@canonry/canonry 7.97.0 → 7.97.2

package/assets/agent-workspace/skills/canonry/references/canonry-cli.md

@@ -1153,7 +1153,7 @@ upgrade reads high on that side.
 
 ## Google Analytics 4
 
-GA4 integration supports service-account auth and OAuth (`canonry google connect <project> --type ga4`). With OAuth, `ga properties` lists the readable properties so the numeric id `ga connect --property-id` needs can be discovered without leaving canonry. The service account must have Viewer access on the GA4 property. `ga sync` writes the traffic tables (`gaTrafficSnapshots`, `gaAiReferrals`, `gaSocialReferrals`, `gaTrafficSummaries`) plus the GA4 Search Console landing-page snapshot (`gaSearchLandingWindows`, `gaSearchLandingPages`); every subsequent read command queries the local store rather than re-fetching from GA4, so reads are fast and quotaless. AI-referral rows are sessions GA4 puts in its `AI Assistant` channel (medium `ai-assistant`, since 2026-05-13, not retroactive) plus sessions whose source is an AI engine's host or a subdomain of it (`chatgpt.com`, `www.perplexity.ai`, `gemini.google.com`, `claude.ai`, `copilot.microsoft.com`, `grok.com`, `meta.ai`, `you.com`, …), its bare name (`chatgpt`, `gemini`, `grok`), its official Android app id, bare or as `android-app://` (`com.openai.chatgpt`, `com.microsoft.copilot`), or, for ChatGPT, Perplexity, Claude, DeepSeek and Phind, a tag that starts with the name or host (`perplexity_ai`, `chatgpt.com_ads`). These cover older history and AI visits GA4 files elsewhere. An engine name inside another source is never matched, so ngrok tunnels, `philanthropic.org` and the Gemini exchange stay out. A channel row whose source names no engine is kept under its own source and counted in every AI total; visits that send no referrer still land in Direct. Rows are tracked across three GA4 attribution dimensions (`session` / `first_user` / `manual_utm`; the manual UTM lens matches sources only, since GA4 has no channel for it) and joined to landing pages. Social referrals are split Organic vs Paid via GA4's `sessionDefaultChannelGroup`. Synced rows carry no GA4 property, so anything that changes the property a project resolves to (`ga connect` to another property, `ga disconnect`, or `google disconnect --type ga4` with no service account behind it) deletes the project's GA rows; the next `ga sync` refills them from the new property. All commands support `--format json`.
+GA4 integration supports service-account auth and OAuth (`canonry google connect <project> --type ga4`). With OAuth, `ga properties` lists the readable properties so the numeric id `ga connect --property-id` needs can be discovered without leaving canonry. The service account must have Viewer access on the GA4 property. `ga sync` writes the traffic tables (`gaTrafficSnapshots`, `gaAiReferrals`, `gaSocialReferrals`, `gaTrafficSummaries`) plus the GA4 Search Console landing-page snapshot (`gaSearchLandingWindows`, `gaSearchLandingPages`); every subsequent read command queries the local store rather than re-fetching from GA4, so reads are fast and quotaless. AI-referral rows are sessions GA4 puts in its `AI Assistant` channel (medium `ai-assistant`, since 2026-05-13, not retroactive) plus sessions whose source is an AI engine's host or a subdomain of it (`chatgpt.com`, `www.perplexity.ai`, `gemini.google.com`, `claude.ai`, `copilot.microsoft.com`, `grok.com`, `meta.ai`, `you.com`, …), its bare name (`chatgpt`, `gemini`, `grok`), its official Android app id, bare or as `android-app://` (`com.openai.chatgpt`, `com.microsoft.copilot`), or, for ChatGPT, Perplexity, Claude, DeepSeek and Phind, a tag that starts with the name or host (`perplexity_ai`, `chatgpt.com_ads`). These cover older history and AI visits GA4 files elsewhere. An engine name inside another source is never matched, so unrelated tunnel hosts, `philanthropic.org` and the Gemini exchange stay out. A channel row whose source names no engine is kept under its own source and counted in every AI total; visits that send no referrer still land in Direct. Rows are tracked across three GA4 attribution dimensions (`session` / `first_user` / `manual_utm`; the manual UTM lens matches sources only, since GA4 has no channel for it) and joined to landing pages. Social referrals are split Organic vs Paid via GA4's `sessionDefaultChannelGroup`. Synced rows carry no GA4 property, so anything that changes the property a project resolves to (`ga connect` to another property, `ga disconnect`, or `google disconnect --type ga4` with no service account behind it) deletes the project's GA rows; the next `ga sync` refills them from the new property. All commands support `--format json`.
