@canonry/canonry 7.17.1 → 7.18.0

package/dist/{chunk-ZQ7C6IFA.js → chunk-COQOQYRZ.js}

@@ -86,6 +86,7 @@ import {
   LOGIN_FAILED_MESSAGE,
   MEASUREMENT_CHANGES_DEFAULT_SORT,
   MEASUREMENT_CHANGES_NOISE_ANSWERS,
+  MEASUREMENT_DEFAULT_QUERY_CLASS,
   MEASUREMENT_DRAFT_MAX_ASSIGNMENTS,
   MEASUREMENT_DRAFT_MAX_ASSIGNMENTS_PER_ACTION,
   MEASUREMENT_DRAFT_MAX_AUTHORING_BYTES,
@@ -303,6 +304,7 @@ import {
   coerceSkillManifest,
   compactDateToIso,
   compareSemver,
+  compareText,
   competitorAliasBlockRequestSchema,
   competitorAliasProjectIdentity,
   competitorAliasesRequestSchema,
@@ -376,6 +378,7 @@ import {
   emptyCitationVisibility,
   emptySentimentCounts,
   escapeLikePattern,
+  escapeRegExp,
   evaluateModelPointerExposure,
   expandQueryTemplate,
   expandResearchTemplate,
@@ -493,6 +496,7 @@ import {
   isoDateDaysBeforeInTimeZone,
   keywordDtoSchema,
   keywordGenerateRequestSchema,
+  keywordGenerateResponseSchema,
   latestProjectRunDtoSchema,
   linearTrend,
   locationContextSchema,
@@ -577,6 +581,7 @@ import {
   measurementPropertyEvidenceResponseSchema,
   measurementPropertyQuestionsQuerySchema,
   measurementPropertyQuestionsResponseSchema,
+  measurementQueryClassFilterSchema,
   measurementQuerySetDetailSchema,
   measurementQuerySetListResponseSchema,
   measurementQuerySetUpsertRequestSchema,
@@ -604,6 +609,7 @@ import {
   normalizeCompetitorAliases,
   normalizeCompetitorDomain,
   normalizeIdTokens,
+  normalizeIdentityText,
   normalizeMeasurementExactUrl,
   normalizeMeasurementExecutionQueryText,
   normalizeMeasurementHost,
@@ -643,8 +649,10 @@ import {
   planCompetitorAliases,
   planCompetitorAutoAliases,
   prepareBrandMatchText,
+  projectConfigExportSchema,
   projectConfigSchema,
   projectCreateRequestSchema,
+  projectDefaultLocationResponseSchema,
   projectDtoSchema,
   projectOverviewDtoSchema,
   projectSearchResponseSchema,
@@ -656,6 +664,7 @@ import {
   providersFailing,
   queryDtoSchema,
   queryGenerateRequestSchema,
+  queryGenerateResponseSchema,
   queryTrackingCommitRequestSchema,
   queryTrackingCommitResponseSchema,
   queryTrackingPreviewRequestSchema,
@@ -777,6 +786,7 @@ import {
   snapshotReportSchema,
   snapshotRequestInputSchema,
   snapshotRequestSchema,
+  sortedUnique,
   sourceBreakdownDtoSchema,
   sourceBreakdownQuerySchema,
   splitList,
@@ -833,12 +843,12 @@ import {
   wordpressManualAssistDtoSchema,
   wordpressOnboardResultDtoSchema,
   wordpressPageDetailDtoSchema,
-  wordpressPageSummaryDtoSchema,
+  wordpressPageListDtoSchema,
   wordpressSchemaBlockDtoSchema,
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-MHB23E3N.js";
+} from "./chunk-X2S7D3MN.js";
 
 // src/intelligence-service.ts
 import { eq as eq89, desc as desc41, asc as asc18, and as and75, ne as ne16, or as or22, inArray as inArray36, gte as gte24, lte as lte20, isNull as isNull17, sql as sql32, exists as exists2 } from "drizzle-orm";
@@ -1040,7 +1050,7 @@ var projects = sqliteTable("projects", {
   locations: text("locations", { mode: "json" }).$type().notNull().default([]),
   defaultLocation: text("default_location"),
   autoExtractBacklinks: integer("auto_extract_backlinks", { mode: "boolean" }).notNull().default(false),
-  configSource: text("config_source").notNull().default("cli"),
+  configSource: text("config_source").$type().notNull().default("cli"),
   configRevision: integer("config_revision").notNull().default(1),
   icpDescription: text("icp_description"),
   createdAt: text("created_at").notNull(),
@@ -9682,11 +9692,13 @@ var SentimentRepository = class {
   }
 };
 
-// ../intelligence/src/regressions.ts
+// ../intelligence/src/snapshot-key.ts
 function snapshotKey(snap) {
   const loc = snap.location ?? "__none__";
   return JSON.stringify([snap.query, snap.provider, loc]);
 }
+
+// ../intelligence/src/regressions.ts
 function detectRegressions(currentRun, previousRun) {
   if ((currentRun.location ?? null) !== (previousRun.location ?? null)) {
     return [];
@@ -9726,24 +9738,20 @@ function observedKeys(run, keyOf) {
 }
 
 // ../intelligence/src/gains.ts
-function snapshotKey2(snap) {
-  const loc = snap.location ?? "__none__";
-  return JSON.stringify([snap.query, snap.provider, loc]);
-}
 function detectGains(currentRun, previousRun) {
   if ((currentRun.location ?? null) !== (previousRun.location ?? null)) {
     return [];
   }
   const gains = [];
-  const previousObserved = observedKeys(previousRun, snapshotKey2);
+  const previousObserved = observedKeys(previousRun, snapshotKey);
   const previousCited = /* @__PURE__ */ new Set();
   for (const snap of previousRun.snapshots) {
     if (snap.cited) {
-      previousCited.add(snapshotKey2(snap));
+      previousCited.add(snapshotKey(snap));
     }
   }
   for (const snap of currentRun.snapshots) {
-    const key = snapshotKey2(snap);
+    const key = snapshotKey(snap);
     if (snap.cited && previousObserved.has(key) && !previousCited.has(key)) {
       gains.push({
         query: snap.query,
@@ -12451,6 +12459,11 @@ var FORWARDED_HEADERS = ["x-forwarded-for", "forwarded", "x-real-ip"];
 function hasForwardedHeaders(request) {
   return FORWARDED_HEADERS.some((header2) => request.headers[header2] !== void 0);
 }
+var PROXY_PATH_HEADERS = ["via", "cf-connecting-ip", "true-client-ip"];
+var FORWARDED_HEADER_PREFIX = "x-forwarded-";
+function hasProxyHeaders(request) {
+  return hasForwardedHeaders(request) || PROXY_PATH_HEADERS.some((header2) => request.headers[header2] !== void 0) || Object.keys(request.headers).some((header2) => header2.startsWith(FORWARDED_HEADER_PREFIX));
+}
 function resolveCallerKey(request, trustProxyConfigured) {
   const socketAddress = request.socket.remoteAddress ?? request.ip;
   if (!trustProxyConfigured) return socketAddress;
@@ -14418,8 +14431,7 @@ function rowKey(row) {
   return { queryText: row.queryText, queryId: row.queryId, executionNodeKey: row.executionNodeKey };
 }
 function compareRows(left, right) {
-  const order = (a, b) => a < b ? -1 : a > b ? 1 : 0;
-  return left.queryText.localeCompare(right.queryText, "en") || order(left.queryText, right.queryText) || order(left.queryId, right.queryId) || order(left.executionNodeKey ?? "", right.executionNodeKey ?? "");
+  return left.queryText.localeCompare(right.queryText, "en") || compareText(left.queryText, right.queryText) || compareText(left.queryId, right.queryId) || compareText(left.executionNodeKey ?? "", right.executionNodeKey ?? "");
 }
 function withheldCounts(counts2) {
   return Object.fromEntries(Object.entries(counts2).map(([key, value]) => [key, OPERATIONAL_OUTCOMES.has(key) ? value : 0]));
@@ -14987,9 +14999,6 @@ import { and as and7, desc as desc4, eq as eq12, exists, inArray as inArray4, is
 import crypto7 from "crypto";
 import { and as and6, eq as eq11, gt as gt2, lte as lte4 } from "drizzle-orm";
 var MEASUREMENT_RECEIPT_TTL_MS = 24 * 60 * 60 * 1e3;
-function compareText(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function canonicalJsonValue(value) {
   if (Array.isArray(value)) return value.map(canonicalJsonValue);
   if (value && typeof value === "object") {
@@ -15957,10 +15966,6 @@ import { and as and11, desc as desc7, eq as eq17, gt as gt3, inArray as inArray6
 import { and as and9, desc as desc5, eq as eq15, gte as gte2, inArray as inArray5, isNull as isNull4, lt as lt4, lte as lte5, ne as ne4 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-report.ts
-var compareText2 = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-function sortedUnique(values) {
-  return [...new Set(values)].sort(compareText2);
-}
 function normalizedHost(value) {
   try {
     return normalizeMeasurementHost(value);
@@ -16042,7 +16047,7 @@ function classifySourceAttribution(value, routes, normalizedOwnedHosts) {
     const claim = routeClaim(source, route);
     if (claim) claims.push(claim);
   }
-  claims.sort((left, right) => right.modeRank - left.modeRank || right.pathLength - left.pathLength || compareText2(left.targetId, right.targetId) || compareText2(left.urlId, right.urlId));
+  claims.sort((left, right) => right.modeRank - left.modeRank || right.pathLength - left.pathLength || compareText(left.targetId, right.targetId) || compareText(left.urlId, right.urlId));
   const best = claims.at(0);
   if (!best) {
     return {
@@ -16083,8 +16088,7 @@ function classifySourceForUsageEdge(source, usageEdge) {
 }
 function normalizeMeasurementLocation(value) {
   if (value === null) return null;
-  const normalized = value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-  return normalized || null;
+  return normalizeIdentityText(value) || null;
 }
 function words(value) {
   return value.normalize("NFKC").toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
@@ -16142,7 +16146,7 @@ function mentionedTargetsForAliases(answerText, aliases, preparedWords) {
 }
 function identityAmbiguityPatterns(aliases) {
   const patterns = aliases.flatMap((alias2) => {
-    const name = words(alias2).join(" ").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const name = escapeRegExp(words(alias2).join(" "));
     if (!name) return [];
     return [{
       clarification: new RegExp(`(?:^| )which (?:specific )?${name} (?:(?:(?:do|did) )?you mean|(?:(?:are|were) you|you(?: re| are| were)?) (?:asking about|referring to|talking about))(?= |$)`, "u"),
@@ -16158,7 +16162,15 @@ function identityAmbiguityPatterns(aliases) {
     multipleEntities: patterns.flatMap((pattern) => pattern.multipleEntities)
   };
 }
-function resolveMentionIdentity(text2, targets, aliases, citedTargetIds, ambiguityPatterns = new Map(targets.map((target) => [target.id, identityAmbiguityPatterns(target.aliases)]))) {
+var NO_TARGETS = /* @__PURE__ */ new Set();
+function queryNamedTargetIds(queryText, brandedTargetIds, aliases) {
+  if (!queryText || brandedTargetIds === void 0) return NO_TARGETS;
+  const branded = new Set(brandedTargetIds);
+  if (branded.size === 0) return NO_TARGETS;
+  const named = [...mentionedTargetsForAliases(queryText, aliases).mentioned].filter((id) => branded.has(id));
+  return named.length === 0 ? NO_TARGETS : new Set(named);
+}
+function resolveMentionIdentity(text2, targets, aliases, citedTargetIds, ambiguityPatterns = new Map(targets.map((target) => [target.id, identityAmbiguityPatterns(target.aliases)])), queryNamed = NO_TARGETS) {
   const textWords = text2 === null ? [] : words(text2);
   const state = mentionedTargetsForAliases(text2, aliases, textWords);
   if (text2 === null) return state;
@@ -16166,8 +16178,10 @@ function resolveMentionIdentity(text2, targets, aliases, citedTargetIds, ambigui
   for (const target of targets) {
     if (!state.mentioned.has(target.id)) continue;
     const patterns = ambiguityPatterns.get(target.id);
-    const qualified = citedTargetIds.has(target.id) || (target.identityAliases?.length ?? 0) > 0 && containsAnyAlias(text2, target.identityAliases);
-    const unresolved = patterns?.clarification.some((pattern) => pattern.test(normalized)) || !qualified && (patterns?.multipleEntities.some((pattern) => pattern.test(normalized)) || (target.identityAliases?.length ?? 0) > 0);
+    const cited = citedTargetIds.has(target.id);
+    const qualified = cited || (target.identityAliases?.length ?? 0) > 0 && containsAnyAlias(text2, target.identityAliases);
+    const clarified = cited || queryNamed.has(target.id);
+    const unresolved = !clarified && patterns?.clarification.some((pattern) => pattern.test(normalized)) || !qualified && (patterns?.multipleEntities.some((pattern) => pattern.test(normalized)) || (target.identityAliases?.length ?? 0) > 0);
     if (unresolved) {
       state.mentioned.delete(target.id);
       state.unknown.add(target.id);
@@ -16182,13 +16196,14 @@ function createTargetMentionReader(targets, ownedHosts = []) {
   const ambiguityPatterns = new Map(targets.map((target) => [target.id, identityAmbiguityPatterns(target.aliases)]));
   const routes = compiledTargetRoutes(targets);
   const normalizedOwnedHosts = ownedHosts.map(normalizedHost);
-  return (answerText, targetIds, citedUrls = []) => {
+  return (answerText, targetIds, citedUrls = [], query = null) => {
     if (answerText === null || targetIds.length === 0) return null;
     const citedTargetIds = new Set(citedUrls.flatMap((url) => {
       const source = classifySourceAttribution(url, routes, normalizedOwnedHosts);
       return source.classification === "matched" ? source.matchedTargetIds : [];
     }));
-    const state = resolveMentionIdentity(answerProseForMentions(answerText), targets, aliases, citedTargetIds, ambiguityPatterns);
+    const queryNamed = query === null ? NO_TARGETS : queryNamedTargetIds(query.text, query.brandedTargetIds.filter((id) => targetIds.includes(id)), aliases);
+    const state = resolveMentionIdentity(answerProseForMentions(answerText), targets, aliases, citedTargetIds, ambiguityPatterns, queryNamed);
     if (targetIds.some((id) => state.mentioned.has(id))) return true;
     return targetIds.some((id) => !mentionableIds.has(id) || state.unknown.has(id)) ? null : false;
   };
@@ -16245,7 +16260,7 @@ function prepareReport(input, options = {}, detailedEvidence = true) {
   const observationsBySlot = /* @__PURE__ */ new Map();
   const historical = /* @__PURE__ */ new Set();
   const evidenceIncomplete = /* @__PURE__ */ new Set();
-  for (const slot of [...input.expectedSlots].sort((left, right) => compareText2(left.id, right.id))) {
+  for (const slot of [...input.expectedSlots].sort((left, right) => compareText(left.id, right.id))) {
     const rows = candidates.get(slot.id) ?? [];
     if (rows.length > 1) {
       for (const row of rows) ambiguous.add(row.id);
@@ -16291,17 +16306,33 @@ function prepareReport(input, options = {}, detailedEvidence = true) {
   const mentionableIds = new Set(
     mentionAliases.map((alias2) => alias2.targetId)
   );
+  const queryNamedByExecution = /* @__PURE__ */ new Map();
+  const queryNamedFor = (slot) => {
+    const cached = queryNamedByExecution.get(slot.executionId);
+    if (cached !== void 0) return cached;
+    const branded = (edgesByExecution.get(slot.executionId) ?? []).flatMap((edge) => edge.type === "target" && edge.queryClass === "branded" ? [edge.targetId] : []);
+    const named = queryNamedTargetIds(slot.queryText, branded, aliasesByFirstWord);
+    queryNamedByExecution.set(slot.executionId, named);
+    return named;
+  };
   for (const observation of observationsBySlot.values()) {
     const citedTargetIds = new Set(observation.sourceUrls.flatMap((url) => {
       const source = sourceAttribution(url);
       return source.classification === "matched" ? source.matchedTargetIds : [];
     }));
-    const mentions = resolveMentionIdentity(observation.mentionText, input.targets, aliasesByFirstWord, citedTargetIds, ambiguityPatterns);
+    const mentions = resolveMentionIdentity(
+      observation.mentionText,
+      input.targets,
+      aliasesByFirstWord,
+      citedTargetIds,
+      ambiguityPatterns,
+      queryNamedFor(observation.slot)
+    );
     observation.mentionedTargetIds = mentions.mentioned;
     observation.unknownMentionTargetIds = mentions.unknown;
     observation.citedTargetIds = citedTargetIds;
     if (!detailedEvidence) continue;
-    const edges = [...edgesByExecution.get(observation.slot.executionId) ?? []].sort((left, right) => compareText2(left.id, right.id));
+    const edges = [...edgesByExecution.get(observation.slot.executionId) ?? []].sort((left, right) => compareText(left.id, right.id));
     for (const edge of edges) {
       const sources = observation.sourceUrls.map((sourceUrl) => {
         const { classification, normalizedUrl, matchedTargetIds, matchedUrlIds } = classifySourceForUsageEdge(sourceAttribution(sourceUrl), edge);
@@ -16336,7 +16367,7 @@ function prepareReport(input, options = {}, detailedEvidence = true) {
       });
     }
   }
-  answers.sort((left, right) => compareText2(left.expectedSlotId, right.expectedSlotId) || compareText2(left.usageEdgeId, right.usageEdgeId));
+  answers.sort((left, right) => compareText(left.expectedSlotId, right.expectedSlotId) || compareText(left.usageEdgeId, right.usageEdgeId));
   const evidence = answers.flatMap((answer) => answer.sources.map((source) => ({
     observationId: answer.observationId,
     expectedSlotId: answer.expectedSlotId,
@@ -16355,7 +16386,7 @@ function prepareReport(input, options = {}, detailedEvidence = true) {
     matchedTargetIds: source.matchedTargetIds,
     matchedUrlIds: source.matchedUrlIds
   })));
-  evidence.sort((left, right) => compareText2(left.expectedSlotId, right.expectedSlotId) || compareText2(left.usageEdgeId, right.usageEdgeId) || compareText2(left.sourceUrl, right.sourceUrl) || compareText2(left.classification, right.classification));
+  evidence.sort((left, right) => compareText(left.expectedSlotId, right.expectedSlotId) || compareText(left.usageEdgeId, right.usageEdgeId) || compareText(left.sourceUrl, right.sourceUrl) || compareText(left.classification, right.classification));
   options.onSourceAttributionComputed?.(sourceAttributions.size);
   return {
     observationsBySlot,
@@ -16387,7 +16418,7 @@ function slotsForEdges(expectedSlots, edges) {
   for (const slot of expectedSlots) {
     if (executionIds.has(slot.executionId)) slots.set(slot.id, slot);
   }
-  return [...slots.values()].sort((left, right) => compareText2(left.id, right.id));
+  return [...slots.values()].sort((left, right) => compareText(left.id, right.id));
 }
 function completeness(slots, prepared) {
   const observations = slots.flatMap((slot) => {
@@ -16450,7 +16481,7 @@ function providersFor(slots) {
   return sortedUnique(slots.map((slot) => slot.provider));
 }
 function buildSovForSlots(slots, competitors2, projectBrandNames, projectDomain, prepared) {
-  const sortedCompetitors = [...competitors2].sort((left, right) => compareText2(left.domain, right.domain));
+  const sortedCompetitors = [...competitors2].sort((left, right) => compareText(left.domain, right.domain));
   const rows = [
     { domain: projectDomain, own: true, aliases: projectBrandNames },
     ...sortedCompetitors.map((competitor) => ({
@@ -16614,7 +16645,7 @@ function indexedSlotsForEdges(edges, indexes) {
   for (const edge of edges) {
     for (const slot of indexes.slotsByExecutionId.get(edge.executionId) ?? []) slots.set(slot.id, slot);
   }
-  return [...slots.values()].sort((left, right) => compareText2(left.id, right.id));
+  return [...slots.values()].sort((left, right) => compareText(left.id, right.id));
 }
 function indexedAnsweredSlots(slots, indexes) {
   return slots.filter((slot) => indexes.answeredSlotIds.has(slot.id));
@@ -16778,22 +16809,19 @@ function buildMeasurementReport(input, options = {}) {
   const prepared = prepareReport(input, options);
   return {
     revision: input.revision,
-    groups: [...input.groups].sort((left, right) => compareText2(left.id, right.id)).map((group) => buildGroupReport(group, input, prepared)),
-    targets: [...input.targets].sort((left, right) => compareText2(left.id, right.id)).map((target) => buildTargetReport(target, input, prepared)),
+    groups: [...input.groups].sort((left, right) => compareText(left.id, right.id)).map((group) => buildGroupReport(group, input, prepared)),
+    targets: [...input.targets].sort((left, right) => compareText(left.id, right.id)).map((target) => buildTargetReport(target, input, prepared)),
     evidence: prepared.evidence,
     diagnostics: prepared.diagnostics
   };
 }
 
