[{"data":1,"prerenderedAt":3142},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Freference\u002Fcli":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":90,"body":141,"description":3135,"extension":3136,"meta":3137,"navigation":3138,"path":89,"seo":3139,"stem":3140,"__hash__":3141},"docs\u002Fdocs\u002Freference\u002Fcli.md",{"type":142,"value":143,"toc":2991},"minimark",[144,151,161,168,174,180,186,193,199,206,212,218,224,230,236,242,248,254,260,266,272,278,284,290,296,302,308,314,320,326,332,338,344,350,356,362,368,374,380,386,392,398,404,410,416,422,428,434,440,446,452,458,464,470,476,482,488,494,500,506,512,518,524,530,536,542,548,554,560,566,571,577,582,588,593,599,605,611,617,623,629,635,641,647,653,659,665,671,676,682,687,693,698,704,710,716,721,727,732,738,743,749,755,761,766,772,777,783,788,794,800,806,811,817,822,828,833,839,845,851,857,863,869,875,881,887,893,899,905,911,917,923,928,934,939,945,950,956,962,968,973,979,984,990,995,1001,1007,1013,1018,1024,1029,1035,1040,1046,1052,1058,1063,1069,1074,1080,1085,1091,1097,1103,1108,1114,1119,1125,1130,1136,1142,1148,1154,1160,1166,1172,1178,1184,1190,1196,1202,1208,1214,1220,1226,1232,1238,1244,1250,1256,1262,1268,1274,1280,1286,1292,1298,1304,1310,1316,1322,1328,1334,1340,1346,1352,1358,1364,1370,1376,1382,1388,1394,1400,1406,1412,1418,1424,1430,1436,1442,1448,1454,1460,1466,1472,1478,1484,1490,1496,1502,1508,1514,1520,1526,1532,1538,1544,1550,1556,1562,1568,1574,1580,1586,1592,1598,1604,1610,1616,1622,1628,1634,1640,1646,1652,1658,1664,1670,1676,1682,1688,1694,1700,1706,1712,1718,1724,1730,1736,1742,1748,1754,1760,1766,1772,1778,1784,1790,1796,1802,1808,1814,1820,1826,1832,1838,1844,1850,1856,1862,1868,1874,1880,1886,1892,1898,1904,1910,1916,1922,1928,1934,1940,1946,1952,1958,1964,1970,1976,1982,1988,1994,2000,2006,2012,2018,2024,2030,2036,2042,2048,2054,2060,2066,2072,2078,2084,2090,2096,2102,2108,2114,2120,2126,2132,2138,2144,2150,2156,2162,2168,2174,2180,2186,2192,2198,2204,2210,2216,2222,2228,2234,2240,2246,2252,2258,2264,2270,2276,2282,2288,2294,2300,2306,2312,2318,2324,2330,2336,2342,2348,2354,2360,2366,2372,2378,2384,2390,2396,2402,2408,2414,2420,2426,2432,2438,2444,2450,2456,2462,2468,2474,2480,2486,2492,2498,2504,2510,2516,2522,2528,2534,2540,2546,2552,2558,2564,2570,2576,2582,2588,2594,2600,2606,2612,2618,2624,2630,2636,2642,2648,2654,2660,2666,2672,2678,2684,2690,2696,2702,2708,2714,2720,2726,2732,2738,2744,2750,2756,2762,2768,2774,2780,2786,2792,2798,2804,2810,2817,2823,2829,2835,2841,2847,2853,2859,2865,2871,2877,2883,2889,2895,2901,2907,2913,2919,2925,2931,2937,2943,2949,2955,2961,2967,2973,2979,2985],[145,146,148],"h1",{"id":147},"mm",[149,150,147],"code",{},[152,153,159],"pre",{"className":154,"code":156,"language":157,"meta":158},[155],"language-text","mm compiles one engine-neutral project contract into reviewed plans, then applies them through a selected runtime. Selection is resolved once from CLI flags, private preferences, environment config, project defaults, then target defaults. Missing or contradictory selection is an error. Plans, logs, and JSON never contain secret values.\n\n`--help` never probes a container engine or opens project state.\n\nUsage: mm [OPTIONS] [COMMAND]\n\nCommands:\n  init     Initialize a project through a reviewed plan or interactive onboarding\n  dev      Set up and operate the local development environment\n  config   Validate and edit desired project configuration through typed reviews\n  doctor   Check configuration health and resolved runtime capabilities\n  ingress  Start or stop this workstation's global public HTTP\u002FHTTPS forwarding\n  service  Inspect and operate deployed services\n  job      Run finite jobs and operate their schedules\n  env      Inspect and deliver non-secret environment values\n  secret   Manage secret values, rotation, and provider instances\n  access   Manage application access policies, users, routes, and sessions\n  build    Plan and execute deterministic OCI image builds\n  deploy   Plan and apply the selected environment to its target\n  team     Show who may reach remote environments, join, and sync access\n  forward  Reach a remote service's port on localhost; save forwards for reuse\n  key      Create or show this device's SSH key for remote environments\n  target   Manage targets, private selection, setup, ingress, and remote access\n  agent    Show and trust what AI agents may do, and connect coding tools\n  mcp      Serve the Model Context Protocol server that AI agents use\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n      --root \u003CPATH>\n          Project root or a path inside the project\n\n  -e, --environment \u003CNAME>\n          Environment to operate on (overrides MM_ENVIRONMENT and default-environment)\n\n          [env: MM_ENVIRONMENT=]\n\n      --runtime \u003CRUNTIME>\n          Ephemeral runtime adapter for this invocation only\n\n          [possible values: podman-compose, docker-compose, docker-swarm]\n\n      --target \u003CNAME>\n          Ephemeral target name for this invocation only\n\n      --mm-home \u003CPATH>\n          Directory containing mm's local state and target catalog\n\n          [env: MM_HOME=]\n\n      --output \u003COUTPUT>\n          Human text or machine-readable JSON. JSON errors stay JSON\n\n          [default: human]\n          [possible values: human, json]\n\n  -h, --help\n          Print help (see a summary with '-h')\n\n  -V, --version\n          Print version\n\nExamples:\n  mm init\n  mm dev setup\n  mm config validate\n  mm service status\n  mm deploy plan\n\nSelection: --runtime and --target override private preferences and project defaults. Use `mm target preference show` to inspect provenance.\n","text","",[149,160,156],{"__ignoreMap":158},[162,163,165],"h2",{"id":164},"mm-init",[149,166,167],{},"mm init",[152,169,172],{"className":170,"code":171,"language":157,"meta":158},[155],"Initialize a project through a reviewed plan or interactive onboarding\n\nUsage: init [OPTIONS]\n\nOptions:\n      --name \u003CNAME>\n          Override the project name inferred from the directory\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only initialization review\n\n      --yes\n          Apply the reviewed configuration, Ansible starter, and local-override ignore rule\n\n  -h, --help\n          Print help\n\nExamples:\n  mm init --name example\n  mm init --name example --plan HASH --yes\n\nWith an interactive terminal and no arguments, onboarding opens without mutating files before review. Noninteractive use prints a deterministic review. Apply requires the exact plan hash and --yes. Exit codes: 0 success; 1 stale\u002Flocal state; 2 invalid root\u002Fconfiguration; 3 security failure.\n",[149,173,171],{"__ignoreMap":158},[162,175,177],{"id":176},"mm-dev",[149,178,179],{},"mm dev",[152,181,184],{"className":182,"code":183,"language":157,"meta":158},[155],"Set up and operate the local development environment\n\nUsage: dev [COMMAND]\n\nCommands:\n  setup      Set up local trust, ingress, Mailpit, Cap, dashboard, and project routes\n  up         Review or apply the local development deployment\n  down       Stop the project's containers; volumes, routes, and overrides are kept\n  status     Show local project and runtime status\n  tls        Inspect and maintain local HTTPS certificates and trust\n  services   Manage the installation-wide local service stack\n  dashboard  Serve the local developer dashboard\n  mounts     Discover, review, and disable source-code mounts\n  open       Print a configured local service URL\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,185,183],{"__ignoreMap":158},[187,188,190],"h3",{"id":189},"mm-dev-setup",[149,191,192],{},"mm dev setup",[152,194,197],{"className":195,"code":196,"language":157,"meta":158},[155],"Set up local trust, ingress, Mailpit, Cap, dashboard, and project routes\n\nUsage: setup [OPTIONS] [COMMAND]\n\nCommands:\n  project  Inspect and deploy an existing clone using its configured development environment\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n      --no-trust\n          Generate certificates without trusting the root\n\n      --system\n          Use the privileged system trust store on macOS or Windows\n\n      --services\n          Review and install the shared local service stack\n\n      --smtp-port \u003CPORT>\n          Publish SMTP on this explicit loopback port\n\n      --yes\n          Apply the displayed service plan without prompting\n\n  -h, --help\n          Print help\n",[149,198,196],{"__ignoreMap":158},[200,201,203],"h4",{"id":202},"mm-dev-setup-project",[149,204,205],{},"mm dev setup project",[152,207,210],{"className":208,"code":209,"language":157,"meta":158},[155],"Inspect and deploy an existing clone using its configured development environment\n\nUsage: project [OPTIONS]\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by the read-only guided workflow review\n\n      --deploy-plan \u003CHASH>\n          Hash printed by `mm deploy plan` for the same environment and target\n\n      --yes\n          Apply reviewed local dependencies and deployment without prompting\n\n  -h, --help\n          Print help\n\nExamples:\n  mm dev setup project\n  mm dev setup project --plan WORKFLOW_HASH --deploy-plan DEPLOY_HASH --yes\n\nThe first command is read-only. Apply requires both reviewed hashes. Secret plaintext is entered separately with `mm secret set`; it is never displayed. Exit codes: 0 success; 1 stale\u002Flocal state; 2 missing values\u002Fconfiguration; 3 runtime\u002Fsecurity failure.\n",[149,211,209],{"__ignoreMap":158},[187,213,215],{"id":214},"mm-dev-up",[149,216,217],{},"mm dev up",[152,219,222],{"className":220,"code":221,"language":157,"meta":158},[155],"Review or apply the local development deployment\n\nUsage: up [OPTIONS]\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by the deployment review\n\n      --yes\n          Apply the exact reviewed plan without prompting\n\n  -h, --help\n          Print help\n",[149,223,221],{"__ignoreMap":158},[187,225,227],{"id":226},"mm-dev-down",[149,228,229],{},"mm dev down",[152,231,234],{"className":232,"code":233,"language":157,"meta":158},[155],"Stop the project's containers; volumes, routes, and overrides are kept\n\nUsage: down [OPTIONS]\n\nOptions:\n      --yes\n          Confirm stopping every stack of the selected environment\n\n  -h, --help\n          Print help\n",[149,235,233],{"__ignoreMap":158},[187,237,239],{"id":238},"mm-dev-status",[149,240,241],{},"mm dev status",[152,243,246],{"className":244,"code":245,"language":157,"meta":158},[155],"Show local project and runtime status\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,247,245],{"__ignoreMap":158},[187,249,251],{"id":250},"mm-dev-tls",[149,252,253],{},"mm dev tls",[152,255,258],{"className":256,"code":257,"language":157,"meta":158},[155],"Inspect and maintain local HTTPS certificates and trust\n\nUsage: tls [OPTIONS] \u003CCOMMAND>\n\nCommands:\n  status     Query CA files, leaf renewal, and the actual platform trust store\n  repair     Restore trust, renew stale leaves, and finish an interrupted rotation\n  rotate     Rotate the root with staged trust overlap and reissued leaves\n  uninstall  Remove only exact mm-owned trust entries and local private material\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n      --system\n          Use the privileged system trust store on macOS or Windows\n\n  -h, --help\n          Print help\n",[149,259,257],{"__ignoreMap":158},[200,261,263],{"id":262},"mm-dev-tls-status",[149,264,265],{},"mm dev tls status",[152,267,270],{"className":268,"code":269,"language":157,"meta":158},[155],"Query CA files, leaf renewal, and the actual platform trust store\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,271,269],{"__ignoreMap":158},[200,273,275],{"id":274},"mm-dev-tls-repair",[149,276,277],{},"mm dev tls repair",[152,279,282],{"className":280,"code":281,"language":157,"meta":158},[155],"Restore trust, renew stale leaves, and finish an interrupted rotation\n\nUsage: repair\n\nOptions:\n  -h, --help\n          Print help\n",[149,283,281],{"__ignoreMap":158},[200,285,287],{"id":286},"mm-dev-tls-rotate",[149,288,289],{},"mm dev tls rotate",[152,291,294],{"className":292,"code":293,"language":157,"meta":158},[155],"Rotate the root with staged trust overlap and reissued leaves\n\nUsage: rotate\n\nOptions:\n  -h, --help\n          Print help\n",[149,295,293],{"__ignoreMap":158},[200,297,299],{"id":298},"mm-dev-tls-uninstall",[149,300,301],{},"mm dev tls uninstall",[152,303,306],{"className":304,"code":305,"language":157,"meta":158},[155],"Remove only exact mm-owned trust entries and local private material\n\nUsage: uninstall\n\nOptions:\n  -h, --help\n          Print help\n",[149,307,305],{"__ignoreMap":158},[187,309,311],{"id":310},"mm-dev-services",[149,312,313],{},"mm dev services",[152,315,318],{"className":316,"code":317,"language":157,"meta":158},[155],"Manage the installation-wide local service stack\n\nUsage: services \u003CCOMMAND>\n\nCommands:\n  plan     Publish a deterministic reviewed lifecycle plan\n  apply    Apply an exact install\u002Fconvergence plan hash\n  status   Show component health, ownership, image, route, certificate, and drift status\n  upgrade  Apply an exact version upgrade plan hash\n  repair   Recover an interrupted operation or reconcile drift from an exact plan\n  remove   Remove only mm-owned runtime resources using an exact reviewed plan\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,319,317],{"__ignoreMap":158},[200,321,323],{"id":322},"mm-dev-services-plan",[149,324,325],{},"mm dev services plan",[152,327,330],{"className":328,"code":329,"language":157,"meta":158},[155],"Publish a deterministic reviewed lifecycle plan\n\nUsage: plan [OPTIONS]\n\nOptions:\n      --operation \u003COPERATION>\n          Lifecycle operation represented by the plan\n\n          [default: apply]\n          [possible values: apply, upgrade, repair, remove]\n\n      --smtp-port \u003CPORT>\n          Publish SMTP on this loopback port for host-native applications\n\n      --purge\n          Include persistent data deletion in a remove plan\n\n      --gate\n          Prepare conditional Cap and Valkey components before creating the first gate policy\n\n  -h, --help\n          Print help\n",[149,331,329],{"__ignoreMap":158},[200,333,335],{"id":334},"mm-dev-services-apply",[149,336,337],{},"mm dev services apply",[152,339,342],{"className":340,"code":341,"language":157,"meta":158},[155],"Apply an exact install\u002Fconvergence plan hash\n\nUsage: apply [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm dev services plan` for an apply operation\n\n      --smtp-port \u003CPORT>\n          Publish SMTP on this loopback port; must match the reviewed plan\n\n      --gate\n          Include the reviewed first-policy Cap and Valkey preparation\n\n      --yes\n          Skip the service mutation confirmation prompt\n\n  -h, --help\n          Print help\n",[149,343,341],{"__ignoreMap":158},[200,345,347],{"id":346},"mm-dev-services-status",[149,348,349],{},"mm dev services status",[152,351,354],{"className":352,"code":353,"language":157,"meta":158},[155],"Show component health, ownership, image, route, certificate, and drift status\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,355,353],{"__ignoreMap":158},[200,357,359],{"id":358},"mm-dev-services-upgrade",[149,360,361],{},"mm dev services upgrade",[152,363,366],{"className":364,"code":365,"language":157,"meta":158},[155],"Apply an exact version upgrade plan hash\n\nUsage: upgrade [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm dev services plan --operation upgrade`\n\n      --smtp-port \u003CPORT>\n          Change the loopback SMTP port as part of the reviewed upgrade\n\n      --gate\n          Include the reviewed Cap and Valkey components\n\n      --yes\n          Skip the service mutation confirmation prompt\n\n  -h, --help\n          Print help\n",[149,367,365],{"__ignoreMap":158},[200,369,371],{"id":370},"mm-dev-services-repair",[149,372,373],{},"mm dev services repair",[152,375,378],{"className":376,"code":377,"language":157,"meta":158},[155],"Recover an interrupted operation or reconcile drift from an exact plan\n\nUsage: repair [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm dev services plan --operation repair`\n\n      --yes\n          Skip the service mutation confirmation prompt\n\n  -h, --help\n          Print help\n",[149,379,377],{"__ignoreMap":158},[200,381,383],{"id":382},"mm-dev-services-remove",[149,384,385],{},"mm dev services remove",[152,387,390],{"className":388,"code":389,"language":157,"meta":158},[155],"Remove only mm-owned runtime resources using an exact reviewed plan\n\nUsage: remove [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm dev services plan --operation remove`\n\n      --purge\n          Delete retained Mailpit and ingress volumes; must match the reviewed plan\n\n      --yes\n          Skip the service mutation confirmation prompt\n\n  -h, --help\n          Print help\n",[149,391,389],{"__ignoreMap":158},[187,393,395],{"id":394},"mm-dev-dashboard",[149,396,397],{},"mm