@canonry/canonry 4.143.0 → 4.145.0

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-TJ6SDLXL.js";
+} from "./chunk-XNAJXSZ2.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
@@ -47,7 +47,7 @@ import {
   saveConfig,
   saveConfigPatch,
   usageError
-} from "./chunk-3G5B3IMZ.js";
+} from "./chunk-MBLATP5L.js";
 import {
   apiKeys,
   createClient,
@@ -55,7 +55,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-VN3CI6K6.js";
+} from "./chunk-GTBCGJNT.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -74,6 +74,8 @@ import {
   RunStatuses,
   TrafficEventKinds,
   TrafficSeriesGranularities,
+  USER_PASSWORD_MIN_LENGTH,
+  UserRoles,
   adsActivateTreeRequestSchema,
   adsActivationGrantCreateRequestSchema,
   adsAdCreateRequestSchema,
@@ -104,7 +106,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-KUPTGRME.js";
+} from "./chunk-EFBTZ6ZT.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -7549,13 +7551,224 @@ var KEYS_CLI_COMMANDS = [
   }
 ];
 
+// src/cli-prompt.ts
+import readline from "readline";
+async function promptHiddenInput(question) {
+  const input = process.stdin;
+  const output = process.stdout;
+  if (!input.isTTY) {
+    const rl2 = readline.createInterface({ input, output });
+    try {
+      return await new Promise((resolve) => {
+        rl2.question(question, resolve);
+      });
+    } finally {
+      rl2.close();
+    }
+  }
+  const rl = readline.createInterface({ input, output, terminal: true });
+  const mutable = rl;
+  const originalWrite = mutable._writeToOutput?.bind(rl);
+  let muted = false;
+  mutable._writeToOutput = (chunk) => {
+    if (muted) {
+      output.write("");
+      return;
+    }
+    originalWrite?.(chunk);
+  };
+  try {
+    return await new Promise((resolve) => {
+      rl.question(question, (answer) => {
+        output.write("\n");
+        resolve(answer);
+      });
+      muted = true;
+    });
+  } finally {
+    muted = false;
+    if (originalWrite) mutable._writeToOutput = originalWrite;
+    rl.close();
+  }
+}
+async function readAllStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/commands/users.ts
+function getClient13() {
+  return createApiClient();
+}
+var ROLE_NAMES = Object.values(UserRoles);
+function parseRole(role) {
+  const normalized = role.trim().toLowerCase();
+  if (ROLE_NAMES.includes(normalized)) return normalized;
+  throw new CliError({
+    code: "CLI_USAGE_ERROR",
+    message: `Unknown role "${role}" \u2014 choose ${ROLE_NAMES.join(" or ")}`,
+    displayMessage: `Error: unknown role "${role}". Choose ${ROLE_NAMES.join(" or ")}.`
+  });
+}
+async function listUsers(format) {
+  const client = getClient13();
+  const { users } = await client.listUsers();
+  if (format === "json") {
+    console.log(JSON.stringify({ users }, null, 2));
+    return;
+  } else if (format === "jsonl") {
+    emitJsonl(users);
+    return;
+  }
+  if (users.length === 0) {
+    console.log("No accounts yet \u2014 the dashboard opens without a sign-in.");
+    console.log("Create the first one with: canonry user create --name <name> --role admin");
+    return;
+  }
+  console.log(`${"NAME".padEnd(24)} ${"ROLE".padEnd(8)} ${"CREATED".padEnd(12)} LAST SIGN-IN`);
+  for (const user of users) {
+    const lastLogin = user.lastLoginAt ? formatIsoDate(user.lastLoginAt) : "never";
+    console.log(
+      `${user.name.padEnd(24)} ${user.role.padEnd(8)} ${formatIsoDate(user.createdAt).padEnd(12)} ${lastLogin}`
+    );
+  }
+}
+async function createUser(opts) {
+  const role = parseRole(opts.role);
+  const password = opts.passwordStdin ? (await (opts.readStdin ?? readAllStdin)()).replace(/\r?\n$/, "") : await askForPassword();
+  if (password.length < USER_PASSWORD_MIN_LENGTH) {
+    throw new CliError({
+      code: "CLI_USAGE_ERROR",
+      message: "Password too short",
+      displayMessage: `Error: the password must be at least ${USER_PASSWORD_MIN_LENGTH} characters.`
+    });
+  }
+  const client = getClient13();
+  const wasFirst = await isFirstAccount(client);
+  const created = await client.createUser({ name: opts.name, role, password });
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify(created, null, 2));
+    return;
+  }
+  printCreated(created, wasFirst);
+}
+async function askForPassword() {
+  const first = await promptHiddenInput("Password: ");
+  const second = await promptHiddenInput("Confirm password: ");
+  if (first !== second) {
+    throw new CliError({
+      code: "CLI_USAGE_ERROR",
+      message: "Passwords do not match",
+      displayMessage: "Error: the two passwords do not match. Nothing was created."
+    });
+  }
+  return first;
+}
+async function isFirstAccount(client) {
+  try {
+    const { users } = await client.listUsers();
+    return users.length === 0;
+  } catch {
+    return false;
+  }
+}
+function printCreated(created, wasFirst) {
+  console.log(`Account "${created.name}" created with ${created.role} access.
+`);
+  if (wasFirst) {
+    console.log("This is the first account on this install, so the dashboard now asks");
