@ainyc/canonry 4.112.7 → 4.114.0

package/dist/{chunk-K2XOEBSH.js → chunk-DUBZH5JW.js}

@@ -25,7 +25,7 @@ import {
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/config.ts
 import fs from "fs";

package/dist/{chunk-DBZLOLYT.js → chunk-VEUBAZRG.js}

@@ -5619,14 +5619,21 @@ function parseThemeOverride(raw) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
-function embedClientConfigForRequest(resolved, projectTabsOverride, themeOverride) {
+function parseRenderTokenOverride(raw) {
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096) return void 0;
+  return value;
+}
+function embedClientConfigForRequest(resolved, projectTabsOverride, themeOverride, renderTokenOverride) {
   const base = buildEmbedClientConfig(resolved);
   if (!base) return void 0;
   const tabs = normalizeIdTokens(splitList(projectTabsOverride));
   const theme = parseThemeOverride(themeOverride);
+  const renderToken = parseRenderTokenOverride(renderTokenOverride);
   let out = base;
   if (tabs) out = { ...out, projectTabs: tabs };
   if (theme) out = { ...out, theme };
+  if (renderToken) out = { ...out, renderToken };
   return out;
 }
 function serializeForInlineScript(value) {

package/dist/{chunk-FVELOZTK.js → chunk-WMWZW34J.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-K2XOEBSH.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -115,7 +115,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-D5PEINWZ.js";
+} from "./chunk-3VSTTH4M.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -178,7 +178,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -2752,6 +2752,13 @@ var perplexityAdapter = {
 };
 
