@canonry/canonry 4.156.0 → 4.158.0

package/dist/cli.js

@@ -16,6 +16,7 @@ import {
   detectAndTrackUpgrade,
   emitInstallSummary,
   formatAuditFactorScore,
+  getCloudflareTrafficConnection,
   getMissingUserSkillsNudge,
   getOrCreateAnonymousId,
   installSkills,
@@ -30,7 +31,7 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-ZWESOFA5.js";
+} from "./chunk-4VZP64GZ.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -50,15 +51,21 @@ import {
   saveConfigPatch,
   systemError,
   usageError
-} from "./chunk-CPASKGUE.js";
+} from "./chunk-LK6YFHG4.js";
 import {
+  CLOUDFLARE_WORKER_BINDINGS,
+  CLOUDFLARE_WORKER_GENERATED_MARKER,
+  CLOUDFLARE_WRANGLER_GENERATED_MARKER,
+  DEFAULT_BOT_LIST,
   apiKeys,
   createClient,
+  generateWorkerScript,
+  generateWranglerToml,
   migrate,
   projects,
   queries,
   renderReportHtml
-} from "./chunk-ABNN2ZVR.js";
+} from "./chunk-YP4K2KXH.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -122,7 +129,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-AMPT2EP7.js";
+} from "./chunk-DEVAEC2S.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -168,9 +175,9 @@ import { parseArgs } from "util";
 function commandId(spec) {
   return spec.path.join(".");
 }
-function matchesPath(args, path12) {
-  if (args.length < path12.length) return false;
-  return path12.every((segment, index) => args[index] === segment);
+function matchesPath(args, path13) {
+  if (args.length < path13.length) return false;
+  return path13.every((segment, index) => args[index] === segment);
 }
 function withGlobalOptions(options) {
   const base = options ? { ...options } : {};
@@ -3868,9 +3875,9 @@ async function gaConnect(project, opts) {
     propertyId: opts.propertyId
   };
   if (opts.keyFile) {
-    const fs17 = await import("fs");
+    const fs18 = await import("fs");
     try {
-      const content = fs17.readFileSync(opts.keyFile, "utf-8");
+      const content = fs18.readFileSync(opts.keyFile, "utf-8");
       JSON.parse(content);
       body.keyJson = content;
     } catch (e) {
@@ -5224,9 +5231,9 @@ async function getCommand(opts) {
     console.log(JSON.stringify(leaf, null, 2));
   }
 }
-function walkPath(value, path12) {
-  if (!path12 || path12 === ".") return value;
-  const segments = path12.split(".").flatMap((part) => {
+function walkPath(value, path13) {
+  if (!path13 || path13 === ".") return value;
+  const segments = path13.split(".").flatMap((part) => {
     const tokens = [];
     let i = 0;
     const bracketStart = part.indexOf("[");
@@ -5274,17 +5281,342 @@ var GET_CLI_COMMANDS = [
     },
     run: async (input) => {
       const project = requireProject(input, "get", USAGE2);
-      const path12 = requirePositional(input, 1, {
+      const path13 = requirePositional(input, 1, {
         command: "get",
         usage: USAGE2,
         message: 'path is required (e.g. "scores.mentionShare.value")'
       });
       const from = getString(input.values, "from");
-      await getCommand({ project, path: path12, from, format: input.format });
+      await getCommand({ project, path: path13, from, format: input.format });
     }
   }
 ];
 