 
 ```bash
 cnry ga connect <project> --property-id <id> --key-file ./sa-key.json

package/assets/agent-workspace/skills/canonry/references/google-business-profile.md

@@ -106,7 +106,15 @@ Rules that hold for both sources:
 
 Subscribe: `cnry notify add <project> --webhook <url> --events review.negative,review.rating-dropped`. Discord and Slack webhook URLs get a formatted message; any other URL gets the signed JSON payload. The doctor check warns only when a project subscribes to review events and some location has no review source at all; missing v4 access alone reports as skipped, since it is the normal state.
 
-**Account-credential gotcha:** API calls use your **Application Default Credentials** (`gcloud auth application-default login` → `print-access-token`), while `gcloud services enable` uses the separate **gcloud CLI account** (`gcloud config get-value account`). These can be different identities. Verify the token's real account with `curl "https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=$TOKEN"` before concluding anything about access — a "wrong account" symptom is often just the two credential stores disagreeing.
+**Account-credential gotcha:** Application Default Credentials (ADC) and the
+gcloud CLI have separate authentication configurations. An API diagnostic
+using ADC can therefore run as a different identity from `gcloud services
+enable`, which uses the CLI account shown by `gcloud config get-value account`.
+Confirm which credential source the diagnostic uses and which account was
+authorized for it before concluding that API access is missing. If the local
+ADC identity is wrong, have the operator authorize the intended account with
+`gcloud auth application-default login`; changing the CLI's active account
+does not change ADC. See [Google's ADC configuration and search order](https://cloud.google.com/docs/authentication/application-default-credentials).
 
 ### Create OAuth client credentials
 

package/assets/agent-workspace/skills/canonry/references/server-side-traffic.md

@@ -482,39 +482,44 @@ same-origin assets, or the account is on Workers Paid.
 
 ### Excluding static assets from the route
 
-A route with NO script disables Workers on that path, and Cloudflare applies
-the most specific match. This removes the bundle without losing any crawler
-evidence, because crawlers request pages, not JS chunks.
+A route with no Worker assigned bypasses Workers on that path. Cloudflare's
+most-specific-match rule lets an asset route override the broader Canonry
+route. This reduces invocations while retaining page traffic; requests to the
+excluded asset paths are intentionally absent from Canonry's evidence.
 
-```bash
-# assets -> no worker. Omitting "script" is what disables it.
-curl -s -X POST -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \
-  --data '{"pattern":"<host>/_nuxt/*"}' \
-  "https://api.cloudflare.com/client/v4/zones/$ZONE/workers/routes"
+Use the zone's route management or the [Workers Routes API](https://developers.cloudflare.com/api/resources/workers/subresources/routes/methods/create/)
+to create the exclusion. For a Nuxt site, the route creation payload is:
+
+```json
+{"pattern":"<host>/_nuxt/*"}
 ```
 
-Prefixes by framework: `/_nuxt/*` Nuxt, `/_next/*` Next.js, plus `/assets/*`,
-`/static/*`, `/build/*`.
+Replace `<host>` with the canonical hostname and omit `script` so no Worker is
+assigned. Verify the saved route has the intended pattern and no Worker. Keep
+the broader `<host>/*` route assigned to the Canonry Worker. Other asset
+prefixes include `/_next/*` for Next.js, `/assets/*`, `/static/*`, and `/build/*`.
+See [Cloudflare's route matching rules](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
 
 **The Worker's own "Domains and Routes" tab cannot do this.** That screen only
 attaches routes TO that Worker, so adding the asset path there routes assets
-INTO the Worker and doubles the load. Asset exclusion is zone-level: the zone's
-Workers Routes page, or the API above.
+INTO the Worker. Asset exclusion must leave the Worker unassigned, using zone
+route management or the API above.
 
-### Fail open defaults to OFF
+### Verify the route's fail mode
 
-`request_limit_fail_open` is per route and defaults to `false`. Left off, a
-Worker error or an exhausted request allowance returns 5xx for every request on
-that route, which on a catch-all is the whole site. Setting it is not optional
-and it is not the default, so verify rather than assume:
+For a Worker used only to collect traffic, configure the route to **fail open**.