 // ../api-routes/src/measurement-report-adapter.ts
-function compareText3(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function normalizedProviders(values) {
   const providers = values.map((value) => value.trim().toLocaleLowerCase("en"));
   if (providers.some((value) => !value)) throw new Error("measurement manifest provider must be non-empty");
   if (new Set(providers).size !== providers.length) throw new Error("measurement manifest providers must be unique");
-  return providers.sort(compareText3);
+  return providers.sort(compareText);
 }
 function canonicalContext(value) {
   if (value === null) return "null";
@@ -16826,7 +16854,7 @@ function frozenExecutionNodes(plan) {
 }
 function manifestFromNodes(nodes, providersFor2) {
   const expectedSlots = [];
-  for (const node of [...nodes].sort((left, right) => compareText3(left.stableKey, right.stableKey))) {
+  for (const node of [...nodes].sort((left, right) => compareText(left.stableKey, right.stableKey))) {
     const providers = providersFor2(node);
     if (node.expectedSnapshots !== providers.length) {
       throw new Error(`measurement manifest provider roster does not satisfy execution ${node.stableKey}`);
@@ -17069,9 +17097,10 @@ function buildMeasurementPlanV2ReportInput(revision, plan, manifest, snapshots)
     }
   };
 }
-function responseFromReport(revision, report, run) {
+function responseFromReport(revision, report, run, queryClass) {
   return {
     revision,
+    queryClass,
     run,
     groups: report.groups,
     targets: report.targets,
@@ -17134,31 +17163,38 @@ function measurementRunExpectedSlots(run, plan) {
   if (run.measurementManifest === null) manifestFailure(`missing for run ${run.id}`);
   return parseManifest(run.measurementManifest, frozenExecutionNodes(plan), run.measurementScope === null);
 }
-function storedMeasurementPlanV2Report(db, projectId, version, plan, runId) {
+function storedMeasurementPlanV2Report(db, projectId, version, plan, runId, queryClass) {
   const run = runId ? pinnedMeasurementRun(db, projectId, version.id, runId, { exactVersion: true }) : latestMeasurementRun(db, projectId, version.id, [RunStatuses.completed, RunStatuses.partial], {}, { exactVersion: true });
   if (!run) {
     const empty = buildMeasurementPlanV2ReportInput(version.revision, plan, { schemaVersion: 1, expectedSlots: [] }, []);
     return {
       kind: "no-population",
       reason: "no-run",
-      report: responseFromReport(version.revision, buildMeasurementReport(empty.input), null)
+      report: responseFromReport(version.revision, buildMeasurementReport(classInput(empty, queryClass)), null, queryClass)
     };
   }
   const manifest = measurementRunExpectedSlots(run, plan);
   const snapshots = db.select().from(querySnapshots).where(eq15(querySnapshots.runId, run.id)).all();
-  const { input } = buildMeasurementPlanV2ReportInput(version.revision, plan, manifest, snapshots);
+  const materialized = buildMeasurementPlanV2ReportInput(version.revision, plan, manifest, snapshots);
   return {
     kind: "report",
-    report: responseFromReport(version.revision, buildMeasurementReport(input), {
+    report: responseFromReport(version.revision, buildMeasurementReport(classInput(materialized, queryClass)), {
       id: run.id,
       status: run.status === RunStatuses.completed ? RunStatuses.completed : RunStatuses.partial,
       createdAt: run.createdAt,
       startedAt: run.startedAt,
       finishedAt: run.finishedAt
-    })
+    }, queryClass)
   };
 }
-function buildStoredMeasurementReport(db, projectId, revision, runId) {
+function classInput(materialized, queryClass) {
+  if (queryClass === "all") return materialized.input;
+  return {
+    ...materialized.input,
+    usageEdges: materialized.input.usageEdges.filter((edge) => materialized.edgeQueryClass.get(edge.id) === queryClass)
+  };
+}
+function buildStoredMeasurementReport(db, projectId, revision, runId, queryClass) {
   const version = db.select().from(measurementPlanVersions).where(and9(
     eq15(measurementPlanVersions.projectId, projectId),
     eq15(measurementPlanVersions.revision, revision)
@@ -17166,7 +17202,12 @@ function buildStoredMeasurementReport(db, projectId, revision, runId) {
   if (!version) return { kind: "no-plan", revision };
   const stored = parseStoredMeasurementPlanAnyVersion(version.canonicalJson);
   if (stored.schemaVersion === MEASUREMENT_PLAN_V2_SCHEMA_VERSION) {
-    return storedMeasurementPlanV2Report(db, projectId, version, stored, runId);
+    return storedMeasurementPlanV2Report(db, projectId, version, stored, runId, queryClass ?? MEASUREMENT_DEFAULT_QUERY_CLASS);
+  }
+  if (queryClass !== void 0 && queryClass !== "all") {
+    throw validationError(
+      `Revision ${revision} is a schema v1 plan, which records no query class. Omit queryClass to read every answer.`
+    );
   }
   const plan = stored;
   const run = runId ? pinnedMeasurementRun(db, projectId, version.id, runId, { exactVersion: true }) : db.select().from(runs).where(and9(
@@ -17193,7 +17234,7 @@ function buildStoredMeasurementReport(db, projectId, revision, runId) {
     )).orderBy(desc5(runs.createdAt), desc5(runs.id)).get();
     if (!selectedRun) {
       const report2 = buildMeasurementReport(reportInput(version.revision, plan, { schemaVersion: 1, expectedSlots: [] }, [], false));
-      return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null) };
+      return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null, null) };
     }
     const legacySnapshots = db.select().from(querySnapshots).where(eq15(querySnapshots.runId, selectedRun.id)).all();
     const providers = [...new Set(legacySnapshots.map((snapshot) => snapshot.provider.trim().toLocaleLowerCase("en")).filter(Boolean))];
@@ -17201,12 +17242,12 @@ function buildStoredMeasurementReport(db, projectId, revision, runId) {
       manifest = buildMeasurementRunManifest(plan, providers);
     } catch {
       const report2 = buildMeasurementReport(reportInput(version.revision, plan, { schemaVersion: 1, expectedSlots: [] }, [], false));
-      return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null) };
+      return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null, null) };
     }
     legacy = true;
   } else {
     const report2 = buildMeasurementReport(reportInput(version.revision, plan, { schemaVersion: 1, expectedSlots: [] }, [], false));
-    return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null) };
+    return { kind: "no-population", reason: "no-run", report: responseFromReport(version.revision, report2, null, null) };
   }
   const snapshots = db.select().from(querySnapshots).where(eq15(querySnapshots.runId, selectedRun.id)).all();
   const report = buildMeasurementReport(reportInput(version.revision, plan, manifest, snapshots, legacy));
@@ -17218,7 +17259,7 @@ function buildStoredMeasurementReport(db, projectId, revision, runId) {
       createdAt: selectedRun.createdAt,
       startedAt: selectedRun.startedAt,
       finishedAt: selectedRun.finishedAt
-    })
+    }, null)
   };
 }
 
@@ -17324,9 +17365,6 @@ function expectedSlotsFor(nodes, providers, models) {
     ...models[provider] ? { requestedModel: models[provider] } : {}
   })));
 }
-function compareText4(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function normalizedLocationIdentity(value) {
   if (!value) return null;
   return [value.country, value.region, value.city, value.label, value.timezone ?? ""].map((part) => part.trim().toLocaleLowerCase("en")).join("\0");
@@ -17353,7 +17391,7 @@ function materializeV2ExecutionNodes(nodes, instanceModels) {
   const answering = /* @__PURE__ */ new Map();
   const retired = /* @__PURE__ */ new Set();
   const claimed = /* @__PURE__ */ new Set();
-  for (const node of [...nodes].sort((left, right) => compareText4(left.stableKey, right.stableKey))) {
+  for (const node of [...nodes].sort((left, right) => compareText(left.stableKey, right.stableKey))) {
     const nodeProviders = normalizeProviders(node.context.providers);
     const declared = nodeProviderModels(node);
     const resolved = /* @__PURE__ */ new Map();
@@ -17385,11 +17423,11 @@ function materializeV2ExecutionNodes(nodes, instanceModels) {
   }
   return {
     expectedSlots,
-    providers: [...providers].sort(compareText4),
+    providers: [...providers].sort(compareText),
     models: Object.fromEntries([...models].flatMap(([provider, model]) => {
       if (model) return [[provider, model]];
       const current = answering.get(provider);
-      return retired.has(provider) && current ? [[provider, [...current].sort(compareText4).join(" + ")]] : [];
+      return retired.has(provider) && current ? [[provider, [...current].sort(compareText).join(" + ")]] : [];
     }))
   };
 }
@@ -17405,12 +17443,9 @@ function sliceForV2(plan, params) {
 function quotedList(values) {
   return values.map((value) => `"${value}"`).join(", ");
 }
-function sortedUnique2(values) {
-  return [...new Set(values)].sort(compareText4);
-}
 function resolveV2RunScope(plan, scope) {
-  const requestedGroups = sortedUnique2(scope.groups ?? []);
-  const requestedTargets = sortedUnique2(scope.targets ?? []);
+  const requestedGroups = sortedUnique(scope.groups ?? []);
+  const requestedTargets = sortedUnique(scope.targets ?? []);
   const groupsByKey = new Map(plan.groups.map((group) => [group.stableKey, group]));
   const targetKeys = new Set(plan.targets.map((target) => target.stableKey));
   const unknownGroups = requestedGroups.filter((key) => !groupsByKey.has(key));
@@ -17429,7 +17464,7 @@ function resolveV2RunScope(plan, scope) {
   for (const key of requestedGroups) {
     for (const targetKey of groupsByKey.get(key).targetKeys) selected.add(targetKey);
   }
-  const resolvedTargets = [...selected].sort(compareText4);
+  const resolvedTargets = [...selected].sort(compareText);
   const usedNodeKeys = new Set(plan.usageEdges.filter((edge) => selected.has(edge.targetKey)).map((edge) => edge.executionNodeKey));
   const executionNodes = plan.executionNodes.filter((node) => usedNodeKeys.has(node.stableKey));
   if (executionNodes.length === 0) {
@@ -17444,7 +17479,7 @@ function resolveV2RunScope(plan, scope) {
   };
 }
 function resolveV2QueryScope(plan, queryTexts) {
-  const requested = sortedUnique2(queryTexts.map(normalizeMeasurementExecutionQueryText).filter(Boolean));
+  const requested = sortedUnique(queryTexts.map(normalizeMeasurementExecutionQueryText).filter(Boolean));
   const measured = new Set(plan.executionNodes.map((node) => normalizeMeasurementExecutionQueryText(node.queryText)));
   const unknown = requested.filter((text2) => !measured.has(text2));
   if (unknown.length) {
@@ -19708,6 +19743,9 @@ var CURRENT_RUN_STATUSES = [
   RunStatuses.partial,
   RunStatuses.failed
 ];
+function servedQueryClass(query) {
+  return query.queryClass ?? MEASUREMENT_DEFAULT_QUERY_CLASS;
+}
 var MEASUREMENT_OVERVIEW_CACHE_MAX_ENTRIES = 32;
 function cacheKeyOf(key) {
   return JSON.stringify([
@@ -19750,6 +19788,9 @@ function parseOverviewQuery(raw) {
   };
   const parsed = measurementOverviewQuerySchema.safeParse(candidate);
   if (!parsed.success) throw validationError("Invalid measurement overview query", { issues: parsed.error.issues });
+  if (parsed.data.marketKey !== void 0 && parsed.data.scope !== "market") {
+    throw validationError(`"marketKey" is accepted only when scope is "market"; scope "${parsed.data.scope}" does not narrow to a market.`);
+  }
   return parsed.data;
 }
 function activeMeasurementPlan(db, projectId) {
@@ -19804,20 +19845,18 @@ function countMetric(rate2) {
   if (rate2.numerator === null) return unavailable2(metricReason(rate2.reason));
   return { state: "available", value: rate2.numerator, numerator: rate2.numerator, denominator: rate2.denominator };
 }
-function normalizedText(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function overviewFilterFingerprint(query) {
   const filters = {
     scope: query.scope,
     groupKey: query.groupKey ?? null,
+    marketKey: query.marketKey ?? null,
     targetKey: query.targetKey ?? null,
-    queryClass: query.queryClass ?? "all",
-    provider: query.provider === void 0 ? null : normalizedText(query.provider),
-    location: query.location === void 0 ? null : normalizedText(query.location),
+    queryClass: servedQueryClass(query),
+    provider: query.provider === void 0 ? null : normalizeIdentityText(query.provider),
+    location: query.location === void 0 ? null : normalizeIdentityText(query.location),
     from: query.from ?? null,
     to: query.to ?? null,
-    search: query.search === void 0 ? null : normalizedText(query.search),
+    search: query.search === void 0 ? null : normalizeIdentityText(query.search),
     compact: query.compact ?? false
   };
   return createHash4("sha256").update(JSON.stringify(filters)).digest("base64url");
@@ -19826,29 +19865,30 @@ function overviewAggregateFingerprint(query) {
   const filters = {
     scope: query.scope,
     groupKey: query.groupKey ?? null,
+    marketKey: query.marketKey ?? null,
     targetKey: query.targetKey ?? null,
-    queryClass: query.queryClass ?? "all",
-    provider: query.provider === void 0 ? null : normalizedText(query.provider),
-    location: query.location === void 0 ? null : normalizedText(query.location),
+    queryClass: servedQueryClass(query),
+    provider: query.provider === void 0 ? null : normalizeIdentityText(query.provider),
+    location: query.location === void 0 ? null : normalizeIdentityText(query.location),
     from: query.from ?? null,
     to: query.to ?? null
   };
   return createHash4("sha256").update(JSON.stringify(filters)).digest("base64url");
 }
 function compareLabels(left, right) {
-  const leftLabel = normalizedText(left.label);
-  const rightLabel = normalizedText(right.label);
+  const leftLabel = normalizeIdentityText(left.label);
+  const rightLabel = normalizeIdentityText(right.label);
   if (leftLabel !== rightLabel) return leftLabel < rightLabel ? -1 : 1;
-  return left.targetKey < right.targetKey ? -1 : left.targetKey > right.targetKey ? 1 : 0;
+  return compareText(left.targetKey, right.targetKey);
 }
 function compareLabelSort(left, right, descending) {
-  const leftLabel = normalizedText(left.label);
-  const rightLabel = normalizedText(right.label);
+  const leftLabel = normalizeIdentityText(left.label);
+  const rightLabel = normalizeIdentityText(right.label);
   if (leftLabel !== rightLabel) {
     const compared = leftLabel < rightLabel ? -1 : 1;
     return descending ? -compared : compared;
   }
-  return left.targetKey < right.targetKey ? -1 : left.targetKey > right.targetKey ? 1 : 0;
+  return compareText(left.targetKey, right.targetKey);
 }
 function metricForSort(row, sort) {
   switch (sort) {
@@ -19877,7 +19917,7 @@ function compareRows2(left, right, sort) {
   return compareLabels(left, right);
 }
 function legacyCursorOf(row) {
-  return Buffer.from(`${normalizedText(row.label)}:${row.targetKey}`, "utf8").toString("base64url");
+  return Buffer.from(`${normalizeIdentityText(row.label)}:${row.targetKey}`, "utf8").toString("base64url");
 }
 function cursorOf(row, sort, displayedRunId, filterFingerprint2, planVersionId, evidenceFingerprint) {
   const cursor = {
@@ -20071,6 +20111,7 @@ function resolveScope(plan, query) {
       group: v2GroupOf(plan, groupKey)
     };
   }
+  if (query.scope === "market") return resolveMarketScope(plan, query.marketKey);
   if (query.scope === "property") {
     if (query.targetKey === void 0) throw validationError('"targetKey" is required when scope is "property".');
     const target = plan.targets.find((candidate) => candidate.stableKey === query.targetKey);
@@ -20079,6 +20120,24 @@ function resolveScope(plan, query) {
   }
   return { kind: "all", label: "All Properties", targetKeys: plan.targets.map((target) => target.stableKey), group: null };
 }
+function resolveMarketScope(plan, marketKey) {
+  if (marketKey === void 0) throw validationError('"marketKey" is required when scope is "market".');
+  const notInRevision = () => validationError(`Measurement market "${marketKey}" is not in the active revision.`);
+  if (plan.schemaVersion !== MEASUREMENT_PLAN_V2_SCHEMA_VERSION) throw notInRevision();
+  const market = plan.reportingScopes?.find((candidate) => candidate.stableKey === marketKey);
+  if (!market) throw notInRevision();
+  const members = new Set(market.usageEdges.map(measurementV2UsageEdgeKey));
+  const edges = plan.usageEdges.filter((edge) => members.has(measurementV2UsageEdgeKey(edge)));
+  const targetKeys = new Set(edges.map((edge) => edge.targetKey));
+  return {
+    kind: "market",
+    key: market.stableKey,
+    label: market.label,
+    targetKeys: plan.targets.map((target) => target.stableKey).filter((targetKey) => targetKeys.has(targetKey)),
+    group: null,
+    edgeIds: new Set(edges.map(v2UsageEdgeId))
+  };
+}
 function namedIdentitiesFor(plan, scope, queryClass) {
   if (scope.kind !== "group" || queryClass !== "non-brand" || scope.group === null) return [];
   if (scope.group.competitors.length === 0) return [];
@@ -20116,12 +20175,9 @@ function planExpectedSlots(plan) {
 }
 function matchesSearch(row, search) {
   if (search === void 0) return true;
-  const needle = normalizedText(search);
+  const needle = normalizeIdentityText(search);
   if (needle === "") return true;
-  return normalizedText(row.label).includes(needle) || normalizedText(row.targetKey).includes(needle);
-}
-function compareGroupText(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
+  return normalizeIdentityText(row.label).includes(needle) || normalizeIdentityText(row.targetKey).includes(needle);
 }
 function propertyLocations(plan) {
   const groupsByKey = new Map(plan.groups.map((group) => [group.stableKey, group]));
@@ -20138,7 +20194,7 @@ function propertyLocations(plan) {
     }
     return levels;
   };
-  const byLabel = (left, right) => compareGroupText(left.label, right.label) || compareGroupText(left.stableKey, right.stableKey);
+  const byLabel = (left, right) => compareText(left.label, right.label) || compareText(left.stableKey, right.stableKey);
   const metros = /* @__PURE__ */ new Map();
   const submarkets = /* @__PURE__ */ new Map();
   const push = (map, key, value) => {
@@ -20199,7 +20255,7 @@ function planV1Overview(db, projectId, active, query, scope) {
   return {
     mode: "active-v1",
     scope: scopeDto(scope),
-    queryClass: query.queryClass ?? "all",
+    queryClass: servedQueryClass(query),
     measurement: {
       state: displayed ? displayedState(displayed.status) : "not_measured",
       ...displayed ? { currentRunId: displayed.id, displayedRunId: displayed.id } : {},
@@ -20220,7 +20276,7 @@ function planV1Overview(db, projectId, active, query, scope) {
   };
 }
 function planV2Overview(db, projectId, active, plan, query, scope, cache) {
-  const queryClass = query.queryClass ?? "all";
+  const queryClass = servedQueryClass(query);
   const displayed = selectDisplayedRun(db, projectId, active, query);
   const current = latestMeasurementRun(db, projectId, active.version.id, CURRENT_RUN_STATUSES);
   const currentDto = current ? { currentRunId: current.id } : {};
@@ -20275,8 +20331,8 @@ function planV2Overview(db, projectId, active, plan, query, scope, cache) {
   }, () => {
     const manifest = measurementRunExpectedSlots(displayed, plan);
     const { input, edgeQueryClass } = buildMeasurementPlanV2ReportInput(active.version.revision, plan, manifest, snapshots);
-    const expectedSlots = input.expectedSlots.filter((slot) => (query.provider === void 0 || slot.provider === normalizedText(query.provider)) && (query.location === void 0 || normalizedText(slot.location ?? "") === normalizedText(query.location)));
-    const usageEdges = queryClass === "all" ? input.usageEdges : input.usageEdges.filter((edge) => edgeQueryClass.get(edge.id) === queryClass);
+    const expectedSlots = input.expectedSlots.filter((slot) => (query.provider === void 0 || slot.provider === normalizeIdentityText(query.provider)) && (query.location === void 0 || normalizeIdentityText(slot.location ?? "") === normalizeIdentityText(query.location)));
+    const usageEdges = input.usageEdges.filter((edge) => (queryClass === "all" || edgeQueryClass.get(edge.id) === queryClass) && (scope.edgeIds === void 0 || scope.edgeIds.has(edge.id)));
     return buildMeasurementOverview({
       ...input,
       expectedSlots,
@@ -20514,7 +20570,7 @@ function readCompetitorIdentityChangedAt(db, projectId) {
   return renamed !== null && renamed > audited ? renamed : audited;
 }
 function pooledRunIds(pooled) {
-  return [...pooled].sort((left, right) => left.createdAt === right.createdAt ? compareStoredIds(right.id, left.id) : compareStoredIds(right.createdAt, left.createdAt)).slice(0, POOLED_RUN_ID_LIMIT).map((run) => run.id);
+  return [...pooled].sort((left, right) => left.createdAt === right.createdAt ? compareText(right.id, left.id) : compareText(right.createdAt, left.createdAt)).slice(0, POOLED_RUN_ID_LIMIT).map((run) => run.id);
 }
 function readCompetitorLandscape(app, projectName, query, selection) {
   const project = resolveProject(app.db, projectName);
@@ -20666,7 +20722,7 @@ function readCompetitorLandscape(app, projectName, query, selection) {
       else excluded.nonCompleted++;
       excludedByModel.set(key, excluded);
     }
-    const sortedGroups = [...modelGroups.values()].sort((left, right) => compareStoredIds(left.provider, right.provider) || (left.model === null ? right.model === null ? 0 : -1 : right.model === null ? 1 : compareStoredIds(left.model, right.model)));
+    const sortedGroups = [...modelGroups.values()].sort((left, right) => compareText(left.provider, right.provider) || (left.model === null ? right.model === null ? 0 : -1 : right.model === null ? 1 : compareText(left.model, right.model)));
     const groups = sortedGroups.slice(0, COMPETITOR_LANDSCAPE_MODEL_GROUP_LIMIT).map((group) => {
       const groupHistory = buildHistory(group.snapshots);
       const groupObserved = groupHistory.observed.slice(0, COMPETITOR_LANDSCAPE_RANKED_ROW_LIMIT);
@@ -20823,12 +20879,23 @@ function scopeForFrozenPlan(plan, kind, groupKey) {
     ids.add(edge.targetKey);
     targetIdsByExecution.set(edge.executionNodeKey, ids);
   }
+  const queryTextByExecution = new Map(plan.executionNodes.map((node) => [node.stableKey, node.queryText]));
+  const brandedTargetIdsByExecution = /* @__PURE__ */ new Map();
+  for (const assignment of plan.assignments) {
+    if (assignment.queryClass !== "branded") continue;
+    const ids = brandedTargetIdsByExecution.get(assignment.executionNodeKey) ?? [];
+    ids.push(assignment.targetKey);
+    brandedTargetIdsByExecution.set(assignment.executionNodeKey, ids);
+  }
   return {
     executionNodeKeys,
     queryClassesByExecution,
     mentioned: (answerText, executionId, citedUrls) => {
       const ids = executionId === null ? [] : [...targetIdsByExecution.get(executionId) ?? []];
-      return readMention(answerText, ids, citedUrls);
+      const queryText = executionId === null ? void 0 : queryTextByExecution.get(executionId);
+      const brandedTargetIds = executionId === null ? void 0 : brandedTargetIdsByExecution.get(executionId);
+      const query = queryText === void 0 || brandedTargetIds === void 0 ? null : { text: queryText, brandedTargetIds };
+      return readMention(answerText, ids, citedUrls, query);
     },
     competitors: mergePins(groups.flatMap((group) => group.competitors.map((competitor) => ({
       domain: competitor.domain,
@@ -20878,9 +20945,6 @@ function snapshotMatchesFilters(input) {
 function requestedModel(model) {
   return model?.trim() || null;
 }
-function compareStoredIds(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function normalizedDomain(value) {
   return registrableDomain(value) || hostOf(value);
 }
@@ -21853,8 +21917,8 @@ function hash(value) {
 function answerIdentityFrom(project, competitorRows2, marketNames = /* @__PURE__ */ new Map()) {
   const projectDomains = effectiveDomains({ canonicalDomain: project.canonicalDomain, ownedDomains: project.ownedDomains });
   const projectBrandNames = effectiveBrandNames({ displayName: project.displayName, aliases: project.aliases });
-  const names = competitorRows2.map((row) => [row.domain, competitorIdentityAliases(row)]).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
-  const market = [...marketNames].map(([domain, learned]) => [domain, [...learned]]).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  const names = competitorRows2.map((row) => [row.domain, competitorIdentityAliases(row)]).sort(([left], [right]) => compareText(left, right));
+  const market = [...marketNames].map(([domain, learned]) => [domain, [...learned]]).sort(([left], [right]) => compareText(left, right));
   return {
     projectDomains,
     projectBrandNames,
@@ -22304,12 +22368,6 @@ var MeasurementDiscoveryConfigurationError = class extends Error {
     this.name = "MeasurementDiscoveryConfigurationError";
   }
 };
-function compareText5(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function sortedUnique3(values) {
-  return [...new Set(values)].sort(compareText5);
-}
 function normalizeDeclaredHost(value, label) {
   const normalized = value.trim().toLowerCase().replace(/\.$/, "");
   if (!normalized || normalized.includes("://") || normalized.includes("/") || normalized.includes("@")) {
@@ -22374,7 +22432,7 @@ function normalizePatternValue(value, label) {
   return normalized;
 }
 function compileRules(input) {
-  const ownedHosts = sortedUnique3(input.ownedHosts.map((host, index2) => normalizeDeclaredHost(host, `ownedHosts[${index2}]`)));
+  const ownedHosts = sortedUnique(input.ownedHosts.map((host, index2) => normalizeDeclaredHost(host, `ownedHosts[${index2}]`)));
   if (ownedHosts.length === 0) {
     throw new MeasurementDiscoveryConfigurationError("ownedHosts must contain at least one hostname");
   }
@@ -22385,7 +22443,7 @@ function compileRules(input) {
   if (aliases.some((alias2) => alias2.host === primary.host)) {
     throw new MeasurementDiscoveryConfigurationError("alias rules must use another owned host");
   }
-  const excludedSlugSuffixes = sortedUnique3(
+  const excludedSlugSuffixes = sortedUnique(
     (input.rules.excludedSlugSuffixes ?? []).map(
       (value, index2) => normalizePatternValue(value, `rules.excludedSlugSuffixes[${index2}]`)
     )
@@ -22393,7 +22451,7 @@ function compileRules(input) {
   const excludedSlugPatterns = (input.rules.excludedSlugPatterns ?? []).map((pattern, index2) => ({
     kind: pattern.kind,
     value: normalizePatternValue(pattern.value, `rules.excludedSlugPatterns[${index2}].value`)
-  })).sort((a, b) => compareText5(`${a.kind}:${a.value}`, `${b.kind}:${b.value}`));
+  })).sort((a, b) => compareText(`${a.kind}:${a.value}`, `${b.kind}:${b.value}`));
   return { ownedHosts, rules: { primary, aliases, excludedSlugSuffixes, excludedSlugPatterns } };
 }
 function parseSitemapUrl(value) {
@@ -22473,10 +22531,10 @@ function classifyMeasurementSitemapUrls(input) {
   const shared = [];
   const unmatched = [];
   const excluded = [];
-  const canonicalEntries = [...canonicalGroups.entries()].sort(([a], [b]) => compareText5(a, b));
+  const canonicalEntries = [...canonicalGroups.entries()].sort(([a], [b]) => compareText(a, b));
   let classifiedUrlCount = 0;
   for (const [canonicalUrl, group] of canonicalEntries) {
-    const orderedGroup = [...group].sort((a, b) => compareText5(a.sourceUrl, b.sourceUrl));
+    const orderedGroup = [...group].sort((a, b) => compareText(a.sourceUrl, b.sourceUrl));
     const representative = orderedGroup[0];
     for (let index2 = 1; index2 < orderedGroup.length; index2 += 1) {
       diagnostics.push({
@@ -22534,7 +22592,7 @@ function classifyMeasurementSitemapUrls(input) {
     else unmatched.push(item(canonicalUrl, "unmatched", "unmatched-path"));
   }
   const proposed = [...candidatesBySlug.values()].map(({ slug, stableKey, url }) => {
-    const aliasCoverageUrls = sortedUnique3((aliasesBySlug.get(slug) ?? []).map((match) => match.url));
+    const aliasCoverageUrls = sortedUnique((aliasesBySlug.get(slug) ?? []).map((match) => match.url));
     return {
       classification: "proposed",
       reason: "primary-match",
@@ -22544,7 +22602,7 @@ function classifyMeasurementSitemapUrls(input) {
       primaryUrl: url,
       aliasCoverageUrls
     };
-  }).sort((a, b) => compareText5(a.stableKey, b.stableKey));
+  }).sort((a, b) => compareText(a.stableKey, b.stableKey));
   const aliases = [];
   for (const [slug, matches] of aliasesBySlug) {
     const target = candidatesBySlug.get(slug);
@@ -22562,14 +22620,14 @@ function classifyMeasurementSitemapUrls(input) {
     }
     for (const match of matches) unmatched.push(item(match.url, "unmatched", "alias-without-primary"));
   }
-  const sortItems = (items) => items.sort((a, b) => compareText5(a.url, b.url));
+  const sortItems = (items) => items.sort((a, b) => compareText(a.url, b.url));
   return {
     proposed,
-    aliases: aliases.sort((a, b) => compareText5(a.url, b.url)),
+    aliases: aliases.sort((a, b) => compareText(a.url, b.url)),
     shared: sortItems(shared),
     unmatched: sortItems(unmatched),
     excluded: sortItems(excluded),
-    diagnostics: diagnostics.sort((a, b) => compareText5(`${a.kind}:${a.url}`, `${b.kind}:${b.url}`))
+    diagnostics: diagnostics.sort((a, b) => compareText(`${a.kind}:${a.url}`, `${b.kind}:${b.url}`))
   };
 }
 