+// src/cloudflare-worker-deploy.ts
+import { spawn } from "child_process";
+import { randomUUID } from "crypto";
+import fs4 from "fs";
+import os from "os";
+import path2 from "path";
+import { stripVTControlCharacters } from "util";
+var MAX_WRANGLER_DIAGNOSTIC_LENGTH = 2e3;
+function wranglerDiagnostic(output) {
+  const plain = stripVTControlCharacters(output).trim();
+  if (plain.length <= MAX_WRANGLER_DIAGNOSTIC_LENGTH) return plain;
+  const half = Math.floor(MAX_WRANGLER_DIAGNOSTIC_LENGTH / 2);
+  return `${plain.slice(0, half)}
+...
+${plain.slice(-half)}`;
+}
+function projectSlug(project) {
+  return project.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+}
+function lstatIfPresent(filePath) {
+  try {
+    return fs4.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function resolveCloudflareWorkerOutputDirectory(project, outputDirectory, cwd = process.cwd()) {
+  return path2.resolve(cwd, outputDirectory ?? `canonry-cloudflare-${projectSlug(project)}`);
+}
+function prepareCloudflareWorkerOutputDirectory(outputDirectory) {
+  const resolved = path2.resolve(outputDirectory);
+  const outputStat = lstatIfPresent(resolved);
+  if (outputStat) {
+    const stat = outputStat;
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error(`output directory is not a regular directory: ${resolved}`);
+    }
+  } else {
+    fs4.mkdirSync(resolved, { recursive: true, mode: 448 });
+  }
+  const artifacts = {
+    outputDirectory: resolved,
+    workerScriptPath: path2.join(resolved, "worker.js"),
+    wranglerTomlPath: path2.join(resolved, "wrangler.toml")
+  };
+  for (const artifactPath of [artifacts.workerScriptPath, artifacts.wranglerTomlPath]) {
+    const stat = lstatIfPresent(artifactPath);
+    if (!stat) continue;
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`artifact path is not a regular file: ${artifactPath}`);
+    }
+    const contents = fs4.readFileSync(artifactPath, "utf-8");
+    if (!isRecognizablyCanonryGenerated(artifactPath, contents)) {
+      throw new Error(`refusing to overwrite an operator-owned artifact: ${artifactPath}`);
+    }
+  }
+  return artifacts;
+}
+function readRegularArtifact(filePath) {
+  const stat = lstatIfPresent(filePath);
+  if (!stat) return null;
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`artifact path is not a regular file: ${filePath}`);
+  }
+  return fs4.readFileSync(filePath, "utf-8");
+}
+function isRecognizablyCanonryGenerated(filePath, contents) {
+  if (path2.basename(filePath) === "worker.js") {
+    return contents.startsWith(`${CLOUDFLARE_WORKER_GENERATED_MARKER}
+`);
+  }
+  if (path2.basename(filePath) !== "wrangler.toml") return false;
+  if (contents.startsWith(`${CLOUDFLARE_WRANGLER_GENERATED_MARKER}
+`)) return true;
+  return /^name = "canonry-traffic-[^"]+"$/m.test(contents) && /^main = "worker\.js"$/m.test(contents) && /^CANONRY_DELIVERY_MODE = "direct-push"$/m.test(contents) && /^CANONRY_SOURCE_ID = /m.test(contents) && /^CANONRY_INGEST_URL = /m.test(contents) && /^CANONRY_WORKER_VERSION = /m.test(contents) && contents.includes("[secrets]") && contents.includes(CLOUDFLARE_WORKER_BINDINGS.bearerToken) && contents.includes(CLOUDFLARE_WORKER_BINDINGS.hmacSecret);
+}
+function writePrivateTemporaryFile(filePath, contents) {
+  const temporaryPath = path2.join(
+    path2.dirname(filePath),
+    `.${path2.basename(filePath)}.${randomUUID()}.tmp`
+  );
+  const fd = fs4.openSync(temporaryPath, "wx", 384);
+  let closed = false;
+  try {
+    fs4.writeFileSync(fd, contents, "utf-8");
+    fs4.fsyncSync(fd);
+    fs4.closeSync(fd);
+    closed = true;
+  } catch (error) {
+    if (!closed) {
+      try {
+        fs4.closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      fs4.unlinkSync(temporaryPath);
+    } catch {
+    }
+    throw error;
+  }
+  return temporaryPath;
+}
+function writeCloudflareWorkerArtifacts(artifacts, contents) {
+  const requested = [
+    { filePath: artifacts.workerScriptPath, contents: contents.workerScript },
+    { filePath: artifacts.wranglerTomlPath, contents: contents.wranglerToml }
+  ];
+  const changes = requested.flatMap((artifact) => {
+    const previous = readRegularArtifact(artifact.filePath);
+    if (previous === artifact.contents) return [];
+    if (previous !== null && !isRecognizablyCanonryGenerated(artifact.filePath, previous)) {
+      throw new Error(`refusing to overwrite an operator-owned artifact: ${artifact.filePath}`);
+    }
+    return [{ ...artifact, previous }];
+  });
+  const pending = [];
+  const applied = [];
+  try {
+    for (const change of changes) {
+      pending.push({
+        ...change,
+        temporaryPath: writePrivateTemporaryFile(change.filePath, change.contents)
+      });
+    }
+    for (const change of pending) {
+      if (readRegularArtifact(change.filePath) !== change.previous) {
+        throw new Error(`artifact changed during update: ${change.filePath}`);
+      }
+      if (change.previous === null) {
+        fs4.linkSync(change.temporaryPath, change.filePath);
+        fs4.unlinkSync(change.temporaryPath);
+      } else {
+        fs4.renameSync(change.temporaryPath, change.filePath);
+      }
+      applied.push(change);
+    }
+  } catch (error) {
+    for (const change of applied.reverse()) {
+      try {
+        if (readRegularArtifact(change.filePath) !== change.contents) continue;
+        if (change.previous === null) {
+          fs4.unlinkSync(change.filePath);
+        } else {
+          const restorePath = writePrivateTemporaryFile(change.filePath, change.previous);
+          fs4.renameSync(restorePath, change.filePath);
+        }
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    for (const change of pending) {
+      try {
+        if (fs4.existsSync(change.temporaryPath)) fs4.unlinkSync(change.temporaryPath);
+      } catch {
+      }
+    }
+  }
+}
+function assertCloudflareArtifactsDoNotContainSecrets(contents, secrets) {
+  const artifactText = [contents.workerScript, contents.wranglerToml, contents.instructions ?? ""];
+  for (const secret of [secrets.bearerToken, secrets.hmacSecret]) {
+    if (secret && artifactText.some((value) => value.includes(secret))) {
+      throw new Error("Cloudflare setup response unexpectedly contained a cleartext secret");
+    }
+  }
+}
+function redactCloudflareSecrets(message, secrets) {
+  let redacted = message;
+  for (const secret of [secrets.bearerToken, secrets.hmacSecret]) {
+    if (secret) redacted = redacted.replaceAll(secret, "[REDACTED]");
+  }
+  return redacted;
+}
+async function runWrangler(command, args, opts) {
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, [...args], {
+      cwd: opts.cwd,
+      shell: false,
+      stdio: "inherit"
+    });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(
+        signal ? `Wrangler exited after signal ${signal}` : `Wrangler exited with code ${code ?? "unknown"}`
+      ));
+    });
+  });
+}
+async function runWranglerCapture(command, args, opts) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, [...args], {
+      cwd: opts.cwd,
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let output = "";
+    child.stdout.setEncoding("utf-8");
+    child.stderr.setEncoding("utf-8");
+    child.stdout.on("data", (chunk) => {
+      output += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      output += String(chunk);
+    });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve(output);
+        return;
+      }
+      const diagnostic = wranglerDiagnostic(output);
+      const suffix = diagnostic ? `
+${diagnostic}` : "";
+      reject(new Error(
+        signal ? `Wrangler exited after signal ${signal}${suffix}` : `Wrangler exited with code ${code ?? "unknown"}${suffix}`
+      ));
+    });
+  });
+}
+async function preflightCloudflareWrangler(opts = {}) {
+  const runner = opts.run ?? runWranglerCapture;
+  const help = await runner(
+    "wrangler",
+    ["deploy", "--help"],
+    { cwd: path2.resolve(opts.cwd ?? process.cwd()) }
+  );
+  const missing = ["--dry-run", "--secrets-file", "--strict"].filter((flag) => !help.includes(flag));
+  if (missing.length > 0) {
+    throw new Error(`Wrangler deploy does not support required flags: ${missing.join(", ")}`);
+  }
+  const tempDirectory = fs4.mkdtempSync(path2.join(
+    opts.tempRoot ?? os.tmpdir(),
+    "canonry-cloudflare-wrangler-preflight-"
+  ));
+  const workerScriptPath = path2.join(tempDirectory, "worker.js");
+  const wranglerTomlPath = path2.join(tempDirectory, "wrangler.toml");
+  const secretsPath = path2.join(tempDirectory, "secrets.json");
+  try {
+    fs4.chmodSync(tempDirectory, 448);
+    fs4.writeFileSync(workerScriptPath, generateWorkerScript({
+      deliveryMode: "direct-push",
+      workerVersion: "preflight",
+      botList: DEFAULT_BOT_LIST
+    }), { encoding: "utf-8", flag: "wx", mode: 384 });
+    fs4.writeFileSync(wranglerTomlPath, generateWranglerToml({
+      deliveryMode: "direct-push",
+      sourceId: "preflight",
+      hostname: "example.invalid",
+      ingestUrl: "https://canonry.example.invalid/api/v1/projects/preflight/traffic/cloudflare/ingest",
+      workerVersion: "preflight"
+    }), { encoding: "utf-8", flag: "wx", mode: 384 });
+    fs4.writeFileSync(secretsPath, JSON.stringify({
+      [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: "preflight-bearer",
+      [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: "preflight-hmac"
+    }), { encoding: "utf-8", flag: "wx", mode: 384 });
+    const validationOutput = await runner(
+      "wrangler",
+      [
+        "deploy",
+        "--config",
+        wranglerTomlPath,
+        "--secrets-file",
+        secretsPath,
+        "--strict",
+        "--dry-run",
+        "--outdir",
+        path2.join(tempDirectory, "dist")
+      ],
+      { cwd: tempDirectory }
+    );
+    const hasUnknownFields = /Unexpected fields found/i.test(validationOutput);
+    const hasExperimentalSecrets = /\bexperimental\b/i.test(validationOutput) && /\bsecrets?\b/i.test(validationOutput);
+    if (hasUnknownFields || hasExperimentalSecrets) {
+      throw new Error(
+        `Wrangler reported an incompatible generated configuration:
+${wranglerDiagnostic(validationOutput)}`
+      );
+    }
+  } finally {
+    fs4.rmSync(tempDirectory, { recursive: true, force: true });
+  }
+}
+async function deployCloudflareWorker(opts) {
+  const tempDirectory = fs4.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
+  const secretsPath = path2.join(tempDirectory, "secrets.json");
+  try {
+    fs4.chmodSync(tempDirectory, 448);
+    fs4.writeFileSync(
+      secretsPath,
+      JSON.stringify({
+        [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: opts.secrets.bearerToken,
