@pithy-sh/core 0.13.0 → 0.15.0

package/dist/cli/commandCatalog.generated.js

@@ -25,6 +25,11 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": true
 			},
+			"--floor": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
 			"--eject": {
 				"type": "boolean",
 				"required": false,
@@ -77,6 +82,67 @@ const COMMANDS = {
 			"flags": ["--remove", "--status"]
 		}]
 	},
+	"audit lock": {
+		"positionals": [],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
+	"audit verify": {
+		"positionals": [{
+			"name": "file",
+			"required": true,
+			"variadic": false
+		}],
+		"flags": { "--json": {
+			"type": "boolean",
+			"required": false,
+			"repeatable": false
+		} },
+		"groups": []
+	},
+	"backup": {
+		"positionals": [],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--binding": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--output": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"cloudflare connect": {
 		"positionals": [],
 		"flags": {
@@ -276,9 +342,44 @@ const COMMANDS = {
 				"type": "string",
 				"required": false,
 				"repeatable": false
+			},
+			"--oidc-issuer": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--oidc-claim": {
+				"type": "string",
+				"required": false,
+				"repeatable": true
+			},
+			"--oidc-audience": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
 			}
 		},
 		"groups": [
+			{
+				"kind": "requires",
+				"flag": "--oidc-claim",
+				"needs": ["--oidc-issuer"],
+				"any": false
+			},
+			{
+				"kind": "requires",
+				"flag": "--oidc-audience",
+				"needs": ["--oidc-issuer"],
+				"any": false
+			},
+			{
+				"kind": "atMostOne",
+				"flags": ["--oidc-issuer", "--public-key"]
+			},
+			{
+				"kind": "atMostOne",
+				"flags": ["--oidc-issuer", "--update"]
+			},
 			{
 				"kind": "requires",
 				"flag": "--public-key",
@@ -300,8 +401,8 @@ const COMMANDS = {
 			{
 				"kind": "requires",
 				"flag": "--kind",
-				"needs": ["--public-key"],
-				"any": false
+				"needs": ["--public-key", "--oidc-issuer"],
+				"any": true
 			},
 			{
 				"kind": "requires",
@@ -316,6 +417,47 @@ const COMMANDS = {
 			}
 		]
 	},
+	"dashboard connections": {
+		"positionals": [],
+		"flags": {
+			"--principal": {
+				"type": "string",
+				"required": true,
+				"repeatable": false
+			},
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--revoke": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--reason": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--yes": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"dashboard disconnect": {
 		"positionals": [],
 		"flags": {
@@ -400,6 +542,48 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"dashboard revoke-trust": {
+		"positionals": [],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--origin": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--open": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--trust-id": {
+				"type": "string",
+				"required": true,
+				"repeatable": false
+			},
+			"--yes": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"dashboard rotate": {
 		"positionals": [],
 		"flags": {
@@ -982,6 +1166,36 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
+			"--lint": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--react-native": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--app": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--ios-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--android-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--web-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
 			"--dir": {
 				"type": "string",
 				"required": false,
@@ -996,6 +1210,156 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"mcp connect": {
+		"positionals": [],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--worker-url": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--purpose": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--scope": {
+				"type": "string",
+				"required": false,
+				"repeatable": true
+			},
+			"--update": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--oidc-issuer": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--oidc-claim": {
+				"type": "string",
+				"required": false,
+				"repeatable": true
+			},
+			"--oidc-audience": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--oidc-token": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--client": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"enum": [
+					"claude-code",
+					"cursor",
+					"vscode",
+					"gemini",
+					"claude-desktop",
+					"cline",
+					"zed",
+					"codex",
+					"goose",
+					"continue"
+				]
+			},
+			"--all": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": [
+			{
+				"kind": "atMostOne",
+				"flags": ["--client", "--all"]
+			},
+			{
+				"kind": "atMostOne",
+				"flags": ["--oidc-issuer", "--update"]
+			},
+			{
+				"kind": "requires",
+				"flag": "--oidc-claim",
+				"needs": ["--oidc-issuer"],
+				"any": false
+			},
+			{
+				"kind": "requires",
