@canonry/canonry 7.23.0 → 7.24.1

package/dist/{chunk-46JZR2IV.js → chunk-H7UNFLYH.js}

@@ -64,6 +64,7 @@ import {
   DiscoveryCompetitorTypes,
   DiscoveryPromoteCompetitorSkipReasons,
   DiscoverySessionStatuses,
+  FeatureNames,
   GA_SEARCH_LANDING_DEFAULT_LIMIT,
   GA_SEARCH_LANDING_DEFAULT_WINDOW,
   GA_SEARCH_LANDING_MAX_LIMIT,
@@ -118,11 +119,15 @@ import {
   OPERATIONAL_LOG_FIELDS_HEADER,
   OPERATIONAL_LOG_OPT_IN_CONTEXT_FIELDS,
   OUTSTANDING_PROVIDER_BATCH_STATUSES,
+  OutcomeReasonCodes,
+  OutcomeStatuses,
+  OutcomeTriggers,
   POOLED_RUN_ID_LIMIT,
   PROJECTS_WRITE_SCOPE,
   PROJECT_OVERVIEW_QUERY_CLASS_SCOPE,
   PROVIDER_ACCOUNT_FAILURE_STREAK,
   PROVIDER_ACCOUNT_RETRY_HOURS,
+  PROVIDER_NAMES,
   ProviderDispatchModes,
   READ_ONLY_SCOPE,
   RESEARCH_RUN_SCOPE,
@@ -264,6 +269,7 @@ import {
   brandLabelFromDomain,
   brandMetricsDtoSchema,
   breakdownShares,
+  bucketDuration,
   buildHarvestAnchorTerms,
   buildMeasurementExecutionIdentity,
   buildMeasurementRunManifestV1,
@@ -293,6 +299,7 @@ import {
   citationVisibilityResponseSchema,
   classifyAiReferralTrafficClass,
   classifyCitedSurface,
+  classifyOutcomeError,
   classifyProviderErrorMessage,
   classifySkillFile,
   classifySurfaceFromCategory,
@@ -610,6 +617,7 @@ import {
   nextScheduleUpdatedAt,
   noProvider,
   noQueries,
+  normalizeAgentSlug,
   normalizeCompetitorAliases,
   normalizeCompetitorDomain,
   normalizeIdTokens,
@@ -640,6 +648,7 @@ import {
   orderLocationsDefaultFirst,
   organicEvidenceDtoSchema,
   organicEvidencePeriodSchema,
+  outcomeSurfaceSchema,
   parseBoundedRate,
   parseInclusiveEndMs,
   parseMeasurementDraftEtagVersion,
@@ -855,7 +864,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-MRKV43TV.js";
+} from "./chunk-656KW4RB.js";
 
 // src/intelligence-service.ts
 import { eq as eq89, desc as desc41, asc as asc18, and as and75, ne as ne16, or as or22, inArray as inArray36, gte as gte24, lte as lte20, isNull as isNull17, sql as sql32, exists as exists2 } from "drizzle-orm";
@@ -13118,12 +13127,28 @@ import { eq as eq5, ne, sql as sql5 } from "drizzle-orm";
 import { AsyncLocalStorage } from "async_hooks";
 var requestContext = new AsyncLocalStorage();
 var MAX_REQUEST_CONTEXT_LENGTH = 512;
+var ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,39}$/;
+var MAX_ERROR_BODY_BYTES = 16384;
+function errorCodeOfBody(payload) {
+  const text2 = typeof payload === "string" ? payload : Buffer.isBuffer(payload) ? payload.toString("utf8") : void 0;
+  if (!text2 || text2.length > MAX_ERROR_BODY_BYTES || !text2.trimStart().startsWith("{")) return void 0;
+  try {
+    const code = JSON.parse(text2).error?.code;
+    return typeof code === "string" && ERROR_CODE_PATTERN.test(code) ? code : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function getRequestContext(boundRequestId) {
   const context = requestContext.getStore();
   if (!context || context.completed && context.requestId !== boundRequestId) return void 0;
   const { completed: _completed, ...safeContext } = context;
   return safeContext;
 }
+function currentOutcomeAttribution() {
+  const context = getRequestContext();
+  return context ? { userAgent: context.userAgent, surfaceLabel: context.usageSurface, agentLabel: context.usageAgent } : void 0;
+}
 function requestAuditIdentity(request) {
   const principal = request.principal;
   if (!principal) return {};
@@ -13152,17 +13177,30 @@ function registerRequestContext(app, options = {}) {
       actorSession: sanitizeRequestContext(request.headers["x-canonry-actor-session"]) ?? void 0,
       method: request.method,
       // Route template only, never a raw URL, query string, or route parameter.
-      route: request.routeOptions.url
+      route: request.routeOptions.url,
+      usageSurface: headerValue(request.headers[USAGE_TELEMETRY_HEADERS.surface]),
+      usageAgent: headerValue(request.headers[USAGE_TELEMETRY_HEADERS.agent])
     }, done);
   });
   app.addHook("preHandler", (request, _reply, done) => {
     populateIdentity(request);
     done();
   });
-  app.addHook("onError", (request, _reply, _error, done) => {
+  app.addHook("onError", (request, _reply, error, done) => {
     populateIdentity(request);
+    const code = error.code;
+    const context = requestContext.getStore();
+    if (context && typeof code === "string" && ERROR_CODE_PATTERN.test(code)) context.errorCode = code;
     done();
   });
+  app.addHook("onSend", (_request, reply, payload, done) => {
+    if (reply.statusCode >= 400) {
+      const context = requestContext.getStore();
+      const code = context ? errorCodeOfBody(payload) : void 0;
+      if (context && code) context.errorCode = code;
+    }
+    done(null, payload);
+  });
   app.addHook("onResponse", (request, reply, done) => {
     populateIdentity(request);
     const context = requestContext.getStore();
@@ -13176,6 +13214,7 @@ function registerRequestContext(app, options = {}) {
           route,
           statusCode: reply.statusCode,
           durationMs: reply.elapsedTime,
+          ...context?.errorCode && reply.statusCode >= 400 ? { errorCode: context.errorCode } : {},
           userAgent: headerValue(request.headers["user-agent"]),
           actorSession: headerValue(request.headers["x-canonry-actor-session"]),
           principalKind: kind === "user" ? "user" : kind ? "api-key" : void 0,
@@ -14532,6 +14571,17 @@ async function sentimentRoutes(app, options) {
   });
 }
 
+// ../api-routes/src/outcome-telemetry.ts
+function createOutcomeEmitter(sink) {
+  return (event) => {
+    if (!sink) return;
+    try {
+      sink({ ...event, attribution: event.attribution ?? currentOutcomeAttribution() });
+    } catch {
+    }
+  };
+}
+
 // ../api-routes/src/oauth.ts
 import crypto6 from "crypto";
 import { and as and5, eq as eq10, isNull as isNull3, lt as lt3 } from "drizzle-orm";
@@ -14995,6 +15045,93 @@ function registerOAuthAdminRoutes(app, opts) {
 import crypto12 from "crypto";
 import { and as and13, eq as eq19, sql as sql7 } from "drizzle-orm";
 
+// ../api-routes/src/feature-outcome.ts
+function reportFeatureOutcome(app, target, outcome2) {
+  try {
+    app.emitOutcome({
+      event: "feature.completed",
+      properties: {
+        feature: target.feature,
+        operation: target.operation,
+        ...target.trigger ? { trigger: target.trigger } : {},
+        ...outcome2
+      },
+      ...target.attribution ? { attribution: target.attribution } : {}
+    });
+  } catch {
+  }
+}
+function failedOutcome(err, reasonCode) {
+  return { status: OutcomeStatuses.failed, ...classifyOutcomeError(err), ...reasonCode ? { reasonCode } : {} };
+}
+async function withFeatureOutcome(app, target, run, failureReason) {
+  const startedAt = Date.now();
+  let settled;
+  const report = (outcome2) => {
+    try {
+      const resolved = outcome2();
+      if (resolved) reportFeatureOutcome(app, target, { ...resolved, durationBucket: bucketDuration(Date.now() - startedAt) });
+    } catch {
+    }
+  };
+  let result;
+  try {
+    result = await run((outcome2) => {
+      settled = outcome2;
+    });
+  } catch (err) {
+    report(() => {
+      if (settled === null) return null;
+      if (settled && settled.status !== OutcomeStatuses.succeeded) return settled;
+      return failedOutcome(err, failureReason?.(err));
+    });
+    throw err;
+  }
+  report(() => settled === void 0 ? { status: OutcomeStatuses.succeeded } : settled);
+  return result;
+}
+function startRouteOutcome(app, feature, operation, options = {}) {
+  const startedAt = Date.now();
+  let sent = false;
+  const report = (outcome2) => {
+    if (sent) return;
+    sent = true;
+    const counts2 = Object.entries(outcome2.counts ?? {}).filter((entry) => typeof entry[1] === "number");
+    reportFeatureOutcome(app, { feature, operation, ...options }, {
+      status: outcome2.status,
+      ...outcome2.reasonCode ? { reasonCode: outcome2.reasonCode } : {},
+      ...outcome2.errorName ? { errorName: outcome2.errorName } : {},
+      durationBucket: bucketDuration(Date.now() - startedAt),
+      ...counts2.length > 0 ? { counts: Object.fromEntries(counts2) } : {}
+    });
+  };
+  return {
+    report,
+    refuse(reasonCode, error) {
+      report({ status: OutcomeStatuses.failed, reasonCode });
+      return error;
+    },
+    guard(reasonCode, check2) {
+      try {
+        return check2();
+      } catch (err) {
+        report({ status: OutcomeStatuses.failed, ...classifyOutcomeError(err), reasonCode });
+        throw err;
+      }
+    }
+  };
+}
+function upstreamFailure(err) {
+  const classified = classifyOutcomeError(err);
+  const upstreamStatus = err instanceof AppError ? err.details?.upstreamStatus : void 0;
+  return typeof upstreamStatus === "number" ? { ...classified, reasonCode: classifyOutcomeError({ status: upstreamStatus }).reasonCode } : classified;
+}
+function credentialFailure(err) {
+  const classified = classifyOutcomeError(err);
+  const transient = [OutcomeReasonCodes.RATE_LIMITED, OutcomeReasonCodes.TIMEOUT, OutcomeReasonCodes.NETWORK];
+  return transient.includes(classified.reasonCode) ? classified : { ...classified, reasonCode: OutcomeReasonCodes.INVALID_CREDENTIALS };
+}
+
 // ../api-routes/src/competitor-writes.ts
 import crypto8 from "crypto";
 import { and as and8, eq as eq13 } from "drizzle-orm";
@@ -15754,6 +15891,450 @@ function marketCompetitorDto(entry, stored, now) {
   };
 }
 
+// ../api-routes/src/notifications/destinations.ts
+import { z as z2 } from "zod";
+
+// ../api-routes/src/notifications/alert.ts
+import { z } from "zod";
+var alertSeveritySchema = z.enum(["critical", "warning", "success", "info"]);
+var AlertSeverities = alertSeveritySchema.enum;
+var AlertFieldLabels = {
+  status: "Status",
+  check: "Check",
+  previously: "Was",
+  remediation: "What to do",
+  alsoFailing: "Also failing",
+  event: "Event",
+  run: "Run",
+  changes: "Changes",
+  insights: "Insights",
+  location: "Location",
+  rating: "Rating",
+  reviewer: "Reviewer",
+  replied: "Replied",
+  source: "Source"
+};
+var HEALTH_EVENTS = /* @__PURE__ */ new Set(["health.degraded", "health.recovered"]);
+function isHealth(payload) {
+  return HEALTH_EVENTS.has(payload.event);
+}
+var MAX_LIST_ITEMS = 10;
+function bulletList(lines) {
+  const shown = lines.slice(0, MAX_LIST_ITEMS);
+  const omitted = lines.length - shown.length;
+  const body = shown.map((line) => `\u2022 ${line}`).join("\n");
+  return omitted > 0 ? `${body}
+\u2022 \u2026and ${omitted} more` : body;
+}
+function healthView(payload) {
+  const { health, project } = payload;
+  const recovered = payload.event === "health.recovered";
+  const severity = recovered ? AlertSeverities.success : health.status === "fail" ? AlertSeverities.critical : AlertSeverities.warning;
+  const fields = [
+    { label: AlertFieldLabels.status, value: recovered ? "recovered" : health.status, compact: true },
+    { label: AlertFieldLabels.check, value: health.code, compact: true }
+  ];
+  if (health.previousStatus) {
+    fields.push({ label: AlertFieldLabels.previously, value: health.previousStatus, compact: true });
+  }
+  if (health.remediation) {
+    fields.push({ label: AlertFieldLabels.remediation, value: health.remediation });
+  }
+  const others = health.failing.filter((check2) => check2.code !== health.code);
+  if (others.length > 0) {
+    fields.push({
+      label: `${AlertFieldLabels.alsoFailing} (${others.length})`,
+      value: bulletList(others.map((check2) => `${check2.status} \u2014 ${check2.code}`))
+    });
+  }
+  const website = health.code.startsWith("site.reachability.");
+  return {
+    severity,
+    title: website ? recovered ? `${project.name} website is back up` : `${project.name} website is down` : recovered ? `${project.name} recovered` : `${project.name} \u2014 measurement degraded`,
+    body: health.summary,
+    fields,
+    url: payload.dashboardUrl,
+    footer: project.canonicalDomain,
+    timestamp: health.checkedAt
+  };
+}
+function runView(payload) {
+  const failed = payload.event === "run.failed";
+  const transitions = "transitions" in payload ? payload.transitions : [];
+  const insights2 = "insights" in payload ? payload.insights : [];
+  const fields = [
+    { label: AlertFieldLabels.event, value: payload.event, compact: true },
+    { label: AlertFieldLabels.run, value: payload.run.status, compact: true }
+  ];
+  if (transitions.length > 0) {
+    fields.push({
+      label: `${AlertFieldLabels.changes} (${transitions.length})`,
+      value: bulletList(transitions.map((t) => `${t.provider}: ${t.from} \u2192 ${t.to} \u2014 ${t.query}`))
+    });
+  }
+  if (insights2.length > 0) {
+    fields.push({
+      label: `${AlertFieldLabels.insights} (${insights2.length})`,
+      value: bulletList(insights2.map((i) => `[${i.severity}] ${i.title}`))
+    });
+  }
+  return {
+    severity: failed ? AlertSeverities.critical : AlertSeverities.info,
+    title: payload.project.name,
+    fields,
+    url: payload.dashboardUrl,
+    footer: payload.project.canonicalDomain,
+    ...payload.run.finishedAt ? { timestamp: payload.run.finishedAt } : {}
+  };
+}
+function stars(rating) {
+  const filled = Math.max(0, Math.min(5, Math.round(rating)));
+  return `${"\u2605".repeat(filled)}${"\u2606".repeat(5 - filled)}`;
+}
+function snippet(text2, max2 = 160) {
+  const flat = text2.replace(/\s+/g, " ").trim();
+  return flat.length > max2 ? `${flat.slice(0, max2 - 1)}\u2026` : flat;
+}
+var SOURCE_LABELS = {
+  gbp: "Business Profile",
+  places: "Public listing (Places, partial)"
+};
+function reviewView(payload) {
+  const { project, reviews } = payload;
+  const newest = reviews.reduce((latest, r) => !latest || r.updateTime > latest ? r.updateTime : latest, void 0);
+  const origins = [...new Set(reviews.map((r) => r.origin))];
+  const sourceField = {
+    label: AlertFieldLabels.source,
+    value: origins.map((origin) => SOURCE_LABELS[origin]).join(", "),
+    compact: true
+  };
+  if (reviews.length === 1) {
+    const review = reviews[0];
+    const fields = [
+      { label: AlertFieldLabels.location, value: review.location.displayName, compact: true },
+      { label: AlertFieldLabels.rating, value: `${stars(review.starRating)} (${review.starRating}/5)`, compact: true }
+    ];
+    if (review.reviewerName) fields.push({ label: AlertFieldLabels.reviewer, value: review.reviewerName, compact: true });
+    if (review.replied !== null) fields.push({ label: AlertFieldLabels.replied, value: review.replied ? "yes" : "no", compact: true });
+    fields.push(sourceField);
+    return {
+      severity: AlertSeverities.warning,
+      title: `${project.name}: new ${review.starRating}-star review`,
+      body: review.comment ?? "Rating only, no text.",
+      fields,
+      url: review.reviewUri ?? review.location.mapsUri ?? payload.dashboardUrl,
+      footer: project.canonicalDomain,
+      timestamp: review.updateTime
+    };
+  }
+  return {
+    severity: AlertSeverities.warning,
+    title: `${project.name}: ${reviews.length} new negative reviews`,
+    body: bulletList(reviews.map((r) => {
+      const text2 = r.comment ? ` "${snippet(r.comment)}"` : "";
+      const by = r.reviewerName ? ` (${r.reviewerName})` : "";
+      return `${stars(r.starRating)} ${r.location.displayName}:${text2}${by}`;
+    })),
+    fields: [sourceField],
+    url: payload.dashboardUrl,
+    footer: project.canonicalDomain,
+    ...newest ? { timestamp: newest } : {}
+  };
+}
+function ratingView(payload) {
+  const { project, ratings } = payload;
+  const line = (r) => {
+    const counts2 = r.previousReviewCount !== null && r.reviewCount !== null ? ` (${r.previousReviewCount} \u2192 ${r.reviewCount} reviews)` : "";
+    return `${r.location.displayName}: ${r.previousRating} \u2192 ${r.rating}${counts2}`;
+  };
+  const single = ratings.length === 1 ? ratings[0] : null;
+  return {
+    severity: AlertSeverities.warning,
+    title: single ? `${project.name}: Google rating fell to ${single.rating}` : `${project.name}: Google rating fell at ${ratings.length} locations`,
+    body: single ? line(single) : bulletList(ratings.map(line)),
+    fields: [
+      { label: AlertFieldLabels.source, value: SOURCE_LABELS.places, compact: true },
+      {
+        label: AlertFieldLabels.remediation,
+        value: "Read the newest reviews on Google Maps. Without Business Profile review access, Canonry sees at most five of them."
+      }
+    ],
+    url: single?.location.mapsUri ?? payload.dashboardUrl,
+    footer: project.canonicalDomain,
+    timestamp: ratings.reduce((latest, r) => r.observedAt > latest ? r.observedAt : latest, ratings[0]?.observedAt ?? "")
+  };
+}
+function toAlertView(payload) {
+  if (isHealth(payload)) return healthView(payload);
+  if (payload.event === "review.negative") return reviewView(payload);
+  if (payload.event === "review.rating-dropped") return ratingView(payload);
+  return runView(payload);
+}
+
+// ../api-routes/src/notifications/destinations.ts
+var webhookDestinationSchema = z2.enum(["first-party", "discord", "slack"]);
+var WebhookDestinations = webhookDestinationSchema.enum;
+function hostIs(url, ...domains) {
+  const host = url.hostname.toLowerCase();
+  return domains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+}
+var DISCORD_MAX_DESCRIPTION = 3800;
+var DISCORD_MAX_FIELD = 1e3;
+var DISCORD_COLORS = {
+  [AlertSeverities.critical]: 14235195,
+  [AlertSeverities.warning]: 14256926,
+  [AlertSeverities.success]: 3055183,
+  [AlertSeverities.info]: 4873068
+};
+var SEVERITY_ICONS = {
+  [AlertSeverities.critical]: "\u{1F534}",
+  [AlertSeverities.warning]: "\u{1F7E0}",
+  [AlertSeverities.success]: "\u2705",
+  [AlertSeverities.info]: "\u{1F4CA}"
+};
+function clamp(value, max2) {
+  return value.length <= max2 ? value : `${value.slice(0, max2 - 1)}\u2026`;
+}
+function absoluteLink(url) {
+  if (!url) return void 0;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function renderDiscord(view) {
+  return {
+    username: "Canonry",
+    embeds: [{
+      title: `${SEVERITY_ICONS[view.severity]} ${view.title}`,
+      ...view.body ? { description: clamp(view.body, DISCORD_MAX_DESCRIPTION) } : {},
+      color: DISCORD_COLORS[view.severity],
+      fields: view.fields.map((field) => ({
+        name: field.label,
+        value: clamp(field.value, DISCORD_MAX_FIELD),
+        ...field.compact ? { inline: true } : {}
+      })),
+      ...absoluteLink(view.url) ? { url: absoluteLink(view.url) } : {},
+      ...view.timestamp ? { timestamp: view.timestamp } : {},
+      ...view.footer ? { footer: { text: view.footer } } : {}
+    }]
+  };
+}
+var SLACK_MAX_TEXT = 2900;
+var SLACK_MAX_FIELD = 1e3;
+var SLACK_COLORS = {
+  [AlertSeverities.critical]: "#d9363b",
+  [AlertSeverities.warning]: "#d98b1e",
+  [AlertSeverities.success]: "#2e9e4f",
+  [AlertSeverities.info]: "#4a5b6c"
+};
+function renderSlack(view) {
+  const headline = `${SEVERITY_ICONS[view.severity]} ${view.title}`;
+  return {
+    // `text` is the notification preview and the accessible fallback, so it
+    // must stand alone rather than repeat an empty string.
