@canonry/canonry 7.17.0 → 7.17.2

package/dist/{chunk-WEKVQK3O.js → chunk-3LPQ4JV5.js}

@@ -20,23 +20,25 @@ import {
   saveConfig,
   saveConfigPatch,
   sentimentInstallReadiness
-} from "./chunk-WVBLFG7H.js";
+} from "./chunk-P2XY5YX7.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-QPOXDS43.js";
+} from "./chunk-NPNU6UHD.js";
 import {
   CanonryMcpToolNames,
   CliError,
   PACKAGE_VERSION,
   canonryMcpTools
-} from "./chunk-RBQUGZM4.js";
+} from "./chunk-QAIJH74T.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
+  EgressFailedError,
+  EgressRefusedError,
   GBP_DAILY_METRICS,
   GSC_DATA_LAG_DAYS,
   GSC_REPORTING_TIME_ZONE,
@@ -65,6 +67,7 @@ import {
   apiRoutes,
   applyCompetitorAutoAliases,
   assessConversionTrackingIntegrity,
+  auditFromRequest,
   auditLog,
   backfillProjectAnswerMentions,
   backfillProjectAnswerMentionsInChunks,
@@ -86,6 +89,7 @@ import {
   countPopulatedGroups,
   createCredentialChecker,
   createFastifyLogger,
+  createGuardedFetch,
   createLogger,
   createProjectPassQueue,
   createRunCompetitorResolver,
@@ -133,6 +137,7 @@ import {
   gtmConnections,
   gtmRawSnapshots,
   hasOutstandingProviderBatch,
+  hasProxyHeaders,
   hashApiKey,
   hashAttributes,
   hashLodging,
@@ -216,8 +221,9 @@ import {
   siteCrawlSnapshots,
   siteLivenessState,
   toAlertView,
-  usageCounters
-} from "./chunk-3NAZXITW.js";
+  usageCounters,
+  writeAuditLog
+} from "./chunk-YJS4OE6I.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -337,6 +343,7 @@ import {
   effectiveDomains,
   embedClientConfigForRequest,
   embedProjectTabsError,
+  escapeRegExp,
   extractProviderHttpStatus,
   extractRecommendedCompetitors,
   factorStatusFromScore,
@@ -432,7 +439,7 @@ import {
   winnabilityClassLabel,
   withRetry,
   withSkippedProviders
-} from "./chunk-PVWGKDY6.js";
+} from "./chunk-MIRAKDRW.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -1240,9 +1247,6 @@ function buildDailyConversionMetricsQuery(options) {
 }
 
 // ../integration-google-ads/src/google-ads-client.ts
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function sanitizeText(value, secrets) {
   let sanitized = value.replace(/(authorization\s*:\s*bearer\s+)[^\s,"'}]+/gi, "$1***").replace(/((?:developer|access)[_-]?token\s*[:=]\s*["']?)[^\s,"'}]+/gi, "$1***");
   for (const secret of secrets) {
@@ -8045,7 +8049,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "292663bc656bcd51a4a32fa879fbdcd7f7935398" : void 0;
+  const embedded = true ? "3bf6bc30c036bb0dbbed1d8ed17141d1ad2a387f" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -12143,10 +12147,14 @@ import { eq as eq9 } from "drizzle-orm";
 var log7 = createLogger("SitemapParser");
 var LOC_REGEX = /<loc>([^<]+)<\/loc>/gi;
 var SITEMAP_TAG_REGEX = /<sitemap>[\s\S]*?<\/sitemap>/gi;
-async function validateSitemapUrl(url) {
-  const check = await resolveWebhookTarget(url, { allowLoopback: true });
-  if (!check.ok) {
-    throw new Error(`Sitemap URL rejected: ${check.message.replace(/^"url" /, "")} (${url})`);
+var sitemapFetch = createGuardedFetch({ allowLoopback: true });
+async function fetchSitemap(url) {
+  try {
+    return await sitemapFetch(url);
+  } catch (err) {
+    if (err instanceof EgressRefusedError) throw new Error(`Sitemap ${url} rejected: ${err.message}`);
+    if (err instanceof EgressFailedError) throw new Error(`Failed to fetch sitemap at ${url}: ${err.message}`);
+    throw err;
   }
 }
 async function readSitemapBody(res) {
@@ -12178,8 +12186,7 @@ async function parseSitemapRecursive(url, urls, visited, depth, isChild) {
   visited.add(url);
   let res;
   try {
-    await validateSitemapUrl(url);
-    res = await fetch(url);
+    res = await fetchSitemap(url);
   } catch (err) {
     if (!isChild) throw err;
     log7.warn("child-sitemap.fetch-failed", {
@@ -12864,7 +12871,7 @@ async function executeReleaseSync(db, syncId, opts) {
       const rowsByProject = groupByProject(rows, projectsByDomain);
