@appfleet-cli/cli 0.1.0

package/dist/command-registry.js

@@ -0,0 +1,1067 @@
+export const cliCommandDocs = [
+    {
+        namespace: "appfleet",
+        name: "link",
+        summary: "Link local project memory to the signed-in hosted AppFleet workspace.",
+        usage: "appfleet link [--json]",
+        arguments: [],
+        options: [{ flags: "--json", description: "Emit machine-readable JSON." }],
+        examples: ["appfleet link", "appfleet link --json"],
+        reads: [".appfleet/cloud-session.json", ".appfleet/project-memory.json"],
+        writes: ["hosted project metadata and local metadata-sync state after authorization"],
+        secretSafety: [
+            "Uploads safe project metadata and the latest safe doctor report only.",
+            "Never uploads environment values, credential values, command output, key wrappers, or provider payloads.",
+        ],
+    },
+    {
+        namespace: "appfleet",
+        name: "init",
+        summary: "Run the first-time local setup flow for the current project.",
+        usage: "appfleet init --url <url> [path] [options]",
+        arguments: ["path: optional project path; defaults to the caller directory."],
+        options: [
+            { flags: "--url <url>", description: "Canonical project URL to import." },
+            { flags: "--project <project>", description: "Project id to use when importing." },
+            { flags: "--name <name>", description: "Human project name." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet init --url https://atlas-notes.example.com",
+            "appfleet init /path/to/app --url https://atlas-notes.example.com --project atlas-notes",
+            "appfleet init --url https://atlas-notes.example.com --json",
+        ],
+        reads: [
+            "package.json and safe source/config files under the project path",
+            "target project git origin remote",
+        ],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Runs safe discovery and import only.",
+            "Skips .env files, .appfleet, node_modules, .git, test files, and build output.",
+            "Does not ask for or store secret values.",
+            "Does not call provider APIs or infer provider health.",
+        ],
+    },
+    {
+        namespace: "auth",
+        name: "login",
+        summary: "Create local-test session metadata by default, or hosted session metadata when production cloud is explicitly enabled.",
+        usage: "appfleet auth login [--workspace <workspace-id>] [--email <email>] [--production-cloud] [--api-base-url <url>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for local-test or hosted session metadata." },
+            { flags: "--email <email>", description: "Optional non-secret user label for local-test identity or hosted login metadata." },
+            { flags: "--production-cloud", description: "Explicitly use hosted auth mode; also requires API/auth env config." },
+            { flags: "--api-base-url <url>", description: "Production AppFleet API base URL; overrides APPFLEET_API_BASE_URL." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet auth login --workspace workspace_test",
+            "appfleet auth login --workspace workspace_test --email demo@example.com --json",
+            "APPFLEET_API_BASE_URL=https://appfleet.xyz appfleet auth login --production-cloud --workspace workspace_prod --json",
+        ],
+        reads: [".appfleet/cloud-session.json if it already exists"],
+        writes: [".appfleet/cloud-session.json local-test or hosted redacted session metadata with status and expiry"],
+        secretSafety: [
+            "Stores user/workspace identity, session status, expiry metadata, and redacted auth source metadata only.",
+            "In production mode, opens the hosted browser auth page and completes through a Clerk-backed local callback; APPFLEET_CLOUD_AUTH_TOKEN is not used for login.",
+            "Does not store access tokens, refresh tokens, cookies, provider credentials, encrypted credential blobs, key wrappers, command output, secret fragments, or secret values.",
+        ],
+    },
+    {
+        namespace: "auth",
+        name: "logout",
+        summary: "Log out of local-test session metadata by default, or revoke hosted session metadata when production cloud is explicitly enabled.",
+        usage: "appfleet auth logout [--production-cloud] [--api-base-url <url>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--production-cloud", description: "Explicitly use hosted logout mode; also requires API/auth env config and hosted session metadata." },
+            { flags: "--api-base-url <url>", description: "Production AppFleet API base URL; overrides APPFLEET_API_BASE_URL." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet auth logout",
+            "appfleet auth logout --json",
+            "APPFLEET_API_BASE_URL=https://appfleet.xyz appfleet auth logout --production-cloud --json",
+        ],
+        reads: [".appfleet/cloud-session.json"],
+        writes: [".appfleet/cloud-session.json is removed when present; JSON output includes a safe logged_out/not_found/missing_hosted_session status"],
+        secretSafety: [
+            "Removes local-test or hosted redacted session metadata and reports a safe logout status.",
+            "In production mode, opens the hosted browser auth page to revoke AppFleet hosted session metadata for the signed-in Clerk user.",
+            "Does not read or remove access tokens, refresh tokens, cookies, provider credentials, encrypted credential blobs, key wrappers, command output, or secret fragments.",
+        ],
+    },
+    {
+        namespace: "cloud",
+        name: "sync",
+        summary: "Sync cloud-safe project metadata in local-test mode by default, or production mode only when explicitly enabled.",
+        usage: "appfleet cloud sync [--workspace <workspace-id>] [--production-cloud] [--api-base-url <url>] [--idempotency-key <key>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the local-test sync store." },
+            { flags: "--production-cloud", description: "Explicitly use production cloud mode; also requires API/auth env config." },
+            { flags: "--api-base-url <url>", description: "Production AppFleet API base URL; overrides APPFLEET_API_BASE_URL." },
+            { flags: "--idempotency-key <key>", description: "Override the production metadata sync idempotency key; retries reuse the same key." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet cloud sync",
+            "appfleet cloud sync --workspace workspace_test --json",