+Cloudflare then bypasses the Worker if the Free account exhausts its daily
+request allowance; fail closed returns a Cloudflare `1027` error page. This
+keeps the origin available while traffic collection is interrupted. A Worker
+that also enforces security needs its own fail-mode decision.
 
-```bash
-curl -s -H "Authorization: Bearer $CF_TOKEN" \
-  "https://api.cloudflare.com/client/v4/zones/$ZONE/workers/routes" \
-  | jq '.result[] | {pattern, script, request_limit_fail_open}'
-```
+In the Cloudflare dashboard, inspect the corresponding route and set its fail
+mode to open, then reopen it to confirm the saved setting. The API's
+`request_limit_fail_open` field represents this route setting; verify it is
+`true` when inspecting route state. Do not infer the setting from a successful
+deployment. See [Cloudflare's daily request limits and route fail modes](https://developers.cloudflare.com/workers/platform/limits/#daily-requests).
 
-Both route operations need `Zone | Workers Routes | Edit` on the token.
+API route changes require `Zone | Workers Routes | Edit` permission.
 
 ```bash
 npm install -g wrangler@latest

package/dist/{backfill-ZSLOPGNJ.js → backfill-6UMNMA5D.js}

@@ -10,8 +10,8 @@ import {
   backfillSnapshotAttributionCommand,
   backfillTrafficClassificationCommand,
   replayQueryAuditLog
-} from "./chunk-JJH55CAR.js";
-import "./chunk-FFPD6DWR.js";
+} from "./chunk-I37MDUG5.js";
+import "./chunk-KIUXAGME.js";
 import "./chunk-PNVI2UYZ.js";
 import "./chunk-HGMYEDAQ.js";
 import "./chunk-QP6RYMZR.js";
@@ -19,7 +19,7 @@ import "./chunk-RIQXJDGZ.js";
 import {
   backfillProjectAnswerMentions,
   backfillProjectAnswerMentionsInChunks
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import "./chunk-VDWTOMU4.js";

package/dist/{chunk-HL64C53O.js → chunk-BYPNVDJE.js}

@@ -5,7 +5,7 @@ import {
   isStoredPageReadTool,
   isStoredReadTool,
   truncateToolResult
-} from "./chunk-NKJLQ6ED.js";
+} from "./chunk-CD7WROGG.js";
 import {
   CANONRY_MCP_TOOLKITS,
   resolveAeroSkillDir

package/dist/{chunk-NKJLQ6ED.js → chunk-CD7WROGG.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   buildOpenApiDocument
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import {
   DEFAULT_COMPETITOR_AUTO_ALIAS_MODE,
   MeasurementPortfolioLists,

package/dist/{chunk-VRDN5TH7.js → chunk-FVA3QBUJ.js}

@@ -17,7 +17,7 @@ import {
   mergeGscQueryTotalsWithFallback,
   readGscQueryDailyRows,
   readLatestGscDataDate
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import {
   competitors,
   gbpDailyMetrics,

package/dist/{chunk-JJH55CAR.js → chunk-I37MDUG5.js}

@@ -8,7 +8,7 @@ import {
   reparseStoredResult4,
   reparseStoredResult5,
   resolveStoredApiResponse
-} from "./chunk-FFPD6DWR.js";
+} from "./chunk-KIUXAGME.js";
 import {
   loadConfig
 } from "./chunk-PNVI2UYZ.js";
@@ -24,7 +24,7 @@ import {
   createRunCompetitorResolver,
   readMarketCompetitorNames,
   refreshSnapshotMentionIdentity
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import {
   RawEventSampleEventTypes,
   auditLog,
@@ -429,7 +429,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
   }
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService } = await import("./intelligence-service-T5DWIMJS.js");
+  const { IntelligenceService } = await import("./intelligence-service-GW55NFVE.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);

package/dist/{chunk-FFPD6DWR.js → chunk-KIUXAGME.js}

@@ -7,7 +7,7 @@ import {
   mergeSplitJourneyVisitors,
   repairAiReferralArrivalsOnStartup,
