@canonry/canonry 5.16.1 → 5.18.0

package/dist/{chunk-5QK5KHA7.js → chunk-HIFBIDOW.js}

@@ -17,12 +17,12 @@ import {
   resolveOperatorApiKeyIds,
   runWithUsageTags,
   saveConfigPatch
-} from "./chunk-ZGZSROSR.js";
+} from "./chunk-TMTO2JHU.js";
 import {
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout
-} from "./chunk-CDQDPUY4.js";
+} from "./chunk-HAABFHXB.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -184,7 +184,7 @@ import {
   siteLivenessState,
   toAlertView,
   usageCounters
-} from "./chunk-3YAPVVFN.js";
+} from "./chunk-Y5IDGH5B.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -194,6 +194,7 @@ import {
   AdsAdGroupBillingEventTypes,
   AdsCampaignBiddingTypes,
   AgentProviderIds,
+  AppError,
   BacklinkSources,
   CANONRY_NPM_PACKAGE_URL,
   CITED_URL_CAPTURE_VERSION,
@@ -232,6 +233,7 @@ import {
   TrafficEventKinds,
   TrafficEvidenceKinds,
   TrafficSourceTypes,
+  UserRoles,
   VERTEX_AI_SEARCH_PROXY_DOMAIN,
   actionConfidenceLabel,
   adsAccountDtoSchema,
@@ -345,7 +347,7 @@ import {
   visibilityReportRequestSchema,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-L36TC6LB.js";
+} from "./chunk-77VHT3JD.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -3560,11 +3562,11 @@ function createGoogleMarketingRuntime(options) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto26 from "crypto";
+import crypto27 from "crypto";
 import fs8 from "fs";
 import path8 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { and as and19, eq as eq25 } from "drizzle-orm";
+import { and as and20, eq as eq26 } from "drizzle-orm";
 import Fastify from "fastify";
 import os4 from "os";
 
@@ -6063,6 +6065,11 @@ function resolveAgentProactiveEnabled(env, config) {
   }
   return config.agent?.mode !== "prompt-only";
 }
+function resolveAgentAllowViewers(env, config) {
+  const raw = env.CANONRY_AGENT_ALLOW_VIEWERS?.trim();
+  if (raw) return raw === "1" || raw.toLowerCase() === "true";
+  return config.agent?.allowViewers === true;
+}
 
 // src/places-config.ts
 var DEFAULT_TIER = "atmosphere";
@@ -6491,7 +6498,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "c03ab4f56518250251bec6d577c20d1334377cec" : void 0;
+  const embedded = true ? "508d40ec00ff12e4604267c10940212dd3b750b9" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -12067,7 +12074,7 @@ function readStoredGroundingSources(rawResponse) {
   return result2;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-EAUKUVVM.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-EORTVFDF.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -15130,7 +15137,7 @@ function ensureBuiltinsRegistered() {
     builtinsRegistered = true;
   }
 }
-function loadAeroSystemPrompt(pkgDir) {
+function loadAeroSystemPrompt(pkgDir, opts = {}) {
   const skillDir = resolveAeroSkillDir(pkgDir);
   const skillBody = fs7.readFileSync(path7.join(skillDir, "SKILL.md"), "utf-8");
   const soulPath = path7.join(skillDir, "soul.md");
@@ -15139,7 +15146,7 @@ function loadAeroSystemPrompt(pkgDir) {
 ---
 
 ${skillBody}` : skillBody;
-  return appendSystemPromptExtras(base + AERO_RUNTIME_PROMPT);
+  return opts.extras === false ? base + AERO_RUNTIME_PROMPT : appendSystemPromptExtras(base + AERO_RUNTIME_PROMPT);
 }
 function appendSystemPromptExtras(base, env = process.env) {
   const inline = env.AERO_SYSTEM_PROMPT_APPEND?.trim();
@@ -16200,16 +16207,223 @@ ${lines.join("\n")}
   }
 };
 
-// src/mcp-http.ts
+// src/agent/viewer-sessions.ts
 import crypto25 from "crypto";
-import { eq as eq21 } from "drizzle-orm";
+import { and as and17, eq as eq21, isNotNull, like as like2 } from "drizzle-orm";
+var AERO_VIEWER_EXCLUDED_MCP_TOOLS = /* @__PURE__ */ new Set([
+  CanonryMcpToolNames.canonry_ads_account,
+  CanonryMcpToolNames.canonry_ads_geo_search,
+  CanonryMcpToolNames.canonry_ads_live_delivery,
+  CanonryMcpToolNames.canonry_ads_conversion_pixels,
+  CanonryMcpToolNames.canonry_ads_conversion_event_settings,
+  CanonryMcpToolNames.canonry_google_ads_customers,
+  CanonryMcpToolNames.canonry_gtm_accounts,
+  CanonryMcpToolNames.canonry_gtm_containers,
+  CanonryMcpToolNames.canonry_gtm_workspaces,
+  // These can list every account the install's Google or provider login can
+  // see, other clients included, or run live checks. Not a viewer's to read.
+  CanonryMcpToolNames.canonry_settings_get,
+  CanonryMcpToolNames.canonry_doctor,
+  CanonryMcpToolNames.canonry_ga_properties,
+  CanonryMcpToolNames.canonry_gbp_accounts,
+  // Marked read, but embeds the harvested queries with the operator's Gemini key.
+  CanonryMcpToolNames.canonry_discover_harvest,
+  // Live Search Console call on the operator's Google login, which can also
+  // refresh and store its token.
