@ainyc/canonry 4.113.0 → 4.114.0

package/dist/{chunk-XYSEBOHP.js → chunk-3VSTTH4M.js}

@@ -179,6 +179,7 @@ import {
   mapWithConcurrency,
   mentionStateFromAnswerMentioned,
   missingDependency,
+  normalizeIdTokens,
   normalizeProjectAliases,
   normalizeProjectDomain,
   normalizeQueryText,
@@ -237,6 +238,7 @@ import {
   snapshotReportSchema,
   snapshotRequestSchema,
   sourceBreakdownDtoSchema,
+  splitList,
   sumInfraHits,
   summarizeCheckResults,
   surfaceClassFromCompetitorType,
@@ -271,7 +273,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/intelligence-service.ts
 import { eq as eq38, desc as desc18, asc as asc6, and as and29, ne as ne5, or as or6, inArray as inArray14, gte as gte7, lte as lte4 } from "drizzle-orm";
@@ -5847,6 +5849,82 @@ function parseCookies(header) {
     return cookies;
   }, {});
 }
+function queryValue(request, key) {
+  const raw = request.query?.[key];
+  if (typeof raw === "string") return raw;
+  if (Array.isArray(raw) && typeof raw[0] === "string") return raw[0];
+  return void 0;
+}
+function requestEmbedProjectTabs(request, fallback) {
+  const headerTabs = normalizeIdTokens(splitList(request.headers["x-canonry-embed-tabs"]));
+  if (headerTabs) return headerTabs;
+  return fallback && fallback.length > 0 ? [...fallback] : void 0;
+}
+function projectRouteRest(url) {
+  const match = url.match(/\/projects\/[^/]+(?:\/([^?#]*))?$/);
+  if (!match) return null;
+  return match[1] ?? "";
+}
+function isGlobalAnswerVisibilityRunsList(request, url) {
+  if (!url.endsWith("/runs")) return false;
+  const kind = queryValue(request, "kind");
+  return kind === RunKinds["answer-visibility"];
+}
+function isAnswerVisibilityRunsList(request, rest) {
+  if (rest !== "runs") return false;
+  const kind = queryValue(request, "kind");
+  return kind === RunKinds["answer-visibility"];
+}
+function isAnswerVisibilityRunDetail(request, url) {
+  const runMatch = url.match(/\/runs\/([^/?#]+)$/);
+  if (!runMatch) return false;
+  const run = request.server.db.select({ kind: runs.kind }).from(runs).where(eq(runs.id, decodeURIComponent(runMatch[1]))).get();
+  return !run || run.kind === RunKinds["answer-visibility"];
+}
+function isProjectShellRead(request, url) {
+  if (url.endsWith("/projects")) return true;
+  if (isGlobalAnswerVisibilityRunsList(request, url)) return true;
+  const rest = projectRouteRest(url);
+  if (rest === null) return isAnswerVisibilityRunDetail(request, url);
+  return rest === "" || isAnswerVisibilityRunsList(request, rest);
+}
+function isOverviewRead(url) {
+  const rest = projectRouteRest(url);
+  if (rest === null) return false;
+  return (/* @__PURE__ */ new Set([
+    "queries",
+    "competitors",
+    "timeline",
+    "overview",
+    "analytics/metrics",
+    "google/gsc/coverage",
+    "bing/coverage",
+    "insights",
+    "citations/visibility"
+  ])).has(rest);
+}
+function isTechnicalAeoRead(url) {
+  const rest = projectRouteRest(url);
+  return rest === "technical-aeo" || rest === "technical-aeo/pages" || rest === "technical-aeo/trend";
+}
+function isReportRead(url) {
+  const rest = projectRouteRest(url);
+  return rest === "report" || rest === "report.html";
+}
+function enforceEmbedProjectTabs(request, configuredTabs) {
+  const tabs = requestEmbedProjectTabs(request, configuredTabs);
+  if (!tabs || tabs.length === 0) return;
+  if (request.method === "OPTIONS") return;
+  if (WRITE_METHODS.has(request.method)) {
+    throw forbidden("This endpoint is not available in embed mode.");
+  }
+  const url = request.url.split("?")[0];
+  if (isProjectShellRead(request, url)) return;
+  if (tabs.includes("overview") && isOverviewRead(url)) return;
+  if (tabs.includes("technical-aeo") && isTechnicalAeoRead(url)) return;
+  if (tabs.includes("report") && isReportRead(url)) return;
+  throw forbidden("This endpoint is not available for the configured embed tabs.");
+}
 async function authPlugin(app, opts = {}) {
   app.addHook("onRequest", async (request) => {
     const url = request.url.split("?")[0];
@@ -5884,6 +5962,7 @@ async function authPlugin(app, opts = {}) {
     if (isReadOnlyKey(scopes) && WRITE_METHODS.has(request.method)) {
       throw forbidden("This API key is read-only and cannot perform write operations.");
     }
+    enforceEmbedProjectTabs(request, opts.embedProjectTabs);
     if (key.projectId) {
       const match = url.match(/\/projects\/([^/?#]+)/);
       if (match) {
@@ -34725,7 +34804,8 @@ async function apiRoutes(app, opts) {
     if (!opts.skipAuth) {
       await authPlugin(api, {
         sessionCookieName: opts.sessionCookieName,
-        resolveSessionApiKeyId: opts.resolveSessionApiKeyId
+        resolveSessionApiKeyId: opts.resolveSessionApiKeyId,
+        embedProjectTabs: opts.embedProjectTabs
       });
     }
     await api.register(openApiRoutes, { ...opts.openApiInfo, routePrefix: opts.routePrefix });

