@canonry/canonry 4.158.0 → 4.160.0

package/dist/cli.js

@@ -16,7 +16,7 @@ import {
   detectAndTrackUpgrade,
   emitInstallSummary,
   formatAuditFactorScore,
-  getCloudflareTrafficConnection,
+  getCloudflareTrafficConnectionBySourceId,
   getMissingUserSkillsNudge,
   getOrCreateAnonymousId,
   installSkills,
@@ -31,7 +31,7 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-4VZP64GZ.js";
+} from "./chunk-XGESWHFP.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -51,7 +51,7 @@ import {
   saveConfigPatch,
   systemError,
   usageError
-} from "./chunk-LK6YFHG4.js";
+} from "./chunk-HQAVEK42.js";
 import {
   CLOUDFLARE_WORKER_BINDINGS,
   CLOUDFLARE_WORKER_GENERATED_MARKER,
@@ -65,7 +65,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-YP4K2KXH.js";
+} from "./chunk-X7CYY5Q7.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -129,7 +129,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-DEVAEC2S.js";
+} from "./chunk-7M7T5QXS.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -3875,9 +3875,9 @@ async function gaConnect(project, opts) {
     propertyId: opts.propertyId
   };
   if (opts.keyFile) {
-    const fs18 = await import("fs");
+    const fs19 = await import("fs");
     try {
-      const content = fs18.readFileSync(opts.keyFile, "utf-8");
+      const content = fs19.readFileSync(opts.keyFile, "utf-8");
       JSON.parse(content);
       body.keyJson = content;
     } catch (e) {
@@ -5292,6 +5292,9 @@ var GET_CLI_COMMANDS = [
   }
 ];
 
+// src/commands/traffic.ts
+import fs5 from "fs";
+
 // src/cloudflare-worker-deploy.ts
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
@@ -5455,7 +5458,8 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
 }
 function assertCloudflareArtifactsDoNotContainSecrets(contents, secrets) {
   const artifactText = [contents.workerScript, contents.wranglerToml, contents.instructions ?? ""];
-  for (const secret of [secrets.bearerToken, secrets.hmacSecret]) {
+  const secretValues = "apiToken" in secrets ? [secrets.apiToken] : [secrets.bearerToken, secrets.hmacSecret];
+  for (const secret of secretValues) {
     if (secret && artifactText.some((value) => value.includes(secret))) {
       throw new Error("Cloudflare setup response unexpectedly contained a cleartext secret");
     }
@@ -5463,7 +5467,8 @@ function assertCloudflareArtifactsDoNotContainSecrets(contents, secrets) {
 }
 function redactCloudflareSecrets(message, secrets) {
   let redacted = message;
-  for (const secret of [secrets.bearerToken, secrets.hmacSecret]) {
+  const secretValues = "apiToken" in secrets ? [secrets.apiToken] : [secrets.bearerToken, secrets.hmacSecret];
+  for (const secret of secretValues) {
     if (secret) redacted = redacted.replaceAll(secret, "[REDACTED]");
   }
   return redacted;
@@ -5520,12 +5525,14 @@ ${diagnostic}` : "";
 }
 async function preflightCloudflareWrangler(opts = {}) {
   const runner = opts.run ?? runWranglerCapture;
+  const deliveryMode = opts.deliveryMode ?? "direct-push";
   const help = await runner(
     "wrangler",
     ["deploy", "--help"],
     { cwd: path2.resolve(opts.cwd ?? process.cwd()) }
   );
-  const missing = ["--dry-run", "--secrets-file", "--strict"].filter((flag) => !help.includes(flag));
+  const requiredFlags = deliveryMode === "direct-push" ? ["--dry-run", "--secrets-file", "--strict"] : ["--dry-run", "--strict"];
+  const missing = requiredFlags.filter((flag) => !help.includes(flag));
   if (missing.length > 0) {
     throw new Error(`Wrangler deploy does not support required flags: ${missing.join(", ")}`);
   }
@@ -5539,29 +5546,38 @@ async function preflightCloudflareWrangler(opts = {}) {
   try {
     fs4.chmodSync(tempDirectory, 448);
     fs4.writeFileSync(workerScriptPath, generateWorkerScript({
-      deliveryMode: "direct-push",
+      deliveryMode,
       workerVersion: "preflight",
       botList: DEFAULT_BOT_LIST
     }), { encoding: "utf-8", flag: "wx", mode: 384 });
-    fs4.writeFileSync(wranglerTomlPath, generateWranglerToml({
-      deliveryMode: "direct-push",
-      sourceId: "preflight",
-      hostname: "example.invalid",
-      ingestUrl: "https://canonry.example.invalid/api/v1/projects/preflight/traffic/cloudflare/ingest",
-      workerVersion: "preflight"
-    }), { encoding: "utf-8", flag: "wx", mode: 384 });
-    fs4.writeFileSync(secretsPath, JSON.stringify({
-      [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: "preflight-bearer",
-      [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: "preflight-hmac"
-    }), { encoding: "utf-8", flag: "wx", mode: 384 });
+    fs4.writeFileSync(wranglerTomlPath, generateWranglerToml(
+      deliveryMode === "queue-pull" ? {
+        deliveryMode,
+        sourceId: "preflight",
+        hostname: "example.invalid",
+        queueName: "canonry-preflight",
+        workerVersion: "preflight"
+      } : {
+        deliveryMode,
+        sourceId: "preflight",
+        hostname: "example.invalid",
+        ingestUrl: "https://canonry.example.invalid/api/v1/projects/preflight/traffic/cloudflare/ingest",
+        workerVersion: "preflight"
+      }
+    ), { encoding: "utf-8", flag: "wx", mode: 384 });
+    if (deliveryMode === "direct-push") {
+      fs4.writeFileSync(secretsPath, JSON.stringify({
+        [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: "preflight-bearer",
+        [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: "preflight-hmac"
+      }), { encoding: "utf-8", flag: "wx", mode: 384 });
+    }
     const validationOutput = await runner(
       "wrangler",
       [
         "deploy",
         "--config",
         wranglerTomlPath,
-        "--secrets-file",
-        secretsPath,
+        ...deliveryMode === "direct-push" ? ["--secrets-file", secretsPath] : [],
         "--strict",
         "--dry-run",
         "--outdir",
@@ -5582,6 +5598,18 @@ ${wranglerDiagnostic(validationOutput)}`
   }
 }
 async function deployCloudflareWorker(opts) {
+  const deliveryMode = opts.deliveryMode ?? "direct-push";
+  if (deliveryMode === "queue-pull") {
+    const runner = opts.run ?? runWrangler;
+    await runner(
+      "wrangler",
+      ["deploy", "--config", path2.resolve(opts.wranglerTomlPath), "--strict"],
+      { cwd: path2.dirname(path2.resolve(opts.wranglerTomlPath)) }
+    );
+    return;
+  }
+  if (!opts.secrets) throw new Error("Direct-push Worker deploy requires bearer and HMAC secrets");
+  const secrets = opts.secrets;
   const tempDirectory = fs4.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
   const secretsPath = path2.join(tempDirectory, "secrets.json");
   try {
@@ -5589,8 +5617,8 @@ async function deployCloudflareWorker(opts) {
     fs4.writeFileSync(
       secretsPath,
       JSON.stringify({
-        [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: opts.secrets.bearerToken,
-        [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: opts.secrets.hmacSecret
+        [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: secrets.bearerToken,
+        [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: secrets.hmacSecret
       }),
       { encoding: "utf-8", flag: "wx", mode: 384 }
     );
@@ -5618,6 +5646,9 @@ async function deployCloudflareWorker(opts) {
 }
 
