@canonry/canonry 7.11.0 → 7.12.0

package/dist/{chunk-HA2BAJ6Z.js → chunk-GQMSJEMZ.js}

@@ -820,10 +820,10 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-CF7G2HGX.js";
+} from "./chunk-AU7OUDWR.js";
 
 // src/intelligence-service.ts
-import { eq as eq87, desc as desc39, asc as asc17, and as and73, ne as ne15, or as or21, inArray as inArray35, gte as gte23, lte as lte20, isNull as isNull16, sql as sql32, exists as exists2 } from "drizzle-orm";
+import { eq as eq87, desc as desc39, asc as asc17, and as and73, ne as ne16, or as or21, inArray as inArray35, gte as gte23, lte as lte20, isNull as isNull16, sql as sql32, exists as exists2 } from "drizzle-orm";
 
 // ../db/src/client.ts
 import { mkdirSync } from "fs";
@@ -863,6 +863,7 @@ __export(schema_exports, {
   conversionTrackingContracts: () => conversionTrackingContracts,
   crawlerEventsHourly: () => crawlerEventsHourly,
   crawlerVerificationManifestsHourly: () => crawlerVerificationManifestsHourly,
+  dashboardSessions: () => dashboardSessions,
   dataRepairCompletions: () => dataRepairCompletions,
   discoveryProbes: () => discoveryProbes,
   discoverySessions: () => discoverySessions,
@@ -1587,6 +1588,18 @@ var userSessions = sqliteTable("user_sessions", {
   index("idx_user_sessions_user").on(table.userId),
   index("idx_user_sessions_expires").on(table.expiresAt)
 ]);
+var dashboardSessions = sqliteTable("dashboard_sessions", {
+  tokenHash: text("token_hash").primaryKey(),
+  apiKeyId: text("api_key_id").notNull().references(() => apiKeys.id, { onDelete: "cascade" }),
+  apiKeyHash: text("api_key_hash").notNull().default(""),
+  /** Null for API-key sign-ins; password sign-ins bind the configured password hash's digest. */
+  passwordFingerprint: text("password_fingerprint"),
+  createdAt: text("created_at").notNull(),
+  expiresAt: text("expires_at").notNull()
+}, (table) => [
+  index("idx_dashboard_sessions_key").on(table.apiKeyId),
+  index("idx_dashboard_sessions_expires").on(table.expiresAt)
+]);
 var oauthClients = sqliteTable("oauth_clients", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
@@ -8287,6 +8300,28 @@ var MIGRATION_VERSIONS = [
       )`,
       `CREATE UNIQUE INDEX IF NOT EXISTS idx_market_competitor_names_project_domain ON market_competitor_names(project_id, domain)`
     ]
+  },
+  {
+    version: 173,
+    name: "durable-dashboard-sessions",
+    statements: [
+      `CREATE TABLE IF NOT EXISTS dashboard_sessions (
+        token_hash TEXT PRIMARY KEY,
+        api_key_id TEXT NOT NULL REFERENCES api_keys(id) ON DELETE CASCADE,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_dashboard_sessions_key ON dashboard_sessions(api_key_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_dashboard_sessions_expires ON dashboard_sessions(expires_at)`
+    ]
+  },
+  {
+    version: 174,
+    name: "dashboard-session-credential-binding",
+    statements: [
+      `ALTER TABLE dashboard_sessions ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`,
+      `ALTER TABLE dashboard_sessions ADD COLUMN password_fingerprint TEXT`
+    ]
   }
 ];
 var AERO_LEDGER_REBUILDS = [
@@ -12504,6 +12539,7 @@ async function userSessionRoutes(app, opts = {}) {
       const err = authRequired("Sign in to see where you are signed in.");
       return reply.status(err.statusCode).send(err.toJSON());
     }
+    if (resolved.renewedExpiresAt) setSessionCookie(request, reply, token);
     const currentHash = hashSessionToken(token);
     const rows = app.db.select().from(userSessions).where(eq3(userSessions.userId, resolved.user.id)).all();
     return reply.send({
@@ -14507,7 +14543,7 @@ function registerOAuthRoutesIn(app, opts) {
     if (grantedScope === null) {
       return badRequest(reply, "invalid_scope", `Supported scopes: ${SUPPORTED_SCOPES.join(", ")}.`);
     }
-    const user = opts.resolveUser(request);
+    const user = opts.resolveUser(request, reply);
     if (!user) {
       return sendGatePage(reply, signInPage(request.url, null));
     }
@@ -14525,7 +14561,7 @@ function registerOAuthRoutesIn(app, opts) {
     assertCookieWriteOrigin(request);
     const q = request.query;
     const body = request.body ?? {};
-    const user = opts.resolveUser(request);
+    const user = opts.resolveUser(request, reply);
     if (!user) return badRequest(reply, "access_denied", "Not signed in.");
     const clientId = q.client_id;
     const redirectUri = q.redirect_uri;
@@ -20613,7 +20649,7 @@ function mergePins(...collections) {
 
