@canonry/canonry 7.9.0 → 7.10.0

package/dist/{chunk-NU62UT2S.js → chunk-FVMWUT2R.js}

@@ -20,20 +20,20 @@ import {
   saveConfig,
   saveConfigPatch,
   sentimentInstallReadiness
-} from "./chunk-LO56QXPO.js";
+} from "./chunk-IKXVLT4M.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-T2V2PESH.js";
+} from "./chunk-5ZBN3EEK.js";
 import {
   CanonryMcpToolNames,
   CliError,
   PACKAGE_VERSION,
   canonryMcpTools
-} from "./chunk-ZLB7WX5D.js";
+} from "./chunk-VSZJVBVR.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -205,7 +205,7 @@ import {
   siteLivenessState,
   toAlertView,
   usageCounters
-} from "./chunk-KRFTA4I7.js";
+} from "./chunk-52PHEGHT.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -414,7 +414,7 @@ import {
   visibilityReportRequestSchema,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -3543,6 +3543,7 @@ import { createRequire as createRequire3 } from "module";
 import crypto29 from "crypto";
 import fs9 from "fs";
 import path8 from "path";
+import { isIP } from "net";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { and as and23, eq as eq29 } from "drizzle-orm";
 
@@ -7872,7 +7873,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "c54a2244dca1abcb4657e792eaa6f89bb0d230d5" : void 0;
+  const embedded = true ? "b8858fd6adad2abea13e838eab395ad7aef15323" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -16465,7 +16466,7 @@ function partialLists(root) {
       if (uncounted.length === 1) {
         const index = uncounted[0];
         const key = lists[index][0];
-        const paged = cursorForList(object, path9, key, root) || typeof object.truncated === "boolean" || typeof object[`${key}Truncated`] === "boolean" || ["items", "rows", "results"].includes(key);
+        const paged = object === root || cursorForList(object, path9, key, root) || typeof object.truncated === "boolean" || typeof object[`${key}Truncated`] === "boolean" || ["items", "rows", "results"].includes(key);
         if (paged) counts[index] = bareTotal(numbers);
       }
       for (const [index, [key, rows]] of lists.entries()) {
@@ -16746,12 +16747,12 @@ function projectionPath(path9) {
   const digest = createHash5("sha256").update(path9).digest("hex").slice(0, 12);
   return `${truncateUtf16(path9, 48)}...#${digest}${path9.slice(-24)}`;
 }
-function boundedProjection(full) {
+function boundedProjection(full, partialRows, reserve = 0) {
   const value = JSON.parse(full);
-  const summary = {
+  let summary = {
     droppedKeys: [],
     keptItems: {},
-    projection: "Only complete array rows and marked partial string prefixes are shown; omitted fields are not evidence. Never follow a cursor from a cut page; re-request the original cursor with a smaller limit."
+    projection: partialRows ? "Array rows are complete unless slicedKeys or droppedKeys name a field inside one; sliced strings are partial prefixes and omitted fields are not evidence. Never follow a cursor from a cut page; re-request the original cursor with a smaller limit." : "Only complete array rows and marked partial string prefixes are shown; omitted fields are not evidence. Never follow a cursor from a cut page; re-request the original cursor with a smaller limit."
   };
   const skippedMetadata = () => {
     summary.moreMetadataEntries = (summary.moreMetadataEntries ?? 0) + 1;
@@ -16777,6 +16778,7 @@ function boundedProjection(full) {
     }
     if (dropped > summary.droppedKeys.length) summary.moreDroppedKeys = dropped - summary.droppedKeys.length;
   };
+  const cutOwners = /* @__PURE__ */ new Set();
   const project = (input, budget, path9, owner, ownerPath = "") => {
     if (Array.isArray(input)) {
       const rows = [];
@@ -16784,11 +16786,26 @@ function boundedProjection(full) {
       for (const row of input) {
