@canonry/canonry 7.97.8 → 7.98.0

package/dist/{chunk-22LX5CWD.js → chunk-IX5AC3QB.js}

@@ -1,7 +1,7 @@
 import {
   answerServiceAdapters,
   answerServiceDescriptors
-} from "./chunk-GMCVZPKO.js";
+} from "./chunk-EJZ444VV.js";
 import {
   AeroLlmUsageFeatures,
   aeroTurnStatus,
@@ -27,14 +27,14 @@ import {
   resolveConfiguredAgentProvider,
   resolveSessionProviderAndModel,
   setAeroSystemPrompt
-} from "./chunk-I6G5K5PM.js";
+} from "./chunk-RLKI2QF7.js";
 import {
   AeroToolProfiles,
   AeroToolScopes,
   buildAeroStateTools,
   isAeroToolProfile,
   truncateToolResult
-} from "./chunk-AI2G7QMW.js";
+} from "./chunk-Q5SNOMRB.js";
 import {
   getGoogleAuthConfig,
   getGoogleConnection,
@@ -53,7 +53,7 @@ import {
   removeCloudflareTrafficConnection,
   removeCloudflareTrafficConnectionBySourceId,
   upsertCloudflareTrafficConnection
-} from "./chunk-FDVCTZXD.js";
+} from "./chunk-J6MYB3F4.js";
 import {
   claudeAdapter,
   embedQueries,
@@ -65,7 +65,7 @@ import {
   openrouterAdapter,
   perplexityAdapter,
   startTrafficReclassification
-} from "./chunk-Q4KVK426.js";
+} from "./chunk-TNOYUE2L.js";
 import {
   classifyUsageSurface,
   createApiUsageTelemetry,
@@ -77,7 +77,7 @@ import {
   startOutcomeTimer,
   trackFeatureCompleted,
   trackInstallState
-} from "./chunk-RABCSQBW.js";
+} from "./chunk-YJITDEZR.js";
 import {
   isLoopbackBindHost
 } from "./chunk-TSENU4GG.js";
@@ -85,7 +85,7 @@ import {
   isApiProviderRegistrable,
   isCdpProviderRegistrable,
   registeredProviderNames
-} from "./chunk-C3LS3ZKI.js";
+} from "./chunk-FQ3L2TIX.js";
 import {
   checkLatestVersionForServer,
   getOrCreateAnonymousId,
@@ -97,17 +97,17 @@ import {
   recordDashboardEvent,
   setTelemetryPreference,
   trackEvent
-} from "./chunk-TUQYYF4G.js";
+} from "./chunk-2XCYEBQV.js";
 import {
   createCanonryMcpServer
-} from "./chunk-YO2OW67H.js";
+} from "./chunk-64R66MWZ.js";
 import {
   CANONRY_MCP_TIERS,
   CANONRY_MCP_TOOLKIT_NAMES
 } from "./chunk-MTW37GXF.js";
 import {
   ApiClient
-} from "./chunk-7APKPDOV.js";
+} from "./chunk-OL2L5ANJ.js";
 import {
   AGENT_PROVIDERS,
   adapterSupportsBatch,
@@ -139,21 +139,21 @@ import {
   saveConfigPatch,
   sentimentInstallReadiness,
   updateSharedProviderExecutionGate
-} from "./chunk-RSJBMQMN.js";
+} from "./chunk-BLW327AU.js";
 import {
   getBundledSkillSnapshots
-} from "./chunk-QM4PMS52.js";
+} from "./chunk-RTH5JVC3.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-UBF2S3DF.js";
+} from "./chunk-2Q7JEC6N.js";
 import {
   CanonryMcpToolNames,
   canonryMcpTools
-} from "./chunk-LPSKHUCV.js";
+} from "./chunk-3GMBHGQ5.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -162,16 +162,16 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   IntelligenceService
-} from "./chunk-NLN7EGU3.js";
+} from "./chunk-SAKH2RRF.js";
 import {
   computeCitedCompetitorDomains,
   determineCitationState
-} from "./chunk-5455IRP3.js";
+} from "./chunk-ISIJ2NS4.js";
 import {
   addLogListener,
   createFastifyLogger,
   createLogger
-} from "./chunk-4OGRTTZX.js";
+} from "./chunk-UXXZXXNG.js";
 import {
   BingApiError,
   CC_CACHE_DIR,
@@ -316,7 +316,7 @@ import {
   webhookResponseReason,
   webhookTargetRefusalReason,
   writeAuditLog
-} from "./chunk-FZIYHP67.js";
+} from "./chunk-O22WSFWL.js";
 import {
   OperationalLogStore,
   SentimentIdempotencyConflict,
@@ -407,13 +407,14 @@ import {
   siteCrawlPages,
   siteCrawlRunRequests,
   siteCrawlSnapshots,
+  siteHealthNotifyState,
   siteLivenessState,
   sitemapListSyncs,
   trafficSources,
   unrecognizedAgentEventsHourly,
   unrecognizedAgentNotifyState,
   usageCounters
-} from "./chunk-66DTIEWN.js";
+} from "./chunk-KK3Z34AN.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AI_ENGINE_DOMAINS,
@@ -673,7 +674,7 @@ import {
   winnabilityClassLabel,
   withRetry,
   withSkippedProviders
-} from "./chunk-ZN3KIIMP.js";
+} from "./chunk-ZBTUISPG.js";
 
 // src/google-marketing-runtime.ts
 import crypto2 from "crypto";
@@ -3357,13 +3358,13 @@ function createGoogleMarketingRuntime(options) {
 
 // src/server.ts
 import { createRequire } from "module";
-import crypto27 from "crypto";
+import crypto28 from "crypto";
 import fs5 from "fs";
 import path5 from "path";
 import { isIP as isIP2 } from "net";
 import { fileURLToPath } from "url";
 import { setImmediate as yieldToEventLoop4 } from "timers/promises";
-import { and as and29, eq as eq35, isNotNull as isNotNull5, isNull as isNull8, lte as lte3, max, ne as ne4, or as or4, sql as sql15 } from "drizzle-orm";
+import { and as and30, eq as eq36, isNotNull as isNotNull5, isNull as isNull8, lte as lte3, max, ne as ne4, or as or4, sql as sql15 } from "drizzle-orm";
 
 // src/seo-runtime.ts
 import { eq, inArray } from "drizzle-orm";
@@ -6001,7 +6002,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "58098d90ba7afb8fa38629099f82a91d52ed434c" : void 0;
+  const embedded = true ? "161453e7b8d6e3b33614392ce97134fc484106ec" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -15139,8 +15140,85 @@ async function refreshAllIntegrations(client, projectName, now = /* @__PURE__ */
 }
 
