@ainyc/canonry 4.88.0 → 4.90.0

package/dist/{chunk-2VEFNAQ3.js → chunk-I4FR66PU.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-XG7JKKTC.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -104,7 +104,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-WMZJO56S.js";
+} from "./chunk-KO3T36E5.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -136,6 +136,7 @@ import {
   agentMemoryUpsertRequestSchema,
   authInvalid,
   authRequired,
+  buildEmbedClientConfig,
   buildRunErrorFromMessages,
   classifySkillFile,
   coerceSkillManifest,
@@ -147,20 +148,23 @@ import {
   effectiveBrandNames,
   effectiveDomains,
   factorStatusFromScore,
+  frameAncestorsHeaderValue,
   hostOf,
   isAgentProviderId,
   isBrowserProvider,
   isRetryableHttpError,
   normalizeUrlPath,
   notFound,
+  parseOriginList,
   providerError,
   resolveSnapshotRequestQueries,
   serializeRunError,
   skillsClientSchema,
+  splitList,
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-PL2ODHUC.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -2728,6 +2732,34 @@ var perplexityAdapter = {
   }
 };
 
+// src/embed.ts
+function resolveEmbedConfig(env, config) {
+  const embed = config.embed;
+  const rawEnabled = env.CANONRY_EMBED?.trim();
+  const enabled = rawEnabled ? rawEnabled === "1" || rawEnabled.toLowerCase() === "true" : embed?.enabled === true;
+  const allowedOrigins = env.CANONRY_EMBED_ORIGINS !== void 0 ? parseOriginList(env.CANONRY_EMBED_ORIGINS) : parseOriginList(embed?.allowOrigins);
+  const rawViews = env.CANONRY_EMBED_VIEWS !== void 0 ? splitList(env.CANONRY_EMBED_VIEWS) : splitList(embed?.views);
+  const views = normalizeViews(rawViews);
+  return {
+    enabled,
+    allowedOrigins,
+    ...views ? { views } : {},
+    ...embed?.theme ? { theme: embed.theme } : {}
+  };
+}
+function normalizeViews(raw) {
+  if (raw.length === 0) return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const view of raw) {
+    const id = view.toLowerCase();
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
 // src/places-config.ts
 var DEFAULT_TIER = "atmosphere";
 var DEFAULT_REFRESH_INTERVAL_DAYS = 7;
@@ -4035,6 +4067,8 @@ async function executeGbpSync(db, runId, projectId, opts) {
                 syncedAt: insertNow,
                 syncRunId: runId
               }).run();
+            } else if (lodging !== null && latestLodging) {
+              tx.update(gbpLodgingSnapshots).set({ syncedAt: insertNow, syncRunId: runId }).where(eq3(gbpLodgingSnapshots.id, latestLodging.id)).run();
             }
             if (placeToWrite) {
               tx.insert(gbpPlaceDetails).values({
@@ -6289,7 +6323,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-WTEEV46F.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-DZK4FOAJ.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -10538,6 +10572,8 @@ async function createServer(opts) {
   const rawBasePath = process.env.CANONRY_BASE_PATH ?? opts.config.basePath;
   const normalizedBasePath = rawBasePath ? "/" + rawBasePath.replace(/^\//, "").replace(/\/?$/, "/") : void 0;
   const basePath = normalizedBasePath === "/" ? void 0 : normalizedBasePath;
+  const embed = resolveEmbedConfig(process.env, opts.config);
+  const embedCsp = embed.enabled ? frameAncestorsHeaderValue(embed.allowedOrigins) : void 0;
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
@@ -11173,16 +11209,25 @@ async function createServer(opts) {
     }
   });
   const dirname = path9.dirname(fileURLToPath3(import.meta.url));
-  const assetsDir = path9.join(dirname, "..", "assets");
+  const assetsDir = opts.assetsDir ?? path9.join(dirname, "..", "assets");
   if (fs8.existsSync(assetsDir)) {
     const indexPath = path9.join(assetsDir, "index.html");
     const injectConfig = (html) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
+      if (embed.enabled) {
+        const embedClient = buildEmbedClientConfig(embed);
+        if (embedClient) clientConfig.embed = embedClient;
+      }
       const configScript = `<script>window.__CANONRY_CONFIG__=${JSON.stringify(clientConfig)}</script>`;
       const baseTag = `<base href="${basePath ?? "/"}">`;
       return html.replace("<head>", `<head>${baseTag}`).replace("</head>", `${configScript}</head>`);
     };
+    const sendSpaDocument = (reply, html) => {
+      reply.header("Cache-Control", "no-cache, must-revalidate");
+      if (embedCsp) reply.header("Content-Security-Policy", embedCsp);
+      return reply.type("text/html").send(injectConfig(html));
+    };
     const fastifyStatic = await import("@fastify/static");
     await app.register(fastifyStatic.default, {
       root: assetsDir,
@@ -11209,7 +11254,7 @@ async function createServer(opts) {
     const serveIndex = (_request, reply) => {
       if (fs8.existsSync(indexPath)) {
         const html = fs8.readFileSync(indexPath, "utf-8");
-        return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
+        return sendSpaDocument(reply, html);
       }
       return reply.status(404).send({ error: "Dashboard not built" });
     };
@@ -11230,7 +11275,7 @@ async function createServer(opts) {
       }
       if (fs8.existsSync(indexPath)) {
         const html = fs8.readFileSync(indexPath, "utf-8");
-        return reply.header("Cache-Control", "no-cache, must-revalidate").type("text/html").send(injectConfig(html));
+        return sendSpaDocument(reply, html);
       }
       return reply.status(404).send({ error: "Not found" });
     });

