@canonry/canonry 4.177.3 → 4.178.1

package/dist/{chunk-7ABFIVKO.js → chunk-WINVGL5B.js}

@@ -1,15 +1,17 @@
 import {
   ApiClient,
+  CANONRY_MCP_TOOLKIT_NAMES,
   CanonryMcpToolNames,
   canonryMcpTools,
   configExists,
+  createCanonryMcpServer,
   getBundledSkillSnapshots,
   getConfigPath,
   isMachineFormat,
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-6XUWDSLN.js";
+} from "./chunk-UTW6QOGP.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -18,6 +20,7 @@ import {
   GSC_REPORTING_TIME_ZONE,
   IntelligenceService,
   PLUGIN_DIR,
+  USER_SESSION_COOKIE_NAME,
   adsAdGroups,
   adsAds,
   adsCampaigns,
@@ -48,7 +51,9 @@ import {
   countPopulatedGroups,
   crawlerEventsHourly,
   createClient,
+  createCredentialChecker,
   createLogger,
+  createUserSession,
   deliverWebhook,
   determineCitationState,
   discoverySessions,
@@ -90,9 +95,11 @@ import {
   gscUrlInspections,
   gtmConnections,
   gtmRawSnapshots,
+  hashApiKey,
   hashAttributes,
   hashLodging,
   hashPlaceDetails,
+  insightNotifyState,
   insights,
   inspectUrl,
   installDuckdb,
@@ -110,6 +117,7 @@ import {
   migrate,
   nextRunFromCron,
   notifications,
+  parseCookieHeader,
   parseJsonColumn,
   probeLatestRelease,
   projects,
@@ -122,15 +130,19 @@ import {
   readInstalledVersion,
   redactNotificationUrl,
   refreshAccessToken,
+  registerOAuthAdminRoutes,
+  registerOAuthRoutes,
   researchRunQueries,
   researchRuns,
   resolveDestination,
   resolveMeasurementSitemapTarget,
   resolveTrustProxy,
+  resolveUserSession,
   resolveVercelSyncDeadlineMs,
   resolveWebhookTarget,
   runs,
   schedules,
+  serializeUserSessionCookie,
   siteAuditPages,
   siteAuditSnapshots,
   siteCrawlAttempts,
@@ -145,7 +157,7 @@ import {
   siteCrawlSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-5EH666EO.js";
+} from "./chunk-JKKHGDDC.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -208,6 +220,7 @@ import {
   canonicalizeGtmAccountId,
   canonicalizeGtmContainerId,
   canonicalizeGtmResourceSelection,
+  classifyProviderErrorMessages,
   classifyTemplateLinkEdge,
   cloudflareQueueNameSchema,
   computeBacklinkSummaryMetrics,
@@ -249,6 +262,7 @@ import {
   isAgentProviderId,
   isBrowserProvider,
   isGhostTelemetryEvent,
+  isReadOnlyKey,
   isRetryableHttpError,
   isSelfLink,
   isVertexGroundingRedirect,
@@ -282,7 +296,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-PQT3ECM3.js";
+} from "./chunk-OYDIND7Q.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -849,9 +863,11 @@ function dailyMetricClauses(options) {
     );
   }
   const filters = [
-    `segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'`,
-    "campaign.status != 'REMOVED'"
+    `segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'`
   ];
+  if (options.campaignIds === void 0) {
+    filters.push("campaign.status != 'REMOVED'");
+  }
   if (options.campaignIds !== void 0) {
     if (!Array.isArray(options.campaignIds) || options.campaignIds.length === 0) {
       throw new GoogleAdsApiError("Campaign IDs must be a non-empty array when provided", 400);
@@ -878,6 +894,22 @@ function dailyMetricClauses(options) {
     `LIMIT ${validatedLimit(options.limit)}`
   ];
 }
+function buildCampaignSpendRankingQuery(options) {
+  const start = parseIsoDate(options.startDate, "Start date");
+  const end = parseIsoDate(options.endDate, "End date");
+  if (start > end) {
+    throw new GoogleAdsApiError("Start date must be on or before end date", 400);
+  }
+  return selectQuery([
+    "campaign.id",
+    "campaign.status",
+    "metrics.cost_micros"
+  ], "campaign", [
+    `WHERE segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'`,
+    "ORDER BY metrics.cost_micros DESC",
+    `LIMIT ${validatedLimit(options.limit)}`
+  ]);
+}
 function buildCampaignsQuery(options = {}) {
   const clauses = [];
   if (!options.includeRemoved) clauses.push("WHERE campaign.status != 'REMOVED'");
@@ -1317,6 +1349,18 @@ var GoogleAdsClient = class {
       }
     };
   }
+  /**
+   * Campaigns ranked by spend over a window, removed ones included, so the
+   * bounded daily-metrics query can be scoped to where the money actually went
+   * rather than to the lowest campaign ids.