package/dist/{chunk-RMTNF2ES.js → chunk-DUBZH5JW.js}

@@ -25,7 +25,7 @@ import {
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/config.ts
 import fs from "fs";

package/dist/{chunk-DBZLOLYT.js → chunk-VEUBAZRG.js}

@@ -5619,14 +5619,21 @@ function parseThemeOverride(raw) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
-function embedClientConfigForRequest(resolved, projectTabsOverride, themeOverride) {
+function parseRenderTokenOverride(raw) {
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096) return void 0;
+  return value;
+}
+function embedClientConfigForRequest(resolved, projectTabsOverride, themeOverride, renderTokenOverride) {
   const base = buildEmbedClientConfig(resolved);
   if (!base) return void 0;
   const tabs = normalizeIdTokens(splitList(projectTabsOverride));
   const theme = parseThemeOverride(themeOverride);
+  const renderToken = parseRenderTokenOverride(renderTokenOverride);
   let out = base;
   if (tabs) out = { ...out, projectTabs: tabs };
   if (theme) out = { ...out, theme };
+  if (renderToken) out = { ...out, renderToken };
   return out;
 }
 function serializeForInlineScript(value) {

package/dist/{chunk-B3B3HJPH.js → chunk-WMWZW34J.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-RMTNF2ES.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -115,7 +115,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-XYSEBOHP.js";
+} from "./chunk-3VSTTH4M.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -178,7 +178,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -2752,6 +2752,13 @@ var perplexityAdapter = {
 };
 
