@canonry/canonry 7.73.0 → 7.74.0

package/dist/{ads-TX5622SS.js → ads-L64W5J35.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{agent-AIOQL66U.js → agent-CMQ34CFD.js}

@@ -1,12 +1,12 @@
 import {
   trackCliConnection
-} from "./chunk-4B6DE7BB.js";
-import "./chunk-S77W2XSI.js";
-import "./chunk-PRSQ4R47.js";
+} from "./chunk-KOWOQ3JZ.js";
+import "./chunk-SCRPC2PQ.js";
+import "./chunk-DL3LTSBV.js";
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   isMachineFormat

package/dist/{agent-ask-A6GIJTBX.js → agent-ask-3KEYJSZV.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{agent-conversations-LHWLKOPQ.js → agent-conversations-4KKPOTCP.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{agent-memory-F54BPEYN.js → agent-memory-VOSRZ57W.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{agent-providers-L74KZOSG.js → agent-providers-SLXTYMDS.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{agent-transcript-IH65H755.js → agent-transcript-Q6OEZROG.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{analytics-YWCY2KSY.js → analytics-LSF6NYII.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{apply-BLUUYG2N.js → apply-7O3RES7N.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{backfill-6WO5CH6Z.js → backfill-7ARSKYDG.js}

@@ -10,9 +10,9 @@ import {
   backfillSnapshotAttributionCommand,
   backfillTrafficClassificationCommand,
   replayQueryAuditLog
-} from "./chunk-B6R223HQ.js";
+} from "./chunk-WY2C6FFA.js";
 import "./chunk-6ATKY252.js";
-import "./chunk-HKV4UWG5.js";
+import "./chunk-NXFNXXYM.js";
 import "./chunk-HGMYEDAQ.js";
 import "./chunk-JPM3VC6A.js";
 import {

package/dist/{backlinks-NC7AUGTK.js → backlinks-4YAC374B.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{bing-WQUEYHVC.js → bing-SHAYDXAA.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
-import "./chunk-HKV4UWG5.js";
+} from "./chunk-BICUWFV4.js";
+import "./chunk-NXFNXXYM.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{bootstrap-AXZV4BBC.js → bootstrap-BHLBGQKJ.js}

@@ -1,12 +1,12 @@
 import {
   trackCliConnection
-} from "./chunk-4B6DE7BB.js";
+} from "./chunk-KOWOQ3JZ.js";
 import {
   answerServiceDescriptors
 } from "./chunk-6W5AR4IW.js";
 import {
   outcomeFailure
-} from "./chunk-S77W2XSI.js";
+} from "./chunk-SCRPC2PQ.js";
 import {
   isLoopbackBindHost
 } from "./chunk-TSENU4GG.js";
@@ -16,10 +16,10 @@ import {
 import {
   isTelemetryEnabled,
   recordInstallRef
-} from "./chunk-PRSQ4R47.js";
+} from "./chunk-DL3LTSBV.js";
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   configExists,
   getAnswerServiceEnv,
@@ -30,7 +30,7 @@ import {
   loadConfigRaw,
   saveConfig,
   withBootstrapProviderDefaults
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{cdp-DUG5PMUD.js → cdp-QWJE6SFY.js}

@@ -1,17 +1,17 @@
 import {
   trackCliConnection
-} from "./chunk-4B6DE7BB.js";
+} from "./chunk-KOWOQ3JZ.js";
 import {
   outcomeFailure
-} from "./chunk-S77W2XSI.js";
-import "./chunk-PRSQ4R47.js";
+} from "./chunk-SCRPC2PQ.js";
+import "./chunk-DL3LTSBV.js";
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   loadConfig,
   saveConfigPatch
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 import "./chunk-AOJU5LKX.js";
 import {
   CliError,

package/dist/{chunk-HGMTGC34.js → chunk-AJMDETJA.js}

@@ -4,7 +4,7 @@ import {
 import {
   configExists,
   loadConfigRaw
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 
 // src/setup-state.ts
 import fs from "fs";
@@ -47,7 +47,7 @@ function queueServeHandoff() {
 async function runPendingServeHandoff(format) {
   if (!pendingServeHandoff) return;
   pendingServeHandoff = false;
-  const { serveCommand } = await import("./serve-BYHHULUU.js");
+  const { serveCommand } = await import("./serve-BPM2P3GY.js");
   await serveCommand(format);
 }
 

