@canonry/canonry 7.58.3 → 7.58.5

package/dist/{chunk-NWQQYLZV.js → chunk-QEJBAPDP.js}

@@ -59714,7 +59714,7 @@ async function backlinksRoutes(app, opts) {
 import crypto51 from "crypto";
 import { isIP } from "net";
 import { isDeepStrictEqual } from "util";
-import { and as and68, desc as desc38, eq as eq79, gte as gte18, inArray as inArray33, lte as lte19, sql as sql29 } from "drizzle-orm";
+import { and as and68, desc as desc38, eq as eq79, gt as gt6, gte as gte18, inArray as inArray33, lt as lt12, lte as lte19, sql as sql29 } from "drizzle-orm";
 
 // ../api-routes/src/cloudflare-worker-version.ts
 var CURRENT_CLOUDFLARE_WORKER_VERSION = "1.0.1";
@@ -59723,8 +59723,9 @@ var CURRENT_CLOUDFLARE_WORKER_VERSION = "1.0.1";
 var VERCEL_MAX_SYNC_WINDOW_MS = 24 * 60 * 6e4;
 var DEFAULT_VERCEL_SYNC_DEADLINE_MS = 4 * 6e4;
 var CLOUDFLARE_QUEUE_BATCH_SIZE = 100;
-var DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES = 10;
-var DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET = CLOUDFLARE_QUEUE_BATCH_SIZE * DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES;
+var DEFAULT_CLOUDFLARE_QUEUE_SYNC_DEADLINE_MS = 4 * 6e4;
+var DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES = 300;
+var CLOUDFLARE_QUEUE_RESIDUAL_WARN_COUNT = 1e3;
 var MIN_VERCEL_SYNC_DEADLINE_MS = 3e4;
 var MAX_VERCEL_SYNC_DEADLINE_MS = 15 * 6e4;
 var TRAFFIC_SOURCE_MAX_CATCHUP_MS = {
@@ -59737,6 +59738,13 @@ function resolveVercelSyncDeadlineMs(env = process.env) {
   if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
   return Math.min(MAX_VERCEL_SYNC_DEADLINE_MS, Math.max(MIN_VERCEL_SYNC_DEADLINE_MS, Math.trunc(parsed)));
 }
+function resolveCloudflareQueueSyncDeadlineMs(env = process.env) {
+  const raw = env.CANONRY_CLOUDFLARE_QUEUE_SYNC_DEADLINE_MS;
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+  return Math.min(MAX_VERCEL_SYNC_DEADLINE_MS, Math.max(MIN_VERCEL_SYNC_DEADLINE_MS, Math.trunc(parsed)));
+}
 
 // ../integration-cloud-run/src/auth.ts
 import crypto49 from "crypto";
@@ -60723,8 +60731,11 @@ function resolveOptions(options) {
     sleep: options.sleep
   };
 }
+function queueUrl(options) {
+  return `${options.apiBaseUrl}/accounts/${encodeURIComponent(options.accountId)}/queues/${encodeURIComponent(options.queueId)}`;
+}
 function queueMessagesUrl(options, action) {
-  return `${options.apiBaseUrl}/accounts/${encodeURIComponent(options.accountId)}/queues/${encodeURIComponent(options.queueId)}/messages/${action}`;
+  return `${queueUrl(options)}/messages/${action}`;
 }
 function requestSignal(timeoutMs, signal) {
   const timeout = AbortSignal.timeout(timeoutMs);
@@ -60768,16 +60779,20 @@ async function withQueueRetry(attempt, options) {
   throw lastError;
 }
 async function postJson(options, action, body, signal) {
+  return requestJson(options, { method: "POST", url: queueMessagesUrl(options, action), label: action, body }, signal);
+}
+async function requestJson(options, request, signal) {
+  const { label: action } = request;
   return withQueueRetry(async () => {
     let response;
     try {
-      response = await options.fetchImpl(queueMessagesUrl(options, action), {
-        method: "POST",
+      response = await options.fetchImpl(request.url, {
+        method: request.method,
         headers: {
           Authorization: `Bearer ${options.apiToken}`,
-          "Content-Type": "application/json"
+          ...request.body ? { "Content-Type": "application/json" } : {}
         },
-        body: JSON.stringify(body),
+        ...request.body ? { body: JSON.stringify(request.body) } : {},
         signal: requestSignal(options.timeoutMs, signal)
       });
     } catch (error) {
@@ -60795,7 +60810,10 @@ async function postJson(options, action, body, signal) {
     }
     try {
       return await response.json();
-    } catch {
+    } catch (error) {
+      if (isAbortError(error)) {
+        throw new CloudflareQueueApiError("Cloudflare Queue request timed out or was aborted", 408);
+      }
       throw new CloudflareQueueApiError(`Cloudflare Queue ${action} returned invalid JSON`, 502);
     }
   }, {
@@ -60996,6 +61014,19 @@ function normalizeRetries(retries) {
     return { leaseId, ...retry.delaySeconds === void 0 ? {} : { delaySeconds: retry.delaySeconds } };
   });
 }
+var CLOUDFLARE_QUEUE_MAX_RETENTION_SECONDS = 14 * 24 * 60 * 60;
+var MIN_RETENTION_SECONDS = 60;
+var SANITY_MAX_RETENTION_SECONDS = 10 * 365 * 24 * 60 * 60;
+function recordOrNull(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+async function getCloudflareQueueRetentionSeconds(client, signal) {
+  const resolved = resolveOptions(client);
