@bli-cockpit/cli 0.2.239 → 0.2.241

package/dist/commands/local-arg-values.js

@@ -9,9 +9,13 @@
  * verbatim: no logic changed, and `normalizeUrl` is still re-exported from
  * `./local-args.js` for the callers that had it there.
  *
- * `rejectServiceRoleLikeArgument` runs on every token, flag or positional, and
- * is why a service-role credential cannot enter a collector command from the
- * command line at all.
+ * `rejectSupabaseServiceCredential` runs on every token, flag or positional of every command, and is
+ * why a Supabase service credential (a service-role JWT, or the newer `sb_secret_…` key) cannot enter a
+ * collector command from the command line. It looks at
+ * the SHAPE of a value, never at words: a note that says "the Supabase service-role key" is
+ * plain text. The wider telemetry-core secret rulebook (`rejectSecretLikeValue`) is NOT run
+ * here: it reads words like "password: x" or "M0-…-review" as secrets, which no other command
+ * may be refused for. Only `cockpit manager`'s free-text values go through it (BLI-5777).
  */
 const WORK_ROOT_FLAGS = ["--repo", "--workspace"];
 export function parseNamedArgs(args, options) {
@@ -23,12 +27,15 @@ export function parseNamedArgs(args, options) {
     const positionals = [];
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index] ?? "";
-        rejectServiceRoleLikeArgument(arg);
+        rejectSupabaseServiceCredential(arg);
         if (!arg.startsWith("--")) {
             positionals.push(arg);
             continue;
         }
-        const [flag, inlineValue] = arg.split("=", 2);
+        // Split on the FIRST "=" only: the value may hold more of them ("ARR = 1M", a URL query).
+        const equalsAt = arg.indexOf("=");
+        const flag = equalsAt === -1 ? arg : arg.slice(0, equalsAt);
+        const inlineValue = equalsAt === -1 ? undefined : arg.slice(equalsAt + 1);
         if (!allowed.has(flag))
             throw new Error(`Unknown flag: ${flag}`);
         if (valueFlags.has(flag)) {
@@ -36,7 +43,7 @@ export function parseNamedArgs(args, options) {
             if (!value || value.startsWith("--")) {
                 throw new Error(`${flag} requires a value.`);
             }
-            rejectServiceRoleLikeArgument(value);
+            rejectSupabaseServiceCredential(value);
             flags.set(flag, value);
             const existing = flagValues.get(flag) ?? [];
             existing.push(value);
@@ -139,14 +146,84 @@ export function normalizeUrl(value) {
         throw new Error("URL value cannot be empty.");
     return trimmed;
 }
-function rejectServiceRoleLikeArgument(value) {
-    if (!looksLikeServiceRoleSecret(value))
-        return;
-    throw new Error("Service-role credentials are not accepted by local collector commands.");
+/**
+ * Supabase's newer secret key format (`SUPABASE_SECRET_KEY`, admin-contracts.ts): not a JWT, so it needs its own shape.
+ * A provider prefix plus a key-length body: prose about the key ("SUPABASE_SECRET_KEY docs") never matches.
+ */
+const SUPABASE_SECRET_KEY_SHAPE = /\bsb_secret_[A-Za-z0-9_-]{16}[A-Za-z0-9_-]*/;
+/**
+ * Every command, every token: refuses a Supabase service credential, by SHAPE: a JWT whose payload says it is the
+ * privileged role, or an `sb_secret_…` key. The words "service-role key" are plain text (BLI-5777: a meeting note that
+ * named one was refused, and an agent reworded the client's words to get through).
+ */
+export function rejectSupabaseServiceCredential(value) {
+    if (looksLikeServiceRoleJwt(value) || containsServiceRoleJwt(value) || SUPABASE_SECRET_KEY_SHAPE.test(value)) {
+        throw new Error("Service-role credentials are not accepted by local collector commands.");
+    }
+}
+/**
+ * The key SHAPES `cockpit manager` free text is refused for: only high-precision ones, each a provider's own key format, so a
+ * sentence about a key, a commit sha or a session name is never refused. Copied from the telemetry-core rulebook
+ * (`packages/cockpit-telemetry-core/src/secret-guards-content-rules.ts`, `SECRET_VALUE_PATTERNS` and the password rule), which is
+ * built to over-match for redaction (it masks and uploads, never refuses) and is NOT used here: its mem0 rule `m0[-_]…` reads
+ * "M0-deliverable-review-session" as a key. Left out on purpose: that rule, `name=value` assignments other than a password, and
+ * any generic entropy, token or session-id shape.