+   */
+  async getCampaignSpendRanking(customerId, options) {
+    return this.#searchStream(
+      customerId,
+      "campaign-spend-ranking",
+      buildCampaignSpendRankingQuery(options)
+    );
+  }
   async getDailyCampaignMetrics(customerId, options) {
     return this.#searchStream(
       customerId,
@@ -2816,19 +2860,21 @@ function campaignMetricDto(row) {
     conversionValueMicros: conversionValueMicros(row.metrics)
   };
 }
-function defaultMetricsQuery(now, campaigns, timeZone) {
-  const campaignIds = campaigns.map((campaign) => campaign.id).sort((left, right) => left.localeCompare(right));
-  const selected = campaignIds.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS);
-  if (selected.length === 0) return { query: null, inventoryTruncated: false };
+function defaultMetricsWindow(now, timeZone) {
   const customerTimeZone = typeof timeZone === "string" && timeZone.trim() !== "" ? timeZone : "UTC";
   const endDate = formatIsoDateInTimeZone(now.toISOString(), customerTimeZone);
+  return { startDate: shiftIsoCalendarDate(endDate, -(GOOGLE_ADS_CAMPAIGN_METRICS_MAX_DAYS - 1)), endDate };
+}
+function defaultMetricsQuery(now, campaigns, timeZone, rankedCampaignIds) {
+  const inventoryIds = campaigns.map((campaign) => campaign.id).sort((left, right) => left.localeCompare(right));
+  const ranked = rankedCampaignIds ?? [];
+  const ordered = ranked.length > 0 ? [...ranked, ...inventoryIds.filter((id) => !ranked.includes(id))] : inventoryIds;
+  const selected = ordered.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS);
+  if (selected.length === 0) return { query: null, inventoryTruncated: false };
+  const { startDate, endDate } = defaultMetricsWindow(now, timeZone);
   return {
-    query: googleAdsCampaignMetricsQuerySchema.parse({
-      campaignIds: selected,
-      startDate: shiftIsoCalendarDate(endDate, -(GOOGLE_ADS_CAMPAIGN_METRICS_MAX_DAYS - 1)),
-      endDate
-    }),
-    inventoryTruncated: campaignIds.length > selected.length
+    query: googleAdsCampaignMetricsQuerySchema.parse({ campaignIds: selected, startDate, endDate }),
+    inventoryTruncated: ordered.length > selected.length
   };
 }
 function countRedactedProviderValues(value) {
@@ -3131,7 +3177,21 @@ var DefaultGoogleMarketingRuntime = class {
       capturedAt
     );
     const effectiveGoalGraph = deriveGoogleAdsEffectiveGoalGraph(inventory);
-    const defaults = defaultMetricsQuery(this.#now(), inventory.campaigns, customerResult.data.timeZone);
+    const rankingWindow = defaultMetricsWindow(this.#now(), customerResult.data.timeZone);
+    const ranking = await client.getCampaignSpendRanking(customerId, {
+      ...rankingWindow,
+      limit: GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS + 1
+    }).then((result) => ({
+      ids: result.data.map((row) => String(row.campaign.id)),
+      failed: false
+    })).catch(() => ({ ids: [], failed: true }));
+    const rankingTruncated = ranking.ids.length > GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS;
+    const defaults = defaultMetricsQuery(
+      this.#now(),
+      inventory.campaigns,
+      customerResult.data.timeZone,
+      ranking.failed ? void 0 : ranking.ids.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS)
+    );
     const metricsQuery = suppliedMetricsQuery ?? defaults.query;
     if (!metricsQuery) {
       return {
@@ -3149,7 +3209,10 @@ var DefaultGoogleMarketingRuntime = class {
     const response = {
       query: metricsQuery,
       rows: metricRows.slice(0, GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS),
-      truncated: metricRows.length > GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS || suppliedMetricsQuery === void 0 && defaults.inventoryTruncated,
+      truncated: metricRows.length > GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS || suppliedMetricsQuery === void 0 && defaults.inventoryTruncated || // Either the ranking could not be read (so selection fell back to an
+      // order that omits removed campaigns) or it reported more campaigns
+      // than the cap. Both mean these totals are a subset of the account.
+      suppliedMetricsQuery === void 0 && (ranking.failed || rankingTruncated),
       fetchedAt: this.#now().toISOString()
     };
     const metricsPayload = {
@@ -3330,11 +3393,11 @@ function createGoogleMarketingRuntime(options) {
 
 // src/server.ts
 import { createRequire as createRequire4 } from "module";
-import crypto26 from "crypto";
+import crypto27 from "crypto";
 import fs7 from "fs";
 import path8 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { and as and19, eq as eq25 } from "drizzle-orm";
+import { and as and19, eq as eq26 } from "drizzle-orm";
 import Fastify from "fastify";
 import os4 from "os";
 
@@ -6349,40 +6412,7 @@ function classifyRunAbortReason(message) {
   return void 0;
 }
 function classifyProviderErrors(errors) {
-  const codes = /* @__PURE__ */ new Set();
-  for (const message of errors.values()) {
-    codes.add(classifyOneProviderError(message));
-  }
-  const priority = [
-    "PROVIDER_AUTH",
-    "RATE_LIMITED",
-    "TIMEOUT",
-    "NETWORK",
-    "PARSE_ERROR",
-    "UNKNOWN"
-  ];
-  for (const code of priority) {
-    if (codes.has(code)) return code;
-  }
-  return "UNKNOWN";
-}
-function classifyOneProviderError(message) {
-  if (/\b401\b|\b403\b|unauthorized|forbidden|invalid[_ -]?api[_ -]?key|missing[_ -]?api[_ -]?key|authentication/i.test(message)) {
-    return "PROVIDER_AUTH";
-  }
-  if (/\b429\b|rate[_ -]?limit|too many requests|quota[_ -]?exceeded/i.test(message)) {
-    return "RATE_LIMITED";
-  }
-  if (/timeout|timed out|ETIMEDOUT/i.test(message)) {
-    return "TIMEOUT";
-  }
-  if (/ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|network|fetch failed|socket hang up/i.test(message)) {
-    return "NETWORK";
-  }
-  if (/parse|unexpected token|invalid json|malformed|JSON\.parse/i.test(message)) {
-    return "PARSE_ERROR";
-  }
-  return "UNKNOWN";
+  return classifyProviderErrorMessages(errors.values());
 }
 var JobRunner = class {
   /**
@@ -10855,6 +10885,31 @@ function partitionDeadLinks(deadLinks) {
   ];
   return { dead, unverified };
 }
+function reportedTermination(summary) {
+  const limits = summary.limits;
+  if (limits) {
+    if (limits.maxBytes && (summary.bytesRead ?? 0) >= limits.maxBytes) return "max-bytes";
+    if (limits.maxDurationMs && (summary.elapsedMs ?? 0) >= limits.maxDurationMs) return "max-duration";
+    if (limits.maxFetches && (summary.fetchesStarted ?? 0) >= limits.maxFetches) return "max-fetches";
+  }
+  return summary.terminationReason ?? "complete";
+}
+function crawlBudgetsFor(maxPages) {
+  return {
+    // 2x the ~745 KB/page measured on a media-heavy production site, so the
+    // byte cap is headroom rather than the thing that stops the crawl.
