@canonry/canonry 6.1.5 → 6.3.0

package/dist/{chunk-4UEX44C3.js → chunk-OTROA7CN.js}

@@ -19,21 +19,21 @@ import {
   runWithUsageTags,
   saveConfigPatch,
   sentimentInstallReadiness
-} from "./chunk-FRBKYQN7.js";
+} from "./chunk-ZZEPF3A5.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-MSFBNFTI.js";
+} from "./chunk-FSRVG2H7.js";
 import {
   CanonryMcpToolNames,
   CliError,
   PACKAGE_VERSION,
   canonryMcpTools,
   isMachineFormat
-} from "./chunk-5QH72CTN.js";
+} from "./chunk-DERWXLHX.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -214,7 +214,7 @@ import {
   siteLivenessState,
   toAlertView,
   usageCounters
-} from "./chunk-MTEVU6KG.js";
+} from "./chunk-QVGG76UW.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -232,6 +232,7 @@ import {
   CheckNotificationPolicies,
   DEFAULT_VIEWER_RESEARCH_DAILY_RUN_LIMIT,
   DiscoveryCompetitorTypes,
+  FEEDBACK_LIMITS,
   GOOGLE_ADS_CAMPAIGN_METRICS_MAX_CAMPAIGNS,
   GOOGLE_ADS_CAMPAIGN_METRICS_MAX_DAYS,
   GOOGLE_ADS_CAMPAIGN_METRICS_MAX_ROWS,
@@ -304,6 +305,7 @@ import {
   canonicalizeGtmAccountId,
   canonicalizeGtmContainerId,
   canonicalizeGtmResourceSelection,
+  classifyProviderErrorMessage,
   classifyProviderErrorMessages,
   classifyTemplateLinkEdge,
   cloudflareQueueNameSchema,
@@ -315,6 +317,7 @@ import {
   contentBriefDtoSchema,
   createTemplateLinkDetectionTally,
   createTemplateLinkPairIndex,
+  deliveryFailed,
   deriveCitedUrlCandidates,
   deriveGoogleAdsEffectiveGoalGraph,
   deriveIndexCoverage,
@@ -327,6 +330,7 @@ import {
   effectiveBrandNames,
   effectiveDomains,
   embedClientConfigForRequest,
+  extractProviderHttpStatus,
   factorStatusFromScore,
   filterCapturedCitedUrls,
   forbidden,
@@ -383,7 +387,9 @@ import {
   percentOf,
   providerError,
   providerSupportsLocationContext,
+  quotaExceeded,
   ratioUnitSchema,
+  redactFeedbackText,
   registrableDomain,
   reportMonthsForDoctor,
   resolveNegativeReviewMaxStars,
@@ -414,7 +420,7 @@ import {
   visibilityReportRequestSchema,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-J7LV4CS2.js";
+} from "./chunk-EV5G5QRR.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -3629,7 +3635,7 @@ function createGoogleMarketingRuntime(options) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto28 from "crypto";
+import crypto29 from "crypto";
 import fs9 from "fs";
 import path8 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -4053,6 +4059,19 @@ import os4 from "os";
 import { GoogleGenAI } from "@google/genai";
 
 // ../provider-gemini/src/utils.ts
+var GEMINI_MAX_RATE_LIMIT_WAIT_MS = 65e3;
+function geminiRetryDelayMs(err) {
+  const match = /"retryDelay"\s*:\s*"(\d+(?:\.\d+)?)s"/.exec(describeError(err));
+  return match ? Math.round(Number(match[1]) * 1e3) : null;
+}
+function isGeminiDailyQuotaError(err) {
+  return /"quotaId"\s*:\s*"[^"]*PerDay/i.test(describeError(err));
+}
+function isGeminiRetryable(err) {
+  if (!isRetryableHttpError(err) || isGeminiDailyQuotaError(err)) return false;
+  const asked = geminiRetryDelayMs(err);
+  return asked === null || asked <= GEMINI_MAX_RATE_LIMIT_WAIT_MS;
+}
 async function withRetry2(fn, options = {}) {
   return withRetry(fn, {
     maxRetries: options.maxRetries ?? 3,
@@ -4061,7 +4080,12 @@ async function withRetry2(fn, options = {}) {
     // provider has shipped to date (1000, 2000, 4000ms). Enable per-caller
     // if you need it.
     jitter: false,
-    isRetryable: isRetryableHttpError,
+    isRetryable: isGeminiRetryable,
+    computeDelayMs: (_attempt, err, defaultMs) => {
+      const asked = geminiRetryDelayMs(err);
+      return asked === null ? defaultMs : asked + 500;
+    },
+    ...options.sleep ? { sleep: options.sleep } : {},
     onRetry: ({ attempt, err, delayMs }) => {
       console.warn(
         `[provider] Attempt ${attempt + 1} failed, retrying in ${delayMs}ms...`,
@@ -4072,7 +4096,7 @@ async function withRetry2(fn, options = {}) {
 }
 
 // ../provider-gemini/src/normalize.ts
-var DEFAULT_MODEL = "gemini-2.5-flash";
+var DEFAULT_MODEL = "gemini-flash-latest";
 function isVertexConfig(config) {
   return !!config.vertexProject;
 }
@@ -4515,10 +4539,20 @@ var geminiAdapter = {
   keyUrl: "https://aistudio.google.com/apikey",
   // Upstream model list: https://ai.google.dev/gemini-api/docs/models
   modelRegistry: {
-    defaultModel: "gemini-2.5-flash",
+    defaultModel: "gemini-flash-latest",
     validationPattern: /./,
-    validationHint: "any valid Google model name (e.g. gemini-2.5-flash, learnlm-1.5-pro-experimental)",
+    validationHint: "any valid Google model name (e.g. gemini-flash-latest, gemini-3.8-flash)",
     knownModels: [
+      // Google's moving aliases: always the newest Flash / Flash-Lite, with
+      // 2 weeks' email notice before a breaking change. The model actually
+      // served is recorded per snapshot (`servedModel`), so trends still show
+      // when the model behind an alias changed.
+      { id: "gemini-flash-latest", displayName: "Gemini Flash (latest)", tier: "standard" },
+      { id: "gemini-flash-lite-latest", displayName: "Gemini Flash-Lite (latest)", tier: "economy" },
+      { id: "gemini-3.8-flash", displayName: "Gemini 3.8 Flash", tier: "standard" },
+      { id: "gemini-3.5-flash-lite", displayName: "Gemini 3.5 Flash-Lite", tier: "economy" },
+      // Google limits the 2.5 models to projects that already used them, so a
+      // new key may be refused. Listed for installs that still pin them.
       { id: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", tier: "flagship" },
       { id: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", tier: "standard" },
       { id: "gemini-2.5-flash-lite", displayName: "Gemini 2.5 Flash-Lite", tier: "economy" },
@@ -7824,13 +7858,101 @@ function createApiUsageTelemetry(options = {}) {
   };
 }
 