+    text: headline,
+    attachments: [{
+      color: SLACK_COLORS[view.severity],
+      title: headline,
+      ...absoluteLink(view.url) ? { title_link: absoluteLink(view.url) } : {},
+      ...view.body ? { text: clamp(view.body, SLACK_MAX_TEXT) } : {},
+      fields: view.fields.map((field) => ({
+        title: field.label,
+        value: clamp(field.value, SLACK_MAX_FIELD),
+        ...field.compact ? { short: true } : {}
+      })),
+      ...view.footer ? { footer: view.footer } : {},
+      ...view.timestamp ? { ts: Math.floor(new Date(view.timestamp).getTime() / 1e3) } : {}
+    }]
+  };
+}
+var DISCORD_ADAPTER = {
+  destination: WebhookDestinations.discord,
+  matches: (url) => hostIs(url, "discord.com", "discordapp.com") && url.pathname.startsWith("/api/webhooks/"),
+  render: renderDiscord,
+  signed: false
+};
+var SLACK_ADAPTER = {
+  destination: WebhookDestinations.slack,
+  matches: (url) => hostIs(url, "slack.com") && url.pathname.startsWith("/services/"),
+  render: renderSlack,
+  signed: false
+};
+var FIRST_PARTY_ADAPTER = {
+  destination: WebhookDestinations["first-party"],
+  matches: () => true,
+  signed: true
+};
+var DESTINATION_ADAPTERS = [
+  DISCORD_ADAPTER,
+  SLACK_ADAPTER,
+  FIRST_PARTY_ADAPTER
+];
+function resolveDestination(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return FIRST_PARTY_ADAPTER;
+  }
+  if (url.protocol !== "https:") return FIRST_PARTY_ADAPTER;
+  return DESTINATION_ADAPTERS.find((adapter) => adapter.matches(url)) ?? FIRST_PARTY_ADAPTER;
+}
+
+// ../api-routes/src/connection-telemetry.ts
+var PROVIDER_NAME_SET = new Set(PROVIDER_NAMES);
+function outcomeProviderName(name) {
+  return PROVIDER_NAME_SET.has(name) ? name : void 0;
+}
+function telemetryRead(read, fallback) {
+  try {
+    return read();
+  } catch {
+    return fallback;
+  }
+}
+var APP_ERROR_REASONS = {
+  NOT_IMPLEMENTED: "UNSUPPORTED",
+  INTERNAL_ERROR: "INTERNAL",
+  MISSING_DEPENDENCY: "UNSUPPORTED"
+};
+function routeOutcomeFailure(err, reasonCode) {
+  const classified = classifyOutcomeError(err);
+  if (reasonCode) return { ...classified, reasonCode };
+  const { code, details } = err && typeof err === "object" ? err : {};
+  if (code === "FORBIDDEN") {
+    const upstreamStatus = details?.upstreamStatus;
+    return {
+      ...classified,
+      reasonCode: typeof upstreamStatus === "number" ? classifyOutcomeError({ status: upstreamStatus }).reasonCode : "GATE_REFUSED"
+    };
+  }
+  const mapped = typeof code === "string" ? APP_ERROR_REASONS[code] : void 0;
+  return { ...classified, reasonCode: mapped ?? classified.reasonCode };
+}
+var DESTINATION_TARGETS = {
+  "first-party": "first_party",
+  discord: "discord",
+  slack: "slack"
+};
+function webhookOutcomeTarget(rawUrl) {
+  return DESTINATION_TARGETS[resolveDestination(rawUrl).destination];
+}
+function webhookTargetRefusalReason(check2) {
+  if (check2.blocked) return "BLOCKED_UNSAFE_URL";
+  if (check2.unresolved) return "NETWORK";
+  return "VALIDATION";
+}
+function webhookResponseReason(result) {
+  if (result.status >= 200 && result.status < 300) return void 0;
+  if (result.status === 0) return result.timedOut ? "TIMEOUT" : "NETWORK";
+  if (result.status >= 500) return "HTTP_5XX";
+  if (result.status >= 400) return "HTTP_4XX";
+  return "UNSUPPORTED";
+}
+function oauthStartAttribution() {
+  const context = getRequestContext();
+  const surface = outcomeSurfaceSchema.safeParse(context?.usageSurface);
+  const agent = normalizeAgentSlug(context?.usageAgent);
+  return {
+    ...surface.success ? { surface: surface.data } : {},
+    ...agent ? { agent } : {}
+  };
+}
+function oauthStateAttribution(state) {
+  if (!state) return {};
+  const surface = outcomeSurfaceSchema.safeParse(state.surface);
+  const agent = typeof state.agent === "string" ? normalizeAgentSlug(state.agent) : null;
+  return {
+    ...surface.success ? { surface: surface.data } : {},
+    ...agent ? { agent } : {}
+  };
+}
+function unverifiedOAuthStateField(encoded, field) {
+  if (!encoded || encoded.length > 8192) return void 0;
+  try {
+    const envelope = JSON.parse(Buffer.from(encoded, "base64url").toString());
+    if (typeof envelope.payload !== "string") return void 0;
+    const value = JSON.parse(envelope.payload)[field];
+    return typeof value === "string" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var NO_ATTEMPT = {
+  update: () => {
+  },
+  started: () => {
+  },
+  succeeded: () => {
+  },
+  failed: () => {
+  },
+  cancelled: () => {
+  },
+  deferred: () => {
+  }
+};
+function startConnectionAttempt(app, subject, now = Date.now) {
+  if (!subject) return NO_ATTEMPT;
+  const startedAt = now();
+  let current = { ...subject };
+  let reported = false;
+  const report = (status, failure) => {
+    if (reported) return;
+    reported = true;
+    try {
+      const emit = app.emitOutcome;
+      if (typeof emit !== "function") return;
+      const properties = {
+        ...current,
+        status,
+        ...failure,
+        ...status === "started" ? {} : { durationBucket: bucketDuration(now() - startedAt) }
+      };
+      for (const key of Object.keys(properties)) {
+        if (properties[key] === void 0) delete properties[key];
+      }
+      emit.call(app, { event: "integration.connection", properties });
+    } catch {
+    }
+  };
+  return {
+    update: (patch) => {
+      current = { ...current, ...patch };
+    },
+    started: () => report("started"),
+    succeeded: () => report("succeeded"),
+    failed: (err, reasonCode) => report("failed", routeOutcomeFailure(err, reasonCode)),
+    cancelled: (reasonCode) => report("cancelled", { reasonCode }),
+    deferred: () => {
+      reported = true;
+    }
+  };
+}
+function connectionRoute(app, subjectOf, handler) {
+  return async (request, reply) => {
+    let subject;
+    try {
+      subject = subjectOf(request);
+    } catch {
+      subject = void 0;
+    }
+    const attempt = startConnectionAttempt(app, subject);
+    try {
+      const result = await handler(request, reply, attempt);
+      attempt.succeeded();
+      return result;
+    } catch (err) {
+      attempt.failed(err);
+      throw err;
+    }
+  };
+}
+
 // ../api-routes/src/settings.ts
 var SETTINGS_WRITE_SCOPE = "settings.write";
 async function settingsRoutes(app, opts) {
@@ -15782,7 +16363,13 @@ async function settingsRoutes(app, opts) {
       bing: opts.bing ?? { configured: false }
     };
   });
-  app.put("/settings/providers/:name", async (request) => {
+  app.put("/settings/providers/:name", connectionRoute(app, (request) => {
+    const provider = outcomeProviderName(request.params.name);
+    const body = request.body;
+    if (!provider || body?.apiKey === void 0 && body?.baseUrl === void 0) return void 0;
+    const configured = (opts.providerSummary ?? []).some((entry) => entry.name === provider && entry.configured);
+    return { integration: "provider", provider, action: configured ? "reauth" : "connect" };
+  }, async (request) => {
     requireScope(request, SETTINGS_WRITE_SCOPE);
     const { apiKey, baseUrl, model, quota } = request.body ?? {};
     const name = request.params.name;
@@ -15862,8 +16449,8 @@ async function settingsRoutes(app, opts) {
       throw internalError("Failed to update provider configuration");
     }
     return result;
-  });
-  app.post("/settings/providers/reload", async (request) => {
+  }));
+  app.post("/settings/providers/reload", async (request) => withFeatureOutcome(app, { feature: "providers", operation: "reload" }, async (settle) => {
     requireScope(request, SETTINGS_WRITE_SCOPE);
     requireInstanceAdministrator(request);
     const parsed = providerReloadRequestSchema.safeParse(request.body ?? {});
@@ -15879,8 +16466,9 @@ async function settingsRoutes(app, opts) {
       entityType: "provider"
     });
     const providers = await opts.onProviderReload(parsed.data, { actor, userAgent, actorSession, requestId, credentialId });
+    settle({ status: OutcomeStatuses.succeeded, counts: { providers: providers.filter((provider) => provider.configured).length } });
     return providerReloadResponseDtoSchema.parse({ reloaded: true, providers });
-  });
+  }, (err) => err instanceof AppError && err.code === "NOT_IMPLEMENTED" ? OutcomeReasonCodes.UNSUPPORTED : void 0));
   app.put("/settings/google", async (request) => {
     requireScope(request, SETTINGS_WRITE_SCOPE);
     const { clientId, clientSecret } = request.body ?? {};
@@ -18386,7 +18974,7 @@ async function projectRoutes(app, opts) {
     });
     return reply.send({ defaultLocation: label });
   });
-  app.get("/projects/:name/export", async (request, reply) => {
+  app.get("/projects/:name/export", async (request, reply) => withFeatureOutcome(app, { feature: "exports", operation: "export" }, async (settle) => {
     const project = resolveProject(app.db, request.params.name);
     const negativeReviewMaxStars = readNegativeReviewMaxStars(app.db, project.id);
     const qs = app.db.select().from(queries).where(eq19(queries.projectId, project.id)).all();
@@ -18450,8 +19038,9 @@ async function projectRoutes(app, opts) {
         } : {}
       }
     };
+    settle({ status: OutcomeStatuses.succeeded, counts: { queries: qs.length } });
     return reply.send(config);
-  });
+  }));
 }
 function assertProviderModelScope(request, current, next, nextProviders) {
   const effectiveCurrent = pruneProviderModelsForProviders(current, nextProviders);
@@ -25707,9 +26296,12 @@ async function measurementDraftRoutes(app, opts = {}) {
       diff: diffCompiledPlans(comparable, compiled.plan, active?.revision ?? null)
     };
   });
-  app.post("/projects/:name/measurement-plan/draft/actions/publish", async (request, reply) => {
+  app.post("/projects/:name/measurement-plan/draft/actions/publish", async (request, reply) => withFeatureOutcome(app, { feature: "measurement", operation: "publish" }, async (recordOutcome) => {
     const gate = beginMutation(request, reply, "publish");
-    if (gate.replay !== null) return gate.replay;
+    if (gate.replay !== null) {
+      recordOutcome(null);
+      return gate.replay;
+    }
     const parsed = measurementDraftPublishRequestSchema.safeParse(request.body);
     if (!parsed.success) throw validationError('Invalid "publish" payload', { issues: parsed.error.issues });
     const ifMatch = requireIfMatch(request);
@@ -25718,7 +26310,7 @@ async function measurementDraftRoutes(app, opts = {}) {
     let pinEffect = null;
     const settled = app.db.transaction((tx) => {
       const pinWrite = beginMarketPinWrite(tx, gate.project);
-      const settle = (published, version, plan) => {
+      const settle = (published, version, plan2) => {
         const response = {
           published,
           active: {
@@ -25726,7 +26318,7 @@ async function measurementDraftRoutes(app, opts = {}) {
             checksum: version.checksum,
             compiledChecksum: version.compiledChecksum,
             createdAt: version.createdAt,
-            plan
+            plan: plan2
           }
         };
         sweepExpiredMeasurementReceipts(tx, now);
@@ -25843,9 +26435,11 @@ async function measurementDraftRoutes(app, opts = {}) {
       const created = tx.select().from(measurementPlanVersions).where(eq31(measurementPlanVersions.id, versionId)).get();
       return settle(true, created, compiled.plan);
     });
+    const { plan } = settled.active;
+    recordOutcome(settled.published ? { status: OutcomeStatuses.succeeded, counts: { items: plan.groups.length, targets: plan.targets.length, queries: plan.querySnapshots.length } } : { status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.NO_DATA });
     notifyMarketPinWrite(opts, gate.project, pinEffect);
     return settled;
-  });
+  }));
   app.post("/projects/:name/measurement-plan/draft/actions/discard", async (request, reply) => {
     const gate = beginMutation(request, reply, "discard");
     if (gate.replay !== null) return gate.replay;
@@ -31773,7 +32367,7 @@ async function resolveWebhookTarget(raw, options = {}) {
   }
   const blocked = addresses.find((entry) => isBlockedAddress(entry.address, options));
   if (blocked) {
-    return { ok: false, message: '"url" must not resolve to a private or loopback address' };
+    return { ok: false, message: '"url" must not resolve to a private or loopback address', blocked: true };
   }
   return {
     ok: true,
@@ -31825,11 +32419,13 @@ async function deliverWebhook(target, payload, webhookSecret) {
         resolve({ status: response.statusCode ?? 0, error: null });
       });
     });
+    let timedOut = false;
     request.on("timeout", () => {
+      timedOut = true;
       request.destroy(new Error(`Request timed out after ${REQUEST_TIMEOUT_MS}ms`));
     });
     request.on("error", (error) => {
-      resolve({ status: 0, error: error.message });
+      resolve({ status: 0, error: error.message, ...timedOut ? { timedOut: true } : {} });
     });
     request.end(body);
   });
@@ -36537,7 +37133,7 @@ function filenameFor(projectName, format2) {
   return `canonry-results-${safeName}-${date}.${format2}`;
 }
 async function resultsExportRoutes(app) {
-  app.get("/projects/:name/results/export", async (request, reply) => {
+  app.get("/projects/:name/results/export", async (request, reply) => withFeatureOutcome(app, { feature: "exports", operation: "export" }, async (settle) => {
     const project = resolveProject(app.db, request.params.name);
     const format2 = parseFormat(request.query.format);
     const includeProbes = parseBoolean(request.query.includeProbes, "includeProbes");
@@ -36634,13 +37230,11 @@ async function resultsExportRoutes(app) {
     reply.header("Content-Disposition", `attachment; filename="${filenameFor(project.name, format2)}"`);
     reply.header("Cache-Control", "private, no-store");
     reply.header("X-Content-Type-Options", "nosniff");
-    if (format2 === "csv") {
-      reply.type("text/csv; charset=utf-8");
-      return reply.send(renderResultsExportCsv(dto));
-    }
-    reply.type("application/json; charset=utf-8");
-    return reply.send(dto);
-  });
+    const body = format2 === "csv" ? renderResultsExportCsv(dto) : JSON.stringify(dto);
+    settle({ status: OutcomeStatuses.succeeded, counts: { rows: records.length, bytes: Buffer.byteLength(body) } });
+    reply.type(format2 === "csv" ? "text/csv; charset=utf-8" : "application/json; charset=utf-8");
+    return reply.send(body);
+  }));
 }
 
 // ../api-routes/src/composites.ts
@@ -38135,6 +38729,16 @@ function findRecommendationByRef(db, project, targetRef) {
   const rows = buildContentTargetRows(input);
   return rows.find((r) => r.targetRef === targetRef) ?? null;
 }
+function contentFailureReason(err) {
+  return err instanceof AppError && err.code === "PROVIDER_ERROR" ? OutcomeReasonCodes.NOT_CONNECTED : void 0;
+}
+function generatedCounts(unit, costMillicents) {
+  return {
+    [unit]: 1,
+    modelCalls: 1,
+    ...Number.isInteger(costMillicents) && costMillicents >= 0 ? { costMicros: costMillicents * 10 } : {}
+  };
+}
 async function contentRoutes(app, opts = {}) {
   app.get("/projects/:name/content/targets", async (request) => {
     const project = resolveProject(app.db, request.params.name);
@@ -38251,7 +38855,7 @@ async function contentRoutes(app, opts = {}) {
     }
     return reply.send(formatExplanationRow(row));
   });
-  app.post("/projects/:name/content/recommendations/:targetRef/analyze", async (request, reply) => {
+  app.post("/projects/:name/content/recommendations/:targetRef/analyze", async (request, reply) => withFeatureOutcome(app, { feature: "content", operation: "analyze" }, async (settle) => {
     const project = resolveProject(app.db, request.params.name);
     const explainer = opts.explainContentRecommendation;
     if (!explainer) {
@@ -38274,7 +38878,10 @@ async function contentRoutes(app, opts = {}) {
         eq52(recommendationExplanations.projectId, project.id),
         eq52(recommendationExplanations.targetRef, targetRef)
       )).orderBy(desc26(recommendationExplanations.generatedAt)).limit(1).get();
-      if (cached) return reply.send(formatExplanationRow(cached));
+      if (cached) {
+        settle({ status: OutcomeStatuses.succeeded, counts: { targets: 1 } });
+        return reply.send(formatExplanationRow(cached));
+      }
     }
     const result = await explainer({
       projectId: project.id,
@@ -38309,6 +38916,7 @@ async function contentRoutes(app, opts = {}) {
         generatedAt: now
       }
     }).run();
+    settle({ status: OutcomeStatuses.succeeded, counts: generatedCounts("targets", result.costMillicents) });
     const row = app.db.select().from(recommendationExplanations).where(and45(
       eq52(recommendationExplanations.projectId, project.id),
       eq52(recommendationExplanations.targetRef, targetRef),
@@ -38316,7 +38924,7 @@ async function contentRoutes(app, opts = {}) {
     )).get();
     if (!row) throw notFound("recommendationExplanation", targetRef);
     return reply.send(formatExplanationRow(row));
-  });
+  }, contentFailureReason));
   app.get("/projects/:name/content/recommendations/:targetRef/brief", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const { targetRef } = request.params;
@@ -38333,7 +38941,7 @@ async function contentRoutes(app, opts = {}) {
     if (!row) throw notFound("recommendationBrief", request.params.targetRef);
     return reply.send(formatBriefRow(row));
   });
-  app.post("/projects/:name/content/recommendations/:targetRef/brief", async (request, reply) => {
+  app.post("/projects/:name/content/recommendations/:targetRef/brief", async (request, reply) => withFeatureOutcome(app, { feature: "content", operation: "brief" }, async (settle) => {
     const project = resolveProject(app.db, request.params.name);
     const synthesizer = opts.briefContentRecommendation;
     if (!synthesizer) {
@@ -38352,13 +38960,17 @@ async function contentRoutes(app, opts = {}) {
       throw notFound("contentRecommendation", targetRef);
     }
     if (recommendation.winnabilityClass === WinnabilityClasses.ceded) {
+      settle({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.GATE_REFUSED });
       throw validationError(
         `Cannot synthesize a brief for "${recommendation.query}": its cited surface is ceded (dominated by aggregators/editorial). This is not a query first-party content can realistically win.`
       );
     }
     if (!body.forceRefresh) {
       const cached = lookupCachedBrief(app.db, project.id, targetRef, opts.briefPromptVersion);
-      if (cached) return reply.send(formatBriefRow(cached));
+      if (cached) {
+        settle({ status: OutcomeStatuses.succeeded, counts: { briefs: 1 } });
+        return reply.send(formatBriefRow(cached));
+      }
     }
     const result = await synthesizer({
       projectId: project.id,
@@ -38393,6 +39005,7 @@ async function contentRoutes(app, opts = {}) {
         generatedAt: now
       }
     }).run();
+    settle({ status: OutcomeStatuses.succeeded, counts: generatedCounts("briefs", result.costMillicents) });
     const row = app.db.select().from(recommendationBriefs).where(and45(
       eq52(recommendationBriefs.projectId, project.id),
       eq52(recommendationBriefs.targetRef, targetRef),
@@ -38400,7 +39013,7 @@ async function contentRoutes(app, opts = {}) {
     )).get();
     if (!row) throw notFound("recommendationBrief", targetRef);
     return reply.send(formatBriefRow(row));
-  });
+  }, contentFailureReason));
   app.get("/projects/:name/content/domain-classifications", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const rows = app.db.select().from(domainClassifications).where(eq52(domainClassifications.projectId, project.id)).orderBy(desc26(domainClassifications.hits)).all();
@@ -38449,7 +39062,7 @@ function winnabilityClassRank(winnabilityClass) {
 }
 
 // ../api-routes/src/openapi-schemas.ts
-import { z } from "zod";
+import { z as z3 } from "zod";
 var SCHEMA_TABLE = {
   SentimentSummary: sentimentSummarySchema,
   SentimentSettings: sentimentSettingsSchema,
@@ -38725,7 +39338,7 @@ var SCHEMA_TABLE = {
   SnapshotListResponse: snapshotListResponseSchema,
   SnapshotReportDto: snapshotReportSchema,
   // The API accepts legacy phrases, but the public contract advertises queries.