+    maxBytes: maxPages * 15e5,
+    // ~5 pages/s at the engine's default concurrency of 5, doubled for slow
+    // origins, and never below the engine's own 2-minute floor.
+    maxDurationMs: Math.max(12e4, Math.ceil(maxPages / 5 * 1e3 * 2)),
+    // Redirects and dead-link probes cost fetches without producing pages.
+    maxFetches: Math.ceil(maxPages * 1.5),
+    // Raised off the default of 10 because it is an ADMISSION limit: a sitemap
+    // with many query-parameter variants trips it during seeding and latches a
+    // soft reason that then masks whatever really stops the crawl.
+    maxQueryVariants: Math.max(50, Math.ceil(maxPages / 10))
+  };
+}
 async function executeSiteAudit(db, runId, projectId, opts = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const claim = db.update(runs).set({ status: "running", startedAt }).where(and12(eq15(runs.id, runId), eq15(runs.projectId, projectId), eq15(runs.status, "queued"))).run();
@@ -11155,6 +11210,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       maxEdges,
       maxDepth: opts.maxDepth ?? null
     });
+    const budgets = crawlBudgetsFor(maxPages);
     const report = await runSiteCrawl(crawlRootUrl, {
       mode: "summary",
       sitemapUrl: opts.sitemapUrl,
@@ -11162,6 +11218,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       maxEdges,
       maxDepth: opts.maxDepth,
       checkDeadLinks: opts.checkDeadLinks ?? false,
+      ...budgets,
       signal: opts.signal,
       onEvent: persistEvent
     });
@@ -11288,7 +11345,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         maxDepth: opts.maxDepth ?? null,
         checkDeadLinks: opts.checkDeadLinks ?? false,
         complete: crawlSummary.complete,
-        termination: crawlSummary.terminationReason ?? "complete",
+        termination: reportedTermination(crawlSummary),
         detailsAvailable: true,
         pagesDiscovered: crawlSummary.pagesDiscovered,
         pagesFetched: crawlSummary.pagesFetched,
@@ -11839,7 +11896,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-CHZGHFGS.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-YSRPTRKP.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -12829,6 +12886,21 @@ async function refreshAllIntegrations(client, projectName) {
 import { eq as eq18, desc as desc7, and as and15, inArray as inArray7, or as or2 } from "drizzle-orm";
 import crypto21 from "crypto";
 var log16 = createLogger("Notifier");
+var MATERIAL_MAGNITUDE_DELTA = 20;
+var SEVERITY_RANK = { low: 0, medium: 1, high: 2, critical: 3 };
+function severityRank(severity) {
+  return SEVERITY_RANK[severity] ?? 0;
+}
+function insightFingerprint(insight) {
+  return insight.title.replace(/\b\d+(?:\.\d+)?%/g, "N%");
+}
+function insightMagnitude(insight) {
+  const match = /\b(\d+(?:\.\d+)?)%/.exec(insight.title);
+  return match?.[1] === void 0 ? null : Math.round(Number(match[1]));
+}
+function insightNotifyKey(projectId, insight) {
+  return `${projectId}:${insight.type}:${insight.query}:${insightFingerprint(insight)}`;
+}
 var Notifier = class {
   db;
   serverUrl;
@@ -12984,11 +13056,59 @@ var Notifier = class {
     log16.info("health.notified", { projectId, event, status, code, subscribers: notifs.length, delivered });
     return event;
   }
+  /**
+   * Has this finding already been said?
+   *
+   * The identity of a finding is its type, its subject and its wording with the
+   * magnitude neutralised. So the same drop reported at 79% and at 80% over the
+   * same window is one piece of news, while the same drop over an ADVANCED
+   * window is a new one.
+   *
+   * Re-notifies on three things and nothing else:
+   *   - never sent before
+   *   - severity got worse (medium -> high -> critical)
+   *   - magnitude moved by more than MATERIAL_MAGNITUDE_DELTA points
+   *
+   * Deliberately NOT time-based. A daily repeat is exactly the behaviour this
+   * exists to stop, and "re-alert after N days" is that behaviour with a delay.