 // src/notifier.ts
-import { eq as eq25, desc as desc9, and as and22, inArray as inArray12, or as or2, isNull as isNull5 } from "drizzle-orm";
+import { eq as eq26, desc as desc10, and as and23, inArray as inArray12, or as or2, isNull as isNull5 } from "drizzle-orm";
+import crypto23 from "crypto";
+
+// src/site-health-alerts.ts
 import crypto22 from "crypto";
+import { and as and22, asc as asc5, desc as desc9, eq as eq25, gt as gt3 } from "drizzle-orm";
+var ISSUE_TITLES = {
+  "missing-h1": "Missing H1",
+  "multiple-h1": "Multiple H1 tags",
+  "missing-title": "Missing title",
+  "names-another-entity": "Names another property"
+};
+var PAGE_BATCH = 500;
+var MAX_EXAMPLES = 5;
+function siteHealthProblemKey(code, url) {
+  return `${code}|${crypto22.createHash("sha256").update(url).digest("hex").slice(0, 16)}`;
+}
+function readSiteHealthScan(db, projectId, runId) {
+  const snapshot = db.select().from(siteCrawlSnapshots).where(and22(eq25(siteCrawlSnapshots.projectId, projectId), eq25(siteCrawlSnapshots.runId, runId))).orderBy(desc9(siteCrawlSnapshots.updatedAt)).limit(1).get();
+  if (!snapshot?.detailsAvailable || !snapshot.attemptId) return null;
+  const scope = and22(
+    eq25(siteCrawlPages.projectId, projectId),
+    eq25(siteCrawlPages.runId, runId),
+    eq25(siteCrawlPages.attemptId, snapshot.attemptId)
+  );
+  const pagesByCode = /* @__PURE__ */ new Map();
+  const keys = /* @__PURE__ */ new Set();
+  let after;
+  for (; ; ) {
+    const pages = db.select({ nodeKey: siteCrawlPages.nodeKey, url: siteCrawlPages.url, auditFields: siteCrawlPages.auditFields }).from(siteCrawlPages).where(after === void 0 ? scope : and22(scope, gt3(siteCrawlPages.nodeKey, after))).orderBy(asc5(siteCrawlPages.nodeKey)).limit(PAGE_BATCH).all();
+    for (const page of pages) {
+      const defects = page.auditFields.criticalDefects;
+      for (const defect of Array.isArray(defects) ? defects : []) {
+        if (!defect || typeof defect !== "object") continue;
+        const { id, severity } = defect;
+        if (typeof id !== "string" || id === "" || severity !== "critical") continue;
+        const key = siteHealthProblemKey(id, page.url);
+        keys.add(key);
+        let pagesForCode = pagesByCode.get(id);
+        if (!pagesForCode) {
+          pagesForCode = /* @__PURE__ */ new Map();
+          pagesByCode.set(id, pagesForCode);
+        }
+        pagesForCode.set(key, page.url);
+      }
+    }
+    if (pages.length < PAGE_BATCH) break;
+    after = pages.at(-1).nodeKey;
+  }
+  return { complete: snapshot.complete, pagesByCode, keys };
+}
+function newSiteHealthIssues(scan, reported) {
+  const issues = [];
+  for (const [code, pages] of scan.pagesByCode) {
+    const fresh = [...pages].filter(([key]) => !reported.has(key)).map(([, url]) => url).sort(compareText);
+    if (fresh.length === 0) continue;
+    issues.push({
+      code,
+      title: ISSUE_TITLES[code] ?? code,
+      severity: "critical",
+      affectedPages: pages.size,
+      newPages: fresh.length,
+      examples: fresh.slice(0, MAX_EXAMPLES)
+    });
+  }
+  return issues.sort((a, b) => b.newPages - a.newPages || compareText(a.code, b.code));
+}
+function settledSiteHealthKeys(scan, reported) {
+  return [...scan.complete ? scan.keys : /* @__PURE__ */ new Set([...reported, ...scan.keys])].sort(compareText);
+}
+function readSiteHealthNotifyState(db, projectId) {
+  return db.select().from(siteHealthNotifyState).where(eq25(siteHealthNotifyState.projectId, projectId)).get() ?? null;
+}
+function writeSiteHealthNotifyState(db, input) {
+  const values = { reportedKeys: input.reportedKeys, runId: input.runId, updatedAt: input.updatedAt, notifiedAt: input.notifiedAt };
+  db.insert(siteHealthNotifyState).values({ projectId: input.projectId, ...values }).onConflictDoUpdate({ target: siteHealthNotifyState.projectId, set: values }).run();
+}
+
+// src/notifier.ts
 var log24 = createLogger("Notifier");
 var sampleDelivery = createOutcomeSampler({ burst: 20, refillMs: 6e4, now: () => Date.now() });
 function trackWebhookDelivery(input) {
@@ -15262,18 +15340,18 @@ var Notifier = class {
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId, opts) {
     log24.info("run.completed", { runId, projectId, origin: opts?.origin ?? "sweep" });
-    const notifs = this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    const notifs = this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) {
       log24.info("notifications.none-enabled", { projectId });
       return;
     }
     log24.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq25(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq26(runs.id, runId)).get();
     if (!run) {
       log24.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
     if (!project) {
       log24.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
@@ -15352,7 +15430,7 @@ var Notifier = class {
    * than inferred from the absence of a webhook.
    */
   async onHealthChecked(projectId, report) {
-    const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
     if (!project) {
       log24.error("project.not-found", { projectId, msg: "skipping health notification" });
       return null;
@@ -15385,7 +15463,7 @@ var Notifier = class {
     const status = noSignal ? "warn" : worst ? worst.status : "ok";
     const code = noSignal ? HEALTH_NO_SIGNAL_CODE : worst?.code ?? "health.ok";
     const summary = noSignal ? `No health check produced a result (${healthChecks.length} skipped) \u2014 health is unknown, not confirmed.` : worst?.summary ?? `All ${graded.length} health check(s) passing.`;
-    const previous = this.db.select().from(doctorHealthState).where(eq25(doctorHealthState.projectId, projectId)).get();
+    const previous = this.db.select().from(doctorHealthState).where(eq26(doctorHealthState.projectId, projectId)).get();
     const previousStatus = previous?.status ?? null;
     const failingSignature = failing.map((c) => `${c.status}:${c.code}`).join(",");
     const failingNow = failing.map((c) => ({ id: c.id, code: c.code, rank: rank(c.status) }));
@@ -15455,7 +15533,7 @@ var Notifier = class {
     const urgentById = new Map(urgentItems.map((item) => [item.id, item]));
     const generalEvent = event;
     const urgentRecord = previous?.urgentNotified ?? null;
-    const enabled = generalEvent || urgentItems.length > 0 || urgentRecord ? this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled) : [];
+    const enabled = generalEvent || urgentItems.length > 0 || urgentRecord ? this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled) : [];
     const listedEvents = (notif) => notif.config.events;
     const hasUrl = (notif) => Boolean(notif.config.url);
     const urgentSubscribers = enabled.filter((n) => hasUrl(n) && (listedEvents(n) ?? []).some((e) => URGENT_HEALTH_EVENTS.has(e)));
@@ -15503,7 +15581,7 @@ var Notifier = class {
     if (previous === void 0) {
       this.db.insert(doctorHealthState).values({ ...observation, notifiedAt: null }).run();
     } else {
-      this.db.update(doctorHealthState).set(observation).where(eq25(doctorHealthState.projectId, projectId)).run();
+      this.db.update(doctorHealthState).set(observation).where(eq26(doctorHealthState.projectId, projectId)).run();
     }
     for (const group of urgentGroups) {
       const { urgentEvent, urgentTold, urgentNew, urgentCleared, urgentNotifs, urgentSettled } = group;
@@ -15547,7 +15625,7 @@ var Notifier = class {
       }
       if (accepted > 0) {
         recordUrgentReceipts(urgentReceipts, group.subscribers, formatUrgentBreaches(urgentSettled) || null);
-        this.db.update(doctorHealthState).set({ urgentNotified: doctorUrgentSummary(urgentReceipts), urgentReceipts }).where(eq25(doctorHealthState.projectId, projectId)).run();
+        this.db.update(doctorHealthState).set({ urgentNotified: doctorUrgentSummary(urgentReceipts), urgentReceipts }).where(eq26(doctorHealthState.projectId, projectId)).run();
       }
       if (urgentNotifs.length > 0) {
         log24.info("health.urgent-notified", {
@@ -15591,7 +15669,7 @@ var Notifier = class {
       if (await this.sendWebhook(config.url, payload, notif.id, projectId, notif.webhookSecret ?? null)) delivered += 1;
     }
     if (delivered > 0) {
-      this.db.update(doctorHealthState).set({ notifiedAt: now, notifiedSignature: formatBreaches(failingNow), pendingSignature: null }).where(eq25(doctorHealthState.projectId, projectId)).run();
+      this.db.update(doctorHealthState).set({ notifiedAt: now, notifiedSignature: formatBreaches(failingNow), pendingSignature: null }).where(eq26(doctorHealthState.projectId, projectId)).run();
     }
     log24.info("health.notified", {
       projectId,
@@ -15621,12 +15699,12 @@ var Notifier = class {
   async onSiteLivenessChecked(projectId, result) {
     const { check, checkedAt } = result;
     if (check.status !== "ok" && check.status !== "fail") return null;
-    const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
     if (!project) {
       log24.error("project.not-found", { projectId, msg: "skipping site liveness notification" });
       return null;
     }
-    const previous = this.db.select().from(siteLivenessState).where(eq25(siteLivenessState.projectId, projectId)).get();
+    const previous = this.db.select().from(siteLivenessState).where(eq26(siteLivenessState.projectId, projectId)).get();
     const sincePrevious = previous ? Date.parse(checkedAt) - Date.parse(previous.checkedAt) : Number.NaN;
     const countsAsRepeat = Number.isFinite(sincePrevious) && sincePrevious >= SITE_LIVENESS_MIN_PASS_GAP_MS && sincePrevious <= SITE_LIVENESS_MAX_PASS_GAP_MS;
     const failures = check.status === "fail" ? countsAsRepeat ? (previous?.consecutiveFailures ?? 0) + 1 : 1 : 0;
@@ -15636,7 +15714,7 @@ var Notifier = class {
     if (check.status === "ok" && outagePaged) event = "health.recovered";
     const confirmed = check.status === "fail" && failures >= SITE_LIVENESS_FAILURES_TO_PAGE;
     const urgentRecord = previous?.urgentNotifiedAt ?? null;
-    const enabled = event !== null || confirmed || urgentRecord !== null ? this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled) : [];
+    const enabled = event !== null || confirmed || urgentRecord !== null ? this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled) : [];
     const listedEvents = (notif) => notif.config.events;
     const hasUrl = (notif) => Boolean(notif.config.url);
     const scoped = enabled.filter((n) => hasUrl(n) && (listedEvents(n) ?? []).some((e) => URGENT_HEALTH_EVENTS.has(e)));
@@ -15669,7 +15747,7 @@ var Notifier = class {
     if (previous === void 0) {
       this.db.insert(siteLivenessState).values(observation).run();
     } else {
-      this.db.update(siteLivenessState).set(observation).where(eq25(siteLivenessState.projectId, projectId)).run();
+      this.db.update(siteLivenessState).set(observation).where(eq26(siteLivenessState.projectId, projectId)).run();
     }
     if (!event && urgentGroups.every((group) => group.urgentEvent === null)) return null;
     const payloadFor = (name) => {
@@ -15705,7 +15783,7 @@ var Notifier = class {
         }
       }
       if (event === "health.degraded" && delivered > 0) {
-        this.db.update(siteLivenessState).set({ notifiedAt: checkedAt }).where(eq25(siteLivenessState.projectId, projectId)).run();
+        this.db.update(siteLivenessState).set({ notifiedAt: checkedAt }).where(eq26(siteLivenessState.projectId, projectId)).run();
       }
       log24.info("site-liveness.notified", { projectId, event, code: check.code, subscribers: notifs.length, delivered });
     }
@@ -15719,7 +15797,7 @@ var Notifier = class {
       }
       if (accepted > 0) {
         recordUrgentReceipts(urgentReceipts, group.subscribers, group.settled);
-        this.db.update(siteLivenessState).set({ urgentNotifiedAt: siteUrgentSummary(urgentReceipts), urgentReceipts }).where(eq25(siteLivenessState.projectId, projectId)).run();
+        this.db.update(siteLivenessState).set({ urgentNotifiedAt: siteUrgentSummary(urgentReceipts), urgentReceipts }).where(eq26(siteLivenessState.projectId, projectId)).run();
       }
       if (urgentNotifs.length > 0 || generalIds.size > 0) {
         log24.info("site-liveness.urgent-notified", { projectId, event: urgentEvent, code: check.code, subscribers: urgentNotifs.length + generalIds.size, delivered: accepted });
@@ -15745,7 +15823,7 @@ var Notifier = class {
    */
   isNewInsightNews(projectId, insight) {
     const key = insightNotifyKey(projectId, insight);
-    const previous = this.db.select().from(insightNotifyState).where(eq25(insightNotifyState.key, key)).get();
+    const previous = this.db.select().from(insightNotifyState).where(eq26(insightNotifyState.key, key)).get();
     if (!previous) return true;
     if (severityRank(insight.severity) > severityRank(previous.severity)) return true;
     const magnitude = insightMagnitude(insight);