+        [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: opts.secrets.hmacSecret
+      }),
+      { encoding: "utf-8", flag: "wx", mode: 384 }
+    );
+    fs4.chmodSync(secretsPath, 384);
+    const runner = opts.run ?? runWrangler;
+    await runner(
+      "wrangler",
+      [
+        "deploy",
+        "--config",
+        path2.resolve(opts.wranglerTomlPath),
+        "--secrets-file",
+        secretsPath,
+        "--strict"
+      ],
+      { cwd: path2.dirname(path2.resolve(opts.wranglerTomlPath)) }
+    );
+  } finally {
+    try {
+      if (fs4.existsSync(secretsPath)) fs4.unlinkSync(secretsPath);
+    } finally {
+      fs4.rmSync(tempDirectory, { recursive: true, force: true });
+    }
+  }
+}
+
 // src/commands/traffic.ts
 function getClient9() {
   return createApiClient();
@@ -5292,6 +5624,169 @@ function getClient9() {
 function configString(value, fallback = "(unset)") {
   return typeof value === "string" ? value : fallback;
 }
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function trafficConnectCloudflare(project, opts, deps = {}) {
+  if (opts.deploy && !opts.zoneId) {
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_DEPLOY_ZONE_REQUIRED",
+      message: "--zone-id is required with --deploy",
+      displayMessage: "Error: --zone-id <id> is required with --deploy",
+      details: { project }
+    });
+  }
+  if (opts.deploy && !opts.confirmRoute) {
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_ROUTE_CONFIRMATION_REQUIRED",
+      message: "--confirm-route is required with --deploy",
+      displayMessage: "Error: inspect existing Worker routes first. Pass --confirm-route to acknowledge the required manual route attachment after Worker deployment.",
+      details: { project, zoneId: opts.zoneId }
+    });
+  }
+  if (opts.deploy && !opts.confirmFailOpen) {
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_FAIL_OPEN_CONFIRMATION_REQUIRED",
+      message: "--confirm-fail-open is required with --deploy",
+      displayMessage: "Error: pass --confirm-fail-open to acknowledge the required Fail open setting during manual route attachment after Worker deployment.",
+      details: { project, zoneId: opts.zoneId }
+    });
+  }
+  if (opts.deploy) {
+    try {
+      await (deps.preflightWrangler ?? preflightCloudflareWrangler)();
+    } catch (error) {
+      const message = errorMessage2(error);
+      throw new CliError({
+        code: "TRAFFIC_CLOUDFLARE_WRANGLER_UNSUPPORTED",
+        message,
+        displayMessage: `Error: Wrangler preflight failed before Canonry changed state.
+${message}`,
+        details: { project }
+      });
+    }
+  }
+  const outputDirectory = resolveCloudflareWorkerOutputDirectory(project, opts.outputDirectory);
+  let artifacts;
+  try {
+    artifacts = prepareCloudflareWorkerOutputDirectory(outputDirectory);
+  } catch (error) {
+    const message = errorMessage2(error);
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_OUTPUT_INVALID",
+      message,
+      displayMessage: `Error: cannot use Cloudflare Worker output directory: ${message}`,
+      details: { project, outputDirectory }
+    });
+  }
+  const client = deps.client ?? getClient9();
+  const result = await client.trafficConnectCloudflare(project, {
+    deliveryMode: "direct-push",
+    displayName: opts.displayName,
+    zoneId: opts.zoneId,
+    accountId: opts.accountId
+  });
+  const localConfig = (deps.loadLocalConfig ?? loadConfigRaw)();
+  const localCredential = localConfig ? getCloudflareTrafficConnection(localConfig, project) : void 0;
+  const deploymentCredential = localCredential?.sourceId === result.sourceId ? localCredential : void 0;
+  if (deploymentCredential) {
+    try {
+      assertCloudflareArtifactsDoNotContainSecrets(result, deploymentCredential);
+    } catch {
+      throw new CliError({
+        code: "TRAFFIC_CLOUDFLARE_SECRET_EXPOSURE",
+        message: "Cloudflare setup response unexpectedly contained a cleartext secret",
+        displayMessage: "Error: refused to write Cloudflare artifacts because the response contained a cleartext secret",
+        details: { project, sourceId: result.sourceId }
+      });
+    }
+  }
+  try {
+    writeCloudflareWorkerArtifacts(artifacts, result);
+  } catch (error) {
+    const message = errorMessage2(error);
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_ARTIFACT_WRITE_FAILED",
+      message,
+      displayMessage: `Error: Cloudflare source connected, but artifact writing failed: ${message}`,
+      details: { project, sourceId: result.sourceId, outputDirectory }
+    });
+  }
+  if (opts.deploy && !deploymentCredential) {
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_DEPLOY_CONFIG_UNSHARED",
+      message: "Cloudflare auto-deploy requires the CLI and Canonry server to share the same local config",
+      displayMessage: "Error: source connected and artifacts written, but auto-deploy is unavailable because this CLI cannot read the server-stored Worker credentials. Ask the Canonry server operator to deploy the Worker and install its secrets.",
+      details: {
+        project,
+        sourceId: result.sourceId,
+        outputDirectory
+      }
+    });
+  }
+  if (opts.deploy && deploymentCredential) {
+    try {
+      await (deps.deployWorker ?? deployCloudflareWorker)({
+        wranglerTomlPath: artifacts.wranglerTomlPath,
+        secrets: deploymentCredential
+      });
+    } catch (error) {
+      const message = redactCloudflareSecrets(errorMessage2(error), deploymentCredential);
+      throw new CliError({
+        code: "TRAFFIC_CLOUDFLARE_DEPLOY_FAILED",
+        message,
+        displayMessage: `Error: Cloudflare source connected and artifacts written, but Wrangler deploy failed: ${message}`,
+        details: { project, sourceId: result.sourceId, outputDirectory }
+      });
+    }
+  }
+  const summary = {
+    sourceId: result.sourceId,
+    deliveryMode: result.deliveryMode,
+    workerVersion: result.workerVersion,
+    outputDirectory: artifacts.outputDirectory,
+    files: {
+      workerScript: artifacts.workerScriptPath,
+      wranglerConfig: artifacts.wranglerTomlPath
+    },
+    autoDeployAvailable: Boolean(deploymentCredential),
+    deployment: opts.deploy ? "worker-deployed-route-unattached" : "not-requested",
+    routeAttachment: "required-manual",
+    requestLimitFailureMode: {
+      required: "fail-open",
+      status: "required-during-manual-route-attachment",
+      configuredBy: "cloudflare-dashboard",
+      configuredByWrangler: false
+    },
+    postDeployInstructions: result.instructions
+  };
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  console.log(`Cloudflare direct-push traffic source connected for project "${project}".`);
+  console.log(`  Source ID:       ${result.sourceId}`);
+  console.log(`  Worker version:  ${result.workerVersion}`);
+  console.log(`  Worker script:   ${artifacts.workerScriptPath}`);
+  console.log(`  Wrangler config: ${artifacts.wranglerTomlPath}`);
+  console.log(`  Deployment:      ${opts.deploy ? "Worker deployed; route not attached" : "not requested"}`);
+  console.log("");
+  console.log("The required manual route is a catch-all. Inspect existing Worker routes before deployment.");
+  console.log("Wrangler deployment does not attach the route. Attach it manually after the Worker deploys.");
+  console.log("Required: set the route Request limit failure mode to Fail open before route activation.");
+  console.log("Wrangler cannot configure this toggle. Workers Free includes 100,000 requests per day for the account.");
+  console.log("Use one authoritative server-traffic source for this site. Overlapping adapters double-count project totals.");
+  if (opts.deploy) {
+    console.log("");
+    console.log("Required Cloudflare Dashboard steps:");
+    console.log(result.instructions);
+    console.log("Keep the Canonry public HTTPS URL reachable so the Worker can push events.");
+  } else if (deploymentCredential) {
+    console.log("Next: install and authenticate Wrangler. Inspect the route, then rerun with --deploy --confirm-route --confirm-fail-open and --zone-id <id>.");
+  } else {
+    console.log("Auto-deploy is unavailable because this CLI and the Canonry server do not share local config. Ask the server operator to deploy and install the Worker secrets.");
+  }
+}
 async function trafficConnectWordpress(project, opts) {
   if (!opts.url) {
     throw new CliError({
@@ -5319,9 +5814,9 @@ async function trafficConnectWordpress(project, opts) {
   }
   let applicationPassword = opts.appPassword?.trim() ?? "";
   if (!applicationPassword && opts.appPasswordFile) {
-    const fs17 = await import("fs");
+    const fs18 = await import("fs");
     try {
-      applicationPassword = fs17.readFileSync(opts.appPasswordFile, "utf-8").trim();
+      applicationPassword = fs18.readFileSync(opts.appPasswordFile, "utf-8").trim();
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new CliError({
@@ -5377,10 +5872,10 @@ async function trafficConnectCloudRun(project, opts) {
       details: { project }
     });
   }
-  const fs17 = await import("fs");
+  const fs18 = await import("fs");
   let keyJson;
   try {
-    keyJson = fs17.readFileSync(opts.serviceAccountKey, "utf-8");
+    keyJson = fs18.readFileSync(opts.serviceAccountKey, "utf-8");
     JSON.parse(keyJson);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -5440,9 +5935,9 @@ async function trafficConnectVercel(project, opts) {
   }
   let token = opts.token?.trim() ?? "";
   if (!token && opts.tokenFile) {
-    const fs17 = await import("fs");
+    const fs18 = await import("fs");
     try {
-      token = fs17.readFileSync(opts.tokenFile, "utf-8").trim();
+      token = fs18.readFileSync(opts.tokenFile, "utf-8").trim();
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new CliError({
@@ -5552,11 +6047,11 @@ async function trafficBackfill(project, opts) {
     console.log(`Inspect rebuilt rollups: canonry traffic events ${project} --source ${opts.source} --since-minutes ${submitted.daysApplied * 24 * 60}`);
     return;
   }
-  const errorMessage2 = final.error?.message ?? null;
+  const errorMessage3 = final.error?.message ?? null;
   throw new CliError({
     code: "TRAFFIC_BACKFILL_FAILED",
-    message: errorMessage2 ?? "backfill run did not complete successfully",
-    displayMessage: `Error: backfill run ${final.id} ${final.status}${errorMessage2 ? ` \u2014 ${errorMessage2}` : ""}`,
+    message: errorMessage3 ?? "backfill run did not complete successfully",
+    displayMessage: `Error: backfill run ${final.id} ${final.status}${errorMessage3 ? ` \u2014 ${errorMessage3}` : ""}`,
     details: { project, runId: final.id, status: final.status }
   });
 }
@@ -5791,6 +6286,36 @@ async function trafficEvents(project, opts) {
 
