@ainyc/canonry 4.88.0 → 4.89.0

package/dist/{chunk-2VEFNAQ3.js → chunk-MUPIPQBB.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-PRKBJNAG.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -104,7 +104,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-WMZJO56S.js";
+} from "./chunk-WEV4RH25.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -136,6 +136,7 @@ import {
   agentMemoryUpsertRequestSchema,
   authInvalid,
   authRequired,
+  buildEmbedClientConfig,
   buildRunErrorFromMessages,
   classifySkillFile,
   coerceSkillManifest,
@@ -147,20 +148,23 @@ import {
   effectiveBrandNames,
   effectiveDomains,
   factorStatusFromScore,
+  frameAncestorsHeaderValue,
   hostOf,
   isAgentProviderId,
   isBrowserProvider,
   isRetryableHttpError,
   normalizeUrlPath,
   notFound,
+  parseOriginList,
   providerError,
   resolveSnapshotRequestQueries,
   serializeRunError,
   skillsClientSchema,
+  splitList,
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-LRO4CLPL.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -2728,6 +2732,34 @@ var perplexityAdapter = {
   }
 };
 
+// src/embed.ts
+function resolveEmbedConfig(env, config) {
+  const embed = config.embed;
+  const rawEnabled = env.CANONRY_EMBED?.trim();
+  const enabled = rawEnabled ? rawEnabled === "1" || rawEnabled.toLowerCase() === "true" : embed?.enabled === true;
+  const allowedOrigins = env.CANONRY_EMBED_ORIGINS !== void 0 ? parseOriginList(env.CANONRY_EMBED_ORIGINS) : parseOriginList(embed?.allowOrigins);
+  const rawViews = env.CANONRY_EMBED_VIEWS !== void 0 ? splitList(env.CANONRY_EMBED_VIEWS) : splitList(embed?.views);
+  const views = normalizeViews(rawViews);
+  return {
+    enabled,
+    allowedOrigins,
+    ...views ? { views } : {},
+    ...embed?.theme ? { theme: embed.theme } : {}
+  };
+}
+function normalizeViews(raw) {
+  if (raw.length === 0) return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const view of raw) {
+    const id = view.toLowerCase();
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
 // src/places-config.ts
 var DEFAULT_TIER = "atmosphere";
 var DEFAULT_REFRESH_INTERVAL_DAYS = 7;
@@ -6289,7 +6321,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-WTEEV46F.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-SO46DMGR.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -10538,6 +10570,8 @@ async function createServer(opts) {
   const rawBasePath = process.env.CANONRY_BASE_PATH ?? opts.config.basePath;
   const normalizedBasePath = rawBasePath ? "/" + rawBasePath.replace(/^\//, "").replace(/\/?$/, "/") : void 0;
   const basePath = normalizedBasePath === "/" ? void 0 : normalizedBasePath;
+  const embed = resolveEmbedConfig(process.env, opts.config);
+  const embedCsp = embed.enabled ? frameAncestorsHeaderValue(embed.allowedOrigins) : void 0;
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
@@ -11173,16 +11207,25 @@ async function createServer(opts) {
     }
   });
   const dirname = path9.dirname(fileURLToPath3(import.meta.url));
-  const assetsDir = path9.join(dirname, "..", "assets");
+  const assetsDir = opts.assetsDir ?? path9.join(dirname, "..", "assets");
   if (fs8.existsSync(assetsDir)) {
     const indexPath = path9.join(assetsDir, "index.html");
     const injectConfig = (html) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
+      if (embed.enabled) {
+        const embedClient = buildEmbedClientConfig(embed);
+        if (embedClient) clientConfig.embed = embedClient;
+      }
       const configScript = `<script>window.__CANONRY_CONFIG__=${JSON.stringify(clientConfig)}</script>`;
       const baseTag = `<base href="${basePath ?? "/"}">`;
       return html.replace("<head>", `<head>${baseTag}`).replace("</head>", `${configScript}</head>`);
     };
+    const sendSpaDocument = (reply, html) => {
+      reply.header("Cache-Control", "no-cache, must-revalidate");
+      if (embedCsp) reply.header("Content-Security-Policy", embedCsp);
+      return reply.type("text/html").send(injectConfig(html));
+    };
     const fastifyStatic = await import("@fastify/static");
     await app.register(fastifyStatic.default, {
       root: assetsDir,
@@ -11209,7 +11252,7 @@ async function createServer(opts) {
     const serveIndex = (_request, reply) => {
       if (fs8.existsSync(indexPath)) {
         const html = fs8.readFileSync(indexPath, "utf-8");
-        return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
+        return sendSpaDocument(reply, html);
       }
       return reply.status(404).send({ error: "Dashboard not built" });
     };
@@ -11230,7 +11273,7 @@ async function createServer(opts) {
       }
       if (fs8.existsSync(indexPath)) {
         const html = fs8.readFileSync(indexPath, "utf-8");
-        return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
+        return sendSpaDocument(reply, html);
       }
       return reply.status(404).send({ error: "Not found" });
     });