+   */
+  isNewInsightNews(projectId, insight) {
+    const key = insightNotifyKey(projectId, insight);
+    const previous = this.db.select().from(insightNotifyState).where(eq18(insightNotifyState.key, key)).get();
+    if (!previous) return true;
+    if (severityRank(insight.severity) > severityRank(previous.severity)) return true;
+    const magnitude = insightMagnitude(insight);
+    if (magnitude !== null && previous.magnitude !== null && previous.magnitude !== void 0) {
+      if (Math.abs(magnitude - previous.magnitude) > MATERIAL_MAGNITUDE_DELTA) return true;
+    }
+    return false;
+  }
+  /** Record a delivered insight so it stops being news. */
+  rememberInsightNotified(projectId, insight) {
+    const key = insightNotifyKey(projectId, insight);
+    const row = {
+      key,
+      projectId,
+      type: insight.type,
+      subject: insight.query,
+      fingerprint: insightFingerprint(insight),
+      severity: insight.severity,
+      magnitude: insightMagnitude(insight),
+      notifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const existing = this.db.select().from(insightNotifyState).where(eq18(insightNotifyState.key, key)).get();
+    if (existing) {
+      this.db.update(insightNotifyState).set(row).where(eq18(insightNotifyState.key, key)).run();
+    } else {
+      this.db.insert(insightNotifyState).values(row).run();
+    }
+  }
   /** Dispatch insight webhooks for critical/high severity insights after a run. */
   async dispatchInsightWebhooks(runId, projectId, result) {
     const insightEvents = [];
-    const criticalInsights = result.insights.filter((i) => i.severity === "critical");
-    const highInsights = result.insights.filter((i) => i.severity === "high");
+    const unsent = result.insights.filter((i) => this.isNewInsightNews(projectId, i));
+    const criticalInsights = unsent.filter((i) => i.severity === "critical");
+    const highInsights = unsent.filter((i) => i.severity === "high");
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
@@ -13022,6 +13142,7 @@ var Notifier = class {
           dashboardUrl: `${this.serverUrl}/projects/${project.name}`
         };
         await this.sendWebhook(config.url, payload, notif.id, projectId, notif.webhookSecret ?? null);
+        for (const insight of relevantInsights) this.rememberInsightNotified(projectId, insight);
       }
     }
   }
@@ -15185,10 +15306,159 @@ ${lines.join("\n")}
   }
 };
 
-// src/agent/agent-routes.ts
+// src/mcp-http.ts
+import crypto26 from "crypto";
 import { eq as eq22 } from "drizzle-orm";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+var SESSION_IDLE_MS = 10 * 60 * 1e3;
+var SWEEP_INTERVAL_MS = 60 * 1e3;
+function mintSessionKey(db, scopes, userId) {
+  const raw = `cnry_${crypto26.randomBytes(24).toString("hex")}`;
+  const id = crypto26.randomUUID();
+  db.insert(apiKeys).values({
+    id,
+    name: `mcp-session:${userId}`,
+    keyHash: hashApiKey(raw),
+    keyPrefix: raw.slice(0, 9),
+    scopes: [...scopes],
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  }).run();
+  return { id, raw };
+}
+function revokeSessionKey(db, id) {
+  try {
+    db.update(apiKeys).set({ revokedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(apiKeys.id, id)).run();
+  } catch {
+  }
+}
+function mcpTransportPaths() {
+  const paths = ["/mcp", "/mcp/readonly"];
+  for (const toolkit of CANONRY_MCP_TOOLKIT_NAMES) {
+    paths.push(`/mcp/x/${toolkit}`, `/mcp/x/${toolkit}/readonly`);
+  }
+  return paths;
+}
+function registerMcpHttpRoutes(scope, opts) {
+  const sessions = /* @__PURE__ */ new Map();
+  const now = opts.now ?? (() => Date.now());
+  async function dropSession(id) {
+    const session = sessions.get(id);
+    if (!session) return;
+    sessions.delete(id);
+    await session.close().catch(() => {
+    });
+  }
+  const sweep = setInterval(() => {
+    const cutoff = now() - SESSION_IDLE_MS;
+    for (const [id, session] of sessions) {
+      if (session.lastSeenAt < cutoff) void dropSession(id);
+    }
+  }, SWEEP_INTERVAL_MS);
+  sweep.unref();
+  if (opts.issuer) {
+    scope.addHook("onSend", async (request, reply, payload) => {
+      const isTransport = request.routeOptions.config?.transportEnvelope === true;
+      if (isTransport && reply.statusCode === 401 && !reply.getHeader("WWW-Authenticate")) {
+        const metadata = `${opts.issuer}/.well-known/oauth-protected-resource${request.routeOptions.url ?? ""}`;
+        void reply.header("WWW-Authenticate", `Bearer resource_metadata="${metadata}"`);
+      }
+      return payload;
+    });
+  }
+  scope.addHook("onClose", async () => {
+    clearInterval(sweep);
+    await Promise.all([...sessions.keys()].map((id) => dropSession(id)));
+  });
+  function callerBearer(request) {
+    const header = request.headers.authorization;
+    if (typeof header !== "string") return null;
+    const trimmed = header.trim();
+    const prefix = "bearer ";
+    if (trimmed.length <= prefix.length) return null;
+    if (trimmed.slice(0, prefix.length).toLowerCase() !== prefix) return null;
+    return trimmed.slice(prefix.length).trim() || null;
+  }
+  async function openSession(request, keyId, segment) {
+    const bearer = callerBearer(request);
+    if (!bearer) return null;
+    const scopes = request.principal?.scopes ?? request.apiKey?.scopes ?? [];
+    let sessionKey = null;
+    if (!request.apiKey && request.principal?.kind === "user") {
+      sessionKey = mintSessionKey(opts.db, scopes, request.principal.id);
+    }
+    const client = new ApiClient(opts.selfApiUrl, sessionKey?.raw ?? bearer, { skipProbe: true });
+    const server = createCanonryMcpServer({
+      scope: segment.readOnly || isReadOnlyKey(scopes) ? "read-only" : "all",
+      tiers: segment.tiers,
+      clientFactory: () => client
+    });
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => crypto26.randomUUID(),
+      onsessioninitialized: (id) => {
+        sessions.set(id, { transport, close, keyId, segmentId: segment.id, lastSeenAt: now() });
+      }
+    });
+    async function close() {
+      await transport.close();
+      await server.close();
+      if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
+    }
+    transport.onclose = () => {
+      const id = transport.sessionId;
+      if (id) sessions.delete(id);
+      if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
+    };
+    await server.connect(transport);
+    return { transport, close, keyId, segmentId: segment.id, lastSeenAt: now() };
+  }
+  async function handle(request, reply, segment) {
+    const keyId = request.principal?.id ?? request.apiKey?.id;
+    if (!keyId) {
+      await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