+            "APPFLEET_PRODUCTION_CLOUD_ENABLED=true APPFLEET_API_BASE_URL=https://appfleet.xyz APPFLEET_CLOUD_AUTH_TOKEN=<redacted> appfleet cloud sync --workspace <workspace-id> --json",
+            "APPFLEET_API_BASE_URL=https://appfleet.xyz appfleet cloud sync --production-cloud --workspace <workspace-id> --json",
+        ],
+        reads: [".appfleet/cloud-session.json", ".appfleet/project-memory.json", ".appfleet/cloud-metadata-sync.json"],
+        writes: [".appfleet/cloud-metadata-sync.json", ".appfleet/project-memory.json lastSyncedAt for accepted projects"],
+        secretSafety: [
+            "Chooses local-test mode by default; production mode requires --production-cloud, APPFLEET_PRODUCTION_CLOUD_ENABLED=true, or APPFLEET_CLOUD_MODE=production.",
+            "In production mode, fails closed when APPFLEET_API_BASE_URL/--api-base-url or APPFLEET_CLOUD_AUTH_TOKEN is missing.",
+            "Production metadata sync posts to /api/workspaces/<workspace-id>/metadata-sync on the configured AppFleet web API base URL.",
+            "Production metadata sync sends redacted auth reporting plus an idempotency key, workspace id, and project metadata envelopes.",
+            "Production metadata sync retries safe transient transport failures with the same idempotency key.",
+            "Persists local-test and production sync metadata, project ids, fingerprints, durable queue status, idempotency metadata, and conflict reports only.",
+            "Reports API, database, and config state with redacted tokens, cookies, DSNs, secrets, command output, encrypted blob ids, and key wrappers.",
+            "Omits project-memory payloads, plaintext credential values, encrypted credential blobs, key wrappers, key material, command output, and secret fragments.",
+        ],
+    },
+    {
+        namespace: "cloud",
+        name: "metadata-sync",
+        summary: "Alias-style command for cloud-safe metadata sync with the same local-test/production boundary as cloud sync.",
+        usage: "appfleet cloud metadata-sync [--workspace <workspace-id>] [--production-cloud] [--api-base-url <url>] [--idempotency-key <key>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the local-test sync store." },
+            { flags: "--production-cloud", description: "Explicitly use production cloud mode; also requires API/auth env config." },
+            { flags: "--api-base-url <url>", description: "Production AppFleet API base URL; overrides APPFLEET_API_BASE_URL." },
+            { flags: "--idempotency-key <key>", description: "Override the production metadata sync idempotency key; retries reuse the same key." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet cloud metadata-sync",
+            "appfleet cloud metadata-sync --workspace workspace_test --json",
+            "APPFLEET_CLOUD_MODE=production APPFLEET_API_BASE_URL=https://appfleet.xyz APPFLEET_CLOUD_AUTH_TOKEN=<redacted> appfleet cloud metadata-sync --workspace <workspace-id> --json",
+            "APPFLEET_API_BASE_URL=https://appfleet.xyz appfleet cloud metadata-sync --production-cloud --workspace <workspace-id> --json",
+        ],
+        reads: [".appfleet/cloud-session.json", ".appfleet/project-memory.json", ".appfleet/cloud-metadata-sync.json"],
+        writes: [".appfleet/cloud-metadata-sync.json", ".appfleet/project-memory.json lastSyncedAt for accepted projects"],
+        secretSafety: [
+            "Chooses local-test mode by default; production mode requires --production-cloud, APPFLEET_PRODUCTION_CLOUD_ENABLED=true, or APPFLEET_CLOUD_MODE=production.",
+            "In production mode, fails closed when APPFLEET_API_BASE_URL/--api-base-url or APPFLEET_CLOUD_AUTH_TOKEN is missing.",
+            "Production metadata sync posts to /api/workspaces/<workspace-id>/metadata-sync on the configured AppFleet web API base URL.",
+            "Production metadata sync sends redacted auth reporting plus an idempotency key, workspace id, and project metadata envelopes.",
+            "Production metadata sync retries safe transient transport failures with the same idempotency key.",
+            "Persists local-test and production sync metadata, project ids, fingerprints, durable queue status, idempotency metadata, and conflict reports only.",
+            "Reports API, database, and config state with redacted tokens, cookies, DSNs, secrets, command output, encrypted blob ids, and key wrappers.",
+            "Omits project-memory payloads, plaintext credential values, encrypted credential blobs, key wrappers, key material, command output, and secret fragments.",
+        ],
+    },
+    {
+        namespace: "cloud",
+        name: "resolve-conflict",
+        summary: "Resolve a pending local/cloud metadata conflict state without syncing secret values or encrypted blobs.",
+        usage: "appfleet cloud resolve-conflict --project <project-id> --accept <local|remote> [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--project <project-id>", description: "Project id with a pending metadata conflict." },
+            { flags: "--accept <local|remote>", description: "Resolve by accepting local metadata for the next sync or acknowledging remote metadata." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the local sync store." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet cloud resolve-conflict --workspace workspace_test --project atlas-notes --accept local",
+            "appfleet cloud resolve-conflict --project atlas-notes --accept remote --json",
+        ],
+        reads: [".appfleet/cloud-session.json", ".appfleet/project-memory.json", ".appfleet/cloud-metadata-sync.json"],
+        writes: [".appfleet/cloud-metadata-sync.json conflict and queue status metadata only"],
+        secretSafety: [
+            "Resolves metadata conflict state locally and does not call cloud transport.",
+            "Does not overwrite local project memory with remote payloads because remote project payloads are not stored in the sync queue.",
+            "Does not store project-memory payloads, plaintext credential values, encrypted credential blobs, key wrappers, key material, command output, or secret fragments.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "seed-demo-fleet",
+        summary: "Seed three safe mock projects for local dashboard demos.",
+        usage: "appfleet projects seed-demo-fleet",
+        arguments: [],
+        options: [],
+        examples: ["appfleet projects seed-demo-fleet"],
+        reads: [],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Writes safe mock metadata only.",
+            "Does not store credential values or encrypted credential internals.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "discover",