package/dist/{chunk-RH3QYFX3.js → chunk-PRKBJNAG.js}

@@ -23,7 +23,7 @@ import {
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-LRO4CLPL.js";
 
 // src/config.ts
 import fs from "fs";

package/dist/{chunk-WMZJO56S.js → chunk-WEV4RH25.js}

@@ -258,7 +258,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-LRO4CLPL.js";
 
 // src/intelligence-service.ts
 import { eq as eq37, desc as desc18, asc as asc5, and as and27, ne as ne5, or as or5, inArray as inArray14, gte as gte7, lte as lte4 } from "drizzle-orm";

package/dist/cli.js

@@ -27,7 +27,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-2VEFNAQ3.js";
+} from "./chunk-MUPIPQBB.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -44,7 +44,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-PRKBJNAG.js";
 import {
   apiKeys,
   createClient,
@@ -52,7 +52,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-WMZJO56S.js";
+} from "./chunk-WEV4RH25.js";
 import {
   BacklinkSources,
   CcReleaseSyncStatuses,
@@ -77,7 +77,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-LRO4CLPL.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -10299,6 +10299,18 @@ async function waitForReady(host, port, maxMs = 1e4) {
   }
   return false;
 }
+function buildServeForwardArgs(opts) {
+  const args = [];
+  if (opts.port) args.push("--port", opts.port);
+  if (opts.host) args.push("--host", opts.host);
+  if (opts.basePath) args.push("--base-path", opts.basePath);
+  if (opts.embed) {
+    args.push("--embed");
+    for (const origin of opts.embedAllowOrigins ?? []) args.push("--embed-allow-origin", origin);
+    for (const view of opts.embedViews ?? []) args.push("--embed-view", view);
+  }
+  return args;
+}
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
@@ -10319,9 +10331,7 @@ async function startDaemon(opts) {
   const cliPath = path7.resolve(new URL(import.meta.url).pathname);
   const inSourceMode = new URL(import.meta.url).pathname.endsWith(".ts");
   const args = inSourceMode ? ["--import", "tsx", cliPath, "serve"] : [cliPath, "serve"];
-  if (opts.port) args.push("--port", opts.port);
-  if (opts.host) args.push("--host", opts.host);
-  if (opts.basePath) args.push("--base-path", opts.basePath);
+  args.push(...buildServeForwardArgs(opts));
   const child = spawn(process.execPath, args, {
     detached: true,
     stdio: "ignore"
@@ -11002,6 +11012,11 @@ function applyServerEnv(values) {
   if (port) process.env.CANONRY_PORT = port;
   if (host) process.env.CANONRY_HOST = host;
   if (basePath) process.env.CANONRY_BASE_PATH = basePath;
+  const embedOrigins = getStringArray(values, "embed-allow-origin");
+  const embedViews = getStringArray(values, "embed-view");
+  if (getBoolean(values, "embed")) process.env.CANONRY_EMBED = "1";
+  if (embedOrigins && embedOrigins.length > 0) process.env.CANONRY_EMBED_ORIGINS = embedOrigins.join(",");
+  if (embedViews && embedViews.length > 0) process.env.CANONRY_EMBED_VIEWS = embedViews.join(",");
 }
 var SYSTEM_CLI_COMMANDS = [
   {
@@ -11058,11 +11073,14 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["serve"],
-    usage: "canonry serve [--port <port>] [--host <host>] [--base-path <path>] [--format json]",
+    usage: "canonry serve [--port <port>] [--host <host>] [--base-path <path>] [--embed] [--embed-allow-origin <origin>...] [--embed-view <view>...] [--format json]",
     options: {
       port: stringOption(),
       host: stringOption(),
-      "base-path": stringOption()
+      "base-path": stringOption(),
+      embed: { type: "boolean", default: false },
+      "embed-allow-origin": multiStringOption(),
+      "embed-view": multiStringOption()
     },
     allowPositionals: false,
     run: async (input) => {
@@ -11072,11 +11090,14 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["start"],
-    usage: "canonry start [--port <port>] [--host <host>] [--base-path <path>] [--format json]",
+    usage: "canonry start [--port <port>] [--host <host>] [--base-path <path>] [--embed] [--embed-allow-origin <origin>...] [--embed-view <view>...] [--format json]",
     options: {
       port: stringOption(),
       host: stringOption(),
-      "base-path": stringOption()
+      "base-path": stringOption(),
+      embed: { type: "boolean", default: false },
+      "embed-allow-origin": multiStringOption(),
+      "embed-view": multiStringOption()
     },
     allowPositionals: false,
     run: async (input) => {
@@ -11084,6 +11105,9 @@ var SYSTEM_CLI_COMMANDS = [
         port: getString(input.values, "port"),
         host: getString(input.values, "host"),
         basePath: getString(input.values, "base-path"),
+        embed: getBoolean(input.values, "embed"),
+        embedAllowOrigins: getStringArray(input.values, "embed-allow-origin"),
+        embedViews: getStringArray(input.values, "embed-view"),
         format: input.format
       });
     }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { FastifyInstance } from 'fastify';
 import { DatabaseClient } from '@ainyc/canonry-db';
-import { ProviderQuotaPolicy } from '@ainyc/canonry-contracts';
+import { ProviderQuotaPolicy, EmbedConfigEntry } from '@ainyc/canonry-contracts';
 
