm";
+import { eq as eq56 } from "drizzle-orm";
 var DEFAULT_MAX_PROBES = 100;
 var ABSOLUTE_MAX_PROBES = 500;
 function classifyProbeBucket(input) {
@@ -57394,7 +58750,7 @@ async function executeDiscovery(opts) {
     status: DiscoverySessionStatuses.seeding,
     dedupThreshold,
     startedAt
-  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq56(discoverySessions.id, opts.sessionId)).run();
   const seedResult = await opts.deps.seed({
     project: opts.project,
     icpDescription: opts.icpDescription,
@@ -57455,7 +58811,7 @@ async function executeDiscovery(opts) {
     dedupBandPairFraction: dedupStats.bandPairFraction,
     dedupPairsTotal: dedupStats.pairsTotal,
     warning
-  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq56(discoverySessions.id, opts.sessionId)).run();
   const probeLocation = opts.locations?.[0];
   const probeResults = await mapWithConcurrency(
     probedCanonicals,
@@ -57509,7 +58865,7 @@ async function executeDiscovery(opts) {
     wastedCount: buckets["wasted-surface"],
     competitorMap,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq55(discoverySessions.id, opts.sessionId)).run();
+  }).where(eq56(discoverySessions.id, opts.sessionId)).run();
   upsertDomainClassifications(opts.db, opts.project.id, opts.sessionId, competitorMap);
   return {
     buckets,
@@ -57549,7 +58905,7 @@ function markSessionFailed(db, sessionId, error) {
     status: DiscoverySessionStatuses.failed,
     error,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq55(discoverySessions.id, sessionId)).run();
+  }).where(eq56(discoverySessions.id, sessionId)).run();
 }
 function dedupeStrings(input) {
   const seen = /* @__PURE__ */ new Set();
@@ -57567,7 +58923,7 @@ function dedupeStrings(input) {
 
 // ../api-routes/src/technical-aeo.ts
 import crypto44 from "crypto";
-import { and as and44, asc as asc10, count, desc as desc24, eq as eq56, inArray as inArray19, isNotNull as isNotNull3, isNull as isNull5, lt as lt8, or as or11, sql as sql21 } from "drizzle-orm";
+import { and as and45, asc as asc10, count, desc as desc24, eq as eq57, inArray as inArray20, isNotNull as isNotNull3, isNull as isNull6, lt as lt8, or as or12, sql as sql21 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 var FETCHED_SITE_CRAWL_STATES = /* @__PURE__ */ new Set([
   ...SiteCrawlFetchedStates,
@@ -57615,13 +58971,13 @@ function emptyScore(projectName) {
     prioritizedFixes: []
   };
 }
-function parsePositiveInt(value, fallback, max) {
+function parsePositiveInt(value, fallback, max2) {
   const n = typeof value === "string" ? Number.parseInt(value, 10) : typeof value === "number" ? value : NaN;
   if (!Number.isFinite(n) || n < 0) return fallback;
-  return Math.min(max, Math.floor(n));
+  return Math.min(max2, Math.floor(n));
 }
-function parseBoundedLimit(value, fallback, max) {
-  const parsed = parsePositiveInt(value, fallback, max);
+function parseBoundedLimit(value, fallback, max2) {
+  const parsed = parsePositiveInt(value, fallback, max2);
   return Math.max(1, parsed);
 }
 function parseSiteHealthState(value) {
@@ -57766,8 +59122,8 @@ function parseLinkKind(value) {
   return allowed.data;
 }
 function linkKindFilter(linkKind) {
-  if (linkKind === SiteHealthLinkKinds.content) return eq56(siteCrawlEdges.isTemplate, false);
-  if (linkKind === SiteHealthLinkKinds.template) return eq56(siteCrawlEdges.isTemplate, true);
+  if (linkKind === SiteHealthLinkKinds.content) return eq57(siteCrawlEdges.isTemplate, false);
+  if (linkKind === SiteHealthLinkKinds.template) return eq57(siteCrawlEdges.isTemplate, true);
   return void 0;
 }
 var graphSourceNode = alias(siteCrawlGraphNodes, "site_crawl_graph_source_node");
@@ -57872,50 +59228,50 @@ function changedFields(before, after, fields) {
 async function technicalAeoRoutes(app, opts) {
   const resolveCrawl = (projectId, runId) => {
     const filters = [
-      eq56(siteCrawlSnapshots.projectId, projectId),
-      eq56(runs.projectId, projectId),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      inArray19(runs.status, SURFACEABLE_STATUSES),
+      eq57(siteCrawlSnapshots.projectId, projectId),
+      eq57(runs.projectId, projectId),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      inArray20(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
     if (runId) {
-      filters.push(eq56(siteCrawlSnapshots.runId, runId));
+      filters.push(eq57(siteCrawlSnapshots.runId, runId));
     } else {
-      filters.push(eq56(siteCrawlSnapshots.complete, true), eq56(runs.status, RunStatuses.completed));
+      filters.push(eq57(siteCrawlSnapshots.complete, true), eq57(runs.status, RunStatuses.completed));
     }
-    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+    return app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq57(siteCrawlSnapshots.runId, runs.id)).where(and45(...filters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
   };
   const detailScopeFor = (projectId, snapshot) => snapshot.detailsAvailable && snapshot.attemptId ? { projectId, runId: snapshot.runId, attemptId: snapshot.attemptId } : null;
   const pageInScope = (scope, selector) => {
     if (!selector.nodeKey && !selector.url) return null;
-    return app.db.select().from(siteCrawlPages).where(and44(
-      eq56(siteCrawlPages.projectId, scope.projectId),
-      eq56(siteCrawlPages.runId, scope.runId),
-      eq56(siteCrawlPages.attemptId, scope.attemptId),
-      selector.nodeKey ? eq56(siteCrawlPages.nodeKey, selector.nodeKey) : eq56(siteCrawlPages.url, selector.url)
+    return app.db.select().from(siteCrawlPages).where(and45(
+      eq57(siteCrawlPages.projectId, scope.projectId),
+      eq57(siteCrawlPages.runId, scope.runId),
+      eq57(siteCrawlPages.attemptId, scope.attemptId),
+      selector.nodeKey ? eq57(siteCrawlPages.nodeKey, selector.nodeKey) : eq57(siteCrawlPages.url, selector.url)
     )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
   };
-  const rootPageInScope = (scope, rootUrl) => pageInScope(scope, { url: rootUrl }) ?? app.db.select().from(siteCrawlPages).where(and44(
-    eq56(siteCrawlPages.projectId, scope.projectId),
-    eq56(siteCrawlPages.runId, scope.runId),
-    eq56(siteCrawlPages.attemptId, scope.attemptId),
-    eq56(siteCrawlPages.depth, 0)
+  const rootPageInScope = (scope, rootUrl) => pageInScope(scope, { url: rootUrl }) ?? app.db.select().from(siteCrawlPages).where(and45(
+    eq57(siteCrawlPages.projectId, scope.projectId),
+    eq57(siteCrawlPages.runId, scope.runId),
+    eq57(siteCrawlPages.attemptId, scope.attemptId),
+    eq57(siteCrawlPages.depth, 0)
   )).orderBy(asc10(siteCrawlPages.nodeKey)).limit(1).get() ?? null;
-  const isSurfaceableAuditRun = (projectId, runId) => Boolean(app.db.select({ id: runs.id }).from(runs).where(and44(
-    eq56(runs.id, runId),
-    eq56(runs.projectId, projectId),
-    eq56(runs.kind, RunKinds["site-audit"]),
-    inArray19(runs.status, SURFACEABLE_STATUSES),
+  const isSurfaceableAuditRun = (projectId, runId) => Boolean(app.db.select({ id: runs.id }).from(runs).where(and45(
+    eq57(runs.id, runId),
+    eq57(runs.projectId, projectId),
+    eq57(runs.kind, RunKinds["site-audit"]),
+    inArray20(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
   const assertKnownAuditRun = (projectId, runId) => {
     if (runId && !isSurfaceableAuditRun(projectId, runId)) throw notFound("Site crawl run", runId);
   };
-  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
-    eq56(siteAuditSnapshots.projectId, projectId),
-    eq56(runs.projectId, projectId),
-    eq56(runs.kind, RunKinds["site-audit"]),
-    inArray19(runs.status, SURFACEABLE_STATUSES),
+  const hasLegacyAudit = (projectId) => Boolean(app.db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).innerJoin(runs, eq57(siteAuditSnapshots.runId, runs.id)).where(and45(
+    eq57(siteAuditSnapshots.projectId, projectId),
+    eq57(runs.projectId, projectId),
+    eq57(runs.kind, RunKinds["site-audit"]),
+    inArray20(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
   const emptyCrawlSummary = (projectName, legacyAuditAvailable) => ({
@@ -57936,20 +59292,20 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const baseFilters = [
-      eq56(siteAuditSnapshots.projectId, project.id),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      inArray19(runs.status, SURFACEABLE_STATUSES),