+        summary: "Discover safe local project metadata and optionally import it into project memory.",
+        usage: "appfleet projects discover [path] [--remember] [--url <url>] [options]",
+        arguments: ["path: optional project path; defaults to the current directory."],
+        options: [
+            { flags: "--project <project>", description: "Project id to use when importing." },
+            { flags: "--name <name>", description: "Human project name." },
+            { flags: "--url <url>", description: "Canonical project URL for import." },
+            { flags: "--remember", description: "Write discovered safe facts to project memory." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet projects discover",
+            "appfleet projects discover /path/to/app --json",
+            "appfleet projects discover --remember --url https://atlas-notes.example.com",
+        ],
+        reads: [
+            "package.json and safe source/config files under the project path",
+            "target project git origin remote",
+        ],
+        writes: [".appfleet/project-memory.json only when --remember is provided"],
+        secretSafety: [
+            "Skips .env files, .appfleet, node_modules, .git, test files, and build output.",
+            "Records env alias names only; it never stores values.",
+            "Does not call provider APIs or infer provider health.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "create",
+        summary: "Create local project memory from safe public metadata.",
+        usage: "appfleet projects create <project> --url <url> [options]",
+        arguments: ["project: project id to create."],
+        options: [
+            { flags: "--url <url>", description: "Canonical project URL." },
+            { flags: "--name <name>", description: "Human project name." },
+            { flags: "--repo <repo-url>", description: "Repository URL." },
+            {
+                flags: "--git-remote-fingerprint <fingerprint>",
+                description: "Explicit repo fingerprint override.",
+            },
+            { flags: "--path <path>", description: "Remembered local path." },
+            { flags: "--remembered-url <url>", description: "Known old or alternate URL." },
+            {
+                flags: "--provider <Name:kind:role>",
+                description: "Provider alias and safe role metadata.",
+            },
+            {
+                flags: "--env-alias <NAME:purpose>",
+                description: "Environment alias name and non-secret purpose.",
+            },
+            { flags: "--note <note>", description: "Non-secret recovery note." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet projects create atlas-notes --url https://atlas-notes.example.com",
+            "appfleet projects create atlas-notes --url https://atlas-notes.example.com --env-alias \"VITE_SUPABASE_URL:Supabase project URL\"",
+        ],
+        reads: ["current git origin remote unless --git-remote-fingerprint is provided"],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Thin alias of projects remember for safe metadata only.",
+            "Does not read .env files or provider secrets.",
+            "Does not store environment values or claim cloud persistence.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "remember",
+        summary: "Record safe public recovery facts for a project.",
+        usage: "appfleet projects remember <project> --url <url> [options]",
+        arguments: ["project: project id to remember."],
+        options: [
+            { flags: "--url <url>", description: "Canonical project URL." },
+            { flags: "--name <name>", description: "Human project name." },
+            { flags: "--repo <repo-url>", description: "Repository URL." },
+            {
+                flags: "--git-remote-fingerprint <fingerprint>",
+                description: "Explicit repo fingerprint override.",
+            },
+            { flags: "--path <path>", description: "Remembered local path." },
+            { flags: "--remembered-url <url>", description: "Known old or alternate URL." },
+            {
+                flags: "--provider <Name:kind:role>",
+                description: "Provider alias and safe role metadata.",
+            },
+            {
+                flags: "--env-alias <NAME:purpose>",
+                description: "Environment alias name and non-secret purpose.",
+            },
+            { flags: "--note <note>", description: "Non-secret recovery note." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet projects remember atlas-notes --url https://atlas-notes.example.com",
+            "appfleet projects remember atlas-notes --url https://atlas-notes.example.com --provider \"Netlify:deployment:frontend hosting\" --env-alias \"VITE_SUPABASE_URL:Supabase project URL\"",
+        ],
+        reads: ["current git origin remote unless --git-remote-fingerprint is provided"],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Stores alias names and public metadata only.",
+            "Does not read .env files.",
+            "Do not put secret values in notes, provider aliases, or env alias purposes.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "edit",
+        summary: "Update safe local project memory fields without reading secrets.",
+        usage: "appfleet projects edit <project> [options]",
+        arguments: ["project: project id to edit."],
+        options: [
+            { flags: "--url <url>", description: "Replace the canonical project URL." },
+            { flags: "--name <name>", description: "Replace the human project name." },
+            { flags: "--repo <repo-url>", description: "Replace the repository URL." },
+            {
+                flags: "--git-remote-fingerprint <fingerprint>",
+                description: "Replace the stored repo fingerprint.",
+            },
+            { flags: "--remembered-url <url>", description: "Add a known old or alternate URL." },
+            {
+                flags: "--provider <Name:kind:role>",
+                description: "Add or update provider alias and safe role metadata.",
+            },
+            {
+                flags: "--env-alias <NAME:purpose>",
+                description: "Add or update an environment alias name and non-secret purpose.",
+            },
+            { flags: "--note <note>", description: "Add a non-secret recovery note." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet projects edit atlas-notes --name \"Atlas Notes\"",