+      return;
+    }
+    const sessionId = request.headers["mcp-session-id"];
+    const existing = typeof sessionId === "string" ? sessions.get(sessionId) : void 0;
+    if (existing) {
+      if (existing.keyId !== keyId || existing.segmentId !== segment.id) {
+        await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
+        return;
+      }
+      existing.lastSeenAt = now();
+      await existing.transport.handleRequest(request.raw, reply.raw, request.body);
+      return;
+    }
+    if (typeof sessionId === "string") {
+      await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
+      return;
+    }
+    const opened = await openSession(request, keyId, segment);
+    if (!opened) {
+      await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
+      return;
+    }
+    await opened.transport.handleRequest(request.raw, reply.raw, request.body);
+  }
+  const config = { transportEnvelope: true };
+  function mount(pathname, segment) {
+    const run = (request, reply) => handle(request, reply, segment);
+    scope.post(pathname, { config }, run);
+    scope.get(pathname, { config }, run);
+    scope.delete(pathname, { config }, run);
+  }
+  mount("/mcp", { id: "core", tiers: ["core"], readOnly: false });
+  mount("/mcp/readonly", { id: "core:ro", tiers: ["core"], readOnly: true });
+  for (const toolkit of CANONRY_MCP_TOOLKIT_NAMES) {
+    const tiers = ["core", toolkit];
+    mount(`/mcp/x/${toolkit}`, { id: toolkit, tiers, readOnly: false });
+    mount(`/mcp/x/${toolkit}/readonly`, { id: `${toolkit}:ro`, tiers, readOnly: true });
+  }
+}
+
+// src/agent/agent-routes.ts
+import { eq as eq23 } from "drizzle-orm";
 function resolveProject(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq22(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq23(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -15197,7 +15467,7 @@ function registerAgentRoutes(app, opts) {
     "/projects/:name/agent/transcript",
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq22(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq23(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -15221,7 +15491,7 @@ function registerAgentRoutes(app, opts) {
     async (request) => {
       const project = resolveProject(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq23(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -16164,20 +16434,20 @@ function clipText(value, length) {
 }
 
 // src/research-runner.ts
-import { and as and17, eq as eq23, inArray as inArray8, sql as sql10 } from "drizzle-orm";
+import { and as and17, eq as eq24, inArray as inArray8, sql as sql10 } from "drizzle-orm";
 var unfinishedResearchQueryStatuses = [ResearchQueryStatuses.queued, ResearchQueryStatuses.running];
 function finalResearchRunStatus(completed, failed) {
   if (failed === 0) return ResearchRunStatuses.completed;
   return completed > 0 ? ResearchRunStatuses.partial : ResearchRunStatuses.failed;
 }
 async function executeResearchRun(db, registry, runId, projectId) {
-  const run = db.select().from(researchRuns).where(and17(eq23(researchRuns.id, runId), eq23(researchRuns.projectId, projectId))).get();
+  const run = db.select().from(researchRuns).where(and17(eq24(researchRuns.id, runId), eq24(researchRuns.projectId, projectId))).get();
   if (!run || run.status !== ResearchRunStatuses.queued) return;
-  const project = db.select().from(projects).where(eq23(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
   if (!project) return;
   const provider = registry.get(run.provider);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and17(eq23(researchRuns.id, runId), eq23(researchRuns.status, ResearchRunStatuses.queued))).run();
+  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and17(eq24(researchRuns.id, runId), eq24(researchRuns.status, ResearchRunStatuses.queued))).run();
   if (claim.changes !== 1) return;
   let reserved = 0;
   let dispatched = 0;
@@ -16201,8 +16471,8 @@ async function executeResearchRun(db, registry, runId, projectId) {
     }
     reserved = run.totalQueries;
     reservation = { scope, period };
-    const rows = db.select().from(researchRunQueries).where(eq23(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
-    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq23(competitors.projectId, projectId)).all().map((row) => row.domain);
+    const rows = db.select().from(researchRunQueries).where(eq24(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
+    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq24(competitors.projectId, projectId)).all().map((row) => row.domain);
     const domains = effectiveDomains(project);
     const brands = effectiveBrandNames(project);
     const config = { ...provider.config, model: run.resolvedModel };
@@ -16210,7 +16480,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and17(eq23(researchRunQueries.id, row.id), eq23(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
+        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and17(eq24(researchRunQueries.id, row.id), eq24(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
         const raw = await gate.run(async () => {
           dispatched++;
           return provider.adapter.executeTrackedQuery({ query: row.queryText, canonicalDomains: domains, competitorDomains, ...run.location ? { location: run.location } : {} }, config);
@@ -16237,7 +16507,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
           citationState: determineCitationState(normalized, domains),
           rawResponse: raw.rawResponse,
           finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(and17(eq23(researchRunQueries.id, row.id), eq23(researchRunQueries.status, ResearchQueryStatuses.running))).run();
+        }).where(and17(eq24(researchRunQueries.id, row.id), eq24(researchRunQueries.status, ResearchQueryStatuses.running))).run();
         if (completed.changes === 1) incrementResearchProgress(db, runId, "completedQueries");
       } catch (error) {
         try {
@@ -16261,18 +16531,18 @@ async function executeResearchRun(db, registry, runId, projectId) {
   }
 }
 function incrementResearchProgress(db, runId, column) {
-  db.update(researchRuns).set({ [column]: sql10`${researchRuns[column]} + 1` }).where(eq23(researchRuns.id, runId)).run();
+  db.update(researchRuns).set({ [column]: sql10`${researchRuns[column]} + 1` }).where(eq24(researchRuns.id, runId)).run();
 }
 function markResearchQueryFailed(db, runId, queryId, error) {
   const message = describeError(error);
-  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq23(researchRunQueries.id, queryId), inArray8(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq24(researchRunQueries.id, queryId), inArray8(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