@@ -15767,9 +15845,9 @@ var Notifier = class {
       magnitude: insightMagnitude(insight),
       notifiedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const existing = this.db.select().from(insightNotifyState).where(eq25(insightNotifyState.key, key)).get();
+    const existing = this.db.select().from(insightNotifyState).where(eq26(insightNotifyState.key, key)).get();
     if (existing) {
-      this.db.update(insightNotifyState).set(row).where(eq25(insightNotifyState.key, key)).run();
+      this.db.update(insightNotifyState).set(row).where(eq26(insightNotifyState.key, key)).run();
     } else {
       this.db.insert(insightNotifyState).values(row).run();
     }
@@ -15783,11 +15861,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled);
+    const notifs = this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq25(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq26(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = notif.config;
@@ -15868,9 +15946,9 @@ var Notifier = class {
     return delivered;
   }
   async dispatchQueuedReviewAlerts(projectId) {
-    const pendingReviews = this.db.select().from(gbpReviews).where(and22(eq25(gbpReviews.projectId, projectId), eq25(gbpReviews.alertState, "pending"))).all();
-    const pendingRatings = this.db.select().from(gbpReviewRatings).where(and22(eq25(gbpReviewRatings.projectId, projectId), eq25(gbpReviewRatings.alertState, "pending"))).all();
-    const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+    const pendingReviews = this.db.select().from(gbpReviews).where(and23(eq26(gbpReviews.projectId, projectId), eq26(gbpReviews.alertState, "pending"))).all();
+    const pendingRatings = this.db.select().from(gbpReviewRatings).where(and23(eq26(gbpReviewRatings.projectId, projectId), eq26(gbpReviewRatings.alertState, "pending"))).all();
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
     if (!project) return { reviews: 0, ratingDrops: 0, delivered: 0 };
     const chatSendsLeft = /* @__PURE__ */ new Map();
     const now = /* @__PURE__ */ new Date();
@@ -15882,10 +15960,10 @@ var Notifier = class {
         displayName: gbpLocations.displayName,
         mapsUri: gbpLocations.mapsUri,
         reviewsAccess: gbpLocations.reviewsAccess
-      }).from(gbpLocations).where(eq25(gbpLocations.projectId, projectId)).all().map((loc) => [loc.locationName, loc])
+      }).from(gbpLocations).where(eq26(gbpLocations.projectId, projectId)).all().map((loc) => [loc.locationName, loc])
     );
     const v4HasWorked = new Set(
-      this.db.select({ locationName: gbpReviewRatings.locationName }).from(gbpReviewRatings).where(and22(eq25(gbpReviewRatings.projectId, projectId), eq25(gbpReviewRatings.origin, "gbp"))).all().map((row) => row.locationName)
+      this.db.select({ locationName: gbpReviewRatings.locationName }).from(gbpReviewRatings).where(and23(eq26(gbpReviewRatings.projectId, projectId), eq26(gbpReviewRatings.origin, "gbp"))).all().map((row) => row.locationName)
     );
     const coveredByBusinessProfile = (locationName) => businessProfileReviewsCover(locations.get(locationName)?.reviewsAccess ?? null, v4HasWorked.has(locationName));
     const locationRef = (locationName) => {
@@ -15914,7 +15992,7 @@ var Notifier = class {
       else if (row.rating === null || row.previousRating === null) setRatingState([row.id], "none");
       else ratingsToSend.push(row);
     }
-    const enabled = this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled && n.config.url);
+    const enabled = this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled && n.config.url);
     const subscribedTo = (event) => enabled.filter((n) => (n.config.events ?? []).includes(event));
     const projectRef = { name: project.name, canonicalDomain: project.canonicalDomain };
     const dashboardUrl = `${this.serverUrl}/projects/${project.name}`;
@@ -15968,13 +16046,13 @@ var Notifier = class {
             if (!sent) all = false;
           }
           if (all) {
-            this.db.update(gbpReviews).set({ alertState: "sent", alertStateAt: nowIso }).where(and22(
-              eq25(gbpReviews.id, review.id),
-              eq25(gbpReviews.alertState, "pending"),
-              eq25(gbpReviews.updateTime, review.updateTime),
-              review.alertStateAt === null ? isNull5(gbpReviews.alertStateAt) : eq25(gbpReviews.alertStateAt, review.alertStateAt),
-              review.comment === null ? isNull5(gbpReviews.comment) : eq25(gbpReviews.comment, review.comment),
-              review.starRating === null ? isNull5(gbpReviews.starRating) : eq25(gbpReviews.starRating, review.starRating)
+            this.db.update(gbpReviews).set({ alertState: "sent", alertStateAt: nowIso }).where(and23(
+              eq26(gbpReviews.id, review.id),
+              eq26(gbpReviews.alertState, "pending"),
+              eq26(gbpReviews.updateTime, review.updateTime),
+              review.alertStateAt === null ? isNull5(gbpReviews.alertStateAt) : eq26(gbpReviews.alertStateAt, review.alertStateAt),
+              review.comment === null ? isNull5(gbpReviews.comment) : eq26(gbpReviews.comment, review.comment),
+              review.starRating === null ? isNull5(gbpReviews.starRating) : eq26(gbpReviews.starRating, review.starRating)
             )).run();
           }
         }
@@ -16015,7 +16093,7 @@ var Notifier = class {
     return { reviews: reviewsToSend.length, ratingDrops: ratingsToSend.length, delivered };
   }
   computeTransitions(runId, projectId) {
-    const thisRun = this.db.select().from(runs).where(eq25(runs.id, runId)).get();
+    const thisRun = this.db.select().from(runs).where(eq26(runs.id, runId)).get();
     if (!thisRun) return [];
     const completeness = measurementRunCompleteness(this.db, runId);
     if (completeness.planned && !completeness.complete) {
@@ -16026,10 +16104,10 @@ var Notifier = class {
       });
       return [];
     }
-    const groupSiblings = this.db.select().from(runs).where(and22(
-      eq25(runs.projectId, projectId),
-      eq25(runs.kind, thisRun.kind),
-      eq25(runs.createdAt, thisRun.createdAt),
+    const groupSiblings = this.db.select().from(runs).where(and23(
+      eq26(runs.projectId, projectId),
+      eq26(runs.kind, thisRun.kind),
+      eq26(runs.createdAt, thisRun.createdAt),
       notProbeRun()
     )).all();
     const stillPending = groupSiblings.some((r) => r.status === "queued" || r.status === "running");
@@ -16046,20 +16124,20 @@ var Notifier = class {
       return candidate.id > best.id ? candidate : best;
     });
     if (winner.id !== runId) return [];
-    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq25(projects.id, projectId)).get();
+    const projectLocations = this.db.select({ locations: projects.locations }).from(projects).where(eq26(projects.id, projectId)).get();
     const locationCount = Math.max(
       1,
       (projectLocations?.locations ?? []).length
     );
     const RECENT_FETCH_LIMIT = Math.max(8, locationCount * 4);
     const recentRuns = this.db.select().from(runs).where(
-      and22(
-        eq25(runs.projectId, projectId),
-        eq25(runs.kind, thisRun.kind),
-        or2(eq25(runs.status, "completed"), eq25(runs.status, "partial")),
+      and23(
+        eq26(runs.projectId, projectId),
+        eq26(runs.kind, thisRun.kind),
+        or2(eq26(runs.status, "completed"), eq26(runs.status, "partial")),
         notProbeRun()
       )
-    ).orderBy(desc9(runs.createdAt), desc9(runs.id)).limit(RECENT_FETCH_LIMIT).all();
+    ).orderBy(desc10(runs.createdAt), desc10(runs.id)).limit(RECENT_FETCH_LIMIT).all();
     const groups = groupRunsByCreatedAt(recentRuns);
     const currentGroupIdx = groups.findIndex((g) => g[0]?.createdAt === thisRun.createdAt);
     if (currentGroupIdx < 0) return [];
@@ -16074,7 +16152,7 @@ var Notifier = class {
       provider: querySnapshots.provider,
       location: querySnapshots.location,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(queries, eq25(querySnapshots.queryId, queries.id)).where(inArray12(querySnapshots.runId, currentRunIds)).all();
+    }).from(querySnapshots).leftJoin(queries, eq26(querySnapshots.queryId, queries.id)).where(inArray12(querySnapshots.runId, currentRunIds)).all();
     const previousSnapshots = this.db.select({
       queryId: querySnapshots.queryId,
       provider: querySnapshots.provider,
@@ -16125,12 +16203,12 @@ var Notifier = class {
         recordUnrecognizedAgentDecisions(this.db, projectId, baseline, UnrecognizedAgentNotifyStates.baseline, now);
         if (due.length === 0) continue;
         const names = due.map((agent) => agent.name);
-        const subscribed = this.db.select().from(notifications).where(eq25(notifications.projectId, projectId)).all().filter((n) => n.enabled && n.config.url && n.config.events.includes("traffic.agent.discovered"));
+        const subscribed = this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled && n.config.url && n.config.events.includes("traffic.agent.discovered"));
         if (subscribed.length === 0) {
           recordUnrecognizedAgentDecisions(this.db, projectId, names, UnrecognizedAgentNotifyStates.skipped, now);
           continue;
         }
-        const project = this.db.select().from(projects).where(eq25(projects.id, projectId)).get();
+        const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
         if (!project) continue;
         const payload = {
           source: "canonry",
@@ -16153,6 +16231,73 @@ var Notifier = class {
     }
     return sentNames;
   }
+  /**
+   * After a site audit, send `site-health.issue.new` to the webhooks that list
+   * it when the scan found a critical page problem on a page where it was not
+   * reported before.
+   *
+   * What was reported lives in `site_health_notify_state`. It changes when a
+   * subscriber accepts an alert, so a refused alert is owed again after the
+   * next audit, and when a complete scan no longer finds a problem, so the
+   * problem is reported again if it comes back. A partial scan may have missed
+   * pages, so it never clears anything. Nothing is recorded while no webhook
+   * subscribes: a new subscriber hears about every current problem once.
+   *
+   * Returns the event sent, or null when nothing was sent, so "stayed quiet" is
+   * observable in tests.
+   */
+  async onSiteAuditCompleted(runId, projectId) {
+    const run = this.db.select().from(runs).where(eq26(runs.id, runId)).get();
+    if (!run || run.kind !== RunKinds["site-audit"]) return null;
+    if (run.status !== RunStatuses.completed && run.status !== RunStatuses.partial) return null;
+    const subscribed = this.db.select().from(notifications).where(eq26(notifications.projectId, projectId)).all().filter((n) => n.enabled && n.config.url && n.config.events.includes("site-health.issue.new"));
+    if (subscribed.length === 0) return null;
+    const project = this.db.select().from(projects).where(eq26(projects.id, projectId)).get();
+    if (!project) return null;
+    const scan = readSiteHealthScan(this.db, projectId, runId);
+    if (!scan) return null;
+    const state = readSiteHealthNotifyState(this.db, projectId);
+    const reported = new Set(state?.reportedKeys ?? []);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const issues = newSiteHealthIssues(scan, reported);
+    if (issues.length === 0) {
+      if (state && scan.complete) {
+        writeSiteHealthNotifyState(this.db, {
+          projectId,
+          runId,
+          reportedKeys: settledSiteHealthKeys(scan, reported),
+          updatedAt: now,
+          notifiedAt: state.notifiedAt
+        });
+      }
+      return null;
+    }
+    const payload = {
+      source: "canonry",
+      event: "site-health.issue.new",
+      project: { name: project.name, canonicalDomain: project.canonicalDomain },
+      run: { id: run.id, status: run.status, finishedAt: run.finishedAt },
+      scanComplete: scan.complete,
+      issues,
+      dashboardUrl: `${this.serverUrl}/projects/${project.name}/technical-aeo`
+    };
+    let accepted = false;
+    for (const notif of subscribed) {
+      if (await this.sendWebhook(notif.config.url, payload, notif.id, projectId, notif.webhookSecret ?? null)) accepted = true;
+    }
+    if (!accepted) {
+      log24.info("site-health.alert-owed", { runId, projectId, issues: issues.length });
+      return null;
+    }
+    writeSiteHealthNotifyState(this.db, {
+      projectId,
+      runId,
+      reportedKeys: settledSiteHealthKeys(scan, reported),
+      updatedAt: now,
+      notifiedAt: now
+    });
+    return "site-health.issue.new";
+  }
   async sendWebhook(url, payload, notificationId, projectId, webhookSecret) {
     const elapsed = startOutcomeTimer();
     const destination = resolveDestination(url);
@@ -16220,7 +16365,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto22.randomUUID(),
+      id: crypto23.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -16233,7 +16378,7 @@ var Notifier = class {
 };
 