       for (const p of allProjects) {
         const projectRows = rowsByProject.get(p.id) ?? [];
-        const summary = computeSummary(projectRows);
+        const summary = computeBacklinkSummaryMetrics(projectRows);
         tx.insert(backlinkSummaries).values({
           id: crypto17.randomUUID(),
           projectId: p.id,
@@ -12947,20 +12954,6 @@ function groupByProject(rows, projectsByDomain) {
   }
   return out;
 }
-function computeSummary(rows) {
-  if (rows.length === 0) {
-    return { totalLinkingDomains: 0, totalHosts: 0, top10HostsShare: "0" };
-  }
-  const sorted = [...rows].sort((a, b) => b.numHosts - a.numHosts);
-  const totalHosts = sorted.reduce((acc, r) => acc + r.numHosts, 0);
-  const top10Hosts = sorted.slice(0, 10).reduce((acc, r) => acc + r.numHosts, 0);
-  const share = totalHosts > 0 ? top10Hosts / totalHosts : 0;
-  return {
-    totalLinkingDomains: rows.length,
-    totalHosts,
-    top10HostsShare: share.toFixed(6)
-  };
-}
 
 // src/backlink-extract.ts
 import crypto18 from "crypto";
@@ -13031,7 +13024,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
         }));
         tx.insert(backlinkDomains).values(values).run();
       }
-      const summary = computeSummary2(rows);
+      const summary = computeSummary(rows);
       tx.insert(backlinkSummaries).values({
         id: crypto18.randomUUID(),
         projectId,
@@ -13071,7 +13064,7 @@ async function executeBacklinkExtract(db, runId, projectId, opts = {}) {
     throw err;
   }
 }
-function computeSummary2(rows) {
+function computeSummary(rows) {
   return computeBacklinkSummaryMetrics(rows);
 }
 
@@ -15526,11 +15519,17 @@ var SITE_LIVENESS_MAX_PASS_GAP_MS = 45 * 6e4;
 var Notifier = class {
   db;
   serverUrl;
+  /**
+   * The server's `allowLoopbackWebhooks`, so delivery admits exactly the
+   * destinations that creating and testing a webhook admitted.
+   */
+  allowLoopbackWebhooks;
   /** Projects with a review dispatch in progress; see {@link dispatchReviewAlerts}. */
   reviewDispatchInFlight = /* @__PURE__ */ new Set();
-  constructor(db, serverUrl) {
+  constructor(db, serverUrl, opts = {}) {
     this.db = db;
     this.serverUrl = serverUrl;
+    this.allowLoopbackWebhooks = opts.allowLoopbackWebhooks === true;
   }
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId, opts) {
@@ -16096,7 +16095,7 @@ var Notifier = class {
     const body = destination.render ? destination.render(toAlertView(payload)) : payload;
     const signingSecret = destination.signed ? webhookSecret : null;
     const targetLabel = redactNotificationUrl(url).urlDisplay;
-    const targetCheck = await resolveWebhookTarget(url);
+    const targetCheck = await resolveWebhookTarget(url, { allowLoopback: this.allowLoopbackWebhooks });
     if (!targetCheck.ok) {
       log20.error("webhook.ssrf-blocked", { url: targetLabel, reason: targetCheck.message });
       this.logDelivery(projectId, notificationId, payload.event, "failed", `SSRF: ${targetCheck.message}`);
@@ -21526,6 +21525,10 @@ function waitForServerRuntimeStartup(app) {
   const startup = runtimeStartupByServer.get(app);
   return startup ?? Promise.reject(new Error("Server runtime startup was not registered"));
 }
+var keylessFirstRunSetupByServer = /* @__PURE__ */ new WeakMap();
+function allowsKeylessFirstRunSetup(app) {
+  return keylessFirstRunSetupByServer.get(app) ?? false;
+}
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
   maxRequestsPerMinute: 10,
@@ -21618,9 +21621,6 @@ function summarizeProviderConfig(config) {
     quota: { ...config?.quota ?? DEFAULT_QUOTA }
   };
 }
-function hashApiKey2(key) {
-  return crypto29.createHash("sha256").update(key).digest("hex");
-}
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
@@ -21659,7 +21659,7 @@ function verifyDashboardPassword(password, storedHash) {
     };
   }
   if (/^[a-f0-9]{64}$/i.test(storedHash)) {
-    const candidate = Buffer.from(hashApiKey2(password), "hex");
