@canonry/canonry 7.46.0 → 7.47.0

package/dist/{chunk-ZOTA3MOL.js → chunk-KCSU2OSL.js}

@@ -147,6 +147,7 @@ import {
   RatioUnits,
   ResearchQueryStatuses,
   ResearchRunStatuses,
+  RetrievalStatuses,
   RunFillRefusalCodes,
   RunKinds,
   RunStatuses,
@@ -888,6 +889,7 @@ import {
   unsupportedKind,
   upgradeCaveatFor,
   usableBrandAliases,
+  usageSurfaceSchema,
   userDtoSchema,
   userListDtoSchema,
   validationError,
@@ -913,7 +915,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-V4TITINC.js";
+} from "./chunk-QS262E4F.js";
 
 // src/intelligence-service.ts
 import { eq as eq99, desc as desc45, asc as asc20, and as and82, ne as ne17, or as or24, inArray as inArray40, gte as gte26, lte as lte23, isNull as isNull19, sql as sql37, exists as exists2 } from "drizzle-orm";
@@ -30901,6 +30903,7 @@ function visibilityComparisonPopulation(run, selection) {
       answerMentioned: signals.mention,
       mentionApplicable: candidate.edges.some((edge) => targets.get(edge.targetKey)?.mentionEligible === true),
       citation: citationForCoverage(candidate, targets),
+      retrievalStatus: candidate.observation.retrievalStatus ?? null,
       answerText: candidate.observation.answerText,
       competitorDomains: [...new Set(candidate.edges.flatMap((edge) => edge.competitorDomains))],
       competitorMentions: candidate.observation.competitorMentionDomains.filter((domain) => candidate.edges.some((edge) => edge.competitorDomains.includes(domain))),
@@ -30965,6 +30968,7 @@ function loadVisibilitySnapshots(db, runIds) {
     citedDomains: querySnapshots.citedDomains,
     citedUrls: querySnapshots.citedUrls,
     captureStatus: querySnapshots.captureStatus,
+    retrievalStatus: querySnapshots.retrievalStatus,
     location: querySnapshots.location,
     measurementExecutionId: querySnapshots.measurementExecutionId,
     requestedContext: querySnapshots.requestedContext,
@@ -31110,6 +31114,7 @@ function v2Observations(plan, revision, run, snapshots, includeEvidence = true)
       unknownMentionTargetKeys: attribution?.unknownMentionTargetIds ?? [],
       citedTargetKeys: attribution?.citedTargetIds ?? [],
       citationComplete: attribution?.sourceComplete ?? false,
+      retrievalStatus: raw.retrievalStatus ?? null,
       competitorMentionDomains: signals.mentioned,
       competitorCitationDomains: signals.cited,
       observedCompetitorNames: includeEvidence ? observedCompetitorNames2(raw.recommendedCompetitors) : [],
@@ -31233,6 +31238,7 @@ function frozenSimpleRun(run, definition2, snapshots, includeEvidence = true) {
       // Simple citation state comes from the stored cited domains, not from
       // source-URL capture, so a saved Simple answer is never `unchecked`.
       citationComplete: true,
+      retrievalStatus: snapshot.retrievalStatus ?? null,
       competitorMentionDomains: competitorSignalsForSnapshot.mentioned,
       competitorCitationDomains: competitorSignalsForSnapshot.cited,
       observedCompetitorNames: includeEvidence ? observedCompetitorNames2(snapshot.recommendedCompetitors) : [],
@@ -31316,6 +31322,7 @@ function legacySimpleRun(project, run, snapshots, includeEvidence = true) {
       citedTargetKeys: snapshot.citationState === "cited" ? ["project"] : [],
       // Legacy rows carry only the stored citation state (see the frozen-simple note).
       citationComplete: true,
+      retrievalStatus: snapshot.retrievalStatus ?? null,
       competitorMentionDomains: [],
       competitorCitationDomains: [],
       observedCompetitorNames: includeEvidence ? observedCompetitorNames2(snapshot.recommendedCompetitors) : [],
@@ -37543,6 +37550,7 @@ function countPeriod(snaps, competitors2, queryClassOf, classificationAvailable,
   let total = 0;
   let cited = 0;
   let citationUnknown = 0;
+  let citationNotSearched = 0;
   let competitorCited = 0;
   const perProvider = /* @__PURE__ */ new Map();
   const mentionedQueries = /* @__PURE__ */ new Set();
@@ -37555,9 +37563,11 @@ function countPeriod(snaps, competitors2, queryClassOf, classificationAvailable,
       mentionedQueries.add(snap.queryId);
     }
     const citationKnown = snap.citationChecked !== false;
-    if (citationKnown) total += 1;
-    else citationUnknown += 1;
-    const isCited = citationKnown && snap.citationState === CitationStates.cited;
+    const noRetrieval = citationKnown && snap.retrievalStatus === RetrievalStatuses["not-used"];
+    if (!citationKnown) citationUnknown += 1;
+    else if (noRetrieval) citationNotSearched += 1;
+    else total += 1;
+    const isCited = citationKnown && !noRetrieval && snap.citationState === CitationStates.cited;
     if (isCited) cited += 1;
     const pp = perProvider.get(snap.provider) ?? { checked: 0, mentioned: 0, cited: 0 };
     if (snap.answerMentioned === true || snap.answerMentioned === false) pp.checked += 1;
@@ -37602,6 +37612,7 @@ function countPeriod(snaps, competitors2, queryClassOf, classificationAvailable,
     total,
     cited,
     citationUnknown,
+    citationNotSearched,
     citationEvidence: snaps.some((snapshot) => snapshot.citationChecked !== void 0),
     projectCited: cited,
     competitorCited,
@@ -37661,7 +37672,7 @@ function computeVisibilityCompare(input) {
   });
   const fromShare = shareCounts(fromShareCounts);
   const toShare = shareCounts(toShareCounts);
-  const citationPeriod = (c, value) => c.citationEvidence ? { ...value, excludedUnknown: c.citationUnknown } : value;
+  const citationPeriod = (c, value) => c.citationEvidence ? { ...value, excludedUnknown: c.citationUnknown, ...c.citationNotSearched > 0 ? { excludedNoRetrieval: c.citationNotSearched } : {} } : value;
   const metrics = [
     metric(
       "mention-share-of-voice",
@@ -37708,7 +37719,7 @@ function computeVisibilityCompare(input) {
   const classPeriod = (snapshots, queryClass, signal) => {
     if (!classificationAvailable) return { ...period(0, 0), availability: "classification-unavailable" };
     const selected = snapshots.filter((snapshot) => queryClassOf(snapshot) === queryClass && (signal === "cited" || snapshot.mentionApplicable !== false));
-    const checked = selected.filter((snapshot) => signal === "mention" ? typeof snapshot.answerMentioned === "boolean" : snapshot.citationChecked !== false);
+    const checked = selected.filter((snapshot) => signal === "mention" ? typeof snapshot.answerMentioned === "boolean" : snapshot.citationChecked !== false && snapshot.retrievalStatus !== RetrievalStatuses["not-used"]);
     const numerator = checked.filter((snapshot) => signal === "mention" ? snapshot.answerMentioned === true : snapshot.citationState === CitationStates.cited).length;
     return { ...period(numerator, checked.length), excludedUnknown: selected.length - checked.length };
   };
@@ -43354,7 +43365,7 @@ var routeCatalog = [
     method: "get",
     path: "/api/v1/projects/{name}/visibility-compare",
     summary: "Compare AEO visibility month over month",
-    description: "Statistically honest month-over-month AEO comparison in one call. PRIMARY metric is share of voice (brand vs competitor mentions in the same answers), which is less exposed to broad model-wide naming propensity than an absolute rate but never bypasses model continuity. Rates are pooled per-snapshot over each month (invariant to sweep count), restricted to query/provider pairs present in BOTH months, and then restricted again to providers with exactly one known, identical configured model id in both months. `continuity` reports every provider and its model evidence; changed, mixed mid-month, or legacy-unknown models are excluded. When no provider remains, metrics return a continuity-blocked verdict rather than a directional call. `from` must be a month strictly before `to`. Adds separate branded/non-brand mention and cited rates with classification-unavailable rather than pooled fallback. Advanced class metrics read frozen Property/market/execution assignments and reuse each answer once per class. Without a scope or marketKey the four original metrics keep the project frame (provider/location narrow it the same way for Simple and Advanced) and Advanced class metrics carry their own `classComparison` cohort. A scope or marketKey answers entirely from the frozen frame and is refused when either month holds runs whose plan cannot be reconstructed (schema v1). On frozen frames, answers with incomplete source capture leave every citation figure and are counted in `excludedUnknown`. A silent upstream version bump under an unchanged configured id remains undetectable. competitorIdentityChangedAt is when the project's competitor names last changed (a tracked competitor's curated or stored auto-detected names (a block counts only when it removes a stored name), a detection pass or a write that moved a market-only competitor's learned names, or a published revision that renames a market pin). Share of voice reads both months with the tracked competitors' current names only, so a comparison quoted before a change to those names was restated; a market pin or learned-name change moves the time without changing share of voice. A scoped comparison (a group, market or property scope, or a marketKey) reads frozen plan history and carries no competitorIdentityChangedAt.",
+    description: "Statistically honest month-over-month AEO comparison in one call. PRIMARY metric is share of voice (brand vs competitor mentions in the same answers), which is less exposed to broad model-wide naming propensity than an absolute rate but never bypasses model continuity. Rates are pooled per-snapshot over each month (invariant to sweep count), restricted to query/provider pairs present in BOTH months, and then restricted again to providers with exactly one known, identical configured model id in both months. `continuity` reports every provider and its model evidence; changed, mixed mid-month, or legacy-unknown models are excluded. When no provider remains, metrics return a continuity-blocked verdict rather than a directional call. `from` must be a month strictly before `to`. Adds separate branded/non-brand mention and cited rates with classification-unavailable rather than pooled fallback. Advanced class metrics read frozen Property/market/execution assignments and reuse each answer once per class. Without a scope or marketKey the four original metrics keep the project frame (provider/location narrow it the same way for Simple and Advanced) and Advanced class metrics carry their own `classComparison` cohort. A scope or marketKey answers entirely from the frozen frame and is refused when either month holds runs whose plan cannot be reconstructed (schema v1). On frozen frames, answers with incomplete source capture leave every citation figure and are counted in `excludedUnknown`. An answer the provider wrote with no retrieval step at all (retrievalStatus of not-used) cites nothing by construction, so it also leaves the cited denominator and is counted in `excludedNoRetrieval`; it stays in the mention denominator, since brand recall does not need search. A silent upstream version bump under an unchanged configured id remains undetectable. competitorIdentityChangedAt is when the project's competitor names last changed (a tracked competitor's curated or stored auto-detected names (a block counts only when it removes a stored name), a detection pass or a write that moved a market-only competitor's learned names, or a published revision that renames a market pin). Share of voice reads both months with the tracked competitors' current names only, so a comparison quoted before a change to those names was restated; a market pin or learned-name change moves the time without changing share of voice. A scoped comparison (a group, market or property scope, or a marketKey) reads frozen plan history and carries no competitorIdentityChangedAt.",
     tags: ["analytics"],
     parameters: [
       nameParameter,
@@ -46517,6 +46528,7 @@ var routeCatalog = [
       // TODO: Add `GaConnectResponse` Zod schema in contracts.
       200: rawJsonResponse("GA4 connection established.", looseObjectSchema),
       400: errorResponse("Invalid GA4 connection request."),
+      403: errorResponse("Google refused the property (`details.reason` is `ga4-permission-missing`). Retrying will not help until access is granted; repeated refusals are answered without asking Google again until `details.nextCheckAt`."),
       404: errorResponse("Project not found.")
     }
   },
@@ -60100,11 +60112,76 @@ async function adsRoutes(app, opts) {
 }
 