   if (failed.changes === 1) incrementResearchProgress(db, runId, "failedQueries");
 }
 function markUnfinishedResearchQueriesFailed(db, runId, error) {
-  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq23(researchRunQueries.researchRunId, runId), inArray8(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq24(researchRunQueries.researchRunId, runId), inArray8(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
 }
 function finalizeResearchRun(db, runId, fatalError) {
-  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq23(researchRunQueries.researchRunId, runId)).all();
+  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq24(researchRunQueries.researchRunId, runId)).all();
   const completed = rows.filter((row) => row.status === ResearchQueryStatuses.completed).length;
   const failed = rows.filter((row) => row.status === ResearchQueryStatuses.failed).length;
   db.update(researchRuns).set({
@@ -16281,11 +16551,11 @@ function finalizeResearchRun(db, runId, fatalError) {
     failedQueries: failed,
     error: fatalError ?? (failed === rows.length ? "Every research query failed." : null),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq23(researchRuns.id, runId)).run();
+  }).where(eq24(researchRuns.id, runId)).run();
 }
 
 // src/google-marketing-sync.ts
-import { and as and18, eq as eq24, isNull as isNull3 } from "drizzle-orm";
+import { and as and18, eq as eq25, isNull as isNull3 } from "drizzle-orm";
 function safeErrorMessage(error) {
   const raw = describeError(error);
   return raw.replace(/(["']?authorization["']?\s*[:=]\s*["']?bearer\s+)[^\s,"'}]+/gi, "$1[redacted]").replace(/(["']?(?:developer|access|refresh|client)[_-]?(?:token|secret)["']?\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1[redacted]").replace(/[\r\n\t]+/g, " ").slice(0, 1e3);
@@ -16309,9 +16579,9 @@ function assertSnapshotContext(metadata, expected) {
 }
 function requireSyncRun(db, runId, projectId, kind) {
   const run = db.select().from(runs).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind)
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind)
   )).get();
   if (!run) throw new Error(`Run ${runId} is not a ${kind} run for this project.`);
   if (run.status !== RunStatuses.queued) {
@@ -16325,18 +16595,18 @@ function markFailed(db, runId, projectId, kind, expectedStatus, error) {
     error: serializeRunError({ message: safeErrorMessage(error) }),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
   }).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind),
-    eq24(runs.status, expectedStatus)
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind),
+    eq25(runs.status, expectedStatus)
   )).run();
 }
 function claimSyncRun(db, runId, projectId, kind, startedAt) {
   const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind),
-    eq24(runs.status, RunStatuses.queued)
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind),
+    eq25(runs.status, RunStatuses.queued)
   )).run();
   return claim.changes === 1;
 }
@@ -16344,9 +16614,9 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
   let claimed = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["google-ads-sync"]);
-    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq25(projects.id, projectId)).get();
     if (!project) throw new Error(`Project ${projectId} was not found.`);
-    const connection = db.select().from(googleAdsConnections).where(eq24(googleAdsConnections.projectId, projectId)).get();
+    const connection = db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, projectId)).get();
     if (!connection?.selectedCustomerId) {
       throw new Error("Google Ads needs a selected customer before it can sync.");
     }
@@ -16398,10 +16668,10 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         finishedAt,
         error: null
       }).where(and18(
-        eq24(runs.id, runId),
-        eq24(runs.projectId, projectId),
-        eq24(runs.kind, RunKinds["google-ads-sync"]),
-        eq24(runs.status, RunStatuses.running)
+        eq25(runs.id, runId),
+        eq25(runs.projectId, projectId),
+        eq25(runs.kind, RunKinds["google-ads-sync"]),
+        eq25(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw new Error(`Run ${runId} was no longer running when Google Ads evidence was ready.`);
@@ -16419,11 +16689,11 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         lastMetricsSnapshotId: result.metrics?.metadata.id ?? connection.lastMetricsSnapshotId,
         updatedAt: finishedAt
       }).where(and18(
-        eq24(googleAdsConnections.id, connection.id),
-        eq24(googleAdsConnections.projectId, projectId),
-        eq24(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
-        connection.selectedLoginCustomerId === null ? isNull3(googleAdsConnections.selectedLoginCustomerId) : eq24(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
-        eq24(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
+        eq25(googleAdsConnections.id, connection.id),
+        eq25(googleAdsConnections.projectId, projectId),
+        eq25(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
+        connection.selectedLoginCustomerId === null ? isNull3(googleAdsConnections.selectedLoginCustomerId) : eq25(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
+        eq25(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw new Error("Google Ads selection changed while its evidence was being collected.");
@@ -16450,9 +16720,9 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
   let claimed = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["gtm-sync"]);
-    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq25(projects.id, projectId)).get();
     if (!project) throw new Error(`Project ${projectId} was not found.`);
-    const connection = db.select().from(gtmConnections).where(eq24(gtmConnections.projectId, projectId)).get();
+    const connection = db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, projectId)).get();
     if (!connection?.selectedAccountId || !connection.selectedContainerId) {
       throw new Error("GTM needs a selected account and container before it can sync.");
     }
@@ -16488,10 +16758,10 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         finishedAt,
         error: null
       }).where(and18(
-        eq24(runs.id, runId),
-        eq24(runs.projectId, projectId),
-        eq24(runs.kind, RunKinds["gtm-sync"]),
-        eq24(runs.status, RunStatuses.running)
+        eq25(runs.id, runId),
+        eq25(runs.projectId, projectId),