+  const envelope = recordOrNull(await requestJson(resolved, { method: "GET", url: queueUrl(resolved), label: "read" }, signal));
+  if (envelope?.success !== true) return null;
+  const seconds = recordOrNull(recordOrNull(envelope.result)?.settings)?.message_retention_period;
+  return typeof seconds === "number" && Number.isInteger(seconds) && seconds >= MIN_RETENTION_SECONDS && seconds <= SANITY_MAX_RETENTION_SECONDS ? seconds : null;
+}
 async function pullCloudflareQueueMessages(client, options = {}) {
   const resolved = resolveOptions(client);
   const body = {};
@@ -61421,7 +61452,10 @@ var MAX_BACKFILL_DAYS = 90;
 var BACKFILL_MAX_PAGES = 1e3;
 var BACKFILL_SAMPLE_LIMIT = 500;
 var CLOUDFLARE_INGEST_BODY_LIMIT = 256 * 1024;
-var CLOUDFLARE_QUEUE_RECEIPT_TTL_MS = 14 * 24 * 60 * 6e4 + 10 * 6e4;
+var CLOUDFLARE_QUEUE_RECEIPT_REPLAY_MARGIN_MS = 10 * 6e4;
+var CLOUDFLARE_QUEUE_RECEIPT_TTL_MS = CLOUDFLARE_QUEUE_MAX_RETENTION_SECONDS * 1e3 + CLOUDFLARE_QUEUE_RECEIPT_REPLAY_MARGIN_MS;
+var DAY_MS2 = 24 * 60 * 6e4;
+var CLOUDFLARE_QUEUE_RETENTION_READ_TIMEOUT_MS = 1e4;
 var CLOUDFLARE_QUEUE_VISIBILITY_TIMEOUT_MS = 5 * 6e4;
 var CLOUDFLARE_QUEUE_SYNC_LEASE_TTL_MS = 5 * 6e4;
 var WORDPRESS_SYNC_LEASE_TTL_MS = 5 * 6e4;
@@ -61440,6 +61474,35 @@ function timingSafeEqualHex(a, b) {
   const right = Buffer.from(b, "hex");
   return left.length === right.length && crypto51.timingSafeEqual(left, right);
 }
+async function loadQueueReceiptPolicy(db, sourceId, readRetentionSeconds, warn2) {
+  let liveTtlMs = null;
+  try {
+    const seconds = await readRetentionSeconds();
+    if (seconds === null) {
+      warn2({}, "Cloudflare reported no usable Queue retention; keeping dedupe receipts for the maximum retention");
+    } else {
+      liveTtlMs = seconds * 1e3 + CLOUDFLARE_QUEUE_RECEIPT_REPLAY_MARGIN_MS;
+    }
+  } catch (error) {
+    warn2(
+      error instanceof CloudflareQueueApiError ? { status: error.status, error: error.message } : { error: "unexpected error" },
+      "Could not read Cloudflare Queue retention; keeping dedupe receipts for the maximum retention"
+    );
+  }
+  if (liveTtlMs === null) return { ttlMsAt: () => CLOUDFLARE_QUEUE_RECEIPT_TTL_MS };
+  const ttlMs = liveTtlMs;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const alive = and68(eq79(trafficEventReceipts.sourceId, sourceId), gt6(trafficEventReceipts.expiresAt, now));
+  const lifetimeMs = sql29`(julianday(${trafficEventReceipts.expiresAt}) - julianday(${trafficEventReceipts.receivedAt})) * ${DAY_MS2}`;
+  const shortest = db.select({ ms: sql29`min(${lifetimeMs})` }).from(trafficEventReceipts).where(alive).get()?.ms ?? null;
+  if (shortest !== null && shortest < ttlMs - 1e3) {
+    const extended = sql29`strftime('%Y-%m-%dT%H:%M:%fZ', julianday(${trafficEventReceipts.receivedAt}) + ${ttlMs / DAY_MS2})`;
+    db.update(trafficEventReceipts).set({ expiresAt: extended }).where(and68(alive, lt12(trafficEventReceipts.expiresAt, extended))).run();
+  }
+  const floorExpiry = db.select({ at: sql29`max(${trafficEventReceipts.expiresAt})` }).from(trafficEventReceipts).where(and68(alive, sql29`${lifetimeMs} < ${CLOUDFLARE_QUEUE_RECEIPT_TTL_MS - 1e3}`)).get()?.at ?? null;
+  const floorMs = floorExpiry ? Date.parse(floorExpiry) : 0;
+  return { ttlMsAt: (receivedAt) => Math.max(ttlMs, floorMs - Date.parse(receivedAt)) };
+}
 function parseDirectPushCloudflareSourceConfig(config) {
   const parsed = cloudflareTrafficSourceConfigSchema.safeParse(config);
   return parsed.success && parsed.data.deliveryMode === CloudflareTrafficDeliveryModes["direct-push"] ? parsed.data : null;
@@ -62139,9 +62202,11 @@ async function trafficRoutes(app, opts) {
   const pullVercelEvents = opts.pullVercelTrafficEvents ?? listVercelTrafficEvents;
   const pullQueueMessages = opts.pullCloudflareQueueMessages ?? pullCloudflareQueueMessages;
   const ackQueueMessages = opts.ackCloudflareQueueMessages ?? ackCloudflareQueueMessages;
+  const readQueueRetentionSeconds = opts.getCloudflareQueueRetentionSeconds ?? getCloudflareQueueRetentionSeconds;
   const cloudflareQueueMaxBatches = opts.cloudflareQueueMaxBatches ?? DEFAULT_CLOUDFLARE_QUEUE_MAX_BATCHES;
-  if (!Number.isInteger(cloudflareQueueMaxBatches) || cloudflareQueueMaxBatches < 1 || cloudflareQueueMaxBatches > 50) {
-    throw new RangeError("cloudflareQueueMaxBatches must be an integer from 1 to 50");
+  const cloudflareQueueSyncDeadlineMs = opts.cloudflareQueueSyncDeadlineMs ?? DEFAULT_CLOUDFLARE_QUEUE_SYNC_DEADLINE_MS;
+  if (!Number.isInteger(cloudflareQueueMaxBatches) || cloudflareQueueMaxBatches < 1 || cloudflareQueueMaxBatches > 1e3) {