+ */
+export const MANAGER_KEY_SHAPES = [
+    // Any JWT (a Supabase anon, service-role or user token): three base64url parts, the first starting `eyJ`.
+    /\beyJ[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10}[A-Za-z0-9_-]*\b/,
+    // Real keys are long and hold digits; prose ("Upgrade sk-learn-pipeline-improvements", "rk_quarterly_review_notes_final") does not: a digit is required,
+    // and sk- needs a 32+ character body, rk_ and the _live_/_test_ keys 24+. (Not pk_live_: a publishable key is public.)
+    /\bsk-(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{32,}/,
+    /\b(?:sk|rk)_(?:live|test)_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{24,}/,
+    /\brk_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{24,}/,
+    SUPABASE_SECRET_KEY_SHAPE,
+    /\bgh[pousr]_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{16,}/,
+    /\bgithub_pat_(?=[A-Za-z0-9_]*\d)[A-Za-z0-9_]{20,}/,
+    /\blin_api_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{16,}/,
+    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    /\bxox[abprs]-(?=[A-Za-z0-9-]*\d)[A-Za-z0-9-]{16,}/,
+    /\bBearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{16,}/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+];
+/** A candidate password: the word, then `:` or `=` and a value (its quotes aside). */
+const PASSWORD_ASSIGNMENT = /(?<![A-Za-z0-9])(?:password|passwd|passcode)(?:[_-][A-Za-z0-9_-]{0,40})?["']?\s*[:=]\s*["']?([^\s"'`,;<>(){}\[\]]{6,})/gi;
+/**
+ * A password ASSIGNED a value is a secret when the value holds a digit or a symbol ("password: hunter2", `passwd="x1y2z3"`, "admin password: Tr0ub4dor&3").
+ * Prose is text: the word alone ("password reset flow"), a value of letters ("Password: rotated."), sentence punctuation after it (".,!?;:"), a hyphen or
+ * apostrophe between letters ("password: on-site", "Client password: e-mailed to Jo") and the product name 1Password ("Shared password: 1Password vault").
+ */
+export function looksLikePasswordAssignment(value) {
+    for (const match of value.matchAll(PASSWORD_ASSIGNMENT)) {
+        const plain = match[1].replace(/[.,!?;:]+$/, "").replace(/1password/gi, "").replace(/(?<=[A-Za-z])[-'’](?=[A-Za-z])/g, "");
+        if (/[^A-Za-z]/.test(plain))
+            return true;
+    }
+    return false;
+}
+/** The whole manager free-text question: does this text hold a key shape or an assigned password? */
+export function looksLikeManagerSecret(value) {
+    return MANAGER_KEY_SHAPES.some((shape) => shape.test(value)) || looksLikePasswordAssignment(value);
+}
+/**
+ * `cockpit manager` free text only (its text flags and every `--fields-file` value): the service-role JWT, plus the key shapes above.
+ * `where` names the flag or file key, so the sentence says which one; the value is never echoed.
+ */
+export function rejectSecretLikeValue(value, where) {
+    // The named sentence first (KEY_SHAPES holds the JWT and sb_secret_ shapes too); the service-role JWT check stays as the floor.
+    if (looksLikeManagerSecret(value)) {
+        throw new Error(`The value of ${where} looks like a secret (a key, token or password), and secrets are not accepted there. Take the secret out and run it again; text that only talks about a key is fine.`);
+    }
+    rejectSupabaseServiceCredential(value);
 }
-function looksLikeServiceRoleSecret(value) {
-    if (serviceCredentialNamePattern().test(value))
-        return true;
+/**
+ * A service-role JWT anywhere inside the value ("the service-role key=<jwt> for staging."): every token that starts at a JWT header (`eyJ`, which every
+ * Supabase JWT does) is decoded. Anchored on the header, not on any three dotted words, so a JWT glued after a dotted word ("staging.eyJ….….…") is found whole.