+				"flag": "--oidc-audience",
+				"needs": ["--oidc-issuer"],
+				"any": false
+			},
+			{
+				"kind": "requires",
+				"flag": "--oidc-token",
+				"needs": ["--oidc-issuer"],
+				"any": false
+			}
+		]
+	},
+	"mcp disconnect": {
+		"positionals": [],
+		"flags": {
+			"--connection": {
+				"type": "string",
+				"required": true,
+				"repeatable": false
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
+	"mcp serve": {
+		"positionals": [],
+		"flags": { "--connection": {
+			"type": "string",
+			"required": true,
+			"repeatable": false
+		} },
+		"groups": []
+	},
+	"mcp status": {
+		"positionals": [],
+		"flags": { "--json": {
+			"type": "boolean",
+			"required": false,
+			"repeatable": false
+		} },
+		"groups": []
+	},
 	"media deprovision": {
 		"positionals": [],
 		"flags": {
@@ -1280,6 +1644,47 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"restore": {
+		"positionals": [{
+			"name": "dir",
+			"required": true,
+			"variadic": false
+		}],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--binding": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--database": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--group": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"schema": {
 		"positionals": [{
 			"name": "command",
@@ -2237,6 +2642,26 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
+			"--app": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--ios-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--android-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--web-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
 			"--auth": {
 				"type": "boolean",
 				"required": false,
@@ -2252,6 +2677,11 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
+			"--consent": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
 			"--dry-run": {
 				"type": "boolean",
 				"required": false,
@@ -2282,6 +2712,26 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
+			"--app": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--ios-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--android-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--web-rail": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
 			"--check": {
 				"type": "boolean",
 				"required": false,
@@ -2603,11 +3053,13 @@ const GLOBAL_FLAGS = [
 ];
 /** The groups, which only list their subcommands: a sentence may name one, and nobody runs one. */
 const GROUPS = [
+	"audit",
 	"cloudflare",
 	"dashboard",
 	"docs",
 	"email",
 	"feature",
+	"mcp",
 	"media",
 	"payments",
 	"privacy",

package/dist/cli/commandFacts.d.ts

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 /**
- * **What the catalog cannot say about a `pithy` command, written down once (#711).**
+ * **What the catalog cannot say about a `pithy` command, written down once.**
  *
  * `commandCatalog.generated.ts` is the parser's own account of every command: its arguments, its flags, which
  * are required, which have defaults, which go together. Four facts are not in any parser, and each was the
@@ -24,14 +24,14 @@
  * The commands that act on exactly one Worker, and refuse `input/required` without `--worker` when a project
  * has several and the run cannot ask. Every line that names one names the Worker, by its `apps/` directory.
  */
-export declare const WORKER_SCOPED: readonly ["add", "dashboard connect", "email provision", "media provision", "payments provision", "storage provision", "support provision", "testers provision", "turnstile deprovision", "turnstile provision", "ui add", "ui sync", "vector provision", "vector reprocess", "vector reset", "worker sync"];
+export declare const WORKER_SCOPED: readonly ["add", "dashboard connect", "email provision", "mcp connect", "media provision", "payments provision", "storage provision", "support provision", "testers provision", "turnstile deprovision", "turnstile provision", "ui add", "ui sync", "vector provision", "vector reprocess", "vector reset", "worker sync"];
 /** A command that acts on one Worker. */
 export type WorkerScopedPath = (typeof WORKER_SCOPED)[number];
 /**
  * The commands that take `--worker` and do not need it: each fans out over every Worker, or falls back to the
  * first that answers, and the flag narrows.
  */
-export declare const WORKER_NARROWS: readonly ["contract", "dashboard disconnect", "dashboard revoke-key", "dashboard rotate", "dashboard status", "doctor", "env", "init", "migrate", "secrets tables", "seed", "support deprovision", "upgrade"];
+export declare const WORKER_NARROWS: readonly ["backup", "contract", "dashboard connections", "dashboard disconnect", "dashboard revoke-key", "dashboard revoke-trust", "dashboard rotate", "dashboard status", "doctor", "env", "init", "mcp disconnect", "migrate", "restore", "secrets tables", "seed", "support deprovision", "upgrade"];
 /**
  * A command only a person runs, at a terminal, where the Worker is asked for. `pithy remove` refuses every run
  * that cannot ask (`core/person_required`).
