@canonry/canonry 4.147.0 → 4.148.0

package/dist/{chunk-BVOU4UJM.js → chunk-43XIYBG4.js}

@@ -5436,6 +5436,14 @@ var apiKeyDtoSchema = z9.object({
    * scoped key may only read/write its own project (enforced server-side).
    */
   projectId: z9.string().nullable(),
+  /**
+   * The scoped project's name, or `null` for a full-instance key. Resolved
+   * server-side so a surface listing keys does not have to fetch every project
+   * to turn an id into something a person can read — the id alone cannot answer
+   * "is this key safe to hand to someone", which is the question the list is
+   * usually open to answer. Additive field.
+   */
+  projectName: z9.string().nullable(),
   /**
    * Server-derived convenience flag: `true` when this key is read-only (carries
    * the `read` scope and no write-granting scope), in which case the API rejects

package/dist/{chunk-ZDYS24LW.js → chunk-MHTZ4THA.js}

@@ -10,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-4BL24FQA.js";
+} from "./chunk-3HYF3LUP.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -126,7 +126,7 @@ import {
   siteAuditSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-DRDNHYIF.js";
+} from "./chunk-VUTKHFTM.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -217,7 +217,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-BVOU4UJM.js";
+} from "./chunk-43XIYBG4.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -7420,7 +7420,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-7CGZ537D.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-OGOGIQJD.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -13885,6 +13885,9 @@ async function createServer(opts) {
       if (!dashboardShowUpdateNotification) {
         dashboardConfig.showUpdateNotification = false;
       }
+      if (!agentEnabled) {
+        dashboardConfig.showAgentBar = false;
+      }
       if (Object.keys(dashboardConfig).length > 0) {
         clientConfig.dashboard = dashboardConfig;
       }

package/dist/{chunk-DRDNHYIF.js → chunk-VUTKHFTM.js}

@@ -517,7 +517,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-BVOU4UJM.js";
+} from "./chunk-43XIYBG4.js";
 
 // src/intelligence-service.ts
 import { eq as eq57, desc as desc26, asc as asc11, and as and45, ne as ne7, or as or11, inArray as inArray19, gte as gte13, lte as lte10 } from "drizzle-orm";
@@ -5037,6 +5037,20 @@ var MIGRATION_VERSIONS = [
       `CREATE INDEX IF NOT EXISTS idx_measurement_operation_receipts_expires
         ON measurement_operation_receipts(expires_at)`
     ]
+  },
+  {
+    version: 124,
+    name: "measurement-foundation-named-indexes",
+    statements: [
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_measurement_plan_versions_project_revision
+        ON measurement_plan_versions(project_id, revision)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_measurement_plan_versions_project_id
+        ON measurement_plan_versions(project_id, id)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_measurement_segments_project_key
+        ON measurement_segments(project_id, stable_key)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_measurement_segments_project_id
+        ON measurement_segments(project_id, id)`
+    ]
   }
 ];
 function addRunsMeasurementPlanVersionForeignKey(tx) {
@@ -32713,26 +32727,32 @@ function buildOperationId(method, path8) {
 import crypto22 from "crypto";
 import { desc as desc16, eq as eq35 } from "drizzle-orm";
 var KEYS_WRITE_SCOPE = "keys.write";
-function toApiKeyDto(row) {
+function toApiKeyDto(row, projectNames) {
   const scopes = Array.isArray(row.scopes) ? row.scopes : [];
+  const projectId = row.projectId ?? null;
   return {
     id: row.id,
     name: row.name,
     keyPrefix: row.keyPrefix,
     scopes,
-    projectId: row.projectId ?? null,
+    projectId,
+    projectName: projectId ? projectNames.get(projectId) ?? null : null,
     readOnly: isReadOnlyKey(scopes),
     createdAt: row.createdAt,
     lastUsedAt: row.lastUsedAt ?? null,
     revokedAt: row.revokedAt ?? null
   };
 }
+function projectNameById(db) {
+  return new Map(db.select().from(projects).all().map((p) => [p.id, p.name]));
+}
 async function keysRoutes(app) {
   app.get("/keys", async (request) => {
     requireAdminSession(request);
     const scopedProjectId = request.apiKey?.projectId;
     const rows = scopedProjectId ? app.db.select().from(apiKeys).where(eq35(apiKeys.projectId, scopedProjectId)).orderBy(desc16(apiKeys.createdAt)).all() : app.db.select().from(apiKeys).orderBy(desc16(apiKeys.createdAt)).all();
-    return { keys: rows.map(toApiKeyDto) };
+    const names = projectNameById(app.db);
+    return { keys: rows.map((row) => toApiKeyDto(row, names)) };
   });
   app.get("/keys/self", async (request) => {
     const id = request.apiKey?.id;
@@ -32743,7 +32763,7 @@ async function keysRoutes(app) {
     if (!row) {
       throw notFound("API key", id);
     }
-    return toApiKeyDto(row);
+    return toApiKeyDto(row, projectNameById(app.db));
   });
   app.post("/keys", async (request) => {
     requireAdminSession(request);
@@ -32793,6 +32813,9 @@ async function keysRoutes(app) {
       keyPrefix,
       scopes: effectiveScopes,
       projectId: projectId ?? null,
+      // Resolved from the project the caller just named, so the response says
+      // what the key reaches without a second round trip.