 // src/embed.ts
+var DEFAULT_EMBED_PROJECT_TABS = ["overview"];
+var SERVER_ENFORCED_EMBED_PROJECT_TABS = ["overview", "technical-aeo", "report"];
+function unsupportedEmbedProjectTabs(projectTabs) {
+  if (!projectTabs) return [];
+  const supported = new Set(SERVER_ENFORCED_EMBED_PROJECT_TABS);
+  return projectTabs.filter((tab) => !supported.has(tab));
+}
 function resolveEmbedConfig(env, config) {
   const embed = config.embed;
   const rawEnabled = env.CANONRY_EMBED?.trim();
@@ -2760,7 +2767,7 @@ function resolveEmbedConfig(env, config) {
   const rawViews = env.CANONRY_EMBED_VIEWS !== void 0 ? splitList(env.CANONRY_EMBED_VIEWS) : splitList(embed?.views);
   const views = normalizeIdTokens(rawViews);
   const rawProjectTabs = env.CANONRY_EMBED_PROJECT_TABS !== void 0 ? splitList(env.CANONRY_EMBED_PROJECT_TABS) : splitList(embed?.projectTabs);
-  const projectTabs = normalizeIdTokens(rawProjectTabs);
+  const projectTabs = normalizeIdTokens(rawProjectTabs) ?? (enabled ? DEFAULT_EMBED_PROJECT_TABS : void 0);
   return {
     enabled,
     allowedOrigins,
@@ -6508,7 +6515,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-RRWOGVVE.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-I5EQ77KZ.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -11004,6 +11011,16 @@ var DEFAULT_QUOTA = {
 };
 var SESSION_COOKIE_NAME = "canonry_session";
 var SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+function parseBooleanEnv(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) return void 0;
+  if (normalized === "1" || normalized === "true" || normalized === "yes") return true;
+  if (normalized === "0" || normalized === "false" || normalized === "no") return false;
+  return void 0;
+}
+function resolveDashboardRequirePassword(env, config) {
+  return parseBooleanEnv(env.CANONRY_DASHBOARD_REQUIRE_PASSWORD) ?? config.dashboard?.requirePassword ?? true;
+}
 var API_ADAPTERS = [
   geminiAdapter,
   openaiAdapter,
@@ -11164,6 +11181,24 @@ function isLoopbackBindHost(host) {
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
   return false;
 }
+function resolveGooglePublicUrl(config, basePath) {
+  const configured = config.publicUrl?.trim();
+  if (configured) return configured;
+  try {
+    const url = new URL(config.apiUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+    if (!isLoopbackBindHost(url.hostname)) return void 0;
+    const port = config.port && config.port > 0 ? String(config.port) : url.port;
+    if (port === "0") return void 0;
+    const pathFromApiUrl = url.pathname && url.pathname !== "/" ? url.pathname.replace(/\/$/, "") : "";
+    const pathFromBasePath = basePath ? basePath.replace(/\/$/, "") : "";
+    const pathSuffix = pathFromApiUrl || pathFromBasePath;
+    const portSuffix = port ? `:${port}` : "";
+    return `${url.protocol}//localhost${portSuffix}${pathSuffix}`;
+  } catch {
+    return void 0;
+  }
+}
 async function createServer(opts) {
   const logger = opts.logger === false ? false : process.stdout.isTTY ? {
     transport: {
@@ -11597,7 +11632,23 @@ async function createServer(opts) {
   const basePath = normalizedBasePath === "/" ? void 0 : normalizedBasePath;
   const embed = resolveEmbedConfig(process.env, opts.config);
   const embedCsp = embed.enabled ? frameAncestorsHeaderValue(embed.allowedOrigins) : void 0;
+  const unsupportedProjectTabs = unsupportedEmbedProjectTabs(embed.projectTabs);
+  if (embed.enabled && unsupportedProjectTabs.length > 0) {
+    app.log.warn(
+      {
+        projectTabs: unsupportedProjectTabs,
+        supportedProjectTabs: [...SERVER_ENFORCED_EMBED_PROJECT_TABS]
+      },
+      "Embed project tabs include unsupported values; API reads for those tabs will be blocked"
+    );
+  }
+  const dashboardRequirePassword = resolveDashboardRequirePassword(process.env, opts.config);
+  app.log.info(
+    { dashboardRequirePassword },
+    "Dashboard password gate resolved"
+  );
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
+  const googlePublicUrl = resolveGooglePublicUrl(opts.config, basePath);
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
     const existing = opts.db.select().from(apiKeys).where(eq20(apiKeys.keyHash, keyHash)).get();
@@ -11680,6 +11731,9 @@ async function createServer(opts) {
     return Boolean(key && !key.revokedAt);
   };
   app.get(apiPrefix + "/session", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
     return reply.send({
       authenticated: Boolean(sessionId && resolveSessionApiKeyId(sessionId)),
@@ -11687,6 +11741,9 @@ async function createServer(opts) {
     });
   });
   app.post(apiPrefix + "/session/setup", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     if (!boundToLoopback && !requestHasValidApiKey(request)) {
       const err = authRequired(
         "This server is network-reachable; setting the dashboard password requires a valid API key."
@@ -11711,6 +11768,9 @@ async function createServer(opts) {
     return reply.send({ authenticated: true });
   });
   app.post(apiPrefix + "/session", async (request, reply) => {
+    if (!dashboardRequirePassword) {
+      return reply.send({ authenticated: true, setupRequired: false });
+    }
     const password = request.body?.password?.trim();
     const apiKey = request.body?.apiKey?.trim();
     if (password) {
@@ -11815,6 +11875,7 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    ...embed.enabled && embed.projectTabs ? { embedProjectTabs: embed.projectTabs } : {},
     explainContentRecommendation,
     briefContentRecommendation,
     briefPromptVersion: RECOMMENDATION_BRIEF_PROMPT_VERSION,
@@ -11866,7 +11927,7 @@ async function createServer(opts) {
     getAgentProviderSummary: () => buildAgentProvidersResponse(opts.config).providers,
     googleConnectionStore,
     googleStateSecret,
-    publicUrl: opts.config.publicUrl,
+    publicUrl: googlePublicUrl,
     onGscSyncRequested: (runId, projectId, syncOpts) => {
       const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
       if (!googleClientId || !googleClientSecret) {
@@ -12308,11 +12369,11 @@ async function createServer(opts) {
   const assetsDir = opts.assetsDir ?? path9.join(dirname, "..", "assets");
   if (fs8.existsSync(assetsDir)) {
     const indexPath = path9.join(assetsDir, "index.html");
-    const injectConfig = (html, projectTabsOverride, themeOverride) => {
+    const injectConfig = (html, projectTabsOverride, themeOverride, renderTokenOverride) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
       if (embed.enabled) {
-        const embedClient = embedClientConfigForRequest(embed, projectTabsOverride, themeOverride);
+        const embedClient = embedClientConfigForRequest(embed, projectTabsOverride, themeOverride, renderTokenOverride);
         if (embedClient) clientConfig.embed = embedClient;
       }
       const configScript = `<script>window.__CANONRY_CONFIG__=${serializeForInlineScript(clientConfig)}</script>`;
@@ -12326,7 +12387,8 @@ async function createServer(opts) {
         injectConfig(
           html,
           reply.request.headers["x-canonry-embed-tabs"],
-          reply.request.headers["x-canonry-embed-theme"]
+          reply.request.headers["x-canonry-embed-theme"],
+          reply.request.headers["x-canonry-embed-render-token"]
         )
       );
     };