package/dist/{chunk-WMZJO56S.js → chunk-KO3T36E5.js}

@@ -258,7 +258,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-PL2ODHUC.js";
 
 // src/intelligence-service.ts
 import { eq as eq37, desc as desc18, asc as asc5, and as and27, ne as ne5, or as or5, inArray as inArray14, gte as gte7, lte as lte4 } from "drizzle-orm";
@@ -1170,6 +1170,16 @@ var gbpLocations = sqliteTable("gbp_locations", {
   // rendered-listing data. Null when Google has not assigned a Place ID.
   placeId: text("place_id"),
   mapsUri: text("maps_uri"),
+  // Owner-authored profile content from the Business Information v1 Location
+  // resource — the entity-anchor + qualifier signals AI answer engines weight.
+  // `serviceArea` / `regularHours` are stored verbatim (presence + raw shape).
+  additionalCategories: text("additional_categories", { mode: "json" }).$type(),
+  description: text("description"),
+  serviceArea: text("service_area", { mode: "json" }).$type(),
+  regularHours: text("regular_hours", { mode: "json" }).$type(),
+  primaryPhone: text("primary_phone"),
+  openStatus: text("open_status"),
+  openingDate: text("opening_date"),
   selected: integer("selected", { mode: "boolean" }).notNull().default(true),
   syncedAt: text("synced_at"),
   createdAt: text("created_at").notNull(),
@@ -3134,6 +3144,28 @@ var MIGRATION_VERSIONS = [
         db.run(sql.raw(`ALTER TABLE health_snapshots ADD COLUMN mentioned_pairs INTEGER`));
       }
     }
+  },
+  {
+    version: 81,
+    name: "gbp-locations-owner-content",
+    statements: [],
+    run: (db) => {
+      if (!tableExists(db, "gbp_locations")) return;
+      const cols = [
+        "additional_categories",
+        "description",
+        "service_area",
+        "regular_hours",
+        "primary_phone",
+        "open_status",
+        "opening_date"
+      ];
+      for (const col of cols) {
+        if (!columnExists(db, "gbp_locations", col)) {
+          db.run(sql.raw(`ALTER TABLE gbp_locations ADD COLUMN ${col} TEXT`));
+        }
+      }
+    }
   }
 ];
 function rebuildBacklinkTableWithSource(tx, table) {
@@ -5217,22 +5249,22 @@ function analyzeGbp(signals) {
         drafts.push({
           ...base,
           type: "gbp-listing-discrepancy",
-          severity: "high",
-          title: `${loc.displayName}: public listing shows ${loc.placesAmenities.length} amenit${loc.placesAmenities.length === 1 ? "y" : "ies"} your GBP profile doesn\u2019t`,
+          severity: "medium",
+          title: `${loc.displayName}: public listing advertises ${loc.placesAmenities.length} amenit${loc.placesAmenities.length === 1 ? "y" : "ies"} canonry can\u2019t confirm via the GBP API`,
           recommendation: {
-            action: "Populate the hotel\u2019s structured amenity attributes in Google Business Profile to match what its public listing already advertises \u2014 the amenity source you directly control",
-            reason: `Google\u2019s rendered listing advertises ${amenityList} (synthesized from Hotel Center / OTAs / Places), but your GBP structured profile has zero populated attributes. The structured attributes are what AI answer engines cite and the only amenity data you control, so the public listing is making promises your profile can\u2019t back.`
+            action: 'Verify these amenities are set in the Google Business Profile "Hotel details" panel so the structured profile matches what the public listing advertises.',