 // ../api-routes/src/bing.ts
-import crypto42 from "crypto";
+import crypto43 from "crypto";
 import { eq as eq66, and as and54, desc as desc32 } from "drizzle-orm";
 
-// ../integration-bing/src/bing-client.ts
+// ../api-routes/src/connection-verify-cache.ts
 import crypto41 from "crypto";
+var CONNECTION_VERIFY_TTL_MS = 15 * 60 * 1e3;
+var REFUSALS_BEFORE_BACKOFF = 3;
+var FIRST_BACKOFF_MS = 5 * 60 * 1e3;
+var MAX_BACKOFF_MS = 60 * 60 * 1e3;
+var MAX_ENTRIES = 500;
+function remember(entries, key, value) {
+  entries.delete(key);
+  entries.set(key, value);
+  if (entries.size > MAX_ENTRIES) entries.delete(entries.keys().next().value);
+}
+function isInteractiveCaller() {
+  const attribution = currentOutcomeAttribution();
+  const label = usageSurfaceSchema.safeParse(attribution?.surfaceLabel);
+  if (label.success) return label.data === "cli" || label.data === "dashboard";
+  const ua = attribution?.userAgent ?? "";
+  return ua.startsWith("canonry-cli") || ua.startsWith("Mozilla/");
+}
+function verifyCacheKey(...parts) {
+  return crypto41.createHash("sha256").update(parts.join("\0")).digest("hex");
+}
+function createVerifyCache(ttlMs = CONNECTION_VERIFY_TTL_MS) {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    get(key) {
+      const entry = entries.get(key);
+      if (!entry) return void 0;
+      if (Date.now() - entry.at < ttlMs) return entry.value;
+      entries.delete(key);
+      return void 0;
+    },
+    set(key, value) {
+      remember(entries, key, { value, at: Date.now() });
+    }
+  };
+}
+function createRefusalBackoff() {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    /** The refusal to answer with instead of asking the upstream, while this key is backing off. */
+    replay(key) {
+      const entry = entries.get(key);
+      if (!entry || entry.count < REFUSALS_BEFORE_BACKOFF) return void 0;
+      const wait = Math.min(FIRST_BACKOFF_MS * 2 ** (entry.count - REFUSALS_BEFORE_BACKOFF), MAX_BACKOFF_MS);
+      const nextCheckAt = entry.at + wait;
+      if (Date.now() >= nextCheckAt) return void 0;
+      const { error } = entry;
+      return {
+        error: new AppError(error.code, error.message, error.statusCode, {
+          ...error.details,
+          nextCheckAt: new Date(nextCheckAt).toISOString()
+        }),
+        cause: entry.cause
+      };
+    },
+    refused(key, error, cause) {
+      remember(entries, key, { count: (entries.get(key)?.count ?? 0) + 1, at: Date.now(), error, cause });
+    },
+    cleared(key) {
+      entries.delete(key);
+    }
+  };
+}
+
+// ../integration-bing/src/bing-client.ts
+import crypto42 from "crypto";
 