+            "appfleet projects edit atlas-notes --url https://app.example.com --remembered-url https://old.example.com",
+        ],
+        reads: [".appfleet/project-memory.json"],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Updates safe names, URLs, provider labels, env alias names, and notes only.",
+            "Does not read .env files or store environment values.",
+            "Does not call provider APIs or infer provider health.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "env",
+        summary: "List, add, or remove local project environment labels and alias metadata.",
+        usage: "appfleet projects env <list|add|remove> <project> [environment] [options]",
+        arguments: [
+            "action: list, add, or remove.",
+            "project: project id.",
+            "environment: environment label for add or remove.",
+        ],
+        options: [
+            {
+                flags: "--env-alias <NAME:purpose>",
+                description: "Alias metadata to add; for remove, pass alias names to remove.",
+            },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet projects env list atlas-notes",
+            "appfleet projects env add atlas-notes production --env-alias \"VITE_SUPABASE_URL:Supabase project URL\"",
+            "appfleet projects env remove atlas-notes preview --env-alias VITE_PREVIEW_URL",
+        ],
+        reads: [".appfleet/project-memory.json"],
+        writes: [".appfleet/project-memory.json for add and remove"],
+        secretSafety: [
+            "Stores environment labels and alias names only.",
+            "Does not read .env files or store values.",
+            "Does not call provider APIs or claim cloud persistence.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "brief",
+        summary: "Show the lower-level memory-only project view.",
+        usage: "appfleet projects brief [project] [--json]",
+        arguments: ["project: optional explicit project id."],
+        options: [{ flags: "--json", description: "Emit machine-readable JSON." }],
+        examples: ["appfleet projects brief", "appfleet projects brief atlas-notes --json"],
+        reads: [".appfleet/project-memory.json", "current git origin remote when project is omitted"],
+        writes: [],
+        secretSafety: ["Omits credential references and secret material."],
+    },
+    {
+        namespace: "projects",
+        name: "status",
+        summary: "Show the daily recovery summary for a remembered project.",
+        usage: "appfleet projects status [project] [--json]",
+        arguments: ["project: optional explicit project id."],
+        options: [{ flags: "--json", description: "Emit machine-readable JSON." }],
+        examples: ["appfleet projects status", "appfleet projects status atlas-notes --json"],
+        reads: [".appfleet/project-memory.json", "current git origin remote when project is omitted"],
+        writes: [],
+        secretSafety: [
+            "Does not read .env files.",
+            "Does not call provider APIs.",
+            "Does not print credential values.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "doctor",
+        summary: "Run conservative safe diagnostics and persist the latest safe report.",
+        usage: "appfleet projects doctor [project] [--json] [--upload]",
+        arguments: ["project: optional explicit project id."],
+        options: [
+            { flags: "--json", description: "Emit machine-readable JSON." },
+            { flags: "--upload", description: "Upload the safe report through the authenticated production metadata sync path." },
+        ],
+        examples: ["appfleet projects doctor", "appfleet projects doctor atlas-notes --upload --json"],
+        reads: [".appfleet/project-memory.json", "public canonical and remembered URLs"],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: [
+            "Does not read .env files.",
+            "Does not inspect secret contents.",
+            "Does not call Supabase, Netlify, Vercel, or other provider APIs.",
+            "Reports unknown instead of guessing provider failure.",
+        ],
+    },
+    {
+        namespace: "projects",
+        name: "dashboard",
+        summary: "Print the local dashboard URL, dev command, memory status, and next steps.",
+        usage: "appfleet projects dashboard [project] [--json]",
+        arguments: ["project: optional explicit project id."],
+        options: [{ flags: "--json", description: "Emit machine-readable JSON." }],
+        examples: ["appfleet projects dashboard", "appfleet projects dashboard --json"],
+        reads: [".appfleet/project-memory.json", "current git origin remote when project is omitted"],
+        writes: [],
+        secretSafety: ["Does not start the dashboard or read secrets."],
+    },
+    {
+        namespace: "projects",
+        name: "check",
+        summary: "Refresh stored canonical URL status for an explicit project.",
+        usage: "appfleet projects check <project>",
+        arguments: ["project: explicit project id."],
+        options: [],
+        examples: ["appfleet projects check atlas-notes"],
+        reads: [".appfleet/project-memory.json", "public canonical and remembered URLs"],
+        writes: [".appfleet/project-memory.json"],
+        secretSafety: ["Performs URL checks only; it does not use credentials."],
+    },
+    {
+        namespace: "projects",
+        name: "sync",
+        summary: "Inspect the cloud-safe sync contract scaffold.",
+        usage: "appfleet projects sync [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the scaffold envelope." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet projects sync", "appfleet projects sync --workspace workspace_test --json"],
+        reads: [".appfleet/project-memory.json"],
+        writes: [],
+        secretSafety: ["Omits credential references and does not claim production cloud persistence."],
+    },
+    {
+        namespace: "providers",
+        name: "catalog",
+        summary: "List provider integration catalog contracts for GitHub, Vercel, Netlify, Supabase, Cloudflare, Stripe, OpenAI, and Anthropic.",
+        usage: "appfleet providers catalog [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the metadata-only contract report." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet providers catalog", "appfleet providers catalog --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Does not read provider credentials or local secret stores.",
+            "Reports connector boundaries, supported discovery surfaces, and credential-location hint kinds only.",
+            "Does not call provider APIs or infer live provider health.",