+            reason: `Google\u2019s rendered listing advertises ${amenityList}, but the GBP Lodging API returns no structured attributes for this location. The Lodging API does not expose the owner-set "Hotel details" amenity panel, so the amenities may already be set there and simply not be readable via the API. Verify in Hotel details: if any are missing, add them, since the structured attributes are the amenity data you directly control and that AI answer engines cite.`
           }
         });
       } else {
         drafts.push({
           ...base,
           type: "gbp-lodging-gap",
-          severity: "high",
-          title: `${loc.displayName}: lodging profile has no structured attributes`,
+          severity: "low",
+          title: `${loc.displayName}: structured lodging attributes not readable via the GBP API`,
           recommendation: {
-            action: "Populate the hotel\u2019s structured amenity attributes in Google Business Profile \u2014 the amenity source you directly control",
-            reason: "The GBP API exposes only owner-configured attributes, and this profile has none. Google\u2019s rendered listing may still show amenities it synthesizes from Hotel Center, OTAs, and user data \u2014 so the public listing can differ from this profile \u2014 but the structured attributes are what AI answer engines cite and the only amenity data you control."
+            action: 'Verify the hotel amenities in the Google Business Profile "Hotel details" panel. If they are already set there, no change is needed.',
+            reason: 'The GBP Lodging API returns no structured attributes for this location. That resource is commonly empty even for complete hotels, because the owner-set "Hotel details" amenity panel (breakfast, wifi, parking, accessibility, and the like) writes to a separate surface the Lodging API does not expose. Treat this as a verify, not a confirmed gap: confirm the amenities are set in Hotel details, the amenity source you directly control and that AI answer engines cite.'
           }
         });
       }
@@ -19710,6 +19742,15 @@ var GBP_LOCATIONS_DEFAULT_READ_MASK = [
   "storefrontAddress",
   "websiteUri",
   "categories.primaryCategory.displayName",
+  // Owner-authored profile content — the entity-anchor and qualifier signals AI
+  // answer engines weight most. All ride the same Business Information v1
+  // Location resource canonry already reads (no new auth / API enablement).
+  "categories.additionalCategories.displayName",
+  "profile.description",
+  "serviceArea",
+  "regularHours",
+  "phoneNumbers",
+  "openInfo",
   "metadata.placeId",
   "metadata.mapsUri"
 ].join(",");
@@ -19847,6 +19888,26 @@ function formatStorefrontAddress(loc) {
   ].filter((p) => Boolean(p));
   return parts.length ? parts.join(", ") : null;
 }
+function buildLocationProfileFields(loc) {
+  return {
+    additionalCategories: (loc.categories?.additionalCategories ?? []).map((c) => c.displayName).filter((n) => Boolean(n)),
+    description: loc.profile?.description ?? null,
+    serviceArea: loc.serviceArea ?? null,
+    regularHours: loc.regularHours ?? null,
+    primaryPhone: loc.phoneNumbers?.primaryPhone ?? null,
+    openStatus: loc.openInfo?.status ?? null,
+    openingDate: formatOpeningDate(loc.openInfo?.openingDate)
+  };
+}
+function formatOpeningDate(date) {
+  if (!date?.year) return null;
+  let out = String(date.year);
+  if (date.month) {
+    out += `-${String(date.month).padStart(2, "0")}`;
+    if (date.day) out += `-${String(date.day).padStart(2, "0")}`;
+  }
+  return out;
+}
 
