@canonry/canonry 7.32.0 → 7.43.2

package/dist/{chunk-K5EGSSXC.js → chunk-WXX3NL4C.js}

@@ -21,20 +21,22 @@ import {
   saveConfig,
   saveConfigPatch,
   sentimentInstallReadiness
-} from "./chunk-QFXD7GR5.js";
+} from "./chunk-KOIOZ7QW.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-2C6NWFN4.js";
+} from "./chunk-BWR5MNL5.js";
 import {
   CanonryMcpToolNames,
-  CliError,
   PACKAGE_VERSION,
   canonryMcpTools
-} from "./chunk-ZIETXJYU.js";
+} from "./chunk-LYKDNJXR.js";
+import {
+  CliError
+} from "./chunk-HGMYEDAQ.js";
 import {
   BingApiError,
   CC_CACHE_DIR,
@@ -230,6 +232,7 @@ import {
   siteCrawlRunRequests,
   siteCrawlSnapshots,
   siteLivenessState,
+  syncRunClaimKey,
   toAlertView,
   trafficSources,
   usageCounters,
@@ -237,7 +240,7 @@ import {
   webhookResponseReason,
   webhookTargetRefusalReason,
   writeAuditLog
-} from "./chunk-WRHA54BN.js";
+} from "./chunk-65BHDVYO.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -281,7 +284,9 @@ import {
   MeasurementPortfolioLists,
   MemorySources,
   ONBOARDING_FLOW_VERSION,
+  OPERATION_ACCESS_HEADER,
   OUTSTANDING_PROVIDER_BATCH_STATUSES,
+  OperationAccesses,
   OutcomeReasonCodes,
   OutcomeStatuses,
   OutcomeSurfaces,
@@ -307,6 +312,7 @@ import {
   SITE_AUDIT_DEFAULT_PAGE_LIMIT,
   SITE_AUDIT_MAX_EDGE_LIMIT,
   SITE_AUDIT_MAX_PAGE_LIMIT,
+  STORED_ONLY_HEADER,
   SchedulableRunKinds,
   SentimentOutcomes,
   SiteHealthLinkClassificationSources,
@@ -462,6 +468,7 @@ import {
   splitList,
   startOfDayHourInTimeZone,
   statusClassOf,
+  storedOnlyRefused,
   storedSentimentClassifierInputSchema,
   summarizeRunUsage,
   templateLinkDetection,
@@ -480,7 +487,7 @@ import {
   winnabilityClassLabel,
   withRetry,
   withSkippedProviders
-} from "./chunk-42XUY243.js";
+} from "./chunk-E43JM3QV.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -659,6 +666,7 @@ function startBackgroundRefresh(getNow) {
   })();
 }
 function checkLatestVersionForServer(opts) {
+  if (opts?.storedOnly) return memoryCache?.latest ? buildUpdateAvailable(PKG_VERSION, memoryCache.latest) : null;
   if (!isUpdateCheckEnabled()) return null;
   const getNow = opts?.now ?? Date.now;
   const ttl = opts?.ttlMs ?? 60 * 60 * 1e3;
@@ -1863,14 +1871,19 @@ async function fetchOnce(url, accessToken, options) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? GTM_REQUEST_TIMEOUT_MS);
   try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        authorization: `Bearer ${accessToken}`,
-        accept: "application/json"
-      },
-      signal: controller.signal
-    });
+    let response;
+    try {
+      response = await fetchImpl(url, {
+        method: "GET",
+        headers: {
+          authorization: `Bearer ${accessToken}`,
+          accept: "application/json"
+        },
+        signal: controller.signal
+      });
+    } catch (error) {
+      throw new Error(describeFetchError(error, url), { cause: error });
+    }
     const text = await response.text();
     let body = void 0;
     let invalidJson = false;
@@ -8344,7 +8357,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "8df46cfa2e6d818351a792096390ac2a8bd59dbe" : void 0;
+  const embedded = true ? "01789509e9cc5d3516928fae0e96bb1dedbdacd3" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -12110,15 +12123,20 @@ function buildUrl(path11, queryPairs) {
 }
 async function adsFetch(apiKey, path11, queryPairs = [], method = "GET", body) {
   const url = buildUrl(path11, queryPairs);
-  const res = await fetch(url, {
-    method,
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json"
-    },
-    body: body === void 0 ? void 0 : JSON.stringify(body),
-    signal: AbortSignal.timeout(OPENAI_ADS_REQUEST_TIMEOUT_MS)
-  });
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(OPENAI_ADS_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(describeFetchError(error, url), { cause: error });
+  }
   if (res.status === 401 || res.status === 403) {
     const { code } = parseErrorEnvelope(await res.text());
     adsClientLog("error", "http.auth-failed", { path: path11, httpStatus: res.status, code });
@@ -16455,6 +16473,7 @@ function refuseManagedSweepCancel(tool, ctx) {
