@canonry/canonry 4.163.0 → 4.164.0

package/dist/{chunk-G5UZTODF.js → chunk-GCQPFCP2.js}

@@ -581,7 +581,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-ESH3LPYQ.js";
+} from "./chunk-BFGHZ2GU.js";
 
 // src/intelligence-service.ts
 import { eq as eq59, desc as desc26, asc as asc11, and as and47, ne as ne7, or as or13, inArray as inArray21, gte as gte14, lte as lte12 } from "drizzle-orm";
@@ -608,6 +608,7 @@ __export(schema_exports, {
   agentToolEvents: () => agentToolEvents,
   aiReferralEventsHourly: () => aiReferralEventsHourly,
   aiUserFetchEventsHourly: () => aiUserFetchEventsHourly,
+  aiUserFetchVerificationManifestsHourly: () => aiUserFetchVerificationManifestsHourly,
   apiKeys: () => apiKeys,
   auditLog: () => auditLog,
   backlinkDomains: () => backlinkDomains,
@@ -620,6 +621,7 @@ __export(schema_exports, {
   competitors: () => competitors,
   contentTargetDismissals: () => contentTargetDismissals,
   crawlerEventsHourly: () => crawlerEventsHourly,
+  crawlerVerificationManifestsHourly: () => crawlerVerificationManifestsHourly,
   discoveryProbes: () => discoveryProbes,
   discoverySessions: () => discoverySessions,
   doctorHealthState: () => doctorHealthState,
@@ -2242,6 +2244,55 @@ var crawlerEventsHourly = sqliteTable("crawler_events_hourly", {
   index("idx_crawler_hourly_project_ts").on(table.projectId, table.tsHour),
   index("idx_crawler_hourly_path").on(table.projectId, table.pathNormalized)
 ]);
+var crawlerVerificationManifestsHourly = sqliteTable("crawler_verification_manifests_hourly", {
+  projectId: text("project_id").notNull(),
+  sourceId: text("source_id").notNull(),
+  tsHour: text("ts_hour").notNull(),
+  botId: text("bot_id").notNull(),
+  verificationStatus: text("verification_status").notNull(),
+  pathNormalized: text("path_normalized").notNull(),
+  status: integer("status").notNull(),
+  manifestId: text("manifest_id").notNull(),
+  manifestJson: text("manifest_json", { mode: "json" }).$type(),
+  hits: integer("hits").notNull().default(0),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  primaryKey({
+    columns: [
+      table.projectId,
+      table.sourceId,
+      table.tsHour,
+      table.botId,
+      table.verificationStatus,
+      table.pathNormalized,
+      table.status,
+      table.manifestId
+    ]
+  }),
+  foreignKey({
+    name: "crawler_verification_manifests_parent_fk",
+    columns: [
+      table.projectId,
+      table.sourceId,
+      table.tsHour,
+      table.botId,
+      table.verificationStatus,
+      table.pathNormalized,
+      table.status
+    ],
+    foreignColumns: [
+      crawlerEventsHourly.projectId,
+      crawlerEventsHourly.sourceId,
+      crawlerEventsHourly.tsHour,
+      crawlerEventsHourly.botId,
+      crawlerEventsHourly.verificationStatus,
+      crawlerEventsHourly.pathNormalized,
+      crawlerEventsHourly.status
+    ]
+  }).onDelete("cascade"),
+  index("idx_crawler_verification_manifests_project_ts").on(table.projectId, table.tsHour)
+]);
 var aiUserFetchEventsHourly = sqliteTable("ai_user_fetch_events_hourly", {
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
@@ -2270,6 +2321,55 @@ var aiUserFetchEventsHourly = sqliteTable("ai_user_fetch_events_hourly", {
   index("idx_ai_user_fetch_hourly_project_ts").on(table.projectId, table.tsHour),
   index("idx_ai_user_fetch_hourly_path").on(table.projectId, table.pathNormalized)
 ]);
+var aiUserFetchVerificationManifestsHourly = sqliteTable("ai_user_fetch_verification_manifests_hourly", {
+  projectId: text("project_id").notNull(),
+  sourceId: text("source_id").notNull(),
+  tsHour: text("ts_hour").notNull(),
+  botId: text("bot_id").notNull(),
+  verificationStatus: text("verification_status").notNull(),
+  pathNormalized: text("path_normalized").notNull(),
+  status: integer("status").notNull(),
+  manifestId: text("manifest_id").notNull(),
+  manifestJson: text("manifest_json", { mode: "json" }).$type(),
+  hits: integer("hits").notNull().default(0),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (table) => [
+  primaryKey({
+    columns: [
+      table.projectId,
+      table.sourceId,
+      table.tsHour,
+      table.botId,
+      table.verificationStatus,
+      table.pathNormalized,
+      table.status,
+      table.manifestId
+    ]
+  }),
+  foreignKey({
+    name: "ai_user_fetch_verification_manifests_parent_fk",
+    columns: [
+      table.projectId,
+      table.sourceId,
+      table.tsHour,
+      table.botId,
+      table.verificationStatus,
+      table.pathNormalized,
+      table.status
+    ],
+    foreignColumns: [
+      aiUserFetchEventsHourly.projectId,
+      aiUserFetchEventsHourly.sourceId,
+      aiUserFetchEventsHourly.tsHour,
+      aiUserFetchEventsHourly.botId,
+      aiUserFetchEventsHourly.verificationStatus,
+      aiUserFetchEventsHourly.pathNormalized,
+      aiUserFetchEventsHourly.status
+    ]
+  }).onDelete("cascade"),
+  index("idx_ai_user_fetch_verification_manifests_project_ts").on(table.projectId, table.tsHour)
+]);
 var aiReferralEventsHourly = sqliteTable("ai_referral_events_hourly", {
   projectId: text("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
   sourceId: text("source_id").notNull().references(() => trafficSources.id, { onDelete: "cascade" }),
@@ -6264,6 +6364,71 @@ var MIGRATION_VERSIONS = [
       `ALTER TABLE site_crawl_edges ADD COLUMN placement_unknown_occurrences INTEGER`,
       `ALTER TABLE site_crawl_snapshots ADD COLUMN link_placement_ruleset_version TEXT`
     ]
+  },
+  {
+    version: 139,
+    name: "traffic-verification-manifest-provenance",
+    // Verification is evidence produced by one exact range manifest. Store
+    // that provenance in additive sidecars: the existing rollup keys stay
+    // unchanged so an older binary can still upsert them after a rollback.