+    const candidate = Buffer.from(hashApiKey(password), "hex");
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
@@ -21668,22 +21668,6 @@ function verifyDashboardPassword(password, storedHash) {
   }
   return { ok: false, needsRehash: false };
 }
-function parseCookies(header) {
-  if (!header) return {};
-  return header.split(";").map((part) => part.trim()).filter(Boolean).reduce((cookies, part) => {
-    const eqIdx = part.indexOf("=");
-    if (eqIdx <= 0) return cookies;
-    const name = part.slice(0, eqIdx).trim();
-    const value = part.slice(eqIdx + 1).trim();
-    if (!name) return cookies;
-    try {
-      cookies[name] = decodeURIComponent(value);
-    } catch {
-      cookies[name] = value;
-    }
-    return cookies;
-  }, {});
-}
 function serializeSessionCookie(opts) {
   const parts = [
     `${opts.name}=${opts.value ? encodeURIComponent(opts.value) : ""}`,
@@ -21754,6 +21738,38 @@ function isLoopbackBindHost(host) {
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
   return false;
 }
+function isLoopbackPeerAddress(address) {
+  if (!address) return false;
+  const normalized = address.toLowerCase().replace(/^::ffff:(?=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$)/, "");
+  return isIP(normalized) !== 0 && isLoopbackBindHost(normalized);
+}
+function isDirectLocalRequest(request) {
+  if (request.raw.httpVersion !== "1.1") return false;
+  if (!isLoopbackPeerAddress(request.raw.socket.remoteAddress)) return false;
+  if (hasProxyHeaders(request)) return false;
+  const host = request.headers.host;
+  if (!host) return false;
+  let hostname;
+  try {
+    hostname = new URL(`http://${host}`).hostname;
+  } catch {
+    return false;
+  }
+  return hostname !== "" && isLoopbackBindHost(hostname);
+}
+function configuresExternalAccess(trustProxy, basePath, ...configuredUrls) {
+  if (trustProxy !== false || basePath !== void 0) return true;
+  return configuredUrls.some((configuredUrl) => {
+    const value = configuredUrl?.trim();
+    if (!value) return false;
+    try {
+      const { hostname } = new URL(value);
+      return hostname === "" || !isLoopbackBindHost(hostname);
+    } catch {
+      return true;
+    }
+  });
+}
 function isAllowedHost(host, allowedHosts) {
   const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
   return allowedHosts.has(normalized) || isIP(normalized) !== 0;
@@ -22028,7 +22044,8 @@ async function createServer(opts) {
     onFirstActivation: () => maybeShowActivationNotice()
   });
   jobRunner.recoverStaleRuns();
-  const notifier = new Notifier(opts.db, serverUrl);
+  const allowLoopbackWebhooks = process.env.CANONRY_ALLOW_LOOPBACK_WEBHOOKS !== "0";
+  const notifier = new Notifier(opts.db, serverUrl, { allowLoopbackWebhooks });
   const intelligenceService = new IntelligenceService(opts.db);
   const aeroClient = new ApiClient(opts.config.apiUrl, opts.config.apiKey, {
     skipProbe: true,
@@ -22819,7 +22836,7 @@ async function createServer(opts) {
     }
   })();
   if (opts.config.apiKey) {
-    const keyHash = hashApiKey2(opts.config.apiKey);
+    const keyHash = hashApiKey(opts.config.apiKey);
     const existing = opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
@@ -22845,11 +22862,11 @@ async function createServer(opts) {
       ne3(dashboardSessions.passwordFingerprint, currentPasswordFingerprint())
     )
   )).run();
-  const createSession = (key, passwordBased = false) => {
+  const createSession = (key, passwordBased = false, db = opts.db) => {
     const now = /* @__PURE__ */ new Date();
-    opts.db.delete(dashboardSessions).where(lte2(dashboardSessions.expiresAt, now.toISOString())).run();
+    db.delete(dashboardSessions).where(lte2(dashboardSessions.expiresAt, now.toISOString())).run();
     const sessionId = crypto29.randomBytes(32).toString("hex");
-    opts.db.insert(dashboardSessions).values({
+    db.insert(dashboardSessions).values({