+// src/feedback.ts
+import crypto4 from "crypto";
+var FEEDBACK_ENDPOINT = "https://canonry.ai/api/feedback";
+var TIMEOUT_MS2 = 1e4;
+var FEEDBACK_MAX_BODY_BYTES = 8e3;
+function feedbackSource(context) {
+  const surface = classifyUsageSurface({
+    userAgent: context.userAgent,
+    usageLabels: { surface: context.surface }
+  });
+  if (surface === "cli" || surface === "dashboard") return surface;
+  if (surface === "mcp-stdio" || surface === "mcp-http") return "mcp";
+  return "api";
+}
+async function sendFeedback(submission, context, deps = {}) {
+  const doFetch = deps.fetch ?? fetch;
+  const telemetryOn = (deps.telemetryEnabled ?? isTelemetryEnabled)();
+  const anonymousId = telemetryOn ? (deps.anonymousId ?? getOrCreateAnonymousId)() : void 0;
+  const agent = [context.agent, context.mcpClient].map((label) => normalizeAgentSlug(label)).find((slug) => !!slug && slug !== "none");
+  const payload = {
+    feedbackId: crypto4.randomUUID(),
+    ...anonymousId ? { anonymousId } : {},
+    kind: submission.kind,
+    summary: redactFeedbackText(submission.summary, FEEDBACK_LIMITS.summary),
+    ...submission.details ? { details: redactFeedbackText(submission.details, FEEDBACK_LIMITS.details) } : {},
+    ...submission.area ? { area: redactFeedbackText(submission.area, FEEDBACK_LIMITS.area) } : {},
+    ...submission.command ? { command: redactFeedbackText(submission.command, FEEDBACK_LIMITS.command) } : {},
+    ...submission.errorCode ? { errorCode: redactFeedbackText(submission.errorCode, FEEDBACK_LIMITS.errorCode) } : {},
+    source: feedbackSource(context),
+    ...agent ? { agent } : {},
+    version: PACKAGE_VERSION.slice(0, 20),
+    nodeVersion: process.versions.node.slice(0, 20),
+    os: process.platform.slice(0, 20),
+    arch: process.arch.slice(0, 20),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const body = fitToByteBudget(payload);
+  let response;
+  try {
+    response = await doFetch(FEEDBACK_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      signal: AbortSignal.timeout(TIMEOUT_MS2)
+    });
+  } catch {
+    throw deliveryFailed("Could not reach canonry.ai to send feedback. Check the network and try again.");
+  }
+  if (response.status === 202 || response.ok) {
+    const body2 = await response.json().catch(() => ({}));
+    return { accepted: body2.accepted ?? true, id: typeof body2.id === "string" ? body2.id : payload.feedbackId };
+  }
+  if (response.status === 429) throw quotaExceeded("feedback submissions", { retryLater: true });
+  if (response.status === 400 || response.status === 413) {
+    const body2 = await response.json().catch(() => ({}));
+    throw validationError("canonry.ai rejected the feedback", body2.issues ? { issues: body2.issues } : void 0);
+  }
+  throw deliveryFailed(`canonry.ai could not store the feedback (HTTP ${response.status}). Try again later.`);
+}
+function truncateCodePoints(value, maxCodePoints) {
+  return Array.from(value).slice(0, Math.max(0, maxCodePoints)).join("");
+}
+function fitToByteBudget(payload) {
+  let current = { ...payload };
+  for (const field of ["details", "summary"]) {
+    let serialized = JSON.stringify(current);
+    let bytes = Buffer.byteLength(serialized, "utf8");
+    while (bytes > FEEDBACK_MAX_BODY_BYTES) {
+      const text = current[field];
+      if (typeof text !== "string" || text.length === 0) break;
+      const points = Array.from(text).length;
+      const target = points - Math.max(1, Math.ceil((bytes - FEEDBACK_MAX_BODY_BYTES) / 4));
+      if (field === "summary" && target < 1) break;
+      const shorter = truncateCodePoints(text, target);
+      if (field === "details" && shorter.length === 0) {
+        const { details: _dropped, ...rest } = current;
+        current = rest;
+      } else {
+        current = { ...current, [field]: shorter };
+      }
+      serialized = JSON.stringify(current);
+      bytes = Buffer.byteLength(serialized, "utf8");
+    }
+    if (bytes <= FEEDBACK_MAX_BODY_BYTES) return serialized;
+  }
+  return JSON.stringify(current);
+}
+
 // src/instance-identity.ts
 function nonBlank(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "07710f04d6bdd8ec8b4374a93f0f3c3d1b56f498" : void 0;
+  const embedded = true ? "a0351a3c7ac5eb8e0e4028ee004ddd5a12874575" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -7841,15 +7963,15 @@ function resolveInstanceIdentity(env = process.env) {
 }
 
 // src/job-runner.ts
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 import fs4 from "fs";
 import path3 from "path";
 import os3 from "os";
 import { setImmediate as yieldToEventLoop } from "timers/promises";
-import { and as and3, asc as asc2, count, eq as eq3, inArray, isNotNull, isNull, ne, sql as sql2 } from "drizzle-orm";
+import { and as and3, asc as asc2, count, desc, eq as eq3, inArray, isNotNull, isNull, lt, ne, sql as sql2 } from "drizzle-orm";
 
 // src/run-telemetry.ts
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 function extractRegistrableHost(input) {
   if (!input) return null;
   const trimmed = input.trim();
@@ -7869,7 +7991,7 @@ function extractRegistrableHost(input) {
 function hashDomain(input) {
   const host = extractRegistrableHost(input);
   if (!host) return null;
-  return crypto4.createHash("sha256").update(host).digest("hex");
+  return crypto5.createHash("sha256").update(host).digest("hex");
 }
 function buildRunCompletedProps(input) {
   const totalMs = input.phases?.total_ms ?? Date.now() - input.startTime;
@@ -7911,6 +8033,51 @@ function buildSiteAuditCompletedProps(input) {
   if (crawl.checkDeadLinks) props.deadLinksFound = crawl.deadLinksFound;
   return props;
 }
+var MAX_NESTED_KEYS = 12;
+function buildProviderOutcomeProps(providers, providerErrors) {
+  if (providerErrors.size === 0) return {};
+  const names = [.../* @__PURE__ */ new Set([...providers, ...providerErrors.keys()])].slice(0, MAX_NESTED_KEYS);
+  const providerOutcomes = {};
+  const providerHttpStatus = {};
+  for (const name of names) {
+    const message = providerErrors.get(name);
+    if (message === void 0) {
+      providerOutcomes[name] = "ok";
+      continue;
+    }
+    providerOutcomes[name] = classifyProviderErrorMessage(message);
+    const status = extractProviderHttpStatus(message);
+    if (status !== void 0) providerHttpStatus[name] = status;
+  }
+  return Object.keys(providerHttpStatus).length > 0 ? { providerOutcomes, providerHttpStatus } : { providerOutcomes };
+}
+function runFailureSite(providerCallStart, providerCallEnd) {
+  if (providerCallStart === void 0) return "setup";
+  return providerCallEnd === void 0 ? "provider_call" : "finalize";
+}
+var ERROR_NAME_RE = /^[a-z_$][\w$]{0,39}$/i;
+var ERROR_SYS_CODE_RE = /^[A-Z][A-Z0-9_]{1,39}$/;
+function describeRunFailure(err, site) {
+  const props = site ? { errorSite: site } : {};
+  const name = err instanceof Error ? err.name : typeof err;
+  if (ERROR_NAME_RE.test(name)) props.errorName = name;
+  const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
+  if (typeof code === "string" && ERROR_SYS_CODE_RE.test(code)) props.errorSysCode = code;
+  return props;
+}
+var FAILURE_STREAK_SAMPLE_AFTER = 5;
+var FAILURE_STREAK_SAMPLE_RATE = 20;
+function failureStreakSampling(status, priorStreak, runId) {
+  if (status !== "failed" && status !== "partial") return { report: true, props: {} };
+  if (priorStreak < FAILURE_STREAK_SAMPLE_AFTER) {
+    return { report: true, props: { failureStreak: priorStreak } };
+  }
+  const bucket = crypto5.createHash("sha256").update(runId).digest().readUInt32BE(0) % FAILURE_STREAK_SAMPLE_RATE;
+  return {
+    report: bucket === 0,
+    props: { failureStreak: priorStreak, sampleRate: FAILURE_STREAK_SAMPLE_RATE }
+  };
+}
 
 // src/provider-execution-gate.ts
 var ProviderExecutionGate = class {
@@ -7978,7 +8145,7 @@ function getSharedProviderExecutionGate(providerName, maxConcurrency, maxPerMinu
 }
 