+    // Historical rows deliberately receive no sidecar row because the old
+    // schema never recorded which bundle classified them.
+    statements: [
+      `CREATE TABLE IF NOT EXISTS crawler_verification_manifests_hourly (
+        project_id          TEXT NOT NULL,
+        source_id           TEXT NOT NULL,
+        ts_hour             TEXT NOT NULL,
+        bot_id              TEXT NOT NULL,
+        verification_status TEXT NOT NULL,
+        path_normalized     TEXT NOT NULL,
+        status              INTEGER NOT NULL,
+        manifest_id         TEXT NOT NULL,
+        manifest_json       TEXT,
+        hits                INTEGER NOT NULL DEFAULT 0,
+        created_at          TEXT NOT NULL,
+        updated_at          TEXT NOT NULL,
+        PRIMARY KEY (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status, manifest_id
+        ),
+        FOREIGN KEY (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status
+        ) REFERENCES crawler_events_hourly (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status
+        ) ON DELETE CASCADE
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_crawler_verification_manifests_project_ts
+        ON crawler_verification_manifests_hourly(project_id, ts_hour)`,
+      `CREATE TABLE IF NOT EXISTS ai_user_fetch_verification_manifests_hourly (
+        project_id          TEXT NOT NULL,
+        source_id           TEXT NOT NULL,
+        ts_hour             TEXT NOT NULL,
+        bot_id              TEXT NOT NULL,
+        verification_status TEXT NOT NULL,
+        path_normalized     TEXT NOT NULL,
+        status              INTEGER NOT NULL,
+        manifest_id         TEXT NOT NULL,
+        manifest_json       TEXT,
+        hits                INTEGER NOT NULL DEFAULT 0,
+        created_at          TEXT NOT NULL,
+        updated_at          TEXT NOT NULL,
+        PRIMARY KEY (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status, manifest_id
+        ),
+        FOREIGN KEY (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status
+        ) REFERENCES ai_user_fetch_events_hourly (
+          project_id, source_id, ts_hour, bot_id, verification_status,
+          path_normalized, status
+        ) ON DELETE CASCADE
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_ai_user_fetch_verification_manifests_project_ts
+        ON ai_user_fetch_verification_manifests_hourly(project_id, ts_hour)`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -48518,13 +48683,78 @@ async function listCloudRunTrafficEvents(accessToken, options) {
 
 // ../integration-traffic/src/ip-ranges/anthropic.json
 var anthropic_default = {
-  _source: "ARIN RDAP \u2014 every network registered to Anthropic, PBC (handle AP-2440)",
-  _query: "https://rdap.arin.net/registry/entity/AP-2440",
-  _notes: "Anthropic does not publish a clean machine-readable IP-range JSON like Google or OpenAI do. These prefixes are taken straight from ARIN's authoritative allocation records (NOT bgp.tools' AS-based view, which can include misleading announcements \u2014 e.g. AS60808 is registered to Anthropic but announces 209.249.57.0/24 which actually belongs to Mitel Networks). 216.73.216.0/22 (AWS-ANTHROPIC) is the load-bearing prefix \u2014 empirical Cloud Run logs show 100% of real ClaudeBot traffic comes from there; the other two are Anthropic's own allocations for non-crawler infra (kept since the verification gate still requires a Claude-* UA match). Refresh by re-running the ARIN RDAP query above and replacing the prefix list.",
+  _source: "https://claude.com/crawling/bots.json",
+  creationTime: "2026-08-13T20:38:01Z",
   prefixes: [
-    { ipv4Prefix: "216.73.216.0/22" },
-    { ipv4Prefix: "160.79.104.0/21" },
-    { ipv6Prefix: "2607:6bc0::/32" }
+    {
+      ipv4Prefix: "216.73.216.0/22"
+    },
+    {
+      ipv4Prefix: "34.162.230.222/32"
+    },
+    {
+      ipv4Prefix: "34.162.244.71/32"
+    },
+    {
+      ipv4Prefix: "34.162.191.81/32"
+    },
+    {
+      ipv4Prefix: "34.150.241.79/32"
+    },
+    {
+      ipv4Prefix: "34.85.172.162/32"
+    },
+    {
+      ipv4Prefix: "35.245.175.129/32"
+    },
+    {
+      ipv4Prefix: "34.182.222.37/32"
+    },
+    {
+      ipv4Prefix: "34.186.108.163/32"
+    },
+    {
+      ipv4Prefix: "35.245.89.239/32"
+    },
+    {
+      ipv4Prefix: "34.182.161.143/32"
+    },
+    {
+      ipv4Prefix: "34.182.218.27/32"
+    },
+    {
+      ipv4Prefix: "34.182.220.85/32"
+    },
+    {
+      ipv4Prefix: "34.11.34.31/32"
+    },
+    {
+      ipv4Prefix: "34.182.140.95/32"
+    },
+    {
+      ipv4Prefix: "136.107.176.208/32"
+    },
+    {
+      ipv4Prefix: "34.182.226.151/32"
+    },
+    {
+      ipv4Prefix: "34.182.226.221/32"
+    },
+    {
+      ipv4Prefix: "35.221.29.174/32"
+    },
+    {
+      ipv4Prefix: "34.182.225.167/32"
+    },
+    {
+      ipv4Prefix: "40.124.101.48/28"
+    },
+    {
+      ipv4Prefix: "20.102.46.224/28"
+    },
+    {
+      ipv4Prefix: "20.64.57.208/28"
+    }
   ]
 };
 
@@ -50623,6 +50853,141 @@ var perplexitybot_default = {
   ]
 };
 
+// ../integration-traffic/src/ip-range-manifest.ts
+import { createHash as createHash4 } from "crypto";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stableJson2(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? JSON.stringify(value) : JSON.stringify(String(value));
+  }
+  if (typeof value !== "object") return JSON.stringify(`[${typeof value}]`);