+  CanonryMcpToolNames.canonry_gsc_sitemaps,
+  // Live Common Crawl probe; free, but an outbound call a viewer has no need to make.
+  CanonryMcpToolNames.canonry_backlinks_latest_release,
+  // The whole install's audit log, not this project's.
+  CanonryMcpToolNames.canonry_history_global
+]);
+var OPERATOR_ONLY_TOOL_NAMES = new Set(
+  canonryMcpTools.filter((tool) => tool.tier === "agent" || tool.requiresOperator).map((tool) => tool.name)
+);
+var VIEWER_AERO_TURN_LIMITS = { maxToolCalls: 12, timeoutMs: 12e4 };
+var VIEWER_AERO_MAX_PROMPT_CHARS = 4e3;
+var VIEWER_AERO_DAILY_TURN_LIMIT = 50;
+function viewerAeroDailyLimitExceeded(limit) {
+  return new AppError(
+    "QUOTA_EXCEEDED",
+    `You have used today's ${limit} Aero questions for this project. Try again tomorrow or ask an administrator.`,
+    429,
+    { metric: "aero.viewer.turns", limit }
+  );
+}
+var VIEWER_AERO_KEY_PREFIX = "aero-viewer:";
+var VIEWER_AERO_PROMPT = "\n\nThis conversation is with a view-only account. You can read this project's data but cannot change anything, start or schedule sweeps, or spend on live provider reads. If asked to, say an administrator has to do it. You cannot see the operator's own Aero conversations or notes.";
+var MAX_VIEWER_MESSAGES = 40;
+function trimViewerTranscript(messages, max = MAX_VIEWER_MESSAGES) {
+  if (messages.length <= max) return messages;
+  for (let i = messages.length - max; i < messages.length; i++) {
+    if (messages[i].role === "user") return messages.slice(i);
+  }
+  const lastUser = messages.map((message) => message.role).lastIndexOf("user");
+  return lastUser > 0 ? messages.slice(lastUser) : messages;
+}
+var VIEWER_IDLE_MS = 12 * 60 * 60 * 1e3;
+function mintViewerAeroKey(db, userId, now = /* @__PURE__ */ new Date()) {
+  const raw = `cnry_${crypto25.randomBytes(24).toString("hex")}`;
+  const id = crypto25.randomUUID();
+  db.insert(apiKeys).values({
+    id,
+    name: `${VIEWER_AERO_KEY_PREFIX}${userId}`,
+    keyHash: hashApiKey(raw),
+    keyPrefix: raw.slice(0, 9),
+    scopes: ["read"],
+    delegatedUserId: userId,
+    createdAt: now.toISOString()
+  }).run();
+  return { id, raw };
+}
+function buildViewerAeroTools(client, projectName, managedSweeps = false) {
+  const state = buildAeroStateTools({ client, projectName }, {
+    scope: AeroToolScopes.readOnly,
+    managedSweeps
+  }).filter((tool) => !AERO_VIEWER_EXCLUDED_MCP_TOOLS.has(tool.name) && !OPERATOR_ONLY_TOOL_NAMES.has(tool.name));
+  return [...state, ...buildSkillDocTools()];
+}
+var ViewerAeroSessions = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.now = opts.now ?? Date.now;
+    this.revokeOrphanedKeys();
+  }
+  opts;
+  sessions = /* @__PURE__ */ new Map();
+  acquisitions = /* @__PURE__ */ new Set();
+  /** Turns per viewer and project today, keyed with the UTC date. In memory: a restart forgives. */
+  turnsToday = /* @__PURE__ */ new Map();
+  now;
+  key(projectName, userId) {
+    return `${projectName}\0${userId}`;
+  }
+  /** Without tool `details`, which can be large and the bar never renders; the model's text copy stays. */
+  transcript(projectName, userId) {
+    this.evictIdle();
+    const messages = this.sessions.get(this.key(projectName, userId))?.agent.state.messages ?? [];
+    return withoutPersistedToolDetails(messages);
+  }
+  updatedAt(projectName, userId) {
+    return this.sessions.get(this.key(projectName, userId))?.updatedAt ?? null;
+  }
+  isBusy(projectName, userId) {
+    const key = this.key(projectName, userId);
+    return this.acquisitions.has(key) || this.sessions.get(key)?.agent.state.isStreaming === true;
+  }
+  reset(projectName, userId) {
+    const key = this.key(projectName, userId);
+    if (this.isBusy(projectName, userId)) throw agentBusy(projectName);
+    this.sessions.delete(key);
+  }
+  async acquireForTurn(project, userId, preferences = {}) {
+    preferences.signal?.throwIfAborted();
+    this.evictIdle();
+    const key = this.key(project.name, userId);
+    if (this.isBusy(project.name, userId)) throw agentBusy(project.name);
+    const today = new Date(this.now()).toISOString().slice(0, 10);
+    const used = this.turnsToday.get(key);
+    const count = used?.date === today ? used.count : 0;
+    if (count >= VIEWER_AERO_DAILY_TURN_LIMIT) throw viewerAeroDailyLimitExceeded(VIEWER_AERO_DAILY_TURN_LIMIT);
+    const minted = mintViewerAeroKey(this.opts.db, userId, new Date(this.now()));
+    this.acquisitions.add(key);
+    let handedOff = false;
+    try {
+      const client = new ApiClient(this.opts.selfApiUrl, minted.raw, { skipProbe: true, surface: "aero" });