-  SnapshotRequest: z.object(snapshotRequestInputSchema.shape).omit({ phrases: true }),
+  SnapshotRequest: z3.object(snapshotRequestInputSchema.shape).omit({ phrases: true }),
   SourceBreakdownDto: sourceBreakdownDtoSchema,
   TelemetryEventAcceptedDto: telemetryEventAcceptedDtoSchema,
   FeedbackSubmission: feedbackSubmissionSchema,
@@ -38764,11 +39377,11 @@ var SCHEMA_TABLE = {
   // the API never returns this from a typed handler — it's emitted by the
   // global error handler. Codegen consumers reference it through the
   // ErrorEnvelope ref so error shape is part of the public contract.
-  ErrorEnvelope: z.object({
-    error: z.object({
-      code: z.string(),
-      message: z.string(),
-      details: z.unknown().optional()
+  ErrorEnvelope: z3.object({
+    error: z3.object({
+      code: z3.string(),
+      message: z3.string(),
+      details: z3.unknown().optional()
     })
   })
 };
@@ -38793,7 +39406,7 @@ function buildComponentSchemas() {
   const out = {};
   for (const [name, schema] of Object.entries(SCHEMA_TABLE)) {
     const io = INPUT_FORM_SCHEMAS.has(name) ? "input" : "output";
-    const json = z.toJSONSchema(schema, { target: "openapi-3.0", io });
+    const json = z3.toJSONSchema(schema, { target: "openapi-3.0", io });
     addNullToNullableEnums(json);
     out[name] = json;
   }
@@ -46812,7 +47425,7 @@ async function telemetryRoutes(app, opts) {
     if (typeof enabled !== "boolean") {
       throw validationError("enabled (boolean) is required");
     }
-    opts.setTelemetryEnabled(enabled);
+    opts.setTelemetryEnabled(enabled, currentOutcomeAttribution());
     const status = opts.getTelemetryStatus?.();
     const effective = normalizeTelemetryStatus(status ?? { enabled });
     if (app.hasDecorator("db")) {
@@ -46846,7 +47459,9 @@ async function telemetryRoutes(app, opts) {
     opts.recordOnboardingEvent?.(normalizeOnboardingEventForCollection(parsed.data));
     return reply.status(202).send({ accepted: Boolean(opts.recordOnboardingEvent) });
   });
-  app.post("/telemetry/ui", async (request, reply) => {
+  app.post("/telemetry/ui", {
+    config: { readSemantic: true }
+  }, async (request, reply) => {
     const parsed = uiTelemetryEventSchema.safeParse(request.body);
     if (!parsed.success) {
       throw validationError("Invalid UI telemetry event", {
@@ -47132,311 +47747,32 @@ function formatSchedule(row) {
 // ../api-routes/src/notifications.ts
 import crypto30 from "crypto";
 import { eq as eq56 } from "drizzle-orm";
-
-// ../api-routes/src/notifications/alert.ts
-import { z as z2 } from "zod";
-var alertSeveritySchema = z2.enum(["critical", "warning", "success", "info"]);
-var AlertSeverities = alertSeveritySchema.enum;
-var AlertFieldLabels = {
-  status: "Status",
-  check: "Check",
-  previously: "Was",
-  remediation: "What to do",
-  alsoFailing: "Also failing",
-  event: "Event",
-  run: "Run",
-  changes: "Changes",
-  insights: "Insights",
-  location: "Location",
-  rating: "Rating",
-  reviewer: "Reviewer",
-  replied: "Replied",
-  source: "Source"
-};
-var HEALTH_EVENTS = /* @__PURE__ */ new Set(["health.degraded", "health.recovered"]);
-function isHealth(payload) {
-  return HEALTH_EVENTS.has(payload.event);
-}
-var MAX_LIST_ITEMS = 10;
-function bulletList(lines) {
-  const shown = lines.slice(0, MAX_LIST_ITEMS);
-  const omitted = lines.length - shown.length;
-  const body = shown.map((line) => `\u2022 ${line}`).join("\n");
-  return omitted > 0 ? `${body}
-\u2022 \u2026and ${omitted} more` : body;
-}
-function healthView(payload) {
-  const { health, project } = payload;
-  const recovered = payload.event === "health.recovered";
-  const severity = recovered ? AlertSeverities.success : health.status === "fail" ? AlertSeverities.critical : AlertSeverities.warning;
-  const fields = [
-    { label: AlertFieldLabels.status, value: recovered ? "recovered" : health.status, compact: true },
-    { label: AlertFieldLabels.check, value: health.code, compact: true }
-  ];
-  if (health.previousStatus) {
-    fields.push({ label: AlertFieldLabels.previously, value: health.previousStatus, compact: true });
-  }
-  if (health.remediation) {
-    fields.push({ label: AlertFieldLabels.remediation, value: health.remediation });
-  }
-  const others = health.failing.filter((check2) => check2.code !== health.code);
-  if (others.length > 0) {
-    fields.push({
-      label: `${AlertFieldLabels.alsoFailing} (${others.length})`,
-      value: bulletList(others.map((check2) => `${check2.status} \u2014 ${check2.code}`))
-    });
-  }
-  const website = health.code.startsWith("site.reachability.");
+var AGENT_WEBHOOK_SOURCE = "agent";
+function webhookConnection(action, url, source) {
   return {
-    severity,
-    title: website ? recovered ? `${project.name} website is back up` : `${project.name} website is down` : recovered ? `${project.name} recovered` : `${project.name} \u2014 measurement degraded`,
-    body: health.summary,
-    fields,
-    url: payload.dashboardUrl,
-    footer: project.canonicalDomain,
-    timestamp: health.checkedAt
-  };
-}
-function runView(payload) {
-  const failed = payload.event === "run.failed";
-  const transitions = "transitions" in payload ? payload.transitions : [];
-  const insights2 = "insights" in payload ? payload.insights : [];
-  const fields = [
-    { label: AlertFieldLabels.event, value: payload.event, compact: true },
-    { label: AlertFieldLabels.run, value: payload.run.status, compact: true }
-  ];
-  if (transitions.length > 0) {
-    fields.push({
-      label: `${AlertFieldLabels.changes} (${transitions.length})`,
-      value: bulletList(transitions.map((t) => `${t.provider}: ${t.from} \u2192 ${t.to} \u2014 ${t.query}`))
-    });
-  }
-  if (insights2.length > 0) {
-    fields.push({
-      label: `${AlertFieldLabels.insights} (${insights2.length})`,
-      value: bulletList(insights2.map((i) => `[${i.severity}] ${i.title}`))
-    });
-  }
-  return {
-    severity: failed ? AlertSeverities.critical : AlertSeverities.info,
-    title: payload.project.name,
-    fields,
-    url: payload.dashboardUrl,
-    footer: payload.project.canonicalDomain,
-    ...payload.run.finishedAt ? { timestamp: payload.run.finishedAt } : {}
-  };
-}
-function stars(rating) {
-  const filled = Math.max(0, Math.min(5, Math.round(rating)));
-  return `${"\u2605".repeat(filled)}${"\u2606".repeat(5 - filled)}`;
-}
-function snippet(text2, max2 = 160) {
-  const flat = text2.replace(/\s+/g, " ").trim();
-  return flat.length > max2 ? `${flat.slice(0, max2 - 1)}\u2026` : flat;
-}
-var SOURCE_LABELS = {
-  gbp: "Business Profile",
-  places: "Public listing (Places, partial)"
-};
-function reviewView(payload) {
-  const { project, reviews } = payload;
-  const newest = reviews.reduce((latest, r) => !latest || r.updateTime > latest ? r.updateTime : latest, void 0);
-  const origins = [...new Set(reviews.map((r) => r.origin))];
-  const sourceField = {
-    label: AlertFieldLabels.source,
-    value: origins.map((origin) => SOURCE_LABELS[origin]).join(", "),
-    compact: true
-  };
-  if (reviews.length === 1) {
-    const review = reviews[0];
-    const fields = [
-      { label: AlertFieldLabels.location, value: review.location.displayName, compact: true },
-      { label: AlertFieldLabels.rating, value: `${stars(review.starRating)} (${review.starRating}/5)`, compact: true }
-    ];
-    if (review.reviewerName) fields.push({ label: AlertFieldLabels.reviewer, value: review.reviewerName, compact: true });
-    if (review.replied !== null) fields.push({ label: AlertFieldLabels.replied, value: review.replied ? "yes" : "no", compact: true });
-    fields.push(sourceField);
-    return {
-      severity: AlertSeverities.warning,
-      title: `${project.name}: new ${review.starRating}-star review`,
-      body: review.comment ?? "Rating only, no text.",
-      fields,
-      url: review.reviewUri ?? review.location.mapsUri ?? payload.dashboardUrl,
-      footer: project.canonicalDomain,
-      timestamp: review.updateTime
-    };
-  }
-  return {
-    severity: AlertSeverities.warning,
-    title: `${project.name}: ${reviews.length} new negative reviews`,
-    body: bulletList(reviews.map((r) => {
-      const text2 = r.comment ? ` "${snippet(r.comment)}"` : "";
-      const by = r.reviewerName ? ` (${r.reviewerName})` : "";
-      return `${stars(r.starRating)} ${r.location.displayName}:${text2}${by}`;
-    })),
-    fields: [sourceField],
-    url: payload.dashboardUrl,
-    footer: project.canonicalDomain,
-    ...newest ? { timestamp: newest } : {}
-  };
-}
-function ratingView(payload) {
-  const { project, ratings } = payload;
-  const line = (r) => {
-    const counts2 = r.previousReviewCount !== null && r.reviewCount !== null ? ` (${r.previousReviewCount} \u2192 ${r.reviewCount} reviews)` : "";
-    return `${r.location.displayName}: ${r.previousRating} \u2192 ${r.rating}${counts2}`;
-  };
-  const single = ratings.length === 1 ? ratings[0] : null;
-  return {
-    severity: AlertSeverities.warning,
-    title: single ? `${project.name}: Google rating fell to ${single.rating}` : `${project.name}: Google rating fell at ${ratings.length} locations`,
-    body: single ? line(single) : bulletList(ratings.map(line)),
-    fields: [
-      { label: AlertFieldLabels.source, value: SOURCE_LABELS.places, compact: true },
-      {
-        label: AlertFieldLabels.remediation,
-        value: "Read the newest reviews on Google Maps. Without Business Profile review access, Canonry sees at most five of them."
-      }
-    ],
-    url: single?.location.mapsUri ?? payload.dashboardUrl,
-    footer: project.canonicalDomain,
-    timestamp: ratings.reduce((latest, r) => r.observedAt > latest ? r.observedAt : latest, ratings[0]?.observedAt ?? "")
-  };
-}
-function toAlertView(payload) {
-  if (isHealth(payload)) return healthView(payload);
-  if (payload.event === "review.negative") return reviewView(payload);
-  if (payload.event === "review.rating-dropped") return ratingView(payload);
-  return runView(payload);
-}
-
-// ../api-routes/src/notifications/destinations.ts
-import { z as z3 } from "zod";
-var webhookDestinationSchema = z3.enum(["first-party", "discord", "slack"]);
-var WebhookDestinations = webhookDestinationSchema.enum;
-function hostIs(url, ...domains) {
-  const host = url.hostname.toLowerCase();
-  return domains.some((domain) => host === domain || host.endsWith(`.${domain}`));
-}
-var DISCORD_MAX_DESCRIPTION = 3800;
-var DISCORD_MAX_FIELD = 1e3;
-var DISCORD_COLORS = {
-  [AlertSeverities.critical]: 14235195,
-  [AlertSeverities.warning]: 14256926,
-  [AlertSeverities.success]: 3055183,
-  [AlertSeverities.info]: 4873068
-};
-var SEVERITY_ICONS = {
-  [AlertSeverities.critical]: "\u{1F534}",
-  [AlertSeverities.warning]: "\u{1F7E0}",
-  [AlertSeverities.success]: "\u2705",
-  [AlertSeverities.info]: "\u{1F4CA}"
-};
-function clamp(value, max2) {
-  return value.length <= max2 ? value : `${value.slice(0, max2 - 1)}\u2026`;
-}
-function absoluteLink(url) {
-  if (!url) return void 0;
-  try {
-    const parsed = new URL(url);
-    return parsed.protocol === "https:" || parsed.protocol === "http:" ? url : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function renderDiscord(view) {
-  return {
-    username: "Canonry",
-    embeds: [{
-      title: `${SEVERITY_ICONS[view.severity]} ${view.title}`,
-      ...view.body ? { description: clamp(view.body, DISCORD_MAX_DESCRIPTION) } : {},
-      color: DISCORD_COLORS[view.severity],
-      fields: view.fields.map((field) => ({
-        name: field.label,
-        value: clamp(field.value, DISCORD_MAX_FIELD),
-        ...field.compact ? { inline: true } : {}
-      })),
-      ...absoluteLink(view.url) ? { url: absoluteLink(view.url) } : {},
-      ...view.timestamp ? { timestamp: view.timestamp } : {},
-      ...view.footer ? { footer: { text: view.footer } } : {}
-    }]
-  };
-}
-var SLACK_MAX_TEXT = 2900;
-var SLACK_MAX_FIELD = 1e3;
-var SLACK_COLORS = {
-  [AlertSeverities.critical]: "#d9363b",
-  [AlertSeverities.warning]: "#d98b1e",
-  [AlertSeverities.success]: "#2e9e4f",
-  [AlertSeverities.info]: "#4a5b6c"
-};
-function renderSlack(view) {
-  const headline = `${SEVERITY_ICONS[view.severity]} ${view.title}`;
-  return {
-    // `text` is the notification preview and the accessible fallback, so it
-    // must stand alone rather than repeat an empty string.
-    text: headline,
-    attachments: [{
-      color: SLACK_COLORS[view.severity],
-      title: headline,
-      ...absoluteLink(view.url) ? { title_link: absoluteLink(view.url) } : {},
-      ...view.body ? { text: clamp(view.body, SLACK_MAX_TEXT) } : {},
-      fields: view.fields.map((field) => ({
-        title: field.label,
-        value: clamp(field.value, SLACK_MAX_FIELD),
-        ...field.compact ? { short: true } : {}
-      })),
-      ...view.footer ? { footer: view.footer } : {},
-      ...view.timestamp ? { ts: Math.floor(new Date(view.timestamp).getTime() / 1e3) } : {}
-    }]
+    integration: source === AGENT_WEBHOOK_SOURCE ? "agent_webhook" : "webhook",
+    action,
+    ...typeof url === "string" && url ? { target: webhookOutcomeTarget(url) } : {}
   };
 }
-var DISCORD_ADAPTER = {
-  destination: WebhookDestinations.discord,
-  matches: (url) => hostIs(url, "discord.com", "discordapp.com") && url.pathname.startsWith("/api/webhooks/"),
-  render: renderDiscord,
-  signed: false
-};
-var SLACK_ADAPTER = {
-  destination: WebhookDestinations.slack,
-  matches: (url) => hostIs(url, "slack.com") && url.pathname.startsWith("/services/"),
-  render: renderSlack,
-  signed: false
-};
-var FIRST_PARTY_ADAPTER = {
-  destination: WebhookDestinations["first-party"],
-  matches: () => true,
-  signed: true
-};
-var DESTINATION_ADAPTERS = [
-  DISCORD_ADAPTER,
-  SLACK_ADAPTER,
-  FIRST_PARTY_ADAPTER
-];
-function resolveDestination(rawUrl) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return FIRST_PARTY_ADAPTER;
-  }
-  if (url.protocol !== "https:") return FIRST_PARTY_ADAPTER;
-  return DESTINATION_ADAPTERS.find((adapter) => adapter.matches(url)) ?? FIRST_PARTY_ADAPTER;
-}
-
-// ../api-routes/src/notifications.ts
 var VALID_EVENTS = notificationEventSchema.options;
 async function notificationRoutes(app, opts = {}) {
   const allowLoopback = opts.allowLoopbackWebhooks === true;
   app.get("/notifications/events", async (_request, reply) => {
     return reply.send(VALID_EVENTS);
   });
-  app.post("/projects/:name/notifications", async (request, reply) => {
+  app.post("/projects/:name/notifications", connectionRoute(app, (request) => {
+    const body = request.body;
+    return webhookConnection("connect", body?.url, body?.source);
+  }, async (request, reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const { channel, url, events, source } = request.body ?? {};
     if (channel !== "webhook") throw validationError('Only "webhook" channel is supported');
     const urlCheck = await resolveWebhookTarget(url ?? "", { allowLoopback });
-    if (!urlCheck.ok) throw validationError(urlCheck.message);
+    if (!urlCheck.ok) {
+      attempt.failed(void 0, webhookTargetRefusalReason(urlCheck));
+      throw validationError(urlCheck.message);
+    }
     if (!events?.length) throw validationError('"events" must be a non-empty array');
     const invalid = events.filter((e) => !VALID_EVENTS.includes(e));
     if (invalid.length) {
@@ -47467,13 +47803,17 @@ async function notificationRoutes(app, opts = {}) {
       ...formatNotification(app.db.select().from(notifications).where(eq56(notifications.id, id)).get()),
       webhookSecret
     });
-  });
+  }));
   app.get("/projects/:name/notifications", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const rows = app.db.select().from(notifications).where(eq56(notifications.projectId, project.id)).all();
     return reply.send(rows.map(formatNotification));
   });
-  app.delete("/projects/:name/notifications/:id", async (request, reply) => {
+  app.delete("/projects/:name/notifications/:id", connectionRoute(app, (request) => {
+    const stored = app.db.select({ config: notifications.config }).from(notifications).where(eq56(notifications.id, request.params.id)).get();
+    const config = stored?.config;
+    return config ? webhookConnection("disconnect", config.url, config.source) : void 0;
+  }, async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
     const notification = app.db.select().from(notifications).where(eq56(notifications.id, request.params.id)).get();
     if (!notification || notification.projectId !== project.id) {
@@ -47488,8 +47828,12 @@ async function notificationRoutes(app, opts = {}) {
       entityId: notification.id
     });
     return reply.status(204).send();
-  });
-  app.post("/projects/:name/notifications/:id/test", async (request, reply) => {
+  }));
+  app.post("/projects/:name/notifications/:id/test", connectionRoute(app, (request) => {
+    const stored = app.db.select({ config: notifications.config }).from(notifications).where(eq56(notifications.id, request.params.id)).get();
+    const config = stored?.config;
+    return config ? webhookConnection("test", config.url, config.source) : void 0;
+  }, async (request, reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const notification = app.db.select().from(notifications).where(eq56(notifications.id, request.params.id)).get();
     if (!notification || notification.projectId !== project.id) {
@@ -47497,7 +47841,10 @@ async function notificationRoutes(app, opts = {}) {
     }
     const config = notification.config;
     const urlCheck = await resolveWebhookTarget(config.url, { allowLoopback });
-    if (!urlCheck.ok) throw validationError(`Stored webhook URL is invalid: ${urlCheck.message}`);
+    if (!urlCheck.ok) {
+      attempt.failed(void 0, webhookTargetRefusalReason(urlCheck));
+      throw validationError(`Stored webhook URL is invalid: ${urlCheck.message}`);
+    }
     const payload = {
       source: "canonry",
       event: "run.completed",
@@ -47516,8 +47863,11 @@ async function notificationRoutes(app, opts = {}) {
     const signingSecret = destination.signed ? notification.webhookSecret ?? null : null;
     const targetLabel = redactNotificationUrl(config.url).urlDisplay;
     request.log.info(`[Notification test] POST ${targetLabel} (${destination.destination})`);
-    const { status, error } = await deliverWebhook(urlCheck.target, body, signingSecret);
+    const delivery = await deliverWebhook(urlCheck.target, body, signingSecret);
+    const { status, error } = delivery;
     request.log.info(`[Notification test] Response: HTTP ${status} from ${targetLabel}`);
+    const failure = webhookResponseReason(delivery);
+    if (failure) attempt.failed(void 0, failure);
     writeAuditLog(app.db, {
       projectId: project.id,
       actor: "api",
@@ -47528,7 +47878,7 @@ async function notificationRoutes(app, opts = {}) {
     });
     if (error) throw deliveryFailed(error);
     return reply.send({ status, ok: status >= 200 && status < 300 });
-  });
+  }));
 }
 function formatNotification(row) {
   const config = row.config;
@@ -49769,6 +50119,10 @@ function classifyReviewsError(err) {
 }
 
 // ../api-routes/src/google.ts
+var GOOGLE_INTEGRATIONS = { gsc: "gsc", ga4: "ga4", gbp: "gbp" };
+function googleIntegration(type) {
+  return typeof type === "string" && Object.hasOwn(GOOGLE_INTEGRATIONS, type) ? GOOGLE_INTEGRATIONS[type] : void 0;
+}
 function resolveReportedWindow(resolved, startDate, endDate) {
   const start = startDate ?? resolved.startDate;
   const end = endDate ?? resolved.endDate;
@@ -49902,6 +50256,19 @@ function googleAuthErrorStatus(err) {
   const match = err.message.match(/failed \((\d{3})\)/);
   return match ? Number(match[1]) : null;
 }
+function gscOutcomeFailure(err) {
+  const classified = classifyOutcomeError(err);
+  if (err instanceof AppError && (err.code === "NOT_FOUND" || err.code === "VALIDATION_ERROR")) {
+    return { ...classified, reasonCode: OutcomeReasonCodes.NOT_CONNECTED };
+  }
+  if (err instanceof GoogleAuthError) {
+    const status = googleAuthErrorStatus(err);
+    const reasonCode = status === 429 ? OutcomeReasonCodes.RATE_LIMITED : status !== null && status >= 500 ? OutcomeReasonCodes.HTTP_5XX : OutcomeReasonCodes.INVALID_CREDENTIALS;
+    return { ...classified, reasonCode };
+  }
+  if (err instanceof GoogleApiError && err.status === 404) return { ...classified, reasonCode: OutcomeReasonCodes.PROPERTY_NOT_FOUND };
+  return classified;
+}
 function gscErrorToAppError(err, context) {
   if (err instanceof AppError) return err;
   if (err instanceof GoogleApiError) {
@@ -49985,7 +50352,10 @@ async function googleRoutes(app, opts) {
       updatedAt: connection.updatedAt
     }));
   });
-  app.post("/projects/:name/google/connect", async (request) => {
+  app.post("/projects/:name/google/connect", connectionRoute(app, (request) => {
+    const integration = googleIntegration(request.body?.type);
+    return integration ? { integration, action: "connect" } : void 0;
+  }, async (request, _reply, attempt) => {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
       throw validationError("Google OAuth is not configured. Set Google OAuth credentials in the local Canonry config.");
@@ -49995,6 +50365,7 @@ async function googleRoutes(app, opts) {
       throw validationError('type must be "gsc", "ga4", or "gbp"');
     }
     const project = resolveProject(app.db, request.params.name);
+    if (telemetryRead(() => opts.googleConnectionStore?.getConnection(project.canonicalDomain, type), void 0)) attempt.update({ action: "reauth" });
     let redirectUri;
     if (publicUrl) {
       redirectUri = publicUrl.replace(/\/$/, "") + "/api/v1/google/callback";
@@ -50013,22 +50384,40 @@ async function googleRoutes(app, opts) {
         domain: project.canonicalDomain,
         type,
         propertyId,
-        redirectUri
+        redirectUri,
+        // The browser finishes the flow, so the callback reports the surface that started it.