 // src/usage-quota.ts
-import crypto5 from "crypto";
+import crypto6 from "crypto";
 import { and as and2, eq as eq2, lte, sql } from "drizzle-orm";
 function getCurrentUsageDay() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -7995,7 +8162,7 @@ function reserveDailyQueryQuota(db, input) {
     )).run();
     if (reserveExisting().changes === 1) return { reserved: true, used: 0 };
     const inserted = tx.insert(usageCounters).values({
-      id: crypto5.randomUUID(),
+      id: crypto6.randomUUID(),
       scope: input.scope,
       period: input.period,
       metric: "queries",
@@ -8259,6 +8426,7 @@ function classifyRunAbortReason(message) {
   if (/^Run [^ ]+ is not executable\b/.test(message)) return "run_not_executable";
   return void 0;
 }
+var FAILURE_STREAK_LOOKBACK = 50;
 function classifyProviderErrors(errors) {
   return classifyProviderErrorMessages(errors.values());
 }
@@ -8589,7 +8757,7 @@ var JobRunner = class {
             const answerLocation = runLocation && isSearchLocationIgnored(providerName, normalized.retrievalStatus) ? { location: null, requestedContext: runLocation, supportedContext: { status: "ignored" } } : { location: runLocation?.label ?? null };
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs4.existsSync(raw.screenshotPath)) {
-              const snapshotId = crypto6.randomUUID();
+              const snapshotId = crypto7.randomUUID();
               const screenshotDir = path3.join(os3.homedir(), ".canonry", "screenshots", runId);
               if (!fs4.existsSync(screenshotDir)) fs4.mkdirSync(screenshotDir, { recursive: true });
               const destPath = path3.join(screenshotDir, `${snapshotId}.png`);
@@ -8633,7 +8801,7 @@ var JobRunner = class {
               }).run();
             } else {
               this.db.insert(querySnapshots).values({
-                id: crypto6.randomUUID(),
+                id: crypto7.randomUUID(),
                 runId,
                 queryId: q.id,
                 queryText: q.query,
@@ -8853,21 +9021,28 @@ var JobRunner = class {
           ...executionContext.location ? { location: executionContext.location } : {}
         });
       } else {
-        trackEvent(
-          "run.completed",
-          buildRunCompletedProps({
-            status: "failed",
-            providerCount: executionContext.providerCount,
-            providers: executionContext.providers,
-            queryCount: executionContext.queryCount,
-            startTime,
-            trigger: executionContext.trigger,
-            canonicalDomain: executionContext.canonicalDomain,
-            phases,
-            location: executionContext.location
-          }),
-          { errorCode: "UNKNOWN" }
-        );
+        const sampling = failureStreakSampling("failed", this.priorFailureStreak(projectId, runId), runId);
+        if (sampling.report) {
+          trackEvent(
+            "run.completed",
+            {
+              ...buildRunCompletedProps({
+                status: "failed",
+                providerCount: executionContext.providerCount,
+                providers: executionContext.providers,
+                queryCount: executionContext.queryCount,
+                startTime,
+                trigger: executionContext.trigger,
+                canonicalDomain: executionContext.canonicalDomain,
+                phases,
+                location: executionContext.location
+              }),
+              ...describeRunFailure(err, runFailureSite(providerCallStart, providerCallEnd)),
+              ...sampling.props
+            },
+            { errorCode: "INTERNAL" }
+          );
+        }
       }
       if (this.onRunCompleted) {
         this.onRunCompleted(runId, projectId).catch((notifErr) => {
@@ -8931,21 +9106,28 @@ var JobRunner = class {
   reportFinalizedRun(input, finalStatus) {
     const { runId, projectId, providerErrors, executionContext } = input;
     const failureCode = providerErrors.size > 0 ? classifyProviderErrors(providerErrors) : void 0;
-    trackEvent(
-      "run.completed",
-      buildRunCompletedProps({
-        status: finalStatus,
-        providerCount: executionContext.providerCount,
-        providers: executionContext.providers,
-        queryCount: executionContext.queryCount,
-        startTime: input.startTime,
-        trigger: executionContext.trigger,
-        canonicalDomain: executionContext.canonicalDomain,
-        phases: input.phases,
-        location: executionContext.location
-      }),
-      failureCode ? { errorCode: failureCode } : void 0
-    );
+    const sampling = failureStreakSampling(finalStatus, this.priorFailureStreak(projectId, runId), runId);
+    if (sampling.report) {
+      trackEvent(
+        "run.completed",
+        {
+          ...buildRunCompletedProps({
+            status: finalStatus,
+            providerCount: executionContext.providerCount,
+            providers: executionContext.providers,
+            queryCount: executionContext.queryCount,
+            startTime: input.startTime,
+            trigger: executionContext.trigger,
+            canonicalDomain: executionContext.canonicalDomain,
+            phases: input.phases,
+            location: executionContext.location
+          }),
+          ...buildProviderOutcomeProps(executionContext.providers, providerErrors),
+          ...sampling.props
+        },
+        failureCode ? { errorCode: failureCode } : void 0
+      );
+    }
     if (input.kind === RunKinds["answer-visibility"] && executionContext.trigger !== RunTriggers.probe && input.inserted > 0 && !this.hasPriorActivation(projectId, runId)) {
       trackEvent("activation.completed", {
         flowVersion: ONBOARDING_FLOW_VERSION,
@@ -9159,7 +9341,7 @@ var JobRunner = class {
         syncUnits.push(unit);
         continue;
       }
-      const customId = crypto6.randomUUID().replace(/-/g, "");
+      const customId = crypto7.randomUUID().replace(/-/g, "");
       const lines = linesByModel.get(model) ?? [];
       lines.push({ unit, requestedModel, customId, request, bytes: Buffer.byteLength(JSON.stringify({ custom_id: customId, params: request.body })) });
       linesByModel.set(model, lines);
@@ -9195,7 +9377,7 @@ var JobRunner = class {
     if (!capability || !reservation) throw new Error(`Provider ${providerName} cannot submit a batch for run ${ctx.runId}`);
     const deadlineMs = (config.batch?.deadlineHours ?? capability.defaultDeadlineHours) * HOUR_MS;
     const created = /* @__PURE__ */ new Date();
-    const rowId = crypto6.randomUUID();
+    const rowId = crypto7.randomUUID();
     const ledger = lines.map((line) => ({
       id: line.customId,
       batchId: rowId,
@@ -9888,7 +10070,7 @@ var JobRunner = class {
       competitorAliases
     );
     const answerContext = supportedContext && isSearchLocationIgnored(providerName, normalized.retrievalStatus) ? { status: "ignored" } : supportedContext;
-    const snapshotId = crypto6.randomUUID();
+    const snapshotId = crypto7.randomUUID();
     let screenshotRelPath = null;
     if (raw.screenshotPath && fs4.existsSync(raw.screenshotPath)) {
       const screenshotDir = path3.join(os3.homedir(), ".canonry", "screenshots", ctx.runId);
@@ -9990,7 +10172,7 @@ var JobRunner = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const period = now.slice(0, 10);
     this.db.insert(usageCounters).values({
-      id: crypto6.randomUUID(),
+      id: crypto7.randomUUID(),
       scope,
       period,
       metric,
@@ -10008,6 +10190,36 @@ var JobRunner = class {
     }
     providerReservations.clear();
   }
+  /**
+   * How many runs of the same kind, created before this one, failed or came
+   * back partial in a row. Telemetry only: it feeds `failureStreak` and the
+   * sampling of runs stuck failing the same way. Probes do not count, other run
+   * kinds (syncs, audits) neither break nor extend a streak, and a run aborted
+   * before any provider was called (`run.aborted`, never a failed
+   * `run.completed`) is skipped, so every failure counted was also reported.
+   */
+  priorFailureStreak(projectId, currentRunId) {
+    try {
+      const current = this.db.select({ kind: runs.kind, createdAt: runs.createdAt }).from(runs).where(eq3(runs.id, currentRunId)).get();
+      if (!current) return 0;
+      const recent = this.db.select({ status: runs.status, error: runs.error }).from(runs).where(and3(
+        eq3(runs.projectId, projectId),
+        eq3(runs.kind, current.kind),
+        lt(runs.createdAt, current.createdAt),
+        ne(runs.trigger, RunTriggers.probe),
+        inArray(runs.status, ["completed", "partial", "failed"])
+      )).orderBy(desc(runs.createdAt)).limit(FAILURE_STREAK_LOOKBACK).all();
+      let streak = 0;
+      for (const row of recent) {
+        if (row.status === "completed") break;
+        if (row.status === "failed" && row.error && classifyRunAbortReason(row.error)) continue;
+        streak++;
+      }
+      return streak;
+    } catch {
+      return 0;
+    }
+  }
   hasPriorActivation(projectId, currentRunId) {
     return this.db.select({ id: querySnapshots.id }).from(querySnapshots).innerJoin(runs, eq3(querySnapshots.runId, runs.id)).where(and3(
       eq3(runs.projectId, projectId),
@@ -10094,12 +10306,12 @@ function maybeShowActivationNotice(io = {}) {
 }
 
 // src/gsc-sync.ts
-import crypto8 from "crypto";
+import crypto9 from "crypto";
 import { eq as eq5, and as and5, sql as sql3 } from "drizzle-orm";
 