+      const agent = this.sessions.get(key)?.agent ?? this.createAgent(project, client);
+      agent.state.messages = trimViewerTranscript(agent.state.messages);
+      const view = { client, projectName: project.name, basePath: this.opts.config.basePath, context: preferences.context };
+      const evidence = preferences.context ? await readAeroViewEvidence(view) : void 0;
+      preferences.signal?.throwIfAborted();
+      agent.state.systemPrompt = loadAeroSystemPrompt(void 0, { extras: false }) + VIEWER_AERO_PROMPT + aeroViewPrompt(preferences.context);
+      configureAeroRuntime(agent, [...buildViewerAeroTools(client, project.name, this.opts.managedSweeps), buildAeroViewTool(view, evidence)], VIEWER_AERO_TURN_LIMITS, true);
+      this.sessions.set(key, { agent, lastUsedAt: this.now(), updatedAt: this.sessions.get(key)?.updatedAt ?? null });
+      this.turnsToday.set(key, { date: today, count: count + 1 });
+      handedOff = true;
+      let released = false;
+      return {
+        agent,
+        release: () => {
+          if (released) return;
+          released = true;
+          this.acquisitions.delete(key);
+          const session = this.sessions.get(key);
+          if (session) {
+            session.lastUsedAt = this.now();
+            const previous = session.updatedAt ? Date.parse(session.updatedAt) : 0;
+            session.updatedAt = new Date(Math.max(this.now(), previous + 1)).toISOString();
+          }
+          this.removeKey(minted.id);
+        }
+      };
+    } finally {
+      if (!handedOff) {
+        this.acquisitions.delete(key);
+        this.removeKey(minted.id);
+      }
+    }
+  }
+  createAgent(project, client) {
+    const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config);
+    return createAeroSession({
+      projectName: project.name,
+      client,
+      config: this.opts.config,
+      provider,
+      modelId,
+      systemPromptOverride: loadAeroSystemPrompt(void 0, { extras: false }) + VIEWER_AERO_PROMPT,
+      toolScope: AeroToolScopes.readOnly,
+      managedSweeps: this.opts.managedSweeps,
+      db: this.opts.db,
+      projectId: project.id
+    });
+  }
+  /**
+   * Delete the turn's key rather than revoke it: the key list shows revoked
+   * keys too, and one per turn would bury the operator's own. Revoke only if
+   * the delete fails, so the key is dead either way.
+   */
+  removeKey(id) {
+    try {
+      this.opts.db.delete(apiKeys).where(eq21(apiKeys.id, id)).run();
+    } catch {
+      try {
+        this.opts.db.update(apiKeys).set({ revokedAt: new Date(this.now()).toISOString() }).where(eq21(apiKeys.id, id)).run();
+      } catch {
+      }
+    }
+  }
+  /**
+   * A key outlives its turn only if the process died mid-turn. Remove those on
+   * start. Only delegated keys match: the key API never sets a delegate, so an
+   * operator key that merely shares the name prefix is left alone.
+   */
+  revokeOrphanedKeys() {
+    try {
+      this.opts.db.delete(apiKeys).where(and17(like2(apiKeys.name, `${VIEWER_AERO_KEY_PREFIX}%`), isNotNull(apiKeys.delegatedUserId))).run();
+    } catch {
+    }
+  }
+  evictIdle() {
+    const cutoff = this.now() - VIEWER_IDLE_MS;
+    for (const [key, session] of this.sessions) {
+      if (session.lastUsedAt < cutoff && !this.acquisitions.has(key) && !session.agent.state.isStreaming) {
+        this.sessions.delete(key);
+      }
+    }
+  }
+};
+
+// src/mcp-http.ts
+import crypto26 from "crypto";
+import { eq as eq22 } from "drizzle-orm";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 var SESSION_IDLE_MS = 10 * 60 * 1e3;
 var SWEEP_INTERVAL_MS = 60 * 1e3;
 function mintSessionKey(db, scopes, userId) {
-  const raw = `cnry_${crypto25.randomBytes(24).toString("hex")}`;
-  const id = crypto25.randomUUID();
+  const raw = `cnry_${crypto26.randomBytes(24).toString("hex")}`;
+  const id = crypto26.randomUUID();
   db.insert(apiKeys).values({
     id,
     name: `mcp-session:${userId}`,
@@ -16223,7 +16437,7 @@ function mintSessionKey(db, scopes, userId) {
 }
 function revokeSessionKey(db, id) {
   try {
-    db.update(apiKeys).set({ revokedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(apiKeys.id, id)).run();
+    db.update(apiKeys).set({ revokedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(apiKeys.id, id)).run();
   } catch {
   }
 }
@@ -16293,7 +16507,7 @@ function registerMcpHttpRoutes(scope, opts) {
       clientName: `canonry-mcp/${PACKAGE_VERSION}`,
       surface: "mcp-http",
       // Correlation only: this is never accepted as caller identity or authority.