dev dashboard",[152,399,402],{"className":400,"code":401,"language":157,"meta":158},[155],"Serve the local developer dashboard\n\nUsage: dashboard \u003CCOMMAND>\n\nCommands:\n  serve  Run the ingress-authenticated dashboard backend\n  help   Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,403,401],{"__ignoreMap":158},[200,405,407],{"id":406},"mm-dev-dashboard-serve",[149,408,409],{},"mm dev dashboard serve",[152,411,414],{"className":412,"code":413,"language":157,"meta":158},[155],"Run the ingress-authenticated dashboard backend\n\nUsage: serve [OPTIONS]\n\nOptions:\n      --listen \u003CADDRESS>\n          Control listener used by the managed ingress route\n\n          [default: 0.0.0.0:42831]\n\n  -h, --help\n          Print help\n",[149,415,413],{"__ignoreMap":158},[187,417,419],{"id":418},"mm-dev-mounts",[149,420,421],{},"mm dev mounts",[152,423,426],{"className":424,"code":425,"language":157,"meta":158},[155],"Discover, review, and disable source-code mounts\n\nUsage: mounts \u003CCOMMAND>\n\nCommands:\n  plan       Produce a deterministic mount proposal with discovery evidence\n  configure  Persist the exact reviewed proposal in the project config\n  disable    Remove a configured mount after reviewing its current plan\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,427,425],{"__ignoreMap":158},[200,429,431],{"id":430},"mm-dev-mounts-plan",[149,432,433],{},"mm dev mounts plan",[152,435,438],{"className":436,"code":437,"language":157,"meta":158},[155],"Produce a deterministic mount proposal with discovery evidence\n\nUsage: plan [OPTIONS] \u003CMODULE>\n\nArguments:\n  \u003CMODULE>\n\n\nOptions:\n      --source \u003CPATH>\n          Override the module-relative portable source proposed by discovery\n\n      --mount-target \u003CPATH>\n          Override the absolute container target proposed by discovery\n\n      --service \u003CSERVICE>\n          Select a service explicitly; repeat for multiple services\n\n      --preset \u003CPRESET>\n          Use a framework preservation preset explicitly\n\n          [possible values: laravel, node, dotnet, rust]\n\n      --read-only\n          Mount source read-only instead of read-write\n\n      --safe-exception \u003CPATH>\n          Explicitly approve one otherwise-sensitive module-relative path\n\n  -h, --help\n          Print help\n",[149,439,437],{"__ignoreMap":158},[200,441,443],{"id":442},"mm-dev-mounts-configure",[149,444,445],{},"mm dev mounts configure",[152,447,450],{"className":448,"code":449,"language":157,"meta":158},[155],"Persist the exact reviewed proposal in the project config\n\nUsage: configure [OPTIONS] --plan \u003CHASH> \u003CMODULE>\n\nArguments:\n  \u003CMODULE>\n\n\nOptions:\n      --source \u003CPATH>\n          Override the module-relative portable source proposed by discovery\n\n      --mount-target \u003CPATH>\n          Override the absolute container target proposed by discovery\n\n      --service \u003CSERVICE>\n          Select a service explicitly; repeat for multiple services\n\n      --preset \u003CPRESET>\n          Use a framework preservation preset explicitly\n\n          [possible values: laravel, node, dotnet, rust]\n\n      --read-only\n          Mount source read-only instead of read-write\n\n      --safe-exception \u003CPATH>\n          Explicitly approve one otherwise-sensitive module-relative path\n\n      --plan \u003CHASH>\n          Hash printed by `mm dev mounts plan` with identical options\n\n  -h, --help\n          Print help\n",[149,451,449],{"__ignoreMap":158},[200,453,455],{"id":454},"mm-dev-mounts-disable",[149,456,457],{},"mm dev mounts disable",[152,459,462],{"className":460,"code":461,"language":157,"meta":158},[155],"Remove a configured mount after reviewing its current plan\n\nUsage: disable --plan \u003CHASH> \u003CMODULE>\n\nArguments:\n  \u003CMODULE>\n\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm dev mounts plan MODULE`\n\n  -h, --help\n          Print help\n",[149,463,461],{"__ignoreMap":158},[187,465,467],{"id":466},"mm-dev-open",[149,468,469],{},"mm dev open",[152,471,474],{"className":472,"code":473,"language":157,"meta":158},[155],"Print a configured local service URL\n\nUsage: open [SERVICE]\n\nArguments:\n  [SERVICE]\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,475,473],{"__ignoreMap":158},[162,477,479],{"id":478},"mm-config",[149,480,481],{},"mm config",[152,483,486],{"className":484,"code":485,"language":157,"meta":158},[155],"Validate and edit desired project configuration through typed reviews\n\nUsage: config \u003CCOMMAND>\n\nCommands:\n  validate     Validate .config\u002Fmm.yaml, its split files, and local overrides, without probing a runtime\n  module       Review typed module declarations\n  service      Review typed service declarations\n  stack        Review stack declarations or compile generated artifacts\n  build        Review typed image-build declarations\n  environment  Review typed environment declarations\n  binding      Review typed environment bindings\n  secret       Review secret declarations and references, never material\n  ingress      Review ingress declarations or inspect compiled routes\n  mount        Review typed development mount declarations\n  job          Review typed finite-job declarations\n  schedule     Review typed schedule declarations\n  access       Review typed application-access declarations\n  user         Review who may reach remote environments (the users: key)\n  schema       Print the generated JSON Schema for .config\u002Fmm.yaml, or for one split file's value\n  split        Plan moving a top-level key into its own .config\u002Fmm\u002FKEY.yaml; apply only with --plan and --yes\n  join         Plan moving a split key back into .config\u002Fmm.yaml; apply only with --plan and --yes\n  sources      Show which file declares each top-level key\n  help         Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,487,485],{"__ignoreMap":158},[187,489,491],{"id":490},"mm-config-validate",[149,492,493],{},"mm config validate",[152,495,498],{"className":496,"code":497,"language":157,"meta":158},[155],"Validate .config\u002Fmm.yaml, its split files, and local overrides, without probing a runtime\n\nUsage: validate [OPTIONS]\n\nOptions:\n      --for-remote\n          Also refuse Compose features a remote host blocks unless its host policy allows them\n\n  -h, --help\n          Print help\n",[149,499,497],{"__ignoreMap":158},[187,501,503],{"id":502},"mm-config-module",[149,504,505],{},"mm config module",[152,507,510],{"className":508,"code":509,"language":157,"meta":158},[155],"Review typed module declarations\n\nUsage: module \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,511,509],{"__ignoreMap":158},[200,513,515],{"id":514},"mm-config-module-add",[149,516,517],{},"mm config module add",[152,519,522],{"className":520,"code":521,"language":157,"meta":158},[155],"Plan adding a new named resource; apply only with --plan and --yes\n\nUsage: add [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,523,521],{"__ignoreMap":158},[200,525,527],{"id":526},"mm-config-module-edit",[149,528,529],{},"mm config module edit",[152,531,534],{"className":532,"code":533,"language":157,"meta":158},[155],"Plan replacing one named resource definition; apply only with --plan and --yes\n\nUsage: edit [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,535,533],{"__ignoreMap":158},[200,537,539],{"id":538},"mm-config-module-remove",[149,540,541],{},"mm config module remove",[152,543,546],{"className":544,"code":545,"language":157,"meta":158},[155],"Plan removing one named resource; apply only with --plan and --yes\n\nUsage: remove [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier removal review\n\n      --yes\n          Apply the exact reviewed removal; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,547,545],{"__ignoreMap":158},[187,549,551],{"id":550},"mm-config-service",[149,552,553],{},"mm config service",[152,555,558],{"className":556,"code":557,"language":157,"meta":158},[155],"Review typed service declarations\n\nUsage: service \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,559,557],{"__ignoreMap":158},[200,561,563],{"id":562},"mm-config-service-add",[149,564,565],{},"mm config service add",[152,567,569],{"className":568,"code":521,"language":157,"meta":158},[155],[149,570,521],{"__ignoreMap":158},[200,572,574],{"id":573},"mm-config-service-edit",[149,575,576],{},"mm config service edit",[152,578,580],{"className":579,"code":533,"language":157,"meta":158},[155],[149,581,533],{"__ignoreMap":158},[200,583,585],{"id":584},"mm-config-service-remove",[149,586,587],{},"mm config service remove",[152,589,591],{"className":590,"code":545,"language":157,"meta":158},[155],[149,592,545],{"__ignoreMap":158},[187,594,596],{"id":595},"mm-config-stack",[149,597,598],{},"mm config stack",[152,600,603],{"className":601,"code":602,"language":157,"meta":158},[155],"Review stack declarations or compile generated artifacts\n\nUsage: stack \u003CCOMMAND>\n\nCommands:\n  add      Plan adding a stack declaration\n  edit     Plan replacing a stack declaration\n  remove   Plan removing a stack declaration\n  compile  Publish deterministic Compose manifests and generated overlays\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,604,602],{"__ignoreMap":158},[200,606,608],{"id":607},"mm-config-stack-add",[149,609,610],{},"mm config stack add",[152,612,615],{"className":613,"code":614,"language":157,"meta":158},[155],"Plan adding a stack declaration\n\nUsage: add [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,616,614],{"__ignoreMap":158},[200,618,620],{"id":619},"mm-config-stack-edit",[149,621,622],{},"mm config stack edit",[152,624,627],{"className":625,"code":626,"language":157,"meta":158},[155],"Plan replacing a stack declaration\n\nUsage: edit [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,628,626],{"__ignoreMap":158},[200,630,632],{"id":631},"mm-config-stack-remove",[149,633,634],{},"mm config stack remove",[152,636,639],{"className":637,"code":638,"language":157,"meta":158},[155],"Plan removing a stack declaration\n\nUsage: remove [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier removal review\n\n      --yes\n          Apply the exact reviewed removal; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,640,638],{"__ignoreMap":158},[200,642,644],{"id":643},"mm-config-stack-compile",[149,645,646],{},"mm config stack compile",[152,648,651],{"className":649,"code":650,"language":157,"meta":158},[155],"Publish deterministic Compose manifests and generated overlays\n\nUsage: compile\n\nOptions:\n  -h, --help\n          Print help\n",[149,652,650],{"__ignoreMap":158},[187,654,656],{"id":655},"mm-config-build",[149,657,658],{},"mm config build",[152,660,663],{"className":661,"code":662,"language":157,"meta":158},[155],"Review typed image-build declarations\n\nUsage: build \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,664,662],{"__ignoreMap":158},[200,666,668],{"id":667},"mm-config-build-add",[149,669,670],{},"mm config build add",[152,672,674],{"className":673,"code":521,"language":157,"meta":158},[155],[149,675,521],{"__ignoreMap":158},[200,677,679],{"id":678},"mm-config-build-edit",[149,680,681],{},"mm config build edit",[152,683,685],{"className":684,"code":533,"language":157,"meta":158},[155],[149,686,533],{"__ignoreMap":158},[200,688,690],{"id":689},"mm-config-build-remove",[149,691,692],{},"mm config build remove",[152,694,696],{"className":695,"code":545,"language":157,"meta":158},[155],[149,697,545],{"__ignoreMap":158},[187,699,701],{"id":700},"mm-config-environment",[149,702,703],{},"mm config environment",[152,705,708],{"className":706,"code":707,"language":157,"meta":158},[155],"Review typed environment declarations\n\nUsage: environment \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,709,707],{"__ignoreMap":158},[200,711,713],{"id":712},"mm-config-environment-add",[149,714,715],{},"mm config environment add",[152,717,719],{"className":718,"code":521,"language":157,"meta":158},[155],[149,720,521],{"__ignoreMap":158},[200,722,724],{"id":723},"mm-config-environment-edit",[149,725,726],{},"mm config environment edit",[152,728,730],{"className":729,"code":533,"language":157,"meta":158},[155],[149,731,533],{"__ignoreMap":158},[200,733,735],{"id":734},"mm-config-environment-remove",[149,736,737],{},"mm config environment remove",[152,739,741],{"className":740,"code":545,"language":157,"meta":158},[155],[149,742,545],{"__ignoreMap":158},[187,744,746],{"id":745},"mm-config-binding",[149,747,748],{},"mm config binding",[152,750,753],{"className":751,"code":752,"language":157,"meta":158},[155],"Review typed environment bindings\n\nUsage: binding \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,754,752],{"__ignoreMap":158},[200,756,758],{"id":757},"mm-config-binding-add",[149,759,760],{},"mm config binding add",[152,762,764],{"className":763,"code":521,"language":157,"meta":158},[155],[149,765,521],{"__ignoreMap":158},[200,767,769],{"id":768},"mm-config-binding-edit",[149,770,771],{},"mm config binding edit",[152,773,775],{"className":774,"code":533,"language":157,"meta":158},[155],[149,776,533],{"__ignoreMap":158},[200,778,780],{"id":779},"mm-config-binding-remove",[149,781,782],{},"mm config binding remove",[152,784,786],{"className":785,"code":545,"language":157,"meta":158},[155],[149,787,545],{"__ignoreMap":158},[187,789,791],{"id":790},"mm-config-secret",[149,792,793],{},"mm config secret",[152,795,798],{"className":796,"code":797,"language":157,"meta":158},[155],"Review secret declarations and references, never material\n\nUsage: secret \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,799,797],{"__ignoreMap":158},[200,801,803],{"id":802},"mm-config-secret-add",[149,804,805],{},"mm config secret add",[152,807,809],{"className":808,"code":521,"language":157,"meta":158},[155],[149,810,521],{"__ignoreMap":158},[200,812,814],{"id":813},"mm-config-secret-edit",[149,815,816],{},"mm config secret edit",[152,818,820],{"className":819,"code":533,"language":157,"meta":158},[155],[149,821,533],{"__ignoreMap":158},[200,823,825],{"id":824},"mm-config-secret-remove",[149,826,827],{},"mm config secret remove",[152,829,831],{"className":830,"code":545,"language":157,"meta":158},[155],[149,832,545],{"__ignoreMap":158},[187,834,836],{"id":835},"mm-config-ingress",[149,837,838],{},"mm config ingress",[152,840,843],{"className":841,"code":842,"language":157,"meta":158},[155],"Review ingress declarations or inspect compiled routes\n\nUsage: ingress \u003CCOMMAND>\n\nCommands:\n  add      Plan adding an ingress declaration\n  edit     Plan replacing an ingress declaration\n  remove   Plan removing an ingress declaration\n  list     List every service URL or the reason it was not routed\n  explain  Explain ingress selection for one service name\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,844,842],{"__ignoreMap":158},[200,846,848],{"id":847},"mm-config-ingress-add",[149,849,850],{},"mm config ingress add",[152,852,855],{"className":853,"code":854,"language":157,"meta":158},[155],"Plan adding an ingress declaration\n\nUsage: add [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,856,854],{"__ignoreMap":158},[200,858,860],{"id":859},"mm-config-ingress-edit",[149,861,862],{},"mm config ingress edit",[152,864,867],{"className":865,"code":866,"language":157,"meta":158},[155],"Plan replacing an ingress declaration\n\nUsage: edit [OPTIONS] --definition \u003CDOCUMENT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --definition \u003CDOCUMENT>\n          Public JSON or YAML definition. Secret plaintext is rejected\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review with identical arguments\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,868,866],{"__ignoreMap":158},[200,870,872],{"id":871},"mm-config-ingress-remove",[149,873,874],{},"mm config ingress remove",[152,876,879],{"className":877,"code":878,"language":157,"meta":158},[155],"Plan removing an ingress declaration\n\nUsage: remove [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Portable resource name\n\nOptions:\n      --parent \u003CNAME>\n          Owning module, stack, or environment when the resource is nested\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier removal review\n\n      --yes\n          Apply the exact reviewed removal; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,880,878],{"__ignoreMap":158},[200,882,884],{"id":883},"mm-config-ingress-list",[149,885,886],{},"mm config ingress list",[152,888,891],{"className":889,"code":890,"language":157,"meta":158},[155],"List every service URL or the reason it was not routed\n\nUsage: list\n\nOptions:\n  -h, --help\n          Print help\n",[149,892,890],{"__ignoreMap":158},[200,894,896],{"id":895},"mm-config-ingress-explain",[149,897,898],{},"mm config ingress explain",[152,900,903],{"className":901,"code":902,"language":157,"meta":158},[155],"Explain ingress selection for one service name\n\nUsage: explain \u003CSERVICE>\n\nArguments:\n  \u003CSERVICE>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,904,902],{"__ignoreMap":158},[187,906,908],{"id":907},"mm-config-mount",[149,909,910],{},"mm