+    throw new RangeError("cloudflareQueueMaxBatches must be an integer from 1 to 1000");
   }
   const allowLoopback = opts.allowLoopbackWebhooks === true;
   let rawSampleRetentionTimer;
@@ -63054,6 +63119,61 @@ async function trafficRoutes(app, opts) {
       const runId = crypto51.randomUUID();
       const startedAt = (/* @__PURE__ */ new Date()).toISOString();
       const startedMs = Date.now();
+      let acceptedEvents = 0;
+      let selfTrafficExcluded = 0;
+      let crawlerHits = 0;
+      let aiUserFetchHits = 0;
+      let aiReferralHits = 0;
+      let unknownHits = 0;
+      let crawlerBucketRows = 0;
+      let aiUserFetchBucketRows = 0;
+      let aiReferralBucketRows = 0;
+      let sampleRows = 0;
+      let committedAt = startedAt;
+      let remainingBacklogCount = 0;
+      let completedBatches = 0;
+      const finishSync = (status, error) => {
+        app.db.update(runs).set({ status, finishedAt: committedAt, ...error ? { error } : {} }).where(eq79(runs.id, runId)).run();
+        writeAuditLog(app.db, {
+          projectId: project.id,
+          actor: "api",
+          action: "traffic.cloudflare.queue-synced",
+          entityType: "traffic_source",
+          entityId: sourceRow2.id
+        });
+        try {
+          opts.onTrafficSynced?.({
+            status: "completed",
+            sourceType: sourceRow2.sourceType,
+            sourceId: sourceRow2.id,
+            pulledEvents: acceptedEvents,
+            selfTrafficExcluded,
+            crawlerHits,
+            aiUserFetchHits,
+            aiReferralHits,
+            durationMs: Date.now() - startedMs
+          });
+        } catch {
+        }
+        return {
+          sourceId: sourceRow2.id,
+          runId,
+          syncedAt: committedAt,
+          pulledEvents: acceptedEvents,
+          selfTrafficExcluded,
+          crawlerHits,
+          aiUserFetchHits,
+          aiReferralHits,
+          unknownHits,
+          crawlerBucketRows,
+          aiUserFetchBucketRows,
+          aiReferralBucketRows,
+          sampleRows,
+          remainingBacklogCount,
+          windowStart: startedAt,
+          windowEnd: committedAt
+        };
+      };
       try {
         app.db.insert(runs).values({
           id: runId,
@@ -63065,20 +63185,17 @@ async function trafficRoutes(app, opts) {
           startedAt,
           createdAt: startedAt
         }).run();
-        let acceptedEvents = 0;
-        let selfTrafficExcluded = 0;
-        let crawlerHits = 0;
-        let aiUserFetchHits = 0;
-        let aiReferralHits = 0;
-        let unknownHits = 0;
-        let crawlerBucketRows = 0;
-        let aiUserFetchBucketRows = 0;
-        let aiReferralBucketRows = 0;
-        let sampleRows = 0;
-        let committedAt = startedAt;
-        let remainingBacklogCount = 0;
         const canonicalHost = resolveCloudflareWorkerRouteHost(project.canonicalDomain);
-        for (let batch = 0; batch < cloudflareQueueMaxBatches; batch += 1) {
+        const drainDeadlineMs = startedMs + cloudflareQueueSyncDeadlineMs;
+        let consecutiveEmptyPulls = 0;
+        let receiptPolicy = null;
+        const resolveReceiptPolicy = () => receiptPolicy ??= loadQueueReceiptPolicy(
+          app.db,
+          sourceRow2.id,
+          () => readQueueRetentionSeconds({ ...queueClient, maxRetries: 0, timeoutMs: CLOUDFLARE_QUEUE_RETENTION_READ_TIMEOUT_MS }),
+          (fields, message) => request.log.warn({ sourceId: sourceRow2.id, ...fields }, message)
+        );
+        for (let batch = 0; batch < cloudflareQueueMaxBatches && (batch === 0 || Date.now() < drainDeadlineMs); batch += 1) {
           if (!tryClaimTrafficSyncLease({
             db: app.db,
             sourceId: sourceRow2.id,
@@ -63144,6 +63261,7 @@ async function trafficRoutes(app, opts) {
             }
             validLeases.push(message.leaseId);
           }
+          const policy = normalized.length > 0 ? await resolveReceiptPolicy() : null;
           committedAt = (/* @__PURE__ */ new Date()).toISOString();
           const writeResult = writeTrafficEventBatch({
             db: app.db,
@@ -63151,7 +63269,7 @@ async function trafficRoutes(app, opts) {
             sourceId: sourceRow2.id,
             events: normalized,
             receivedAt: committedAt,
-            receiptTtlMs: CLOUDFLARE_QUEUE_RECEIPT_TTL_MS,
+            receiptTtlMs: policy ? policy.ttlMsAt(committedAt) : CLOUDFLARE_QUEUE_RECEIPT_TTL_MS,
             sampleLimit,
             validateSource: (latest) => {
