@canonry/canonry 7.9.0 → 7.9.1

package/dist/{chunk-NU62UT2S.js → chunk-4BKRZGLC.js}

@@ -3543,6 +3543,7 @@ import { createRequire as createRequire3 } from "module";
 import crypto29 from "crypto";
 import fs9 from "fs";
 import path8 from "path";
+import { isIP } from "net";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { and as and23, eq as eq29 } from "drizzle-orm";
 
@@ -7872,7 +7873,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "c54a2244dca1abcb4657e792eaa6f89bb0d230d5" : void 0;
+  const embedded = true ? "1ef30fafb9a5781918fcb963ade6280231796cc9" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -21280,6 +21281,28 @@ function isLoopbackBindHost(host) {
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) return true;
   return false;
 }
+function isAllowedHost(host, allowedHosts) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  return allowedHosts.has(normalized) || isIP(normalized) !== 0;
+}
+function buildAllowedHosts(bindHost, ...configuredUrls) {
+  const allowed = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+  if (bindHost) {
+    const normalized = bindHost.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    if (normalized && !isLoopbackBindHost(normalized)) {
+      allowed.add(normalized);
+    }
+  }
+  for (const configuredUrl of configuredUrls) {
+    if (!configuredUrl) continue;
+    try {
+      const url = new URL(configuredUrl.trim());
+      if (url.hostname) allowed.add(url.hostname.toLowerCase().replace(/^\[|\]$/g, ""));
+    } catch {
+    }
+  }
+  return allowed;
+}
 function resolveGooglePublicUrl(config, basePath) {
   const configured = config.publicUrl?.trim();
   if (configured) return configured;
@@ -21432,6 +21455,45 @@ async function createServer(opts) {
     genReqId: () => crypto29.randomUUID(),
     trustProxy
   });
+  const allowedHosts = buildAllowedHosts(opts.host, opts.config.apiUrl, opts.config.publicUrl);
+  const embedAllowedOrigins = new Set(
+    (embed.allowedOrigins ?? []).map((o) => {
+      try {
+        return new URL(o).origin;
+      } catch {
+        return null;
+      }
+    }).filter((h) => h !== null)
+  );
+  app.addHook("onRequest", async (req, reply) => {
+    const reject = (message) => {
+      const error = forbidden(message);
+      return reply.status(error.statusCode).send(error.toJSON());
+    };
+    const rawHostHeader = req.headers.host?.toLowerCase() ?? "";
+    let requestUrl;
+    try {
+      requestUrl = new URL(`http://${rawHostHeader}`);
+    } catch {
+      return reject("Unexpected Host header");
+    }
+    if (!isAllowedHost(requestUrl.hostname, allowedHosts)) {
+      return reject("Unexpected Host header");
+    }
+    const origin = req.headers.origin;
+    if (origin) {
+      let originUrl;
+      try {
+        originUrl = new URL(origin);
+      } catch {
+        return reject("Invalid Origin header");
+      }
+      const requestHost = req.headers.host?.toLowerCase() ?? "";
+      if (originUrl.host !== requestHost && !embedAllowedOrigins.has(originUrl.origin)) {
+        return reject("Cross-origin request refused");
+      }
+    }
+  });
   const registry = new ProviderRegistry();
   const providers = opts.config.providers ?? {};
   if (opts.config.geminiApiKey && !providers.gemini) {

package/dist/cli.js

@@ -32,7 +32,7 @@ import {
   trackCliCommandFinished,
   trackEvent,
   waitForServerRuntimeStartup
-} from "./chunk-NU62UT2S.js";
+} from "./chunk-4BKRZGLC.js";
 import {
   autoSyncSkills,
   formatAutoSyncNotice

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   createGoogleMarketingCredentialStore,
   createGoogleMarketingRuntime,
   createServer
-} from "./chunk-NU62UT2S.js";
+} from "./chunk-4BKRZGLC.js";
 import {
   loadConfig
 } from "./chunk-LO56QXPO.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "7.9.0",
+  "version": "7.9.1",
   "type": "module",
   "description": "Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.",
   "keywords": [
@@ -86,31 +86,31 @@
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
     "@ainyc/canonry-web": "0.0.0",
+    "@ainyc/canonry-api-routes": "0.0.0",
+    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
-    "@ainyc/canonry-config": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
-    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-integration-bing": "0.0.0",
-    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
-    "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
+    "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
+    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
+    "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-google-ads": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-google-tag-manager": "0.0.0",
-    "@ainyc/canonry-integration-google-places": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-openai-ads": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
     "@ainyc/canonry-intelligence": "0.0.0",
+    "@ainyc/canonry-integration-google-places": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
-    "@ainyc/canonry-integration-google": "0.0.0",
-    "@ainyc/canonry-provider-local": "0.0.0",
-    "@ainyc/canonry-provider-muse": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
+    "@ainyc/canonry-provider-muse": "0.0.0",
     "@ainyc/canonry-provider-perplexity": "0.0.0",
     "@ainyc/canonry-integration-typesafe": "0.0.0"
   },