package/dist/cli.js

@@ -29,7 +29,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-B3B3HJPH.js";
+} from "./chunk-WMWZW34J.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -46,7 +46,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-RMTNF2ES.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   apiKeys,
   createClient,
@@ -54,7 +54,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-XYSEBOHP.js";
+} from "./chunk-3VSTTH4M.js";
 import {
   BacklinkSources,
   CcReleaseSyncStatuses,
@@ -80,7 +80,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";

package/dist/index.d.ts

@@ -183,6 +183,14 @@ interface AgentConfigEntry {
      */
     mode?: 'disabled';
 }
+interface DashboardConfigEntry {
+    /**
+     * Whether the browser dashboard requires Canonry's built-in password/session
+     * gate. Defaults to true. Set false only when an upstream layer enforces auth
+     * and the engine is not directly internet-reachable.
+     */
+    requirePassword?: boolean;
+}
 /**
  * Google Places API config — supplemental rendered-listing data for GBP
  * lodging locations (#648). The API key authenticates Place Details calls
@@ -220,6 +228,7 @@ interface CanonryConfig {
     vercelTraffic?: VercelTrafficConfigEntry;
     openaiAds?: OpenAiAdsConfigEntry;
     dashboardPasswordHash?: string;
+    dashboard?: DashboardConfigEntry;
     telemetry?: boolean;
     anonymousId?: string;
     lastSeenVersion?: string;

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-B3B3HJPH.js";
+} from "./chunk-WMWZW34J.js";
 import {
   loadConfig
-} from "./chunk-RMTNF2ES.js";
-import "./chunk-XYSEBOHP.js";
-import "./chunk-DBZLOLYT.js";
+} from "./chunk-DUBZH5JW.js";
+import "./chunk-3VSTTH4M.js";
+import "./chunk-VEUBAZRG.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-RRWOGVVE.js → intelligence-service-I5EQ77KZ.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-XYSEBOHP.js";
-import "./chunk-DBZLOLYT.js";
+} from "./chunk-3VSTTH4M.js";
+import "./chunk-VEUBAZRG.js";
 export {
   IntelligenceService
 };

package/dist/mcp.js

@@ -3,10 +3,10 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-RMTNF2ES.js";
+} from "./chunk-DUBZH5JW.js";
 import {
   isReadOnlyKey
-} from "./chunk-DBZLOLYT.js";
+} from "./chunk-VEUBAZRG.js";
 
 // src/mcp/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainyc/canonry",
-  "version": "4.113.0",
+  "version": "4.114.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -65,27 +65,27 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-config": "0.0.0",
-    "@ainyc/canonry-db": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
     "@ainyc/canonry-api-routes": "0.0.0",
-    "@ainyc/canonry-integration-openai-ads": "0.0.0",
+    "@ainyc/canonry-db": "0.0.0",
+    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-integration-bing": "0.0.0",
+    "@ainyc/canonry-integration-openai-ads": "0.0.0",
+    "@ainyc/canonry-integration-google": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
+    "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
-    "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
-    "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
-    "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
-    "@ainyc/canonry-integration-traffic": "0.0.0",
-    "@ainyc/canonry-provider-perplexity": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
-    "@ainyc/canonry-provider-local": "0.0.0"
+    "@ainyc/canonry-provider-local": "0.0.0",
+    "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-provider-perplexity": "0.0.0"
   },
   "scripts": {
     "build": "tsx scripts/copy-agent-assets.ts && tsup && tsx build-web.ts",