+      eq57(siteAuditSnapshots.projectId, project.id),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      inArray20(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    const targetFilters = request.query.runId ? [...baseFilters, eq56(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
-    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    const targetFilters = request.query.runId ? [...baseFilters, eq57(siteAuditSnapshots.runId, request.query.runId)] : baseFilters;
+    const latest = app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq57(siteAuditSnapshots.runId, runs.id)).where(and45(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest) {
       if (request.query.runId) throw notFound("Site audit run", request.query.runId);
       return emptyScore(project.name);
     }
     const snap = latest.snap;
-    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...baseFilters, lt8(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
+    const previous = app.db.select({ snap: siteAuditSnapshots }).from(siteAuditSnapshots).innerJoin(runs, eq57(siteAuditSnapshots.runId, runs.id)).where(and45(...baseFilters, lt8(siteAuditSnapshots.createdAt, snap.createdAt))).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get()?.snap ?? null;
     const deltaScore = previous ? snap.aggregateScore - previous.aggregateScore : null;
     const trend = deltaScore == null ? null : deltaScore > 0 ? SiteAuditTrendDirections.up : deltaScore < 0 ? SiteAuditTrendDirections.down : SiteAuditTrendDirections.flat;
     return {
@@ -57976,14 +59332,14 @@ async function technicalAeoRoutes(app, opts) {
   app.get("/projects/:name/technical-aeo/pages", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const targetFilters = [
-      eq56(siteAuditSnapshots.projectId, project.id),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      inArray19(runs.status, SURFACEABLE_STATUSES),
+      eq57(siteAuditSnapshots.projectId, project.id),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      inArray20(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     ];
-    if (request.query.runId) targetFilters.push(eq56(siteAuditSnapshots.runId, request.query.runId));
-    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
+    if (request.query.runId) targetFilters.push(eq57(siteAuditSnapshots.runId, request.query.runId));
+    const latest = app.db.select({ runId: siteAuditSnapshots.runId, auditedAt: siteAuditSnapshots.auditedAt }).from(siteAuditSnapshots).innerJoin(runs, eq57(siteAuditSnapshots.runId, runs.id)).where(and45(...targetFilters)).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(1).get();
     if (!latest && request.query.runId) {
       throw notFound("Site audit run", request.query.runId);
     }
@@ -57991,9 +59347,9 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, runId: null, auditedAt: null, total: 0, pages: [] };
     }
     const statusFilter = request.query.status === "success" || request.query.status === "error" ? request.query.status : null;
-    const conds = [eq56(siteAuditPages.projectId, project.id), eq56(siteAuditPages.runId, latest.runId)];
-    if (statusFilter) conds.push(eq56(siteAuditPages.status, statusFilter));
-    const where = and44(...conds);
+    const conds = [eq57(siteAuditPages.projectId, project.id), eq57(siteAuditPages.runId, latest.runId)];
+    if (statusFilter) conds.push(eq57(siteAuditPages.status, statusFilter));
+    const where = and45(...conds);
     const totalRow = app.db.select({ value: count() }).from(siteAuditPages).where(where).get();
     const total = totalRow?.value ?? 0;
     const limit = parsePositiveInt(request.query.limit, 100, 500);
@@ -58017,11 +59373,11 @@ async function technicalAeoRoutes(app, opts) {
       auditedAt: siteAuditSnapshots.auditedAt,
       aggregateScore: siteAuditSnapshots.aggregateScore,
       pagesAudited: siteAuditSnapshots.pagesAudited
-    }).from(siteAuditSnapshots).innerJoin(runs, eq56(siteAuditSnapshots.runId, runs.id)).where(and44(
-      eq56(siteAuditSnapshots.projectId, project.id),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      inArray19(runs.status, SURFACEABLE_STATUSES),
+    }).from(siteAuditSnapshots).innerJoin(runs, eq57(siteAuditSnapshots.runId, runs.id)).where(and45(
+      eq57(siteAuditSnapshots.projectId, project.id),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      inArray20(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     )).orderBy(desc24(siteAuditSnapshots.createdAt)).limit(limit).all();
     return { project: project.name, points: rows.reverse() };
@@ -58115,10 +59471,10 @@ async function technicalAeoRoutes(app, opts) {
       { projectId: project.id, runId: snapshot.runId, attemptId: snapshot.attemptId },
       snapshot.rootUrl
     )?.nodeKey ?? null;
-    const persistedLayout = app.db.select().from(siteCrawlGraphLayouts).where(and44(
-      eq56(siteCrawlGraphLayouts.projectId, project.id),
-      eq56(siteCrawlGraphLayouts.runId, snapshot.runId),
-      eq56(siteCrawlGraphLayouts.attemptId, snapshot.attemptId)
+    const persistedLayout = app.db.select().from(siteCrawlGraphLayouts).where(and45(
+      eq57(siteCrawlGraphLayouts.projectId, project.id),
+      eq57(siteCrawlGraphLayouts.runId, snapshot.runId),
+      eq57(siteCrawlGraphLayouts.attemptId, snapshot.attemptId)
     )).limit(1).get();
     if (!persistedLayout) {
       return {
@@ -58169,9 +59525,9 @@ async function technicalAeoRoutes(app, opts) {
     const maxNodes = parseBoundedLimit(request.query.maxNodes, SITE_CRAWL_GRAPH_DEFAULT_MAX_NODES, SITE_CRAWL_GRAPH_MAX_NODES);
     const maxEdges = parseBoundedLimit(request.query.maxEdges, SITE_CRAWL_GRAPH_DEFAULT_MAX_EDGES, SITE_CRAWL_GRAPH_MAX_EDGES);
     const graphScope = [
-      eq56(siteCrawlGraphNodes.projectId, project.id),
-      eq56(siteCrawlGraphNodes.runId, snapshot.runId),
-      eq56(siteCrawlGraphNodes.attemptId, snapshot.attemptId)
+      eq57(siteCrawlGraphNodes.projectId, project.id),
+      eq57(siteCrawlGraphNodes.runId, snapshot.runId),
+      eq57(siteCrawlGraphNodes.attemptId, snapshot.attemptId)
     ];
     const nodeRows = app.db.select({
       nodeKey: siteCrawlPages.nodeKey,
@@ -58190,17 +59546,17 @@ async function technicalAeoRoutes(app, opts) {
       linkScoreNormalized: siteCrawlPages.linkScoreNormalized,
       x: siteCrawlGraphNodes.x,
       y: siteCrawlGraphNodes.y
-    }).from(siteCrawlGraphNodes).innerJoin(siteCrawlPages, and44(
-      eq56(siteCrawlPages.projectId, siteCrawlGraphNodes.projectId),
-      eq56(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
-      eq56(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
-      eq56(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
-    )).where(and44(...graphScope, lt8(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc10(siteCrawlGraphNodes.sampleRank)).all();
+    }).from(siteCrawlGraphNodes).innerJoin(siteCrawlPages, and45(
+      eq57(siteCrawlPages.projectId, siteCrawlGraphNodes.projectId),
+      eq57(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
+      eq57(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
+      eq57(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
+    )).where(and45(...graphScope, lt8(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc10(siteCrawlGraphNodes.sampleRank)).all();
     const nodes = nodeRows.map(({ indexabilityReasons, canonicalNodeKey, ...row }) => ({
       ...row,
       healthState: deriveSiteHealthState({ ...row, indexabilityReasons, canonicalNodeKey })
     }));
-    const graphLinkKindFilter = linkKind === SiteHealthLinkKinds.all ? void 0 : eq56(siteCrawlGraphEdges.isTemplate, linkKind === SiteHealthLinkKinds.template);
+    const graphLinkKindFilter = linkKind === SiteHealthLinkKinds.all ? void 0 : eq57(siteCrawlGraphEdges.isTemplate, linkKind === SiteHealthLinkKinds.template);
     const edges = app.db.select({
       edgeKey: siteCrawlGraphEdges.edgeKey,
       sourceNodeKey: siteCrawlGraphEdges.sourceNodeKey,
@@ -58208,22 +59564,22 @@ async function technicalAeoRoutes(app, opts) {
       followable: siteCrawlGraphEdges.followable,
       occurrences: siteCrawlGraphEdges.occurrences,
       isTemplate: siteCrawlGraphEdges.isTemplate
-    }).from(siteCrawlGraphEdges).innerJoin(graphSourceNode, and44(
-      eq56(graphSourceNode.projectId, siteCrawlGraphEdges.projectId),
-      eq56(graphSourceNode.runId, siteCrawlGraphEdges.runId),