+    console.log("everyone to sign in. API keys are unaffected and keep working as before.\n");
+  }
+  if (created.role === UserRoles.viewer) {
+    console.log("A viewer can read everything and change nothing.");
+  } else {
+    console.log("An administrator can do everything the install could already do.");
+  }
+}
+async function deleteUser(name, format) {
+  const client = getClient13();
+  const result = await client.deleteUser(name);
+  if (isMachineFormat(format)) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(`Account "${result.name}" deleted. Any browser signed in as them is signed out now.`);
+}
+
+// src/cli-commands/users.ts
+var CREATE_USAGE = "canonry user create --name <name> --role <admin|viewer> [--password-stdin] [--format json]";
+var USERS_CLI_COMMANDS = [
+  {
+    path: ["user", "list"],
+    usage: "canonry user list [--format json|jsonl]",
+    run: async (input) => {
+      await listUsers(input.format);
+    }
+  },
+  {
+    path: ["user", "create"],
+    usage: CREATE_USAGE,
+    options: {
+      name: stringOption(),
+      role: stringOption(),
+      // There is deliberately no `--password` flag: a password given on the
+      // command line lands in the shell history and the process list.
+      "password-stdin": { type: "boolean" }
+    },
+    run: async (input) => {
+      const name = requireStringOption(input, "name", {
+        command: "user.create",
+        usage: CREATE_USAGE,
+        message: "--name is required"
+      });
+      const role = requireStringOption(input, "role", {
+        command: "user.create",
+        usage: CREATE_USAGE,
+        message: "--role is required (admin or viewer)"
+      });
+      await createUser({
+        name,
+        role,
+        passwordStdin: getBoolean(input.values, "password-stdin"),
+        format: input.format
+      });
+    }
+  },
+  {
+    path: ["user", "delete"],
+    usage: "canonry user delete <name> [--format json]",
+    run: async (input) => {
+      const name = requirePositional(input, 0, {
+        command: "user.delete",
+        usage: "canonry user delete <name> [--format json]",
+        message: "Account name is required"
+      });
+      await deleteUser(name, input.format);
+    }
+  },
+  {
+    path: ["user"],
+    usage: "canonry user <list|create|delete>",
+    run: async (input) => {
+      unknownSubcommand(input.positionals[0], {
+        command: "user",
+        usage: "canonry user <list|create|delete>",
+        available: ["list", "create", "delete"]
+      });
+    }
+  }
+];
+
 // src/commands/keyword.ts
 import fs4 from "fs";
-function getClient13() {
+function getClient14() {
   return createApiClient();
 }
 async function addKeywords(project, keywords, format) {
-  const client = getClient13();
+  const client = getClient14();
   await client.appendKeywords(project, keywords);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({
@@ -7568,7 +7781,7 @@ async function addKeywords(project, keywords, format) {
   console.log(`Added ${keywords.length} key phrase(s) to "${project}".`);
 }
 async function replaceKeywords(project, keywords, format) {
-  const client = getClient13();
+  const client = getClient14();
   await client.putKeywords(project, keywords);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({
@@ -7581,7 +7794,7 @@ async function replaceKeywords(project, keywords, format) {
   console.log(`Set ${keywords.length} key phrase(s) for "${project}".`);
 }
 async function removeKeywords(project, keywords, format) {
-  const client = getClient13();
+  const client = getClient14();
   const existing = await client.listKeywords(project);
   const existingSet = new Set(existing.map((k) => k.keyword));
   const removedKeywords = keywords.filter((k) => existingSet.has(k));
@@ -7598,7 +7811,7 @@ async function removeKeywords(project, keywords, format) {
   console.log(`Removed ${removedKeywords.length} key phrase(s) from "${project}".`);
 }
 async function listKeywords(project, format) {
-  const client = getClient13();
+  const client = getClient14();
   const kws = await client.listKeywords(project);
   if (format === "json") {
     console.log(JSON.stringify(kws, null, 2));
@@ -7644,7 +7857,7 @@ async function importKeywords(project, filePath, format) {
     console.log("No key phrases found in file.");
     return;
   }
-  const client = getClient13();
+  const client = getClient14();
   await client.appendKeywords(project, keywords);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({
@@ -7658,7 +7871,7 @@ async function importKeywords(project, filePath, format) {
   console.log(`Imported ${keywords.length} key phrase(s) to "${project}".`);
 }
 async function generateKeywords(project, provider, opts) {
-  const client = getClient13();
+  const client = getClient14();
   const result = await client.generateKeywords(project, provider, opts.count);
   const saved = Boolean(opts.save && result.keywords.length > 0);
   if (!isMachineFormat(opts.format)) {
@@ -7831,11 +8044,11 @@ var KEYWORD_CLI_COMMANDS = [
 