@@ -22580,7 +22638,117 @@ import { gunzip } from "zlib";
 import { promisify as promisify2 } from "util";
 import http from "http";
 import https from "https";
+import net2 from "net";
+
+// ../api-routes/src/egress-policy.ts
 import net from "net";
+function blockedAddressReason(value, options = {}) {
+  const address = stripZoneId(stripIpv6Brackets(value));
+  if (options.allowLoopback && isLoopbackAddress(address)) return null;
+  const family = net.isIP(address);
+  if (family === 4) return blockedIpv4Reason(ipv4Octets(address));
+  if (family === 6) {
+    const bytes = ipv6Bytes(address);
+    return bytes ? blockedIpv6Reason(bytes) : "which could not be read as an address";
+  }
+  return "which is not an IP address";
+}
+function isLoopbackAddress(value) {
+  const address = stripZoneId(stripIpv6Brackets(value));
+  const family = net.isIP(address);
+  if (family === 4) return ipv4Octets(address)[0] === 127;
+  if (family !== 6) return false;
+  const bytes = ipv6Bytes(address);
+  if (!bytes) return false;
+  const mapped = mappedIpv4(bytes);
+  if (mapped) return mapped[0] === 127;
+  return bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1;
+}
+function stripIpv6Brackets(value) {
+  return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+}
+function stripZoneId(address) {
+  return address.split("%")[0];
+}
+function ipv4Octets(address) {
+  return address.split(".").map((part) => Number.parseInt(part, 10));
+}
+function blockedIpv4Reason(octets) {
+  const [first, second] = octets;
+  if (first === 0) return "which is unspecified space";
+  if (first === 127) return "which is loopback";
+  if (first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) {
+    return "which is private space";
+  }
+  if (first === 100 && second >= 64 && second <= 127) return "which is carrier-grade NAT space";
+  if (first === 169 && second === 254) return "which is link-local";
+  if (first >= 224 && first <= 239) return "which is multicast";
+  if (first === 192 && second === 0 && octets[2] === 0 || first === 198 && (second === 18 || second === 19) || first >= 240) {
+    return "which is reserved";
+  }
+  return null;
+}
+function blockedIpv6Reason(bytes) {
+  const first = bytes[0];
+  if (first === 0) {
+    const nat64 = nat64Ipv4(bytes);
+    if (nat64) return blockedIpv4Reason(nat64) === null ? null : `which is the NAT64 form of ${nat64.join(".")}`;
+    const mapped = mappedIpv4(bytes);
+    return mapped ? `which is the IPv6 form of ${mapped.join(".")}` : "which is reserved IPv6 space";
+  }
+  if (first === 1 && bytes.slice(1, 8).every((byte) => byte === 0)) return "which is reserved IPv6 space";
+  if (first === 255) return "which is multicast";
+  if ((first & 254) === 252) return "which is unique-local";
+  if (first === 254 && (bytes[1] & 192) === 128) return "which is link-local";
+  if (first === 254 && (bytes[1] & 192) === 192) return "which is reserved site-local space";
+  if (first === 32 && bytes[1] === 1 && bytes[2] === 0 && bytes[3] === 0) return "which is a Teredo tunnel";
+  if (first === 32 && bytes[1] === 2) return "which is a 6to4 tunnel";
+  if (first === 32 && bytes[1] === 1 && bytes[2] === 0 && bytes[3] === 2 && bytes[4] === 0 && bytes[5] === 0) {
+    return "which is reserved IPv6 space";
+  }
+  return null;
+}
+function mappedIpv4(bytes) {
+  const isMapped = bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 255 && bytes[11] === 255;
+  return isMapped ? [bytes[12], bytes[13], bytes[14], bytes[15]] : null;
+}
+var NAT64_WELL_KNOWN_PREFIX = [0, 100, 255, 155, 0, 0, 0, 0, 0, 0, 0, 0];
+function nat64Ipv4(bytes) {
+  const isNat64 = NAT64_WELL_KNOWN_PREFIX.every((byte, index2) => bytes[index2] === byte);
+  return isNat64 ? [bytes[12], bytes[13], bytes[14], bytes[15]] : null;
+}
+function ipv6Bytes(address) {
+  if (!net.isIPv6(address)) return null;
+  const halves = address.split("::");
+  if (halves.length > 2) return null;
+  const expand = (text2) => {
+    if (text2 === "") return [];
+    const groups2 = [];
+    const chunks = text2.split(":");
+    for (const [index2, chunk] of chunks.entries()) {
+      if (index2 === chunks.length - 1 && chunk.includes(".")) {
+        const octets = ipv4Octets(chunk);
+        groups2.push(octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]);
+        continue;
+      }
+      groups2.push(Number.parseInt(chunk, 16));
+    }
+    return groups2;
+  };
+  const head = expand(halves[0]);
+  const tail = halves.length === 2 ? expand(halves[1]) : [];
+  const missing = 8 - head.length - tail.length;
+  if (halves.length === 1 ? missing !== 0 : missing < 0) return null;
+  const groups = [...head, ...new Array(halves.length === 2 ? missing : 0).fill(0), ...tail];
+  const bytes = new Uint8Array(16);
+  for (const [index2, group] of groups.entries()) {
+    bytes[index2 * 2] = group >> 8;
+    bytes[index2 * 2 + 1] = group & 255;
+  }
+  return bytes;
+}
+
+// ../api-routes/src/measurement-sitemap-fetch.ts
 var gunzipAsync = promisify2(gunzip);
 var DEFAULT_MEASUREMENT_SITEMAP_LIMITS = {
   timeoutMs: 1e4,
@@ -22630,7 +22798,7 @@ async function fetchMeasurementSitemap(sitemapUrl, options = {}) {
     }
   }
   await visit(sitemapUrl, 0);
-  return { urls: [...urls].sort(compareText6), fetchedSitemaps: visited.size, bytesChecksum: documents.digest("hex") };
+  return { urls: [...urls].sort(compareText), fetchedSitemaps: visited.size, bytesChecksum: documents.digest("hex") };
 }
 async function resolveMeasurementSitemapTarget(rawUrl, options = {}) {
   let parsed;
@@ -22647,7 +22815,7 @@ async function resolveMeasurementSitemapTarget(rawUrl, options = {}) {
   }
   const hostname = stripIpv6Brackets(parsed.hostname);
   if (!hostname) return { ok: false, message: "the URL has no hostname" };
-  const literalFamily = net.isIPv6(hostname) ? 6 : net.isIPv4(hostname) ? 4 : null;
+  const literalFamily = net2.isIPv6(hostname) ? 6 : net2.isIPv4(hostname) ? 4 : null;
   const addresses = literalFamily ? [{ address: hostname, family: literalFamily }] : await (options.resolveAddresses ?? resolveSitemapAddresses)(hostname);
   if (addresses.length === 0) return { ok: false, message: `${hostname} does not resolve` };
   for (const entry of addresses) {
@@ -22663,85 +22831,6 @@ async function resolveSitemapAddresses(hostname) {
   if (ipv6.status === "fulfilled") for (const address of ipv6.value) found.set(`6:${address}`, { address, family: 6 });
   return [...found.values()];
 }
-function blockedAddressReason(value) {
-  const address = stripIpv6Brackets(value).split("%")[0];
-  const family = net.isIP(address);
-  if (family === 4) return blockedIpv4Reason(ipv4Octets(address));
-  if (family === 6) {
-    const bytes = ipv6Bytes(address);
-    return bytes ? blockedIpv6Reason(bytes) : "which could not be read as an address";
-  }
-  return "which is not an IP address";
-}
-function ipv4Octets(address) {
-  return address.split(".").map((part) => Number.parseInt(part, 10));
-}
-function blockedIpv4Reason(octets) {
-  const [first, second] = octets;
-  if (first === 0) return "which is unspecified space";
-  if (first === 127) return "which is loopback";
-  if (first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) {
-    return "which is private space";
-  }
-  if (first === 100 && second >= 64 && second <= 127) return "which is carrier-grade NAT space";
-  if (first === 169 && second === 254) return "which is link-local";
-  if (first >= 224 && first <= 239) return "which is multicast";
-  if (first === 192 && second === 0 && octets[2] === 0 || first === 198 && (second === 18 || second === 19) || first >= 240) {
-    return "which is reserved";
-  }
-  return null;
-}
-function blockedIpv6Reason(bytes) {
-  const first = bytes[0];
-  if (first === 0) {
-    const mapped = mappedIpv4(bytes);
-    return mapped ? `which is the IPv6 form of ${mapped.join(".")}` : "which is reserved IPv6 space";
-  }
-  if (first === 255) return "which is multicast";
-  if ((first & 254) === 252) return "which is unique-local";
-  if (first === 254 && (bytes[1] & 192) === 128) return "which is link-local";
-  if (first === 254 && (bytes[1] & 192) === 192) return "which is reserved site-local space";
-  if (first === 32 && bytes[1] === 1 && bytes[2] === 0 && bytes[3] === 0) return "which is a Teredo tunnel";
-  if (first === 32 && bytes[1] === 2) return "which is a 6to4 tunnel";
-  return null;
-}
-function mappedIpv4(bytes) {
-  const isMapped = bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 255 && bytes[11] === 255;
-  return isMapped ? [bytes[12], bytes[13], bytes[14], bytes[15]] : null;
-}
-function ipv6Bytes(address) {
-  if (!net.isIPv6(address)) return null;
-  const halves = address.split("::");
-  if (halves.length > 2) return null;
-  const expand = (text2) => {
-    if (text2 === "") return [];
-    const groups2 = [];
-    const chunks = text2.split(":");
-    for (const [index2, chunk] of chunks.entries()) {
-      if (index2 === chunks.length - 1 && chunk.includes(".")) {
-        const octets = ipv4Octets(chunk);
-        groups2.push(octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]);
-        continue;
-      }
-      groups2.push(Number.parseInt(chunk, 16));
-    }
-    return groups2;
-  };
-  const head = expand(halves[0]);
-  const tail = halves.length === 2 ? expand(halves[1]) : [];
-  const missing = 8 - head.length - tail.length;
-  if (halves.length === 1 ? missing !== 0 : missing < 0) return null;
-  const groups = [...head, ...new Array(halves.length === 2 ? missing : 0).fill(0), ...tail];
-  const bytes = new Uint8Array(16);
-  for (const [index2, group] of groups.entries()) {
-    bytes[index2 * 2] = group >> 8;
-    bytes[index2 * 2 + 1] = group & 255;
-  }
-  return bytes;
-}
-function stripIpv6Brackets(value) {
-  return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
-}
 async function requestFollowingValidatedRedirects(startUrl, resolveTarget, transport, limits, deadlineAt) {
   let current = startUrl;
   for (let redirects = 0; ; redirects += 1) {
@@ -22798,7 +22887,7 @@ async function requestPinnedSitemap(target, limits) {
     path: `${target.url.pathname}${target.url.search}`,
     headers: { Host: target.url.host, Accept: "application/xml,text/xml,*/*;q=0.1", "Accept-Encoding": "gzip" }
   };
-  if (secure) requestOptions.servername = target.url.hostname.replace(/^\[|\]$/g, "");
+  if (secure) requestOptions.servername = stripIpv6Brackets(target.url.hostname);
   return await new Promise((resolve, reject) => {
     let settled = false;
     const succeed = (response) => {
@@ -22854,11 +22943,11 @@ async function decodeSitemapBody(body, headers, maxBodyBytes) {
 }
 function sitemapIndexLocations(xml) {
   if (!hasXmlElement(xml, "sitemapindex")) return [];
-  return sortedUniqueUrls(xmlElementContents(xml, "sitemap").flatMap(extractLocation));
+  return sortedUnique(xmlElementContents(xml, "sitemap").flatMap(extractLocation));
 }
 function urlSetLocations(xml) {
   if (!hasXmlElement(xml, "urlset")) return [];
-  return sortedUniqueUrls(xmlElementContents(xml, "url").flatMap(extractLocation));
+  return sortedUnique(xmlElementContents(xml, "url").flatMap(extractLocation));
 }
 function extractLocation(xml) {
   const value = xmlElementContents(xml, "loc")[0]?.trim();
@@ -22949,12 +23038,6 @@ function decodeXmlEntities(value) {
 function firstHeader(value) {
   return Array.isArray(value) ? value[0] : value;
 }
-function compareText6(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function sortedUniqueUrls(values) {
-  return [...new Set(values)].sort(compareText6);
-}
 function assertLimits(limits) {
   for (const [name, value] of Object.entries(limits)) {
     if (!Number.isSafeInteger(value) || value < 1) throw new Error(`Sitemap ${name} must be a positive safe integer`);
@@ -23008,7 +23091,13 @@ async function measurementServiceRoutes(app, opts) {
     if (runId !== void 0 && (typeof runId !== "string" || runId.trim() === "")) {
       throw validationError('"runId" must be a non-empty string');
     }
-    const result = buildStoredMeasurementReport(app.db, project.id, revision, runId);
+    let queryClass;
+    if (request.query.queryClass !== void 0) {
+      const parsedClass = measurementQueryClassFilterSchema.safeParse(request.query.queryClass);
+      if (!parsedClass.success) throw validationError('"queryClass" must be one of non-brand, branded or all');
+      queryClass = parsedClass.data;
+    }
+    const result = buildStoredMeasurementReport(app.db, project.id, revision, runId, queryClass);
     if (result.kind === "no-plan") throw notFound("Measurement plan revision", rawRevision);
     if (runId !== void 0 && result.report.run?.id !== runId) throw notFound("Measurement run", runId);
     return measurementReportResponseSchema.parse(result.report);
@@ -23025,12 +23114,6 @@ var MEASUREMENT_DRAFT_MAX_QUERIES = 1e3;
 var MEASUREMENT_PLAN_V2_MAX_BYTES = 4 * 1024 * 1024;
 var CHECKSUM_PLACEHOLDER = "0".repeat(64);
 var MEASUREMENT_V2_PROVENANCE_EPOCH = "1970-01-01T00:00:00.000Z";
-function compareText7(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-function canonicalStrings(values) {
-  return [...new Set(values)].sort(compareText7);
-}
 function proposeQueryClass(queryText, brandNames) {
   const matcher = compileBrandAliases(brandNames.filter((name) => brandKeyFromText(name).length > 0));
   return matcherMatchesText(matcher, queryText) ? "branded" : "non-brand";
@@ -23062,12 +23145,17 @@ function parseDraftMatcher(value) {
 function matcherHost(matcher) {
   return matcher.kind === "exact" ? new URL(matcher.url).hostname : matcher.host;
 }
+function matcherPathIdentity(path8, pathCase) {
+  return pathCase === "insensitive" ? path8.toLocaleLowerCase("en") : path8;
+}
 function matcherIdentity(matcher) {
   switch (matcher.kind) {
-    case "exact":
-      return `exact\0${new URL(matcher.url).hostname}\0${new URL(matcher.url).pathname}`;
+    case "exact": {
+      const url = new URL(matcher.url);
+      return `exact\0${url.hostname}\0${matcherPathIdentity(url.pathname, matcher.pathCase)}`;
+    }
     case "prefix":
-      return `prefix\0${matcher.host}\0${matcher.pathPrefix}`;
+      return `prefix\0${matcher.host}\0${matcherPathIdentity(matcher.pathPrefix, matcher.pathCase)}`;
     case "host":
       return `host\0${matcher.host}\0`;
   }
@@ -23142,7 +23230,7 @@ function createChecks() {
   };
 }
 function normalizeProviders2(values) {
-  return canonicalStrings(values.map((value) => value.trim().toLowerCase()).filter(Boolean));
+  return sortedUnique(values.map((value) => value.trim().toLowerCase()).filter(Boolean));
 }
 function compileMeasurementDraft(authoring, context) {
   const { checks, sink, failed } = createChecks();
@@ -23152,7 +23240,7 @@ function compileMeasurementDraft(authoring, context) {
   } catch {
     sink.fail("invalid-project-identity", "The project canonical domain is not a valid hostname.", ["identities", "projectBrand", "canonicalHost"]);
   }
-  const ownedHosts = canonicalStrings([context.canonicalDomain, ...context.ownedDomains].flatMap((value) => {
+  const ownedHosts = sortedUnique([context.canonicalDomain, ...context.ownedDomains].flatMap((value) => {
     try {
       return [normalizeMeasurementHost(value)];
     } catch {
@@ -23216,7 +23304,7 @@ function compileMeasurementDraft(authoring, context) {
       }
       aliasClaims.set(identity, target.stableKey);
     });
-    const aliases = canonicalStrings(target.aliases);
+    const aliases = sortedUnique(target.aliases);
     const aliasKeys = aliases.map(measurementMentionAliasKey).filter(Boolean);
     target.identityAliases?.forEach((identityAlias, index2) => {
       const identityKey = measurementMentionAliasKey(identityAlias);
@@ -23233,7 +23321,7 @@ function compileMeasurementDraft(authoring, context) {
         stableKey: target.stableKey,
         label: target.label,
         aliases,
-        ...target.identityAliases === void 0 ? {} : { identityAliases: canonicalStrings(target.identityAliases) },
+        ...target.identityAliases === void 0 ? {} : { identityAliases: sortedUnique(target.identityAliases) },
         urlMatchers: matchers,
         mentionNotApplicable: aliases.length === 0,
         discoveryIdentity: target.discoveryIdentity ?? null
@@ -23281,8 +23369,8 @@ function compileMeasurementDraft(authoring, context) {
       stableKey: group.stableKey,
       label: group.label,
       ...group.parentGroupKey === void 0 ? {} : { parentGroupKey: group.parentGroupKey },
-      targetKeys: canonicalStrings(group.targetKeys),
-      competitors: [...group.competitors].map((competitor) => ({ ...competitor, aliases: canonicalStrings(competitor.aliases) })).sort((left, right) => compareText7(left.stableKey, right.stableKey))
+      targetKeys: sortedUnique(group.targetKeys),
+      competitors: [...group.competitors].map((competitor) => ({ ...competitor, aliases: sortedUnique(competitor.aliases) })).sort((left, right) => compareText(left.stableKey, right.stableKey))
     });
   });
   const resolveContext = (override, path8) => {
@@ -23300,7 +23388,7 @@ function compileMeasurementDraft(authoring, context) {
       }
       models[normalized] = model;
     }
-    const labels = canonicalStrings(override?.locations ?? authoring.defaultContext.locations);
+    const labels = sortedUnique(override?.locations ?? authoring.defaultContext.locations);
     const locations = [];
     labels.forEach((label, labelIndex) => {
       const location = locationsByLabel.get(label);
@@ -23461,7 +23549,7 @@ function compileMeasurementDraft(authoring, context) {
     }
   }
   if (failed()) return { ok: false, checks };
-  const querySnapshots3 = [...usedQueryIds].sort(compareText7).map((queryId) => ({
+  const querySnapshots3 = [...usedQueryIds].sort(compareText).map((queryId) => ({
     queryId,
     queryText: queriesById.get(queryId),
     // Provenance is frozen at publish time so a later reader can explain the
@@ -23478,7 +23566,7 @@ function compileMeasurementDraft(authoring, context) {
       projectBrand: {
         canonicalHost,
         ownedHosts,
-        names: canonicalStrings(context.brandNames)
+        names: sortedUnique(context.brandNames)
       }
     },
     targets: compiledTargets.map(({ target }) => target),
@@ -23527,13 +23615,13 @@ function keyedDiff2(before, after) {
   const added = [];
   const changed = [];
   const unchanged = [];
-  for (const stableKey of [...afterByKey.keys()].sort(compareText7)) {
+  for (const stableKey of [...afterByKey.keys()].sort(compareText)) {
     const beforeValue = beforeByKey.get(stableKey);
     if (!beforeValue) added.push(stableKey);
     else if (JSON.stringify(canonicalJsonValue(beforeValue)) === JSON.stringify(canonicalJsonValue(afterByKey.get(stableKey)))) unchanged.push(stableKey);
     else changed.push(stableKey);
   }
-  const removed = [...beforeByKey.keys()].filter((key) => !afterByKey.has(key)).sort(compareText7);
+  const removed = [...beforeByKey.keys()].filter((key) => !afterByKey.has(key)).sort(compareText);
   return { added, removed, changed, unchanged };
 }
 function assignmentClasses(plan) {
@@ -23562,8 +23650,8 @@ function diffCompiledPlans(active, candidate, activeRevision) {
     groups: keyedDiff2(active?.groups ?? [], candidate.groups),
     assignments: { added: addedAssignments, removed: removedAssignments, reclassified },
     execution: {
-      addedNodeKeys: [...afterNodes].filter((key) => !beforeNodes.has(key)).sort(compareText7),
-      removedNodeKeys: [...beforeNodes].filter((key) => !afterNodes.has(key)).sort(compareText7)
+      addedNodeKeys: [...afterNodes].filter((key) => !beforeNodes.has(key)).sort(compareText),
+      removedNodeKeys: [...beforeNodes].filter((key) => !afterNodes.has(key)).sort(compareText)
     }
   };
 }
@@ -23636,9 +23724,6 @@ function requireGroup(authoring, groupKey) {
 function unique(values) {
   return [...new Set(values)];
 }
-function compareText8(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function knownQueryIds(queryIds, context) {
   const uniqueQueryIds = unique(queryIds);
   const unknown = uniqueQueryIds.filter((queryId) => !context.queriesById.has(queryId));
@@ -23692,7 +23777,7 @@ function resolveDraftAudience(authoring, audience) {
     groups.push({ groupKey: group.stableKey, label: group.label, memberCount: memberKeys.length });
     selected.push(...memberKeys);
   }
-  const targetKeys = unique(selected).sort(compareText8);
+  const targetKeys = unique(selected).sort(compareText);
   return {
     targetKeys,
     groups,
@@ -24122,9 +24207,6 @@ var MeasurementGroupMembershipImportError = class extends Error {
   statusCode;
   details;
 };
-function compareText9(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function sha256Hex2(value) {
   return crypto20.createHash("sha256").update(value).digest("hex");
 }
@@ -24132,7 +24214,7 @@ function canonicalJsonValue2(value) {
   if (Array.isArray(value)) return value.map(canonicalJsonValue2);
   if (value && typeof value === "object") {
     return Object.fromEntries(
-      Object.entries(value).filter(([, child]) => child !== void 0).sort(([left], [right]) => compareText9(left, right)).map(([key, child]) => [key, canonicalJsonValue2(child)])
+      Object.entries(value).filter(([, child]) => child !== void 0).sort(([left], [right]) => compareText(left, right)).map(([key, child]) => [key, canonicalJsonValue2(child)])
     );
   }
   return value;
@@ -24429,8 +24511,8 @@ function groupIdentities(rows, authoring, segments) {
     groupsByLabel.set(label, matches);
   }
   const identities = [];
-  for (const normalizedGroupLabel of [...labels.keys()].sort(compareText9)) {
-    const existing = [...groupsByLabel.get(normalizedGroupLabel) ?? []].sort((left, right) => compareText9(left.stableKey, right.stableKey));
+  for (const normalizedGroupLabel of [...labels.keys()].sort(compareText)) {
+    const existing = [...groupsByLabel.get(normalizedGroupLabel) ?? []].sort((left, right) => compareText(left.stableKey, right.stableKey));
     if (existing.length > 1) {
       identities.push({
         kind: "ambiguous",
@@ -24508,8 +24590,8 @@ function groupChangesFromRows(rows, identities) {
     bucket.rows.push(row);
     byGroupKey.set(row.groupKey, bucket);
   }
-  return [...byGroupKey.values()].sort((left, right) => compareText9(left.identity.normalizedGroupLabel, right.identity.normalizedGroupLabel)).map(({ identity, rows: matchedRows }) => {
-    const targetKeys = [...new Set(matchedRows.map((row) => row.targetKey))].sort(compareText9);
+  return [...byGroupKey.values()].sort((left, right) => compareText(left.identity.normalizedGroupLabel, right.identity.normalizedGroupLabel)).map(({ identity, rows: matchedRows }) => {
+    const targetKeys = sortedUnique(matchedRows.map((row) => row.targetKey));
     const addedTargetKeys = targetKeys.filter((targetKey) => !identity.existingTargetKeys.has(targetKey));
     const unchangedTargetKeys = targetKeys.filter((targetKey) => identity.existingTargetKeys.has(targetKey));
     return {
@@ -24573,7 +24655,7 @@ function resolveRows(parsedRows, authoring, identities) {
       resolved.push(rowFailure(row, "invalid", "missing-group"));
       continue;
     }
-    const labelCandidates = [...targetsByLabel.get(row.normalizedProperty) ?? []].sort((left, right) => compareText9(left.stableKey, right.stableKey));
+    const labelCandidates = [...targetsByLabel.get(row.normalizedProperty) ?? []].sort((left, right) => compareText(left.stableKey, right.stableKey));
     if (!labelCandidates.length) {
       resolved.push(rowFailure(row, "unmatched", "property-not-found"));
       continue;
@@ -24654,7 +24736,7 @@ function resolveArtifacts(input) {
   return { rows, groupChanges, counts: countsFromRows(rows, groupChanges), identities };
 }
 function checksumIdentities(identities) {
-  return [...identities].sort((left, right) => compareText9(left.normalizedGroupLabel, right.normalizedGroupLabel)).map((identity) => {
+  return [...identities].sort((left, right) => compareText(left.normalizedGroupLabel, right.normalizedGroupLabel)).map((identity) => {
     if (identity.kind === "ready") {
       return {
         normalizedGroupLabel: identity.normalizedGroupLabel,
@@ -24668,7 +24750,7 @@ function checksumIdentities(identities) {
       return {
         normalizedGroupLabel: identity.normalizedGroupLabel,
         outcome: identity.kind,
-        groupKeys: [...identity.groupKeys].sort(compareText9)
+        groupKeys: [...identity.groupKeys].sort(compareText)
       };
     }
     return {
@@ -24676,8 +24758,8 @@ function checksumIdentities(identities) {
       outcome: identity.kind,
       groupKey: identity.groupKey,
       evidence: [...identity.evidence].sort((left, right) => {
-        const bySource = compareText9(left.source, right.source);
-        return bySource || compareText9(left.normalizedGroupLabel ?? "", right.normalizedGroupLabel ?? "");
+        const bySource = compareText(left.source, right.source);
+        return bySource || compareText(left.normalizedGroupLabel ?? "", right.normalizedGroupLabel ?? "");
       })
     };
   });
@@ -24697,7 +24779,7 @@ function resolveGroupMembershipPreview(input) {
     })),
     rows: artifacts.rows,
     proposedGroups: checksumIdentities(artifacts.identities),
-    persistedSegments: [...input.segments].sort((left, right) => compareText9(left.stableKey, right.stableKey)).map((segment) => ({ stableKey: segment.stableKey, kind: segment.kind, retiredAt: segment.retiredAt }))
+    persistedSegments: [...input.segments].sort((left, right) => compareText(left.stableKey, right.stableKey)).map((segment) => ({ stableKey: segment.stableKey, kind: segment.kind, retiredAt: segment.retiredAt }))
   });
   return {
     draftEtag: input.draftEtag,
@@ -24825,9 +24907,6 @@ function applyReviewedGroupMembership(authoring, preview, review) {
 