 // ../integration-google-business-profile/src/performance-client.ts
 function pad2(n) {
@@ -20863,6 +20924,13 @@ async function googleRoutes(app, opts) {
       websiteUri: row.websiteUri ?? null,
       placeId: row.placeId ?? null,
       mapsUri: row.mapsUri ?? null,
+      additionalCategories: row.additionalCategories ?? [],
+      description: row.description ?? null,
+      serviceArea: row.serviceArea ?? null,
+      regularHours: row.regularHours ?? null,
+      primaryPhone: row.primaryPhone ?? null,
+      openStatus: row.openStatus ?? null,
+      openingDate: row.openingDate ?? null,
       selected: Boolean(row.selected),
       syncedAt: row.syncedAt ?? null,
       createdAt: row.createdAt,
@@ -20958,6 +21026,7 @@ async function googleRoutes(app, opts) {
       if (switching) clearGbpProjectData(tx, project.id);
       for (const remote of remoteLocations) {
         const existing = tx.select().from(gbpLocations).where(and14(eq21(gbpLocations.projectId, project.id), eq21(gbpLocations.locationName, remote.name))).get();
+        const profile = buildLocationProfileFields(remote);
         if (existing) {
           tx.update(gbpLocations).set({
             accountName,
@@ -20967,6 +21036,7 @@ async function googleRoutes(app, opts) {
             websiteUri: remote.websiteUri ?? null,
             placeId: remote.metadata?.placeId ?? null,
             mapsUri: remote.metadata?.mapsUri ?? null,
+            ...profile,
             updatedAt: now
           }).where(eq21(gbpLocations.id, existing.id)).run();
         } else {
@@ -20981,6 +21051,7 @@ async function googleRoutes(app, opts) {
             websiteUri: remote.websiteUri ?? null,
             placeId: remote.metadata?.placeId ?? null,
             mapsUri: remote.metadata?.mapsUri ?? null,
+            ...profile,
             selected: selectAllNew,
             createdAt: now,
             updatedAt: now