+ */
+function containsServiceRoleJwt(value) {
+    return (value.match(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g) ?? []).some((token) => looksLikeServiceRoleJwt(token));
+}
+function looksLikeServiceRoleJwt(value) {
     const parts = value.split(".");
     if (parts.length !== 3)
         return false;
@@ -162,12 +239,6 @@ function looksLikeServiceRoleSecret(value) {
         return false;
     }
 }
-function serviceCredentialNamePattern() {
-    return new RegExp([
-        ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("[_-]?"),
-        ["service", "role"].join("[_-]?"),
-    ].join("|"), "i");
-}
 function serviceCredentialPayloadPattern() {
     const privilegedRole = ["service", "role"].join("_");
     return new RegExp(`"role"\\s*:\\s*"${privilegedRole}"`);

package/dist/commands/local-args-tower-cal.js

@@ -20,14 +20,14 @@
  */
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 const CAL_ACTIONS = new Set([
-    "event", "export", "duplicate", "batch", "undo", "conflicts", "calendar-change",
+    "event", "export", "duplicate", "batch", "undo", "conflicts", "calendar-change", "view-settings", "view-settings-change",
     "today",
     "week",
     "next",
     "find",
     "calendars",
     "add-ical",
-    "change", "cancel",
+    "change", "cancel", "rsvp",
     "create",
     "share",
     "detach",
@@ -36,7 +36,7 @@ const CAL_ACTIONS = new Set([
     "delete",
 ]);
 /** Every verb that names ONE thing first — a calendar id, or (delete) an event id. */
-const CAL_ACTIONS_NEEDING_A_SUBJECT = new Set(["event", "export", "duplicate", "calendar-change", "sync", "detach", "share", "delete", "change", "cancel"]);
+const CAL_ACTIONS_NEEDING_A_SUBJECT = new Set(["event", "export", "duplicate", "calendar-change", "sync", "detach", "share", "delete", "change", "cancel", "rsvp"]);
 /** `sync-status [<calendar id>]` — every calendar, or one's. Ticket 10730. */
 const CAL_ACTIONS_WITH_OPTIONAL_SUBJECT = new Set(["sync-status", "undo"]);
 const CAL_ALLOWED_FLAGS = [
@@ -71,6 +71,8 @@ const CAL_ALLOWED_FLAGS = [
     "--idempotency-key",
     "--expected-version",
     "--reason",
+    "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
+    "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
 ];
 const CAL_VALUE_FLAGS = [
     "--home",
@@ -94,6 +96,8 @@ const CAL_VALUE_FLAGS = [
     "--idempotency-key",
     "--expected-version",
     "--reason",
+    "--scope", "--occurrence", "--response", "--comment", "--reminder", "--visibility", "--transparency", "--key",
+    "--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone",
 ];
 export function parseCalArgs(args) {
     const values = parseNamedArgs(args, { allowedFlags: CAL_ALLOWED_FLAGS, valueFlags: CAL_VALUE_FLAGS });
@@ -106,13 +110,14 @@ export function parseCalArgs(args) {
     // two of them wrong is told about --limit first, as before.