-      actorSession: crypto25.randomUUID()
+      actorSession: crypto26.randomUUID()
     });
     let server;
     try {
@@ -16310,7 +16524,7 @@ function registerMcpHttpRoutes(scope, opts) {
       throw error;
     }
     const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => crypto25.randomUUID(),
+      sessionIdGenerator: () => crypto26.randomUUID(),
       onsessioninitialized: (id) => {
         sessions.set(id, { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() });
       }
@@ -16406,20 +16620,145 @@ function registerMcpHttpRoutes(scope, opts) {
 }
 
 // src/agent/agent-routes.ts
-import { eq as eq22 } from "drizzle-orm";
+import { eq as eq23 } from "drizzle-orm";
+function viewerAeroCaller(request, opts) {
+  if (!opts.viewerSessions) return null;
+  const principal = request.principal;
+  return principal?.kind === "user" && principal.role === UserRoles.viewer ? principal.id : null;
+}
+var VIEWER_HIDDEN_ASSISTANT_KEYS = ["api", "provider", "model", "responseId", "usage"];
+var VIEWER_ERROR_MESSAGE = "Aero could not finish this answer. Try again, or ask an administrator if it keeps happening.";
+function viewerRedact(_key, value) {
+  if (!value || typeof value !== "object" || value.role !== "assistant") return value;
+  const copy = { ...value };
+  for (const key of VIEWER_HIDDEN_ASSISTANT_KEYS) delete copy[key];
+  if (typeof copy.errorMessage === "string" && copy.errorMessage) copy.errorMessage = VIEWER_ERROR_MESSAGE;
+  return copy;
+}
+function redactForViewer(value) {
+  return JSON.parse(JSON.stringify(value, viewerRedact));
+}
+function viewerTranscript(opts, projectName, userId) {
+  const sessions = opts.viewerSessions;
+  return {
+    conversationId: null,
+    messages: redactForViewer(sessions.transcript(projectName, userId)),
+    isStreaming: sessions.isBusy(projectName, userId),
+    modelProvider: null,
+    modelId: null,
+    updatedAt: sessions.updatedAt(projectName, userId)
+  };
+}
 function resolveProject(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq22(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq23(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
+function promptMessage(prompt, context) {
+  return {
+    role: "user",
+    content: prompt,
+    timestamp: Date.now(),
+    ...context ? { aeroContext: context } : {}
+  };
+}
+async function streamAgentTurn(reply, agent, turn) {
+  reply.raw.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    "Connection": "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const write = (payload) => {
+    if (reply.raw.writableEnded) return;
+    try {
+      const frame = turn.viewer && payload.type === "error" ? { type: "error", message: VIEWER_ERROR_MESSAGE } : payload;
+      reply.raw.write(`data: ${JSON.stringify(frame, turn.viewer ? viewerRedact : void 0)}
+
+`);
+    } catch {
+    }
+  };
+  write({ type: "stream_open" });
+  const unsubscribe = agent.subscribe((event) => {
+    if (event.type === "tool_execution_start") {
+      const labelled = { ...event, label: agent.state.tools.find((tool) => tool.name === event.toolName)?.label };
+      write(labelled);
+    } else write(event);
+  });
+  let failed = false;
+  try {
+    await agent.prompt(turn.batch);
+    await agent.waitForIdle();
+  } catch (err) {
+    failed = true;
+    write({ type: "error", message: describeError(err) });
+  } finally {
+    try {
+      turn.save();
+    } catch (err) {
+      failed = true;
+      write({ type: "error", message: describeError(err) });
+    }
+    const status = aeroTurnStatus(agent);
+    write({ type: "aero_turn_status", status: status && failed ? { ...status, reason: "error" } : status });
+    unsubscribe();
+    turn.detach();
+    write({ type: "stream_close" });
+    if (!reply.raw.writableEnded) {
+      reply.raw.end();
+    }
+  }
+}
+async function streamViewerTurn(opts, project, viewerId, body, reply) {
+  const disconnected = new AbortController();
+  const live = {};
+  const onClose = () => {
+    if (!reply.raw.writableEnded) {
+      disconnected.abort();
+      live.agent?.abort();
+    }
+  };
+  reply.raw.once("close", onClose);
+  let turn;
+  try {
+    turn = await opts.viewerSessions.acquireForTurn(project, viewerId, { context: body.context, signal: disconnected.signal });
+  } catch (err) {
+    reply.raw.off("close", onClose);
+    if (disconnected.signal.aborted) return reply;
+    throw err;
+  }
+  live.agent = turn.agent;
+  if (disconnected.signal.aborted) {
+    turn.release();
+    return reply;
+  }
+  try {
+    await streamAgentTurn(reply, turn.agent, {
+      batch: promptMessage(body.prompt, body.context),
+      save: () => {
+      },
+      detach: () => reply.raw.off("close", onClose),
+      viewer: true
+    });
+  } finally {
+    turn.release();
+  }
+  return reply;
+}
 function registerAgentRoutes(app, opts) {
   registerAgentConversationRoutes(app, { db: opts.db, runtime: opts.sessionRegistry });
   app.get(
     "/projects/:name/agent/transcript",
     async (request) => {
+      const viewerId = viewerAeroCaller(request, opts);
+      if (viewerId) {
+        const project2 = resolveProject(opts.db, request.params.name);
+        return viewerTranscript(opts, project2.name, viewerId);
+      }
       requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq22(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq23(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { conversationId: null, messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -16444,23 +16783,46 @@ function registerAgentRoutes(app, opts) {
   );
   app.delete(
     "/projects/:name/agent/transcript",
+    // For a viewer this writes nothing: it drops their own in-memory
+    // conversation. Everyone else still meets the administrator gate below
+    // before anything is written, so the grant widens nothing for them.
+    { config: { readSemantic: true } },
     async (request) => {
+      const viewerId = viewerAeroCaller(request, opts);
+      if (viewerId) {
+        const project2 = resolveProject(opts.db, request.params.name);
+        opts.viewerSessions.reset(project2.name, viewerId);
+        return { status: "reset" };
+      }
       requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       if (opts.sessionRegistry.isBusy(project.name)) throw agentBusy(project.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq23(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
-  app.post("/projects/:name/agent/prompt", async (request, reply) => {
-    requireInstanceAdministrator(request);
+  app.post("/projects/:name/agent/prompt", {
+    // A turn is a paid read: it calls the LLM provider. The marker only lets a
+    // read-only principal reach this handler; the handler decides. A viewer is
+    // served from their own lane when the install allows it, and every other
+    // caller still meets `requireInstanceAdministrator`.