package/dist/{chunk-JZ67YCHT.js → chunk-PL2ODHUC.js}

@@ -901,6 +901,17 @@ var gbpLocationDtoSchema = z8.object({
   // the location is not on Maps). `placeId` is the join key to the Places API.
   placeId: z8.string().nullable(),
   mapsUri: z8.string().nullable(),
+  // Owner-authored profile content (Business Information v1 Location resource).
+  // These are the entity-anchor + qualifier signals AI answer engines weight:
+  // secondary categories, the business description, the service area + hours
+  // (stored verbatim as JSON), the primary phone, and the open state.
+  additionalCategories: z8.array(z8.string()),
+  description: z8.string().nullable(),
+  serviceArea: z8.record(z8.string(), z8.unknown()).nullable(),
+  regularHours: z8.record(z8.string(), z8.unknown()).nullable(),
+  primaryPhone: z8.string().nullable(),
+  openStatus: z8.string().nullable(),
+  openingDate: z8.string().nullable(),
   selected: z8.boolean(),
   syncedAt: z8.string().nullable(),
   createdAt: z8.string(),
@@ -4827,6 +4838,7 @@ var TrafficPathClasses = {
   other: "other"
 };
 var ROBOTS_BASENAMES = /* @__PURE__ */ new Set(["robots.txt", "llms.txt", "llms-full.txt"]);
+var INFRA_BASENAMES = /* @__PURE__ */ new Set(["xmlrpc.php", "wp-cron.php"]);
 var ASSET_EXTENSIONS = /* @__PURE__ */ new Set([
   "css",
   "js",
@@ -4925,6 +4937,9 @@ function classifyTrafficPath(pathNormalized) {
   if (ROBOTS_BASENAMES.has(basename)) return TrafficPathClasses.robots;
   if (lower.endsWith(".xml") || lower.endsWith(".xml.gz")) return TrafficPathClasses.sitemap;
   if (SITEMAP_BASENAME.test(basename)) return TrafficPathClasses.sitemap;
+  if (INFRA_BASENAMES.has(basename)) return TrafficPathClasses.other;
+  if (lower === "/wp-json" || lower.startsWith("/wp-json/")) return TrafficPathClasses.other;
+  if (lower.endsWith("/feed") || lower.includes("/feed/")) return TrafficPathClasses.other;
   const dot = basename.lastIndexOf(".");
   const ext = dot > 0 ? basename.slice(dot + 1) : "";
   if (ext) {
@@ -5183,6 +5198,63 @@ function escapeLikePattern(value) {
   return value.replace(/[\\%_]/g, (match) => `\\${match}`);
 }
 
+// ../contracts/src/embed.ts
+var SELF_TOKEN = "'self'";
+function normalizeFrameOrigin(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed === SELF_TOKEN) return SELF_TOKEN;
+  if (trimmed.includes("*")) return null;
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (url.username || url.password) return null;
+  if (url.pathname && url.pathname !== "/" || url.search || url.hash) return null;
+  if (!url.hostname) return null;
+  return url.origin;
+}
+function splitList(raw) {
+  if (raw === void 0) return [];
+  const tokens = (Array.isArray(raw) ? raw : [raw]).flatMap(
+    (entry) => String(entry).split(/[\s,]+/)
+  );
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const token of tokens) {
+    const trimmed = token.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+function parseOriginList(raw) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const token of splitList(raw)) {
+    const origin = normalizeFrameOrigin(token);
+    if (!origin || seen.has(origin)) continue;
+    seen.add(origin);
+    out.push(origin);
+  }
+  return out;
+}
+function frameAncestorsHeaderValue(origins) {
+  if (origins.length === 0) return "frame-ancestors 'none'";
+  return `frame-ancestors ${origins.join(" ")}`;
+}
+function buildEmbedClientConfig(resolved) {
+  if (!resolved.enabled) return void 0;
+  const client = { enabled: true };
+  if (resolved.views && resolved.views.length > 0) client.views = resolved.views;
+  if (resolved.theme && Object.keys(resolved.theme).length > 0) client.theme = resolved.theme;
+  return client;
+}
+
 export {
   __export,
   apiKeyDtoSchema,
@@ -5480,5 +5552,9 @@ export {
   AI_PROVIDER_INFRA_DOMAINS,
   escapeLikePattern,
   READ_ONLY_SCOPE,
-  isReadOnlyKey
+  isReadOnlyKey,
+  splitList,
+  parseOriginList,
+  frameAncestorsHeaderValue,
+  buildEmbedClientConfig
 };

package/dist/{chunk-RH3QYFX3.js → chunk-XG7JKKTC.js}

@@ -23,7 +23,7 @@ import {
   trafficConnectVercelRequestSchema,
   trafficConnectWordpressRequestSchema,
   trafficEventKindSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-PL2ODHUC.js";
 