               if (!latest || latest.projectId !== project.id || latest.status !== TrafficSourceStatuses.connected || latest.syncLeaseOwner !== leaseOwner || !isDeepStrictEqual(latest.configJson, sourceRow2.configJson)) {
@@ -63198,53 +63316,27 @@ async function trafficRoutes(app, opts) {
           aiUserFetchBucketRows += writeResult.aiUserFetchBucketRows;
           aiReferralBucketRows += writeResult.aiReferralBucketRows;
           sampleRows += writeResult.sampleRows;
-          const pulledEnvelopeCount = pulled.messages.length + pulled.skippedUnleasedMessageCount;
-          if (pulledEnvelopeCount < CLOUDFLARE_QUEUE_BATCH_SIZE || remainingBacklogCount === 0) break;
-        }
-        app.db.update(runs).set({ status: RunStatuses.completed, finishedAt: committedAt }).where(eq79(runs.id, runId)).run();
-        writeAuditLog(app.db, {
-          projectId: project.id,
-          actor: "api",
-          action: "traffic.cloudflare.queue-synced",
-          entityType: "traffic_source",
-          entityId: sourceRow2.id
-        });
-        try {
-          opts.onTrafficSynced?.({
-            status: "completed",
-            sourceType: sourceRow2.sourceType,
-            sourceId: sourceRow2.id,
-            pulledEvents: acceptedEvents,
-            selfTrafficExcluded,
-            crawlerHits,
-            aiUserFetchHits,
-            aiReferralHits,
-            durationMs: Date.now() - startedMs
-          });
-        } catch {
+          completedBatches += 1;
+          if (remainingBacklogCount === 0) break;
+          if (pulled.messages.length === 0) {
+            if (pulled.skippedUnleasedMessageCount > 0 && pulled.skippedUnleasedMessageCount < CLOUDFLARE_QUEUE_BATCH_SIZE) break;
+            consecutiveEmptyPulls = pulled.skippedUnleasedMessageCount === 0 ? consecutiveEmptyPulls + 1 : 0;
+            if (consecutiveEmptyPulls >= 2) break;
+          } else {
+            consecutiveEmptyPulls = 0;
+          }
         }
-        const response = {
-          sourceId: sourceRow2.id,
-          runId,
-          syncedAt: committedAt,
-          pulledEvents: acceptedEvents,
-          selfTrafficExcluded,
-          crawlerHits,
-          aiUserFetchHits,
-          aiReferralHits,
-          unknownHits,
-          crawlerBucketRows,
-          aiUserFetchBucketRows,
-          aiReferralBucketRows,
-          sampleRows,
-          remainingBacklogCount,
-          windowStart: startedAt,
-          windowEnd: committedAt
-        };
-        return response;
+        return finishSync(RunStatuses.completed, null);
       } catch (error) {
         const failedAt = (/* @__PURE__ */ new Date()).toISOString();
         const safeError = error instanceof CloudflareQueueApiError ? error.message : "Cloudflare Queue sync failed; retry the active source.";
+        if (completedBatches > 0) {
+          request.log.warn(
+            { sourceId: sourceRow2.id, completedBatches, error: safeError },
+            "Cloudflare Queue sync stopped after saving some batches"
+          );
+          return finishSync(RunStatuses.partial, safeError);
+        }
         try {
           opts.onTrafficSynced?.({
             status: "failed",
@@ -65907,7 +65999,7 @@ var GSC_DATA_STALE_DAYS = 7;
 var SYNC_IDLE_DAYS = 3;
 var NOT_SYNCING_URGENT_DAYS = 8;
 var GSC_REPORTING_TIME_ZONE2 = "America/Los_Angeles";
-var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var DAY_MS3 = 24 * 60 * 60 * 1e3;
 var ISO_DATE = /^(\d{4})-(\d{2})-(\d{2})$/;
 function utcFromIsoDate(date) {
   const match = ISO_DATE.exec(date);
@@ -65918,7 +66010,7 @@ function daysBetweenIsoDates(from, to) {
   const start = utcFromIsoDate(from);
   const end = utcFromIsoDate(to);
   if (start === null || end === null) return null;
-  return Math.floor((end - start) / DAY_MS2);
+  return Math.floor((end - start) / DAY_MS3);
 }
 function daysSinceDate(date, now = /* @__PURE__ */ new Date(), timeZone) {
   const today = timeZone ? formatIsoDateInTimeZone(now.toISOString(), timeZone) : `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}-${String(now.getUTCDate()).padStart(2, "0")}`;
@@ -65930,7 +66022,7 @@ function skipped(code, summary3) {
 function lastSyncAgeDays(ctx, kinds) {
   const row = ctx.db.select({ createdAt: runs.createdAt }).from(runs).where(and73(eq87(runs.projectId, ctx.project.id), inArray36(runs.kind, kinds), eq87(runs.status, "completed"))).orderBy(desc40(runs.createdAt)).limit(1).get();
   if (!row?.createdAt) return null;
-  const age = Math.floor((Date.now() - Date.parse(row.createdAt)) / DAY_MS2);
+  const age = Math.floor((Date.now() - Date.parse(row.createdAt)) / DAY_MS3);