+        ...oauthStartAttribution()
       },
       stateSecret
     );
     const authUrl = getAuthUrl(googleClientId, redirectUri, scopes, stateEncoded);
+    attempt.started();
     return { authUrl, redirectUri };
-  });
+  }));
   async function handleOAuthCallback(request, reply) {
+    const verifiedState = request.query.state ? verifySignedGoogleOAuthState(request.query.state, stateSecret) : null;
+    const integration = googleIntegration(verifiedState?.type ?? unverifiedOAuthStateField(request.query.state, "type"));
+    const replacesConnection = integration && typeof verifiedState?.domain === "string" && telemetryRead(() => opts.googleConnectionStore?.getConnection(verifiedState.domain, integration), void 0);
+    const attempt = startConnectionAttempt(app, integration ? { integration, action: replacesConnection ? "reauth" : "connect", ...oauthStateAttribution(verifiedState) } : void 0);
+    try {
+      return await completeOAuthCallback(request, reply, attempt);
+    } catch (err) {
+      attempt.failed(err);
+      throw err;
+    }
+  }
+  async function completeOAuthCallback(request, reply, attempt) {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
+      attempt.failed(void 0, "UNSUPPORTED");
       return reply.status(500).send("Google OAuth not configured");
     }
     const store = requireConnectionStore();
     const escapeHtml3 = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
     const { code, state, error } = request.query;
     if (error) {
+      if (error === "access_denied") attempt.cancelled("OAUTH_CANCELLED");
+      else attempt.failed(void 0, "AUTH_DENIED");
       const safeError = escapeHtml3(String(error));
       const errorHtml = error === "redirect_uri_mismatch" ? `<html><body style="font-family:system-ui;padding:40px;max-width:600px;margin:0 auto">
             <h2 style="color:#ef4444">Redirect URI mismatch</h2>
@@ -50055,21 +50444,26 @@ async function googleRoutes(app, opts) {
       return reply.type("text/html").send(errorHtml);
     }
     if (!code || !state) {
+      attempt.failed(void 0, state ? "VALIDATION" : "OAUTH_STATE_INVALID");
       return reply.status(400).send("Missing code or state parameter");
     }
     const stateData = verifySignedGoogleOAuthState(state, stateSecret);
     if (!stateData) {
+      attempt.failed(void 0, "OAUTH_STATE_INVALID");
       return reply.status(400).send("Invalid or tampered state parameter");
     }
     const { domain, type, propertyId, redirectUri, projectId, projectName } = stateData;
     if (!projectId) {
+      attempt.failed(void 0, "OAUTH_STATE_INVALID");
       return reply.status(400).send("Stale OAuth state \u2014 restart the connect flow.");
     }
     const project = app.db.select().from(projects).where(eq57(projects.id, projectId)).get();
     if (!project) {
+      attempt.failed(void 0, "NOT_FOUND");
       return reply.status(400).send("Project no longer exists. Restart the connect flow.");
     }
     if (project.canonicalDomain.toLowerCase() !== domain.toLowerCase()) {
+      attempt.failed(void 0, "OAUTH_STATE_INVALID");
       return reply.status(400).send(
         `Project "${projectName ?? project.name}" canonical domain changed since this OAuth flow started. Expected "${domain}", got "${project.canonicalDomain}". Restart the connect flow.`
       );
@@ -50078,6 +50472,7 @@ async function googleRoutes(app, opts) {
     try {
       tokens = await exchangeCode(googleClientId, googleClientSecret, code, redirectUri);
     } catch (err) {
+      attempt.failed(err);
       const msg = describeError(err);
       return reply.type("text/html").send(
         `<html><body style="font-family:system-ui;padding:40px;max-width:600px;margin:0 auto">
@@ -50095,6 +50490,7 @@ async function googleRoutes(app, opts) {
     const expiresAt = new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
     const existing = store.getConnection(domain, type);
     if (existing && existing.createdByProjectId && existing.createdByProjectId !== projectId) {
+      attempt.failed(void 0, "ALREADY_CONNECTED");
       return reply.status(403).send(
         `This domain already has a Google ${String(type).toUpperCase()} connection owned by another project. Disconnect it from that project first (DELETE /api/v1/projects/<owner>/google/connections/${escapeHtml3(String(type))}) before re-connecting from "${escapeHtml3(projectName ?? "")}".`
       );
@@ -50121,6 +50517,7 @@ async function googleRoutes(app, opts) {
       entityId: type,
       diff: { domain, type, propertyId }
     });
+    attempt.succeeded();
     return reply.type("text/html").send(googleOAuthSuccessHtml(type));
   }
   app.get("/google/callback", async (request, reply) => {
@@ -50129,12 +50526,16 @@ async function googleRoutes(app, opts) {
   app.get("/projects/:name/google/callback", async (request, reply) => {
     return handleOAuthCallback(request, reply);
   });
-  app.delete("/projects/:name/google/connections/:type", async (request, reply) => {
+  app.delete("/projects/:name/google/connections/:type", connectionRoute(app, (request) => {
+    const integration = googleIntegration(request.params.type);
+    return integration ? { integration, action: "disconnect" } : void 0;
+  }, async (request, reply, attempt) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
     const type = request.params.type;
     const existing = store.getConnection(project.canonicalDomain, type);
     if (!existing) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("Google connection", type);
     }
     if (existing.createdByProjectId && existing.createdByProjectId !== project.id) {
@@ -50144,6 +50545,7 @@ async function googleRoutes(app, opts) {
     }
     const deleted = store.deleteConnection(project.canonicalDomain, type);
     if (!deleted) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("Google connection", type);
     }
     writeAuditLog(app.db, {
@@ -50154,7 +50556,7 @@ async function googleRoutes(app, opts) {
       entityId: type
     });
     return reply.status(204).send();
-  });
+  }));
   app.get("/projects/:name/google/properties", async (request) => {
     assertNotProjectScoped(request, "listing Search Console properties");
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
@@ -50472,14 +50874,16 @@ async function googleRoutes(app, opts) {
     if (!url) {
       throw validationError("url is required");
     }
+    const outcome2 = startRouteOutcome(app, FeatureNames.search_console, "inspect");
     let result;
     try {
       const { accessToken, propertyId } = await getValidToken(store, project.canonicalDomain, "gsc", googleClientId, googleClientSecret);
       if (!propertyId) {
-        throw validationError("No GSC property configured for this connection");
+        throw outcome2.refuse(OutcomeReasonCodes.PROPERTY_NOT_FOUND, validationError("No GSC property configured for this connection"));
       }
       result = await inspectUrl(accessToken, url, propertyId);
     } catch (err) {
+      outcome2.report({ status: OutcomeStatuses.failed, ...gscOutcomeFailure(err) });
       throw gscErrorToAppError(err, "Failed to inspect URL in Search Console");
     }
     const ir = result.inspectionResult;
@@ -50506,6 +50910,7 @@ async function googleRoutes(app, opts) {
       inspectedAt: now,
       createdAt: now
     }).run();
+    outcome2.report({ status: OutcomeStatuses.succeeded, counts: { urls: 1 } });
     return {
       id,
       url,
@@ -50730,31 +51135,43 @@ async function googleRoutes(app, opts) {
     const sitemapUrls = [...new Set(parsed.data.sitemapUrls)];
     const project = resolveProject(app.db, request.params.name);
     const store = requireConnectionStore();
+    const outcome2 = startRouteOutcome(app, FeatureNames.search_console, "sitemap_submit");
     const conn = store.getConnection(project.canonicalDomain, "gsc");
     if (!conn) {
-      throw validationError('No GSC connection found for this domain. Run "canonry google connect" first.');
+      throw outcome2.refuse(OutcomeReasonCodes.NOT_CONNECTED, validationError('No GSC connection found for this domain. Run "canonry google connect" first.'));
     }
     if (!conn.propertyId) {
-      throw validationError('No GSC property configured for this connection. Set one with "canonry google set-property".');
+      throw outcome2.refuse(
+        OutcomeReasonCodes.PROPERTY_NOT_FOUND,
+        validationError('No GSC property configured for this connection. Set one with "canonry google set-property".')
+      );
     }
     const invalidUrls = sitemapUrls.filter((url) => !isSitemapOwnedByProperty(url, conn.propertyId, project.canonicalDomain));
     if (invalidUrls.length > 0) {
-      throw validationError(`Sitemap URLs must belong to the configured GSC property "${conn.propertyId}". Invalid: ${invalidUrls.slice(0, 5).join(", ")}`);
+      throw outcome2.refuse(
+        OutcomeReasonCodes.VALIDATION,
+        validationError(`Sitemap URLs must belong to the configured GSC property "${conn.propertyId}". Invalid: ${invalidUrls.slice(0, 5).join(", ")}`)
+      );
     }
     if (!(conn.scopes ?? []).includes(GSC_SCOPE)) {
-      throw validationError('This GSC connection has the read-only webmasters scope and cannot submit sitemaps. Reconnect with "canonry google connect" to grant the full webmasters scope.');
+      throw outcome2.refuse(
+        OutcomeReasonCodes.PERMISSION_MISSING,
+        validationError('This GSC connection has the read-only webmasters scope and cannot submit sitemaps. Reconnect with "canonry google connect" to grant the full webmasters scope.')
+      );
     }
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
-      throw validationError("Google OAuth is not configured");
+      throw outcome2.refuse(OutcomeReasonCodes.NOT_CONNECTED, validationError("Google OAuth is not configured"));
     }
     let accessToken;
     try {
       ({ accessToken } = await getValidToken(store, project.canonicalDomain, "gsc", googleClientId, googleClientSecret));
     } catch (err) {
+      outcome2.report({ status: OutcomeStatuses.failed, ...gscOutcomeFailure(err) });
       throw gscErrorToAppError(err, "Failed to authorize Search Console sitemap submission");
     }
     const results = [];
+    let lastSubmitError;
     for (const sitemapUrl of sitemapUrls) {
       try {
         await submitSitemap(accessToken, conn.propertyId, sitemapUrl);
@@ -50768,11 +51185,15 @@ async function googleRoutes(app, opts) {
         });
         results.push({ sitemapUrl, status: "accepted", submittedAt });
       } catch (err) {
+        lastSubmitError = err;
         results.push({ sitemapUrl, status: "error", error: describeError(err) });
       }
     }
     const accepted = results.filter((result) => result.status === "accepted").length;
-    return { summary: { total: results.length, accepted, failed: results.length - accepted }, results };
+    const failed = results.length - accepted;
+    const counts2 = { urls: accepted, failures: failed };
+    outcome2.report(failed === 0 ? { status: OutcomeStatuses.succeeded, counts: counts2 } : { status: accepted > 0 ? OutcomeStatuses.partial : OutcomeStatuses.failed, ...gscOutcomeFailure(lastSubmitError), counts: counts2 });
+    return { summary: { total: results.length, accepted, failed }, results };
   });
   app.post("/projects/:name/google/gsc/discover-sitemaps", async (request) => {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
@@ -50866,7 +51287,10 @@ async function googleRoutes(app, opts) {
     }
     return { sitemapUrl: sitemapUrl.trim() };
   });
-  app.put("/projects/:name/google/connections/:type/property", async (request) => {
+  app.put("/projects/:name/google/connections/:type/property", connectionRoute(app, (request) => {
+    const integration = googleIntegration(request.params.type);
+    return integration ? { integration, action: "select" } : void 0;
+  }, async (request, _reply, attempt) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
     const { propertyId } = request.body ?? {};
@@ -50879,10 +51303,11 @@ async function googleRoutes(app, opts) {
       { propertyId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
     );
     if (!conn) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("Google connection", request.params.type);
     }
     return { propertyId };
-  });
+  }));
   app.post("/projects/:name/google/indexing/request", async (request) => {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getAuthConfig();
     if (!googleClientId || !googleClientSecret) {
@@ -51197,7 +51622,7 @@ async function googleRoutes(app, opts) {
     }
     return response;
   });
-  app.put("/projects/:name/gbp/locations/:locationName/selection", async (request) => {
+  app.put("/projects/:name/gbp/locations/:locationName/selection", connectionRoute(app, () => ({ integration: "gbp", action: "select" }), async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const locationName = decodeURIComponent(request.params.locationName);
     const parsed = gbpLocationSelectionRequestSchema.safeParse(request.body ?? {});
@@ -51220,8 +51645,8 @@ async function googleRoutes(app, opts) {
     });
     const refreshed = app.db.select().from(gbpLocations).where(eq57(gbpLocations.id, existing.id)).get();
     return rowToDto2(refreshed);
-  });
-  app.delete("/projects/:name/gbp/connection", async (request, reply) => {
+  }));
+  app.delete("/projects/:name/gbp/connection", connectionRoute(app, () => ({ integration: "gbp", action: "disconnect" }), async (request, reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const store = requireConnectionStore();
     app.db.transaction((tx) => {
@@ -51233,9 +51658,9 @@ async function googleRoutes(app, opts) {
         entityType: "gbp_connection"
       });
     });
-    store.deleteConnection(project.canonicalDomain, "gbp");
+    if (!store.deleteConnection(project.canonicalDomain, "gbp")) attempt.cancelled("NOT_CONNECTED");
     return reply.status(204).send();
-  });
+  }));
   app.post("/projects/:name/gbp/sync", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const store = requireConnectionStore();
@@ -51500,6 +51925,10 @@ var oauthStateSchema = z4.object({
 }).strict();
 var GOOGLE_MARKETING_OAUTH_PENDING_FLOW_MAX = 256;
 var GOOGLE_MARKETING_OAUTH_COOKIE_PREFIX = "canonry_google_marketing_oauth_";
+var MARKETING_INTEGRATIONS = { "google-ads": "google_ads", gtm: "gtm" };
+function marketingConnection(provider, action = "connect") {
+  return typeof provider === "string" && Object.hasOwn(MARKETING_INTEGRATIONS, provider) ? { integration: MARKETING_INTEGRATIONS[provider], action } : void 0;
+}
 function oauthInitiator(request) {
   const principal = request.principal;
   return {
@@ -52226,7 +52655,7 @@ async function googleMarketingRoutes(app, opts) {
   });
   if (stateSecret) {
     const registerOAuthConnect = (path8, provider) => {
-      app.post(path8, async (request, reply) => {
+      app.post(path8, connectionRoute(app, () => marketingConnection(provider), async (request, reply, attempt) => {
         requireWrite(request);
         if (request.principal && !request.principal.viaCookie) {
           throw forbidden("Google Marketing OAuth must be started from a signed-in browser.");
@@ -52240,6 +52669,8 @@ async function googleMarketingRoutes(app, opts) {
         }
         const project = resolveProject(app.db, request.params.name);
         const store = requireCredentialStore(opts);
+        const connectionAction = telemetryRead(() => store.get(asProjectRef(project), provider), void 0) ? "reauth" : "connect";
+        attempt.update({ action: connectionAction });
         const adapter = opts.googleMarketingOAuth;
         if (!adapter) throw notImplemented("Google Marketing OAuth is not configured for this deployment.");
         const scopes = opts.googleMarketingOAuthScopes?.[provider];
@@ -52281,6 +52712,7 @@ async function googleMarketingRoutes(app, opts) {
           expiresAtMs: nowMs + GOOGLE_OAUTH_STATE_MAX_AGE_MS,
           initiator: oauthInitiator(request),
           browserNonce,
+          connectionAction,
           ...suppliedDeveloperToken ? { developerToken: suppliedDeveloperToken } : {}
         }, nowMs);
         appendSetCookie(reply, serializeOAuthBindingCookie({
@@ -52297,28 +52729,34 @@ async function googleMarketingRoutes(app, opts) {
           entityId: provider,
           diff: { provider }
         }));
+        attempt.started();
         return {
           provider,
           authorizationUrl,
           redirectUri,
           expiresAt: null
         };
-      });
+      }));
     };
     registerOAuthConnect("/projects/:name/google-ads/oauth/connect", GoogleMarketingProviders["google-ads"]);
     registerOAuthConnect("/projects/:name/gtm/oauth/connect", GoogleMarketingProviders.gtm);
-    app.get("/google-marketing/callback", async (request, reply) => {
+    app.get("/google-marketing/callback", connectionRoute(app, (request) => {
+      const verified = oauthStateSchema.safeParse(verifySignedGoogleOAuthState(request.query.state ?? "", stateSecret));
+      return marketingConnection(verified.success ? verified.data.provider : unverifiedOAuthStateField(request.query.state, "provider"));
+    }, async (request, reply, attempt) => {
       if (!request.query.state) {
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Missing OAuth state."));
       }
       const state = verifySignedGoogleOAuthState(request.query.state, stateSecret);
       const parsedState = oauthStateSchema.safeParse(state);
       if (!parsedState.success) {
+        attempt.failed(void 0, "OAUTH_STATE_INVALID");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Invalid, expired, or tampered OAuth state."));
       }
       const browserNonce = parseCookieHeader(request.headers.cookie)[oauthBindingCookieName(parsedState.data.nonce)];
       const pending = pendingOAuthFlows.consume(parsedState.data, browserNonce);
       if (!pending) {
+        attempt.failed(void 0, "OAUTH_STATE_INVALID");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "OAuth state is unknown, expired, already used, or was opened in a different browser."));
       }
       appendSetCookie(reply, serializeOAuthBindingCookie({
@@ -52327,39 +52765,48 @@ async function googleMarketingRoutes(app, opts) {
         secure: new URL(parsedState.data.redirectUri).protocol === "https:",
         opts
       }));
+      attempt.update({ action: pending.connectionAction ?? "connect" });
       if (request.query.error) {
         pendingOAuthFlows.finish(pending);
+        if (request.query.error === "access_denied") attempt.cancelled("OAUTH_CANCELLED");
+        else attempt.failed(void 0, "AUTH_DENIED");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Google did not approve this authorization request."));
       }
       if (!request.query.code) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "VALIDATION");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Missing OAuth code."));
       }
       const { projectId, projectName, provider, redirectUri } = parsedState.data;
       const project = app.db.select().from(projects).where(eq58(projects.id, projectId)).get();
       if (!project || project.name !== projectName) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, project ? "OAUTH_STATE_INVALID" : "NOT_FOUND");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Project ownership changed. Restart the OAuth flow."));