 // src/commands/query.ts
 import fs5 from "fs";
-function getClient14() {
+function getClient15() {
   return createApiClient();
 }
 async function addQueries(project, queries2, format) {
-  const client = getClient14();
+  const client = getClient15();
   await client.appendQueries(project, queries2);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({
@@ -7848,7 +8061,7 @@ async function addQueries(project, queries2, format) {
   console.log(`Added ${queries2.length} ${queries2.length === 1 ? "query" : "queries"} to "${project}".`);
 }
 async function replaceQueries(project, queries2, opts) {
-  const client = getClient14();
+  const client = getClient15();
   const isJson = isMachineFormat(opts?.format);
   if (opts?.dryRun) {
     const preview = await client.previewReplaceQueries(project, queries2);
@@ -7884,7 +8097,7 @@ async function replaceQueries(project, queries2, opts) {
   console.log(`Set ${queries2.length} ${queries2.length === 1 ? "query" : "queries"} for "${project}".`);
 }
 async function removeQueries(project, queries2, format) {
-  const client = getClient14();
+  const client = getClient15();
   const existing = await client.listQueries(project);
   const existingSet = new Set(existing.map((q) => q.query));
   const removedQueries = queries2.filter((q) => existingSet.has(q));
@@ -7901,7 +8114,7 @@ async function removeQueries(project, queries2, format) {
   console.log(`Removed ${removedQueries.length} ${removedQueries.length === 1 ? "query" : "queries"} from "${project}".`);
 }
 async function listQueries(project, format) {
-  const client = getClient14();
+  const client = getClient15();
   const qs = await client.listQueries(project);
   if (format === "json") {
     console.log(JSON.stringify(qs, null, 2));
@@ -7947,7 +8160,7 @@ async function importQueries(project, filePath, format) {
     console.log("No queries found in file.");
     return;
   }
-  const client = getClient14();
+  const client = getClient15();
   await client.appendQueries(project, queries2);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({
@@ -7961,7 +8174,7 @@ async function importQueries(project, filePath, format) {
   console.log(`Imported ${queries2.length} ${queries2.length === 1 ? "query" : "queries"} to "${project}".`);
 }
 async function generateQueries(project, provider, opts) {
-  const client = getClient14();
+  const client = getClient15();
   const result = await client.generateQueries(project, provider, opts.count);
   const saved = Boolean(opts.save && result.queries.length > 0);
   if (!isMachineFormat(opts.format)) {
@@ -8456,11 +8669,11 @@ var MCP_CLI_COMMANDS = [
 ];
 
 // src/commands/notify.ts
-function getClient15() {
+function getClient16() {
   return createApiClient();
 }
 async function addNotification(project, opts) {
-  const client = getClient15();
+  const client = getClient16();
   const result = await client.createNotification(project, {
     channel: "webhook",
     url: opts.webhook,
@@ -8474,7 +8687,7 @@ async function addNotification(project, opts) {
   printNotification(result);
 }
 async function listNotifications(project, format) {
-  const client = getClient15();
+  const client = getClient16();
   const results = await client.listNotifications(project);
   if (format === "json") {
     console.log(JSON.stringify(results, null, 2));
@@ -8495,7 +8708,7 @@ async function listNotifications(project, format) {
   }
 }
 async function removeNotification(project, id, format) {
-  const client = getClient15();
+  const client = getClient16();
   await client.deleteNotification(project, id);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({ project, id, removed: true }, null, 2));
@@ -8504,7 +8717,7 @@ async function removeNotification(project, id, format) {
   console.log(`Notification ${id} removed from "${project}"`);
 }
 async function testNotification(project, id, format) {
-  const client = getClient15();
+  const client = getClient16();
   const result = await client.testNotification(project, id);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({ project, id, ...result }, null, 2));
@@ -8701,11 +8914,11 @@ async function applyConfigs(filePaths, format) {
 }
 
 // src/commands/analytics.ts
-function getClient16() {
+function getClient17() {
   return createApiClient();
 }
 async function showAnalytics(project, options) {
-  const client = getClient16();
+  const client = getClient17();
   const features = options.feature ? [options.feature] : ["metrics", "gaps", "sources"];
   const results = {};
   for (const feature of features) {
@@ -8908,7 +9121,7 @@ Source Origin Breakdown`);
 }
 
 // src/commands/sources.ts
-function getClient17() {
+function getClient18() {
   return createApiClient();
 }
 var pct = (n) => `${(n * 100).toFixed(1)}%`;
@@ -8919,7 +9132,7 @@ async function showSources(project, options) {
       details: { command: "sources", option: "limit", value: options.limit }
     });
   }
-  const client = getClient17();
+  const client = getClient18();
   const data = await client.getAnalyticsSources(project, { window: options.window, limit: options.limit });
   if (options.format === "jsonl") {
     emitJsonl(data.ranked.entries.map((e) => ({ project, ...e })));
@@ -8970,11 +9183,11 @@ function printRankedEntries(list, indent = "") {
 }
 
 // src/commands/evidence.ts
-function getClient18() {
+function getClient19() {
   return createApiClient();
 }
 async function showEvidence(project, format) {
-  const client = getClient18();
+  const client = getClient19();
   const timeline = await client.getTimeline(project);
   if (format === "json") {
     const enriched = timeline.map((entry) => ({
@@ -9057,7 +9270,7 @@ async function exportResults(project, opts) {
 }
 
