@canonry/canonry 7.72.2 → 7.74.0

package/dist/{chunk-7KOAP47B.js → chunk-WLWOGBLJ.js}

@@ -9,14 +9,14 @@ import {
   normalizeCloudflareWorkerEvent,
   sessionizeJourneyRequests,
   verifyRequestSignature
-} from "./chunk-JEBY6MS6.js";
+} from "./chunk-QS6RIP37.js";
 import {
   currentOutcomeAttribution,
   getRequestContext,
   registerRequestContext,
   requestAuditIdentity,
   sanitizeRequestContext
-} from "./chunk-BADJCT6U.js";
+} from "./chunk-GWDMWKM6.js";
 import {
   SentimentIdempotencyConflict,
   SentimentRepository,
@@ -109,6 +109,7 @@ import {
   notifications,
   oauthAuthorizationCodes,
   oauthClients,
+  oauthGrants,
   oauthTokens,
   parseJsonColumn,
   pickGroupRepresentative,
@@ -156,7 +157,7 @@ import {
   userSessions,
   users,
   writeNegativeReviewMaxStars
-} from "./chunk-O7WOCTBD.js";
+} from "./chunk-PAIYFNNY.js";
 import {
   ADS_ACTIVATE_SCOPE,
   ADS_ACTIVATION_ABSOLUTE_MAX_ENTITIES,
@@ -788,6 +789,7 @@ import {
   matchesMarketRankingFilter,
   matchesMarketRankingText,
   matchesMeasurementTargetUrl,
+  mcpProfileDtoSchema,
   measurementChangesQuerySchema,
   measurementChangesResponseSchema,
   measurementCompiledChecksumConflict,
@@ -1194,7 +1196,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../api-routes/src/user-session.ts
 import crypto2 from "crypto";
@@ -6076,9 +6078,6 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 
-// ../api-routes/src/agent-conversations.ts
-import { and as and7, desc as desc2, eq as eq12, like } from "drizzle-orm";
-
 // ../api-routes/src/auth.ts
 import crypto8 from "crypto";
 import { eq as eq10 } from "drizzle-orm";
@@ -6107,6 +6106,9 @@ function isPaidReadRoute(request) {
 function isTransportEnvelopeRoute(request) {
   return request.routeOptions.config.transportEnvelope === true;
 }
+function isMcpAuthorizationRoute(request) {
+  return isTransportEnvelopeRoute(request) || (request.method === "GET" || request.method === "HEAD") && matchOperationTemplate("GET", request.routeOptions.url ?? request.url) === "GET /api/v1/mcp/profile";
+}
 function requireScope(request, scope) {
   if (request.readSemanticGrant) return;
   const scopes = principalScopes(request);
@@ -6216,11 +6218,17 @@ function shouldSkipAuth(url) {
   if (url.endsWith("/traffic/cloudflare/ingest")) return true;
   return false;
 }
+var MCP_DELEGATED_KEY_MAX_AGE_MS = 60 * 60 * 1e3;
 var USERS_READ_SCOPE = "users.read";
 var USERS_WRITE_SCOPE = "users.write";
 function scopesForRole(role, researchAllowViewers = false) {
   return role === UserRoles.admin ? [WILDCARD_SCOPE] : researchAllowViewers ? [READ_ONLY_SCOPE, RESEARCH_RUN_SCOPE] : [READ_ONLY_SCOPE];
 }
+function delegatedScopesForRole(role, requested, researchAllowViewers = false) {
+  const effective = intersectScopes(scopesForRole(role, researchAllowViewers), requested).filter((scope) => requested.includes(WILDCARD_SCOPE) || requested.includes(scope));
+  if (effective.length === 0) throw forbidden("This credential no longer has any authorized scopes.");
+  return effective;
+}
 function queryValue(request, key) {
   const raw = request.query?.[key];
   if (typeof raw === "string") return raw;
@@ -6374,15 +6382,15 @@ async function authPlugin(app, opts = {}) {
       const hash3 = hashApiKey(token);
       key = app.db.select().from(apiKeys).where(eq10(apiKeys.keyHash, hash3)).get();
       if (!key || key.revokedAt) {
-        const granted = isTransportEnvelopeRoute(request) ? opts.resolveOAuthToken?.(token) ?? null : null;
+        const granted = isMcpAuthorizationRoute(request) ? opts.resolveOAuthToken?.(token) ?? null : null;
         if (granted) {
           const account = app.db.select().from(users).where(eq10(users.id, granted.userId)).get();
           if (!account) throw authInvalid();
-          const roleScopes = scopesForRole(account.role, opts.researchAllowViewers);
-          const requested = (granted.scope ?? "").split(/\s+/).filter((part) => part.length > 0 && part !== "offline_access");
-          const effective = intersectScopes(roleScopes, requested);
+          const requested = (granted.scope ?? READ_ONLY_SCOPE).split(/\s+/).filter((part) => part.length > 0 && part !== "offline_access");
+          const effective = delegatedScopesForRole(account.role, requested, opts.researchAllowViewers);
           request.principal = {
             kind: "user",
+            oauthGrantId: granted.grantId,
             id: account.id,
             name: account.name,
             scopes: effective,
@@ -6423,10 +6431,17 @@ async function authPlugin(app, opts = {}) {
     let scopes = Array.isArray(key.scopes) ? key.scopes : [];
     const delegatedUser = key.delegatedUserId ? app.db.select().from(users).where(eq10(users.id, key.delegatedUserId)).get() : void 0;
     if (key.delegatedUserId && !delegatedUser) throw authInvalid();
-    if (delegatedUser) scopes = intersectScopes(scopesForRole(delegatedUser.role, opts.researchAllowViewers), scopes);
+    if (key.delegatedOAuthGrantId) {
+      const age = Date.now() - Date.parse(key.createdAt);
+      if (!Number.isFinite(age) || age < 0 || age >= MCP_DELEGATED_KEY_MAX_AGE_MS) throw authInvalid();
+      const grant = app.db.select().from(oauthGrants).where(eq10(oauthGrants.id, key.delegatedOAuthGrantId)).get();
+      if (!grant || grant.revokedAt || grant.userId !== key.delegatedUserId) throw authInvalid();
+    }
+    if (delegatedUser) scopes = delegatedScopesForRole(delegatedUser.role, scopes, opts.researchAllowViewers);
     request.apiKey = { id: key.id, name: key.name, scopes, projectId: key.projectId ?? null };
     request.principal = {
       kind: "api-key",
+      oauthGrantId: key.delegatedOAuthGrantId,
       id: key.id,
       name: key.name,
       scopes,
@@ -6455,6 +6470,34 @@ async function authPlugin(app, opts = {}) {
   });
 }
 
+// ../api-routes/src/mcp-profile.ts
+async function mcpProfileRoutes(app, opts) {
+  app.get("/mcp/profile", async (request, reply) => {
+    requireScope(request, READ_ONLY_SCOPE);
+    const principal = request.principal;
+    const user = principal?.kind === "user" ? principal : principal?.delegatedUser;
+    if (!user || principal?.projectId) {
+      throw forbidden("MCP connection profiles require an instance-wide named account.");
+    }
+    if (!opts.oauthResourceUrl) {
+      throw notImplemented("This instance has no configured MCP OAuth resource.");
+    }
+    reply.header("Cache-Control", "no-store");
+    return {
+      userId: user.id,
+      displayName: user.name,
+      instance: {
+        issuer: new URL(opts.oauthResourceUrl).origin,
+        resource: opts.oauthResourceUrl
+      },
+      scopes: [READ_ONLY_SCOPE]
+    };
+  });
+}
+
+// ../api-routes/src/agent-conversations.ts
+import { and as and7, desc as desc2, eq as eq12, like } from "drizzle-orm";
+
 // ../api-routes/src/helpers.ts
 import crypto9 from "crypto";
 import { eq as eq11, ne as ne3, sql as sql2 } from "drizzle-orm";
@@ -7866,7 +7909,7 @@ function createOutcomeEmitter(sink) {
 
 // ../api-routes/src/oauth.ts
 import crypto10 from "crypto";
-import { and as and10, eq as eq16, isNull as isNull2, lt as lt2 } from "drizzle-orm";
+import { and as and10, eq as eq16, inArray as inArray7, isNull as isNull2, lt as lt2 } from "drizzle-orm";
 var CODE_TTL_MS = 6e4;
 var ACCESS_TTL_MS = 60 * 60 * 1e3;
 var REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -8021,6 +8064,7 @@ function registerOAuthRoutesIn(app, opts) {
       // S256 only. Advertising `plain` would invite a downgrade attempt.
       code_challenge_methods_supported: ["S256"],
       token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+      revocation_endpoint_auth_methods_supported: ["client_secret_post", "none"],
       scopes_supported: [...SUPPORTED_SCOPES]
     };
   }
@@ -8210,38 +8254,25 @@ function registerOAuthRoutesIn(app, opts) {
     return reply.redirect(request.url);
   });
   app.post("/oauth/token", async (request, reply) => {
+    reply.header("cache-control", "no-store").header("pragma", "no-cache");
     const body = request.body ?? {};
     const now = /* @__PURE__ */ new Date();
     db.delete(oauthAuthorizationCodes).where(lt2(oauthAuthorizationCodes.expiresAt, now.toISOString())).run();
-    function checkClient(clientId) {
-      const client = db.select().from(oauthClients).where(eq16(oauthClients.id, clientId)).get();
-      if (!client || client.revokedAt) return "invalid_client";
-      if (client.secretHash) {
-        const presented = body.client_secret;
-        if (!presented) return "invalid_secret";
-        const expected = Buffer.from(client.secretHash);
-        const actual = Buffer.from(sha256(presented));
-        if (expected.length !== actual.length || !crypto10.timingSafeEqual(expected, actual)) {
-          return "invalid_secret";
-        }
-      }
-      return "ok";
-    }
-    function issue(clientId, userId, resource, scope) {
+    function issue(tx, grant) {
       const accessToken = newToken();
       const refreshToken = newToken();
-      const rows = [
+      for (const row of [
         { token: accessToken, kind: "access", ttl: ACCESS_TTL_MS },
         { token: refreshToken, kind: "refresh", ttl: REFRESH_TTL_MS }
-      ];
-      for (const row of rows) {
-        db.insert(oauthTokens).values({
+      ]) {
+        tx.insert(oauthTokens).values({
           tokenHash: sha256(row.token),
           kind: row.kind,
-          clientId,
-          userId,
-          resource,
-          scope,
+          grantId: grant.id,
+          clientId: grant.clientId,
+          userId: grant.userId,
+          resource: grant.resource,
+          scope: grant.scope,
           expiresAt: new Date(now.getTime() + row.ttl).toISOString(),
           createdAt: now.toISOString()
         }).run();
@@ -8250,54 +8281,119 @@ function registerOAuthRoutesIn(app, opts) {
         access_token: accessToken,
         token_type: "Bearer",
         expires_in: Math.floor(ACCESS_TTL_MS / 1e3),
-        // Without a refresh token the client silently loses access at the
-        // first expiry, which reads to a user as the connector breaking.
+        // Preserve refresh issuance for existing clients that omit offline_access.
         refresh_token: refreshToken,
-        scope: scope ?? "read"
+        scope: grant.scope ?? "read"
       };
     }
     if (body.grant_type === "authorization_code") {
       const code = body.code;
       const verifier = body.code_verifier;
       if (!code || !verifier) return badRequest(reply, "invalid_request", "code and code_verifier are required.");
-      const row = db.select().from(oauthAuthorizationCodes).where(eq16(oauthAuthorizationCodes.codeHash, sha256(code))).get();
-      if (!row) return badRequest(reply, "invalid_grant", "Unknown or already-redeemed code.");
-      db.delete(oauthAuthorizationCodes).where(eq16(oauthAuthorizationCodes.codeHash, row.codeHash)).run();
-      if (Date.parse(row.expiresAt) <= now.getTime()) return badRequest(reply, "invalid_grant", "Code has expired.");
-      if (body.client_id !== row.clientId) return badRequest(reply, "invalid_grant", "Code was issued to a different client.");
-      const clientState = checkClient(row.clientId);
-      if (clientState !== "ok") return badRequest(reply, "invalid_client", "Client is unknown, revoked, or failed authentication.");
-      if (body.redirect_uri !== row.redirectUri) return badRequest(reply, "invalid_grant", "redirect_uri does not match the authorization request.");
-      if (!verifyPkce(verifier, row.codeChallenge)) return badRequest(reply, "invalid_grant", "PKCE verification failed.");
-      return issue(row.clientId, row.userId, row.resource, row.scope);
+      const result = db.transaction((tx) => {
+        const row = tx.delete(oauthAuthorizationCodes).where(eq16(oauthAuthorizationCodes.codeHash, sha256(code))).returning().get();
+        if (!row) return { error: "invalid_grant", description: "Unknown or already-redeemed code." };
+        if (Date.parse(row.expiresAt) <= now.getTime()) return { error: "invalid_grant", description: "Code has expired." };
+        if (body.client_id !== row.clientId) return { error: "invalid_grant", description: "Code was issued to a different client." };
+        if (!authenticateClient(tx, row.clientId, body.client_secret)) return { error: "invalid_client", description: "Client is unknown, revoked, or failed authentication." };
+        if (body.redirect_uri !== row.redirectUri) return { error: "invalid_grant", description: "redirect_uri does not match the authorization request." };
+        if (!verifyPkce(verifier, row.codeChallenge)) return { error: "invalid_grant", description: "PKCE verification failed." };
+        if (body.resource && body.resource !== row.resource) return { error: "invalid_target", description: "resource does not match the authorization grant." };
+        const grant = { id: crypto10.randomUUID(), clientId: row.clientId, userId: row.userId, resource: row.resource, scope: row.scope };
+        tx.insert(oauthGrants).values({ ...grant, createdAt: now.toISOString() }).run();
+        return { tokens: issue(tx, grant) };
+      }, { behavior: "immediate" });
+      return result.tokens ?? badRequest(reply, result.error, result.description);
     }
     if (body.grant_type === "refresh_token") {
       const presented = body.refresh_token;
-      if (!presented) return badRequest(reply, "invalid_request", "refresh_token is required.");
-      const row = db.select().from(oauthTokens).where(and10(eq16(oauthTokens.tokenHash, sha256(presented)), eq16(oauthTokens.kind, "refresh"))).get();
-      if (!row || row.revokedAt) return badRequest(reply, "invalid_grant", "Unknown or revoked refresh token.");
-      if (Date.parse(row.expiresAt) <= now.getTime()) return badRequest(reply, "invalid_grant", "Refresh token has expired.");
-      const refreshClientState = checkClient(row.clientId);
-      if (refreshClientState !== "ok") return badRequest(reply, "invalid_client", "Client is unknown, revoked, or failed authentication.");
-      db.update(oauthTokens).set({ revokedAt: now.toISOString() }).where(eq16(oauthTokens.tokenHash, row.tokenHash)).run();
-      return issue(row.clientId, row.userId, row.resource, row.scope);
+      if (!presented || !body.client_id) return badRequest(reply, "invalid_request", "refresh_token and client_id are required.");
+      const result = db.transaction((tx) => {
+        const row = tx.select().from(oauthTokens).where(and10(eq16(oauthTokens.tokenHash, sha256(presented)), eq16(oauthTokens.kind, "refresh"))).get();
+        if (!row) return { error: "invalid_grant", description: "Unknown refresh token." };
+        if (body.client_id !== row.clientId) return { error: "invalid_grant", description: "Refresh token was issued to a different client." };
+        if (!authenticateClient(tx, row.clientId, body.client_secret)) return { error: "invalid_client", description: "Client is unknown, revoked, or failed authentication." };
+        if (body.resource && body.resource !== row.resource) return { error: "invalid_target", description: "resource does not match the authorization grant." };
+        if (row.revokedAt) {
+          const grantId2 = row.grantId ?? adoptLegacyGrant(tx, row, now.toISOString());
+          if (grantId2) revokeGrant(tx, grantId2, now.toISOString());
+          return { error: "invalid_grant", description: "Refresh token was already used or revoked. Reconnect this authorization." };
+        }
+        if (Date.parse(row.expiresAt) <= now.getTime()) return { error: "invalid_grant", description: "Refresh token has expired." };
+        const grant = row.grantId ? tx.select().from(oauthGrants).where(eq16(oauthGrants.id, row.grantId)).get() : void 0;
+        if (row.grantId && (!grant || grant.revokedAt)) return { error: "invalid_grant", description: "Authorization has been revoked." };
+        const grantId = row.grantId ?? adoptLegacyGrant(tx, row, now.toISOString());
+        if (!grantId) return { error: "invalid_grant", description: "Authorization no longer has an existing account and client." };
+        const consumed = tx.update(oauthTokens).set({ revokedAt: now.toISOString() }).where(and10(eq16(oauthTokens.tokenHash, row.tokenHash), isNull2(oauthTokens.revokedAt))).run();
+        if (consumed.changes !== 1) return { error: "invalid_grant", description: "Refresh token was already used." };
+        return { tokens: issue(tx, { ...row, id: grantId }) };
+      }, { behavior: "immediate" });
+      return result.tokens ?? badRequest(reply, result.error, result.description);
     }
     return badRequest(reply, "unsupported_grant_type", "Supported grants: authorization_code, refresh_token.");
   });
   app.post("/oauth/revoke", async (request, reply) => {
     const body = request.body ?? {};
-    if (body.token) {
-      db.update(oauthTokens).set({ revokedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq16(oauthTokens.tokenHash, sha256(body.token))).run();
-    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = db.transaction((tx) => {
+      if (body.client_id && !authenticateClient(tx, body.client_id, body.client_secret)) return "invalid_client";
+      const row = body.token ? tx.select().from(oauthTokens).where(eq16(oauthTokens.tokenHash, sha256(body.token))).get() : void 0;
+      if (!row || row.revokedAt || !Number.isFinite(Date.parse(row.expiresAt)) || Date.parse(row.expiresAt) <= Date.parse(now)) return;
+      if (body.client_id && body.client_id !== row.clientId) return;
+      if (!body.client_id && !authenticateClient(tx, row.clientId, body.client_secret)) return;
+      const grantId = row.grantId ?? adoptLegacyGrant(tx, row, now);
+      if (grantId) revokeGrant(tx, grantId, now);
+    }, { behavior: "immediate" });
+    if (result) return badRequest(reply, result, "Client is unknown, revoked, or failed authentication.");
     return reply.status(200).send({});
   });
 }
+function authenticateClient(db, clientId, secret) {
+  const client = db.select().from(oauthClients).where(eq16(oauthClients.id, clientId)).get();
+  if (!client || client.revokedAt) return false;
+  if (!client.secretHash) return true;
+  if (!secret) return false;
+  const expected = Buffer.from(client.secretHash);
+  const actual = Buffer.from(sha256(secret));
+  return expected.length === actual.length && crypto10.timingSafeEqual(expected, actual);
+}
+function adoptLegacyGrant(db, row, now) {
+  if (!db.select({ id: users.id }).from(users).where(eq16(users.id, row.userId)).get() || !db.select({ id: oauthClients.id }).from(oauthClients).where(eq16(oauthClients.id, row.clientId)).get()) return null;
+  const identity = and10(
+    eq16(oauthTokens.clientId, row.clientId),
+    eq16(oauthTokens.userId, row.userId),
+    row.resource === null ? isNull2(oauthTokens.resource) : eq16(oauthTokens.resource, row.resource),
+    row.scope === null ? isNull2(oauthTokens.scope) : eq16(oauthTokens.scope, row.scope),
+    isNull2(oauthTokens.grantId)
+  );
+  const id = crypto10.randomUUID();
+  db.insert(oauthGrants).values({ id, clientId: row.clientId, userId: row.userId, resource: row.resource, scope: row.scope, createdAt: now }).run();
+  db.update(oauthTokens).set({ grantId: id }).where(identity).run();
+  return id;
+}
+function revokeGrant(db, grantId, now) {
+  db.update(oauthGrants).set({ revokedAt: now }).where(and10(eq16(oauthGrants.id, grantId), isNull2(oauthGrants.revokedAt))).run();
+  db.update(oauthTokens).set({ revokedAt: now }).where(and10(eq16(oauthTokens.grantId, grantId), isNull2(oauthTokens.revokedAt))).run();
+  const delegatedKeys = db.select({ id: apiKeys.id }).from(apiKeys).where(eq16(apiKeys.delegatedOAuthGrantId, grantId));
+  db.delete(dashboardSessions).where(inArray7(dashboardSessions.apiKeyId, delegatedKeys)).run();
+  db.update(apiKeys).set({ revokedAt: now }).where(and10(eq16(apiKeys.delegatedOAuthGrantId, grantId), isNull2(apiKeys.revokedAt))).run();
+}
 function resolveOAuthAccessToken(db, token, expectedResource, now = /* @__PURE__ */ new Date()) {
   const row = db.select().from(oauthTokens).where(and10(eq16(oauthTokens.tokenHash, sha256(token)), eq16(oauthTokens.kind, "access"))).get();
   if (!row || row.revokedAt) return null;
   if (Date.parse(row.expiresAt) <= now.getTime()) return null;
   if (row.resource && row.resource !== expectedResource) return null;
-  return { userId: row.userId, clientId: row.clientId, scope: row.scope };
+  const client = db.select().from(oauthClients).where(eq16(oauthClients.id, row.clientId)).get();
+  if (!client || client.revokedAt) return null;
+  const grantId = row.grantId ?? db.transaction((tx) => {
+    const current = tx.select().from(oauthTokens).where(eq16(oauthTokens.tokenHash, row.tokenHash)).get();
+    if (!current || current.revokedAt) return null;
+    return current.grantId ?? adoptLegacyGrant(tx, current, now.toISOString());
+  }, { behavior: "immediate" });
+  if (!grantId) return null;
+  const grant = db.select().from(oauthGrants).where(eq16(oauthGrants.id, grantId)).get();
+  if (!grant || grant.revokedAt) return null;
+  return { userId: row.userId, clientId: row.clientId, grantId, scope: row.scope };
 }
 function registerOAuthAdminRoutes(app, opts) {
   const { db } = opts;
@@ -8320,19 +8416,22 @@ function registerOAuthAdminRoutes(app, opts) {
       }))
     };
   });
-  app.delete("/oauth/clients/:id", async (request, reply) => {
+  app.delete("/oauth/clients/:id", async (request) => {
     requireAdminSession(request);
     const { id } = request.params;
-    const client = db.select().from(oauthClients).where(eq16(oauthClients.id, id)).get();
-    if (!client) {
-      const error = notFound("OAuth client", id);
-      return reply.status(error.statusCode).send(error.toJSON());
-    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    db.update(oauthClients).set({ revokedAt: now }).where(eq16(oauthClients.id, id)).run();
-    db.update(oauthTokens).set({ revokedAt: now }).where(and10(eq16(oauthTokens.clientId, id), isNull2(oauthTokens.revokedAt))).run();
-    db.delete(oauthAuthorizationCodes).where(eq16(oauthAuthorizationCodes.clientId, id)).run();
-    return { id, revokedAt: now };
+    const revokedAt = db.transaction((tx) => {
+      const client = tx.select().from(oauthClients).where(eq16(oauthClients.id, id)).get();
+      if (!client) throw notFound("OAuth client", id);
+      tx.update(oauthClients).set({ revokedAt: now }).where(and10(eq16(oauthClients.id, id), isNull2(oauthClients.revokedAt))).run();
+      for (const grant of tx.select().from(oauthGrants).where(eq16(oauthGrants.clientId, id)).all()) {
+        revokeGrant(tx, grant.id, now);
+      }
+      tx.update(oauthTokens).set({ revokedAt: now }).where(and10(eq16(oauthTokens.clientId, id), isNull2(oauthTokens.revokedAt))).run();
+      tx.delete(oauthAuthorizationCodes).where(eq16(oauthAuthorizationCodes.clientId, id)).run();
+      return client.revokedAt ?? now;
+    }, { behavior: "immediate" });
+    return { id, revokedAt };
   });
 }
 