+    config: { paidRead: true }
+  }, async (request, reply) => {
+    const viewerId = viewerAeroCaller(request, opts);
+    if (!viewerId) requireInstanceAdministrator(request);
     const project = resolveProject(opts.db, request.params.name);
     const parsed = agentPromptRequestSchema.safeParse(request.body);
     if (!parsed.success) throw validationError(parsed.error.issues.map((issue) => issue.message).join("; "));
     const body = parsed.data;
+    if (viewerId) {
+      if (body.prompt.length > VIEWER_AERO_MAX_PROMPT_CHARS) {
+        throw validationError(`Keep questions under ${VIEWER_AERO_MAX_PROMPT_CHARS} characters.`);
+      }
+      return streamViewerTurn(opts, project, viewerId, body, reply);
+    }
     if (body.conversationId !== void 0) {
-      const current = opts.db.select({ id: agentSessions.id }).from(agentSessions).where(eq22(agentSessions.projectId, project.id)).get();
+      const current = opts.db.select({ id: agentSessions.id }).from(agentSessions).where(eq23(agentSessions.projectId, project.id)).get();
       if ((current?.id ?? null) !== body.conversationId) throw validationError("The active conversation changed. Reload the conversation before sending.");
     }
     const promptText = body.prompt;
@@ -16491,60 +16853,13 @@ function registerAgentRoutes(app, opts) {
       throw err;
     }
     if (disconnected.signal.aborted) return reply;
-    const acquiredAgent = agent;
-    reply.raw.writeHead(200, {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      "Connection": "keep-alive",
-      "X-Accel-Buffering": "no"
+    const pending = opts.sessionRegistry.consumePending(project.name);
+    const userMessage = promptMessage(promptText, body.context);
+    await streamAgentTurn(reply, agent, {
+      batch: pending.length > 0 ? [...pending, userMessage] : userMessage,
+      save: () => opts.sessionRegistry.save(project.name),
+      detach: () => reply.raw.off("close", onClose)
     });
-    const write = (payload) => {
-      if (reply.raw.writableEnded) return;
-      try {
-        reply.raw.write(`data: ${JSON.stringify(payload)}
-
-`);
-      } catch {
-      }
-    };
-    write({ type: "stream_open" });
-    const unsubscribe = agent.subscribe((event) => {
-      if (event.type === "tool_execution_start") {
-        const labelled = { ...event, label: acquiredAgent.state.tools.find((tool) => tool.name === event.toolName)?.label };
-        write(labelled);
-      } else write(event);
-    });
-    let failed = false;
-    try {
-      const pending = opts.sessionRegistry.consumePending(project.name);
-      const userMessage = {
-        role: "user",
-        content: promptText,
-        timestamp: Date.now(),
-        ...body.context ? { aeroContext: body.context } : {}
-      };
-      const batch = pending.length > 0 ? [...pending, userMessage] : userMessage;
-      await agent.prompt(batch);
-      await agent.waitForIdle();
-    } catch (err) {
-      failed = true;
-      write({ type: "error", message: describeError(err) });
-    } finally {
-      try {
-        opts.sessionRegistry.save(project.name);
-      } catch (err) {
-        failed = true;
-        write({ type: "error", message: describeError(err) });
-      }
-      const status = aeroTurnStatus(agent);
-      write({ type: "aero_turn_status", status: status && failed ? { ...status, reason: "error" } : status });
-      unsubscribe();
-      reply.raw.off("close", onClose);
-      write({ type: "stream_close" });
-      if (!reply.raw.writableEnded) {
-        reply.raw.end();
-      }
-    }
     return reply;
   });
   app.get(
@@ -17445,20 +17760,20 @@ function clipText(value, length) {
 }
 
 // src/research-runner.ts
-import { and as and17, eq as eq23, inArray as inArray9, sql as sql9 } from "drizzle-orm";
+import { and as and18, eq as eq24, inArray as inArray9, sql as sql9 } from "drizzle-orm";
 var unfinishedResearchQueryStatuses = [ResearchQueryStatuses.queued, ResearchQueryStatuses.running];
 function finalResearchRunStatus(completed, failed) {
   if (failed === 0) return ResearchRunStatuses.completed;
   return completed > 0 ? ResearchRunStatuses.partial : ResearchRunStatuses.failed;
 }
 async function executeResearchRun(db, registry, runId, projectId) {
-  const run = db.select().from(researchRuns).where(and17(eq23(researchRuns.id, runId), eq23(researchRuns.projectId, projectId))).get();
+  const run = db.select().from(researchRuns).where(and18(eq24(researchRuns.id, runId), eq24(researchRuns.projectId, projectId))).get();
   if (!run || run.status !== ResearchRunStatuses.queued) return;
-  const project = db.select().from(projects).where(eq23(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
   if (!project) return;
   const provider = registry.get(run.provider);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and17(eq23(researchRuns.id, runId), eq23(researchRuns.status, ResearchRunStatuses.queued))).run();
+  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and18(eq24(researchRuns.id, runId), eq24(researchRuns.status, ResearchRunStatuses.queued))).run();
   if (claim.changes !== 1) return;
   let reserved = 0;
   let dispatched = 0;
@@ -17482,8 +17797,8 @@ async function executeResearchRun(db, registry, runId, projectId) {
     }
     reserved = run.totalQueries;
     reservation = { scope, period };
-    const rows = db.select().from(researchRunQueries).where(eq23(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
-    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq23(competitors.projectId, projectId)).all().map((row) => row.domain);
+    const rows = db.select().from(researchRunQueries).where(eq24(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
+    const competitorDomains = db.select({ domain: competitors.domain }).from(competitors).where(eq24(competitors.projectId, projectId)).all().map((row) => row.domain);
     const domains = effectiveDomains(project);
     const brands = effectiveBrandNames(project);
     const config = { ...provider.config, model: run.resolvedModel };
@@ -17491,7 +17806,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and17(eq23(researchRunQueries.id, row.id), eq23(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