+  if (seen.has(value)) return '"[circular]"';
+  seen.add(value);
+  const result = Array.isArray(value) ? `[${value.map((entry) => stableJson2(entry, seen)).join(",")}]` : `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson2(value[key], seen)}`).join(",")}}`;
+  seen.delete(value);
+  return result;
+}
+function parseIp(ip) {
+  if (typeof ip !== "string" || ip.length === 0) return null;
+  const mappedMatch = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
+  if (mappedMatch) return parseIp(mappedMatch[1]);
+  if (ip.includes(":")) {
+    const sides = ip.split("::");
+    if (sides.length > 2) return null;
+    const left = sides[0].length > 0 ? sides[0].split(":") : [];
+    const right = sides.length === 2 && sides[1].length > 0 ? sides[1].split(":") : [];
+    const groupCount = left.length + right.length;
+    if (sides.length === 1 && groupCount !== 8) return null;
+    if (sides.length === 2 && groupCount >= 8) return null;
+    const fill = 8 - groupCount;
+    const groups = [...left, ...new Array(fill).fill("0"), ...right];
+    let addr2 = 0n;
+    for (const group of groups) {
+      if (!/^[0-9a-f]{1,4}$/i.test(group)) return null;
+      addr2 = addr2 << 16n | BigInt(Number.parseInt(group, 16));
+    }
+    return { version: 6, addr: addr2 };
+  }
+  const octets = ip.split(".");
+  if (octets.length !== 4) return null;
+  let addr = 0n;
+  for (const octet of octets) {
+    if (!/^(?:0|[1-9]\d{0,2})$/.test(octet)) return null;
+    const value = Number(octet);
+    if (value > 255) return null;
+    addr = addr << 8n | BigInt(value);
+  }
+  return { version: 4, addr };
+}
+function parseCidr(cidr) {
+  if (typeof cidr !== "string") return null;
+  const slash = cidr.indexOf("/");
+  if (slash <= 0 || slash !== cidr.lastIndexOf("/") || slash === cidr.length - 1) return null;
+  const ipPart = cidr.slice(0, slash);
+  const prefixStr = cidr.slice(slash + 1);
+  if (!/^(?:0|[1-9]\d{0,2})$/.test(prefixStr)) return null;
+  const parsed = parseIp(ipPart);
+  if (!parsed) return null;
+  const prefix = Number(prefixStr);
+  const totalBits = parsed.version === 4 ? 32 : 128;
+  if (prefix > totalBits) return null;
+  const allOnes = (1n << BigInt(totalBits)) - 1n;
+  const mask = allOnes >> BigInt(totalBits - prefix) << BigInt(totalBits - prefix);
+  return {
+    version: parsed.version,
+    network: parsed.addr & mask,
+    mask
+  };
+}
+function canonicalPrefixKey(entry) {
+  if (isRecord(entry)) {
+    const hasIpv4 = Object.hasOwn(entry, "ipv4Prefix");
+    const hasIpv6 = Object.hasOwn(entry, "ipv6Prefix");
+    if (hasIpv4 !== hasIpv6) {
+      const value = entry[hasIpv4 ? "ipv4Prefix" : "ipv6Prefix"];
+      if (typeof value === "string") {
+        const parsed = parseCidr(value);
+        const expectedVersion = hasIpv4 ? 4 : 6;
+        if (parsed?.version === expectedVersion) {
+          const hexWidth = parsed.version === 4 ? 8 : 32;
+          const network = parsed.network.toString(16).padStart(hexWidth, "0");
+          const mask = parsed.mask.toString(16).padStart(hexWidth, "0");
+          return `cidr:${parsed.version}:${network}:${mask}`;
+        }
+      }
+    }
+  }
+  return `invalid:${stableJson2(entry)}`;
+}
+function ipRangeManifestContentHash(value) {
+  const prefixes = isRecord(value) ? value.prefixes : void 0;
+  const canonical = Array.isArray(prefixes) ? prefixes.map(canonicalPrefixKey).sort() : [`invalid-prefixes:${stableJson2(prefixes)}`];
+  return createHash4("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function validateIpRangeManifestPayload(value) {
+  if (!isRecord(value)) return { ok: false, error: "response must be a JSON object" };
+  const creationTime = value.creationTime;
+  if (typeof creationTime !== "string" || creationTime.trim().length === 0) {
+    return { ok: false, error: "response missing `creationTime` version" };
+  }
+  if (!Array.isArray(value.prefixes)) {
+    return { ok: false, error: "response missing `prefixes` array" };
+  }
+  const prefixes = [];
+  for (const [index2, entry] of value.prefixes.entries()) {
+    if (!isRecord(entry)) {
+      return { ok: false, error: `prefixes[${index2}] must be an object` };
+    }
+    const hasIpv4 = Object.hasOwn(entry, "ipv4Prefix");
+    const hasIpv6 = Object.hasOwn(entry, "ipv6Prefix");
+    if (hasIpv4 === hasIpv6) {
+      return { ok: false, error: `prefixes[${index2}] must contain exactly one IP prefix` };
+    }
+    const field = hasIpv4 ? "ipv4Prefix" : "ipv6Prefix";
+    const cidr = entry[field];
+    if (typeof cidr !== "string") {
+      return { ok: false, error: `prefixes[${index2}].${field} must be a string` };
+    }
+    const parsed = parseCidr(cidr);
+    const expectedVersion = hasIpv4 ? 4 : 6;
+    if (!parsed || parsed.version !== expectedVersion) {
+      return { ok: false, error: `prefixes[${index2}].${field} is not a valid IPv${expectedVersion} CIDR` };
+    }
+    prefixes.push(hasIpv4 ? { ipv4Prefix: cidr } : { ipv6Prefix: cidr });
+  }
+  return {
+    ok: true,
+    value: {
+      creationTime: creationTime.trim(),
+      prefixes
+    }
+  };
+}
+
 // ../integration-traffic/src/ip-verify.ts
 var RULE_ID_TO_RANGES = {
   // OpenAI — three separate published lists (training crawler vs
@@ -50656,94 +51021,56 @@ var RULE_ID_TO_RANGES = {
   "perplexity-bot": perplexitybot_default,