@@ -9393,10 +9492,10 @@ async function settingsRoutes(app, opts) {
 
 // ../api-routes/src/run-queue.ts
 import crypto12 from "crypto";
-import { and as and13, desc as desc7, eq as eq19, gt as gt2, inArray as inArray8, like as like2, or as or3 } from "drizzle-orm";
+import { and as and13, desc as desc7, eq as eq19, gt as gt2, inArray as inArray9, like as like2, or as or3 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-report-adapter.ts
-import { and as and11, desc as desc5, eq as eq17, gte as gte2, inArray as inArray7, isNull as isNull3, lt as lt3, lte as lte4, ne as ne5 } from "drizzle-orm";
+import { and as and11, desc as desc5, eq as eq17, gte as gte2, inArray as inArray8, isNull as isNull3, lt as lt3, lte as lte4, ne as ne5 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-report.ts
 function normalizedHost(value) {
@@ -10579,9 +10678,9 @@ function latestMeasurementRun(db, projectId, versionId, statuses, window2 = {},
     // must never borrow a predecessor's run through the comparable chain; the
     // active-dashboard surfaces want the chain so a label-only republish does
     // not blank them. exactVersion selects the contract.
-    opts.exactVersion ? eq17(runs.measurementPlanVersionId, versionId) : inArray7(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, projectId, versionId)),
+    opts.exactVersion ? eq17(runs.measurementPlanVersionId, versionId) : inArray8(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, projectId, versionId)),
     eq17(runs.kind, RunKinds["answer-visibility"]),
-    inArray7(runs.status, [...statuses]),
+    inArray8(runs.status, [...statuses]),
     ne5(runs.trigger, RunTriggers.probe),
     isNull3(runs.measurementScope)
   ];
@@ -10593,9 +10692,9 @@ function pinnedMeasurementRun(db, projectId, versionId, runId, opts = {}) {
   return db.select().from(runs).where(and11(
     eq17(runs.id, runId),
     eq17(runs.projectId, projectId),
-    opts.exactVersion ? eq17(runs.measurementPlanVersionId, versionId) : inArray7(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, projectId, versionId)),
+    opts.exactVersion ? eq17(runs.measurementPlanVersionId, versionId) : inArray8(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, projectId, versionId)),
     eq17(runs.kind, RunKinds["answer-visibility"]),
-    inArray7(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray8(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     ne5(runs.trigger, RunTriggers.probe),
     isNull3(runs.measurementScope)
   )).get();
@@ -10655,7 +10754,7 @@ function buildStoredMeasurementReport(db, projectId, revision, runId, queryClass
     eq17(runs.projectId, projectId),
     eq17(runs.measurementPlanVersionId, version.id),
     eq17(runs.kind, RunKinds["answer-visibility"]),
-    inArray7(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray8(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     ne5(runs.trigger, RunTriggers.probe)
   )).orderBy(desc5(runs.createdAt), desc5(runs.id)).get();
   let selectedRun = run;
@@ -11139,7 +11238,7 @@ function heldProviderAccounts(db, params) {
   }).from(runs).where(and13(
     eq19(runs.projectId, params.projectId),
     eq19(runs.kind, RunKinds["answer-visibility"]),
-    inArray8(runs.status, [RunStatuses.completed, RunStatuses.partial, RunStatuses.failed, RunStatuses.cancelled])
+    inArray9(runs.status, [RunStatuses.completed, RunStatuses.partial, RunStatuses.failed, RunStatuses.cancelled])
   )).orderBy(desc7(runs.createdAt), desc7(runs.id)).limit(PROVIDER_ACCOUNT_LOOKBACK).all().map((run) => ({ ...run, providers: parseRunError(run.error)?.providers ?? {} }));
   const entries = recent.flatMap((run) => Object.values(run.providers));
   const withAccountFailure = recent.filter((run) => Object.values(run.providers).some((entry) => !entry.skipped && isProviderAccountFailure(entry.code)));
@@ -11201,7 +11300,7 @@ function heldProviderAccounts(db, params) {
   }
   if (held.size === 0) return held;
   const since = [...held.values()].map((streak) => streak.since).sort()[0];
-  const settingsChanges = db.select({ entityId: auditLog.entityId, action: auditLog.action, diff: auditLog.diff, createdAt: auditLog.createdAt }).from(auditLog).where(and13(eq19(auditLog.entityType, "provider"), inArray8(auditLog.entityId, [...held.keys()]), gt2(auditLog.createdAt, since))).all();
+  const settingsChanges = db.select({ entityId: auditLog.entityId, action: auditLog.action, diff: auditLog.diff, createdAt: auditLog.createdAt }).from(auditLog).where(and13(eq19(auditLog.entityType, "provider"), inArray9(auditLog.entityId, [...held.keys()]), gt2(auditLog.createdAt, since))).all();
   for (const change of settingsChanges) {
     const streak = held.get(change.entityId ?? "");
     if (streak && change.createdAt > streak.since && providerSettingsChangeCouldFix(change.action, change.diff)) {
@@ -11358,7 +11457,7 @@ function queueRunIfProjectIdle(db, params) {
 }
 
 // ../api-routes/src/provider-batches.ts
-import { and as and14, asc as asc4, eq as eq20, inArray as inArray9 } from "drizzle-orm";
+import { and as and14, asc as asc4, eq as eq20, inArray as inArray10 } from "drizzle-orm";
 function formatProviderBatchSummary(row) {
   return {
     id: row.id,
@@ -11381,10 +11480,10 @@ function runHadProviderBatch(db, runId) {
   return db.select({ id: providerBatches.id }).from(providerBatches).where(eq20(providerBatches.runId, runId)).limit(1).get() !== void 0;
 }
 function hasOutstandingProviderBatch(db, runId) {
-  return db.select({ id: providerBatches.id }).from(providerBatches).where(and14(eq20(providerBatches.runId, runId), inArray9(providerBatches.status, [...OUTSTANDING_PROVIDER_BATCH_STATUSES]))).limit(1).get() !== void 0;
+  return db.select({ id: providerBatches.id }).from(providerBatches).where(and14(eq20(providerBatches.runId, runId), inArray10(providerBatches.status, [...OUTSTANDING_PROVIDER_BATCH_STATUSES]))).limit(1).get() !== void 0;
 }
 function readProjectRunsWithOutstandingProviderBatch(db, projectId) {
-  return db.selectDistinct({ runId: providerBatches.runId }).from(providerBatches).where(and14(eq20(providerBatches.projectId, projectId), inArray9(providerBatches.status, [...OUTSTANDING_PROVIDER_BATCH_STATUSES]))).orderBy(asc4(providerBatches.runId)).all().map((row) => row.runId);
+  return db.selectDistinct({ runId: providerBatches.runId }).from(providerBatches).where(and14(eq20(providerBatches.projectId, projectId), inArray10(providerBatches.status, [...OUTSTANDING_PROVIDER_BATCH_STATUSES]))).orderBy(asc4(providerBatches.runId)).all().map((row) => row.runId);
 }
 
 // ../api-routes/src/notification-redaction.ts
@@ -12098,7 +12197,7 @@ function aliasArraysEqual(a, b) {
 
 // ../api-routes/src/queries.ts
 import crypto15 from "crypto";
-import { and as and17, eq as eq23, inArray as inArray11, sql as sql5 } from "drizzle-orm";
+import { and as and17, eq as eq23, inArray as inArray12, sql as sql5 } from "drizzle-orm";
 
 // ../api-routes/src/query-class-read.ts
 function storedQueryClasses(db, projectId) {
@@ -12130,9 +12229,9 @@ function readQueryClasses(db, project, rows) {
 
 // ../api-routes/src/query-replace.ts
 import crypto14 from "crypto";
-import { and as and16, eq as eq22, inArray as inArray10, isNull as isNull4 } from "drizzle-orm";
+import { and as and16, eq as eq22, inArray as inArray11, isNull as isNull4 } from "drizzle-orm";
 function preserveSnapshotQueryText(tx, projectId, queryIds) {
-  const candidates = queryIds && queryIds.length > 0 ? tx.select({ id: queries.id, text: queries.query }).from(queries).where(and16(eq22(queries.projectId, projectId), inArray10(queries.id, queryIds))).all() : tx.select({ id: queries.id, text: queries.query }).from(queries).where(eq22(queries.projectId, projectId)).all();
+  const candidates = queryIds && queryIds.length > 0 ? tx.select({ id: queries.id, text: queries.query }).from(queries).where(and16(eq22(queries.projectId, projectId), inArray11(queries.id, queryIds))).all() : tx.select({ id: queries.id, text: queries.query }).from(queries).where(eq22(queries.projectId, projectId)).all();
   for (const q of candidates) {
     tx.update(querySnapshots).set({ queryText: q.text }).where(and16(eq22(querySnapshots.queryId, q.id), isNull4(querySnapshots.queryText))).run();
   }
@@ -12195,7 +12294,7 @@ function assertNoActivePlanlessSweep(tx, scope) {
   const activeRun = tx.select({ id: runs.id }).from(runs).where(and16(
     eq22(runs.projectId, scope.projectId),
     eq22(runs.kind, RunKinds["answer-visibility"]),
-    inArray10(runs.status, [RunStatuses.queued, RunStatuses.running]),
+    inArray11(runs.status, [RunStatuses.queued, RunStatuses.running]),
     isNull4(runs.measurementPlanVersionId)
   )).get();
   if (activeRun) throw runInProgress(scope.projectName, RunKinds["answer-visibility"], activeRun.id);
@@ -12248,11 +12347,11 @@ function replaceProjectQueries(tx, projectId, incomingTexts, now) {
     for (const dup of diff.duplicates) {
       tx.update(querySnapshots).set({ queryId: dup.keptId }).where(eq22(querySnapshots.queryId, dup.id)).run();
     }
-    tx.delete(queries).where(inArray10(queries.id, diff.duplicates.map((d) => d.id))).run();
+    tx.delete(queries).where(inArray11(queries.id, diff.duplicates.map((d) => d.id))).run();
   }
   if (diff.removed.length > 0) {
     const removedIds = diff.removed.map((r) => r.id);
-    tx.delete(queries).where(inArray10(queries.id, removedIds)).run();
+    tx.delete(queries).where(inArray11(queries.id, removedIds)).run();
   }
   for (const keptRow of diff.kept) {
     if (keptRow.currentText !== keptRow.incomingText) {
@@ -12350,9 +12449,9 @@ async function queryRoutes(app, opts) {
     let snapshotsDetached = 0;
     let affectedQueries = 0;
     if (removedIds.length > 0) {
-      const snapshotCount = app.db.select({ n: sql5`count(*)` }).from(querySnapshots).where(inArray11(querySnapshots.queryId, removedIds)).get();
+      const snapshotCount = app.db.select({ n: sql5`count(*)` }).from(querySnapshots).where(inArray12(querySnapshots.queryId, removedIds)).get();
       snapshotsDetached = snapshotCount?.n ?? 0;
-      const distinctAffected = app.db.select({ n: sql5`count(distinct ${querySnapshots.queryId})` }).from(querySnapshots).where(inArray11(querySnapshots.queryId, removedIds)).get();
+      const distinctAffected = app.db.select({ n: sql5`count(distinct ${querySnapshots.queryId})` }).from(querySnapshots).where(inArray12(querySnapshots.queryId, removedIds)).get();
       affectedQueries = distinctAffected?.n ?? 0;
     }
     return reply.send({
@@ -12633,7 +12732,7 @@ import { and as and22, eq as eq29 } from "drizzle-orm";
 