 // src/commands/history.ts
-function getClient19() {
+function getClient20() {
   return createApiClient();
 }
 function originLabel(entry) {
@@ -9068,7 +9281,7 @@ function originLabel(entry) {
   return entry.actor;
 }
 async function showHistory(project, format, opts = {}) {
-  const client = getClient19();
+  const client = getClient20();
   try {
     const entries = project ? await client.getHistory(project, opts) : await client.getGlobalHistory(opts);
     if (format === "json") {
@@ -9109,11 +9322,11 @@ async function showHistory(project, format, opts = {}) {
 }
 
 // src/commands/status.ts
-function getClient20() {
+function getClient21() {
   return createApiClient();
 }
 async function showStatus(project, format) {
-  const client = getClient20();
+  const client = getClient21();
   const projectData = await client.getProject(project);
   const latest = await getLatestRunSummary(client, project);
   if (isMachineFormat(format)) {
@@ -9312,11 +9525,11 @@ var OPERATOR_CLI_COMMANDS = [
 ];
 
 // src/commands/project.ts
-function getClient21() {
+function getClient22() {
   return createApiClient();
 }
 async function createProject(name, opts) {
-  const client = getClient21();
+  const client = getClient22();
   const result = await client.putProject(name, {
     displayName: opts.displayName,
     canonicalDomain: opts.domain,
@@ -9334,7 +9547,7 @@ async function createProject(name, opts) {
   console.log(`Project created: ${result.name} (${result.id})`);
 }
 async function listProjects(format) {
-  const client = getClient21();
+  const client = getClient22();
   const projects2 = await client.listProjects();
   if (format === "json") {
     console.log(JSON.stringify(projects2, null, 2));
@@ -9366,7 +9579,7 @@ async function listProjects(format) {
   }
 }
 async function showProject(name, format) {
-  const client = getClient21();
+  const client = getClient22();
   const project = await client.getProject(name);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify(project, null, 2));
@@ -9398,7 +9611,7 @@ async function showProject(name, format) {
   if (project.updatedAt) console.log(`  Updated:          ${project.updatedAt}`);
 }
 async function updateProjectSettings(name, opts) {
-  const client = getClient21();
+  const client = getClient22();
   const project = await client.getProject(name);
   let ownedDomains = opts.ownedDomains ?? project.ownedDomains ?? [];
   if (opts.addOwnedDomain) {
@@ -9461,7 +9674,7 @@ async function updateProjectSettings(name, opts) {
   }
 }
 async function deleteProject(name, opts) {
-  const client = getClient21();
+  const client = getClient22();
   const isJson = isMachineFormat(opts?.format);
   if (opts?.dryRun) {
     const preview = await client.previewProjectDelete(name);
@@ -9491,7 +9704,7 @@ async function deleteProject(name, opts) {
   console.log(`Project deleted: ${name}`);
 }
 async function addLocation(project, opts) {
-  const client = getClient21();
+  const client = getClient22();
   const location = await client.addLocation(project, {
     label: opts.label,
     city: opts.city,
@@ -9506,7 +9719,7 @@ async function addLocation(project, opts) {
   console.log(`Location added: ${opts.label} (${opts.city}, ${opts.region}, ${opts.country})`);
 }
 async function listLocations(project, format) {
-  const client = getClient21();
+  const client = getClient22();
   const result = await client.listLocations(project);
   if (format === "json") {
     console.log(JSON.stringify(result, null, 2));
@@ -9540,7 +9753,7 @@ async function listLocations(project, format) {
   }
 }
 async function removeLocation(project, label, format) {
-  const client = getClient21();
+  const client = getClient22();
   await client.removeLocation(project, label);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({ project, label, removed: true }, null, 2));
@@ -9549,7 +9762,7 @@ async function removeLocation(project, label, format) {
   console.log(`Location removed: ${label}`);
 }
 async function setDefaultLocation(project, label, format) {
-  const client = getClient21();
+  const client = getClient22();
   const result = await client.setDefaultLocation(project, label);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify({ project, ...result }, null, 2));
@@ -9897,12 +10110,12 @@ var ORGANIC_EVIDENCE_CLI_COMMANDS = [
 ];
 