 // ../api-routes/src/measurement-draft.ts
 var MEASUREMENT_GROUP_MEMBERSHIP_BODY_LIMIT = MEASUREMENT_GROUP_MEMBERSHIP_CSV_MAX_BYTES * 7 + 4096;
-function compareText10(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function authoringIdentity(authoring) {
   return canonicalJson(authoring);
 }
@@ -24896,7 +24975,7 @@ function emptyAuthoring(project, opts) {
     defaultContext: {
       providers,
       ...Object.keys(models).length ? { models } : {},
-      locations: project.locations.map((location) => location.label).sort(compareText10)
+      locations: project.locations.map((location) => location.label).sort(compareText)
     },
     targets: [],
     assignments: [],
@@ -25106,7 +25185,7 @@ function pageLimit(value) {
 }
 function paginate(rows, query, sortKey, searchable) {
   const needle = query.search?.trim().toLowerCase();
-  const filtered = (needle ? rows.filter((row) => searchable(row).toLowerCase().includes(needle)) : [...rows]).sort((left, right) => compareText10(sortKey(left), sortKey(right)));
+  const filtered = (needle ? rows.filter((row) => searchable(row).toLowerCase().includes(needle)) : [...rows]).sort((left, right) => compareText(sortKey(left), sortKey(right)));
   const after = query.cursor ? Buffer.from(query.cursor, "base64url").toString("utf8") : null;
   const remaining = after === null ? filtered : filtered.filter((row) => sortKey(row) > after);
   const limit = pageLimit(query.limit);
@@ -26112,22 +26191,22 @@ function proposeMeasurementDiscoveryBindings(input) {
     if (excluded.has(candidate.slug) || excluded.has(identity.toLowerCase())) continue;
     const parts = parseMeasurementDiscoveryIdentity(identity);
     if (!parts) continue;
-    const candidates = missing.map((entry) => ({ targetKey: entry.target.stableKey, score: rebindScore(parts, entry.parts) })).filter((entry) => entry.score > MEASUREMENT_REBIND_THRESHOLD).sort((left, right) => right.score - left.score || compareText11(left.targetKey, right.targetKey));
+    const candidates = missing.map((entry) => ({ targetKey: entry.target.stableKey, score: rebindScore(parts, entry.parts) })).filter((entry) => entry.score > MEASUREMENT_REBIND_THRESHOLD).sort((left, right) => right.score - left.score || compareText(left.targetKey, right.targetKey));
     proposals.push({
       discoveryIdentity: identity,
       stableKey: candidate.stableKey,
       slug: candidate.slug,
       label: candidate.label,
       discoveredUrl: candidate.primaryUrl,
-      urlMatchers: [.../* @__PURE__ */ new Set([candidate.primaryUrl, ...candidate.aliasCoverageUrls])].sort(compareText11),
+      urlMatchers: sortedUnique([candidate.primaryUrl, ...candidate.aliasCoverageUrls]),
       kind: candidates.length === 1 ? "rebind" : candidates.length === 0 ? "new-target" : "ambiguous",
       ...candidates.length === 1 ? { rebindTargetKey: candidates[0].targetKey } : {},
       candidates
     });
   }
   return {
-    proposals: proposals.sort((left, right) => compareText11(left.discoveryIdentity, right.discoveryIdentity)),
-    unchanged: input.targets.filter((target) => target.discoveryIdentity !== void 0 && present.has(target.discoveryIdentity)).map((target) => target.stableKey).sort(compareText11)
+    proposals: proposals.sort((left, right) => compareText(left.discoveryIdentity, right.discoveryIdentity)),
+    unchanged: input.targets.filter((target) => target.discoveryIdentity !== void 0 && present.has(target.discoveryIdentity)).map((target) => target.stableKey).sort(compareText)
   };
 }
 function rebindScore(left, right) {
@@ -26150,15 +26229,12 @@ function normalizePathTemplate(value) {
 function hostOfUrl(value) {
   return normalizeMeasurementHost(new URL(value).hostname);
 }
-function compareText11(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
 function canonicalJson2(value) {
   const canonical = (input) => {
     if (Array.isArray(input)) return input.map(canonical);
     if (input && typeof input === "object") {
       return Object.fromEntries(
-        Object.entries(input).filter(([, child]) => child !== void 0).sort(([left], [right]) => compareText11(left, right)).map(([key, child]) => [key, canonical(child)])
+        Object.entries(input).filter(([, child]) => child !== void 0).sort(([left], [right]) => compareText(left, right)).map(([key, child]) => [key, canonical(child)])
       );
     }
     return input;
@@ -26173,20 +26249,10 @@ function measurementDiscoveryInputChecksum(input) {
     compilerVersion: MEASUREMENT_DISCOVERY_COMPILER_VERSION,
     sitemapUrl: input.sitemapUrl,
     rule: input.rule,
-    exclusions: [...new Set(input.exclusions.map((value) => value.trim().toLowerCase()))].sort(compareText11),
+    exclusions: sortedUnique(input.exclusions.map((value) => value.trim().toLowerCase())),
     bytesChecksum: input.bytesChecksum
   }));
 }
-function draftCounts2(authoring) {
-  return {
-    targets: authoring.targets.length,
-    includedTargets: authoring.targets.filter((target) => target.status === "included").length,
-    assignments: authoring.assignments.length,
-    unclassifiedAssignments: authoring.assignments.filter((assignment) => assignment.queryClass === "unclassified").length,
-    groups: authoring.groups.length,
-    competitors: authoring.groups.reduce((total, group) => total + group.competitors.length, 0)
-  };
-}
 function loadDraft(app, projectId, projectName) {
   const row = app.db.select().from(measurementPlanDrafts).where(eq32(measurementPlanDrafts.projectId, projectId)).get();
   if (!row) throw notFound("Measurement plan draft", projectName);
@@ -26243,7 +26309,7 @@ function commitDraft(app, input) {
     etag: measurementDraftEtag(etagVersion),
     changed: input.changed,
     warnings: input.warnings,
-    counts: draftCounts2(authoring.data)
+    counts: draftCounts(authoring.data)
   });
   const actor = actorReference(input.request);
   app.db.transaction((tx) => {
@@ -26346,7 +26412,7 @@ async function measurementDiscoveryV2Routes(app) {
     if (!parsed.success) {
       throw validationError("Invalid sitemap import request", { issues: parsed.error.issues });
     }
-    const exclusions = [...new Set((parsed.data.exclusions ?? []).map((value) => value.trim().toLowerCase()))].sort(compareText11);
+    const exclusions = sortedUnique((parsed.data.exclusions ?? []).map((value) => value.trim().toLowerCase()));
     const idempotencyKey = requireIdempotencyKey2(request, "import-sitemap");
     const requestChecksum2 = sha2562(canonicalJson2({ ...parsed.data, exclusions }));
     const replay = replayedResponse(app, project.id, "import-sitemap", idempotencyKey, requestChecksum2);
@@ -26491,7 +26557,7 @@ async function measurementDiscoveryV2Routes(app) {
       const rebound = {
         ...existing,
         ...relabelled,
-        urlMatchers: [.../* @__PURE__ */ new Set([...existing.urlMatchers, ...proposal.urlMatchers])].sort(compareText11),
+        urlMatchers: sortedUnique([...existing.urlMatchers, ...proposal.urlMatchers]),
         discoveredUrl: proposal.discoveredUrl,
         discoveryIdentity: proposal.discoveryIdentity
       };
@@ -26549,15 +26615,12 @@ function parseEvidenceQuery(raw) {
   }
   return parsed.data;
 }
-function normalizedText2(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function filterFingerprint(query) {
   const filters = {
     targetKey: query.targetKey,
     queryClass: query.queryClass ?? "all",
-    provider: query.provider === void 0 ? null : normalizedText2(query.provider),
-    location: query.location === void 0 ? null : normalizedText2(query.location)
+    provider: query.provider === void 0 ? null : normalizeIdentityText(query.provider),
+    location: query.location === void 0 ? null : normalizeIdentityText(query.location)
   };
   return createHash5("sha256").update(JSON.stringify(filters)).digest("base64url");
 }
@@ -26619,7 +26682,7 @@ function propertyEvidenceRows(db, plan, active, run, query, queryClass) {
   const manifest = measurementRunExpectedSlots(run, plan);
   const { input, edgeQueryClass } = buildMeasurementPlanV2ReportInput(active.version.revision, plan, manifest, snapshots);
   const ownEdgeIds = new Set(input.usageEdges.filter((edge) => edge.type === "target" && edge.targetId === query.targetKey).filter((edge) => queryClass === "all" || edgeQueryClass.get(edge.id) === queryClass).map((edge) => edge.id));
-  const provider = query.provider === void 0 ? void 0 : normalizedText2(query.provider);
+  const provider = query.provider === void 0 ? void 0 : normalizeIdentityText(query.provider);
   const location = query.location === void 0 ? void 0 : normalizeMeasurementLocation(query.location);
   const owned = (row) => ownEdgeIds.has(row.usageEdgeId) && (provider === void 0 || row.provider === provider) && (location === void 0 || normalizeMeasurementLocation(row.location) === location);
   const built = buildMeasurementEvidence(input);
@@ -26734,12 +26797,6 @@ var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   RunStatuses.partial
 ]);
 var { rawResponse: omittedRawResponse, ...measurementQuestionSnapshotColumns } = getTableColumns(querySnapshots);
-function compareText12(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-function normalizeText(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function excerptOf(answer) {
   const normalized = answer.normalize("NFKC").trim().replace(/\s+/g, " ");
   return normalized.length <= 240 ? normalized : normalized.slice(0, 240);
@@ -26826,16 +26883,16 @@ function selectMeasurementQuestionRun(db, projectId, active, runId) {
   return run;
 }
 function slotKey(executionId, provider) {
-  return `${executionId}\0${normalizeText(provider)}`;
+  return `${executionId}\0${normalizeIdentityText(provider)}`;
 }
 function scopedManifest(manifest, scope) {
   if (scope === void 0) return manifest;
   const executionIds = new Set(scope.executionIds);
-  const provider = scope.provider === void 0 ? void 0 : normalizeText(scope.provider);
+  const provider = scope.provider === void 0 ? void 0 : normalizeIdentityText(scope.provider);
   const location = scope.location === void 0 ? void 0 : normalizeMeasurementLocation(scope.location);
   return {
     ...manifest,
-    expectedSlots: manifest.expectedSlots.filter((slot) => executionIds.has(slot.executionId) && (provider === void 0 || normalizeText(slot.provider) === provider) && (location === void 0 || normalizeMeasurementLocation(slot.context?.label ?? null) === location))
+    expectedSlots: manifest.expectedSlots.filter((slot) => executionIds.has(slot.executionId) && (provider === void 0 || normalizeIdentityText(slot.provider) === provider) && (location === void 0 || normalizeMeasurementLocation(slot.context?.label ?? null) === location))
   };
 }
 function selectedQuestionSnapshots(db, runId, manifest, scope) {
@@ -26846,7 +26903,7 @@ function selectedQuestionSnapshots(db, runId, manifest, scope) {
     conditions.push(inArray15(querySnapshots.measurementExecutionId, executionIds));
   }
   if (scope?.provider !== void 0) {
-    conditions.push(sql12`lower(trim(${querySnapshots.provider})) = ${normalizeText(scope.provider)}`);
+    conditions.push(sql12`lower(trim(${querySnapshots.provider})) = ${normalizeIdentityText(scope.provider)}`);
   }
   return db.select(measurementQuestionSnapshotColumns).from(querySnapshots).where(and26(...conditions)).all();
 }
@@ -26921,7 +26978,7 @@ function questionRows(plan, target, materialized, filters = {}) {
   for (const slot of materialized.input.expectedSlots) {
     const assignment = assignmentsByExecution.get(slot.executionId);
     if (!assignment) continue;
-    if (filters.provider !== void 0 && normalizeText(slot.provider) !== normalizeText(filters.provider)) continue;
+    if (filters.provider !== void 0 && normalizeIdentityText(slot.provider) !== normalizeIdentityText(filters.provider)) continue;
     if (filters.location !== void 0 && normalizeMeasurementLocation(slot.location) !== normalizeMeasurementLocation(filters.location)) continue;
     const question = queryById.get(assignment.queryId);
     const manifestSlot = materialized.manifestSlotsByIdentity.get(slotKey(slot.executionId, slot.provider));
@@ -26958,7 +27015,7 @@ function questionRows(plan, target, materialized, filters = {}) {
     const key = `${row.queryId}\0${row.provider}\0${row.location ?? ""}`;
     if (!deduped.has(key)) deduped.set(key, row);
   }
-  return [...deduped.values()].sort((left, right) => compareText12(left.queryId, right.queryId) || compareText12(left.provider, right.provider) || compareText12(left.location ?? "", right.location ?? "") || compareText12(left.text, right.text));
+  return [...deduped.values()].sort((left, right) => compareText(left.queryId, right.queryId) || compareText(left.provider, right.provider) || compareText(left.location ?? "", right.location ?? "") || compareText(left.text, right.text));
 }
 function recommendedInstead(candidates, target) {
   const ownNames = new Set([target.label, ...target.aliases].map(brandKeyFromText).filter((key) => key.length > 0));
@@ -27095,12 +27152,6 @@ async function measurementQuestionReadRoutes(app) {
 