 // src/commands/traffic.ts
+var DEFAULT_CLOUDFLARE_QUEUE_RETENTION_SECONDS = 345600;
+var CLOUDFLARE_QUEUE_RETENTION_MIN_SECONDS = 60;
+var CLOUDFLARE_QUEUE_RETENTION_MAX_SECONDS = 1209600;
 function getClient9() {
   return createApiClient();
 }
@@ -5627,7 +5658,60 @@ function configString(value, fallback = "(unset)") {
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
+function requireCloudflareQueueOption(project, value, option) {
+  if (value?.trim()) return value.trim();
+  const code = option === "--account-id" ? "TRAFFIC_CLOUDFLARE_QUEUE_ACCOUNT_REQUIRED" : option === "--queue-id" ? "TRAFFIC_CLOUDFLARE_QUEUE_ID_REQUIRED" : option === "--queue-name" ? "TRAFFIC_CLOUDFLARE_QUEUE_NAME_REQUIRED" : "TRAFFIC_CLOUDFLARE_QUEUE_TOKEN_FILE_REQUIRED";
+  throw new CliError({
+    code,
+    message: `${option} is required with --delivery-mode queue-pull`,
+    displayMessage: `Error: ${option} is required with --delivery-mode queue-pull`,
+    details: { project }
+  });
+}
+function readCloudflareQueueApiToken(project, tokenFile) {
+  try {
+    const stat = fs5.lstatSync(tokenFile);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error("not a regular file");
+    }
+    const apiToken = fs5.readFileSync(tokenFile, "utf-8").trim();
+    if (!apiToken) throw new Error("file is empty");
+    return apiToken;
+  } catch (error) {
+    const message = errorMessage2(error);
+    throw new CliError({
+      code: "TRAFFIC_CLOUDFLARE_QUEUE_TOKEN_FILE_READ_ERROR",
+      message: `Failed to read --api-token-file: ${message}`,
+      displayMessage: `Error: failed to read --api-token-file "${tokenFile}": ${message}`,
+      details: { project, tokenFile }
+    });
+  }
+}
 async function trafficConnectCloudflare(project, opts, deps = {}) {
+  const deliveryMode = opts.deliveryMode ?? "direct-push";
+  let queuePull;
+  if (deliveryMode === "queue-pull") {
+    const accountId = requireCloudflareQueueOption(project, opts.accountId, "--account-id");
+    const queueId = requireCloudflareQueueOption(project, opts.queueId, "--queue-id");
+    const queueName = requireCloudflareQueueOption(project, opts.queueName, "--queue-name");
+    const tokenFile = requireCloudflareQueueOption(project, opts.apiTokenFile, "--api-token-file");
+    const retentionSeconds = opts.retentionSeconds ?? DEFAULT_CLOUDFLARE_QUEUE_RETENTION_SECONDS;
+    if (!Number.isInteger(retentionSeconds) || retentionSeconds < CLOUDFLARE_QUEUE_RETENTION_MIN_SECONDS || retentionSeconds > CLOUDFLARE_QUEUE_RETENTION_MAX_SECONDS) {
+      throw new CliError({
+        code: "TRAFFIC_CLOUDFLARE_QUEUE_RETENTION_INVALID",
+        message: "--retention-seconds must be an integer between 60 and 1209600",
+        displayMessage: "Error: --retention-seconds must be an integer between 60 and 1209600",
+        details: { project }
+      });
+    }
+    queuePull = {
+      accountId,
+      queueId,
+      queueName,
+      apiToken: readCloudflareQueueApiToken(project, tokenFile),
+      retentionSeconds
+    };
+  }
   if (opts.deploy && !opts.zoneId) {
     throw new CliError({
       code: "TRAFFIC_CLOUDFLARE_DEPLOY_ZONE_REQUIRED",
@@ -5654,7 +5738,7 @@ async function trafficConnectCloudflare(project, opts, deps = {}) {
   }
   if (opts.deploy) {
     try {
-      await (deps.preflightWrangler ?? preflightCloudflareWrangler)();
+      await (deps.preflightWrangler ?? preflightCloudflareWrangler)({ deliveryMode });
     } catch (error) {
       const message = errorMessage2(error);
       throw new CliError({
@@ -5680,18 +5764,27 @@ ${message}`,
     });
   }
   const client = deps.client ?? getClient9();
-  const result = await client.trafficConnectCloudflare(project, {
-    deliveryMode: "direct-push",
-    displayName: opts.displayName,
-    zoneId: opts.zoneId,
-    accountId: opts.accountId
-  });
+  const result = await client.trafficConnectCloudflare(
+    project,
+    deliveryMode === "queue-pull" ? {
+      deliveryMode,
+      displayName: opts.displayName,
+      zoneId: opts.zoneId,
+      ...queuePull
+    } : {
+      deliveryMode,
+      displayName: opts.displayName,
+      zoneId: opts.zoneId,
+      accountId: opts.accountId
+    }
+  );
   const localConfig = (deps.loadLocalConfig ?? loadConfigRaw)();
-  const localCredential = localConfig ? getCloudflareTrafficConnection(localConfig, project) : void 0;
-  const deploymentCredential = localCredential?.sourceId === result.sourceId ? localCredential : void 0;
-  if (deploymentCredential) {
+  const localCredential = localConfig ? getCloudflareTrafficConnectionBySourceId(localConfig, result.sourceId) : void 0;
+  const deploymentCredential = localCredential?.deliveryMode === result.deliveryMode ? localCredential : void 0;
+  const artifactSecrets = deploymentCredential ?? (queuePull ? { apiToken: queuePull.apiToken } : void 0);
+  if (artifactSecrets) {
     try {
-      assertCloudflareArtifactsDoNotContainSecrets(result, deploymentCredential);
+      assertCloudflareArtifactsDoNotContainSecrets(result, artifactSecrets);
     } catch {
       throw new CliError({
         code: "TRAFFIC_CLOUDFLARE_SECRET_EXPOSURE",
@@ -5712,7 +5805,7 @@ ${message}`,
       details: { project, sourceId: result.sourceId, outputDirectory }
     });
   }
-  if (opts.deploy && !deploymentCredential) {
+  if (opts.deploy && result.deliveryMode === "direct-push" && !deploymentCredential) {
     throw new CliError({
       code: "TRAFFIC_CLOUDFLARE_DEPLOY_CONFIG_UNSHARED",
       message: "Cloudflare auto-deploy requires the CLI and Canonry server to share the same local config",
@@ -5724,7 +5817,7 @@ ${message}`,
       }
     });
   }
-  if (opts.deploy && deploymentCredential) {
+  if (opts.deploy && result.deliveryMode === "direct-push" && deploymentCredential?.deliveryMode === "direct-push") {
     try {
       await (deps.deployWorker ?? deployCloudflareWorker)({
         wranglerTomlPath: artifacts.wranglerTomlPath,
@@ -5740,16 +5833,40 @@ ${message}`,
       });
     }
   }
+  if (opts.deploy && result.deliveryMode === "queue-pull") {
+    try {
+      await (deps.deployWorker ?? deployCloudflareWorker)({
+        wranglerTomlPath: artifacts.wranglerTomlPath,
+        deliveryMode: "queue-pull"
+      });
+    } catch (error) {
+      const message = artifactSecrets ? redactCloudflareSecrets(errorMessage2(error), artifactSecrets) : errorMessage2(error);
+      throw new CliError({
+        code: "TRAFFIC_CLOUDFLARE_DEPLOY_FAILED",
+        message,
+        displayMessage: `Error: Cloudflare source connected and artifacts written, but Wrangler deploy failed: ${message}`,
+        details: { project, sourceId: result.sourceId, outputDirectory }
+      });
+    }
+  }
   const summary = {
     sourceId: result.sourceId,
     deliveryMode: result.deliveryMode,
+    activationRequired: result.activationRequired === true,
     workerVersion: result.workerVersion,
     outputDirectory: artifacts.outputDirectory,
     files: {
       workerScript: artifacts.workerScriptPath,
       wranglerConfig: artifacts.wranglerTomlPath
     },
-    autoDeployAvailable: Boolean(deploymentCredential),
+    autoDeployAvailable: result.deliveryMode === "queue-pull" || Boolean(deploymentCredential),
+    ...result.deliveryMode === "queue-pull" ? {
+      queuePullConsumer: {
+        required: true,
+        queueName: result.queueName,
+        configuredBy: "wrangler-or-cloudflare-dashboard"
+      }
+    } : {},
     deployment: opts.deploy ? "worker-deployed-route-unattached" : "not-requested",
     routeAttachment: "required-manual",
     requestLimitFailureMode: {
@@ -5764,7 +5881,7 @@ ${message}`,
     console.log(JSON.stringify(summary, null, 2));
     return;
   }
-  console.log(`Cloudflare direct-push traffic source connected for project "${project}".`);
+  console.log(`Cloudflare ${result.deliveryMode} traffic source connected for project "${project}".`);
   console.log(`  Source ID:       ${result.sourceId}`);
   console.log(`  Worker version:  ${result.workerVersion}`);
   console.log(`  Worker script:   ${artifacts.workerScriptPath}`);
@@ -5776,17 +5893,42 @@ ${message}`,