       tokenHash: hashSessionToken(sessionId),
       apiKeyId: key.id,
       apiKeyHash: key.keyHash,
@@ -22883,12 +22900,9 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, hashApiKey2(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
-  const createPasswordSession = (reply) => {
-    const key = getDefaultApiKey();
-    if (!key || key.revokedAt) return false;
-    const sessionId = createSession(key, true);
+  const setSessionCookie = (reply, sessionId) => {
     reply.header(
       "set-cookie",
       serializeSessionCookie({
@@ -22899,19 +22913,27 @@ async function createServer(opts) {
         ttlMs: SESSION_TTL_MS
       })
     );
+  };
+  const createPasswordSession = (reply) => {
+    const key = getDefaultApiKey();
+    if (!key || key.revokedAt) return false;
+    setSessionCookie(reply, createSession(key, true));
     return true;
   };
-  const boundToLoopback = isLoopbackBindHost(opts.host);
-  const requestHasValidApiKey = (request) => {
+  const keylessLocalSetup = isLoopbackBindHost(opts.host) && !configuresExternalAccess(trustProxy, basePath, opts.config.apiUrl, opts.config.publicUrl);
+  keylessFirstRunSetupByServer.set(app, keylessLocalSetup);
+  const requestPresentsKey = (request, key) => {
     const header = request.headers.authorization;
     if (!header) return false;
     const parts = header.split(" ");
-    if (parts.length !== 2 || parts[0] !== "Bearer") return false;
-    const key = opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, hashApiKey2(parts[1]))).get();
-    return Boolean(key && !key.revokedAt);
+    if (parts.length !== 2 || parts[0] !== "Bearer" || !parts[1]) return false;
+    const presented = Buffer.from(hashApiKey(parts[1]), "hex");
+    const expected = Buffer.from(key.keyHash, "hex");
+    return presented.length === expected.length && crypto29.timingSafeEqual(presented, expected);
   };
   const namedAccountsInUse = () => anyUsersExist(opts.db);
   const NAMED_ACCOUNTS_MESSAGE = "This install uses named accounts. Sign in with your name and password.";
+  const serverApiKeyMissing = () => new AppError("AUTH_INVALID", "Server API key not found \u2014 run canonry bootstrap", 401);
   app.get(apiPrefix + "/session", async (request, reply) => {
     if (namedAccountsInUse()) {
       return reply.send({ authenticated: false, setupRequired: false });
@@ -22919,7 +22941,7 @@ async function createServer(opts) {
     if (!dashboardRequirePassword) {
       return reply.send({ authenticated: true, setupRequired: false });
     }
-    const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
+    const sessionId = parseCookieHeader(request.headers.cookie)[SESSION_COOKIE_NAME];
     return reply.send({
       authenticated: Boolean(sessionId && resolveSessionApiKeyId(sessionId)),
       setupRequired: !opts.config.dashboardPasswordHash
@@ -22933,9 +22955,13 @@ async function createServer(opts) {
     if (!dashboardRequirePassword) {
       return reply.send({ authenticated: true, setupRequired: false });
     }
-    if (!boundToLoopback && !requestHasValidApiKey(request)) {
-      const err = authRequired(
-        "This server is network-reachable; setting the dashboard password requires a valid API key."
+    const found = getDefaultApiKey();
+    const defaultKey = found && !found.revokedAt ? found : void 0;
+    const presentsConfiguredKey = opts.config.apiKey ? requestPresentsKey(request, { keyHash: hashApiKey(opts.config.apiKey) }) : false;
+    const presentedRootKey = defaultKey !== void 0 && presentsConfiguredKey;
+    if (!presentedRootKey && !(keylessLocalSetup && isDirectLocalRequest(request))) {
+      const err = presentsConfiguredKey ? serverApiKeyMissing() : authRequired(
+        "Setting the dashboard password requires the root API key (apiKey in config.yaml), unless the request comes directly from this machine to a loopback-bound server that has no external URL, base path, or trusted proxy configured."