   // src: https://www.perplexity.ai/perplexity-user.json
   "perplexity-user": perplexity_user_default,
-  // Anthropic — no machine-readable JSON published. The bundled
-  // anthropic.json is the set of networks registered to Anthropic,
-  // PBC at ARIN (the authoritative allocation record). Maintained by
-  // hand; refresh by re-querying the ARIN entity below. The crawler
-  // block is AWS-ANTHROPIC 216.73.216.0/22 — empirical Cloud Run
-  // logs show all real ClaudeBot traffic comes from there. The same
-  // raw set is shared across every Claude-* UA the classifier emits:
-  // both the training crawler and the per-user fetcher map here.
-  // src: https://rdap.arin.net/registry/entity/AP-2440
+  // Anthropic publishes one shared crawler-origin manifest. It confirms
+  // Anthropic origin but does not attribute a prefix to ClaudeBot,
+  // Claude-SearchBot, or Claude-User individually, so both classifier rules
+  // map to the same file and the UA remains the product discriminator.
+  // src: https://claude.com/crawling/bots.json
   "anthropic-claudebot": anthropic_default,
   "claude-user": anthropic_default
 };
+function manifestMetadata(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  const record = raw;
+  const source = typeof record._source === "string" ? record._source.trim() : "";
+  const version = typeof record.creationTime === "string" ? record.creationTime.trim() : "";
+  if (!source || !version) return null;
+  const contentHash2 = ipRangeManifestContentHash(raw);
+  return { id: `${source}#${version}#sha256:${contentHash2}`, source, version };
+}
+function verificationDataFromRaw(raw) {
+  const validation = validateIpRangeManifestPayload(raw);
+  const ranges = [];
+  if (validation.ok) {
+    for (const entry of validation.value.prefixes) {
+      const parsed = parseCidr(entry.ipv4Prefix ?? entry.ipv6Prefix);
+      if (parsed) ranges.push(parsed);
+    }
+  }
+  return { ranges, manifest: manifestMetadata(raw) };
+}
+function decideIpVerification(ip, data) {
+  if (!ip || data.ranges.length === 0) return { verified: false, manifest: null };
+  const parsed = parseIp(ip);
+  if (!parsed) return { verified: false, manifest: null };
+  for (const cidr of data.ranges) {
+    if (parsed.version !== cidr.version) continue;
+    if ((parsed.addr & cidr.mask) === cidr.network) {
+      return { verified: true, manifest: data.manifest };
+    }
+  }
+  return { verified: false, manifest: data.manifest };
+}
 var CACHE = (() => {
   const cache = /* @__PURE__ */ new Map();
   for (const [ruleId, raw] of Object.entries(RULE_ID_TO_RANGES)) {
-    const parsed = [];
-    for (const entry of raw.prefixes) {
-      const cidr = entry.ipv4Prefix ?? entry.ipv6Prefix;
-      if (!cidr) continue;
-      const p = parseCidr(cidr);
-      if (p) parsed.push(p);
-    }
-    cache.set(ruleId, parsed);
+    cache.set(ruleId, verificationDataFromRaw(raw));
   }
   return cache;
 })();
-function parseIp(ip) {
-  if (!ip) return null;
-  const mappedMatch = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
-  if (mappedMatch) return parseIp(mappedMatch[1]);
-  if (ip.includes(":")) {
-    const sides = ip.split("::");
-    if (sides.length > 2) return null;
-    const left = sides[0].length > 0 ? sides[0].split(":") : [];
-    const right = sides.length === 2 && sides[1].length > 0 ? sides[1].split(":") : [];
-    const groupCount = left.length + right.length;
-    if (groupCount > 8) return null;
-    if (sides.length === 1 && groupCount !== 8) return null;
-    const fill = 8 - groupCount;
-    const groups = [...left, ...new Array(fill).fill("0"), ...right];
-    let addr2 = 0n;
-    for (const g of groups) {
-      if (g.length === 0 || g.length > 4) return null;
-      const n = Number.parseInt(g, 16);
-      if (!Number.isFinite(n) || n < 0 || n > 65535) return null;
-      addr2 = addr2 << 16n | BigInt(n);
-    }
-    return { version: 6, addr: addr2 };
-  }
-  const octets = ip.split(".");
-  if (octets.length !== 4) return null;
-  let addr = 0n;
-  for (const o of octets) {
-    if (o.length === 0 || o.length > 3) return null;
-    const n = Number.parseInt(o, 10);
-    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
-    addr = addr << 8n | BigInt(n);
-  }
-  return { version: 4, addr };
-}
-function parseCidr(cidr) {
-  const [ipPart, prefixStr] = cidr.split("/");
-  if (!ipPart || !prefixStr) return null;
-  const prefix = Number.parseInt(prefixStr, 10);
-  if (!Number.isInteger(prefix)) return null;
-  const parsed = parseIp(ipPart);
-  if (!parsed) return null;
-  const totalBits = parsed.version === 4 ? 32 : 128;
-  if (prefix < 0 || prefix > totalBits) return null;
-  const allOnes = (1n << BigInt(totalBits)) - 1n;
-  const mask = allOnes >> BigInt(totalBits - prefix) << BigInt(totalBits - prefix);
-  return {
-    version: parsed.version,
-    network: parsed.addr & mask,
-    mask
-  };
-}
-function verifyIpForRule(ip, ruleId) {
-  if (!ip) return false;
-  const ranges = CACHE.get(ruleId);
-  if (!ranges || ranges.length === 0) return false;
-  const parsed = parseIp(ip);
-  if (!parsed) return false;
-  for (const cidr of ranges) {
-    if (parsed.version !== cidr.version) continue;
-    if ((parsed.addr & cidr.mask) === cidr.network) return true;
-  }
-  return false;
+function verifyIpForRuleDecision(ip, ruleId) {
+  const data = CACHE.get(ruleId);