       }
       const store = opts.googleMarketingCredentialStore;
       const adapter = opts.googleMarketingOAuth;
       if (!store || !adapter) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "UNSUPPORTED");
         return reply.status(500).type("text/html").send(oauthHtml("Authorization failed", "Google Marketing OAuth is not configured."));
       }
       let tokens;
       try {
         tokens = await adapter.exchangeCode({ provider, code: request.query.code, redirectUri });
-      } catch {
+      } catch (err) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(err);
         return reply.status(502).type("text/html").send(oauthHtml("Authorization failed", "Google rejected the OAuth code. Restart the connection flow."));
       }
       if (!pendingOAuthFlows.isCurrent(pending)) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "OAUTH_STATE_INVALID");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "This OAuth flow was replaced or disconnected. Restart the connection flow."));
       }
       if (typeof tokens.refreshToken !== "string" || tokens.refreshToken.trim().length === 0) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "PERMISSION_MISSING");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Google did not provide offline access. Restart the connection flow and approve access."));
       }
       let confirmationId;
@@ -52367,19 +52814,22 @@ async function googleMarketingRoutes(app, opts) {
         confirmationId = pendingOAuthFlows.createConfirmation(pending, tokens);
       } catch {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "RATE_LIMITED");
         return reply.status(503).type("text/html").send(oauthHtml("Authorization failed", "Too many pending OAuth confirmations. Restart the connection flow."));
       }
       if (!confirmationId) {
         pendingOAuthFlows.finish(pending);
+        attempt.failed(void 0, "OAUTH_STATE_INVALID");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "This OAuth flow was replaced or disconnected. Restart the connection flow."));
       }
+      attempt.deferred();
       return reply.type("text/html").send(oauthConfirmationHtml({
         provider,
         projectName: project.name,
         confirmationId,
         opts
       }));
-    });
+    }));
     app.post("/google-marketing/callback/confirm/:confirmationId", async (request, reply) => {
       if (request.principal && !request.principal.viaCookie) {
         throw forbidden("Google Marketing OAuth confirmation requires the browser that started the connection.");
@@ -52395,18 +52845,22 @@ async function googleMarketingRoutes(app, opts) {
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "This OAuth confirmation is unknown, expired, already used, or belongs to another browser session."));
       }
       const { flow, tokens } = confirmation;
+      const attempt = startConnectionAttempt(app, marketingConnection(flow.provider, flow.connectionAction));
       if (!pendingOAuthFlows.isCurrent(flow)) {
         pendingOAuthFlows.finish(flow);
+        attempt.failed(void 0, "OAUTH_STATE_INVALID");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "This OAuth flow was replaced or disconnected. Restart the connection flow."));
       }
       const project = app.db.select().from(projects).where(eq58(projects.id, flow.projectId)).get();
       if (!project || project.name !== flow.projectName) {
         pendingOAuthFlows.finish(flow);
+        attempt.failed(void 0, project ? "OAUTH_STATE_INVALID" : "NOT_FOUND");
         return reply.status(400).type("text/html").send(oauthHtml("Authorization failed", "Project ownership changed. Restart the OAuth flow."));
       }
       const store = opts.googleMarketingCredentialStore;
       if (!store) {
         pendingOAuthFlows.finish(flow);
+        attempt.failed(void 0, "UNSUPPORTED");
         return reply.status(500).type("text/html").send(oauthHtml("Authorization failed", "Google Marketing OAuth is not configured."));
       }
       const projectRef = asProjectRef(project);
@@ -52494,6 +52948,7 @@ async function googleMarketingRoutes(app, opts) {
           });
         });
       } catch (error) {
+        attempt.failed(error);
         if (rollbackCredential) {
           try {
             rollbackCredential();
@@ -52505,6 +52960,7 @@ async function googleMarketingRoutes(app, opts) {
       } finally {
         pendingOAuthFlows.finish(flow);
       }
+      attempt.succeeded();
       const label = flow.provider === GoogleMarketingProviders["google-ads"] ? "Google Ads" : "Google Tag Manager";
       return reply.type("text/html").send(oauthHtml("Connected successfully", `${label} is now linked to this project.`));
     });
@@ -52595,16 +53051,24 @@ async function googleMarketingRoutes(app, opts) {
     enqueueAfterCommit(app, callback, run.id, projectId, kind);
     return run.id;
   };
-  app.put("/projects/:name/google-ads/selection", async (request) => {
+  app.put("/projects/:name/google-ads/selection", connectionRoute(app, () => marketingConnection(GoogleMarketingProviders["google-ads"], "select"), async (request, _reply, attempt) => {
     requireWrite(request);
     const parsedBody = parseBody3(googleAdsCustomerSelectionRequestSchema, request.body, "Google Ads selection");
     const body = canonicalizeGoogleAdsCustomerSelection(parsedBody);
     if (!body) throw validationError("Invalid Google Ads selection.");
     const project = resolveProject(app.db, request.params.name);
     const projectRef = asProjectRef(project);
-    requiredCredential(opts, projectRef, GoogleMarketingProviders["google-ads"]);
+    try {
+      requiredCredential(opts, projectRef, GoogleMarketingProviders["google-ads"]);
+    } catch (err) {
+      attempt.failed(err, "NOT_CONNECTED");
+      throw err;
+    }
     const existing = app.db.select().from(googleAdsConnections).where(eq58(googleAdsConnections.projectId, project.id)).get();
-    if (!existing) throw validationError("Connect Google Ads before selecting a customer.");
+    if (!existing) {
+      attempt.failed(void 0, "NOT_CONNECTED");
+      throw validationError("Connect Google Ads before selecting a customer.");
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const customerChanged = existing.selectedCustomerId !== body.customerId;
     app.db.transaction((tx) => {
@@ -52637,17 +53101,25 @@ async function googleMarketingRoutes(app, opts) {
     });
     queueSelectionSync(request, project.id, "google-ads-sync", opts.onGoogleAdsSyncRequested);
     return googleAdsStatus(app, opts, projectRef);
-  });
-  app.put("/projects/:name/gtm/selection", async (request) => {
+  }));
+  app.put("/projects/:name/gtm/selection", connectionRoute(app, () => marketingConnection(GoogleMarketingProviders.gtm, "select"), async (request, _reply, attempt) => {
     requireWrite(request);
     const parsedBody = parseBody3(gtmResourceSelectionRequestSchema, request.body, "GTM selection");
     const body = canonicalizeGtmResourceSelection(parsedBody);
     if (!body) throw validationError("Invalid GTM selection.");
     const project = resolveProject(app.db, request.params.name);
     const projectRef = asProjectRef(project);
-    requiredCredential(opts, projectRef, GoogleMarketingProviders.gtm);
+    try {
+      requiredCredential(opts, projectRef, GoogleMarketingProviders.gtm);
+    } catch (err) {
+      attempt.failed(err, "NOT_CONNECTED");
+      throw err;
+    }
     const existing = app.db.select().from(gtmConnections).where(eq58(gtmConnections.projectId, project.id)).get();
-    if (!existing) throw validationError("Connect Google Tag Manager before selecting resources.");
+    if (!existing) {
+      attempt.failed(void 0, "NOT_CONNECTED");
+      throw validationError("Connect Google Tag Manager before selecting resources.");
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const selectedWorkspaceId = body.workspaceId ?? null;
     const containerChanged = existing.selectedAccountId !== body.accountId || existing.selectedContainerId !== body.containerId;
@@ -52681,7 +53153,7 @@ async function googleMarketingRoutes(app, opts) {
     });
     queueSelectionSync(request, project.id, "gtm-sync", opts.onGtmSyncRequested);
     return gtmStatus(app, opts, projectRef);
-  });
+  }));
   app.post("/projects/:name/google-ads/sync", async (request) => {
     requireLiveRead(request);
     requireWrite(request);
@@ -52823,7 +53295,7 @@ async function googleMarketingRoutes(app, opts) {
     if (!snapshot) throw providerError("Stored GTM snapshot is invalid.");
     return { snapshot };
   });
-  app.delete("/projects/:name/google-ads/connection", async (request) => {
+  app.delete("/projects/:name/google-ads/connection", connectionRoute(app, () => marketingConnection(GoogleMarketingProviders["google-ads"], "disconnect"), async (request, _reply, attempt) => {
     requireWrite(request);
     const project = resolveProject(app.db, request.params.name);
     const projectRef = asProjectRef(project);
@@ -52859,9 +53331,10 @@ async function googleMarketingRoutes(app, opts) {
         }));
       });
     }
+    if (!row && !removedCredential) attempt.cancelled("NOT_CONNECTED");
     return { provider: GoogleMarketingProviders["google-ads"], disconnected: Boolean(row) || removedCredential };
-  });
-  app.delete("/projects/:name/gtm/connection", async (request) => {
+  }));
+  app.delete("/projects/:name/gtm/connection", connectionRoute(app, () => marketingConnection(GoogleMarketingProviders.gtm, "disconnect"), async (request, _reply, attempt) => {
     requireWrite(request);
     const project = resolveProject(app.db, request.params.name);
     const projectRef = asProjectRef(project);
@@ -52895,8 +53368,9 @@ async function googleMarketingRoutes(app, opts) {
         }));
       });
     }
+    if (!row && !removedCredential) attempt.cancelled("NOT_CONNECTED");
     return { provider: GoogleMarketingProviders.gtm, disconnected: Boolean(row) || removedCredential };
-  });
+  }));
   app.get("/projects/:name/conversion-tracking/options", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const adsSnapshot = latestGoogleAdsSnapshot(app, project.id);
@@ -54912,6 +55386,31 @@ function enforceAdsActivationOperationalCap(manifest) {
     );
   }
 }
+var ACTIVATION_FAILURE_REASONS = {
+  [AdsActivationErrorCodes.invalidManifest]: OutcomeReasonCodes.VALIDATION,
+  [AdsActivationErrorCodes.grantNotFound]: OutcomeReasonCodes.NOT_FOUND,
+  [AdsActivationErrorCodes.grantProjectMismatch]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.grantAccountMismatch]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.grantHashMismatch]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.grantExecutorMismatch]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.grantExpired]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.grantRevoked]: OutcomeReasonCodes.CANCELLED_BY_USER,
+  [AdsActivationErrorCodes.grantUsed]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.operationConflict]: OutcomeReasonCodes.VALIDATION,
+  [AdsActivationErrorCodes.accountNotApproved]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.entityMismatch]: OutcomeReasonCodes.VALIDATION,
+  [AdsActivationErrorCodes.entityNotPaused]: OutcomeReasonCodes.VALIDATION,
+  [AdsActivationErrorCodes.entityStale]: OutcomeReasonCodes.VALIDATION,
+  [AdsActivationErrorCodes.adNotApproved]: OutcomeReasonCodes.GATE_REFUSED,
+  [AdsActivationErrorCodes.manualRemediationRequired]: OutcomeReasonCodes.QUARANTINED,
+  [AdsActivationErrorCodes.persistenceFailed]: OutcomeReasonCodes.INTERNAL
+};
+function activationFailure(error) {
+  const known = error instanceof AdsActivationError ? ACTIVATION_FAILURE_REASONS[error.code] : void 0;
+  const failure = known ? { ...classifyOutcomeError(error), reasonCode: known } : upstreamFailure(error);
+  const status = failure.reasonCode === OutcomeReasonCodes.QUARANTINED ? OutcomeStatuses.partial : failure.reasonCode === OutcomeReasonCodes.CANCELLED_BY_USER ? OutcomeStatuses.cancelled : OutcomeStatuses.failed;
+  return { status, ...failure };
+}
 function requireAuthenticatedKey(request) {
   if (!request.apiKey) {
     throw forbidden("Ads activation approval and execution require an authenticated API key");
@@ -54987,21 +55486,39 @@ function terminalActivationResponse(app, opts, grant, operationKey) {
   return activationResponse(opts, canonical.grant, canonical.operation);
 }
 async function executeActivationGrant(app, opts, request, project, executorApiKeyId, grant, operationKey) {
-  const runtime = await opts.resolveRuntime(project);
-  const result = await executeApprovedAdsActivation({
-    store: createActivationStore(app, request),
-    provider: runtime.provider,
-    leaseMs: opts.leaseMs ?? ACTIVATION_LEASE_MS
-  }, {
-    projectId: project.id,
-    adAccountId: runtime.adAccountId,
-    operationKey,
-    grantId: grant.id,
-    manifestHash: grant.manifestHash,
-    executorApiKeyId,
-    manifest: grant.manifest
-  });
-  return activationResponse(opts, result.grant, result.operation);
+  const outcome2 = startRouteOutcome(app, FeatureNames.openai_ads, "activation", request ? {} : { trigger: OutcomeTriggers.retry });
+  const store = createActivationStore(app, request);
+  let claimKind;
+  try {
+    const runtime = await opts.resolveRuntime(project);
+    const result = await executeApprovedAdsActivation({
+      store: {
+        ...store,
+        claimGrantAndOperation: async (input) => {
+          const claim = await store.claimGrantAndOperation(input);
+          claimKind = claim.kind;
+          return claim;
+        }
+      },
+      provider: runtime.provider,
+      leaseMs: opts.leaseMs ?? ACTIVATION_LEASE_MS
+    }, {
+      projectId: project.id,
+      adAccountId: runtime.adAccountId,
+      operationKey,
+      grantId: grant.id,
+      manifestHash: grant.manifestHash,
+      executorApiKeyId,
+      manifest: grant.manifest
+    });
+    if (claimKind === "claimed" || claimKind === "resumed") {
+      outcome2.report({ status: OutcomeStatuses.succeeded, counts: { campaigns: 1, operations: result.steps.length } });
+    }
+    return activationResponse(opts, result.grant, result.operation);
+  } catch (error) {
+    outcome2.report(activationFailure(error));
+    throw error;
+  }
 }
 function selectWatchdogOperations(app, nowIso, batchSize, allowLiveRevocationLease) {
   const leaseAvailable = or15(
@@ -55356,7 +55873,8 @@ function registerAdsActivationRoutes(app, opts) {
       const approver = requireAuthenticatedKey(request);
       const project = resolveProject(app.db, request.params.name);
       const body = parseBody4(adsActivationGrantCreateRequestSchema, request.body);
-      enforceAdsActivationOperationalCap(body.manifest);
+      const outcome2 = startRouteOutcome(app, FeatureNames.openai_ads, "activation");
+      outcome2.guard(OutcomeReasonCodes.GATE_REFUSED, () => enforceAdsActivationOperationalCap(body.manifest));
       const now = /* @__PURE__ */ new Date();
       const expiresAt = Date.parse(body.expiresAt);
       if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime() || expiresAt > now.getTime() + MAX_ACTIVATION_GRANT_LIFETIME_MS) {
@@ -55375,7 +55893,13 @@ function registerAdsActivationRoutes(app, opts) {
       if (!executor.scopes.includes("*") && !executor.scopes.includes(ADS_ACTIVATE_SCOPE)) {
         throw forbidden(`The executor API key requires the "${ADS_ACTIVATE_SCOPE}" scope`);
       }
-      const runtime = await opts.resolveRuntime(project);
+      let runtime;
+      try {
+        runtime = await opts.resolveRuntime(project);
+      } catch (error) {
+        outcome2.report(activationFailure(error));
+        throw error;
+      }
       let preflight;
       try {
         preflight = body.versionPolicy === AdsActivationVersionPolicies.refreshSemanticallyUnchanged ? await refreshSemanticallyUnchangedAdsActivationManifest(runtime.provider, {
@@ -55387,6 +55911,7 @@ function registerAdsActivationRoutes(app, opts) {
           manifest: body.manifest
         });
       } catch (error) {
+        outcome2.report(activationFailure(error));
         if (error instanceof AdsActivationError) throw mapApprovalPreflightError(error);
         throw error;
       }
@@ -55495,6 +56020,9 @@ function registerAdsActivationRoutes(app, opts) {
       if (grant.revocationRequestedAt !== null && (grant.state === AdsActivationGrantStates.executing || grant.state === AdsActivationGrantStates.unknown)) {
         startWatchdogSweep?.();
       }
+      if (existing.state === AdsActivationGrantStates.approved && grant.state === AdsActivationGrantStates.revoked) {
+        startRouteOutcome(app, FeatureNames.openai_ads, "activation").report({ status: OutcomeStatuses.cancelled, reasonCode: OutcomeReasonCodes.CANCELLED_BY_USER });
+      }
       return adsActivationGrantResponseSchema.parse({ grant });
     }
   );
@@ -56268,15 +56796,21 @@ function storedEntityState(row) {
   };
 }
 async function executeAdsOperation(app, request, input) {
+  const outcome2 = startRouteOutcome(app, FeatureNames.openai_ads, "operation");
   const hash2 = requestHash({ kind: input.kind, entityType: input.entityType, payload: input.payload });
   const existing = readOperationByKey(app, input.projectId, input.operationKey);
   if (existing) {
     if (existing.requestHash !== hash2) {
-      throw alreadyExists("Ads operation key", input.operationKey);
+      throw outcome2.refuse(OutcomeReasonCodes.VALIDATION, alreadyExists("Ads operation key", input.operationKey));
     }
     return { operation: operationDto(existing), replayed: true };
   }
-  await input.preflight?.();
+  try {
+    await input.preflight?.();
+  } catch (err) {
+    outcome2.report({ status: OutcomeStatuses.failed, ...upstreamFailure(err) });
+    throw err;
+  }
   const id = crypto39.randomUUID();
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const reconcileFields = input.reconciliation.fields ?? null;
@@ -56308,10 +56842,10 @@ async function executeAdsOperation(app, request, input) {
     eq60(adsOperations.operationKey, input.operationKey)
   )).get();
   if (!canonical) {
-    throw providerError("Ads operation receipt could not be claimed");
+    throw outcome2.refuse(OutcomeReasonCodes.INTERNAL, providerError("Ads operation receipt could not be claimed"));
   }
   if (canonical.requestHash !== hash2) {
-    throw alreadyExists("Ads operation key", input.operationKey);
+    throw outcome2.refuse(OutcomeReasonCodes.VALIDATION, alreadyExists("Ads operation key", input.operationKey));
   }
   if (inserted.length === 0) {
     return { operation: operationDto(canonical), replayed: true };
@@ -56360,6 +56894,7 @@ async function executeAdsOperation(app, request, input) {
         }));
       }
     });
+    outcome2.report({ status: OutcomeStatuses.succeeded });
     const row = app.db.select().from(adsOperations).where(eq60(adsOperations.id, id)).get();
     return { operation: operationDto(row), replayed: false };
   } catch (err) {
@@ -56390,6 +56925,10 @@ async function executeAdsOperation(app, request, input) {
       }
       return update.changes > 0;
     });
+    outcome2.report({
+      status: failure.state === AdsOperationStates.failed ? OutcomeStatuses.failed : OutcomeStatuses.partial,
+      ...upstreamFailure(err)