 // ../integration-bing/src/constants.ts
 var BING_WMT_API_BASE = "https://ssl.bing.com/webmaster/api.svc/json";
@@ -60259,7 +60336,7 @@ async function bingFetchOnce(apiKey, endpoint, opts) {
 var throttleCooldownUntil = /* @__PURE__ */ new Map();
 var cooldownNow = () => Date.now();
 function cooldownKey(apiKey) {
-  return crypto41.createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
+  return crypto42.createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
 }
 function throttleCooldownRemainingMs(apiKey) {
   const until = throttleCooldownUntil.get(cooldownKey(apiKey));
@@ -60403,6 +60480,7 @@ async function loadBlockingCrawlIssues(apiKey, siteUrl, domain) {
   return blockedUrls;
 }
 async function bingRoutes(app, opts) {
+  const keyChecks = createVerifyCache();
   function requireConnectionStore() {
     if (opts.bingConnectionStore) return opts.bingConnectionStore;
     throw validationError("Bing connection storage is not configured for this deployment");
@@ -60421,16 +60499,21 @@ async function bingRoutes(app, opts) {
       throw validationError("apiKey is required");
     }
     const project = resolveProject(app.db, request.params.name);
-    let sites;
-    try {
-      sites = await getSites(apiKey);
-      bingLog("info", "connect.verify-key", { domain: project.canonicalDomain, siteCount: sites.length });
-    } catch (e) {
-      const msg = describeError(e);
-      bingLog("error", "connect.verify-key-failed", { domain: project.canonicalDomain, error: msg });
-      attempt.failed(e);
-      throw validationError(`Failed to verify Bing API key: ${msg}`);
+    const keyCheck = verifyCacheKey("bing-key", apiKey);
+    let sites = isInteractiveCaller() ? void 0 : keyChecks.get(keyCheck);
+    if (!sites) {
+      try {
+        sites = await getSites(apiKey);
+        keyChecks.set(keyCheck, sites);
+        bingLog("info", "connect.verify-key", { domain: project.canonicalDomain, siteCount: sites.length });
+      } catch (e) {
+        const msg = describeError(e);
+        bingLog("error", "connect.verify-key-failed", { domain: project.canonicalDomain, error: msg });
+        attempt.failed(e);
+        throw validationError(`Failed to verify Bing API key: ${msg}`);
+      }
     }
+    const availableSites = sites.map((s) => ({ url: s.Url, verified: s.IsVerified ?? false }));
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const existing = store.getConnection(project.canonicalDomain);
     if (existing) attempt.update({ action: "reauth" });
@@ -60440,6 +60523,9 @@ async function bingRoutes(app, opts) {
         `This domain already has a Bing connection owned by another project. Disconnect it from that project first before re-connecting from "${project.name}".`
       );
     }
+    if (existing?.apiKey === apiKey && existing.createdByProjectId) {
+      return { connected: true, domain: project.canonicalDomain, siteUrl: existing.siteUrl ?? null, availableSites };
+    }
     store.upsertConnection({
       domain: project.canonicalDomain,
       apiKey,
@@ -60459,7 +60545,7 @@ async function bingRoutes(app, opts) {
       connected: true,
       domain: project.canonicalDomain,
       siteUrl: existing?.siteUrl ?? null,
-      availableSites: sites.map((s) => ({ url: s.Url, verified: s.IsVerified ?? false }))
+      availableSites
     };
   }));
   app.delete("/projects/:name/bing/disconnect", connectionRoute(app, () => ({ integration: "bing", action: "disconnect" }), async (request, reply, attempt) => {
@@ -60589,7 +60675,7 @@ async function bingRoutes(app, opts) {
       const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
       const now = (/* @__PURE__ */ new Date()).toISOString();
       app.db.insert(bingCoverageSnapshots).values({
-        id: crypto42.randomUUID(),
+        id: crypto43.randomUUID(),
         projectId: project.id,
         syncRunId: snapshotRunId,
         date: snapshotDate,
@@ -60664,7 +60750,7 @@ async function bingRoutes(app, opts) {
       throw validationError("url is required");
     }
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto42.randomUUID();
+    const runId = crypto43.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -60685,7 +60771,7 @@ async function bingRoutes(app, opts) {
         discoveryDate: result.DiscoveryDate ?? null
       });
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const id = crypto42.randomUUID();
+      const id = crypto43.randomUUID();
       const httpCode = result.HttpStatus ?? result.HttpCode ?? null;
       const lastCrawledDate = parseBingDate(result.LastCrawledDate);
       const inIndexDate = parseBingDate(result.InIndexDate);
@@ -60762,7 +60848,7 @@ async function bingRoutes(app, opts) {
       throw validationError('No Bing site configured. Run "canonry bing set-site <project> <url>" first.');
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto42.randomUUID();
+    const runId = crypto43.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -61060,7 +61146,7 @@ async function cdpRoutes(app, opts) {
 }
 
 // ../api-routes/src/ga.ts
-import crypto44 from "crypto";
+import crypto45 from "crypto";
 import { eq as eq69, desc as desc34, and as and57, sql as sql27 } from "drizzle-orm";
 
 // ../api-routes/src/ga-session-history.ts
@@ -61120,14 +61206,14 @@ function findBiggestMover(current, prior) {
 }
 