 // ../api-routes/src/competitor-auto-aliases.ts
 import { setImmediate as yieldToEventLoop2 } from "timers/promises";
-import { and as and18, asc as asc5, desc as desc8, eq as eq24, inArray as inArray12 } from "drizzle-orm";
+import { and as and18, asc as asc5, desc as desc8, eq as eq24, inArray as inArray13 } from "drizzle-orm";
 var SCAN_PAGE_SIZE = 200;
 async function scanCompetitorAutoAliasEvidence(db, project, opts = {}) {
   const tracked = readStoredCompetitors(db, project.id);
@@ -12652,7 +12751,7 @@ async function scanCompetitorAutoAliasEvidence(db, project, opts = {}) {
   const runRows = tracked.length === 0 && market.length === 0 ? [] : db.select({ id: runs.id, createdAt: runs.createdAt, planVersionId: runs.measurementPlanVersionId }).from(runs).where(and18(
     eq24(runs.projectId, project.id),
     eq24(runs.kind, RunKinds["answer-visibility"]),
-    inArray12(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray13(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     notProbeRun()
   )).orderBy(desc8(runs.createdAt), desc8(runs.id)).limit(AUTO_ALIAS_SCAN_MAX_RUNS).all();
   const pause = () => opts.yieldToEventLoop === false ? Promise.resolve() : yieldToEventLoop2();
@@ -12674,7 +12773,7 @@ async function scanCompetitorAutoAliasEvidence(db, project, opts = {}) {
         rawResponse: querySnapshots.rawResponse,
         executionId: querySnapshots.measurementExecutionId,
         createdAt: querySnapshots.createdAt
-      }).from(querySnapshots).where(inArray12(querySnapshots.id, ids.slice(offset, offset + SCAN_PAGE_SIZE))).all();
+      }).from(querySnapshots).where(inArray13(querySnapshots.id, ids.slice(offset, offset + SCAN_PAGE_SIZE))).all();
       scannedSnapshots += rows.length;
       for (const row of rows) {
         accumulator.add({
@@ -12850,10 +12949,10 @@ function createProjectPassQueue(run, opts = {}) {
 }
 
 // ../api-routes/src/competitor-change-preview.ts
-import { and as and21, eq as eq28, inArray as inArray14 } from "drizzle-orm";
+import { and as and21, eq as eq28, inArray as inArray15 } from "drizzle-orm";
 
 // ../api-routes/src/competitor-landscape.ts
-import { and as and20, desc as desc9, eq as eq27, gte as gte3, inArray as inArray13, isNull as isNull5, or as or4, sql as sql6 } from "drizzle-orm";
+import { and as and20, desc as desc9, eq as eq27, gte as gte3, inArray as inArray14, isNull as isNull5, or as or4, sql as sql6 } from "drizzle-orm";
 
 // ../api-routes/src/mention-share-inputs.ts
 import { eq as eq25 } from "drizzle-orm";
@@ -13714,8 +13813,8 @@ function selectLandscapePopulation(app, projectName, filters, selection) {
   const candidateRuns = app.db.select().from(runs).where(and20(
     eq27(runs.projectId, project.id),
     eq27(runs.kind, RunKinds["answer-visibility"]),
-    selection?.runIds ? inArray13(runs.id, [...selection.runIds]) : void 0,
-    latestRunIds ? inArray13(runs.id, latestRunIds) : filters.runId ? eq27(runs.id, filters.runId) : void 0,
+    selection?.runIds ? inArray14(runs.id, [...selection.runIds]) : void 0,
+    latestRunIds ? inArray14(runs.id, latestRunIds) : filters.runId ? eq27(runs.id, filters.runId) : void 0,
     cutoff ? gte3(runs.createdAt, cutoff) : void 0
   )).all();
   const advanced = filters.groupKey || filters.scope === "all-markets" ? resolveAdvancedScope(app, project.id, filters.groupKey ? "group" : "all-markets", filters.groupKey, candidateRuns) : null;
@@ -13746,7 +13845,7 @@ function selectLandscapePopulation(app, projectName, filters, selection) {
     location: querySnapshots.location,
     measurementExecutionId: querySnapshots.measurementExecutionId,
     createdAt: querySnapshots.createdAt
-  }).from(querySnapshots).where(inArray13(querySnapshots.runId, candidateRuns.map((run) => run.id))).all();
+  }).from(querySnapshots).where(inArray14(querySnapshots.runId, candidateRuns.map((run) => run.id))).all();
   const runById = new Map(candidateRuns.map((run) => [run.id, run]));
   const selectedIds = selection?.snapshotIds ? new Set(selection.snapshotIds) : null;
   const inScope = allSnapshots.filter((snapshot) => (!selectedIds || selectedIds.has(snapshot.id)) && snapshotMatchesFilters({
@@ -13773,7 +13872,7 @@ function selectLandscapePopulation(app, projectName, filters, selection) {
     );
   }
   const hydratedInScope = selection?.answerTextCap === void 0 || eligibleSnapshots.length === 0 ? inScope : (() => {
-    const answerTextById = new Map(app.db.select({ id: querySnapshots.id, answerText: querySnapshots.answerText }).from(querySnapshots).where(inArray13(querySnapshots.id, eligibleSnapshots.map((snapshot) => snapshot.id))).all().map((row) => [row.id, row.answerText]));
+    const answerTextById = new Map(app.db.select({ id: querySnapshots.id, answerText: querySnapshots.answerText }).from(querySnapshots).where(inArray14(querySnapshots.id, eligibleSnapshots.map((snapshot) => snapshot.id))).all().map((row) => [row.id, row.answerText]));
     return inScope.map((snapshot) => eligibleRuns.has(snapshot.runId) ? { ...snapshot, answerText: answerTextById.get(snapshot.id) ?? null } : snapshot);
   })();
   return {
@@ -13810,7 +13909,7 @@ function latestSweepRuns(db, projectId) {
   const candidates = db.select().from(runs).where(and20(
     eq27(runs.projectId, projectId),
     eq27(runs.kind, RunKinds["answer-visibility"]),
-    inArray13(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray14(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     notProbeRun(),
     // A scoped spot check is never the latest sweep.
     isNull5(runs.measurementScope)
@@ -13863,7 +13962,7 @@ function readCompetitorIdentityChangedAt(db, projectId) {
   const row = db.select({ at: sql6`max(${auditLog.createdAt})` }).from(auditLog).where(and20(
     eq27(auditLog.projectId, projectId),
     or4(
-      inArray13(auditLog.action, COMPETITOR_NAME_CHANGE_ACTIONS),
+      inArray14(auditLog.action, COMPETITOR_NAME_CHANGE_ACTIONS),
       sql6`(json_valid(${diff}) AND (
           json_type(${diff}, '$.aliasChanges') = 'array'
           OR json_type(${diff}, '$.autoAliasChanges') = 'array'
@@ -14114,7 +14213,7 @@ function frozenRunScopes(db, projectId, kind, groupKey, candidateRuns) {
   const planVersionIds = [...new Set(candidateRuns.map((run) => run.measurementPlanVersionId).filter((id) => typeof id === "string" && id.length > 0))];
   const historicalVersions = planVersionIds.length === 0 ? [] : db.select().from(measurementPlanVersions).where(and20(
     eq27(measurementPlanVersions.projectId, projectId),
-    inArray13(measurementPlanVersions.id, planVersionIds)
+    inArray14(measurementPlanVersions.id, planVersionIds)
   )).all();
   const frozenByVersionId = new Map(historicalVersions.map((version) => [
     version.id,
@@ -14288,7 +14387,7 @@ function previewCompetitorShareImpact(app, projectName, after, options = {}) {
   const before = shareOfVoiceFromLandscape(beforeLandscape, queryClass);
   const afterShare = shareOfVoiceFromLandscape(afterLandscape, queryClass);
   const runIds = beforeLandscape.runIds ?? [];
-  const sweepAt = runIds.length === 0 ? null : app.db.select({ createdAt: runs.createdAt }).from(runs).where(and21(eq28(runs.projectId, project.id), inArray14(runs.id, runIds))).all().map((row) => row.createdAt).sort().at(-1) ?? null;
+  const sweepAt = runIds.length === 0 ? null : app.db.select({ createdAt: runs.createdAt }).from(runs).where(and21(eq28(runs.projectId, project.id), inArray15(runs.id, runIds))).all().map((row) => row.createdAt).sort().at(-1) ?? null;
   const caveats = [];
   if (queryClass === "pooled") caveats.push(CompetitorShareImpactCaveats["pooled"]);
   if (runIds.length === 0) caveats.push(CompetitorShareImpactCaveats["no-latest-sweep"]);
@@ -14938,13 +15037,13 @@ async function competitorSuggestionRoutes(app) {
 
 // ../api-routes/src/runs.ts
 import crypto18 from "crypto";
-import { and as and25, eq as eq33, ne as ne7, asc as asc7, desc as desc12, inArray as inArray17, notInArray, or as or6, sql as sql9 } from "drizzle-orm";
+import { and as and25, eq as eq33, ne as ne7, asc as asc7, desc as desc12, inArray as inArray18, notInArray, or as or6, sql as sql9 } from "drizzle-orm";
 import { z as z3 } from "zod";
 import { gte as gte4 } from "drizzle-orm";
 
 // ../api-routes/src/run-fill.ts
 import crypto16 from "crypto";
-import { and as and23, desc as desc10, eq as eq31, gt as gt3, inArray as inArray15, isNull as isNull6, ne as ne6, or as or5, sql as sql7 } from "drizzle-orm";
+import { and as and23, desc as desc10, eq as eq31, gt as gt3, inArray as inArray16, isNull as isNull6, ne as ne6, or as or5, sql as sql7 } from "drizzle-orm";
 var ACTIVE_STATUSES = ["queued", "running"];
 function normalizeProvider(value) {
   return value.trim().toLocaleLowerCase("en");
@@ -14974,7 +15073,7 @@ function newerFullSweep(db, run) {
     isNull6(runs.queries),
     gt3(runs.createdAt, run.createdAt),
     or5(
-      inArray15(runs.status, ["queued", "running", "completed", "partial"]),
+      inArray16(runs.status, ["queued", "running", "completed", "partial"]),
       sql7`EXISTS (SELECT 1 FROM ${querySnapshots} WHERE ${querySnapshots.runId} = ${runs.id})`
     )
   )).orderBy(desc10(runs.createdAt)).get();
@@ -15120,13 +15219,13 @@ function latestFillFor(db, runId) {
   return db.select().from(runFills).where(eq31(runFills.runId, runId)).orderBy(desc10(runFills.createdAt), desc10(runFills.id)).get();
 }
 function activeFillFor(db, projectId) {
-  return db.select().from(runFills).where(and23(eq31(runFills.projectId, projectId), inArray15(runFills.status, [...ACTIVE_STATUSES]))).get();
+  return db.select().from(runFills).where(and23(eq31(runFills.projectId, projectId), inArray16(runFills.status, [...ACTIVE_STATUSES]))).get();
 }
 function activeSweepFor(db, projectId) {
   return db.select({ id: runs.id }).from(runs).where(and23(
     eq31(runs.projectId, projectId),
     eq31(runs.kind, RunKinds["answer-visibility"]),
-    inArray15(runs.status, [...ACTIVE_STATUSES])
+    inArray16(runs.status, [...ACTIVE_STATUSES])
   )).get();
 }
 function readRunCompleteness(db, run, input = {}) {
@@ -15190,7 +15289,7 @@ function queueRunFill(db, runId, input = {}) {
 
 // ../api-routes/src/seo.ts
 import crypto17 from "crypto";
-import { and as and24, asc as asc6, desc as desc11, eq as eq32, inArray as inArray16, isNotNull as isNotNull3, sql as sql8 } from "drizzle-orm";
+import { and as and24, asc as asc6, desc as desc11, eq as eq32, inArray as inArray17, isNotNull as isNotNull3, sql as sql8 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-scope-options.ts
 function marketLinks(keys, settings) {
@@ -15571,7 +15670,7 @@ async function seoRoutes(app, opts) {
     return profileDto(row);
   };
   const tasks = (id) => currentSeoTasks(app.db.select().from(seoTasks).where(eq32(seoTasks.jobId, id)).orderBy(asc6(seoTasks.id)).all());
-  const taskCounts = (ids) => ids.length ? app.db.select({ jobId: seoTasks.jobId, status: seoTasks.status, count: sql8`count(*)` }).from(seoTasks).where(and24(inArray16(seoTasks.jobId, ids), currentSeoTaskCondition())).groupBy(seoTasks.jobId, seoTasks.status).all() : [];
+  const taskCounts = (ids) => ids.length ? app.db.select({ jobId: seoTasks.jobId, status: seoTasks.status, count: sql8`count(*)` }).from(seoTasks).where(and24(inArray17(seoTasks.jobId, ids), currentSeoTaskCondition())).groupBy(seoTasks.jobId, seoTasks.status).all() : [];
   const runSummary = (row) => runDto(row, taskCounts([row.id]));
   const job = (projectId, id) => {
     const row = app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId), eq32(seoJobs.id, id))).get();
@@ -15586,7 +15685,7 @@ async function seoRoutes(app, opts) {
       if (query.profileId && row.profileId !== query.profileId) throw validationError("The SEO run does not belong to this profile.");
       return row;
     }
-    return app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId), query.profileId ? eq32(seoJobs.profileId, query.profileId) : void 0, evidenceOnly ? inArray16(seoJobs.status, [SeoRunStatuses.completed, SeoRunStatuses.partial]) : void 0)).orderBy(desc11(seoJobs.createdAt), sql8`seo_jobs.rowid DESC`).get() ?? null;
+    return app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId), query.profileId ? eq32(seoJobs.profileId, query.profileId) : void 0, evidenceOnly ? inArray17(seoJobs.status, [SeoRunStatuses.completed, SeoRunStatuses.partial]) : void 0)).orderBy(desc11(seoJobs.createdAt), sql8`seo_jobs.rowid DESC`).get() ?? null;
   };
   const queryInput = (value) => {
     const raw = value ?? {};
@@ -15597,7 +15696,7 @@ async function seoRoutes(app, opts) {
   const status = (projectId) => {
     const runtime = getRuntime();
     const latest = app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId))).orderBy(desc11(seoJobs.createdAt)).get();
-    const last = app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId), inArray16(seoJobs.status, [SeoRunStatuses.completed, SeoRunStatuses.partial]))).orderBy(desc11(seoJobs.finishedAt)).get();
+    const last = app.db.select().from(seoJobs).where(and24(eq32(seoJobs.projectId, projectId), isNotNull3(seoJobs.runId), inArray17(seoJobs.status, [SeoRunStatuses.completed, SeoRunStatuses.partial]))).orderBy(desc11(seoJobs.finishedAt)).get();
     const available = !!runtime?.connections.length && !!opts.onSeoRunRequested;
     return { available, reason: available ? null : "SEO execution is not configured on this host.", capabilities: [...new Set(runtime?.connections.flatMap((connection) => [...connection.adapter.capabilities]) ?? [])], profileCount: profiles(projectId).length, latestRunId: latest?.id ?? null, latestRunStatus: latest?.status ?? null, lastCompletedAt: last?.finishedAt ?? null };
   };
@@ -16219,7 +16318,7 @@ async function runRoutes(app, opts) {
     const terminalStatuses = /* @__PURE__ */ new Set(["completed", "partial", "failed", "cancelled"]);
     if (terminalStatuses.has(run.status)) throw runNotCancellable(run.id, run.status);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const cancelled = app.db.update(runs).set({ status: "cancelled", finishedAt: now, error: serializeRunError({ message: "Cancelled by user" }) }).where(and25(eq33(runs.id, run.id), inArray17(runs.status, ["queued", "running"]))).run();
+    const cancelled = app.db.update(runs).set({ status: "cancelled", finishedAt: now, error: serializeRunError({ message: "Cancelled by user" }) }).where(and25(eq33(runs.id, run.id), inArray18(runs.status, ["queued", "running"]))).run();
     if (cancelled.changes === 0) {
       const current = app.db.select().from(runs).where(eq33(runs.id, run.id)).get();
       if (!current) throw notFound("Run", run.id);
@@ -17556,7 +17655,7 @@ async function measurementServiceRoutes(app, opts) {
 