   writeUnrecognizedAgentBuckets
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import {
   AGENT_TRUST_RULES_VERSION,
   BROWSER_SHAPED_AGENT_MARKERS,

package/dist/{chunk-VNQHCJXG.js → chunk-NBZ7GLTP.js}

@@ -47,7 +47,7 @@ function queueServeHandoff() {
 async function runPendingServeHandoff(format) {
   if (!pendingServeHandoff) return;
   pendingServeHandoff = false;
-  const { serveCommand } = await import("./serve-MH7ZC44A.js");
+  const { serveCommand } = await import("./serve-NHQ4J6IG.js");
   await serveCommand(format);
 }
 

package/dist/{chunk-7VPF373L.js → chunk-RQMGGRIO.js}

@@ -47162,10 +47162,45 @@ function pinnedAgent(addresses) {
 }
 
 // ../api-routes/src/gbp-hotel-policy.ts
+var WORD = String.raw`[\p{L}\p{N}&.'’-]+`;
+var VERB_USES = [
+  /\bdeals?\s+with\b/gu,
+  new RegExp(
+    String.raw`\b(?:does|do|did|will|would|can|could|may|might|should|must|to)\s+(?:not\s+)?(?:${WORD}\s+){0,4}?offer\b`,
+    "gu"
+  ),
+  new RegExp(String.raw`\bwhat\s+(?:${WORD}\s+){0,3}?offers?\b`, "gu"),
+  /\boffers?(?=\s+(?:a|an|the|free|both|several|written|financing|warrant(?:y|ies)|inspections?|services?|repairs?|coverage|options?|support)\b)/gu
+];
+function withoutVerbUses(text) {
+  return VERB_USES.reduce((value, verb) => value.replace(verb, " "), text);
+}
 function hotelEditorialText(value) {
   const text = decodeHTML(value).normalize("NFKC").toLowerCase();
   return text.trim().length > 0 && !/\b(?:offers?|deals?|promotions?|discounts?|coupons?|promo\s*codes?|special\s+rates?|book\s+now|save\s+\d+)\b|\d+\s*%\s*off/iu.test(
-    text
+    withoutVerbUses(text)
+  );
+}
+var PROMOTION = new RegExp(
+  [
+    String.raw`\b(?:promotions?|discounts?|coupons?|promo\s*codes?|special\s+rates?|book\s+now|save\s+\d+)\b`,
+    String.raw`\d+\s*%\s*off`,
+    String.raw`\b(?:special|exclusive|limited[-\s]+time|seasonal|holiday|weekend|package|hot|last[-\s]+minute|early[-\s]+bird|flash|daily|weekly|monthly|travel|room|hotel|stay|spa|dining|best|great|top|our|these|latest|current|view|see|explore|browse|all)\s+(?:offers?|deals?)\b`,
+    String.raw`\b(?:offers?|deals?)\s+(?:end(?:s|ing)?|expire[sd]?|expiring|code)\b`,
+    String.raw`\b(?:deal|offer)\s+of\s+the\s+(?:day|week|month)\b`
+  ].join("|"),
+  "u"
+);
+function promotionFree(value) {
+  return !PROMOTION.test(decodeHTML(value).normalize("NFKC").toLowerCase());
+}
+var TAG = String.raw`<(?:[^"'<>]|"[^"]*"|'[^']*')*>`;
+var SENTENCES = /(<(p|li)\b(?:[^"'<>]|"[^"]*"|'[^']*')*>)([\s\S]*?)(<\/\2\s*>)/giu;
+var SENTENCE_PARTS = new RegExp(String.raw`(<a\b(?:[^"'<>]|"[^"]*"|'[^']*')*>[\s\S]*?<\/a\s*>|${TAG})|[^<]+`, "giu");
+function withoutSentenceText(html) {
+  return html.replace(
+    SENTENCES,
+    (_whole, open, _tag, inner, close) => open + inner.replace(SENTENCE_PARTS, (_part, markup) => markup ?? " ") + close
   );
 }
 var JSON_STRING = /"(?:\\.|[^"\\])*"/gu;
@@ -47264,7 +47299,8 @@ function editorialHtml(html) {
       return `<script${attributes}>${normalized}</script>`;
     }
   );
-  return valid && hotelEditorialText(text) && hotelEditorialText(decodePercentRuns(text));
+  const markup = withoutSentenceText(text);
+  return valid && hotelEditorialText(markup) && hotelEditorialText(decodePercentRuns(markup)) && promotionFree(text) && promotionFree(decodePercentRuns(text));
 }
 async function hotelEditorialDestination(domain, summary3, articleUrl, fetchImpl = createGuardedFetch()) {
   try {

package/dist/{chunk-WQJCGMHW.js → chunk-WOHQNWVO.js}

@@ -728,7 +728,7 @@ var DEMO_CLI_COMMANDS = [{