 // src/cli-commands/traffic.ts
 var TRAFFIC_CLI_COMMANDS = [
+  {
+    path: ["traffic", "connect", "cloudflare"],
+    usage: "canonry traffic connect cloudflare <project> [--display-name <name>] [--zone-id <id>] [--account-id <id>] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open] [--format json]",
+    options: {
+      "display-name": stringOption(),
+      "zone-id": stringOption(),
+      "account-id": stringOption(),
+      "output-dir": stringOption(),
+      deploy: { type: "boolean" },
+      "confirm-route": { type: "boolean" },
+      "confirm-fail-open": { type: "boolean" }
+    },
+    run: async (input) => {
+      const project = requireProject(
+        input,
+        "traffic.connect.cloudflare",
+        "canonry traffic connect cloudflare <project> [--zone-id <id>] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open]"
+      );
+      await trafficConnectCloudflare(project, {
+        displayName: getString(input.values, "display-name"),
+        zoneId: getString(input.values, "zone-id"),
+        accountId: getString(input.values, "account-id"),
+        outputDirectory: getString(input.values, "output-dir"),
+        deploy: getBoolean(input.values, "deploy"),
+        confirmRoute: getBoolean(input.values, "confirm-route"),
+        confirmFailOpen: getBoolean(input.values, "confirm-fail-open"),
+        format: input.format
+      });
+    }
+  },
   {
     path: ["traffic", "connect", "cloud-run"],
     usage: "canonry traffic connect cloud-run <project> --gcp-project <id> --service-account-key <path> [--service <name>] [--location <region>] [--display-name <name>] [--format json]",
@@ -5890,7 +6415,7 @@ var TRAFFIC_CLI_COMMANDS = [
       unknownSubcommand(input.positionals[0], {
         command: "traffic connect",
         usage: "canonry traffic connect <provider> <project> [args]",
-        available: ["cloud-run", "wordpress", "vercel"]
+        available: ["cloud-run", "cloudflare", "wordpress", "vercel"]
       });
     }
   },
@@ -5998,7 +6523,7 @@ var TRAFFIC_CLI_COMMANDS = [
   },
   {
     path: ["traffic", "events"],
-    usage: "canonry traffic events <project> [--kind crawler|ai-referral|all] [--source <id>] [--since-minutes 1440] [--since <iso>] [--until <iso>] [--limit 500] [--granularity hour|day] [--format json]",
+    usage: "canonry traffic events <project> [--kind crawler|ai-user-fetch|ai-referral|all] [--source <id>] [--since-minutes 1440] [--since <iso>] [--until <iso>] [--limit 500] [--granularity hour|day] [--format json]",
     options: {
       kind: stringOption(),
       source: stringOption(),
@@ -6270,10 +6795,10 @@ Open this URL in your browser to authorize Google ${opts.type.toUpperCase()} acc
     console.log("(Ensure this URI is listed in your Google Cloud Console OAuth client's authorized redirect URIs)\n");
   }
   try {
-    const { spawn: spawn2 } = await import("child_process");
+    const { spawn: spawn3 } = await import("child_process");
     const platform = process.platform;
     const [cmd, ...extraArgs] = platform === "darwin" ? ["open", authUrl] : platform === "win32" ? ["cmd", "/c", "start", "", authUrl] : ["xdg-open", authUrl];
-    spawn2(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();
+    spawn3(cmd, [...extraArgs], { detached: true, stdio: "ignore" }).unref();
     console.log("(Browser opened automatically)");
   } catch {
     console.log("(Could not open browser automatically \u2014 please copy the URL above)");
@@ -7785,7 +8310,7 @@ var USERS_CLI_COMMANDS = [
 ];
 