 // src/gsc-coverage-snapshot.ts
-import crypto7 from "crypto";
-import { and as and4, desc, eq as eq4, gte } from "drizzle-orm";
+import crypto8 from "crypto";
+import { and as and4, desc as desc2, eq as eq4, gte } from "drizzle-orm";
 var COVERAGE_IMPRESSION_WINDOW_DAYS = 30;
 function pageKey(raw) {
   if (!raw) return null;
@@ -10123,9 +10335,9 @@ function writeCoverageSnapshot(db, projectId, runId, opts = {}) {
     eq4(siteCrawlSnapshots.projectId, projectId),
     eq4(siteCrawlSnapshots.complete, true),
     eq4(runs.status, "completed")
-  )).orderBy(desc(siteCrawlSnapshots.createdAt)).limit(1).get();
+  )).orderBy(desc2(siteCrawlSnapshots.createdAt)).limit(1).get();
   const hasCrawlHistory = Boolean(db.select({ id: siteCrawlSnapshots.id }).from(siteCrawlSnapshots).where(eq4(siteCrawlSnapshots.projectId, projectId)).limit(1).get());
-  const latestAudit = db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).where(eq4(siteAuditSnapshots.projectId, projectId)).orderBy(desc(siteAuditSnapshots.createdAt)).limit(1).get();
+  const latestAudit = db.select({ runId: siteAuditSnapshots.runId }).from(siteAuditSnapshots).where(eq4(siteAuditSnapshots.projectId, projectId)).orderBy(desc2(siteAuditSnapshots.createdAt)).limit(1).get();
   const sitemapUrls = latestCrawl?.attemptId ? db.select({ url: siteCrawlPages.url }).from(siteCrawlPages).where(and4(
     eq4(siteCrawlPages.projectId, projectId),
     eq4(siteCrawlPages.runId, latestCrawl.runId),
@@ -10160,7 +10372,7 @@ function writeCoverageSnapshot(db, projectId, runId, opts = {}) {
   const snapshotDate = now.toISOString().split("T")[0];
   db.delete(gscCoverageSnapshots).where(and4(eq4(gscCoverageSnapshots.projectId, projectId), eq4(gscCoverageSnapshots.date, snapshotDate))).run();
   db.insert(gscCoverageSnapshots).values({
-    id: crypto7.randomUUID(),
+    id: crypto8.randomUUID(),
     projectId,
     syncRunId: runId,
     date: snapshotDate,
@@ -10239,7 +10451,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       for (const row of batch) {
         const [query, page, country, device, date] = row.keys;
         db.insert(gscSearchData).values({
-          id: crypto8.randomUUID(),
+          id: crypto9.randomUUID(),
           projectId,
           syncRunId: runId,
           date: date ?? "",
@@ -10271,7 +10483,7 @@ async function executeGscSync(db, runId, projectId, opts) {
     for (const row of totalRows) {
       const [date] = row.keys;
       db.insert(gscDailyTotals).values({
-        id: crypto8.randomUUID(),
+        id: crypto9.randomUUID(),
         projectId,
         date: date ?? "",
         clicks: row.clicks,
@@ -10320,7 +10532,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       const [date, query] = row.keys;
       if (!date || !query) continue;
       db.insert(gscQueryDailyTotals).values({
-        id: crypto8.randomUUID(),
+        id: crypto9.randomUUID(),
         projectId,
         date,
         query,
@@ -10345,12 +10557,12 @@ async function executeGscSync(db, runId, projectId, opts) {
 }
 
 // src/gbp-sync.ts
-import crypto10 from "crypto";
-import { eq as eq7, and as and7, desc as desc3, inArray as inArray3, lt } from "drizzle-orm";
+import crypto11 from "crypto";
+import { eq as eq7, and as and7, desc as desc4, inArray as inArray3, lt as lt2 } from "drizzle-orm";
 
 // src/gbp-reviews.ts
-import crypto9 from "crypto";
-import { and as and6, desc as desc2, eq as eq6, inArray as inArray2, sql as sql4 } from "drizzle-orm";
+import crypto10 from "crypto";
+import { and as and6, desc as desc3, eq as eq6, inArray as inArray2, sql as sql4 } from "drizzle-orm";
 var log4 = createLogger("GbpReviews");
 var MS_PER_DAY = 864e5;
 var REVIEW_ALERT_MAX_AGE_DAYS = 30;
@@ -10382,7 +10594,7 @@ function placesReviewsDue(db, projectId, locationName, now) {
     eq6(gbpReviewRatings.projectId, projectId),
     eq6(gbpReviewRatings.locationName, locationName),
     eq6(gbpReviewRatings.origin, "places")
-  )).orderBy(desc2(gbpReviewRatings.observedAt)).limit(1).get();
+  )).orderBy(desc3(gbpReviewRatings.observedAt)).limit(1).get();
   if (!latest) return true;
   return now.getTime() - Date.parse(latest.observedAt) >= PLACES_REVIEW_MIN_INTERVAL_HOURS * 36e5;
 }
@@ -10463,12 +10675,12 @@ function persistReviewObservation(tx, projectId, runId, obs, ctx) {
     eq6(gbpReviewRatings.projectId, projectId),
     eq6(gbpReviewRatings.locationName, obs.locationName),
     eq6(gbpReviewRatings.origin, obs.origin)
-  )).orderBy(desc2(gbpReviewRatings.observedAt)).limit(1).get();
+  )).orderBy(desc3(gbpReviewRatings.observedAt)).limit(1).get();
   const baseline = latestRating === void 0;
   let queuedRatingDrop = false;
   if (!latestRating) {
     tx.insert(gbpReviewRatings).values({
-      id: crypto9.randomUUID(),
+      id: crypto10.randomUUID(),
       projectId,
       locationName: obs.locationName,
       origin: obs.origin,
@@ -10488,7 +10700,7 @@ function persistReviewObservation(tx, projectId, runId, obs, ctx) {
     const alertState = ratingAlertState(obs.origin, latestRating.rating, obs.rating);
     queuedRatingDrop = alertState === "pending";
     tx.insert(gbpReviewRatings).values({
-      id: crypto9.randomUUID(),
+      id: crypto10.randomUUID(),
       projectId,
       locationName: obs.locationName,
       origin: obs.origin,
@@ -10538,7 +10750,7 @@ function persistReviewObservation(tx, projectId, runId, obs, ctx) {
       const alertState = reviewAlertState(review, { baseline, now, negativeMaxStars });
       if (alertState === "pending") queuedReviews++;
       tx.insert(gbpReviews).values({
-        id: crypto9.randomUUID(),
+        id: crypto10.randomUUID(),
         projectId,
         origin: obs.origin,
         reviewName: review.reviewName,
@@ -10669,15 +10881,15 @@ async function executeGbpSync(db, runId, projectId, opts) {
             fetchLocationReviews(db, projectId, loc, reviewContext)
           ]);
           const lodgingHash = lodging ? hashLodging(lodging) : null;
-          const latestLodging = lodging ? db.select().from(gbpLodgingSnapshots).where(and7(eq7(gbpLodgingSnapshots.projectId, projectId), eq7(gbpLodgingSnapshots.locationName, loc.locationName))).orderBy(desc3(gbpLodgingSnapshots.syncedAt)).limit(1).get() : void 0;
+          const latestLodging = lodging ? db.select().from(gbpLodgingSnapshots).where(and7(eq7(gbpLodgingSnapshots.projectId, projectId), eq7(gbpLodgingSnapshots.locationName, loc.locationName))).orderBy(desc4(gbpLodgingSnapshots.syncedAt)).limit(1).get() : void 0;
           const lodgingChanged = lodging !== null && latestLodging?.contentHash !== lodgingHash;
           const attributesHash = hashAttributes(attributes);
-          const latestAttributes = db.select().from(gbpAttributesSnapshots).where(and7(eq7(gbpAttributesSnapshots.projectId, projectId), eq7(gbpAttributesSnapshots.locationName, loc.locationName))).orderBy(desc3(gbpAttributesSnapshots.syncedAt)).limit(1).get();
+          const latestAttributes = db.select().from(gbpAttributesSnapshots).where(and7(eq7(gbpAttributesSnapshots.projectId, projectId), eq7(gbpAttributesSnapshots.locationName, loc.locationName))).orderBy(desc4(gbpAttributesSnapshots.syncedAt)).limit(1).get();
           const attributesChanged = latestAttributes?.contentHash !== attributesHash;
           let placeToWrite = null;
           let placeToTouch = null;
           if (placesTier !== "off" && placesApiKey && lodging !== null && loc.placeId) {
-            const latestPlace = db.select().from(gbpPlaceDetails).where(and7(eq7(gbpPlaceDetails.projectId, projectId), eq7(gbpPlaceDetails.locationName, loc.locationName))).orderBy(desc3(gbpPlaceDetails.syncedAt)).limit(1).get();
+            const latestPlace = db.select().from(gbpPlaceDetails).where(and7(eq7(gbpPlaceDetails.projectId, projectId), eq7(gbpPlaceDetails.locationName, loc.locationName))).orderBy(desc4(gbpPlaceDetails.syncedAt)).limit(1).get();
             const ageDays = latestPlace ? (Date.now() - new Date(latestPlace.syncedAt).getTime()) / MS_PER_DAY2 : Infinity;
             if (ageDays >= placesRefreshDays) {
               try {
@@ -10699,7 +10911,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             tx.delete(gbpDailyMetrics).where(and7(eq7(gbpDailyMetrics.projectId, projectId), eq7(gbpDailyMetrics.locationName, loc.locationName))).run();
             for (const row of metricRows) {
               tx.insert(gbpDailyMetrics).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 date: row.date,
@@ -10711,7 +10923,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             tx.delete(gbpKeywordImpressions).where(and7(eq7(gbpKeywordImpressions.projectId, projectId), eq7(gbpKeywordImpressions.locationName, loc.locationName))).run();
             for (const row of keywordRows) {
               tx.insert(gbpKeywordImpressions).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 periodStart: monthKey(keywordsStart),
@@ -10732,7 +10944,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
               for (const { month, rows } of monthlyKeywordResults) {
                 for (const row of rows) {
                   tx.insert(gbpKeywordMonthly).values({
-                    id: crypto10.randomUUID(),
+                    id: crypto11.randomUUID(),
                     projectId,
                     locationName: loc.locationName,
                     month,
@@ -10747,13 +10959,13 @@ async function executeGbpSync(db, runId, projectId, opts) {
               tx.delete(gbpKeywordMonthly).where(and7(
                 eq7(gbpKeywordMonthly.projectId, projectId),
                 eq7(gbpKeywordMonthly.locationName, loc.locationName),
-                lt(gbpKeywordMonthly.month, keywordRetentionCutoff)
+                lt2(gbpKeywordMonthly.month, keywordRetentionCutoff)
               )).run();
             }
             tx.delete(gbpPlaceActions).where(and7(eq7(gbpPlaceActions.projectId, projectId), eq7(gbpPlaceActions.locationName, loc.locationName))).run();
             for (const row of placeActionRows) {
               tx.insert(gbpPlaceActions).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 placeActionLinkName: row.placeActionLinkName,
@@ -10766,7 +10978,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (lodging !== null && lodgingChanged) {
               tx.insert(gbpLodgingSnapshots).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 contentHash: lodgingHash,
@@ -10780,7 +10992,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (attributesChanged) {
               tx.insert(gbpAttributesSnapshots).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 contentHash: attributesHash,
@@ -10794,7 +11006,7 @@ async function executeGbpSync(db, runId, projectId, opts) {
             }
             if (placeToWrite) {
               tx.insert(gbpPlaceDetails).values({
-                id: crypto10.randomUUID(),
+                id: crypto11.randomUUID(),
                 projectId,
                 locationName: loc.locationName,
                 placeId: placeToWrite.placeId,
@@ -10899,7 +11111,7 @@ async function refreshSelectedLocationProfiles(db, projectId, accessToken, locat
 }
 
