@canonry/canonry 4.127.0 → 4.128.0

package/dist/{chunk-HQRUFTLN.js → chunk-NCFH26X5.js}

@@ -18795,7 +18795,7 @@ var routeCatalog = [
     method: "post",
     path: "/api/v1/projects/{name}/ads/activation-grants/{grantId}/revoke",
     summary: "Revoke or cancel an OpenAI Ads activation grant",
-    description: "Human-only kill switch. Before execution, the grant becomes revoked. After execution starts, or while an activation outcome is unknown, revocationRequestedAt is recorded atomically. Subsequent activation steps are blocked, and the recovery worker rolls back confirmed active entities. Unknown outcomes remain explicitly unknown while the watchdog repeatedly issues exact-tree safety pauses. A provider request already authorized or in flight may still settle before containment. Verified rollback leaves the single-use grant consumed and the operation failed.",
+    description: "Human-only kill switch. Before execution, the grant becomes revoked. After execution starts, or while an activation outcome is unknown, revocationRequestedAt is recorded atomically. Subsequent activation steps are blocked, and the recovery worker rolls back confirmed active entities. Unknown outcomes remain explicitly unknown unless revocation was requested, the provider settlement window elapsed, and the watchdog can enumerate the complete provider tree and verify every entity paused. A provider request already authorized or in flight may still settle before containment. Verified rollback leaves the single-use grant consumed and the operation failed.",
     tags: ["ads"],
     parameters: [
       nameParameter,
@@ -25989,6 +25989,7 @@ async function executeApprovedAdsActivation(dependencies, request) {
 // ../api-routes/src/ads-activation-routes.ts
 var MAX_ACTIVATION_GRANT_LIFETIME_MS = 24 * 60 * 60 * 1e3;
 var ACTIVATION_LEASE_MS = 5 * 6e4;
+var ACTIVATION_REVOCATION_SETTLEMENT_MS = ACTIVATION_LEASE_MS;
 var ACTIVATION_STEP_INSERT_BATCH_SIZE = 40;
 function parseBody(schema, value) {
   const parsed = schema.safeParse(value);
@@ -26554,6 +26555,56 @@ function selectWatchdogOperations(app, nowIso, batchSize, allowLiveRevocationLea
 function selectRecoveryWatchdogOperations(app, nowIso, batchSize) {
   return selectWatchdogOperations(app, nowIso, batchSize, false);
 }
+function finalizeContainedRevokedUnknownActivation(app, operation, grant) {
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const revocationRequestedAt = grant.revocationRequestedAt === null ? Number.NaN : Date.parse(grant.revocationRequestedAt);
+  if (!Number.isFinite(revocationRequestedAt) || Date.parse(nowIso) - revocationRequestedAt < ACTIVATION_REVOCATION_SETTLEMENT_MS) {
+    return false;
+  }
+  return app.db.transaction((tx) => {
+    const operationUpdate = tx.update(adsOperations).set({
+      state: AdsOperationStates.failed,
+      errorCode: AdsActivationErrorCodes.grantRevoked,
+      errorMessage: "Ads activation was cancelled and the provider tree was verified paused",
+      leaseOwner: null,
+      leaseExpiresAt: null,
+      lastReconciledAt: nowIso,
+      updatedAt: nowIso
+    }).where(and19(
+      eq25(adsOperations.id, operation.id),
+      eq25(adsOperations.state, AdsOperationStates.unknown)
+    )).run();
+    if (operationUpdate.changes !== 1) return false;
+    const grantUpdate = tx.update(adsActivationGrants).set({
+      state: AdsActivationGrantStates.consumed,
+      consumedAt: nowIso,
+      updatedAt: nowIso
+    }).where(and19(
+      eq25(adsActivationGrants.id, grant.id),
+      eq25(adsActivationGrants.operationId, operation.id),
+      eq25(adsActivationGrants.state, AdsActivationGrantStates.unknown),
+      isNotNull(adsActivationGrants.revocationRequestedAt)
+    )).run();
+    if (grantUpdate.changes !== 1) {
+      throw internalError("Revoked unknown ads activation could not be finalized");
+    }
+    writeAuditLog(tx, {
+      projectId: operation.projectId,
+      actor: "system",
+      action: "ads.campaign_tree_activate.failed",
+      entityType: AdsActivationEntityTypes.campaign,
+      entityId: operation.entityId,
+      diff: {
+        operationId: operation.id,
+        operationKey: operation.operationKey,
+        grantId: grant.id,
+        reason: "revoked_and_verified_paused"
+      },
+      userAgent: "canonry-activation-watchdog"
+    });
+    return true;
+  }, { behavior: "immediate" });
+}
 function validateWatchdogContainmentBinding(app, opts, operation, grant) {
   const terminal = terminalActivationResponse(app, opts, grant, operation.operationKey);
   if (terminal) {
@@ -26703,6 +26754,13 @@ async function sweepStaleAdsActivationsOnce(app, opts) {
         runtime.provider,
         grant.manifest
       );
+      if (safety.fullyVerified && grant.revocationRequestedAt !== null && finalizeContainedRevokedUnknownActivation(app, operation, grant)) {
+        app.log.warn(
+          { operationId: operation.id },
+          "Revoked unknown ads activation was finalized after verified pause"
+        );
+        return;
+      }
       app.db.update(adsOperations).set({
         reconcileAttempts: operation.reconcileAttempts + 1,
         lastReconciledAt: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/{chunk-A4YBV4Y4.js → chunk-ZKUSY4PI.js}