       );
       return reply.status(err.statusCode).send(err.toJSON());
     }
@@ -22948,12 +22974,31 @@ async function createServer(opts) {
       const err = validationError("Password must be at least 8 characters");
       return reply.status(err.statusCode).send(err.toJSON());
     }
-    opts.config.dashboardPasswordHash = hashDashboardPassword(password);
-    saveConfigPatch(opts.config);
-    if (!createPasswordSession(reply)) {
-      const err = authInvalid();
+    if (!defaultKey) {
+      const err = serverApiKeyMissing();
       return reply.status(err.statusCode).send(err.toJSON());
     }
+    opts.config.dashboardPasswordHash = hashDashboardPassword(password);
+    let sessionId;
+    try {
+      sessionId = opts.db.transaction((tx) => {
+        writeAuditLog(tx, auditFromRequest(request, {
+          actor: `api-key:${defaultKey.id}`,
+          credentialId: presentedRootKey ? defaultKey.id : null,
+          requestId: request.id,
+          action: "dashboard-password.created",
+          entityType: "dashboard-password",
+          diff: { authorizedBy: presentedRootKey ? "root-api-key" : "local-request" }
+        }));
+        const created = createSession(defaultKey, true, tx);
+        saveConfigPatch(opts.config);
+        return created;
+      });
+    } catch (err) {
+      opts.config.dashboardPasswordHash = void 0;
+      throw err;
+    }
+    setSessionCookie(reply, sessionId);
     return reply.send({ authenticated: true });
   });
   app.post(apiPrefix + "/session", async (request, reply) => {
@@ -22992,40 +23037,26 @@ async function createServer(opts) {
         opts.config.dashboardPasswordHash = migratedHash;
       }
       if (!createPasswordSession(reply)) {
-        return reply.status(401).send({
-          error: {
-            code: "AUTH_INVALID",
-            message: "Server API key not found \u2014 run canonry bootstrap"
-          }
-        });
+        const err2 = serverApiKeyMissing();
+        return reply.status(err2.statusCode).send(err2.toJSON());
       }
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, hashApiKey2(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq29(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
       opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq29(apiKeys.id, key.id)).run();
-      const sessionId = createSession(key);
-      reply.header(
-        "set-cookie",
-        serializeSessionCookie({
-          name: SESSION_COOKIE_NAME,
-          value: sessionId,
-          path: sessionCookiePath,
-          secure: sessionCookieSecure,
-          ttlMs: SESSION_TTL_MS
-        })
-      );
+      setSessionCookie(reply, createSession(key));
       return reply.send({ authenticated: true });
     }
     const err = validationError("Either password or apiKey is required");
     return reply.status(err.statusCode).send(err.toJSON());
   });
   app.delete(apiPrefix + "/session", async (request, reply) => {
-    const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
+    const sessionId = parseCookieHeader(request.headers.cookie)[SESSION_COOKIE_NAME];
     clearSession(sessionId);
     reply.header(
       "set-cookie",
@@ -23277,12 +23308,7 @@ async function createServer(opts) {
     getAgentPluginState: opts.getAgentPluginState,
     // Powers the `canonry.version.current` doctor check. Non-blocking.
     getUpdateStatus: () => getServerUpdateStatus(),
-    // Local canonry serve runs on the operator's machine, where pointing a
-    // webhook at localhost (Discord test container, Pipedream-mock dev server,
-    // etc.) is a legitimate workflow. Default to allowing it for the local
-    // installer; cloud deployments inherit the secure default of `false` by
-    // not passing this option. Override with CANONRY_ALLOW_LOOPBACK_WEBHOOKS=0.
-    allowLoopbackWebhooks: process.env.CANONRY_ALLOW_LOOPBACK_WEBHOOKS !== "0",
+    allowLoopbackWebhooks,
     // Wall-clock budget for one incremental Vercel drain. This is the only lever
     // that decides whether a source catches up or falls further behind, and it
     // was previously reachable only from tests, so a source losing ground could
@@ -24164,6 +24190,7 @@ export {
   createGoogleMarketingCredentialStore,
   createGoogleMarketingRuntime,
   waitForServerRuntimeStartup,
+  allowsKeylessFirstRunSetup,
   isLoopbackBindHost,
   createServer
 };

package/dist/{chunk-2MBI5SYB.js → chunk-4EDH2ORA.js}

@@ -4,14 +4,14 @@ import {
   installSkills,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-WVBLFG7H.js";
+} from "./chunk-P2XY5YX7.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-RBQUGZM4.js";
+} from "./chunk-QAIJH74T.js";
 import {
   SKILL_MANIFEST_FILENAME,
   SkillsClients
-} from "./chunk-PVWGKDY6.js";
+} from "./chunk-MIRAKDRW.js";
 
 // src/skills-autosync.ts
 import fs from "fs";