package/dist/{chunk-WH2M2MQF.js → chunk-BICUWFV4.js}

@@ -1,6 +1,6 @@
 import {
   loadConfig
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";

package/dist/{chunk-PRSQ4R47.js → chunk-DL3LTSBV.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   CANONRY_NPM_PACKAGE_URL,
   compareSemver,

package/dist/{chunk-JQNVNB63.js → chunk-EXGETCJR.js}

@@ -2,7 +2,7 @@ import {
   configExists,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-HKV4UWG5.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   BUNDLED_SKILL_NAMES,
   installSkills

package/dist/{chunk-4B6DE7BB.js → chunk-KOWOQ3JZ.js}

@@ -1,9 +1,9 @@
 import {
   trackIntegrationConnection
-} from "./chunk-S77W2XSI.js";
+} from "./chunk-SCRPC2PQ.js";
 import {
   cliRuntimeContext
-} from "./chunk-PRSQ4R47.js";
+} from "./chunk-DL3LTSBV.js";
 
 // src/cli-connection-telemetry.ts
 function trackCliConnection(properties) {

package/dist/{chunk-4JMTDLFV.js → chunk-L5GIL45X.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";

package/dist/{chunk-ETVM3T7K.js → chunk-LS47ZAX2.js}

@@ -1,6 +1,6 @@
 import {
   runWithUsageTags
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   CanonryMcpToolNames,
   canonryMcpTools

package/dist/{chunk-F5D4GPZQ.js → chunk-MB3IUJ6Z.js}

@@ -6,7 +6,7 @@ import {
 import {
   createApiClient,
   runWithUsageTags
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   canonryMcpTools,
   mcpOutputSchema,

package/dist/{chunk-HKV4UWG5.js → chunk-NXFNXXYM.js}

@@ -23,7 +23,7 @@ import {
 } from "./chunk-SF5JLMLG.js";
 
 // ../config/src/index.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // ../config/src/sentiment.ts
 import { z } from "zod";
@@ -84,78 +84,170 @@ var seoInstallConfigSchema = z3.object({
   }).strict()]))
 }).strict();
 