+    });
     if (!finalized) {
       const canonical2 = app.db.select().from(adsOperations).where(and50(
         eq60(adsOperations.id, id),
@@ -56605,8 +57144,17 @@ async function reconcileOneAdsOperation(app, input) {
     maxAttempts: Math.min(20, Math.max(1, input.maxAttempts ?? DEFAULT_RECONCILE_MAX_ATTEMPTS))
   };
   const context = input.audit ?? { actor: "system" };
+  const outcome2 = startRouteOutcome(app, FeatureNames.openai_ads, "reconcile", context.request ? {} : { trigger: OutcomeTriggers.scheduled });
+  const reportInProgress = () => outcome2.report({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.OPERATION_IN_PROGRESS });
+  const finished = (row, failure) => {
+    if (row.state === AdsOperationStates.succeeded) outcome2.report({ status: OutcomeStatuses.succeeded });
+    else if (row.errorCode === ADS_RECONCILIATION_QUARANTINED) outcome2.report({ status: OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.QUARANTINED });
+    else outcome2.report({ status: OutcomeStatuses.failed, ...failure });
+    return reconcileResponse(row);
+  };
   const pendingWaitMs = existing.state === AdsOperationStates.pending ? pendingIdleRemainingMs(existing, now, policy.pendingMinIdleMs) : 0;
   if (pendingWaitMs > 0) {
+    reportInProgress();
     throw operationInProgress(
       "The ads mutation may still be in flight; reconciliation is blocked until the receipt is idle",
       {
@@ -56617,7 +57165,14 @@ async function reconcileOneAdsOperation(app, input) {
     );
   }
   if (existing.reconcileAttempts >= policy.maxAttempts) {
-    return reconcileResponse(quarantineExhaustedReconciliation(app, existing, now, policy, context));
+    const row = quarantineExhaustedReconciliation(app, existing, now, policy, context);
+    if (row.errorCode !== ADS_RECONCILIATION_QUARANTINED) {
+      reportInProgress();
+    } else {
+      const already = existing.errorCode === ADS_RECONCILIATION_QUARANTINED;
+      outcome2.report({ status: already ? OutcomeStatuses.skipped : OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.QUARANTINED });
+    }
+    return reconcileResponse(row);
   }
   const leaseOwner = `ads-reconcile:${crypto39.randomUUID()}`;
   const claimed = claimOperationForReconciliation(
@@ -56635,6 +57190,7 @@ async function reconcileOneAdsOperation(app, input) {
     if (canonical.state === AdsOperationStates.pending) {
       const retryAfterMs = pendingIdleRemainingMs(canonical, now, policy.pendingMinIdleMs);
       if (retryAfterMs > 0) {
+        reportInProgress();
         throw operationInProgress(
           "The ads mutation may still be in flight; reconciliation is blocked until the receipt is idle",
           {
@@ -56645,6 +57201,7 @@ async function reconcileOneAdsOperation(app, input) {
         );
       }
     }
+    reportInProgress();
     return {
       operation: operationDto(canonical),
       resolved: canonical.state === AdsOperationStates.succeeded
@@ -56660,7 +57217,9 @@ async function reconcileOneAdsOperation(app, input) {
       claimed.adAccountId ? "The current credential is connected to a different OpenAI ad account" : "This legacy receipt is not bound to a verified OpenAI ad account",
       policy.maxAttempts
     );
-    return reconcileResponse(row);
+    return finished(row, {
+      reasonCode: claimed.adAccountId ? OutcomeReasonCodes.ACCOUNT_NOT_FOUND : OutcomeReasonCodes.UNSUPPORTED
+    });
   }
   const strategy = claimed.reconcileStrategy;
   const desired = claimed.reconcileFields;
@@ -56674,7 +57233,7 @@ async function reconcileOneAdsOperation(app, input) {
       "This operation cannot be reconciled automatically",
       policy.maxAttempts
     );
-    return reconcileResponse(row);
+    return finished(row, { reasonCode: OutcomeReasonCodes.UNSUPPORTED });
   }
   try {
     let match;
@@ -56689,7 +57248,7 @@ async function reconcileOneAdsOperation(app, input) {
         "The create outcome has no checkpointed provider id and cannot be resolved automatically",
         policy.maxAttempts
       );
-      return reconcileResponse(row2);
+      return finished(row2, { reasonCode: OutcomeReasonCodes.UNSUPPORTED });
     }
     if (checkpointedId) {
       const entity = await getEntityForReconciliation(
@@ -56718,13 +57277,13 @@ async function reconcileOneAdsOperation(app, input) {
         "The upstream entity did not match the requested safe state",
         policy.maxAttempts
       );
-      return reconcileResponse(row2);
+      return finished(row2, { reasonCode: OutcomeReasonCodes.UNKNOWN });
     }
     const row = finishReconciliation(app, claimed, leaseOwner, context, {
       state: AdsOperationStates.succeeded,
       entity: match
     }, policy.maxAttempts);
-    return reconcileResponse(row);
+    return finished(row, { reasonCode: OutcomeReasonCodes.UNKNOWN });
   } catch (error) {
     const failure = errorDetails(error);
     const row = unknownReconciliation(
@@ -56736,7 +57295,7 @@ async function reconcileOneAdsOperation(app, input) {
       "OpenAI Ads API outcome could not be reconciled",
       policy.maxAttempts
     );
-    return reconcileResponse(row);
+    return finished(row, upstreamFailure(error));
   }
 }
 async function sweepAdsOperationsOnce(app, opts, config) {
@@ -56808,7 +57367,10 @@ async function sweepAdsOperationsOnce(app, opts, config) {
     )
   )).orderBy(asc12(adsOperations.updatedAt)).limit(config.batchSize).all();
   for (const row of exhaustedRows) {
-    quarantineExhaustedReconciliation(app, row, now, config.policy, { actor: "system" });
+    const settled = quarantineExhaustedReconciliation(app, row, now, config.policy, { actor: "system" });
+    if (settled.errorCode === ADS_RECONCILIATION_QUARANTINED) {
+      startRouteOutcome(app, FeatureNames.openai_ads, "reconcile", { trigger: OutcomeTriggers.scheduled }).report({ status: OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.QUARANTINED });
+    }
   }
   const credentialsByProjectId = /* @__PURE__ */ new Map();
   const projectRows = app.db.selectDistinct({ id: projects.id, name: projects.name }).from(projects).innerJoin(adsOperations, eq60(adsOperations.projectId, projects.id)).where(staleReconcileWhere).all();
@@ -57002,7 +57564,7 @@ async function adsRoutes(app, opts) {
   });
   app.post(
     "/projects/:name/ads/connect",
-    async (request) => {
+    connectionRoute(app, () => ({ integration: "openai_ads", action: "connect" }), async (request, _reply, attempt) => {
       requireScope(request, ADS_WRITE_SCOPE);
       const project = resolveProject(app.db, request.params.name);
       const parsed = adsConnectRequestSchema.safeParse(request.body);
@@ -57014,12 +57576,14 @@ async function adsRoutes(app, opts) {
       try {
         account = await opts.verifyAdsAccount(parsed.data.apiKey);
       } catch (err) {
+        attempt.failed(err);
         const message = describeError(err);
         throw validationError(`OpenAI Ads API rejected the key: ${message}`);
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
       verificationCache.delete(project.id);
       const existingCfg = opts.adsCredentialStore.getConnection(project.name);
+      if (existingCfg) attempt.update({ action: "reauth" });
       opts.adsCredentialStore.upsertConnection({
         projectName: project.name,
         apiKey: parsed.data.apiKey,
@@ -57071,9 +57635,9 @@ async function adsRoutes(app, opts) {
       });
       const row = app.db.select().from(adsConnections).where(eq60(adsConnections.projectId, project.id)).get();
       return statusDto(row);
-    }
+    })
   );
-  app.delete("/projects/:name/ads/connection", async (request) => {
+  app.delete("/projects/:name/ads/connection", connectionRoute(app, () => ({ integration: "openai_ads", action: "disconnect" }), async (request, _reply, attempt) => {
     requireScope(request, ADS_WRITE_SCOPE);
     const project = resolveProject(app.db, request.params.name);
     const row = app.db.select().from(adsConnections).where(eq60(adsConnections.projectId, project.id)).get();
@@ -57092,8 +57656,9 @@ async function adsRoutes(app, opts) {
     const removedFromConfig = opts.adsCredentialStore?.removeConnection(project.name) ?? false;
     verificationCache.delete(project.id);
     const response = { disconnected: Boolean(row) || removedFromConfig };
+    if (!response.disconnected) attempt.cancelled("NOT_CONNECTED");
     return response;
-  });
+  }));
   app.get("/projects/:name/ads/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const row = app.db.select().from(adsConnections).where(eq60(adsConnections.projectId, project.id)).get();
@@ -58426,7 +58991,7 @@ async function bingRoutes(app, opts) {
     }
     return conn;
   }
-  app.post("/projects/:name/bing/connect", async (request) => {
+  app.post("/projects/:name/bing/connect", connectionRoute(app, () => ({ integration: "bing", action: "connect" }), async (request, _reply, attempt) => {
     const store = requireConnectionStore();
     const { apiKey } = request.body ?? {};
     if (!apiKey || typeof apiKey !== "string") {
@@ -58440,11 +59005,14 @@ async function bingRoutes(app, opts) {
     } catch (e) {
       const msg = describeError(e);
       bingLog("error", "connect.verify-key-failed", { domain: project.canonicalDomain, error: msg });
+      attempt.failed(e);
       throw validationError(`Failed to verify Bing API key: ${msg}`);
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = store.getConnection(project.canonicalDomain);
+    if (existing) attempt.update({ action: "reauth" });
     if (existing && existing.createdByProjectId && existing.createdByProjectId !== project.id) {
+      attempt.failed(void 0, "ALREADY_CONNECTED");
       throw validationError(
         `This domain already has a Bing connection owned by another project. Disconnect it from that project first before re-connecting from "${project.name}".`
       );
@@ -58470,12 +59038,13 @@ async function bingRoutes(app, opts) {
       siteUrl: existing?.siteUrl ?? null,
       availableSites: sites.map((s) => ({ url: s.Url, verified: s.IsVerified ?? false }))
     };
-  });
-  app.delete("/projects/:name/bing/disconnect", async (request, reply) => {
+  }));
+  app.delete("/projects/:name/bing/disconnect", connectionRoute(app, () => ({ integration: "bing", action: "disconnect" }), async (request, reply, attempt) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
     const existing = store.getConnection(project.canonicalDomain);
     if (!existing) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("Bing connection", project.canonicalDomain);
     }
     if (existing.createdByProjectId && existing.createdByProjectId !== project.id) {
@@ -58485,6 +59054,7 @@ async function bingRoutes(app, opts) {
     }
     const deleted = store.deleteConnection(project.canonicalDomain);
     if (!deleted) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("Bing connection", project.canonicalDomain);
     }
     writeAuditLog(app.db, {
@@ -58495,7 +59065,7 @@ async function bingRoutes(app, opts) {
       entityId: project.canonicalDomain
     });
     return reply.status(204).send();
-  });
+  }));
   app.get("/projects/:name/bing/status", async (request) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
@@ -58516,10 +59086,15 @@ async function bingRoutes(app, opts) {
     const sites = await getSites(conn.apiKey);
     return { sites: sites.map((s) => ({ url: s.Url, verified: s.IsVerified ?? false })) };
   });
-  app.post("/projects/:name/bing/set-site", async (request) => {
+  app.post("/projects/:name/bing/set-site", connectionRoute(app, () => ({ integration: "bing", action: "select" }), async (request, _reply, attempt) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
-    requireConnection(store, project.canonicalDomain);
+    try {
+      requireConnection(store, project.canonicalDomain);
+    } catch (err) {
+      attempt.failed(err, "NOT_CONNECTED");
+      throw err;
+    }
     const { siteUrl } = request.body ?? {};
     if (!siteUrl || typeof siteUrl !== "string") {
       throw validationError("siteUrl is required");
@@ -58529,7 +59104,7 @@ async function bingRoutes(app, opts) {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     return { siteUrl };
-  });
+  }));
   app.get("/projects/:name/bing/coverage", async (request) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
@@ -58653,9 +59228,13 @@ async function bingRoutes(app, opts) {
   app.post("/projects/:name/bing/inspect-url", async (request) => {
     const store = requireConnectionStore();
     const project = resolveProject(app.db, request.params.name);
-    const conn = requireConnection(store, project.canonicalDomain);
+    const outcome2 = startRouteOutcome(app, FeatureNames.bing, "inspect");
+    const conn = outcome2.guard(OutcomeReasonCodes.NOT_CONNECTED, () => requireConnection(store, project.canonicalDomain));
     if (!conn.siteUrl) {
-      throw validationError('No Bing site configured. Run "canonry bing set-site <project> <url>" first.');
+      throw outcome2.refuse(
+        OutcomeReasonCodes.PROPERTY_NOT_FOUND,
+        validationError('No Bing site configured. Run "canonry bing set-site <project> <url>" first.')
+      );
     }
     const { url } = request.body ?? {};
     if (!url) {
@@ -58726,6 +59305,7 @@ async function bingRoutes(app, opts) {
         discoveryDate
       }).run();
       app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: now }).where(eq61(runs.id, runId)).run();
+      outcome2.report({ status: OutcomeStatuses.succeeded, counts: { urls: 1 } });
       return {
         id,
         url,
@@ -58742,6 +59322,12 @@ async function bingRoutes(app, opts) {
       const msg = describeError(e);
       bingLog("error", "inspect-url.failed", { domain: project.canonicalDomain, url, error: msg });
       app.db.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq61(runs.id, runId)).run();
+      const failure = classifyOutcomeError(e);
+      outcome2.report({
+        status: OutcomeStatuses.failed,
+        ...failure,
+        ...e instanceof BingApiError && e.isThrottle ? { reasonCode: OutcomeReasonCodes.RATE_LIMITED } : {}
+      });
       throw e;
     }
   });
@@ -58893,35 +59479,48 @@ async function cdpRoutes(app, opts) {
     const stream = fs.createReadStream(fullPath);
     return reply.type("image/png").send(stream);
   });
-  app.put("/settings/cdp", async (request, reply) => {
+  app.put("/settings/cdp", connectionRoute(app, () => ({ integration: "cdp", action: "connect" }), async (request, reply, attempt) => {
     requireScope(request, SETTINGS_WRITE_SCOPE);
     if (!opts.onCdpConfigure) {
       const err = notImplemented("CDP configuration not supported in this deployment");
+      attempt.failed(err);
       return reply.code(err.statusCode).send(err.toJSON());
     }
     const { host, port = 9222 } = request.body;
     if (!host || typeof host !== "string") {
       const err = validationError("host is required");
+      attempt.failed(err);
       return reply.code(err.statusCode).send(err.toJSON());
     }
     const ALLOWED_HOSTS = ["localhost", "127.0.0.1", "::1"];
     if (!ALLOWED_HOSTS.includes(host)) {
       const err = validationError("host must be localhost, 127.0.0.1, or ::1");
+      attempt.failed(err, "BLOCKED_UNSAFE_URL");
       return reply.code(err.statusCode).send(err.toJSON());
     }
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
       const err = validationError("port must be an integer between 1 and 65535");
+      attempt.failed(err);
       return reply.code(err.statusCode).send(err.toJSON());
     }
     await opts.onCdpConfigure(host, port);
     return reply.code(200).send({ endpoint: `ws://${host}:${port}` });
-  });
+  }));
   app.get("/cdp/status", async (_request, reply) => {
     if (!opts.getCdpStatus) {
       const err = notImplemented("CDP not configured");
       return reply.code(err.statusCode).send(err.toJSON());
     }
-    const status = await opts.getCdpStatus();
+    const attempt = startConnectionAttempt(app, { integration: "cdp", action: "test" });
+    let status;
+    try {
+      status = await opts.getCdpStatus();
+    } catch (err) {
+      attempt.failed(err);
+      throw err;
+    }
+    if (status.connected) attempt.succeeded();
+    else if (status.endpoint) attempt.failed(void 0, "NETWORK");
     return reply.send(status);
   });
   app.post("/cdp/screenshot", async (request, reply) => {
@@ -59546,6 +60145,17 @@ async function resolveGa4AccessToken(opts, projectName, canonicalDomain) {
   });
   return { accessToken, propertyId: oauthConn.propertyId };
 }
+function ga4SyncFailure(err, credentialsResolved, opts, project) {
+  const classified = classifyOutcomeError(err);
+  if (credentialsResolved) {
+    return err instanceof GA4ApiError && err.status === 404 ? { ...classified, reasonCode: OutcomeReasonCodes.PROPERTY_NOT_FOUND } : classified;
+  }
+  if (!(err instanceof AppError)) return credentialFailure(err);
+  const oauth = opts.googleConnectionStore?.getConnection(project.canonicalDomain, "ga4");
+  const serviceAccount = opts.ga4CredentialStore?.getConnection(project.name);
+  const unselected = Boolean(oauth?.refreshToken && !oauth.propertyId) || Boolean(serviceAccount?.clientEmail && !serviceAccount.propertyId);
+  return { ...classified, reasonCode: unselected ? OutcomeReasonCodes.PROPERTY_NOT_FOUND : OutcomeReasonCodes.NOT_CONNECTED };
+}
 function requireGa4Connection(opts, projectName, canonicalDomain) {
   const saConn = opts.ga4CredentialStore?.getConnection(projectName);
   const oauthConn = opts.googleConnectionStore?.getConnection(canonicalDomain, "ga4");
@@ -59554,7 +60164,10 @@ function requireGa4Connection(opts, projectName, canonicalDomain) {
   }
 }
 async function ga4Routes(app, opts) {
-  app.post("/projects/:name/ga/connect", async (request, _reply) => {
+  app.post("/projects/:name/ga/connect", connectionRoute(app, (request) => {
+    const body = request.body;
+    return { integration: "ga4", action: typeof body?.keyJson === "string" && body.keyJson ? "connect" : "select" };
+  }, async (request, _reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const { propertyId, keyJson } = request.body ?? {};
     if (!propertyId || typeof propertyId !== "string") {
@@ -59581,10 +60194,12 @@ async function ga4Routes(app, opts) {
       } catch (e) {
         const msg = describeError(e);
         gaLog("error", "connect.verify-failed", { projectId: project.id, propertyId, error: msg });
+        attempt.failed(e);
         throw validationError(`Failed to verify GA4 credentials: ${msg}`);
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const existing = opts.ga4CredentialStore.getConnection(project.name);
+      if (existing) attempt.update({ action: "reauth" });
       const previousPropertyId2 = resolveCurrentGa4PropertyId(opts, project.name, project.canonicalDomain);
       opts.ga4CredentialStore.upsertConnection({
         projectName: project.name,
@@ -59616,6 +60231,7 @@ async function ga4Routes(app, opts) {
     }
     const oauthConn = googleStore.getConnection(project.canonicalDomain, "ga4");
     if (!oauthConn?.accessToken || !oauthConn?.refreshToken) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw validationError(
         'No GA4 OAuth token found. Run "canonry google connect <project> --type ga4" first, or pass --key-file to use a service account.'