+        ],
+    },
+    {
+        namespace: "providers",
+        name: "status",
+        summary: "Report fail-closed provider connection status without contacting the provider.",
+        usage: "appfleet providers status <provider> [--workspace <workspace-id>] [--json]",
+        arguments: ["provider: one of github, vercel, netlify, supabase, cloudflare, stripe, openai, anthropic."],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the metadata-only status report." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet providers status github",
+            "appfleet providers status supabase --workspace workspace_test --json",
+        ],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Returns credentials_required and canSync=false until explicit provider credentials exist.",
+            "Does not read tokens, cookies, provider credentials, encrypted blobs, key wrappers, env values, or command output.",
+            "Does not call provider APIs or infer live provider health.",
+        ],
+    },
+    {
+        namespace: "providers",
+        name: "sync",
+        summary: "Create a provider sync-run scaffold that is blocked until credentials are configured.",
+        usage: "appfleet providers sync <provider> [--workspace <workspace-id>] [--json]",
+        arguments: ["provider: one of github, vercel, netlify, supabase, cloudflare, stripe, openai, anthropic."],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the metadata-only sync run." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet providers sync vercel --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Records no provider payloads and imports zero records.",
+            "Reports blocked_missing_credentials instead of attempting a live sync.",
+            "Does not call provider APIs.",
+        ],
+    },
+    {
+        namespace: "providers",
+        name: "discover",
+        summary: "Inspect provider-side project, environment, or credential-location discovery contracts.",
+        usage: "appfleet providers discover <provider> [--surface <surface>] [--workspace <workspace-id>] [--json]",
+        arguments: ["provider: one of github, vercel, netlify, supabase, cloudflare, stripe, openai, anthropic."],
+        options: [
+            { flags: "--surface <surface>", description: "projects, environments, or credential_locations; defaults to projects." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the metadata-only discovery contract." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet providers discover netlify --surface projects",
+            "appfleet providers discover stripe --surface credential_locations --json",
+        ],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Returns output schema and credential-location hint kinds only.",
+            "Does not discover provider-side records until explicit provider credentials exist.",
+            "Does not call provider APIs.",
+        ],
+    },
+    {
+        namespace: "providers",
+        name: "github",
+        summary: "GitHub provider subcommands, including metadata-only app inventory import.",
+        usage: "appfleet providers github inventory-import --repo <owner/name> [--repo <owner/name>] [--workspace <workspace-id>] [--json]",
+        arguments: ["subcommand: inventory-import."],
+        options: [
+            { flags: "--repo <owner/name>", description: "Repository metadata to include in the import contract; repeatable." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the import contract." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet providers github inventory-import --repo acme/atlas-notes --json",
+        ],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Accepts caller-supplied repository names only.",
+            "Does not call GitHub, read GitHub App private keys, installation tokens, OAuth tokens, cookies, or provider payloads.",
+            "Does not persist imported project memory; it emits a metadata-only import contract.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "observability",
+        summary: "Plan advanced observability integrations with safe public checks and audit correlation.",
+        usage: "appfleet ops observability [--workspace <workspace-id>] [--project <project-id>] [--provider <provider-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the operational workflow." },
+            { flags: "--project <project-id>", description: "Optional project id to scope the plan." },
+            { flags: "--provider <provider-id>", description: "Optional provider id for credential-gated observability import." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops observability --project atlas-notes --provider vercel --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Plans public health, TLS, domain, provider-status annotation, and audit-correlation metadata only.",
+            "Does not call provider APIs, read env files, or accept plaintext secrets.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "rotate-secret",
+        summary: "Generate a fail-closed manual secret rotation plan.",
+        usage: "appfleet ops rotate-secret --project <project-id> --alias <NAME> [--workspace <workspace-id>] [--provider <provider-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--project <project-id>", description: "Project id whose alias should rotate." },
+            { flags: "--alias <NAME>", description: "Credential alias to rotate; repeat for multiple aliases." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the operational workflow." },
+            { flags: "--provider <provider-id>", description: "Provider id whose external dashboard/tool owns rotation." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops rotate-secret --project atlas-notes --provider supabase --alias SUPABASE_SERVICE_ROLE_KEY --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Does not rotate provider credentials automatically.",
+            "Requires local audit before mutation and local vault update after external provider rotation.",
+            "Does not accept or print secret values.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "repair-provider",
+        summary: "Generate a provider repair plan that fails closed without explicit provider credentials.",
+        usage: "appfleet ops repair-provider --provider <provider-id> [--workspace <workspace-id>] [--project <project-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--provider <provider-id>", description: "Provider id to repair." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the operational workflow." },