+  return data ? decideIpVerification(ip, data) : { verified: false, manifest: null };
 }
 
 // ../integration-traffic/src/rules.ts
@@ -51113,13 +51440,14 @@ function classifyCrawler(event) {
   for (const rule of DEFAULT_AI_CRAWLER_RULES) {
     if (rule.purpose === USER_FETCH_PURPOSE) continue;
     if (rule.userAgentPatterns.some((pattern) => pattern.test(userAgent))) {
-      const verified = verifyIpForRule(event.remoteIp, rule.id);
+      const decision = verifyIpForRuleDecision(event.remoteIp, rule.id);
       return {
         botId: rule.id,
         operator: rule.operator,
         product: rule.product,
         purpose: rule.purpose,
-        verificationStatus: verified ? "verified" : "claimed_unverified",
+        verificationStatus: decision.verified ? "verified" : "claimed_unverified",
+        verificationManifest: decision.manifest,
         matchedUserAgent: userAgent
       };
     }
@@ -51132,12 +51460,13 @@ function classifyAiUserFetch(event) {
   for (const rule of DEFAULT_AI_CRAWLER_RULES) {
     if (rule.purpose !== USER_FETCH_PURPOSE) continue;
     if (rule.userAgentPatterns.some((pattern) => pattern.test(userAgent))) {
-      const verified = verifyIpForRule(event.remoteIp, rule.id);
+      const decision = verifyIpForRuleDecision(event.remoteIp, rule.id);
       return {
         botId: rule.id,
         operator: rule.operator,
         product: rule.product,
-        verificationStatus: verified ? "verified" : "claimed_unverified",
+        verificationStatus: decision.verified ? "verified" : "claimed_unverified",
+        verificationManifest: decision.manifest,
         matchedUserAgent: userAgent
       };
     }
@@ -51286,10 +51615,10 @@ function mergeReferralSession(current, next) {
   return { ...winner, trafficClass: paid ? AiReferralTrafficClasses.paid : winner.trafficClass };
 }
 function sortCrawlerBuckets(a, b) {
-  return a.tsHour.localeCompare(b.tsHour) || a.botId.localeCompare(b.botId) || a.pathNormalized.localeCompare(b.pathNormalized) || String(a.status).localeCompare(String(b.status));
+  return a.tsHour.localeCompare(b.tsHour) || a.botId.localeCompare(b.botId) || a.verificationStatus.localeCompare(b.verificationStatus) || (a.verificationManifest?.id ?? "").localeCompare(b.verificationManifest?.id ?? "") || a.pathNormalized.localeCompare(b.pathNormalized) || String(a.status).localeCompare(String(b.status));
 }
 function sortAiUserFetchBuckets(a, b) {
-  return a.tsHour.localeCompare(b.tsHour) || a.botId.localeCompare(b.botId) || a.pathNormalized.localeCompare(b.pathNormalized) || String(a.status).localeCompare(String(b.status));
+  return a.tsHour.localeCompare(b.tsHour) || a.botId.localeCompare(b.botId) || a.verificationStatus.localeCompare(b.verificationStatus) || (a.verificationManifest?.id ?? "").localeCompare(b.verificationManifest?.id ?? "") || a.pathNormalized.localeCompare(b.pathNormalized) || String(a.status).localeCompare(String(b.status));
 }
 function sortReferralBuckets(a, b) {
   return a.tsHour.localeCompare(b.tsHour) || a.product.localeCompare(b.product) || a.sourceDomain.localeCompare(b.sourceDomain) || a.landingPathNormalized.localeCompare(b.landingPathNormalized) || String(a.status).localeCompare(String(b.status));
@@ -51332,6 +51661,7 @@ function buildTrafficProbeReport(events, options = {}) {
         tsHour,
         crawler.botId,
         crawler.verificationStatus,
+        crawler.verificationManifest?.id ?? "no-manifest",
         pathNormalized,
         event.status ?? "null"
       ].join("	");
@@ -51345,6 +51675,7 @@ function buildTrafficProbeReport(events, options = {}) {
           operator: crawler.operator,
           product: crawler.product,
           verificationStatus: crawler.verificationStatus,
+          verificationManifest: crawler.verificationManifest,
           pathNormalized,
           status: event.status,
           hits: 1,
@@ -51363,6 +51694,7 @@ function buildTrafficProbeReport(events, options = {}) {
         tsHour,
         aiUserFetch.botId,
         aiUserFetch.verificationStatus,
+        aiUserFetch.verificationManifest?.id ?? "no-manifest",
         pathNormalized,
         event.status ?? "null"
       ].join("	");
@@ -51376,6 +51708,7 @@ function buildTrafficProbeReport(events, options = {}) {
           operator: aiUserFetch.operator,
           product: aiUserFetch.product,
           verificationStatus: aiUserFetch.verificationStatus,
+          verificationManifest: aiUserFetch.verificationManifest,
           pathNormalized,
           status: event.status,
           hits: 1,
@@ -53042,6 +53375,38 @@ function writeTrafficEventBatch(opts) {
             updatedAt: opts.receivedAt
           }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(crawlerVerificationManifestsHourly).values({
+            projectId: opts.projectId,
+            sourceId: opts.sourceId,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: opts.receivedAt,
+            updatedAt: opts.receivedAt
+          }).onConflictDoUpdate({
+            target: [
+              crawlerVerificationManifestsHourly.projectId,
+              crawlerVerificationManifestsHourly.sourceId,
+              crawlerVerificationManifestsHourly.tsHour,
+              crawlerVerificationManifestsHourly.botId,
+              crawlerVerificationManifestsHourly.verificationStatus,
+              crawlerVerificationManifestsHourly.pathNormalized,