 // ../api-routes/src/measurement-portfolio-reads.ts
 var DEFAULT_LIMIT3 = 10;
-function compareText13(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-function normalizeText2(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function parseLimitQuery(raw, schema, message) {
   const candidate = { ...raw, ...raw.limit === void 0 ? {} : { limit: Number(raw.limit) } };
   const parsed = schema.safeParse(candidate);
@@ -27173,9 +27224,9 @@ function materializeWithDb(db, active, plan, run) {
   return materializeMeasurementQuestionRun(db, active, plan, run);
 }
 function filteredEvaluator(materialized, filters, targetKeys) {
-  const provider = filters.provider === void 0 ? void 0 : normalizeText2(filters.provider);
+  const provider = filters.provider === void 0 ? void 0 : normalizeIdentityText(filters.provider);
   const location = filters.location === void 0 ? void 0 : normalizeMeasurementLocation(filters.location);
-  const expectedSlots = materialized.input.expectedSlots.filter((slot) => (provider === void 0 || normalizeText2(slot.provider) === provider) && (location === void 0 || normalizeMeasurementLocation(slot.location) === location));
+  const expectedSlots = materialized.input.expectedSlots.filter((slot) => (provider === void 0 || normalizeIdentityText(slot.provider) === provider) && (location === void 0 || normalizeMeasurementLocation(slot.location) === location));
   const usageEdges = materialized.input.usageEdges.filter((edge) => filters.queryClass === "all" || materialized.edgeQueryClass.get(edge.id) === filters.queryClass);
   return createMeasurementOverviewEvaluator({
     ...materialized.input,
@@ -27230,12 +27281,12 @@ function createTargetAnswerReader(plan, materialized, filters) {
   }
   const incompleteObservationIds = new Set(materialized.evidence.diagnostics.evidenceIncompleteObservationIds);
   const questionsById = new Map(plan.querySnapshots.map((question) => [question.queryId, question.queryText]));
-  const provider = filters.provider === void 0 ? void 0 : normalizeText2(filters.provider);
+  const provider = filters.provider === void 0 ? void 0 : normalizeIdentityText(filters.provider);
   const location = filters.location === void 0 ? void 0 : normalizeMeasurementLocation(filters.location);
   const slotsByExecution = /* @__PURE__ */ new Map();
   const slotOrder = /* @__PURE__ */ new Map();
   materialized.input.expectedSlots.forEach((slot, index2) => {
-    if (provider !== void 0 && normalizeText2(slot.provider) !== provider) return;
+    if (provider !== void 0 && normalizeIdentityText(slot.provider) !== provider) return;
     if (location !== void 0 && normalizeMeasurementLocation(slot.location) !== location) return;
     pushTo(slotsByExecution, slot.executionId, slot);
     slotOrder.set(slot.id, index2);
@@ -27316,7 +27367,7 @@ function domainRows(answers, limit, readHost = createCitedHostReader()) {
     const domains = new Set(answerDomains(answer, readHost).values());
     for (const domain of domains) counts2.set(domain, (counts2.get(domain) ?? 0) + 1);
   }
-  const rows = [...counts2].map(([domain, count6]) => ({ domain, answers: count6 })).sort((left, right) => right.answers - left.answers || compareText13(left.domain, right.domain));
+  const rows = [...counts2].map(([domain, count6]) => ({ domain, answers: count6 })).sort((left, right) => right.answers - left.answers || compareText(left.domain, right.domain));
   return { rows: rows.slice(0, limit), total: rows.length };
 }
 function targetAliasKeys(target) {
@@ -27341,7 +27392,7 @@ function recommendationRows(target, population) {
   forEachNameWrittenInstead(target, population.answers, (key, name, answer, firstInAnswer) => {
     const existing = grouped.get(key);
     if (existing) {
-      if (compareText13(name, existing.name) < 0) existing.name = name;
+      if (compareText(name, existing.name) < 0) existing.name = name;
       if (!firstInAnswer) return;
       existing.occurrences++;
       existing.providers.add(answer.provider);
@@ -27356,8 +27407,8 @@ function recommendationRows(target, population) {
     }
   });
   return [...grouped.values()].map((row) => {
-    const providers = [...row.providers].sort(compareText13);
-    const questions = [...row.questions].sort(compareText13);
+    const providers = [...row.providers].sort(compareText);
+    const questions = [...row.questions].sort(compareText);
     return {
       name: row.name,
       occurrences: row.occurrences,
@@ -27368,7 +27419,7 @@ function recommendationRows(target, population) {
       questionTotal: questions.length,
       questionsTruncated: questions.length > 5
     };
-  }).sort((left, right) => right.occurrences - left.occurrences || compareText13(left.name, right.name));
+  }).sort((left, right) => right.occurrences - left.occurrences || compareText(left.name, right.name));
 }
 function namedInsteadFields(names, limit = MEASUREMENT_PORTFOLIO_ROW_EVIDENCE_LIMIT) {
   const returned = names.slice(0, limit);
@@ -27388,7 +27439,7 @@ function compareWeakest(left, right) {
   const rightUnavailable = right.mentionCoverage.state === "unavailable" || right.citationCoverage.state === "unavailable";
   if (leftUnavailable !== rightUnavailable) return leftUnavailable ? 1 : -1;
   if (leftUnavailable || rightUnavailable) {
-    return compareText13(left.label, right.label) || compareText13(left.targetKey, right.targetKey);
+    return compareText(left.label, right.label) || compareText(left.targetKey, right.targetKey);
   }
   if (left.mentionCoverage.state === "available" && right.mentionCoverage.state === "available" && left.mentionCoverage.value !== right.mentionCoverage.value) {
     return left.mentionCoverage.value - right.mentionCoverage.value;
@@ -27396,7 +27447,7 @@ function compareWeakest(left, right) {
   if (left.citationCoverage.state === "available" && right.citationCoverage.state === "available" && left.citationCoverage.value !== right.citationCoverage.value) {
     return left.citationCoverage.value - right.citationCoverage.value;
   }
-  return compareText13(left.label, right.label) || compareText13(left.targetKey, right.targetKey);
+  return compareText(left.label, right.label) || compareText(left.targetKey, right.targetKey);
 }
 function requireGroup2(plan, groupKey) {
   const group = plan.groups.find((candidate) => candidate.stableKey === groupKey);
@@ -27498,14 +27549,14 @@ function compareWeakestMarket(a, b) {
   const aUnavailable = a.mentionCoverage.state === "unavailable" || a.citationCoverage.state === "unavailable";
   const bUnavailable = b.mentionCoverage.state === "unavailable" || b.citationCoverage.state === "unavailable";
   if (aUnavailable !== bUnavailable) return aUnavailable ? 1 : -1;
-  if (aUnavailable || bUnavailable) return compareText13(a.label, b.label) || compareText13(a.groupKey, b.groupKey);
+  if (aUnavailable || bUnavailable) return compareText(a.label, b.label) || compareText(a.groupKey, b.groupKey);
   if (a.mentionCoverage.state === "available" && b.mentionCoverage.state === "available" && a.mentionCoverage.value !== b.mentionCoverage.value) {
     return a.mentionCoverage.value - b.mentionCoverage.value;
   }
   if (a.citationCoverage.state === "available" && b.citationCoverage.state === "available" && a.citationCoverage.value !== b.citationCoverage.value) {
     return a.citationCoverage.value - b.citationCoverage.value;
   }
-  return compareText13(a.label, b.label) || compareText13(a.groupKey, b.groupKey);
+  return compareText(a.label, b.label) || compareText(a.groupKey, b.groupKey);
 }
 function mentionRanking(rows, limit) {
   const eligible = [];
@@ -27526,7 +27577,7 @@ function mentionRanking(rows, limit) {
       });
     }
   }
-  const byLabel = (a, b) => compareText13(a.label, b.label) || compareText13(a.targetKey, b.targetKey);
+  const byLabel = (a, b) => compareText(a.label, b.label) || compareText(a.targetKey, b.targetKey);
   const byRate = (direction) => (a, b) => direction * (a.mentionCoverage.value - b.mentionCoverage.value) || byLabel(a, b);
   return {
     eligiblePropertyCount: eligible.length,
@@ -27676,7 +27727,7 @@ function compactPortfolioPage(response, query, versionId, evidence, cursor) {
 function portfolioAnswerEvidence(plan, materialized, filters, targetKeys) {
   const targets = new Set(targetKeys);
   const executions = new Set(plan.assignments.filter((assignment) => targets.has(assignment.targetKey) && (filters.queryClass === "all" || assignment.queryClass === filters.queryClass)).map((assignment) => assignment.executionNodeKey));
-  const slots = materialized.input.expectedSlots.filter((slot) => executions.has(slot.executionId) && (filters.provider === void 0 || normalizeText2(slot.provider) === normalizeText2(filters.provider)) && (filters.location === void 0 || normalizeMeasurementLocation(slot.location) === normalizeMeasurementLocation(filters.location)));
+  const slots = materialized.input.expectedSlots.filter((slot) => executions.has(slot.executionId) && (filters.provider === void 0 || normalizeIdentityText(slot.provider) === normalizeIdentityText(filters.provider)) && (filters.location === void 0 || normalizeMeasurementLocation(slot.location) === normalizeMeasurementLocation(filters.location)));
   const mentionsBySlot = /* @__PURE__ */ new Map();
   for (const answer of materialized.evidence.answers) pushTo(mentionsBySlot, answer.expectedSlotId, answer.mentioned);
   const selected = [];
@@ -27818,7 +27869,7 @@ function portfolioResponse(db, active, plan, query, ownDomains) {
     },
     measurement,
     queryClass: query.queryClass,
-    engines: [...engines].sort(compareText13),
+    engines: [...engines].sort(compareText),
     metrics: {
       propertiesMentioned: countMetric2(overview.propertiesMentioned),
       propertiesNeverMentioned: neverMentionedMetric(overview.propertiesMentioned, targetKeys.length),
@@ -27885,7 +27936,7 @@ function tieByMetro(rows) {
     add(row.metro);
     for (const other of row.otherMetros ?? []) add(other);
   }
-  return [...counts2.values()].sort((left, right) => right.count - left.count || (left.metro === null ? 1 : 0) - (right.metro === null ? 1 : 0) || compareText13(left.metro?.label ?? "", right.metro?.label ?? "") || compareText13(left.metro?.groupKey ?? "", right.metro?.groupKey ?? "")).map(({ metro, count: count6 }) => ({ metro: metro?.label ?? null, count: count6 }));
+  return [...counts2.values()].sort((left, right) => right.count - left.count || (left.metro === null ? 1 : 0) - (right.metro === null ? 1 : 0) || compareText(left.metro?.label ?? "", right.metro?.label ?? "") || compareText(left.metro?.groupKey ?? "", right.metro?.groupKey ?? "")).map(({ metro, count: count6 }) => ({ metro: metro?.label ?? null, count: count6 }));
 }
 function tieNamedInstead(rows) {
   const grouped = /* @__PURE__ */ new Map();
@@ -27893,14 +27944,14 @@ function tieNamedInstead(rows) {
     forEachNameWrittenInstead(target, population.answers, (key, name, answer) => {
       const existing = grouped.get(key);
       if (existing) {
-        if (compareText13(name, existing.name) < 0) existing.name = name;
+        if (compareText(name, existing.name) < 0) existing.name = name;
         existing.answers.add(answer.snapshot.id);
       } else {
         grouped.set(key, { name, answers: /* @__PURE__ */ new Set([answer.snapshot.id]) });
       }
     });
   }
-  const counted = [...grouped.values()].map((row) => ({ name: row.name, answers: row.answers.size })).sort((left, right) => right.answers - left.answers || compareText13(left.name, right.name));
+  const counted = [...grouped.values()].map((row) => ({ name: row.name, answers: row.answers.size })).sort((left, right) => right.answers - left.answers || compareText(left.name, right.name));
   return { rows: counted.slice(0, MEASUREMENT_PORTFOLIO_TIE_NAMED_INSTEAD_LIMIT), total: counted.length };
 }
 function weakestAnswerSources(rows, ownDomains) {
@@ -28007,10 +28058,10 @@ function scopeKey(run) {
   if (run.measurementScope === null) return "full";
   const scope = run.measurementScope;
   return JSON.stringify({
-    groups: [...scope.groups].sort(compareText13),
-    targets: [...scope.targets].sort(compareText13),
-    queries: [...scope.queries].sort(compareText13),
-    resolvedTargets: [...scope.resolvedTargets].sort(compareText13)
+    groups: [...scope.groups].sort(compareText),
+    targets: [...scope.targets].sort(compareText),
+    queries: [...scope.queries].sort(compareText),
+    resolvedTargets: [...scope.resolvedTargets].sort(compareText)
   });
 }
 function previousComparableRun(db, active, current) {
@@ -28142,7 +28193,7 @@ function classifyPropertyMove(mention, citation) {
   };
 }
 function compareChangeLabel(left, right) {
-  return compareText13(left.row.label, right.row.label) || compareText13(left.row.targetKey, right.row.targetKey);
+  return compareText(left.row.label, right.row.label) || compareText(left.row.targetKey, right.row.targetKey);
 }
 function compareChangeMagnitude(left, right) {
   const larger = (move) => Math.max(move.mentionSize, move.citationSize);
@@ -28320,11 +28371,11 @@ function qualityResponse(db, active, plan, query) {
     const materialized = materializeWithDb(db, active, plan, run);
     const expected = materialized.manifest.expectedSlots.length;
     const snapshots = materialized.snapshots;
-    const expectedSlotKeys = new Set(materialized.manifest.expectedSlots.map((slot) => `${slot.executionId}\0${normalizeText2(slot.provider)}`));
+    const expectedSlotKeys = new Set(materialized.manifest.expectedSlots.map((slot) => `${slot.executionId}\0${normalizeIdentityText(slot.provider)}`));
     const observedSlotKeys = /* @__PURE__ */ new Set();
     for (const snapshot of snapshots) {
       if (snapshot.measurementExecutionId === null) throw new Error("stored result has no frozen execution identity");
-      const key = `${snapshot.measurementExecutionId}\0${normalizeText2(snapshot.provider)}`;
+      const key = `${snapshot.measurementExecutionId}\0${normalizeIdentityText(snapshot.provider)}`;
       if (!expectedSlotKeys.has(key) || observedSlotKeys.has(key)) {
         throw new Error("stored results do not map one-to-one to the frozen manifest");
       }
@@ -28515,16 +28566,10 @@ var VisibilityReportScopeError = class extends Error {
   }
 };
 var ALL_CLASSES = ["branded", "non-brand", "unknown"];
-function compareText14(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-function normalizeText3(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function locationMatches(location, selected) {
   if (selected.kind === "all") return true;
   if (selected.kind === "none") return location === null;
-  return location !== null && normalizeText3(location) === normalizeText3(selected.value);
+  return location !== null && normalizeIdentityText(location) === normalizeIdentityText(selected.value);
 }
 function selectedClasses(value) {
   return value === "all" ? ALL_CLASSES : [value];
@@ -28580,15 +28625,15 @@ function scopeResolution(definition, selection) {
 }
 function scopeTargetKeys(definition, selection) {
   const resolution = scopeResolution(definition, selection);
-  if (resolution.market !== void 0) return [...new Set(definition.edges.filter((edge) => resolution.edgeIds.has(edge.id)).map((edge) => edge.targetKey))].sort(compareText14);
-  if (selection.scope === "project") return definition.targets.map((target) => target.id).sort(compareText14);
+  if (resolution.market !== void 0) return sortedUnique(definition.edges.filter((edge) => resolution.edgeIds.has(edge.id)).map((edge) => edge.targetKey));
+  if (selection.scope === "project") return definition.targets.map((target) => target.id).sort(compareText);
   if (selection.scope === "property") return [resolution.option.id];
   if (selection.scope === "group") {
     const group = definition.groups.find((candidate) => candidate.id === resolution.option.id);
     if (!group) throw new VisibilityReportScopeError(`Group "${resolution.option.id}" is not in this frozen definition.`, { reason: VisibilityReportScopeErrorReasons["retired-scope"], kind: "group", key: resolution.option.id });
-    return [...group.targetKeys].sort(compareText14);
+    return [...group.targetKeys].sort(compareText);
   }
-  return [...new Set(definition.edges.filter((edge) => resolution.edgeIds.has(edge.id)).map((edge) => edge.targetKey))].sort(compareText14);
+  return sortedUnique(definition.edges.filter((edge) => resolution.edgeIds.has(edge.id)).map((edge) => edge.targetKey));
 }
 function observationIndex(run) {
   const index2 = /* @__PURE__ */ new Map();
@@ -28624,16 +28669,16 @@ function candidatesFor(run, selection, queryClass) {
       bySlot.set(slot.id, list);
     }
   }
-  const provider = selection.provider === void 0 ? void 0 : normalizeText3(selection.provider);
-  const model = selection.model === void 0 ? void 0 : normalizeText3(selection.model);
+  const provider = selection.provider === void 0 ? void 0 : normalizeIdentityText(selection.provider);
+  const model = selection.model === void 0 ? void 0 : normalizeIdentityText(selection.model);
   const candidates = [];
   for (const [slotId, edges] of bySlot) {
     const slot = slotsById.get(slotId);
     if (!slot) throw new Error(`Frozen slot ${slotId} disappeared during reconstruction`);
     const observation = observations.get(slot.id) ?? null;
-    if (provider !== void 0 && normalizeText3(slot.provider) !== provider) continue;
+    if (provider !== void 0 && normalizeIdentityText(slot.provider) !== provider) continue;
     if (!locationMatches(slot.location, selection.location)) continue;
-    if (model !== void 0 && (observation === null || observation.model === null || normalizeText3(observation.model) !== model)) continue;
+    if (model !== void 0 && (observation === null || observation.model === null || normalizeIdentityText(observation.model) !== model)) continue;
     candidates.push({ run, slot, edges, observation });
   }
   return { resolution, candidates };
@@ -28702,7 +28747,7 @@ function candidateKey(candidate) {
   return `${candidate.run.id}\0${candidate.slot.id}`;
 }
 function selectedTargetKeys(candidates) {
-  return [...new Set(candidates.flatMap((candidate) => candidate.edges.map((edge) => edge.targetKey)))].sort(compareText14);
+  return sortedUnique(candidates.flatMap((candidate) => candidate.edges.map((edge) => edge.targetKey)));
 }
 function targetMetrics(candidates, targets, targetKey) {
   const own = candidates.filter((candidate) => candidate.edges.some((edge) => edge.targetKey === targetKey));
@@ -28773,7 +28818,7 @@ function summary2(candidates, definition, populationTargetKeys = selectedTargetK
 }
 function queryRows(candidates, definition, selection) {
   const targets = targetMap(definition);
-  const narrowed = candidates.filter((candidate) => (selection.queryKey === void 0 || candidate.slot.queryKey === selection.queryKey) && (selection.queryId === void 0 || candidate.slot.queryId === selection.queryId) && (selection.search === void 0 || normalizeText3(candidate.slot.query).includes(normalizeText3(selection.search))));
+  const narrowed = candidates.filter((candidate) => (selection.queryKey === void 0 || candidate.slot.queryKey === selection.queryKey) && (selection.queryId === void 0 || candidate.slot.queryId === selection.queryId) && (selection.search === void 0 || normalizeIdentityText(candidate.slot.query).includes(normalizeIdentityText(selection.search))));
   const groups = /* @__PURE__ */ new Map();
   for (const candidate of narrowed) {
     const model = candidate.observation?.model ?? null;
@@ -28786,7 +28831,7 @@ function queryRows(candidates, definition, selection) {
     const first = rows[0];
     const value = coverageSummary(rows, definition, targets);
     return {
-      sourceSnapshotIds: [...new Set(rows.flatMap((row) => row.observation ? [row.observation.answerId] : []))].sort(compareText14),
+      sourceSnapshotIds: sortedUnique(rows.flatMap((row) => row.observation ? [row.observation.answerId] : [])),
       queryKey: first.slot.queryKey,
       queryId: first.slot.queryId,
       query: first.slot.query,
@@ -28795,14 +28840,14 @@ function queryRows(candidates, definition, selection) {
       location: first.slot.location,
       targetKeys: selectedTargetKeys(rows),
       ...(() => {
-        const marketKeys = [...new Set(rows.flatMap((row) => row.edges.flatMap((edge) => edge.marketKeys)))].sort(compareText14);
+        const marketKeys = sortedUnique(rows.flatMap((row) => row.edges.flatMap((edge) => edge.marketKeys)));
         return marketKeys.length === 0 ? {} : { marketKeys };
       })(),
       answerCount: value.answerCount,
       mentionCoverage: value.mentionCoverage,
       citationCoverage: value.citationCoverage
     };
-  }).sort((left, right) => (selection.scope === "property" && selection.marketKey === void 0 ? compareText14((left.marketKeys ?? []).join("\0"), (right.marketKeys ?? []).join("\0")) : 0) || compareText14(normalizeText3(left.query), normalizeText3(right.query)) || compareText14(left.provider, right.provider) || compareText14(left.model ?? "", right.model ?? "") || compareText14(left.location ?? "", right.location ?? "") || compareText14(left.queryKey, right.queryKey));
+  }).sort((left, right) => (selection.scope === "property" && selection.marketKey === void 0 ? compareText((left.marketKeys ?? []).join("\0"), (right.marketKeys ?? []).join("\0")) : 0) || compareText(normalizeIdentityText(left.query), normalizeIdentityText(right.query)) || compareText(left.provider, right.provider) || compareText(left.model ?? "", right.model ?? "") || compareText(left.location ?? "", right.location ?? "") || compareText(left.queryKey, right.queryKey));
 }
 function evidenceRows(candidates, definition, selection) {
   if (selection.queryKey === void 0 && selection.queryId === void 0) return [];
@@ -28830,10 +28875,10 @@ function evidenceRows(candidates, definition, selection) {
       sources: [...observation.sources],
       observedCompetitors: [...observation.observedCompetitorNames]
     };
-  }).sort((left, right) => compareText14(left.createdAt, right.createdAt) || compareText14(left.answerId, right.answerId));
+  }).sort((left, right) => compareText(left.createdAt, right.createdAt) || compareText(left.answerId, right.answerId));
 }
 function competitorRows(candidates) {
-  const domains = [...new Set(candidates.flatMap((candidate) => candidate.edges.flatMap((edge) => edge.competitorDomains)))].sort(compareText14);
+  const domains = sortedUnique(candidates.flatMap((candidate) => candidate.edges.flatMap((edge) => edge.competitorDomains)));
   return domains.map((domain) => {
     const eligible = candidates.map((candidate) => {
       const edges = candidate.edges.filter((edge) => edge.competitorDomains.includes(domain));
@@ -28864,7 +28909,7 @@ function observedCompetitorRows(candidates) {
       answersByName.set(name, answers);
     }
   }
-  return [...answersByName].map(([name, answers]) => ({ name, answerCount: answers.size })).sort((left, right) => compareText14(left.name, right.name));
+  return [...answersByName].map(([name, answers]) => ({ name, answerCount: answers.size })).sort((left, right) => compareText(left.name, right.name));
 }
 function narrowedToTargetKeys(candidate, targetKeys) {
   const edges = candidate.edges.filter((edge) => targetKeys.has(edge.targetKey));
@@ -28883,7 +28928,7 @@ function breakdown(candidates, definition, populationTargetKeys = selectedTarget
       queryCount: new Set(own.map((candidate) => candidate.slot.queryKey)).size,
       ...metrics
     };
-  }).sort((left, right) => compareText14(left.label, right.label) || compareText14(left.id, right.id));
+  }).sort((left, right) => compareText(left.label, right.label) || compareText(left.id, right.id));
   const populationTargetSet = new Set(populationTargetKeys);
   const groups = definition.groups.map((group) => ({ group, targetKeys: group.targetKeys.filter((targetKey) => populationTargetSet.has(targetKey)) })).filter(({ targetKeys }) => targetKeys.length > 0).map(({ group, targetKeys }) => {
     const groupTargetKeys = new Set(targetKeys);
@@ -28897,7 +28942,7 @@ function breakdown(candidates, definition, populationTargetKeys = selectedTarget
       mentionCoverage: metrics,
       citationCoverage: citations
     };
-  }).sort((left, right) => compareText14(left.label, right.label) || compareText14(left.id, right.id));
+  }).sort((left, right) => compareText(left.label, right.label) || compareText(left.id, right.id));
   return { properties, groups };
 }
 function fingerprint(value) {
@@ -28974,16 +29019,16 @@ function filterOptions(definition, selection, run) {
   const resolution = scopeResolution(definition, selection);
   const slots = definition.slots.filter((slot) => definition.edges.some((edge) => edge.executionId === slot.executionId && resolution.edgeIds.has(edge.id)));
   const observations = run ? observationIndex(run) : /* @__PURE__ */ new Map();
-  const providers = [...new Set(slots.map((slot) => slot.provider))].sort(compareText14);
+  const providers = sortedUnique(slots.map((slot) => slot.provider));
   const models = [...new Map(slots.flatMap((slot) => {
     const observation = observations.get(slot.id);
     return observation?.model === null || observation === void 0 ? [] : [[`${slot.provider}\0${observation.model}`, { provider: slot.provider, model: observation.model }]];
-  })).values()].sort((left, right) => compareText14(left.provider, right.provider) || compareText14(left.model, right.model));
+  })).values()].sort((left, right) => compareText(left.provider, right.provider) || compareText(left.model, right.model));
   const locations = [{ kind: "all" }];
   const seen2 = /* @__PURE__ */ new Set(["all"]);
   for (const slot of slots) {
     const value = slot.location === null ? { kind: "none" } : { kind: "exact", value: slot.location };
-    const key = value.kind === "exact" ? `exact:${normalizeText3(value.value)}` : value.kind;
+    const key = value.kind === "exact" ? `exact:${normalizeIdentityText(value.value)}` : value.kind;
     if (!seen2.has(key)) {
       seen2.add(key);
       locations.push(value);
@@ -29074,7 +29119,7 @@ function emptyPopulation(queryClass, definition, input) {
   };
 }
 function buildVisibilityReport(input) {
-  const runs2 = input.runs.filter((run) => !run.probe && inTime(run, input.selection)).sort((left, right) => compareText14(left.createdAt, right.createdAt) || compareText14(left.id, right.id));
+  const runs2 = input.runs.filter((run) => !run.probe && inTime(run, input.selection)).sort((left, right) => compareText(left.createdAt, right.createdAt) || compareText(left.id, right.id));
   const selectedRun = input.selection.runId === void 0 ? input.preferredRunId === void 0 ? runs2.at(-1) : runs2.find((run) => run.id === input.preferredRunId) : runs2.find((run) => run.id === input.selection.runId);
   const definition = selectedRun?.definition ?? input.activeDefinition;
   const selectedResolution = scopeResolution(definition, input.selection);
@@ -29208,9 +29253,6 @@ function visibilityComparisonPopulation(run, selection) {
 }
 