 // src/ads-sync.ts
-import crypto11 from "crypto";
+import crypto12 from "crypto";
 import { and as and8, eq as eq8, inArray as inArray4, notInArray } from "drizzle-orm";
 
 // ../integration-openai-ads/src/constants.ts
@@ -11674,7 +11886,7 @@ async function executeAdsSync(db, runId, projectId, opts) {
       }
       for (const upsert of insightUpserts) {
         tx.insert(adsInsightsDaily).values({
-          id: crypto11.randomUUID(),
+          id: crypto12.randomUUID(),
           projectId,
           level: upsert.level,
           entityId: upsert.entityId,
@@ -11742,7 +11954,7 @@ async function executeAdsSync(db, runId, projectId, opts) {
 }
 
 // src/gsc-inspect-sitemap.ts
-import crypto13 from "crypto";
+import crypto14 from "crypto";
 import { eq as eq9 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
@@ -11842,7 +12054,7 @@ async function parseSitemapRecursive(url, urls, visited, depth, isChild) {
 }
 
 // src/inspect-rate-gate.ts
-import crypto12 from "crypto";
+import crypto13 from "crypto";
 var gates = /* @__PURE__ */ new Map();
 function sharedRateGate(key) {
   let entry = gates.get(key);
@@ -11861,7 +12073,7 @@ function sharedRateGate(key) {
   };
 }
 function credentialGateKey(prefix, secret) {
-  const digest = crypto12.createHash("sha256").update(secret).digest("hex").slice(0, 12);
+  const digest = crypto13.createHash("sha256").update(secret).digest("hex").slice(0, 12);
   return `${prefix}:${digest}`;
 }
 
@@ -12016,7 +12228,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
           const rich = ir.richResultsResult;
           const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
           db.insert(gscUrlInspections).values({
-            id: crypto13.randomUUID(),
+            id: crypto14.randomUUID(),
             projectId,
             syncRunId: runId,
             url: pageUrl,
@@ -12074,8 +12286,8 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/bing-inspect-sitemap.ts
-import crypto14 from "crypto";
-import { eq as eq10, desc as desc4 } from "drizzle-orm";
+import crypto15 from "crypto";
+import { eq as eq10, desc as desc5 } from "drizzle-orm";
 var log9 = createLogger("BingInspectSitemap");
 var BING_INSPECT_SPACING_MS = 2e3;
 function parseBingDate(value) {
@@ -12179,7 +12391,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
             derivedInIndex = false;
           }
           db.insert(bingUrlInspections).values({
-            id: crypto14.randomUUID(),
+            id: crypto15.randomUUID(),
             projectId,
             url: pageUrl,
             httpCode,
@@ -12239,7 +12451,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
         `Bing inspection failed for every URL attempted (${errors} of ${targetUrls.length}); coverage was left unchanged rather than re-dated from stored inspections. Last error: ${detail}`
       );
     }
-    const allInspections = db.select().from(bingUrlInspections).where(eq10(bingUrlInspections.projectId, projectId)).orderBy(desc4(bingUrlInspections.inspectedAt)).all();
+    const allInspections = db.select().from(bingUrlInspections).where(eq10(bingUrlInspections.projectId, projectId)).orderBy(desc5(bingUrlInspections.inspectedAt)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     const definitiveByUrl = /* @__PURE__ */ new Map();
     for (const row of allInspections) {
@@ -12263,7 +12475,7 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const snapNow = (/* @__PURE__ */ new Date()).toISOString();
     db.insert(bingCoverageSnapshots).values({
-      id: crypto14.randomUUID(),
+      id: crypto15.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -12304,8 +12516,8 @@ async function executeBingInspectSitemap(db, runId, projectId, opts) {
 }
 
 // src/coverage-refresh.ts
-import crypto15 from "crypto";
-import { and as and9, desc as desc5, eq as eq11, inArray as inArray5 } from "drizzle-orm";
+import crypto16 from "crypto";
+import { and as and9, desc as desc6, eq as eq11, inArray as inArray5 } from "drizzle-orm";
 var log10 = createLogger("CoverageRefresh");
 var COVERAGE_REFRESH_MIN_INTERVAL_MS = 60 * 60 * 1e3;
 var COVERAGE_REFRESH_MANUAL_MIN_INTERVAL_MS = 2 * 60 * 1e3;
@@ -12334,7 +12546,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
       eq11(runs.kind, RunKinds["inspect-sitemap"]),
       inArray5(runs.status, IN_FLIGHT_STATUSES)
     )
-  ).orderBy(desc5(runs.createdAt)).limit(1).get();
+  ).orderBy(desc6(runs.createdAt)).limit(1).get();
   if (inFlight2) {
     log10.info("skip.in-flight", { projectId });
     return null;
@@ -12346,7 +12558,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
       eq11(runs.kind, RunKinds["inspect-sitemap"]),
       inArray5(runs.status, ACTIVE_OR_DONE_STATUSES)
     )
-  ).orderBy(desc5(runs.createdAt)).limit(1).get();
+  ).orderBy(desc6(runs.createdAt)).limit(1).get();
   if (recent) {
     const ageMs = nowMs - Date.parse(recent.createdAt);
     if (Number.isFinite(ageMs) && ageMs < windowMs) {
@@ -12354,7 +12566,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
       return null;
     }
   }
-  const runId = crypto15.randomUUID();
+  const runId = crypto16.randomUUID();
   db.insert(runs).values({
     id: runId,
     projectId,
@@ -12377,7 +12589,7 @@ async function maybeRefreshGscCoverage(db, config, projectId, deps = defaultDeps
 }
 