+              crawlerVerificationManifestsHourly.status,
+              crawlerVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql18`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: opts.receivedAt
+            }
+          }).run();
+        }
         crawlerBucketRows += 1;
       }
       for (const bucket of report.aiUserFetchEventsHourly) {
@@ -53075,6 +53440,38 @@ function writeTrafficEventBatch(opts) {
             updatedAt: opts.receivedAt
           }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(aiUserFetchVerificationManifestsHourly).values({
+            projectId: opts.projectId,
+            sourceId: opts.sourceId,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: opts.receivedAt,
+            updatedAt: opts.receivedAt
+          }).onConflictDoUpdate({
+            target: [
+              aiUserFetchVerificationManifestsHourly.projectId,
+              aiUserFetchVerificationManifestsHourly.sourceId,
+              aiUserFetchVerificationManifestsHourly.tsHour,
+              aiUserFetchVerificationManifestsHourly.botId,
+              aiUserFetchVerificationManifestsHourly.verificationStatus,
+              aiUserFetchVerificationManifestsHourly.pathNormalized,
+              aiUserFetchVerificationManifestsHourly.status,
+              aiUserFetchVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql18`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: opts.receivedAt
+            }
+          }).run();
+        }
         aiUserFetchBucketRows += 1;
       }
       for (const bucket of report.aiReferralEventsHourly) {
@@ -53393,6 +53790,117 @@ function trafficSeriesPoint(pointsByBucket, bucket) {
   pointsByBucket.set(bucket, created);
   return created;
 }
+function verificationEventKey(row) {
+  return JSON.stringify([
+    row.sourceId,
+    row.tsHour,
+    row.botId,
+    row.verificationStatus,
+    row.pathNormalized,
+    row.status
+  ]);
+}
+function verificationSelectedRowsJson(projectId, rows) {
+  return JSON.stringify(rows.map((row) => [
+    projectId,
+    row.sourceId,
+    row.tsHour,
+    row.botId,
+    row.verificationStatus,
+    row.pathNormalized,
+    row.status
+  ]));
+}
+function buildVerificationProvenance(events, rows) {
+  const manifestsByEvent = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const key = verificationEventKey(row);
+    const manifests = manifestsByEvent.get(key);
+    const usage = { manifestId: row.manifestId, manifest: row.manifest, hits: row.hits };
+    if (manifests) manifests.push(usage);
+    else manifestsByEvent.set(key, [usage]);
+  }
+  const provenanceByEvent = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    const key = verificationEventKey(event);
+    const verificationManifests = manifestsByEvent.get(key) ?? [];
+    verificationManifests.sort((a, b) => a.manifestId.localeCompare(b.manifestId));
+    const attributedHits = verificationManifests.reduce((sum, manifest) => sum + manifest.hits, 0);
+    provenanceByEvent.set(key, {
+      verificationManifests,
+      verificationUnattributedHits: Math.max(0, event.hits - attributedHits)
+    });
+  }
+  return provenanceByEvent;
+}
+function crawlerVerificationProvenance(db, projectId, events) {
+  if (events.length === 0) return /* @__PURE__ */ new Map();
+  const selectedRows = verificationSelectedRowsJson(projectId, events);
+  const rows = db.select({
+    sourceId: crawlerVerificationManifestsHourly.sourceId,
+    tsHour: crawlerVerificationManifestsHourly.tsHour,
+    botId: crawlerVerificationManifestsHourly.botId,
+    verificationStatus: crawlerVerificationManifestsHourly.verificationStatus,
+    pathNormalized: crawlerVerificationManifestsHourly.pathNormalized,
+    status: crawlerVerificationManifestsHourly.status,
+    manifestId: crawlerVerificationManifestsHourly.manifestId,
+    manifest: crawlerVerificationManifestsHourly.manifestJson,
+    hits: crawlerVerificationManifestsHourly.hits
+  }).from(crawlerVerificationManifestsHourly).where(sql19`(
+      ${crawlerVerificationManifestsHourly.projectId},
+      ${crawlerVerificationManifestsHourly.sourceId},
+      ${crawlerVerificationManifestsHourly.tsHour},
+      ${crawlerVerificationManifestsHourly.botId},
+      ${crawlerVerificationManifestsHourly.verificationStatus},
+      ${crawlerVerificationManifestsHourly.pathNormalized},
+      ${crawlerVerificationManifestsHourly.status}
+    ) IN (
+      SELECT
+        json_extract(value, '$[0]'),
+        json_extract(value, '$[1]'),
+        json_extract(value, '$[2]'),
+        json_extract(value, '$[3]'),
+        json_extract(value, '$[4]'),
+        json_extract(value, '$[5]'),
+        json_extract(value, '$[6]')
+      FROM json_each(${selectedRows})
+    )`).orderBy(crawlerVerificationManifestsHourly.manifestId).all();
+  return buildVerificationProvenance(events, rows);
+}
+function aiUserFetchVerificationProvenance(db, projectId, events) {
+  if (events.length === 0) return /* @__PURE__ */ new Map();
+  const selectedRows = verificationSelectedRowsJson(projectId, events);
+  const rows = db.select({
+    sourceId: aiUserFetchVerificationManifestsHourly.sourceId,
+    tsHour: aiUserFetchVerificationManifestsHourly.tsHour,
+    botId: aiUserFetchVerificationManifestsHourly.botId,
+    verificationStatus: aiUserFetchVerificationManifestsHourly.verificationStatus,
+    pathNormalized: aiUserFetchVerificationManifestsHourly.pathNormalized,