-      eq56(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
-      eq56(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
+    }).from(siteCrawlGraphEdges).innerJoin(graphSourceNode, and45(
+      eq57(graphSourceNode.projectId, siteCrawlGraphEdges.projectId),
+      eq57(graphSourceNode.runId, siteCrawlGraphEdges.runId),
+      eq57(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq57(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
       lt8(graphSourceNode.sampleRank, maxNodes)
-    )).innerJoin(graphTargetNode, and44(
-      eq56(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
-      eq56(graphTargetNode.runId, siteCrawlGraphEdges.runId),
-      eq56(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
-      eq56(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
+    )).innerJoin(graphTargetNode, and45(
+      eq57(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
+      eq57(graphTargetNode.runId, siteCrawlGraphEdges.runId),
+      eq57(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
+      eq57(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
       lt8(graphTargetNode.sampleRank, maxNodes)
-    )).where(and44(
-      eq56(siteCrawlGraphEdges.projectId, project.id),
-      eq56(siteCrawlGraphEdges.runId, snapshot.runId),
-      eq56(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
+    )).where(and45(
+      eq57(siteCrawlGraphEdges.projectId, project.id),
+      eq57(siteCrawlGraphEdges.runId, snapshot.runId),
+      eq57(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
       lt8(siteCrawlGraphEdges.sampleRank, maxEdges),
       graphLinkKindFilter
     )).orderBy(asc10(siteCrawlGraphEdges.sampleRank)).all();
@@ -58317,15 +59673,15 @@ async function technicalAeoRoutes(app, opts) {
     let frontier = [focus.nodeKey];
     let queryTruncated = false;
     for (let distance = 0; distance < hops && frontier.length > 0; distance += 1) {
-      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
-        eq56(siteCrawlEdges.projectId, scope.projectId),
-        eq56(siteCrawlEdges.runId, scope.runId),
-        eq56(siteCrawlEdges.attemptId, scope.attemptId),
-        eq56(siteCrawlEdges.internal, true),
+      const candidates = app.db.select().from(siteCrawlEdges).where(and45(
+        eq57(siteCrawlEdges.projectId, scope.projectId),
+        eq57(siteCrawlEdges.runId, scope.runId),
+        eq57(siteCrawlEdges.attemptId, scope.attemptId),
+        eq57(siteCrawlEdges.internal, true),
         isNotNull3(siteCrawlEdges.targetNodeKey),
-        or11(
-          inArray19(siteCrawlEdges.sourceNodeKey, frontier),
-          inArray19(siteCrawlEdges.targetNodeKey, frontier)
+        or12(
+          inArray20(siteCrawlEdges.sourceNodeKey, frontier),
+          inArray20(siteCrawlEdges.targetNodeKey, frontier)
         )
       )).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(maxEdges + maxNodes + 1).all();
       if (candidates.length > maxEdges + maxNodes) queryTruncated = true;
@@ -58358,22 +59714,22 @@ async function technicalAeoRoutes(app, opts) {
       frontier = [...next].sort();
     }
     const nodeKeys = [...distances.keys()];
-    const pageRows = nodeKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
-      eq56(siteCrawlPages.projectId, scope.projectId),
-      eq56(siteCrawlPages.runId, scope.runId),
-      eq56(siteCrawlPages.attemptId, scope.attemptId),
-      inArray19(siteCrawlPages.nodeKey, nodeKeys)
+    const pageRows = nodeKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and45(
+      eq57(siteCrawlPages.projectId, scope.projectId),
+      eq57(siteCrawlPages.runId, scope.runId),
+      eq57(siteCrawlPages.attemptId, scope.attemptId),
+      inArray20(siteCrawlPages.nodeKey, nodeKeys)
     )).all();
     const persistedNodeKeys = new Set(pageRows.map((row) => row.nodeKey));
     const outermostNodeKeys = pageRows.filter((row) => distances.get(row.nodeKey) === hops).map((row) => row.nodeKey);
-    const omittedOutermostEdge = outermostNodeKeys.length === 0 ? void 0 : app.db.select({ edgeKey: siteCrawlEdges.edgeKey }).from(siteCrawlEdges).where(and44(
-      eq56(siteCrawlEdges.projectId, scope.projectId),
-      eq56(siteCrawlEdges.runId, scope.runId),
-      eq56(siteCrawlEdges.attemptId, scope.attemptId),
-      eq56(siteCrawlEdges.internal, true),
+    const omittedOutermostEdge = outermostNodeKeys.length === 0 ? void 0 : app.db.select({ edgeKey: siteCrawlEdges.edgeKey }).from(siteCrawlEdges).where(and45(
+      eq57(siteCrawlEdges.projectId, scope.projectId),
+      eq57(siteCrawlEdges.runId, scope.runId),
+      eq57(siteCrawlEdges.attemptId, scope.attemptId),
+      eq57(siteCrawlEdges.internal, true),
       isNotNull3(siteCrawlEdges.targetNodeKey),
-      inArray19(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
-      inArray19(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
+      inArray20(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
+      inArray20(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
     )).limit(1).get();
     if (omittedOutermostEdge && !seenEdgeKeys.has(omittedOutermostEdge.edgeKey)) {
       omittedEdgeKeys.add(omittedOutermostEdge.edgeKey);
@@ -58467,23 +59823,23 @@ async function technicalAeoRoutes(app, opts) {
     let found = fromPage.nodeKey === toPage.nodeKey;
     let truncated = false;
     for (let depth = 0; depth < maxDepth && frontier.length > 0 && !found; depth += 1) {
-      const candidates = app.db.select().from(siteCrawlEdges).where(and44(
-        eq56(siteCrawlEdges.projectId, scope.projectId),
-        eq56(siteCrawlEdges.runId, scope.runId),
-        eq56(siteCrawlEdges.attemptId, scope.attemptId),
-        eq56(siteCrawlEdges.internal, true),
-        eq56(siteCrawlEdges.followable, true),
-        eq56(siteCrawlEdges.relation, "anchor"),
+      const candidates = app.db.select().from(siteCrawlEdges).where(and45(
+        eq57(siteCrawlEdges.projectId, scope.projectId),
+        eq57(siteCrawlEdges.runId, scope.runId),
+        eq57(siteCrawlEdges.attemptId, scope.attemptId),
+        eq57(siteCrawlEdges.internal, true),
+        eq57(siteCrawlEdges.followable, true),
+        eq57(siteCrawlEdges.relation, "anchor"),
         isNotNull3(siteCrawlEdges.targetNodeKey),
-        inArray19(siteCrawlEdges.sourceNodeKey, frontier)
+        inArray20(siteCrawlEdges.sourceNodeKey, frontier)
       )).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(SITE_HEALTH_PATH_MAX_VISITED_NODES + 1).all();
       if (candidates.length > SITE_HEALTH_PATH_MAX_VISITED_NODES) truncated = true;
       const candidateTargetKeys = [...new Set(candidates.map((edge) => edge.targetNodeKey).filter((nodeKey) => nodeKey != null))];
-      const persistedTargetKeys = new Set(candidateTargetKeys.length === 0 ? [] : app.db.select({ nodeKey: siteCrawlPages.nodeKey }).from(siteCrawlPages).where(and44(
-        eq56(siteCrawlPages.projectId, scope.projectId),
-        eq56(siteCrawlPages.runId, scope.runId),
-        eq56(siteCrawlPages.attemptId, scope.attemptId),
-        inArray19(siteCrawlPages.nodeKey, candidateTargetKeys)
+      const persistedTargetKeys = new Set(candidateTargetKeys.length === 0 ? [] : app.db.select({ nodeKey: siteCrawlPages.nodeKey }).from(siteCrawlPages).where(and45(
+        eq57(siteCrawlPages.projectId, scope.projectId),
+        eq57(siteCrawlPages.runId, scope.runId),
+        eq57(siteCrawlPages.attemptId, scope.attemptId),
+        inArray20(siteCrawlPages.nodeKey, candidateTargetKeys)
       )).all().map((row) => row.nodeKey));
       const next = /* @__PURE__ */ new Set();
       for (const edge of candidates.slice(0, SITE_HEALTH_PATH_MAX_VISITED_NODES)) {
@@ -58525,11 +59881,11 @@ async function technicalAeoRoutes(app, opts) {
       pathEdges.unshift(step.edge);
       pathKeys.unshift(step.nodeKey);
     }
-    const pathRows = app.db.select().from(siteCrawlPages).where(and44(
-      eq56(siteCrawlPages.projectId, scope.projectId),
-      eq56(siteCrawlPages.runId, scope.runId),
-      eq56(siteCrawlPages.attemptId, scope.attemptId),
-      inArray19(siteCrawlPages.nodeKey, pathKeys)
+    const pathRows = app.db.select().from(siteCrawlPages).where(and45(
+      eq57(siteCrawlPages.projectId, scope.projectId),
+      eq57(siteCrawlPages.runId, scope.runId),
+      eq57(siteCrawlPages.attemptId, scope.attemptId),
+      inArray20(siteCrawlPages.nodeKey, pathKeys)
     )).all();