 // src/commands/keyword.ts
-import fs4 from "fs";
+import fs5 from "fs";
 function getClient14() {
   return createApiClient();
 }
@@ -7853,7 +8378,7 @@ async function listKeywords(project, format) {
   }
 }
 async function importKeywords(project, filePath, format) {
-  if (!fs4.existsSync(filePath)) {
+  if (!fs5.existsSync(filePath)) {
     throw new CliError({
       code: "KEYWORD_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -7864,7 +8389,7 @@ async function importKeywords(project, filePath, format) {
       }
     });
   }
-  const content = fs4.readFileSync(filePath, "utf-8");
+  const content = fs5.readFileSync(filePath, "utf-8");
   const keywords = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (keywords.length === 0) {
     if (isMachineFormat(format)) {
@@ -8065,7 +8590,7 @@ var KEYWORD_CLI_COMMANDS = [
 ];
 
 // src/commands/query.ts
-import fs5 from "fs";
+import fs6 from "fs";
 function getClient15() {
   return createApiClient();
 }
@@ -8156,7 +8681,7 @@ async function listQueries(project, format) {
   }
 }
 async function importQueries(project, filePath, format) {
-  if (!fs5.existsSync(filePath)) {
+  if (!fs6.existsSync(filePath)) {
     throw new CliError({
       code: "QUERY_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -8167,7 +8692,7 @@ async function importQueries(project, filePath, format) {
       }
     });
   }
-  const content = fs5.readFileSync(filePath, "utf-8");
+  const content = fs6.readFileSync(filePath, "utf-8");
   const queries2 = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (queries2.length === 0) {
     if (isMachineFormat(format)) {
@@ -8369,16 +8894,16 @@ var QUERY_CLI_COMMANDS = [
 ];
 
 // src/commands/mcp.ts
-import fs6 from "fs";
-import path3 from "path";
+import fs7 from "fs";
+import path4 from "path";
 import { createRequire } from "module";
 
 // src/mcp-clients.ts
-import os from "os";
-import path2 from "path";
+import os2 from "os";
+import path3 from "path";
 var CLAUDE_DESKTOP_CONFIG_FILENAME = "claude_desktop_config.json";
 function homeRelative(...segments) {
-  return path2.join(os.homedir(), ...segments);
+  return path3.join(os2.homedir(), ...segments);
 }
 function claudeDesktopConfigPath() {
   switch (process.platform) {
@@ -8386,7 +8911,7 @@ function claudeDesktopConfigPath() {
       return homeRelative("Library", "Application Support", "Claude", CLAUDE_DESKTOP_CONFIG_FILENAME);
     case "win32": {
       const appData = process.env.APPDATA ?? homeRelative("AppData", "Roaming");
-      return path2.join(appData, "Claude", CLAUDE_DESKTOP_CONFIG_FILENAME);
+      return path3.join(appData, "Claude", CLAUDE_DESKTOP_CONFIG_FILENAME);
     }
     default:
       return homeRelative(".config", "Claude", CLAUDE_DESKTOP_CONFIG_FILENAME);
@@ -8399,7 +8924,7 @@ function codexConfigPath() {
   return homeRelative(".codex", "config.toml");
 }
 function claudeCodeProjectConfigPath() {
-  return path2.join(process.cwd(), ".mcp.json");
+  return path3.join(process.cwd(), ".mcp.json");
 }
 var SUPPORTED_MCP_CLIENTS = [
   {
@@ -8442,7 +8967,7 @@ function listMcpClientIds() {
 var _require = createRequire(import.meta.url);
 function resolveCanonryMcpBin() {
   const packageJsonPath = _require.resolve("../package.json");
-  const packageRoot = path3.dirname(packageJsonPath);
+  const packageRoot = path4.dirname(packageJsonPath);
   const pkg = _require("../package.json");
   const relativeBin = pkg.bin?.["canonry-mcp"];
   if (!relativeBin) {
@@ -8452,7 +8977,7 @@ function resolveCanonryMcpBin() {
       exitCode: 2
     });
   }
-  return path3.resolve(packageRoot, relativeBin);
+  return path4.resolve(packageRoot, relativeBin);
 }
 function buildEntry(opts) {
   const target = opts.binPath ?? resolveCanonryMcpBin();
@@ -8485,8 +9010,8 @@ function renderClientSnippet(client, serverName, entry) {
   return renderJsonSnippet(serverName, entry, client.format);
 }
 function readJsonConfig(configPath) {
-  if (!fs6.existsSync(configPath)) return {};
-  const raw = fs6.readFileSync(configPath, "utf-8").trim();
+  if (!fs7.existsSync(configPath)) return {};
+  const raw = fs7.readFileSync(configPath, "utf-8").trim();
   if (!raw) return {};
   try {
     const parsed = JSON.parse(raw);
@@ -8504,14 +9029,14 @@ function readJsonConfig(configPath) {
   }
 }
 function writeJsonConfig(configPath, value) {
-  fs6.mkdirSync(path3.dirname(configPath), { recursive: true });
-  fs6.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
+  fs7.mkdirSync(path4.dirname(configPath), { recursive: true });
+  fs7.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
 `, "utf-8");
 }
 function backupConfigIfPresent(configPath) {
-  if (!fs6.existsSync(configPath)) return void 0;
+  if (!fs7.existsSync(configPath)) return void 0;
   const backupPath = `${configPath}.canonry.bak`;
-  fs6.copyFileSync(configPath, backupPath);
+  fs7.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function findClientOrThrow(id) {
@@ -8867,13 +9392,13 @@ var NOTIFY_CLI_COMMANDS = [
 ];
 
 // src/commands/apply.ts
-import fs7 from "fs";
+import fs8 from "fs";
 import { parseAllDocuments } from "yaml";
 async function applyConfigFile(filePath) {
-  if (!fs7.existsSync(filePath)) {
+  if (!fs8.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const content = fs7.readFileSync(filePath, "utf-8");
+  const content = fs8.readFileSync(filePath, "utf-8");
   const docs = parseAllDocuments(content);
   const client = createApiClient();
   const errors = [];
@@ -9276,8 +9801,8 @@ async function loadLatestRunForExport(client, project) {
 }
 
 // src/commands/results-export.ts
-import fs8 from "fs";
-import path4 from "path";
+import fs9 from "fs";
+import path5 from "path";
 async function exportResults(project, opts) {
   const { output, ...request } = opts;
   const artifact = await createApiClient().downloadResultsExport(project, request);
@@ -9285,9 +9810,9 @@ async function exportResults(project, opts) {
     process.stdout.write(artifact.content);
     return;
   }
-  const target = output ? path4.resolve(output) : path4.resolve(process.cwd(), path4.basename(artifact.filename));
-  fs8.mkdirSync(path4.dirname(target), { recursive: true });
-  fs8.writeFileSync(target, artifact.content, "utf8");
+  const target = output ? path5.resolve(output) : path5.resolve(process.cwd(), path5.basename(artifact.filename));
+  fs9.mkdirSync(path5.dirname(target), { recursive: true });
+  fs9.writeFileSync(target, artifact.content, "utf8");
   console.log(`Results export written to ${target}`);
 }
 
@@ -10003,11 +10528,11 @@ function parseProviderModelAssignments(assignments) {
 }
 