 // src/config.ts
 import fs from "fs";
@@ -6291,7 +6291,7 @@ var canonryMcpTools = [
   defineTool({
     name: "canonry_gbp_lodging",
     title: "Get GBP lodging attributes",
-    description: "List the latest Google Business Profile lodging snapshot per location (hotel structured attributes). populatedGroupCount=0 means an empty profile \u2014 an AEO gap.",
+    description: 'List the latest Google Business Profile lodging snapshot per location (hotel structured attributes). populatedGroupCount=0 means the Lodging API returned no structured attributes, which is common even for complete hotels because the owner-set "Hotel details" amenity panel is a separate surface the API does not expose. Treat it as a "verify the Hotel details panel", not a confirmed gap.',
     access: "read",
     tier: "gbp",
     inputSchema: gbpLocationScopedInputSchema,

package/dist/cli.js

@@ -27,7 +27,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-2VEFNAQ3.js";
+} from "./chunk-I4FR66PU.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -44,7 +44,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-XG7JKKTC.js";
 import {
   apiKeys,
   createClient,
@@ -52,7 +52,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-WMZJO56S.js";
+} from "./chunk-KO3T36E5.js";
 import {
   BacklinkSources,
   CcReleaseSyncStatuses,
@@ -77,7 +77,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-PL2ODHUC.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -3514,7 +3514,7 @@ async function gbpLodging(project, opts) {
   }
   console.log(`${response.total} lodging profile(s):`);
   for (const l of response.lodging) {
-    const note = l.populatedGroupCount === 0 ? " \u2014 EMPTY (AEO gap: no structured amenities for AI engines to cite)" : "";
+    const note = l.populatedGroupCount === 0 ? ' (none readable via the Lodging API; verify the "Hotel details" panel, often set there but not exposed by the API)' : "";
     console.log(`  ${l.locationName}  ${l.populatedGroupCount} attribute group(s)${note}`);
   }
 }
@@ -10299,6 +10299,18 @@ async function waitForReady(host, port, maxMs = 1e4) {
   }
   return false;
 }
+function buildServeForwardArgs(opts) {
+  const args = [];
+  if (opts.port) args.push("--port", opts.port);
+  if (opts.host) args.push("--host", opts.host);
+  if (opts.basePath) args.push("--base-path", opts.basePath);
+  if (opts.embed) {
+    args.push("--embed");
+    for (const origin of opts.embedAllowOrigins ?? []) args.push("--embed-allow-origin", origin);
+    for (const view of opts.embedViews ?? []) args.push("--embed-view", view);
+  }
+  return args;
+}
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
@@ -10319,9 +10331,7 @@ async function startDaemon(opts) {
   const cliPath = path7.resolve(new URL(import.meta.url).pathname);
   const inSourceMode = new URL(import.meta.url).pathname.endsWith(".ts");
   const args = inSourceMode ? ["--import", "tsx", cliPath, "serve"] : [cliPath, "serve"];
-  if (opts.port) args.push("--port", opts.port);
-  if (opts.host) args.push("--host", opts.host);
-  if (opts.basePath) args.push("--base-path", opts.basePath);
+  args.push(...buildServeForwardArgs(opts));
   const child = spawn(process.execPath, args, {
     detached: true,
     stdio: "ignore"
@@ -11002,6 +11012,11 @@ function applyServerEnv(values) {
   if (port) process.env.CANONRY_PORT = port;
   if (host) process.env.CANONRY_HOST = host;
   if (basePath) process.env.CANONRY_BASE_PATH = basePath;
+  const embedOrigins = getStringArray(values, "embed-allow-origin");
+  const embedViews = getStringArray(values, "embed-view");
+  if (getBoolean(values, "embed")) process.env.CANONRY_EMBED = "1";
+  if (embedOrigins && embedOrigins.length > 0) process.env.CANONRY_EMBED_ORIGINS = embedOrigins.join(",");
+  if (embedViews && embedViews.length > 0) process.env.CANONRY_EMBED_VIEWS = embedViews.join(",");
 }
 var SYSTEM_CLI_COMMANDS = [
   {
@@ -11058,11 +11073,14 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["serve"],
-    usage: "canonry serve [--port <port>] [--host <host>] [--base-path <path>] [--format json]",
+    usage: "canonry serve [--port <port>] [--host <host>] [--base-path <path>] [--embed] [--embed-allow-origin <origin>...] [--embed-view <view>...] [--format json]",
     options: {
       port: stringOption(),
       host: stringOption(),
-      "base-path": stringOption()
+      "base-path": stringOption(),
+      embed: { type: "boolean", default: false },
+      "embed-allow-origin": multiStringOption(),
+      "embed-view": multiStringOption()
     },
     allowPositionals: false,
     run: async (input) => {
@@ -11072,11 +11090,14 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["start"],
-    usage: "canonry start [--port <port>] [--host <host>] [--base-path <path>] [--format json]",
+    usage: "canonry start [--port <port>] [--host <host>] [--base-path <path>] [--embed] [--embed-allow-origin <origin>...] [--embed-view <view>...] [--format json]",
     options: {
       port: stringOption(),
       host: stringOption(),
-      "base-path": stringOption()
+      "base-path": stringOption(),
+      embed: { type: "boolean", default: false },
+      "embed-allow-origin": multiStringOption(),
+      "embed-view": multiStringOption()
     },
     allowPositionals: false,
     run: async (input) => {
@@ -11084,6 +11105,9 @@ var SYSTEM_CLI_COMMANDS = [
         port: getString(input.values, "port"),
         host: getString(input.values, "host"),
         basePath: getString(input.values, "base-path"),
+        embed: getBoolean(input.values, "embed"),
+        embedAllowOrigins: getStringArray(input.values, "embed-allow-origin"),
+        embedViews: getStringArray(input.values, "embed-view"),
         format: input.format
       });
     }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { FastifyInstance } from 'fastify';
 import { DatabaseClient } from '@ainyc/canonry-db';
-import { ProviderQuotaPolicy } from '@ainyc/canonry-contracts';
+import { ProviderQuotaPolicy, EmbedConfigEntry } from '@ainyc/canonry-contracts';
 
