@crombolo/cli 0.15.0 → 0.17.0

package/oclif.manifest.json

@@ -82,6 +82,81 @@
         "reset-password.ts"
       ]
     },
+    "api-client:rotate": {
+      "aliases": [],
+      "args": {},
+      "description": "The old secret stops working at once. Put the new one in CROMBOLO_API_CLIENT_SECRET: a start keeps the client it finds, so it never sets the secret back.",
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "client": {
+          "name": "client",
+          "summary": "the client id; CROMBOLO_API_CLIENT_ID when not given",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "api-client:rotate",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "issue a new secret for the API client, and print it once",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "RotateClientSecret",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "non_idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "client",
+            "type": "string"
+          },
+          {
+            "name": "secret",
+            "type": "string"
+          }
+        ],
+        "errors": [
+          "usage",
+          "not_found"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "api-client",
+        "rotate.ts"
+      ]
+    },
     "assets": {
       "aliases": [],
       "args": {},
@@ -722,6 +797,73 @@
         "purge.ts"
       ]
     },
+    "cache:rebuild": {
+      "aliases": [],
+      "args": {},
+      "description": "Each node rebuilds at its next poll, within a few seconds. Nothing has to be reachable from here but the database.",
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cache:rebuild",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "rebuild the published cache on every node of the site",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "system",
+        "action": "RebuildCache",
+        "entityType": "Cache"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "instruction",
+            "type": "integer"
+          },
+          {
+            "name": "nodes",
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "the nodes seen in the last minute"
+          }
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "cache",
+        "rebuild.ts"
+      ]
+    },
     "components": {
       "aliases": [],
       "args": {},
@@ -1010,6 +1152,10 @@
           {
             "name": "template",
             "type": "boolean"
+          },
+          {
+            "name": "email",
+            "type": "boolean"
           }
         ],
         "errors": [
@@ -2926,6 +3072,97 @@
         "generate.ts"
       ]
     },
+    "health": {
+      "aliases": [],
+      "args": {},
+      "description": "The same checks as Settings › Health Check. Exits 20 when a check fails; a warning is reported, not counted.",
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "group": {
+          "name": "group",
+          "summary": "only this group of checks",
+          "hasDynamicHelp": false,
+          "helpValue": "<name>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "health",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "run the site's health checks",
+      "enableJsonFlag": false,
+      "spec": {
+        "effects": "read_only",
+        "cardinality": "bounded",
+        "outputFields": [
+          {
+            "name": "groups",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "fields": [
+                {
+                  "name": "name",
+                  "type": "string"
+                },
+                {
+                  "name": "checks",
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  }
+                }
+              ]
+            }
+          },
+          {
+            "name": "failed",
+            "type": "integer"
+          },
+          {
+            "name": "warnings",
+            "type": "integer"
+          }
+        ],
+        "errors": [
+          "not_found"
+        ],
+        "outcomes": [
+          "problems_found"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "health.ts"
+      ]
+    },
     "import": {
       "aliases": [],
       "args": {
@@ -3358,14 +3595,9 @@
         "report.ts"
       ]
     },
-    "init": {
+    "index:list": {
       "aliases": [],
       "args": {},
-      "description": "A --template brings schema, views and content; `--template list` prints the templates.",
-      "examples": [
-        "<%= config.bin %> init",
-        "<%= config.bin %> init --template list"
-      ],
       "flags": {
         "output": {
           "char": "o",
@@ -3387,68 +3619,229 @@
           "summary": "the same as -o json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "force": {
-          "name": "force",
-          "summary": "overwrite files that are already here",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "name": {
-          "name": "name",
-          "summary": "the site's name",
-          "hasDynamicHelp": false,
-          "helpValue": "<site name>",
-          "multiple": false,
-          "type": "option"
-        },
-        "postgres": {
-          "name": "postgres",
-          "summary": "configure Postgres rather than SQLite",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "template": {
-          "name": "template",
-          "summary": "a starter template, or `list`",
-          "hasDynamicHelp": false,
-          "helpValue": "<id>",
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "init",