 // src/commands/report.ts
-import fs9 from "fs";
-import path5 from "path";
+import fs10 from "fs";
+import path6 from "path";
 function defaultOutputPath(project, audience) {
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  return path5.resolve(process.cwd(), `canonry-report-${project}-${audience}-${date}.html`);
+  return path6.resolve(process.cwd(), `canonry-report-${project}-${audience}-${date}.html`);
 }
 async function runReportCommand(project, opts = {}) {
   const client = createApiClient();
@@ -10018,12 +10543,12 @@ async function runReportCommand(project, opts = {}) {
     return;
   }
   const html = renderReportHtml(report, { audience });
-  const targetPath = opts.output ? path5.resolve(opts.output) : defaultOutputPath(project, audience);
-  const dir = path5.dirname(targetPath);
-  if (!fs9.existsSync(dir)) {
-    fs9.mkdirSync(dir, { recursive: true });
+  const targetPath = opts.output ? path6.resolve(opts.output) : defaultOutputPath(project, audience);
+  const dir = path6.dirname(targetPath);
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
   }
-  fs9.writeFileSync(targetPath, html, "utf-8");
+  fs10.writeFileSync(targetPath, html, "utf-8");
   console.log(`Report written to ${targetPath}`);
 }
 
@@ -10998,12 +11523,12 @@ var SKILLS_CLI_COMMANDS = [
 ];
 
 // src/commands/snapshot.ts
-import fs11 from "fs";
-import path7 from "path";
+import fs12 from "fs";
+import path8 from "path";
 
 // src/snapshot-pdf.ts
-import fs10 from "fs";
-import path6 from "path";
+import fs11 from "fs";
+import path7 from "path";
 import { PDFDocument, StandardFonts, rgb } from "pdf-lib";
 var PAGE_WIDTH = 612;
 var PAGE_HEIGHT = 792;
@@ -11215,9 +11740,9 @@ async function writeSnapshotPdf(report, outputPath) {
   renderCompetitors(pdf, report);
   renderQueries(pdf, report);
   const bytes = await doc.save();
-  const resolvedPath = path6.resolve(outputPath);
-  fs10.mkdirSync(path6.dirname(resolvedPath), { recursive: true });
-  fs10.writeFileSync(resolvedPath, bytes);
+  const resolvedPath = path7.resolve(outputPath);
+  fs11.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
+  fs11.writeFileSync(resolvedPath, bytes);
   return resolvedPath;
 }
 function renderCover(pdf, report) {
@@ -11375,9 +11900,9 @@ Markdown saved: ${savedMdPath}`);
 PDF saved: ${savedPdfPath}`);
 }
 function writeSnapshotMarkdown(report, outputPath) {
-  const resolvedPath = path7.resolve(outputPath);
-  fs11.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
-  fs11.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
+  const resolvedPath = path8.resolve(outputPath);
+  fs12.mkdirSync(path8.dirname(resolvedPath), { recursive: true });
+  fs12.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
   return resolvedPath;
 }
 function formatSnapshotMarkdown(report) {
@@ -12360,7 +12885,7 @@ var CONTENT_CLI_COMMANDS = [
 
 // src/commands/bootstrap.ts
 import crypto from "crypto";
-import path8 from "path";
+import path9 from "path";
 import { eq } from "drizzle-orm";
 
 // ../config/src/index.ts
@@ -12517,7 +13042,7 @@ async function bootstrapCommand(_opts) {
     );
   }
   const configDir = getConfigDir();
-  const databasePath = env.databasePath || path8.join(configDir, "data.db");
+  const databasePath = env.databasePath || path9.join(configDir, "data.db");
   const existing = configExists();
   const existingConfig = existing ? loadConfig() : void 0;
   let rawApiKey;
@@ -12604,11 +13129,11 @@ async function bootstrapCommand(_opts) {
 }
 
 // src/commands/daemon.ts
-import { spawn } from "child_process";
-import fs12 from "fs";
-import path9 from "path";
+import { spawn as spawn2 } from "child_process";
+import fs13 from "fs";
+import path10 from "path";
 function getPidPath() {
-  return path9.join(getConfigDir(), "canonry.pid");
+  return path10.join(getConfigDir(), "canonry.pid");
 }
 function isProcessAlive(pid) {
   try {
@@ -12648,8 +13173,8 @@ function buildServeForwardArgs(opts) {
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
-  if (fs12.existsSync(pidPath)) {
-    const existingPid = parseInt(fs12.readFileSync(pidPath, "utf-8").trim(), 10);
+  if (fs13.existsSync(pidPath)) {
+    const existingPid = parseInt(fs13.readFileSync(pidPath, "utf-8").trim(), 10);
     if (!isNaN(existingPid) && isProcessAlive(existingPid)) {
       throw new CliError({
         code: "DAEMON_ALREADY_RUNNING",
@@ -12660,13 +13185,13 @@ async function startDaemon(opts) {
         }
       });
     }
-    fs12.unlinkSync(pidPath);
+    fs13.unlinkSync(pidPath);
   }
-  const cliPath = path9.resolve(new URL(import.meta.url).pathname);
+  const cliPath = path10.resolve(new URL(import.meta.url).pathname);
   const inSourceMode = new URL(import.meta.url).pathname.endsWith(".ts");
   const args = inSourceMode ? ["--import", "tsx", cliPath, "serve"] : [cliPath, "serve"];
   args.push(...buildServeForwardArgs(opts));
-  const child = spawn(process.execPath, args, {
+  const child = spawn2(process.execPath, args, {
     detached: true,
     stdio: "ignore"
   });
@@ -12679,10 +13204,10 @@ async function startDaemon(opts) {
     });
   }
   const configDir = getConfigDir();
-  if (!fs12.existsSync(configDir)) {
-    fs12.mkdirSync(configDir, { recursive: true });
+  if (!fs13.existsSync(configDir)) {
+    fs13.mkdirSync(configDir, { recursive: true });
   }
-  fs12.writeFileSync(pidPath, String(child.pid), "utf-8");
+  fs13.writeFileSync(pidPath, String(child.pid), "utf-8");
   const port = opts.port ?? "4100";
   const host = opts.host ?? "127.0.0.1";
   if (!isMachineFormat(format)) {
@@ -12691,7 +13216,7 @@ async function startDaemon(opts) {
   const ready = await waitForReady(host, port);
   if (!ready) {
     try {
-      fs12.unlinkSync(pidPath);
+      fs13.unlinkSync(pidPath);
     } catch {
     }
     throw new CliError({
@@ -12723,7 +13248,7 @@ async function startDaemon(opts) {
 }
 function stopDaemon(format = "text") {
   const pidPath = getPidPath();
-  if (!fs12.existsSync(pidPath)) {
+  if (!fs13.existsSync(pidPath)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: false,
@@ -12734,7 +13259,7 @@ function stopDaemon(format = "text") {
     console.log("Canonry is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs12.readFileSync(pidPath, "utf-8").trim(), 10);
+  const pid = parseInt(fs13.readFileSync(pidPath, "utf-8").trim(), 10);
   if (isNaN(pid)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
@@ -12745,7 +13270,7 @@ function stopDaemon(format = "text") {
     } else {
       console.error("Invalid PID file. Removing it.");
     }
-    fs12.unlinkSync(pidPath);
+    fs13.unlinkSync(pidPath);
     return;
   }
   if (!isProcessAlive(pid)) {
@@ -12759,12 +13284,12 @@ function stopDaemon(format = "text") {
     } else {
       console.log(`Canonry is not running (stale PID: ${pid}). Cleaning up.`);
     }
-    fs12.unlinkSync(pidPath);
+    fs13.unlinkSync(pidPath);
     return;
   }
   try {
     process.kill(pid, "SIGTERM");
-    fs12.unlinkSync(pidPath);
+    fs13.unlinkSync(pidPath);
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: true,
@@ -12788,9 +13313,9 @@ function stopDaemon(format = "text") {
 