 // ../api-routes/src/measurement-draft.ts
 import crypto22 from "crypto";
-import { and as and27, asc as asc8, desc as desc14, eq as eq35, inArray as inArray18 } from "drizzle-orm";
+import { and as and27, asc as asc8, desc as desc14, eq as eq35, inArray as inArray19 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-draft-compile.ts
 var MEASUREMENT_DRAFT_MAX_TARGETS = 1e3;
@@ -20148,7 +20247,7 @@ async function measurementDraftRoutes(app, opts = {}) {
       // The comparable chain, not the bare active id: a label-only
       // republish must not flip setup back to awaiting_first_run while
       // the overview keeps serving the prior run.
-      inArray18(runs.measurementPlanVersionId, comparableMeasurementVersionIds(app.db, project.id, active.id)),
+      inArray19(runs.measurementPlanVersionId, comparableMeasurementVersionIds(app.db, project.id, active.id)),
       eq35(runs.status, RunStatuses.completed)
     )).get() : void 0;
     const state = activeSchemaVersion === 1 ? "republish_required" : draft ? "setup_in_progress" : active ? completedRun ? "operational" : "awaiting_first_run" : "simple";
@@ -20848,7 +20947,7 @@ async function measurementDraftRoutes(app, opts = {}) {
     const sets = app.db.select().from(measurementQuerySets).where(eq35(measurementQuerySets.projectId, project.id)).orderBy(asc8(measurementQuerySets.name)).all();
     const counts2 = /* @__PURE__ */ new Map();
     if (sets.length) {
-      for (const item2 of app.db.select({ querySetId: measurementQuerySetItems.querySetId }).from(measurementQuerySetItems).where(inArray18(measurementQuerySetItems.querySetId, sets.map((set) => set.id))).all()) {
+      for (const item2 of app.db.select({ querySetId: measurementQuerySetItems.querySetId }).from(measurementQuerySetItems).where(inArray19(measurementQuerySetItems.querySetId, sets.map((set) => set.id))).all()) {
         counts2.set(item2.querySetId, (counts2.get(item2.querySetId) ?? 0) + 1);
       }
     }
@@ -21783,10 +21882,10 @@ async function measurementPropertyEvidenceRoutes(app) {
 
 // ../api-routes/src/measurement-portfolio-reads.ts
 import { createHash as createHash5 } from "crypto";
-import { and as and31, desc as desc15, eq as eq39, inArray as inArray20, lt as lt4, or as or7 } from "drizzle-orm";
+import { and as and31, desc as desc15, eq as eq39, inArray as inArray21, lt as lt4, or as or7 } from "drizzle-orm";
 
 // ../api-routes/src/measurement-question-reads.ts
-import { and as and30, eq as eq38, getTableColumns, inArray as inArray19, sql as sql10 } from "drizzle-orm";
+import { and as and30, eq as eq38, getTableColumns, inArray as inArray20, sql as sql10 } from "drizzle-orm";
 var DEFAULT_LIMIT2 = 50;
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   RunStatuses.completed,
@@ -21896,7 +21995,7 @@ function selectedQuestionSnapshots(db, runId, manifest, scope) {
   if (scope !== void 0) {
     const executionIds = [...new Set(manifest.expectedSlots.map((slot) => slot.executionId))];
     if (executionIds.length === 0) return [];
-    conditions.push(inArray19(querySnapshots.measurementExecutionId, executionIds));
+    conditions.push(inArray20(querySnapshots.measurementExecutionId, executionIds));
   }
   if (scope?.provider !== void 0) {
     conditions.push(sql10`lower(trim(${querySnapshots.provider})) = ${normalizeIdentityText(scope.provider)}`);
@@ -21911,7 +22010,7 @@ function rawResponsesForLegacyQuestionSnapshots(db, runId, snapshots) {
     rawResponse: querySnapshots.rawResponse
   }).from(querySnapshots).where(and30(
     eq38(querySnapshots.runId, runId),
-    inArray19(querySnapshots.id, legacyIds)
+    inArray20(querySnapshots.id, legacyIds)
   )).all().map((snapshot) => [snapshot.id, snapshot.rawResponse]));
 }
 function withLegacyRawEvidence(db, runId, snapshots) {
@@ -23077,9 +23176,9 @@ function previousComparableRun(db, active, current) {
     // republish: a run pinned to a comparable prior revision measured exactly
     // the questions the active revision asks. The execution-identity and scope
     // checks below still gate what actually compares.
-    inArray20(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, current.projectId, active.version.id)),
+    inArray21(runs.measurementPlanVersionId, comparableMeasurementVersionIds(db, current.projectId, active.version.id)),
     eq39(runs.kind, RunKinds["answer-visibility"]),
-    inArray20(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray21(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     or7(
       lt4(runs.createdAt, current.createdAt),
       and31(eq39(runs.createdAt, current.createdAt), lt4(runs.id, current.id))
@@ -23490,7 +23589,7 @@ async function measurementPortfolioReadRoutes(app) {
 
 // ../api-routes/src/visibility-report.ts
 import { createHash as createHash7 } from "crypto";
-import { and as and32, desc as desc16, eq as eq40, gte as gte5, inArray as inArray21, isNotNull as isNotNull4, isNull as isNull7, lt as lt5, lte as lte5, or as or8 } from "drizzle-orm";
+import { and as and32, desc as desc16, eq as eq40, gte as gte5, inArray as inArray22, isNotNull as isNotNull4, isNull as isNull7, lt as lt5, lte as lte5, or as or8 } from "drizzle-orm";
 
 // ../api-routes/src/visibility-report-reader.ts
 import { createHash as createHash6 } from "crypto";
@@ -24275,7 +24374,7 @@ function loadVisibilitySnapshots(db, runIds) {
     requestedContext: querySnapshots.requestedContext,
     supportedContext: querySnapshots.supportedContext,
     createdAt: querySnapshots.createdAt
-  }).from(querySnapshots).where(inArray21(querySnapshots.runId, [...runIds])).all();
+  }).from(querySnapshots).where(inArray22(querySnapshots.runId, [...runIds])).all();
   for (const row of rows) {
     const snapshots = byRun.get(row.runId) ?? [];
     snapshots.push(row);
@@ -24696,7 +24795,7 @@ function completedVisibilityRuns(db, projectId, planless, query) {
   return db.select().from(runs).where(and32(
     eq40(runs.projectId, projectId),
     eq40(runs.kind, RunKinds["answer-visibility"]),
-    inArray21(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray22(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     notProbeRun(),
     planless ? isNull7(runs.measurementPlanVersionId) : isNotNull4(runs.measurementPlanVersionId),
     // A scoped spot check is never a whole-project sweep. It can be inspected
@@ -24711,7 +24810,7 @@ function previousEligibleVisibilityRun(db, projectId, planless, selected) {
   return db.select().from(runs).where(and32(
     eq40(runs.projectId, projectId),
     eq40(runs.kind, RunKinds["answer-visibility"]),
-    inArray21(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray22(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     notProbeRun(),
     planless ? isNull7(runs.measurementPlanVersionId) : isNotNull4(runs.measurementPlanVersionId),
     isNull7(runs.measurementScope),
@@ -24850,7 +24949,7 @@ function frozenSimpleDefinitions(db, projectId, runIds) {
   if (runIds.length === 0) return /* @__PURE__ */ new Map();
   return new Map(db.select().from(simpleMeasurementDefinitions).where(and32(
     eq40(simpleMeasurementDefinitions.projectId, projectId),
-    inArray21(simpleMeasurementDefinitions.runId, [...runIds])
+    inArray22(simpleMeasurementDefinitions.runId, [...runIds])
   )).all().map((row) => [row.runId, row.definition]));
 }
 function simpleRunInput(db, project, run, definition2, includeEvidence) {
@@ -24919,7 +25018,7 @@ function readVisibilityComparisonRuns(db, projectId, since, until, includeEviden
   const sourceRuns = db.select().from(runs).where(and32(
     eq40(runs.projectId, projectId),
     eq40(runs.kind, RunKinds["answer-visibility"]),
-    inArray21(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray22(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     notProbeRun(),
     isNotNull4(runs.measurementPlanVersionId),
     isNull7(runs.measurementScope),
@@ -24949,7 +25048,7 @@ function readVisibilityComparisonRuns(db, projectId, since, until, includeEviden
 
 // ../api-routes/src/query-tracking.ts
 import crypto24 from "crypto";
-import { and as and33, desc as desc17, eq as eq41, inArray as inArray22, isNotNull as isNotNull5, isNull as isNull8, ne as ne8 } from "drizzle-orm";
+import { and as and33, desc as desc17, eq as eq41, inArray as inArray23, isNotNull as isNotNull5, isNull as isNull8, ne as ne8 } from "drizzle-orm";
 
 // ../api-routes/src/embed-queries.ts
 function embedQueryWriteLimit(request) {
@@ -25156,7 +25255,7 @@ function simpleMeasuredAtByQuery(db, project, queryRows2, opts) {
   }).from(runs).where(and33(
     eq41(runs.projectId, project.id),
     eq41(runs.kind, RunKinds["answer-visibility"]),
-    inArray22(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray23(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     ne8(runs.trigger, RunTriggers.probe),
     isNull8(runs.measurementScope),
     isNull8(runs.measurementPlanVersionId)
@@ -25168,7 +25267,7 @@ function simpleMeasuredAtByQuery(db, project, queryRows2, opts) {
     definition: simpleMeasurementDefinitions.definition
   }).from(simpleMeasurementDefinitions).where(and33(
     eq41(simpleMeasurementDefinitions.projectId, project.id),
-    inArray22(simpleMeasurementDefinitions.runId, eligibleRuns.map((run) => run.id))
+    inArray23(simpleMeasurementDefinitions.runId, eligibleRuns.map((run) => run.id))
   )).all()) {
     const parsed = simpleMeasurementDefinitionSchema.safeParse(row.definition);
     if (parsed.success) frozenByRun.set(row.runId, parsed.data);
@@ -25180,7 +25279,7 @@ function simpleMeasuredAtByQuery(db, project, queryRows2, opts) {
     queryId: querySnapshots.queryId,
     queryText: querySnapshots.queryText,
     provider: querySnapshots.provider
-  }).from(querySnapshots).where(inArray22(querySnapshots.runId, [...frozenByRun.keys()])).all()) {
+  }).from(querySnapshots).where(inArray23(querySnapshots.runId, [...frozenByRun.keys()])).all()) {
     if (!snapshot.queryId) continue;
     const byQuery = snapshotsByRunQuery.get(snapshot.runId) ?? /* @__PURE__ */ new Map();
     const rows = byQuery.get(snapshot.queryId) ?? [];
@@ -25278,7 +25377,7 @@ function measuredAtByQuery(db, state, opts) {
   const eligibleRuns = db.select().from(runs).where(and33(
     eq41(runs.projectId, project.id),
     eq41(runs.kind, RunKinds["answer-visibility"]),
-    inArray22(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+    inArray23(runs.status, [RunStatuses.completed, RunStatuses.partial]),
     ne8(runs.trigger, RunTriggers.probe),
     isNull8(runs.measurementScope),
     isNotNull5(runs.measurementPlanVersionId)
@@ -25291,7 +25390,7 @@ function measuredAtByQuery(db, state, opts) {
     canonicalJson: measurementPlanVersions.canonicalJson
   }).from(measurementPlanVersions).where(and33(
     eq41(measurementPlanVersions.projectId, project.id),
-    inArray22(measurementPlanVersions.id, versionIds)
+    inArray23(measurementPlanVersions.id, versionIds)
   )).all().flatMap((row) => {
     const parsed = parseStoredMeasurementPlanAnyVersion(row.canonicalJson);
     return parsed.schemaVersion === 2 ? [[row.id, { revision: row.revision, plan: parsed }]] : [];
@@ -25323,7 +25422,7 @@ function measuredAtByQuery(db, state, opts) {
     measurementExecutionId: querySnapshots.measurementExecutionId,
     requestedContext: querySnapshots.requestedContext,
     supportedContext: querySnapshots.supportedContext
-  }).from(querySnapshots).where(inArray22(querySnapshots.runId, eligibleRuns.map((run) => run.id))).all();
+  }).from(querySnapshots).where(inArray23(querySnapshots.runId, eligibleRuns.map((run) => run.id))).all();
   for (const snapshot of snapshotRows) {
     const snapshots = snapshotsByRun.get(snapshot.runId) ?? [];
     snapshots.push(snapshot);
@@ -26332,7 +26431,7 @@ function writeAdvancedCandidate(tx, candidate, request, now) {
   const removed = current.filter((row) => !candidate.queryRows.has(row.id));
   if (removed.length > 0) {
     preserveSnapshotQueryText(tx, candidate.state.project.id, removed.map((row) => row.id));
-    tx.delete(queries).where(inArray22(queries.id, removed.map((row) => row.id))).run();
+    tx.delete(queries).where(inArray23(queries.id, removed.map((row) => row.id))).run();
   }
   for (const row of candidate.queryRows.values()) {
     const previous = currentById.get(row.id);
@@ -27379,7 +27478,7 @@ async function applyRoutes(app, opts) {
 }
 