+            { flags: "--project <project-id>", description: "Optional project id to scope the repair." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops repair-provider --provider github --project atlas-notes --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Checks safe metadata contracts only.",
+            "Does not mutate provider settings or persist provider payloads.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "incident",
+        summary: "Open a safe incident workflow with mitigation and audit-correlation steps.",
+        usage: "appfleet ops incident [--workspace <workspace-id>] [--project <project-id>] [--provider <provider-id>] [--severity <sev1|sev2|sev3>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the incident." },
+            { flags: "--project <project-id>", description: "Optional affected project id." },
+            { flags: "--provider <provider-id>", description: "Optional affected provider id." },
+            { flags: "--severity <sev1|sev2|sev3>", description: "Incident severity; defaults to sev3." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops incident --project atlas-notes --provider vercel --severity sev2 --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Captures safe evidence fields only.",
+            "Does not include logs, command output, provider payloads, or secret values.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "runbook",
+        summary: "Generate a production operations runbook checklist.",
+        usage: "appfleet ops runbook --kind <deploy|rollback|env_rotation|migration|provider_repair|incident_response> [--workspace <workspace-id>] [--project <project-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--kind <kind>", description: "Runbook kind to generate." },
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the runbook." },
+            { flags: "--project <project-id>", description: "Optional project id to scope the runbook." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops runbook --kind rollback --project atlas-notes --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Returns checklist metadata only.",
+            "Does not execute deploys, rollbacks, migrations, provider changes, or env rotations.",
+        ],
+    },
+    {
+        namespace: "ops",
+        name: "audit-verify",
+        summary: "Plan tamper-evident audit-chain verification over safe audit ids.",
+        usage: "appfleet ops audit-verify [--workspace <workspace-id>] [--project <project-id>] [--audit-id <audit-id>] [--broken-at <audit-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the audit chain." },
+            { flags: "--project <project-id>", description: "Optional project id to scope verification." },
+            { flags: "--audit-id <audit-id>", description: "Safe audit id to include; repeat for ordered events." },
+            { flags: "--broken-at <audit-id>", description: "Optional audit id where a broken chain was detected." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet ops audit-verify --audit-id audit_1 --audit-id audit_2 --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Uses audit ids and hash-chain metadata only.",
+            "Does not include local command output, encrypted blobs, provider payloads, or secret values.",
+        ],
+    },
+    {
+        namespace: "audit",
+        name: "sync",
+        summary: "Convert local sensitive-audit events into cloud-safe audit shadow metadata.",
+        usage: "appfleet audit sync [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id whose local audit events should be synced." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet audit sync --workspace workspace_local --json"],
+        reads: [".appfleet/vault-audit.jsonl"],
+        writes: [".appfleet/cloud-audit-sync.json"],
+        secretSafety: [
+            "Writes cloud-safe audit metadata only.",
+            "Omits command output, plaintext secrets, encrypted credential blob ids, provider payloads, key material, and secret fragments.",
+            "Does not call provider APIs.",
+        ],
+    },
+    {
+        namespace: "health",
+        name: "schedule",
+        summary: "Show the safe health-check scheduler and cron heartbeat contract.",
+        usage: "appfleet health schedule [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the scheduler contract." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet health schedule --workspace workspace_local --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Schedules public URL, TLS, and stored domain metadata checks only.",
+            "Does not read .env files.",
+            "Does not call provider APIs or use credentials.",
+        ],
+    },
+    {
+        namespace: "vault",
+        name: "init",
+        summary: "Create the encrypted local vault store.",
+        usage: "appfleet vault init [--workspace <workspace-id>] [--master-password <password>]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the local vault." },
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+        ],
+        examples: ["APPFLEET_MASTER_PASSWORD=demo appfleet vault init"],
+        reads: [".appfleet/local-vault.json if it already exists"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: [
+            "Does not print the master password or workspace vault key.",
+            "Prefer APPFLEET_MASTER_PASSWORD over command-line password values.",
+        ],
+    },
+    {
+        namespace: "vault",
+        name: "unlock",
+        summary: "Verify the local vault can be unlocked by the master password.",
+        usage: "appfleet vault unlock [--master-password <password>]",
+        arguments: [],
+        options: [
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+        ],
+        examples: ["APPFLEET_MASTER_PASSWORD=demo appfleet vault unlock"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [],
+        secretSafety: ["Does not print plaintext key material."],
+    },
+    {
+        namespace: "vault",
+        name: "change-password",
+        summary: "Replace the active master-password key wrapper.",
+        usage: "appfleet vault change-password [--master-password <password>] [--new-master-password <password>]",
+        arguments: [],
+        options: [
+            { flags: "--master-password <password>", description: "Current master password; prefer APPFLEET_MASTER_PASSWORD." },
+            { flags: "--new-master-password <password>", description: "New master password; prefer APPFLEET_NEW_MASTER_PASSWORD." },
+        ],
+        examples: ["APPFLEET_MASTER_PASSWORD=old APPFLEET_NEW_MASTER_PASSWORD=new appfleet vault change-password"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: [