   options: { host: stringOption(), port: stringOption(), "trust-proxy": multiStringOption() },
   allowPositionals: false,
   run: async (input) => {
-    const { demoCommand } = await import("./demo-JMOSQAAH.js");
+    const { demoCommand } = await import("./demo-PQUQM6D6.js");
     await demoCommand({
       host: getString(input.values, "host"),
       port: getString(input.values, "port"),
@@ -749,7 +749,7 @@ var BACKFILL_CLI_COMMANDS = [
     allowPositionals: false,
     supportsDryRun: true,
     run: async (input) => {
-      const { backfillAnswerVisibilityCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillAnswerVisibilityCommand } = await import("./backfill-6UMNMA5D.js");
       await backfillAnswerVisibilityCommand({
         project: getString(input.values, "project"),
         dryRun: input.dryRun,
@@ -766,7 +766,7 @@ var BACKFILL_CLI_COMMANDS = [
     allowPositionals: false,
     supportsDryRun: true,
     run: async (input) => {
-      const { backfillAnswerMentionsCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillAnswerMentionsCommand } = await import("./backfill-6UMNMA5D.js");
       await backfillAnswerMentionsCommand({
         project: getString(input.values, "project"),
         dryRun: input.dryRun,
@@ -784,7 +784,7 @@ var BACKFILL_CLI_COMMANDS = [
     },
     supportsDryRun: true,
     run: async (input) => {
-      const { backfillInsightsCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillInsightsCommand } = await import("./backfill-6UMNMA5D.js");
       const usage = "canonry backfill insights <project> [--from-run <id>] [--to-run <id>] [--since <date>] [--dry-run] [--format json]";
       const project3 = requireProject(input, "backfill insights", usage);
       await backfillInsightsCommand(project3, {
@@ -804,7 +804,7 @@ var BACKFILL_CLI_COMMANDS = [
     },
     allowPositionals: false,
     run: async (input) => {
-      const { backfillNormalizedPathsCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillNormalizedPathsCommand } = await import("./backfill-6UMNMA5D.js");
       await backfillNormalizedPathsCommand({
         project: getString(input.values, "project"),
         format: input.format
@@ -819,7 +819,7 @@ var BACKFILL_CLI_COMMANDS = [
     },
     allowPositionals: false,
     run: async (input) => {
-      const { backfillAiReferralPathsCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillAiReferralPathsCommand } = await import("./backfill-6UMNMA5D.js");
       await backfillAiReferralPathsCommand({
         project: getString(input.values, "project"),
         format: input.format
@@ -831,7 +831,7 @@ var BACKFILL_CLI_COMMANDS = [
     usage: "canonry backfill snapshot-attribution <project> [--dry-run] [--format json]",
     supportsDryRun: true,
     run: async (input) => {
-      const { backfillSnapshotAttributionCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillSnapshotAttributionCommand } = await import("./backfill-6UMNMA5D.js");
       const usage = "canonry backfill snapshot-attribution <project> [--dry-run] [--format json]";
       const project3 = requireProject(input, "backfill snapshot-attribution", usage);
       await backfillSnapshotAttributionCommand({
@@ -850,7 +850,7 @@ var BACKFILL_CLI_COMMANDS = [
     allowPositionals: false,
     supportsDryRun: true,
     run: async (input) => {
-      const { backfillTrafficClassificationCommand } = await import("./backfill-ZSLOPGNJ.js");
+      const { backfillTrafficClassificationCommand } = await import("./backfill-6UMNMA5D.js");