   return Number.isFinite(age) ? age : null;
 }
 function grade(ctx, spec, newestDate) {
@@ -66423,7 +66515,7 @@ async function probeApiHost(host, options = {}) {
 }
 
 // ../api-routes/src/doctor/checks/integration-sync.ts
-import { and as and74, count as count6, desc as desc41, eq as eq88, gte as gte21, gt as gt6, inArray as inArray37, isNull as isNull14, notInArray as notInArray3, or as or19 } from "drizzle-orm";
+import { and as and74, count as count6, desc as desc41, eq as eq88, gte as gte21, gt as gt7, inArray as inArray37, isNull as isNull14, notInArray as notInArray3, or as or19 } from "drizzle-orm";
 var SYNC_FAILURE_WINDOW = 3;
 var SUMMARY_ERROR_LIMIT = 300;
 var FINISHED_STATUSES = [RunStatuses.completed, RunStatuses.partial, RunStatuses.failed];
@@ -66518,7 +66610,7 @@ function readSyncRunState(db, projectId, kind, options = {}) {
   const graded = options.since ? and74(scope, gte21(runs.createdAt, options.since)) : scope;
   const recent = db.select({ id: runs.id, status: runs.status, trigger: runs.trigger, error: runs.error, createdAt: runs.createdAt }).from(runs).where(and74(graded, inArray37(runs.status, FINISHED_STATUSES))).orderBy(desc41(runs.createdAt)).limit(SYNC_FAILURE_WINDOW).all();
   const lastSuccess = db.select({ createdAt: runs.createdAt, finishedAt: runs.finishedAt }).from(runs).where(and74(graded, inArray37(runs.status, SUCCESS_STATUSES))).orderBy(desc41(runs.createdAt)).limit(1).get();
-  const failureCount = db.select({ count: count6() }).from(runs).where(and74(lastSuccess ? and74(graded, gt6(runs.createdAt, lastSuccess.createdAt)) : graded, eq88(runs.status, RunStatuses.failed))).get();
+  const failureCount = db.select({ count: count6() }).from(runs).where(and74(lastSuccess ? and74(graded, gt7(runs.createdAt, lastSuccess.createdAt)) : graded, eq88(runs.status, RunStatuses.failed))).get();
   const failuresSinceSuccess = Number(failureCount?.count ?? 0);
   const latest = recent[0];
   return {
@@ -68353,12 +68445,12 @@ var queueBacklogCheck = {
     }
     const remaining = measured.filter((source) => (source.queueBacklogCount ?? 0) > 0);
     const total = remaining.reduce((sum, source) => sum + source.queueBacklogCount, 0);
-    if (total > DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET) {
+    if (total > CLOUDFLARE_QUEUE_RESIDUAL_WARN_COUNT) {
       return {
         status: CheckStatuses.warn,
         code: "traffic.queue-backlog.remaining",
-        summary: `${total.toLocaleString("en-US")} message(s) remained across ${remaining.length} Cloudflare Queue source(s) after the last bounded sync, exceeding the default ${DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET.toLocaleString("en-US")}-message drain budget.`,
-        remediation: "Run `canonry traffic sync <project> --source <id>` again. If the backlog stays above 1,000 messages, shorten the traffic-sync schedule interval.",
+        summary: `${total.toLocaleString("en-US")} message(s) remained across ${remaining.length} Cloudflare Queue source(s) after the last sync, more than the ${CLOUDFLARE_QUEUE_RESIDUAL_WARN_COUNT.toLocaleString("en-US")} that can arrive while a drain runs. The drain stopped at its time limit or pull cap before the Queue was empty.`,
+        remediation: "If the backlog keeps growing, messages will pass the Queue's retention and be dropped. Shorten the traffic-sync schedule interval, or raise `CANONRY_CLOUDFLARE_QUEUE_SYNC_DEADLINE_MS` (default 4 minutes per sync).",
         details
       };
     }
@@ -68366,8 +68458,8 @@ var queueBacklogCheck = {
       return {
         status: CheckStatuses.ok,
         code: "traffic.queue-backlog.within-drain-budget",
-        summary: `${total.toLocaleString("en-US")} message(s) remained after the last bounded sync, within the default ${DEFAULT_CLOUDFLARE_QUEUE_DRAIN_BUDGET.toLocaleString("en-US")}-message drain budget.`,
-        remediation: "If no new messages arrive, the next scheduled sync can drain this residual backlog. Run `canonry traffic sync <project> --source <id>` to accelerate it.",
+        summary: `${total.toLocaleString("en-US")} message(s) remained after the last sync, within the ${CLOUDFLARE_QUEUE_RESIDUAL_WARN_COUNT.toLocaleString("en-US")} that can arrive while a drain runs.`,
+        remediation: "The next scheduled sync drains these. Run `canonry traffic sync <project> --source <id>` to drain them sooner.",
         details
       };
     }
@@ -68529,7 +68621,7 @@ var GTM_REQUIRED_OAUTH_SCOPES = [
 ];
 var FRESH_SNAPSHOT_WARN_DAYS = 7;
 var FRESH_SNAPSHOT_FAIL_DAYS = 30;
-var DAY_MS3 = 24 * 60 * 60 * 1e3;
+var DAY_MS4 = 24 * 60 * 60 * 1e3;