@@ -63,8 +63,10 @@ export declare const MEANING_ONLY_WITH: {
 export declare const DESTRUCTIVE_COMMANDS: {
     readonly "dashboard disconnect": "the environment's dashboard connection and the key it signs with";
     readonly "dashboard revoke-key": "a signing key the dashboard holds";
+    readonly "dashboard revoke-trust": "an OIDC trust a workload calls under";
     readonly "email deprovision": "the email Workers, and with --suppression the suppression database";
     readonly "feature destroy": "the feature's worktree, its branch and every resource it provisioned";
+    readonly "mcp disconnect": "an agent's key or trust, its key file and its client entries";
     readonly "media deprovision": "the media Worker, and with --storage its bucket";
     readonly remove: "a capability's wiring";
     readonly "secrets deprovision": "the secrets manager, and with --keys the store's keys";
@@ -88,6 +90,7 @@ export declare const DESTRUCTIVE_FLAGS: {
     readonly "--destroy-retained": "a resource kept for recovery";
     readonly "--drop": "a capability's tables";
     readonly "--redo": "the data a seed wrote";
+    readonly "--revoke": "every key and trust a principal's connections hold";
     readonly "--rollback": "the schema a migration group applied";
 };
 /** A flag that makes a command destroy something. */
@@ -139,14 +142,14 @@ export declare const PRODUCTION_CONFIRMS: {
 /** A command whose production run is a person's decision. */
 export type ProductionPath = keyof typeof PRODUCTION_CONFIRMS;
 /**
- * **A command that acts on every environment when its `--env` is left off (#711)**, production among them. `pithy
+ * **A command that acts on every environment when its `--env` is left off**, production among them. `pithy
  * testers provision` with no `--env` provisions every declared environment, so the bare line touches production as
  * surely as `--env prod` does, and is a person's decision for the same reason. Each declares `--env` with no
  * default; `command.test.ts` holds that against the catalog.
  */
 export declare const EVERY_ENVIRONMENT_WITHOUT_ENV: readonly ["testers provision"];
 /**
- * **A command that acts on every environment on every run (#711)**, production among them, with no `--env` to narrow
+ * **A command that acts on every environment on every run**, production among them, with no `--env` to narrow
  * it. `pithy secrets provision` deploys each declared environment's manager and mints its store entries, so every line
  * naming it touches production and is a person's decision — never the fix for one binding, one database or one
  * setting. None declares `--env`; `command.test.ts` holds that against the catalog.

package/dist/cli/commandFacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../src/cli/commandFacts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,YACxB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,CACL,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc,YACzB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,MAAM,EACN,qBAAqB,EACrB,SAAS,CACD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,QAAQ,CAAU,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAuB,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,OAAO,CAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,OAAO,EAAE,WAAW;CAAW,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;aAC/B,sBAAsB,EAAE,kEAAkE;aAC1F,sBAAsB,EAAE,mCAAmC;aAC3D,mBAAmB,EAAE,oEAAoE;aACzF,iBAAiB,EAAE,sEAAsE;aACzF,mBAAmB,EAAE,iDAAiD;aACtE,MAAM,EAAE,uBAAuB;aAC/B,qBAAqB,EAAE,uDAAuD;aAC9E,wBAAwB,EAAE,iEAAiE;aAC3F,YAAY,EAAE,iBAAiB;aAC/B,qBAAqB,EAAE,mDAAmD;aAC1E,qBAAqB,EAAE,yDAAyD;aAChF,qBAAqB,EAAE,oBAAoB;aAC3C,cAAc,EAAE,cAAc;aAC9B,uBAAuB,EAAE,yDAAyD;aAClF,cAAc,EAAE,2BAA2B;aAC3C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAC5B,oBAAoB,EAAE,8BAA8B;aACpD,QAAQ,EAAE,uBAAuB;aACjC,QAAQ,EAAE,uBAAuB;aACjC,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAI,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAIhH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,CAChB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,uBAAuB,YAAI,MAAM,EAAE,YAAY,CAAU,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;wBACnB,WAAW;mBAChB,sBAAsB;;;;CAI8B,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAqE,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gCAAqE,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAEnG,CAAC"}