         const text = serializeResult(row);
         const cost = text.length + (rows.length > 0 ? 1 : 0);
-        if (used2 + cost > budget) break;
-        rows.push(text);
-        used2 += cost;
+        if (used2 + cost <= budget) {
+          rows.push(text);
+          used2 += cost;
+          continue;
+        }
+        if (partialRows && (rows.length === 0 || text.length > MAX_TOOL_RESULT_CHARS)) {
+          const before = { summary: serializeResult(summary), dropped };
+          const partial = project(row, budget - used2 - (rows.length > 0 ? 1 : 0), `${path9 || "items"}[${rows.length}]`);
+          if (partial !== void 0 && partial !== "{}" && partial !== "[]") {
+            partialRows.set(path9 || "items", rows.length);
+            rows.push(partial);
+          } else {
+            summary = JSON.parse(before.summary);
+            dropped = before.dropped;
+          }
+        }
+        break;
       }
       if (rows.length < input.length) {
+        if (partialRows && owner) cutOwners.add(owner);
         record2(summary.keptItems, path9 || "items", `${rows.length} of ${input.length}`);
         if (rows.length === 0) omit(path9 || "items");
         if (owner) {
@@ -16812,9 +16829,8 @@ function boundedProjection(full) {
       omit(path9 || "(root)");
       return void 0;
     }
-    const fields = Object.entries(input).filter(([key]) => !key.startsWith("__"));
-    const priority = ([key, child]) => key === "queryPage" && isRecord5(child) ? 0 : typeof child === "string" && child.length > budget ? 2 : Number(typeof child === "object" && child !== null);
-    fields.sort((a, b) => priority(a) - priority(b));
+    const priority = ([key, child]) => key === "queryPage" && isRecord5(child) ? 0 : typeof child === "string" && child.length > budget ? 2 : typeof child !== "object" || child === null ? 0 : partialRows && serializeResult(child).length > budget ? 2 : 1;
+    const fields = Object.entries(input).filter(([key]) => !key.startsWith("__")).map((field) => ({ field, rank: priority(field) })).sort((a, b) => a.rank - b.rank).map(({ field }) => field);
     const shown2 = [];
     let used = 2;
     for (const [key, child] of fields) {
@@ -16830,17 +16846,40 @@ function boundedProjection(full) {
       shown2.push(prefix + text);
       used += prefix.length + text.length + (shown2.length > 1 ? 1 : 0);
     }
+    if (path9 && cutOwners.has(input)) shown2.push('"__truncated":true');
     return `{${shown2.join(",")}}`;
   };
-  const projected = project(value, MAX_TOOL_RESULT_CHARS - PROJECTION_SUMMARY_CHARS, "");
+  const projected = project(value, MAX_TOOL_RESULT_CHARS - PROJECTION_SUMMARY_CHARS - reserve, "");
   const shown = projected === void 0 ? {} : JSON.parse(projected);
   const output = isRecord5(shown) ? shown : { items: shown };
-  return serializeResult({ ...output, __truncated: true, [TRUNCATION_SUMMARY_KEY]: summary });
-}
-function truncateToolResult(details) {
+  const result2 = { ...output, __truncated: true, [TRUNCATION_SUMMARY_KEY]: summary };
+  return serializeResult(partialRows ? withPartialLists(result2) : result2);
+}
+function rowsShown(cut, path9) {
+  if (path9.includes("[")) return Infinity;
+  const list = path9.split(".").reduce((owner, key) => isRecord5(owner) ? owner[key] : void 0, cut);
+  return Array.isArray(list) ? list.length : 0;
+}
+function withPartialRows(full, whole) {
+  const rescued = /* @__PURE__ */ new Map();
+  let partial = boundedProjection(full, rescued);
+  if (!fitsCap(partial)) {
+    const { [PARTIAL_LISTS_KEY]: lists, __pagination: pagination } = JSON.parse(partial);
+    rescued.clear();
+    partial = boundedProjection(full, rescued, serializeResult({ lists, pagination }).length);
+  }
+  if (!fitsCap(partial)) return whole;