       await backfillTrafficClassificationCommand({
         project: getString(input.values, "project"),
         dryRun: input.dryRun,
@@ -1494,7 +1494,7 @@ var DASHBOARD_CLI_COMMANDS = [
     usage: "canonry dashboard reset-password [--format json]",
     help: "Clears the dashboard password from config.yaml, so the dashboard asks for a new one after a restart.\nLocal only: it edits the config file under CANONRY_CONFIG_DIR and does not call the server.",
     run: async (input) => {
-      const { resetDashboardPassword } = await import("./dashboard-BC4XZVJW.js");
+      const { resetDashboardPassword } = await import("./dashboard-A2GTXYCN.js");
       await resetDashboardPassword({ format: input.format });
     }
   },
@@ -7161,7 +7161,7 @@ var SYSTEM_CLI_COMMANDS = [
     options: { access: stringOption() },
     run: async (input) => {
       if (input.positionals.length > 1) throw usageError("Expected at most one command group");
-      const [{ printCliCatalog }, { REGISTERED_CLI_COMMANDS: REGISTERED_CLI_COMMANDS2 }] = await Promise.all([import("./cli-catalog-MWRBP7AQ.js"), import("./cli-commands-WPTOQUHN.js")]);
+      const [{ printCliCatalog }, { REGISTERED_CLI_COMMANDS: REGISTERED_CLI_COMMANDS2 }] = await Promise.all([import("./cli-catalog-MWRBP7AQ.js"), import("./cli-commands-WCKKUVFG.js")]);
       printCliCatalog(REGISTERED_CLI_COMMANDS2, input.format, input.positionals[0], getString(input.values, "access"));
     }
   },
@@ -7210,7 +7210,7 @@ var SYSTEM_CLI_COMMANDS = [
     },
     allowPositionals: false,
     run: async (input) => {
-      const { initCommand } = await import("./init-OCKHQ7IL.js");
+      const { initCommand } = await import("./init-T7KF667H.js");
       await initCommand({
         force: getBoolean(input.values, "force"),
         ref: getString(input.values, "ref"),
@@ -7265,7 +7265,7 @@ var SYSTEM_CLI_COMMANDS = [
     allowPositionals: false,
     run: async (input) => {
       applyServerEnv(input.values);
-      const { serveCommand } = await import("./serve-MH7ZC44A.js");
+      const { serveCommand } = await import("./serve-NHQ4J6IG.js");
       await serveCommand(input.format);
     }
   },
@@ -8657,8 +8657,8 @@ var AGENT_CLI_COMMANDS = [
       "timeout-ms": stringOption()
     },
     run: async (input) => {
-      const { coerceAgentProvider } = await import("./session-P6STOUZI.js");
-      const { AERO_TOOL_PROFILES, isAeroToolProfile } = await import("./tools-AJWV72XT.js");
+      const { coerceAgentProvider } = await import("./session-L4CT3XZQ.js");
+      const { AERO_TOOL_PROFILES, isAeroToolProfile } = await import("./tools-OIVQXP5C.js");
       const { agentAsk } = await import("./agent-ask-ATVWKFBN.js");
       const usage = `canonry agent ask <project> "<prompt>" [--provider ${AGENT_PROVIDER_IDS.join("|")}] [--model <id>] [--scope all|read-only] [--profile default|ads-operator] [--context <json>] [--conversation <id>] [--max-tool-calls <n>] [--timeout-ms <ms>] [--format json]`;
       const project3 = requireProject(input, "agent.ask", usage);

package/dist/{chunk-PL5T2LOA.js → chunk-XJQNALKR.js}

@@ -27,14 +27,14 @@ import {
   resolveConfiguredAgentProvider,
   resolveSessionProviderAndModel,
   setAeroSystemPrompt
-} from "./chunk-HL64C53O.js";
+} from "./chunk-BYPNVDJE.js";
 import {
   AeroToolProfiles,
   AeroToolScopes,
   buildAeroStateTools,
   isAeroToolProfile,
   truncateToolResult
-} from "./chunk-NKJLQ6ED.js";
+} from "./chunk-CD7WROGG.js";
 import {
   getGoogleAuthConfig,
   getGoogleConnection,
@@ -65,7 +65,7 @@ import {