 // ../api-routes/src/runs.ts
 import crypto16 from "crypto";
-import { and as and21, eq as eq28, asc as asc4, desc as desc11, inArray as inArray13, or as or7, sql as sql11 } from "drizzle-orm";
+import { and as and21, eq as eq28, ne as ne6, asc as asc4, desc as desc11, inArray as inArray13, notInArray, or as or7, sql as sql11 } from "drizzle-orm";
 import { gte as gte4 } from "drizzle-orm";
 
 // ../api-routes/src/run-fill.ts
@@ -21059,9 +21095,11 @@ async function runRoutes(app, opts) {
     const project = resolveProject(app.db, request.params.name);
     const parsedLimit = parseInt(request.query.limit ?? "", 10);
     const limit = Number.isNaN(parsedLimit) || parsedLimit <= 0 ? void 0 : parsedLimit;
-    const { kind, status } = parseListFilters(request.query);
+    const { kind, excludeKind, excludeKinds, status } = parseListFilters(request.query);
     const filters = [eq28(runs.projectId, project.id)];
     if (kind) filters.push(eq28(runs.kind, kind));
+    if (excludeKind) filters.push(ne6(runs.kind, excludeKind));
+    if (excludeKinds?.length) filters.push(notInArray(runs.kind, excludeKinds));
     if (status) filters.push(eq28(runs.status, status));
     const where = and21(...filters);
     const rows = limit == null ? app.db.select().from(runs).where(where).orderBy(asc4(runs.createdAt)).all() : app.db.select().from(runs).where(where).orderBy(desc11(runs.createdAt)).limit(limit).all().reverse();
@@ -21084,10 +21122,12 @@ async function runRoutes(app, opts) {
     const limit = parseListLimit(request.query.limit, 500, 5e3);
     const since = parseListSince(request.query.since);
     const includeProbe = request.query.includeProbe === "1" || request.query.includeProbe === "true";
-    const { kind, status } = parseListFilters(request.query);
+    const { kind, excludeKind, excludeKinds, status } = parseListFilters(request.query);
     const filters = [gte4(runs.createdAt, since)];
     if (!includeProbe) filters.push(notProbeRun());
     if (kind) filters.push(eq28(runs.kind, kind));
+    if (excludeKind) filters.push(ne6(runs.kind, excludeKind));
+    if (excludeKinds?.length) filters.push(notInArray(runs.kind, excludeKinds));
     if (status) filters.push(eq28(runs.status, status));
     const scopedProjectId = request.apiKey?.projectId;
     if (scopedProjectId) filters.push(eq28(runs.projectId, scopedProjectId));
@@ -21342,6 +21382,8 @@ function parseListLimit(raw, defaultValue, max2) {
 }
 var RUN_LIST_FILTER_OPTIONS = {
   kind: runKindSchema.options,
+  excludeKind: runKindSchema.options,
+  excludeKinds: runKindSchema.options,
   status: runStatusSchema.options
 };
 function isRunListFilterField(field) {
@@ -21350,10 +21392,12 @@ function isRunListFilterField(field) {
 function parseListFilters(query) {
   const parsed = runListFilterQuerySchema.safeParse({
     kind: query.kind === "" ? void 0 : query.kind,
+    excludeKind: query.excludeKind === "" ? void 0 : query.excludeKind,
+    excludeKinds: query.excludeKinds,
     status: query.status === "" ? void 0 : query.status
   });
   if (parsed.success) return parsed.data;
-  const invalid = parsed.error.issues.map((issue) => issue.path[0]).filter(isRunListFilterField);
+  const invalid = [...new Set(parsed.error.issues.map((issue) => issue.path[0]).filter(isRunListFilterField))];
   const message = invalid.length > 0 ? invalid.map((field) => `"${field}" must be one of: ${RUN_LIST_FILTER_OPTIONS[field].join(", ")}`).join("; ") : "Invalid run list filters";
   throw validationError(message, { invalid: Object.fromEntries(invalid.map((field) => [field, query[field]])) });
 }
@@ -29597,7 +29641,7 @@ function readVisibilityComparisonRuns(db, projectId, since, until, includeEviden
 