+            "Revokes the old master-password wrapper after the new wrapper is written.",
+            "Does not print passwords, workspace vault keys, salts, ciphertext, or wrapper internals.",
+        ],
+    },
+    {
+        namespace: "vault",
+        name: "recovery generate",
+        summary: "Create recovery-key wrapper and emergency recovery kit metadata.",
+        usage: "appfleet vault recovery generate [--master-password <password>] [--recovery-key <key>]",
+        arguments: [],
+        options: [
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+            { flags: "--recovery-key <key>", description: "User-held recovery key; prefer APPFLEET_RECOVERY_KEY." },
+        ],
+        examples: ["APPFLEET_MASTER_PASSWORD=demo APPFLEET_RECOVERY_KEY=... appfleet vault recovery generate"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: [
+            "Stores only encrypted wrapper data and recovery-kit metadata.",
+            "Does not print or persist the recovery key or plaintext vault key.",
+        ],
+    },
+    {
+        namespace: "vault",
+        name: "recovery unlock",
+        summary: "Verify recovery-key unlock metadata can unwrap the local vault.",
+        usage: "appfleet vault recovery unlock [--recovery-key <key>]",
+        arguments: [],
+        options: [
+            { flags: "--recovery-key <key>", description: "User-held recovery key; prefer APPFLEET_RECOVERY_KEY." },
+        ],
+        examples: ["APPFLEET_RECOVERY_KEY=... appfleet vault recovery unlock"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [],
+        secretSafety: ["Does not print the recovery key or plaintext key material."],
+    },
+    {
+        namespace: "vault",
+        name: "recovery rotate",
+        summary: "Rotate the active recovery-key wrapper metadata.",
+        usage: "appfleet vault recovery rotate [--master-password <password>] [--recovery-key <key>]",
+        arguments: [],
+        options: [
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+            { flags: "--recovery-key <key>", description: "New user-held recovery key; prefer APPFLEET_RECOVERY_KEY." },
+        ],
+        examples: ["APPFLEET_MASTER_PASSWORD=demo APPFLEET_RECOVERY_KEY=... appfleet vault recovery rotate"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: [
+            "Revokes the old active recovery wrapper and records replacement metadata.",
+            "Does not print recovery keys, plaintext vault keys, or wrapper internals.",
+        ],
+    },
+    {
+        namespace: "vault",
+        name: "recovery kit",
+        summary: "Show emergency recovery kit metadata without rendering key material.",
+        usage: "appfleet vault recovery kit",
+        arguments: [],
+        options: [],
+        examples: ["appfleet vault recovery kit"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [],
+        secretSafety: ["Shows recovery-kit metadata only and never renders recovery-key material."],
+    },
+    {
+        namespace: "vault",
+        name: "device-key register",
+        summary: "Record metadata for a future device-key unlock path.",
+        usage: "appfleet vault device-key register --device <device-id> [--label <label>]",
+        arguments: [],
+        options: [
+            { flags: "--device <device-id>", description: "Stable non-secret device id." },
+            { flags: "--label <label>", description: "Non-secret device label." },
+        ],
+        examples: ["appfleet vault device-key register --device laptop-1 --label work-laptop"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: ["Records metadata only; no device private key or plaintext vault key is stored."],
+    },
+    {
+        namespace: "vault",
+        name: "keychain status",
+        summary: "Record the OS keychain integration boundary.",
+        usage: "appfleet vault keychain status [--provider <provider>]",
+        arguments: [],
+        options: [
+            { flags: "--provider <provider>", description: "macos_keychain, windows_credential_manager, or linux_secret_service." },
+        ],
+        examples: ["appfleet vault keychain status --provider macos_keychain"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: ["Records integration status only; AppFleet local JSON never stores OS keychain key material."],
+    },
+    {
+        namespace: "secrets",
+        name: "set",
+        summary: "Encrypt and store a local secret value by project, environment, and alias.",
+        usage: "appfleet secrets set <project> --env <env> --alias <NAME> [options]",
+        arguments: ["project: project id."],
+        options: [
+            { flags: "--env <env>", description: "Environment name." },
+            { flags: "--alias <NAME>", description: "Environment variable alias." },
+            { flags: "--value <value>", description: "Secret value; prefer APPFLEET_SECRET_VALUE." },
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+        ],
+        examples: [
+            "APPFLEET_SECRET_VALUE=... APPFLEET_MASTER_PASSWORD=demo appfleet secrets set atlas-notes --env production --alias SUPABASE_SERVICE_ROLE_KEY",
+        ],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/local-vault.json"],
+        secretSafety: [
+            "Encrypts values before writing the local store.",
+            "Does not print secret values or encrypted credential internals.",
+            "Prefer APPFLEET_SECRET_VALUE over --value.",
+        ],
+    },
+    {
+        namespace: "secrets",
+        name: "list",
+        summary: "List recorded secret aliases without revealing values.",
+        usage: "appfleet secrets list <project> [--env <env>]",
+        arguments: ["project: project id."],
+        options: [{ flags: "--env <env>", description: "Filter by environment." }],
+        examples: ["appfleet secrets list atlas-notes", "appfleet secrets list atlas-notes --env production"],
+        reads: [".appfleet/local-vault.json"],
+        writes: [],
+        secretSafety: ["Shows aliases only; it does not decrypt or print values."],
+    },
+    {
+        namespace: "secrets",
+        name: "inject",
+        summary: "Decrypt matching local secrets and inject them into one child command.",
+        usage: "appfleet secrets inject <project> --env <env> [--master-password <password>] -- <command> [args...]",
+        arguments: ["project: project id.", "command: child process to run after --."],
+        options: [
+            { flags: "--env <env>", description: "Environment name." },