+    status: aiUserFetchVerificationManifestsHourly.status,
+    manifestId: aiUserFetchVerificationManifestsHourly.manifestId,
+    manifest: aiUserFetchVerificationManifestsHourly.manifestJson,
+    hits: aiUserFetchVerificationManifestsHourly.hits
+  }).from(aiUserFetchVerificationManifestsHourly).where(sql19`(
+      ${aiUserFetchVerificationManifestsHourly.projectId},
+      ${aiUserFetchVerificationManifestsHourly.sourceId},
+      ${aiUserFetchVerificationManifestsHourly.tsHour},
+      ${aiUserFetchVerificationManifestsHourly.botId},
+      ${aiUserFetchVerificationManifestsHourly.verificationStatus},
+      ${aiUserFetchVerificationManifestsHourly.pathNormalized},
+      ${aiUserFetchVerificationManifestsHourly.status}
+    ) IN (
+      SELECT
+        json_extract(value, '$[0]'),
+        json_extract(value, '$[1]'),
+        json_extract(value, '$[2]'),
+        json_extract(value, '$[3]'),
+        json_extract(value, '$[4]'),
+        json_extract(value, '$[5]'),
+        json_extract(value, '$[6]')
+      FROM json_each(${selectedRows})
+    )`).orderBy(aiUserFetchVerificationManifestsHourly.manifestId).all();
+  return buildVerificationProvenance(events, rows);
+}
 function parseSourceConfig(row) {
   return row.configJson;
 }
@@ -53570,6 +54078,7 @@ async function runBackfillTask(options) {
         )
       ).run();
       for (const bucket of report.crawlerEventsHourly) {
+        const status = bucket.status ?? 0;
         tx.insert(crawlerEventsHourly).values({
           projectId: project.id,
           sourceId: sourceRow2.id,
@@ -53578,14 +54087,62 @@ async function runBackfillTask(options) {
           operator: bucket.operator,
           verificationStatus: bucket.verificationStatus,
           pathNormalized: bucket.pathNormalized,
-          status: bucket.status ?? 0,
+          status,
           hits: bucket.hits,
           sampledUserAgent: bucket.sampledUserAgent,
           createdAt: finishedAt,
           updatedAt: finishedAt
+        }).onConflictDoUpdate({
+          target: [
+            crawlerEventsHourly.projectId,
+            crawlerEventsHourly.sourceId,
+            crawlerEventsHourly.tsHour,
+            crawlerEventsHourly.botId,
+            crawlerEventsHourly.verificationStatus,
+            crawlerEventsHourly.pathNormalized,
+            crawlerEventsHourly.status
+          ],
+          set: {
+            hits: sql19`${crawlerEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: finishedAt
+          }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(crawlerVerificationManifestsHourly).values({
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: finishedAt,
+            updatedAt: finishedAt
+          }).onConflictDoUpdate({
+            target: [
+              crawlerVerificationManifestsHourly.projectId,
+              crawlerVerificationManifestsHourly.sourceId,
+              crawlerVerificationManifestsHourly.tsHour,
+              crawlerVerificationManifestsHourly.botId,
+              crawlerVerificationManifestsHourly.verificationStatus,
+              crawlerVerificationManifestsHourly.pathNormalized,
+              crawlerVerificationManifestsHourly.status,
+              crawlerVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql19`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: finishedAt
+            }
+          }).run();
+        }
       }
       for (const bucket of report.aiUserFetchEventsHourly) {
+        const status = bucket.status ?? 0;
         tx.insert(aiUserFetchEventsHourly).values({
           projectId: project.id,
           sourceId: sourceRow2.id,
@@ -53594,12 +54151,59 @@ async function runBackfillTask(options) {
           operator: bucket.operator,
           verificationStatus: bucket.verificationStatus,
           pathNormalized: bucket.pathNormalized,
-          status: bucket.status ?? 0,
+          status,
           hits: bucket.hits,
           sampledUserAgent: bucket.sampledUserAgent,
           createdAt: finishedAt,
           updatedAt: finishedAt
+        }).onConflictDoUpdate({
+          target: [
+            aiUserFetchEventsHourly.projectId,
+            aiUserFetchEventsHourly.sourceId,
+            aiUserFetchEventsHourly.tsHour,
+            aiUserFetchEventsHourly.botId,
+            aiUserFetchEventsHourly.verificationStatus,
+            aiUserFetchEventsHourly.pathNormalized,
+            aiUserFetchEventsHourly.status
+          ],
+          set: {
+            hits: sql19`${aiUserFetchEventsHourly.hits} + ${bucket.hits}`,
+            sampledUserAgent: bucket.sampledUserAgent,
+            updatedAt: finishedAt
+          }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(aiUserFetchVerificationManifestsHourly).values({
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: finishedAt,
+            updatedAt: finishedAt
+          }).onConflictDoUpdate({
+            target: [
+              aiUserFetchVerificationManifestsHourly.projectId,
+              aiUserFetchVerificationManifestsHourly.sourceId,
+              aiUserFetchVerificationManifestsHourly.tsHour,
+              aiUserFetchVerificationManifestsHourly.botId,
+              aiUserFetchVerificationManifestsHourly.verificationStatus,
+              aiUserFetchVerificationManifestsHourly.pathNormalized,
+              aiUserFetchVerificationManifestsHourly.status,