+// ../config/src/mcp-gateway.ts
+import { z as z4 } from "zod";
+var nonempty = z4.string().trim().min(1);
+var identifier = z4.string().regex(/^[a-z0-9][\w-]{0,127}$/i);
+var url = z4.url().refine((value) => {
+  const parsed = new URL(value);
+  return !parsed.username && !parsed.password && !parsed.hash && !parsed.search;
+}, "URLs must not contain credentials, fragments, or query strings");
+var gatewayTenantSchema = z4.object({
+  id: identifier,
+  displayName: nonempty.max(200),
+  origin: url,
+  issuer: url,
+  resource: url,
+  mcpUrl: url,
+  enabled: z4.boolean(),
+  allowPrivateNetwork: z4.boolean().default(false),
+  protocolVersions: z4.array(nonempty).min(1),
+  catalogVersion: z4.literal("canonry-readonly-v1"),
+  upstreamClientId: nonempty.optional()
+}).strict();
+var clientSchema = z4.object({
+  client_id: identifier,
+  client_name: nonempty.max(200),
+  redirect_uris: z4.array(z4.url()).min(1),
+  token_endpoint_auth_method: z4.literal("none").default("none"),
+  grant_types: z4.array(z4.enum(["authorization_code", "refresh_token"])).default(["authorization_code", "refresh_token"]),
+  response_types: z4.tuple([z4.literal("code")]).default(["code"])
+}).strict();
+var gatewayConfigSchema = z4.object({
+  issuer: url,
+  development: z4.boolean().default(false),
+  host: nonempty.default("127.0.0.1"),
+  port: z4.number().int().min(1).max(65535).default(4101),
+  databasePath: nonempty,
+  clients: z4.array(clientSchema).min(1),
+  tenants: z4.array(gatewayTenantSchema).min(1),
+  requestTimeoutMs: z4.number().int().min(100).max(12e4).default(3e4),
+  trustedProxyAddresses: z4.array(z4.union([z4.ipv4(), z4.ipv6()])).default([]),
+  rateLimitPerMinute: z4.number().int().min(1).max(1e5).default(120),
+  maxBodyBytes: z4.number().int().min(1024).max(10 * 1024 * 1024).default(1024 * 1024),
+  domainVerificationToken: z4.string().regex(/^[\w-]{1,1024}$/).optional()
+}).strict().superRefine((config, ctx) => {
+  const checkTransport = (value, path2) => {
+    const parsed = new URL(value);
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+    if (parsed.protocol !== "https:" && !(config.development && loopback && parsed.protocol === "http:")) {
+      ctx.addIssue({ code: "custom", path: path2, message: "HTTPS is required except explicit development on loopback" });
+    }
+  };
+  checkTransport(config.issuer, ["issuer"]);
+  const issuer = new URL(config.issuer);
+  if (issuer.pathname !== "/" || config.issuer.endsWith("/")) {
+    ctx.addIssue({ code: "custom", path: ["issuer"], message: "Gateway issuer must be an origin without a trailing slash" });
+  }
+  if (!config.development && config.databasePath === ":memory:") {
+    ctx.addIssue({ code: "custom", path: ["databasePath"], message: "Production requires a durable database path" });
+  }
+  const tenantIds = /* @__PURE__ */ new Set();
+  config.tenants.forEach((tenant, index) => {
+    if (tenantIds.has(tenant.id)) ctx.addIssue({ code: "custom", path: ["tenants", index, "id"], message: "Tenant IDs must be unique" });
+    tenantIds.add(tenant.id);
+    if (new URL(tenant.origin).origin !== tenant.origin) {
+      ctx.addIssue({ code: "custom", path: ["tenants", index, "origin"], message: "Tenant origin must be an origin without a path or trailing slash" });
+    }
+    for (const field of ["origin", "issuer", "resource", "mcpUrl"]) {
+      checkTransport(tenant[field], ["tenants", index, field]);
+      if (new URL(tenant[field]).origin !== tenant.origin) {
+        ctx.addIssue({ code: "custom", path: ["tenants", index, field], message: "Tenant endpoints must belong to the provisioned origin" });
+      }
+    }
+    if (!new URL(tenant.mcpUrl).pathname.endsWith("/api/v1/mcp/readonly")) {
+      ctx.addIssue({ code: "custom", path: ["tenants", index, "mcpUrl"], message: "Only the Canonry read-only MCP endpoint is permitted" });
+    }
+    if (!new URL(tenant.resource).pathname.endsWith("/api/v1/mcp")) {
+      ctx.addIssue({ code: "custom", path: ["tenants", index, "resource"], message: "Canonical MCP resource must end in /api/v1/mcp" });
+    }
+  });
+  const clientIds = /* @__PURE__ */ new Set();
+  config.clients.forEach((client, index) => {