   console.log("Required: set the route Request limit failure mode to Fail open before route activation.");
   console.log("Wrangler cannot configure this toggle. Workers Free includes 100,000 requests per day for the account.");
   console.log("Use one authoritative server-traffic source for this site. Overlapping adapters double-count project totals.");
+  if (result.deliveryMode === "queue-pull") {
+    console.log(`Required: enable HTTP pull with \`wrangler queues consumer http add ${result.queueName}\` before the first sync.`);
+  }
+  if (result.activationRequired) {
+    console.log(`Activation required: run \`canonry traffic activate ${project} --source ${result.sourceId}\`. This command does not activate delivery.`);
+  }
   if (opts.deploy) {
     console.log("");
     console.log("Required Cloudflare Dashboard steps:");
     console.log(result.instructions);
-    console.log("Keep the Canonry public HTTPS URL reachable so the Worker can push events.");
+    if (result.deliveryMode === "direct-push") {
+      console.log("Keep the Canonry public HTTPS URL reachable so the Worker can push events.");
+    }
   } else if (deploymentCredential) {
     console.log("Next: install and authenticate Wrangler. Inspect the route, then rerun with --deploy --confirm-route --confirm-fail-open and --zone-id <id>.");
+  } else if (result.deliveryMode === "queue-pull") {
+    console.log("Next: install and authenticate Wrangler externally, then rerun with --deploy --confirm-route --confirm-fail-open and --zone-id <id>.");
   } else {
     console.log("Auto-deploy is unavailable because this CLI and the Canonry server do not share local config. Ask the server operator to deploy and install the Worker secrets.");
   }
 }
+async function trafficActivate(project, opts, deps = {}) {
+  const client = deps.client ?? getClient9();
+  const source = await client.trafficActivate(project, opts.sourceId);
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify(source, null, 2));
+    return;
+  }
+  const sourceMode = typeof source.config.deliveryMode === "string" ? source.config.deliveryMode : source.sourceType;
+  const trafficSync2 = sourceMode === "direct-push" ? "not required for direct-push delivery" : "enabled for this pull source";
+  console.log(`Traffic source activated for project "${project}".`);
+  console.log(`  Source ID:       ${source.id}`);
+  console.log(`  Source mode:     ${sourceMode}`);
+  console.log(`  Status:          ${source.status}`);
+  console.log(`  Traffic sync:    ${trafficSync2}`);
+}
 async function trafficConnectWordpress(project, opts) {
   if (!opts.url) {
     throw new CliError({
@@ -5814,9 +5956,9 @@ async function trafficConnectWordpress(project, opts) {
   }
   let applicationPassword = opts.appPassword?.trim() ?? "";
   if (!applicationPassword && opts.appPasswordFile) {
-    const fs18 = await import("fs");
+    const fs19 = await import("fs");
     try {
-      applicationPassword = fs18.readFileSync(opts.appPasswordFile, "utf-8").trim();
+      applicationPassword = fs19.readFileSync(opts.appPasswordFile, "utf-8").trim();
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new CliError({
@@ -5872,10 +6014,10 @@ async function trafficConnectCloudRun(project, opts) {
       details: { project }
     });
   }
-  const fs18 = await import("fs");
+  const fs19 = await import("fs");
   let keyJson;
   try {
-    keyJson = fs18.readFileSync(opts.serviceAccountKey, "utf-8");
+    keyJson = fs19.readFileSync(opts.serviceAccountKey, "utf-8");
     JSON.parse(keyJson);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -5935,9 +6077,9 @@ async function trafficConnectVercel(project, opts) {
   }
   let token = opts.token?.trim() ?? "";
   if (!token && opts.tokenFile) {
-    const fs18 = await import("fs");
+    const fs19 = await import("fs");
     try {
-      token = fs18.readFileSync(opts.tokenFile, "utf-8").trim();
+      token = fs19.readFileSync(opts.tokenFile, "utf-8").trim();
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new CliError({
@@ -6288,11 +6430,16 @@ async function trafficEvents(project, opts) {
 var TRAFFIC_CLI_COMMANDS = [
   {
     path: ["traffic", "connect", "cloudflare"],
-    usage: "canonry traffic connect cloudflare <project> [--display-name <name>] [--zone-id <id>] [--account-id <id>] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open] [--format json]",
+    usage: "canonry traffic connect cloudflare <project> [--delivery-mode direct-push|queue-pull] [--display-name <name>] [--zone-id <id>] [--account-id <id>] [--queue-id <id> --queue-name <name> --api-token-file <path> --retention-seconds 345600] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open] [--format json]",
     options: {
       "display-name": stringOption(),
       "zone-id": stringOption(),
       "account-id": stringOption(),
+      "delivery-mode": stringOption(),
+      "queue-id": stringOption(),
+      "queue-name": stringOption(),
+      "api-token-file": stringOption(),
+      "retention-seconds": stringOption(),
       "output-dir": stringOption(),
       deploy: { type: "boolean" },
       "confirm-route": { type: "boolean" },
@@ -6302,12 +6449,26 @@ var TRAFFIC_CLI_COMMANDS = [
       const project = requireProject(
         input,
         "traffic.connect.cloudflare",
-        "canonry traffic connect cloudflare <project> [--zone-id <id>] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open]"
+        "canonry traffic connect cloudflare <project> [--delivery-mode direct-push|queue-pull] [--zone-id <id>] [--output-dir <dir>] [--deploy --confirm-route --confirm-fail-open]"
       );
+      const deliveryMode = getString(input.values, "delivery-mode") ?? "direct-push";
+      if (deliveryMode !== "direct-push" && deliveryMode !== "queue-pull") {
+        throw new Error("--delivery-mode must be direct-push or queue-pull");
+      }
+      const retentionSeconds = parseIntegerOption(input, "retention-seconds", {
+        command: "traffic.connect.cloudflare",
+        usage: "canonry traffic connect cloudflare <project> --delivery-mode queue-pull --retention-seconds 345600",
+        message: "--retention-seconds must be an integer"
+      });
       await trafficConnectCloudflare(project, {
+        deliveryMode,
         displayName: getString(input.values, "display-name"),
         zoneId: getString(input.values, "zone-id"),
         accountId: getString(input.values, "account-id"),
+        queueId: getString(input.values, "queue-id"),
+        queueName: getString(input.values, "queue-name"),
+        apiTokenFile: getString(input.values, "api-token-file"),
+        retentionSeconds: retentionSeconds ?? DEFAULT_CLOUDFLARE_QUEUE_RETENTION_SECONDS,
         outputDirectory: getString(input.values, "output-dir"),
         deploy: getBoolean(input.values, "deploy"),
         confirmRoute: getBoolean(input.values, "confirm-route"),
@@ -6419,6 +6580,23 @@ var TRAFFIC_CLI_COMMANDS = [
       });
     }
   },
+  {
+    path: ["traffic", "activate"],
+    usage: "canonry traffic activate <project> --source <id> [--format json]",
+    options: {
+      source: stringOption()
+    },
+    run: async (input) => {
+      const project = requireProject(
+        input,
+        "traffic.activate",
+        "canonry traffic activate <project> --source <id>"
+      );
+      const sourceId = getString(input.values, "source");
+      if (!sourceId) throw new Error("--source <id> is required");
+      await trafficActivate(project, { sourceId, format: input.format });
+    }
+  },
   {
     path: ["traffic", "sync"],
     usage: "canonry traffic sync <project> --source <id> [--since-minutes 43200] [--format json]",
@@ -6568,7 +6746,7 @@ var TRAFFIC_CLI_COMMANDS = [
       unknownSubcommand(input.positionals[0], {
         command: "traffic",
         usage: "canonry traffic <subcommand> <project> [args]",
-        available: ["connect", "sync", "backfill", "status", "sources", "events"]
+        available: ["connect", "activate", "sync", "backfill", "status", "sources", "events"]
       });
     }
   }
@@ -8310,7 +8488,7 @@ var USERS_CLI_COMMANDS = [
 ];
 