 // ../api-routes/src/query-tracking.ts
 import crypto23 from "crypto";
-import { and as and29, desc as desc16, eq as eq37, inArray as inArray18, isNotNull as isNotNull5, isNull as isNull9, ne as ne6 } from "drizzle-orm";
+import { and as and29, desc as desc16, eq as eq37, inArray as inArray18, isNotNull as isNotNull5, isNull as isNull9, ne as ne7 } from "drizzle-orm";
 var SOURCE_LIMIT = 100;
 var MAX_REVIEW_AGE_MS = 15 * 60 * 1e3;
 var MAX_REVIEW_FUTURE_SKEW_MS = 60 * 1e3;
@@ -29784,7 +29828,7 @@ function simpleMeasuredAtByQuery(db, project, queryRows2, opts) {
     eq37(runs.projectId, project.id),
     eq37(runs.kind, RunKinds["answer-visibility"]),
     inArray18(runs.status, [RunStatuses.completed, RunStatuses.partial]),
-    ne6(runs.trigger, RunTriggers.probe),
+    ne7(runs.trigger, RunTriggers.probe),
     isNull9(runs.measurementScope),
     isNull9(runs.measurementPlanVersionId)
   )).orderBy(desc16(runs.createdAt), desc16(runs.id)).limit(SOURCE_LIMIT).all();
@@ -29906,7 +29950,7 @@ function measuredAtByQuery(db, state, opts) {
     eq37(runs.projectId, project.id),
     eq37(runs.kind, RunKinds["answer-visibility"]),
     inArray18(runs.status, [RunStatuses.completed, RunStatuses.partial]),
-    ne6(runs.trigger, RunTriggers.probe),
+    ne7(runs.trigger, RunTriggers.probe),
     isNull9(runs.measurementScope),
     isNotNull5(runs.measurementPlanVersionId)
   )).orderBy(desc16(runs.createdAt), desc16(runs.id)).limit(SOURCE_LIMIT).all();
@@ -31799,7 +31843,7 @@ function aliasArraysEqual2(a, b) {
 }
 
 // ../api-routes/src/history.ts
-import { and as and31, asc as asc6, count, desc as desc17, eq as eq39, gte as gte6, inArray as inArray19, like as like2, ne as ne7, or as or10 } from "drizzle-orm";
+import { and as and31, asc as asc6, count, desc as desc17, eq as eq39, gte as gte6, inArray as inArray19, like as like2, ne as ne8, or as or10 } from "drizzle-orm";
 
 // ../api-routes/src/notification-redaction.ts
 var REDACTED_URL = {
@@ -31880,7 +31924,7 @@ async function historyRoutes(app) {
   app.get("/projects/:name/history", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const filters = [eq39(auditLog.projectId, project.id)];
-    if (request.operatorAccess !== true) filters.push(ne7(auditLog.entityType, "telemetry"));
+    if (request.operatorAccess !== true) filters.push(ne8(auditLog.entityType, "telemetry"));
     addAuditHistoryFilters(filters, request.query);
     const rows = app.db.select().from(auditLog).where(and31(...filters)).orderBy(desc17(auditLog.createdAt), desc17(auditLog.id)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
@@ -31888,7 +31932,7 @@ async function historyRoutes(app) {
   app.get("/history", async (request, reply) => {
     const scopedProjectId = request.apiKey?.projectId;
     const filters = scopedProjectId ? [eq39(auditLog.projectId, scopedProjectId)] : [];
-    if (request.operatorAccess !== true) filters.push(ne7(auditLog.entityType, "telemetry"));
+    if (request.operatorAccess !== true) filters.push(ne8(auditLog.entityType, "telemetry"));
     addAuditHistoryFilters(filters, request.query);
     const rows = app.db.select().from(auditLog).where(filters.length > 0 ? and31(...filters) : void 0).orderBy(desc17(auditLog.createdAt), desc17(auditLog.id)).limit(parseBoundedInt(request.query.limit, 100, 500)).offset(parseBoundedInt(request.query.offset, 0, Number.MAX_SAFE_INTEGER)).all();
     return reply.send(rows.map(formatAuditEntry));
@@ -33357,7 +33401,7 @@ async function intelligenceRoutes(app) {
 }
 
 // ../api-routes/src/traffic-analytics.ts
-import { and as and35, desc as desc20, eq as eq42, gte as gte8, lt as lt8, lte as lte7, ne as ne8, sql as sql14 } from "drizzle-orm";
+import { and as and35, desc as desc20, eq as eq42, gte as gte8, lt as lt8, lte as lte7, ne as ne9, sql as sql14 } from "drizzle-orm";
 