+      projectName: projectId ? projectNameById(app.db).get(projectId) ?? null : null,
       readOnly: isReadOnlyKey(effectiveScopes),
       createdAt: now,
       lastUsedAt: null,
@@ -32817,7 +32840,7 @@ async function keysRoutes(app) {
       throw forbidden("A project-scoped key can only revoke keys scoped to its own project.");
     }
     if (row.revokedAt) {
-      return toApiKeyDto(row);
+      return toApiKeyDto(row, projectNameById(app.db));
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     app.db.transaction((tx) => {
@@ -32830,7 +32853,7 @@ async function keysRoutes(app) {
         diff: { name: row.name, keyPrefix: row.keyPrefix }
       }));
     });
-    return toApiKeyDto({ ...row, revokedAt: now });
+    return toApiKeyDto({ ...row, revokedAt: now }, projectNameById(app.db));
   });
 }
 
@@ -33795,7 +33818,8 @@ async function exchangeCode(clientId, clientSecret, code, redirectUri) {
         detail += detail ? `: ${sanitized}` : sanitized;
       }
     } catch {
-      detail = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
+      const truncated = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
+      detail = truncated.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(code), "g"), "***");
     }
     throw new GoogleAuthError(`Token exchange failed (${res.status}): ${detail}`);
   }
@@ -33833,7 +33857,8 @@ async function refreshAccessToken(clientId, clientSecret, currentRefreshToken) {
         detail += detail ? `: ${sanitized}` : sanitized;
       }
     } catch {
-      detail = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
+      const truncated = body.length <= 120 ? body : `${body.slice(0, 120)}...`;
+      detail = truncated.replace(new RegExp(escapeRegExp(clientId), "g"), "***").replace(new RegExp(escapeRegExp(clientSecret), "g"), "***").replace(new RegExp(escapeRegExp(currentRefreshToken), "g"), "***");
     }
     throw new GoogleAuthError(`Token refresh failed (${res.status}): ${detail}`);
   }
@@ -33923,6 +33948,9 @@ function gscClientLog(level, action, ctx) {
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
+function escapeRegExp2(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 async function gscFetchResponse(accessToken, url, opts) {
   const method = opts?.method ?? "GET";
   const headers = {
@@ -33947,7 +33975,11 @@ async function gscFetchResponse(accessToken, url, opts) {
     const body = await res.text();
     gscClientLog("error", "http.error", { url, method, httpStatus: res.status });
     const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-    throw new GoogleApiError(`GSC API error (${res.status}): ${detail}`, res.status);
+    let sanitizedDetail = detail;
+    if (accessToken) {
+      sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp2(accessToken), "g"), "***");
+    }
+    throw new GoogleApiError(`GSC API error (${res.status}): ${sanitizedDetail}`, res.status);
   }
   return res;
 }
@@ -34206,13 +34238,13 @@ async function getAccessToken(clientEmail, privateKey) {
     const body = await res.text().catch(() => "");
     ga4Log("error", "token.failed", { httpStatus: res.status });
     const detail = body.length <= 200 ? body : `${body.slice(0, 200)}... [truncated]`;
-    const sanitizedDetail = detail.replace(new RegExp(escapeRegExp2(clientEmail), "g"), "***").replace(new RegExp(escapeRegExp2(privateKey.slice(0, 32)), "g"), "***");
+    const sanitizedDetail = detail.replace(new RegExp(escapeRegExp3(clientEmail), "g"), "***").replace(new RegExp(escapeRegExp3(privateKey.slice(0, 32)), "g"), "***");
     throw new GA4ApiError(`Failed to get access token: ${sanitizedDetail}`, res.status);
   }
   const data = await res.json();
   return data.access_token;
 }
-function escapeRegExp2(str) {
+function escapeRegExp3(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var gaInFlight = 0;
@@ -34315,9 +34347,13 @@ async function runReport(accessToken, propertyId, request) {