 // src/run-coordinator.ts
-import { eq as eq26 } from "drizzle-orm";
+import { eq as eq27 } from "drizzle-orm";
 var log25 = createLogger("RunCoordinator");
 function reportInsightsGenerated(runTrigger, outcome) {
   trackFeatureCompleted({
@@ -16267,7 +16412,7 @@ var RunCoordinator = class {
    */
   onAnswersRecorded;
   async onRunCompleted(runId, projectId, opts) {
-    const runRow = this.db.select().from(runs).where(eq26(runs.id, runId)).get();
+    const runRow = this.db.select().from(runs).where(eq27(runs.id, runId)).get();
     const kind = runRow?.kind ?? RunKinds["answer-visibility"];
     if (runRow?.trigger === RunTriggers.probe) {
       log25.info("probe.skip-side-effects", { runId, projectId, kind });
@@ -16361,6 +16506,13 @@ var RunCoordinator = class {
     } catch (err) {
       log25.error("notifier.failed", { runId, error: describeError(err) });
     }
+    if (kind === RunKinds["site-audit"]) {
+      try {
+        await this.notifier.onSiteAuditCompleted(runId, projectId);
+      } catch (err) {
+        log25.error("site-health-webhook.failed", { runId, error: describeError(err) });
+      }
+    }
     if (this.onAeroEvent) {
       try {
         const ctx = kind === RunKinds["aeo-discover-probe"] ? this.buildDiscoveryAeroContext(runId, projectId, runRow?.status === "failed" ? "failed" : "completed", runRow?.error ?? null) : {
@@ -16387,7 +16539,7 @@ var RunCoordinator = class {
    * so the Aero queue is never starved of a follow-up.
    */
   buildDiscoveryAeroContext(runId, projectId, status, error) {
-    const session = this.db.select().from(discoverySessions).where(eq26(discoverySessions.runId, runId)).get();
+    const session = this.db.select().from(discoverySessions).where(eq27(discoverySessions.runId, runId)).get();
     const competitorMap = session ? session.competitorMap : [];
     return {
       kind: RunKinds["aeo-discover-probe"],
@@ -16429,8 +16581,8 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto24 from "crypto";
-import { eq as eq29 } from "drizzle-orm";
+import crypto25 from "crypto";
+import { eq as eq30 } from "drizzle-orm";
 