 // ../api-routes/src/ai-referral-status.ts
 import { and as and34, sql as sql13 } from "drizzle-orm";
@@ -33398,7 +33442,7 @@ function readTrafficActivity(db, projectId, windowDays2) {
   const sourceRows = db.select({ id: trafficSources.id }).from(trafficSources).where(
     and35(
       eq42(trafficSources.projectId, projectId),
-      ne8(trafficSources.status, TrafficSourceStatuses.archived)
+      ne9(trafficSources.status, TrafficSourceStatuses.archived)
     )
   ).all();
   if (sourceRows.length === 0) return null;
@@ -33432,7 +33476,7 @@ function readTrafficActivity(db, projectId, windowDays2) {
     db.select({ total: sql14`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
       and35(
         eq42(crawlerEventsHourly.projectId, projectId),
-        ne8(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
+        ne9(crawlerEventsHourly.verificationStatus, VerificationStatuses.verified),
         gte8(crawlerEventsHourly.tsHour, windowStartIso),
         exclusiveEnd ? lt8(crawlerEventsHourly.tsHour, windowEndIso) : lte7(crawlerEventsHourly.tsHour, windowEndIso)
       )
@@ -33721,7 +33765,7 @@ async function trafficAnalyticsRoutes(app) {
 }
 
 // ../api-routes/src/referral-assessment.ts
-import { and as and36, desc as desc21, eq as eq43, gte as gte9, lte as lte8, ne as ne9, sql as sql15 } from "drizzle-orm";
+import { and as and36, desc as desc21, eq as eq43, gte as gte9, lte as lte8, ne as ne10, sql as sql15 } from "drizzle-orm";
 
 // ../api-routes/src/ga-ai-referral-aggregation.ts
 function normalizeAiTrafficClass(value) {
@@ -33876,7 +33920,7 @@ function latestGaSyncQueriedWindow(db, projectId, startDate, endDate) {
     eq43(gaAiReferrals.projectId, projectId),
     gte9(gaAiReferrals.date, summary3.start),
     lte8(gaAiReferrals.date, summary3.end),
-    ne9(gaAiReferrals.syncedAt, summary3.syncedAt)
+    ne10(gaAiReferrals.syncedAt, summary3.syncedAt)
   )).limit(1).get();
   return leftByAnotherSync === void 0;
 }
@@ -38499,6 +38543,20 @@ var runsListKindQueryParameter = {
   description: "Restrict results to a single run kind. Without this filter, integration syncs (bing-inspect, gsc-sync, ga-sync) can fill the default 500-row cap within minutes on busy projects and push answer-visibility runs out of the response. Unknown values are rejected with 400.",
   schema: { type: "string", enum: [...runKindSchema.options] }
 };
+var runsListExcludeKindQueryParameter = {
+  name: "excludeKind",
+  in: "query",
+  description: "Exclude one run kind before applying the row limit. Combines with kind and status filters. Unknown values are rejected with 400.",
+  schema: { type: "string", enum: [...runKindSchema.options] }
+};
+var runsListExcludeKindsQueryParameter = {
+  name: "excludeKinds",
+  in: "query",
+  description: "Exclude multiple run kinds before applying the row limit. Accepts repeated or comma-separated values. Combines with excludeKind, kind, and status; unknown values are rejected with 400.",
+  style: "form",
+  explode: true,
+  schema: { type: "array", items: { type: "string", enum: [...runKindSchema.options] }, maxItems: runKindSchema.options.length }
+};
 var runsListStatusQueryParameter = {
   name: "status",
   in: "query",
@@ -40510,7 +40568,7 @@ var routeCatalog = [
     path: "/api/v1/projects/{name}/runs",
     summary: "List project runs",
     tags: ["runs"],
-    parameters: [nameParameter, limitQueryParameter, runsListKindQueryParameter, runsListStatusQueryParameter],
+    parameters: [nameParameter, limitQueryParameter, runsListKindQueryParameter, runsListExcludeKindQueryParameter, runsListExcludeKindsQueryParameter, runsListStatusQueryParameter],
     responses: {
       200: jsonArrayResponse("Runs returned.", "RunDto")
     }
@@ -40535,6 +40593,8 @@ var routeCatalog = [
       runsListSinceQueryParameter,
       runsListIncludeProbeQueryParameter,
       runsListKindQueryParameter,
+      runsListExcludeKindQueryParameter,
+      runsListExcludeKindsQueryParameter,
       runsListStatusQueryParameter
     ],
     responses: {
@@ -42320,6 +42380,7 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("List of discovered locations and selection summary returned.", "GbpLocationListResponse"),
       400: errorResponse("Invalid discover request, unknown account, account-switch not opted into, or scope/API problem."),
+      403: errorResponse("The Google connection was rejected; reconnect Google Business Profile."),
       404: errorResponse("Project not found."),
       429: errorResponse("GBP API quota exceeded (access form may not be approved).")
     }
@@ -42333,6 +42394,7 @@ var routeCatalog = [
     responses: {
       200: jsonResponse("Accounts the OAuth user manages or owns.", "GbpAccountListResponse"),
       400: errorResponse("No GBP connection or scope/API problem."),
+      403: errorResponse("The Google connection was rejected; reconnect Google Business Profile."),
       404: errorResponse("Project not found."),
       429: errorResponse("GBP API quota exceeded (access form may not be approved).")
     }
@@ -45938,6 +46000,7 @@ async function keysRoutes(app) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     app.db.transaction((tx) => {
+      tx.delete(dashboardSessions).where(eq53(dashboardSessions.apiKeyId, id)).run();
       tx.update(apiKeys).set({ revokedAt: now }).where(eq53(apiKeys.id, id)).run();
       writeAuditLog(tx, auditFromRequest(request, {
         actor: "api",
@@ -50116,7 +50179,12 @@ async function googleRoutes(app, opts) {
         { reason: err.reason, body: err.body }
       );
     }
-    if (err.status === 401) return authRequired();
+    if (err.status === 401) {
+      return forbidden(
+        `${context}: the Google connection has expired or was revoked. Reconnect Google Business Profile.`,
+        { reason: "gbp-reconnect", upstreamStatus: 401 }
+      );
+    }
     return providerError(`${context}: ${err.message}`, { reason: err.reason ?? void 0, status: err.status });
   }
   function rowToDto2(row) {
@@ -50613,7 +50681,7 @@ function parseReviewLimit(value) {
 