 // src/commands/keyword.ts
-import fs5 from "fs";
+import fs6 from "fs";
 function getClient14() {
   return createApiClient();
 }
@@ -8378,7 +8556,7 @@ async function listKeywords(project, format) {
   }
 }
 async function importKeywords(project, filePath, format) {
-  if (!fs5.existsSync(filePath)) {
+  if (!fs6.existsSync(filePath)) {
     throw new CliError({
       code: "KEYWORD_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -8389,7 +8567,7 @@ async function importKeywords(project, filePath, format) {
       }
     });
   }
-  const content = fs5.readFileSync(filePath, "utf-8");
+  const content = fs6.readFileSync(filePath, "utf-8");
   const keywords = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (keywords.length === 0) {
     if (isMachineFormat(format)) {
@@ -8590,7 +8768,7 @@ var KEYWORD_CLI_COMMANDS = [
 ];
 
 // src/commands/query.ts
-import fs6 from "fs";
+import fs7 from "fs";
 function getClient15() {
   return createApiClient();
 }
@@ -8681,7 +8859,7 @@ async function listQueries(project, format) {
   }
 }
 async function importQueries(project, filePath, format) {
-  if (!fs6.existsSync(filePath)) {
+  if (!fs7.existsSync(filePath)) {
     throw new CliError({
       code: "QUERY_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -8692,7 +8870,7 @@ async function importQueries(project, filePath, format) {
       }
     });
   }
-  const content = fs6.readFileSync(filePath, "utf-8");
+  const content = fs7.readFileSync(filePath, "utf-8");
   const queries2 = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (queries2.length === 0) {
     if (isMachineFormat(format)) {
@@ -8894,7 +9072,7 @@ var QUERY_CLI_COMMANDS = [
 ];
 