     const pageByKey = new Map(pathRows.map((row) => [row.nodeKey, row]));
     return {
@@ -58557,21 +59913,21 @@ async function technicalAeoRoutes(app, opts) {
       throw validationError("change must be all, added, removed, or changed");
     }
     const completeSnapshotFilters = [
-      eq56(siteCrawlSnapshots.projectId, project.id),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      eq56(runs.status, RunStatuses.completed),
-      eq56(siteCrawlSnapshots.complete, true),
+      eq57(siteCrawlSnapshots.projectId, project.id),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      eq57(runs.status, RunStatuses.completed),
+      eq57(siteCrawlSnapshots.complete, true),
       notProbeRun()
     ];
-    const afterTarget = request.query.toRunId ? resolveCrawl(project.id, request.query.toRunId) : app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(...completeSnapshotFilters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
+    const afterTarget = request.query.toRunId ? resolveCrawl(project.id, request.query.toRunId) : app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq57(siteCrawlSnapshots.runId, runs.id)).where(and45(...completeSnapshotFilters)).orderBy(desc24(siteCrawlSnapshots.createdAt), desc24(siteCrawlSnapshots.runId)).limit(1).get();
     if (request.query.toRunId && !afterTarget) throw notFound("Site crawl run", request.query.toRunId);
-    const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(
+    const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq57(siteCrawlSnapshots.runId, runs.id)).where(and45(
       ...completeSnapshotFilters,
-      or11(
+      or12(
         lt8(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
-        and44(
-          eq56(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+        and45(
+          eq57(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
           lt8(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
         )
       )
@@ -58806,18 +60162,18 @@ async function technicalAeoRoutes(app, opts) {
     const visibleKeys = keyRows.slice(0, limit);
     const pageKeys = visibleKeys.filter((row) => row.entity === "page").map((row) => row.key);
     const linkKeys = visibleKeys.filter((row) => row.entity === "link").map((row) => row.key);
-    const pageRowsFor = (scope) => pageKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and44(
-      eq56(siteCrawlPages.projectId, scope.projectId),
-      eq56(siteCrawlPages.runId, scope.runId),
-      eq56(siteCrawlPages.attemptId, scope.attemptId),
-      inArray19(siteCrawlPages.nodeKey, pageKeys)
+    const pageRowsFor = (scope) => pageKeys.length === 0 ? [] : app.db.select().from(siteCrawlPages).where(and45(
+      eq57(siteCrawlPages.projectId, scope.projectId),
+      eq57(siteCrawlPages.runId, scope.runId),
+      eq57(siteCrawlPages.attemptId, scope.attemptId),
+      inArray20(siteCrawlPages.nodeKey, pageKeys)
     )).all();
-    const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and44(
-      eq56(siteCrawlEdges.projectId, scope.projectId),
-      eq56(siteCrawlEdges.runId, scope.runId),
-      eq56(siteCrawlEdges.attemptId, scope.attemptId),
-      eq56(siteCrawlEdges.internal, true),
-      inArray19(siteCrawlEdges.edgeKey, linkKeys)
+    const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and45(
+      eq57(siteCrawlEdges.projectId, scope.projectId),
+      eq57(siteCrawlEdges.runId, scope.runId),
+      eq57(siteCrawlEdges.attemptId, scope.attemptId),
+      eq57(siteCrawlEdges.internal, true),
+      inArray20(siteCrawlEdges.edgeKey, linkKeys)
     )).all();
     const beforePages = new Map(pageRowsFor(beforeScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
     const afterPages = new Map(pageRowsFor(afterScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
@@ -58940,30 +60296,30 @@ async function technicalAeoRoutes(app, opts) {
       return { project: project.name, hasCrawlData: true, runId: snapshot.runId, total: 0, nextCursor: null, healthStateFilter: null, pages: [] };
     }
     const filters = [
-      eq56(siteCrawlPages.projectId, project.id),
-      eq56(siteCrawlPages.runId, snapshot.runId),
-      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
+      eq57(siteCrawlPages.projectId, project.id),
+      eq57(siteCrawlPages.runId, snapshot.runId),
+      eq57(siteCrawlPages.attemptId, snapshot.attemptId)
     ];
-    if (request.query.nodeKey) filters.push(eq56(siteCrawlPages.nodeKey, request.query.nodeKey));
+    if (request.query.nodeKey) filters.push(eq57(siteCrawlPages.nodeKey, request.query.nodeKey));
     const inventoryEligible = parseBoolean2(request.query.inventoryEligible);
-    if (inventoryEligible != null) filters.push(eq56(siteCrawlPages.inventoryEligible, inventoryEligible));
-    if (request.query.fetchState) filters.push(eq56(siteCrawlPages.fetchState, request.query.fetchState));
-    if (request.query.indexabilityState) filters.push(eq56(siteCrawlPages.indexabilityState, request.query.indexabilityState));
-    if (request.query.auditState) filters.push(eq56(siteCrawlPages.auditState, request.query.auditState));
+    if (inventoryEligible != null) filters.push(eq57(siteCrawlPages.inventoryEligible, inventoryEligible));
+    if (request.query.fetchState) filters.push(eq57(siteCrawlPages.fetchState, request.query.fetchState));
+    if (request.query.indexabilityState) filters.push(eq57(siteCrawlPages.indexabilityState, request.query.indexabilityState));
+    if (request.query.auditState) filters.push(eq57(siteCrawlPages.auditState, request.query.auditState));
     const healthState = parseSiteHealthState(request.query.healthState);
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
     const orderBy = request.query.sort === "score-desc" ? [desc24(siteCrawlPages.auditScore), asc10(siteCrawlPages.nodeKey)] : request.query.sort === "score-asc" ? [asc10(siteCrawlPages.auditScore), asc10(siteCrawlPages.nodeKey)] : request.query.sort === "path" ? [asc10(siteCrawlPages.path), asc10(siteCrawlPages.nodeKey)] : [asc10(siteCrawlPages.url), asc10(siteCrawlPages.nodeKey)];
     let healthStateFilter = null;
     if (healthState) {
-      const legacyRow = app.db.select({ id: siteCrawlPages.id }).from(siteCrawlPages).where(and44(
-        eq56(siteCrawlPages.projectId, project.id),
-        eq56(siteCrawlPages.runId, snapshot.runId),
-        eq56(siteCrawlPages.attemptId, snapshot.attemptId),
-        isNull5(siteCrawlPages.healthState)
+      const legacyRow = app.db.select({ id: siteCrawlPages.id }).from(siteCrawlPages).where(and45(
+        eq57(siteCrawlPages.projectId, project.id),
+        eq57(siteCrawlPages.runId, snapshot.runId),
+        eq57(siteCrawlPages.attemptId, snapshot.attemptId),
+        isNull6(siteCrawlPages.healthState)
       )).limit(1).get();
       healthStateFilter = legacyRow ? "unavailable-legacy-scan" : "applied";
-      if (healthStateFilter === "applied") filters.push(eq56(siteCrawlPages.healthState, healthState));
+      if (healthStateFilter === "applied") filters.push(eq57(siteCrawlPages.healthState, healthState));
     }
     if (healthStateFilter === "unavailable-legacy-scan") {
       return {
@@ -58976,7 +60332,7 @@ async function technicalAeoRoutes(app, opts) {
         pages: []
       };
     }
-    const where = and44(...filters);
+    const where = and45(...filters);
     const total = app.db.select({ value: count() }).from(siteCrawlPages).where(where).get()?.value ?? 0;
     const rows = app.db.select().from(siteCrawlPages).where(where).orderBy(...orderBy).limit(limit).offset(offset).all();
     const nextOffset = offset + rows.length;
@@ -59007,10 +60363,10 @@ async function technicalAeoRoutes(app, opts) {
       url: siteCrawlPages.url,
       inventoryEligible: siteCrawlPages.inventoryEligible,
       fetchState: siteCrawlPages.fetchState
-    }).from(siteCrawlPages).where(and44(
-      eq56(siteCrawlPages.projectId, project.id),
-      eq56(siteCrawlPages.runId, snapshot.runId),
-      eq56(siteCrawlPages.attemptId, snapshot.attemptId)
+    }).from(siteCrawlPages).where(and45(
+      eq57(siteCrawlPages.projectId, project.id),
+      eq57(siteCrawlPages.runId, snapshot.runId),
+      eq57(siteCrawlPages.attemptId, snapshot.attemptId)
     )).limit(MAX_STRUCTURE_SOURCE_ROWS + 1).all();
     if (sourceRows.length > MAX_STRUCTURE_SOURCE_ROWS) {