 function unavailableStatus() {
   return {
     status: CheckStatuses.skipped,
@@ -68616,7 +68708,7 @@ function snapshotOutput(provider, latestSnapshotAt, now) {
       details: { latestSnapshotAt }
     };
   }
-  const ageDays2 = (now.getTime() - snapshotMs) / DAY_MS3;
+  const ageDays2 = (now.getTime() - snapshotMs) / DAY_MS4;
   const details = { latestSnapshotAt, ageDays: Math.max(0, Math.round(ageDays2)) };
   if (ageDays2 < 0) {
     return {
@@ -69925,12 +70017,12 @@ function dedupeStrings(input) {
 
 // ../api-routes/src/technical-aeo.ts
 import crypto55 from "crypto";
-import { and as and81, asc as asc20, count as count7, desc as desc45, eq as eq98, gte as gte25, inArray as inArray41, isNotNull as isNotNull9, isNull as isNull17, lt as lt12, or as or21, sql as sql33 } from "drizzle-orm";
+import { and as and81, asc as asc20, count as count7, desc as desc45, eq as eq98, gte as gte25, inArray as inArray41, isNotNull as isNotNull9, isNull as isNull17, lt as lt13, or as or21, sql as sql33 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 
 // ../api-routes/src/technical-aeo-issues.ts
 import { createHash as createHash10 } from "crypto";
-import { and as and80, asc as asc19, eq as eq97, gt as gt7, sql as sql32 } from "drizzle-orm";
+import { and as and80, asc as asc19, eq as eq97, gt as gt8, sql as sql32 } from "drizzle-orm";
 var ADVISORY_CODES = /* @__PURE__ */ new Set([
   "entity-consistency.title.short",
   "site.duplicate-title",
@@ -70091,7 +70183,7 @@ function readSiteAuditIssues(input) {
         url: siteCrawlPages.url,
         auditScore: siteCrawlPages.auditScore,
         auditFields: siteCrawlPages.auditFields
-      }).from(siteCrawlPages).where(and80(scope, after === void 0 ? void 0 : gt7(siteCrawlPages.nodeKey, after))).orderBy(asc19(siteCrawlPages.nodeKey)).limit(200).all();
+      }).from(siteCrawlPages).where(and80(scope, after === void 0 ? void 0 : gt8(siteCrawlPages.nodeKey, after))).orderBy(asc19(siteCrawlPages.nodeKey)).limit(200).all();
       for (const page3 of pages) {
         evidenceHash.update(JSON.stringify(page3));
         const fields = record(page3.auditFields);
@@ -70581,11 +70673,11 @@ async function technicalAeoRoutes(app, opts) {
   };
   const resolveCrawl = (projectId, runId, requestedDate, scope = {}) => {
     const filters = visibleCrawlFilters(projectId);
-    if (scope.recordedBefore) filters.push(lt12(siteCrawlSnapshots.createdAt, scope.recordedBefore));
+    if (scope.recordedBefore) filters.push(lt13(siteCrawlSnapshots.createdAt, scope.recordedBefore));
     if (requestedDate) {
       const nextDate2 = /* @__PURE__ */ new Date(`${requestedDate}T00:00:00.000Z`);
       nextDate2.setUTCDate(nextDate2.getUTCDate() + 1);
-      filters.push(gte25(siteCrawlSnapshots.createdAt, requestedDate), lt12(siteCrawlSnapshots.createdAt, nextDate2.toISOString()));
+      filters.push(gte25(siteCrawlSnapshots.createdAt, requestedDate), lt13(siteCrawlSnapshots.createdAt, nextDate2.toISOString()));
     }
     const selectionFilters = scope.scoredOnly ? [...filters, sql33`exists (select 1 from ${siteAuditSnapshots} where ${siteAuditSnapshots.projectId} = ${siteCrawlSnapshots.projectId} and ${siteAuditSnapshots.runId} = ${siteCrawlSnapshots.runId})`] : filters;
     const selected = app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq98(siteCrawlSnapshots.runId, runs.id)).where(and81(...selectionFilters, runId ? eq98(siteCrawlSnapshots.runId, runId) : void 0)).orderBy(
@@ -70602,7 +70694,7 @@ async function technicalAeoRoutes(app, opts) {
     const sameDate = and81(
       ...filters,
       gte25(siteCrawlSnapshots.createdAt, date),
-      lt12(siteCrawlSnapshots.createdAt, nextDate.toISOString())
+      lt13(siteCrawlSnapshots.createdAt, nextDate.toISOString())
     );
     const sameDateRunCount = app.db.select({ value: count7() }).from(siteCrawlSnapshots).innerJoin(runs, eq98(siteCrawlSnapshots.runId, runs.id)).where(sameDate).get()?.value ?? 0;
     const candidates = app.db.select({
@@ -70633,7 +70725,7 @@ async function technicalAeoRoutes(app, opts) {
       eq98(runs.kind, RunKinds["site-audit"]),
       inArray41(runs.status, SURFACEABLE_STATUSES),
       notProbeRun(),
-      ...recordedBefore ? [lt12(siteAuditSnapshots.createdAt, recordedBefore)] : []
+      ...recordedBefore ? [lt13(siteAuditSnapshots.createdAt, recordedBefore)] : []
     ];
     const complete = sql33`case when ${runs.status} = ${RunStatuses.completed} then 1 else 0 end`;