config mount",[152,912,915],{"className":913,"code":914,"language":157,"meta":158},[155],"Review typed development mount declarations\n\nUsage: mount \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,916,914],{"__ignoreMap":158},[200,918,920],{"id":919},"mm-config-mount-add",[149,921,922],{},"mm config mount add",[152,924,926],{"className":925,"code":521,"language":157,"meta":158},[155],[149,927,521],{"__ignoreMap":158},[200,929,931],{"id":930},"mm-config-mount-edit",[149,932,933],{},"mm config mount edit",[152,935,937],{"className":936,"code":533,"language":157,"meta":158},[155],[149,938,533],{"__ignoreMap":158},[200,940,942],{"id":941},"mm-config-mount-remove",[149,943,944],{},"mm config mount remove",[152,946,948],{"className":947,"code":545,"language":157,"meta":158},[155],[149,949,545],{"__ignoreMap":158},[187,951,953],{"id":952},"mm-config-job",[149,954,955],{},"mm config job",[152,957,960],{"className":958,"code":959,"language":157,"meta":158},[155],"Review typed finite-job declarations\n\nUsage: job \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,961,959],{"__ignoreMap":158},[200,963,965],{"id":964},"mm-config-job-add",[149,966,967],{},"mm config job add",[152,969,971],{"className":970,"code":521,"language":157,"meta":158},[155],[149,972,521],{"__ignoreMap":158},[200,974,976],{"id":975},"mm-config-job-edit",[149,977,978],{},"mm config job edit",[152,980,982],{"className":981,"code":533,"language":157,"meta":158},[155],[149,983,533],{"__ignoreMap":158},[200,985,987],{"id":986},"mm-config-job-remove",[149,988,989],{},"mm config job remove",[152,991,993],{"className":992,"code":545,"language":157,"meta":158},[155],[149,994,545],{"__ignoreMap":158},[187,996,998],{"id":997},"mm-config-schedule",[149,999,1000],{},"mm config schedule",[152,1002,1005],{"className":1003,"code":1004,"language":157,"meta":158},[155],"Review typed schedule declarations\n\nUsage: schedule \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1006,1004],{"__ignoreMap":158},[200,1008,1010],{"id":1009},"mm-config-schedule-add",[149,1011,1012],{},"mm config schedule add",[152,1014,1016],{"className":1015,"code":521,"language":157,"meta":158},[155],[149,1017,521],{"__ignoreMap":158},[200,1019,1021],{"id":1020},"mm-config-schedule-edit",[149,1022,1023],{},"mm config schedule edit",[152,1025,1027],{"className":1026,"code":533,"language":157,"meta":158},[155],[149,1028,533],{"__ignoreMap":158},[200,1030,1032],{"id":1031},"mm-config-schedule-remove",[149,1033,1034],{},"mm config schedule remove",[152,1036,1038],{"className":1037,"code":545,"language":157,"meta":158},[155],[149,1039,545],{"__ignoreMap":158},[187,1041,1043],{"id":1042},"mm-config-access",[149,1044,1045],{},"mm config access",[152,1047,1050],{"className":1048,"code":1049,"language":157,"meta":158},[155],"Review typed application-access declarations\n\nUsage: access \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1051,1049],{"__ignoreMap":158},[200,1053,1055],{"id":1054},"mm-config-access-add",[149,1056,1057],{},"mm config access add",[152,1059,1061],{"className":1060,"code":521,"language":157,"meta":158},[155],[149,1062,521],{"__ignoreMap":158},[200,1064,1066],{"id":1065},"mm-config-access-edit",[149,1067,1068],{},"mm config access edit",[152,1070,1072],{"className":1071,"code":533,"language":157,"meta":158},[155],[149,1073,533],{"__ignoreMap":158},[200,1075,1077],{"id":1076},"mm-config-access-remove",[149,1078,1079],{},"mm config access remove",[152,1081,1083],{"className":1082,"code":545,"language":157,"meta":158},[155],[149,1084,545],{"__ignoreMap":158},[187,1086,1088],{"id":1087},"mm-config-user",[149,1089,1090],{},"mm config user",[152,1092,1095],{"className":1093,"code":1094,"language":157,"meta":158},[155],"Review who may reach remote environments (the users: key)\n\nUsage: user \u003CCOMMAND>\n\nCommands:\n  add     Plan adding a new named resource; apply only with --plan and --yes\n  edit    Plan replacing one named resource definition; apply only with --plan and --yes\n  remove  Plan removing one named resource; apply only with --plan and --yes\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1096,1094],{"__ignoreMap":158},[200,1098,1100],{"id":1099},"mm-config-user-add",[149,1101,1102],{},"mm config user add",[152,1104,1106],{"className":1105,"code":521,"language":157,"meta":158},[155],[149,1107,521],{"__ignoreMap":158},[200,1109,1111],{"id":1110},"mm-config-user-edit",[149,1112,1113],{},"mm config user edit",[152,1115,1117],{"className":1116,"code":533,"language":157,"meta":158},[155],[149,1118,533],{"__ignoreMap":158},[200,1120,1122],{"id":1121},"mm-config-user-remove",[149,1123,1124],{},"mm config user remove",[152,1126,1128],{"className":1127,"code":545,"language":157,"meta":158},[155],[149,1129,545],{"__ignoreMap":158},[187,1131,1133],{"id":1132},"mm-config-schema",[149,1134,1135],{},"mm config schema",[152,1137,1140],{"className":1138,"code":1139,"language":157,"meta":158},[155],"Print the generated JSON Schema for .config\u002Fmm.yaml, or for one split file's value\n\nUsage: schema [KEY]\n\nArguments:\n  [KEY]\n          Top-level key whose split-file schema to print, for .config\u002Fmm\u002FKEY.yaml\n\n          [possible values: project, default-environment, target, runtime, build, networks, stacks, modules, providers, secrets, bindings, environment-delivery, environments, ingress, development-mounts, development-mail, jobs, schedules, gates, users, agents, targets, registries]\n\nOptions:\n  -h, --help\n          Print help\n",[149,1141,1139],{"__ignoreMap":158},[187,1143,1145],{"id":1144},"mm-config-split",[149,1146,1147],{},"mm config split",[152,1149,1152],{"className":1150,"code":1151,"language":157,"meta":158},[155],"Plan moving a top-level key into its own .config\u002Fmm\u002FKEY.yaml; apply only with --plan and --yes\n\nUsage: split [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n          Top-level configuration key, such as stacks or environments\n\n          [possible values: project, default-environment, target, runtime, build, networks, stacks, modules, providers, secrets, bindings, environment-delivery, environments, ingress, development-mounts, development-mail, jobs, schedules, gates, users, agents, targets, registries]\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same move\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,1153,1151],{"__ignoreMap":158},[187,1155,1157],{"id":1156},"mm-config-join",[149,1158,1159],{},"mm config join",[152,1161,1164],{"className":1162,"code":1163,"language":157,"meta":158},[155],"Plan moving a split key back into .config\u002Fmm.yaml; apply only with --plan and --yes\n\nUsage: join [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n          Top-level configuration key, such as stacks or environments\n\n          [possible values: project, default-environment, target, runtime, build, networks, stacks, modules, providers, secrets, bindings, environment-delivery, environments, ingress, development-mounts, development-mail, jobs, schedules, gates, users, agents, targets, registries]\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same move\n\n      --yes\n          Apply the exact reviewed plan; never bypasses stale-file checks\n\n  -h, --help\n          Print help\n",[149,1165,1163],{"__ignoreMap":158},[187,1167,1169],{"id":1168},"mm-config-sources",[149,1170,1171],{},"mm config sources",[152,1173,1176],{"className":1174,"code":1175,"language":157,"meta":158},[155],"Show which file declares each top-level key\n\nUsage: sources\n\nOptions:\n  -h, --help\n          Print help\n",[149,1177,1175],{"__ignoreMap":158},[162,1179,1181],{"id":1180},"mm-doctor",[149,1182,1183],{},"mm doctor",[152,1185,1188],{"className":1186,"code":1187,"language":157,"meta":158},[155],"Check configuration health and resolved runtime capabilities\n\nUsage: doctor [OPTIONS] [COMMAND]\n\nCommands:\n  recover-state  Review recovery of pre-baseline state; apply requires the reviewed hash and --yes\n  help           Print this message or the help of the given subcommand(s)\n\nOptions:\n      --check-updates\n          Fetch the stable release manifest and compare the installed version\n\n  -h, --help\n          Print help\n\nExamples:\n  mm doctor --output json\n  mm doctor recover-state\n\nInspection is read-only. State recovery applies only with an exact reviewed hash and --yes. Exit codes: 0 healthy; 1 state\u002FI\u002FO failure; 2 invalid configuration; 3 unavailable runtime or capability.\n",[149,1189,1187],{"__ignoreMap":158},[187,1191,1193],{"id":1192},"mm-doctor-recover-state",[149,1194,1195],{},"mm doctor recover-state",[152,1197,1200],{"className":1198,"code":1199,"language":157,"meta":158},[155],"Review recovery of pre-baseline state; apply requires the reviewed hash and --yes\n\nUsage: recover-state [OPTIONS]\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash from the recovery review\n\n      --yes\n          Confirm backup and replacement of the reviewed legacy state\n\n  -h, --help\n          Print help\n",[149,1201,1199],{"__ignoreMap":158},[162,1203,1205],{"id":1204},"mm-ingress",[149,1206,1207],{},"mm ingress",[152,1209,1212],{"className":1210,"code":1211,"language":157,"meta":158},[155],"Start or stop this workstation's global public HTTP\u002FHTTPS forwarding\n\nUsage: ingress \u003CCOMMAND>\n\nCommands:\n  start    Ensure ingress is installed and healthy, then start public forwarding on ports 80 and 443\n  stop     Stop global public forwarding to free ports 80 and 443; keep project containers running\n  status   Show public forwarding state and the health of the services it depends on (read-only)\n  restart  Reconcile ingress prerequisites, then restart public forwarding on ports 80 and 443\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n\nExamples:\n  mm ingress stop\n  mm ingress start\n\nGlobal to this workstation; no project is required. Start ensures the required host helper, TLS, and shared ingress are installed, offering reviewed installation or repair when necessary. Stop only stops public forwarding. Interactive use requests sudo authorization when needed; JSON\u002Fnoninteractive installation requires --yes and never prompts. DNS is configured by install.sh workstation setup.\n",[149,1213,1211],{"__ignoreMap":158},[187,1215,1217],{"id":1216},"mm-ingress-start",[149,1218,1219],{},"mm ingress start",[152,1221,1224],{"className":1222,"code":1223,"language":157,"meta":158},[155],"Ensure ingress is installed and healthy, then start public forwarding on ports 80 and 443\n\nUsage: start [OPTIONS]\n\nOptions:\n      --yes\n          Approve required installation or repair plans without prompting\n\n  -h, --help\n          Print help\n",[149,1225,1223],{"__ignoreMap":158},[187,1227,1229],{"id":1228},"mm-ingress-stop",[149,1230,1231],{},"mm ingress stop",[152,1233,1236],{"className":1234,"code":1235,"language":157,"meta":158},[155],"Stop global public forwarding to free ports 80 and 443; keep project containers running\n\nUsage: stop\n\nOptions:\n  -h, --help\n          Print help\n",[149,1237,1235],{"__ignoreMap":158},[187,1239,1241],{"id":1240},"mm-ingress-status",[149,1242,1243],{},"mm ingress status",[152,1245,1248],{"className":1246,"code":1247,"language":157,"meta":158},[155],"Show public forwarding state and the health of the services it depends on (read-only)\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,1249,1247],{"__ignoreMap":158},[187,1251,1253],{"id":1252},"mm-ingress-restart",[149,1254,1255],{},"mm ingress restart",[152,1257,1260],{"className":1258,"code":1259,"language":157,"meta":158},[155],"Reconcile ingress prerequisites, then restart public forwarding on ports 80 and 443\n\nUsage: restart [OPTIONS]\n\nOptions:\n      --yes\n          Approve required installation or repair plans without prompting\n\n  -h, --help\n          Print help\n",[149,1261,1259],{"__ignoreMap":158},[162,1263,1265],{"id":1264},"mm-service",[149,1266,1267],{},"mm service",[152,1269,1272],{"className":1270,"code":1271,"language":157,"meta":158},[155],"Inspect and operate deployed services\n\nUsage: service \u003CCOMMAND>\n\nCommands:\n  status   Show desired and observed state, optionally for one service\n  logs     Stream bounded, redacted service logs\n  exec     Execute an exact argv vector; no shell is implied\n  shell    Open an explicitly approved high-risk shell\n  restart  Restart one service through runtime policy\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1273,1271],{"__ignoreMap":158},[187,1275,1277],{"id":1276},"mm-service-status",[149,1278,1279],{},"mm service status",[152,1281,1284],{"className":1282,"code":1283,"language":157,"meta":158},[155],"Show desired and observed state, optionally for one service\n\nUsage: status [SERVICE]\n\nArguments:\n  [SERVICE]\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1285,1283],{"__ignoreMap":158},[187,1287,1289],{"id":1288},"mm-service-logs",[149,1290,1291],{},"mm service logs",[152,1293,1296],{"className":1294,"code":1295,"language":157,"meta":158},[155],"Stream bounded, redacted service logs\n\nUsage: logs [OPTIONS] \u003CSERVICE>\n\nArguments:\n  \u003CSERVICE>\n          Service whose container output should be streamed\n\nOptions:\n      --stack \u003CSTACK>\n          Restrict the service to one configured stack\n\n      --follow\n          Continue streaming new records until interrupted\n\n      --tail \u003CCOUNT>\n          Number of recent records requested before following\n\n          [default: 100]\n\n      --since \u003CUNIX_MS>\n          Include records at or after this Unix millisecond timestamp\n\n      --until \u003CUNIX_MS>\n          Include records before this Unix millisecond timestamp\n\n      --timestamps\n          Preserve provider timestamps in rendered output\n\n      --stdout\n          Include only standard output records\n\n      --stderr\n          Include only standard error records\n\n      --max-line-bytes \u003CMAX_LINE_BYTES>\n          Maximum bytes retained from any one log line\n\n          [default: 65536]\n\n      --max-bytes-per-second \u003CMAX_BYTES_PER_SECOND>\n          Maximum aggregate log bytes accepted per second\n\n          [default: 1048576]\n\n      --max-lines-per-second \u003CMAX_LINES_PER_SECOND>\n          Maximum aggregate log records accepted per second\n\n          [default: 10000]\n\n      --raw\n          Disable redaction. Requires --approve-high-risk\n\n      --approve-high-risk\n          Confirm that raw application logs can disclose arbitrary secret values\n\n  -h, --help\n          Print help\n",[149,1297,1295],{"__ignoreMap":158},[187,1299,1301],{"id":1300},"mm-service-exec",[149,1302,1303],{},"mm service exec",[152,1305,1308],{"className":1306,"code":1307,"language":157,"meta":158},[155],"Execute an exact argv vector; no shell is implied\n\nUsage: exec [OPTIONS] \u003CSERVICE> -- \u003CCOMMAND>...\n\nArguments:\n  \u003CSERVICE>\n          Service containing the command target\n\n  \u003CCOMMAND>...