       throw validationError(`Persisted crawl exceeds the ${MAX_STRUCTURE_SOURCE_ROWS}-page structure limit`);
@@ -59089,17 +60445,17 @@ async function technicalAeoRoutes(app, opts) {
       };
     }
     const filters = [
-      eq56(siteCrawlEdges.projectId, project.id),
-      eq56(siteCrawlEdges.runId, snapshot.runId),
-      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq56(siteCrawlEdges.internal, true),
+      eq57(siteCrawlEdges.projectId, project.id),
+      eq57(siteCrawlEdges.runId, snapshot.runId),
+      eq57(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq57(siteCrawlEdges.internal, true),
       linkKindFilter(linkKind)
     ];
-    if (request.query.sourceUrl) filters.push(eq56(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
-    if (request.query.targetUrl) filters.push(eq56(siteCrawlEdges.targetUrl, request.query.targetUrl));
+    if (request.query.sourceUrl) filters.push(eq57(siteCrawlEdges.sourceUrl, request.query.sourceUrl));
+    if (request.query.targetUrl) filters.push(eq57(siteCrawlEdges.targetUrl, request.query.targetUrl));
     const followable = parseBoolean2(request.query.followable);
-    if (followable != null) filters.push(eq56(siteCrawlEdges.followable, followable));
-    const where = and44(...filters);
+    if (followable != null) filters.push(eq57(siteCrawlEdges.followable, followable));
+    const where = and45(...filters);
     const total = app.db.select({ value: count() }).from(siteCrawlEdges).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const offset = decodeCursor(request.query.cursor);
@@ -59157,17 +60513,17 @@ async function technicalAeoRoutes(app, opts) {
       };
     }
     const scope = [
-      eq56(siteCrawlEdges.projectId, project.id),
-      eq56(siteCrawlEdges.runId, snapshot.runId),
-      eq56(siteCrawlEdges.attemptId, snapshot.attemptId),
-      eq56(siteCrawlEdges.internal, true),
+      eq57(siteCrawlEdges.projectId, project.id),
+      eq57(siteCrawlEdges.runId, snapshot.runId),
+      eq57(siteCrawlEdges.attemptId, snapshot.attemptId),
+      eq57(siteCrawlEdges.internal, true),
       linkKindFilter(linkKind)
     ];
-    const inboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.targetUrl, request.query.url);
-    const outboundMatch = request.query.nodeKey && request.query.url ? or11(eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq56(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq56(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq56(siteCrawlEdges.sourceUrl, request.query.url);
+    const inboundMatch = request.query.nodeKey && request.query.url ? or12(eq57(siteCrawlEdges.targetNodeKey, request.query.nodeKey), eq57(siteCrawlEdges.targetUrl, request.query.url)) : request.query.nodeKey ? eq57(siteCrawlEdges.targetNodeKey, request.query.nodeKey) : eq57(siteCrawlEdges.targetUrl, request.query.url);
+    const outboundMatch = request.query.nodeKey && request.query.url ? or12(eq57(siteCrawlEdges.sourceNodeKey, request.query.nodeKey), eq57(siteCrawlEdges.sourceUrl, request.query.url)) : request.query.nodeKey ? eq57(siteCrawlEdges.sourceNodeKey, request.query.nodeKey) : eq57(siteCrawlEdges.sourceUrl, request.query.url);
     const limit = parseBoundedLimit(request.query.limit, 50, 100);
-    const inboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
-    const outboundRows = app.db.select().from(siteCrawlEdges).where(and44(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const inboundRows = app.db.select().from(siteCrawlEdges).where(and45(...scope, inboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
+    const outboundRows = app.db.select().from(siteCrawlEdges).where(and45(...scope, outboundMatch)).orderBy(asc10(siteCrawlEdges.edgeKey)).limit(limit + 1).all();
     return {
       project: project.name,
       hasCrawlData: true,
@@ -59200,11 +60556,11 @@ async function technicalAeoRoutes(app, opts) {
     if (!snapshot.attemptId) {
       return { project: project.name, runId: snapshot.runId, state: "partial", checkDeadLinks: true, checked: snapshot.deadLinksChecked, found: snapshot.deadLinksFound, total: 0, nextCursor: null, deadLinks: [] };
     }
-    const where = and44(
-      eq56(siteCrawlFindings.projectId, project.id),
-      eq56(siteCrawlFindings.runId, snapshot.runId),
-      eq56(siteCrawlFindings.attemptId, snapshot.attemptId),
-      eq56(siteCrawlFindings.findingType, "dead-link")
+    const where = and45(
+      eq57(siteCrawlFindings.projectId, project.id),
+      eq57(siteCrawlFindings.runId, snapshot.runId),
+      eq57(siteCrawlFindings.attemptId, snapshot.attemptId),
+      eq57(siteCrawlFindings.findingType, "dead-link")
     );
     const total = app.db.select({ value: count() }).from(siteCrawlFindings).where(where).get()?.value ?? 0;
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
@@ -59242,19 +60598,19 @@ async function technicalAeoRoutes(app, opts) {
       createdAt: runs.createdAt,
       startedAt: runs.startedAt,
       finishedAt: runs.finishedAt
-    }).from(runs).where(and44(
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
+    }).from(runs).where(and45(
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
       notProbeRun()
     )).orderBy(desc24(runs.createdAt), desc24(runs.id)).limit(limit).all();
     const runIds = rows.map((row) => row.runId);
-    const crawlRunIds = new Set(runIds.length === 0 ? [] : app.db.select({ runId: siteCrawlSnapshots.runId }).from(siteCrawlSnapshots).innerJoin(runs, eq56(siteCrawlSnapshots.runId, runs.id)).where(and44(
-      eq56(siteCrawlSnapshots.projectId, project.id),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
-      inArray19(runs.status, SURFACEABLE_STATUSES),
+    const crawlRunIds = new Set(runIds.length === 0 ? [] : app.db.select({ runId: siteCrawlSnapshots.runId }).from(siteCrawlSnapshots).innerJoin(runs, eq57(siteCrawlSnapshots.runId, runs.id)).where(and45(
+      eq57(siteCrawlSnapshots.projectId, project.id),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
+      inArray20(runs.status, SURFACEABLE_STATUSES),
       notProbeRun(),
-      inArray19(siteCrawlSnapshots.runId, runIds)
+      inArray20(siteCrawlSnapshots.runId, runIds)
     )).all().map((row) => row.runId));
     return {
       project: project.name,
@@ -59267,21 +60623,21 @@ async function technicalAeoRoutes(app, opts) {
   });
   app.get("/projects/:name/technical-aeo/runs/:runId/progress", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const run = app.db.select().from(runs).where(and44(
-      eq56(runs.id, request.params.runId),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
+    const run = app.db.select().from(runs).where(and45(
+      eq57(runs.id, request.params.runId),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
       notProbeRun()
     )).get();
     if (!run) throw notFound("Site audit run", request.params.runId);
-    const attempt = app.db.select().from(siteCrawlAttempts).where(and44(
-      eq56(siteCrawlAttempts.projectId, project.id),
-      eq56(siteCrawlAttempts.runId, run.id)
+    const attempt = app.db.select().from(siteCrawlAttempts).where(and45(
+      eq57(siteCrawlAttempts.projectId, project.id),
+      eq57(siteCrawlAttempts.runId, run.id)
     )).orderBy(desc24(siteCrawlAttempts.attemptNumber), desc24(siteCrawlAttempts.updatedAt)).limit(1).get();
-    const persistedLayout = attempt ? app.db.select().from(siteCrawlGraphLayouts).where(and44(
-      eq56(siteCrawlGraphLayouts.projectId, project.id),
-      eq56(siteCrawlGraphLayouts.runId, run.id),
-      eq56(siteCrawlGraphLayouts.attemptId, attempt.id)
+    const persistedLayout = attempt ? app.db.select().from(siteCrawlGraphLayouts).where(and45(
+      eq57(siteCrawlGraphLayouts.projectId, project.id),
+      eq57(siteCrawlGraphLayouts.runId, run.id),
+      eq57(siteCrawlGraphLayouts.attemptId, attempt.id)
     )).get() : void 0;
     const layoutState = persistedLayout?.state === "ready" || persistedLayout?.state === "unavailable" ? persistedLayout.state : run.status === RunStatuses.completed || run.status === RunStatuses.partial ? "unavailable" : "pending";
     return {
@@ -59312,18 +60668,18 @@ async function technicalAeoRoutes(app, opts) {
     };
   });
   app.get("/projects/:name/technical-aeo/runs/:runId/page-health-preview", async (request) => app.db.transaction((tx) => {
-    const project = tx.select().from(projects).where(eq56(projects.name, request.params.name)).get();