   openrouterAdapter,
   perplexityAdapter,
   startTrafficReclassification
-} from "./chunk-FFPD6DWR.js";
+} from "./chunk-KIUXAGME.js";
 import {
   classifyUsageSurface,
   createApiUsageTelemetry,
@@ -162,7 +162,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   IntelligenceService
-} from "./chunk-VRDN5TH7.js";
+} from "./chunk-FVA3QBUJ.js";
 import {
   computeCitedCompetitorDomains,
   determineCitationState
@@ -316,7 +316,7 @@ import {
   webhookResponseReason,
   webhookTargetRefusalReason,
   writeAuditLog
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import {
   OperationalLogStore,
   SentimentIdempotencyConflict,
@@ -5980,7 +5980,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "f5d4612e23d2b1f0e5f46b217245359125c52a80" : void 0;
+  const embedded = true ? "c9c5d088f29e5bd2401d84d2b77d8720e9360728" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {

package/dist/{cli-commands-WPTOQUHN.js → cli-commands-WCKKUVFG.js}

@@ -1,6 +1,6 @@
 import {
   REGISTERED_CLI_COMMANDS
-} from "./chunk-WQJCGMHW.js";
+} from "./chunk-WOHQNWVO.js";
 import "./chunk-6GO5VVAC.js";
 import "./chunk-VJWDBFSL.js";
 import "./chunk-DVIZZYL5.js";

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node --import tsx
 import {
   REGISTERED_CLI_COMMANDS
-} from "./chunk-WQJCGMHW.js";
+} from "./chunk-WOHQNWVO.js";
 import "./chunk-6GO5VVAC.js";
 import {
   buildSetupState,
   runPendingServeHandoff
-} from "./chunk-VNQHCJXG.js";
+} from "./chunk-NBZ7GLTP.js";
 import "./chunk-VJWDBFSL.js";
 import "./chunk-DVIZZYL5.js";
 import "./chunk-TSENU4GG.js";

package/dist/{dashboard-BC4XZVJW.js → dashboard-A2GTXYCN.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   anyUsersExist
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import {

package/dist/{demo-JMOSQAAH.js → demo-PQUQM6D6.js}

@@ -40,7 +40,7 @@ function parseDemoTrustedProxies(values) {
 async function demoCommand(options) {
   const { host, port } = parseDemoListenOptions(options);
   const trustProxy = parseDemoTrustedProxies(options.trustProxy);
-  const { createDemoServer } = await import("./demo-server-YPDXH7HV.js");
+  const { createDemoServer } = await import("./demo-server-2EIJCN6D.js");
   const app = await createDemoServer({ trustProxy });
   let stopping = false;
   const stop = () => {

package/dist/{demo-server-YPDXH7HV.js → demo-server-2EIJCN6D.js}

@@ -18,7 +18,7 @@ import "./chunk-HGMYEDAQ.js";
 import {
   HISTORY_WINDOW_RUNS,
   IntelligenceService
-} from "./chunk-VRDN5TH7.js";
+} from "./chunk-FVA3QBUJ.js";
 import {
   determineCitationState
 } from "./chunk-QP6RYMZR.js";
@@ -26,7 +26,7 @@ import "./chunk-RIQXJDGZ.js";
 import {
   apiRoutes,
   assessConversionTrackingIntegrity
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import {

package/dist/index.js

@@ -3,14 +3,14 @@ import {
   createGoogleMarketingCredentialStore,
   createGoogleMarketingRuntime,
   createServer
-} from "./chunk-PL5T2LOA.js";
+} from "./chunk-XJQNALKR.js";
 import "./chunk-M6OBSGWD.js";
-import "./chunk-HL64C53O.js";
-import "./chunk-NKJLQ6ED.js";
+import "./chunk-BYPNVDJE.js";
+import "./chunk-CD7WROGG.js";
 import "./chunk-ELCLGWUT.js";
 import "./chunk-XEBKF4N5.js";
 import "./chunk-YL3ZBKBV.js";
-import "./chunk-FFPD6DWR.js";
+import "./chunk-KIUXAGME.js";
 import "./chunk-F2O75EG3.js";
 import "./chunk-TSENU4GG.js";
 import "./chunk-Z57QUHG6.js";
@@ -28,10 +28,10 @@ import "./chunk-GSQR574F.js";
 import "./chunk-SKXOS5YA.js";
 import "./chunk-AOJU5LKX.js";
 import "./chunk-HGMYEDAQ.js";