\n          Exact executable and argument vector; no shell is implied\n\nOptions:\n      --stack \u003CSTACK>\n          Restrict the service to one configured stack\n\n      --container \u003CCONTAINER>\n          Select one exact container when the service has multiple replicas\n\n      --user \u003CUSER>\n          User or numeric identity used inside the container\n\n      --workdir \u003CPATH>\n          Working directory used inside the container\n\n      --env \u003CNAME=REFERENCE>\n          Set NAME from a secret reference (NAME=provider:\u002F\u002Flocation); plaintext is rejected\n\n      --tty\n          Allocate an interactive terminal; output capture is disabled\n\n      --stdin\n          Forward standard input to the remote command\n\n      --timeout \u003CSECONDS>\n          Maximum command runtime before cancellation\n\n          [default: 30]\n\n  -h, --help\n          Print help\n",[149,1309,1307],{"__ignoreMap":158},[187,1311,1313],{"id":1312},"mm-service-shell",[149,1314,1315],{},"mm service shell",[152,1317,1320],{"className":1318,"code":1319,"language":157,"meta":158},[155],"Open an explicitly approved high-risk shell\n\nUsage: shell [OPTIONS] --approve-high-risk \u003CSERVICE>\n\nArguments:\n  \u003CSERVICE>\n          Service in which to start the interactive shell\n\nOptions:\n      --stack \u003CSTACK>\n          Restrict the service to one configured stack\n\n      --container \u003CCONTAINER>\n          Select one exact container when the service has multiple replicas\n\n      --user \u003CUSER>\n          User or numeric identity used inside the container\n\n      --workdir \u003CPATH>\n          Working directory used inside the container\n\n      --approve-high-risk\n          Confirm the shell's high-risk, authorization-gated behavior\n\n  -h, --help\n          Print help\n",[149,1321,1319],{"__ignoreMap":158},[187,1323,1325],{"id":1324},"mm-service-restart",[149,1326,1327],{},"mm service restart",[152,1329,1332],{"className":1330,"code":1331,"language":157,"meta":158},[155],"Restart one service through runtime policy\n\nUsage: restart \u003CSERVICE>\n\nArguments:\n  \u003CSERVICE>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1333,1331],{"__ignoreMap":158},[162,1335,1337],{"id":1336},"mm-job",[149,1338,1339],{},"mm job",[152,1341,1344],{"className":1342,"code":1343,"language":157,"meta":158},[155],"Run finite jobs and operate their schedules\n\nUsage: job \u003CCOMMAND>\n\nCommands:\n  run       Enqueue a named job and wait for its durable terminal status\n  status    Show one durable run by UUID\n  history   List bounded run history, optionally for one job\n  cancel    Request cancellation of a queued or active run\n  retry     Enqueue a new run from the current definition of a terminal run\n  schedule  Operate schedules for configured jobs\n  help      Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1345,1343],{"__ignoreMap":158},[187,1347,1349],{"id":1348},"mm-job-run",[149,1350,1351],{},"mm job run",[152,1353,1356],{"className":1354,"code":1355,"language":157,"meta":158},[155],"Enqueue a named job and wait for its durable terminal status\n\nUsage: run [OPTIONS] \u003CJOB>\n\nArguments:\n  \u003CJOB>\n\n\nOptions:\n      --no-wait\n          Return after durable enqueue instead of driving execution\n\n  -h, --help\n          Print help\n",[149,1357,1355],{"__ignoreMap":158},[187,1359,1361],{"id":1360},"mm-job-status",[149,1362,1363],{},"mm job status",[152,1365,1368],{"className":1366,"code":1367,"language":157,"meta":158},[155],"Show one durable run by UUID\n\nUsage: status \u003CRUN_ID>\n\nArguments:\n  \u003CRUN_ID>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1369,1367],{"__ignoreMap":158},[187,1371,1373],{"id":1372},"mm-job-history",[149,1374,1375],{},"mm job history",[152,1377,1380],{"className":1378,"code":1379,"language":157,"meta":158},[155],"List bounded run history, optionally for one job\n\nUsage: history [OPTIONS] [JOB]\n\nArguments:\n  [JOB]\n\n\nOptions:\n      --limit \u003CLIMIT>\n          Maximum number of newest runs to return\n\n          [default: 100]\n\n  -h, --help\n          Print help\n",[149,1381,1379],{"__ignoreMap":158},[187,1383,1385],{"id":1384},"mm-job-cancel",[149,1386,1387],{},"mm job cancel",[152,1389,1392],{"className":1390,"code":1391,"language":157,"meta":158},[155],"Request cancellation of a queued or active run\n\nUsage: cancel \u003CRUN_ID>\n\nArguments:\n  \u003CRUN_ID>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1393,1391],{"__ignoreMap":158},[187,1395,1397],{"id":1396},"mm-job-retry",[149,1398,1399],{},"mm job retry",[152,1401,1404],{"className":1402,"code":1403,"language":157,"meta":158},[155],"Enqueue a new run from the current definition of a terminal run\n\nUsage: retry [OPTIONS] \u003CRUN_ID>\n\nArguments:\n  \u003CRUN_ID>\n\n\nOptions:\n      --no-wait\n          Return after durable enqueue instead of driving execution\n\n  -h, --help\n          Print help\n",[149,1405,1403],{"__ignoreMap":158},[187,1407,1409],{"id":1408},"mm-job-schedule",[149,1410,1411],{},"mm job schedule",[152,1413,1416],{"className":1414,"code":1415,"language":157,"meta":158},[155],"Operate schedules for configured jobs\n\nUsage: schedule \u003CCOMMAND>\n\nCommands:\n  reconcile  Plan or apply transactional definition reconciliation\n  list       List schedules and their durable next due time\n  show       Show one schedule\n  enable     Enable one reconciled schedule\n  disable    Disable one reconciled schedule without deleting history\n  run-now    Enqueue the schedule's job immediately, independent of enabled state\n  next       Show the durable next due time for one schedule\n  history    List bounded history for one schedule\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1417,1415],{"__ignoreMap":158},[200,1419,1421],{"id":1420},"mm-job-schedule-reconcile",[149,1422,1423],{},"mm job schedule reconcile",[152,1425,1428],{"className":1426,"code":1427,"language":157,"meta":158},[155],"Plan or apply transactional definition reconciliation\n\nUsage: reconcile [OPTIONS]\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the schedule reconciliation review\n\n      --yes\n          Apply the reviewed reconciliation plan\n\n  -h, --help\n          Print help\n",[149,1429,1427],{"__ignoreMap":158},[200,1431,1433],{"id":1432},"mm-job-schedule-list",[149,1434,1435],{},"mm job schedule list",[152,1437,1440],{"className":1438,"code":1439,"language":157,"meta":158},[155],"List schedules and their durable next due time\n\nUsage: list\n\nOptions:\n  -h, --help\n          Print help\n",[149,1441,1439],{"__ignoreMap":158},[200,1443,1445],{"id":1444},"mm-job-schedule-show",[149,1446,1447],{},"mm job schedule show",[152,1449,1452],{"className":1450,"code":1451,"language":157,"meta":158},[155],"Show one schedule\n\nUsage: show \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1453,1451],{"__ignoreMap":158},[200,1455,1457],{"id":1456},"mm-job-schedule-enable",[149,1458,1459],{},"mm job schedule enable",[152,1461,1464],{"className":1462,"code":1463,"language":157,"meta":158},[155],"Enable one reconciled schedule\n\nUsage: enable \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1465,1463],{"__ignoreMap":158},[200,1467,1469],{"id":1468},"mm-job-schedule-disable",[149,1470,1471],{},"mm job schedule disable",[152,1473,1476],{"className":1474,"code":1475,"language":157,"meta":158},[155],"Disable one reconciled schedule without deleting history\n\nUsage: disable \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1477,1475],{"__ignoreMap":158},[200,1479,1481],{"id":1480},"mm-job-schedule-run-now",[149,1482,1483],{},"mm job schedule run-now",[152,1485,1488],{"className":1486,"code":1487,"language":157,"meta":158},[155],"Enqueue the schedule's job immediately, independent of enabled state\n\nUsage: run-now [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --no-wait\n          Return after durable enqueue instead of driving execution\n\n  -h, --help\n          Print help\n",[149,1489,1487],{"__ignoreMap":158},[200,1491,1493],{"id":1492},"mm-job-schedule-next",[149,1494,1495],{},"mm job schedule next",[152,1497,1500],{"className":1498,"code":1499,"language":157,"meta":158},[155],"Show the durable next due time for one schedule\n\nUsage: next \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1501,1499],{"__ignoreMap":158},[200,1503,1505],{"id":1504},"mm-job-schedule-history",[149,1506,1507],{},"mm job schedule history",[152,1509,1512],{"className":1510,"code":1511,"language":157,"meta":158},[155],"List bounded history for one schedule\n\nUsage: history [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --limit \u003CLIMIT>\n          Maximum number of newest runs to return\n\n          [default: 100]\n\n  -h, --help\n          Print help\n",[149,1513,1511],{"__ignoreMap":158},[162,1515,1517],{"id":1516},"mm-env",[149,1518,1519],{},"mm env",[152,1521,1524],{"className":1522,"code":1523,"language":157,"meta":158},[155],"Inspect and deliver non-secret environment values\n\nUsage: env \u003CCOMMAND>\n\nCommands:\n  status       Show effective values, provenance, and secret status\n  explain      Explain every use of one global key or local variable\n  set          Set a workspace-local non-secret override\n  unset        Remove a workspace-local override\n  default      Get or change the project-wide default environment\n  check        Resolve and compile every service environment in memory\n  materialize  Explicitly write a module's conventional .env file\n  diff         Compare a module's .env with the effective compiled environment\n  review       Explain source and delivery without revealing secret values\n  setup        Show missing bindings and the resolved delivery mode\n  delivery     Show or persist environment delivery mode\n  help         Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1525,1523],{"__ignoreMap":158},[187,1527,1529],{"id":1528},"mm-env-status",[149,1530,1531],{},"mm env status",[152,1533,1536],{"className":1534,"code":1535,"language":157,"meta":158},[155],"Show effective values, provenance, and secret status\n\nUsage: status [OPTIONS]\n\nOptions:\n      --no-check-secrets\n          Do not contact secret providers\n\n  -h, --help\n          Print help\n",[149,1537,1535],{"__ignoreMap":158},[187,1539,1541],{"id":1540},"mm-env-explain",[149,1542,1543],{},"mm env explain",[152,1545,1548],{"className":1546,"code":1547,"language":157,"meta":158},[155],"Explain every use of one global key or local variable\n\nUsage: explain [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n\n\nOptions:\n      --no-check-secrets\n          Do not contact secret providers\n\n  -h, --help\n          Print help\n",[149,1549,1547],{"__ignoreMap":158},[187,1551,1553],{"id":1552},"mm-env-set",[149,1554,1555],{},"mm env set",[152,1557,1560],{"className":1558,"code":1559,"language":157,"meta":158},[155],"Set a workspace-local non-secret override\n\nUsage: set [OPTIONS] \u003CKEY> [VALUE]\n\nArguments:\n  \u003CKEY>\n\n\n  [VALUE]\n\n\nOptions:\n      --stdin\n          Read the value from stdin instead of an argument\n\n      --expected-revision \u003CEXPECTED_REVISION>\n          Fail if the existing override has another revision\n\n  -h, --help\n          Print help\n",[149,1561,1559],{"__ignoreMap":158},[187,1563,1565],{"id":1564},"mm-env-unset",[149,1566,1567],{},"mm env unset",[152,1569,1572],{"className":1570,"code":1571,"language":157,"meta":158},[155],"Remove a workspace-local override\n\nUsage: unset \u003CKEY>\n\nArguments:\n  \u003CKEY>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1573,1571],{"__ignoreMap":158},[187,1575,1577],{"id":1576},"mm-env-default",[149,1578,1579],{},"mm env default",[152,1581,1584],{"className":1582,"code":1583,"language":157,"meta":158},[155],"Get or change the project-wide default environment\n\nUsage: default \u003CCOMMAND>\n\nCommands:\n  show   Print the configured project default environment\n  set    Persist a new project default environment\n  unset  Remove the project default environment\n  help   Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1585,1583],{"__ignoreMap":158},[200,1587,1589],{"id":1588},"mm-env-default-show",[149,1590,1591],{},"mm env default show",[152,1593,1596],{"className":1594,"code":1595,"language":157,"meta":158},[155],"Print the configured project default environment\n\nUsage: show\n\nOptions:\n  -h, --help\n          Print help\n",[149,1597,1595],{"__ignoreMap":158},[200,1599,1601],{"id":1600},"mm-env-default-set",[149,1602,1603],{},"mm env default set",[152,1605,1608],{"className":1606,"code":1607,"language":157,"meta":158},[155],"Persist a new project default environment\n\nUsage: set \u003CENVIRONMENT>\n\nArguments:\n  \u003CENVIRONMENT>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1609,1607],{"__ignoreMap":158},[200,1611,1613],{"id":1612},"mm-env-default-unset",[149,1614,1615],{},"mm env default unset",[152,1617,1620],{"className":1618,"code":1619,"language":157,"meta":158},[155],"Remove the project default environment\n\nUsage: unset\n\nOptions:\n  -h, --help\n          Print help\n",[149,1621,1619],{"__ignoreMap":158},[187,1623,1625],{"id":1624},"mm-env-check",[149,1626,1627],{},"mm env check",[152,1629,1632],{"className":1630,"code":1631,"language":157,"meta":158},[155],"Resolve and compile every service environment in memory\n\nUsage: check\n\nOptions:\n  -h, --help\n          Print help\n",[149,1633,1631],{"__ignoreMap":158},[187,1635,1637],{"id":1636},"mm-env-materialize",[149,1638,1639],{},"mm env materialize",[152,1641,1644],{"className":1642,"code":1643,"language":157,"meta":158},[155],"Explicitly write a module's conventional .env file\n\nUsage: materialize [OPTIONS] \u003CMODULE>\n\nArguments:\n  \u003CMODULE>\n\n\nOptions:\n      --service \u003CSERVICE>\n          Limit materialization to one service in the module\n\n      --force\n          Overwrite an existing .env file\n\n  -h, --help\n          Print help\n",[149,1645,1643],{"__ignoreMap":158},[187,1647,1649],{"id":1648},"mm-env-diff",[149,1650,1651],{},"mm env diff",[152,1653,1656],{"className":1654,"code":1655,"language":157,"meta":158},[155],"Compare a module's .env with the effective compiled environment\n\nUsage: diff [OPTIONS] \u003CMODULE>\n\nArguments:\n  \u003CMODULE>\n\n\nOptions:\n      --service \u003CSERVICE>\n          Limit the diff to one service in the module\n\n  -h, --help\n          Print help\n",[149,1657,1655],{"__ignoreMap":158},[187,1659,1661],{"id":1660},"mm-env-review",[149,1662,1663],{},"mm env review",[152,1665,1668],{"className":1666,"code":1667,"language":157,"meta":158},[155],"Explain source and delivery without revealing secret values\n\nUsage: review\n\nOptions:\n  -h, --help\n          Print help\n",[149,1669,1667],{"__ignoreMap":158},[187,1671,1673],{"id":1672},"mm-env-setup",[149,1674,1675],{},"mm env setup",[152,1677,1680],{"className":1678,"code":1679,"language":157,"meta":158},[155],"Show missing bindings and the resolved delivery mode\n\nUsage: setup\n\nOptions:\n  -h, --help\n          Print help\n",[149,1681,1679],{"__ignoreMap":158},[187,1683,1685],{"id":1684},"mm-env-delivery",[149,1686,1687],{},"mm env delivery",[152,1689,1692],{"className":1690,"code":1691,"language":157,"meta":158},[155],"Show or persist environment delivery mode\n\nUsage: delivery \u003CCOMMAND>\n\nCommands:\n  show  Show the resolved delivery mode and provenance\n  set   Persist an explicit delivery mode for one environment\n  help  Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1693,1691],{"__ignoreMap":158},[200,1695,1697],{"id":1696},"mm-env-delivery-show",[149,1698,1699],{},"mm env delivery show",[152,1701,1704],{"className":1702,"code":1703,"language":157,"meta":158},[155],"Show the resolved delivery mode and provenance\n\nUsage: show\n\nOptions:\n  -h, --help\n          Print help\n",[149,1705,1703],{"__ignoreMap":158},[200,1707,1709],{"id":1708},"mm-env-delivery-set",[149,1710,1711],{},"mm env delivery set",[152,1713,1716],{"className":1714,"code":1715,"language":157,"meta":158},[155],"Persist an explicit delivery mode for one environment\n\nUsage: set \u003CENVIRONMENT> \u003CMODE>\n\nArguments:\n  \u003CENVIRONMENT>\n\n\n  \u003CMODE>\n          [possible values: direct, env-file]\n\nOptions:\n  -h, --help\n          Print help\n",[149,1717,1715],{"__ignoreMap":158},[162,1719,1721],{"id":1720},"mm-secret",[149,1722,1723],{},"mm secret",[152,1725,1728],{"className":1726,"code":1727,"language":157,"meta":158},[155],"Manage secret values, rotation, and provider instances\n\nUsage: secret \u003CCOMMAND>\n\nCommands:\n  providers  List available provider capabilities\n  init       Initialize a secret provider for this project\n  status     Show secret set\u002Funset state without revealing values\n  set        Set a configured secret using a hidden prompt or stdin\n  unset      Remove a configured secret\n  generate   Create configured generated secrets without overwriting existing values\n  rotate     Explicitly replace one secret using its configured source\n  rotation   Plan or apply scheduled rotations\n  provider   Manage OpenBao and Vault provider instances\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1729,1727],{"__ignoreMap":158},[187,1731,1733],{"id":1732},"mm-secret-providers",[149,1734,1735],{},"mm secret providers",[152,1737,1740],{"className":1738,"code":1739,"language":157,"meta":158},[155],"List available provider capabilities\n\nUsage: providers\n\nOptions:\n  -h, --help\n          Print help\n",[149,1741,1739],{"__ignoreMap":158},[187,1743,1745],{"id":1744},"mm-secret-init",[149,1746,1747],{},"mm secret init",[152,1749,1752],{"className":1750,"code":1751,"language":157,"meta":158},[155],"Initialize a secret provider for this project\n\nUsage: init \u003CPROVIDER>\n\nArguments:\n  \u003CPROVIDER>\n          [possible values: age]\n\nOptions:\n  -h, --help\n          Print help\n",[149,1753,1751],{"__ignoreMap":158},[187,1755,1757],{"id":1756},"mm-secret-status",[149,1758,1759],{},"mm secret status",[152,1761,1764],{"className":1762,"code":1763,"language":157,"meta":158},[155],"Show secret set\u002Funset state without revealing values\n\nUsage: status [KEY]\n\nArguments:\n  [KEY]\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,1765,1763],{"__ignoreMap":158},[187,1767,1769],{"id":1768},"mm-secret-set",[149,1770,1771],{},"mm secret set",[152,1773,1776],{"className":1774,"code":1775,"language":157,"meta":158},[155],"Set a configured secret using a hidden prompt or stdin\n\nUsage: set [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n\n\nOptions:\n      --stdin\n          Read exactly one value from stdin without prompting\n\n  -h, --help\n          Print help\n",[149,1777,1775],{"__ignoreMap":158},[187,1779,1781],{"id":1780},"mm-secret-unset",[149,1782,1783],{},"mm secret unset",[152,1785,1788],{"className":1786,"code":1787,"language":157,"meta":158},[155],"Remove a configured secret\n\nUsage: unset [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n\n\nOptions:\n      --yes\n          Skip the destructive confirmation prompt\n\n  -h, --help\n          Print help\n",[149,1789,1787],{"__ignoreMap":158},[187,1791,1793],{"id":1792},"mm-secret-generate",[149,1794,1795],{},"mm secret generate",[152,1797,1800],{"className":1798,"code":1799,"language":157,"meta":158},[155],"Create