 // src/commoncrawl-sync.ts
-import crypto16 from "crypto";
+import crypto17 from "crypto";
 import path4 from "path";
 import { and as and10, eq as eq12, sql as sql5 } from "drizzle-orm";
 var log11 = createLogger("CommonCrawlSync");
@@ -12452,7 +12664,7 @@ async function executeReleaseSync(db, syncId, opts) {
         if (!projectIds) continue;
         for (const projectId of projectIds) {
           expanded.push({
-            id: crypto16.randomUUID(),
+            id: crypto17.randomUUID(),
             projectId,
             releaseSyncId: syncId,
             release,
@@ -12472,7 +12684,7 @@ async function executeReleaseSync(db, syncId, opts) {
         const projectRows = rowsByProject.get(p.id) ?? [];
         const summary = computeSummary(projectRows);
         tx.insert(backlinkSummaries).values({
-          id: crypto16.randomUUID(),
+          id: crypto17.randomUUID(),
           projectId: p.id,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -12569,9 +12781,9 @@ function computeSummary(rows) {
 }
 
 // src/backlink-extract.ts
-import crypto17 from "crypto";
+import crypto18 from "crypto";
 import fs5 from "fs";
-import { and as and11, desc as desc6, eq as eq13 } from "drizzle-orm";
+import { and as and11, desc as desc7, eq as eq13 } from "drizzle-orm";
 var log12 = createLogger("BacklinkExtract");
 function defaultDeps3() {
   return {
@@ -12589,7 +12801,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
-    const sync = opts.release ? db.select().from(ccReleaseSyncs).where(eq13(ccReleaseSyncs.release, opts.release)).get() : db.select().from(ccReleaseSyncs).where(eq13(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).orderBy(desc6(ccReleaseSyncs.createdAt)).limit(1).get();
+    const sync = opts.release ? db.select().from(ccReleaseSyncs).where(eq13(ccReleaseSyncs.release, opts.release)).get() : db.select().from(ccReleaseSyncs).where(eq13(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)).orderBy(desc7(ccReleaseSyncs.createdAt)).limit(1).get();
     if (!sync) {
       throw new Error("No ready release sync available \u2014 run `canonry backlinks sync` first");
     }
@@ -12625,7 +12837,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       ).run();
       if (rows.length > 0) {
         const values = rows.map((r) => ({
-          id: crypto17.randomUUID(),
+          id: crypto18.randomUUID(),
           projectId,
           releaseSyncId: syncId,
           source: BacklinkSources.commoncrawl,
@@ -12639,7 +12851,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
       }
       const summary = computeSummary2(rows);
       tx.insert(backlinkSummaries).values({
-        id: crypto17.randomUUID(),
+        id: crypto18.randomUUID(),
         projectId,
         releaseSyncId: syncId,
         source: BacklinkSources.commoncrawl,
@@ -12682,7 +12894,7 @@ function computeSummary2(rows) {
 }
 
 // src/discovery-run.ts
-import crypto18 from "crypto";
+import crypto19 from "crypto";
 import { and as and12, eq as eq14 } from "drizzle-orm";
 var log13 = createLogger("DiscoveryRun");
 var DEFAULT_SEED_COUNT = 30;
@@ -13037,7 +13249,7 @@ function writeDiscoveryInsight(db, input) {
       eq14(insights.dismissed, false)
     )).run();
     tx.insert(insights).values({
-      id: crypto18.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId: input.projectId,
       runId: input.runId,
       type: "discovery.basket-divergence",
@@ -13073,7 +13285,7 @@ function buildDiscoveryInsightTitle(input) {
 }
 
 // src/execute-site-audit.ts
-import crypto19 from "crypto";
+import crypto20 from "crypto";
 import { and as and14, eq as eq16, ne as ne2, sql as sql6 } from "drizzle-orm";
 import { runSiteCrawl } from "@canonry/aeo-audit";
 
@@ -13493,10 +13705,13 @@ function deadLinkCheckedCount(edges, pages) {
 }
 function trackSiteAuditOutcome(db, input) {
   try {
-    const errorCode = input.status === "cancelled" ? "RUN_CANCELLED" : input.status === "failed" ? "UNKNOWN" : void 0;
+    const errorCode = input.status === "cancelled" ? "RUN_CANCELLED" : input.status === "failed" ? "INTERNAL" : void 0;
     trackEvent(
       "site_audit.completed",
-      buildSiteAuditCompletedProps(input),
+      {
+        ...buildSiteAuditCompletedProps(input),
+        ...input.status === "failed" ? describeRunFailure(input.error) : {}
+      },
       errorCode ? { errorCode } : void 0
     );
     const pagesAudited = input.crawl?.pagesAudited ?? 0;
@@ -13521,7 +13736,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
   const trigger = db.select({ trigger: runs.trigger }).from(runs).where(eq16(runs.id, runId)).get()?.trigger ?? null;
   let canonicalDomain = null;
   const attemptNumber = (db.select({ value: sql6`coalesce(max(${siteCrawlAttempts.attemptNumber}), 0)` }).from(siteCrawlAttempts).where(eq16(siteCrawlAttempts.runId, runId)).get()?.value ?? 0) + 1;
-  const attemptId = crypto19.randomUUID();
+  const attemptId = crypto20.randomUUID();
   db.insert(siteCrawlAttempts).values({
     id: attemptId,
     projectId,
@@ -13599,7 +13814,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       nodeKey: page.key
     });
     tx.insert(siteCrawlPages).values({
-      id: crypto19.randomUUID(),
+      id: crypto20.randomUUID(),
       projectId,
       runId,
       attemptId,
@@ -13692,7 +13907,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
     if (isSelfLink(edge.from, edge.to)) return;
     observedEdges.set(edge.key, edge);
     tx.insert(siteCrawlEdges).values({
-      id: crypto19.randomUUID(),
+      id: crypto20.randomUUID(),
       projectId,
       runId,
       attemptId,
@@ -13762,7 +13977,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         return;
       }
       tx.insert(siteCrawlEventReceipts).values({
-        id: crypto19.randomUUID(),
+        id: crypto20.randomUUID(),
         projectId,
         runId,
         attemptId,
@@ -13898,7 +14113,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       if (claim2.changes === 0) return false;
       if (hasAuditedPages) {
         tx.insert(siteAuditSnapshots).values({
-          id: crypto19.randomUUID(),
+          id: crypto20.randomUUID(),
           projectId,
           runId,
           sitemapUrl: opts.sitemapUrl ?? new URL("/sitemap.xml", crawlRootUrl).href,
@@ -13916,7 +14131,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         for (const page of observedPages.values()) {
           if (!isLegacyScorecardPage(page)) continue;
           tx.insert(siteAuditPages).values({
-            id: crypto19.randomUUID(),
+            id: crypto20.randomUUID(),
             projectId,
             runId,
             url: page.finalUrl ?? page.requestedUrl,
@@ -13929,7 +14144,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
         }
       }
       tx.insert(siteCrawlSnapshots).values({
-        id: crypto19.randomUUID(),
+        id: crypto20.randomUUID(),
         projectId,
         runId,
         attemptId,
@@ -13975,7 +14190,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       if (opts.checkDeadLinks) {
         for (const finding of deadLinkFindings) {
           tx.insert(siteCrawlFindings).values({
-            id: crypto19.randomUUID(),
+            id: crypto20.randomUUID(),
             projectId,
             runId,
             attemptId,
@@ -14063,7 +14278,8 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
       status: cancelled ? "cancelled" : "failed",
       startTime,
       trigger,
-      canonicalDomain
+      canonicalDomain,
+      error
     });
     throw error;
   }
@@ -14071,7 +14287,7 @@ async function executeSiteAudit(db, runId, projectId, opts = {}) {
 