+      "id": "index:list",
       "pluginAlias": "@crombolo/cli",
       "pluginName": "@crombolo/cli",
       "pluginType": "core",
       "strict": true,
-      "summary": "scaffold a site in the current directory",
+      "summary": "the search indexes: what each holds, and what is waiting to be indexed",
       "enableJsonFlag": false,
       "spec": {
-        "effects": "non_idempotent",
+        "effects": "read_only",
         "cardinality": "bounded",
         "outputFields": [
           {
-            "name": "created",
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+            "name": "name",
+            "type": "string"
           },
           {
-            "name": "existing",
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+            "name": "documents",
+            "type": "integer"
           },
           {
-            "name": "templates",
-            "type": "array",
-            "items": {
-              "type": "object"
+            "name": "fields",
+            "type": "integer"
+          },
+          {
+            "name": "pending",
+            "type": "integer"
+          },
+          {
+            "name": "healthy",
+            "type": "boolean",
+            "description": "nothing waiting to be indexed"
+          }
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "index",
+        "list.ts"
+      ]
+    },
+    "index:rebuild": {
+      "aliases": [],
+      "args": {
+        "index": {
+          "description": "one index; both when not given",
+          "name": "index",
+          "options": [
+            "InternalIndex",
+            "MembersIndex"
+          ]
+        }
+      },
+      "description": "Search keeps answering while it runs. --queue-only queues everything and leaves the indexing to the running site.",
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "queue-only": {
+          "name": "queue-only",
+          "summary": "queue everything, and let the site index it",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "index:rebuild",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "index every item again, for every node: the index is in the database",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "system",
+        "action": "RebuildIndex",
+        "entityType": "Index"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "indexes",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "indexed",
+            "type": "integer",
+            "description": "items indexed here; 0 with --queue-only"
+          },
+          {
+            "name": "queued",
+            "type": "boolean"
+          }
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "index",
+        "rebuild.ts"
+      ]
+    },
+    "init": {
+      "aliases": [],
+      "args": {},
+      "description": "A --template brings schema, views and content; `--template list` prints the templates.",
+      "examples": [
+        "<%= config.bin %> init",
+        "<%= config.bin %> init --template list"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "name": "force",
+          "summary": "overwrite files that are already here",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "name": {
+          "name": "name",
+          "summary": "the site's name",
+          "hasDynamicHelp": false,
+          "helpValue": "<site name>",
+          "multiple": false,
+          "type": "option"
+        },
+        "postgres": {
+          "name": "postgres",
+          "summary": "configure Postgres rather than SQLite",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "template": {
+          "name": "template",
+          "summary": "a starter template, or `list`",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "init",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "scaffold a site in the current directory",
+      "enableJsonFlag": false,
+      "spec": {
+        "effects": "non_idempotent",
+        "cardinality": "bounded",
+        "outputFields": [
+          {
+            "name": "created",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "existing",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "templates",
+            "type": "array",
+            "items": {
+              "type": "object"
             }
           }
         ],
@@ -3796,10 +4189,17 @@
         "status.ts"
       ]
     },
-    "media:fetch": {
+    "media:export": {
       "aliases": [],
-      "args": {},
-      "description": "Exits 10 when a file could not be fetched; running it again fetches only what is missing.",
+      "args": {
+        "folder": {
+          "description": "a media folder, as a path or uuid; everything when not given",
+          "name": "folder"
+        }
+      },
+      "examples": [
+        "<%= config.bin %> media export /Gallery --out ./gallery"
+      ],
       "flags": {
         "output": {
           "char": "o",
@@ -3821,27 +4221,36 @@
           "summary": "the same as -o json",
           "allowNo": false,
           "type": "boolean"
+        },
+        "out": {
+          "name": "out",
+          "required": true,
+          "summary": "the folder to write into",
+          "hasDynamicHelp": false,
+          "helpValue": "<dir>",
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "media:fetch",
+      "id": "media:export",
       "pluginAlias": "@crombolo/cli",
       "pluginName": "@crombolo/cli",