configured generated secrets without overwriting existing values\n\nUsage: generate [OPTIONS] [KEY]\n\nArguments:\n  [KEY]\n          Logical secret name to generate\n\nOptions:\n      --missing\n          Generate every configured secret that is currently missing\n\n  -h, --help\n          Print help\n",[149,1801,1799],{"__ignoreMap":158},[187,1803,1805],{"id":1804},"mm-secret-rotate",[149,1806,1807],{},"mm secret rotate",[152,1809,1812],{"className":1810,"code":1811,"language":157,"meta":158},[155],"Explicitly replace one secret using its configured source\n\nUsage: rotate [OPTIONS] \u003CKEY>\n\nArguments:\n  \u003CKEY>\n\n\nOptions:\n      --stdin\n          Read a prompted replacement from stdin\n\n      --yes\n          Apply the exact displayed rotation plan without an interactive confirmation\n\n  -h, --help\n          Print help\n",[149,1813,1811],{"__ignoreMap":158},[187,1815,1817],{"id":1816},"mm-secret-rotation",[149,1818,1819],{},"mm secret rotation",[152,1821,1824],{"className":1822,"code":1823,"language":157,"meta":158},[155],"Plan or apply scheduled rotations\n\nUsage: rotation \u003CCOMMAND>\n\nCommands:\n  plan   Inspect metadata and produce an approval hash without changing secrets\n  apply  Apply the exact reviewed plan using revision-guarded writes\n  help   Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1825,1823],{"__ignoreMap":158},[200,1827,1829],{"id":1828},"mm-secret-rotation-plan",[149,1830,1831],{},"mm secret rotation plan",[152,1833,1836],{"className":1834,"code":1835,"language":157,"meta":158},[155],"Inspect metadata and produce an approval hash without changing secrets\n\nUsage: plan\n\nOptions:\n  -h, --help\n          Print help\n",[149,1837,1835],{"__ignoreMap":158},[200,1839,1841],{"id":1840},"mm-secret-rotation-apply",[149,1842,1843],{},"mm secret rotation apply",[152,1845,1848],{"className":1846,"code":1847,"language":157,"meta":158},[155],"Apply the exact reviewed plan using revision-guarded writes\n\nUsage: apply [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm secret rotation plan`\n\n      --yes\n          Skip the confirmation prompt\n\n  -h, --help\n          Print help\n",[149,1849,1847],{"__ignoreMap":158},[187,1851,1853],{"id":1852},"mm-secret-provider",[149,1854,1855],{},"mm secret provider",[152,1857,1860],{"className":1858,"code":1859,"language":157,"meta":158},[155],"Manage OpenBao and Vault provider instances\n\nUsage: provider \u003CCOMMAND>\n\nCommands:\n  list     List configured provider instances and registered drivers\n  show     Show one provider instance with its typed descriptor and capabilities\n  add      Configure a declared provider instance\n  edit     Reconfigure a declared provider instance without changing its driver or mode\n  test     Test one external provider instance\n  status   Show health and capabilities for one provider instance\n  plan     Produce a deterministic provider lifecycle plan\n  apply    Apply an exact provider lifecycle plan\n  backup   Write an encrypted provider snapshot after exact review\n  restore  Restore an encrypted provider snapshot after exact review\n  remove   Remove a provider through its exact reviewed lifecycle plan\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,1861,1859],{"__ignoreMap":158},[200,1863,1865],{"id":1864},"mm-secret-provider-list",[149,1866,1867],{},"mm secret provider list",[152,1869,1872],{"className":1870,"code":1871,"language":157,"meta":158},[155],"List configured provider instances and registered drivers\n\nUsage: list\n\nOptions:\n  -h, --help\n          Print help\n",[149,1873,1871],{"__ignoreMap":158},[200,1875,1877],{"id":1876},"mm-secret-provider-show",[149,1878,1879],{},"mm secret provider show",[152,1881,1884],{"className":1882,"code":1883,"language":157,"meta":158},[155],"Show one provider instance with its typed descriptor and capabilities\n\nUsage: show \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable provider instance name\n\nOptions:\n  -h, --help\n          Print help\n",[149,1885,1883],{"__ignoreMap":158},[200,1887,1889],{"id":1888},"mm-secret-provider-add",[149,1890,1891],{},"mm secret provider add",[152,1893,1896],{"className":1894,"code":1895,"language":157,"meta":158},[155],"Configure a declared provider instance\n\nUsage: add [OPTIONS] --driver \u003CDRIVER> --mode \u003CMODE> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable provider instance name already declared in mm.yaml\n\nOptions:\n      --driver \u003CDRIVER>\n          Registered provider driver ID\n\n      --mode \u003CMODE>\n          Provider operating mode\n\n          [possible values: managed, external]\n\n      --scope \u003CSCOPE>\n          Provider ownership scope\n\n          [possible values: installation, project]\n\n      --bootstrap\n          Enable missing mounts for an external provider\n\n      --stdin\n          Read an external bootstrap credential from stdin instead of a hidden prompt\n\n      --yes\n          Apply after displaying the exact setup or install plan\n\n  -h, --help\n          Print help\n",[149,1897,1895],{"__ignoreMap":158},[200,1899,1901],{"id":1900},"mm-secret-provider-edit",[149,1902,1903],{},"mm secret provider edit",[152,1905,1908],{"className":1906,"code":1907,"language":157,"meta":158},[155],"Reconfigure a declared provider instance without changing its driver or mode\n\nUsage: edit [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable provider instance name\n\nOptions:\n      --driver \u003CDRIVER>\n          Assert the existing driver; changing it requires replacement\n\n      --mode \u003CMODE>\n          Assert the existing mode; changing it requires replacement\n\n          [possible values: managed, external]\n\n      --bootstrap\n          Enable missing mounts for an external provider\n\n      --stdin\n          Read the bootstrap credential from stdin instead of a hidden prompt\n\n      --yes\n          Apply after displaying the exact setup plan\n\n  -h, --help\n          Print help\n",[149,1909,1907],{"__ignoreMap":158},[200,1911,1913],{"id":1912},"mm-secret-provider-test",[149,1914,1915],{},"mm secret provider test",[152,1917,1920],{"className":1918,"code":1919,"language":157,"meta":158},[155],"Test one external provider instance\n\nUsage: test \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable external provider instance name\n\nOptions:\n  -h, --help\n          Print help\n",[149,1921,1919],{"__ignoreMap":158},[200,1923,1925],{"id":1924},"mm-secret-provider-status",[149,1926,1927],{},"mm secret provider status",[152,1929,1932],{"className":1930,"code":1931,"language":157,"meta":158},[155],"Show health and capabilities for one provider instance\n\nUsage: status \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable provider instance name\n\nOptions:\n  -h, --help\n          Print help\n",[149,1933,1931],{"__ignoreMap":158},[200,1935,1937],{"id":1936},"mm-secret-provider-plan",[149,1938,1939],{},"mm secret provider plan",[152,1941,1944],{"className":1942,"code":1943,"language":157,"meta":158},[155],"Produce a deterministic provider lifecycle plan\n\nUsage: plan [OPTIONS] --operation \u003COPERATION> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable managed provider instance name\n\nOptions:\n      --operation \u003COPERATION>\n          Lifecycle operation represented by the plan\n\n          [possible values: install, restart, upgrade, seal, unseal, remove]\n\n      --purge\n          Delete owned persistent data when removing the provider\n\n  -h, --help\n          Print help\n",[149,1945,1943],{"__ignoreMap":158},[200,1947,1949],{"id":1948},"mm-secret-provider-apply",[149,1950,1951],{},"mm secret provider apply",[152,1953,1956],{"className":1954,"code":1955,"language":157,"meta":158},[155],"Apply an exact provider lifecycle plan\n\nUsage: apply [OPTIONS] --operation \u003COPERATION> --plan \u003CHASH> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable managed provider instance name\n\nOptions:\n      --operation \u003COPERATION>\n          Lifecycle operation represented by the plan\n\n          [possible values: install, restart, upgrade, seal, unseal, remove]\n\n      --purge\n          Delete owned persistent data when removing the provider\n\n      --plan \u003CHASH>\n          Hash printed by the identical provider lifecycle plan\n\n      --yes\n          Apply the exact reviewed plan without prompting\n\n  -h, --help\n          Print help\n",[149,1957,1955],{"__ignoreMap":158},[200,1959,1961],{"id":1960},"mm-secret-provider-backup",[149,1962,1963],{},"mm secret provider backup",[152,1965,1968],{"className":1966,"code":1967,"language":157,"meta":158},[155],"Write an encrypted provider snapshot after exact review\n\nUsage: backup [OPTIONS] --file \u003CPATH> --plan \u003CHASH> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable managed provider instance name\n\nOptions:\n      --file \u003CPATH>\n          Encrypted snapshot source or destination\n\n      --plan \u003CHASH>\n          Hash for the exact current state and selected path\n\n      --yes\n          Apply the exact reviewed backup or restore\n\n  -h, --help\n          Print help\n",[149,1969,1967],{"__ignoreMap":158},[200,1971,1973],{"id":1972},"mm-secret-provider-restore",[149,1974,1975],{},"mm secret provider restore",[152,1977,1980],{"className":1978,"code":1979,"language":157,"meta":158},[155],"Restore an encrypted provider snapshot after exact review\n\nUsage: restore [OPTIONS] --file \u003CPATH> --plan \u003CHASH> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable managed provider instance name\n\nOptions:\n      --file \u003CPATH>\n          Encrypted snapshot source or destination\n\n      --plan \u003CHASH>\n          Hash for the exact current state and selected path\n\n      --yes\n          Apply the exact reviewed backup or restore\n\n  -h, --help\n          Print help\n",[149,1981,1979],{"__ignoreMap":158},[200,1983,1985],{"id":1984},"mm-secret-provider-remove",[149,1986,1987],{},"mm secret provider remove",[152,1989,1992],{"className":1990,"code":1991,"language":157,"meta":158},[155],"Remove a provider through its exact reviewed lifecycle plan\n\nUsage: remove [OPTIONS] --plan \u003CHASH> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Stable managed provider instance name\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by the corresponding remove plan\n\n      --yes\n          Apply the exact reviewed removal\n\n      --purge\n          Delete provider-owned persistent data\n\n  -h, --help\n          Print help\n",[149,1993,1991],{"__ignoreMap":158},[162,1995,1997],{"id":1996},"mm-access",[149,1998,1999],{},"mm access",[152,2001,2004],{"className":2002,"code":2003,"language":157,"meta":158},[155],"Manage application access policies, users, routes, and sessions\n\nUsage: access \u003CCOMMAND>\n\nCommands:\n  add      Review or create a password-cap policy using the managed local Cap service\n  remove   Review or remove an unattached policy and its owned secret material\n  show     Show redacted policy metadata\n  attach   Review or attach one policy middleware to an owned router\n  detach   Review or detach one policy middleware from an owned router\n  user     Manage application-access principals (separate from deployment RBAC users)\n  session  List, revoke, or rotate opaque sessions\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2005,2003],{"__ignoreMap":158},[187,2007,2009],{"id":2008},"mm-access-add",[149,2010,2011],{},"mm access add",[152,2013,2016],{"className":2014,"code":2015,"language":157,"meta":158},[155],"Review or create a password-cap policy using the managed local Cap service\n\nUsage: add [OPTIONS] \u003CPOLICY>\n\nArguments:\n  \u003CPOLICY>\n          Unique policy name in the selected project and environment\n\nOptions:\n      --mode \u003CMODE>\n          Driver evaluation mode for this policy\n\n          [default: any]\n          [possible values: any, all]\n\n      --session-days \u003CSESSION_DAYS>\n          Session lifetime in days (default seven, maximum thirty)\n\n          [default: 7]\n\n      --secret-provider \u003CSECRET_PROVIDER>\n          Secret storage provider for generated gate keys and pepper material\n\n          [default: age]\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only policy review\n\n      --yes\n          Apply the exact reviewed policy plan\n\n  -h, --help\n          Print help\n",[149,2017,2015],{"__ignoreMap":158},[187,2019,2021],{"id":2020},"mm-access-remove",[149,2022,2023],{},"mm access remove",[152,2025,2028],{"className":2026,"code":2027,"language":157,"meta":158},[155],"Review or remove an unattached policy and its owned secret material\n\nUsage: remove [OPTIONS] \u003CPOLICY>\n\nArguments:\n  \u003CPOLICY>\n          Policy to remove\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only removal review\n\n      --yes\n          Apply the exact reviewed removal plan\n\n  -h, --help\n          Print help\n",[149,2029,2027],{"__ignoreMap":158},[187,2031,2033],{"id":2032},"mm-access-show",[149,2034,2035],{},"mm access show",[152,2037,2040],{"className":2038,"code":2039,"language":157,"meta":158},[155],"Show redacted policy metadata\n\nUsage: show [POLICY]\n\nArguments:\n  [POLICY]\n          Optional policy name; omit to show every policy in the selected scope\n\nOptions:\n  -h, --help\n          Print help\n",[149,2041,2039],{"__ignoreMap":158},[187,2043,2045],{"id":2044},"mm-access-attach",[149,2046,2047],{},"mm access attach",[152,2049,2052],{"className":2050,"code":2051,"language":157,"meta":158},[155],"Review or attach one policy middleware to an owned router\n\nUsage: attach [OPTIONS] --target-id \u003CUUID> \u003CPOLICY> \u003CROUTER>\n\nArguments:\n  \u003CPOLICY>\n          Policy to attach or detach\n\n  \u003CROUTER>\n          Owned ingress router to update\n\nOptions:\n      --target-id \u003CUUID>\n          Target that owns the ingress router\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only route review\n\n      --yes\n          Apply the exact reviewed route plan\n\n  -h, --help\n          Print help\n",[149,2053,2051],{"__ignoreMap":158},[187,2055,2057],{"id":2056},"mm-access-detach",[149,2058,2059],{},"mm access detach",[152,2061,2064],{"className":2062,"code":2063,"language":157,"meta":158},[155],"Review or detach one policy middleware from an owned router\n\nUsage: detach [OPTIONS] --target-id \u003CUUID> \u003CPOLICY> \u003CROUTER>\n\nArguments:\n  \u003CPOLICY>\n          Policy to attach or detach\n\n  \u003CROUTER>\n          Owned ingress router to update\n\nOptions:\n      --target-id \u003CUUID>\n          Target that owns the ingress router\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only route review\n\n      --yes\n          Apply the exact reviewed route plan\n\n  -h, --help\n          Print help\n",[149,2065,2063],{"__ignoreMap":158},[187,2067,2069],{"id":2068},"mm-access-user",[149,2070,2071],{},"mm access user",[152,2073,2076],{"className":2074,"code":2075,"language":157,"meta":158},[155],"Manage application-access principals (separate from deployment RBAC users)\n\nUsage: user \u003CCOMMAND>\n\nCommands:\n  add             Review or create an application-access user with a hidden password\n  disable         Review or disable an application-access user and revoke active sessions\n  enable          Review or re-enable an application-access user\n  password-reset  Review or replace an application-access user's hidden password\n  remove          Review or remove an application-access user and revoke active sessions\n  list            Show redacted application-user metadata for one policy\n  help            Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2077,2075],{"__ignoreMap":158},[200,2079,2081],{"id":2080},"mm-access-user-add",[149,2082,2083],{},"mm access user add",[152,2085,2088],{"className":2086,"code":2087,"language":157,"meta":158},[155],"Review or create an application-access user with a hidden password\n\nUsage: add [OPTIONS] \u003CPOLICY> \u003CUSERNAME>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the application user\n\n  \u003CUSERNAME>\n          Application-access username\n\nOptions:\n      --stdin\n          Read the password from standard input instead of prompting\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only user review\n\n      --yes\n          Apply the exact reviewed user plan\n\n  -h, --help\n          Print help\n",[149,2089,2087],{"__ignoreMap":158},[200,2091,2093],{"id":2092},"mm-access-user-disable",[149,2094,2095],{},"mm access user disable",[152,2097,2100],{"className":2098,"code":2099,"language":157,"meta":158},[155],"Review or disable an application-access user and revoke active sessions\n\nUsage: disable [OPTIONS] \u003CPOLICY> \u003CUSERNAME>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the application user\n\n  \u003CUSERNAME>\n          Application-access username\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only user review\n\n      --yes\n          Apply the exact reviewed user plan\n\n  -h, --help\n          Print