 // src/agent/remote-mcp.ts
 import { Type } from "@earendil-works/pi-ai";
@@ -16534,8 +16686,8 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto23 from "crypto";
-import { and as and23, desc as desc10, eq as eq27, like, sql as sql12, or as or3 } from "drizzle-orm";
+import crypto24 from "crypto";
+import { and as and24, desc as desc11, eq as eq28, like, sql as sql12, or as or3 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
 function rowToDto(row) {
@@ -16549,7 +16701,7 @@ function rowToDto(row) {
   };
 }
 function listMemoryEntries(db, projectId, opts = {}) {
-  const query = db.select().from(agentMemory).where(eq27(agentMemory.projectId, projectId)).orderBy(desc10(agentMemory.updatedAt));
+  const query = db.select().from(agentMemory).where(eq28(agentMemory.projectId, projectId)).orderBy(desc11(agentMemory.updatedAt));
   const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
   return rows.map(rowToDto);
 }
@@ -16563,7 +16715,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto23.randomUUID();
+  const id = crypto24.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -16580,22 +16732,22 @@ function upsertMemoryEntry(db, args) {
       updatedAt: now
     }
   }).run();
-  const row = db.select().from(agentMemory).where(and23(eq27(agentMemory.projectId, args.projectId), eq27(agentMemory.key, args.key))).get();
+  const row = db.select().from(agentMemory).where(and24(eq28(agentMemory.projectId, args.projectId), eq28(agentMemory.key, args.key))).get();
   if (!row) throw new Error("memory upsert produced no row");
   return rowToDto(row);
 }
 function deleteMemoryEntry(db, projectId, key) {
-  const result = db.delete(agentMemory).where(and23(eq27(agentMemory.projectId, projectId), eq27(agentMemory.key, key))).run();
+  const result = db.delete(agentMemory).where(and24(eq28(agentMemory.projectId, projectId), eq28(agentMemory.key, key))).run();
   const changes = result.changes ?? 0;
   return changes > 0;
 }
 function loadRecentForHydrate(db, projectId, limit, sessionId) {
   if (sessionId === void 0) return listMemoryEntries(db, projectId, { limit });
   const sessionPrefix = `compaction:${sessionId ?? ""}:`;
-  return db.select().from(agentMemory).where(and23(
-    eq27(agentMemory.projectId, projectId),
+  return db.select().from(agentMemory).where(and24(
+    eq28(agentMemory.projectId, projectId),
     or3(sql12`substr(${agentMemory.key}, 1, ${COMPACTION_KEY_PREFIX.length}) <> ${COMPACTION_KEY_PREFIX}`, sessionId ? sql12`substr(${agentMemory.key}, 1, ${sessionPrefix.length}) = ${sessionPrefix}` : void 0)
-  )).orderBy(desc10(agentMemory.updatedAt)).limit(limit).all().map(rowToDto);
+  )).orderBy(desc11(agentMemory.updatedAt)).limit(limit).all().map(rowToDto);
 }
 function writeCompactionNote(db, args) {
   if (Buffer.byteLength(args.summary, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
@@ -16605,7 +16757,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto23.randomUUID();
+  const id = crypto24.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -16619,16 +16771,16 @@ function writeCompactionNote(db, args) {
     }).run();
     const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
     const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
-      and23(
-        eq27(agentMemory.projectId, args.projectId),
+      and24(
+        eq28(agentMemory.projectId, args.projectId),
         like(agentMemory.key, `${sessionPrefix}%`)
       )
-    ).orderBy(desc10(agentMemory.updatedAt)).all();
+    ).orderBy(desc11(agentMemory.updatedAt)).all();
     const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
     if (stale.length > 0) {
       tx.delete(agentMemory).where(sql12`${agentMemory.id} IN (${sql12.join(stale.map((s) => sql12`${s}`), sql12`, `)})`).run();
     }
-    const row = tx.select().from(agentMemory).where(and23(eq27(agentMemory.projectId, args.projectId), eq27(agentMemory.key, key))).get();
+    const row = tx.select().from(agentMemory).where(and24(eq28(agentMemory.projectId, args.projectId), eq28(agentMemory.key, key))).get();
     if (row) inserted = rowToDto(row);
   });
   if (!inserted) throw new Error("compaction note write produced no row");
@@ -16702,7 +16854,7 @@ function trackAeroTurn(agent, turn) {
 }
 