 // ../api-routes/src/google-marketing.ts
 import crypto36 from "crypto";
-import { and as and48, desc as desc29, eq as eq58, isNull as isNull10, lt as lt9, ne as ne10, or as or14, sql as sql21 } from "drizzle-orm";
+import { and as and48, desc as desc29, eq as eq58, isNull as isNull10, lt as lt9, ne as ne11, or as or14, sql as sql21 } from "drizzle-orm";
 import { z as z4 } from "zod";
 var snapshotPageQuerySchema = z4.object({
   limit: z4.coerce.number().int().min(1).max(GOOGLE_MARKETING_STORED_SNAPSHOT_PAGE_MAX).optional(),
@@ -52114,7 +52182,7 @@ async function googleMarketingRoutes(app, opts) {
     const duplicate = app.db.select({ id: conversionTrackingContracts.id }).from(conversionTrackingContracts).where(and48(
       eq58(conversionTrackingContracts.projectId, project.id),
       eq58(conversionTrackingContracts.name, body.name),
-      ne10(conversionTrackingContracts.id, existing.id)
+      ne11(conversionTrackingContracts.id, existing.id)
     )).get();
     if (duplicate) throw alreadyExists("Conversion tracking contract", body.name);
     const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -52203,7 +52271,7 @@ async function googleMarketingRoutes(app, opts) {
 
 // ../api-routes/src/ads.ts
 import crypto39 from "crypto";
-import { eq as eq60, and as and50, asc as asc12, desc as desc30, gt as gt6, gte as gte14, lt as lt10, lte as lte14, ne as ne11, inArray as inArray27, or as or16, isNull as isNull12, isNotNull as isNotNull7, sql as sql23 } from "drizzle-orm";
+import { eq as eq60, and as and50, asc as asc12, desc as desc30, gt as gt6, gte as gte14, lt as lt10, lte as lte14, ne as ne12, inArray as inArray27, or as or16, isNull as isNull12, isNotNull as isNotNull7, sql as sql23 } from "drizzle-orm";
 
 // ../api-routes/src/ads-activation.ts
 import crypto37 from "crypto";
@@ -55901,7 +55969,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
   );
   const staleReconcileWhere = and50(
     lt10(adsOperations.reconcileAttempts, config.policy.maxAttempts),
-    ne11(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
+    ne12(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
     or16(
       eq60(adsOperations.reconcileStrategy, AdsReconcileStrategies.known_entity),
       and50(
@@ -55918,7 +55986,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
     retryableStateWhere
   );
   const exhaustedRows = app.db.select().from(adsOperations).where(and50(
-    ne11(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
+    ne12(adsOperations.kind, AdsOperationKinds.campaign_tree_activate),
     gte14(adsOperations.reconcileAttempts, config.policy.maxAttempts),
     or16(
       and50(
@@ -55933,7 +56001,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
     ),
     or16(
       isNull12(adsOperations.errorCode),
-      ne11(adsOperations.errorCode, ADS_RECONCILIATION_QUARANTINED)
+      ne12(adsOperations.errorCode, ADS_RECONCILIATION_QUARANTINED)
     )
   )).orderBy(asc12(adsOperations.updatedAt)).limit(config.batchSize).all();
   for (const row of exhaustedRows) {
@@ -61432,7 +61500,7 @@ function pruneCachedRelease(release, opts = {}) {
 }
 