 // src/commands/init.ts
 import crypto2 from "crypto";
-import fs13 from "fs";
+import fs14 from "fs";
 import readline2 from "readline";
-import path10 from "path";
+import path11 from "path";
 var pendingServeHandoff = false;
 function consumePendingServeHandoff() {
   const pending = pendingServeHandoff;
@@ -12825,8 +13350,8 @@ var DEFAULT_QUOTA = {
 var PROJECT_MARKERS = [".git", "canonry.yaml", "canonry.yml", "package.json"];
 function cwdLooksLikeProject(dir) {
   const home = process.env.HOME ?? "";
-  if (home && path10.resolve(dir) === path10.resolve(home)) return false;
-  return PROJECT_MARKERS.some((marker) => fs13.existsSync(path10.join(dir, marker)));
+  if (home && path11.resolve(dir) === path11.resolve(home)) return false;
+  return PROJECT_MARKERS.some((marker) => fs14.existsSync(path11.join(dir, marker)));
 }
 var DEFAULT_AGENT_MODELS = {
   anthropic: "anthropic/claude-sonnet-4-6",
@@ -12857,8 +13382,8 @@ async function initCommand(opts) {
     return void 0;
   }
   const configDir = getConfigDir();
-  if (!fs13.existsSync(configDir)) {
-    fs13.mkdirSync(configDir, { recursive: true });
+  if (!fs14.existsSync(configDir)) {
+    fs14.mkdirSync(configDir, { recursive: true });
   }
   const bootstrapEnv = getBootstrapEnv(process.env, {
     GEMINI_API_KEY: opts?.geminiKey,
@@ -12973,7 +13498,7 @@ async function initCommand(opts) {
   const rawApiKey = `cnry_${crypto2.randomBytes(16).toString("hex")}`;
   const keyHash = crypto2.createHash("sha256").update(rawApiKey).digest("hex");
   const keyPrefix = rawApiKey.slice(0, 9);
-  const databasePath = path10.join(configDir, "data.db");
+  const databasePath = path11.join(configDir, "data.db");
   const db = createClient(databasePath);
   migrate(db);
   db.insert(apiKeys).values({
@@ -13159,8 +13684,8 @@ function encodeLegacySetupState(state) {
 }
 
 // src/agent-plugin.ts
-import fs14 from "fs";
-import path11 from "path";
+import fs15 from "fs";
+import path12 from "path";
 var CANONRY_PLUGIN_ID = "canonry@canonry";
 var REQUIRED_SKILLS = ["canonry", "aero"];
 var AGENT_PLUGINS_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
@@ -13204,7 +13729,7 @@ function isCanonryPluginId(value) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(fs14.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs15.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
@@ -13223,7 +13748,7 @@ function readCodexPluginConfigured(filePath) {
   try {
     let currentPlugin = null;
     let inPluginsTable = false;
-    for (const line of fs14.readFileSync(filePath, "utf8").split(/\r?\n/)) {
+    for (const line of fs15.readFileSync(filePath, "utf8").split(/\r?\n/)) {
       const section = /^\s*\[plugins\.(?:"([^"]+)"|'([^']+)'|(\S+))\]\s*(?:#.*)?$/.exec(line);
       if (section) {
         const captures = section.slice(1, 4);
@@ -13256,21 +13781,21 @@ function readCodexPluginConfigured(filePath) {
   }
 }
 function verifiedPluginVersion(root, client) {
-  if (client === "codex" && fs14.existsSync(path11.join(root, "plugin.json"))) {
-    const manifest2 = readJson(path11.join(root, "plugin.json"));
+  if (client === "codex" && fs15.existsSync(path12.join(root, "plugin.json"))) {
+    const manifest2 = readJson(path12.join(root, "plugin.json"));
     if (manifest2 && typeof manifest2 === "object") {
       const plugin2 = manifest2;
       if (plugin2.$schema === AGENT_PLUGINS_SCHEMA) {
         if (plugin2.name !== "canonry" || typeof plugin2.version !== "string" || !parseSemver(plugin2.version)) {
           return null;
         }
-        const mcp2 = readJson(path11.join(root, "mcp.json"));
+        const mcp2 = readJson(path12.join(root, "mcp.json"));
         if (!mcp2 || typeof mcp2 !== "object") return null;
         const portableMcp = mcp2;
         if (portableMcp.$schema !== AGENT_PLUGINS_MCP_SCHEMA || portableMcp.mcpServers?.canonry?.type !== "stdio" || portableMcp.mcpServers.canonry.command !== "canonry-mcp") {
           return null;
         }
-        return REQUIRED_SKILLS.every((name) => fs14.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
+        return REQUIRED_SKILLS.every((name) => fs15.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
       }
       if (typeof plugin2.$schema === "string" && plugin2.$schema.startsWith("https://agent-plugins.org/schemas/")) {
         return null;
@@ -13278,20 +13803,20 @@ function verifiedPluginVersion(root, client) {
     }
   }
   const manifestDir = client === "claude-code" ? ".claude-plugin" : ".codex-plugin";
-  const manifest = readJson(path11.join(root, manifestDir, "plugin.json"));
+  const manifest = readJson(path12.join(root, manifestDir, "plugin.json"));
   if (!manifest || typeof manifest !== "object") return null;
   const plugin = manifest;
   if (plugin.name !== "canonry" || typeof plugin.version !== "string" || !parseSemver(plugin.version) || plugin.skills !== "./skills/" || plugin.mcpServers !== "./.mcp.json") {
     return null;
   }
-  const mcp = readJson(path11.join(root, ".mcp.json"));
+  const mcp = readJson(path12.join(root, ".mcp.json"));
   if (!mcp || typeof mcp !== "object") return null;
   const canonryServer = mcp.mcpServers?.canonry;
   if (canonryServer?.command !== "canonry-mcp") return null;
-  return REQUIRED_SKILLS.every((name) => fs14.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
+  return REQUIRED_SKILLS.every((name) => fs15.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
 }
 function readClaudeUserInstallPaths(claudeConfigDir) {
-  const parsed = readJson(path11.join(claudeConfigDir, "plugins", "installed_plugins.json"));
+  const parsed = readJson(path12.join(claudeConfigDir, "plugins", "installed_plugins.json"));
   if (!parsed || typeof parsed !== "object") return [];
   const plugins = parsed.plugins;
   if (!plugins || typeof plugins !== "object") return [];
@@ -13305,7 +13830,7 @@ function readClaudeUserInstallPaths(claudeConfigDir) {
 }
 function listDirectories(dir) {
   try {
-    return fs14.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path11.join(dir, entry.name));
+    return fs15.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path12.join(dir, entry.name));
   } catch {
     return [];
   }
@@ -13317,8 +13842,8 @@ function verifiedClaudeVersion(claudeConfigDir) {
   return newestVersion(readClaudeUserInstallPaths(claudeConfigDir).map((installPath) => verifiedPluginVersion(installPath, "claude-code")).filter((version) => version !== null));
 }
 function verifiedCodexVersion(codexHome) {
-  const pluginCache = path11.join(codexHome, "plugins", "cache", "canonry", "canonry");
-  const versionedRoots = listDirectories(pluginCache).map((installPath) => ({ installPath, version: path11.basename(installPath) })).filter((candidate) => parseSemver(candidate.version) !== null).sort((left, right) => compareSemver(left.version, right.version));
+  const pluginCache = path12.join(codexHome, "plugins", "cache", "canonry", "canonry");
+  const versionedRoots = listDirectories(pluginCache).map((installPath) => ({ installPath, version: path12.basename(installPath) })).filter((candidate) => parseSemver(candidate.version) !== null).sort((left, right) => compareSemver(left.version, right.version));
   const active = versionedRoots.at(-1);
   if (!active) return verifiedPluginVersion(pluginCache, "codex");
   const manifestVersion = verifiedPluginVersion(active.installPath, "codex");
@@ -13326,12 +13851,12 @@ function verifiedCodexVersion(codexHome) {
 }
 function detectCanonryAgentPlugin(opts = {}) {
   const home = opts.home?.trim() || null;
-  const claudeConfigDir = opts.claudeConfigDir?.trim() || (home ? path11.join(home, ".claude") : null);
-  const codexHome = opts.codexHome?.trim() || (home ? path11.join(home, ".codex") : null);
+  const claudeConfigDir = opts.claudeConfigDir?.trim() || (home ? path12.join(home, ".claude") : null);
+  const codexHome = opts.codexHome?.trim() || (home ? path12.join(home, ".codex") : null);
   const configuredClients = [];
   const verifiedClients = [];
   const verifiedClientVersions = {};
-  const claudeConfigured = claudeConfigDir ? readClaudePluginConfigured(path11.join(claudeConfigDir, "settings.json")) : false;
+  const claudeConfigured = claudeConfigDir ? readClaudePluginConfigured(path12.join(claudeConfigDir, "settings.json")) : false;
   if (claudeConfigured) {
     configuredClients.push("claude-code");
     const version = claudeConfigDir ? verifiedClaudeVersion(claudeConfigDir) : null;
@@ -13340,7 +13865,7 @@ function detectCanonryAgentPlugin(opts = {}) {
       verifiedClientVersions["claude-code"] = version;
     }
   }
-  const codexConfigured = codexHome ? readCodexPluginConfigured(path11.join(codexHome, "config.toml")) : false;
+  const codexConfigured = codexHome ? readCodexPluginConfigured(path12.join(codexHome, "config.toml")) : false;
   if (codexConfigured) {
     configuredClients.push("codex");
     const version = codexHome ? verifiedCodexVersion(codexHome) : null;
@@ -14603,14 +15128,14 @@ Usage: ${usage}`, {
     }
   }
 ];
-function siteHealthAlias(sourcePath, path12, usage) {
+function siteHealthAlias(sourcePath, path13, usage) {
   const source = TECHNICAL_AEO_CLI_COMMANDS_BASE.find(
     (candidate) => candidate.path.join(" ") === sourcePath.join(" ")
   );
   if (!source) throw new Error(`Missing Site Health compatibility source: ${sourcePath.join(" ")}`);
   return {
     ...source,
-    path: path12,
+    path: path13,
     usage,
     run: async (input) => {
       try {
@@ -14621,7 +15146,7 @@ function siteHealthAlias(sourcePath, path12, usage) {
         throw usageError(`${firstLine}
 Usage: ${usage}`, {
           message: error.message,
-          details: { ...error.details, command: path12.join("."), usage }
+          details: { ...error.details, command: path13.join("."), usage }
         });
       }
     }
@@ -14920,7 +15445,7 @@ var VISIBILITY_STATS_CLI_COMMANDS = [
 ];
 