 // src/commands/mcp.ts
-import fs7 from "fs";
+import fs8 from "fs";
 import path4 from "path";
 import { createRequire } from "module";
 
@@ -9010,8 +9188,8 @@ function renderClientSnippet(client, serverName, entry) {
   return renderJsonSnippet(serverName, entry, client.format);
 }
 function readJsonConfig(configPath) {
-  if (!fs7.existsSync(configPath)) return {};
-  const raw = fs7.readFileSync(configPath, "utf-8").trim();
+  if (!fs8.existsSync(configPath)) return {};
+  const raw = fs8.readFileSync(configPath, "utf-8").trim();
   if (!raw) return {};
   try {
     const parsed = JSON.parse(raw);
@@ -9029,14 +9207,14 @@ function readJsonConfig(configPath) {
   }
 }
 function writeJsonConfig(configPath, value) {
-  fs7.mkdirSync(path4.dirname(configPath), { recursive: true });
-  fs7.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
+  fs8.mkdirSync(path4.dirname(configPath), { recursive: true });
+  fs8.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
 `, "utf-8");
 }
 function backupConfigIfPresent(configPath) {
-  if (!fs7.existsSync(configPath)) return void 0;
+  if (!fs8.existsSync(configPath)) return void 0;
   const backupPath = `${configPath}.canonry.bak`;
-  fs7.copyFileSync(configPath, backupPath);
+  fs8.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function findClientOrThrow(id) {
@@ -9392,13 +9570,13 @@ var NOTIFY_CLI_COMMANDS = [
 ];
 
 // src/commands/apply.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import { parseAllDocuments } from "yaml";
 async function applyConfigFile(filePath) {
-  if (!fs8.existsSync(filePath)) {
+  if (!fs9.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const content = fs8.readFileSync(filePath, "utf-8");
+  const content = fs9.readFileSync(filePath, "utf-8");
   const docs = parseAllDocuments(content);
   const client = createApiClient();
   const errors = [];
@@ -9801,7 +9979,7 @@ async function loadLatestRunForExport(client, project) {
 }
 