 type GoogleConnectionType = 'gsc' | 'ga4' | 'gbp';
 interface ProviderConfigEntry {
@@ -205,6 +205,7 @@ interface CanonryConfig {
     lastKnownLatestVersion?: string;
     agent?: AgentConfigEntry;
     places?: PlacesConfigEntry;
+    embed?: EmbedConfigEntry;
 }
 declare function loadConfig(): CanonryConfig;
 
@@ -223,6 +224,13 @@ declare function createServer(opts: {
      * Defaults to loopback when unset (programmatic/test callers).
      */
     host?: string;
+    /**
+     * Override for the directory the pre-built SPA is served from. Defaults to
+     * the package's bundled `assets/` (resolved from `import.meta.url`). Exposed
+     * so tests can point at a temp dir containing a fixture `index.html` and
+     * assert the injected config + framing header on the served document.
+     */
+    assetsDir?: string;
 }): Promise<FastifyInstance>;
 
 export { type CanonryConfig, createServer, loadConfig };

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-2VEFNAQ3.js";
+} from "./chunk-I4FR66PU.js";
 import {
   loadConfig
-} from "./chunk-RH3QYFX3.js";
-import "./chunk-WMZJO56S.js";
-import "./chunk-JZ67YCHT.js";
+} from "./chunk-XG7JKKTC.js";
+import "./chunk-KO3T36E5.js";
+import "./chunk-PL2ODHUC.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-WTEEV46F.js → intelligence-service-DZK4FOAJ.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-WMZJO56S.js";
-import "./chunk-JZ67YCHT.js";
+} from "./chunk-KO3T36E5.js";
+import "./chunk-PL2ODHUC.js";
 export {
   IntelligenceService
 };

package/dist/mcp.js

@@ -3,10 +3,10 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-RH3QYFX3.js";
+} from "./chunk-XG7JKKTC.js";
 import {
   isReadOnlyKey
-} from "./chunk-JZ67YCHT.js";
+} from "./chunk-PL2ODHUC.js";
 
 // src/mcp/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";