 // ../api-routes/src/ga-search-landing-pages.ts
-import crypto43 from "crypto";
+import crypto44 from "crypto";
 import { and as and56, asc as asc13, count as count4, desc as desc33, eq as eq68 } from "drizzle-orm";
 function persistSearchLandingSnapshot(db, input) {
   db.transaction((tx) => {
     deleteSearchLandingRows(tx, input.projectId);
     for (const window of input.windows) {
       tx.insert(gaSearchLandingWindows).values({
-        id: crypto43.randomUUID(),
+        id: crypto44.randomUUID(),
         projectId: input.projectId,
         propertyId: input.propertyId,
         windowKey: window.window,
@@ -61149,7 +61235,7 @@ function persistSearchLandingSnapshot(db, input) {
       }).run();
       for (const row of window.rows) {
         tx.insert(gaSearchLandingPages).values({
-          id: crypto43.randomUUID(),
+          id: crypto44.randomUUID(),
           projectId: input.projectId,
           windowKey: window.window,
           landingPage: row.landingPage,
@@ -61381,7 +61467,7 @@ function persistAcquisitionMeasurement(db, input) {
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaAcquisitionDaily).values({
-        id: crypto44.randomUUID(),
+        id: crypto45.randomUUID(),
         projectId: input.projectId,
         date: row.date,
         channelGroup: row.channelGroup,
@@ -61423,7 +61509,7 @@ function persistLeadMeasurement(db, input) {
     )).run();
     for (const row of input.report.rows) {
       tx.insert(gaLeadEventsDaily).values({
-        id: crypto44.randomUUID(),
+        id: crypto45.randomUUID(),
         projectId: input.projectId,
         date: row.date,
         eventName: row.eventName,
@@ -61533,6 +61619,18 @@ function ga4ErrorToAppError(err, context) {
   }
   return providerError(`${context}: ${describeError(err)}`);
 }
+function ga4ConnectError(err, propertyId, principal, context) {
+  if (err instanceof GA4ApiError && err.status === 403) {
+    return forbidden(
+      `Google refused access to GA4 property ${propertyId} for ${principal}. Add ${principal} as a Viewer in Google Analytics (Admin > Property access management), then connect again. Retrying will not help until access is granted.`,
+      { reason: "ga4-permission-missing", propertyId, retryable: false }
+    );
+  }
+  return validationError(`${context}: ${describeError(err)}`);
+}
+function isPermissionRefusal(error) {
+  return error.details?.reason === "ga4-permission-missing";
+}
 async function resolveGa4AccessToken(opts, projectName, canonicalDomain) {
   const saConn = opts.ga4CredentialStore?.getConnection(projectName);
   if (saConn?.clientEmail && saConn?.privateKey && saConn?.propertyId) {
@@ -61583,6 +61681,25 @@ function requireGa4Connection(opts, projectName, canonicalDomain) {
   }
 }
 async function ga4Routes(app, opts) {
+  const connectPasses = createVerifyCache();
+  const connectRefusals = createRefusalBackoff();
+  async function checkGa4Access(key, verify, toError) {
+    if (!isInteractiveCaller()) {
+      if (connectPasses.get(key)) return { ok: true };
+      const replay = connectRefusals.replay(key);
+      if (replay) return { ok: false, ...replay };
+    }
+    try {
+      await verify();
+      connectPasses.set(key, true);
+      connectRefusals.cleared(key);
+      return { ok: true };
+    } catch (cause) {
+      const error = toError(cause);
+      if (isPermissionRefusal(error)) connectRefusals.refused(key, error, cause);
+      return { ok: false, error, cause };
+    }
+  }
   app.post("/projects/:name/ga/connect", connectionRoute(app, (request) => {
     const body = request.body;
     return { integration: "ga4", action: typeof body?.keyJson === "string" && body.keyJson ? "connect" : "select" };
@@ -61607,18 +61724,23 @@ async function ga4Routes(app, opts) {
       }
       const clientEmail = parsed.client_email;
       const privateKey = parsed.private_key;
-      try {
-        await verifyConnection(clientEmail, privateKey, propertyId);
-        gaLog("info", "connect.verified.service-account", { projectId: project.id, propertyId });
-      } catch (e) {
-        const msg = describeError(e);
-        gaLog("error", "connect.verify-failed", { projectId: project.id, propertyId, error: msg });
-        attempt.failed(e);
-        throw validationError(`Failed to verify GA4 credentials: ${msg}`);
+      const check3 = await checkGa4Access(
+        verifyCacheKey("ga4-service-account", project.id, propertyId, clientEmail, privateKey),
+        () => verifyConnection(clientEmail, privateKey, propertyId),
+        (err) => ga4ConnectError(err, propertyId, clientEmail, "Failed to verify GA4 credentials")
+      );
+      if (!check3.ok) {
+        gaLog("error", "connect.verify-failed", { projectId: project.id, propertyId, error: check3.error.message });
+        attempt.failed(check3.cause);
+        throw check3.error;
       }
+      gaLog("info", "connect.verified.service-account", { projectId: project.id, propertyId });
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const existing = opts.ga4CredentialStore.getConnection(project.name);
       if (existing) attempt.update({ action: "reauth" });
+      if (existing?.clientEmail === clientEmail && existing.privateKey === privateKey && existing.propertyId === propertyId) {
+        return { connected: true, propertyId, authMethod: "service-account", clientEmail };
+      }
       const previousPropertyId2 = resolveCurrentGa4PropertyId(opts, project.name, project.canonicalDomain);
       opts.ga4CredentialStore.upsertConnection({
         projectName: project.name,
@@ -61655,19 +61777,27 @@ async function ga4Routes(app, opts) {
         'No GA4 OAuth token found. Run "canonry google connect <project> --type ga4" first, or pass --key-file to use a service account.'
       );
     }
-    const accessToken = await refreshOAuthTokenIfNeeded(googleStore, authConfig, project.canonicalDomain, {
-      accessToken: oauthConn.accessToken,
-      refreshToken: oauthConn.refreshToken,
-      tokenExpiresAt: oauthConn.tokenExpiresAt
-    });
-    try {
-      await verifyConnectionWithToken(accessToken, propertyId);
-      gaLog("info", "connect.verified.oauth", { projectId: project.id, propertyId });
-    } catch (e) {
-      const msg = describeError(e);
-      gaLog("error", "connect.verify-failed.oauth", { projectId: project.id, propertyId, error: msg });
-      attempt.failed(e);
-      throw validationError(`Failed to verify GA4 access: ${msg}`);
+    const { accessToken: storedAccessToken, refreshToken } = oauthConn;
+    const check2 = await checkGa4Access(
+      verifyCacheKey("ga4-oauth", project.id, propertyId, refreshToken),
+      async () => {
+        const accessToken = await refreshOAuthTokenIfNeeded(googleStore, authConfig, project.canonicalDomain, {
+          accessToken: storedAccessToken,
+          refreshToken,
+          tokenExpiresAt: oauthConn.tokenExpiresAt
+        });
+        return verifyConnectionWithToken(accessToken, propertyId);
+      },
+      (err) => err instanceof AppError ? err : ga4ConnectError(err, propertyId, "the connected Google account", "Failed to verify GA4 access")
+    );
+    if (!check2.ok) {
+      gaLog("error", "connect.verify-failed.oauth", { projectId: project.id, propertyId, error: check2.error.message });
+      attempt.failed(check2.cause);
+      throw check2.error;
+    }
+    gaLog("info", "connect.verified.oauth", { projectId: project.id, propertyId });
+    if (oauthConn.propertyId === propertyId) {
+      return { connected: true, propertyId, authMethod: "oauth" };
     }
     const previousPropertyId = resolveCurrentGa4PropertyId(opts, project.name, project.canonicalDomain);
     const connectedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -61777,7 +61907,7 @@ async function ga4Routes(app, opts) {
     const leadDays = measurementState?.leadSyncedAt != null ? days : GA4_MAX_SYNC_DAYS;
     const leadEventNames = project.measurement.leadEventNames;
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto44.randomUUID();
+    const runId = crypto45.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -61837,7 +61967,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of rows) {
             tx.insert(gaTrafficSnapshots).values({
-              id: crypto44.randomUUID(),
+              id: crypto45.randomUUID(),
               projectId: project.id,
               date: row.date,
               landingPage: row.landingPage,
@@ -61860,7 +61990,7 @@ async function ga4Routes(app, opts) {
         ).run();
         for (const row of dailyTotals) {
           tx.insert(gaDailyTotals).values({
-            id: crypto44.randomUUID(),
+            id: crypto45.randomUUID(),
             projectId: project.id,
             date: row.date,
             sessions: row.sessions,
@@ -61886,7 +62016,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of aiReferrals) {
             tx.insert(gaAiReferrals).values({
-              id: crypto44.randomUUID(),
+              id: crypto45.randomUUID(),
               projectId: project.id,
               date: row.date,
               source: row.source,
@@ -61918,7 +62048,7 @@ async function ga4Routes(app, opts) {
           ).run();
           for (const row of socialReferrals) {
             tx.insert(gaSocialReferrals).values({
-              id: crypto44.randomUUID(),
+              id: crypto45.randomUUID(),
               projectId: project.id,
               date: row.date,
               source: row.source,
@@ -61934,7 +62064,7 @@ async function ga4Routes(app, opts) {
         if (syncSummary) {
           tx.delete(gaTrafficSummaries).where(eq69(gaTrafficSummaries.projectId, project.id)).run();
           tx.insert(gaTrafficSummaries).values({
-            id: crypto44.randomUUID(),
+            id: crypto45.randomUUID(),
             projectId: project.id,
             periodStart: summary3.periodStart,
             periodEnd: summary3.periodEnd,
@@ -61947,7 +62077,7 @@ async function ga4Routes(app, opts) {
           tx.delete(gaTrafficWindowSummaries).where(eq69(gaTrafficWindowSummaries.projectId, project.id)).run();
           for (const ws of windowSummaries) {
             tx.insert(gaTrafficWindowSummaries).values({
-              id: crypto44.randomUUID(),
+              id: crypto45.randomUUID(),
               projectId: project.id,
               windowKey: ws.windowKey,
               periodStart: ws.periodStart,
@@ -62744,7 +62874,7 @@ function parseSchemaPageEntry(entry) {
 }
 