+        eq25(runs.kind, RunKinds["gtm-sync"]),
+        eq25(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw new Error(`Run ${runId} was no longer running when GTM evidence was ready.`);
@@ -16506,12 +16776,12 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         lastSnapshotId: snapshot.metadata.id,
         updatedAt: finishedAt
       }).where(and18(
-        eq24(gtmConnections.id, connection.id),
-        eq24(gtmConnections.projectId, projectId),
-        eq24(gtmConnections.selectedAccountId, connection.selectedAccountId),
-        eq24(gtmConnections.selectedContainerId, connection.selectedContainerId),
-        connection.selectedWorkspaceId === null ? isNull3(gtmConnections.selectedWorkspaceId) : eq24(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
-        eq24(gtmConnections.selectionGeneration, connection.selectionGeneration)
+        eq25(gtmConnections.id, connection.id),
+        eq25(gtmConnections.projectId, projectId),
+        eq25(gtmConnections.selectedAccountId, connection.selectedAccountId),
+        eq25(gtmConnections.selectedContainerId, connection.selectedContainerId),
+        connection.selectedWorkspaceId === null ? isNull3(gtmConnections.selectedWorkspaceId) : eq25(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
+        eq25(gtmConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw new Error("GTM selection changed while its evidence was being collected.");
@@ -16597,15 +16867,15 @@ function summarizeProviderConfig(config) {
     quota: { ...config?.quota ?? DEFAULT_QUOTA }
   };
 }
-function hashApiKey(key) {
-  return crypto26.createHash("sha256").update(key).digest("hex");
+function hashApiKey2(key) {
+  return crypto27.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto26.randomBytes(16);
-  const derived = crypto26.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto27.randomBytes(16);
+  const derived = crypto27.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -16626,23 +16896,23 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto26.scryptSync(password, salt, expected.length, {
+    const derived = crypto27.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto26.timingSafeEqual(derived, expected),
+      ok: crypto27.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
   if (/^[a-f0-9]{64}$/i.test(storedHash)) {
-    const candidate = Buffer.from(hashApiKey(password), "hex");
+    const candidate = Buffer.from(hashApiKey2(password), "hex");
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto26.timingSafeEqual(candidate, expected);
+    const ok = crypto27.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -16778,7 +17048,7 @@ function cloneGtmConfig(config) {
 function createGoogleMarketingConfigCredentialStore(input) {
   const persistConfigPatch = input.saveConfigPatch ?? saveConfigPatch;
   const env = input.env ?? process.env;
-  const randomUUID = input.randomUUID ?? crypto26.randomUUID;
+  const randomUUID = input.randomUUID ?? crypto27.randomUUID;
   const snapshot = () => ({
     googleAds: cloneGoogleAdsConfig(input.config.googleAds),
     gtm: cloneGtmConfig(input.config.gtm)
@@ -16970,7 +17240,7 @@ async function createServer(opts) {
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
       if (!sessionRegistry) return;
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq26(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -17413,7 +17683,7 @@ async function createServer(opts) {
       void (async () => {
         try {
           const report = await aeroClient.runDoctor({ project: projectName });
-          const project = opts.db.select().from(projects).where(eq25(projects.name, projectName)).get();
+          const project = opts.db.select().from(projects).where(eq26(projects.name, projectName)).get();
           if (!project) {
             app.log.warn({ projectName }, "doctor schedule fired for an unknown project");
             return;
@@ -17442,8 +17712,8 @@ async function createServer(opts) {
         if (!probed) return;
         const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(
           and19(
-            eq25(ccReleaseSyncs.release, probed.release),
-            eq25(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+            eq26(ccReleaseSyncs.release, probed.release),
+            eq26(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
           )
         ).limit(1).get();
         if (alreadySynced) {
@@ -17624,7 +17894,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto26.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto27.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -17697,14 +17967,26 @@ async function createServer(opts) {
     "Dashboard password gate resolved"
   );
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
+  const credentialChecker = createCredentialChecker({
+    db: opts.db,
+    trustProxyConfigured: trustProxy !== false
+  });
   const googlePublicUrl = resolveGooglePublicUrl(opts.config, basePath);
+  const publicOrigin = (() => {
+    if (!googlePublicUrl) return void 0;
+    try {
+      return new URL(googlePublicUrl).origin;
+    } catch {
+      return void 0;
+    }
+  })();
   if (opts.config.apiKey) {
-    const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, keyHash)).get();
+    const keyHash = hashApiKey2(opts.config.apiKey);
+    const existing = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto26.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto27.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -17728,7 +18010,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto26.randomBytes(32).toString("hex");
+    const sessionId = crypto27.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -17752,7 +18034,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -17776,7 +18058,7 @@ async function createServer(opts) {
     if (!header) return false;
     const parts = header.split(" ");
     if (parts.length !== 2 || parts[0] !== "Bearer") return false;
-    const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(parts[1]))).get();
+    const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(parts[1]))).get();
     return Boolean(key && !key.revokedAt);
   };
   const namedAccountsInUse = () => anyUsersExist(opts.db);
@@ -17866,12 +18148,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq26(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header(
         "set-cookie",
@@ -18004,7 +18286,11 @@ async function createServer(opts) {
     vercelSyncDeadlineMs: resolveVercelSyncDeadlineMs(process.env),
     // Local-only Aero agent routes. Registered here so they inherit api-routes'
     // auth plugin — bare `registerAgentRoutes(app, ...)` would skip auth.