       );
@@ -59631,6 +60247,7 @@ async function ga4Routes(app, opts) {
     } catch (e) {
       const msg = describeError(e);
       gaLog("error", "connect.verify-failed.oauth", { projectId: project.id, propertyId, error: msg });
+      attempt.failed(e);
       throw validationError(`Failed to verify GA4 access: ${msg}`);
     }
     const previousPropertyId = resolveCurrentGa4PropertyId(opts, project.name, project.canonicalDomain);
@@ -59651,12 +60268,13 @@ async function ga4Routes(app, opts) {
       entityId: propertyId
     });
     return { connected: true, propertyId, authMethod: "oauth" };
-  });
-  app.delete("/projects/:name/ga/disconnect", async (request, reply) => {
+  }));
+  app.delete("/projects/:name/ga/disconnect", connectionRoute(app, () => ({ integration: "ga4", action: "disconnect" }), async (request, reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const saConn = opts.ga4CredentialStore?.getConnection(project.name);
     const oauthConn = opts.googleConnectionStore?.getConnection(project.canonicalDomain, "ga4");
     if (!saConn && !oauthConn) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("GA4 connection", project.name);
     }
     app.db.delete(gaTrafficSnapshots).where(eq64(gaTrafficSnapshots.projectId, project.id)).run();
@@ -59676,7 +60294,7 @@ async function ga4Routes(app, opts) {
       entityId: propertyId
     });
     return reply.status(204).send();
-  });
+  }));
   app.get("/projects/:name/ga/properties", async (request) => {
     assertNotProjectScoped(request, "listing GA4 properties");
     const project = resolveProject(app.db, request.params.name);
@@ -59750,8 +60368,12 @@ async function ga4Routes(app, opts) {
       startedAt,
       createdAt: startedAt
     }).run();
+    const outcome2 = startRouteOutcome(app, FeatureNames.ga4, "sync");
+    let credentialsResolved = false;
+    let componentFailure;
     try {
       const { accessToken, propertyId } = await resolveGa4AccessToken(opts, project.name, project.canonicalDomain);
+      credentialsResolved = true;
       let rows = [];
       let aiReferrals = [];
       let socialReferrals = [];
@@ -59924,6 +60546,7 @@ async function ga4Routes(app, opts) {
       const [acquisitionSettled, leadsSettled, searchLandingSettled] = await measurementFetch;
       const measurementNow = (/* @__PURE__ */ new Date()).toISOString();
       const recordMeasurementFailure = (component, reason) => {
+        componentFailure ??= { error: reason };
         const message = describeError(reason);
         gaLog("warn", "measurement.component-failed", {
           projectId: project.id,
@@ -59989,6 +60612,7 @@ async function ga4Routes(app, opts) {
         }
       })();
       const recordSearchLandingFailure = (status, reason) => {
+        if (status === "error") componentFailure ??= { error: reason };
         const message = describeError(reason);
         gaLog("warn", "search-landing.component-failed", {
           projectId: project.id,
@@ -60047,6 +60671,14 @@ async function ga4Routes(app, opts) {
         totalUsers: summary3.totalUsers,
         ...only ? { only } : {}
       });
+      const counts2 = { rows: rows.length + dailyTotals.length + aiReferrals.length + socialReferrals.length };
+      if (componentFailure) {
+        outcome2.report({ status: OutcomeStatuses.partial, ...classifyOutcomeError(componentFailure.error), counts: counts2 });
+      } else if (rows.length === 0 && dailyTotals.length === 0) {
+        outcome2.report({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.NO_DATA, counts: counts2 });
+      } else {
+        outcome2.report({ status: OutcomeStatuses.succeeded, counts: counts2 });
+      }
       return {
         synced: true,
         rowCount: rows.length,
@@ -60067,6 +60699,7 @@ async function ga4Routes(app, opts) {
       const msg = describeError(e);
       gaLog("error", "sync.fetch-failed", { projectId: project.id, runId, error: msg });
       app.db.update(runs).set({ status: RunStatuses.failed, error: msg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq64(runs.id, runId)).run();
+      outcome2.report({ status: OutcomeStatuses.failed, ...ga4SyncFailure(e, credentialsResolved, opts, project) });
       throw e;
     }
   });
@@ -61706,16 +62339,43 @@ function toAppError(error) {
       return providerError(error.message, { statusCode: error.statusCode });
   }
 }
-async function withWordpressErrorHandling(handler) {
+function wordpressFailureReason(error) {
+  if (error instanceof EgressRefusedError) return "BLOCKED_UNSAFE_URL";
+  if (error instanceof EgressFailedError) return "NETWORK";
+  return void 0;
+}
+async function withWordpressErrorHandling(handler, attempt) {
   try {
     return await handler();
   } catch (error) {
+    attempt?.failed(error, wordpressFailureReason(error));
     if (error instanceof WordpressApiError) throw toAppError(error);
     if (error instanceof EgressRefusedError && !error.redirected) throw validationError(error.message);
     if (error instanceof EgressRefusedError || error instanceof EgressFailedError) throw providerError(error.message);
     throw error;
   }
 }
+var MANUAL_ASSIST_OUTCOME = { status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.UNSUPPORTED };
+function metaWriteOutcome(results) {
+  const applied = results.filter((r) => r.status === "applied").length;
+  const manual = results.filter((r) => r.status === "manual").length;
+  const errored = results.filter((r) => r.status === "skipped").length;
+  const counts2 = { items: applied, skipped: manual, failures: errored };
+  if (manual === 0 && errored === 0) return { status: OutcomeStatuses.succeeded, counts: counts2 };
+  const reasonCode = manual > 0 ? OutcomeReasonCodes.UNSUPPORTED : OutcomeReasonCodes.UNKNOWN;
+  if (applied > 0) return { status: OutcomeStatuses.partial, reasonCode, counts: counts2 };
+  return { status: errored > 0 ? OutcomeStatuses.failed : OutcomeStatuses.skipped, reasonCode, counts: counts2 };
+}
+function schemaDeployOutcome(results) {
+  const deployed = results.filter((r) => r.status === "deployed").length;
+  const stripped = results.filter((r) => r.status === "stripped").length;
+  const missing = results.filter((r) => r.status === "skipped").length;
+  const failed = results.filter((r) => r.status === "failed").length;
+  const counts2 = { items: deployed, skipped: stripped + missing, failures: failed };
+  if (deployed === results.length) return { status: OutcomeStatuses.succeeded, counts: counts2 };
+  const reasonCode = stripped > 0 ? OutcomeReasonCodes.PERMISSION_MISSING : failed > 0 ? OutcomeReasonCodes.UNKNOWN : OutcomeReasonCodes.NOT_FOUND;
+  return { status: deployed > 0 ? OutcomeStatuses.partial : OutcomeStatuses.failed, reasonCode, counts: counts2 };
+}
 async function wordpressRoutes(app, opts) {
   const allowLoopback = opts.allowLoopbackWebhooks === true;
   function requireStore() {
@@ -61726,20 +62386,22 @@ async function wordpressRoutes(app, opts) {
   function guarded(connection) {
     return { ...connection, fetchImpl: egressFetch };
   }
-  async function assertWordpressUrlAllowed(rawUrl, field) {
+  async function assertWordpressUrlAllowed(rawUrl, field, attempt) {
     const check2 = await resolveWebhookTarget(rawUrl, { allowLoopback });
     if (!check2.ok) {
+      attempt?.failed(void 0, webhookTargetRefusalReason(check2));
       throw validationError(`${field} ${check2.message.replace(/^"url" /, "")}`);
     }
   }
-  function requireConnection(store, projectName) {
+  function requireConnection(store, projectName, settle) {
     const connection = store.getConnection(projectName);
     if (!connection) {
+      settle?.({ status: OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.NOT_CONNECTED });
       throw validationError(`No WordPress connection found for project "${projectName}". Run "canonry wordpress connect ${projectName}" first.`);
     }
     return guarded(connection);
   }
-  app.post("/projects/:name/wordpress/connect", async (request) => {
+  app.post("/projects/:name/wordpress/connect", connectionRoute(app, () => ({ integration: "wordpress", action: "connect" }), async (request, _reply, attempt) => {
     return withWordpressErrorHandling(async () => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
@@ -61751,10 +62413,11 @@ async function wordpressRoutes(app, opts) {
       if (defaultEnv === "staging" && !stagingUrl) {
         throw validationError('defaultEnv "staging" requires stagingUrl');
       }
-      await assertWordpressUrlAllowed(url, "url");
-      if (stagingUrl) await assertWordpressUrlAllowed(stagingUrl, "stagingUrl");
+      await assertWordpressUrlAllowed(url, "url", attempt);
+      if (stagingUrl) await assertWordpressUrlAllowed(stagingUrl, "stagingUrl", attempt);
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const existing = store.getConnection(project.name);
+      if (existing) attempt.update({ action: "reauth" });
       const nextConnection = {
         projectName: project.name,
         url,
@@ -61784,13 +62447,14 @@ async function wordpressRoutes(app, opts) {
         staging,
         adminUrl: getWpStagingAdminUrl(connection.url)
       };
-    });
-  });
-  app.delete("/projects/:name/wordpress/disconnect", async (request, reply) => {
+    }, attempt);
+  }));
+  app.delete("/projects/:name/wordpress/disconnect", connectionRoute(app, () => ({ integration: "wordpress", action: "disconnect" }), async (request, reply, attempt) => {
     const store = requireStore();
     const project = resolveProject(app.db, request.params.name);
     const deleted = store.deleteConnection(project.name);
     if (!deleted) {
+      attempt.failed(void 0, "NOT_CONNECTED");
       throw notFound("WordPress connection", project.name);
     }
     writeAuditLog(app.db, {
@@ -61801,7 +62465,7 @@ async function wordpressRoutes(app, opts) {
       entityId: project.name
     });
     return reply.status(204).send();
-  });
+  }));
   app.get("/projects/:name/wordpress/status", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const stored = opts.wordpressConnectionStore?.getConnection(project.name);
@@ -61853,10 +62517,10 @@ async function wordpressRoutes(app, opts) {
     });
   });
   app.post("/projects/:name/wordpress/pages", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "publish" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const { title, slug, content, status } = request.body ?? {};
       const env = parseEnvInput(request.body?.env);
       if (!title || !slug || !content) {
@@ -61870,14 +62534,15 @@ async function wordpressRoutes(app, opts) {
         entityType: "wordpress_page",
         entityId: created.slug
       });
+      settle({ status: OutcomeStatuses.succeeded, counts: { items: 1 } });
       return created;
-    });
+    }, wordpressFailureReason));
   });
   app.put("/projects/:name/wordpress/page", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "publish" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const currentSlug = request.body?.currentSlug?.trim();
       if (!currentSlug) {
         throw validationError("currentSlug is required");
@@ -61896,14 +62561,15 @@ async function wordpressRoutes(app, opts) {
         entityType: "wordpress_page",
         entityId: currentSlug
       });
+      settle({ status: OutcomeStatuses.succeeded, counts: { items: 1 } });
       return updated;
-    });
+    }, wordpressFailureReason));
   });
   app.post("/projects/:name/wordpress/page/meta", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "meta_write" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const slug = request.body?.slug?.trim();
       if (!slug) {
         throw validationError("slug is required");
@@ -61921,14 +62587,15 @@ async function wordpressRoutes(app, opts) {
         entityType: "wordpress_page",
         entityId: slug
       });
+      settle({ status: OutcomeStatuses.succeeded, counts: { items: 1 } });
       return updated;
-    });
+    }, wordpressFailureReason));
   });
   app.post("/projects/:name/wordpress/pages/meta/bulk", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "meta_write" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const entries = request.body?.entries;
       if (!Array.isArray(entries) || entries.length === 0) {
         throw validationError("entries array is required and must not be empty");
@@ -61950,8 +62617,9 @@ async function wordpressRoutes(app, opts) {
           entityId: `bulk(${applied.map((r) => r.slug).join(",")})`
         });
       }
+      settle(metaWriteOutcome(result.results));
       return result;
-    });
+    }, wordpressFailureReason));
   });
   app.get("/projects/:name/wordpress/schema", async (request) => {
     return withWordpressErrorHandling(async () => {
@@ -61967,31 +62635,35 @@ async function wordpressRoutes(app, opts) {
     });
   });
   app.post("/projects/:name/wordpress/schema/manual", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "schema_deploy" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const slug = request.body?.slug?.trim();
       const json = request.body?.json;
       if (!slug || !json) {
         throw validationError("slug and json are required");
       }
       const env = parseEnvInput(request.body?.env);
-      return buildManualSchemaUpdate(connection, slug, { type: request.body?.type, json }, env);
-    });
+      const manual = await buildManualSchemaUpdate(connection, slug, { type: request.body?.type, json }, env);
+      settle(MANUAL_ASSIST_OUTCOME);
+      return manual;
+    }, wordpressFailureReason));
   });
   app.post("/projects/:name/wordpress/schema/deploy", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "schema_deploy" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const profile = request.body?.profile;
       if (!profile?.business?.name || !profile?.pages || Object.keys(profile.pages).length === 0) {
         throw validationError("profile with business.name and non-empty pages is required");
       }
       const env = parseEnvInput(request.body?.env);
-      return deploySchemaFromProfile(connection, profile, env);
-    });
+      const deployed = await deploySchemaFromProfile(connection, profile, env);
+      settle(schemaDeployOutcome(deployed.results));
+      return deployed;
+    }, wordpressFailureReason));
   });
   app.get("/projects/:name/wordpress/schema/status", async (request) => {
     return withWordpressErrorHandling(async () => {
@@ -62012,17 +62684,19 @@ async function wordpressRoutes(app, opts) {
     });
   });
   app.post("/projects/:name/wordpress/llms-txt/manual", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "llms_txt" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       const content = request.body?.content;
       if (!content) {
         throw validationError("content is required");
       }
       const env = parseEnvInput(request.body?.env);
-      return buildManualLlmsTxtUpdate(connection, content, env);
-    });
+      const manual = await buildManualLlmsTxtUpdate(connection, content, env);
+      settle(MANUAL_ASSIST_OUTCOME);
+      return manual;
+    }, wordpressFailureReason));
   });
   app.get("/projects/:name/wordpress/audit", async (request) => {
     return withWordpressErrorHandling(async () => {
@@ -62060,17 +62734,20 @@ async function wordpressRoutes(app, opts) {
     });
   });
   app.post("/projects/:name/wordpress/staging/push", async (request) => {
-    return withWordpressErrorHandling(async () => {
+    return withWordpressErrorHandling(async () => withFeatureOutcome(app, { feature: "wordpress", operation: "publish" }, async (settle) => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
-      const connection = requireConnection(store, project.name);
+      const connection = requireConnection(store, project.name, settle);
       if (!connection.stagingUrl) {
         throw validationError("No staging URL configured for this project. Reconnect with --staging-url before using staging push.");
       }
-      return buildManualStagingPush(connection);
-    });
+      const manual = await buildManualStagingPush(connection);
+      settle(MANUAL_ASSIST_OUTCOME);
+      return manual;
+    }, wordpressFailureReason));
   });
   app.post("/projects/:name/wordpress/onboard", async (request) => {
+    const attempt = startConnectionAttempt(app, { integration: "wordpress", action: "connect" });
     return withWordpressErrorHandling(async () => {
       const store = requireStore();
       const project = resolveProject(app.db, request.params.name);
@@ -62082,14 +62759,15 @@ async function wordpressRoutes(app, opts) {
       if (defaultEnv === "staging" && !stagingUrl) {
         throw validationError('defaultEnv "staging" requires stagingUrl');
       }
-      await assertWordpressUrlAllowed(url, "url");
-      if (stagingUrl) await assertWordpressUrlAllowed(stagingUrl, "stagingUrl");
+      await assertWordpressUrlAllowed(url, "url", attempt);
+      if (stagingUrl) await assertWordpressUrlAllowed(stagingUrl, "stagingUrl", attempt);
       const steps = [];
       let connection = null;
       let pageUrls = [];
       try {
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = store.getConnection(project.name);
+        if (existing) attempt.update({ action: "reauth" });
         const nextConnection = {
           projectName: project.name,
           url,
@@ -62110,7 +62788,9 @@ async function wordpressRoutes(app, opts) {
           entityId: project.name
         });
         steps.push({ name: "connect", status: "completed", summary: `Connected to ${url}` });
+        attempt.succeeded();
       } catch (err) {
+        attempt.failed(err, wordpressFailureReason(err));
         const msg = describeError(err);
         steps.push({ name: "connect", status: "failed", error: msg });
         return { projectName: project.name, steps };
@@ -62131,6 +62811,11 @@ async function wordpressRoutes(app, opts) {
         steps.push({ name: "audit", status: "failed", error: msg });
         return { projectName: project.name, steps };
       }
+      const metaStartedAt = Date.now();
+      const reportMetaStep = (outcome2) => reportFeatureOutcome(app, { feature: "wordpress", operation: "meta_write" }, {
+        ...outcome2,
+        durationBucket: bucketDuration(Date.now() - metaStartedAt)
+      });
       try {
         const metaEntries = [];
         for (const issue of auditIssues) {
@@ -62155,8 +62840,10 @@ async function wordpressRoutes(app, opts) {
         }
         if (metaEntries.length === 0) {
           steps.push({ name: "set-meta", status: "skipped", summary: "No pages with missing meta found" });
+          reportMetaStep({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.NO_DATA });
         } else {
           const result = await bulkSetSeoMeta(connection, metaEntries);
+          reportMetaStep(metaWriteOutcome(result.results));
           const applied = result.results.filter((r) => r.status === "applied").length;
           const manual = result.results.filter((r) => r.status === "manual").length;
           const skipped4 = result.results.filter((r) => r.status === "skipped").length;
@@ -62169,6 +62856,7 @@ async function wordpressRoutes(app, opts) {
       } catch (err) {
         const msg = describeError(err);
         steps.push({ name: "set-meta", status: "failed", error: msg });
+        reportMetaStep(failedOutcome(err, wordpressFailureReason(err)));
         return { projectName: project.name, steps };
       }
       if (skipSchema || !profile) {
@@ -62178,11 +62866,18 @@ async function wordpressRoutes(app, opts) {
           summary: skipSchema ? "Skipped via --skip-schema" : "No --profile provided"
         });
       } else {
+        const schemaStartedAt = Date.now();
+        const reportSchemaStep = (outcome2) => reportFeatureOutcome(app, { feature: "wordpress", operation: "schema_deploy" }, {
+          ...outcome2,
+          durationBucket: bucketDuration(Date.now() - schemaStartedAt)
+        });
         try {
           if (!profile.business?.name || !profile.pages || Object.keys(profile.pages).length === 0) {
             steps.push({ name: "schema-deploy", status: "skipped", summary: "Profile missing business.name or pages" });
+            reportSchemaStep({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.VALIDATION });
           } else {
             const result = await deploySchemaFromProfile(connection, profile);
+            reportSchemaStep(schemaDeployOutcome(result.results));
             const deployed = result.results.filter((r) => r.status === "deployed").length;
             const stripped = result.results.filter((r) => r.status === "stripped").length;
             const skipped4 = result.results.filter((r) => r.status === "skipped").length;
@@ -62195,6 +62890,7 @@ async function wordpressRoutes(app, opts) {
         } catch (err) {
           const msg = describeError(err);
           steps.push({ name: "schema-deploy", status: "failed", error: msg });
+          reportSchemaStep(failedOutcome(err, wordpressFailureReason(err)));
           return { projectName: project.name, steps };
         }
       }
@@ -62262,7 +62958,7 @@ async function wordpressRoutes(app, opts) {
         entityId: project.name
       });
       return { projectName: project.name, steps };
-    });
+    }, attempt);
   });
 }
 
@@ -62854,13 +63550,14 @@ async function backlinksRoutes(app, opts) {
     }
     return reply.send(opts.getBacklinksStatus());
   });
-  app.post("/backlinks/install", async (_request, reply) => {
+  app.post("/backlinks/install", async (_request, reply) => withFeatureOutcome(app, { feature: "backlinks", operation: "install" }, async (settle) => {
     if (!opts.onInstallBacklinks) {
       throw missingDependency(BACKLINKS_UNSUPPORTED_MESSAGE);
     }
     const result = await opts.onInstallBacklinks();