       } catch {
         if (body.length < 200) detail = ` ${body}`;
       }
+      let sanitizedDetail = detail;
+      if (accessToken) {
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+      }
       ga4Log("error", "report.auth-failed", { propertyId, httpStatus: res.status });
       throw new GA4ApiError(
-        `GA4 API authentication failed \u2014 check service account permissions.${detail}`,
+        `GA4 API authentication failed \u2014 check service account permissions.${sanitizedDetail}`,
         res.status
       );
     }
@@ -34331,7 +34367,11 @@ async function runReport(accessToken, propertyId, request) {
       const retryAfterSeconds = res.status >= 500 ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
       ga4Log("error", "report.error", { propertyId, httpStatus: res.status, retryAfterSeconds });
       const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-      throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status, retryAfterSeconds);
+      let sanitizedDetail = detail;
+      if (accessToken) {
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+      }
+      throw new GA4ApiError(`GA4 API error (${res.status}): ${sanitizedDetail}`, res.status, retryAfterSeconds);
     }
     return await res.json();
   }, "report"));
@@ -34351,8 +34391,12 @@ async function batchRunReports(accessToken, propertyId, requests) {
     if (res.status === 401 || res.status === 403) {
       const body = await res.text().catch(() => "");
       ga4Log("error", "batch-report.auth-failed", { propertyId, httpStatus: res.status });
+      let sanitizedDetail = body;
+      if (accessToken) {
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+      }
       throw new GA4ApiError(
-        `GA4 API authentication failed \u2014 check service account permissions. ${body}`,
+        `GA4 API authentication failed \u2014 check service account permissions. ${sanitizedDetail}`,
         res.status
       );
     }
@@ -34366,7 +34410,11 @@ async function batchRunReports(accessToken, propertyId, requests) {
       const retryAfterSeconds = res.status >= 500 ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
       ga4Log("error", "batch-report.error", { propertyId, httpStatus: res.status, retryAfterSeconds });
       const detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-      throw new GA4ApiError(`GA4 API error (${res.status}): ${detail}`, res.status, retryAfterSeconds);
+      let sanitizedDetail = detail;
+      if (accessToken) {
+        sanitizedDetail = sanitizedDetail.replace(new RegExp(escapeRegExp3(accessToken), "g"), "***");
+      }
+      throw new GA4ApiError(`GA4 API error (${res.status}): ${sanitizedDetail}`, res.status, retryAfterSeconds);
     }
     const data = await res.json();
     return data.reports;
@@ -41701,7 +41749,7 @@ function bingClientLog(level, action, ctx) {
   const stream = level === "error" ? process.stderr : process.stdout;
   stream.write(JSON.stringify(entry) + "\n");
 }
-function escapeRegExp3(str) {
+function escapeRegExp4(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function bingFetch(apiKey, endpoint, opts) {
@@ -41729,7 +41777,7 @@ async function bingFetch(apiKey, endpoint, opts) {
     const body = await res.text();
     bingClientLog("error", "http.error", { endpoint, method, httpStatus: res.status });
     let detail = body.length <= 500 ? body : `${body.slice(0, 500)}... [truncated]`;
-    detail = detail.replace(new RegExp(escapeRegExp3(apiKey), "g"), "***");
+    detail = detail.replace(new RegExp(escapeRegExp4(apiKey), "g"), "***");
     throw new BingApiError(`Bing API error (${res.status}): ${detail}`, res.status);
   }
   const text2 = await res.text();
@@ -43938,7 +43986,14 @@ async function fetchJson(connection, siteUrl, path8, init) {
   }
   if (!res.ok) {
     const text2 = await res.text().catch(() => "");