 // ../api-routes/src/history.ts
-import { and as and36, asc as asc9, count as count2, getTableColumns as getTableColumns2, desc as desc18, eq as eq45, gte as gte6, inArray as inArray23, like as like3, lte as lte6, ne as ne9, notInArray as notInArray2, or as or9, sql as sql11 } from "drizzle-orm";
+import { and as and36, asc as asc9, count as count2, getTableColumns as getTableColumns2, desc as desc18, eq as eq45, gte as gte6, inArray as inArray24, like as like3, lte as lte6, ne as ne9, notInArray as notInArray2, or as or9, sql as sql11 } from "drizzle-orm";
 async function historyRoutes(app) {
   app.post("/projects/:name/results/clear", async (request) => {
     requireAdminSession(request);
@@ -27389,27 +27488,27 @@ async function historyRoutes(app) {
     if (!parsed.success) throw validationError("Invalid history cleanup request", { issues: parsed.error.issues });
     const input = parsed.data;
     return app.db.transaction((tx) => {
-      const active = tx.select({ id: runs.id }).from(runs).where(and36(eq45(runs.projectId, project.id), eq45(runs.kind, RunKinds["answer-visibility"]), inArray23(runs.status, ["queued", "running"]))).get();
-      const activeResearch = tx.select({ id: researchRuns.id }).from(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray23(researchRuns.status, ["queued", "running"]))).get();
+      const active = tx.select({ id: runs.id }).from(runs).where(and36(eq45(runs.projectId, project.id), eq45(runs.kind, RunKinds["answer-visibility"]), inArray24(runs.status, ["queued", "running"]))).get();
+      const activeResearch = tx.select({ id: researchRuns.id }).from(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray24(researchRuns.status, ["queued", "running"]))).get();
       if (active || activeResearch) throw runInProgress(project.name, active ? "answer-visibility" : "research", (active ?? activeResearch).id);
-      const activeFill = tx.select({ id: runFills.id, runId: runFills.runId }).from(runFills).where(and36(eq45(runFills.projectId, project.id), inArray23(runFills.status, ["queued", "running"]))).get();
+      const activeFill = tx.select({ id: runFills.id, runId: runFills.runId }).from(runFills).where(and36(eq45(runFills.projectId, project.id), inArray24(runFills.status, ["queued", "running"]))).get();
       if (activeFill) throw runFillInProgress(activeFill.runId, activeFill.id);
-      const selectedRuns = tx.select({ id: runs.id, kind: runs.kind }).from(runs).where(and36(eq45(runs.projectId, project.id), inArray23(runs.id, input.runIds))).all();
-      const selectedResearch = tx.select({ id: researchRuns.id }).from(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray23(researchRuns.id, input.researchRunIds))).all();
+      const selectedRuns = tx.select({ id: runs.id, kind: runs.kind }).from(runs).where(and36(eq45(runs.projectId, project.id), inArray24(runs.id, input.runIds))).all();
+      const selectedResearch = tx.select({ id: researchRuns.id }).from(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray24(researchRuns.id, input.researchRunIds))).all();
       if (selectedRuns.length !== input.runIds.length || selectedResearch.length !== input.researchRunIds.length) throw notFound("Selected saved run in project", project.name);
       if (selectedRuns.some((run) => run.kind !== RunKinds["answer-visibility"])) throw validationError("Only answer-visibility runs and research batches can be cleared. Site Health and integration runs are preserved.");
       const result = {
         dryRun: !input.confirm,
         runIds: input.runIds,
         researchRunIds: input.researchRunIds,
-        querySnapshots: tx.select({ value: count2() }).from(querySnapshots).where(inArray23(querySnapshots.runId, input.runIds)).get().value,
-        researchQueries: tx.select({ value: count2() }).from(researchRunQueries).where(inArray23(researchRunQueries.researchRunId, input.researchRunIds)).get().value,
-        insights: tx.select({ value: count2() }).from(insights).where(inArray23(insights.runId, input.runIds)).get().value,
-        healthSnapshots: tx.select({ value: count2() }).from(healthSnapshots).where(inArray23(healthSnapshots.runId, input.runIds)).get().value
+        querySnapshots: tx.select({ value: count2() }).from(querySnapshots).where(inArray24(querySnapshots.runId, input.runIds)).get().value,
+        researchQueries: tx.select({ value: count2() }).from(researchRunQueries).where(inArray24(researchRunQueries.researchRunId, input.researchRunIds)).get().value,
+        insights: tx.select({ value: count2() }).from(insights).where(inArray24(insights.runId, input.runIds)).get().value,
+        healthSnapshots: tx.select({ value: count2() }).from(healthSnapshots).where(inArray24(healthSnapshots.runId, input.runIds)).get().value
       };
       if (input.confirm) {
-        tx.delete(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray23(researchRuns.id, input.researchRunIds))).run();
-        tx.delete(runs).where(and36(eq45(runs.projectId, project.id), inArray23(runs.id, input.runIds))).run();
+        tx.delete(researchRuns).where(and36(eq45(researchRuns.projectId, project.id), inArray24(researchRuns.id, input.researchRunIds))).run();
+        tx.delete(runs).where(and36(eq45(runs.projectId, project.id), inArray24(runs.id, input.runIds))).run();
         writeAuditLog(tx, { projectId: project.id, actor: "api", action: "results.cleared", entityType: "project", entityId: project.id, diff: result });
       }
       return result;
@@ -27462,7 +27561,7 @@ async function historyRoutes(app) {
       location: querySnapshots.location,
       rawResponse: querySnapshots.rawResponse,
       createdAt: querySnapshots.createdAt
-    }).from(querySnapshots).leftJoin(queries, eq45(querySnapshots.queryId, queries.id)).where(inArray23(querySnapshots.runId, projectRuns.map((r) => r.id))).orderBy(desc18(querySnapshots.createdAt)).all();
+    }).from(querySnapshots).leftJoin(queries, eq45(querySnapshots.queryId, queries.id)).where(inArray24(querySnapshots.runId, projectRuns.map((r) => r.id))).orderBy(desc18(querySnapshots.createdAt)).all();
     const locationFilter = request.query.location;
     const filtered = locationFilter !== void 0 ? allSnapshots.filter((s) => s.location === (locationFilter || null)) : allSnapshots;
     const total = filtered.length;
@@ -27523,7 +27622,7 @@ async function historyRoutes(app) {
       return reply.send([]);
     }
     const runIds = new Set(projectRuns.map((r) => r.id));
-    const rawSnapshots = app.db.select().from(querySnapshots).where(inArray23(querySnapshots.runId, [...runIds])).all();
+    const rawSnapshots = app.db.select().from(querySnapshots).where(inArray24(querySnapshots.runId, [...runIds])).all();
     const timelineLocationFilter = request.query.location;
     const filteredSnapshots = timelineLocationFilter !== void 0 ? rawSnapshots.filter((s) => s.location === (timelineLocationFilter || null)) : rawSnapshots;
     const allSnapshots = filteredSnapshots.map((snapshot) => ({
@@ -27644,7 +27743,7 @@ async function historyRoutes(app) {
       throw validationError("Both run1 and run2 query params are required");
     }
     const requestedRunIds = [.../* @__PURE__ */ new Set([run1, run2])];
-    const runRows = app.db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(inArray23(runs.id, requestedRunIds)).all();
+    const runRows = app.db.select({ id: runs.id, projectId: runs.projectId }).from(runs).where(inArray24(runs.id, requestedRunIds)).all();
     const runsById = new Map(runRows.map((row) => [row.id, row]));
     for (const runId of requestedRunIds) {
       const run = runsById.get(runId);
@@ -27761,7 +27860,7 @@ function parseOptionalPositiveInt(value, max2) {
 }
 
 // ../api-routes/src/analytics.ts
-import { and as and37, desc as desc19, eq as eq46, gte as gte7, inArray as inArray24, lt as lt6 } from "drizzle-orm";
+import { and as and37, desc as desc19, eq as eq46, gte as gte7, inArray as inArray25, lt as lt6 } from "drizzle-orm";
 
 // ../api-routes/src/analytics-model-attribution.ts
 function logicalSweeps(observations) {
@@ -27873,7 +27972,7 @@ async function analyticsRoutes(app) {
     const projectRuns = app.db.select().from(runs).where(and37(
       eq46(runs.projectId, project.id),
       eq46(runs.kind, RunKinds["answer-visibility"]),
-      inArray24(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+      inArray25(runs.status, [RunStatuses.completed, RunStatuses.partial]),
       notProbeRun(),
       cutoff ? gte7(runs.createdAt, cutoff) : void 0
     )).orderBy(desc19(runs.createdAt)).all().filter((r) => measuredWhole(app.db, r)).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
@@ -27922,7 +28021,7 @@ async function analyticsRoutes(app) {
       answerMentioned: querySnapshots.answerMentioned,
       mentionIdentity: querySnapshots.mentionIdentity,
       answerText: querySnapshots.answerText
-    }).from(querySnapshots).where(inArray24(querySnapshots.runId, runIds)).all();
+    }).from(querySnapshots).where(inArray25(querySnapshots.runId, runIds)).all();
     const rawSnapshots = referenceBasket ? loadedSnapshots.filter(
       (s) => s.queryId !== null || s.queryText !== null && referenceBasket.has(normalizeQueryText(s.queryText))
     ) : filterTrackedSnapshots(loadedSnapshots);
@@ -27972,7 +28071,7 @@ async function analyticsRoutes(app) {
       const anchorRunPredicate = and37(
         eq46(runs.projectId, project.id),
         eq46(runs.kind, RunKinds["answer-visibility"]),
-        inArray24(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+        inArray25(runs.status, [RunStatuses.completed, RunStatuses.partial]),
         notProbeRun(),
         lt6(runs.createdAt, cutoff)
       );
@@ -28002,7 +28101,7 @@ async function analyticsRoutes(app) {
             provider: querySnapshots.provider,
             model: querySnapshots.model,
             servedModel: querySnapshots.servedModel
-          }).from(querySnapshots).where(inArray24(querySnapshots.runId, runIds2)).all())) {
+          }).from(querySnapshots).where(inArray25(querySnapshots.runId, runIds2)).all())) {
             if (pending.has(snapshot.provider)) {
               const models = modelsByProvider.get(snapshot.provider) ?? [];
               models.push(snapshot.model);
@@ -28155,7 +28254,7 @@ async function analyticsRoutes(app) {
         answerMentioned: querySnapshots.answerMentioned,
         mentionIdentity: querySnapshots.mentionIdentity,
         answerText: querySnapshots.answerText
-      }).from(querySnapshots).where(inArray24(querySnapshots.runId, windowRunIds)).all());
+      }).from(querySnapshots).where(inArray25(querySnapshots.runId, windowRunIds)).all());
       for (const s of allWindowSnaps) {
         const timePoint = runIdToCreatedAt.get(s.runId) ?? s.runId;
         let entry = consistencyMap.get(s.queryId);
@@ -28177,7 +28276,7 @@ async function analyticsRoutes(app) {
       mentionIdentity: querySnapshots.mentionIdentity,
       answerText: querySnapshots.answerText,
       citedDomains: querySnapshots.citedDomains
-    }).from(querySnapshots).leftJoin(queries, eq46(querySnapshots.queryId, queries.id)).where(inArray24(querySnapshots.runId, latestGroupRunIds)).all());
+    }).from(querySnapshots).leftJoin(queries, eq46(querySnapshots.queryId, queries.id)).where(inArray25(querySnapshots.runId, latestGroupRunIds)).all());
     const snapshots = rawSnapshots.map((s) => ({
       ...s,
       resolvedMentioned: resolveSnapshotAnswerMentioned(s, project)
@@ -28344,7 +28443,7 @@ async function analyticsRoutes(app) {
       eq46(runs.projectId, project.id),
       eq46(runs.kind, RunKinds["answer-visibility"]),
       notProbeRun(),
-      latestRuns ? inArray24(runs.id, latestRuns.map((run) => run.id)) : requestedRunId ? eq46(runs.id, requestedRunId) : void 0
+      latestRuns ? inArray25(runs.id, latestRuns.map((run) => run.id)) : requestedRunId ? eq46(runs.id, requestedRunId) : void 0
     )).orderBy(desc19(runs.createdAt), desc19(runs.id)).all().filter((r) => r.status === "completed" || r.status === "partial").filter((r) => measuredWhole(app.db, r)).filter((r) => !cutoff || r.createdAt >= cutoff);
     if (windowRuns.length === 0) {
       return reply.send({
@@ -28377,7 +28476,7 @@ async function analyticsRoutes(app) {
       citedDomains: querySnapshots.citedDomains,
       citedUrls: querySnapshots.citedUrls,
       measurementExecutionId: querySnapshots.measurementExecutionId
-    }).from(querySnapshots).leftJoin(queries, eq46(querySnapshots.queryId, queries.id)).where(inArray24(querySnapshots.runId, windowRunIds)).all();
+    }).from(querySnapshots).leftJoin(queries, eq46(querySnapshots.queryId, queries.id)).where(inArray25(querySnapshots.runId, windowRunIds)).all();
     let unclassifiedAnswers = 0;
     let snapshots = loadedSnapshots;
     if (splitByClass) {
@@ -28730,7 +28829,7 @@ function buildCategoryCounts(counts2) {
 }
 
 // ../api-routes/src/intelligence.ts
-import { eq as eq47, desc as desc20, and as and38, inArray as inArray25, like as like4 } from "drizzle-orm";
+import { eq as eq47, desc as desc20, and as and38, inArray as inArray26, like as like4 } from "drizzle-orm";
 var SEVERITY_RANK = { low: 0, medium: 1, high: 2, critical: 3 };
 function severitiesAtOrAbove(min2) {
   const floor = SEVERITY_RANK[min2];
@@ -28866,7 +28965,7 @@ async function intelligenceRoutes(app) {
     }
     const severityFilter = request.query.severity?.trim();
     if (severityFilter) {
-      conditions.push(inArray25(insights.severity, severitiesAtOrAbove(severityFilter)));
+      conditions.push(inArray26(insights.severity, severitiesAtOrAbove(severityFilter)));
     }
     let limit;
     if (request.query.limit !== void 0) {
@@ -28904,7 +29003,7 @@ async function intelligenceRoutes(app) {
     const projectVisRuns = app.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(and38(
       eq47(runs.projectId, project.id),
       eq47(runs.kind, RunKinds["answer-visibility"]),
-      inArray25(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+      inArray26(runs.status, [RunStatuses.completed, RunStatuses.partial]),
       // Health-latest is the dashboard headline; probe runs must not
       // displace the most recent real visibility sweep.
       notProbeRun()
@@ -28914,7 +29013,7 @@ async function intelligenceRoutes(app) {
     if (latestGroupRunIds.length > 0) {
       const groupRows = app.db.select().from(healthSnapshots).where(and38(
         eq47(healthSnapshots.projectId, project.id),
-        inArray25(healthSnapshots.runId, latestGroupRunIds)
+        inArray26(healthSnapshots.runId, latestGroupRunIds)
       )).all();
       if (groupRows.length > 0) {
         return reply.send(aggregateHealthSnapshots(project.id, groupRows));
@@ -29300,7 +29399,7 @@ async function trafficAnalyticsRoutes(app) {
 }
 
 // ../api-routes/src/traffic-samples.ts
-import { and as and41, count as count3, desc as desc22, eq as eq49, gte as gte9, inArray as inArray26, lte as lte8, sql as sql14 } from "drizzle-orm";
+import { and as and41, count as count3, desc as desc22, eq as eq49, gte as gte9, inArray as inArray27, lte as lte8, sql as sql14 } from "drizzle-orm";
 var storedKind = {
   [TrafficSampleKinds.crawler]: "crawler",
   [TrafficSampleKinds["ai-user-fetch"]]: "ai_user_fetch",
@@ -29323,7 +29422,7 @@ async function trafficSamplesRoutes(app) {
     const limit = query.limit ?? 100;
     const offset = query.offset ?? 0;
     const filters = [eq49(rawEventSamples.projectId, project.id), gte9(rawEventSamples.ts, windowStart), lte8(rawEventSamples.ts, windowEnd)];
-    filters.push(query.kind && query.kind !== "all" ? eq49(rawEventSamples.eventType, storedKind[query.kind]) : inArray26(rawEventSamples.eventType, [storedKind[TrafficSampleKinds.crawler], storedKind[TrafficSampleKinds["ai-user-fetch"]], storedKind[TrafficSampleKinds["ai-referral"]]]));
+    filters.push(query.kind && query.kind !== "all" ? eq49(rawEventSamples.eventType, storedKind[query.kind]) : inArray27(rawEventSamples.eventType, [storedKind[TrafficSampleKinds.crawler], storedKind[TrafficSampleKinds["ai-user-fetch"]], storedKind[TrafficSampleKinds["ai-referral"]]]));
     if (query.sourceId) filters.push(eq49(rawEventSamples.sourceId, query.sourceId));
     if (query.path !== void 0) filters.push(sql14`${rawEventSamples.pathNormalized} LIKE ${escapeLikePattern(query.path) + "%"} ESCAPE '\\'`);
     const where = and41(...filters);
@@ -29346,7 +29445,7 @@ async function trafficSamplesRoutes(app) {
 
 // ../api-routes/src/journeys.ts
 import crypto28 from "crypto";
-import { and as and42, asc as asc10, count as count4, desc as desc23, eq as eq50, gt as gt4, gte as gte10, inArray as inArray27, lt as lt8, lte as lte9, sql as sql15 } from "drizzle-orm";
+import { and as and42, asc as asc10, count as count4, desc as desc23, eq as eq50, gt as gt4, gte as gte10, inArray as inArray28, lt as lt8, lte as lte9, sql as sql15 } from "drizzle-orm";
 import "zod";
 