 // ../integration-wordpress/src/wordpress-client.ts
-import crypto45 from "crypto";
+import crypto46 from "crypto";
 function validateUsername(username) {
   if (!username || typeof username !== "string" || username.trim().length === 0) {
     throw new WordpressApiError("AUTH_INVALID", "Username is required and must be a non-empty string", 400);
@@ -62964,7 +63094,7 @@ function buildSnippet(content) {
   return `${text2.slice(0, 157)}...`;
 }
 function contentHash(content) {
-  return crypto45.createHash("sha256").update(content).digest("hex");
+  return crypto46.createHash("sha256").update(content).digest("hex");
 }
 function buildAmbiguousSlugMessage(slug, pages) {
   const candidates = pages.map((page3) => {
@@ -64457,7 +64587,7 @@ async function wordpressRoutes(app, opts) {
 }
 
 // ../api-routes/src/backlinks.ts
-import crypto46 from "crypto";
+import crypto47 from "crypto";
 import { and as and61, asc as asc15, desc as desc36, eq as eq72, sql as sql29 } from "drizzle-orm";
 
 // ../integration-commoncrawl/src/constants.ts
@@ -65110,7 +65240,7 @@ async function backlinksRoutes(app, opts) {
       const refreshed = app.db.select().from(ccReleaseSyncs).where(eq72(ccReleaseSyncs.id, existing.id)).get();
       return reply.status(200).send(mapSyncRow(refreshed));
     }
-    const id = crypto46.randomUUID();
+    const id = crypto47.randomUUID();
     app.db.insert(ccReleaseSyncs).values({
       id,
       release,
@@ -65167,7 +65297,7 @@ async function backlinksRoutes(app, opts) {
       throw validationError("Invalid release id");
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const runId = crypto46.randomUUID();
+    const runId = crypto47.randomUUID();
     app.db.insert(runs).values({
       id: runId,
       projectId: project.id,
@@ -65256,7 +65386,7 @@ async function backlinksRoutes(app, opts) {
 }
 
 // ../api-routes/src/traffic.ts
-import crypto49 from "crypto";
+import crypto50 from "crypto";
 import { isIP } from "net";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { and as and65, desc as desc37, eq as eq76, gte as gte18, inArray as inArray31, lte as lte20, sql as sql32 } from "drizzle-orm";
@@ -65284,7 +65414,7 @@ function resolveVercelSyncDeadlineMs(env = process.env) {
 }
 
 // ../integration-cloud-run/src/auth.ts
-import crypto47 from "crypto";
+import crypto48 from "crypto";
 var GOOGLE_TOKEN_URL3 = "https://oauth2.googleapis.com/token";
 var CLOUD_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
 var TOKEN_REQUEST_TIMEOUT_MS = 3e4;
@@ -65315,7 +65445,7 @@ function createServiceAccountJwt2(clientEmail, privateKey, scope) {
   const headerB64 = encode(header2);
   const payloadB64 = encode(payload);
   const signingInput = `${headerB64}.${payloadB64}`;
-  const sign = crypto47.createSign("RSA-SHA256");
+  const sign = crypto48.createSign("RSA-SHA256");
   sign.update(signingInput);
   const signature = sign.sign(privateKey, "base64url");
   return `${signingInput}.${signature}`;
@@ -81924,7 +82054,7 @@ async function ackCloudflareQueueMessages(client, options) {
 }
 
 // ../api-routes/src/traffic-event-ingest.ts
-import crypto48 from "crypto";
+import crypto49 from "crypto";
 import { and as and63, eq as eq74, gte as gte17, lt as lt12, lte as lte18, sql as sql31 } from "drizzle-orm";
 