 // ../api-routes/src/backlinks-filter.ts
-import { and as and54, ne as ne12, notLike } from "drizzle-orm";
+import { and as and54, ne as ne13, notLike } from "drizzle-orm";
 var BACKLINK_FILTER_PATTERNS = [
   "*.google.com",
   "*.googleusercontent.com",
@@ -61449,10 +61517,10 @@ function backlinkCrawlerExclusionClause() {
   for (const pattern of BACKLINK_FILTER_PATTERNS) {
     if (pattern.startsWith("*.")) {
       const suffix = pattern.slice(2);
-      conditions.push(ne12(backlinkDomains.linkingDomain, suffix));
+      conditions.push(ne13(backlinkDomains.linkingDomain, suffix));
       conditions.push(notLike(backlinkDomains.linkingDomain, `%.${suffix}`));
     } else {
-      conditions.push(ne12(backlinkDomains.linkingDomain, pattern));
+      conditions.push(ne13(backlinkDomains.linkingDomain, pattern));
     }
   }
   const combined = and54(...conditions);
@@ -82314,7 +82382,7 @@ var reportDailyDataCheck = {
 };
 
 // ../api-routes/src/doctor/checks/referral-assessment.ts
-import { and as and62, eq as eq72, ne as ne13 } from "drizzle-orm";
+import { and as and62, eq as eq72, ne as ne14 } from "drizzle-orm";
 var REFERRAL_ASSESSMENT_CHECKS = [{
   id: "report.ai-referral-bursts",
   category: CheckCategories.integrations,
@@ -82323,7 +82391,7 @@ var REFERRAL_ASSESSMENT_CHECKS = [{
   notificationPolicy: CheckNotificationPolicies.silent,
   run: (ctx) => {
     if (!ctx.project) return { status: CheckStatuses.skipped, code: "report.ai-referral-bursts.no-project", summary: "Select a project to inspect referral evidence." };
-    const configured = ctx.db.select({ id: trafficSources.id }).from(trafficSources).where(and62(eq72(trafficSources.projectId, ctx.project.id), ne13(trafficSources.status, TrafficSourceStatuses.archived))).get();
+    const configured = ctx.db.select({ id: trafficSources.id }).from(trafficSources).where(and62(eq72(trafficSources.projectId, ctx.project.id), ne14(trafficSources.status, TrafficSourceStatuses.archived))).get();
     if (!configured) {
       return { status: CheckStatuses.skipped, code: "report.ai-referral-bursts.not-configured", summary: "No non-archived server traffic source is configured for this project." };
     }
@@ -84632,7 +84700,7 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and67, eq as eq80, gte as gte19, inArray as inArray31, ne as ne14, sql as sql29 } from "drizzle-orm";
+import { and as and67, eq as eq80, gte as gte19, inArray as inArray31, ne as ne15, sql as sql29 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function isCloudflareDirectPush(source) {
@@ -84673,7 +84741,7 @@ function loadProbes(ctx) {
   const rows = ctx.db.select().from(trafficSources).where(
     and67(
       eq80(trafficSources.projectId, ctx.project.id),
-      ne14(trafficSources.status, TrafficSourceStatuses.archived)
+      ne15(trafficSources.status, TrafficSourceStatuses.archived)
     )
   ).all();
   return rows.map((r) => ({
@@ -90270,7 +90338,7 @@ function analyzableRunPredicates(projectId) {
     // Defensive: RunCoordinator already skips probes before analyzeAndPersist
     // is called, but a future call site invoking it directly for a probe must
     // still not pollute the intelligence window.
-    ne15(runs.trigger, RunTriggers.probe)
+    ne16(runs.trigger, RunTriggers.probe)
   ];
 }
 function readStoredGroundingSources2(rawResponse) {
@@ -90865,7 +90933,7 @@ var IntelligenceService = class {
         eq87(runs.kind, RunKinds["answer-visibility"]),
         or21(eq87(runs.status, "completed"), eq87(runs.status, "partial")),
         // Defensive — see top of file.
-        ne15(runs.trigger, RunTriggers.probe)
+        ne16(runs.trigger, RunTriggers.probe)
       )
     ).orderBy(desc39(runs.createdAt), desc39(runs.id)).limit((RECURRENCE_LOOKBACK_RUNS + 1) * ROWS_PER_GROUP_BUDGET).all();
     const recentGroups = groupRunsByCreatedAt(recentRunRows);
@@ -90992,6 +91060,7 @@ export {
   auditLog,
   dataRepairCompletions,
   apiKeys,
+  dashboardSessions,
   schedules,
   insightNotifyState,
   doctorHealthState,
@@ -91084,9 +91153,11 @@ export {
   computeCitedCompetitorDomains,
   resolveTrustProxy,
   USER_SESSION_COOKIE_NAME,
+  cookieIsSecure,
   anyUsersExist,
   parseCookieHeader,
   serializeUserSessionCookie,
+  hashSessionToken,
   createUserSession,
   resolveUserSession,
   createCredentialChecker,