     const limit = optionalPositiveInteger(values.flags.get("--limit"), "--limit");
     const offset = readCalOffset(values);
-    return buildCalCommand(values, action, subject, query, title, startsAt, endsAt, offset, limit);
+    const command = buildCalCommand(values, action, subject, query, title, startsAt, endsAt, offset, limit);
+    return { ...command, ...readCalEventScope(action, values), ...readViewSettingsPatch(action, values) };
 }
 function readCalAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "today" : first);
     if (!CAL_ACTIONS.has(action)) {
-        throw new Error(`Unknown cal command: ${first}. Try today, week, conflicts, calendar-change, next, find, calendars, add-ical, create, duplicate, batch, undo, share, detach, sync, sync-status, or delete.`);
+        throw new Error(`Unknown cal command: ${first}. Try today, week, conflicts, calendar-change, view-settings, view-settings-change, next, find, calendars, add-ical, create, duplicate, batch, undo, share, detach, sync, sync-status, or delete.`);
     }
     return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -122,7 +127,7 @@ function readCalSubjectOrQuery(action, rest) {
     if (CAL_ACTIONS_NEEDING_A_SUBJECT.has(action)) {
         subject = optionalNonEmpty(rest[0]);
         if (!subject) {
-            throw new Error(action === "delete" || action === "duplicate"
+            throw new Error(action === "delete" || action === "duplicate" || action === "change" || action === "cancel" || action === "rsvp"
                 ? `cal ${action} needs an event id — take one from a window verb's output (today/week/next/find).`
                 : `cal ${action} needs a calendar id — take one from \`cockpit cal calendars\`.`);
         }
@@ -182,7 +187,7 @@ function readCalOffset(values) {
 function buildCalCommand(values, action, subject, query, title, startsAt, endsAt, offset, limit) {
     return {
         kind: "cal",
-        occurrenceStart: optionalNonEmpty(values.flags.get("--occurrence-start")),
+        occurrenceStart: optionalNonEmpty(values.flags.get("--occurrence") ?? values.flags.get("--occurrence-start")),
         color: optionalNonEmpty(values.flags.get("--color")),
         action,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
@@ -211,7 +216,7 @@ function buildCalCommand(values, action, subject, query, title, startsAt, endsAt
         allDay: values.booleans.has("--all-day"),
         timed: values.booleans.has("--timed"),
         keepInvitees: values.booleans.has("--keep-invitees"),
-        idempotencyKey: optionalNonEmpty(values.flags.get("--idempotency-key")),
+        idempotencyKey: optionalNonEmpty(values.flags.get("--idempotency-key") ?? values.flags.get("--key")),
         expectedVersion: optionalNonEmpty(values.flags.get("--expected-version")),
         reason: optionalNonEmpty(values.flags.get("--reason")),
         meet: values.booleans.has("--meet"),
@@ -230,4 +235,139 @@ function splitAddresses(raw) {
         .split(",")
         .map((value) => value.trim())
         .filter((value) => value !== "");
+}
+const SCOPES = ["instance", "following", "series"];
+const RSVP_RESPONSES = ["accepted", "declined", "tentative"];
+const VISIBILITIES = ["default", "public", "private", "confidential"];
+const TRANSPARENCIES = ["opaque", "transparent"];
+const WRITE_ACTIONS = new Set(["create", "change"]);
+/**
+ * BLI-21311: the scope, RSVP and event-detail flags. Validated here so a typo
+ * never costs a request; the door still owns every rule that needs the event.
+ */
+function readCalEventScope(action, values) {
+    const out = {};
+    const scope = optionalNonEmpty(values.flags.get("--scope"));
+    if (scope !== undefined) {
+        if (!SCOPES.includes(scope))
+            throw new Error("--scope takes instance, following or series.");
+        if (action !== "change" && action !== "cancel" && action !== "delete" && action !== "rsvp")
+            throw new Error(`cal ${action} does not take --scope.`);
+        if (action === "rsvp" && scope === "following")
+            throw new Error("An RSVP takes --scope instance or series.");
+        out.scope = scope;
+    }
+    if (action === "rsvp") {
+        const response = optionalNonEmpty(values.flags.get("--response"));
+        if (!response || !RSVP_RESPONSES.includes(response)) {
+            throw new Error("cal rsvp needs --response accepted, declined or tentative.");
+        }
+        out.rsvpResponse = response;
+        out.rsvpComment = optionalNonEmpty(values.flags.get("--comment"));
+        return out;
+    }
+    if (values.flags.has("--response") || values.flags.has("--comment"))
+        throw new Error("--response and --comment belong to cal rsvp.");
+    if (!WRITE_ACTIONS.has(action)) {
+        for (const flag of ["--reminder", "--visibility", "--transparency"]) {
+            if (values.flags.has(flag))
+                throw new Error(`cal ${action} does not take ${flag}.`);
+        }
+        return out;
+    }
+    const color = optionalNonEmpty(values.flags.get("--color"));