 // src/agent/project-shape.ts
-import { and as and24, count as count5, eq as eq28 } from "drizzle-orm";
+import { and as and25, count as count5, eq as eq29 } from "drizzle-orm";
 var ADVANCED_TOOLS = [
   "canonry_measurement_portfolio_summary",
   "canonry_measurement_overview",
@@ -16729,10 +16881,10 @@ var ADVANCED_ROUTES = [
 ];
 function aeroProjectShape(db, projectId) {
   try {
-    const pointer = db.select().from(measurementPlans).where(eq28(measurementPlans.projectId, projectId)).get();
-    const version = pointer ? db.select().from(measurementPlanVersions).where(and24(
-      eq28(measurementPlanVersions.projectId, projectId),
-      eq28(measurementPlanVersions.id, pointer.activeVersionId)
+    const pointer = db.select().from(measurementPlans).where(eq29(measurementPlans.projectId, projectId)).get();
+    const version = pointer ? db.select().from(measurementPlanVersions).where(and25(
+      eq29(measurementPlanVersions.projectId, projectId),
+      eq29(measurementPlanVersions.id, pointer.activeVersionId)
     )).get() : void 0;
     if (version) {
       const plan = JSON.parse(version.canonicalJson);
@@ -16759,7 +16911,7 @@ canonry_visibility_report describes the whole project, not one Property. canonry
         pinned: ADVANCED_TOOLS
       };
     }
-    const tracked = db.select({ total: count5() }).from(queries).where(eq28(queries.projectId, projectId)).get()?.total ?? 0;
+    const tracked = db.select({ total: count5() }).from(queries).where(eq29(queries.projectId, projectId)).get()?.total ?? 0;
     return {
       prompt: `
 
@@ -17018,7 +17170,7 @@ var SessionRegistry = class {
           modelProvider: effectiveProvider,
           modelId: effectiveModelId,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(eq29(agentSessions.projectId, projectId)).run();
+        }).where(eq30(agentSessions.projectId, projectId)).run();
       }
       const agent2 = createAeroSession({
         projectName,
@@ -17047,7 +17199,7 @@ var SessionRegistry = class {
       return agent2;
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
-    const sessionId = crypto24.randomUUID();
+    const sessionId = crypto25.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -17337,7 +17489,7 @@ ${lines.join("\n")}
       modelProvider: nextProvider,
       modelId: nextModelId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq29(agentSessions.projectId, projectId)).run();
+    }).where(eq30(agentSessions.projectId, projectId)).run();
   }
   /** Snapshot pending work without consuming it before an atomic conversation switch. */
   prepareConversationChange(projectName) {
@@ -17545,7 +17697,7 @@ ${lines.join("\n")}
   providerAccountKey(provider, apiKey) {
     const canonical = coerceAgentProvider(provider);
     const vendor = canonical ? getAgentProvider(canonical).piAiProvider : provider;
-    return crypto24.createHash("sha256").update(JSON.stringify([vendor, apiKey ?? ""])).digest("hex");
+    return crypto25.createHash("sha256").update(JSON.stringify([vendor, apiKey ?? ""])).digest("hex");
   }
   providerCoolingDown(projectName) {
     for (const [key, cooldown] of this.providerCooldowns) {
@@ -17562,18 +17714,18 @@ ${lines.join("\n")}
     return id;
   }
   tryResolveProjectId(projectName) {
-    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq29(projects.name, projectName)).get();
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq30(projects.name, projectName)).get();
     return row?.id;
   }
   loadRow(projectId) {
-    const row = this.opts.db.select().from(agentSessions).where(eq29(agentSessions.projectId, projectId)).get();
+    const row = this.opts.db.select().from(agentSessions).where(eq30(agentSessions.projectId, projectId)).get();
     return row ?? null;
   }
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const modelProvider = params.provider ?? params.modelProvider ?? AgentProviderIds.claude;
     this.opts.db.insert(agentSessions).values({
-      id: params.id ?? crypto24.randomUUID(),
+      id: params.id ?? crypto25.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider,
@@ -17586,7 +17738,7 @@ ${lines.join("\n")}
   }
   updateRow(projectId, patch) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq29(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq30(agentSessions.projectId, projectId)).run();
   }
   /**
    * Store a refreshed prompt snapshot without touching `updatedAt`, which the
@@ -17595,13 +17747,13 @@ ${lines.join("\n")}
    * recently used right after an upgrade.
    */
   persistPromptSnapshot(projectId, systemPrompt) {
-    this.opts.db.update(agentSessions).set({ systemPrompt }).where(eq29(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ systemPrompt }).where(eq30(agentSessions.projectId, projectId)).run();
   }
 };
 
 // src/agent/viewer-sessions.ts
-import crypto25 from "crypto";
-import { and as and25, eq as eq30, isNotNull as isNotNull4, like as like2 } from "drizzle-orm";
+import crypto26 from "crypto";
+import { and as and26, eq as eq31, isNotNull as isNotNull4, like as like2 } from "drizzle-orm";
 var AERO_VIEWER_EXCLUDED_MCP_TOOLS = /* @__PURE__ */ new Set([
   CanonryMcpToolNames.canonry_ads_account,
   CanonryMcpToolNames.canonry_ads_geo_search,
@@ -17654,8 +17806,8 @@ function trimViewerTranscript(messages, max2 = MAX_VIEWER_MESSAGES) {
 }
 var VIEWER_IDLE_MS = 12 * 60 * 60 * 1e3;
 function mintViewerAeroKey(db, userId, now = /* @__PURE__ */ new Date()) {
-  const raw = `cnry_${crypto25.randomBytes(24).toString("hex")}`;
-  const id = crypto25.randomUUID();
+  const raw = `cnry_${crypto26.randomBytes(24).toString("hex")}`;
+  const id = crypto26.randomUUID();
   db.insert(apiKeys).values({
     id,
     name: `${VIEWER_AERO_KEY_PREFIX}${userId}`,
@@ -17778,12 +17930,12 @@ var ViewerAeroSessions = class {
    */
   removeKey(id) {
     try {
-      this.opts.db.delete(apiKeys).where(eq30(apiKeys.id, id)).run();
+      this.opts.db.delete(apiKeys).where(eq31(apiKeys.id, id)).run();
     } catch {
       try {
         this.opts.db.transaction((tx) => {
-          tx.delete(dashboardSessions).where(eq30(dashboardSessions.apiKeyId, id)).run();
-          tx.update(apiKeys).set({ revokedAt: new Date(this.now()).toISOString() }).where(eq30(apiKeys.id, id)).run();
+          tx.delete(dashboardSessions).where(eq31(dashboardSessions.apiKeyId, id)).run();
+          tx.update(apiKeys).set({ revokedAt: new Date(this.now()).toISOString() }).where(eq31(apiKeys.id, id)).run();
         });
       } catch {
       }
@@ -17796,7 +17948,7 @@ var ViewerAeroSessions = class {
    */
   revokeOrphanedKeys() {
     try {
-      this.opts.db.delete(apiKeys).where(and25(like2(apiKeys.name, `${VIEWER_AERO_KEY_PREFIX}%`), isNotNull4(apiKeys.delegatedUserId))).run();
+      this.opts.db.delete(apiKeys).where(and26(like2(apiKeys.name, `${VIEWER_AERO_KEY_PREFIX}%`), isNotNull4(apiKeys.delegatedUserId))).run();
     } catch {
     }
   }
@@ -17811,9 +17963,9 @@ var ViewerAeroSessions = class {
 };
 