 // src/commands/run.ts
-function getClient22() {
+function getClient23() {
   return createApiClient();
 }
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["completed", "partial", "failed", "cancelled"]);
 async function triggerRun(project, opts) {
-  const client = getClient22();
+  const client = getClient23();
   const body = {};
   if (opts?.provider) {
     const providerInputs = opts.provider.split(",").map((s) => s.trim()).filter(Boolean);
@@ -9912,6 +10125,12 @@ async function triggerRun(project, opts) {
   if (opts?.queries?.length) {
     body.queries = opts.queries;
   }
+  if (opts?.groups?.length || opts?.targets?.length) {
+    body.measurementScope = {
+      ...opts.groups?.length ? { groups: opts.groups } : {},
+      ...opts.targets?.length ? { targets: opts.targets } : {}
+    };
+  }
   if (opts?.location) {
     body.location = opts.location;
   }
@@ -10004,7 +10223,7 @@ async function triggerRun(project, opts) {
   }
 }
 async function triggerRunAll(opts) {
-  const client = getClient22();
+  const client = getClient23();
   const projects2 = await client.listProjects();
   if (projects2.length === 0) {
     if (isMachineFormat(opts?.format)) {
@@ -10087,7 +10306,7 @@ async function triggerRunAll(opts) {
   }
 }
 async function cancelRun(project, runId, format) {
-  const client = getClient22();
+  const client = getClient23();
   let targetId = runId;
   if (!targetId) {
     const runs = await client.listRuns(project);
@@ -10119,7 +10338,7 @@ To cancel by ID  : canonry run cancel ${project} <run-id>`,
   console.log(`Run ${result.id} cancelled.`);
 }
 async function showRun(id, format) {
-  const client = getClient22();
+  const client = getClient23();
   const run = await client.getRun(id);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify(run, null, 2));
@@ -10128,7 +10347,7 @@ async function showRun(id, format) {
   printRunDetail(run);
 }
 async function listRuns(project, opts) {
-  const client = getClient22();
+  const client = getClient23();
   const runs = await client.listRuns(project, opts?.limit, opts?.kind);
   if (opts?.format === "json") {
     console.log(JSON.stringify(runs, null, 2));
@@ -10195,6 +10414,90 @@ function printRunDetail(run) {
 }
 
 // src/cli-commands/run.ts
+var RUN_TRIGGER_USAGE = "canonry run trigger <project> [--group <key>]... [--target <key>]... [--provider <name>] [--query <q>...] [--location <label>] [--all-locations] [--no-location] [--probe] [--wait] [--format json]";
+var RUN_USAGE2 = "canonry run <project|--all> [--group <key>]... [--target <key>]... [--provider <name>] [--query <q>...] [--location <label>] [--all-locations] [--no-location] [--probe] [--wait] [--format json]";
+var RUN_TRIGGER_OPTIONS = {
+  provider: stringOption(),
+  query: multiStringOption(),
+  // Measure one slice of the project's published measurement plan. A group
+  // stands for its member targets; repeat either flag to widen the slice.
+  group: multiStringOption(),
+  target: multiStringOption(),
+  wait: { type: "boolean", default: false },
+  all: { type: "boolean", default: false },
+  location: stringOption(),
+  "all-locations": { type: "boolean", default: false },
+  "no-location": { type: "boolean", default: false },
+  // Probe runs are operator/agent test runs — they write a snapshot
+  // for inspection but are excluded from dashboard / analytics /
+  // intelligence / notifications. Use when you want to verify a
+  // provider works without polluting the project's metrics.
+  probe: { type: "boolean", default: false }
+};
+async function triggerRunCommand(input, command) {
+  const groups = getStringArray(input.values, "group") ?? [];
+  const targets = getStringArray(input.values, "target") ?? [];
+  const queries2 = getStringArray(input.values, "query") ?? [];
+  const usage = command === "run" ? RUN_USAGE2 : RUN_TRIGGER_USAGE;
+  if (getBoolean(input.values, "all")) {
+    if (input.positionals.length > 0) {
+      throw usageError("Error: --all cannot be combined with a project name", {
+        message: "--all cannot be combined with a project name",
+        details: {
+          command,
+          usage: "canonry run --all [--provider <name>] [--wait] [--format json]"
+        }
+      });
+    }
+    if (queries2.length) {
+      throw usageError("Error: --query cannot be combined with --all (query scope is project-specific)", {
+        message: "--query cannot be combined with --all (query scope is project-specific)",
+        details: {
+          command,
+          usage: "canonry run <project> --query <q>... [--provider <name>] [--wait] [--format json]"
+        }
+      });
+    }
+    if (groups.length || targets.length) {
+      throw usageError("Error: --group and --target cannot be combined with --all (a plan slice belongs to one project)", {
+        message: "--group and --target cannot be combined with --all (a plan slice belongs to one project)",
+        details: { command, usage }
+      });
+    }
+    await triggerRunAll({
+      provider: getString(input.values, "provider"),
+      wait: getBoolean(input.values, "wait"),
+      allLocations: getBoolean(input.values, "all-locations"),
+      noLocation: getBoolean(input.values, "no-location"),
+      format: input.format
+    });
+    return;
+  }
+  if (queries2.length && (groups.length || targets.length)) {
+    throw usageError("Error: --query cannot be combined with --group or --target (pick questions, or pick a slice of the plan)", {
+      message: "--query cannot be combined with --group or --target (pick questions, or pick a slice of the plan)",
+      details: { command, usage }
+    });
+  }
+  const project = requireProject(
+    input,
+    command,
+    usage,
+    command === "run" ? "project name is required (or use --all)" : "project name is required"
+  );
+  await triggerRun(project, {
+    provider: getString(input.values, "provider"),
+    queries: queries2.length ? queries2 : void 0,
+    groups: groups.length ? groups : void 0,
+    targets: targets.length ? targets : void 0,
+    wait: getBoolean(input.values, "wait"),
+    location: getString(input.values, "location"),
+    allLocations: getBoolean(input.values, "all-locations"),
+    noLocation: getBoolean(input.values, "no-location"),
+    probe: getBoolean(input.values, "probe"),
+    format: input.format
+  });
+}
 var RUN_CLI_COMMANDS = [
   {
     path: ["run", "show"],
@@ -10216,69 +10519,25 @@ var RUN_CLI_COMMANDS = [
       await cancelRun(project, input.positionals[1], input.format);
     }
   },
+  {
+    path: ["run", "trigger"],
+    usage: RUN_TRIGGER_USAGE,
+    options: RUN_TRIGGER_OPTIONS,
+    run: (input) => triggerRunCommand(
+      // `canonry run trigger` with nothing after it is ambiguous: the
+      // subcommand with no project, or the older form naming a project called
+      // "trigger". Nobody types the subcommand without a project, and a project
+      // whose name collides with a keyword still has to be runnable, so the
+      // project wins and the word is handed back as the positional.
+      input.positionals.length === 0 && !getBoolean(input.values, "all") ? { ...input, positionals: ["trigger"] } : input,
+      "run.trigger"
+    )
+  },
   {
     path: ["run"],
-    usage: "canonry run <project|--all> [--provider <name>] [--query <q>...] [--location <label>] [--all-locations] [--no-location] [--probe] [--wait] [--format json]",
-    options: {
-      provider: stringOption(),
-      query: multiStringOption(),
-      wait: { type: "boolean", default: false },
-      all: { type: "boolean", default: false },
-      location: stringOption(),
-      "all-locations": { type: "boolean", default: false },
-      "no-location": { type: "boolean", default: false },
-      // Probe runs are operator/agent test runs — they write a snapshot
-      // for inspection but are excluded from dashboard / analytics /
-      // intelligence / notifications. Use when you want to verify a
-      // provider works without polluting the project's metrics.
-      probe: { type: "boolean", default: false }
-    },
-    run: async (input) => {
-      if (getBoolean(input.values, "all")) {
-        if (input.positionals.length > 0) {
-          throw usageError("Error: --all cannot be combined with a project name", {
-            message: "--all cannot be combined with a project name",
-            details: {
-              command: "run",
-              usage: "canonry run --all [--provider <name>] [--wait] [--format json]"
-            }
-          });
-        }
-        if (getStringArray(input.values, "query")?.length) {
-          throw usageError("Error: --query cannot be combined with --all (query scope is project-specific)", {
-            message: "--query cannot be combined with --all (query scope is project-specific)",
-            details: {
-              command: "run",
-              usage: "canonry run <project> --query <q>... [--provider <name>] [--wait] [--format json]"
-            }
-          });
-        }
-        await triggerRunAll({
-          provider: getString(input.values, "provider"),
-          wait: getBoolean(input.values, "wait"),
-          allLocations: getBoolean(input.values, "all-locations"),
-          noLocation: getBoolean(input.values, "no-location"),
-          format: input.format
-        });
-        return;
-      }
-      const project = requireProject(
-        input,
-        "run",
-        "canonry run <project> [--provider <name>] [--query <q>...] [--wait] [--format json]",
-        "project name is required (or use --all)"
-      );
-      await triggerRun(project, {
-        provider: getString(input.values, "provider"),
-        queries: getStringArray(input.values, "query"),
-        wait: getBoolean(input.values, "wait"),
-        location: getString(input.values, "location"),
-        allLocations: getBoolean(input.values, "all-locations"),
-        noLocation: getBoolean(input.values, "no-location"),
-        probe: getBoolean(input.values, "probe"),
-        format: input.format
-      });
-    }
+    usage: RUN_USAGE2,
+    options: RUN_TRIGGER_OPTIONS,
+    run: (input) => triggerRunCommand(input, "run")
   },
   {
     path: ["runs"],
@@ -10303,11 +10562,11 @@ var RUN_CLI_COMMANDS = [
 ];
 