+              aiUserFetchVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql19`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: finishedAt
+            }
+          }).run();
+        }
       }
       for (const bucket of report.aiReferralEventsHourly) {
         tx.insert(aiReferralEventsHourly).values({
@@ -55082,6 +55686,38 @@ async function trafficRoutes(app, opts) {
             updatedAt: finishedAt
           }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(crawlerVerificationManifestsHourly).values({
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: finishedAt,
+            updatedAt: finishedAt
+          }).onConflictDoUpdate({
+            target: [
+              crawlerVerificationManifestsHourly.projectId,
+              crawlerVerificationManifestsHourly.sourceId,
+              crawlerVerificationManifestsHourly.tsHour,
+              crawlerVerificationManifestsHourly.botId,
+              crawlerVerificationManifestsHourly.verificationStatus,
+              crawlerVerificationManifestsHourly.pathNormalized,
+              crawlerVerificationManifestsHourly.status,
+              crawlerVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql19`${crawlerVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: finishedAt
+            }
+          }).run();
+        }
         crawlerBucketRows += 1;
       }
       for (const bucket of report.aiUserFetchEventsHourly) {
@@ -55115,6 +55751,38 @@ async function trafficRoutes(app, opts) {
             updatedAt: finishedAt
           }
         }).run();
+        if (bucket.verificationManifest) {
+          tx.insert(aiUserFetchVerificationManifestsHourly).values({
+            projectId: project.id,
+            sourceId: sourceRow2.id,
+            tsHour: bucket.tsHour,
+            botId: bucket.botId,
+            verificationStatus: bucket.verificationStatus,
+            pathNormalized: bucket.pathNormalized,
+            status,
+            manifestId: bucket.verificationManifest.id,
+            manifestJson: bucket.verificationManifest,
+            hits: bucket.hits,
+            createdAt: finishedAt,
+            updatedAt: finishedAt
+          }).onConflictDoUpdate({
+            target: [
+              aiUserFetchVerificationManifestsHourly.projectId,
+              aiUserFetchVerificationManifestsHourly.sourceId,
+              aiUserFetchVerificationManifestsHourly.tsHour,
+              aiUserFetchVerificationManifestsHourly.botId,
+              aiUserFetchVerificationManifestsHourly.verificationStatus,
+              aiUserFetchVerificationManifestsHourly.pathNormalized,
+              aiUserFetchVerificationManifestsHourly.status,
+              aiUserFetchVerificationManifestsHourly.manifestId
+            ],
+            set: {
+              hits: sql19`${aiUserFetchVerificationManifestsHourly.hits} + ${bucket.hits}`,
+              manifestJson: bucket.verificationManifest,
+              updatedAt: finishedAt
+            }
+          }).run();
+        }
         aiUserFetchBucketRows += 1;
       }
       for (const bucket of report.aiReferralEventsHourly) {
@@ -55691,6 +56359,8 @@ async function trafficRoutes(app, opts) {
           botId: r.botId,
           operator: r.operator,
           verificationStatus: r.verificationStatus,
+          verificationManifests: [],
+          verificationUnattributedHits: r.hits,
           pathNormalized: r.pathNormalized,
           pathClass: classifyTrafficPath(r.pathNormalized),
           status: r.status,
@@ -55729,6 +56399,8 @@ async function trafficRoutes(app, opts) {
           botId: r.botId,
           operator: r.operator,
           verificationStatus: r.verificationStatus,
+          verificationManifests: [],
+          verificationUnattributedHits: r.hits,
           pathNormalized: r.pathNormalized,
           status: r.status,
           hits: r.hits
@@ -55785,6 +56457,25 @@ async function trafficRoutes(app, opts) {
     }
     events.sort((a, b) => a.tsHour < b.tsHour ? 1 : a.tsHour > b.tsHour ? -1 : 0);
     const trimmed = events.slice(0, limit);
+    const trimmedCrawlerEvents = trimmed.filter(
+      (event) => event.kind === TrafficEventKinds.crawler
+    );
+    const trimmedAiUserFetchEvents = trimmed.filter(
+      (event) => event.kind === TrafficEventKinds["ai-user-fetch"]
+    );
+    const crawlerProvenance = crawlerVerificationProvenance(app.db, project.id, trimmedCrawlerEvents);
+    const aiUserFetchProvenance = aiUserFetchVerificationProvenance(app.db, project.id, trimmedAiUserFetchEvents);
+    const eventsWithProvenance = trimmed.map((event) => {
+      if (event.kind === TrafficEventKinds.crawler) {
+        const provenance = crawlerProvenance.get(verificationEventKey(event));
+        return provenance ? { ...event, ...provenance } : event;
+      }
+      if (event.kind === TrafficEventKinds["ai-user-fetch"]) {
+        const provenance = aiUserFetchProvenance.get(verificationEventKey(event));
+        return provenance ? { ...event, ...provenance } : event;
+      }
+      return event;
+    });
     const response = {
       windowStart: sinceIso,
       windowEnd: untilIso,
@@ -55808,7 +56499,7 @@ async function trafficRoutes(app, opts) {
         returned: trimmed.length,
         truncated: trimmed.length < totalEventRows
       },
-      events: trimmed
+      events: eventsWithProvenance
     };
     return response;
   });