 // ../api-routes/src/raw-event-sample-retention.ts
@@ -82223,7 +82353,7 @@ function writeTrafficEventBatch(opts) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto48.randomUUID(),
+          id: crypto49.randomUUID(),
           projectId: opts.projectId,
           sourceId: opts.sourceId,
           ts: sampleTimestamp,
@@ -82324,7 +82454,7 @@ var WORDPRESS_SYNC_LEASE_TTL_MS = 5 * 6e4;
 var DEFAULT_CLOUDFLARE_INGEST_RATE_LIMIT_MAX = 6e3;
 var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
 function sha256Hex3(value) {
-  return crypto49.createHash("sha256").update(value).digest("hex");
+  return crypto50.createHash("sha256").update(value).digest("hex");
 }
 function hashCloudflareBearerToken(value) {
   return sha256Hex3(value);
@@ -82334,7 +82464,7 @@ function timingSafeEqualHex(a, b) {
   if (!SHA256_HEX_PATTERN.test(a) || !SHA256_HEX_PATTERN.test(b)) return false;
   const left = Buffer.from(a, "hex");
   const right = Buffer.from(b, "hex");
-  return left.length === right.length && crypto49.timingSafeEqual(left, right);
+  return left.length === right.length && crypto50.timingSafeEqual(left, right);
 }
 function parseDirectPushCloudflareSourceConfig(config) {
   const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
@@ -82652,7 +82782,7 @@ function bindTrafficSyncSchedule(tx, projectId, sourceId, now, createIfMissing =
   }
   if (!createIfMissing) return { changed: false, created: false };
   tx.insert(schedules).values({
-    id: crypto49.randomUUID(),
+    id: crypto50.randomUUID(),
     projectId,
     kind: SchedulableRunKinds["traffic-sync"],
     cronExpr: DEFAULT_TRAFFIC_SYNC_CRON,
@@ -82973,7 +83103,7 @@ async function runBackfillTask(options) {
           }
         })();
         tx.insert(rawEventSamples).values({
-          id: crypto49.randomUUID(),
+          id: crypto50.randomUUID(),
           projectId: project.id,
           sourceId: sourceRow2.id,
           ts: sampleTimestamp,
@@ -83164,7 +83294,7 @@ async function trafficRoutes(app, opts) {
     const fallbackName = displayName ?? `Cloud Run \xB7 ${gcpProjectId}${serviceName ? ` / ${serviceName}` : ""}`;
     const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
       const activeSource = tx.select().from(trafficSources).where(eq76(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes["cloud-run"] && row.status !== TrafficSourceStatuses.archived);
-      const sourceId = activeSource?.id ?? crypto49.randomUUID();
+      const sourceId = activeSource?.id ?? crypto50.randomUUID();
       const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
       if (activeSource) {
         tx.update(trafficSources).set({
@@ -83256,7 +83386,7 @@ async function trafficRoutes(app, opts) {
     const { sourceRow: sourceRow2, scheduleChanged } = app.db.transaction((tx) => {
       const activeSource = tx.select().from(trafficSources).where(eq76(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.wordpress && row.status !== TrafficSourceStatuses.archived);
       const endpointChanged = activeSource !== void 0 && wordpressBaseUrlIdentity(activeSource.configJson.baseUrl) !== wordpressBaseUrlIdentity(baseUrl);
-      const sourceId = endpointChanged ? crypto49.randomUUID() : activeSource?.id ?? crypto49.randomUUID();
+      const sourceId = endpointChanged ? crypto50.randomUUID() : activeSource?.id ?? crypto50.randomUUID();
       const sourceStatus = trafficConnectStatus(tx, project.id, activeSource);
       if (activeSource && !endpointChanged) {
         tx.update(trafficSources).set({
@@ -83368,7 +83498,7 @@ async function trafficRoutes(app, opts) {
         }).where(eq76(trafficSources.id, activeSource.id)).run();
         row = tx.select().from(trafficSources).where(eq76(trafficSources.id, activeSource.id)).get();
       } else {
-        const newId = crypto49.randomUUID();
+        const newId = crypto50.randomUUID();
         tx.insert(trafficSources).values({
           id: newId,
           projectId: project.id,
@@ -83438,7 +83568,7 @@ async function trafficRoutes(app, opts) {
       const cloudflareSources = app.db.select().from(trafficSources).where(eq76(trafficSources.projectId, project.id)).all().filter((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived);
       const sameModeSource = cloudflareSources.find((row) => parseQueuePullCloudflareSourceConfig(row.configJson));
       if (sameModeSource) attempt.update({ action: "reauth" });
-      const sourceId2 = sameModeSource?.id ?? crypto49.randomUUID();
+      const sourceId2 = sameModeSource?.id ?? crypto50.randomUUID();
       const previousCredential2 = credentialStore.getConnectionBySourceId(sourceId2);
       const workerVersion2 = CURRENT_CLOUDFLARE_WORKER_VERSION;
       const workerScript2 = generateWorkerScript({
@@ -83574,7 +83704,7 @@ async function trafficRoutes(app, opts) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const activeSource = app.db.select().from(trafficSources).where(eq76(trafficSources.projectId, project.id)).all().find((row) => row.sourceType === TrafficSourceTypes.cloudflare && row.status !== TrafficSourceStatuses.archived && parseDirectPushCloudflareSourceConfig(row.configJson) !== null);
     if (activeSource) attempt.update({ action: "reauth" });
-    const sourceId = activeSource?.id ?? crypto49.randomUUID();
+    const sourceId = activeSource?.id ?? crypto50.randomUUID();
     const parsedActiveConfig = activeSource ? parseDirectPushCloudflareSourceConfig(activeSource.configJson) : null;
     if (activeSource && !parsedActiveConfig) {
       throw validationError("Existing Cloudflare source is not configured for direct-push delivery");
@@ -83590,8 +83720,8 @@ async function trafficRoutes(app, opts) {
     const previousAccountId = reusableCredential?.accountId ?? parsedActiveConfig?.accountId ?? null;
     const effectiveZoneId = zoneId ?? previousZoneId;
     const effectiveAccountId = accountId ?? previousAccountId;
-    const bearerToken = reusableCredential?.bearerToken ?? `cnry_cfw_${crypto49.randomBytes(32).toString("hex")}`;
-    const hmacSecret = reusableCredential?.hmacSecret ?? crypto49.randomBytes(32).toString("hex");
+    const bearerToken = reusableCredential?.bearerToken ?? `cnry_cfw_${crypto50.randomBytes(32).toString("hex")}`;
+    const hmacSecret = reusableCredential?.hmacSecret ?? crypto50.randomBytes(32).toString("hex");
     const ingestTokenHash = sha256Hex3(bearerToken);
     const ingestUrl = opts.cloudflareTrafficIngestUrl.replace("{name}", encodeURIComponent(project.name));
     assertCloudflareIngestUrlIsPublicHttps(ingestUrl);
@@ -83937,7 +84067,7 @@ async function trafficRoutes(app, opts) {
         apiToken: credential.apiToken
       };
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const leaseOwner = crypto49.randomUUID();
+      const leaseOwner = crypto50.randomUUID();
       if (!tryClaimTrafficSyncLease({
         db: app.db,
         sourceId: sourceRow2.id,
@@ -83947,7 +84077,7 @@ async function trafficRoutes(app, opts) {
       })) {
         throw operationInProgress("Cloudflare Queue source sync is already in progress", { sourceId: sourceRow2.id });
       }
-      const runId = crypto49.randomUUID();
+      const runId = crypto50.randomUUID();
       const startedAt = (/* @__PURE__ */ new Date()).toISOString();
       const startedMs = Date.now();
       try {
@@ -84187,7 +84317,7 @@ async function trafficRoutes(app, opts) {
     if (sourceRow2.status === TrafficSourceStatuses.paused || sourceRow2.status === TrafficSourceStatuses.archived || hasConnectedSibling) {
       throw validationError("Traffic source must be active before it can sync");
     }
-    const wordpressLeaseOwner = sourceRow2.sourceType === TrafficSourceTypes.wordpress ? crypto49.randomUUID() : void 0;
+    const wordpressLeaseOwner = sourceRow2.sourceType === TrafficSourceTypes.wordpress ? crypto50.randomUUID() : void 0;
     if (wordpressLeaseOwner && !tryClaimTrafficSyncLease({
       db: app.db,
       sourceId: sourceRow2.id,
@@ -84202,7 +84332,7 @@ async function trafficRoutes(app, opts) {
       let windowEnd = syncWindowEnd;
       const startedAt = syncWindowEnd.toISOString();
       const syncStartedAtMs = syncWindowEnd.getTime();
-      const runId = crypto49.randomUUID();
+      const runId = crypto50.randomUUID();
       app.db.insert(runs).values({
         id: runId,
         projectId: project.id,
@@ -84751,7 +84881,7 @@ async function trafficRoutes(app, opts) {
             }
           })();
           tx.insert(rawEventSamples).values({
-            id: crypto49.randomUUID(),
+            id: crypto50.randomUUID(),
             projectId: project.id,
             sourceId: sourceRow2.id,
             ts: sampleTimestamp,
@@ -84983,7 +85113,7 @@ async function trafficRoutes(app, opts) {
       };
     }
     const startedAt = windowEnd.toISOString();
-    const runId = crypto49.randomUUID();
+    const runId = crypto50.randomUUID();
     app.db.transaction((tx) => {
       const latestSource = tx.select().from(trafficSources).where(eq76(trafficSources.id, sourceRow2.id)).get();
       if (!latestSource || !isAuthoritativeTrafficSource(tx, latestSource) || !isSameTrafficSourceGeneration(latestSource, sourceRow2)) {
@@ -85864,7 +85994,7 @@ var REFERRAL_ASSESSMENT_CHECKS = [{
 }];
 