+    const project = tx.select().from(projects).where(eq57(projects.name, request.params.name)).get();
     if (!project) throw notFound("Project", request.params.name);
-    const run = tx.select().from(runs).where(and44(
-      eq56(runs.id, request.params.runId),
-      eq56(runs.projectId, project.id),
-      eq56(runs.kind, RunKinds["site-audit"]),
+    const run = tx.select().from(runs).where(and45(
+      eq57(runs.id, request.params.runId),
+      eq57(runs.projectId, project.id),
+      eq57(runs.kind, RunKinds["site-audit"]),
       notProbeRun()
     )).get();
     if (!run) throw notFound("Site audit run", request.params.runId);
-    const attempt = tx.select().from(siteCrawlAttempts).where(and44(
-      eq56(siteCrawlAttempts.projectId, project.id),
-      eq56(siteCrawlAttempts.runId, run.id)
+    const attempt = tx.select().from(siteCrawlAttempts).where(and45(
+      eq57(siteCrawlAttempts.projectId, project.id),
+      eq57(siteCrawlAttempts.runId, run.id)
     )).orderBy(desc24(siteCrawlAttempts.attemptNumber), desc24(siteCrawlAttempts.updatedAt)).limit(1).get();
     const state = run.status === RunStatuses.queued ? "waiting" : run.status === RunStatuses.running ? "collecting" : "terminal";
     const base = {
@@ -59337,11 +60693,11 @@ async function technicalAeoRoutes(app, opts) {
     if (!attempt) {
       return { ...base, pagesAudited: 0, examples: [] };
     }
-    const auditedWhere = and44(
-      eq56(siteCrawlPages.projectId, project.id),
-      eq56(siteCrawlPages.runId, run.id),
-      eq56(siteCrawlPages.attemptId, attempt.id),
-      eq56(siteCrawlPages.auditState, "success")
+    const auditedWhere = and45(
+      eq57(siteCrawlPages.projectId, project.id),
+      eq57(siteCrawlPages.runId, run.id),
+      eq57(siteCrawlPages.attemptId, attempt.id),
+      eq57(siteCrawlPages.auditState, "success")
     );
     const pagesAudited = tx.select({ value: count() }).from(siteCrawlPages).where(auditedWhere).get()?.value ?? 0;
     if (state !== "collecting") {
@@ -59352,7 +60708,7 @@ async function technicalAeoRoutes(app, opts) {
       url: siteCrawlPages.url,
       auditScore: siteCrawlPages.auditScore,
       auditFields: siteCrawlPages.auditFields
-    }).from(siteCrawlPages).where(and44(
+    }).from(siteCrawlPages).where(and45(
       auditedWhere,
       isNotNull3(siteCrawlPages.auditScore),
       lt8(siteCrawlPages.auditScore, 70)
@@ -59388,13 +60744,13 @@ async function technicalAeoRoutes(app, opts) {
         status: runs.status,
         identityKey: siteCrawlRunRequests.identityKey,
         effectiveOptions: siteCrawlRunRequests.effectiveOptions
-      }).from(runs).leftJoin(siteCrawlRunRequests, and44(
-        eq56(siteCrawlRunRequests.projectId, runs.projectId),
-        eq56(siteCrawlRunRequests.runId, runs.id)
-      )).where(and44(
-        eq56(runs.projectId, project.id),
-        eq56(runs.kind, RunKinds["site-audit"]),
-        inArray19(runs.status, [RunStatuses.queued, RunStatuses.running])
+      }).from(runs).leftJoin(siteCrawlRunRequests, and45(
+        eq57(siteCrawlRunRequests.projectId, runs.projectId),
+        eq57(siteCrawlRunRequests.runId, runs.id)
+      )).where(and45(
+        eq57(runs.projectId, project.id),
+        eq57(runs.kind, RunKinds["site-audit"]),
+        inArray20(runs.status, [RunStatuses.queued, RunStatuses.running])
       )).get();
       if (existing) {
         if (existing.identityKey === identityKey) {
@@ -59445,7 +60801,7 @@ async function technicalAeoRoutes(app, opts) {
 
 // ../api-routes/src/research.ts
 import crypto45 from "crypto";
-import { and as and45, desc as desc25, eq as eq57 } from "drizzle-orm";
+import { and as and46, desc as desc25, eq as eq58 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 async function researchRoutes(app, opts) {
   app.post("/projects/:name/research/runs", async (request, reply) => {
@@ -59475,7 +60831,7 @@ async function researchRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const decision = app.db.transaction((tx) => {
       if (input.idempotencyKey) {
-        const existing = tx.select().from(researchRuns).where(and45(eq57(researchRuns.projectId, project.id), eq57(researchRuns.idempotencyKey, input.idempotencyKey))).get();
+        const existing = tx.select().from(researchRuns).where(and46(eq58(researchRuns.projectId, project.id), eq58(researchRuns.idempotencyKey, input.idempotencyKey))).get();
         if (existing) {
           if (existing.requestHash !== requestHash2) throw alreadyExists("Research idempotency key", input.idempotencyKey);
           return { reused: true, id: existing.id, shouldDispatch: existing.status === ResearchRunStatuses.queued };
@@ -59496,7 +60852,7 @@ async function researchRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const requested = Number.parseInt(request.query.limit ?? "", 10);
     const limit = Number.isInteger(requested) && requested > 0 ? Math.min(requested, 100) : 20;
-    const runs2 = app.db.select().from(researchRuns).where(eq57(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
+    const runs2 = app.db.select().from(researchRuns).where(eq58(researchRuns.projectId, project.id)).orderBy(desc25(researchRuns.createdAt)).limit(limit).all().map(serializeRun);
     return { runs: runs2 };
   });
   app.get("/projects/:name/research/runs/:runId", async (request) => {
@@ -59505,9 +60861,9 @@ async function researchRoutes(app, opts) {
   });
 }
 function getDetail(app, projectId, id) {
-  const row = app.db.select().from(researchRuns).where(and45(eq57(researchRuns.id, id), eq57(researchRuns.projectId, projectId))).get();
+  const row = app.db.select().from(researchRuns).where(and46(eq58(researchRuns.id, id), eq58(researchRuns.projectId, projectId))).get();
   if (!row) throw notFound("Research run", id);
-  const queries2 = app.db.select().from(researchRunQueries).where(eq57(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
+  const queries2 = app.db.select().from(researchRunQueries).where(eq58(researchRunQueries.researchRunId, id)).orderBy(researchRunQueries.position).all().map(serializeQuery);
   return { ...serializeRun(row), queries: queries2 };
 }
 function serializeRun(row) {
@@ -59718,6 +61074,9 @@ async function apiRoutes(app, opts) {
       pullVercelTrafficEvents: opts.pullVercelTrafficEvents,
       vercelSyncDeadlineMs: opts.vercelSyncDeadlineMs,
       cloudflareTrafficCredentialStore: opts.cloudflareTrafficCredentialStore,
+      pullCloudflareQueueMessages: opts.pullCloudflareQueueMessages,
+      ackCloudflareQueueMessages: opts.ackCloudflareQueueMessages,
+      cloudflareQueueMaxBatches: opts.cloudflareQueueMaxBatches,
       cloudflareTrafficIngestUrl: opts.cloudflareTrafficIngestUrl,
       cloudflareIngestRateLimitMax: opts.cloudflareIngestRateLimitMax,
       cloudflareIngestIpRateLimitMax: opts.cloudflareIngestIpRateLimitMax,
@@ -59907,22 +61266,31 @@ function buildTrafficSourceValidators(opts) {
     validators[TrafficSourceTypes.cloudflare] = {
       validateCredentials: (source) => {
         const sourceMode = source.configJson.deliveryMode;
-        if (sourceMode !== void 0 && sourceMode !== "direct-push") return null;
-        const record = store.getConnection(source.projectName);
+        const deliveryMode = sourceMode === "queue-pull" ? "queue-pull" : "direct-push";
+        const record = store.getConnectionBySourceId(source.id);
         if (!record) {
+          const projectRecord = store.getConnection(source.projectName);
+          if (projectRecord && projectRecord.sourceId !== source.id) {
+            return {
+              status: CheckStatuses.fail,
+              code: "traffic.credentials.source-mismatch",
+              summary: `The stored Cloudflare credential belongs to a different source than "${source.displayName}".`,
+              remediation: "Reconnect the Cloudflare source to pair the credential and source row."
+            };
+          }
           return {
             status: CheckStatuses.fail,
             code: "traffic.credentials.missing",
-            summary: `No Cloudflare direct-push credential is stored for project "${source.projectName}".`,
+            summary: `No Cloudflare ${deliveryMode} credential is stored for source "${source.displayName}".`,
             remediation: "Re-run `canonry traffic connect cloudflare <project> --zone-id <id>` from the credential-owning host."