 // src/commands/results-export.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import path5 from "path";
 async function exportResults(project, opts) {
   const { output, ...request } = opts;
@@ -9811,8 +9989,8 @@ async function exportResults(project, opts) {
     return;
   }
   const target = output ? path5.resolve(output) : path5.resolve(process.cwd(), path5.basename(artifact.filename));
-  fs9.mkdirSync(path5.dirname(target), { recursive: true });
-  fs9.writeFileSync(target, artifact.content, "utf8");
+  fs10.mkdirSync(path5.dirname(target), { recursive: true });
+  fs10.writeFileSync(target, artifact.content, "utf8");
   console.log(`Results export written to ${target}`);
 }
 
@@ -10528,7 +10706,7 @@ function parseProviderModelAssignments(assignments) {
 }
 
 // src/commands/report.ts
-import fs10 from "fs";
+import fs11 from "fs";
 import path6 from "path";
 function defaultOutputPath(project, audience) {
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -10545,10 +10723,10 @@ async function runReportCommand(project, opts = {}) {
   const html = renderReportHtml(report, { audience });
   const targetPath = opts.output ? path6.resolve(opts.output) : defaultOutputPath(project, audience);
   const dir = path6.dirname(targetPath);
-  if (!fs10.existsSync(dir)) {
-    fs10.mkdirSync(dir, { recursive: true });
+  if (!fs11.existsSync(dir)) {
+    fs11.mkdirSync(dir, { recursive: true });
   }
-  fs10.writeFileSync(targetPath, html, "utf-8");
+  fs11.writeFileSync(targetPath, html, "utf-8");
   console.log(`Report written to ${targetPath}`);
 }
 
@@ -11523,11 +11701,11 @@ var SKILLS_CLI_COMMANDS = [
 ];
 
 // src/commands/snapshot.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import path8 from "path";
 
 // src/snapshot-pdf.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import path7 from "path";
 import { PDFDocument, StandardFonts, rgb } from "pdf-lib";
 var PAGE_WIDTH = 612;
@@ -11741,8 +11919,8 @@ async function writeSnapshotPdf(report, outputPath) {
   renderQueries(pdf, report);
   const bytes = await doc.save();
   const resolvedPath = path7.resolve(outputPath);
-  fs11.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
-  fs11.writeFileSync(resolvedPath, bytes);
+  fs12.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
+  fs12.writeFileSync(resolvedPath, bytes);
   return resolvedPath;
 }
 function renderCover(pdf, report) {
@@ -11901,8 +12079,8 @@ PDF saved: ${savedPdfPath}`);
 }
 function writeSnapshotMarkdown(report, outputPath) {
   const resolvedPath = path8.resolve(outputPath);
-  fs12.mkdirSync(path8.dirname(resolvedPath), { recursive: true });
-  fs12.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
+  fs13.mkdirSync(path8.dirname(resolvedPath), { recursive: true });
+  fs13.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
   return resolvedPath;
 }
 function formatSnapshotMarkdown(report) {
@@ -13130,7 +13308,7 @@ async function bootstrapCommand(_opts) {
 
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import fs13 from "fs";
+import fs14 from "fs";
 import path10 from "path";
 function getPidPath() {
   return path10.join(getConfigDir(), "canonry.pid");
@@ -13173,8 +13351,8 @@ function buildServeForwardArgs(opts) {
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
-  if (fs13.existsSync(pidPath)) {
-    const existingPid = parseInt(fs13.readFileSync(pidPath, "utf-8").trim(), 10);
+  if (fs14.existsSync(pidPath)) {
+    const existingPid = parseInt(fs14.readFileSync(pidPath, "utf-8").trim(), 10);
     if (!isNaN(existingPid) && isProcessAlive(existingPid)) {
       throw new CliError({
         code: "DAEMON_ALREADY_RUNNING",
@@ -13185,7 +13363,7 @@ async function startDaemon(opts) {
         }
       });
     }
-    fs13.unlinkSync(pidPath);
+    fs14.unlinkSync(pidPath);
   }
   const cliPath = path10.resolve(new URL(import.meta.url).pathname);
   const inSourceMode = new URL(import.meta.url).pathname.endsWith(".ts");
@@ -13204,10 +13382,10 @@ async function startDaemon(opts) {
     });
   }
   const configDir = getConfigDir();
-  if (!fs13.existsSync(configDir)) {
-    fs13.mkdirSync(configDir, { recursive: true });
+  if (!fs14.existsSync(configDir)) {
+    fs14.mkdirSync(configDir, { recursive: true });
   }
-  fs13.writeFileSync(pidPath, String(child.pid), "utf-8");
+  fs14.writeFileSync(pidPath, String(child.pid), "utf-8");
   const port = opts.port ?? "4100";
   const host = opts.host ?? "127.0.0.1";
   if (!isMachineFormat(format)) {
@@ -13216,7 +13394,7 @@ async function startDaemon(opts) {
   const ready = await waitForReady(host, port);
   if (!ready) {
     try {
-      fs13.unlinkSync(pidPath);
+      fs14.unlinkSync(pidPath);
     } catch {
     }
     throw new CliError({
@@ -13248,7 +13426,7 @@ async function startDaemon(opts) {
 }
 function stopDaemon(format = "text") {
   const pidPath = getPidPath();
-  if (!fs13.existsSync(pidPath)) {
+  if (!fs14.existsSync(pidPath)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: false,
@@ -13259,7 +13437,7 @@ function stopDaemon(format = "text") {
     console.log("Canonry is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs13.readFileSync(pidPath, "utf-8").trim(), 10);
+  const pid = parseInt(fs14.readFileSync(pidPath, "utf-8").trim(), 10);
   if (isNaN(pid)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
@@ -13270,7 +13448,7 @@ function stopDaemon(format = "text") {
     } else {
       console.error("Invalid PID file. Removing it.");
     }
-    fs13.unlinkSync(pidPath);
+    fs14.unlinkSync(pidPath);
     return;
   }
   if (!isProcessAlive(pid)) {
@@ -13284,12 +13462,12 @@ function stopDaemon(format = "text") {
     } else {
       console.log(`Canonry is not running (stale PID: ${pid}). Cleaning up.`);
     }
-    fs13.unlinkSync(pidPath);
+    fs14.unlinkSync(pidPath);
     return;
   }
   try {
     process.kill(pid, "SIGTERM");
-    fs13.unlinkSync(pidPath);
+    fs14.unlinkSync(pidPath);
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: true,
@@ -13313,7 +13491,7 @@ function stopDaemon(format = "text") {
 