 // ../api-routes/src/doctor/checks/agent.ts
-import crypto50 from "crypto";
+import crypto51 from "crypto";
 import fs6 from "fs";
 import path7 from "path";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -86098,7 +86228,7 @@ function isInstalled(dir) {
 }
 function hashInstalledFile(filePath) {
   try {
-    return crypto50.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
+    return crypto51.createHash("sha256").update(fs6.readFileSync(filePath)).digest("hex");
   } catch {
     return void 0;
   }
@@ -89981,7 +90111,7 @@ async function statusRoutes(app, opts) {
 }
 
 // ../api-routes/src/discovery/routes.ts
-import crypto51 from "crypto";
+import crypto52 from "crypto";
 import { and as and76, desc as desc42, eq as eq92, gte as gte23, inArray as inArray37, isNull as isNull17, or as or21 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
@@ -90047,8 +90177,8 @@ async function discoveryRoutes(app, opts) {
       if (existing && existing.runId) {
         return { reused: true, sessionId: existing.id, runId: existing.runId };
       }
-      const sessionId = crypto51.randomUUID();
-      const runId = crypto51.randomUUID();
+      const sessionId = crypto52.randomUUID();
+      const runId = crypto52.randomUUID();
       tx.insert(discoverySessions).values({
         id: sessionId,
         projectId: project.id,
@@ -90303,7 +90433,7 @@ async function discoveryRoutes(app, opts) {
         const marketNames = beginMarketNameWrite(tx, project.id);
         for (const query of promotedQueries) {
           tx.insert(queries).values({
-            id: crypto51.randomUUID(),
+            id: crypto52.randomUUID(),
             projectId: project.id,
             query,
             provenance,
@@ -90484,7 +90614,7 @@ function planCompetitorPromotion(input) {
 }
 
 // ../api-routes/src/discovery/orchestrate.ts
-import crypto52 from "crypto";
+import crypto53 from "crypto";
 import { eq as eq93 } from "drizzle-orm";
 var DEFAULT_MAX_PROBES = 100;
 var ABSOLUTE_MAX_PROBES = 500;
@@ -90650,7 +90780,7 @@ async function executeDiscovery(opts) {
     probeRows.push({ citedDomains: probe.citedDomains, bucket });
     buckets[bucket]++;
     return {
-      id: crypto52.randomUUID(),
+      id: crypto53.randomUUID(),
       sessionId: opts.sessionId,
       projectId: opts.project.id,
       query: probedCanonicals[index2],
@@ -90702,7 +90832,7 @@ function upsertDomainClassifications(db, projectId, sessionId, competitorMap) {
     const domain = hostOf(entry.domain) ?? "";
     if (!domain) continue;
     db.insert(domainClassifications).values({
-      id: crypto52.randomUUID(),
+      id: crypto53.randomUUID(),
       projectId,
       domain,
       competitorType: entry.competitorType,
@@ -90742,7 +90872,7 @@ function dedupeStrings(input) {
 }
 
 // ../api-routes/src/technical-aeo.ts
-import crypto53 from "crypto";
+import crypto54 from "crypto";
 import { and as and78, asc as asc18, count as count7, desc as desc43, eq as eq95, gte as gte24, inArray as inArray38, isNotNull as isNotNull9, isNull as isNull18, lt as lt13, or as or22, sql as sql35 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 
@@ -92735,7 +92865,7 @@ async function technicalAeoRoutes(app, opts) {
     const healthState = parseSiteHealthState(request.query.healthState);
     const limit = parseBoundedLimit(request.query.limit, 100, 200);
     const sort = ["score-desc", "score-asc", "path"].includes(request.query.sort ?? "") ? request.query.sort : "url";
-    const selectionKey = crypto53.createHash("sha256").update(JSON.stringify({
+    const selectionKey = crypto54.createHash("sha256").update(JSON.stringify({
       projectId: project.id,
       runId: snapshot.runId,
       attemptId: snapshot.attemptId,
@@ -93235,7 +93365,7 @@ async function technicalAeoRoutes(app, opts) {
         );
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const runId = crypto53.randomUUID();
+      const runId = crypto54.randomUUID();
       tx.insert(runs).values({
         id: runId,
         projectId: project.id,
@@ -93272,7 +93402,7 @@ async function technicalAeoRoutes(app, opts) {
 }
 