 // src/embed.ts
+var DEFAULT_EMBED_PROJECT_TABS = ["overview"];
+var SERVER_ENFORCED_EMBED_PROJECT_TABS = ["overview", "technical-aeo", "report"];
+function unsupportedEmbedProjectTabs(projectTabs) {
+  if (!projectTabs) return [];
+  const supported = new Set(SERVER_ENFORCED_EMBED_PROJECT_TABS);
+  return projectTabs.filter((tab) => !supported.has(tab));
+}
 function resolveEmbedConfig(env, config) {
   const embed = config.embed;
   const rawEnabled = env.CANONRY_EMBED?.trim();
@@ -2760,7 +2767,7 @@ function resolveEmbedConfig(env, config) {
   const rawViews = env.CANONRY_EMBED_VIEWS !== void 0 ? splitList(env.CANONRY_EMBED_VIEWS) : splitList(embed?.views);
   const views = normalizeIdTokens(rawViews);
   const rawProjectTabs = env.CANONRY_EMBED_PROJECT_TABS !== void 0 ? splitList(env.CANONRY_EMBED_PROJECT_TABS) : splitList(embed?.projectTabs);
-  const projectTabs = normalizeIdTokens(rawProjectTabs);
+  const projectTabs = normalizeIdTokens(rawProjectTabs) ?? (enabled ? DEFAULT_EMBED_PROJECT_TABS : void 0);
   return {
     enabled,
     allowedOrigins,
@@ -6508,7 +6515,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-ZPY7NIKR.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-I5EQ77KZ.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -11004,6 +11011,16 @@ var DEFAULT_QUOTA = {
 };
 var SESSION_COOKIE_NAME = "canonry_session";
 var SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+function parseBooleanEnv(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) return void 0;
+  if (normalized === "1" || normalized === "true" || normalized === "yes") return true;
+  if (normalized === "0" || normalized === "false" || normalized === "no") return false;
+  return void 0;
+}
+function resolveDashboardRequirePassword(env, config) {
+  return parseBooleanEnv(env.CANONRY_DASHBOARD_REQUIRE_PASSWORD) ?? config.dashboard?.requirePassword ?? true;
+}
 var API_ADAPTERS = [
   geminiAdapter,
   openaiAdapter,
@@ -11164,6 +11181,24 @@ function isLoopbackBindHost(host) {
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
   return false;
 }
+function resolveGooglePublicUrl(config, basePath) {
+  const configured = config.publicUrl?.trim();
+  if (configured) return configured;
+  try {
+    const url = new URL(config.apiUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+    if (!isLoopbackBindHost(url.hostname)) return void 0;
+    const port = config.port && config.port > 0 ? String(config.port) : url.port;
+    if (port === "0") return void 0;
+    const pathFromApiUrl = url.pathname && url.pathname !== "/" ? url.pathname.replace(/\/$/, "") : "";
+    const pathFromBasePath = basePath ? basePath.replace(/\/$/, "") : "";
+    const pathSuffix = pathFromApiUrl || pathFromBasePath;
+    const portSuffix = port ? `:${port}` : "";
+    return `${url.protocol}//localhost${portSuffix}${pathSuffix}`;
+  } catch {
+    return void 0;
+  }
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -11597,7 +11632,23 @@ async function createServer(opts) {
   const basePath = normalizedBasePath === "/" ? void 0 : normalizedBasePath;
   const embed = resolveEmbedConfig(process.env, opts.config);
   const embedCsp = embed.enabled ? frameAncestorsHeaderValue(embed.allowedOrigins) : void 0;
+  const unsupportedProjectTabs = unsupportedEmbedProjectTabs(embed.projectTabs);
+  if (embed.enabled && unsupportedProjectTabs.length > 0) {
+    app.log.warn(
+      {
+        projectTabs: unsupportedProjectTabs,
+        supportedProjectTabs: [...SERVER_ENFORCED_EMBED_PROJECT_TABS]
+      },
+      "Embed project tabs include unsupported values; API reads for those tabs will be blocked"
+    );
+  }
+  const dashboardRequirePassword = resolveDashboardRequirePassword(process.env, opts.config);
+  app.log.info(
+    { dashboardRequirePassword },
+    "Dashboard password gate resolved"
+  );
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
+  const googlePublicUrl = resolveGooglePublicUrl(opts.config, basePath);
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
     const existing = opts.db.select().from(apiKeys).where(eq20(apiKeys.keyHash, keyHash)).get();
@@ -11680,6 +11731,9 @@ async function createServer(opts) {
     return Boolean(key && !key.revokedAt);
   };
   app.get(apiPrefix + "/session", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
     return reply.send({
       authenticated: Boolean(sessionId && resolveSessionApiKeyId(sessionId)),
@@ -11687,6 +11741,9 @@ async function createServer(opts) {
     });
   });
   app.post(apiPrefix + "/session/setup", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     if (!boundToLoopback && !requestHasValidApiKey(request)) {
       const err = authRequired(
         "This server is network-reachable; setting the dashboard password requires a valid API key."
@@ -11711,6 +11768,9 @@ async function createServer(opts) {
     return reply.send({ authenticated: true });
   });
   app.post(apiPrefix + "/session", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     const password = request.body?.password?.trim();
     const apiKey = request.body?.apiKey?.trim();
     if (password) {
@@ -11815,6 +11875,7 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    ...embed.enabled && embed.projectTabs ? { embedProjectTabs: embed.projectTabs } : {},
     explainContentRecommendation,
     briefContentRecommendation,
     briefPromptVersion: RECOMMENDATION_BRIEF_PROMPT_VERSION,
@@ -11866,7 +11927,7 @@ async function createServer(opts) {
     getAgentProviderSummary: () => buildAgentProvidersResponse(opts.config).providers,
     googleConnectionStore,
     googleStateSecret,
-    publicUrl: opts.config.publicUrl,
+    publicUrl: googlePublicUrl,
     onGscSyncRequested: (runId, projectId, syncOpts) => {
       const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
       if (!googleClientId || !googleClientSecret) {
@@ -12308,11 +12369,11 @@ async function createServer(opts) {
   const assetsDir = opts.assetsDir ?? path9.join(dirname, "..", "assets");
   if (fs8.existsSync(assetsDir)) {
     const indexPath = path9.join(assetsDir, "index.html");
-    const injectConfig = (html, projectTabsOverride, themeOverride) => {
+    const injectConfig = (html, projectTabsOverride, themeOverride, renderTokenOverride) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
       if (embed.enabled) {
-        const embedClient = embedClientConfigForRequest(embed, projectTabsOverride, themeOverride);
+        const embedClient = embedClientConfigForRequest(embed, projectTabsOverride, themeOverride, renderTokenOverride);
         if (embedClient) clientConfig.embed = embedClient;
       }
       const configScript = `<script>window.__CANONRY_CONFIG__=${serializeForInlineScript(clientConfig)}</script>`;
@@ -12326,7 +12387,8 @@ async function createServer(opts) {
         injectConfig(
           html,
           reply.request.headers["x-canonry-embed-tabs"],
-          reply.request.headers["x-canonry-embed-theme"]
+          reply.request.headers["x-canonry-embed-theme"],
+          reply.request.headers["x-canonry-embed-render-token"]
         )
       );
     };