+    if (clientIds.has(client.client_id)) ctx.addIssue({ code: "custom", path: ["clients", index, "client_id"], message: "Client IDs must be unique" });
+    clientIds.add(client.client_id);
+    client.redirect_uris.forEach((redirect, redirectIndex) => {
+      checkTransport(redirect, ["clients", index, "redirect_uris", redirectIndex]);
+      const parsed = new URL(redirect);
+      if (parsed.username || parsed.password || parsed.hash) {
+        ctx.addIssue({ code: "custom", path: ["clients", index, "redirect_uris", redirectIndex], message: "Redirects cannot contain credentials or fragments" });
+      }
+    });
+  });
+});
+
 // ../config/src/index.ts
-var dashboardManagedSweepsSchema = z4.boolean().nullish();
-var researchAllowViewersSchema = z4.boolean().nullish();
-var agentAllowViewersSchema = z4.boolean().nullish();
+var dashboardManagedSweepsSchema = z5.boolean().nullish();
+var researchAllowViewersSchema = z5.boolean().nullish();
+var agentAllowViewersSchema = z5.boolean().nullish();
 var AGENT_REASONING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
-var agentReasoningSchema = z4.enum(AGENT_REASONING_LEVELS).nullish();
-var researchViewerDailyRunLimitSchema = z4.number().int().positive().nullish();
-var dashboardManagedRunKindsSchema = z4.array(schedulableRunKindSchema).nullish();
+var agentReasoningSchema = z5.enum(AGENT_REASONING_LEVELS).nullish();
+var researchViewerDailyRunLimitSchema = z5.number().int().positive().nullish();
+var dashboardManagedRunKindsSchema = z5.array(schedulableRunKindSchema).nullish();
 var agentProviderSchema = agentProviderIdSchema.nullish();
-var agentModelSchema = z4.string().trim().min(1).nullish();
+var agentModelSchema = z5.string().trim().min(1).nullish();
 function resolveOperatorApiKeyIds(source) {
   const raw = source.CANONRY_OPERATOR_KEY_IDS?.trim();
   if (!raw) return [];
-  const parsed = z4.array(z4.string().regex(/^[\w-]{1,256}$/)).max(100).safeParse(raw.split(",").map((id) => id.trim()));
+  const parsed = z5.array(z5.string().regex(/^[\w-]{1,256}$/)).max(100).safeParse(raw.split(",").map((id) => id.trim()));
   if (!parsed.success) throw new Error("CANONRY_OPERATOR_KEY_IDS must contain at most 100 comma-separated API key IDs (letters, digits, underscores, hyphens; no wildcards).");
   return [...new Set(parsed.data)];
 }
-var envSchema = z4.object({
-  DATABASE_URL: z4.string().default("postgresql://aeo:aeo@postgres:5432/aeo_platform"),
-  API_PORT: z4.coerce.number().int().positive().default(3e3),
-  WORKER_PORT: z4.coerce.number().int().positive().default(3001),
-  WEB_PORT: z4.coerce.number().int().positive().default(4173),
-  BOOTSTRAP_SECRET: z4.string().default("change-me"),
-  CANONRY_BASE_PATH: z4.string().default("/"),
+var envSchema = z5.object({
+  DATABASE_URL: z5.string().default("postgresql://aeo:aeo@postgres:5432/aeo_platform"),
+  API_PORT: z5.coerce.number().int().positive().default(3e3),
+  WORKER_PORT: z5.coerce.number().int().positive().default(3001),
+  WEB_PORT: z5.coerce.number().int().positive().default(4173),
+  BOOTSTRAP_SECRET: z5.string().default("change-me"),
+  CANONRY_BASE_PATH: z5.string().default("/"),
   // Gemini
-  GEMINI_API_KEY: z4.string().optional(),
-  GEMINI_MODEL: z4.string().optional(),
-  GEMINI_BASE_URL: z4.string().optional(),
-  GEMINI_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  GEMINI_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  GEMINI_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
+  GEMINI_API_KEY: z5.string().optional(),
+  GEMINI_MODEL: z5.string().optional(),
+  GEMINI_BASE_URL: z5.string().optional(),
+  GEMINI_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  GEMINI_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  GEMINI_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
   // Gemini Vertex AI (alternative to API key auth)
-  GEMINI_VERTEX_PROJECT: z4.string().optional(),
-  GEMINI_VERTEX_REGION: z4.string().optional(),
-  GEMINI_VERTEX_CREDENTIALS: z4.string().optional(),
+  GEMINI_VERTEX_PROJECT: z5.string().optional(),
+  GEMINI_VERTEX_REGION: z5.string().optional(),
+  GEMINI_VERTEX_CREDENTIALS: z5.string().optional(),
   // OpenAI
-  OPENAI_API_KEY: z4.string().optional(),
-  OPENAI_MODEL: z4.string().optional(),
-  OPENAI_BASE_URL: z4.string().optional(),