 // ../api-routes/src/visibility-report.ts
-function normalizedText3(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function observedCompetitorNames2(values) {
   const names = [];
   const seen2 = /* @__PURE__ */ new Set();
@@ -29294,7 +29336,7 @@ function competitorSignals(snapshot, matchers, preparedAnswerText = preparedAnsw
     try {
       return normalizeMeasurementHost(value);
     } catch {
-      return normalizedText3(value);
+      return normalizeIdentityText(value);
     }
   }));
   const cited = [...matchers.keys()].filter((domain) => citedDomains.has(normalizeMeasurementHost(domain)));
@@ -29462,7 +29504,7 @@ function stableSimpleDefinitionId(definition) {
   return `simple:${createHash8("sha256").update(JSON.stringify(source)).digest("hex")}`;
 }
 function simpleModelFingerprint(definition) {
-  const engines = [...definition.engines].map((engine) => ({ provider: normalizedText3(engine.provider), requestedModel: engine.requestedModel })).sort((left, right) => left.provider.localeCompare(right.provider, "en"));
+  const engines = [...definition.engines].map((engine) => ({ provider: normalizeIdentityText(engine.provider), requestedModel: engine.requestedModel })).sort((left, right) => left.provider.localeCompare(right.provider, "en"));
   return `simple-model:${createHash8("sha256").update(JSON.stringify(engines)).digest("hex")}`;
 }
 function frozenSimpleRun(run, definition, snapshots, includeEvidence = true) {
@@ -29479,21 +29521,21 @@ function frozenSimpleRun(run, definition, snapshots, includeEvidence = true) {
     matches.push(query);
     queriesByText.set(query.queryText, matches);
   }
-  const enginesByProvider = new Map(definition.engines.map((engine) => [normalizedText3(engine.provider), engine]));
+  const enginesByProvider = new Map(definition.engines.map((engine) => [normalizeIdentityText(engine.provider), engine]));
   const competitors2 = definition.competitors === void 0 ? null : frozenCompetitorMatchers(definition.competitors);
   const slots = definition.queries.flatMap((query) => definition.engines.map((engine) => ({
-    id: `slot:simple:${query.queryId}:${normalizedText3(engine.provider)}`,
+    id: `slot:simple:${query.queryId}:${normalizeIdentityText(engine.provider)}`,
     executionId: `simple:${query.queryId}`,
     queryKey: query.queryId,
     queryId: query.queryId,
     query: query.queryText,
-    provider: normalizedText3(engine.provider),
+    provider: normalizeIdentityText(engine.provider),
     location: definition.location?.label ?? null
   })));
   const slotKeys = new Set(slots.map((slot) => slot.id));
   const observations = [];
   for (const snapshot of snapshots) {
-    const provider = normalizedText3(snapshot.provider);
+    const provider = normalizeIdentityText(snapshot.provider);
     const engine = enginesByProvider.get(provider);
     if (!engine) throw new Error(`Frozen simple definition has no provider ${snapshot.provider} for stored snapshot ${snapshot.id}`);
     const query = snapshot.queryId === null ? (() => {
@@ -29568,7 +29610,7 @@ function legacySimpleRun(project, run, snapshots, includeEvidence = true) {
     queryKey: snapshot.queryId ?? `legacy:${snapshot.queryText ?? snapshot.id}`,
     queryId: snapshot.queryId,
     query: snapshot.queryText ?? "",
-    provider: normalizedText3(snapshot.provider),
+    provider: normalizeIdentityText(snapshot.provider),
     location: snapshot.location
   }));
   return {
@@ -29937,17 +29979,11 @@ import { and as and29, desc as desc16, eq as eq37, inArray as inArray18, isNotNu
 var SOURCE_LIMIT = 100;
 var MAX_REVIEW_AGE_MS = 15 * 60 * 1e3;
 var MAX_REVIEW_FUTURE_SKEW_MS = 60 * 1e3;
-function compareText15(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-function normalizeText4(value) {
-  return value.normalize("NFKC").trim().replace(/\s+/g, " ").toLocaleLowerCase("en");
-}
 function unique2(values) {
   return [...new Set(values)];
 }
-function stableNewQueryId(projectId, normalizedText4) {
-  return `qtc_${sha256Hex(`${projectId}\0${normalizedText4}`).slice(0, 32)}`;
+function stableNewQueryId(projectId, normalizedText) {
+  return `qtc_${sha256Hex(`${projectId}\0${normalizedText}`).slice(0, 32)}`;
 }
 function providerNames(project, opts) {
   return resolveRunProviderSelection({
@@ -29981,7 +30017,7 @@ function simpleDispatchEngines(project, opts) {
     // override/configuration, just as it is in JobRunner, which also resolves
     // a retired override to the id that answers now.
     requestedModel: resolvedOverride(provider, overrides[provider]) ?? summaries.get(provider)?.model ?? null
-  })).sort((left, right) => compareText15(left.provider, right.provider));
+  })).sort((left, right) => compareText(left.provider, right.provider));
 }
 function resolvedOverride(provider, model) {
   return model === void 0 ? void 0 : resolveProviderModel(provider, model);
@@ -29992,12 +30028,12 @@ function simpleDefaultLocation(project) {
 }
 function contextKey(context) {
   const location = context.location ? [context.location.label, context.location.city, context.location.region, context.location.country, context.location.timezone ?? ""].join("\0") : "";
-  return canonicalJson({ providers: [...context.providers].sort(compareText15), models: context.models, location });
+  return canonicalJson({ providers: [...context.providers].sort(compareText), models: context.models, location });
 }
 function uniqueContexts(contexts) {
   const byKey = /* @__PURE__ */ new Map();
   for (const context of contexts) byKey.set(contextKey(context), context);
-  return [...byKey.values()].sort((left, right) => compareText15(contextKey(left), contextKey(right)));
+  return [...byKey.values()].sort((left, right) => compareText(contextKey(left), contextKey(right)));
 }
 function defaultContexts(project, opts, mode) {
   const providers = providerNames(project, opts);
@@ -30028,7 +30064,7 @@ function workspaceFingerprint(project, active, queryRows2) {
       defaultLocation: project.defaultLocation
     },
     active: active ? { id: active.version.id, revision: active.version.revision, compiledChecksum: active.version.compiledChecksum } : null,
-    queries: queryRows2.map((row) => ({ id: row.id, query: row.query, provenance: row.provenance })).sort((left, right) => compareText15(left.id, right.id))
+    queries: queryRows2.map((row) => ({ id: row.id, query: row.query, provenance: row.provenance })).sort((left, right) => compareText(left.id, right.id))
   }))}`;
 }
 function readWorkspace(db, project) {
@@ -30065,9 +30101,9 @@ function simpleExecutionSignature(input) {
   return canonicalJson({
     identity: {
       displayName: input.identity.displayName,
-      aliases: [...input.identity.aliases].sort(compareText15),
+      aliases: [...input.identity.aliases].sort(compareText),
       canonicalDomain: input.identity.canonicalDomain,
-      ownedDomains: [...input.identity.ownedDomains].sort(compareText15)
+      ownedDomains: [...input.identity.ownedDomains].sort(compareText)
     },
     country: input.country,
     language: input.language,
@@ -30075,7 +30111,7 @@ function simpleExecutionSignature(input) {
     engines: input.engines.map((engine) => ({
       provider: engine.provider.trim().toLocaleLowerCase("en"),
       requestedModel: engine.requestedModel
-    })).sort((left, right) => compareText15(left.provider, right.provider))
+    })).sort((left, right) => compareText(left.provider, right.provider))
   });
 }
 function currentSimpleExecutionSignature(project, opts) {
@@ -30338,7 +30374,7 @@ function measuredAtByQuery(db, state, opts) {
   for (const [queryId, signatures] of activeSignatures) {
     const measured = measurements.get(queryId);
     if (!measured || [...signatures].some((signature) => !measured.has(signature))) continue;
-    const latest = [...measured.values()].sort(compareText15).at(-1);
+    const latest = [...measured.values()].sort(compareText).at(-1);
     if (latest) result.set(queryId, latest);
   }
   return result;
@@ -30353,7 +30389,7 @@ function marketKeysByEdge(plan) {
       else result.set(key, [scope.stableKey]);
     }
   }
-  for (const keys of result.values()) keys.sort(compareText15);
+  for (const keys of result.values()) keys.sort(compareText);
   return result;
 }
 function trackedRows(db, state, queryRows2, plan, opts) {
@@ -30362,12 +30398,12 @@ function trackedRows(db, state, queryRows2, plan, opts) {
     return [...queryRows2.values()].map((row) => ({
       queryId: row.id,
       queryText: row.query,
-      normalizedText: normalizeText4(row.query),
+      normalizedText: normalizeIdentityText(row.query),
       provenance: parseQueryProvenance(row.provenance),
       state: measured.has(row.id) ? "tracked" : "awaiting-sweep",
       lastMeasuredAt: measured.get(row.id) ?? null,
       assignments: []
-    })).sort((left, right) => compareText15(left.normalizedText, right.normalizedText) || compareText15(left.queryId, right.queryId));
+    })).sort((left, right) => compareText(left.normalizedText, right.normalizedText) || compareText(left.queryId, right.queryId));
   }
   const snapshots = new Map(plan.querySnapshots.map((snapshot) => [snapshot.queryId, snapshot]));
   const allIds = unique2([...queryRows2.keys(), ...snapshots.keys()]);
@@ -30405,7 +30441,7 @@ function trackedRows(db, state, queryRows2, plan, opts) {
       } else {
         assignments.set(assignment.targetKey, {
           targetKey: assignment.targetKey,
-          groupKeys: [...groupsByTarget.get(assignment.targetKey) ?? []].sort(compareText15),
+          groupKeys: [...groupsByTarget.get(assignment.targetKey) ?? []].sort(compareText),
           marketKeys: [...marketsByEdge.get(edgeKey2) ?? []],
           queryClass: assignment.queryClass,
           classificationSource: source,
@@ -30416,17 +30452,17 @@ function trackedRows(db, state, queryRows2, plan, opts) {
     return {
       queryId,
       queryText,
-      normalizedText: normalizeText4(queryText),
+      normalizedText: normalizeIdentityText(queryText),
       provenance: snapshot ? provenanceFromPlan(snapshot.provenance) : parseQueryProvenance(row?.provenance ?? null),
       state: measured.has(queryId) ? "tracked" : "awaiting-sweep",
       lastMeasuredAt: measured.get(queryId) ?? null,
       assignments: [...assignments.values()].map((assignment) => ({
         ...assignment,
-        marketKeys: unique2(assignment.marketKeys).sort(compareText15),
+        marketKeys: unique2(assignment.marketKeys).sort(compareText),
         contexts: uniqueContexts(assignment.contexts)
-      })).sort((left, right) => compareText15(left.targetKey, right.targetKey))
+      })).sort((left, right) => compareText(left.targetKey, right.targetKey))
     };
-  }).sort((left, right) => compareText15(left.normalizedText, right.normalizedText) || compareText15(left.queryId, right.queryId));
+  }).sort((left, right) => compareText(left.normalizedText, right.normalizedText) || compareText(left.queryId, right.queryId));
 }
 function savedSources(db, projectId) {
   const research = db.select({
@@ -30509,9 +30545,9 @@ function resolveAudience(plan, input) {
     throw validationError("Select at least one Property, group, or market for a portfolio query.");
   }
   return {
-    targetKeys: [...targetKeys].sort(compareText15),
-    groupKeys: groupKeys.sort(compareText15),
-    marketKeys: marketKeys.sort(compareText15)
+    targetKeys: [...targetKeys].sort(compareText),
+    groupKeys: groupKeys.sort(compareText),
+    marketKeys: marketKeys.sort(compareText)
   };
 }
 function contextsFromInput(project, contexts) {
@@ -30522,7 +30558,7 @@ function contextsFromInput(project, contexts) {
     if (context.location !== null && !location) {
       throw validationError(`Execution context names a location the project does not configure: ${context.location}`);
     }
-    const providers = unique2(context.providers.map((provider) => provider.trim().toLocaleLowerCase("en")).filter(Boolean)).sort(compareText15);
+    const providers = unique2(context.providers.map((provider) => provider.trim().toLocaleLowerCase("en")).filter(Boolean)).sort(compareText);
     for (const provider of Object.keys(context.models)) {
       if (!providers.includes(provider.trim().toLocaleLowerCase("en"))) {
         throw validationError(`Model "${provider}" is not selected by this execution context.`);
@@ -30747,23 +30783,23 @@ function edgeKey(edge) {
 function queryIdsByNormalized(state) {
   const result = /* @__PURE__ */ new Map();
   for (const row of state.queryRows) {
-    const key = normalizeText4(row.query);
+    const key = normalizeIdentityText(row.query);
     const ids = result.get(key);
     if (ids) ids.push(row.id);
     else result.set(key, [row.id]);
   }
   for (const snapshot of state.active?.plan.querySnapshots ?? []) {
-    const key = normalizeText4(snapshot.queryText);
+    const key = normalizeIdentityText(snapshot.queryText);
     const ids = result.get(key);
     if (ids) ids.push(snapshot.queryId);
     else result.set(key, [snapshot.queryId]);
   }
-  for (const ids of result.values()) ids.sort(compareText15);
+  for (const ids of result.values()) ids.sort(compareText);
   return result;
 }
-function preferredQueryId(state, normalizedText4) {
-  const candidates = queryIdsByNormalized(state).get(normalizedText4) ?? [];
-  const bound = new Set((state.active?.plan.querySnapshots ?? []).filter((snapshot) => normalizeText4(snapshot.queryText) === normalizedText4).map((snapshot) => snapshot.queryId));
+function preferredQueryId(state, normalizedText) {
+  const candidates = queryIdsByNormalized(state).get(normalizedText) ?? [];
+  const bound = new Set((state.active?.plan.querySnapshots ?? []).filter((snapshot) => normalizeIdentityText(snapshot.queryText) === normalizedText).map((snapshot) => snapshot.queryId));
   return candidates.find((candidate) => bound.has(candidate)) ?? candidates.at(0) ?? null;
 }
 function rowsEqual(before, after) {
@@ -30785,7 +30821,7 @@ function changeRows(ids, rows, plan, fallbackPlan = null) {
       queryText,
       assignmentCount: (plan ?? fallbackPlan)?.assignments.filter((assignment) => assignment.queryId === queryId).length ?? 0
     }];
-  }).sort((left, right) => compareText15(left.queryText, right.queryText) || compareText15(left.queryId, right.queryId));
+  }).sort((left, right) => compareText(left.queryText, right.queryText) || compareText(left.queryId, right.queryId));
 }
 function planSnapshot(plan, queryId) {
   return plan?.querySnapshots.find((snapshot) => snapshot.queryId === queryId) ?? null;
@@ -30793,26 +30829,26 @@ function planSnapshot(plan, queryId) {
 function displayIds(rows, plan) {
   return /* @__PURE__ */ new Set([...rows.keys(), ...plan?.querySnapshots.map((snapshot) => snapshot.queryId) ?? []]);
 }
-function candidateIdsForText(state, plan, rows, normalizedText4) {
+function candidateIdsForText(state, plan, rows, normalizedText) {
   const ids = /* @__PURE__ */ new Set();
   for (const row of rows.values()) {
-    if (normalizeText4(row.query) === normalizedText4) ids.add(row.id);
+    if (normalizeIdentityText(row.query) === normalizedText) ids.add(row.id);
   }
   for (const snapshot of plan?.querySnapshots ?? []) {
-    if (normalizeText4(snapshot.queryText) === normalizedText4) ids.add(snapshot.queryId);
+    if (normalizeIdentityText(snapshot.queryText) === normalizedText) ids.add(snapshot.queryId);
   }
-  const activeId = preferredQueryId(state, normalizedText4);
+  const activeId = preferredQueryId(state, normalizedText);
   return [...ids].sort((left, right) => {
     if (left === activeId) return -1;
     if (right === activeId) return 1;
-    return compareText15(left, right);
+    return compareText(left, right);
   });
 }
 function resolveMutationQueryId(state, plan, rows, removal) {
   if (removal.queryId !== void 0) {
     return rows.has(removal.queryId) || planSnapshot(plan, removal.queryId) !== null ? removal.queryId : null;
   }
-  const ids = candidateIdsForText(state, plan, rows, normalizeText4(removal.queryText));
+  const ids = candidateIdsForText(state, plan, rows, normalizeIdentityText(removal.queryText));
   return ids[0] ?? null;
 }
 function queryTextForId(state, plan, rows, queryId, fallback) {
@@ -30909,7 +30945,7 @@ function simpleWorkload(project, rows, opts) {
   const result = /* @__PURE__ */ new Map();
   for (const context of defaultContexts(project, opts, "simple")) {
     for (const row of rows.values()) {
-      result.set(`${normalizeText4(row.query)}\0${contextKey(context)}`, context.providers.length);
+      result.set(`${normalizeIdentityText(row.query)}\0${contextKey(context)}`, context.providers.length);
     }
   }
   return result;
@@ -30979,7 +31015,7 @@ function mutationPreviewToken(candidate, mutation, reviewedAt) {
     mutation: { additions: mutation.additions, removals: mutation.removals, ...mutation.edits ? { edits: mutation.edits } : {} },
     reviewedAt,
     plan: document,
-    queries: [...candidate.queryRows.values()].map((row) => ({ id: row.id, query: row.query, provenance: row.provenance })).sort((left, right) => compareText15(left.id, right.id))
+    queries: [...candidate.queryRows.values()].map((row) => ({ id: row.id, query: row.query, provenance: row.provenance })).sort((left, right) => compareText(left.id, right.id))
   }))}`;
 }
 function assertReviewedAt(reviewedAt) {
@@ -30996,7 +31032,7 @@ function assertSimpleAddition(addition) {
   }
 }
 function addSimpleSource(state, rows, source, reusedQueryIds) {
-  const normalized = normalizeText4(source.queryText);
+  const normalized = normalizeIdentityText(source.queryText);
   const existingId = candidateIdsForText(state, null, rows, normalized).at(0) ?? preferredQueryId(state, normalized) ?? stableNewQueryId(state.project.id, normalized);
   const existing = rows.get(existingId);
   if (existing) {
@@ -31026,7 +31062,7 @@ function buildSimpleCandidate(db, state, mutation, opts, manualCapturedAt) {
     }
     const existing = rows.get(edit.queryId);
     if (!existing) throw notFound("Tracked query", edit.queryId);
-    if (edit.text === void 0 || normalizeText4(edit.text) === normalizeText4(existing.query)) continue;
+    if (edit.text === void 0 || normalizeIdentityText(edit.text) === normalizeIdentityText(existing.query)) continue;
     rows.delete(edit.queryId);
     mutatedQueryIds.add(edit.queryId);
     addSimpleSource(state, rows, {
@@ -31070,7 +31106,7 @@ function buildSimpleCandidate(db, state, mutation, opts, manualCapturedAt) {
   };
 }
 function addAdvancedSource(state, plan, rows, addition, source, reusedQueryIds, mutatedQueryIds) {
-  const normalized = normalizeText4(source.queryText);
+  const normalized = normalizeIdentityText(source.queryText);
   const queryId = candidateIdsForText(state, plan, rows, normalized).at(0) ?? preferredQueryId(state, normalized) ?? stableNewQueryId(state.project.id, normalized);
   const knownBefore = state.queryRows.some((row) => row.id === queryId) || planSnapshot(state.active?.plan ?? null, queryId) !== null;
   const queryText = queryTextForId(state, plan, rows, queryId, source.queryText.trim());
@@ -31146,7 +31182,7 @@ function applyAdvancedEdit(state, plan, rows, edit, capturedAt, reusedQueryIds,
   if (!snapshot && !row) throw notFound("Tracked query", edit.queryId);
   const oldText = snapshot?.queryText ?? row.query;
   const text2 = edit.text ?? oldText;
-  const textChanged = normalizeText4(text2) !== normalizeText4(oldText);
+  const textChanged = normalizeIdentityText(text2) !== normalizeIdentityText(oldText);
   const audience = edit.audience === void 0 ? null : resolveAudience(requireAdvanced(state).plan, edit.audience);
   const targetKeys = audience ? new Set(audience.targetKeys) : null;
   const marketKeys = new Set(audience?.marketKeys ?? []);
@@ -31180,7 +31216,7 @@ function applyAdvancedEdit(state, plan, rows, edit, capturedAt, reusedQueryIds,
     }
     return plan;
   }
-  const newQueryId = candidateIdsForText(state, plan, rows, normalizeText4(text2)).at(0) ?? preferredQueryId(state, normalizeText4(text2)) ?? stableNewQueryId(state.project.id, normalizeText4(text2));
+  const newQueryId = candidateIdsForText(state, plan, rows, normalizeIdentityText(text2)).at(0) ?? preferredQueryId(state, normalizeIdentityText(text2)) ?? stableNewQueryId(state.project.id, normalizeIdentityText(text2));
   const queryText = queryTextForId(state, plan, rows, newQueryId, text2.trim());
   const provenance = provenanceForId(state, plan, rows, newQueryId, { source: "manual", sourceId: null, capturedAt });
   if (!rows.has(newQueryId)) rows.set(newQueryId, { id: newQueryId, query: queryText, provenance: serializeQueryProvenance(provenance) });
@@ -31281,7 +31317,7 @@ function writeSimpleCandidate(tx, candidate, now) {
   for (const queryId of candidate.createdQueryIds) {
     const planned = candidate.queryRows.get(queryId);
     if (!planned) continue;
-    const row = persisted.find((candidateRow) => normalizeText4(candidateRow.query) === normalizeText4(planned.query));
+    const row = persisted.find((candidateRow) => normalizeIdentityText(candidateRow.query) === normalizeIdentityText(planned.query));
     if (!row) continue;
     if (row.id !== planned.id) tx.update(queries).set({ id: planned.id }).where(eq37(queries.id, row.id)).run();
     if (planned.provenance) tx.update(queries).set({ provenance: planned.provenance }).where(eq37(queries.id, planned.id)).run();
@@ -31616,7 +31652,7 @@ import crypto24 from "crypto";
 import dns2 from "dns/promises";
 import http2 from "http";
 import https2 from "https";
-import net2 from "net";
+import net3 from "net";
 var REQUEST_TIMEOUT_MS = 1e4;
 async function resolveWebhookTarget(raw, options = {}) {
   let parsed;
@@ -31631,13 +31667,13 @@ async function resolveWebhookTarget(raw, options = {}) {
   if (parsed.username || parsed.password) {
     return { ok: false, message: '"url" must not include credentials' };
   }
-  const lookupHost = stripIpv6Brackets2(parsed.hostname);
+  const lookupHost = stripIpv6Brackets(parsed.hostname);
   if (!lookupHost) {
     return { ok: false, message: '"url" must include a hostname' };
   }
-  const addresses = await resolveHostAddresses(lookupHost);
+  const addresses = await resolveHostAddresses(lookupHost, options.resolveAddresses);
   if (addresses.length === 0) {
-    return { ok: false, message: '"url" hostname could not be resolved' };
+    return { ok: false, message: '"url" hostname could not be resolved', unresolved: true };
   }
   const blocked = addresses.find((entry) => isBlockedAddress(entry.address, options));
   if (blocked) {
@@ -31648,7 +31684,8 @@ async function resolveWebhookTarget(raw, options = {}) {
     target: {
       url: parsed,
       address: addresses[0].address,
-      family: addresses[0].family
+      family: addresses[0].family,
+      addresses
     }
   };
 }
@@ -31668,16 +31705,23 @@ async function deliverWebhook(target, payload, webhookSecret) {
   }
   return await new Promise((resolve) => {
     const requestOptions = {
-      family: target.family,
+      // A connection of its own: a shared agent pools by hostname, so it could
+      // hand this request a socket some other caller dialed unchecked.
+      agent: false,
+      // Dial the checked addresses, falling back from one to the next, so a
+      // receiver that listens on only one of them (`localhost` checks as
+      // 127.0.0.1 and ::1) still gets the delivery.
+      autoSelectFamily: true,
+      lookup: pinnedLookup(checkedAddresses(target)),
       headers,
-      hostname: target.address,
+      hostname: stripIpv6Brackets(target.url.hostname),
       method: "POST",
       path: path8,
       port,
       timeout: REQUEST_TIMEOUT_MS
     };
     if (isHttps) {
-      requestOptions.servername = stripIpv6Brackets2(target.url.hostname);
+      requestOptions.servername = stripIpv6Brackets(target.url.hostname);
     }
     const request = (isHttps ? https2.request : http2.request)(requestOptions, (response) => {
       response.resume();
@@ -31694,11 +31738,27 @@ async function deliverWebhook(target, payload, webhookSecret) {
     request.end(body);
   });
 }
-async function resolveHostAddresses(hostname) {
-  const family = net2.isIP(hostname);
+function checkedAddresses(target) {
+  return target.addresses ?? [{ address: target.address, family: target.family }];
+}
+function pinnedLookup(addresses) {
+  return (_hostname, options, callback) => {
+    if (options.all) callback(null, addresses.map(({ address, family }) => ({ address, family })));
+    else callback(null, addresses[0].address, addresses[0].family);
+  };
+}
+var LOCALHOST_ADDRESSES = [{ address: "127.0.0.1", family: 4 }, { address: "::1", family: 6 }];
+function isLocalhostName(hostname) {
+  const name = hostname.toLowerCase().replace(/\.$/, "");
+  return name === "localhost" || name.endsWith(".localhost");
+}
+async function resolveHostAddresses(hostname, resolveAddresses) {
+  const family = net3.isIP(hostname);
   if (family === 4 || family === 6) {
     return [{ address: hostname, family }];
   }
+  if (isLocalhostName(hostname)) return LOCALHOST_ADDRESSES;
+  if (resolveAddresses) return await resolveAddresses(hostname);
   try {
     const [ipv4, ipv6] = await Promise.allSettled([dns2.resolve4(hostname), dns2.resolve6(hostname)]);
     const unique3 = /* @__PURE__ */ new Map();
@@ -31718,65 +31778,7 @@ async function resolveHostAddresses(hostname) {
   }
 }
 function isBlockedAddress(address, options) {
-  const normalized = stripIpv6Brackets2(address).toLowerCase();
-  const family = net2.isIP(normalized);
-  if (family === 4) {
-    return isBlockedIpv4(normalized, options);
-  }
-  if (family === 6) {
-    const mappedIpv42 = extractMappedIpv4(normalized);
-    if (mappedIpv42) {
-      return isBlockedIpv4(mappedIpv42, options);
-    }
-    return isBlockedIpv6(normalized, options);
-  }
-  return true;
-}
-function isBlockedIpv4(address, options) {
-  const octets = address.split(".").map((part) => Number.parseInt(part, 10));
-  if (octets.length !== 4 || octets.some(Number.isNaN)) {
-    return true;
-  }
-  const [first, second] = octets;
-  if (first === 127 && !options.allowLoopback) {
-    return true;
-  }
-  return first === 0 || first === 10 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 198 && (second === 18 || second === 19);
-}
-function isBlockedIpv6(address, options) {
-  const normalized = address.split("%")[0].toLowerCase();
-  if (normalized === "::") {
-    return true;
-  }
-  if (normalized === "::1") {
-    return !options.allowLoopback;
-  }
-  const firstHextetText = normalized.split(":")[0] ?? "";
-  const firstHextet = firstHextetText === "" ? 0 : Number.parseInt(firstHextetText, 16);
-  if (Number.isNaN(firstHextet)) {
-    return true;
-  }
-  return firstHextet >= 64512 && firstHextet <= 65023 || firstHextet >= 65152 && firstHextet <= 65215;
-}
-function extractMappedIpv4(address) {
-  const normalized = address.toLowerCase();
-  if (!normalized.startsWith("::ffff:")) {
-    return null;
-  }
-  const remainder = normalized.slice("::ffff:".length);
-  if (net2.isIP(remainder) === 4) {
-    return remainder;
-  }
-  const parts = remainder.split(":");
-  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
-    return null;
-  }
-  const high = Number.parseInt(parts[0], 16);
-  const low = Number.parseInt(parts[1], 16);
-  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
-}
-function stripIpv6Brackets2(value) {
-  return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+  return blockedAddressReason(address, { allowLoopback: options.allowLoopback }) !== null;
 }
 