       "pluginType": "core",
       "strict": true,
-      "summary": "a lazily pulled site's media files, all of them now",
+      "summary": "write media files back out as a folder tree",
       "enableJsonFlag": false,
       "spec": {
         "effects": "idempotent",
-        "cardinality": "single",
+        "cardinality": "bounded",
         "outputFields": [
           {
-            "name": "fetched",
-            "type": "integer"
+            "name": "out",
+            "type": "string"
           },
           {
-            "name": "skipped",
+            "name": "files",
             "type": "integer"
           },
           {
@@ -3849,18 +4258,16 @@
             "type": "integer"
           },
           {
-            "name": "failed",
+            "name": "missing",
             "type": "array",
             "items": {
               "type": "string"
-            }
+            },
+            "description": "items whose file is not in the store"
           }
         ],
         "errors": [
-          "not_found",
-          "auth",
-          "unavailable",
-          "io"
+          "not_found"
         ]
       },
       "isESM": true,
@@ -3868,21 +4275,13 @@
         "src",
         "commands",
         "media",
-        "fetch.ts"
+        "export.ts"
       ]
     },
-    "pull": {
+    "media:fetch": {
       "aliases": [],
-      "args": {
-        "remote": {
-          "description": "the remote; the only one, when there is one",
-          "name": "remote"
-        }
-      },
-      "description": "Sealed and anonymised unless --full. In an empty folder it starts a new site and serves it; in a site it replaces it, saying first what it loses (recycled, and asked about unless --yes).\n\n--media-info-only fetches media files one at a time, only what changed since the last pull; --lazy-media fetches each the first time it is asked for; --no-media leaves them out.",
-      "examples": [
-        "<%= config.bin %> pull production --env staging --yes"
-      ],
+      "args": {},
+      "description": "Exits 10 when a file could not be fetched; running it again fetches only what is missing.",
       "flags": {
         "output": {
           "char": "o",
@@ -3904,41 +4303,236 @@
           "summary": "the same as -o json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "env": {
-          "name": "env",
-          "summary": "the environment to pull",
-          "hasDynamicHelp": false,
-          "helpValue": "<id>",
-          "multiple": false,
-          "type": "option"
-        },
-        "full": {
-          "name": "full",
-          "summary": "a full copy, people included: needs the permission for it",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "yes": {
-          "name": "yes",
-          "summary": "replace this site without asking",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "no-media": {
-          "name": "no-media",
-          "summary": "leave the media files out",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "media-info-only": {
-          "name": "media-info-only",
-          "summary": "fetch media files one at a time, only what changed",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "lazy-media": {
-          "name": "lazy-media",
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "media:fetch",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "a lazily pulled site's media files, all of them now",
+      "enableJsonFlag": false,
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "fetched",
+            "type": "integer"
+          },
+          {
+            "name": "skipped",
+            "type": "integer"
+          },
+          {
+            "name": "bytes",
+            "type": "integer"
+          },
+          {
+            "name": "failed",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        ],
+        "errors": [
+          "not_found",
+          "auth",
+          "unavailable",
+          "io"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "media",
+        "fetch.ts"
+      ]
+    },
+    "media:import": {
+      "aliases": [],
+      "args": {
+        "dir": {
+          "description": "the folder to import",
+          "name": "dir",
+          "required": true
+        }
+      },
+      "description": "Each directory becomes a media folder and each file a media item, typed by its extension as an upload is. Files no media type takes are reported and left.\n\nRun it again after a stop: a file already imported with the same bytes is skipped, and one whose bytes differ is reported and left alone.",
+      "examples": [
+        "<%= config.bin %> media import ./photos --under /Gallery --dry-run"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "under": {
+          "name": "under",
+          "summary": "the media folder to import into; the root when not given",
+          "hasDynamicHelp": false,
+          "helpValue": "<path|uuid>",
+          "multiple": false,
+          "type": "option"
+        },
+        "dry-run": {
+          "name": "dry-run",
+          "summary": "say what it would do, and change nothing",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "media:import",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "import a folder of files into the media library, keeping its folders",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "media",