 // src/cli-commands/wordpress.ts
-import fs15 from "fs";
+import fs16 from "fs";
 
 // src/commands/wordpress.ts
 function getClient28() {
@@ -15159,12 +15684,12 @@ async function wordpressSetMeta(project, body) {
   printPageDetail(result);
 }
 async function wordpressBulkSetMeta(project, opts) {
-  const fs17 = await import("fs/promises");
-  const path12 = await import("path");
-  const filePath = path12.resolve(opts.from);
+  const fs18 = await import("fs/promises");
+  const path13 = await import("path");
+  const filePath = path13.resolve(opts.from);
   let raw;
   try {
-    raw = await fs17.readFile(filePath, "utf8");
+    raw = await fs18.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -15261,13 +15786,13 @@ async function wordpressSetSchema(project, body) {
   printManualAssist(`Schema update for "${body.slug}"`, result);
 }
 async function wordpressSchemaDeploy(project, opts) {
-  const fs17 = await import("fs/promises");
-  const path12 = await import("path");
+  const fs18 = await import("fs/promises");
+  const path13 = await import("path");
   const yaml = await loadYamlModule();
-  const filePath = path12.resolve(opts.profile);
+  const filePath = path13.resolve(opts.profile);
   let raw;
   try {
-    raw = await fs17.readFile(filePath, "utf8");
+    raw = await fs18.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -15372,13 +15897,13 @@ async function wordpressOnboard(project, opts) {
   }
   let profileData;
   if (opts.profile) {
-    const fs17 = await import("fs/promises");
-    const path12 = await import("path");
+    const fs18 = await import("fs/promises");
+    const path13 = await import("path");
     const yaml = await loadYamlModule();
-    const filePath = path12.resolve(opts.profile);
+    const filePath = path13.resolve(opts.profile);
     let raw;
     try {
-      raw = await fs17.readFile(filePath, "utf8");
+      raw = await fs18.readFile(filePath, "utf8");
     } catch {
       throw new CliError({
         code: "FILE_READ_ERROR",
@@ -15527,7 +16052,7 @@ function resolveContent(input, command, usage, options) {
   }
   if (contentFile) {
     try {
-      return fs15.readFileSync(contentFile, "utf-8");
+      return fs16.readFileSync(contentFile, "utf-8");
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw usageError(`Error: could not read --content-file "${contentFile}": ${message}`, {
@@ -16494,16 +17019,16 @@ Usage: ${usage}`, {
 
 // src/commands/measurement-plan.ts
 import crypto3 from "crypto";
-import fs16 from "fs";
+import fs17 from "fs";
 import { parse } from "yaml";
 import { z as z2 } from "zod";
 function readPlan(source) {
-  const content = source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
+  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
   return measurementPlanInputSchema.parse(parsed);
 }
 function readDiscoveryRule(source) {
-  const content = source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
+  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
   return measurementDiscoveryRuleSchema.parse(parsed);
 }
@@ -16552,7 +17077,7 @@ var advancedDeactivateInputSchema = z2.object({
 }).strict();
 function readAdvancedMeasurementInput(source) {
   if (source === void 0) return {};
-  const content = source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
+  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
   return JSON.parse(content);
 }
 var advancedMeasurementCollectionKeys = {
@@ -16734,7 +17259,7 @@ async function replaceMeasurementPlanAssignments(project, opts) {
   console.log(JSON.stringify({ preview, result }, null, 2));
 }
 function readGroupMembershipCsv(source) {
-  return source === "-" ? fs16.readFileSync(0, "utf8") : fs16.readFileSync(source, "utf8");
+  return source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
 }
 async function previewMeasurementPlanGroups(project, source) {
   const preview = await createApiClient().previewMeasurementDraftGroupMembership(project, {