package/dist/{chunk-GQAESNJT.js → chunk-SM6ZZAPK.js}

@@ -5,7 +5,7 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   isMachineFormat
-} from "./chunk-7G7YVTDA.js";
+} from "./chunk-BTHEFJCI.js";
 import {
   AGENT_PROVIDER_IDS,
   CANONRY_NPM_PACKAGE_URL,
@@ -50,7 +50,7 @@ import {
   skillsClientSchema,
   upgradeCaveatFor,
   upgradeCommandFor
-} from "./chunk-CF7G2HGX.js";
+} from "./chunk-AU7OUDWR.js";
 
 // src/config.ts
 import fs from "fs";
@@ -7460,13 +7460,13 @@ var ApiClient = class {
       })
     );
   }
-  async listRuns(project, limit, kind, status) {
+  async listRuns(project, limit, kind, status, excludeKind, excludeKinds) {
     return this.invoke(
       () => getApiV1ProjectsByNameRuns({
         client: this.heyClient,
         path: { name: project },
-        // kind/status arrive as free CLI strings; the server validates them against the enums.
-        query: { limit, kind, status }
+        // Filters arrive as free CLI strings; the server validates them against the enums.
+        query: { limit, kind, status, excludeKind, excludeKinds }
       })
     );
   }

package/dist/cli.js

@@ -33,11 +33,11 @@ import {
   trackCliCommandFinished,
   trackEvent,
   waitForServerRuntimeStartup
-} from "./chunk-S46DWUNR.js";
+} from "./chunk-DXI2FTSW.js";
 import {
   autoSyncSkills,
   formatAutoSyncNotice
-} from "./chunk-JRBQFRNT.js";
+} from "./chunk-EPSHIH63.js";
 import {
   configExists,
   createApiClient,
@@ -54,13 +54,13 @@ import {
   saveConfig,
   saveConfigPatch,
   shouldPrintServeSkillsNudge
-} from "./chunk-GQAESNJT.js";
+} from "./chunk-SM6ZZAPK.js";
 import {
   DEFAULT_DEMO_TRUSTED_PROXIES,
   trustedProxiesProblem,
   trustedProxyProblem
 } from "./chunk-RB2F4D3Z.js";
-import "./chunk-OH7E7TJD.js";
+import "./chunk-7I64KEGM.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -72,7 +72,7 @@ import {
   runMeasurementDraftAction,
   systemError,
   usageError
-} from "./chunk-7G7YVTDA.js";
+} from "./chunk-BTHEFJCI.js";
 import {
   CLOUDFLARE_WORKER_BINDINGS,
   CLOUDFLARE_WORKER_GENERATED_MARKER,
@@ -89,6 +89,7 @@ import {
   crawlerEventsHourly,
   createClient,
   createRunCompetitorResolver,
+  dashboardSessions,
   dataRepairCompletions,
   determineCitationState,
   gaAiReferrals,
@@ -103,7 +104,7 @@ import {
   rawEventSamples,
   readMarketCompetitorNames,
   runs
-} from "./chunk-HA2BAJ6Z.js";
+} from "./chunk-GQMSJEMZ.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -233,7 +234,7 @@ import {
   visibilityCompareSelectionSchema,
   visibilityReportRequestSchema,
   winnabilityClassSchema
-} from "./chunk-CF7G2HGX.js";
+} from "./chunk-AU7OUDWR.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -783,7 +784,7 @@ function parseDemoTrustedProxies(values) {
 async function demoCommand(options) {
   const { host, port } = parseDemoListenOptions(options);
   const trustProxy = parseDemoTrustedProxies(options.trustProxy);
-  const { createDemoServer } = await import("./demo-server-BYLZFDKI.js");
+  const { createDemoServer } = await import("./demo-server-WJUA4EIG.js");
   const app = await createDemoServer({ trustProxy });
   let stopping = false;
   const stop = () => {
@@ -1197,7 +1198,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
   }
 }
 async function backfillInsightsCommand(project2, opts) {
-  const { IntelligenceService } = await import("./intelligence-service-TIM4XTYH.js");
+  const { IntelligenceService } = await import("./intelligence-service-DJRH4Z3D.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -14663,7 +14664,7 @@ async function showRun(id, format) {
 }
 async function listRuns(project2, opts) {
   const client = getClient23();
-  const runs2 = await client.listRuns(project2, opts?.limit, opts?.kind, opts?.status);