+            { flags: "--master-password <password>", description: "Master password; prefer APPFLEET_MASTER_PASSWORD." },
+        ],
+        examples: [
+            "APPFLEET_MASTER_PASSWORD=demo appfleet secrets inject atlas-notes --env production -- node -e \"console.log(process.env.SUPABASE_SERVICE_ROLE_KEY ? 'ok' : 'missing')\"",
+        ],
+        reads: [".appfleet/local-vault.json"],
+        writes: [".appfleet/vault-audit.jsonl"],
+        secretSafety: [
+            "Writes audit before starting the child process.",
+            "Fails closed when unlock, decrypt, or audit writing fails.",
+            "Redacts injected secret values from captured child stdout and stderr.",
+            "Runs the child with shell:false.",
+        ],
+    },
+    {
+        namespace: "secrets",
+        name: "upload",
+        summary: "Write a zero-knowledge encrypted secret sync package from the local vault.",
+        usage: "appfleet secrets upload [--output <path>]",
+        arguments: [],
+        options: [
+            { flags: "--output <path>", description: "Encrypted sync package path; defaults to .appfleet/cloud-secret-sync.json." },
+        ],
+        examples: [
+            "appfleet secrets upload",
+            "appfleet secrets upload --output .appfleet/cloud-secret-sync.json",
+        ],
+        reads: [".appfleet/local-vault.json encrypted credential blobs and encrypted key wrappers"],
+        writes: [".appfleet/cloud-secret-sync.json or --output path"],
+        secretSafety: [
+            "Packages encrypted credential blobs and encrypted key wrappers as opaque base64url payloads with SHA-256 metadata.",
+            "Does not decrypt vault contents or print plaintext values.",
+            "Does not print encrypted blob ids, key wrapper ids, ciphertext, key material, master passwords, or recovery keys.",
+        ],
+    },
+    {
+        namespace: "secrets",
+        name: "download",
+        summary: "Import a zero-knowledge encrypted secret sync package into the local vault.",
+        usage: "appfleet secrets download [--input <path>]",
+        arguments: [],
+        options: [
+            { flags: "--input <path>", description: "Encrypted sync package path; defaults to .appfleet/cloud-secret-sync.json." },
+        ],
+        examples: [
+            "appfleet secrets download",
+            "appfleet secrets download --input .appfleet/cloud-secret-sync.json",
+        ],
+        reads: [".appfleet/local-vault.json", ".appfleet/cloud-secret-sync.json or --input path"],
+        writes: [".appfleet/local-vault.json encrypted envelope records only"],
+        secretSafety: [
+            "Imports encrypted envelopes without decrypting secret values or vault keys.",
+            "Fails closed when the package workspace does not match the local vault.",
+            "Does not print encrypted blob ids, key wrapper ids, ciphertext, key material, master passwords, recovery keys, or plaintext values.",
+        ],
+    },
+    {
+        namespace: "billing",
+        name: "plan",
+        summary: "Emit a Stripe-ready billing account metadata contract without calling Stripe.",
+        usage: "appfleet billing plan [--workspace <workspace-id>] [--plan <free|team|business>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the metadata contract." },
+            { flags: "--plan <plan>", description: "Billing plan metadata to report." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: [
+            "appfleet billing plan --workspace workspace_test --plan team",
+            "appfleet billing plan --json",
+        ],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Does not call Stripe or accept payment method details.",
+            "Reports safe customer/subscription reference fields only when supplied by future provider wiring.",
+            "Fails closed without provider credentials.",
+        ],
+    },
+    {
+        namespace: "billing",
+        name: "status",
+        summary: "Report billing/payment provider readiness without provider calls.",
+        usage: "appfleet billing status [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the status report." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet billing status --workspace workspace_test --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Does not call Stripe, read credentials, or print provider payloads.",
+            "Does not include payment method details, tokens, card data, or command output.",
+        ],
+    },
+    {
+        namespace: "billing",
+        name: "failures",
+        summary: "Emit fail-closed payment failure detection metadata.",
+        usage: "appfleet billing failures [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the failure detection contract." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet billing failures --workspace workspace_test --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Represents payment failure detection as metadata only.",
+            "Does not store webhook payloads, payment methods, customer secrets, or Stripe credentials.",
+        ],
+    },
+    {
+        namespace: "billing",
+        name: "kms",
+        summary: "Emit customer-managed KMS metadata without key material.",
+        usage: "appfleet billing kms [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the KMS metadata contract." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet billing kms --workspace workspace_test --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Does not ask for or store plaintext key material.",
+            "Does not call customer KMS providers without explicit credentials.",
+            "Stores customer-managed KMS references only.",
+        ],
+    },
+    {
+        namespace: "cost",
+        name: "summary",
+        summary: "Emit cloud-safe cost usage summary metadata.",
+        usage: "appfleet cost summary [--workspace <workspace-id>] [--json]",
+        arguments: [],
+        options: [
+            { flags: "--workspace <workspace-id>", description: "Workspace id for the cost summary." },
+            { flags: "--json", description: "Emit machine-readable JSON." },
+        ],
+        examples: ["appfleet cost summary --workspace workspace_test --json"],
+        reads: [],
+        writes: [],
+        secretSafety: [
+            "Reports usage totals only.",
+            "Does not read provider invoices, payment method data, provider payloads, credentials, or command output.",
+        ],
+    },
+];
+export function findCliCommandDoc(namespace, name) {
+    return cliCommandDocs.find((command) => command.namespace === namespace && command.name === name);
+}