+    if (result.alreadyPresent) settle({ status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.ALREADY_CONNECTED });
     return reply.status(200).send(result);
-  });
+  }, (err) => err instanceof AppError && err.code === "MISSING_DEPENDENCY" ? OutcomeReasonCodes.UNSUPPORTED : void 0));
   app.post("/backlinks/syncs", async (request, reply) => {
     let release = request.body?.release;
     if (!release) {
@@ -79023,6 +79720,7 @@ async function deliverViaDirectPush(env, batch) {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
+      'user-agent': 'canonry-cloudflare-worker/' + batch.workerVersion,
       'Authorization': 'Bearer ' + bearerToken,
       'X-Canonry-Timestamp': timestamp,
       'X-Canonry-Signature': signature,
@@ -80481,6 +81179,12 @@ async function runBackfillTask(options) {
     pullForBackfill,
     pullErrorPrefix
   } = options;
+  const backfillStartedAt = Date.now();
+  const target = { feature: "server_traffic", operation: "backfill", attribution: currentOutcomeAttribution() };
+  const reportBackfill = (outcome2) => reportFeatureOutcome(app, target, {
+    ...outcome2,
+    durationBucket: bucketDuration(Date.now() - backfillStartedAt)
+  });
   const markFailed = (msg, preserveSourceState = false) => {
     const failedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -80496,6 +81200,7 @@ async function runBackfillTask(options) {
   };
   if (sourceRow2.sourceType === TrafficSourceTypes.wordpress) {
     markFailed("Generic WordPress replace backfill is unavailable because retained coverage is unproven. Use a retention-aware repair that declares the unrecoverable span.");
+    reportBackfill({ status: OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.UNSUPPORTED });
     return;
   }
   let allEvents;
@@ -80506,12 +81211,14 @@ async function runBackfillTask(options) {
       `${pullErrorPrefix}: ${describeError(e)}`,
       e instanceof VercelRetentionClampError
     );
+    reportBackfill(failedOutcome(e, e instanceof VercelRetentionClampError ? OutcomeReasonCodes.NO_DATA : void 0));
     return;
   }
   if (allEvents.length === 0) {
     const finishedAt2 = (/* @__PURE__ */ new Date()).toISOString();
+    let emptyOutcome;
     try {
-      app.db.transaction((tx) => {
+      const completed = app.db.transaction((tx) => {
         const latestSource = tx.select().from(trafficSources).where(eq69(trafficSources.id, sourceRow2.id)).get();
         const stillAuthoritative = latestSource && isAuthoritativeTrafficSource(tx, latestSource) && isSameTrafficSourceGeneration(latestSource, sourceRow2);
         if (stillAuthoritative) {
@@ -80522,9 +81229,13 @@ async function runBackfillTask(options) {
           error: "Traffic source was deactivated or reconfigured during backfill",
           finishedAt: finishedAt2
         }).where(eq69(runs.id, runId)).run();
+        return Boolean(stillAuthoritative);
       });
-    } catch {
+      emptyOutcome = completed ? { status: OutcomeStatuses.skipped, reasonCode: OutcomeReasonCodes.NO_DATA } : { status: OutcomeStatuses.failed, reasonCode: OutcomeReasonCodes.NOT_CONNECTED };
+    } catch (e) {
+      emptyOutcome = failedOutcome(e);
     }
+    reportBackfill(emptyOutcome);
     return;
   }
   const report = buildTrafficProbeReport(allEvents, { sampleLimit: BACKFILL_SAMPLE_LIMIT });
@@ -80784,11 +81495,30 @@ async function runBackfillTask(options) {
       tx.update(runs).set({ status: RunStatuses.completed, finishedAt }).where(eq69(runs.id, runId)).run();
       return "committed";
     });
+    reportBackfill(commitOutcome === "committed" ? {
+      status: OutcomeStatuses.succeeded,
+      counts: {
+        events: report.totals.normalizedEvents,
+        crawlerHits: report.totals.crawlerHits,
+        aiReferralHits: report.totals.aiReferralHits,
+        aiUserFetchHits: report.totals.aiUserFetchHits
+      }
+    } : {
+      status: OutcomeStatuses.failed,
+      reasonCode: commitOutcome === "source-inactive" ? OutcomeReasonCodes.NOT_CONNECTED : OutcomeReasonCodes.UNSUPPORTED
+    });
     if (commitOutcome === "source-inactive" || commitOutcome === "wordpress-backfill-unsupported") return;
   } catch (e) {
     markFailed(`Backfill rollup write failed: ${describeError(e)}`);
+    reportBackfill(failedOutcome(e));
   }
 }
+var TRAFFIC_SOURCE_INTEGRATIONS = {
+  [TrafficSourceTypes.cloudflare]: "traffic_cloudflare",
+  [TrafficSourceTypes["cloud-run"]]: "traffic_cloud_run",
+  [TrafficSourceTypes.vercel]: "traffic_vercel",
+  [TrafficSourceTypes.wordpress]: "traffic_wordpress"
+};
 async function trafficRoutes(app, opts) {
   const pullEvents = opts.pullCloudRunEvents ?? listCloudRunTrafficEvents;
   const resolveAccessToken2 = opts.resolveCloudRunAccessToken ?? defaultResolveAccessToken;
@@ -80820,9 +81550,10 @@ async function trafficRoutes(app, opts) {
   app.addHook("onClose", async () => {
     if (rawSampleRetentionTimer) clearInterval(rawSampleRetentionTimer);
   });
-  async function assertWordpressTargetAllowed(baseUrl) {
+  async function assertWordpressTargetAllowed(baseUrl, attempt) {
     const check2 = await resolveWebhookTarget(baseUrl, { allowLoopback });
     if (!check2.ok) {
+      attempt?.failed(void 0, webhookTargetRefusalReason(check2));
       throw validationError(`WordPress baseUrl rejected: ${check2.message}`);
     }
   }
@@ -80877,7 +81608,7 @@ async function trafficRoutes(app, opts) {
     }
     throw validationError(`Traffic source type "${source.sourceType}" cannot be activated`);
   }
-  app.post("/projects/:name/traffic/connect/cloud-run", async (request) => {
+  app.post("/projects/:name/traffic/connect/cloud-run", connectionRoute(app, () => ({ integration: "traffic_cloud_run", action: "connect" }), async (request, _reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     const body = request.body ?? {};
     const { gcpProjectId, serviceName, location, displayName, keyJson } = body;
@@ -80903,6 +81634,7 @@ async function trafficRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = opts.cloudRunCredentialStore.getConnection(project.name);
+    if (existing) attempt.update({ action: "reauth" });
     opts.cloudRunCredentialStore.upsertConnection({
       projectName: project.name,
       gcpProjectId,
@@ -80966,8 +81698,8 @@ async function trafficRoutes(app, opts) {
       opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
     return rowToDto(sourceRow2);
-  });
-  app.post("/projects/:name/traffic/connect/wordpress", async (request) => {
+  }));
+  app.post("/projects/:name/traffic/connect/wordpress", connectionRoute(app, () => ({ integration: "traffic_wordpress", action: "connect" }), async (request, _reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     if (!opts.wordpressTrafficCredentialStore) {
       throw validationError("WordPress traffic credential storage is not configured for this deployment");
@@ -80978,7 +81710,7 @@ async function trafficRoutes(app, opts) {
       throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
     }
     const { baseUrl, username, applicationPassword, displayName } = parsed.data;
-    await assertWordpressTargetAllowed(baseUrl);
+    await assertWordpressTargetAllowed(baseUrl, attempt);
     try {
       await pullWordpressEvents({
         baseUrl,
@@ -80989,6 +81721,7 @@ async function trafficRoutes(app, opts) {
         fetchImpl: wordpressTrafficFetch
       });
     } catch (e) {
+      attempt.failed(e, e instanceof EgressRefusedError ? "BLOCKED_UNSAFE_URL" : e instanceof EgressFailedError ? "NETWORK" : void 0);
       if (e instanceof WordpressTrafficApiError) {
         throw providerError(
           `WordPress traffic probe failed (HTTP ${e.status}): ${e.message}${e.body ? ` \u2014 ${e.body}` : ""}`
@@ -81000,6 +81733,7 @@ async function trafficRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = credentialStore.getConnection(project.name);
+    if (existing) attempt.update({ action: "reauth" });
     credentialStore.upsertConnection({
       projectName: project.name,
       baseUrl,
@@ -81063,8 +81797,8 @@ async function trafficRoutes(app, opts) {
       opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
     return rowToDto(sourceRow2);
-  });
-  app.post("/projects/:name/traffic/connect/vercel", async (request) => {
+  }));
+  app.post("/projects/:name/traffic/connect/vercel", connectionRoute(app, () => ({ integration: "traffic_vercel", action: "connect" }), async (request, _reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     if (!opts.vercelTrafficCredentialStore) {
       throw validationError("Vercel traffic credential storage is not configured for this deployment");
@@ -81088,6 +81822,7 @@ async function trafficRoutes(app, opts) {
         maxPages: 1
       });
     } catch (e) {
+      attempt.failed(e);
       if (e instanceof VercelLogsApiError) {
         throw providerError(
           `Vercel traffic probe failed (HTTP ${e.status}): ${e.message}${e.body ? ` \u2014 ${e.body}` : ""}`
@@ -81098,6 +81833,7 @@ async function trafficRoutes(app, opts) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = credentialStore.getConnection(project.name);
+    if (existing) attempt.update({ action: "reauth" });
     credentialStore.upsertConnection({
       projectName: project.name,
       projectId,
@@ -81175,8 +81911,8 @@ async function trafficRoutes(app, opts) {
       opts.onScheduleUpdated?.("upsert", project.id, SchedulableRunKinds["traffic-sync"]);
     }
     return rowToDto(sourceRow2);
-  });
-  app.post("/projects/:name/traffic/connect/cloudflare", async (request) => {
+  }));
+  app.post("/projects/:name/traffic/connect/cloudflare", connectionRoute(app, () => ({ integration: "traffic_cloudflare", action: "connect" }), async (request, _reply, attempt) => {
     const project = resolveProject(app.db, request.params.name);
     if (!opts.cloudflareTrafficCredentialStore) {
       throw validationError("Cloudflare traffic credential storage is not configured for this deployment");
@@ -81192,6 +81928,7 @@ async function trafficRoutes(app, opts) {
       const now2 = (/* @__PURE__ */ new Date()).toISOString();
       const cloudflareSources = app.db.select().from(trafficSources).where(eq69(trafficSources.projectId, project.id)).all().filter((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived);
       const sameModeSource = cloudflareSources.find((row) => parseQueuePullCloudflareSourceConfig(row.configJson));
+      if (sameModeSource) attempt.update({ action: "reauth" });
       const sourceId2 = sameModeSource?.id ?? crypto48.randomUUID();
       const previousCredential2 = credentialStore.getConnectionBySourceId(sourceId2);
       const workerVersion2 = CURRENT_CLOUDFLARE_WORKER_VERSION;
@@ -81327,6 +82064,7 @@ async function trafficRoutes(app, opts) {
     const workerRouteHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const activeSource = app.db.select().from(trafficSources).where(eq69(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(row.configJson) !== null);
+    if (activeSource) attempt.update({ action: "reauth" });
     const sourceId = activeSource?.id ?? crypto48.randomUUID();
     const parsedActiveConfig = activeSource ? parseDirectPushCloudflareSourceConfig(activeSource.configJson) : null;
     if (activeSource && !parsedActiveConfig) {
@@ -81486,8 +82224,12 @@ async function trafficRoutes(app, opts) {
       workerVersion,
       instructions
     };
-  });
-  app.post("/projects/:name/traffic/sources/:id/activate", async (request) => {
+  }));
+  app.post("/projects/:name/traffic/sources/:id/activate", connectionRoute(app, (request) => {
+    const source = app.db.select({ sourceType: trafficSources.sourceType }).from(trafficSources).where(eq69(trafficSources.id, request.params.id)).get();
+    const integration = source ? TRAFFIC_SOURCE_INTEGRATIONS[source.sourceType] : void 0;
+    return integration ? { integration, action: "select" } : void 0;
+  }, async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const result = app.db.transaction((tx) => {
@@ -81538,7 +82280,7 @@ async function trafficRoutes(app, opts) {
       opts.onScheduleUpdated?.(result.scheduleAction, project.id, SchedulableRunKinds["traffic-sync"]);
     }
     return rowToDto(result.source);
-  });
+  }));
   app.post("/projects/:name/traffic/cloudflare/ingest", {
     bodyLimit: CLOUDFLARE_INGEST_BODY_LIMIT,
     preHandler: async (request, reply) => {
@@ -81567,6 +82309,22 @@ async function trafficRoutes(app, opts) {
       }
     }
   }, async (request, reply) => {
+    const ingestStartedMs = Date.now();
+    const reportIngest = (outcome2) => {
+      try {
+        opts.onTrafficIngested?.("failure" in outcome2 ? {
+          sourceType: TrafficSourceTypes.cloudflare,
+          status: "failed",
+          events: 0,
+          crawlerHits: 0,
+          aiReferralHits: 0,
+          aiUserFetchHits: 0,
+          durationMs: Date.now() - ingestStartedMs,
+          ...routeOutcomeFailure(outcome2.failure, outcome2.reasonCode)
+        } : { sourceType: TrafficSourceTypes.cloudflare, status: "succeeded", ...outcome2, durationMs: Date.now() - ingestStartedMs });
+      } catch {
+      }
+    };
     const authenticated = authenticateCloudflareIngest(
       request,
       opts.cloudflareTrafficCredentialStore
@@ -81584,6 +82342,7 @@ async function trafficRoutes(app, opts) {
     if (sourceRow2.projectId !== project.id) throw authRequired();
     const parsed = cloudflareWorkerIngestRequestSchema.safeParse(request.body);
     if (!parsed.success) {
+      reportIngest({ failure: void 0, reasonCode: "VALIDATION" });
       throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
     }
     const { workerVersion, events } = parsed.data;
@@ -81592,6 +82351,7 @@ async function trafficRoutes(app, opts) {
       (event) => normalizeCloudflareEventHost(event.host) !== canonicalHost
     );
     if (wrongHostIndex !== -1) {
+      reportIngest({ failure: void 0, reasonCode: "VALIDATION" });
       throw validationError(
         `Cloudflare event at index ${wrongHostIndex} does not belong to project domain "${project.canonicalDomain}"`
       );
@@ -81604,25 +82364,37 @@ async function trafficRoutes(app, opts) {
       else normalizationDrops += 1;
     }
     const receivedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const writeResult = writeTrafficEventBatch({
-      db: app.db,
-      projectId: project.id,
-      sourceId,
-      events: normalized,
-      receivedAt,
-      receiptTtlMs: DIRECT_PUSH_RECEIPT_TTL_MS,
-      sampleLimit,
-      validateSource: (latestRow) => {
-        if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status !== TrafficSourceStatuses.connected || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
-          throw authRequired();
+    let writeResult;
+    try {
+      writeResult = writeTrafficEventBatch({
+        db: app.db,
+        projectId: project.id,
+        sourceId,
+        events: normalized,
+        receivedAt,
+        receiptTtlMs: DIRECT_PUSH_RECEIPT_TTL_MS,
+        sampleLimit,
+        validateSource: (latestRow) => {
+          if (!latestRow || latestRow.projectId !== project.id || latestRow.sourceType !== TrafficSourceTypes.cloudflare || latestRow.status !== TrafficSourceStatuses.connected || !parseDirectPushCloudflareSourceConfig(latestRow.configJson) || !timingSafeEqualHex(bearerHash, latestRow.ingestTokenHash)) {
+            throw authRequired();
+          }
+        },
+        sourceUpdate: {
+          lastWorkerVersion: workerVersion,
+          lastSyncedAt: receivedAt,
+          lastError: null,
+          updatedAt: receivedAt
         }
-      },
-      sourceUpdate: {
-        lastWorkerVersion: workerVersion,
-        lastSyncedAt: receivedAt,
-        lastError: null,
-        updatedAt: receivedAt
-      }
+      });
+    } catch (err) {
+      reportIngest({ failure: err });
+      throw err;
+    }
+    reportIngest({
+      events: writeResult.acceptedEvents,
+      crawlerHits: writeResult.crawlerHits,
+      aiReferralHits: writeResult.aiReferralHits,
+      aiUserFetchHits: writeResult.aiUserFetchHits
     });
     return reply.status(200).send({
       acceptedEvents: writeResult.acceptedEvents,
@@ -81860,6 +82632,22 @@ async function trafficRoutes(app, opts) {
       } catch (error) {
         const failedAt = (/* @__PURE__ */ new Date()).toISOString();
         const safeError = error instanceof CloudflareQueueApiError ? error.message : "Cloudflare Queue sync failed; retry the active source.";
+        try {
+          opts.onTrafficSynced?.({
+            status: "failed",
+            sourceType: sourceRow2.sourceType,
+            sourceId: sourceRow2.id,
+            pulledEvents: 0,
+            selfTrafficExcluded: 0,
+            crawlerHits: 0,
+            aiUserFetchHits: 0,
+            aiReferralHits: 0,
+            durationMs: Date.now() - startedMs,
+            // A 401/403 is the stored API token; any other Queue API answer is the pull.
+            errorCode: error instanceof CloudflareQueueApiError ? error.status === 401 || error.status === 403 ? "PROVIDER_AUTH" : "PROVIDER_PULL" : "INTERNAL"
+          });
+        } catch {
+        }
         app.db.transaction((tx) => {
           tx.update(runs).set({ status: RunStatuses.failed, error: safeError, finishedAt: failedAt }).where(eq69(runs.id, runId)).run();
           const latestSource = tx.select().from(trafficSources).where(eq69(trafficSources.id, sourceRow2.id)).get();
@@ -82573,7 +83361,7 @@ async function trafficRoutes(app, opts) {
       }
     }
   });
-  app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => {
+  app.post("/projects/:name/traffic/sources/:id/backfill", async (request) => withFeatureOutcome(app, { feature: "server_traffic", operation: "backfill" }, async (recordOutcome) => {
     const project = resolveProject(app.db, request.params.name);
     const sourceRow2 = app.db.select().from(trafficSources).where(eq69(trafficSources.id, request.params.id)).get();
     if (!sourceRow2 || sourceRow2.projectId !== project.id) {
@@ -82714,6 +83502,7 @@ async function trafficRoutes(app, opts) {
       pullErrorPrefix
     }).catch(() => {
     });
+    recordOutcome(null);
     const response = {
       sourceId: sourceRow2.id,
       runId,
@@ -82724,7 +83513,7 @@ async function trafficRoutes(app, opts) {
       daysApplied: appliedDays
     };
     return response;
-  });
+  }));
   function buildSourceDetail(projectId, row, since) {
     const crawlerPathRows = app.db.select({
       pathNormalized: crawlerEventsHourly.pathNormalized,
@@ -82790,7 +83579,7 @@ async function trafficRoutes(app, opts) {
       } : null
     };
   }
-  app.post("/projects/:name/traffic/sources/:id/reset", async (request) => {
+  app.post("/projects/:name/traffic/sources/:id/reset", async (request) => withFeatureOutcome(app, { feature: "server_traffic", operation: "reset" }, async () => {
     const project = resolveProject(app.db, request.params.name);
     const parsed = trafficResetRequestSchema.safeParse(request.body ?? {});
     if (!parsed.success) {
@@ -82843,7 +83632,7 @@ async function trafficRoutes(app, opts) {
       updatedRow = tx.select().from(trafficSources).where(eq69(trafficSources.id, sourceRow2.id)).get();
     });
     return buildSourceDetail(project.id, updatedRow, new Date(Date.now() - 24 * 60 * 6e4).toISOString());
-  });
+  }));
   app.get("/projects/:name/traffic/sources", async (request) => {
     const project = resolveProject(app.db, request.params.name);
     const rows = app.db.select().from(trafficSources).where(eq69(trafficSources.projectId, project.id)).orderBy(desc35(trafficSources.createdAt)).all();
@@ -90894,6 +91683,7 @@ function captureSimpleMeasurementDefinition(db, input) {
 // ../api-routes/src/index.ts
 async function apiRoutes(app, opts) {
   app.decorate("db", opts.db);
+  app.decorate("emitOutcome", createOutcomeEmitter(opts.onOutcome));
   app.setErrorHandler((error, _request, reply) => {
     if (error instanceof AppError) {
       return reply.status(error.statusCode).send(error.toJSON());
@@ -91167,6 +91957,7 @@ async function apiRoutes(app, opts) {
       cloudflareIngestIpRateLimitMax: opts.cloudflareIngestIpRateLimitMax,
       defaultSampleLimit: opts.defaultTrafficSampleLimit,
       onTrafficSynced: opts.onTrafficSynced,
+      onTrafficIngested: opts.onTrafficIngested,
       onScheduleUpdated: opts.onScheduleUpdated,
       allowLoopbackWebhooks: opts.allowLoopbackWebhooks
     });
@@ -92497,6 +93288,7 @@ export {
   bingConnections,
   bingUrlInspections,
   bingKeywordStats,
+  gaConnections,
   gaTrafficSnapshots,
   gaDailyTotals,
   gaAcquisitionDaily,
@@ -92574,6 +93366,7 @@ export {
   createCredentialChecker,
   requireInstanceAdministrator,
   hashApiKey,
+  currentOutcomeAttribution,
   notProbeRun,
   writeAuditLog,
   auditFromRequest,
@@ -92587,9 +93380,15 @@ export {
   SentimentService,
   registerOAuthRoutes,
   registerOAuthAdminRoutes,
+  credentialFailure,
   createRunCompetitorResolver,
   competitorIdentityColumns,
   readMarketCompetitorNames,
+  toAlertView,
+  resolveDestination,
+  webhookOutcomeTarget,
+  webhookTargetRefusalReason,
+  webhookResponseReason,
   latestQueryBasketRevision,
   ensureCurrentQueryBasketRevision,
   queueRunIfProjectIdle,
@@ -92609,19 +93408,20 @@ export {
   deliverWebhook,
   redactNotificationUrl,
   buildOpenApiDocument,
-  toAlertView,
-  resolveDestination,
   getPlaceDetails,
   hashPlaceDetails,
   getPlaceReviewSignals,
   GSC_REPORTING_TIME_ZONE,
   GSC_DATA_LAG_DAYS,
+  GoogleAuthError,
+  GoogleApiError,
   getAuthUrl,
   exchangeCode,
   refreshAccessToken,
   fetchSearchAnalytics,
   inspectUrl,
   GBP_DAILY_METRICS,
+  GbpApiError,
   listLocations,
   formatStorefrontAddress,
   buildLocationProfileFields,
@@ -92636,6 +93436,7 @@ export {
   hashAttributes,
   listReviews,
   classifyReviewsError,
+  BingApiError,
   getUrlInfo,
   getCrawlIssues,
   EgressRefusedError,