help\n",[149,2101,2099],{"__ignoreMap":158},[200,2103,2105],{"id":2104},"mm-access-user-enable",[149,2106,2107],{},"mm access user enable",[152,2109,2112],{"className":2110,"code":2111,"language":157,"meta":158},[155],"Review or re-enable an application-access user\n\nUsage: enable [OPTIONS] \u003CPOLICY> \u003CUSERNAME>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the application user\n\n  \u003CUSERNAME>\n          Application-access username\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only user review\n\n      --yes\n          Apply the exact reviewed user plan\n\n  -h, --help\n          Print help\n",[149,2113,2111],{"__ignoreMap":158},[200,2115,2117],{"id":2116},"mm-access-user-password-reset",[149,2118,2119],{},"mm access user password-reset",[152,2121,2124],{"className":2122,"code":2123,"language":157,"meta":158},[155],"Review or replace an application-access user's hidden password\n\nUsage: password-reset [OPTIONS] \u003CPOLICY> \u003CUSERNAME>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the application user\n\n  \u003CUSERNAME>\n          Application-access username\n\nOptions:\n      --stdin\n          Read the password from standard input instead of prompting\n\n      --plan \u003CHASH>\n          Exact hash printed by the read-only user review\n\n      --yes\n          Apply the exact reviewed user plan\n\n  -h, --help\n          Print help\n",[149,2125,2123],{"__ignoreMap":158},[200,2127,2129],{"id":2128},"mm-access-user-remove",[149,2130,2131],{},"mm access user remove",[152,2133,2136],{"className":2134,"code":2135,"language":157,"meta":158},[155],"Review or remove an application-access user and revoke active sessions\n\nUsage: remove [OPTIONS] \u003CPOLICY> \u003CUSERNAME>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the application user\n\n  \u003CUSERNAME>\n          Application-access username\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only user review\n\n      --yes\n          Apply the exact reviewed user plan\n\n  -h, --help\n          Print help\n",[149,2137,2135],{"__ignoreMap":158},[200,2139,2141],{"id":2140},"mm-access-user-list",[149,2142,2143],{},"mm access user list",[152,2145,2148],{"className":2146,"code":2147,"language":157,"meta":158},[155],"Show redacted application-user metadata for one policy\n\nUsage: list \u003CPOLICY>\n\nArguments:\n  \u003CPOLICY>\n          Policy whose application users will be listed\n\nOptions:\n  -h, --help\n          Print help\n",[149,2149,2147],{"__ignoreMap":158},[187,2151,2153],{"id":2152},"mm-access-session",[149,2154,2155],{},"mm access session",[152,2157,2160],{"className":2158,"code":2159,"language":157,"meta":158},[155],"List, revoke, or rotate opaque sessions\n\nUsage: session \u003CCOMMAND>\n\nCommands:\n  list        Show redacted active-session metadata for one policy\n  revoke      Review or revoke one active session\n  rotate-key  Review or rotate a policy's session encryption key\n  help        Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2161,2159],{"__ignoreMap":158},[200,2163,2165],{"id":2164},"mm-access-session-list",[149,2166,2167],{},"mm access session list",[152,2169,2172],{"className":2170,"code":2171,"language":157,"meta":158},[155],"Show redacted active-session metadata for one policy\n\nUsage: list \u003CPOLICY>\n\nArguments:\n  \u003CPOLICY>\n          Policy whose active sessions will be listed\n\nOptions:\n  -h, --help\n          Print help\n",[149,2173,2171],{"__ignoreMap":158},[200,2175,2177],{"id":2176},"mm-access-session-revoke",[149,2178,2179],{},"mm access session revoke",[152,2181,2184],{"className":2182,"code":2183,"language":157,"meta":158},[155],"Review or revoke one active session\n\nUsage: revoke [OPTIONS] \u003CPOLICY> \u003CSESSION_ID>\n\nArguments:\n  \u003CPOLICY>\n          Policy that owns the session\n\n  \u003CSESSION_ID>\n          Opaque session identifier to revoke\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only revocation review\n\n      --yes\n          Apply the exact reviewed revocation plan\n\n  -h, --help\n          Print help\n",[149,2185,2183],{"__ignoreMap":158},[200,2187,2189],{"id":2188},"mm-access-session-rotate-key",[149,2190,2191],{},"mm access session rotate-key",[152,2193,2196],{"className":2194,"code":2195,"language":157,"meta":158},[155],"Review or rotate a policy's session encryption key\n\nUsage: rotate-key [OPTIONS] \u003CPOLICY>\n\nArguments:\n  \u003CPOLICY>\n          Policy whose session encryption key will be rotated\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the read-only key-rotation review\n\n      --yes\n          Apply the exact reviewed key-rotation plan\n\n  -h, --help\n          Print help\n",[149,2197,2195],{"__ignoreMap":158},[162,2199,2201],{"id":2200},"mm-build",[149,2202,2203],{},"mm build",[152,2205,2208],{"className":2206,"code":2207,"language":157,"meta":158},[155],"Plan and execute deterministic OCI image builds\n\nUsage: build [OPTIONS] [COMMAND]\n\nCommands:\n  plan     Print the deterministic image build plan without running Docker\n  apply    Execute an exact plan hash printed by `mm build plan`\n  receipt  Write the latest published build of this checkout and environment to FILE, for `mm deploy plan --receipt` or `mm build import` on another machine\n  import   Review or apply importing a build receipt from `mm build receipt`\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n      --publish\n          Push a multi-platform image index and reviewed tags to the registry\n\n      --yes\n          Skip the build confirmation prompt\n\n  -h, --help\n          Print help\n\nExamples:\n  mm build plan\n  mm build apply --plan HASH --yes\n",[149,2209,2207],{"__ignoreMap":158},[187,2211,2213],{"id":2212},"mm-build-plan",[149,2214,2215],{},"mm build plan",[152,2217,2220],{"className":2218,"code":2219,"language":157,"meta":158},[155],"Print the deterministic image build plan without running Docker\n\nUsage: plan\n\nOptions:\n  -h, --help\n          Print help\n",[149,2221,2219],{"__ignoreMap":158},[187,2223,2225],{"id":2224},"mm-build-apply",[149,2226,2227],{},"mm build apply",[152,2229,2232],{"className":2230,"code":2231,"language":157,"meta":158},[155],"Execute an exact plan hash printed by `mm build plan`\n\nUsage: apply --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm build plan`\n\n  -h, --help\n          Print help\n",[149,2233,2231],{"__ignoreMap":158},[187,2235,2237],{"id":2236},"mm-build-receipt",[149,2238,2239],{},"mm build receipt",[152,2241,2244],{"className":2242,"code":2243,"language":157,"meta":158},[155],"Write the latest published build of this checkout and environment to FILE, for `mm deploy plan --receipt` or `mm build import` on another machine\n\nUsage: receipt \u003CFILE>\n\nArguments:\n  \u003CFILE>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,2245,2243],{"__ignoreMap":158},[187,2247,2249],{"id":2248},"mm-build-import",[149,2250,2251],{},"mm build import",[152,2253,2256],{"className":2254,"code":2255,"language":157,"meta":158},[155],"Review or apply importing a build receipt from `mm build receipt`.\n\nWithout `--plan`, prints the review and its hash. A normal import records the receipt as this checkout's published build for the environment, so deploy plans and status use its digests; it must be a build of HEAD, for this environment or one that builds the same units. `--cache-only` accepts a build of any commit and only lets later `mm build --publish` runs reuse its unchanged images.\n\nUsage: import [OPTIONS] \u003CFILE>\n\nArguments:\n  \u003CFILE>\n\n\nOptions:\n      --cache-only\n          Only seed build reuse; never select deployment images\n\n      --plan \u003CHASH>\n          Apply the import with this hash, printed by the review\n\n  -h, --help\n          Print help (see a summary with '-h')\n\nExamples:\n  mm build import build-receipt.json\n  mm build import build-receipt.json --plan HASH --yes\n  mm build import baseline-receipt.json --cache-only --plan HASH --yes\n",[149,2257,2255],{"__ignoreMap":158},[162,2259,2261],{"id":2260},"mm-deploy",[149,2262,2263],{},"mm deploy",[152,2265,2268],{"className":2266,"code":2267,"language":157,"meta":158},[155],"Plan and apply the selected environment to its target\n\nUsage: deploy [OPTIONS] [COMMAND]\n\nCommands:\n  plan   Print the deterministic deployment plan without applying it\n  apply  Apply an exact plan hash printed by `mm deploy plan`\n  help   Print this message or the help of the given subcommand(s)\n\nOptions:\n      --yes\n          Skip the deployment confirmation prompt\n\n  -h, --help\n          Print help\n\nExamples:\n  mm deploy plan\n  mm deploy apply --plan HASH --yes\n",[149,2269,2267],{"__ignoreMap":158},[187,2271,2273],{"id":2272},"mm-deploy-plan",[149,2274,2275],{},"mm deploy plan",[152,2277,2280],{"className":2278,"code":2279,"language":157,"meta":158},[155],"Print the deterministic deployment plan without applying it\n\nUsage: plan [OPTIONS]\n\nOptions:\n      --commit \u003CSHA>\n          Commit a remote environment deploys; the host fetches it from the project's origin. Defaults to this checkout's HEAD\n\n      --receipt \u003CFILE>\n          Build receipt from `mm build receipt`: deploy its images, built from the deployed commit for this or another environment\n\n  -h, --help\n          Print help\n",[149,2281,2279],{"__ignoreMap":158},[187,2283,2285],{"id":2284},"mm-deploy-apply",[149,2286,2287],{},"mm deploy apply",[152,2289,2292],{"className":2290,"code":2291,"language":157,"meta":158},[155],"Apply an exact plan hash printed by `mm deploy plan`\n\nUsage: apply [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm deploy plan`\n\n      --receipt \u003CFILE>\n          The build receipt the local plan was made with. A remote plan already carries its receipt\n\n  -h, --help\n          Print help\n",[149,2293,2291],{"__ignoreMap":158},[162,2295,2297],{"id":2296},"mm-team",[149,2298,2299],{},"mm team",[152,2301,2304],{"className":2302,"code":2303,"language":157,"meta":158},[155],"Show who may reach remote environments, join, and sync access\n\nUsage: team \u003CCOMMAND>\n\nCommands:\n  join    Add yourself to the users file with this device's key (reviewed edit)\n  add     Add a user with a given public key (reviewed edit)\n  remove  Remove a user from the users file (reviewed edit)\n  show    Show the users file: each user's keys and access per environment\n  whoami  Show who the remote environment thinks you are and what you may do\n  sync    Reconcile the selected remote environment's access from a commit's users file without deploying\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n\nExamples:\n  mm key create\n  mm team join --request staging=deploy\n  mm --environment production team whoami\n  mm --environment staging team sync\n",[149,2305,2303],{"__ignoreMap":158},[187,2307,2309],{"id":2308},"mm-team-join",[149,2310,2311],{},"mm team join",[152,2313,2316],{"className":2314,"code":2315,"language":157,"meta":158},[155],"Add yourself to the users file with this device's key (reviewed edit)\n\nUsage: join [OPTIONS]\n\nOptions:\n      --name \u003CNAME>\n          User name, [a-z][a-z0-9-]*. Defaults to $USER\n\n      --request \u003CENV=LEVEL>\n          Access to request, for example production=view. Repeatable\n\n      --agent\n          Add this device's agent key to your existing entry instead, marked `agent: true`. Create it first with `mm key create --agent`\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same change\n\n      --yes\n          Apply the exact reviewed plan\n\n  -h, --help\n          Print help\n",[149,2317,2315],{"__ignoreMap":158},[187,2319,2321],{"id":2320},"mm-team-add",[149,2322,2323],{},"mm team add",[152,2325,2328],{"className":2326,"code":2327,"language":157,"meta":158},[155],"Add a user with a given public key (reviewed edit)\n\nUsage: add [OPTIONS] --key \u003CPUBLIC_KEY> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --key \u003CPUBLIC_KEY>\n          OpenSSH public key line, `ssh-ed25519 AAAA… comment`\n\n      --machine\n          A CI or automation identity rather than a person\n\n      --access \u003CENV=LEVEL>\n          Access per environment, for example staging=deploy or *=view. Repeatable\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same change\n\n      --yes\n          Apply the exact reviewed plan\n\n  -h, --help\n          Print help\n",[149,2329,2327],{"__ignoreMap":158},[187,2331,2333],{"id":2332},"mm-team-remove",[149,2334,2335],{},"mm team remove",[152,2337,2340],{"className":2338,"code":2339,"language":157,"meta":158},[155],"Remove a user from the users file (reviewed edit)\n\nUsage: remove [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same change\n\n      --yes\n          Apply the exact reviewed plan\n\n  -h, --help\n          Print help\n",[149,2341,2339],{"__ignoreMap":158},[187,2343,2345],{"id":2344},"mm-team-show",[149,2346,2347],{},"mm team show",[152,2349,2352],{"className":2350,"code":2351,"language":157,"meta":158},[155],"Show the users file: each user's keys and access per environment\n\nUsage: show\n\nOptions:\n  -h, --help\n          Print help\n",[149,2353,2351],{"__ignoreMap":158},[187,2355,2357],{"id":2356},"mm-team-whoami",[149,2358,2359],{},"mm team whoami",[152,2361,2364],{"className":2362,"code":2363,"language":157,"meta":158},[155],"Show who the remote environment thinks you are and what you may do\n\nUsage: whoami\n\nOptions:\n  -h, --help\n          Print help\n",[149,2365,2363],{"__ignoreMap":158},[187,2367,2369],{"id":2368},"mm-team-sync",[149,2370,2371],{},"mm team sync",[152,2373,2376],{"className":2374,"code":2375,"language":157,"meta":158},[155],"Reconcile the selected remote environment's access from a commit's users file without deploying\n\nUsage: sync [OPTIONS]\n\nOptions:\n      --commit \u003CSHA>\n          Commit whose users file to apply; defaults to HEAD\n\n      --plan \u003CHASH>\n          Exact hash printed by an earlier review of the same change\n\n      --yes\n          Apply the exact reviewed plan\n\n  -h, --help\n          Print help\n",[149,2377,2375],{"__ignoreMap":158},[162,2379,2381],{"id":2380},"mm-forward",[149,2382,2383],{},"mm forward",[152,2385,2388],{"className":2386,"code":2387,"language":157,"meta":158},[155],"Reach a remote service's port on localhost; save forwards for reuse\n\nUsage: forward [OPTIONS] [SERVICE[:PORT]]...\n       forward \u003CCOMMAND>\n\nCommands:\n  save    Save a forward for this project and environment, with a pinned local port\n  list    List this project's saved forwards\n  remove  Remove a saved forward\n  up      Start every saved forward marked --auto\n  help    Print this message or the help of the given subcommand(s)\n\nArguments:\n  [SERVICE[:PORT]]...