 // ../api-routes/src/cloudflare-worker-version.ts
@@ -29380,7 +29479,7 @@ function persistJourneyBatch(tx, input) {
   if (extracted.length === 0) return { visitsWritten: 0, eventsStored: 0 };
   const stored = /* @__PURE__ */ new Set();
   for (const ids of chunks([...new Set(extracted.map((r) => r.eventId))])) {
-    const rows = tx.select({ id: journeyEvents.sourceEventId }).from(journeyEvents).where(and42(eq50(journeyEvents.projectId, input.projectId), eq50(journeyEvents.sourceId, input.sourceId), inArray27(journeyEvents.sourceEventId, ids))).all();
+    const rows = tx.select({ id: journeyEvents.sourceEventId }).from(journeyEvents).where(and42(eq50(journeyEvents.projectId, input.projectId), eq50(journeyEvents.sourceId, input.sourceId), inArray28(journeyEvents.sourceEventId, ids))).all();
     for (const row of rows) stored.add(row.id);
   }
   const basisByKey = /* @__PURE__ */ new Map();
@@ -29418,13 +29517,13 @@ function persistJourneyBatch(tx, input) {
   };
   const storedCappedDays = /* @__PURE__ */ new Map();
   for (const keys of chunks([...basisByKey.keys()])) {
-    for (const row of tx.select().from(journeyVisitors).where(and42(eq50(journeyVisitors.projectId, input.projectId), inArray27(journeyVisitors.visitorKey, keys))).all()) {
+    for (const row of tx.select().from(journeyVisitors).where(and42(eq50(journeyVisitors.projectId, input.projectId), inArray28(journeyVisitors.visitorKey, keys))).all()) {
       Object.assign(stateFor(row.visitorKey), { firstAiAt: row.firstAiAt, firstAiEngine: row.firstAiEngine, lastAiAt: row.lastAiAt });
       storedCappedDays.set(row.visitorKey, row.cappedDays);
     }
     for (const row of tx.select({ visitorKey: journeyVisits.visitorKey, ts: journeyEvents.ts }).from(journeyEvents).innerJoin(journeyVisits, eq50(journeyVisits.id, journeyEvents.visitId)).where(and42(
       eq50(journeyVisits.projectId, input.projectId),
-      inArray27(journeyVisits.visitorKey, keys),
+      inArray28(journeyVisits.visitorKey, keys),
       eq50(journeyEvents.aiTouch, true),
       gte10(journeyEvents.ts, lookbackStart),
       lte9(journeyEvents.ts, latestIso)
@@ -29434,7 +29533,7 @@ function persistJourneyBatch(tx, input) {
     const day = sql15`substr(${journeyEvents.ts}, 1, 10)`;
     for (const row of tx.select({ visitorKey: journeyVisits.visitorKey, day, total: count4() }).from(journeyEvents).innerJoin(journeyVisits, eq50(journeyVisits.id, journeyEvents.visitId)).where(and42(
       eq50(journeyVisits.projectId, input.projectId),
-      inArray27(journeyVisits.visitorKey, keys),
+      inArray28(journeyVisits.visitorKey, keys),
       gte10(journeyEvents.ts, `${firstDay}T00:00:00.000Z`),
       lt8(journeyEvents.ts, dayAfterLast)
     )).groupBy(journeyVisits.visitorKey, day).all()) {
@@ -29442,7 +29541,7 @@ function persistJourneyBatch(tx, input) {
     }
     for (const row of tx.select().from(journeyVisits).where(and42(
       eq50(journeyVisits.projectId, input.projectId),
-      inArray27(journeyVisits.visitorKey, keys),
+      inArray28(journeyVisits.visitorKey, keys),
       lte9(journeyVisits.startedAt, windowEnd),
       gte10(journeyVisits.endedAt, windowStart)
     )).all()) {
@@ -29561,7 +29660,7 @@ function recomputeVisitTotals(tx, visitIds) {
     endedAt: sql15`coalesce(${of(sql15`max(${journeyEvents.ts})`)}, ${journeyVisits.endedAt})`,
     requestCount: of(sql15`count(*)`),
     pageCount: of(sql15`count(*) FILTER (WHERE ${journeyEvents.kind} = 'page')`)
-  }).where(inArray27(journeyVisits.id, [...visitIds])).run();
+  }).where(inArray28(journeyVisits.id, [...visitIds])).run();
 }
 function recordJourneyBatch(tx, input, handlers) {
   if (!input.secret || input.events.length === 0) return { visitsWritten: 0, eventsStored: 0 };
@@ -29636,7 +29735,7 @@ function visitorDto(visitor, visits) {
 function visitsByVisitor(db, projectId, keys) {
   const out = /* @__PURE__ */ new Map();
   for (const part of chunks(keys)) {
-    for (const row of db.select().from(journeyVisits).where(and42(eq50(journeyVisits.projectId, projectId), inArray27(journeyVisits.visitorKey, part))).orderBy(asc10(journeyVisits.startedAt)).all()) {
+    for (const row of db.select().from(journeyVisits).where(and42(eq50(journeyVisits.projectId, projectId), inArray28(journeyVisits.visitorKey, part))).orderBy(asc10(journeyVisits.startedAt)).all()) {
       const list = out.get(row.visitorKey);
       if (list) list.push(row);
       else out.set(row.visitorKey, [row]);
@@ -29652,7 +29751,7 @@ function partialSources(db, projectId) {
     status: trafficSources.status,
     configJson: trafficSources.configJson,
     lastWorkerVersion: trafficSources.lastWorkerVersion
-  }).from(trafficSources).where(and42(eq50(trafficSources.projectId, projectId), inArray27(trafficSources.sourceType, types))).orderBy(asc10(trafficSources.id)).all();
+  }).from(trafficSources).where(and42(eq50(trafficSources.projectId, projectId), inArray28(trafficSources.sourceType, types))).orderBy(asc10(trafficSources.id)).all();
   const out = [];
   for (const row of rows) {
     if (row.status === TrafficSourceStatuses.archived) continue;
@@ -29762,7 +29861,7 @@ async function journeyRoutes(app) {
     const page3 = visits.slice(offset, offset + limit);
     const events = /* @__PURE__ */ new Map();
     for (const part of chunks(page3.map((v) => v.id))) {
-      for (const row of app.db.select().from(journeyEvents).where(inArray27(journeyEvents.visitId, part)).orderBy(asc10(journeyEvents.ts)).all()) {
+      for (const row of app.db.select().from(journeyEvents).where(inArray28(journeyEvents.visitId, part)).orderBy(asc10(journeyEvents.ts)).all()) {
         const list = events.get(row.visitId);
         if (list) list.push(row);
         else events.set(row.visitId, [row]);
@@ -30165,7 +30264,7 @@ function literalPathPrefixCondition(path8, prefix) {
 }
 
 // ../api-routes/src/ga-measurement-analysis.ts
-import { and as and44, eq as eq52, gte as gte12, inArray as inArray28, lte as lte11, or as or11, sql as sql18 } from "drizzle-orm";
+import { and as and44, eq as eq52, gte as gte12, inArray as inArray29, lte as lte11, or as or11, sql as sql18 } from "drizzle-orm";
 var UNKNOWN_LANDING_PAGE = "(not set)";
 function addDays(date, offset) {
   const value = /* @__PURE__ */ new Date(`${date}T00:00:00.000Z`);
@@ -30473,7 +30572,7 @@ function buildGaMeasurementAnalysis(db, projectName, options = {}) {
   const countedEventNames = countedLeadEventNames(configuredLeadEvents, keyEventNames ?? []);
   const measuredEventSet = new Set(state?.leadEventNames ?? configuredLeadEvents);
   const reportedEventNames = countedEventNames.filter((name) => measuredEventSet.has(name));
-  const leadEventCondition = reportedEventNames.length > 0 ? inArray28(gaLeadEventsDaily.eventName, reportedEventNames) : null;
+  const leadEventCondition = reportedEventNames.length > 0 ? inArray29(gaLeadEventsDaily.eventName, reportedEventNames) : null;
   const acquisitionAnchor = db.select({ date: sql18`max(${gaAcquisitionDaily.date})` }).from(gaAcquisitionDaily).where(and44(eq52(gaAcquisitionDaily.projectId, project.id), ...acquisitionScope)).get()?.date ?? null;
   const leadAnchor = leadEventCondition === null ? null : db.select({ date: sql18`max(${gaLeadEventsDaily.date})` }).from(gaLeadEventsDaily).where(and44(eq52(gaLeadEventsDaily.projectId, project.id), leadEventCondition, or11(
     eq52(gaLeadEventsDaily.attributionScope, "channel"),
@@ -31297,7 +31396,7 @@ async function organicEvidenceRoutes(app) {
 }
 
 // ../api-routes/src/citations.ts
-import { and as and46, eq as eq54, inArray as inArray29 } from "drizzle-orm";
+import { and as and46, eq as eq54, inArray as inArray30 } from "drizzle-orm";
 async function citationRoutes(app) {
   app.get("/projects/:name/citations/visibility", async (request, reply) => {
     const project = resolveProject(app.db, request.params.name);
@@ -31321,7 +31420,7 @@ async function citationRoutes(app) {
       competitorOverlap: querySnapshots.competitorOverlap,
       answerMentioned: querySnapshots.answerMentioned,
       createdAt: querySnapshots.createdAt
-    }).from(querySnapshots).where(inArray29(querySnapshots.runId, projectRuns.map((r) => r.id))).all();
+    }).from(querySnapshots).where(inArray30(querySnapshots.runId, projectRuns.map((r) => r.id))).all();
     if (rawSnapshots.length === 0) {
       return reply.send(emptyCitationVisibility("no-runs-yet"));
     }
@@ -31458,7 +31557,7 @@ function computeCitationVisibility(input) {
 }
 
 // ../api-routes/src/visibility-stats.ts
-import { and as and47, desc as desc26, eq as eq55, inArray as inArray30 } from "drizzle-orm";
+import { and as and47, desc as desc26, eq as eq55, inArray as inArray31 } from "drizzle-orm";
 
 // ../api-routes/src/visibility-compare.ts
 var VISIBILITY_COMPARE_MIN_RUNS = 5;
@@ -31945,7 +32044,7 @@ async function visibilityStatsRoutes(app) {
       citationState: querySnapshots.citationState,
       answerMentioned: querySnapshots.answerMentioned,
       createdAt: querySnapshots.createdAt
-    }).from(querySnapshots).where(inArray30(querySnapshots.runId, runIds)).all() : [];
+    }).from(querySnapshots).where(inArray31(querySnapshots.runId, runIds)).all() : [];
     const stats = computeVisibilityStats({ queries: projectQueries, snapshots, groupBy });
     const queryAttribution = buildQueryAttribution(projectQueries);
     let shareOfVoice;
@@ -31956,7 +32055,7 @@ async function visibilityStatsRoutes(app) {
         queryText: querySnapshots.queryText,
         answerMentioned: querySnapshots.answerMentioned,
         answerText: querySnapshots.answerText
-      }).from(querySnapshots).where(inArray30(querySnapshots.runId, runIds)).all() : [];
+      }).from(querySnapshots).where(inArray31(querySnapshots.runId, runIds)).all() : [];
       const attributedSovSnapshots = sovSnapshots.filter((s) => resolveCurrentQuery(queryAttribution, s) !== void 0);
       const advanced = activeMeasurementPlan(app.db, project.id)?.plan.schemaVersion === 2;
       const queryClass = advanced || projectQueryClassifier(project) ? requestedQueryClass : "all";
@@ -32054,7 +32153,7 @@ function readVisibilityCompare(db, projectName, query) {
       answerText: querySnapshots.answerText,
       citedDomains: querySnapshots.citedDomains,
       location: querySnapshots.location
-    }).from(querySnapshots).where(inArray30(querySnapshots.runId, runIds)).all() : [];
+    }).from(querySnapshots).where(inArray31(querySnapshots.runId, runIds)).all() : [];
     return {
       runCount: runIds.length,
       snapshots: snapshots.filter((snapshot) => (providerKey2 === void 0 || normalizeIdentityText(snapshot.provider) === providerKey2) && (locationKey2 === void 0 || (locationKey2 === "none" ? snapshot.location === null : snapshot.location !== null && normalizeIdentityText(snapshot.location) === locationKey2)))
@@ -32173,7 +32272,7 @@ function readVisibilityContinuity(db, projectName, months) {
   const trackedQueries = db.select({ id: queries.id, query: queries.query }).from(queries).where(eq55(queries.projectId, project.id)).all();
   const loadProjectMonth = (bounds) => {
     const runIds = legacyCompareRunIds(db, project.id, bounds);
-    const rows = runIds.length > 0 && trackedQueries.length > 0 ? db.select({ queryId: querySnapshots.queryId, queryText: querySnapshots.queryText, provider: querySnapshots.provider, model: querySnapshots.model }).from(querySnapshots).where(inArray30(querySnapshots.runId, runIds)).all() : [];
+    const rows = runIds.length > 0 && trackedQueries.length > 0 ? db.select({ queryId: querySnapshots.queryId, queryText: querySnapshots.queryText, provider: querySnapshots.provider, model: querySnapshots.model }).from(querySnapshots).where(inArray31(querySnapshots.runId, runIds)).all() : [];
     return { runCount: runIds.length, snapshots: rows.map(bare) };
   };
   const frames = [{ frame: "project", continuity: gate(trackedQueries, loadProjectMonth(fromBounds), loadProjectMonth(toBounds)) }];
@@ -32433,7 +32532,7 @@ async function resultsExportRoutes(app) {
 }
 
 // ../api-routes/src/composites.ts
-import { eq as eq57, and as and49, desc as desc27, sql as sql20, like as like5, or as or13, inArray as inArray31 } from "drizzle-orm";
+import { eq as eq57, and as and49, desc as desc27, sql as sql20, like as like5, or as or13, inArray as inArray32 } from "drizzle-orm";
 var TOP_INSIGHT_LIMIT = 5;
 var SEARCH_HIT_HARD_LIMIT = 50;
 var SEARCH_SNIPPET_RADIUS = 80;
@@ -32734,7 +32833,7 @@ function loadSnapshotsByRunIds(app, runIds, queryIdByText) {
     rawResponse: querySnapshots.rawResponse,
     competitorOverlap: querySnapshots.competitorOverlap,
     citedDomains: querySnapshots.citedDomains
-  }).from(querySnapshots).where(inArray31(querySnapshots.runId, [...runIds])).all();
+  }).from(querySnapshots).where(inArray32(querySnapshots.runId, [...runIds])).all();
   for (const row of rows) {
     const queryText = row.queryText?.trim() || null;
     let queryId;
@@ -33174,7 +33273,7 @@ import crypto29 from "crypto";
 import { and as and51, desc as desc29, eq as eq59 } from "drizzle-orm";
 
 // ../api-routes/src/content-data.ts
-import { and as and50, eq as eq58, desc as desc28, gte as gte15, inArray as inArray32, lte as lte14 } from "drizzle-orm";
+import { and as and50, eq as eq58, desc as desc28, gte as gte15, inArray as inArray33, lte as lte14 } from "drizzle-orm";
 var RECENT_RUNS_WINDOW = 5;
 function loadOrchestratorInput(db, project, locationFilter = void 0, gscWindowDays = DEFAULT_CONTENT_GSC_WINDOW_DAYS) {
   const projectId = project.id;
@@ -33314,7 +33413,7 @@ function listRecentAnswerVisibilityRunIds(db, projectId, limit, locationFilter)
       // Queued/running/failed/cancelled runs may have partial or no
       // snapshots; including them risks pointing latestRunId at a run with
       // no usable evidence.
-      inArray32(runs.status, [RunStatuses.completed, RunStatuses.partial]),
+      inArray33(runs.status, [RunStatuses.completed, RunStatuses.partial]),
       // Probe runs are operator/agent test runs; they must not poison the
       // recent-runs window the content engine uses to recommend actions.
       notProbeRun()
@@ -33382,7 +33481,7 @@ function buildCandidateQueries(opts) {
   const queryRows2 = opts.db.select({ id: queries.id, text: queries.query }).from(queries).where(eq58(queries.projectId, opts.projectId)).all();
   const queryIdByText = new Map(queryRows2.map((r) => [r.text, r.id]));
   const candidateQueryIds = opts.candidateQueryStrings.map((q) => queryIdByText.get(q)).filter((id) => Boolean(id));
-  const snapshotRows = filterTrackedSnapshots(opts.db.select().from(querySnapshots).where(inArray32(querySnapshots.runId, opts.recentRunIds)).all()).filter((r) => candidateQueryIds.includes(r.queryId));
+  const snapshotRows = filterTrackedSnapshots(opts.db.select().from(querySnapshots).where(inArray33(querySnapshots.runId, opts.recentRunIds)).all()).filter((r) => candidateQueryIds.includes(r.queryId));
   const snapshotsByQuery = /* @__PURE__ */ new Map();
   for (const row of snapshotRows) {
     const list = snapshotsByQuery.get(row.queryId) ?? [];
@@ -34127,6 +34226,7 @@ var SCHEMA_TABLE = {
   ResultsClearResponse: resultsClearResponseSchema,
   DoctorReportDto: doctorReportSchema,
   InstanceStatusDto: instanceStatusDtoSchema,
+  McpProfileDto: mcpProfileDtoSchema,
   GA4AiReferralDailyDto: ga4AiReferralDailyDtoSchema,
   GA4AiReferralHistoryEntry: ga4AiReferralHistoryEntrySchema,
   GA4MeasurementAnalysisDto: gaMeasurementAnalysisDtoSchema,
@@ -41287,6 +41387,19 @@ var routeCatalog = [
       400: errorResponse("Invalid report month.")
     }
   },
+  {
+    method: "get",
+    path: "/api/v1/mcp/profile",
+    summary: "Read the authenticated MCP connection profile",
+    description: "Identifies the named account within this configured MCP resource and its effective instance-wide read scope. Accepts MCP-audience OAuth tokens without granting access to other REST routes. Direct API keys without a named account are refused.",
+    tags: ["mcp"],
+    responses: {
+      200: jsonResponse("Authenticated MCP connection profile.", "McpProfileDto"),
+      401: errorResponse("Authentication required or invalid."),
+      403: errorResponse("An instance-wide named account with read scope is required."),
+      501: errorResponse("MCP OAuth resource is not configured.")
+    }
+  },
   {
     method: "get",
     path: "/api/v1/status",
@@ -45500,7 +45613,7 @@ async function gbpLocalPostsRoutes(app, options) {
 }
 
 // ../api-routes/src/google.ts
-import { eq as eq66, and as and54, desc as desc31, sql as sql21, inArray as inArray33 } from "drizzle-orm";
+import { eq as eq66, and as and54, desc as desc31, sql as sql21, inArray as inArray34 } from "drizzle-orm";
 