package/dist/cli.js

@@ -29,7 +29,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-FVELOZTK.js";
+} from "./chunk-WMWZW34J.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -46,7 +46,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-K2XOEBSH.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   apiKeys,
   createClient,
@@ -54,7 +54,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-D5PEINWZ.js";
+} from "./chunk-3VSTTH4M.js";
 import {
   BacklinkSources,
   CcReleaseSyncStatuses,
@@ -80,7 +80,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";

package/dist/index.d.ts

@@ -183,6 +183,14 @@ interface AgentConfigEntry {
      */
     mode?: 'disabled';
 }
+interface DashboardConfigEntry {
+    /**
+     * Whether the browser dashboard requires Canonry's built-in password/session
+     * gate. Defaults to true. Set false only when an upstream layer enforces auth
+     * and the engine is not directly internet-reachable.
+     */
+    requirePassword?: boolean;
+}
 /**
  * Google Places API config — supplemental rendered-listing data for GBP
  * lodging locations (#648). The API key authenticates Place Details calls
@@ -220,6 +228,7 @@ interface CanonryConfig {
     vercelTraffic?: VercelTrafficConfigEntry;
     openaiAds?: OpenAiAdsConfigEntry;
     dashboardPasswordHash?: string;
+    dashboard?: DashboardConfigEntry;
     telemetry?: boolean;
     anonymousId?: string;
     lastSeenVersion?: string;

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-FVELOZTK.js";
+} from "./chunk-WMWZW34J.js";
 import {
   loadConfig
-} from "./chunk-K2XOEBSH.js";
-import "./chunk-D5PEINWZ.js";
-import "./chunk-DBZLOLYT.js";
+} from "./chunk-DUBZH5JW.js";
+import "./chunk-3VSTTH4M.js";
+import "./chunk-VEUBAZRG.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-ZPY7NIKR.js → intelligence-service-I5EQ77KZ.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-D5PEINWZ.js";
-import "./chunk-DBZLOLYT.js";
+} from "./chunk-3VSTTH4M.js";
+import "./chunk-VEUBAZRG.js";
 export {
   IntelligenceService
 };

package/dist/mcp.js

@@ -3,10 +3,10 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-K2XOEBSH.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   isReadOnlyKey
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/mcp/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainyc/canonry",
-  "version": "4.112.7",
+  "version": "4.114.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -65,27 +65,27 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-config": "0.0.0",
-    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
+    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
+    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-integration-bing": "0.0.0",
     "@ainyc/canonry-integration-openai-ads": "0.0.0",
-    "@ainyc/canonry-integration-commoncrawl": "0.0.0",
-    "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-google-business-profile": "0.0.0",
-    "@ainyc/canonry-integration-google-places": "0.0.0",
+    "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
+    "@ainyc/canonry-integration-commoncrawl": "0.0.0",
+    "@ainyc/canonry-integration-google-places": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
+    "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
-    "@ainyc/canonry-provider-cdp": "0.0.0",
+    "@ainyc/canonry-provider-openai": "0.0.0",
     "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
-    "@ainyc/canonry-provider-perplexity": "0.0.0",
-    "@ainyc/canonry-provider-openai": "0.0.0"
+    "@ainyc/canonry-provider-perplexity": "0.0.0"
   },
   "scripts": {
     "build": "tsx scripts/copy-agent-assets.ts && tsup && tsx build-web.ts",