 // src/mcp-http.ts
-import crypto26 from "crypto";
+import crypto27 from "crypto";
 import { isIP } from "net";
-import { and as and26, eq as eq31, isNull as isNull6 } from "drizzle-orm";
+import { and as and27, eq as eq32, isNull as isNull6 } from "drizzle-orm";
 import { NodeStreamableHTTPServerTransport, toNodeHandler, toWebRequest } from "@modelcontextprotocol/node";
 import { McpServer, createMcpHandler, isInitializeRequest, isLegacyRequest } from "@modelcontextprotocol/server";
 var SESSION_IDLE_MS = 10 * 60 * 1e3;
@@ -17822,8 +17974,8 @@ var MAX_CLEANUP_RETRIES_PER_SWEEP = 8;
 var MAX_PENDING_KEY_RETIREMENTS = 256;
 var MAX_CLEANUP_BACKOFF_MS = 10 * 60 * 1e3;
 function mintSessionKey(db, scopes, userId, oauthGrantId, createdAt) {
-  const raw = `cnry_${crypto26.randomBytes(24).toString("hex")}`;
-  const id = crypto26.randomUUID();
+  const raw = `cnry_${crypto27.randomBytes(24).toString("hex")}`;
+  const id = crypto27.randomUUID();
   db.insert(apiKeys).values({
     id,
     name: `mcp-session:${userId}`,
@@ -17919,12 +18071,12 @@ function registerMcpHttpRoutes(scope, opts) {
     try {
       withoutLockWait(() => {
         opts.db.transaction((tx) => {
-          tx.delete(dashboardSessions).where(eq31(dashboardSessions.apiKeyId, id)).run();
-          tx.update(apiKeys).set({ revokedAt: new Date(now()).toISOString() }).where(and26(eq31(apiKeys.id, id), isNull6(apiKeys.revokedAt))).run();
+          tx.delete(dashboardSessions).where(eq32(dashboardSessions.apiKeyId, id)).run();
+          tx.update(apiKeys).set({ revokedAt: new Date(now()).toISOString() }).where(and27(eq32(apiKeys.id, id), isNull6(apiKeys.revokedAt))).run();
         });
         if (remove) {
           try {
-            opts.db.delete(apiKeys).where(eq31(apiKeys.id, id)).run();
+            opts.db.delete(apiKeys).where(eq32(apiKeys.id, id)).run();
           } catch (error) {
             scope.log.warn({ err: error, keyId: id }, "Retained revoked MCP request key after deletion failed");
           }
@@ -17975,14 +18127,14 @@ function registerMcpHttpRoutes(scope, opts) {
       withoutLockWait(() => {
         const cutoff = now() - SESSION_IDLE_MS;
         for (const session of legacyServers) {
-          const key = session.sessionKeyId ? opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq31(apiKeys.id, session.sessionKeyId)).get() : void 0;
+          const key = session.sessionKeyId ? opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq32(apiKeys.id, session.sessionKeyId)).get() : void 0;
           if (session.lastSeenAt < cutoff || session.expiresAt !== void 0 && session.expiresAt <= now() || session.sessionKeyId && (!key || key.revokedAt)) {
             void session.close().catch((error) => scope.log.error({ err: error }, "Failed to close expired MCP session"));
           }
         }
         for (const exchange of modernExchanges) {
           if (!exchange.sessionKey) continue;
-          const key = opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq31(apiKeys.id, exchange.sessionKey.id)).get();
+          const key = opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq32(apiKeys.id, exchange.sessionKey.id)).get();
           if (!key || key.revokedAt || exchange.sessionKey.expiresAt <= now()) {
             void exchange.close().catch((error) => scope.log.error({ err: error }, "Failed to close expired MCP request"));
           }
@@ -18037,7 +18189,7 @@ function registerMcpHttpRoutes(scope, opts) {
       clientName: `canonry-mcp/${PACKAGE_VERSION}`,
       surface: "mcp-http",
       // Correlation only: this is never accepted as caller identity or authority.
-      ...modern ? {} : { actorSession: crypto26.randomUUID() }
+      ...modern ? {} : { actorSession: crypto27.randomUUID() }
     });
     let server;
     try {
@@ -18062,7 +18214,7 @@ function registerMcpHttpRoutes(scope, opts) {
     if (!bearer) return null;
     const { server, sessionKey } = createAuthorizedServer(request, segment, bearer);
     const transport = new NodeStreamableHTTPServerTransport({
-      sessionIdGenerator: () => crypto26.randomUUID(),
+      sessionIdGenerator: () => crypto27.randomUUID(),
       onsessioninitialized: (id) => {
         if (!shuttingDown && !closing) sessions.set(id, session);
       }
@@ -18232,7 +18384,7 @@ function registerMcpHttpRoutes(scope, opts) {
 }
 
 // src/agent/agent-routes.ts
-import { eq as eq32 } from "drizzle-orm";
+import { eq as eq33 } from "drizzle-orm";
 function viewerAeroCaller(request, opts) {
   if (!opts.viewerSessions) return null;
   const principal = request.principal;
@@ -18272,7 +18424,7 @@ function turnAttribution(request) {
   };
 }
 function resolveProject(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq32(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq33(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -18391,7 +18543,7 @@ function registerAgentRoutes(app, opts) {
       }
       requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq32(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq33(agentSessions.projectId, project.id)).get();
       const nextTurn = opts.sessionRegistry.nextTurnModel(project.name);
       if (!row) {
         return { conversationId: null, messages: [], modelProvider: null, modelId: null, nextTurn, updatedAt: null };
@@ -18433,7 +18585,7 @@ function registerAgentRoutes(app, opts) {
       const project = resolveProject(opts.db, request.params.name);
       if (opts.sessionRegistry.isBusy(project.name)) throw agentBusy(project.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq32(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq33(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -18457,7 +18609,7 @@ function registerAgentRoutes(app, opts) {
       return streamViewerTurn(opts, project, viewerId, body, reply, turnAttribution(request));
     }
     if (body.conversationId !== void 0) {
-      const current = opts.db.select({ id: agentSessions.id }).from(agentSessions).where(eq32(agentSessions.projectId, project.id)).get();
+      const current = opts.db.select({ id: agentSessions.id }).from(agentSessions).where(eq33(agentSessions.projectId, project.id)).get();
       if ((current?.id ?? null) !== body.conversationId) throw validationError("The active conversation changed. Reload the conversation before sending.");
     }
     const promptText = body.prompt;
@@ -19417,7 +19569,7 @@ function clipText(value, length) {
 }
 
 // src/research-runner.ts
-import { and as and27, eq as eq33, inArray as inArray13, sql as sql13 } from "drizzle-orm";
+import { and as and28, eq as eq34, inArray as inArray13, sql as sql13 } from "drizzle-orm";
 var unfinishedResearchQueryStatuses = [ResearchQueryStatuses.queued, ResearchQueryStatuses.running];
 function finalResearchRunStatus(completed, failed, waiting) {
   if (waiting > 0) return ResearchRunStatuses["waiting-upstream"];
@@ -19425,13 +19577,13 @@ function finalResearchRunStatus(completed, failed, waiting) {
   return completed > 0 ? ResearchRunStatuses.partial : ResearchRunStatuses.failed;
 }
 async function executeResearchRun(db, registry, runId, projectId, options = {}) {
-  const run = db.select().from(researchRuns).where(and27(eq33(researchRuns.id, runId), eq33(researchRuns.projectId, projectId))).get();
+  const run = db.select().from(researchRuns).where(and28(eq34(researchRuns.id, runId), eq34(researchRuns.projectId, projectId))).get();
   if (!run || run.status !== ResearchRunStatuses.queued) return;
-  const project = db.select().from(projects).where(eq33(projects.id, projectId)).get();
+  const project = db.select().from(projects).where(eq34(projects.id, projectId)).get();
   if (!project) return;
   const provider = registry.get(run.provider);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and27(eq33(researchRuns.id, runId), eq33(researchRuns.status, ResearchRunStatuses.queued))).run();
+  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and28(eq34(researchRuns.id, runId), eq34(researchRuns.status, ResearchRunStatuses.queued))).run();
   if (claim.changes !== 1) return;
   const elapsed = startOutcomeTimer();
   const requested = currentOutcomeOrigin();
@@ -19465,8 +19617,8 @@ async function executeResearchRun(db, registry, runId, projectId, options = {})
     }
     reserved = run.totalQueries;
     reservation = { scope, period };
-    const rows = db.select().from(researchRunQueries).where(eq33(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
-    const competitorRows = db.select(competitorIdentityColumns).from(competitors).where(eq33(competitors.projectId, projectId)).orderBy(competitors.domain).all();
+    const rows = db.select().from(researchRunQueries).where(eq34(researchRunQueries.researchRunId, runId)).orderBy(researchRunQueries.position).all();
+    const competitorRows = db.select(competitorIdentityColumns).from(competitors).where(eq34(competitors.projectId, projectId)).orderBy(competitors.domain).all();
     const competitorDomains = competitorRows.map((row) => row.domain);
     const competitorAliases = new Map(competitorRows.map((row) => [row.domain, competitorIdentityAliases(row)]).filter(([, aliases]) => aliases.length > 0));
     const domains = effectiveDomains(project);
@@ -19476,7 +19628,7 @@ async function executeResearchRun(db, registry, runId, projectId, options = {})
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and27(eq33(researchRunQueries.id, row.id), eq33(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
+        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and28(eq34(researchRunQueries.id, row.id), eq34(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
         const raw = await gate.run(async () => {
           dispatched++;
           return provider.adapter.executeTrackedQuery({ query: row.queryText, canonicalDomains: domains, competitorDomains, ...run.location ? { location: run.location } : {} }, config);
@@ -19507,7 +19659,7 @@ async function executeResearchRun(db, registry, runId, projectId, options = {})
           rawResponse: raw.rawResponse,
           answerEvidence: raw.evidence ?? null,
           finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(and27(eq33(researchRunQueries.id, row.id), eq33(researchRunQueries.status, ResearchQueryStatuses.running))).run();
+        }).where(and28(eq34(researchRunQueries.id, row.id), eq34(researchRunQueries.status, ResearchQueryStatuses.running))).run();
         if (completed.changes === 1) incrementResearchProgress(db, runId, "completedQueries");
       } catch (error) {
         if (!(error instanceof IncompleteAnswerError && error.resumable)) queryFailure ??= error;
@@ -19558,11 +19710,11 @@ function researchOutcomeStatus(status) {
   }
 }
 function incrementResearchProgress(db, runId, column) {
-  db.update(researchRuns).set({ [column]: sql13`${researchRuns[column]} + 1` }).where(eq33(researchRuns.id, runId)).run();
+  db.update(researchRuns).set({ [column]: sql13`${researchRuns[column]} + 1` }).where(eq34(researchRuns.id, runId)).run();
 }
 function markResearchQueryFailed(db, runId, queryId, error) {
   const message = describeError(error);
-  const unfinished = and27(eq33(researchRunQueries.id, queryId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses));
+  const unfinished = and28(eq34(researchRunQueries.id, queryId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses));
   if (error instanceof IncompleteAnswerError && error.resumable) {
     db.update(researchRunQueries).set({
       status: ResearchQueryStatuses["waiting-upstream"],
@@ -19578,10 +19730,10 @@ function markResearchQueryFailed(db, runId, queryId, error) {
   if (failed.changes === 1) incrementResearchProgress(db, runId, "failedQueries");
 }
 function markUnfinishedResearchQueriesFailed(db, runId, error) {
-  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and27(eq33(researchRunQueries.researchRunId, runId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and28(eq34(researchRunQueries.researchRunId, runId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
 }
 function finalizeResearchRun(db, runId, fatalError) {
-  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq33(researchRunQueries.researchRunId, runId)).all();
+  const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq34(researchRunQueries.researchRunId, runId)).all();
   const completed = rows.filter((row) => row.status === ResearchQueryStatuses.completed).length;
   const failed = rows.filter((row) => row.status === ResearchQueryStatuses.failed).length;
   const waiting = rows.filter((row) => row.status === ResearchQueryStatuses["waiting-upstream"]).length;
@@ -19593,12 +19745,12 @@ function finalizeResearchRun(db, runId, fatalError) {
     error: fatalError ?? (failed === rows.length ? "Every research query failed." : null),
     // A run waiting on upstream jobs has not finished.
     finishedAt: waiting > 0 ? null : (/* @__PURE__ */ new Date()).toISOString()
-  }).where(eq33(researchRuns.id, runId)).run();
+  }).where(eq34(researchRuns.id, runId)).run();
   return { status, total: rows.length, completed, failed };
 }
 