     const selectAudit = (pinnedRunId) => app.db.select({ snap: siteAuditSnapshots, runStatus: runs.status }).from(siteAuditSnapshots).innerJoin(runs, eq98(siteAuditSnapshots.runId, runs.id)).where(and81(...filters, pinnedRunId ? eq98(siteAuditSnapshots.runId, pinnedRunId) : void 0)).orderBy(
@@ -70660,7 +70752,7 @@ async function technicalAeoRoutes(app, opts) {
     const sameDate = and81(
       ...filters,
       gte25(siteAuditSnapshots.createdAt, date),
-      lt12(siteAuditSnapshots.createdAt, nextDate.toISOString())
+      lt13(siteAuditSnapshots.createdAt, nextDate.toISOString())
     );
     const sameDateRunCount = app.db.select({ value: count7() }).from(siteAuditSnapshots).innerJoin(runs, eq98(siteAuditSnapshots.runId, runs.id)).where(sameDate).get()?.value ?? 0;
     const candidates = app.db.select({
@@ -71099,7 +71191,7 @@ async function technicalAeoRoutes(app, opts) {
       eq98(siteCrawlPages.runId, siteCrawlGraphNodes.runId),
       eq98(siteCrawlPages.attemptId, siteCrawlGraphNodes.attemptId),
       eq98(siteCrawlPages.nodeKey, siteCrawlGraphNodes.nodeKey)
-    )).where(and81(...graphScope, lt12(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc20(siteCrawlGraphNodes.sampleRank)).all();
+    )).where(and81(...graphScope, lt13(siteCrawlGraphNodes.sampleRank, maxNodes))).orderBy(asc20(siteCrawlGraphNodes.sampleRank)).all();
     const nodes = nodeRows.map(({ indexabilityReasons, canonicalNodeKey, ...row }) => ({
       ...row,
       healthState: deriveSiteHealthState({ ...row, indexabilityReasons, canonicalNodeKey }),
@@ -71118,18 +71210,18 @@ async function technicalAeoRoutes(app, opts) {
       eq98(graphSourceNode.runId, siteCrawlGraphEdges.runId),
       eq98(graphSourceNode.attemptId, siteCrawlGraphEdges.attemptId),
       eq98(graphSourceNode.nodeKey, siteCrawlGraphEdges.sourceNodeKey),
-      lt12(graphSourceNode.sampleRank, maxNodes)
+      lt13(graphSourceNode.sampleRank, maxNodes)
     )).innerJoin(graphTargetNode, and81(
       eq98(graphTargetNode.projectId, siteCrawlGraphEdges.projectId),
       eq98(graphTargetNode.runId, siteCrawlGraphEdges.runId),
       eq98(graphTargetNode.attemptId, siteCrawlGraphEdges.attemptId),
       eq98(graphTargetNode.nodeKey, siteCrawlGraphEdges.targetNodeKey),
-      lt12(graphTargetNode.sampleRank, maxNodes)
+      lt13(graphTargetNode.sampleRank, maxNodes)
     )).where(and81(
       eq98(siteCrawlGraphEdges.projectId, project.id),
       eq98(siteCrawlGraphEdges.runId, snapshot.runId),
       eq98(siteCrawlGraphEdges.attemptId, snapshot.attemptId),
-      lt12(siteCrawlGraphEdges.sampleRank, maxEdges),
+      lt13(siteCrawlGraphEdges.sampleRank, maxEdges),
       graphLinkKindFilter
     )).orderBy(asc20(siteCrawlGraphEdges.sampleRank)).all();
     const totalNodes = persistedLayout.totalNodes;
@@ -71473,10 +71565,10 @@ async function technicalAeoRoutes(app, opts) {
     const beforeTarget = request.query.fromRunId ? resolveCrawl(project.id, request.query.fromRunId) : afterTarget ? app.db.select({ snapshot: siteCrawlSnapshots, runStatus: runs.status }).from(siteCrawlSnapshots).innerJoin(runs, eq98(siteCrawlSnapshots.runId, runs.id)).where(and81(
       ...completeSnapshotFilters,
       or21(
-        lt12(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
+        lt13(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
         and81(
           eq98(siteCrawlSnapshots.createdAt, afterTarget.snapshot.createdAt),
-          lt12(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
+          lt13(siteCrawlSnapshots.runId, afterTarget.snapshot.runId)
         )
       )
     )).orderBy(desc45(siteCrawlSnapshots.createdAt), desc45(siteCrawlSnapshots.runId)).limit(1).get() : void 0;
@@ -72361,7 +72453,7 @@ async function technicalAeoRoutes(app, opts) {
     }).from(siteCrawlPages).where(and81(
       auditedWhere,
       isNotNull9(siteCrawlPages.auditScore),
-      lt12(siteCrawlPages.auditScore, 70)
+      lt13(siteCrawlPages.auditScore, 70)
     )).orderBy(asc20(siteCrawlPages.auditScore), asc20(siteCrawlPages.nodeKey)).limit(LIVE_PAGE_HEALTH_CANDIDATE_LIMIT).all();
     const examples = candidates.flatMap((candidate) => {
       if (candidate.auditScore == null) return [];
@@ -72456,7 +72548,7 @@ async function technicalAeoRoutes(app, opts) {
 // ../api-routes/src/research.ts
 import crypto56 from "crypto";
 import { z as z6 } from "zod";
-import { and as and82, count as count8, desc as desc46, eq as eq99, gte as gte26, lt as lt13, or as or22, sql as sql34 } from "drizzle-orm";
+import { and as and82, count as count8, desc as desc46, eq as eq99, gte as gte26, lt as lt14, or as or22, sql as sql34 } from "drizzle-orm";