-    throw new WordpressApiError("UPSTREAM_ERROR", `WordPress API error (${res.status}): ${text2 || res.statusText}`, res.status);
+    let detail = text2 || res.statusText;
+    if (connection.appPassword) {
+      detail = detail.replace(new RegExp(escapeRegExp5(connection.appPassword), "g"), "***");
+    }
+    if (connection.username) {
+      detail = detail.replace(new RegExp(escapeRegExp5(connection.username), "g"), "***");
+    }
+    throw new WordpressApiError("UPSTREAM_ERROR", `WordPress API error (${res.status}): ${detail}`, res.status);
   }
   return {
     body: await res.json(),
@@ -44431,12 +44486,12 @@ var CANONRY_SCHEMA_START = "<!-- canonry:schema:start -->";
 var CANONRY_SCHEMA_END = "<!-- canonry:schema:end -->";
 function stripCanonrySchema(content) {
   const regex = new RegExp(
-    `${escapeRegExp4(CANONRY_SCHEMA_START)}[\\s\\S]*?${escapeRegExp4(CANONRY_SCHEMA_END)}`,
+    `${escapeRegExp5(CANONRY_SCHEMA_START)}[\\s\\S]*?${escapeRegExp5(CANONRY_SCHEMA_END)}`,
     "g"
   );
   return content.replace(regex, "").replace(/\n{3,}/g, "\n\n").trim();
 }
-function escapeRegExp4(str) {
+function escapeRegExp5(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function injectCanonrySchema(content, schemas) {
@@ -44543,7 +44598,7 @@ async function getSchemaStatus(connection, env) {
     const thirdPartySchemas = [];
     if (hasCanonryMarker) {
       const markerRegex = new RegExp(
-        `${escapeRegExp4(CANONRY_SCHEMA_START)}([\\s\\S]*?)${escapeRegExp4(CANONRY_SCHEMA_END)}`
+        `${escapeRegExp5(CANONRY_SCHEMA_START)}([\\s\\S]*?)${escapeRegExp5(CANONRY_SCHEMA_END)}`
       );
       const match = markerRegex.exec(rawContent);
       if (match?.[1]) {

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-ZDYS24LW.js";
+} from "./chunk-MHTZ4THA.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -43,12 +43,14 @@ import {
   isMachineFormat,
   loadConfig,
   loadConfigRaw,
+  measurementDraftOperationSchema,
   printCliError,
+  runMeasurementDraftAction,
   saveConfig,
   saveConfigPatch,
   systemError,
   usageError
-} from "./chunk-4BL24FQA.js";
+} from "./chunk-3HYF3LUP.js";
 import {
   apiKeys,
   createClient,
@@ -56,7 +58,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-DRDNHYIF.js";
+} from "./chunk-VUTKHFTM.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -100,15 +102,27 @@ import {
   formatMicros,
   formatRatio,
   formatRunErrorOneLine,
+  measurementChangesQuerySchema,
+  measurementDataQualityQuerySchema,
   measurementDiscoveryRequestSchema,
   measurementDiscoveryRuleSchema,
+  measurementDraftCollectionQuerySchema,
+  measurementOverviewQuerySchema,
+  measurementPlanDeactivateRequestSchema,
   measurementPlanInputSchema,
+  measurementPortfolioSummaryQuerySchema,
+  measurementPropertyCompetitorsQuerySchema,
+  measurementPropertyQuestionsQuerySchema,
+  measurementQuerySetUpsertRequestSchema,
+  measurementQueryTemplateApplyRequestSchema,
+  measurementQueryTemplateUpsertRequestSchema,
+  measurementQuestionResultQuerySchema,
   normalizeProjectAliases,
   notificationEventSchema,
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-BVOU4UJM.js";
+} from "./chunk-43XIYBG4.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -7423,16 +7437,21 @@ async function listApiKeys(format) {
     return;
   }
   console.log(
-    `${"NAME".padEnd(20)} ${"PREFIX".padEnd(11)} ${"SCOPES".padEnd(20)} ${"CREATED".padEnd(12)} ${"LAST USED".padEnd(12)} STATUS`
+    `${"NAME".padEnd(20)} ${"PREFIX".padEnd(11)} ${"SCOPES".padEnd(20)} ${"REACH".padEnd(18)} ${"CREATED".padEnd(12)} ${"LAST USED".padEnd(12)} STATUS`
   );
   for (const key of keys) {
     const scopes = key.scopes.join(",");
     const lastUsed = key.lastUsedAt ? formatIsoDate(key.lastUsedAt) : "\u2014";
     console.log(
-      `${key.name.padEnd(20)} ${key.keyPrefix.padEnd(11)} ${scopes.padEnd(20)} ${formatIsoDate(key.createdAt).padEnd(12)} ${lastUsed.padEnd(12)} ${keyStatus(key)}`