\n          SERVICE, SERVICE:PORT, or the name of a saved forward. Repeatable\n\nOptions:\n      --local \u003CPORT>\n          Local port; defaults to the service port, or a free port if that is busy\n\n      --bind \u003CADDRESS>\n          Local address to listen on. Anything but loopback exposes the service to your network\n\n  -h, --help\n          Print help\n\nExamples:\n  mm --environment staging forward postgres\n  mm --environment staging forward postgres:5432 --local 15432\n  mm --environment staging forward save db postgres --local 15432 --auto\n  mm forward up\n",[149,2389,2387],{"__ignoreMap":158},[187,2391,2393],{"id":2392},"mm-forward-save",[149,2394,2395],{},"mm forward save",[152,2397,2400],{"className":2398,"code":2399,"language":157,"meta":158},[155],"Save a forward for this project and environment, with a pinned local port\n\nUsage: save [OPTIONS] \u003CNAME> \u003CSERVICE[:PORT]>\n\nArguments:\n  \u003CNAME>\n          Name to start it by, for example `mm forward prod-db`\n\n  \u003CSERVICE[:PORT]>\n          Service and optional container port\n\nOptions:\n      --local \u003CPORT>\n          Local port to pin; defaults to the service port\n\n      --bind \u003CADDRESS>\n          Local address to listen on; defaults to 127.0.0.1\n\n      --auto\n          Start it with `mm forward up`\n\n  -h, --help\n          Print help\n",[149,2401,2399],{"__ignoreMap":158},[187,2403,2405],{"id":2404},"mm-forward-list",[149,2406,2407],{},"mm forward list",[152,2409,2412],{"className":2410,"code":2411,"language":157,"meta":158},[155],"List this project's saved forwards\n\nUsage: list\n\nOptions:\n  -h, --help\n          Print help\n",[149,2413,2411],{"__ignoreMap":158},[187,2415,2417],{"id":2416},"mm-forward-remove",[149,2418,2419],{},"mm forward remove",[152,2421,2424],{"className":2422,"code":2423,"language":157,"meta":158},[155],"Remove a saved forward\n\nUsage: remove \u003CNAME>\n\nArguments:\n  \u003CNAME>\n          Name of the saved forward\n\nOptions:\n  -h, --help\n          Print help\n",[149,2425,2423],{"__ignoreMap":158},[187,2427,2429],{"id":2428},"mm-forward-up",[149,2430,2431],{},"mm forward up",[152,2433,2436],{"className":2434,"code":2435,"language":157,"meta":158},[155],"Start every saved forward marked --auto\n\nUsage: up\n\nOptions:\n  -h, --help\n          Print help\n",[149,2437,2435],{"__ignoreMap":158},[162,2439,2441],{"id":2440},"mm-key",[149,2442,2443],{},"mm key",[152,2445,2448],{"className":2446,"code":2447,"language":157,"meta":158},[155],"Create or show this device's SSH key for remote environments\n\nUsage: key \u003CCOMMAND>\n\nCommands:\n  create  Create this device's SSH key under MM_HOME. mm never uses ~\u002F.ssh\n  show    Print this device's public key and fingerprint for the users file\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2449,2447],{"__ignoreMap":158},[187,2451,2453],{"id":2452},"mm-key-create",[149,2454,2455],{},"mm key create",[152,2457,2460],{"className":2458,"code":2459,"language":157,"meta":158},[155],"Create this device's SSH key under MM_HOME. mm never uses ~\u002F.ssh\n\nUsage: create [OPTIONS]\n\nOptions:\n      --security-key\n          Use a FIDO2 security key (sk-ssh-ed25519); touch it when asked\n\n      --agent\n          Create the key `mm mcp serve` uses instead: a separate key for your AI agent, limited on the host by the `agents:` block\n\n  -h, --help\n          Print help\n",[149,2461,2459],{"__ignoreMap":158},[187,2463,2465],{"id":2464},"mm-key-show",[149,2466,2467],{},"mm key show",[152,2469,2472],{"className":2470,"code":2471,"language":157,"meta":158},[155],"Print this device's public key and fingerprint for the users file\n\nUsage: show [OPTIONS]\n\nOptions:\n      --agent\n          Print the agent key instead\n\n  -h, --help\n          Print help\n",[149,2473,2471],{"__ignoreMap":158},[162,2475,2477],{"id":2476},"mm-target",[149,2478,2479],{},"mm target",[152,2481,2484],{"className":2482,"code":2483,"language":157,"meta":158},[155],"Manage targets, private selection, setup, ingress, and remote access\n\nUsage: target \u003CCOMMAND>\n\nCommands:\n  local       Register this machine as the local target, preserving existing targets\n  list        List targets configured beneath MM_HOME\n  show        Show one target from the shared catalog\n  trust       Review a repo-declared target's host key and daemon identity, and accept a change with --yes\n  add         Add an SSH target to the shared catalog\n  update      Update an SSH target without changing its stable identity\n  remove      Remove a target only if its reviewed fingerprint still matches\n  select      Select a private target preference for this project\n  preference  Show or change private runtime and target preferences\n  setup       Plan or apply target provisioning and project enrollment\n  ingress     Configure and plan the target-owned ingress stack\n  access      Administer remote developer access on a target\n  swarm       Manage a Docker Swarm cluster: nodes, placement groups, storage, ingress\n  help        Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2485,2483],{"__ignoreMap":158},[187,2487,2489],{"id":2488},"mm-target-local",[149,2490,2491],{},"mm target local",[152,2493,2496],{"className":2494,"code":2495,"language":157,"meta":158},[155],"Register this machine as the local target, preserving existing targets\n\nUsage: local\n\nOptions:\n  -h, --help\n          Print help\n",[149,2497,2495],{"__ignoreMap":158},[187,2499,2501],{"id":2500},"mm-target-list",[149,2502,2503],{},"mm target list",[152,2505,2508],{"className":2506,"code":2507,"language":157,"meta":158},[155],"List targets configured beneath MM_HOME\n\nUsage: list\n\nOptions:\n  -h, --help\n          Print help\n",[149,2509,2507],{"__ignoreMap":158},[187,2511,2513],{"id":2512},"mm-target-show",[149,2514,2515],{},"mm target show",[152,2517,2520],{"className":2518,"code":2519,"language":157,"meta":158},[155],"Show one target from the shared catalog\n\nUsage: show \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,2521,2519],{"__ignoreMap":158},[187,2523,2525],{"id":2524},"mm-target-trust",[149,2526,2527],{},"mm target trust",[152,2529,2532],{"className":2530,"code":2531,"language":157,"meta":158},[155],"Review a repo-declared target's host key and daemon identity, and accept a change with --yes\n\nUsage: trust [OPTIONS] \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --yes\n          Accept the repo's current keys after reviewing them\n\n  -h, --help\n          Print help\n",[149,2533,2531],{"__ignoreMap":158},[187,2535,2537],{"id":2536},"mm-target-add",[149,2538,2539],{},"mm target add",[152,2541,2544],{"className":2542,"code":2543,"language":157,"meta":158},[155],"Add an SSH target to the shared catalog\n\nUsage: add [OPTIONS] --host \u003CHOST> --user \u003CUSER> --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --host \u003CHOST>\n          SSH hostname or address\n\n      --user \u003CUSER>\n          SSH user\n\n      --port \u003CPORT>\n          SSH port\n\n          [default: 22]\n\n      --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT>\n          OpenSSH SHA256 fingerprint accepted for this host\n\n      --host-key \u003CTYPE BASE64>\n          Full reviewed OpenSSH host public key used for strict known-hosts verification\n\n      --identity-file \u003CPATH>\n          Absolute private-key path used for public-key client authentication\n\n      --remote-root \u003CPATH>\n          Absolute project checkout path on the remote host\n\n      --daemon-fingerprint \u003CBLAKE3>\n          BLAKE3 daemon identity printed by `mmd --print-identity`\n\n  -h, --help\n          Print help\n",[149,2545,2543],{"__ignoreMap":158},[187,2547,2549],{"id":2548},"mm-target-update",[149,2550,2551],{},"mm target update",[152,2553,2556],{"className":2554,"code":2555,"language":157,"meta":158},[155],"Update an SSH target without changing its stable identity\n\nUsage: update [OPTIONS] --host \u003CHOST> --user \u003CUSER> --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT> --expected-fingerprint \u003CEXPECTED_FINGERPRINT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --host \u003CHOST>\n          SSH hostname or address\n\n      --user \u003CUSER>\n          SSH user\n\n      --port \u003CPORT>\n          SSH port\n\n          [default: 22]\n\n      --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT>\n          OpenSSH SHA256 fingerprint accepted for this host\n\n      --host-key \u003CTYPE BASE64>\n          Full reviewed OpenSSH host public key used for strict known-hosts verification\n\n      --identity-file \u003CPATH>\n          Absolute private-key path used for public-key client authentication\n\n      --remote-root \u003CPATH>\n          Absolute project checkout path on the remote host\n\n      --daemon-fingerprint \u003CBLAKE3>\n          BLAKE3 daemon identity printed by `mmd --print-identity`\n\n      --expected-fingerprint \u003CEXPECTED_FINGERPRINT>\n          Fingerprint from the reviewed target list\n\n  -h, --help\n          Print help\n",[149,2557,2555],{"__ignoreMap":158},[187,2559,2561],{"id":2560},"mm-target-remove",[149,2562,2563],{},"mm target remove",[152,2565,2568],{"className":2566,"code":2567,"language":157,"meta":158},[155],"Remove a target only if its reviewed fingerprint still matches\n\nUsage: remove [OPTIONS] --expected-fingerprint \u003CEXPECTED_FINGERPRINT> \u003CNAME>\n\nArguments:\n  \u003CNAME>\n\n\nOptions:\n      --expected-fingerprint \u003CEXPECTED_FINGERPRINT>\n          Fingerprint from `mm target show`\n\n      --yes\n          Confirm catalog mutation\n\n  -h, --help\n          Print help\n",[149,2569,2567],{"__ignoreMap":158},[187,2571,2573],{"id":2572},"mm-target-select",[149,2574,2575],{},"mm target select",[152,2577,2580],{"className":2578,"code":2579,"language":157,"meta":158},[155],"Select a private target preference for this project\n\nUsage: select [OPTIONS] \u003CTARGET>\n\nArguments:\n  \u003CTARGET>\n\n\nOptions:\n      --environment \u003CNAME>\n          Limit the preference to one environment\n\n  -h, --help\n          Print help\n",[149,2581,2579],{"__ignoreMap":158},[187,2583,2585],{"id":2584},"mm-target-preference",[149,2586,2587],{},"mm target preference",[152,2589,2592],{"className":2590,"code":2591,"language":157,"meta":158},[155],"Show or change private runtime and target preferences\n\nUsage: preference \u003CCOMMAND>\n\nCommands:\n  show           Show resolved private runtime and target preferences\n  set-runtime    Persist a private runtime preference\n  unset-runtime  Remove a private runtime preference\n  set-target     Persist a private target preference\n  unset-target   Remove a private target preference\n  help           Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2593,2591],{"__ignoreMap":158},[200,2595,2597],{"id":2596},"mm-target-preference-show",[149,2598,2599],{},"mm target preference show",[152,2601,2604],{"className":2602,"code":2603,"language":157,"meta":158},[155],"Show resolved private runtime and target preferences\n\nUsage: show\n\nOptions:\n  -h, --help\n          Print help\n",[149,2605,2603],{"__ignoreMap":158},[200,2607,2609],{"id":2608},"mm-target-preference-set-runtime",[149,2610,2611],{},"mm target preference set-runtime",[152,2613,2616],{"className":2614,"code":2615,"language":157,"meta":158},[155],"Persist a private runtime preference\n\nUsage: set-runtime [OPTIONS] \u003CRUNTIME>\n\nArguments:\n  \u003CRUNTIME>\n          [possible values: podman-compose, docker-compose, docker-swarm]\n\nOptions:\n      --environment \u003CNAME>\n          Limit the preference to one environment\n\n  -h, --help\n          Print help\n",[149,2617,2615],{"__ignoreMap":158},[200,2619,2621],{"id":2620},"mm-target-preference-unset-runtime",[149,2622,2623],{},"mm target preference unset-runtime",[152,2625,2628],{"className":2626,"code":2627,"language":157,"meta":158},[155],"Remove a private runtime preference\n\nUsage: unset-runtime [OPTIONS]\n\nOptions:\n      --environment \u003CNAME>\n          Limit the unset to one environment\n\n  -h, --help\n          Print help\n",[149,2629,2627],{"__ignoreMap":158},[200,2631,2633],{"id":2632},"mm-target-preference-set-target",[149,2634,2635],{},"mm target preference set-target",[152,2637,2640],{"className":2638,"code":2639,"language":157,"meta":158},[155],"Persist a private target preference\n\nUsage: set-target [OPTIONS] \u003CTARGET>\n\nArguments:\n  \u003CTARGET>\n\n\nOptions:\n      --environment \u003CNAME>\n          Limit the preference to one environment\n\n  -h, --help\n          Print help\n",[149,2641,2639],{"__ignoreMap":158},[200,2643,2645],{"id":2644},"mm-target-preference-unset-target",[149,2646,2647],{},"mm target preference unset-target",[152,2649,2652],{"className":2650,"code":2651,"language":157,"meta":158},[155],"Remove a private target preference\n\nUsage: unset-target [OPTIONS]\n\nOptions:\n      --environment \u003CNAME>\n          Limit the unset to one environment\n\n  -h, --help\n          Print help\n",[149,2653,2651],{"__ignoreMap":158},[187,2655,2657],{"id":2656},"mm-target-setup",[149,2658,2659],{},"mm target setup",[152,2661,2664],{"className":2662,"code":2663,"language":157,"meta":158},[155],"Plan or apply target provisioning and project enrollment\n\nUsage: setup \u003CCOMMAND>\n\nCommands:\n  plan        Produce a deterministic target setup plan. For a cluster target (`nodes:`), the plan also scans each node's SSH host key\n  apply       Execute an exact plan hash printed by `mm target setup plan`\n  deploy-key  Create the environment's read-only git deploy key for a cluster target, stored in the secret `setup.deploy-key.secret` names, and print its public half. Prints the existing key when there is one\n  record      Write each node's SSH host key and daemon identity from the last cluster setup into `.config\u002Fmm\u002Ftargets.yaml`\n  help        Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2665,2663],{"__ignoreMap":158},[200,2667,2669],{"id":2668},"mm-target-setup-plan",[149,2670,2671],{},"mm target setup plan",[152,2673,2676],{"className":2674,"code":2675,"language":157,"meta":158},[155],"Produce a deterministic target setup plan. For a cluster target (`nodes:`), the plan also scans each node's SSH host key\n\nUsage: plan [OPTIONS]\n\nOptions:\n  -h, --help\n          Print help\n\nRemote access (pass the same flags to plan and apply):\n      --origin \u003CURL>\n          Git URL the host fetches the project from with its own read-only deploy key. Turns on the remote access layer\n\n      --origin-host-key \u003CKEY>\n          The git server's SSH host key, `\u003Ctype> \u003Cbase64>`, for SSH origins\n\n      --break-glass \u003CNAME=KEY>\n          A recovery key for the host policy, NAME='ssh-ed25519 AAAA… comment'. Repeat for more. Keep the private half offline\n\n      --host-binaries \u003CDIR>\n          Directory with `mm` and `mmd` built for the host, such as an extracted Linux release. Default: the directory of this `mm`\n\nCluster targets (nodes:):\n      --trust-new-host-keys\n          Accept SSH host keys that differ from the ones the repo records, such as after rebuilding a node. The plan shows each key's fingerprint\n\n      --commit \u003CSHA>\n          Commit the first node syncs the users file from (default: HEAD)\n",[149,2677,2675],{"__ignoreMap":158},[200,2679,2681],{"id":2680},"mm-target-setup-apply",[149,2682,2683],{},"mm target setup apply",[152,2685,2688],{"className":2686,"code":2687,"language":157,"meta":158},[155],"Execute an exact plan hash printed by `mm target setup plan`\n\nUsage: apply [OPTIONS] --plan \u003CHASH>\n\nOptions:\n      --plan \u003CHASH>\n          Hash printed by `mm target setup plan`\n\n      --yes\n          Skip the bootstrap confirmation prompt\n\n  -h, --help\n          Print help\n\nRemote access (pass the same flags to plan and apply):\n      --origin \u003CURL>\n          Git URL the host fetches the project from with its own read-only deploy key. Turns on the remote access layer\n\n      --origin-host-key \u003CKEY>\n          The git server's SSH host key, `\u003Ctype> \u003Cbase64>`, for SSH origins\n\n      --break-glass \u003CNAME=KEY>\n          A recovery key for the host policy, NAME='ssh-ed25519 AAAA… comment'. Repeat for more. Keep the private half offline\n\n      --host-binaries \u003CDIR>\n          Directory with `mm` and `mmd` built for the host, such as an extracted Linux release. Default: the directory of this `mm`\n\nCluster targets (nodes:):\n      --trust-new-host-keys\n          Accept SSH host keys that differ from the ones the repo records, such as after rebuilding a node. The plan shows each key's fingerprint\n\n      --commit \u003CSHA>\n          Commit the first node syncs the users file from (default: HEAD)\n",[149,2689,2687],{"__ignoreMap":158},[200,2691,2693],{"id":2692},"mm-target-setup-deploy-key",[149,2694,2695],{},"mm target setup deploy-key",[152,2697,2700],{"className":2698,"code":2699,"language":157,"meta":158},[155],"Create the environment's read-only git deploy key for a cluster target, stored in the secret `setup.deploy-key.secret` names, and print its public half. Prints the existing key when there is one\n\nUsage: deploy-key\n\nOptions:\n  -h, --help\n          Print help\n",[149,2701,2699],{"__ignoreMap":158},[200,2703,2705],{"id":2704},"mm-target-setup-record",[149,2706,2707],{},"mm target setup record",[152,2709,2712],{"className":2710,"code":2711,"language":157,"meta":158},[155],"Write each node's SSH host key and daemon identity from the last cluster setup into `.config\u002Fmm\u002Ftargets.yaml`\n\nUsage: record\n\nOptions:\n  -h, --help\n          Print help\n",[149,2713,2711],{"__ignoreMap":158},[187,2715,2717],{"id":2716},"mm-target-ingress",[149,2718,2719],{},"mm target ingress",[152,2721,2724],{"className":2722,"code":2723,"language":157,"meta":158},[155],"Configure and plan the target-owned ingress stack\n\nUsage: ingress \u003CCOMMAND>\n\nCommands:\n  configure  Configure digest-pinned Traefik and optional ACME metadata\n  plan       Publish a deterministic target-owned ingress artifact and plan\n  help       Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2725,2723],{"__ignoreMap":158},[200,2727,2729],{"id":2728},"mm-target-ingress-configure",[149,2730,2731],{},"mm target ingress configure",[152,2733,2736],{"className":2734,"code":2735,"language":157,"meta":158},[155],"Configure digest-pinned Traefik and optional ACME metadata\n\nUsage: configure [OPTIONS] --image \u003CIMAGE> --expected-fingerprint \u003CEXPECTED_FINGERPRINT> \u003CTARGET>\n\nArguments:\n  \u003CTARGET>\n\n\nOptions:\n      --image \u003CIMAGE>\n          Digest-pinned Traefik image reference\n\n      --acme-email \u003CACME_EMAIL>\n          Optional ACME account email\n\n      --acme-ca-server \u003CURL>\n          ACME directory URL, such as Let's Encrypt staging or an internal ACME server\n\n      --acme-ca-certificate \u003CPATH>\n          PEM file of the CA that signs the ACME server's HTTPS certificate\n\n      --expected-fingerprint \u003CEXPECTED_FINGERPRINT>\n          Fingerprint from the reviewed target list\n\n  -h, --help\n          Print help\n",[149,2737,2735],{"__ignoreMap":158},[200,2739,2741],{"id":2740},"mm-target-ingress-plan",[149,2742,2743],{},"mm target ingress plan",[152,2745,2748],{"className":2746,"code":2747,"language":157,"meta":158},[155],"Publish a deterministic target-owned ingress artifact and plan\n\nUsage: plan \u003CTARGET>\n\nArguments:\n  \u003CTARGET>\n\n\nOptions:\n  -h, --help\n          Print