-import "./chunk-VRDN5TH7.js";
+import "./chunk-FVA3QBUJ.js";
 import "./chunk-QP6RYMZR.js";
 import "./chunk-RIQXJDGZ.js";
-import "./chunk-7VPF373L.js";
+import "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import "./chunk-VDWTOMU4.js";

package/dist/{init-OCKHQ7IL.js → init-T7KF667H.js}

@@ -7,7 +7,7 @@ import {
 import {
   buildSetupState,
   queueServeHandoff
-} from "./chunk-VNQHCJXG.js";
+} from "./chunk-NBZ7GLTP.js";
 import "./chunk-VJWDBFSL.js";
 import "./chunk-F2O75EG3.js";
 import "./chunk-Z57QUHG6.js";

package/dist/{intelligence-service-T5DWIMJS.js → intelligence-service-GW55NFVE.js}

@@ -1,10 +1,10 @@
 import {
   HISTORY_WINDOW_RUNS,
   IntelligenceService
-} from "./chunk-VRDN5TH7.js";
+} from "./chunk-FVA3QBUJ.js";
 import "./chunk-QP6RYMZR.js";
 import "./chunk-RIQXJDGZ.js";
-import "./chunk-7VPF373L.js";
+import "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import "./chunk-VDWTOMU4.js";

package/dist/{serve-MH7ZC44A.js → serve-NHQ4J6IG.js}

@@ -1,7 +1,7 @@
 import {
   backfillAiReferralPaths,
   backfillNormalizedPaths
-} from "./chunk-JJH55CAR.js";
+} from "./chunk-I37MDUG5.js";
 import {
   operatorHttpUrl
 } from "./chunk-6GO5VVAC.js";
@@ -9,14 +9,14 @@ import {
   allowsKeylessFirstRunSetup,
   createServer,
   waitForServerRuntimeStartup
-} from "./chunk-PL5T2LOA.js";
+} from "./chunk-XJQNALKR.js";
 import "./chunk-M6OBSGWD.js";
-import "./chunk-HL64C53O.js";
-import "./chunk-NKJLQ6ED.js";
+import "./chunk-BYPNVDJE.js";
+import "./chunk-CD7WROGG.js";
 import "./chunk-ELCLGWUT.js";
 import "./chunk-XEBKF4N5.js";
 import "./chunk-YL3ZBKBV.js";
-import "./chunk-FFPD6DWR.js";
+import "./chunk-KIUXAGME.js";
 import {
   trackFeatureCompleted
 } from "./chunk-F2O75EG3.js";
@@ -57,13 +57,13 @@ import {
   CliError,
   isMachineFormat
 } from "./chunk-HGMYEDAQ.js";
-import "./chunk-VRDN5TH7.js";
+import "./chunk-FVA3QBUJ.js";
 import "./chunk-QP6RYMZR.js";
 import "./chunk-RIQXJDGZ.js";
 import {
   refreshSnapshotMentionIdentity,
   snapshotsWithSentimentResults
-} from "./chunk-7VPF373L.js";
+} from "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import {

package/dist/{session-P6STOUZI.js → session-L4CT3XZQ.js}

@@ -9,8 +9,8 @@ import {
   resolveAeroModel,
   resolveConfiguredAgentProvider,
   resolveSessionProviderAndModel
-} from "./chunk-HL64C53O.js";
-import "./chunk-NKJLQ6ED.js";
+} from "./chunk-BYPNVDJE.js";
+import "./chunk-CD7WROGG.js";
 import {
   resolveAeroSkillDir
 } from "./chunk-MTW37GXF.js";
@@ -26,7 +26,7 @@ import "./chunk-SKXOS5YA.js";
 import "./chunk-AOJU5LKX.js";
 import "./chunk-HGMYEDAQ.js";
 import "./chunk-RIQXJDGZ.js";
-import "./chunk-7VPF373L.js";
+import "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import "./chunk-VDWTOMU4.js";

package/dist/{tools-AJWV72XT.js → tools-OIVQXP5C.js}

@@ -11,7 +11,7 @@ import {
   buildAllTools,
   buildReadTools,
   isAeroToolProfile
-} from "./chunk-NKJLQ6ED.js";
+} from "./chunk-CD7WROGG.js";
 import "./chunk-RXWISYNN.js";
 import "./chunk-PNVI2UYZ.js";
 import "./chunk-BUTOZPE7.js";
@@ -19,7 +19,7 @@ import "./chunk-GSQR574F.js";
 import "./chunk-SKXOS5YA.js";
 import "./chunk-AOJU5LKX.js";
 import "./chunk-HGMYEDAQ.js";
-import "./chunk-7VPF373L.js";
+import "./chunk-RQMGGRIO.js";
 import "./chunk-6TIJFZX5.js";
 import "./chunk-D4ABSOQG.js";
 import "./chunk-VDWTOMU4.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "7.97.0",
+  "version": "7.97.2",
   "type": "module",
   "description": "Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.",
   "keywords": [