 // ../api-routes/src/research.ts
-import crypto54 from "crypto";
+import crypto55 from "crypto";
 import { z as z5 } from "zod";
 import { and as and79, count as count8, desc as desc44, eq as eq96, gte as gte25, lt as lt14, or as or23, sql as sql36 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
@@ -93342,9 +93472,9 @@ async function researchRoutes(app, opts) {
           throw researchDailyLimitExceeded(project.name, viewerDailyRunLimit, date);
         }
       }
-      const id = crypto54.randomUUID();
+      const id = crypto55.randomUUID();
       tx.insert(researchRuns).values({ id, projectId: project.id, status: ResearchRunStatuses.queued, provider: providerName, requestedModel: requestedModel2, resolvedModel, location: location ?? null, totalQueries: input.queries.length, scope, template, idempotencyKey: input.idempotencyKey ?? null, requestHash: input.idempotencyKey ? requestHash2 : null, initiatedBy, createdAt: now }).run();
-      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto54.randomUUID(), researchRunId: id, position, queryText: query, queryClass: queryClasses[position] ?? null, status: ResearchQueryStatuses.queued, requestedModel: requestedModel2, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
+      for (const [position, query] of input.queries.entries()) tx.insert(researchRunQueries).values({ id: crypto55.randomUUID(), researchRunId: id, position, queryText: query, queryClass: queryClasses[position] ?? null, status: ResearchQueryStatuses.queued, requestedModel: requestedModel2, resolvedModel, groundingSources: [], citedDomains: [], searchQueries: [], createdAt: now }).run();
       writeAuditLog(tx, { projectId: project.id, actor: "api", action: "research.created", entityType: "research_run", entityId: id });
       return { reused: false, id, shouldDispatch: true };
     });
@@ -93397,7 +93527,7 @@ async function researchRoutes(app, opts) {
       }
       const ids = [];
       for (const [index2, run] of prepared.entries()) {
-        const id = crypto54.randomUUID();
+        const id = crypto55.randomUUID();
         ids.push(id);
         tx.insert(researchRuns).values({
           id,
@@ -93416,7 +93546,7 @@ async function researchRoutes(app, opts) {
           createdAt: now
         }).run();
         for (const [position, query] of run.input.queries.entries()) tx.insert(researchRunQueries).values({
-          id: crypto54.randomUUID(),
+          id: crypto55.randomUUID(),
           researchRunId: id,
           position,
           queryText: query,
@@ -93475,7 +93605,7 @@ async function researchRoutes(app, opts) {
 var DIRECT_REQUEST_HASH_VERSION = "direct-v2:";
 function directResearchRequestHash(input) {
   const { idempotencyKey: _key, ...request } = input;
-  return DIRECT_REQUEST_HASH_VERSION + crypto54.createHash("sha256").update(JSON.stringify(request)).digest("hex");
+  return DIRECT_REQUEST_HASH_VERSION + crypto55.createHash("sha256").update(JSON.stringify(request)).digest("hex");
 }
 function assertSameDirectResearchRequest(existing, input, hash2) {
   if (existing.requestHash?.startsWith(DIRECT_REQUEST_HASH_VERSION)) {
@@ -93493,7 +93623,7 @@ function assertSameDirectResearchRequest(existing, input, hash2) {
     ...scope ? { scope } : {},
     ...template ? { template } : {}
   };
-  if (crypto54.createHash("sha256").update(JSON.stringify(normalized)).digest("hex") !== existing.requestHash) throw alreadyExists("Research idempotency key", input.idempotencyKey);
+  if (crypto55.createHash("sha256").update(JSON.stringify(normalized)).digest("hex") !== existing.requestHash) throw alreadyExists("Research idempotency key", input.idempotencyKey);
 }
 var researchCursorSchema = z5.object({ projectId: z5.string().min(1), createdAt: z5.string().datetime({ offset: true }), id: z5.string().min(1).max(256) }).strict();
 function parseResearchCursor(value, projectId) {
@@ -93513,11 +93643,11 @@ function resolveStoredResearchScope(stored, selection, idempotencyKey) {
   return stored;
 }
 function batchChildReceiptKey(rootKey, index2) {
-  const derived = crypto54.createHash("sha256").update(`${rootKey}\0${index2}`).digest("hex");
+  const derived = crypto55.createHash("sha256").update(`${rootKey}\0${index2}`).digest("hex");
   return `${BATCH_RECEIPT_PREFIX}${derived}:${index2}`;
 }
 function researchBatchRequestHash(input) {
-  return crypto54.createHash("sha256").update(JSON.stringify({ runs: input.runs })).digest("hex");
+  return crypto55.createHash("sha256").update(JSON.stringify({ runs: input.runs })).digest("hex");
 }
 function prepareBatchRun(app, opts, project, active, input) {
   const adapters = opts.providerAdapters ?? [];
@@ -93789,7 +93919,7 @@ function readStoredGroundingSources(rawResponse) {
 }
 
 // ../api-routes/src/simple-measurement-definitions.ts
-import crypto55 from "crypto";
+import crypto56 from "crypto";
 import { and as and81, eq as eq98 } from "drizzle-orm";
 function captureSimpleMeasurementDefinition(db, input) {
   return db.transaction((tx) => {
@@ -93831,11 +93961,11 @@ function captureSimpleMeasurementDefinition(db, input) {
           ...frozen.identity.qualifiedAliases?.length ? { qualifiedAliases: frozen.identity.qualifiedAliases } : {}
         }
       };
-      const replayChecksum = crypto55.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(replayDefinition)).digest("hex");
+      const replayChecksum = crypto56.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(replayDefinition)).digest("hex");
       if (existing.checksum !== replayChecksum) {
         if (frozen.competitors === void 0) {
           const { competitors: _currentCompetitors, ...legacyReplayDefinition } = replayDefinition;
-          const legacyReplayChecksum = crypto55.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(legacyReplayDefinition)).digest("hex");
+          const legacyReplayChecksum = crypto56.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(legacyReplayDefinition)).digest("hex");
           if (existing.checksum === legacyReplayChecksum) return frozen;
         }
         throw validationError("This run already has a captured measurement definition. Start a new run for changed inputs.");
@@ -93859,7 +93989,7 @@ function captureSimpleMeasurementDefinition(db, input) {
         throw validationError("Captured competitors must exactly match the project competitors dispatched for this run.");
       }
     }
-    const checksum = crypto55.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(definition2)).digest("hex");
+    const checksum = crypto56.createHash("sha256").update(canonicalSimpleMeasurementDefinitionJson(definition2)).digest("hex");
     tx.insert(simpleMeasurementDefinitions).values({
       projectId: input.projectId,
       runId: input.runId,
@@ -94474,7 +94604,7 @@ function buildTrafficSourceValidators(opts) {
 }
 
 // src/intelligence-service.ts
-import crypto56 from "crypto";
+import crypto57 from "crypto";
 
 // ../api-routes/src/runtime-logger.ts
 import { format } from "util";
@@ -95276,7 +95406,7 @@ var IntelligenceService = class {
         }).run();
       }
       tx.insert(healthSnapshots).values({
-        id: crypto56.randomUUID(),
+        id: crypto57.randomUUID(),
         projectId,
         runId,
         overallCitedRate: String(result.health.overallCitedRate),