           };
         }
         const recordMode = record.deliveryMode;
-        if (recordMode !== "direct-push") {
+        if (recordMode !== deliveryMode) {
           return {
             status: CheckStatuses.fail,
             code: "traffic.credentials.mode-mismatch",
-            summary: `The stored Cloudflare credential mode does not match direct-push source "${source.displayName}".`,
+            summary: `The stored Cloudflare credential mode does not match ${deliveryMode} source "${source.displayName}".`,
             remediation: "Reconnect the Cloudflare source from the credential-owning host."
           };
         }
@@ -59934,9 +61302,23 @@ function buildTrafficSourceValidators(opts) {
             remediation: "Reconnect the Cloudflare source to pair the credential and source row."
           };
         }
-        const bearerToken = record.bearerToken;
-        const hmacSecret = record.hmacSecret;
-        if (typeof bearerToken !== "string" || bearerToken.length === 0 || typeof hmacSecret !== "string" || hmacSecret.length === 0 || !source.ingestTokenHash || hashCloudflareBearerToken(bearerToken) !== source.ingestTokenHash) {
+        if (record.deliveryMode === "queue-pull") {
+          const queueConfig = source.configJson;
+          if (typeof record.apiToken !== "string" || record.apiToken.length === 0 || typeof record.accountId !== "string" || record.accountId.length === 0 || typeof record.queueId !== "string" || record.queueId.length === 0 || typeof record.queueName !== "string" || record.queueName.length === 0 || !Number.isInteger(record.retentionSeconds) || record.retentionSeconds < 60 || record.retentionSeconds > 1209600 || queueConfig.accountId !== record.accountId || queueConfig.queueId !== record.queueId || queueConfig.queueName !== record.queueName || queueConfig.retentionSeconds !== record.retentionSeconds) {
+            return {
+              status: CheckStatuses.fail,
+              code: "traffic.credentials.queue-mismatch",
+              summary: `The stored Cloudflare Queue credential does not match source "${source.displayName}".`,
+              remediation: "Reconnect the Cloudflare Queue source from the credential-owning host."
+            };
+          }
+          return {
+            status: CheckStatuses.ok,
+            code: "traffic.credentials.resolved",
+            summary: `Cloudflare Queue credentials match source "${source.displayName}".`
+          };
+        }
+        if (typeof record.bearerToken !== "string" || record.bearerToken.length === 0 || typeof record.hmacSecret !== "string" || record.hmacSecret.length === 0 || !source.ingestTokenHash || hashCloudflareBearerToken(record.bearerToken) !== source.ingestTokenHash) {
           return {
             status: CheckStatuses.fail,
             code: "traffic.credentials.bearer-mismatch",
@@ -59950,7 +61332,15 @@ function buildTrafficSourceValidators(opts) {
           summary: `Cloudflare direct-push credentials match source "${source.displayName}".`
         };
       },
-      validateScopes: () => null
+      validateScopes: (source) => {
+        if (source.configJson.deliveryMode !== "queue-pull") return null;
+        return {
+          status: CheckStatuses.skipped,
+          code: "traffic.scopes.queue-pull-static",
+          summary: `Cloudflare Queue token scopes for "${source.displayName}" are not inspected by Doctor.`,
+          remediation: `Verify the token has Account Queues Edit permission and run \`wrangler queues consumer http add ${source.configJson.queueName}\` for the configured Queue, then re-run the Queue smoke test.`
+        };
+      }
     };
   }
   return Object.keys(validators).length > 0 ? validators : void 0;
@@ -60165,9 +61555,9 @@ var IntelligenceService = class {
    */
   analyzeAndPersist(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
-      and46(
-        eq58(runs.projectId, projectId),
-        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
+      and47(
+        eq59(runs.projectId, projectId),
+        or13(eq59(runs.status, "completed"), eq59(runs.status, "partial")),
         // Defensive: RunCoordinator already skips probes before this is
         // called, but if a future call site invokes analyzeAndPersist
         // directly for a probe, probes still must not pollute the
@@ -60249,7 +61639,7 @@ var IntelligenceService = class {
    * Returns the persisted insights so the coordinator can count critical/high.
    */
   analyzeAndPersistGbp(runId, projectId) {
-    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq58(runs.id, runId)).get();
+    const runRow = this.db.select({ createdAt: runs.createdAt, startedAt: runs.startedAt, finishedAt: runs.finishedAt }).from(runs).where(eq59(runs.id, runId)).get();
     if (!runRow) {
       log.info("gbp-intelligence.skip", { runId, reason: "run not found" });
       this.persistGbpInsights(runId, projectId, [], []);
@@ -60257,11 +61647,11 @@ var IntelligenceService = class {
     }
     const windowStart = runRow.startedAt ?? runRow.createdAt;
     const windowEnd = runRow.finishedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-    const selected = this.db.select().from(gbpLocations).where(and46(
-      eq58(gbpLocations.projectId, projectId),
-      eq58(gbpLocations.selected, true),
+    const selected = this.db.select().from(gbpLocations).where(and47(
+      eq59(gbpLocations.projectId, projectId),
+      eq59(gbpLocations.selected, true),
       gte14(gbpLocations.syncedAt, windowStart),
-      lte11(gbpLocations.syncedAt, windowEnd)
+      lte12(gbpLocations.syncedAt, windowEnd)
     )).all();
     if (selected.length === 0) {
       log.info("gbp-intelligence.skip", { runId, reason: "no locations synced during run" });
@@ -60294,12 +61684,12 @@ var IntelligenceService = class {
   }
   /** Build the per-location signal bundle the GBP analyzer consumes. */
   buildGbpLocationSignals(projectId, locationName, displayName, fallbackDate) {
-    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and46(eq58(gbpDailyMetrics.projectId, projectId), eq58(gbpDailyMetrics.locationName, locationName))).all();
-    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and46(eq58(gbpPlaceActions.projectId, projectId), eq58(gbpPlaceActions.locationName, locationName))).all();
-    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and46(eq58(gbpLodgingSnapshots.projectId, projectId), eq58(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
-    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and46(eq58(gbpLocations.projectId, projectId), eq58(gbpLocations.locationName, locationName))).get();
+    const metricRows = this.db.select({ metric: gbpDailyMetrics.metric, date: gbpDailyMetrics.date, value: gbpDailyMetrics.value }).from(gbpDailyMetrics).where(and47(eq59(gbpDailyMetrics.projectId, projectId), eq59(gbpDailyMetrics.locationName, locationName))).all();
+    const placeActionRows = this.db.select({ placeActionType: gbpPlaceActions.placeActionType, providerType: gbpPlaceActions.providerType }).from(gbpPlaceActions).where(and47(eq59(gbpPlaceActions.projectId, projectId), eq59(gbpPlaceActions.locationName, locationName))).all();
+    const lodgingRow = this.db.select({ populatedGroupCount: gbpLodgingSnapshots.populatedGroupCount }).from(gbpLodgingSnapshots).where(and47(eq59(gbpLodgingSnapshots.projectId, projectId), eq59(gbpLodgingSnapshots.locationName, locationName))).orderBy(desc26(gbpLodgingSnapshots.syncedAt)).limit(1).get();
+    const ownerRow = this.db.select({ description: gbpLocations.description }).from(gbpLocations).where(and47(eq59(gbpLocations.projectId, projectId), eq59(gbpLocations.locationName, locationName))).get();
     const descriptionMissing = !(ownerRow?.description ?? "").trim();
-    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and46(eq58(gbpPlaceDetails.projectId, projectId), eq58(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
+    const placeRow = this.db.select({ attributes: gbpPlaceDetails.attributes }).from(gbpPlaceDetails).where(and47(eq59(gbpPlaceDetails.projectId, projectId), eq59(gbpPlaceDetails.locationName, locationName))).orderBy(desc26(gbpPlaceDetails.syncedAt)).limit(1).get();
     const placesAmenities = placeRow ? extractPlaceAmenities(placeRow.attributes) : [];
     const summary = buildGbpSummary({
       locationName,
@@ -60335,7 +61725,7 @@ var IntelligenceService = class {
   /** Build the month-over-month keyword series for a location from the
    *  accumulating gbp_keyword_monthly table (latest complete month vs prior). */
   buildGbpKeywordTrend(projectId, locationName) {
-    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and46(eq58(gbpKeywordMonthly.projectId, projectId), eq58(gbpKeywordMonthly.locationName, locationName))).all();
+    const rows = this.db.select({ month: gbpKeywordMonthly.month, keyword: gbpKeywordMonthly.keyword, valueCount: gbpKeywordMonthly.valueCount }).from(gbpKeywordMonthly).where(and47(eq59(gbpKeywordMonthly.projectId, projectId), eq59(gbpKeywordMonthly.locationName, locationName))).all();
     if (rows.length === 0) return { recentMonth: null, priorMonth: null, points: [] };
     const months = [...new Set(rows.map((r) => r.month))].sort().reverse();
     const recentMonth = months[0] ?? null;
@@ -60366,7 +61756,7 @@ var IntelligenceService = class {
    */
   persistGbpInsights(runId, projectId, gbpInsights, coveredLocationNames) {
     const covered = new Set(coveredLocationNames);
-    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and46(eq58(insights.projectId, projectId), eq58(insights.provider, GBP_INSIGHT_PROVIDER))).all();
+    const existing = this.db.select({ id: insights.id, dismissed: insights.dismissed }).from(insights).where(and47(eq59(insights.projectId, projectId), eq59(insights.provider, GBP_INSIGHT_PROVIDER))).all();
     const staleIds = [];
     const dismissedSlots = /* @__PURE__ */ new Set();
     for (const row of existing) {
@@ -60377,7 +61767,7 @@ var IntelligenceService = class {
     }
     this.db.transaction((tx) => {
       for (const id of staleIds) {
-        tx.delete(insights).where(eq58(insights.id, id)).run();
+        tx.delete(insights).where(eq59(insights.id, id)).run();
       }
       for (const insight of gbpInsights) {
         const parsed = parseGbpInsightId(insight.id);
@@ -60455,7 +61845,7 @@ var IntelligenceService = class {
    *     create per run + aggregate). DB is left untouched.