@@ -116,7 +116,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-HQRUFTLN.js";
+} from "./chunk-NCFH26X5.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -6967,7 +6967,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-2WKS3EWJ.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-SH5Z6JFT.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);

package/dist/cli.js

@@ -29,7 +29,7 @@ import {
   setTelemetrySource,
   showFirstRunNotice,
   trackEvent
-} from "./chunk-A4YBV4Y4.js";
+} from "./chunk-ZKUSY4PI.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -54,7 +54,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-HQRUFTLN.js";
+} from "./chunk-NCFH26X5.js";
 import {
   AdsOperationKinds,
   AdsOperationStates,

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   createServer
-} from "./chunk-A4YBV4Y4.js";
+} from "./chunk-ZKUSY4PI.js";
 import {
   loadConfig
 } from "./chunk-IHRW6WWV.js";
-import "./chunk-HQRUFTLN.js";
+import "./chunk-NCFH26X5.js";
 import "./chunk-BLSHHRRU.js";
 export {
   createServer,

package/dist/{intelligence-service-2WKS3EWJ.js → intelligence-service-SH5Z6JFT.js}

@@ -1,6 +1,6 @@
 import {
   IntelligenceService
-} from "./chunk-HQRUFTLN.js";
+} from "./chunk-NCFH26X5.js";
 import "./chunk-BLSHHRRU.js";
 export {
   IntelligenceService

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "4.127.0",
+  "version": "4.128.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -65,27 +65,27 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-api-routes": "0.0.0",
+    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
     "@ainyc/canonry-integration-bing": "0.0.0",
-    "@ainyc/canonry-integration-openai-ads": "0.0.0",
-    "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
+    "@ainyc/canonry-integration-openai-ads": "0.0.0",
+    "@ainyc/canonry-integration-cloud-run": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
-    "@ainyc/canonry-intelligence": "0.0.0",
-    "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
+    "@ainyc/canonry-integration-traffic": "0.0.0",
+    "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
+    "@ainyc/canonry-provider-gemini": "0.0.0",
     "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
-    "@ainyc/canonry-provider-perplexity": "0.0.0",
-    "@ainyc/canonry-provider-gemini": "0.0.0"
+    "@ainyc/canonry-provider-perplexity": "0.0.0"
   },
   "scripts": {
     "build": "tsx scripts/copy-agent-assets.ts && tsup && tsx build-web.ts",