 var COMPETITOR_AUTO_ALIAS_MODE_REFUSAL = "Aero cannot change a project's competitorAutoAliases mode. Omit competitorAutoAliases to keep the stored mode, or ask the operator to change it.";
 var COMPETITOR_AUTO_ALIAS_MODE_WRITES = /* @__PURE__ */ new Set([
   CanonryMcpToolNames.canonry_project_upsert,
+  CanonryMcpToolNames.canonry_project_update,
   CanonryMcpToolNames.canonry_apply_config
 ]);
 function requestedCompetitorAutoAliasMode(toolName, params, ctx) {
@@ -16463,6 +16482,10 @@ function requestedCompetitorAutoAliasMode(toolName, params, ctx) {
     const request = isRecord8(params.request) ? params.request : {};
     return { project: ctx.projectName, mode: request.competitorAutoAliases };
   }
+  if (toolName === CanonryMcpToolNames.canonry_project_update) {
+    const request = isRecord8(params.request) ? params.request : {};
+    return { project: params.project, mode: request.competitorAutoAliases };
+  }
   const config = isRecord8(params.config) ? params.config : {};
   const metadata2 = isRecord8(config.metadata) ? config.metadata : {};
   const spec = isRecord8(config.spec) ? config.spec : {};
@@ -16490,10 +16513,24 @@ function refuseCompetitorAutoAliasModeChange(tool, ctx) {
     }
   };
 }
+var COMPETITOR_BULK_ADD_REFUSAL = "Aero cannot acknowledge measured bulk competitor growth. Review the stored evidence and acknowledge this operator action explicitly.";
+function refuseCompetitorBulkAddAcknowledgement(tool) {
+  const write = tool.execute;
+  return {
+    ...tool,
+    execute: async (toolCallId, params, ...rest) => {
+      const input = typeof params === "object" && params !== null ? params : void 0;
+      const request = typeof input?.request === "object" && input.request !== null ? input.request : void 0;
+      if (request?.acknowledgeBulkAdd === true) throw new Error(COMPETITOR_BULK_ADD_REFUSAL);
+      return write(toolCallId, params, ...rest);
+    }
+  };
+}
 function buildMcpAgentTools(registry, ctx, opts = {}) {
   return registry.filter((tool) => !AERO_EXCLUDED_MCP_TOOLS.has(tool.name)).filter((tool) => opts.includeNames ? opts.includeNames.has(tool.name) : true).filter((tool) => opts.readOnly ? tool.access === "read" : true).filter((tool) => opts.managedSweeps ? !AERO_MANAGED_SWEEP_MCP_TOOLS.has(tool.name) : true).map((tool) => {
     const agentTool = mcpToAgentTool(tool, ctx);
     if (COMPETITOR_AUTO_ALIAS_MODE_WRITES.has(tool.name)) return refuseCompetitorAutoAliasModeChange(agentTool, ctx);
+    if (tool.name === "canonry_competitors_add") return refuseCompetitorBulkAddAcknowledgement(agentTool);
     return opts.managedSweeps && tool.name === CanonryMcpToolNames.canonry_run_cancel ? refuseManagedSweepCancel(agentTool, ctx) : agentTool;
   });
 }
@@ -18753,19 +18790,27 @@ function queuedRun(result2) {
     runStatus: typeof runStatus === "string" ? runStatus : null
   };
 }
-async function refreshAllIntegrations(client, projectName, now = /* @__PURE__ */ new Date()) {
+async function refreshAllIntegrations(client, projectName, now = /* @__PURE__ */ new Date(), claims) {
   const integrations = [
-    { name: "gsc", completion: "queued", run: () => client.gscSync(projectName, {}) },
-    { name: "bing", completion: "queued", run: () => client.bingInspectSitemap(projectName, {}) },
-    { name: "ga", completion: "synchronous", run: () => client.gaSync(projectName, { days: gaRefreshDays(now) }) },
-    { name: "gbp", completion: "queued", run: () => client.triggerGbpSync(projectName, {}) },
+    { name: "gsc", kind: RunKinds["gsc-sync"], completion: "queued", run: () => client.gscSync(projectName, {}) },
+    { name: "bing", kind: RunKinds["bing-inspect-sitemap"], completion: "queued", run: () => client.bingInspectSitemap(projectName, {}) },
+    { name: "ga", kind: RunKinds["ga-sync"], completion: "synchronous", run: () => client.gaSync(projectName, { days: gaRefreshDays(now) }) },
+    { name: "gbp", kind: RunKinds["gbp-sync"], completion: "queued", run: () => client.triggerGbpSync(projectName, {}) },
     // `ads` remains the OpenAI / ChatGPT Ads integration. For scheduled
     // refreshes, Google providers have explicit names and fan out only here.