 // src/commands/schedule.ts
-function getClient23() {
+function getClient24() {
   return createApiClient();
 }
 async function setSchedule(project, opts) {
-  const client = getClient23();
+  const client = getClient24();
   const body = {};
   if (opts.kind) body.kind = opts.kind;
   if (opts.sourceId) body.sourceId = opts.sourceId;
@@ -10324,7 +10583,7 @@ async function setSchedule(project, opts) {
   printSchedule(result);
 }
 async function showSchedule(project, format, kind) {
-  const client = getClient23();
+  const client = getClient24();
   const result = await client.getSchedule(project, kind);
   if (isMachineFormat(format)) {
     console.log(JSON.stringify(result, null, 2));
@@ -10333,7 +10592,7 @@ async function showSchedule(project, format, kind) {
   printSchedule(result);
 }
 async function enableSchedule(project, format, kind) {
-  const client = getClient23();
+  const client = getClient24();
   const current = await client.getSchedule(project, kind);
   const body = { kind: current.kind, timezone: current.timezone, enabled: true };
   if (current.preset) body.preset = current.preset;
@@ -10348,7 +10607,7 @@ async function enableSchedule(project, format, kind) {
   console.log(`Schedule enabled for "${project}" (kind: ${result.kind})`);
 }
 async function disableSchedule(project, format, kind) {
-  const client = getClient23();
+  const client = getClient24();
   const current = await client.getSchedule(project, kind);
   const body = { kind: current.kind, timezone: current.timezone, enabled: false };
   if (current.preset) body.preset = current.preset;
@@ -10363,7 +10622,7 @@ async function disableSchedule(project, format, kind) {
   console.log(`Schedule disabled for "${project}" (kind: ${result.kind})`);
 }
 async function removeSchedule(project, format, kind) {
-  const client = getClient23();
+  const client = getClient24();
   await client.deleteSchedule(project, kind);
   const resolvedKind = kind ?? "answer-visibility";
   if (isMachineFormat(format)) {
@@ -10481,11 +10740,11 @@ var SCHEDULE_CLI_COMMANDS = [
 ];
 