 // ../api-routes/src/apply.ts
@@ -31895,7 +31897,7 @@ async function applyRoutes(app, opts) {
       const nextAliases = normalizeProjectAliases(config.spec.displayName, config.spec.aliases ?? []);
       if (existing) {
         const prevAliases = existing.aliases;
-        aliasesChanged = !aliasArraysEqual2(prevAliases, nextAliases);
+        aliasesChanged = !aliasArraysEqual(prevAliases, nextAliases);
       }
       if (existing) {
         projectId = existing.id;
@@ -32126,13 +32128,6 @@ async function applyRoutes(app, opts) {
     });
   });
 }
-function aliasArraysEqual2(a, b) {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i++) {
-    if (a[i].toLowerCase() !== b[i].toLowerCase()) return false;
-  }
-  return true;
-}
 
 // ../api-routes/src/history.ts
 import { and as and31, asc as asc6, count, desc as desc17, eq as eq39, gte as gte6, inArray as inArray19, like as like2, ne as ne8, or as or10 } from "drizzle-orm";
@@ -36134,8 +36129,8 @@ function readVisibilityCompare(db, projectName, query) {
   if (scope === "project" && filters.scopeKey !== void 0) throw validationError("scopeKey is not valid for project scope.");
   if (scope === "market" && filters.marketKey !== void 0) throw validationError("marketKey is not valid for market scope.");
   const { fromRaw, toRaw, fromBounds, toBounds } = compareMonths(query.from, query.to);
-  const providerKey2 = filters.provider === void 0 ? void 0 : normalizeText3(filters.provider);
-  const locationKey2 = filters.location === void 0 ? void 0 : normalizeText3(filters.location);
+  const providerKey2 = filters.provider === void 0 ? void 0 : normalizeIdentityText(filters.provider);
+  const locationKey2 = filters.location === void 0 ? void 0 : normalizeIdentityText(filters.location);
   const scoped = scope !== "project" || filters.marketKey !== void 0;
   let advancedComparison;
   if (activeMeasurementPlan(db, project.id) !== null) {
@@ -36186,7 +36181,7 @@ function readVisibilityCompare(db, projectName, query) {
     }).from(querySnapshots).where(inArray23(querySnapshots.runId, runIds)).all() : [];
     return {
       runCount: runIds.length,
-      snapshots: snapshots.filter((snapshot) => (providerKey2 === void 0 || normalizeText3(snapshot.provider) === providerKey2) && (locationKey2 === void 0 || (locationKey2 === "none" ? snapshot.location === null : snapshot.location !== null && normalizeText3(snapshot.location) === locationKey2)))
+      snapshots: snapshots.filter((snapshot) => (providerKey2 === void 0 || normalizeIdentityText(snapshot.provider) === providerKey2) && (locationKey2 === void 0 || (locationKey2 === "none" ? snapshot.location === null : snapshot.location !== null && normalizeIdentityText(snapshot.location) === locationKey2)))
     };
   };
   const fromMonth = loadMonth(fromBounds);
@@ -38513,6 +38508,7 @@ var SCHEMA_TABLE = {
   IndexingRequestResponseDto: indexingRequestResponseDtoSchema,
   IntegrationSettingsSummaryDto: integrationSettingsSummaryDtoSchema,
   KeywordDto: keywordDtoSchema,
+  KeywordGenerateResponse: keywordGenerateResponseSchema,
   LatestProjectRunDto: latestProjectRunDtoSchema,
   RunAdmissionDto: runAdmissionDtoSchema,
   LocationContext: locationContextSchema,
@@ -38589,13 +38585,16 @@ var SCHEMA_TABLE = {
   OrganicEvidenceDto: organicEvidenceDtoSchema,
   ProjectCreateRequest: projectCreateRequestSchema,
   ProjectDto: projectDtoSchema,
+  ProjectDefaultLocationResponse: projectDefaultLocationResponseSchema,
   ProjectUpsertRequest: projectUpsertRequestSchema,
   ProjectConfig: projectConfigSchema,
+  ProjectConfigExport: projectConfigExportSchema,
   ProjectOverviewDto: projectOverviewDtoSchema,
   TrafficAnalyticsResponse: trafficAnalyticsResponseSchema,
   ProjectSearchResponseDto: projectSearchResponseSchema,
   ProviderSummaryEntryDto: providerSummaryEntryDtoSchema,
   QueryDto: queryDtoSchema,
+  QueryGenerateResponse: queryGenerateResponseSchema,
   ReferralAssessment: referralAssessmentSchema,
   ResultsExportDto: resultsExportDtoSchema,
   RunCompletenessDto: runCompletenessDtoSchema,
@@ -38658,7 +38657,7 @@ var SCHEMA_TABLE = {
   WordpressManualAssistDto: wordpressManualAssistDtoSchema,
   WordpressOnboardResultDto: wordpressOnboardResultDtoSchema,
   WordpressPageDetailDto: wordpressPageDetailDtoSchema,
-  WordpressPageSummaryDto: wordpressPageSummaryDtoSchema,
+  WordpressPageListDto: wordpressPageListDtoSchema,
   WordpressSchemaBlockDto: wordpressSchemaBlockDtoSchema,
   WordpressSchemaDeployResultDto: wordpressSchemaDeployResultDtoSchema,
   WordpressSchemaStatusResultDto: wordpressSchemaStatusResultDtoSchema,
@@ -38678,10 +38677,27 @@ var SCHEMA_TABLE = {
 var SHARED_ENUM_REFS = [
   { schema: "ScheduleDto", property: "kind", component: "SchedulableRunKind" }
 ];
+function addNullToNullableEnums(node) {
+  if (Array.isArray(node)) {
+    for (const item2 of node) addNullToNullableEnums(item2);
+    return;
+  }
+  if (node === null || typeof node !== "object") return;
+  const record = node;
+  if (record.nullable === true && Array.isArray(record.enum)) {
+    const values = record.enum;
+    if (!values.includes(null)) record.enum = [...values, null];
+  }
+  for (const value of Object.values(record)) addNullToNullableEnums(value);
+}
+var INPUT_FORM_SCHEMAS = /* @__PURE__ */ new Set(["ProjectConfig"]);
 function buildComponentSchemas() {
   const out = {};
   for (const [name, schema] of Object.entries(SCHEMA_TABLE)) {
-    out[name] = z.toJSONSchema(schema, { target: "openapi-3.0" });
+    const io = INPUT_FORM_SCHEMAS.has(name) ? "input" : "output";
+    const json = z.toJSONSchema(schema, { target: "openapi-3.0", io });
+    addNullToNullableEnums(json);
+    out[name] = json;
   }
   for (const { schema, property, component } of SHARED_ENUM_REFS) {
     const properties = out[schema]?.properties;
@@ -38844,6 +38860,13 @@ var measurementReportRunParameter = {
   description: "Eligible full measurement run to reconstruct. Omit to use the latest run for the revision.",
   schema: stringSchema
 };
+var measurementReportQueryClassParameter = {
+  name: "queryClass",
+  in: "query",
+  required: false,
+  description: "Query class every group, Target and evidence row is taken over. Defaults to non-brand; branded is a separate read. all pools branded and non-brand into one rate and is served only when asked for. A schema v1 revision records no class: omit this (or pass all) to read every answer, and the response echoes queryClass null.",
+  schema: { type: "string", enum: ["non-brand", "branded", "all"], default: "non-brand" }
+};
 var runIdParameter = {
   name: "id",
   in: "path",
@@ -39557,12 +39580,12 @@ var routeCatalog = [
     method: "get",
     path: "/api/v1/projects/{name}/measurement-report",
     summary: "Get a revision-pinned measurement report",
-    description: "Builds the Target, group, and evidence report from the immutable plan revision and either its latest eligible stored run or the exact eligible runId supplied by the caller. Missing run population remains explicit and never triggers live provider execution.",
+    description: "Builds the Target, group, and evidence report from the immutable plan revision and either its latest eligible stored run or the exact eligible runId supplied by the caller. On a schema v2 revision every rate is taken over one query class, non-brand unless queryClass names another; the response echoes the class it served. Missing run population remains explicit and never triggers live provider execution.",
     tags: ["measurement-plans"],
-    parameters: [nameParameter, measurementReportRevisionParameter, measurementReportRunParameter],
+    parameters: [nameParameter, measurementReportRevisionParameter, measurementReportRunParameter, measurementReportQueryClassParameter],
     responses: {
       200: jsonResponse("Revision-pinned measurement report returned.", "MeasurementReportResponse"),
-      400: errorResponse("The revision query parameter is invalid."),
+      400: errorResponse("The revision or queryClass parameter is invalid, or a class was requested for a schema v1 revision."),
       404: errorResponse("Project, measurement-plan revision, or requested run not found.")
     }
   },
@@ -39829,15 +39852,16 @@ var routeCatalog = [
     method: "get",
     path: "/api/v1/projects/{name}/measurement-overview",
     summary: "Get the scoped measurement overview",
-    description: "Aggregates one revision-pinned run snapshot for All Properties, a group, or a single Property. This is snapshot ranking only: it never infers a trend or compares evidence across revisions. Without runId the most recent completed run pinned to the active revision is used; once paging begins, the cursor pins that revision, displayed run, evidence snapshot, and result filters. A run pinned to another revision is refused rather than joined, and appended evidence on a mutable named run invalidates its cursor. On a schema v2 plan every Property row carries its metro (the top-level group holding it, or null) and, when it sits in several top-level groups, otherMetros. Metrics are computed before search is applied, and a metric with no evidence is unavailable rather than zero. For coverage sorts, unavailable rows form the first bucket in either direction before available numeric rates follow the requested direction.",
+    description: "Aggregates one revision-pinned run snapshot for All Properties, a group, a market, or a single Property. A group reads every query its Properties are assigned; a market reads only its own frozen queries, the population the dashboard's market view reads, and the response scope names which kind was read. Rates are taken over one query class, non-brand unless queryClass names another; all pools branded with non-brand and is served only when asked for. This is snapshot ranking only: it never infers a trend or compares evidence across revisions. Without runId the most recent completed run pinned to the active revision is used; once paging begins, the cursor pins that revision, displayed run, evidence snapshot, and result filters. A run pinned to another revision is refused rather than joined, and appended evidence on a mutable named run invalidates its cursor. On a schema v2 plan every Property row carries its metro (the top-level group holding it, or null) and, when it sits in several top-level groups, otherMetros. Metrics are computed before search is applied, and a metric with no evidence is unavailable rather than zero. For coverage sorts, unavailable rows form the first bucket in either direction before available numeric rates follow the requested direction.",
     tags: ["measurement-plans"],
     parameters: [
       nameParameter,
       { name: "compact", in: "query", description: "Byte-bounded whole-row page; omits optional heavy detail with explicit metadata. Default false for compatibility.", schema: { type: "boolean" } },
-      { name: "scope", in: "query", required: true, description: "Reporting scope.", schema: { type: "string", enum: ["all", "group", "property"] } },
+      { name: "scope", in: "query", required: true, description: "Reporting scope. group is every query of the group's Properties; market is only the market's own queries.", schema: { type: "string", enum: ["all", "group", "market", "property"] } },
       { name: "groupKey", in: "query", description: 'Group stable key, required when scope is "group".', schema: stringSchema },
+      { name: "marketKey", in: "query", description: 'Market stable key (a frozen reporting scope), required when scope is "market" and refused (400) with any other scope.', schema: stringSchema },
       { name: "targetKey", in: "query", description: 'Target stable key, required when scope is "property".', schema: stringSchema },
-      { name: "queryClass", in: "query", description: "Restrict to one question class. Never pooled across classes.", schema: { type: "string", enum: ["all", "branded", "non-brand"] } },
+      { name: "queryClass", in: "query", description: "Query class the rates are taken over. Defaults to non-brand; read branded as a separate request. all pools branded and non-brand into one rate.", schema: { type: "string", enum: ["non-brand", "branded", "all"], default: "non-brand" } },
       { name: "provider", in: "query", description: "Restrict to one answer provider.", schema: stringSchema },
       { name: "location", in: "query", description: "Restrict to one execution location label.", schema: stringSchema },
       { name: "from", in: "query", description: "Inclusive start of the window (YYYY-MM-DD).", schema: stringSchema },
@@ -40085,14 +40109,14 @@ var routeCatalog = [
     method: "get",
     path: "/api/v1/projects/{name}/measurement-changes",
     summary: "Compare the latest two comparable measurements",
-    description: "Compares stored runs only when plan revision, execution identity, and full-or-spot-check scope agree. Deltas are current minus previous; it never crosses a revision or silently joins an engine/model change. changedProperties is ordered by the size of each move unless sort=label, and each row carries signed answer-count deltas, denominatorChanged (a metric was taken over a different number of answers, so its delta is not like for like) and withinNoise (every move is at most 2 answers). A move is the rate change times the larger of the two answer counts, the answer-count delta whenever the denominator held, so a falling rate never reads as a gain and a collapse never reads as noise. distribution buckets every Property in scope, not just the returned rows. With queryClass all, metricsByClass reports branded and non-brand beside the pooled metrics.",
+    description: "Compares stored runs only when plan revision, execution identity, and full-or-spot-check scope agree. Deltas are current minus previous; it never crosses a revision or silently joins an engine/model change. changedProperties is ordered by the size of each move unless sort=label, and each row carries signed answer-count deltas, denominatorChanged (a metric was taken over a different number of answers, so its delta is not like for like) and withinNoise (every move is at most 2 answers). A move is the rate change times the larger of the two answer counts, the answer-count delta whenever the denominator held, so a falling rate never reads as a gain and a collapse never reads as noise. distribution buckets every Property in scope, not just the returned rows. Rates are taken over non-brand queries unless queryClass names another class. With queryClass all, the metrics, rows and distribution pool branded with non-brand, and metricsByClass reports each class beside them.",
     tags: ["measurement-plans"],
     parameters: [
       nameParameter,
       { name: "scope", in: "query", description: "Reporting scope. Defaults to all.", schema: { type: "string", enum: ["all", "group", "property"], default: "all" } },
       { name: "groupKey", in: "query", description: "Required for group scope.", schema: stringSchema },
       { name: "targetKey", in: "query", description: "Required for Property scope.", schema: stringSchema },
-      { name: "queryClass", in: "query", description: "Question class. Defaults to all.", schema: { type: "string", enum: ["all", "branded", "non-brand"], default: "all" } },
+      { name: "queryClass", in: "query", description: "Query class. Defaults to non-brand; read branded as a separate request. all pools both classes.", schema: { type: "string", enum: ["non-brand", "branded", "all"], default: "non-brand" } },
       { name: "provider", in: "query", description: "Restrict both runs to one answer provider.", schema: stringSchema },
       { name: "location", in: "query", description: "Restrict both runs to one execution location label.", schema: stringSchema },
       { name: "runId", in: "query", description: "Use this completed or partial run as the current side.", schema: stringSchema },
@@ -40428,7 +40452,7 @@ var routeCatalog = [
       }
     },
     responses: {
-      200: jsonResponse("Default location updated.", "ProjectDto"),
+      200: jsonResponse("Default location updated.", "ProjectDefaultLocationResponse"),
       400: errorResponse("Invalid location."),
       404: errorResponse("Project not found.")
     }
@@ -40440,7 +40464,7 @@ var routeCatalog = [
     tags: ["projects"],
     parameters: [nameParameter],
     responses: {
-      200: jsonResponse("Project configuration returned.", "ProjectConfig"),
+      200: jsonResponse("Project configuration returned.", "ProjectConfigExport"),
       404: errorResponse("Project not found.")
     }
   },
@@ -40643,7 +40667,7 @@ var routeCatalog = [
       }
     },
     responses: {
-      200: rawJsonResponse("Query suggestions returned.", { type: "object", properties: { suggestions: { type: "array", items: { type: "string" } } } }),
+      200: jsonResponse("Query suggestions returned.", "QueryGenerateResponse"),
       501: errorResponse("Query generation is not available.")
     }
   },
@@ -40752,8 +40776,7 @@ var routeCatalog = [
       }
     },
     responses: {
-      // TODO: Add `KeywordGenerateResponse` Zod schema (`{ suggestions: string[] }`) in contracts.
-      200: rawJsonResponse("Legacy keyword suggestions returned.", looseObjectSchema),
+      200: jsonResponse("Legacy keyword suggestions returned.", "KeywordGenerateResponse"),
       501: errorResponse("Legacy keyword generation is not available.")
     }
   },
@@ -44089,7 +44112,7 @@ var routeCatalog = [
     tags: ["wordpress"],
     parameters: [nameParameter, wordpressEnvQueryParameter],
     responses: {
-      200: jsonArrayResponse("WordPress pages returned.", "WordpressPageSummaryDto"),
+      200: jsonResponse("WordPress pages returned.", "WordpressPageListDto"),
       400: errorResponse("Invalid environment or missing connection."),
       404: errorResponse("Project not found.")
     }
@@ -47812,18 +47835,18 @@ async function exchangeCode(clientId, clientSecret, code, redirectUri) {
       const parsed = JSON.parse(body);
       if (parsed.error) detail = parsed.error;
       if (parsed.error_description) {
-        const sanitized = parsed.error_description.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(code), "g"), "***");
+        const sanitized = parsed.error_description.replace(new RegExp(escapeRegExp2(clientId), "g"), "***").replace(new RegExp(escapeRegExp2(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp2(code), "g"), "***");
         detail += detail ? `: ${sanitized}` : sanitized;
       }
     } catch {
       const truncated = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
-      detail = truncated.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(code), "g"), "***");
+      detail = truncated.replace(new RegExp(escapeRegExp2(clientId), "g"), "***").replace(new RegExp(escapeRegExp2(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp2(code), "g"), "***");
     }
     throw new GoogleAuthError(`Token exchange failed (${res.status}): ${detail}`);
   }
   return await res.json();
 }
-function escapeRegExp(str) {
+function escapeRegExp2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function refreshAccessToken(clientId, clientSecret, currentRefreshToken) {
@@ -47851,12 +47874,12 @@ async function refreshAccessToken(clientId, clientSecret, currentRefreshToken) {
       const parsed = JSON.parse(body);
       if (parsed.error) detail = parsed.error;
       if (parsed.error_description) {
-        const sanitized = parsed.error_description.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(currentRefreshToken), "g"), "***");
+        const sanitized = parsed.error_description.replace(new RegExp(escapeRegExp2(clientId), "g"), "***").replace(new RegExp(escapeRegExp2(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp2(currentRefreshToken), "g"), "***");
         detail += detail ? `: ${sanitized}` : sanitized;
       }
     } catch {
       const truncated = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
-      detail = truncated.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(currentRefreshToken), "g"), "***");
+      detail = truncated.replace(new RegExp(escapeRegExp2(clientId), "g"), "***").replace(new RegExp(escapeRegExp2(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp2(currentRefreshToken), "g"), "***");
     }
     throw new GoogleAuthError(`Token refresh failed (${res.status}): ${detail}`);
   }
@@ -47946,7 +47969,7 @@ function gscClientLog(level, action, ctx) {
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
-function escapeRegExp2(str) {
+function escapeRegExp3(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function gscFetchResponse(accessToken, url, opts) {
@@ -47975,7 +47998,7 @@ async function gscFetchResponse(accessToken, url, opts) {
     const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
     let sanitizedDetail = detail;
     if (accessToken) {
-      sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp2(accessToken), "g"), "***");
+      sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
     }
     throw new GoogleApiError(`GSC API error (${res.status}): ${sanitizedDetail}`, res.status);
   }
@@ -48263,15 +48286,12 @@ async function getAccessToken(clientEmail, privateKey) {
     const body = await res.text().catch(() => "");
     ga4Log("error", "token.failed", { httpStatus: res.status });
     const detail = body.length <= 200 ? body : `${body.slice(0, 200)}... [truncated]`;
-    const sanitizedDetail = detail.replace(new RegExp(escapeRegExp3(clientEmail), "g"), "***").replace(new RegExp(escapeRegExp3(privateKey.slice(0, 32)), "g"), "***");
+    const sanitizedDetail = detail.replace(new RegExp(escapeRegExp(clientEmail), "g"), "***").replace(new RegExp(escapeRegExp(privateKey.slice(0, 32)), "g"), "***");
     throw new GA4ApiError(`Failed to get access token: ${sanitizedDetail}`, res.status);
   }
   const data = await res.json();
   return data.access_token;
 }
-function escapeRegExp3(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 var gaInFlight = 0;
 var gaWaitQueue = [];
 async function acquireGa4Slot() {
@@ -48377,7 +48397,7 @@ async function runReport(accessToken, propertyId, request) {
       }
       let sanitizedDetail = detail;
       if (accessToken) {
-        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp(accessToken), "g"), "***");
       }
       ga4Log("error", "report.auth-failed", { propertyId, httpStatus: res.status });
       throw new GA4ApiError(
@@ -48397,7 +48417,7 @@ async function runReport(accessToken, propertyId, request) {
       const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
       let sanitizedDetail = detail;
       if (accessToken) {
-        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp(accessToken), "g"), "***");
       }
       throw new GA4ApiError(`GA4 API error (${res.status}): ${sanitizedDetail}`, res.status, retryAfterSeconds);
     }
@@ -48421,7 +48441,7 @@ async function batchRunReports(accessToken, propertyId, requests) {
       ga4Log("error", "batch-report.auth-failed", { propertyId, httpStatus: res.status });
       let sanitizedDetail = body;
       if (accessToken) {
-        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp(accessToken), "g"), "***");
       }
       throw new GA4ApiError(
         `GA4 API authentication failed \u2014 check service account permissions. ${sanitizedDetail}`,
@@ -48440,7 +48460,7 @@ async function batchRunReports(accessToken, propertyId, requests) {
       const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
       let sanitizedDetail = detail;
       if (accessToken) {
-        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp(accessToken), "g"), "***");
       }
       throw new GA4ApiError(`GA4 API error (${res.status}): ${sanitizedDetail}`, res.status, retryAfterSeconds);
     }
@@ -48742,7 +48762,7 @@ async function listProperties(accessToken) {
         } catch {
           if (raw.length < 200) detail = ` ${raw}`;
         }
-        const sanitized = detail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+        const sanitized = detail.replace(new RegExp(escapeRegExp(accessToken), "g"), "***");
         const retryAfterSeconds = res.status === 429 || res.status >= 500 || res.status === 403 && quotaReason ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
         ga4Log("error", "admin.account-summaries-failed", {
           httpStatus: res.status,
@@ -58074,9 +58094,6 @@ function bingClientLog(level, action, ctx) {
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
-function escapeRegExp4(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function parseBingErrorCode(body) {
   try {
     const parsed = JSON.parse(body);
@@ -58113,7 +58130,7 @@ async function bingFetchOnce(apiKey, endpoint, opts) {
   if (!res.ok) {
     const body = await res.text();
     let detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-    detail = detail.replace(new RegExp(escapeRegExp4(apiKey), "g"), "***");
+    detail = detail.replace(new RegExp(escapeRegExp(apiKey), "g"), "***");
     const bingErrorCode = parseBingErrorCode(body);
     const err = new BingApiError(`Bing API error (${res.status}): ${detail}`, res.status, bingErrorCode);
     bingClientLog("error", err.isThrottle ? "http.throttled" : "http.error", {
@@ -58956,7 +58973,7 @@ function findBiggestMover(current, prior) {
   for (const row of current) entry(row.source).current += row.sessions ?? 0;
   for (const row of prior) entry(row.source).prior += row.sessions ?? 0;
   let mover = null;
-  const sources = [...bySource.keys()].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const sources = [...bySource.keys()].sort(compareText);
   for (const source of sources) {
     const sessions = bySource.get(source);
     const size = Math.abs(sessions.current - sessions.prior);
@@ -60572,7 +60589,7 @@ function buildAuthErrorMessage(res, responseText) {
 async function fetchJson(connection, siteUrl, path8, init) {
   if (siteUrl.startsWith("http:")) {
   }
-  const res = await fetch(`${normalizeSiteUrl(siteUrl)}${path8}`, {
+  const res = await (connection.fetchImpl ?? fetch)(`${normalizeSiteUrl(siteUrl)}${path8}`, {
     ...init,
     headers: {
       "Authorization": `Basic ${encodeBasicAuth(connection.username, connection.appPassword)}`,
@@ -60596,10 +60613,10 @@ async function fetchJson(connection, siteUrl, path8, init) {
     const text2 = await res.text().catch(() => "");
     let detail = text2 || res.statusText;
     if (connection.appPassword) {
-      detail = detail.replace(new RegExp(escapeRegExp5(connection.appPassword), "g"), "***");
+      detail = detail.replace(new RegExp(escapeRegExp(connection.appPassword), "g"), "***");
     }
     if (connection.username) {
-      detail = detail.replace(new RegExp(escapeRegExp5(connection.username), "g"), "***");
+      detail = detail.replace(new RegExp(escapeRegExp(connection.username), "g"), "***");
     }
     throw new WordpressApiError("UPSTREAM_ERROR", `WordPress API error (${res.status}): ${detail}`, res.status);
   }
@@ -60631,9 +60648,9 @@ async function fetchPageCollectionSummary(connection, siteUrl, options) {
   );
   return response;
 }
-async function fetchText(url) {
+async function fetchText(connection, url) {
   try {
-    const res = await fetch(url, { signal: AbortSignal.timeout(WP_FETCH_TEXT_TIMEOUT_MS) });
+    const res = await (connection.fetchImpl ?? fetch)(url, { signal: AbortSignal.timeout(WP_FETCH_TEXT_TIMEOUT_MS) });
     if (!res.ok) return null;
     return await res.text();
   } catch {
@@ -60775,7 +60792,7 @@ async function verifyWordpressConnection(connection) {
   validateConnection(connection, site.siteUrl);
   const userInfo = await verifyAuthenticatedRestAccess(connection, site.siteUrl);
   const response = await fetchPageCollectionSummary(connection, site.siteUrl, { context: "view" });
-  const homeHtml = await fetchText(site.siteUrl);
+  const homeHtml = await fetchText(connection, site.siteUrl);
   return {
     url: site.siteUrl,
     reachable: true,
@@ -60791,7 +60808,7 @@ async function getSiteStatus(connection, env) {
   try {
     const userInfo = await verifyAuthenticatedRestAccess(connection, site.siteUrl);
     const response = await fetchPageCollectionSummary(connection, site.siteUrl, { context: "view" });
-    const homeHtml = await fetchText(site.siteUrl);
+    const homeHtml = await fetchText(connection, site.siteUrl);
     const plugins = await listActivePlugins(connection, env);
     return {
       url: site.siteUrl,
@@ -60881,15 +60898,15 @@ async function getPageBySlug(connection, slug, env) {
   }
   return body[0];
 }
-async function fetchRenderedPage(link) {
+async function fetchRenderedPage(connection, link) {
   if (!link) return null;
-  return fetchText(link);
+  return fetchText(connection, link);
 }
 async function getPageDetail(connection, slug, env, plugins) {
   const site = resolveEnvironment(connection, env);
   const resolvedPlugins = plugins === void 0 ? await listActivePlugins(connection, site.env) : plugins;
   const page3 = await getPageBySlug(connection, slug, site.env);
-  const html = await fetchRenderedPage(page3.link);
+  const html = await fetchRenderedPage(connection, page3.link);
   const schemaBlocks = html ? extractSchemaBlocks(html) : [];
   const seo = buildSeoState(page3, html, resolvedPlugins);
   return {
@@ -61094,14 +61111,11 @@ var CANONRY_SCHEMA_START = "<!-- canonry:schema:start -->";
 var CANONRY_SCHEMA_END = "<!-- canonry:schema:end -->";
 function stripCanonrySchema(content) {
   const regex = new RegExp(
-    `${escapeRegExp5(CANONRY_SCHEMA_START)}[\\s\\S]*?${escapeRegExp5(CANONRY_SCHEMA_END)}`,
+    `${escapeRegExp(CANONRY_SCHEMA_START)}[\\s\\S]*?${escapeRegExp(CANONRY_SCHEMA_END)}`,
     "g"
   );
   return content.replace(regex, "").replace(/\n{3,}/g, "\n\n").trim();
 }
-function escapeRegExp5(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function injectCanonrySchema(content, schemas) {
   if (schemas.length === 0) return content;
   const blocks = schemas.map((schema) => `<script type="application/ld+json">${JSON.stringify(schema).replace(/<\//g, "<\\/")}</script>`).join("\n");
@@ -61206,7 +61220,7 @@ async function getSchemaStatus(connection, env) {
     const thirdPartySchemas = [];
     if (hasCanonryMarker) {
       const markerRegex = new RegExp(
-        `${escapeRegExp5(CANONRY_SCHEMA_START)}([\\s\\S]*?)${escapeRegExp5(CANONRY_SCHEMA_END)}`
+        `${escapeRegExp(CANONRY_SCHEMA_START)}([\\s\\S]*?)${escapeRegExp(CANONRY_SCHEMA_END)}`
       );
       const match = markerRegex.exec(rawContent);
       if (match?.[1]) {
@@ -61249,7 +61263,7 @@ async function getLlmsTxt(connection, env) {
   return {
     env: site.env,
     url,
-    content: await fetchText(url)
+    content: await fetchText(connection, url)
   };
 }
 async function buildManualLlmsTxtUpdate(connection, content, env) {
@@ -61431,6 +61445,132 @@ function parseEnv(value) {
   return parsed.success ? parsed.data : void 0;
 }
 