+        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and18(eq24(researchRunQueries.id, row.id), eq24(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
         const raw = await gate.run(async () => {
           dispatched++;
           return provider.adapter.executeTrackedQuery({ query: row.queryText, canonicalDomains: domains, competitorDomains, ...run.location ? { location: run.location } : {} }, config);
@@ -17518,7 +17833,7 @@ async function executeResearchRun(db, registry, runId, projectId) {
           citationState: determineCitationState(normalized, domains),
           rawResponse: raw.rawResponse,
           finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(and17(eq23(researchRunQueries.id, row.id), eq23(researchRunQueries.status, ResearchQueryStatuses.running))).run();
+        }).where(and18(eq24(researchRunQueries.id, row.id), eq24(researchRunQueries.status, ResearchQueryStatuses.running))).run();
         if (completed.changes === 1) incrementResearchProgress(db, runId, "completedQueries");
       } catch (error) {
         try {
@@ -17542,18 +17857,18 @@ async function executeResearchRun(db, registry, runId, projectId) {
   }
 }
 function incrementResearchProgress(db, runId, column) {
-  db.update(researchRuns).set({ [column]: sql9`${researchRuns[column]} + 1` }).where(eq23(researchRuns.id, runId)).run();
+  db.update(researchRuns).set({ [column]: sql9`${researchRuns[column]} + 1` }).where(eq24(researchRuns.id, runId)).run();
 }
 function markResearchQueryFailed(db, runId, queryId, error) {
   const message = describeError(error);
-  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq23(researchRunQueries.id, queryId), inArray9(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  const failed = db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error: message, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and18(eq24(researchRunQueries.id, queryId), inArray9(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
   if (failed.changes === 1) incrementResearchProgress(db, runId, "failedQueries");
 }
 function markUnfinishedResearchQueriesFailed(db, runId, error) {
-  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and17(eq23(researchRunQueries.researchRunId, runId), inArray9(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and18(eq24(researchRunQueries.researchRunId, runId), inArray9(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
 }
 function finalizeResearchRun(db, runId, fatalError) {
-  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq23(researchRunQueries.researchRunId, runId)).all();
+  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq24(researchRunQueries.researchRunId, runId)).all();
   const completed = rows.filter((row) => row.status === ResearchQueryStatuses.completed).length;
   const failed = rows.filter((row) => row.status === ResearchQueryStatuses.failed).length;
   db.update(researchRuns).set({
@@ -17562,11 +17877,11 @@ function finalizeResearchRun(db, runId, fatalError) {
     failedQueries: failed,
     error: fatalError ?? (failed === rows.length ? "Every research query failed." : null),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq23(researchRuns.id, runId)).run();
+  }).where(eq24(researchRuns.id, runId)).run();
 }
 
 // src/google-marketing-sync.ts
-import { and as and18, eq as eq24, isNull as isNull2 } from "drizzle-orm";
+import { and as and19, eq as eq25, isNull as isNull2 } from "drizzle-orm";
 function safeErrorMessage(error) {
   const raw = describeError(error);
   return raw.replace(/(["']?authorization["']?\s*[:=]\s*["']?bearer\s+)[^\s,"'}]+/gi, "$1[redacted]").replace(/(["']?(?:developer|access|refresh|client)[_-]?(?:token|secret)["']?\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1[redacted]").replace(/[\r\n\t]+/g, " ").slice(0, 1e3);
@@ -17589,10 +17904,10 @@ function assertSnapshotContext(metadata2, expected) {
   }
 }
 function requireSyncRun(db, runId, projectId, kind) {
-  const run = db.select().from(runs).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind)
+  const run = db.select().from(runs).where(and19(
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind)
   )).get();
   if (!run) throw new Error(`Run ${runId} is not a ${kind} run for this project.`);
   if (run.status !== RunStatuses.queued) {
@@ -17605,19 +17920,19 @@ function markFailed(db, runId, projectId, kind, expectedStatus, error) {
     status: RunStatuses.failed,
     error: serializeRunError({ message: safeErrorMessage(error) }),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind),
-    eq24(runs.status, expectedStatus)
+  }).where(and19(
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind),
+    eq25(runs.status, expectedStatus)
   )).run();
 }
 function claimSyncRun(db, runId, projectId, kind, startedAt) {
-  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and18(
-    eq24(runs.id, runId),
-    eq24(runs.projectId, projectId),
-    eq24(runs.kind, kind),
-    eq24(runs.status, RunStatuses.queued)
+  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and19(
+    eq25(runs.id, runId),
+    eq25(runs.projectId, projectId),
+    eq25(runs.kind, kind),
+    eq25(runs.status, RunStatuses.queued)
   )).run();
   return claim.changes === 1;
 }
@@ -17625,9 +17940,9 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
   let claimed = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["google-ads-sync"]);
-    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq25(projects.id, projectId)).get();
     if (!project) throw new Error(`Project ${projectId} was not found.`);
-    const connection = db.select().from(googleAdsConnections).where(eq24(googleAdsConnections.projectId, projectId)).get();
+    const connection = db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, projectId)).get();
     if (!connection?.selectedCustomerId) {
       throw new Error("Google Ads needs a selected customer before it can sync.");
     }
@@ -17678,11 +17993,11 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and18(
-        eq24(runs.id, runId),
-        eq24(runs.projectId, projectId),
-        eq24(runs.kind, RunKinds["google-ads-sync"]),
-        eq24(runs.status, RunStatuses.running)
+      }).where(and19(