+{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../src/cli/commandFacts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,YACxB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,CACL,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc,YACzB,QAAQ,EACR,UAAU,EACV,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,MAAM,EACN,qBAAqB,EACrB,SAAS,CACD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,QAAQ,CAAU,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAuB,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,OAAO,CAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,OAAO,EAAE,WAAW;CAAW,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;aAC/B,sBAAsB,EAAE,kEAAkE;aAC1F,sBAAsB,EAAE,mCAAmC;aAC3D,wBAAwB,EAAE,sCAAsC;aAChE,mBAAmB,EAAE,oEAAoE;aACzF,iBAAiB,EAAE,sEAAsE;aACzF,gBAAgB,EAAE,8DAA8D;aAChF,mBAAmB,EAAE,iDAAiD;aACtE,MAAM,EAAE,uBAAuB;aAC/B,qBAAqB,EAAE,uDAAuD;aAC9E,wBAAwB,EAAE,iEAAiE;aAC3F,YAAY,EAAE,iBAAiB;aAC/B,qBAAqB,EAAE,mDAAmD;aAC1E,qBAAqB,EAAE,yDAAyD;aAChF,qBAAqB,EAAE,oBAAoB;aAC3C,cAAc,EAAE,cAAc;aAC9B,uBAAuB,EAAE,yDAAyD;aAClF,cAAc,EAAE,2BAA2B;aAC3C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAC5B,oBAAoB,EAAE,8BAA8B;aACpD,QAAQ,EAAE,uBAAuB;aACjC,QAAQ,EAAE,uBAAuB;aACjC,UAAU,EAAE,oDAAoD;aAChE,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAI,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAIhH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,CAChB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,uBAAuB,YAAI,MAAM,EAAE,YAAY,CAAU,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;wBACnB,WAAW;mBAChB,sBAAsB;;;;CAI8B,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAqE,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gCAAqE,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAEnG,CAAC"}

package/dist/cli/commandFacts.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 //#region src/cli/commandFacts.ts
 /**
-* **What the catalog cannot say about a `pithy` command, written down once (#711).**
+* **What the catalog cannot say about a `pithy` command, written down once.**
 *
 * `commandCatalog.generated.ts` is the parser's own account of every command: its arguments, its flags, which
 * are required, which have defaults, which go together. Four facts are not in any parser, and each was the
@@ -29,6 +29,7 @@ const WORKER_SCOPED = [
 	"add",
 	"dashboard connect",
 	"email provision",
+	"mcp connect",
 	"media provision",
 	"payments provision",
 	"storage provision",
@@ -48,15 +49,20 @@ const WORKER_SCOPED = [
 * first that answers, and the flag narrows.
 */
 const WORKER_NARROWS = [
+	"backup",
 	"contract",
+	"dashboard connections",
 	"dashboard disconnect",
 	"dashboard revoke-key",
+	"dashboard revoke-trust",
 	"dashboard rotate",
 	"dashboard status",
 	"doctor",
 	"env",
 	"init",
+	"mcp disconnect",
 	"migrate",
+	"restore",
 	"secrets tables",
 	"seed",
 	"support deprovision",
@@ -93,8 +99,10 @@ const MEANING_ONLY_WITH = {
 const DESTRUCTIVE_COMMANDS = {
 	"dashboard disconnect": "the environment's dashboard connection and the key it signs with",
 	"dashboard revoke-key": "a signing key the dashboard holds",
+	"dashboard revoke-trust": "an OIDC trust a workload calls under",
 	"email deprovision": "the email Workers, and with --suppression the suppression database",
 	"feature destroy": "the feature's worktree, its branch and every resource it provisioned",
+	"mcp disconnect": "an agent's key or trust, its key file and its client entries",
 	"media deprovision": "the media Worker, and with --storage its bucket",
 	remove: "a capability's wiring",
 	"secrets deprovision": "the secrets manager, and with --keys the store's keys",
@@ -116,6 +124,7 @@ const DESTRUCTIVE_FLAGS = {
 	"--destroy-retained": "a resource kept for recovery",
 	"--drop": "a capability's tables",
 	"--redo": "the data a seed wrote",
+	"--revoke": "every key and trust a principal's connections hold",
 	"--rollback": "the schema a migration group applied"
 };
 /**
@@ -190,14 +199,14 @@ const PRODUCTION_CONFIRMS = {
 	"vector provision": null
 };
 /**
-* **A command that acts on every environment when its `--env` is left off (#711)**, production among them. `pithy
+* **A command that acts on every environment when its `--env` is left off**, production among them. `pithy
 * testers provision` with no `--env` provisions every declared environment, so the bare line touches production as
 * surely as `--env prod` does, and is a person's decision for the same reason. Each declares `--env` with no
 * default; `command.test.ts` holds that against the catalog.
 */
 const EVERY_ENVIRONMENT_WITHOUT_ENV = ["testers provision"];
 /**
-* **A command that acts on every environment on every run (#711)**, production among them, with no `--env` to narrow
+* **A command that acts on every environment on every run**, production among them, with no `--env` to narrow
 * it. `pithy secrets provision` deploys each declared environment's manager and mints its store entries, so every line
 * naming it touches production and is a person's decision — never the fix for one binding, one database or one
 * setting. None declares `--env`; `command.test.ts` holds that against the catalog.