+      `${key.name.padEnd(20)} ${key.keyPrefix.padEnd(11)} ${scopes.padEnd(20)} ${keyReach(key).padEnd(18)} ${formatIsoDate(key.createdAt).padEnd(12)} ${lastUsed.padEnd(12)} ${keyStatus(key)}`
     );
   }
 }
+function keyReach(key) {
+  if (!key.projectId) return "full instance";
+  if (typeof key.projectName === "string") return key.projectName;
+  return key.projectName === null ? "(deleted project)" : key.projectId.slice(0, 8);
+}
 async function createApiKey(opts) {
   const explicitScopes = opts.scopes && opts.scopes.length > 0 ? opts.scopes : void 0;
   if (opts.readOnly && explicitScopes) {
@@ -7461,7 +7480,7 @@ async function createApiKey(opts) {
   console.log(`  Prefix:    ${created.keyPrefix}`);
   console.log(`  Scopes:    ${created.scopes.join(", ")}`);
   console.log(`  Read-only: ${created.readOnly ? "yes" : "no"}`);
-  console.log(`  Project:   ${opts.project ?? "(full instance)"}`);
+  console.log(`  Reach:     ${keyReach(created)}`);
   console.log("\nSave this now \u2014 it will not be shown again.");
 }
 async function showApiKeySelf(format) {
@@ -7474,6 +7493,7 @@ async function showApiKeySelf(format) {
   console.log(`API key "${key.name}" (${key.keyPrefix})`);
   console.log(`  Scopes:    ${key.scopes.join(", ")}`);
   console.log(`  Read-only: ${key.readOnly ? "yes" : "no"}`);
+  console.log(`  Reach:     ${keyReach(key)}`);
   console.log(`  Status:    ${keyStatus(key)}`);
 }
 async function revokeApiKey(id, format) {
@@ -15719,6 +15739,7 @@ Usage: ${usage}`, {
 import crypto3 from "crypto";
 import fs16 from "fs";
 import { parse } from "yaml";
+import { z as z2 } from "zod";
 function readPlan(source) {
   const content = source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
@@ -15729,6 +15750,171 @@ function readDiscoveryRule(source) {
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
   return measurementDiscoveryRuleSchema.parse(parsed);
 }
+var ADVANCED_MEASUREMENT_OPERATIONS = [
+  "setup",
+  "overview",
+  "portfolio-summary",
+  "property-questions",
+  "question-result",
+  "property-competitors",
+  "changes",
+  "data-quality",
+  "draft",
+  "draft-targets",
+  "draft-assignments",
+  "draft-groups",
+  "draft-action",
+  "deactivate",
+  "query-sets",
+  "query-set-get",
+  "query-set-upsert",
+  "query-set-delete",
+  "query-templates",
+  "query-template-upsert",
+  "query-template-delete",
+  "query-template-apply"
+];
+var advancedIdempotencyKeySchema = z2.string().trim().min(1);
+var advancedResourceIdSchema = z2.string().trim().min(1);
+var advancedEmptyInputSchema = z2.object({}).strict();
+var advancedQuerySetInputSchema = z2.object({ setId: advancedResourceIdSchema }).strict();
+var advancedQuerySetUpsertInputSchema = advancedQuerySetInputSchema.extend({
+  request: measurementQuerySetUpsertRequestSchema
+}).strict();
+var advancedQueryTemplateInputSchema = z2.object({ templateId: advancedResourceIdSchema }).strict();
+var advancedQueryTemplateUpsertInputSchema = advancedQueryTemplateInputSchema.extend({
+  request: measurementQueryTemplateUpsertRequestSchema
+}).strict();
+var advancedQueryTemplateApplyInputSchema = advancedQueryTemplateInputSchema.extend({
+  request: measurementQueryTemplateApplyRequestSchema,
+  idempotencyKey: advancedIdempotencyKeySchema
+}).strict();
+var advancedDeactivateInputSchema = z2.object({
+  request: measurementPlanDeactivateRequestSchema,
+  idempotencyKey: advancedIdempotencyKeySchema
+}).strict();
+function readAdvancedMeasurementInput(source) {
+  if (source === void 0) return {};
+  const content = source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
+  return JSON.parse(content);
+}
+var advancedMeasurementCollectionKeys = {
+  "draft-targets": "items",
+  "draft-assignments": "items",
+  "draft-groups": "items",
+  "query-sets": "querySets",