+        "action": "Import",
+        "entityType": "Media"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "bounded",
+        "outputFields": [
+          {
+            "name": "created",
+            "type": "integer"
+          },
+          {
+            "name": "folders",
+            "type": "integer"
+          },
+          {
+            "name": "skipped",
+            "type": "integer"
+          },
+          {
+            "name": "differs",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "unsupported",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "not_found",
+          "io"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "media",
+        "import.ts"
+      ]
+    },
+    "pull": {
+      "aliases": [],
+      "args": {
+        "remote": {
+          "description": "the remote; the only one, when there is one",
+          "name": "remote"
+        }
+      },
+      "description": "Sealed and anonymised unless --full. In an empty folder it starts a new site and serves it; in a site it replaces it, saying first what it loses (recycled, and asked about unless --yes).\n\n--media-info-only fetches media files one at a time, only what changed since the last pull; --lazy-media fetches each the first time it is asked for; --no-media leaves them out.",
+      "examples": [
+        "<%= config.bin %> pull production --env staging --yes"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "env": {
+          "name": "env",
+          "summary": "the environment to pull",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        },
+        "full": {
+          "name": "full",
+          "summary": "a full copy, people included: needs the permission for it",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "yes": {
+          "name": "yes",
+          "summary": "replace this site without asking",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "no-media": {
+          "name": "no-media",
+          "summary": "leave the media files out",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "media-info-only": {
+          "name": "media-info-only",
+          "summary": "fetch media files one at a time, only what changed",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "lazy-media": {
+          "name": "lazy-media",
           "summary": "fetch each media file the first time it is asked for",
           "allowNo": false,
           "type": "boolean"
@@ -4147,24 +4741,10 @@
         "push.ts"
       ]
     },
-    "remote:add": {
+    "recycle-bin:empty": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "a name for it: lower case letters, digits and dashes",
-          "name": "name",
-          "required": true
-        },
-        "url": {
-          "description": "the site's URL",
-          "name": "url",
-          "required": true
-        }
-      },
-      "description": "URLs only: sign-ins are kept in your keychain. Adding the same remote again changes nothing; a different URL for a name already taken needs --force.",
-      "examples": [
-        "<%= config.bin %> remote add production https://example.com --env production"
-      ],
+      "args": {},
+      "description": "Pages and media both, unless --content or --media names one. --older-than keeps what was trashed recently; an item trashed before crombolo recorded when is kept by it too, and counted.\n\nAsks first, unless --yes; --dry-run lists what would go.",
       "flags": {
         "output": {
           "char": "o",
@@ -4187,20 +4767,170 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "env": {
-          "name": "env",
-          "summary": "the environment it goes to by default",
+        "content": {
+          "exclusive": [
+            "media"
+          ],
+          "name": "content",
+          "summary": "only pages",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "media": {
+          "exclusive": [
+            "content"
+          ],
+          "name": "media",
+          "summary": "only media, with their files",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "older-than": {
+          "name": "older-than",
+          "summary": "only what was trashed more than this many days ago",
           "hasDynamicHelp": false,
-          "helpValue": "<id>",
           "multiple": false,
           "type": "option"
         },
-        "force": {
-          "name": "force",
-          "summary": "replace a remote of the same name",
+        "yes": {
+          "name": "yes",
+          "summary": "don't ask",
           "allowNo": false,
           "type": "boolean"
-        }
+        },
+        "dry-run": {
+          "name": "dry-run",
+          "summary": "say what it would do, and change nothing",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "recycle-bin:empty",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "delete what is in the recycle bin, for good",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "content",
+        "action": "EmptyRecycleBin",
+        "entityType": "Document"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "bounded",
+        "confirmationBypassArg": "--yes",
+        "outputFields": [
+          {
+            "name": "items",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "fields": [
+                {
+                  "name": "key",
+                  "type": "string"
+                },
+                {