+  const cut = JSON.parse(whole);
+  return [...rescued].some(([path9, index]) => rowsShown(cut, path9) <= index) ? partial : whole;
+}
+function truncateToolResult(details, options = {}) {
   const annotated = withPartialLists(details);
   const full = serializeResult(annotated);
   if (full.length <= MAX_TOOL_RESULT_CHARS) return full;
+  const whole = truncateWholeRows(details, full);
+  return options.partialRows ? withPartialRows(full, whole) : whole;
+}
+function truncateWholeRows(details, full) {
   if (full.length > MAX_STRUCTURED_TRUNCATION_CHARS) return boundedProjection(full);
   if (Array.isArray(details)) {
     const render2 = (rows) => serializeResult({
@@ -18140,7 +18179,8 @@ function adaptRemoteTool(client, tool) {
       }
     }
     return {
-      content: [{ type: "text", text: truncateToolResult(shown) }],
+      // A fetched document can be one row larger than the cap; show it in part rather than not at all.
+      content: [{ type: "text", text: truncateToolResult(shown, { partialRows: true }) }],
       details: result2,
       isError: isRemoteToolError(result2)
     };
@@ -21280,6 +21320,28 @@ function isLoopbackBindHost(host) {
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
   return false;
 }
+function isAllowedHost(host, allowedHosts) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  return allowedHosts.has(normalized) || isIP(normalized) !== 0;
+}
+function buildAllowedHosts(bindHost, ...configuredUrls) {
+  const allowed = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+  if (bindHost) {
+    const normalized = bindHost.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    if (normalized && !isLoopbackBindHost(normalized)) {
+      allowed.add(normalized);
+    }
+  }
+  for (const configuredUrl of configuredUrls) {
+    if (!configuredUrl) continue;
+    try {
+      const url = new URL(configuredUrl.trim());
+      if (url.hostname) allowed.add(url.hostname.toLowerCase().replace(/^\[|\]$/g, ""));
+    } catch {
+    }
+  }
+  return allowed;
+}
 function resolveGooglePublicUrl(config, basePath) {
   const configured = config.publicUrl?.trim();
   if (configured) return configured;
@@ -21432,6 +21494,45 @@ async function createServer(opts) {
     genReqId: () => crypto29.randomUUID(),
     trustProxy
   });
+  const allowedHosts = buildAllowedHosts(opts.host, opts.config.apiUrl, opts.config.publicUrl);
+  const embedAllowedOrigins = new Set(
+    (embed.allowedOrigins ?? []).map((o) => {
+      try {
+        return new URL(o).origin;
+      } catch {
+        return null;
+      }
+    }).filter((h) => h !== null)
+  );
+  app.addHook("onRequest", async (req, reply) => {
+    const reject = (message) => {
+      const error = forbidden(message);
+      return reply.status(error.statusCode).send(error.toJSON());
+    };
+    const rawHostHeader = req.headers.host?.toLowerCase() ?? "";
+    let requestUrl;
+    try {
+      requestUrl = new URL(`http://${rawHostHeader}`);
+    } catch {
+      return reject("Unexpected Host header");
+    }
+    if (!isAllowedHost(requestUrl.hostname, allowedHosts)) {
+      return reject("Unexpected Host header");
+    }
+    const origin = req.headers.origin;
+    if (origin) {
+      let originUrl;
+      try {
+        originUrl = new URL(origin);
+      } catch {
+        return reject("Invalid Origin header");
+      }
+      const requestHost = req.headers.host?.toLowerCase() ?? "";
+      if (originUrl.host !== requestHost && !embedAllowedOrigins.has(originUrl.origin)) {
+        return reject("Cross-origin request refused");
+      }
+    }
+  });
   const registry = new ProviderRegistry();
   const providers = opts.config.providers ?? {};
   if (opts.config.geminiApiKey && !providers.gemini) {