+  "query-templates": "templates"
+};
+function isAdvancedMeasurementCollectionOperation(operation) {
+  return operation === "draft-targets" || operation === "draft-assignments" || operation === "draft-groups" || operation === "query-sets" || operation === "query-templates";
+}
+function emitAdvancedMeasurementJsonl(operation, result) {
+  if (!isAdvancedMeasurementCollectionOperation(operation) || typeof result !== "object" || result === null || Array.isArray(result)) return false;
+  const collectionKey = advancedMeasurementCollectionKeys[operation];
+  const envelope = result;
+  const candidateRows = envelope[collectionKey];
+  if (!Array.isArray(candidateRows)) return false;
+  const context = {};
+  for (const [key, value] of Object.entries(envelope)) {
+    if (key !== collectionKey) context[key] = value;
+  }
+  emitJsonl([{ kind: "measurement-advanced-header", operation, ...context }]);
+  emitJsonl(candidateRows.map((row) => row));
+  return true;
+}
+async function runAdvancedMeasurementOperation(project, operation, source, format) {
+  const input = readAdvancedMeasurementInput(source);
+  const client = createApiClient();
+  let result;
+  switch (operation) {
+    case "setup":
+      advancedEmptyInputSchema.parse(input);
+      result = await client.getMeasurementSetup(project);
+      break;
+    case "overview":
+      result = await client.getMeasurementOverview(project, measurementOverviewQuerySchema.parse(input));
+      break;
+    case "portfolio-summary":
+      result = await client.getMeasurementPortfolioSummary(project, measurementPortfolioSummaryQuerySchema.parse(input));
+      break;
+    case "property-questions":
+      result = await client.getMeasurementPropertyQuestions(project, measurementPropertyQuestionsQuerySchema.parse(input));
+      break;
+    case "question-result":
+      result = await client.getMeasurementQuestionResult(project, measurementQuestionResultQuerySchema.parse(input));
+      break;
+    case "property-competitors":
+      result = await client.getMeasurementPropertyCompetitors(project, measurementPropertyCompetitorsQuerySchema.parse(input));
+      break;
+    case "changes":
+      result = await client.getMeasurementChanges(project, measurementChangesQuerySchema.parse(input));
+      break;
+    case "data-quality":
+      result = await client.getMeasurementDataQuality(project, measurementDataQualityQuerySchema.parse(input));
+      break;
+    case "draft":
+      advancedEmptyInputSchema.parse(input);
+      result = await client.getMeasurementPlanDraft(project);
+      break;
+    case "draft-targets":
+      result = await client.getMeasurementDraftTargets(project, measurementDraftCollectionQuerySchema.parse(input));
+      break;
+    case "draft-assignments":
+      result = await client.getMeasurementDraftAssignments(project, measurementDraftCollectionQuerySchema.parse(input));
+      break;
+    case "draft-groups":
+      result = await client.getMeasurementDraftGroups(project, measurementDraftCollectionQuerySchema.parse(input));
+      break;
+    case "draft-action":
+      result = await runMeasurementDraftAction(client, project, measurementDraftOperationSchema.parse(input));
+      break;
+    case "deactivate": {
+      const parsed = advancedDeactivateInputSchema.parse(input);
+      result = await client.deactivateMeasurementPlan(project, parsed.request, parsed.idempotencyKey);
+      break;
+    }
+    case "query-sets":
+      advancedEmptyInputSchema.parse(input);
+      result = await client.listMeasurementQuerySets(project);
+      break;
+    case "query-set-get": {
+      const parsed = advancedQuerySetInputSchema.parse(input);
+      result = await client.getMeasurementQuerySet(project, parsed.setId);
+      break;
+    }
+    case "query-set-upsert": {
+      const parsed = advancedQuerySetUpsertInputSchema.parse(input);