+                  "name": "name",
+                  "type": "string"
+                },
+                {
+                  "name": "kind",
+                  "type": "string",
+                  "enum": [
+                    "content",
+                    "media"
+                  ]
+                },
+                {
+                  "name": "trashedAt",
+                  "type": "string",
+                  "nullable": true
+                }
+              ]
+            }
+          },
+          {
+            "name": "kept",
+            "type": "integer",
+            "description": "trashed too recently, or at an unknown time"
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "confirmation_required",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "recycle-bin",
+        "empty.ts"
+      ]
+    },
+    "remote:add": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "a name for it: lower case letters, digits and dashes",
+          "name": "name",
+          "required": true
+        },
+        "url": {
+          "description": "the site's URL",
+          "name": "url",
+          "required": true
+        }
+      },
+      "description": "URLs only: sign-ins are kept in your keychain. Adding the same remote again changes nothing; a different URL for a name already taken needs --force.",
+      "examples": [
+        "<%= config.bin %> remote add production https://example.com --env production"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "env": {
+          "name": "env",
+          "summary": "the environment it goes to by default",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        },
+        "force": {
+          "name": "force",
+          "summary": "replace a remote of the same name",
+          "allowNo": false,
+          "type": "boolean"
+        }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
@@ -6628,6 +7358,647 @@
         "rewrite.ts"
       ]
     },
+    "users:disable": {
+      "aliases": [],
+      "args": {
+        "user": {
+          "description": "their e-mail address or username",
+          "name": "user",
+          "required": true
+        }
+      },
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:disable",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "stop a user signing in, and end their sessions",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "Disable",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "state",
+            "type": "string"
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "not_found",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "disable.ts"
+      ]
+    },
+    "users:enable": {
+      "aliases": [],
+      "args": {
+        "user": {
+          "description": "their e-mail address or username",
+          "name": "user",
+          "required": true
+        }
+      },
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:enable",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "let a disabled user sign in again",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "Enable",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "state",
+            "type": "string"
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "not_found",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "enable.ts"
+      ]
+    },
+    "users:invite": {
+      "aliases": [],
+      "args": {
+        "email": {
+          "description": "their e-mail address",
+          "name": "email",
+          "required": true
+        }
+      },
+      "description": "The link is printed rather than e-mailed, so it works on a site with no e-mail delivery. It is used once, and expires as an invitation does.",
+      "examples": [
+        "<%= config.bin %> users invite editor@example.com --group editor --name \"Ada Lovelace\""
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "group": {
+          "name": "group",
+          "summary": "a user group, by alias; repeatable",
+          "default": [],
+          "hasDynamicHelp": false,
+          "helpValue": "<alias>",
+          "multiple": true,
+          "type": "option"
+        },
+        "name": {
+          "name": "name",
+          "summary": "their name; the address when not given",
+          "hasDynamicHelp": false,
+          "helpValue": "<name>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:invite",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "create a user and print the link they set their password with",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "Invite",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "non_idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "groups",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "link",
+            "type": "string"
+          }
+        ],
+        "errors": [
+          "usage",
+          "not_found",
+          "conflict",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "invite.ts"
+      ]
+    },
+    "users:list": {
+      "aliases": [],
+      "args": {},
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "limit": {
+          "name": "limit",
+          "summary": "how many to list",
+          "default": 50,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "offset": {
+          "name": "offset",
+          "summary": "how many to skip first",
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "fields": {
+          "name": "fields",