+// ../api-routes/src/guarded-fetch.ts
+import { Agent, fetch as undiciFetch } from "undici";
+var GUARDED_FETCH_MAX_REDIRECTS = 5;
+var MAX_POOLED_AGENTS = 16;
+var EgressRefusedError = class extends Error {
+  /**
+   * True when the refused target is a redirect the site chose rather than the
+   * URL the caller asked for. Refusing the caller's URL is a verdict on the
+   * caller's input; refusing a redirect is the site's failure.
+   */
+  redirected;
+  constructor(message, redirected) {
+    super(message);
+    this.name = "EgressRefusedError";
+    this.redirected = redirected;
+  }
+};
+var EgressFailedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EgressFailedError";
+  }
+};
+var CROSS_ORIGIN_DROPPED_HEADERS = ["authorization", "cookie", "proxy-authorization"];
+var BODY_HEADERS = ["content-encoding", "content-language", "content-length", "content-location", "content-type"];
+function createGuardedFetch(options = {}) {
+  const resolveTarget = options.resolveTarget ?? ((url) => resolveWebhookTarget(url, { allowLoopback: options.allowLoopback }));
+  const agents = /* @__PURE__ */ new Map();
+  function agentFor(target) {
+    const addresses = checkedAddresses(target);
+    const key = `${target.url.origin} ${addresses.map(({ address }) => address).sort().join(" ")}`;
+    const agent = agents.get(key) ?? pinnedAgent(addresses);
+    agents.delete(key);
+    agents.set(key, agent);
+    if (agents.size > MAX_POOLED_AGENTS) {
+      const [oldestKey, oldest] = agents.entries().next().value;
+      agents.delete(oldestKey);
+      oldest.close().catch(() => {
+      });
+    }
+    return agent;
+  }
+  return async (input, init = {}) => {
+    let href = String(input);
+    let method = (init.method ?? "GET").toUpperCase();
+    let body = init.body ?? null;
+    const headers = new Headers(init.headers);
+    const signal = init.signal ?? void 0;
+    let mayRedirectToLoopback = true;
+    for (let redirects = 0; ; redirects += 1) {
+      signal?.throwIfAborted();
+      const check2 = await untilAborted(resolveTarget(href), signal);
+      if (!check2.ok) {
+        const parsed = URL.canParse(href) ? new URL(href) : null;
+        if (check2.unresolved) throw new EgressFailedError(`Could not resolve ${parsed?.hostname || href}`);
+        throw new EgressRefusedError(`Refused to connect to ${parsed?.host || href}: ${check2.message.replace(/^"url" /, "")}`, redirects > 0);
+      }
+      const url = check2.target.url;
+      const onLoopback = checkedAddresses(check2.target).map(({ address }) => isLoopbackAddress(address));
+      if (!mayRedirectToLoopback && onLoopback.includes(true)) {
+        throw new EgressRefusedError(`Refused to connect to ${url.host}: a redirect from a site that is not on loopback must not lead to loopback`, true);
+      }
+      mayRedirectToLoopback = !onLoopback.includes(false);
+      const response = await requestPinned(check2.target, agentFor(check2.target), { method, headers, body, signal });
+      const location = isLocationRedirectStatus(response.status) ? response.headers.get("location") : null;
+      if (location === null) return response;
+      await response.body?.cancel();
+      if (redirects >= GUARDED_FETCH_MAX_REDIRECTS) {
+        throw new EgressFailedError(`${url.host} redirected more than ${GUARDED_FETCH_MAX_REDIRECTS} times`);
+      }
+      let next;
+      try {
+        next = new URL(location, url);
+      } catch {
+        throw new EgressFailedError(`${url.host} redirected to an invalid Location`);
+      }
+      const status = response.status;
+      if (status === 303 && method !== "GET" && method !== "HEAD" || (status === 301 || status === 302) && method === "POST") {
+        method = "GET";
+        body = null;
+        for (const name of BODY_HEADERS) headers.delete(name);
+      }
+      if (next.origin !== url.origin) {
+        for (const name of CROSS_ORIGIN_DROPPED_HEADERS) headers.delete(name);
+      }
+      href = next.href;
+    }
+  };
+}
+async function untilAborted(operation, signal) {
+  if (!signal) return await operation;
+  let onAbort;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new DOMException("This operation was aborted", "AbortError"));
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    ]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+  }
+}
+async function requestPinned(target, dispatcher, init) {
+  const response = await undiciFetch(target.url, {
+    method: init.method,
+    headers: [...init.headers],
+    body: init.body,
+    signal: init.signal,
+    redirect: "manual",
+    dispatcher
+  });
+  return response;
+}
+function pinnedAgent(addresses) {
+  return new Agent({
+    // Try the next checked address when one does not answer, so a dual-stack
+    // site whose first address is unreachable (an IPv6-only network, a dead A
+    // record) still loads, as it does through global `fetch`. Every address
+    // passed the policy, so falling back reaches nothing it refused.
+    autoSelectFamily: true,
+    connect: { lookup: pinnedLookup(addresses) }
+  });
+}
+
 // ../api-routes/src/wordpress.ts
 function parseEnvInput(value, fieldName = "env") {
   const env = parseEnv(value);
@@ -61458,6 +61598,8 @@ async function withWordpressErrorHandling(handler) {
     return await handler();
   } catch (error) {
     if (error instanceof WordpressApiError) throw toAppError(error);
+    if (error instanceof EgressRefusedError && !error.redirected) throw validationError(error.message);
+    if (error instanceof EgressRefusedError || error instanceof EgressFailedError) throw providerError(error.message);
     throw error;
   }
 }
@@ -61467,6 +61609,10 @@ async function wordpressRoutes(app, opts) {
     if (opts.wordpressConnectionStore) return opts.wordpressConnectionStore;
     throw validationError("WordPress connection storage is not configured for this deployment");
   }
+  const egressFetch = createGuardedFetch({ allowLoopback });
+  function guarded(connection) {
+    return { ...connection, fetchImpl: egressFetch };
+  }
   async function assertWordpressUrlAllowed(rawUrl, field) {
     const check2 = await resolveWebhookTarget(rawUrl, { allowLoopback });
     if (!check2.ok) {
@@ -61478,7 +61624,7 @@ async function wordpressRoutes(app, opts) {
     if (!connection) {
       throw validationError(`No WordPress connection found for project "${projectName}". Run "canonry wordpress connect ${projectName}" first.`);
     }
-    return connection;
+    return guarded(connection);
   }
   app.post("/projects/:name/wordpress/connect", async (request) => {
     return withWordpressErrorHandling(async () => {
@@ -61506,8 +61652,8 @@ async function wordpressRoutes(app, opts) {
         createdAt: existing?.createdAt ?? now,
         updatedAt: now
       };
-      await verifyWordpressConnection(nextConnection);
-      const connection = store.upsertConnection(nextConnection);
+      await verifyWordpressConnection(guarded(nextConnection));
+      const connection = guarded(store.upsertConnection(nextConnection));
       const live = await getSiteStatus(connection, "live");
       const staging = connection.stagingUrl ? await getSiteStatus(connection, "staging") : null;
       writeAuditLog(app.db, {
@@ -61545,8 +61691,8 @@ async function wordpressRoutes(app, opts) {
   });
   app.get("/projects/:name/wordpress/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
-    const connection = opts.wordpressConnectionStore?.getConnection(project.name);
-    if (!connection) {
+    const stored = opts.wordpressConnectionStore?.getConnection(project.name);
+    if (!stored) {
       return {
         connected: false,
         projectName: project.name,
@@ -61556,6 +61702,7 @@ async function wordpressRoutes(app, opts) {
         adminUrl: null
       };
     }
+    const connection = guarded(stored);
     const live = await getSiteStatus(connection, "live");
     const staging = connection.stagingUrl ? await getSiteStatus(connection, "staging") : null;
     return {
@@ -61840,8 +61987,8 @@ async function wordpressRoutes(app, opts) {
           createdAt: existing?.createdAt ?? now,
           updatedAt: now
         };
-        await verifyWordpressConnection(nextConnection);
-        connection = store.upsertConnection(nextConnection);
+        await verifyWordpressConnection(guarded(nextConnection));
+        connection = guarded(store.upsertConnection(nextConnection));
         writeAuditLog(app.db, {
           projectId: project.id,
           actor: "api",
@@ -62793,7 +62940,6 @@ async function backlinksRoutes(app, opts) {
 import crypto48 from "crypto";
 import { isIP } from "net";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-import { Agent as UndiciAgent } from "undici";
 import { and as and60, desc as desc35, eq as eq69, gte as gte16, inArray as inArray28, lte as lte17, sql as sql28 } from "drizzle-orm";
 
 // ../api-routes/src/cloudflare-worker-version.ts
@@ -78093,7 +78239,7 @@ async function listWordpressTrafficEvents(options) {
   let skippedEntryCount = 0;
   let hasMore = false;
   const events = [];
-  const dispatcher = options.dispatcher;
+  const fetchImpl = options.fetchImpl ?? fetch;
   for (let page3 = 0; page3 < maxPages; page3 += 1) {
     const url = new URL(endpoint);
     url.searchParams.set("limit", String(pageSize));
@@ -78107,7 +78253,7 @@ async function listWordpressTrafficEvents(options) {
       url.searchParams.set("until", options.until);
     }
     url.searchParams.set("_cb", randomUUID4());
-    const fetchInit = {
+    const response = await fetchImpl(url, {
       method: "GET",
       headers: {
         Authorization: authHeader,
@@ -78115,11 +78261,7 @@ async function listWordpressTrafficEvents(options) {
         "Cache-Control": "no-cache"
       },
       signal: AbortSignal.timeout(timeoutMs)
-    };
-    if (dispatcher !== void 0) {
-      fetchInit.dispatcher = dispatcher;
-    }
-    const response = await fetch(url, fetchInit);
+    });
     if (!response.ok) {
       const body2 = await readErrorBody2(response);
       throw new WordpressTrafficApiError(
@@ -80570,28 +80712,8 @@ async function trafficRoutes(app, opts) {
     if (!check2.ok) {
       throw validationError(`WordPress baseUrl rejected: ${check2.message}`);
     }
-    const { address, family } = check2.target;
-    return new UndiciAgent({
-      connect: {
-        lookup: (_hostname, options, cb) => {
-          if (options?.all) {
-            cb(null, [{ address, family: family === 6 ? 6 : 4 }]);
-          } else {
-            cb(null, address, family === 6 ? 6 : 4);
-          }
-        }
-      }
-    });
-  }
-  async function withPinnedWordpressDispatcher(baseUrl, fn) {
-    const dispatcher = await assertWordpressTargetAllowed(baseUrl);
-    try {
-      return await fn(dispatcher);
-    } finally {
-      await dispatcher.close().catch(() => {
-      });
-    }
   }
+  const wordpressTrafficFetch = createGuardedFetch({ allowLoopback });
   const vercelMaxPages = opts.defaultVercelMaxPages ?? DEFAULT_VERCEL_MAX_PAGES;
   const vercelSyncDeadlineMs = opts.vercelSyncDeadlineMs ?? DEFAULT_VERCEL_SYNC_DEADLINE_MS;
   const syncWindowMinutes = opts.defaultSyncWindowMinutes ?? DEFAULT_SYNC_WINDOW_MINUTES;
@@ -80743,26 +80865,26 @@ async function trafficRoutes(app, opts) {
       throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
     }
     const { baseUrl, username, applicationPassword, displayName } = parsed.data;
-    await withPinnedWordpressDispatcher(baseUrl, async (dispatcher) => {
-      try {
-        await pullWordpressEvents({
-          baseUrl,
-          username,
-          applicationPassword,
-          pageSize: 1,
-          maxPages: 1,
-          dispatcher
-        });
-      } catch (e) {
-        if (e instanceof WordpressTrafficApiError) {
-          throw providerError(
-            `WordPress traffic probe failed (HTTP ${e.status}): ${e.message}${e.body ? ` \u2014 ${e.body}` : ""}`
-          );
-        }
-        const msg = describeError(e);
-        throw providerError(`WordPress traffic probe failed: ${msg}`);
+    await assertWordpressTargetAllowed(baseUrl);
+    try {
+      await pullWordpressEvents({
+        baseUrl,
+        username,
+        applicationPassword,
+        pageSize: 1,
+        maxPages: 1,
+        fetchImpl: wordpressTrafficFetch
+      });
+    } catch (e) {
+      if (e instanceof WordpressTrafficApiError) {
+        throw providerError(
+          `WordPress traffic probe failed (HTTP ${e.status}): ${e.message}${e.body ? ` \u2014 ${e.body}` : ""}`
+        );
       }
-    });
+      if (e instanceof EgressRefusedError && !e.redirected) throw validationError(`WordPress baseUrl rejected: ${e.message}`);
+      const msg = describeError(e);
+      throw providerError(`WordPress traffic probe failed: ${msg}`);
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = credentialStore.getConnection(project.name);
     credentialStore.upsertConnection({
@@ -81835,10 +81957,9 @@ async function trafficRoutes(app, opts) {
         const windowEndIso = windowEnd.toISOString();
         const wpPageSize = opts.defaultWordpressPageSize ?? DEFAULT_WP_PAGE_SIZE;
         const wpMaxPages = opts.defaultWordpressMaxPages ?? DEFAULT_WP_MAX_PAGES;
-        let pinnedDispatcher;
         try {
           renewWordpressLease();
-          pinnedDispatcher = await assertWordpressTargetAllowed(credential.baseUrl);
+          await assertWordpressTargetAllowed(credential.baseUrl);
         } catch (e) {
           const msg = describeError(e);
           markFailed(msg, "PROVIDER_PULL");
@@ -81858,7 +81979,7 @@ async function trafficRoutes(app, opts) {
               maxPages: 1,
               since: windowStartIso,
               until: windowEndIso,
-              dispatcher: pinnedDispatcher
+              fetchImpl: wordpressTrafficFetch
             });
             collected.push(...pageResult.events);
             const previousCursor = cursor;
@@ -81876,10 +81997,8 @@ async function trafficRoutes(app, opts) {
         } catch (e) {
           const msg = describeError(e);
           markFailed(msg, "PROVIDER_PULL");
+          if (e instanceof EgressRefusedError && !e.redirected) throw validationError(`WordPress baseUrl rejected: ${msg}`);
           throw providerError(`WordPress pull failed: ${msg}`);
-        } finally {
-          await pinnedDispatcher.close().catch(() => {
-          });
         }
       } else {
         auditAction = "traffic.vercel.synced";
@@ -84383,7 +84502,7 @@ var DATA_FRESHNESS_CHECKS = [gaRecentDataCheck, gscRecentDataCheck];
 import dns3 from "dns/promises";
 import http3 from "http";
 import https3 from "https";
-import net3 from "net";
+import net4 from "net";
 var SITE_REACHABILITY_USER_AGENT = "Canonry site-liveness (+https://canonry.ai)";
 var DEFAULT_SITE_MAX_REDIRECTS = 10;
 var DEFAULT_TIMEOUT_MS5 = 1e4;
@@ -84408,7 +84527,7 @@ function errorCode(err) {
   return typeof code === "string" ? code : "";
 }
 async function lookupSiteAddresses(hostname, timeoutMs = DNS_TIMEOUT_MS) {
-  const literalFamily = net3.isIPv6(hostname) ? 6 : net3.isIPv4(hostname) ? 4 : null;
+  const literalFamily = net4.isIPv6(hostname) ? 6 : net4.isIPv4(hostname) ? 4 : null;
   if (literalFamily) return { kind: "addresses", addresses: [{ address: hostname, family: literalFamily }] };
   let timer;
   const deadline = new Promise((resolve) => {
@@ -86374,7 +86493,10 @@ var WORDPRESS_PUBLISH_CHECKS = [
         };
       }
       try {
-        const status = await verifyWordpressConnection(connection);
+        const status = await verifyWordpressConnection({
+          ...connection,
+          fetchImpl: createGuardedFetch({ allowLoopback: ctx.allowLoopbackWebhooks === true })
+        });
         return {
           status: CheckStatuses.ok,
           code: "wordpress.publish.connected",
@@ -87023,6 +87145,7 @@ async function doctorRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       bingConnectionStore: opts.bingConnectionStore,
       wordpressConnectionStore: opts.wordpressConnectionStore,
+      allowLoopbackWebhooks: opts.allowLoopbackWebhooks,
       ga4CredentialStore: opts.ga4CredentialStore,
       adsCredentialStore: opts.adsCredentialStore,
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
@@ -87056,6 +87179,7 @@ async function doctorRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       bingConnectionStore: opts.bingConnectionStore,
       wordpressConnectionStore: opts.wordpressConnectionStore,
+      allowLoopbackWebhooks: opts.allowLoopbackWebhooks,
       ga4CredentialStore: opts.ga4CredentialStore,
       adsCredentialStore: opts.adsCredentialStore,
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
@@ -90964,6 +91088,7 @@ async function apiRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       bingConnectionStore: opts.bingConnectionStore,
       wordpressConnectionStore: opts.wordpressConnectionStore,
+      allowLoopbackWebhooks: opts.allowLoopbackWebhooks,
       ga4CredentialStore: opts.ga4CredentialStore,
       adsCredentialStore: opts.adsCredentialStore,
       getGoogleAuthConfig: opts.getGoogleAuthConfig,
@@ -91028,6 +91153,7 @@ function buildTrafficSourceValidators(opts) {
   if (opts.wordpressTrafficCredentialStore) {
     const store = opts.wordpressTrafficCredentialStore;
     const pullEvents = opts.pullWordpressTrafficEvents ?? listWordpressTrafficEvents;
+    const wordpressTrafficFetch = createGuardedFetch({ allowLoopback: opts.allowLoopbackWebhooks === true });
     validators[TrafficSourceTypes.wordpress] = {
       validateCredentials: async (source) => {
         const record = store.getConnection(source.projectName);
@@ -91045,7 +91171,10 @@ function buildTrafficSourceValidators(opts) {
             username: record.username,
             applicationPassword: record.applicationPassword,
             pageSize: 1,
-            maxPages: 1
+            maxPages: 1,
+            // The probe carries Basic-auth credentials: check the stored URL
+            // and every redirect hop as the sync route does.
+            fetchImpl: wordpressTrafficFetch
           });
           return {
             status: CheckStatuses.ok,
@@ -92319,6 +92448,7 @@ export {
   determineCitationState,
   computeCitedCompetitorDomains,
   resolveTrustProxy,
+  hasProxyHeaders,
   USER_SESSION_COOKIE_NAME,
   cookieIsSecure,
   anyUsersExist,
@@ -92331,6 +92461,8 @@ export {
   requireInstanceAdministrator,
   hashApiKey,
   notProbeRun,
+  writeAuditLog,
+  auditFromRequest,
   registerAgentConversationRoutes,
   measurementSlotKey,
   measurementRunSlotState,
@@ -92392,6 +92524,9 @@ export {
   classifyReviewsError,
   getUrlInfo,
   getCrawlIssues,
+  EgressRefusedError,
+  EgressFailedError,
+  createGuardedFetch,
   PLUGIN_DIR,
   DUCKDB_SPEC,
   CC_CACHE_DIR,