 var sameLocation = (a, b) => a.label === b.label && a.city === b.city && a.region === b.region && a.country === b.country && a.timezone === b.timezone;
 var BATCH_RECEIPT_PREFIX = "__canonry_research_batch__:";
 async function researchRoutes(app, opts) {
@@ -72521,7 +72613,7 @@ async function researchRoutes(app, opts) {
         const used = tx.select({ value: count8() }).from(researchRuns).where(and82(
           eq99(researchRuns.projectId, project.id),
           gte26(researchRuns.createdAt, start),
-          lt13(researchRuns.createdAt, end),
+          lt14(researchRuns.createdAt, end),
           sql34`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
         )).get()?.value ?? 0;
         if (used >= viewerDailyRunLimit) {
@@ -72577,7 +72669,7 @@ async function researchRoutes(app, opts) {
         const used = tx.select({ value: count8() }).from(researchRuns).where(and82(
           eq99(researchRuns.projectId, project.id),
           gte26(researchRuns.createdAt, start),
-          lt13(researchRuns.createdAt, end),
+          lt14(researchRuns.createdAt, end),
           sql34`(json_extract(${researchRuns.initiatedBy}, '$.role') = ${UserRoles.viewer} OR json_extract(${researchRuns.initiatedBy}, '$.limited') = 1)`
         )).get()?.value ?? 0;
         if (used + prepared.length > viewerDailyRunLimit) throw researchDailyLimitExceeded(project.name, viewerDailyRunLimit, date);
@@ -72631,7 +72723,7 @@ async function researchRoutes(app, opts) {
     const cursor = request.query.cursor ? parseResearchCursor(request.query.cursor, project.id) : null;
     const rows = app.db.select().from(researchRuns).where(and82(
       eq99(researchRuns.projectId, project.id),
-      cursor ? or22(lt13(researchRuns.createdAt, cursor.createdAt), and82(eq99(researchRuns.createdAt, cursor.createdAt), lt13(researchRuns.id, cursor.id))) : void 0
+      cursor ? or22(lt14(researchRuns.createdAt, cursor.createdAt), and82(eq99(researchRuns.createdAt, cursor.createdAt), lt14(researchRuns.id, cursor.id))) : void 0
     )).orderBy(desc46(researchRuns.createdAt), desc46(researchRuns.id)).limit(limit + 1).all();
     const runs2 = rows.slice(0, limit).map(serializeRun);
     const last = runs2.at(-1);
@@ -73260,7 +73352,9 @@ async function apiRoutes(app, opts) {
       cloudflareTrafficCredentialStore: opts.cloudflareTrafficCredentialStore,
       pullCloudflareQueueMessages: opts.pullCloudflareQueueMessages,
       ackCloudflareQueueMessages: opts.ackCloudflareQueueMessages,
+      getCloudflareQueueRetentionSeconds: opts.getCloudflareQueueRetentionSeconds,
       cloudflareQueueMaxBatches: opts.cloudflareQueueMaxBatches,
+      cloudflareQueueSyncDeadlineMs: opts.cloudflareQueueSyncDeadlineMs,
       cloudflareTrafficIngestUrl: opts.cloudflareTrafficIngestUrl,
       cloudflareIngestRateLimitMax: opts.cloudflareIngestRateLimitMax,
       cloudflareIngestIpRateLimitMax: opts.cloudflareIngestIpRateLimitMax,
@@ -73676,6 +73770,7 @@ export {
   listCachedReleases,
   pruneCachedRelease,
   resolveVercelSyncDeadlineMs,
+  resolveCloudflareQueueSyncDeadlineMs,
   SITE_REACHABILITY_CHECK_ID,
   SITE_REACHABILITY_CHECKS,
   scheduledHealthCheckIds,

package/dist/{cli-commands-3HTHHRXT.js → cli-commands-ZPW3OST3.js}

@@ -1,6 +1,6 @@
 import {
   REGISTERED_CLI_COMMANDS
-} from "./chunk-BDUHO7KK.js";
+} from "./chunk-AP7YSOFC.js";
 import "./chunk-6GO5VVAC.js";
 import "./chunk-WLIGKWVB.js";
 import "./chunk-VJWDBFSL.js";

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node --import tsx
 import {
   REGISTERED_CLI_COMMANDS
-} from "./chunk-BDUHO7KK.js";
+} from "./chunk-AP7YSOFC.js";
 import "./chunk-6GO5VVAC.js";
 import {
   buildSetupState,
   runPendingServeHandoff
-} from "./chunk-JDRKZOUP.js";
+} from "./chunk-NWYNTYPD.js";
 import "./chunk-WLIGKWVB.js";
 import "./chunk-VJWDBFSL.js";
 import "./chunk-TSENU4GG.js";

package/dist/{dashboard-2P3TEH6S.js → dashboard-VT3GQRW4.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   anyUsersExist
-} from "./chunk-NWQQYLZV.js";
+} from "./chunk-QEJBAPDP.js";
 import "./chunk-Q4J3XSWE.js";
 import "./chunk-27SGL3DF.js";
 import {

package/dist/{demo-TPOKI7ZM.js → demo-ZBNVULOO.js}

@@ -40,7 +40,7 @@ function parseDemoTrustedProxies(values) {
 async function demoCommand(options) {
   const { host, port } = parseDemoListenOptions(options);
   const trustProxy = parseDemoTrustedProxies(options.trustProxy);
-  const { createDemoServer } = await import("./demo-server-ZBNKYYM2.js");
+  const { createDemoServer } = await import("./demo-server-QUW4TDJL.js");
   const app = await createDemoServer({ trustProxy });
   let stopping = false;
   const stop = () => {