-    { name: "ads", completion: "queued", run: () => client.triggerAdsSync(projectName) },
-    { name: "google-ads", completion: "queued", run: () => client.triggerGoogleAdsSync(projectName) },
-    { name: "gtm", completion: "queued", run: () => client.triggerGtmSync(projectName) }
+    { name: "ads", kind: RunKinds["ads-sync"], completion: "queued", run: () => client.triggerAdsSync(projectName) },
+    { name: "google-ads", kind: RunKinds["google-ads-sync"], completion: "queued", run: () => client.triggerGoogleAdsSync(projectName) },
+    { name: "gtm", kind: RunKinds["gtm-sync"], completion: "queued", run: () => client.triggerGtmSync(projectName) }
   ];
-  const results = await Promise.allSettled(integrations.map((i) => i.run()));
+  const results = await Promise.allSettled(integrations.map(async (integration) => {
+    const key = syncRunClaimKey(projectName, integration.kind);
+    claims?.add(key);
+    try {
+      return await integration.run();
+    } finally {
+      claims?.delete(key);
+    }
+  }));
   results.forEach((result2, idx) => {
     const { name: integration, completion } = integrations[idx];
     if (result2.status === "rejected") {
@@ -23465,6 +23510,8 @@ async function createServer(opts) {
     surface: OutcomeSurfaces.system
   });
   const scheduledBacklinkReleases = /* @__PURE__ */ new Set();
+  const scheduledSyncClaims = /* @__PURE__ */ new Set();
+  const claimScheduledSync = (projectName, kind, sourceId) => scheduledSyncClaims.delete(syncRunClaimKey(projectName, kind, sourceId));
   const agentEnabled = resolveAgentEnabled(process.env, opts.config);
   const agentProactive = resolveAgentProactiveEnabled(process.env, opts.config);
   const sessionRegistry = agentEnabled ? new SessionRegistry({
@@ -23929,7 +23976,10 @@ async function createServer(opts) {
     getEffectiveProviderModels: () => effectiveProviderModels(registry),
     getBatchEligibleProviderNames: () => batchEligibleProviderNames(registry),
     onTrafficSyncRequested: (projectName, sourceId) => {
-      schedulerClient.trafficSync(projectName, sourceId).catch((err) => {
+      scheduledSyncClaims.add(syncRunClaimKey(projectName, RunKinds["traffic-sync"], sourceId));
+      schedulerClient.trafficSync(projectName, sourceId).finally(() => {
+        scheduledSyncClaims.delete(syncRunClaimKey(projectName, RunKinds["traffic-sync"], sourceId));
+      }).catch((err) => {
         app.log.error(
           {
             projectName,
@@ -23965,7 +24015,7 @@ async function createServer(opts) {
       })();
     },
     onDataRefreshRequested: (projectName) => {
-      void refreshAllIntegrations(schedulerClient, projectName);
+      void refreshAllIntegrations(schedulerClient, projectName, /* @__PURE__ */ new Date(), scheduledSyncClaims);
     },
     onBacklinksSyncRequested: (projectName) => {
       void syncLatestReleaseOnSchedule(projectName, {
@@ -24325,7 +24375,22 @@ async function createServer(opts) {
   const namedAccountsInUse = () => anyUsersExist(opts.db);
   const NAMED_ACCOUNTS_MESSAGE = "This install uses named accounts. Sign in with your name and password.";
   const serverApiKeyMissing = () => new AppError("AUTH_INVALID", "Server API key not found \u2014 run canonry bootstrap", 401);
-  app.get(apiPrefix + "/session", async (request, reply) => {
+  const rejectLegacySessionStoredOnly = async (request, reply) => {
+    const header = request.headers[STORED_ONLY_HEADER];
+    if (header !== "1" && header !== "true") return;
+    const route = request.routeOptions.url ?? request.url;
+    const operation = route.endsWith("/session/setup") ? "POST /api/v1/session/setup" : `${request.method.toUpperCase()} /api/v1/session`;