    */
   backfill(projectName, opts, onProgress) {
-    const project = this.db.select().from(projects).where(eq58(projects.name, projectName)).get();
+    const project = this.db.select().from(projects).where(eq59(projects.name, projectName)).get();
     if (!project) {
       throw new Error(`Project "${projectName}" not found`);
     }
@@ -60468,9 +61858,9 @@ var IntelligenceService = class {
       sinceTimestamp = parsed;
     }
     const allRuns = this.db.select().from(runs).where(
-      and46(
-        eq58(runs.projectId, project.id),
-        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
+      and47(
+        eq59(runs.projectId, project.id),
+        or13(eq59(runs.status, "completed"), eq59(runs.status, "partial")),
         // Backfill must not replay probe runs as if they were real sweeps.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -60503,7 +61893,7 @@ var IntelligenceService = class {
     let wouldDeleteTotal = 0;
     const existingByRunId = /* @__PURE__ */ new Map();
     if (isDryRun && targetRuns.length > 0) {
-      const rows = this.db.select({ runId: insights.runId }).from(insights).where(inArray20(insights.runId, targetRuns.map((r) => r.id))).all();
+      const rows = this.db.select({ runId: insights.runId }).from(insights).where(inArray21(insights.runId, targetRuns.map((r) => r.id))).all();
       for (const r of rows) {
         if (r.runId == null) continue;
         existingByRunId.set(r.runId, (existingByRunId.get(r.runId) ?? 0) + 1);
@@ -60549,7 +61939,7 @@ var IntelligenceService = class {
     return { processed, skipped, totalInsights };
   }
   loadTrackedCompetitors(projectId) {
-    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq58(competitors.projectId, projectId)).all().map((r) => r.domain);
+    return this.db.select({ domain: competitors.domain }).from(competitors).where(eq59(competitors.projectId, projectId)).all().map((r) => r.domain);
   }
   /**
    * Wipe transition signals from an analysis result while keeping health.
@@ -60570,15 +61960,15 @@ var IntelligenceService = class {
   }
   persistResult(result, runId, projectId) {
     const previouslyDismissed = /* @__PURE__ */ new Set();
-    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq58(insights.runId, runId)).all();
+    const existingInsights = this.db.select({ query: insights.query, provider: insights.provider, type: insights.type, dismissed: insights.dismissed }).from(insights).where(eq59(insights.runId, runId)).all();
     for (const row of existingInsights) {
       if (row.dismissed) {
         previouslyDismissed.add(`${row.query}:${row.provider}:${row.type}`);
       }
     }
     this.db.transaction((tx) => {
-      tx.delete(insights).where(eq58(insights.runId, runId)).run();
-      tx.delete(healthSnapshots).where(eq58(healthSnapshots.runId, runId)).run();
+      tx.delete(insights).where(eq59(insights.runId, runId)).run();
+      tx.delete(healthSnapshots).where(eq59(healthSnapshots.runId, runId)).run();
       const now = (/* @__PURE__ */ new Date()).toISOString();
       for (const insight of result.insights) {
         const wasDismissed = previouslyDismissed.has(`${insight.query}:${insight.provider}:${insight.type}`);
@@ -60631,24 +62021,24 @@ var IntelligenceService = class {
   applySeverityTiering(rawInsights, excludeRunId, projectId) {
     const regressions = rawInsights.filter((i) => i.type === "regression");
     if (regressions.length === 0) return rawInsights;
-    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq58(gscSearchData.projectId, projectId)).all();
+    const gscRows = this.db.select({ query: gscSearchData.query, impressions: gscSearchData.impressions }).from(gscSearchData).where(eq59(gscSearchData.projectId, projectId)).all();
     const gscConnected = gscRows.length > 0;
     const gscImpressionsByQuery = /* @__PURE__ */ new Map();
     for (const row of gscRows) {
       const key = row.query.toLowerCase();
       gscImpressionsByQuery.set(key, (gscImpressionsByQuery.get(key) ?? 0) + row.impressions);
     }
-    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq58(projects.id, projectId)).get();
+    const projectRow = this.db.select({ locations: projects.locations }).from(projects).where(eq59(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectRow?.locations ?? []).length
     );
     const ROWS_PER_GROUP_BUDGET = Math.max(2, locationCount);
     const recentRunRows = this.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(
-      and46(
-        eq58(runs.projectId, projectId),
-        eq58(runs.kind, RunKinds["answer-visibility"]),
-        or12(eq58(runs.status, "completed"), eq58(runs.status, "partial")),
+      and47(
+        eq59(runs.projectId, projectId),
+        eq59(runs.kind, RunKinds["answer-visibility"]),
+        or13(eq59(runs.status, "completed"), eq59(runs.status, "partial")),
         // Defensive — see top of file.
         ne7(runs.trigger, RunTriggers.probe)
       )
@@ -60668,7 +62058,7 @@ var IntelligenceService = class {
     const haveHistory = recentRunIds.length > 0;
     const priorRegressionsByPair = /* @__PURE__ */ new Map();
     if (haveHistory) {
-      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and46(eq58(insights.type, "regression"), inArray20(insights.runId, recentRunIds))).all();
+      const priorRows = this.db.select({ query: insights.query, provider: insights.provider, runId: insights.runId }).from(insights).where(and47(eq59(insights.type, "regression"), inArray21(insights.runId, recentRunIds))).all();
       const regressionGroups = /* @__PURE__ */ new Map();
       for (const row of priorRows) {
         if (!row.runId) continue;
@@ -60697,7 +62087,7 @@ var IntelligenceService = class {
     });
   }
   buildRunData(runId, projectId, completedAt, location = null) {
-    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq58(projects.id, projectId)).get();
+    const projectDomainRow = this.db.select({ canonicalDomain: projects.canonicalDomain, ownedDomains: projects.ownedDomains }).from(projects).where(eq59(projects.id, projectId)).get();
     const projectDomains = projectDomainRow ? effectiveDomains({
       canonicalDomain: projectDomainRow.canonicalDomain,
       ownedDomains: projectDomainRow.ownedDomains
@@ -60714,7 +62104,7 @@ var IntelligenceService = class {
       citedDomains: querySnapshots.citedDomains,
       competitorOverlap: querySnapshots.competitorOverlap,
       snapshotLocation: querySnapshots.location
-    }).from(querySnapshots).leftJoin(queries, eq58(querySnapshots.queryId, queries.id)).where(eq58(querySnapshots.runId, runId)).all();
+    }).from(querySnapshots).leftJoin(queries, eq59(querySnapshots.queryId, queries.id)).where(eq59(querySnapshots.runId, runId)).all();
     const snapshots = [];
     let orphanCount = 0;
     for (const r of rows) {
@@ -60768,6 +62158,7 @@ export {
   doctorHealthState,
   notifications,
   gscSearchData,
+  gscDataWatermarks,
   gscDailyTotals,
   gscQueryDailyTotals,
   gscUrlInspections,
@@ -60844,6 +62235,7 @@ export {
   renderReportHtml,
   toAlertView,
   resolveDestination,
+  GSC_REPORTING_TIME_ZONE,
   GSC_DATA_LAG_DAYS,
   refreshAccessToken,
   fetchSearchAnalytics,