 type GoogleConnectionType = 'gsc' | 'ga4' | 'gbp';
 interface ProviderConfigEntry {
@@ -205,6 +205,7 @@ interface CanonryConfig {
     lastKnownLatestVersion?: string;
     agent?: AgentConfigEntry;
     places?: PlacesConfigEntry;
+    embed?: EmbedConfigEntry;
 }
 declare function loadConfig(): CanonryConfig;
 
@@ -223,6 +224,13 @@ declare function createServer(opts: {
      * Defaults to loopback when unset (programmatic/test callers).
      */
     host?: string;
+    /**
+     * Override for the directory the pre-built SPA is served from. Defaults to
+     * the package's bundled `assets/` (resolved from `import.meta.url`). Exposed
+     * so tests can point at a temp dir containing a fixture `index.html` and
+     * assert the injected config + framing header on the served document.
+     */
+    assetsDir?: string;
 }): Promise<FastifyInstance>;
 
 export { type CanonryConfig, createServer, loadConfig };

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-2VEFNAQ3.js";
+} from "./chunk-MUPIPQBB.js";
 import {
   loadConfig
-} from "./chunk-RH3QYFX3.js";
-import "./chunk-WMZJO56S.js";
-import "./chunk-JZ67YCHT.js";
+} from "./chunk-PRKBJNAG.js";
+import "./chunk-WEV4RH25.js";
+import "./chunk-LRO4CLPL.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-WTEEV46F.js → intelligence-service-SO46DMGR.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-WMZJO56S.js";
-import "./chunk-JZ67YCHT.js";
+} from "./chunk-WEV4RH25.js";
+import "./chunk-LRO4CLPL.js";
 export {
   IntelligenceService
 };

package/dist/mcp.js

@@ -3,10 +3,10 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-PRKBJNAG.js";
 import {
   isReadOnlyKey
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-LRO4CLPL.js";
 
 // src/mcp/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainyc/canonry",
-  "version": "4.88.0",
+  "version": "4.89.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -62,24 +62,24 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-client": "0.0.0",
-    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-api-routes": "0.0.0",
+    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
-    "@ainyc/canonry-integration-bing": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
+    "@ainyc/canonry-integration-bing": "0.0.0",
+    "@ainyc/canonry-api-client": "0.0.0",
+    "@ainyc/canonry-integration-openai-ads": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
-    "@ainyc/canonry-integration-openai-ads": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
-    "@ainyc/canonry-provider-gemini": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-provider-gemini": "0.0.0",
     "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
     "@ainyc/canonry-provider-perplexity": "0.0.0"