 // src/commands/settings.ts
-function getClient24() {
+function getClient25() {
   return createApiClient();
 }
 async function setProvider(name, opts) {
-  const client = getClient24();
+  const client = getClient25();
   const { format, ...payload } = opts;
   const result = await client.updateProvider(name, payload);
   if (isMachineFormat(format)) {
@@ -10501,7 +10760,7 @@ async function setProvider(name, opts) {
   }
 }
 async function showSettings(format) {
-  const client = getClient24();
+  const client = getClient25();
   const config = loadConfig();
   const settings = await client.getSettings();
   if (isMachineFormat(format)) {
@@ -11051,7 +11310,7 @@ function wrapText(font, text, size, maxWidth) {
 }
 
 // src/commands/snapshot.ts
-function getClient25() {
+function getClient26() {
   return createApiClient();
 }
 function slugify(value) {
@@ -11062,7 +11321,7 @@ function autoOutputPath(companyName, ext) {
   return `${slugify(companyName)}-snapshot-${date}.${ext}`;
 }
 async function createSnapshotReport(companyName, opts) {
-  const client = getClient25();
+  const client = getClient26();
   const report = await client.createSnapshot({
     companyName,
     domain: opts.domain,
@@ -12508,7 +12767,7 @@ function stopDaemon(format = "text") {
 // src/commands/init.ts
 import crypto2 from "crypto";
 import fs13 from "fs";
-import readline from "readline";
+import readline2 from "readline";
 import path10 from "path";
 var pendingServeHandoff = false;
 function consumePendingServeHandoff() {
@@ -12525,7 +12784,7 @@ async function promptProviderApiKey(label, envVar, promptFn = prompt, env = proc
   return promptFn(`${label} API key (press Enter to skip): `);
 }
 function prompt(question) {
-  const rl = readline.createInterface({
+  const rl = readline2.createInterface({
     input: process.stdin,
     output: process.stdout
   });
@@ -13438,11 +13697,11 @@ var SYSTEM_CLI_COMMANDS = [
 ];
 
 // src/commands/technical-aeo.ts
-function getClient26() {
+function getClient27() {
   return createApiClient();
 }
 async function technicalAeoScore(project, opts) {
-  const client = getClient26();
+  const client = getClient27();
   const score = await client.getTechnicalAeoScore(project, { runId: opts.runId });
   if (isMachineFormat(opts.format)) {
     console.log(JSON.stringify(score, null, 2));
@@ -13478,7 +13737,7 @@ async function technicalAeoScore(project, opts) {
   console.log(lines.join("\n"));
 }
 async function technicalAeoPages(project, opts) {
-  const client = getClient26();
+  const client = getClient27();
   const status = opts.status === "success" || opts.status === "error" ? opts.status : void 0;
   const res = await client.getTechnicalAeoPages(project, { runId: opts.runId, status, sort: opts.sort, limit: opts.limit });
   if (opts.format === "jsonl") {
@@ -13504,7 +13763,7 @@ async function technicalAeoPages(project, opts) {
   console.log(lines.join("\n"));
 }
 async function technicalAeoTrend(project, opts) {
-  const client = getClient26();
+  const client = getClient27();
   const res = await client.getTechnicalAeoTrend(project, { limit: opts.limit });
   if (opts.format === "jsonl") {
     emitJsonl(res.points.map((p) => ({ project, ...p })));
@@ -13526,7 +13785,7 @@ async function technicalAeoTrend(project, opts) {
   console.log(lines.join("\n"));
 }
 async function technicalAeoRun(project, opts) {
-  const client = getClient26();
+  const client = getClient27();
   const { runId, status } = await client.triggerSiteAudit(project, {
     sitemapUrl: opts.sitemapUrl,
     limit: opts.limit
@@ -13885,7 +14144,7 @@ var VISIBILITY_STATS_CLI_COMMANDS = [
 import fs15 from "fs";
 