package/dist/{chunk-AAMKTL6B.js → chunk-HL3C6Z7T.js}

@@ -4,14 +4,14 @@ import {
   installSkills,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-LO56QXPO.js";
+} from "./chunk-IKXVLT4M.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-ZLB7WX5D.js";
+} from "./chunk-VSZJVBVR.js";
 import {
   SKILL_MANIFEST_FILENAME,
   SkillsClients
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/skills-autosync.ts
 import fs from "fs";

package/dist/{chunk-LO56QXPO.js → chunk-IKXVLT4M.js}

@@ -5,7 +5,7 @@ import {
   PACKAGE_VERSION,
   canonryMcpTools,
   isMachineFormat
-} from "./chunk-ZLB7WX5D.js";
+} from "./chunk-VSZJVBVR.js";
 import {
   AGENT_PROVIDER_IDS,
   CANONRY_NPM_PACKAGE_URL,
@@ -50,7 +50,7 @@ import {
   skillsClientSchema,
   upgradeCaveatFor,
   upgradeCommandFor
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/config.ts
 import fs from "fs";

package/dist/{chunk-ZLB7WX5D.js → chunk-VSZJVBVR.js}

@@ -138,7 +138,7 @@ import {
   trafficSeriesGranularitySchema,
   visibilityCompareSelectionSchema,
   visibilityReportRequestSchema
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/cli-error.ts
 function isMachineFormat(format) {

package/dist/cli.js

@@ -32,11 +32,11 @@ import {
   trackCliCommandFinished,
   trackEvent,
   waitForServerRuntimeStartup
-} from "./chunk-NU62UT2S.js";
+} from "./chunk-FVMWUT2R.js";
 import {
   autoSyncSkills,
   formatAutoSyncNotice
-} from "./chunk-AAMKTL6B.js";
+} from "./chunk-HL3C6Z7T.js";
 import {
   configExists,
   createApiClient,
@@ -53,13 +53,13 @@ import {
   saveConfig,
   saveConfigPatch,
   shouldPrintServeSkillsNudge
-} from "./chunk-LO56QXPO.js";
+} from "./chunk-IKXVLT4M.js";
 import {
   DEFAULT_DEMO_TRUSTED_PROXIES,
   trustedProxiesProblem,
   trustedProxyProblem
 } from "./chunk-RB2F4D3Z.js";
-import "./chunk-T2V2PESH.js";
+import "./chunk-5ZBN3EEK.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -71,7 +71,7 @@ import {
   runMeasurementDraftAction,
   systemError,
   usageError
-} from "./chunk-ZLB7WX5D.js";
+} from "./chunk-VSZJVBVR.js";
 import {
   CLOUDFLARE_WORKER_BINDINGS,
   CLOUDFLARE_WORKER_GENERATED_MARKER,
@@ -100,7 +100,7 @@ import {
   querySnapshots,
   rawEventSamples,
   runs
-} from "./chunk-KRFTA4I7.js";
+} from "./chunk-52PHEGHT.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -229,7 +229,7 @@ import {
   visibilityCompareSelectionSchema,
   visibilityReportRequestSchema,
   winnabilityClassSchema
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -779,7 +779,7 @@ function parseDemoTrustedProxies(values) {
 async function demoCommand(options) {
   const { host, port } = parseDemoListenOptions(options);
   const trustProxy = parseDemoTrustedProxies(options.trustProxy);
-  const { createDemoServer } = await import("./demo-server-KDMG3APY.js");
+  const { createDemoServer } = await import("./demo-server-WZIB4JKJ.js");
   const app = await createDemoServer({ trustProxy });
   let stopping = false;
   const stop = () => {
@@ -1193,7 +1193,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
   }
 }
 async function backfillInsightsCommand(project2, opts) {
-  const { IntelligenceService } = await import("./intelligence-service-LAXJFE3U.js");
+  const { IntelligenceService } = await import("./intelligence-service-KC62A4X5.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);