 // ../api-routes/src/gsc-period-comparison.ts
 var DAY_MS2 = 864e5;
@@ -48756,10 +48869,10 @@ async function googleRoutes(app, opts) {
         locationProfiles: []
       });
     }
-    const metricRows = app.db.select().from(gbpDailyMetrics).where(and54(eq66(gbpDailyMetrics.projectId, project.id), inArray33(gbpDailyMetrics.locationName, locationNames))).all();
-    const keywordRows = app.db.select().from(gbpKeywordImpressions).where(and54(eq66(gbpKeywordImpressions.projectId, project.id), inArray33(gbpKeywordImpressions.locationName, locationNames))).all();
-    const placeActionRows = app.db.select().from(gbpPlaceActions).where(and54(eq66(gbpPlaceActions.projectId, project.id), inArray33(gbpPlaceActions.locationName, locationNames))).all();
-    const lodgingRows = app.db.select().from(gbpLodgingSnapshots).where(and54(eq66(gbpLodgingSnapshots.projectId, project.id), inArray33(gbpLodgingSnapshots.locationName, locationNames))).orderBy(desc31(gbpLodgingSnapshots.syncedAt)).all();
+    const metricRows = app.db.select().from(gbpDailyMetrics).where(and54(eq66(gbpDailyMetrics.projectId, project.id), inArray34(gbpDailyMetrics.locationName, locationNames))).all();
+    const keywordRows = app.db.select().from(gbpKeywordImpressions).where(and54(eq66(gbpKeywordImpressions.projectId, project.id), inArray34(gbpKeywordImpressions.locationName, locationNames))).all();
+    const placeActionRows = app.db.select().from(gbpPlaceActions).where(and54(eq66(gbpPlaceActions.projectId, project.id), inArray34(gbpPlaceActions.locationName, locationNames))).all();
+    const lodgingRows = app.db.select().from(gbpLodgingSnapshots).where(and54(eq66(gbpLodgingSnapshots.projectId, project.id), inArray34(gbpLodgingSnapshots.locationName, locationNames))).orderBy(desc31(gbpLodgingSnapshots.syncedAt)).all();
     const latestLodgingByLocation = /* @__PURE__ */ new Map();
     for (const row of lodgingRows) {
       if (!latestLodgingByLocation.has(row.locationName)) {
@@ -48773,7 +48886,7 @@ async function googleRoutes(app, opts) {
       regularHours: gbpLocations.regularHours,
       primaryPhone: gbpLocations.primaryPhone,
       openStatus: gbpLocations.openStatus
-    }).from(gbpLocations).where(and54(eq66(gbpLocations.projectId, project.id), inArray33(gbpLocations.locationName, locationNames))).all();
+    }).from(gbpLocations).where(and54(eq66(gbpLocations.projectId, project.id), inArray34(gbpLocations.locationName, locationNames))).all();
     return buildGbpSummary({
       locationName,
       locationCount: locationNames.length,
@@ -50443,7 +50556,7 @@ async function googleMarketingRoutes(app, opts) {
 
 // ../api-routes/src/ads.ts
 import crypto42 from "crypto";
-import { eq as eq69, and as and57, asc as asc15, desc as desc33, gt as gt6, gte as gte16, lt as lt10, lte as lte16, ne as ne13, inArray as inArray34, or as or16, isNull as isNull12, isNotNull as isNotNull7, sql as sql24 } from "drizzle-orm";
+import { eq as eq69, and as and57, asc as asc15, desc as desc33, gt as gt6, gte as gte16, lt as lt10, lte as lte16, ne as ne13, inArray as inArray35, or as or16, isNull as isNull12, isNotNull as isNotNull7, sql as sql24 } from "drizzle-orm";
 
 // ../api-routes/src/ads-activation.ts
 import crypto40 from "crypto";
@@ -53541,7 +53654,7 @@ function semanticallyMatchesMaterializedEntity(app, input) {
     eq69(adsOperations.projectId, input.projectId),
     eq69(adsOperations.entityType, input.entityType),
     eq69(adsOperations.entityId, input.entityId),
-    inArray34(adsOperations.kind, [createKind, updateKind])
+    inArray35(adsOperations.kind, [createKind, updateKind])
   )).orderBy(asc15(adsOperations.createdAt), asc15(adsOperations.id)).all();
   if (rows.some((row) => row.state === AdsOperationStates.pending || row.state === AdsOperationStates.reconciling || row.state === AdsOperationStates.unknown || row.kind === updateKind && row.state === AdsOperationStates.succeeded)) {
     return false;
@@ -53989,7 +54102,7 @@ function quarantineExhaustedReconciliation(app, row, now, policy, context) {
       eq69(adsOperations.id, row.id),
       eq69(adsOperations.projectId, row.projectId),
       gte16(adsOperations.reconcileAttempts, policy.maxAttempts),
-      inArray34(adsOperations.state, [
+      inArray35(adsOperations.state, [
         AdsOperationStates.pending,
         AdsOperationStates.unknown,
         AdsOperationStates.reconciling
@@ -54233,7 +54346,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
         eq69(adsOperations.reconcileStrategy, AdsReconcileStrategies.create_fingerprint),
         or16(
           isNotNull7(adsOperations.entityId),
-          inArray34(adsOperations.state, [
+          inArray35(adsOperations.state, [
             AdsOperationStates.pending,
             AdsOperationStates.reconciling
           ])
@@ -54284,7 +54397,7 @@ async function sweepAdsOperationsOnce(app, opts, config) {
   const eligibleProjectIds = [...credentialsByProjectId.keys()];
   if (eligibleProjectIds.length === 0) return;
   const rows = app.db.select().from(adsOperations).where(and57(
-    inArray34(adsOperations.projectId, eligibleProjectIds),
+    inArray35(adsOperations.projectId, eligibleProjectIds),
     staleReconcileWhere
   )).orderBy(asc15(adsOperations.updatedAt)).limit(config.batchSize).all();
   for (const row of rows) {
@@ -54610,7 +54723,7 @@ async function adsRoutes(app, opts) {
     const cursor = parsed.data.cursor ? decodeAdsOperationCursor(parsed.data.cursor, project.id, parsed.data.state) : void 0;
     const rows = app.db.select().from(adsOperations).where(and57(
       eq69(adsOperations.projectId, project.id),
-      inArray34(adsOperations.state, parsed.data.state),
+      inArray35(adsOperations.state, parsed.data.state),
       cursor ? or16(
         gt6(adsOperations.createdAt, cursor.createdAt),
         and57(
@@ -55044,7 +55157,7 @@ async function adsRoutes(app, opts) {
     const inFlight2 = app.db.select({ id: runs.id, status: runs.status }).from(runs).where(and57(
       eq69(runs.projectId, project.id),
       eq69(runs.kind, RunKinds["ads-sync"]),
-      inArray34(runs.status, [RunStatuses.queued, RunStatuses.running])
+      inArray35(runs.status, [RunStatuses.queued, RunStatuses.running])
     )).get();
     if (inFlight2) {
       const existing = { runId: inFlight2.id, status: inFlight2.status };
@@ -60934,7 +61047,7 @@ async function backlinksRoutes(app, opts) {
 import crypto52 from "crypto";
 import { isIP } from "net";
 import { isDeepStrictEqual } from "util";
-import { and as and69, desc as desc39, eq as eq80, gt as gt7, gte as gte20, inArray as inArray35, lt as lt13, lte as lte21, sql as sql31 } from "drizzle-orm";
+import { and as and69, desc as desc39, eq as eq80, gt as gt7, gte as gte20, inArray as inArray36, lt as lt13, lte as lte21, sql as sql31 } from "drizzle-orm";
 
 // ../api-routes/src/traffic-limits.ts
 var VERCEL_MAX_SYNC_WINDOW_MS = 24 * 60 * 6e4;
@@ -65884,7 +65997,7 @@ async function trafficRoutes(app, opts) {
       const listed = useContentList ? contentPaths : infraPaths;
       const IN_LIST_CAP = 2e4;
       const listFitsInSql = listed.length <= IN_LIST_CAP;
-      const contentExpr = listed.length === 0 ? useContentList ? sql31`0` : sql31`${crawlerEventsHourly.hits}` : useContentList ? sql31`CASE WHEN ${inArray35(crawlerEventsHourly.pathNormalized, listed)} THEN ${crawlerEventsHourly.hits} ELSE 0 END` : sql31`CASE WHEN ${inArray35(crawlerEventsHourly.pathNormalized, listed)} THEN 0 ELSE ${crawlerEventsHourly.hits} END`;
+      const contentExpr = listed.length === 0 ? useContentList ? sql31`0` : sql31`${crawlerEventsHourly.hits}` : useContentList ? sql31`CASE WHEN ${inArray36(crawlerEventsHourly.pathNormalized, listed)} THEN ${crawlerEventsHourly.hits} ELSE 0 END` : sql31`CASE WHEN ${inArray36(crawlerEventsHourly.pathNormalized, listed)} THEN 0 ELSE ${crawlerEventsHourly.hits} END`;
       if (listFitsInSql) {
         const crawlerSeries = app.db.select({
           bucket: crawlerSeriesBucket,
@@ -66273,7 +66386,7 @@ var reportSweepsCheck = {
 };
 
 // ../api-routes/src/doctor/checks/report-models.ts
-import { and as and71, eq as eq82, gte as gte22, inArray as inArray36, lte as lte23 } from "drizzle-orm";
+import { and as and71, eq as eq82, gte as gte22, inArray as inArray37, lte as lte23 } from "drizzle-orm";
 var reportModelsCheck = {
   id: "report.models",
   category: CheckCategories.providers,
@@ -66288,7 +66401,7 @@ var reportModelsCheck = {
     const months = reportMonths.flatMap((month) => {
       const bounds = calendarMonthBounds(month);
       const previous = new Date(Date.parse(bounds.since) - 1).toISOString().slice(0, 7);
-      const observations = ctx.db.select({ provider: querySnapshots.provider, model: querySnapshots.model, at: runs.createdAt }).from(querySnapshots).innerJoin(runs, eq82(runs.id, querySnapshots.runId)).where(and71(eq82(runs.projectId, ctx.project.id), eq82(runs.kind, RunKinds["answer-visibility"]), inArray36(runs.status, [RunStatuses.completed, RunStatuses.partial]), notProbeRun(), gte22(runs.createdAt, bounds.since), lte23(runs.createdAt, bounds.until))).all();
+      const observations = ctx.db.select({ provider: querySnapshots.provider, model: querySnapshots.model, at: runs.createdAt }).from(querySnapshots).innerJoin(runs, eq82(runs.id, querySnapshots.runId)).where(and71(eq82(runs.projectId, ctx.project.id), eq82(runs.kind, RunKinds["answer-visibility"]), inArray37(runs.status, [RunStatuses.completed, RunStatuses.partial]), notProbeRun(), gte22(runs.createdAt, bounds.since), lte23(runs.createdAt, bounds.until))).all();
       return readVisibilityContinuity(ctx.db, ctx.project.name, { from: previous, to: month }).map(({ frame, continuity: continuity2 }) => ({
         month,
         previousMonth: previous,
@@ -66865,7 +66978,7 @@ var BACKLINKS_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/bing-auth.ts
-import { and as and73, desc as desc40, eq as eq85, inArray as inArray37 } from "drizzle-orm";
+import { and as and73, desc as desc40, eq as eq85, inArray as inArray38 } from "drizzle-orm";
 var BING_CONNECTION_ENTITY = "bing_connection";
 var BING_CONNECTED_ACTION = "bing.connected";
 var BING_DISCONNECTED_ACTION = "bing.disconnected";
@@ -66876,7 +66989,7 @@ function lostBingConnection(ctx, project) {
   const lastChange = ctx.db.select({ action: auditLog.action }).from(auditLog).where(and73(
     eq85(auditLog.entityType, BING_CONNECTION_ENTITY),
     eq85(auditLog.entityId, project.canonicalDomain),
-    inArray37(auditLog.action, [BING_CONNECTED_ACTION, BING_DISCONNECTED_ACTION])
+    inArray38(auditLog.action, [BING_CONNECTED_ACTION, BING_DISCONNECTED_ACTION])
   )).orderBy(desc40(auditLog.createdAt)).limit(1).get();
   return lastChange?.action !== BING_DISCONNECTED_ACTION;
 }
@@ -67422,7 +67535,7 @@ var ga4ConnectionCheck = {
 var GA_AUTH_CHECKS = [ga4ConnectionCheck];
 
 // ../api-routes/src/doctor/checks/data-freshness.ts
-import { and as and74, desc as desc41, eq as eq88, inArray as inArray38 } from "drizzle-orm";
+import { and as and74, desc as desc41, eq as eq88, inArray as inArray39 } from "drizzle-orm";
 var GA_DATA_AGING_DAYS = 3;
 var GA_DATA_STALE_DAYS = 5;
 var GSC_DATA_AGING_DAYS = 5;
@@ -67451,7 +67564,7 @@ function skipped(code, summary3) {
   return { status: CheckStatuses.skipped, code, summary: summary3, remediation: null };
 }
 function lastSyncAgeDays(ctx, kinds) {
-  const row = ctx.db.select({ createdAt: runs.createdAt }).from(runs).where(and74(eq88(runs.projectId, ctx.project.id), inArray38(runs.kind, kinds), eq88(runs.status, "completed"))).orderBy(desc41(runs.createdAt)).limit(1).get();
+  const row = ctx.db.select({ createdAt: runs.createdAt }).from(runs).where(and74(eq88(runs.projectId, ctx.project.id), inArray39(runs.kind, kinds), eq88(runs.status, "completed"))).orderBy(desc41(runs.createdAt)).limit(1).get();
   if (!row?.createdAt) return null;
   const age = Math.floor((Date.now() - Date.parse(row.createdAt)) / DAY_MS4);
   return Number.isFinite(age) ? age : null;
@@ -67577,7 +67690,7 @@ var gscRecentDataCheck = {
 var DATA_FRESHNESS_CHECKS = [gaRecentDataCheck, gscRecentDataCheck];
 
 // ../api-routes/src/doctor/checks/seo-refresh.ts
-import { and as and75, asc as asc20, desc as desc42, eq as eq89, gt as gt8, inArray as inArray39, sql as sql32 } from "drizzle-orm";
+import { and as and75, asc as asc20, desc as desc42, eq as eq89, gt as gt8, inArray as inArray40, sql as sql32 } from "drizzle-orm";
 var GRACE_DAYS = 2;
 var DAY_MS5 = 24 * 60 * 60 * 1e3;
 var FIRING_SPAN_MS = 6e4;
@@ -67609,7 +67722,7 @@ function isIncomplete(run) {
   return run.status === RunStatuses.failed || run.status === RunStatuses.partial;
 }
 function runProfiles(ctx, firing) {
-  const jobs = firing.length === 0 ? [] : ctx.db.select({ runId: seoJobs.runId, profileId: seoJobs.profileId }).from(seoJobs).where(inArray39(seoJobs.runId, firing.map((run) => run.id))).all();
+  const jobs = firing.length === 0 ? [] : ctx.db.select({ runId: seoJobs.runId, profileId: seoJobs.profileId }).from(seoJobs).where(inArray40(seoJobs.runId, firing.map((run) => run.id))).all();
   const byRun = new Map(jobs.flatMap((job) => job.runId ? [[job.runId, job.profileId]] : []));
   return new Map(firing.map((run) => [run.id, byRun.get(run.id) ?? skippedRefreshProfile(run.error)]));
 }
@@ -67719,7 +67832,7 @@ function gradeSeoRefresh(ctx, project) {
     };
   }
   if (now >= Date.parse(deadlineAt)) {
-    const active = ctx.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(and75(seoSyncRuns(project.id), inArray39(runs.status, [RunStatuses.queued, RunStatuses.running]))).orderBy(asc20(runs.createdAt)).limit(1).get();
+    const active = ctx.db.select({ id: runs.id, createdAt: runs.createdAt }).from(runs).where(and75(seoSyncRuns(project.id), inArray40(runs.status, [RunStatuses.queued, RunStatuses.running]))).orderBy(asc20(runs.createdAt)).limit(1).get();
     const since = last ? `No SEO refresh has completed since ${day(last.at)}.` : "No SEO refresh has completed since the schedule was enabled.";
     const missed = last ? `The scheduled refresh due ${day(dueAt)} did not complete within ${GRACE_DAYS} days.` : `Its first refresh, due ${day(dueAt)}, did not complete within ${GRACE_DAYS} days.`;
     return {
@@ -68135,7 +68248,7 @@ async function probeApiHost(host, options = {}) {
 }
 
 // ../api-routes/src/doctor/checks/integration-sync.ts
-import { and as and76, count as count7, desc as desc43, eq as eq90, gte as gte23, gt as gt9, inArray as inArray40, isNull as isNull14, notInArray as notInArray3, or as or19 } from "drizzle-orm";
+import { and as and76, count as count7, desc as desc43, eq as eq90, gte as gte23, gt as gt9, inArray as inArray41, isNull as isNull14, notInArray as notInArray3, or as or19 } from "drizzle-orm";
 var SYNC_FAILURE_WINDOW = 3;
 var SUMMARY_ERROR_LIMIT = 300;
 var FINISHED_STATUSES = [RunStatuses.completed, RunStatuses.partial, RunStatuses.failed];
@@ -68228,8 +68341,8 @@ function readSyncRunState(db, projectId, kind, options = {}) {
     ...options.nothingToSyncErrors?.length ? [or19(isNull14(runs.error), notInArray3(runs.error, [...options.nothingToSyncErrors]))] : []
   );
   const graded = options.since ? and76(scope, gte23(runs.createdAt, options.since)) : scope;
-  const recent = db.select({ id: runs.id, status: runs.status, trigger: runs.trigger, error: runs.error, createdAt: runs.createdAt }).from(runs).where(and76(graded, inArray40(runs.status, FINISHED_STATUSES))).orderBy(desc43(runs.createdAt)).limit(SYNC_FAILURE_WINDOW).all();
-  const lastSuccess = db.select({ createdAt: runs.createdAt, finishedAt: runs.finishedAt }).from(runs).where(and76(graded, inArray40(runs.status, SUCCESS_STATUSES))).orderBy(desc43(runs.createdAt)).limit(1).get();
+  const recent = db.select({ id: runs.id, status: runs.status, trigger: runs.trigger, error: runs.error, createdAt: runs.createdAt }).from(runs).where(and76(graded, inArray41(runs.status, FINISHED_STATUSES))).orderBy(desc43(runs.createdAt)).limit(SYNC_FAILURE_WINDOW).all();
+  const lastSuccess = db.select({ createdAt: runs.createdAt, finishedAt: runs.finishedAt }).from(runs).where(and76(graded, inArray41(runs.status, SUCCESS_STATUSES))).orderBy(desc43(runs.createdAt)).limit(1).get();
   const failureCount = db.select({ count: count7() }).from(runs).where(and76(lastSuccess ? and76(graded, gt9(runs.createdAt, lastSuccess.createdAt)) : graded, eq90(runs.status, RunStatuses.failed))).get();
   const failuresSinceSuccess = Number(failureCount?.count ?? 0);
   const latest = recent[0];
@@ -68790,7 +68903,7 @@ var PLACES_CHECK_BY_ID = Object.fromEntries(
 );
 