 // src/commands/backfill.ts
 import { setImmediate as yieldToEventLoop2 } from "timers/promises";
-import { and as and15, asc as asc4, desc as desc7, eq as eq17, gt as gt3, inArray as inArray7, isNull as isNull2, lte as lte2, sql as sql7 } from "drizzle-orm";
+import { and as and15, asc as asc4, desc as desc8, eq as eq17, gt as gt3, inArray as inArray7, isNull as isNull2, lte as lte2, sql as sql7 } from "drizzle-orm";
 var SNAPSHOT_BATCH_SIZE = 500;
 var PATH_REPAIR_PAGE_SIZE = 128;
 async function backfillAnswerVisibilityCommand(opts) {
@@ -14259,7 +14475,7 @@ function backfillNormalizedPaths(db, opts) {
 async function repairStoredPaths(db, table, opts) {
   const pageSize = opts?.pageSize ?? PATH_REPAIR_PAGE_SIZE;
   const projectScope = opts?.projectId ? sql7`+${table.projectId} = ${opts.projectId}` : void 0;
-  const lastId = db.select({ id: table.id }).from(table).where(projectScope).orderBy(desc7(table.id)).limit(1).get()?.id;
+  const lastId = db.select({ id: table.id }).from(table).where(projectScope).orderBy(desc8(table.id)).limit(1).get()?.id;
   if (lastId === void 0) return { examined: 0, updated: 0, unchanged: 0 };
   let cursor;
   let examined = 0;
@@ -14549,7 +14765,7 @@ function readStoredGroundingSources(rawResponse) {
   return result2;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-JYGP6LME.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-5J36RBEM.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -15139,7 +15355,7 @@ var ProviderRegistry = class {
 import { createHash as createHash4 } from "crypto";
 var TTL_MS = 60 * 60 * 1e3;
 var RETRY_MS = 60 * 1e3;
-var TIMEOUT_MS2 = 3e3;
+var TIMEOUT_MS3 = 3e3;
 function createProviderModelCatalog(registry) {
   const cache = /* @__PURE__ */ new Map();
   const read = async (name) => {
@@ -15165,7 +15381,7 @@ function createProviderModelCatalog(registry) {
       timer = setTimeout(() => {
         controller.abort();
         reject(new Error("Model discovery timed out"));
-      }, TIMEOUT_MS2);
+      }, TIMEOUT_MS3);
     });
     current.pending = Promise.race([
       Promise.resolve().then(() => provider.adapter.listModels(provider.config, controller.signal)),
@@ -15196,14 +15412,14 @@ function createProviderModelCatalog(registry) {
 }
 
 // src/scheduler.ts
-import crypto20 from "crypto";
+import crypto21 from "crypto";
 import cron from "node-cron";
 import { and as and16, eq as eq18, inArray as inArray8, notExists, sql as sql8 } from "drizzle-orm";
 var log15 = createLogger("Scheduler");
 var DEFAULT_HEALTH_CRON = "0 */6 * * *";
 function ensureDefaultHealthSchedule(db, projectId, now = (/* @__PURE__ */ new Date()).toISOString()) {
   const result2 = db.insert(schedules).values({
-    id: crypto20.randomUUID(),
+    id: crypto21.randomUUID(),
     projectId,
     kind: SchedulableRunKinds.doctor,
     cronExpr: DEFAULT_HEALTH_CRON,
@@ -15521,7 +15737,7 @@ var Scheduler = class {
           log15.warn("gbp-sync.no-callback", { scheduleId, projectId, msg: "host did not register onGbpSyncRequested" });
           return;
         }
-        const runId2 = crypto20.randomUUID();
+        const runId2 = crypto21.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -15553,7 +15769,7 @@ var Scheduler = class {
           this.updateScheduleTiming(currentSchedule.id, { nextRunAt });
           return;
         }
-        const runId2 = crypto20.randomUUID();
+        const runId2 = crypto21.randomUUID();
         this.db.insert(runs).values({
           id: runId2,
           projectId,
@@ -15624,7 +15840,7 @@ var Scheduler = class {
           this.updateScheduleTiming(currentSchedule.id, { nextRunAt });
           return;
         }
-        const runId2 = crypto20.randomUUID();
+        const runId2 = crypto21.randomUUID();
         const effectiveRequest = normalizeSiteAuditRunRequest({ maxPages: SITE_AUDIT_MAX_PAGE_LIMIT });
         this.db.transaction((tx) => {
           tx.insert(runs).values({
@@ -15966,8 +16182,8 @@ async function refreshAllIntegrations(client, projectName, now = /* @__PURE__ */
 }
 
 // src/notifier.ts
-import { eq as eq20, desc as desc8, and as and18, inArray as inArray10, or } from "drizzle-orm";
-import crypto21 from "crypto";
+import { eq as eq20, desc as desc9, and as and18, inArray as inArray10, or } from "drizzle-orm";
+import crypto22 from "crypto";
 var log19 = createLogger("Notifier");
 var MATERIAL_MAGNITUDE_DELTA = 20;
 var SEVERITY_RANK = { low: 0, medium: 1, high: 2, critical: 3 };
@@ -16507,7 +16723,7 @@ var Notifier = class {
         eq20(runs.kind, thisRun.kind),
         or(eq20(runs.status, "completed"), eq20(runs.status, "partial"))
       )
-    ).orderBy(desc8(runs.createdAt), desc8(runs.id)).limit(RECENT_FETCH_LIMIT).all();
+    ).orderBy(desc9(runs.createdAt), desc9(runs.id)).limit(RECENT_FETCH_LIMIT).all();
     const groups = groupRunsByCreatedAt(recentRuns);
     const currentGroupIdx = groups.findIndex((g) => g[0]?.createdAt === thisRun.createdAt);
     if (currentGroupIdx < 0) return [];
@@ -16594,7 +16810,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto21.randomUUID(),
+      id: crypto22.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -16770,7 +16986,7 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto25 from "crypto";
+import crypto26 from "crypto";
 import { eq as eq24 } from "drizzle-orm";
 
 // src/agent/session.ts
@@ -16828,12 +17044,17 @@ var PROVIDER_MODELS = {
     [LlmCapabilities.classify]: "gpt-5-nano"
   },
   [AgentProviderIds.gemini]: {
-    // Gemini's 2.5-flash is already cheap + capable; flash-lite is the
+    // Gemini's Flash is already cheap + capable; Flash-Lite is the
     // dedicated micro tier for classify. Analyze stays on flash because
     // flash-lite drops too much quality for structured synthesis.
-    [LlmCapabilities.agent]: "gemini-2.5-flash",
-    [LlmCapabilities.analyze]: "gemini-2.5-flash",
-    [LlmCapabilities.classify]: "gemini-2.5-flash-lite"
+    // Exact IDs, never Google's `-latest` aliases: pi-ai derives request
+    // options (thinking level) from the catalog entry for the ID it is given,
+    // and an alias entry can lag the model it serves. `gemini-flash-latest`
+    // allows MINIMAL thinking while the 3.8 Flash it resolves to rejects it,
+    // so every Aero turn failed. Sweeps can use the alias; Aero cannot.
+    [LlmCapabilities.agent]: "gemini-3.8-flash",
+    [LlmCapabilities.analyze]: "gemini-3.8-flash",
+    [LlmCapabilities.classify]: "gemini-3.5-flash-lite"
   },
   [AgentProviderIds.zai]: {
     // GLM lineage: 5.2 replaced 5.1, which pi-ai 0.87 dropped from its
@@ -18018,7 +18239,7 @@ function buildAeroStateTools(ctx, opts = {}) {
 }
 
 // src/agent/llm-usage.ts
-import crypto22 from "crypto";
+import crypto23 from "crypto";
 var AeroLlmUsageFeatures = {
   turn: "aero.turn"
 };
@@ -18037,7 +18258,7 @@ function recordLlmUsageEvent(args) {
     const usage = args.message.usage;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     args.db.insert(llmUsageEvents).values({
-      id: crypto22.randomUUID(),
+      id: crypto23.randomUUID(),
       projectId: args.projectId,
       runId: args.runId,
       agentSessionId: args.agentSessionId,
@@ -18407,7 +18628,7 @@ This context applies to this turn. Explicit user scope takes precedence; do not
 }
 