package/dist/{demo-server-KDMG3APY.js → demo-server-WZIB4JKJ.js}

@@ -5,11 +5,11 @@ import {
   computeFactorAverages,
   layoutSiteCrawlGraphInput,
   persistSiteCrawlGraphLayout
-} from "./chunk-T2V2PESH.js";
+} from "./chunk-5ZBN3EEK.js";
 import {
   PACKAGE_VERSION,
   canonryMcpTools
-} from "./chunk-ZLB7WX5D.js";
+} from "./chunk-VSZJVBVR.js";
 import {
   HISTORY_WINDOW_RUNS,
   IntelligenceService,
@@ -83,7 +83,7 @@ import {
   siteCrawlPages,
   siteCrawlSnapshots,
   trafficSources
-} from "./chunk-KRFTA4I7.js";
+} from "./chunk-52PHEGHT.js";
 import {
   RunKinds,
   SiteCrawlFetchStates,
@@ -112,7 +112,7 @@ import {
   roundPreservingTotal,
   siteAuditPageFactorSchema,
   wilsonInterval
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/demo-server.ts
 import { dirname, join as join2 } from "path";

package/dist/index.js

@@ -3,14 +3,14 @@ import {
   createGoogleMarketingCredentialStore,
   createGoogleMarketingRuntime,
   createServer
-} from "./chunk-NU62UT2S.js";
+} from "./chunk-FVMWUT2R.js";
 import {
   loadConfig
-} from "./chunk-LO56QXPO.js";
-import "./chunk-T2V2PESH.js";
-import "./chunk-ZLB7WX5D.js";
-import "./chunk-KRFTA4I7.js";
-import "./chunk-DO7XPDG5.js";
+} from "./chunk-IKXVLT4M.js";
+import "./chunk-5ZBN3EEK.js";
+import "./chunk-VSZJVBVR.js";
+import "./chunk-52PHEGHT.js";
+import "./chunk-66DVP4DN.js";
 export {
   GoogleMarketingRuntimeError,
   createGoogleMarketingCredentialStore,

package/dist/{intelligence-service-LAXJFE3U.js → intelligence-service-KC62A4X5.js}

@@ -1,8 +1,8 @@
 import {
   HISTORY_WINDOW_RUNS,
   IntelligenceService
-} from "./chunk-KRFTA4I7.js";
-import "./chunk-DO7XPDG5.js";
+} from "./chunk-52PHEGHT.js";
+import "./chunk-66DVP4DN.js";
 export {
   HISTORY_WINDOW_RUNS,
   IntelligenceService

package/dist/mcp.js

@@ -1,15 +1,15 @@
 import {
   autoSyncSkills
-} from "./chunk-AAMKTL6B.js";
+} from "./chunk-HL3C6Z7T.js";
 import {
   createApiClient,
   createCanonryMcpServer
-} from "./chunk-LO56QXPO.js";
-import "./chunk-ZLB7WX5D.js";
+} from "./chunk-IKXVLT4M.js";
+import "./chunk-VSZJVBVR.js";
 import {
   isReadOnlyKey,
   updateCheckEnvOptOut
-} from "./chunk-DO7XPDG5.js";
+} from "./chunk-66DVP4DN.js";
 
 // src/mcp/cli.ts
 import { randomUUID } from "crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "type": "module",
   "description": "Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.",
   "keywords": [
@@ -88,30 +88,30 @@
     "@ainyc/canonry-web": "0.0.0",
     "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
-    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
+    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-integration-bing": "0.0.0",
-    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
-    "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
-    "@ainyc/canonry-integration-commoncrawl": "0.0.0",
+    "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
+    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
     "@ainyc/canonry-integration-google-ads": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
-    "@ainyc/canonry-integration-google-tag-manager": "0.0.0",
+    "@ainyc/canonry-integration-google": "0.0.0",
+    "@ainyc/canonry-integration-commoncrawl": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
-    "@ainyc/canonry-integration-openai-ads": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
-    "@ainyc/canonry-intelligence": "0.0.0",
+    "@ainyc/canonry-integration-google-tag-manager": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
+    "@ainyc/canonry-intelligence": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
-    "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-provider-local": "0.0.0",
-    "@ainyc/canonry-provider-muse": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-provider-muse": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
     "@ainyc/canonry-provider-perplexity": "0.0.0",
+    "@ainyc/canonry-integration-openai-ads": "0.0.0",
     "@ainyc/canonry-integration-typesafe": "0.0.0"
   },
   "scripts": {