 // ../api-routes/src/doctor/checks/gbp-reviews.ts
-import { and as and78, desc as desc44, eq as eq94, gte as gte24, inArray as inArray41, sql as sql33 } from "drizzle-orm";
+import { and as and78, desc as desc44, eq as eq94, gte as gte24, inArray as inArray42, sql as sql33 } from "drizzle-orm";
 var REVIEW_EVENTS = /* @__PURE__ */ new Set(["review.negative", "review.rating-dropped"]);
 var V4_ACCESS_REMEDIATION = "Business Profile reviews use the legacy My Business API (mybusiness.googleapis.com), which Google enables per Cloud project only on request; the API Library and `gcloud services enable` cannot turn it on. Open the enable link in the API access approval email as the approved account, or reply to the access-request thread asking Google to enable mybusiness.googleapis.com for your project number, then run `canonry gbp sync`.";
 var reviewsAccessCheck = {
@@ -68913,7 +69026,7 @@ var reviewDeliveryCheck = {
       payload: reviewWebhookDeliveries.payload
     }).from(reviewWebhookDeliveries).where(and78(
       eq94(reviewWebhookDeliveries.projectId, ctx.project.id),
-      inArray41(reviewWebhookDeliveries.state, [ReviewDeliveryStates.Uncertain, ReviewDeliveryStates.Failed]),
+      inArray42(reviewWebhookDeliveries.state, [ReviewDeliveryStates.Uncertain, ReviewDeliveryStates.Failed]),
       gte24(lastTouched, since)
     )).orderBy(desc44(lastTouched)).all();
     if (rows.length === 0) {
@@ -69498,7 +69611,7 @@ var RUNTIME_STATE_CHECKS = [
 ];
 
 // ../api-routes/src/doctor/checks/traffic-source.ts
-import { and as and79, desc as desc45, eq as eq95, gte as gte25, inArray as inArray42, isNotNull as isNotNull9, ne as ne16, sql as sql34 } from "drizzle-orm";
+import { and as and79, desc as desc45, eq as eq95, gte as gte25, inArray as inArray43, isNotNull as isNotNull9, ne as ne16, sql as sql34 } from "drizzle-orm";
 var RECENT_DATA_WARN_DAYS = 7;
 var RECENT_DATA_FAIL_DAYS = 30;
 function isCloudflareDirectPush(source) {
@@ -69678,7 +69791,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and79(
           eq95(crawlerEventsHourly.projectId, ctx.project.id),
-          inArray42(crawlerEventsHourly.sourceId, activeSourceIds),
+          inArray43(crawlerEventsHourly.sourceId, activeSourceIds),
           gte25(crawlerEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
@@ -69687,7 +69800,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and79(
           eq95(aiReferralEventsHourly.projectId, ctx.project.id),
-          inArray42(aiReferralEventsHourly.sourceId, activeSourceIds),
+          inArray43(aiReferralEventsHourly.sourceId, activeSourceIds),
           gte25(aiReferralEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
@@ -69696,7 +69809,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
         and79(
           eq95(aiUserFetchEventsHourly.projectId, ctx.project.id),
-          inArray42(aiUserFetchEventsHourly.sourceId, activeSourceIds),
+          inArray43(aiUserFetchEventsHourly.sourceId, activeSourceIds),
           gte25(aiUserFetchEventsHourly.tsHour, warnCutoff)
         )
       ).get()?.total ?? 0
@@ -69722,7 +69835,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${crawlerEventsHourly.hits}), 0)` }).from(crawlerEventsHourly).where(
         and79(
           eq95(crawlerEventsHourly.projectId, ctx.project.id),
-          inArray42(crawlerEventsHourly.sourceId, activeSourceIds),
+          inArray43(crawlerEventsHourly.sourceId, activeSourceIds),
           gte25(crawlerEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
@@ -69731,7 +69844,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${aiReferralEventsHourly.sessionsOrHits}), 0)` }).from(aiReferralEventsHourly).where(
         and79(
           eq95(aiReferralEventsHourly.projectId, ctx.project.id),
-          inArray42(aiReferralEventsHourly.sourceId, activeSourceIds),
+          inArray43(aiReferralEventsHourly.sourceId, activeSourceIds),
           gte25(aiReferralEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
@@ -69740,7 +69853,7 @@ var recentDataCheck = {
       ctx.db.select({ total: sql34`COALESCE(SUM(${aiUserFetchEventsHourly.hits}), 0)` }).from(aiUserFetchEventsHourly).where(
         and79(
           eq95(aiUserFetchEventsHourly.projectId, ctx.project.id),
-          inArray42(aiUserFetchEventsHourly.sourceId, activeSourceIds),
+          inArray43(aiUserFetchEventsHourly.sourceId, activeSourceIds),
           gte25(aiUserFetchEventsHourly.tsHour, failCutoff)
         )
       ).get()?.total ?? 0
@@ -70997,7 +71110,7 @@ async function statusRoutes(app, opts) {
 
 // ../api-routes/src/discovery/routes.ts
 import crypto54 from "crypto";
-import { and as and81, desc as desc47, eq as eq97, gte as gte26, inArray as inArray43, isNull as isNull16, or as or20 } from "drizzle-orm";
+import { and as and81, desc as desc47, eq as eq97, gte as gte26, inArray as inArray44, isNull as isNull16, or as or20 } from "drizzle-orm";
 var MAX_INFLIGHT_DISCOVERY_AGE_MS = 2 * 60 * 60 * 1e3;
 async function discoveryRoutes(app, opts) {
   app.post("/projects/:name/discover/run", async (request, reply) => {
@@ -71052,7 +71165,7 @@ async function discoveryRoutes(app, opts) {
         // must never reuse another set's session. Null (= Gemini-only
         // default, including explicit ['gemini']) matches legacy rows.
         seedProviders == null ? isNull16(discoverySessions.seedProviders) : eq97(discoverySessions.seedProviders, seedProviders),
-        inArray43(discoverySessions.status, [
+        inArray44(discoverySessions.status, [
           DiscoverySessionStatuses.queued,
           DiscoverySessionStatuses.seeding,
           DiscoverySessionStatuses.probing
@@ -71760,7 +71873,7 @@ function dedupeStrings(input) {
 
 // ../api-routes/src/technical-aeo.ts
 import crypto56 from "crypto";
-import { and as and83, asc as asc22, count as count8, desc as desc48, eq as eq100, gte as gte27, inArray as inArray44, isNotNull as isNotNull10, isNull as isNull17, lt as lt14, or as or21, sql as sql36 } from "drizzle-orm";
+import { and as and83, asc as asc22, count as count8, desc as desc48, eq as eq100, gte as gte27, inArray as inArray45, isNotNull as isNotNull10, isNull as isNull17, lt as lt14, or as or21, sql as sql36 } from "drizzle-orm";
 import { alias } from "drizzle-orm/sqlite-core";
 
 // ../api-routes/src/technical-aeo-issues.ts
@@ -72405,7 +72518,7 @@ async function technicalAeoRoutes(app, opts) {
     eq100(siteCrawlSnapshots.projectId, projectId),
     eq100(runs.projectId, projectId),
     eq100(runs.kind, RunKinds["site-audit"]),
-    inArray44(runs.status, SURFACEABLE_STATUSES),
+    inArray45(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   ];
   const availableScanDatesFor = (projectId, requestedDate) => {
@@ -72475,7 +72588,7 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteAuditSnapshots.projectId, projectId),
       eq100(runs.projectId, projectId),
       eq100(runs.kind, RunKinds["site-audit"]),
-      inArray44(runs.status, SURFACEABLE_STATUSES),
+      inArray45(runs.status, SURFACEABLE_STATUSES),
       notProbeRun(),
       ...recordedBefore ? [lt14(siteAuditSnapshots.createdAt, recordedBefore)] : []
     ];
@@ -72627,7 +72740,7 @@ async function technicalAeoRoutes(app, opts) {
     eq100(runs.id, runId),
     eq100(runs.projectId, projectId),
     eq100(runs.kind, RunKinds["site-audit"]),
-    inArray44(runs.status, SURFACEABLE_STATUSES),
+    inArray45(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
   const assertKnownAuditRun = (projectId, runId) => {
@@ -72637,7 +72750,7 @@ async function technicalAeoRoutes(app, opts) {
     eq100(siteAuditSnapshots.projectId, projectId),
     eq100(runs.projectId, projectId),
     eq100(runs.kind, RunKinds["site-audit"]),
-    inArray44(runs.status, SURFACEABLE_STATUSES),
+    inArray45(runs.status, SURFACEABLE_STATUSES),
     notProbeRun()
   )).limit(1).get());
   const emptyCrawlSummary = (projectName, legacyAuditAvailable) => ({
@@ -72768,7 +72881,7 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteAuditSnapshots.projectId, project.id),
       eq100(runs.projectId, project.id),
       eq100(runs.kind, RunKinds["site-audit"]),
-      inArray44(runs.status, SURFACEABLE_STATUSES),
+      inArray45(runs.status, SURFACEABLE_STATUSES),
       notProbeRun()
     )).orderBy(desc48(siteAuditSnapshots.createdAt)).limit(limit).all();
     return { project: project.name, points: rows.reverse() };
@@ -73083,8 +73196,8 @@ async function technicalAeoRoutes(app, opts) {
         eq100(siteCrawlEdges.internal, true),
         isNotNull10(siteCrawlEdges.targetNodeKey),
         or21(
-          inArray44(siteCrawlEdges.sourceNodeKey, frontier),
-          inArray44(siteCrawlEdges.targetNodeKey, frontier)
+          inArray45(siteCrawlEdges.sourceNodeKey, frontier),
+          inArray45(siteCrawlEdges.targetNodeKey, frontier)
         )
       )).orderBy(asc22(siteCrawlEdges.edgeKey)).limit(maxEdges + maxNodes + 1).all();
       if (candidates.length > maxEdges + maxNodes) queryTruncated = true;
@@ -73121,7 +73234,7 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteCrawlPages.projectId, scope.projectId),
       eq100(siteCrawlPages.runId, scope.runId),
       eq100(siteCrawlPages.attemptId, scope.attemptId),
-      inArray44(siteCrawlPages.nodeKey, nodeKeys)
+      inArray45(siteCrawlPages.nodeKey, nodeKeys)
     )).all();
     const persistedNodeKeys = new Set(pageRows.map((row) => row.nodeKey));
     const outermostNodeKeys = pageRows.filter((row) => distances.get(row.nodeKey) === hops).map((row) => row.nodeKey);
@@ -73131,8 +73244,8 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteCrawlEdges.attemptId, scope.attemptId),
       eq100(siteCrawlEdges.internal, true),
       isNotNull10(siteCrawlEdges.targetNodeKey),
-      inArray44(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
-      inArray44(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
+      inArray45(siteCrawlEdges.sourceNodeKey, outermostNodeKeys),
+      inArray45(siteCrawlEdges.targetNodeKey, outermostNodeKeys)
     )).limit(1).get();
     if (omittedOutermostEdge && !seenEdgeKeys.has(omittedOutermostEdge.edgeKey)) {
       omittedEdgeKeys.add(omittedOutermostEdge.edgeKey);
@@ -73233,7 +73346,7 @@ async function technicalAeoRoutes(app, opts) {
         eq100(siteCrawlEdges.followable, true),
         eq100(siteCrawlEdges.relation, "anchor"),
         isNotNull10(siteCrawlEdges.targetNodeKey),
-        inArray44(siteCrawlEdges.sourceNodeKey, frontier)
+        inArray45(siteCrawlEdges.sourceNodeKey, frontier)
       )).orderBy(asc22(siteCrawlEdges.edgeKey)).limit(SITE_HEALTH_PATH_MAX_VISITED_NODES + 1).all();
       if (candidates.length > SITE_HEALTH_PATH_MAX_VISITED_NODES) truncated = true;
       const candidateTargetKeys = [...new Set(candidates.map((edge) => edge.targetNodeKey).filter((nodeKey) => nodeKey != null))];
@@ -73241,7 +73354,7 @@ async function technicalAeoRoutes(app, opts) {
         eq100(siteCrawlPages.projectId, scope.projectId),
         eq100(siteCrawlPages.runId, scope.runId),
         eq100(siteCrawlPages.attemptId, scope.attemptId),
-        inArray44(siteCrawlPages.nodeKey, candidateTargetKeys)
+        inArray45(siteCrawlPages.nodeKey, candidateTargetKeys)
       )).all().map((row) => row.nodeKey));
       const next = /* @__PURE__ */ new Set();
       for (const edge of candidates.slice(0, SITE_HEALTH_PATH_MAX_VISITED_NODES)) {
@@ -73286,7 +73399,7 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteCrawlPages.projectId, scope.projectId),
       eq100(siteCrawlPages.runId, scope.runId),
       eq100(siteCrawlPages.attemptId, scope.attemptId),
-      inArray44(siteCrawlPages.nodeKey, pathKeys)
+      inArray45(siteCrawlPages.nodeKey, pathKeys)
     )).all();
     const pageByKey = new Map(pathRows.map((row) => [row.nodeKey, row]));
     const pathDetection = templateDetectionOf(snapshot.templateDetection);
@@ -73577,14 +73690,14 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteCrawlPages.projectId, scope.projectId),
       eq100(siteCrawlPages.runId, scope.runId),
       eq100(siteCrawlPages.attemptId, scope.attemptId),
-      inArray44(siteCrawlPages.nodeKey, pageKeys)
+      inArray45(siteCrawlPages.nodeKey, pageKeys)
     )).all();
     const edgeRowsFor = (scope) => linkKeys.length === 0 ? [] : app.db.select().from(siteCrawlEdges).where(and83(
       eq100(siteCrawlEdges.projectId, scope.projectId),
       eq100(siteCrawlEdges.runId, scope.runId),
       eq100(siteCrawlEdges.attemptId, scope.attemptId),
       eq100(siteCrawlEdges.internal, true),
-      inArray44(siteCrawlEdges.edgeKey, linkKeys)
+      inArray45(siteCrawlEdges.edgeKey, linkKeys)
     )).all();
     const beforePages = new Map(pageRowsFor(beforeScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
     const afterPages = new Map(pageRowsFor(afterScope).map((row) => [row.nodeKey, mapCrawlPage(row)]));
@@ -74115,9 +74228,9 @@ async function technicalAeoRoutes(app, opts) {
       eq100(siteCrawlSnapshots.projectId, project.id),
       eq100(runs.projectId, project.id),
       eq100(runs.kind, RunKinds["site-audit"]),
-      inArray44(runs.status, SURFACEABLE_STATUSES),
+      inArray45(runs.status, SURFACEABLE_STATUSES),
       notProbeRun(),
-      inArray44(siteCrawlSnapshots.runId, runIds)
+      inArray45(siteCrawlSnapshots.runId, runIds)
     )).all().map((row) => row.runId));
     return {
       project: project.name,
@@ -74258,7 +74371,7 @@ async function technicalAeoRoutes(app, opts) {
       )).where(and83(
         eq100(runs.projectId, project.id),
         eq100(runs.kind, RunKinds["site-audit"]),
-        inArray44(runs.status, [RunStatuses.queued, RunStatuses.running])
+        inArray45(runs.status, [RunStatuses.queued, RunStatuses.running])
       )).get();
       if (existing) {
         if (existing.identityKey === identityKey) {
@@ -75184,6 +75297,7 @@ async function apiRoutes(app, opts) {
       getGoogleMarketingDoctorInput: opts.getGoogleMarketingDoctorInput,
       probeApiHost: opts.probeApiHost
     });
+    await api.register(mcpProfileRoutes, { oauthResourceUrl: opts.oauthResourceUrl });
     await api.register(statusRoutes, {
       db: opts.db,
       getMcpHealth: opts.getMcpHealth,
@@ -75433,6 +75547,7 @@ export {
   createCredentialChecker,
   requireInstanceAdministrator,
   hashApiKey,
+  MCP_DELEGATED_KEY_MAX_AGE_MS,
   notProbeRun,
   syncRunClaimKey,
   writeAuditLog,