+    if (color !== undefined) {
+        if (color === "none")
+            out.colorId = null;
+        else if (/^(?:[1-9]|10|11)$/.test(color))
+            out.colorId = Number(color);
+        else
+            throw new Error("--color takes a colour number 1 to 11, or none.");
+    }
+    const reminders = readReminders(values.flagValues.get("--reminder") ?? []);
+    if (reminders !== undefined)
+        out.reminders = reminders;
+    const visibility = optionalNonEmpty(values.flags.get("--visibility"));
+    if (visibility !== undefined) {
+        if (!VISIBILITIES.includes(visibility))
+            throw new Error(`--visibility takes ${VISIBILITIES.join(", ")}.`);
+        out.visibility = visibility;
+    }
+    const transparency = optionalNonEmpty(values.flags.get("--transparency"));
+    if (transparency !== undefined) {
+        if (!TRANSPARENCIES.includes(transparency))
+            throw new Error(`--transparency takes ${TRANSPARENCIES.join(" or ")}.`);
+        out.transparency = transparency;
+    }
+    return out;
+}
+/** `--reminder 10 --reminder 60:email` or `--reminder default`. Max 5, 0..40320 minutes. */
+function readReminders(raw) {
+    if (raw.length === 0)
+        return undefined;
+    if (raw.includes("default")) {
+        if (raw.length > 1)
+            throw new Error("--reminder default stands alone: it means the calendar's own reminders.");
+        return "default";
+    }
+    if (raw.length > 5)
+        throw new Error("An event holds at most 5 reminders.");
+    return raw.map((entry) => {
+        const [minutesText, method, extra] = entry.split(":");
+        if (extra !== undefined || !/^\d+$/.test(minutesText ?? ""))
+            throw new Error("--reminder takes minutes (0 to 40320), optionally minutes:popup or minutes:email, or default.");
+        const minutes = Number(minutesText);
+        if (minutes > 40320)
+            throw new Error("--reminder minutes run from 0 to 40320 (four weeks).");
+        if (method !== undefined && method !== "popup" && method !== "email")
+            throw new Error("A reminder method is popup or email.");
+        return { minutes, ...(method ? { method } : {}) };
+    });
+}
+const VIEW_FLAG_KEYS = ["--view", "--days", "--week-start", "--hide-weekends", "--density", "--zone"];
+/**
+ * BLI-21423 `view-settings-change`: the flags become the same partial patch the
+ * door takes. Types are read here; the door owns the ranges and the zone list.
+ */
+function readViewSettingsPatch(action, values) {
+    if (action !== "view-settings-change") {
+        for (const flag of VIEW_FLAG_KEYS) {
+            if (values.flags.has(flag))
+                throw new Error(`cal ${action} does not take ${flag}; it belongs to cal view-settings-change.`);
+        }
+        return {};
+    }
+    const patch = {};
+    const view = optionalNonEmpty(values.flags.get("--view"));
+    if (view !== undefined)
+        patch.default_view = view;
+    const days = optionalNonEmpty(values.flags.get("--days"));
+    if (days !== undefined) {
+        if (!/^\d+$/.test(days))
+            throw new Error("--days takes a whole number from 2 to 9.");
+        patch.day_count = Number(days);
+    }
+    const weekStart = optionalNonEmpty(values.flags.get("--week-start"));
+    if (weekStart !== undefined)
+        patch.week_start = weekStart;
+    const hide = optionalNonEmpty(values.flags.get("--hide-weekends"));
+    if (hide !== undefined) {
+        if (hide !== "on" && hide !== "off")
+            throw new Error("--hide-weekends takes on or off.");
+        patch.hide_weekends = hide === "on";
+    }
+    const density = optionalNonEmpty(values.flags.get("--density"));
+    if (density !== undefined)
+        patch.density = density;
+    const zones = values.flagValues.get("--zone") ?? [];
+    if (zones.length) {
+        if (zones.includes("none")) {
+            if (zones.length > 1)
+                throw new Error("--zone none stands alone: it clears the extra zones.");
+            patch.extra_zones = [];
+        }
+        else
+            patch.extra_zones = zones;
+    }
+    return Object.keys(patch).length ? { viewSettings: patch } : {};
 }

package/dist/commands/local-args-tower-docs-msg.js

@@ -8,14 +8,14 @@
  */
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 import { parseDocsExportFlags } from "./local-args-docs-export.js";
-const DOCS_ACTIONS = new Set(["list", "tree", "read", "create", "update", "delete", "link", "sync-status", "export", "mutation-status"]);
+const DOCS_ACTIONS = new Set(["list", "tree", "read", "create", "update", "delete", "link", "sync-status", "export", "mutation-status", "share", "access"]);
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 // BLI-10450: `read` moved to its own branch in `parseDocsDocumentReference` —
 // it takes SEVERAL references now, so it no longer shares the "exactly one"
 // rule `update`/`link` still enforce. BLI‑10555: `delete` takes several too
 // (the same door, called once per ref), so it joined `read`'s branch rather
 // than this set.