-  OPENAI_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  OPENAI_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  OPENAI_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
-  OPENROUTER_API_KEY: z4.string().optional(),
-  OPENROUTER_MODEL: z4.string().optional(),
-  OPENROUTER_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  OPENROUTER_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  OPENROUTER_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
+  OPENAI_API_KEY: z5.string().optional(),
+  OPENAI_MODEL: z5.string().optional(),
+  OPENAI_BASE_URL: z5.string().optional(),
+  OPENAI_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  OPENAI_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  OPENAI_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
+  OPENROUTER_API_KEY: z5.string().optional(),
+  OPENROUTER_MODEL: z5.string().optional(),
+  OPENROUTER_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  OPENROUTER_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  OPENROUTER_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
   // Anthropic / Claude
-  ANTHROPIC_API_KEY: z4.string().optional(),
-  ANTHROPIC_MODEL: z4.string().optional(),
-  ANTHROPIC_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  ANTHROPIC_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  ANTHROPIC_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
+  ANTHROPIC_API_KEY: z5.string().optional(),
+  ANTHROPIC_MODEL: z5.string().optional(),
+  ANTHROPIC_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  ANTHROPIC_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  ANTHROPIC_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
   // Perplexity
-  PERPLEXITY_API_KEY: z4.string().optional(),
-  PERPLEXITY_MODEL: z4.string().optional(),
-  PERPLEXITY_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  PERPLEXITY_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  PERPLEXITY_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
+  PERPLEXITY_API_KEY: z5.string().optional(),
+  PERPLEXITY_MODEL: z5.string().optional(),
+  PERPLEXITY_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  PERPLEXITY_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  PERPLEXITY_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
   // Meta Muse
-  MUSE_API_KEY: z4.string().optional(),
-  MUSE_MODEL: z4.string().optional(),
-  MUSE_BASE_URL: z4.string().optional(),
-  MUSE_MAX_CONCURRENCY: z4.coerce.number().int().positive().default(2),
-  MUSE_MAX_REQUESTS_PER_MINUTE: z4.coerce.number().int().positive().default(10),
-  MUSE_MAX_REQUESTS_PER_DAY: z4.coerce.number().int().positive().default(1e3),
+  MUSE_API_KEY: z5.string().optional(),
+  MUSE_MODEL: z5.string().optional(),
+  MUSE_BASE_URL: z5.string().optional(),
+  MUSE_MAX_CONCURRENCY: z5.coerce.number().int().positive().default(2),
+  MUSE_MAX_REQUESTS_PER_MINUTE: z5.coerce.number().int().positive().default(10),
+  MUSE_MAX_REQUESTS_PER_DAY: z5.coerce.number().int().positive().default(1e3),
   // Secret for HMAC-signing Google OAuth state parameters. Required for
   // cloud deployments that mount googleRoutes; the plugin refuses to register
   // without it (see packages/api-routes/src/google.ts).
-  GOOGLE_STATE_SECRET: z4.string().optional(),
-  CANONRY_RESEARCH_ALLOW_VIEWERS: z4.string().optional(),
-  CANONRY_RESEARCH_VIEWER_DAILY_RUN_LIMIT: z4.coerce.number().int().positive().default(DEFAULT_VIEWER_RESEARCH_DAILY_RUN_LIMIT)
+  GOOGLE_STATE_SECRET: z5.string().optional(),
+  CANONRY_RESEARCH_ALLOW_VIEWERS: z5.string().optional(),
+  CANONRY_RESEARCH_VIEWER_DAILY_RUN_LIMIT: z5.coerce.number().int().positive().default(DEFAULT_VIEWER_RESEARCH_DAILY_RUN_LIMIT)
 });
 var BOOTSTRAP_PROVIDER_DEFAULT_MODELS = {
   gemini: "gemini-flash-latest",
@@ -178,33 +270,33 @@ function withBootstrapProviderDefaults(name, entry) {
     quota: entry.quota ?? { ...BOOTSTRAP_PROVIDER_DEFAULT_QUOTA }
   };
 }
-var bootstrapEnvSchema = z4.object({
-  CANONRY_API_KEY: z4.string().optional(),
-  CANONRY_API_URL: z4.string().optional(),
-  CANONRY_DATABASE_PATH: z4.string().optional(),
-  GEMINI_API_KEY: z4.string().optional(),
-  GEMINI_MODEL: z4.string().optional(),
-  GEMINI_BASE_URL: z4.string().optional(),
-  GEMINI_VERTEX_PROJECT: z4.string().optional(),