+    const error = storedOnlyRefused("Stored-only mode refuses this operation", { operation, access: OperationAccesses.write });
+    return reply.status(error.statusCode).send(error.toJSON());
+  };
+  const legacySessionRouteOptions = {
+    onSend: async (_request, reply, payload) => {
+      reply.header(OPERATION_ACCESS_HEADER, OperationAccesses.write);
+      return payload;
+    },
+    preHandler: rejectLegacySessionStoredOnly
+  };
+  app.get(apiPrefix + "/session", legacySessionRouteOptions, async (request, reply) => {
     if (namedAccountsInUse()) {
       return reply.send({ authenticated: false, setupRequired: false });
     }
@@ -24338,7 +24403,7 @@ async function createServer(opts) {
       setupRequired: !opts.config.dashboardPasswordHash
     });
   });
-  app.post(apiPrefix + "/session/setup", async (request, reply) => {
+  app.post(apiPrefix + "/session/setup", legacySessionRouteOptions, async (request, reply) => {
     if (namedAccountsInUse()) {
       const err = forbidden(NAMED_ACCOUNTS_MESSAGE);
       return reply.status(err.statusCode).send(err.toJSON());
@@ -24393,7 +24458,7 @@ async function createServer(opts) {
     setSessionCookie(reply, sessionId);
     return reply.send({ authenticated: true });
   });
-  app.post(apiPrefix + "/session", async (request, reply) => {
+  app.post(apiPrefix + "/session", legacySessionRouteOptions, async (request, reply) => {
     if (namedAccountsInUse()) {
       const err2 = forbidden(NAMED_ACCOUNTS_MESSAGE);
       return reply.status(err2.statusCode).send(err2.toJSON());
@@ -24447,7 +24512,7 @@ async function createServer(opts) {
     const err = validationError("Either password or apiKey is required");
     return reply.status(err.statusCode).send(err.toJSON());
   });
-  app.delete(apiPrefix + "/session", async (request, reply) => {
+  app.delete(apiPrefix + "/session", legacySessionRouteOptions, async (request, reply) => {
     const sessionId = parseCookieHeader(request.headers.cookie)[SESSION_COOKIE_NAME];
     clearSession(sessionId);
     reply.header(
@@ -24661,6 +24726,7 @@ async function createServer(opts) {
     // Outcome telemetry reported from route code (`app.emitOutcome`).
     onOutcome: handleRouteOutcome,
     db: opts.db,
+    claimScheduledSync,
     sentiment: {
       install: () => {
         const configuration = loadSentimentInstallConfig();
@@ -25397,8 +25463,9 @@ async function createServer(opts) {
   }
   const buildCommit = resolveBuildCommit();
   const instance = resolveInstanceIdentity();
-  const healthHandler = () => {
-    const update = checkLatestVersionForServer();
+  const healthHandler = (request) => {
+    const storedOnly = request.headers[STORED_ONLY_HEADER] === "1" || request.headers[STORED_ONLY_HEADER] === "true";
+    const update = checkLatestVersionForServer({ storedOnly });
     return {
       status: "ok",
       service: "canonry",

package/dist/cli-catalog-J3O6W726.js

@@ -0,0 +1,15 @@
+import {
+  CLI_ROOT_SUMMARIES,
+  buildCliCatalog,
+  printCliCatalog,
+  renderTopLevelHelp
+} from "./chunk-WRUKKEGR.js";
+import "./chunk-WU2BRWXY.js";
+import "./chunk-HGMYEDAQ.js";
+import "./chunk-E43JM3QV.js";
+export {
+  CLI_ROOT_SUMMARIES,
+  buildCliCatalog,
+  printCliCatalog,
+  renderTopLevelHelp
+};

package/dist/cli-commands-QST2CPDG.js

@@ -0,0 +1,15 @@
+import {
+  REGISTERED_CLI_COMMANDS
+} from "./chunk-C2I7M3B2.js";
+import "./chunk-WXX3NL4C.js";
+import "./chunk-KOIOZ7QW.js";
+import "./chunk-WU2BRWXY.js";
+import "./chunk-RB2F4D3Z.js";
+import "./chunk-BWR5MNL5.js";
+import "./chunk-LYKDNJXR.js";
+import "./chunk-HGMYEDAQ.js";
+import "./chunk-65BHDVYO.js";
+import "./chunk-E43JM3QV.js";
+export {
+  REGISTERED_CLI_COMMANDS
+};