+        eq25(runs.id, runId),
+        eq25(runs.projectId, projectId),
+        eq25(runs.kind, RunKinds["google-ads-sync"]),
+        eq25(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw new Error(`Run ${runId} was no longer running when Google Ads evidence was ready.`);
@@ -17699,12 +18014,12 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         lastMetricsSnapshotAt: result2.metrics?.metadata.capturedAt ?? connection.lastMetricsSnapshotAt,
         lastMetricsSnapshotId: result2.metrics?.metadata.id ?? connection.lastMetricsSnapshotId,
         updatedAt: finishedAt
-      }).where(and18(
-        eq24(googleAdsConnections.id, connection.id),
-        eq24(googleAdsConnections.projectId, projectId),
-        eq24(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
-        connection.selectedLoginCustomerId === null ? isNull2(googleAdsConnections.selectedLoginCustomerId) : eq24(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
-        eq24(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
+      }).where(and19(
+        eq25(googleAdsConnections.id, connection.id),
+        eq25(googleAdsConnections.projectId, projectId),
+        eq25(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
+        connection.selectedLoginCustomerId === null ? isNull2(googleAdsConnections.selectedLoginCustomerId) : eq25(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
+        eq25(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw new Error("Google Ads selection changed while its evidence was being collected.");
@@ -17731,9 +18046,9 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
   let claimed = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["gtm-sync"]);
-    const project = db.select().from(projects).where(eq24(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq25(projects.id, projectId)).get();
     if (!project) throw new Error(`Project ${projectId} was not found.`);
-    const connection = db.select().from(gtmConnections).where(eq24(gtmConnections.projectId, projectId)).get();
+    const connection = db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, projectId)).get();
     if (!connection?.selectedAccountId || !connection.selectedContainerId) {
       throw new Error("GTM needs a selected account and container before it can sync.");
     }
@@ -17768,11 +18083,11 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and18(
-        eq24(runs.id, runId),
-        eq24(runs.projectId, projectId),
-        eq24(runs.kind, RunKinds["gtm-sync"]),
-        eq24(runs.status, RunStatuses.running)
+      }).where(and19(
+        eq25(runs.id, runId),
+        eq25(runs.projectId, projectId),
+        eq25(runs.kind, RunKinds["gtm-sync"]),
+        eq25(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw new Error(`Run ${runId} was no longer running when GTM evidence was ready.`);
@@ -17786,13 +18101,13 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         lastSnapshotAt: snapshot.metadata.capturedAt,
         lastSnapshotId: snapshot.metadata.id,
         updatedAt: finishedAt
-      }).where(and18(
-        eq24(gtmConnections.id, connection.id),
-        eq24(gtmConnections.projectId, projectId),
-        eq24(gtmConnections.selectedAccountId, connection.selectedAccountId),
-        eq24(gtmConnections.selectedContainerId, connection.selectedContainerId),
-        connection.selectedWorkspaceId === null ? isNull2(gtmConnections.selectedWorkspaceId) : eq24(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
-        eq24(gtmConnections.selectionGeneration, connection.selectionGeneration)
+      }).where(and19(
+        eq25(gtmConnections.id, connection.id),
+        eq25(gtmConnections.projectId, projectId),
+        eq25(gtmConnections.selectedAccountId, connection.selectedAccountId),
+        eq25(gtmConnections.selectedContainerId, connection.selectedContainerId),
+        connection.selectedWorkspaceId === null ? isNull2(gtmConnections.selectedWorkspaceId) : eq25(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
+        eq25(gtmConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw new Error("GTM selection changed while its evidence was being collected.");
@@ -17913,14 +18228,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey2(key) {
-  return crypto26.createHash("sha256").update(key).digest("hex");
+  return crypto27.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto26.randomBytes(16);
-  const derived = crypto26.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto27.randomBytes(16);
+  const derived = crypto27.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -17941,14 +18256,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto26.scryptSync(password, salt, expected.length, {
+    const derived = crypto27.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto26.timingSafeEqual(derived, expected),
+      ok: crypto27.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -17957,7 +18272,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto26.timingSafeEqual(candidate, expected);
+    const ok = crypto27.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -18093,7 +18408,7 @@ function cloneGtmConfig(config) {
 function createGoogleMarketingConfigCredentialStore(input) {
   const persistConfigPatch = input.saveConfigPatch ?? saveConfigPatch;
   const env = input.env ?? process.env;
-  const randomUUID2 = input.randomUUID ?? crypto26.randomUUID;
+  const randomUUID2 = input.randomUUID ?? crypto27.randomUUID;
   const snapshot = () => ({
     googleAds: cloneGoogleAdsConfig(input.config.googleAds),
     gtm: cloneGtmConfig(input.config.gtm)
@@ -18196,7 +18511,7 @@ async function createServer(opts) {
   const trustProxy = resolveTrustProxy(process.env.CANONRY_TRUST_PROXY);
   const app = Fastify({
     loggerInstance: logger,
-    genReqId: () => crypto26.randomUUID(),
+    genReqId: () => crypto27.randomUUID(),
     trustProxy
   });
   const registry = new ProviderRegistry();
@@ -18281,6 +18596,13 @@ async function createServer(opts) {
     proactive: agentProactive,
     managedSweeps: dashboardManagedRunKinds.includes(SchedulableRunKinds["answer-visibility"])
   }) : void 0;
+  const agentAllowViewers = agentEnabled && resolveAgentAllowViewers(process.env, opts.config);