 // src/commands/init.ts
 import crypto2 from "crypto";
-import fs14 from "fs";
+import fs15 from "fs";
 import readline2 from "readline";
 import path11 from "path";
 var pendingServeHandoff = false;
@@ -13351,7 +13529,7 @@ var PROJECT_MARKERS = [".git", "canonry.yaml", "canonry.yml", "package.json"];
 function cwdLooksLikeProject(dir) {
   const home = process.env.HOME ?? "";
   if (home && path11.resolve(dir) === path11.resolve(home)) return false;
-  return PROJECT_MARKERS.some((marker) => fs14.existsSync(path11.join(dir, marker)));
+  return PROJECT_MARKERS.some((marker) => fs15.existsSync(path11.join(dir, marker)));
 }
 var DEFAULT_AGENT_MODELS = {
   anthropic: "anthropic/claude-sonnet-4-6",
@@ -13382,8 +13560,8 @@ async function initCommand(opts) {
     return void 0;
   }
   const configDir = getConfigDir();
-  if (!fs14.existsSync(configDir)) {
-    fs14.mkdirSync(configDir, { recursive: true });
+  if (!fs15.existsSync(configDir)) {
+    fs15.mkdirSync(configDir, { recursive: true });
   }
   const bootstrapEnv = getBootstrapEnv(process.env, {
     GEMINI_API_KEY: opts?.geminiKey,
@@ -13684,7 +13862,7 @@ function encodeLegacySetupState(state) {
 }
 
 // src/agent-plugin.ts
-import fs15 from "fs";
+import fs16 from "fs";
 import path12 from "path";
 var CANONRY_PLUGIN_ID = "canonry@canonry";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -13729,7 +13907,7 @@ function isCanonryPluginId(value) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(fs15.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs16.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
@@ -13748,7 +13926,7 @@ function readCodexPluginConfigured(filePath) {
   try {
     let currentPlugin = null;
     let inPluginsTable = false;
-    for (const line of fs15.readFileSync(filePath, "utf8").split(/\r?\n/)) {
+    for (const line of fs16.readFileSync(filePath, "utf8").split(/\r?\n/)) {
       const section = /^\s*\[plugins\.(?:"([^"]+)"|'([^']+)'|(\S+))\]\s*(?:#.*)?$/.exec(line);
       if (section) {
         const captures = section.slice(1, 4);
@@ -13781,7 +13959,7 @@ function readCodexPluginConfigured(filePath) {
   }
 }
 function verifiedPluginVersion(root, client) {
-  if (client === "codex" && fs15.existsSync(path12.join(root, "plugin.json"))) {
+  if (client === "codex" && fs16.existsSync(path12.join(root, "plugin.json"))) {
     const manifest2 = readJson(path12.join(root, "plugin.json"));
     if (manifest2 && typeof manifest2 === "object") {
       const plugin2 = manifest2;
@@ -13795,7 +13973,7 @@ function verifiedPluginVersion(root, client) {
         if (portableMcp.$schema !== AGENT_PLUGINS_MCP_SCHEMA || portableMcp.mcpServers?.canonry?.type !== "stdio" || portableMcp.mcpServers.canonry.command !== "canonry-mcp") {
           return null;
         }
-        return REQUIRED_SKILLS.every((name) => fs15.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
+        return REQUIRED_SKILLS.every((name) => fs16.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
       }
       if (typeof plugin2.$schema === "string" && plugin2.$schema.startsWith("https://agent-plugins.org/schemas/")) {
         return null;
@@ -13813,7 +13991,7 @@ function verifiedPluginVersion(root, client) {
   if (!mcp || typeof mcp !== "object") return null;
   const canonryServer = mcp.mcpServers?.canonry;
   if (canonryServer?.command !== "canonry-mcp") return null;
-  return REQUIRED_SKILLS.every((name) => fs15.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
+  return REQUIRED_SKILLS.every((name) => fs16.existsSync(path12.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
 }
 function readClaudeUserInstallPaths(claudeConfigDir) {
   const parsed = readJson(path12.join(claudeConfigDir, "plugins", "installed_plugins.json"));
@@ -13830,7 +14008,7 @@ function readClaudeUserInstallPaths(claudeConfigDir) {
 }
 function listDirectories(dir) {
   try {
-    return fs15.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path12.join(dir, entry.name));
+    return fs16.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path12.join(dir, entry.name));
   } catch {
     return [];
   }
@@ -14354,6 +14532,29 @@ async function technicalAeoTrend(project, opts) {
   }
   console.log(lines.join("\n"));
 }
+async function technicalAeoProgress(project, opts) {
+  const progress = await getClient27().getTechnicalAeoProgress(project, opts.runId);
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify(progress, null, 2));
+    return;
+  }
+  const lines = [
+    `Site Health progress: ${progress.phase} (${progress.status})`,
+    `Run: ${progress.runId}`
+  ];
+  if (progress.attempt) {
+    lines.push(
+      `Pages: ${progress.attempt.pagesDiscovered} found \xB7 ${progress.attempt.pagesFetched} checked \xB7 ${progress.attempt.pagesErrored} failed`,
+      `Eligible: ${progress.attempt.pagesEligible} \xB7 Links found: ${progress.attempt.edgesDiscovered}`,
+      `Updated: ${progress.attempt.lastUpdatedAt}`
+    );
+  } else {
+    lines.push("Pages: waiting for the crawl to start");
+  }
+  lines.push(`Layout: ${progress.layout.state}`);
+  if (progress.error) lines.push(`Error: ${progress.error}`);
+  console.log(lines.join("\n"));
+}
 async function technicalAeoCrawl(project, opts) {
   const crawl = await getClient27().getTechnicalAeoCrawl(project, { runId: opts.runId });
   if (isMachineFormat(opts.format)) {
@@ -14848,6 +15049,21 @@ var TECHNICAL_AEO_CLI_COMMANDS_BASE = [
       await technicalAeoCrawl(project, { runId: getString(input.values, "run-id"), format: input.format });
     }
   },
+  {
+    path: ["technical-aeo", "progress"],
+    usage: "canonry technical-aeo progress <project> --run-id <id> [--format json]",
+    options: { "run-id": stringOption() },
+    run: async (input) => {
+      const usage = "canonry technical-aeo progress <project> --run-id <id> [--format json]";
+      const project = requireProject(input, "technical-aeo.progress", usage);
+      const runId = requireStringOption(input, "run-id", {
+        command: "technical-aeo.progress",
+        usage,
+        message: "--run-id is required"
+      });
+      await technicalAeoProgress(project, { runId, format: input.format });
+    }
+  },
   {
     path: ["technical-aeo", "subgraph"],
     usage: "canonry technical-aeo subgraph <project> [--run-id <id>] [--node-key <key>|--url <url>] [--hops <n>] [--max-nodes <n>] [--max-edges <n>] [--format json]",
@@ -15445,7 +15661,7 @@ var VISIBILITY_STATS_CLI_COMMANDS = [
 ];
 