 // src/google-marketing-sync.ts
-import { and as and28, eq as eq34, isNull as isNull7, sql as sql14 } from "drizzle-orm";
+import { and as and29, eq as eq35, isNull as isNull7, sql as sql14 } from "drizzle-orm";
 var RUNTIME_FAILURE_REASONS = {
   INVALID_INPUT: OutcomeReasonCodes.VALIDATION,
   NOT_CONFIGURED: OutcomeReasonCodes.NOT_CONNECTED,
@@ -19635,10 +19787,10 @@ function assertSnapshotContext(metadata, expected) {
   }
 }
 function requireSyncRun(db, runId, projectId, kind) {
-  const run = db.select().from(runs).where(and28(
-    eq34(runs.id, runId),
-    eq34(runs.projectId, projectId),
-    eq34(runs.kind, kind)
+  const run = db.select().from(runs).where(and29(
+    eq35(runs.id, runId),
+    eq35(runs.projectId, projectId),
+    eq35(runs.kind, kind)
   )).get();
   if (!run) throw withOutcomeReason(new Error(`Run ${runId} is not a ${kind} run for this project.`), OutcomeReasonCodes.NOT_FOUND);
   if (run.status !== RunStatuses.queued) {
@@ -19654,19 +19806,19 @@ function markFailed(db, runId, projectId, kind, expectedStatus, error) {
     status: RunStatuses.failed,
     error: serializeRunError({ message: safeErrorMessage(error) }),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(and28(
-    eq34(runs.id, runId),
-    eq34(runs.projectId, projectId),
-    eq34(runs.kind, kind),
-    eq34(runs.status, expectedStatus)
+  }).where(and29(
+    eq35(runs.id, runId),
+    eq35(runs.projectId, projectId),
+    eq35(runs.kind, kind),
+    eq35(runs.status, expectedStatus)
   )).run();
 }
 function claimSyncRun(db, runId, projectId, kind, startedAt) {
-  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and28(
-    eq34(runs.id, runId),
-    eq34(runs.projectId, projectId),
-    eq34(runs.kind, kind),
-    eq34(runs.status, RunStatuses.queued)
+  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and29(
+    eq35(runs.id, runId),
+    eq35(runs.projectId, projectId),
+    eq35(runs.kind, kind),
+    eq35(runs.status, RunStatuses.queued)
   )).run();
   return claim.changes === 1;
 }
@@ -19676,9 +19828,9 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
   let evidenceCollected = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["google-ads-sync"]);
-    const project = db.select().from(projects).where(eq34(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq35(projects.id, projectId)).get();
     if (!project) throw withOutcomeReason(new Error(`Project ${projectId} was not found.`), OutcomeReasonCodes.NOT_FOUND);
-    const connection = db.select().from(googleAdsConnections).where(eq34(googleAdsConnections.projectId, projectId)).get();
+    const connection = db.select().from(googleAdsConnections).where(eq35(googleAdsConnections.projectId, projectId)).get();
     if (!connection?.selectedCustomerId) {
       throw withOutcomeReason(new Error("Google Ads needs a selected customer before it can sync."), OutcomeReasonCodes.ACCOUNT_NOT_FOUND);
     }
@@ -19730,11 +19882,11 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and28(
-        eq34(runs.id, runId),
-        eq34(runs.projectId, projectId),
-        eq34(runs.kind, RunKinds["google-ads-sync"]),
-        eq34(runs.status, RunStatuses.running)
+      }).where(and29(
+        eq35(runs.id, runId),
+        eq35(runs.projectId, projectId),
+        eq35(runs.kind, RunKinds["google-ads-sync"]),
+        eq35(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw withOutcomeReason(
@@ -19754,12 +19906,12 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         lastMetricsSnapshotAt: result.metrics?.metadata.capturedAt ?? connection.lastMetricsSnapshotAt,
         lastMetricsSnapshotId: result.metrics?.metadata.id ?? connection.lastMetricsSnapshotId,
         updatedAt: finishedAt
-      }).where(and28(
-        eq34(googleAdsConnections.id, connection.id),
-        eq34(googleAdsConnections.projectId, projectId),
-        eq34(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
-        connection.selectedLoginCustomerId === null ? isNull7(googleAdsConnections.selectedLoginCustomerId) : eq34(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
-        eq34(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
+      }).where(and29(
+        eq35(googleAdsConnections.id, connection.id),
+        eq35(googleAdsConnections.projectId, projectId),
+        eq35(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
+        connection.selectedLoginCustomerId === null ? isNull7(googleAdsConnections.selectedLoginCustomerId) : eq35(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
+        eq35(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw withOutcomeReason(
@@ -19799,9 +19951,9 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
   let evidenceCollected = false;
   try {
     requireSyncRun(db, runId, projectId, RunKinds["gtm-sync"]);
-    const project = db.select().from(projects).where(eq34(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq35(projects.id, projectId)).get();
     if (!project) throw withOutcomeReason(new Error(`Project ${projectId} was not found.`), OutcomeReasonCodes.NOT_FOUND);
-    const connection = db.select().from(gtmConnections).where(eq34(gtmConnections.projectId, projectId)).get();
+    const connection = db.select().from(gtmConnections).where(eq35(gtmConnections.projectId, projectId)).get();
     if (!connection?.selectedAccountId || !connection.selectedContainerId) {
       throw withOutcomeReason(new Error("GTM needs a selected account and container before it can sync."), OutcomeReasonCodes.ACCOUNT_NOT_FOUND);
     }
@@ -19839,11 +19991,11 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and28(
-        eq34(runs.id, runId),
-        eq34(runs.projectId, projectId),
-        eq34(runs.kind, RunKinds["gtm-sync"]),
-        eq34(runs.status, RunStatuses.running)
+      }).where(and29(
+        eq35(runs.id, runId),
+        eq35(runs.projectId, projectId),
+        eq35(runs.kind, RunKinds["gtm-sync"]),
+        eq35(runs.status, RunStatuses.running)
       )).run();
       if (terminalClaim.changes !== 1) {
         throw withOutcomeReason(
@@ -19864,13 +20016,13 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         lastSnapshotAt: snapshot.metadata.capturedAt,
         lastSnapshotId: snapshot.metadata.id,
         updatedAt: finishedAt
-      }).where(and28(
-        eq34(gtmConnections.id, connection.id),
-        eq34(gtmConnections.projectId, projectId),
-        eq34(gtmConnections.selectedAccountId, connection.selectedAccountId),
-        eq34(gtmConnections.selectedContainerId, connection.selectedContainerId),
-        connection.selectedWorkspaceId === null ? isNull7(gtmConnections.selectedWorkspaceId) : eq34(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
-        eq34(gtmConnections.selectionGeneration, connection.selectionGeneration)
+      }).where(and29(
+        eq35(gtmConnections.id, connection.id),
+        eq35(gtmConnections.projectId, projectId),
+        eq35(gtmConnections.selectedAccountId, connection.selectedAccountId),
+        eq35(gtmConnections.selectedContainerId, connection.selectedContainerId),
+        connection.selectedWorkspaceId === null ? isNull7(gtmConnections.selectedWorkspaceId) : eq35(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
+        eq35(gtmConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
         throw withOutcomeReason(
@@ -20073,8 +20225,8 @@ var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto27.randomBytes(16);
-  const derived = crypto27.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto28.randomBytes(16);
+  const derived = crypto28.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -20095,14 +20247,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto27.scryptSync(password, salt, expected.length, {
+    const derived = crypto28.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto27.timingSafeEqual(derived, expected),
+      ok: crypto28.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -20111,7 +20263,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto27.timingSafeEqual(candidate, expected);
+    const ok = crypto28.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -20278,7 +20430,7 @@ function cloneGtmConfig(config) {
 function createGoogleMarketingConfigCredentialStore(input) {
   const persistConfigPatch = input.saveConfigPatch ?? saveConfigPatch;
   const env = input.env ?? process.env;
-  const randomUUID2 = input.randomUUID ?? crypto27.randomUUID;
+  const randomUUID2 = input.randomUUID ?? crypto28.randomUUID;
   const snapshot = () => ({
     googleAds: cloneGoogleAdsConfig(input.config.googleAds),
     gtm: cloneGtmConfig(input.config.gtm)
@@ -20395,7 +20547,7 @@ async function createServer(opts) {
   const trustProxy = resolveTrustProxy(process.env.CANONRY_TRUST_PROXY);
   const app = Fastify({
     loggerInstance: logger,
-    genReqId: () => crypto27.randomUUID(),
+    genReqId: () => crypto28.randomUUID(),
     trustProxy
   });
   if (!ownsDefaultConfig) {
@@ -20526,7 +20678,7 @@ async function createServer(opts) {
     async (ctx) => {
       if (!sessionRegistry) return;
       if (!agentProactive) return;
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq35(projects.id, ctx.projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq36(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;
       if (ctx.kind === RunKinds["aeo-discover-probe"]) {
@@ -21000,7 +21152,7 @@ async function createServer(opts) {
       void (async () => {
         try {
           const report = await schedulerClient.runDoctor({ project: projectName, checkIds: scheduledHealthCheckIds() });
-          const project = opts.db.select().from(projects).where(eq35(projects.name, projectName)).get();
+          const project = opts.db.select().from(projects).where(eq36(projects.name, projectName)).get();
           if (!project) {
             app.log.warn({ projectName }, "doctor schedule fired for an unknown project");
             return;
@@ -21194,7 +21346,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto27.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto28.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -21292,11 +21444,11 @@ async function createServer(opts) {
   })();
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq35(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq36(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto27.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto28.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -21311,14 +21463,14 @@ async function createServer(opts) {
   );
   const currentPasswordFingerprint = () => hashSessionToken(opts.config.dashboardPasswordHash ?? "");
   opts.db.delete(dashboardSessions).where(or4(
-    eq35(dashboardSessions.apiKeyHash, ""),
-    and29(
+    eq36(dashboardSessions.apiKeyHash, ""),
+    and30(
       isNotNull5(dashboardSessions.passwordFingerprint),
       ne4(dashboardSessions.passwordFingerprint, currentPasswordFingerprint())
     )
   )).run();
   if (!opts.config.dashboardPasswordHash) {
-    const lastPasswordEventAt = (action) => opts.db.select({ at: max(auditLog.createdAt) }).from(auditLog).where(and29(eq35(auditLog.entityType, "dashboard-password"), eq35(auditLog.action, action))).get()?.at ?? null;
+    const lastPasswordEventAt = (action) => opts.db.select({ at: max(auditLog.createdAt) }).from(auditLog).where(and30(eq36(auditLog.entityType, "dashboard-password"), eq36(auditLog.action, action))).get()?.at ?? null;
     const createdAt = lastPasswordEventAt("dashboard-password.created");
     const clearedAt = lastPasswordEventAt("dashboard-password.cleared");
     if (createdAt !== null && (clearedAt === null || clearedAt < createdAt)) {
@@ -21333,7 +21485,7 @@ async function createServer(opts) {
   const createSession = (key, passwordBased = false, db = opts.db) => {
     const now = /* @__PURE__ */ new Date();
     db.delete(dashboardSessions).where(lte3(dashboardSessions.expiresAt, now.toISOString())).run();
-    const sessionId = crypto27.randomBytes(32).toString("hex");
+    const sessionId = crypto28.randomBytes(32).toString("hex");
     db.insert(dashboardSessions).values({
       tokenHash: hashSessionToken(sessionId),
       apiKeyId: key.id,
@@ -21352,23 +21504,23 @@ async function createServer(opts) {
       currentApiKeyHash: apiKeys.keyHash,
       passwordFingerprint: dashboardSessions.passwordFingerprint,
       expiresAt: dashboardSessions.expiresAt
-    }).from(dashboardSessions).innerJoin(apiKeys, eq35(apiKeys.id, dashboardSessions.apiKeyId)).where(and29(eq35(dashboardSessions.tokenHash, tokenHash), isNull8(apiKeys.revokedAt))).get();
+    }).from(dashboardSessions).innerJoin(apiKeys, eq36(apiKeys.id, dashboardSessions.apiKeyId)).where(and30(eq36(dashboardSessions.tokenHash, tokenHash), isNull8(apiKeys.revokedAt))).get();
     if (!session) return null;
     const expiresAt = Date.parse(session.expiresAt);
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || session.apiKeyHash !== session.currentApiKeyHash || session.passwordFingerprint !== null && session.passwordFingerprint !== currentPasswordFingerprint()) {
-      opts.db.delete(dashboardSessions).where(eq35(dashboardSessions.tokenHash, tokenHash)).run();
+      opts.db.delete(dashboardSessions).where(eq36(dashboardSessions.tokenHash, tokenHash)).run();
       return null;
     }
     return session.apiKeyId;
   };
   const clearSession = (sessionId) => {
     if (sessionId) {
-      opts.db.delete(dashboardSessions).where(eq35(dashboardSessions.tokenHash, hashSessionToken(sessionId))).run();
+      opts.db.delete(dashboardSessions).where(eq36(dashboardSessions.tokenHash, hashSessionToken(sessionId))).run();
     }
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq35(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq36(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const setSessionCookie = (reply, sessionId) => {
     reply.header(
@@ -21397,7 +21549,7 @@ async function createServer(opts) {
     if (parts.length !== 2 || parts[0] !== "Bearer" || !parts[1]) return false;
     const presented = Buffer.from(hashApiKey(parts[1]), "hex");
     const expected = Buffer.from(key.keyHash, "hex");
-    return presented.length === expected.length && crypto27.timingSafeEqual(presented, expected);
+    return presented.length === expected.length && crypto28.timingSafeEqual(presented, expected);
   };
   const namedAccountsInUse = () => anyUsersExist(opts.db);
   const NAMED_ACCOUNTS_MESSAGE = "This install uses named accounts. Sign in with your name and password.";
@@ -21529,12 +21681,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq35(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq36(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq35(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq36(apiKeys.id, key.id)).run();
       setSessionCookie(reply, createSession(key));
       return reply.send({ authenticated: true });
     }
@@ -21612,7 +21764,7 @@ async function createServer(opts) {
   const recomputeDebts = /* @__PURE__ */ new Map();
   let recomputeSequence = 0;
   const markAnswerFieldRecompute = (projectId, full) => {
-    opts.db.update(projects).set({ answerFieldsRecompute: full ? "full" : sql15`CASE WHEN ${projects.answerFieldsRecompute} = 'full' THEN 'full' ELSE 'competitors' END` }).where(eq35(projects.id, projectId)).run();
+    opts.db.update(projects).set({ answerFieldsRecompute: full ? "full" : sql15`CASE WHEN ${projects.answerFieldsRecompute} = 'full' THEN 'full' ELSE 'competitors' END` }).where(eq36(projects.id, projectId)).run();
   };
   const requestAnswerFieldRecompute = (projectId, projectName, scope, reason) => {
     const sequence = ++recomputeSequence;
@@ -21630,10 +21782,10 @@ async function createServer(opts) {
         if (pass.full && debt.latestFull <= sequence) debt.latestFull = 0;
         try {
           if (debt.latest === sequence && debt.latestFull === 0) {
-            opts.db.update(projects).set({ answerFieldsRecompute: null }).where(eq35(projects.id, projectId)).run();
+            opts.db.update(projects).set({ answerFieldsRecompute: null }).where(eq36(projects.id, projectId)).run();
             if (recomputeDebts.get(projectId) === debt) recomputeDebts.delete(projectId);
           } else if (debt.latestFull === 0) {
-            opts.db.update(projects).set({ answerFieldsRecompute: "competitors" }).where(and29(eq35(projects.id, projectId), eq35(projects.answerFieldsRecompute, "full"))).run();
+            opts.db.update(projects).set({ answerFieldsRecompute: "competitors" }).where(and30(eq36(projects.id, projectId), eq36(projects.answerFieldsRecompute, "full"))).run();
           }
         } catch (err) {
           app.log.error({ err, projectId }, "could not clear the owed answer field recompute");
@@ -21670,7 +21822,7 @@ async function createServer(opts) {
     await yieldToEventLoop4();
     const reason = (competitorAutoAliasReasons.get(projectId) ?? []).join(",");
     competitorAutoAliasReasons.delete(projectId);
-    const project = opts.db.select().from(projects).where(eq35(projects.id, projectId)).get();
+    const project = opts.db.select().from(projects).where(eq36(projects.id, projectId)).get();
     if (!project || project.competitorAutoAliases === "off") return;
     if (project.competitorAutoAliases === "apply") {
       await competitorAutoAliases.request(projectId, reason).catch(() => void 0);
@@ -21870,8 +22022,8 @@ async function createServer(opts) {
     getAgentPin: () => describeAgentPin(opts.config),
     getGoogleMarketingDoctorInput: (ctx) => {
       if (!ctx.project) return null;
-      const googleAds = opts.db.select().from(googleAdsConnections).where(eq35(googleAdsConnections.projectId, ctx.project.id)).get();
-      const gtm = opts.db.select().from(gtmConnections).where(eq35(gtmConnections.projectId, ctx.project.id)).get();
+      const googleAds = opts.db.select().from(googleAdsConnections).where(eq36(googleAdsConnections.projectId, ctx.project.id)).get();
+      const gtm = opts.db.select().from(gtmConnections).where(eq36(gtmConnections.projectId, ctx.project.id)).get();
       const googleAdsCredential = getGoogleAdsConnection(opts.config, ctx.project.id);
       const gtmCredential = getGtmConnection(opts.config, ctx.project.id);
       const googleAdsConnected = Boolean(googleAdsCredential?.accessToken);
@@ -22000,7 +22152,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto27.randomUUID();
+            const runId = crypto28.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -22121,7 +22273,7 @@ async function createServer(opts) {
         ...inspectOpts,
         config: opts.config
       }).then(() => {
-        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq35(runs.id, runId)).get();
+        const finished = opts.db.select({ status: runs.status }).from(runs).where(eq36(runs.id, runId)).get();
         if (finished?.status === RunStatuses.completed || finished?.status === RunStatuses.partial) {
           return maybeRefreshGscCoverage(
             opts.db,
@@ -22633,7 +22785,7 @@ async function createServer(opts) {
           isBacklinksInstalled: () => isDuckdbInstalled()
         });
       }
-      for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq35(researchRuns.status, ResearchRunStatuses.queued)).all()) {
+      for (const run of opts.db.select({ id: researchRuns.id, projectId: researchRuns.projectId }).from(researchRuns).where(eq36(researchRuns.status, ResearchRunStatuses.queued)).all()) {
         dispatchResearchRun(run.id, run.projectId, OutcomeTriggers.startup);
       }
       runtimeStartupSettled = true;