+    credentials: credentialChecker,
+    oauthResourceUrl: publicOrigin ? `${publicOrigin}${`${basePath ?? "/"}api/v1/mcp`.replace("//", "/")}` : void 0,
     registerAuthenticatedRoutes: async (scope) => {
+      registerMcpHttpRoutes(scope, { selfApiUrl: opts.config.apiUrl, issuer: publicOrigin, db: opts.db });
+      registerOAuthAdminRoutes(scope, { db: opts.db });
       if (!sessionRegistry) return;
       registerAgentRoutes(scope, { db: opts.db, sessionRegistry });
     },
@@ -18015,8 +18301,8 @@ async function createServer(opts) {
     getAgentProviderSummary: () => buildAgentProvidersResponse(opts.config).providers,
     getGoogleMarketingDoctorInput: (ctx) => {
       if (!ctx.project) return null;
-      const googleAds = opts.db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, ctx.project.id)).get();
-      const gtm = opts.db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, ctx.project.id)).get();
+      const googleAds = opts.db.select().from(googleAdsConnections).where(eq26(googleAdsConnections.projectId, ctx.project.id)).get();
+      const gtm = opts.db.select().from(gtmConnections).where(eq26(gtmConnections.projectId, ctx.project.id)).get();
       const googleAdsCredential = getGoogleAdsConnection(opts.config, ctx.project.id);
       const gtmCredential = getGtmConnection(opts.config, ctx.project.id);
       const googleAdsConnected = Boolean(googleAdsCredential?.accessToken);
@@ -18140,7 +18426,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto26.randomUUID();
+            const runId = crypto27.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -18265,7 +18551,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq25(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq26(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(
             opts.db,
@@ -18375,7 +18661,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto26.randomUUID(),
+            id: crypto27.randomUUID(),
             projectId,
             actor: "api",
             action: existing ? "provider.updated" : "provider.created",
@@ -18629,6 +18915,16 @@ async function createServer(opts) {
         const error = notFound("API route", url);
         return reply.status(error.statusCode).send(error.toJSON());
       }
+      const hasDotSegment = (candidate) => candidate.split("/").some((segment) => segment.startsWith("."));
+      let decodedUrl = url;
+      try {
+        decodedUrl = decodeURIComponent(url);
+      } catch {
+      }
+      if (hasDotSegment(url) || hasDotSegment(decodedUrl)) {
+        const error = notFound("Route", url);
+        return reply.status(error.statusCode).send(error.toJSON());
+      }
       if (basePath && !url.startsWith(basePath)) {
         return reply.status(404).send({ error: "Not found", path: request.url });
       }
@@ -18649,13 +18945,38 @@ async function createServer(opts) {
       ...update ? { updateAvailable: update } : {}
     };
   };
+  if (publicOrigin) {
+    registerOAuthRoutes(app, {
+      db: opts.db,
+      issuer: publicOrigin,
+      resourcePaths: mcpTransportPaths().map(
+        (suffix) => `${basePath ?? "/"}api/v1${suffix}`.replace("//", "/")
+      ),
+      resolveUser: (request) => {
+        const cookies = parseCookieHeader(request.headers.cookie);
+        const token = cookies[USER_SESSION_COOKIE_NAME];
+        if (!token) return null;
+        const resolved = resolveUserSession(opts.db, token);
+        return resolved ? { id: resolved.user.id, name: resolved.user.name } : null;
+      },
+      credentials: credentialChecker,
+      startSession: (userId) => {
+        const token = createUserSession(opts.db, userId);
+        return serializeUserSessionCookie({
+          value: token,
+          path: basePath ?? "/",
+          secure: opts.config.publicUrl?.startsWith("https://") ?? false
+        });
+      }
+    });
+  }
   app.get("/health", healthHandler);
   if (basePath) {
     app.get(`${basePath}health`, healthHandler);
   }
   checkLatestVersionForServer();
   scheduler.start();
-  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq25(researchRuns.status, ResearchRunStatuses.queued)).all()) {
+  for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq26(researchRuns.status, ResearchRunStatuses.queued)).all()) {
     dispatchResearchRun(run.id, run.projectId);
   }
   app.addHook("onClose", async () => {