 // src/cli-commands/wordpress.ts
-import fs16 from "fs";
+import fs17 from "fs";
 
 // src/commands/wordpress.ts
 function getClient28() {
@@ -15684,12 +15900,12 @@ async function wordpressSetMeta(project, body) {
   printPageDetail(result);
 }
 async function wordpressBulkSetMeta(project, opts) {
-  const fs18 = await import("fs/promises");
+  const fs19 = await import("fs/promises");
   const path13 = await import("path");
   const filePath = path13.resolve(opts.from);
   let raw;
   try {
-    raw = await fs18.readFile(filePath, "utf8");
+    raw = await fs19.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -15786,13 +16002,13 @@ async function wordpressSetSchema(project, body) {
   printManualAssist(`Schema update for "${body.slug}"`, result);
 }
 async function wordpressSchemaDeploy(project, opts) {
-  const fs18 = await import("fs/promises");
+  const fs19 = await import("fs/promises");
   const path13 = await import("path");
   const yaml = await loadYamlModule();
   const filePath = path13.resolve(opts.profile);
   let raw;
   try {
-    raw = await fs18.readFile(filePath, "utf8");
+    raw = await fs19.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -15897,13 +16113,13 @@ async function wordpressOnboard(project, opts) {
   }
   let profileData;
   if (opts.profile) {
-    const fs18 = await import("fs/promises");
+    const fs19 = await import("fs/promises");
     const path13 = await import("path");
     const yaml = await loadYamlModule();
     const filePath = path13.resolve(opts.profile);
     let raw;
     try {
-      raw = await fs18.readFile(filePath, "utf8");
+      raw = await fs19.readFile(filePath, "utf8");
     } catch {
       throw new CliError({
         code: "FILE_READ_ERROR",
@@ -16052,7 +16268,7 @@ function resolveContent(input, command, usage, options) {
   }
   if (contentFile) {
     try {
-      return fs16.readFileSync(contentFile, "utf-8");
+      return fs17.readFileSync(contentFile, "utf-8");
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw usageError(`Error: could not read --content-file "${contentFile}": ${message}`, {
@@ -17019,16 +17235,16 @@ Usage: ${usage}`, {
 
 // src/commands/measurement-plan.ts
 import crypto3 from "crypto";
-import fs17 from "fs";
+import fs18 from "fs";
 import { parse } from "yaml";
 import { z as z2 } from "zod";
 function readPlan(source) {
-  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
+  const content = source === "-" ? fs18.readFileSync(0, "utf8") : fs18.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
   return measurementPlanInputSchema.parse(parsed);
 }
 function readDiscoveryRule(source) {
-  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
+  const content = source === "-" ? fs18.readFileSync(0, "utf8") : fs18.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse(content);
   return measurementDiscoveryRuleSchema.parse(parsed);
 }
@@ -17077,7 +17293,7 @@ var advancedDeactivateInputSchema = z2.object({
 }).strict();
 function readAdvancedMeasurementInput(source) {
   if (source === void 0) return {};
-  const content = source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
+  const content = source === "-" ? fs18.readFileSync(0, "utf8") : fs18.readFileSync(source, "utf8");
   return JSON.parse(content);
 }
 var advancedMeasurementCollectionKeys = {
@@ -17259,7 +17475,7 @@ async function replaceMeasurementPlanAssignments(project, opts) {
   console.log(JSON.stringify({ preview, result }, null, 2));
 }
 function readGroupMembershipCsv(source) {
-  return source === "-" ? fs17.readFileSync(0, "utf8") : fs17.readFileSync(source, "utf8");
+  return source === "-" ? fs18.readFileSync(0, "utf8") : fs18.readFileSync(source, "utf8");
 }
 async function previewMeasurementPlanGroups(project, source) {
   const preview = await createApiClient().previewMeasurementDraftGroupMembership(project, {