 // src/agent/tool-usage.ts
-import crypto23 from "crypto";
+import crypto24 from "crypto";
 var AeroToolEventStatuses = {
   success: "success",
   error: "error"
@@ -18470,7 +18691,7 @@ function createAeroToolUsageHooks(args) {
 function recordAgentToolEvent(args) {
   try {
     args.db.insert(agentToolEvents).values({
-      id: crypto23.randomUUID(),
+      id: crypto24.randomUUID(),
       projectId: args.projectId,
       agentSessionId: args.agentSessionId,
       toolCallId: args.toolCallId,
@@ -18725,8 +18946,8 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto24 from "crypto";
-import { and as and19, desc as desc9, eq as eq22, like, sql as sql10, or as or2 } from "drizzle-orm";
+import crypto25 from "crypto";
+import { and as and19, desc as desc10, eq as eq22, like, sql as sql10, or as or2 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto(row) {
@@ -18740,7 +18961,7 @@ function rowToDto(row) {
   };
 }
 function listMemoryEntries(db, projectId, opts = {}) {
-  const query = db.select().from(agentMemory).where(eq22(agentMemory.projectId, projectId)).orderBy(desc9(agentMemory.updatedAt));
+  const query = db.select().from(agentMemory).where(eq22(agentMemory.projectId, projectId)).orderBy(desc10(agentMemory.updatedAt));
   const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
   return rows.map(rowToDto);
 }
@@ -18754,7 +18975,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto24.randomUUID();
+  const id = crypto25.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -18786,7 +19007,7 @@ function loadRecentForHydrate(db, projectId, limit, sessionId) {
   return db.select().from(agentMemory).where(and19(
     eq22(agentMemory.projectId, projectId),
     or2(sql10`substr(${agentMemory.key}, 1, ${COMPACTION_KEY_PREFIX.length}) <> ${COMPACTION_KEY_PREFIX}`, sessionId ? sql10`substr(${agentMemory.key}, 1, ${sessionPrefix.length}) = ${sessionPrefix}` : void 0)
-  )).orderBy(desc9(agentMemory.updatedAt)).limit(limit).all().map(rowToDto);
+  )).orderBy(desc10(agentMemory.updatedAt)).limit(limit).all().map(rowToDto);
 }
 function writeCompactionNote(db, args) {
   if (Buffer.byteLength(args.summary, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
@@ -18796,7 +19017,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto24.randomUUID();
+  const id = crypto25.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -18814,7 +19035,7 @@ function writeCompactionNote(db, args) {
         eq22(agentMemory.projectId, args.projectId),
         like(agentMemory.key, `${sessionPrefix}%`)
       )
-    ).orderBy(desc9(agentMemory.updatedAt)).all();
+    ).orderBy(desc10(agentMemory.updatedAt)).all();
     const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
     if (stale.length > 0) {
       tx.delete(agentMemory).where(sql10`${agentMemory.id} IN (${sql10.join(stale.map((s) => sql10`${s}`), sql10`, `)})`).run();
@@ -19168,7 +19389,7 @@ var SessionRegistry = class {
       return agent2;
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
-    const sessionId = crypto25.randomUUID();
+    const sessionId = crypto26.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -19620,7 +19841,7 @@ ${lines.join("\n")}
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: params.id ?? crypto25.randomUUID(),
+      id: params.id ?? crypto26.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -19647,7 +19868,7 @@ ${lines.join("\n")}
 };
 
 // src/agent/viewer-sessions.ts
-import crypto26 from "crypto";
+import crypto27 from "crypto";
 import { and as and21, eq as eq25, isNotNull as isNotNull3, like as like2 } from "drizzle-orm";
 var AERO_VIEWER_EXCLUDED_MCP_TOOLS = /* @__PURE__ */ new Set([
   CanonryMcpToolNames.canonry_ads_account,
@@ -19701,8 +19922,8 @@ function trimViewerTranscript(messages, max = MAX_VIEWER_MESSAGES) {
 }
 var VIEWER_IDLE_MS = 12 * 60 * 60 * 1e3;
 function mintViewerAeroKey(db, userId, now = /* @__PURE__ */ new Date()) {
-  const raw = `cnry_${crypto26.randomBytes(24).toString("hex")}`;
-  const id = crypto26.randomUUID();
+  const raw = `cnry_${crypto27.randomBytes(24).toString("hex")}`;
+  const id = crypto27.randomUUID();
   db.insert(apiKeys).values({
     id,
     name: `${VIEWER_AERO_KEY_PREFIX}${userId}`,
@@ -19854,15 +20075,15 @@ var ViewerAeroSessions = class {
 };
 
 // src/mcp-http.ts
-import crypto27 from "crypto";
+import crypto28 from "crypto";
 import { eq as eq26 } from "drizzle-orm";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 var SESSION_IDLE_MS = 10 * 60 * 1e3;
 var SWEEP_INTERVAL_MS = 60 * 1e3;
 function mintSessionKey(db, scopes, userId) {
-  const raw = `cnry_${crypto27.randomBytes(24).toString("hex")}`;
-  const id = crypto27.randomUUID();
+  const raw = `cnry_${crypto28.randomBytes(24).toString("hex")}`;
+  const id = crypto28.randomUUID();
   db.insert(apiKeys).values({
     id,
     name: `mcp-session:${userId}`,
@@ -19946,7 +20167,7 @@ function registerMcpHttpRoutes(scope, opts) {
       clientName: `canonry-mcp/${PACKAGE_VERSION}`,
       surface: "mcp-http",
       // Correlation only: this is never accepted as caller identity or authority.
-      actorSession: crypto27.randomUUID()
+      actorSession: crypto28.randomUUID()
     });
     let server;
     try {
@@ -19963,7 +20184,7 @@ function registerMcpHttpRoutes(scope, opts) {
       throw error;
     }
     const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => crypto27.randomUUID(),
+      sessionIdGenerator: () => crypto28.randomUUID(),
       onsessioninitialized: (id) => {
         sessions.set(id, { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() });
       }
@@ -21672,14 +21893,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey2(key) {
-  return crypto28.createHash("sha256").update(key).digest("hex");
+  return crypto29.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto28.randomBytes(16);
-  const derived = crypto28.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto29.randomBytes(16);
+  const derived = crypto29.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -21700,14 +21921,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto28.scryptSync(password, salt, expected.length, {
+    const derived = crypto29.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto28.timingSafeEqual(derived, expected),
+      ok: crypto29.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -21716,7 +21937,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto28.timingSafeEqual(candidate, expected);
+    const ok = crypto29.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -21852,7 +22073,7 @@ function cloneGtmConfig(config) {
 function createGoogleMarketingConfigCredentialStore(input) {
   const persistConfigPatch = input.saveConfigPatch ?? saveConfigPatch;
   const env = input.env ?? process.env;
-  const randomUUID3 = input.randomUUID ?? crypto28.randomUUID;
+  const randomUUID3 = input.randomUUID ?? crypto29.randomUUID;
   const snapshot = () => ({
     googleAds: cloneGoogleAdsConfig(input.config.googleAds),
     gtm: cloneGtmConfig(input.config.gtm)
@@ -21955,7 +22176,7 @@ async function createServer(opts) {
   const trustProxy = resolveTrustProxy(process.env.CANONRY_TRUST_PROXY);
   const app = Fastify({
     loggerInstance: logger,
-    genReqId: () => crypto28.randomUUID(),
+    genReqId: () => crypto29.randomUUID(),
     trustProxy
   });
   const registry = new ProviderRegistry();
@@ -22722,7 +22943,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto28.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto29.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -22816,7 +23037,7 @@ async function createServer(opts) {
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto28.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto29.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -22840,7 +23061,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto28.randomBytes(32).toString("hex");
+    const sessionId = crypto29.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -23313,7 +23534,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto28.randomUUID();
+            const runId = crypto29.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -23557,7 +23778,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto28.randomUUID(),
+            id: crypto29.randomUUID(),
             projectId,
             actor: auditContext?.actor ?? "api",
             userAgent: auditContext?.userAgent ?? null,
@@ -23654,6 +23875,7 @@ async function createServer(opts) {
       const { event: eventName, eventId, ...properties } = event;
       trackEvent(eventName, properties, { source: "dashboard", eventId });
     },
+    submitFeedback: (submission, context) => sendFeedback(submission, context),
     onCdpConfigure: async (host, port2) => {
       if (!opts.config.cdp) opts.config.cdp = {};
       opts.config.cdp.host = host;