help\n",[149,2749,2747],{"__ignoreMap":158},[187,2751,2753],{"id":2752},"mm-target-access",[149,2754,2755],{},"mm target access",[152,2757,2760],{"className":2758,"code":2759,"language":157,"meta":158},[155],"Administer remote developer access on a target\n\nUsage: access \u003CCOMMAND>\n\nCommands:\n  status  Explain the privileged remote-access administration boundary\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2761,2759],{"__ignoreMap":158},[200,2763,2765],{"id":2764},"mm-target-access-status",[149,2766,2767],{},"mm target access status",[152,2769,2772],{"className":2770,"code":2771,"language":157,"meta":158},[155],"Explain the privileged remote-access administration boundary\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,2773,2771],{"__ignoreMap":158},[187,2775,2777],{"id":2776},"mm-target-swarm",[149,2778,2779],{},"mm target swarm",[152,2781,2784],{"className":2782,"code":2783,"language":157,"meta":158},[155],"Manage a Docker Swarm cluster: nodes, placement groups, storage, ingress\n\nUsage: swarm \u003CCOMMAND>\n\nCommands:\n  nodes    List nodes with their role, state, groups, storage, and ingress duty\n  group    Manage placement groups that services name with `placement:`\n  storage  Choose the node that stores shared volumes\n  ingress  Choose the nodes that run ingress (ports 80 and 443); default: every manager\n  member   Enroll other managers running mmd; mm fails over to them in order\n  help     Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2785,2783],{"__ignoreMap":158},[200,2787,2789],{"id":2788},"mm-target-swarm-nodes",[149,2790,2791],{},"mm target swarm nodes",[152,2793,2796],{"className":2794,"code":2795,"language":157,"meta":158},[155],"List nodes with their role, state, groups, storage, and ingress duty\n\nUsage: nodes\n\nOptions:\n  -h, --help\n          Print help\n",[149,2797,2795],{"__ignoreMap":158},[200,2799,2801],{"id":2800},"mm-target-swarm-group",[149,2802,2803],{},"mm target swarm group",[152,2805,2808],{"className":2806,"code":2807,"language":157,"meta":158},[155],"Manage placement groups that services name with `placement:`\n\nUsage: group \u003CCOMMAND>\n\nCommands:\n  set   Make a group contain exactly these nodes\n  rm    Delete a group from every node\n  help  Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2809,2807],{"__ignoreMap":158},[2811,2812,2814],"h5",{"id":2813},"mm-target-swarm-group-set",[149,2815,2816],{},"mm target swarm group set",[152,2818,2821],{"className":2819,"code":2820,"language":157,"meta":158},[155],"Make a group contain exactly these nodes\n\nUsage: set [OPTIONS] \u003CGROUP> \u003CNODE>...\n\nArguments:\n  \u003CGROUP>\n\n\n  \u003CNODE>...\n          Node hostnames or IDs\n\nOptions:\n      --yes\n          Apply without asking\n\n  -h, --help\n          Print help\n",[149,2822,2820],{"__ignoreMap":158},[2811,2824,2826],{"id":2825},"mm-target-swarm-group-rm",[149,2827,2828],{},"mm target swarm group rm",[152,2830,2833],{"className":2831,"code":2832,"language":157,"meta":158},[155],"Delete a group from every node\n\nUsage: rm [OPTIONS] \u003CGROUP>\n\nArguments:\n  \u003CGROUP>\n\n\nOptions:\n      --yes\n          Apply without asking\n\n  -h, --help\n          Print help\n",[149,2834,2832],{"__ignoreMap":158},[200,2836,2838],{"id":2837},"mm-target-swarm-storage",[149,2839,2840],{},"mm target swarm storage",[152,2842,2845],{"className":2843,"code":2844,"language":157,"meta":158},[155],"Choose the node that stores shared volumes\n\nUsage: storage \u003CCOMMAND>\n\nCommands:\n  set   Store shared volumes on this node. Existing data is not copied\n  help  Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2846,2844],{"__ignoreMap":158},[2811,2848,2850],{"id":2849},"mm-target-swarm-storage-set",[149,2851,2852],{},"mm target swarm storage set",[152,2854,2857],{"className":2855,"code":2856,"language":157,"meta":158},[155],"Store shared volumes on this node. Existing data is not copied\n\nUsage: set [OPTIONS] \u003CNODE>\n\nArguments:\n  \u003CNODE>\n\n\nOptions:\n      --yes\n          Apply without asking\n\n  -h, --help\n          Print help\n",[149,2858,2856],{"__ignoreMap":158},[200,2860,2862],{"id":2861},"mm-target-swarm-ingress",[149,2863,2864],{},"mm target swarm ingress",[152,2866,2869],{"className":2867,"code":2868,"language":157,"meta":158},[155],"Choose the nodes that run ingress (ports 80 and 443); default: every manager\n\nUsage: ingress \u003CCOMMAND>\n\nCommands:\n  set   Run ingress only on these nodes; pass none to use every manager again\n  help  Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2870,2868],{"__ignoreMap":158},[2811,2872,2874],{"id":2873},"mm-target-swarm-ingress-set",[149,2875,2876],{},"mm target swarm ingress set",[152,2878,2881],{"className":2879,"code":2880,"language":157,"meta":158},[155],"Run ingress only on these nodes; pass none to use every manager again\n\nUsage: set [OPTIONS] [NODE]...\n\nArguments:\n  [NODE]...\n          Node hostnames or IDs\n\nOptions:\n      --yes\n          Apply without asking\n\n  -h, --help\n          Print help\n",[149,2882,2880],{"__ignoreMap":158},[200,2884,2886],{"id":2885},"mm-target-swarm-member",[149,2887,2888],{},"mm target swarm member",[152,2890,2893],{"className":2891,"code":2892,"language":157,"meta":158},[155],"Enroll other managers running mmd; mm fails over to them in order\n\nUsage: member \u003CCOMMAND>\n\nCommands:\n  add   Add a manager as a failover member of an SSH target\n  rm    Remove a failover member\n  help  Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2894,2892],{"__ignoreMap":158},[2811,2896,2898],{"id":2897},"mm-target-swarm-member-add",[149,2899,2900],{},"mm target swarm member add",[152,2902,2905],{"className":2903,"code":2904,"language":157,"meta":158},[155],"Add a manager as a failover member of an SSH target\n\nUsage: add [OPTIONS] --host \u003CHOST> --user \u003CUSER> --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT> --host-key \u003CTYPE BASE64> --daemon-fingerprint \u003CBLAKE3> --expected-fingerprint \u003CEXPECTED_FINGERPRINT> \u003CTARGET> \u003CMEMBER>\n\nArguments:\n  \u003CTARGET>\n\n\n  \u003CMEMBER>\n\n\nOptions:\n      --host \u003CHOST>\n          SSH hostname or address of this manager\n\n      --user \u003CUSER>\n          SSH relay user on this manager\n\n      --port \u003CPORT>\n          SSH port on this manager\n\n          [default: 22]\n\n      --host-key-fingerprint \u003CHOST_KEY_FINGERPRINT>\n          OpenSSH SHA256 fingerprint of this manager's host key\n\n      --host-key \u003CTYPE BASE64>\n          Full reviewed OpenSSH host public key\n\n      --identity-file \u003CPATH>\n          Absolute private-key path for this manager\n\n      --daemon-fingerprint \u003CBLAKE3>\n          Identity printed by `mmd --print-identity` on this manager\n\n      --expected-fingerprint \u003CEXPECTED_FINGERPRINT>\n          Fingerprint from `mm target show TARGET`\n\n  -h, --help\n          Print help\n",[149,2906,2904],{"__ignoreMap":158},[2811,2908,2910],{"id":2909},"mm-target-swarm-member-rm",[149,2911,2912],{},"mm target swarm member rm",[152,2914,2917],{"className":2915,"code":2916,"language":157,"meta":158},[155],"Remove a failover member\n\nUsage: rm --expected-fingerprint \u003CEXPECTED_FINGERPRINT> \u003CTARGET> \u003CMEMBER>\n\nArguments:\n  \u003CTARGET>\n\n\n  \u003CMEMBER>\n\n\nOptions:\n      --expected-fingerprint \u003CEXPECTED_FINGERPRINT>\n          Fingerprint from `mm target show TARGET`\n\n  -h, --help\n          Print help\n",[149,2918,2916],{"__ignoreMap":158},[162,2920,2922],{"id":2921},"mm-agent",[149,2923,2924],{},"mm agent",[152,2926,2929],{"className":2927,"code":2928,"language":157,"meta":158},[155],"Show and trust what AI agents may do, and connect coding tools\n\nUsage: agent \u003CCOMMAND>\n\nCommands:\n  status  Show what agents may do in each environment and whether this device trusts the project's `agents:` block\n  trust   Review the project's `agents:` block and trust it on this device. Until then, and after any edit to the block, agents can only view\n  setup   Connect coding tools to `mm mcp serve`\n  help    Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n\nExamples:\n  mm agent status\n  mm agent trust\n  mm agent setup --client claude-code --yes\n\nAgents work through `mm mcp serve`, limited per environment by the project's `agents:` block. mm refuses to run directly for an agent.\n",[149,2930,2928],{"__ignoreMap":158},[187,2932,2934],{"id":2933},"mm-agent-status",[149,2935,2936],{},"mm agent status",[152,2938,2941],{"className":2939,"code":2940,"language":157,"meta":158},[155],"Show what agents may do in each environment and whether this device trusts the project's `agents:` block\n\nUsage: status\n\nOptions:\n  -h, --help\n          Print help\n",[149,2942,2940],{"__ignoreMap":158},[187,2944,2946],{"id":2945},"mm-agent-trust",[149,2947,2948],{},"mm agent trust",[152,2950,2953],{"className":2951,"code":2952,"language":157,"meta":158},[155],"Review the project's `agents:` block and trust it on this device. Until then, and after any edit to the block, agents can only view\n\nUsage: trust [OPTIONS]\n\nOptions:\n      --plan \u003CHASH>\n          Exact hash printed by the review of the block\n\n      --yes\n          Trust the reviewed block\n\n  -h, --help\n          Print help\n\nExamples:\n  mm agent trust\n  mm agent trust --plan HASH --yes\n",[149,2954,2952],{"__ignoreMap":158},[187,2956,2958],{"id":2957},"mm-agent-setup",[149,2959,2960],{},"mm agent setup",[152,2962,2965],{"className":2963,"code":2964,"language":157,"meta":158},[155],"Connect coding tools to `mm mcp serve`\n\nUsage: setup [OPTIONS]\n\nOptions:\n      --client \u003CTOOL>\n          Tool to connect. Repeatable. Defaults to the tools found on PATH\n\n          [possible values: claude-code, opencode, codex, cursor]\n\n      --user\n          Register the server for this user instead of this project\n\n      --yes\n          Make the changes shown\n\n  -h, --help\n          Print help\n\nExamples:\n  mm agent setup\n  mm agent setup --client claude-code --yes\n  mm agent setup --user --yes\n\nWithout --yes the changes are only shown. In a project, the files are meant to be committed: the MCP server entry, instructions in AGENTS.md, and for Claude Code a rule that denies running mm directly. With --user, mm registers the server in each tool's own configuration for every project.\n",[149,2966,2964],{"__ignoreMap":158},[162,2968,2970],{"id":2969},"mm-mcp",[149,2971,2972],{},"mm mcp",[152,2974,2977],{"className":2975,"code":2976,"language":157,"meta":158},[155],"Serve the Model Context Protocol server that AI agents use\n\nUsage: mcp \u003CCOMMAND>\n\nCommands:\n  serve  Serve MCP on standard input\u002Foutput for the project in the current directory (or --root). No network listener is opened\n  help   Print this message or the help of the given subcommand(s)\n\nOptions:\n  -h, --help\n          Print help\n",[149,2978,2976],{"__ignoreMap":158},[187,2980,2982],{"id":2981},"mm-mcp-serve",[149,2983,2984],{},"mm mcp serve",[152,2986,2989],{"className":2987,"code":2988,"language":157,"meta":158},[155],"Serve MCP on standard input\u002Foutput for the project in the current directory (or --root). No network listener is opened\n\nUsage: serve [OPTIONS]\n\nOptions:\n      --config \u003CPATH>\n          Private limits for this device. Defaults to $MM_HOME\u002Fmcp.json, which is optional\n\n  -h, --help\n          Print help\n",[149,2990,2988],{"__ignoreMap":158},{"title":158,"searchDepth":2992,"depth":2992,"links":2993},2,[2994,2995,3007,3027,3030,3036,3043,3051,3064,3075,3084,3090,3094,3102,3108,3112,3127,3132],{"id":164,"depth":2992,"text":167},{"id":176,"depth":2992,"text":179,"children":2996},[2997,2999,3000,3001,3002,3003,3004,3005,3006],{"id":189,"depth":2998,"text":192},3,{"id":214,"depth":2998,"text":217},{"id":226,"depth":2998,"text":229},{"id":238,"depth":2998,"text":241},{"id":250,"depth":2998,"text":253},{"id":310,"depth":2998,"text":313},{"id":394,"depth":2998,"text":397},{"id":418,"depth":2998,"text":421},{"id":466,"depth":2998,"text":469},{"id":478,"depth":2992,"text":481,"children":3008},[3009,3010,3011,3012,3013,3014,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026],{"id":490,"depth":2998,"text":493},{"id":502,"depth":2998,"text":505},{"id":550,"depth":2998,"text":553},{"id":595,"depth":2998,"text":598},{"id":655,"depth":2998,"text":658},{"id":700,"depth":2998,"text":703},{"id":745,"depth":2998,"text":748},{"id":790,"depth":2998,"text":793},{"id":835,"depth":2998,"text":838},{"id":907,"depth":2998,"text":910},{"id":952,"depth":2998,"text":955},{"id":997,"depth":2998,"text":1000},{"id":1042,"depth":2998,"text":1045},{"id":1087,"depth":2998,"text":1090},{"id":1132,"depth":2998,"text":1135},{"id":1144,"depth":2998,"text":1147},{"id":1156,"depth":2998,"text":1159},{"id":1168,"depth":2998,"text":1171},{"id":1180,"depth":2992,"text":1183,"children":3028},[3029],{"id":1192,"depth":2998,"text":1195},{"id":1204,"depth":2992,"text":1207,"children":3031},[3032,3033,3034,3035],{"id":1216,"depth":2998,"text":1219},{"id":1228,"depth":2998,"text":1231},{"id":1240,"depth":2998,"text":1243},{"id":1252,"depth":2998,"text":1255},{"id":1264,"depth":2992,"text":1267,"children":3037},[3038,3039,3040,3041,3042],{"id":1276,"depth":2998,"text":1279},{"id":1288,"depth":2998,"text":1291},{"id":1300,"depth":2998,"text":1303},{"id":1312,"depth":2998,"text":1315},{"id":1324,"depth":2998,"text":1327},{"id":1336,"depth":2992,"text":1339,"children":3044},[3045,3046,3047,3048,3049,3050],{"id":1348,"depth":2998,"text":1351},{"id":1360,"depth":2998,"text":1363},{"id":1372,"depth":2998,"text":1375},{"id":1384,"depth":2998,"text":1387},{"id":1396,"depth":2998,"text":1399},{"id":1408,"depth":2998,"text":1411},{"id":1516,"depth":2992,"text":1519,"children":3052},[3053,3054,3055,3056,3057,3058,3059,3060,3061,3062,3063],{"id":1528,"depth":2998,"text":1531},{"id":1540,"depth":2998,"text":1543},{"id":1552,"depth":2998,"text":1555},{"id":1564,"depth":2998,"text":1567},{"id":1576,"depth":2998,"text":1579},{"id":1624,"depth":2998,"text":1627},{"id":1636,"depth":2998,"text":1639},{"id":1648,"depth":2998,"text":1651},{"id":1660,"depth":2998,"text":1663},{"id":1672,"depth":2998,"text":1675},{"id":1684,"depth":2998,"text":1687},{"id":1720,"depth":2992,"text":1723,"children":3065},[3066,3067,3068,3069,3070,3071,3072,3073,3074],{"id":1732,"depth":2998,"text":1735},{"id":1744,"depth":2998,"text":1747},{"id":1756,"depth":2998,"text":1759},{"id":1768,"depth":2998,"text":1771},{"id":1780,"depth":2998,"text":1783},{"id":1792,"depth":2998,"text":1795},{"id":1804,"depth":2998,"text":1807},{"id":1816,"depth":2998,"text":1819},{"id":1852,"depth":2998,"text":1855},{"id":1996,"depth":2992,"text":1999,"children":3076},[3077,3078,3079,3080,3081,3082,3083],{"id":2008,"depth":2998,"text":2011},{"id":2020,"depth":2998,"text":2023},{"id":2032,"depth":2998,"text":2035},{"id":2044,"depth":2998,"text":2047},{"id":2056,"depth":2998,"text":2059},{"id":2068,"depth":2998,"text":2071},{"id":2152,"depth":2998,"text":2155},{"id":2200,"depth":2992,"text":2203,"children":3085},[3086,3087,3088,3089],{"id":2212,"depth":2998,"text":2215},{"id":2224,"depth":2998,"text":2227},{"id":2236,"depth":2998,"text":2239},{"id":2248,"depth":2998,"text":2251},{"id":2260,"depth":2992,"text":2263,"children":3091},[3092,3093],{"id":2272,"depth":2998,"text":2275},{"id":2284,"depth":2998,"text":2287},{"id":2296,"depth":2992,"text":2299,"children":3095},[3096,3097,3098,3099,3100,3101],{"id":2308,"depth":2998,"text":2311},{"id":2320,"depth":2998,"text":2323},{"id":2332,"depth":2998,"text":2335},{"id":2344,"depth":2998,"text":2347},{"id":2356,"depth":2998,"text":2359},{"id":2368,"depth":2998,"text":2371},{"id":2380,"depth":2992,"text":2383,"children":3103},[3104,3105,3106,3107],{"id":2392,"depth":2998,"text":2395},{"id":2404,"depth":2998,"text":2407},{"id":2416,"depth":2998,"text":2419},{"id":2428,"depth":2998,"text":2431},{"id":2440,"depth":2992,"text":2443,"children":3109},[3110,3111],{"id":2452,"depth":2998,"text":2455},{"id":2464,"depth":2998,"text":2467},{"id":2476,"depth":2992,"text":2479,"children":3113},[3114,3115,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126],{"id":2488,"depth":2998,"text":2491},{"id":2500,"depth":2998,"text":2503},{"id":2512,"depth":2998,"text":2515},{"id":2524,"depth":2998,"text":2527},{"id":2536,"depth":2998,"text":2539},{"id":2548,"depth":2998,"text":2551},{"id":2560,"depth":2998,"text":2563},{"id":2572,"depth":2998,"text":2575},{"id":2584,"depth":2998,"text":2587},{"id":2656,"depth":2998,"text":2659},{"id":2716,"depth":2998,"text":2719},{"id":2752,"depth":2998,"text":2755},{"id":2776,"depth":2998,"text":2779},{"id":2921,"depth":2992,"text":2924,"children":3128},[3129,3130,3131],{"id":2933,"depth":2998,"text":2936},{"id":2945,"depth":2998,"text":2948},{"id":2957,"depth":2998,"text":2960},{"id":2969,"depth":2992,"text":2972,"children":3133},[3134],{"id":2981,"depth":2998,"text":2984},"Generated from the mm Clap command tree.","md",{},true,{"title":90,"description":3135},"docs\u002Freference\u002Fcli","tsNsPcNiOkBnUbblzCe2F-hr85UM0WX-Ib-qcbPmGNw",1794512545911]