+  const viewerAeroSessions = agentAllowViewers ? new ViewerAeroSessions({
+    db: opts.db,
+    config: opts.config,
+    selfApiUrl: opts.config.apiUrl,
+    managedSweeps: dashboardManagedRunKinds.includes(SchedulableRunKinds["answer-visibility"])
+  }) : void 0;
   const runCoordinator = new RunCoordinator(
     opts.db,
     notifier,
@@ -18289,7 +18611,7 @@ async function createServer(opts) {
     async (ctx) => {
       if (!sessionRegistry) return;
       if (!agentProactive) return;
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq26(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -18746,7 +19068,7 @@ async function createServer(opts) {
       void (async () => {
         try {
           const report = await schedulerClient.runDoctor({ project: projectName });
-          const project = opts.db.select().from(projects).where(eq25(projects.name, projectName)).get();
+          const project = opts.db.select().from(projects).where(eq26(projects.name, projectName)).get();
           if (!project) {
             app.log.warn({ projectName }, "doctor schedule fired for an unknown project");
             return;
@@ -18774,9 +19096,9 @@ async function createServer(opts) {
         });
         if (!probed) return;
         const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(
-          and19(
-            eq25(ccReleaseSyncs.release, probed.release),
-            eq25(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+          and20(
+            eq26(ccReleaseSyncs.release, probed.release),
+            eq26(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
           )
         ).limit(1).get();
         if (alreadySynced) {
@@ -18957,7 +19279,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto26.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto27.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -19047,11 +19369,11 @@ async function createServer(opts) {
   })();
   if (opts.config.apiKey) {
     const keyHash = hashApiKey2(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto26.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto27.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -19075,7 +19397,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto26.randomBytes(32).toString("hex");
+    const sessionId = crypto27.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -19099,7 +19421,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey2(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -19123,7 +19445,7 @@ async function createServer(opts) {
     if (!header) return false;
     const parts = header.split(" ");
     if (parts.length !== 2 || parts[0] !== "Bearer") return false;
-    const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey2(parts[1]))).get();
+    const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(parts[1]))).get();
     return Boolean(key && !key.revokedAt);
   };
   const namedAccountsInUse = () => anyUsersExist(opts.db);
@@ -19213,12 +19535,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey2(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey2(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq26(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header(
         "set-cookie",
@@ -19371,7 +19693,7 @@ async function createServer(opts) {
       });
       registerOAuthAdminRoutes(scope, { db: opts.db });
       if (!sessionRegistry) return;
-      registerAgentRoutes(scope, { db: opts.db, sessionRegistry });
+      registerAgentRoutes(scope, { db: opts.db, sessionRegistry, viewerSessions: viewerAeroSessions });
     },
     getGoogleAuthConfig: () => getGoogleAuthConfig(opts.config),
     getPlacesConfig: () => getPlacesConfig(opts.config),
@@ -19381,8 +19703,8 @@ async function createServer(opts) {
     getAgentPin: () => describeAgentPin(opts.config),
     getGoogleMarketingDoctorInput: (ctx) => {
       if (!ctx.project) return null;
-      const googleAds = opts.db.select().from(googleAdsConnections).where(eq25(googleAdsConnections.projectId, ctx.project.id)).get();
-      const gtm = opts.db.select().from(gtmConnections).where(eq25(gtmConnections.projectId, ctx.project.id)).get();
+      const googleAds = opts.db.select().from(googleAdsConnections).where(eq26(googleAdsConnections.projectId, ctx.project.id)).get();
+      const gtm = opts.db.select().from(gtmConnections).where(eq26(gtmConnections.projectId, ctx.project.id)).get();
       const googleAdsCredential = getGoogleAdsConnection(opts.config, ctx.project.id);
       const gtmCredential = getGtmConnection(opts.config, ctx.project.id);
       const googleAdsConnected = Boolean(googleAdsCredential?.accessToken);
@@ -19506,7 +19828,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto26.randomUUID();
+            const runId = crypto27.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -19633,7 +19955,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq25(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq26(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(
             opts.db,
@@ -19751,7 +20073,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto26.randomUUID(),
+            id: crypto27.randomUUID(),
             projectId,
             actor: auditContext?.actor ?? "api",
             userAgent: auditContext?.userAgent ?? null,
@@ -19946,6 +20268,9 @@ async function createServer(opts) {
       if (Object.keys(dashboardConfig).length > 0) {
         clientConfig.dashboard = dashboardConfig;
       }
+      if (agentAllowViewers) {
+        clientConfig.agent = { allowViewers: true };
+      }
       if (researchAllowViewers) {
         clientConfig.research = {
           allowViewers: true,
@@ -20106,7 +20431,7 @@ async function createServer(opts) {
         },
         notify: (projectId, result2) => notifier.onSiteLivenessChecked(projectId, result2)
       });
-      for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq25(researchRuns.status, ResearchRunStatuses.queued)).all()) {
+      for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq26(researchRuns.status, ResearchRunStatuses.queued)).all()) {
         dispatchResearchRun(run.id, run.projectId);
       }
       runtimeStartupSettled = true;