+  const runs2 = await client.listRuns(project2, opts?.limit, opts?.kind, opts?.status, opts?.excludeKind, opts?.excludeKinds);
   if (opts?.format === "json") {
     console.log(JSON.stringify(runs2, null, 2));
     return;
@@ -14874,7 +14875,7 @@ async function fillRun(runId, opts = {}) {
 var RUN_TRIGGER_USAGE = "canonry run trigger <project> [--group <key>]... [--target <key>]... [--provider <name>] [--query <q>...] [--location <label>] [--all-locations] [--no-location] [--probe] [--dispatch-mode sync|batch] [--force] [--wait] [--format json]";
 var RUN_USAGE2 = "canonry run <project|--all> [--group <key>]... [--target <key>]... [--provider <name>] [--query <q>...] [--location <label>] [--all-locations] [--no-location] [--probe] [--dispatch-mode sync|batch] [--force] [--wait] [--format json]";
 var RUN_FILL_USAGE = "canonry run fill <run-id> [--provider <name>[,<name>]] [--dry-run] [--wait] [--format json]";
-var RUNS_USAGE = "canonry runs <project> [--limit <n>] [--kind <kind>] [--status <status>] [--format json]";
+var RUNS_USAGE = "canonry runs <project> [--limit <n>] [--kind <kind>] [--exclude-kind <kind>] [--exclude-kinds <kind>[,<kind>]]... [--status <status>] [--format json]";
 var RUN_TRIGGER_OPTIONS = {
   provider: stringOption(),
   query: multiStringOption(),
@@ -15061,6 +15062,8 @@ var RUN_CLI_COMMANDS = [
     options: {
       limit: stringOption(),
       kind: stringOption(),
+      "exclude-kind": stringOption(),
+      "exclude-kinds": multiStringOption(),
       status: stringOption()
     },
     run: async (input) => {
@@ -15073,6 +15076,8 @@ var RUN_CLI_COMMANDS = [
           message: "--limit must be an integer"
         }),
         kind: getString(input.values, "kind"),
+        excludeKind: getString(input.values, "exclude-kind"),
+        excludeKinds: getStringArray(input.values, "exclude-kinds"),
         status: getString(input.values, "status")
       });
     }
@@ -17120,6 +17125,9 @@ async function bootstrapCommand(opts) {
       const rotating = existingDefault.keyHash !== keyHash;
       const needsUpdate = rotating || existingDefault.keyPrefix !== keyPrefix || !isDeepStrictEqual(existingDefault.scopes, ["*"]) || existingDefault.projectId !== null || existingDefault.revokedAt !== null;
       if (needsUpdate) {
+        if (rotating || existingDefault.revokedAt !== null) {
+          tx.delete(dashboardSessions).where(eq2(dashboardSessions.apiKeyId, existingDefault.id)).run();
+        }
         tx.update(apiKeys).set({
           keyHash,
           keyPrefix,
@@ -17132,6 +17140,7 @@ async function bootstrapCommand(opts) {
       }
       for (const duplicate of existingDefaults) {
         if (duplicate.id === existingDefault.id) continue;
+        tx.delete(dashboardSessions).where(eq2(dashboardSessions.apiKeyId, duplicate.id)).run();
         if (duplicate.revokedAt === null) {
           tx.update(apiKeys).set({ revokedAt: rotatedAt }).where(eq2(apiKeys.id, duplicate.id)).run();
           changed = true;

package/dist/{demo-server-BYLZFDKI.js → demo-server-WJUA4EIG.js}

@@ -5,11 +5,11 @@ import {
   computeFactorAverages,
   layoutSiteCrawlGraphInput,
   persistSiteCrawlGraphLayout
-} from "./chunk-OH7E7TJD.js";
+} from "./chunk-7I64KEGM.js";
 import {
   PACKAGE_VERSION,
   canonryMcpTools
-} from "./chunk-7G7YVTDA.js";
+} from "./chunk-BTHEFJCI.js";
 import {
   HISTORY_WINDOW_RUNS,
   IntelligenceService,
@@ -83,7 +83,7 @@ import {
   siteCrawlPages,
   siteCrawlSnapshots,
   trafficSources
-} from "./chunk-HA2BAJ6Z.js";
+} from "./chunk-GQMSJEMZ.js";
 import {
   RunKinds,
   SiteCrawlFetchStates,
@@ -112,7 +112,7 @@ import {
   roundPreservingTotal,
   siteAuditPageFactorSchema,
   wilsonInterval
-} from "./chunk-CF7G2HGX.js";
+} from "./chunk-AU7OUDWR.js";
 
 // src/demo-server.ts
 import { dirname, join as join2 } from "path";