 // src/commands/wordpress.ts
-function getClient27() {
+function getClient28() {
   return createApiClient();
 }
 async function loadYamlModule() {
@@ -14035,7 +14294,7 @@ async function wordpressConnect(project, opts) {
       details: { project }
     });
   }
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressConnect(project, {
     url: opts.url,
     stagingUrl: opts.stagingUrl,
@@ -14052,7 +14311,7 @@ async function wordpressConnect(project, opts) {
   printWordpressStatus(project, result);
 }
 async function wordpressDisconnect(project, format) {
-  const client = getClient27();
+  const client = getClient28();
   await client.wordpressDisconnect(project);
   if (isMachineFormat(format)) {
     printJson2({ project, disconnected: true });
@@ -14061,7 +14320,7 @@ async function wordpressDisconnect(project, format) {
   console.log(`WordPress disconnected from project "${project}".`);
 }
 async function wordpressStatus(project, format) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressStatus(project);
   if (isMachineFormat(format)) {
     printJson2(result);
@@ -14070,7 +14329,7 @@ async function wordpressStatus(project, format) {
   printWordpressStatus(project, result);
 }
 async function wordpressPages(project, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressPages(project, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14079,7 +14338,7 @@ async function wordpressPages(project, opts) {
   printPages(project, result.env, result.pages);
 }
 async function wordpressPage(project, slug, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressPage(project, slug, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14088,7 +14347,7 @@ async function wordpressPage(project, slug, opts) {
   printPageDetail(result);
 }
 async function wordpressCreatePage(project, body) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressCreatePage(project, body);
   if (isMachineFormat(body.format)) {
     printJson2(result);
@@ -14099,7 +14358,7 @@ async function wordpressCreatePage(project, body) {
   printPageDetail(result);
 }
 async function wordpressUpdatePage(project, body) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressUpdatePage(project, body);
   if (isMachineFormat(body.format)) {
     printJson2(result);
@@ -14110,7 +14369,7 @@ async function wordpressUpdatePage(project, body) {
   printPageDetail(result);
 }
 async function wordpressSetMeta(project, body) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSetMeta(project, body);
   if (isMachineFormat(body.format)) {
     printJson2(result);
@@ -14160,7 +14419,7 @@ async function wordpressBulkSetMeta(project, opts) {
       details: { path: filePath }
     });
   }
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressBulkSetMeta(project, { entries, env: opts.env });
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14203,7 +14462,7 @@ async function wordpressBulkSetMeta(project, opts) {
 Total: ${applied.length} applied, ${skipped.length} skipped, ${manual.length} manual`);
 }
 async function wordpressSchema(project, slug, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSchema(project, slug, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14214,7 +14473,7 @@ async function wordpressSchema(project, slug, opts) {
   printSchemaBlocks(result.blocks);
 }
 async function wordpressSetSchema(project, body) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSetSchema(project, body);
   if (isMachineFormat(body.format)) {
     printJson2(result);
@@ -14262,7 +14521,7 @@ async function wordpressSchemaDeploy(project, opts) {
       details: { path: filePath }
     });
   }
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSchemaDeploy(project, { profile: parsed, env: opts.env });
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14301,7 +14560,7 @@ async function wordpressSchemaDeploy(project, opts) {
 Total: ${deployed} deployed, ${stripped} stripped, ${skipped} skipped, ${failed} failed`);
 }
 async function wordpressSchemaStatus(project, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSchemaStatus(project, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14360,7 +14619,7 @@ async function wordpressOnboard(project, opts) {
       });
     }
   }
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressOnboard(project, {
     url: opts.url,
     username: opts.user,
@@ -14385,7 +14644,7 @@ async function wordpressOnboard(project, opts) {
   }
 }
 async function wordpressLlmsTxt(project, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressLlmsTxt(project, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14396,7 +14655,7 @@ async function wordpressLlmsTxt(project, opts) {
   console.log(result.content ?? "(not found)");
 }
 async function wordpressSetLlmsTxt(project, body) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressSetLlmsTxt(project, body);
   if (isMachineFormat(body.format)) {
     printJson2(result);
@@ -14405,7 +14664,7 @@ async function wordpressSetLlmsTxt(project, body) {
   printManualAssist(`llms.txt update for "${project}"`, result);
 }
 async function wordpressAudit(project, opts) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressAudit(project, opts.env);
   if (isMachineFormat(opts.format)) {
     printJson2(result);
@@ -14419,7 +14678,7 @@ async function wordpressAudit(project, opts) {
   printAuditIssues(result.issues);
 }
 async function wordpressDiff(project, slug, format) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressDiff(project, slug);
   if (isMachineFormat(format)) {
     printJson2(result);
@@ -14428,7 +14687,7 @@ async function wordpressDiff(project, slug, format) {
   printDiff(result);
 }
 async function wordpressStagingStatus(project, format) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressStagingStatus(project);
   if (isMachineFormat(format)) {
     printJson2(result);
@@ -14442,7 +14701,7 @@ async function wordpressStagingStatus(project, format) {
   console.log(`  Admin URL:         ${result.adminUrl}`);
 }
 async function wordpressStagingPush(project, format) {
-  const client = getClient27();
+  const client = getClient28();
   const result = await client.wordpressStagingPush(project);
   if (isMachineFormat(format)) {
     printJson2(result);
@@ -15571,6 +15830,7 @@ var REGISTERED_CLI_COMMANDS = [
   ...QUERY_CLI_COMMANDS,
   ...KEYWORD_CLI_COMMANDS,
   ...KEYS_CLI_COMMANDS,
+  ...USERS_CLI_COMMANDS,
   ...COMPETITOR_CLI_COMMANDS,
   ...SETTINGS_CLI_COMMANDS,
   ...SKILLS_CLI_COMMANDS,