-const DOCS_ACTIONS_NEEDING_A_DOC = new Set(["update", "link", "export", "mutation-status"]);
+const DOCS_ACTIONS_NEEDING_A_DOC = new Set(["update", "link", "export", "mutation-status", "share", "access"]);
 const DOCS_ALLOWED_FLAGS = [
     "--home",
     "--dashboard-url",
@@ -37,6 +37,9 @@ const DOCS_ALLOWED_FLAGS = [
     "--offset",
     "--format",
     "--out",
+    "--add",
+    "--remove",
+    "--reason",
     "--json",
 ];
 const DOCS_VALUE_FLAGS = [
@@ -54,6 +57,9 @@ const DOCS_VALUE_FLAGS = [
     "--offset",
     "--format",
     "--out",
+    "--add",
+    "--remove",
+    "--reason",
 ];
 export function parseDocsArgs(args) {
     const values = parseNamedArgs(args, { allowedFlags: DOCS_ALLOWED_FLAGS, valueFlags: DOCS_VALUE_FLAGS });
@@ -123,7 +129,7 @@ function parseDocsAction(positionals) {
     const first = positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!DOCS_ACTIONS.has(action)) {
-        throw new Error(`Unknown docs command: ${first}. Try list, tree, read, create, update, delete, link, sync-status, export, or mutation-status.`);
+        throw new Error(`Unknown docs command: ${first}. Try list, tree, read, create, update, delete, link, sync-status, export, mutation-status, share, or access.`);
     }
     return { action, rest: positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -233,6 +239,26 @@ function parseDocsReadFlags(action, values) {
         throw new Error("--offset belongs to `cockpit docs read`.");
     return { query, wholeWord, limit, bodies, section, offset };
 }
+/**
+ * BLI-21313: `docs share <doc> --add <email> | --remove <email> [--reason <text>]` names or removes a page editor;
+ * `docs access <doc>` reads who may edit and why. A person is an exact email address, never a fuzzy name.
+ */
+function parseDocsShareFlags(action, values) {
+    const addPerson = optionalNonEmpty(values.flags.get("--add"));
+    const removePerson = optionalNonEmpty(values.flags.get("--remove"));
+    const reason = optionalNonEmpty(values.flags.get("--reason"));
+    if ((addPerson || removePerson || reason) && action !== "share") {
+        throw new Error("--add, --remove and --reason belong to `cockpit docs share`.");
+    }
+    if (action === "share") {
+        if (Boolean(addPerson) === Boolean(removePerson)) {
+            throw new Error("docs share needs exactly one of --add <email> or --remove <email>.");
+        }
+        if (reason && reason.length > 200)
+            throw new Error("--reason can be at most 200 characters.");
+    }
+    return { ...(addPerson ? { addPerson } : {}), ...(removePerson ? { removePerson } : {}), ...(reason ? { reason } : {}) };
+}
 function parseDocsOffset(raw) {
     const offsetRaw = optionalNonEmpty(raw);
     if (offsetRaw === undefined)
@@ -268,6 +294,7 @@ function buildDocsCommand(values, action, docRef, docRefs, visibility, clearPare
         ...(link.notionPage ? { notionPage: link.notionPage } : {}),
         ...(link.clearLink ? { clearLink: true } : {}),
         ...parseDocsExportFlags(action, values),
+        ...parseDocsShareFlags(action, values),
         json: values.booleans.has("--json"),
     };
 }

package/dist/commands/local-args-tower-drills.js

@@ -54,7 +54,7 @@ export function parseDrillsArgs(args) {
     if (action === "theme-set") {
         theme = rest.join(" ").trim();
         if (!theme)
-            throw new Error("`cockpit drills theme set` takes a theme: video-game, boxing, muay-thai, crime-drama, anime, sports, or your own words.");
+            throw new Error("`cockpit drills theme set` takes a theme: plain (no theme, the default), video-game, sports, movies-tv, music, anime, cooking, or anything you're into in your own words.");
     }
     else if (rest.length > 0)
         throw new Error(`\`cockpit drills ${action}\` takes no positional arguments.`);