+      result = await client.upsertMeasurementQuerySet(project, parsed.setId, parsed.request);
+      break;
+    }
+    case "query-set-delete": {
+      const parsed = advancedQuerySetInputSchema.parse(input);
+      result = await client.deleteMeasurementQuerySet(project, parsed.setId);
+      break;
+    }
+    case "query-templates":
+      advancedEmptyInputSchema.parse(input);
+      result = await client.listMeasurementQueryTemplates(project);
+      break;
+    case "query-template-upsert": {
+      const parsed = advancedQueryTemplateUpsertInputSchema.parse(input);
+      result = await client.upsertMeasurementQueryTemplate(project, parsed.templateId, parsed.request);
+      break;
+    }
+    case "query-template-delete": {
+      const parsed = advancedQueryTemplateInputSchema.parse(input);
+      result = await client.deleteMeasurementQueryTemplate(project, parsed.templateId);
+      break;
+    }
+    case "query-template-apply": {
+      const parsed = advancedQueryTemplateApplyInputSchema.parse(input);
+      result = await client.applyMeasurementQueryTemplate(project, parsed.templateId, parsed.request, parsed.idempotencyKey);
+      break;
+    }
+  }
+  if (format === "jsonl" && emitAdvancedMeasurementJsonl(operation, result)) return;
+  console.log(JSON.stringify(result ?? null, null, 2));
+}
 async function showMeasurementPlan(project, revision) {
   const client = createApiClient();
   console.log(JSON.stringify(revision === void 0 ? await client.getMeasurementPlan(project) : await client.getMeasurementPlanVersion(project, revision), null, 2));
@@ -16008,6 +16194,12 @@ Usage: ${usage}`);
   }
   return { project, options: { groupKeys, targetKeys, queryIds, allProperties } };
 }
+function advancedMeasurementOperation(value, usage) {
+  const operation = ADVANCED_MEASUREMENT_OPERATIONS.find((candidate) => candidate === value);
+  if (operation) return operation;
+  throw usageError(`Error: unsupported Advanced Measurement operation: ${value ?? "(none)"}
+Usage: ${usage}`);
+}
 var MEASUREMENT_PLAN_CLI_COMMANDS = [
   { path: ["measurement-plan", "show"], usage: "canonry measurement-plan show <project> [--revision N] [--format json]", options: { revision: stringOption() }, run: async (input) => {
     const value = getString(input.values, "revision");
@@ -16028,6 +16220,16 @@ var MEASUREMENT_PLAN_CLI_COMMANDS = [
     if (!stableKey) throw usageError("stable segment key is required");
     return retireMeasurementPlanSegment(project, stableKey);
   } },
+  {
+    path: ["measurement-plan", "advanced"],
+    usage: "canonry measurement-plan advanced <project> <operation> [<json|->] [--format json|jsonl]",
+    run: (input) => {
+      const usage = "canonry measurement-plan advanced <project> <operation> [<json|->] [--format json|jsonl]";
+      const project = requireProject(input, "measurement-plan.advanced", usage);
+      const operation = advancedMeasurementOperation(input.positionals[1], usage);
+      return runAdvancedMeasurementOperation(project, operation, input.positionals[2], input.format);
+    }
+  },
   {
     path: ["measurement-plan", "assignments", "preview"],
     usage: "canonry measurement-plan assignments preview <project> [--group KEY ...] [--target-key KEY ... | --all-properties] --query-id ID [--query-id ID ...] [--format json]",

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-ZDYS24LW.js";
+} from "./chunk-MHTZ4THA.js";
 import {
   loadConfig
-} from "./chunk-4BL24FQA.js";
-import "./chunk-DRDNHYIF.js";
-import "./chunk-BVOU4UJM.js";
+} from "./chunk-3HYF3LUP.js";
+import "./chunk-VUTKHFTM.js";
+import "./chunk-43XIYBG4.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-7CGZ537D.js → intelligence-service-OGOGIQJD.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-DRDNHYIF.js";
-import "./chunk-BVOU4UJM.js";
+} from "./chunk-VUTKHFTM.js";
+import "./chunk-43XIYBG4.js";
 export {
   IntelligenceService
 };