+          "summary": "only these fields of each item, comma-separated",
+          "hasDynamicHelp": false,
+          "helpValue": "<a,b>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:list",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "the back-office users: who, their groups, their state and last sign-in",
+      "enableJsonFlag": false,
+      "spec": {
+        "effects": "read_only",
+        "cardinality": "unbounded",
+        "pagination": {
+          "style": "offset",
+          "offsetArg": "--offset",
+          "limitArg": "--limit"
+        },
+        "fieldsArg": "--fields",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "name",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "userName",
+            "type": "string"
+          },
+          {
+            "name": "kind",
+            "type": "string",
+            "enum": [
+              "Default",
+              "Api"
+            ]
+          },
+          {
+            "name": "state",
+            "type": "string"
+          },
+          {
+            "name": "groups",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "failedLoginAttempts",
+            "type": "integer"
+          },
+          {
+            "name": "lastLoginDate",
+            "type": "string",
+            "nullable": true
+          }
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "list.ts"
+      ]
+    },
+    "users:reset-2fa": {
+      "aliases": [],
+      "args": {
+        "user": {
+          "description": "their e-mail address or username",
+          "name": "user",
+          "required": true
+        }
+      },
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:reset-2fa",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "remove a user's second factors, so their next sign-in sets one up again",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "ResetTwoFactor",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "removed",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "not_found"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "reset-2fa.ts"
+      ]
+    },
+    "users:reset-password": {
+      "aliases": [],
+      "args": {
+        "user": {
+          "description": "their e-mail address or username",
+          "name": "user",
+          "required": true
+        }
+      },
+      "description": "A new one is generated and printed, unless --stdin gives it. `admin reset-password` does the same for the site's own administrator.",
+      "examples": [
+        "<%= config.bin %> users reset-password editor@example.com",
+        "printf %s \"$PASSWORD\" | <%= config.bin %> users reset-password editor@example.com --stdin"
+      ],
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "stdin": {
+          "name": "stdin",
+          "summary": "read the new password from stdin",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:reset-password",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "give a user a new password, and end their sessions",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "ResetPassword",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "non_idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "password",
+            "type": "string",
+            "nullable": true,
+            "description": "the generated one; null when given"
+          }
+        ],
+        "errors": [
+          "not_found",
+          "usage",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "reset-password.ts"
+      ]
+    },
+    "users:unlock": {
+      "aliases": [],
+      "args": {
+        "user": {
+          "description": "their e-mail address or username",
+          "name": "user",
+          "required": true
+        }
+      },
+      "flags": {
+        "output": {
+          "char": "o",
+          "helpGroup": "GLOBAL",
+          "name": "output",
+          "summary": "text for people; json for scripts, on stdout",
+          "default": "text",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "text",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "hidden": true,
+          "name": "json",
+          "summary": "the same as -o json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "users:unlock",
+      "pluginAlias": "@crombolo/cli",
+      "pluginName": "@crombolo/cli",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "clear a user's lockout and failed sign-ins",
+      "enableJsonFlag": false,
+      "audit": {
+        "category": "user",
+        "action": "Unlock",
+        "entityType": "User"
+      },
+      "spec": {
+        "effects": "idempotent",
+        "cardinality": "single",
+        "outputFields": [
+          {
+            "name": "id",
+            "type": "string"
+          },
+          {
+            "name": "email",
+            "type": "string"
+          },
+          {
+            "name": "state",
+            "type": "string"
+          },
+          {
+            "name": "changed",
+            "type": "boolean"
+          }
+        ],
+        "errors": [
+          "not_found",
+          "refused"
+        ]
+      },
+      "isESM": true,
+      "relativePath": [
+        "src",
+        "commands",
+        "users",
+        "unlock.ts"
+      ]
+    },
     "whoami": {
       "aliases": [],
       "args": {
@@ -6706,5 +8077,5 @@
       ]
     }
   },
-  "version": "0.15.0"
+  "version": "0.17.0"
 }