-  GEMINI_VERTEX_REGION: z4.string().optional(),
-  GEMINI_VERTEX_CREDENTIALS: z4.string().optional(),
-  OPENAI_API_KEY: z4.string().optional(),
-  OPENAI_MODEL: z4.string().optional(),
-  OPENAI_BASE_URL: z4.string().optional(),
-  OPENROUTER_API_KEY: z4.string().optional(),
-  OPENROUTER_MODEL: z4.string().optional(),
-  ANTHROPIC_API_KEY: z4.string().optional(),
-  ANTHROPIC_MODEL: z4.string().optional(),
-  PERPLEXITY_API_KEY: z4.string().optional(),
-  PERPLEXITY_MODEL: z4.string().optional(),
-  MUSE_API_KEY: z4.string().optional(),
-  MUSE_MODEL: z4.string().optional(),
-  MUSE_BASE_URL: z4.string().optional(),
-  LOCAL_BASE_URL: z4.string().optional(),
-  LOCAL_API_KEY: z4.string().optional(),
-  LOCAL_MODEL: z4.string().optional(),
-  GOOGLE_CLIENT_ID: z4.string().optional(),
-  GOOGLE_CLIENT_SECRET: z4.string().optional()
+var bootstrapEnvSchema = z5.object({
+  CANONRY_API_KEY: z5.string().optional(),
+  CANONRY_API_URL: z5.string().optional(),
+  CANONRY_DATABASE_PATH: z5.string().optional(),
+  GEMINI_API_KEY: z5.string().optional(),
+  GEMINI_MODEL: z5.string().optional(),
+  GEMINI_BASE_URL: z5.string().optional(),
+  GEMINI_VERTEX_PROJECT: z5.string().optional(),
+  GEMINI_VERTEX_REGION: z5.string().optional(),
+  GEMINI_VERTEX_CREDENTIALS: z5.string().optional(),
+  OPENAI_API_KEY: z5.string().optional(),
+  OPENAI_MODEL: z5.string().optional(),
+  OPENAI_BASE_URL: z5.string().optional(),
+  OPENROUTER_API_KEY: z5.string().optional(),
+  OPENROUTER_MODEL: z5.string().optional(),
+  ANTHROPIC_API_KEY: z5.string().optional(),
+  ANTHROPIC_MODEL: z5.string().optional(),
+  PERPLEXITY_API_KEY: z5.string().optional(),
+  PERPLEXITY_MODEL: z5.string().optional(),
+  MUSE_API_KEY: z5.string().optional(),
+  MUSE_MODEL: z5.string().optional(),
+  MUSE_BASE_URL: z5.string().optional(),
+  LOCAL_BASE_URL: z5.string().optional(),
+  LOCAL_API_KEY: z5.string().optional(),
+  LOCAL_MODEL: z5.string().optional(),
+  GOOGLE_CLIENT_ID: z5.string().optional(),
+  GOOGLE_CLIENT_SECRET: z5.string().optional()
 });
 function getBootstrapEnv(source, overrides) {
   const filtered = overrides ? Object.fromEntries(Object.entries(overrides).filter(([, v]) => v != null)) : {};
@@ -1013,9 +1105,9 @@ Do not use "canonry init --force" for recovery. It replaces credentials without
   const portOverride = process.env.CANONRY_PORT?.trim();
   if (portOverride) {
     try {
-      const url = new URL(parsed.apiUrl);
-      url.port = portOverride;
-      parsed.apiUrl = url.origin;
+      const url2 = new URL(parsed.apiUrl);
+      url2.port = portOverride;
+      parsed.apiUrl = url2.origin;
     } catch {
     }
   }
@@ -1026,9 +1118,9 @@ Do not use "canonry init --force" for recovery. It replaces credentials without
   if (parsed.basePath) {
     const normalizedBase = "/" + parsed.basePath.replace(/^\/|\/$/g, "");
     try {
-      const url = new URL(parsed.apiUrl);
-      if (normalizedBase !== "/" && !url.pathname.startsWith(normalizedBase)) {
-        parsed.apiUrl = url.origin + normalizedBase;
+      const url2 = new URL(parsed.apiUrl);
+      if (normalizedBase !== "/" && !url2.pathname.startsWith(normalizedBase)) {
+        parsed.apiUrl = url2.origin + normalizedBase;
       }
     } catch {
     }
@@ -1053,11 +1145,11 @@ function parseExternalMcpEnv(raw) {
   for (const entry of value) {
     if (!entry || typeof entry !== "object") continue;
     const candidate = entry;
-    const url = typeof candidate.url === "string" ? candidate.url.trim() : "";
+    const url2 = typeof candidate.url === "string" ? candidate.url.trim() : "";
     const token = typeof candidate.token === "string" ? candidate.token : "";
-    if (!url || !token) continue;
+    if (!url2 || !token) continue;
     const label = typeof candidate.label === "string" ? candidate.label : void 0;
-    servers.push({ url, token, ...label ? { label } : {} });
+    servers.push({ url: url2, token, ...label ? { label } : {} });
   }
   return servers.length > 0 ? servers : void 0;
 }

package/dist/{chunk-T5PWWDMJ.js → chunk-O4D66XPL.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VJWDBFSL.js";
 import {
   createApiClient
-} from "./chunk-WH2M2MQF.js";
+} from "./chunk-BICUWFV4.js";
 import {
   CliError,
   isMachineFormat