CLI Command Reference

Document ID: CLI-003
File Path: docs/11-cli/commands.md
Version: generated from wovyr 0.4.0
Status: Generated (from the clap command tree)
Owner: AI Platform Team

Every section below is the verbatim --help output of a real command — generated, so the reference can never describe a command that doesn’t exist, nor omit one that does. Conceptual docs live in index.md, configuration.md, and examples.md.

`wovyr`

Wovyr AI Platform CLI

Usage: wovyr <COMMAND>

Commands:
  login      Authenticate against a server and store credentials locally
  logout     Remove stored credentials
  whoami     Show the current local identity (server + masked token)
  dev        Run an all-in-one local platform server for testing
  agents     Manage and run agents
  workflows  Validate and run workflows
  memory     Store and query agent memory
  plugin     Install and manage plugins (extension capabilities)
  kms        Manage the platform KMS's tenant keys (docs/13-security/encryption.md §5)
  auth       Manage API keys for `WOVYR_AUTH_MODE=apikey` (RM-GA-P1 SEC-101)
  admin      Backup and restore the local `~/.wovyr` state directory (RM-GA-P2 DR-1001)
  help       Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version

`wovyr login`

Authenticate against a server and store credentials locally

Usage: wovyr login [OPTIONS] --server <SERVER>

Options:
      --server <SERVER>  Server base URL (e.g. https://api.wovyr.example.com)
      --token <TOKEN>    Access token. Falls back to the WOVYR_TOKEN environment variable
  -h, --help             Print help

`wovyr logout`

Remove stored credentials

Usage: wovyr logout

Options:
  -h, --help  Print help

`wovyr whoami`

Show the current local identity (server + masked token)

Usage: wovyr whoami

Options:
  -h, --help  Print help

`wovyr dev`

Run an all-in-one local platform server for testing

Usage: wovyr dev [OPTIONS]

Options:
      --addr <ADDR>  Address to bind (host:port) [default: 127.0.0.1:8080]
  -h, --help         Print help

`wovyr agents`

Manage and run agents

Usage: wovyr agents <COMMAND>

Commands:
  run   Run an agent
  help  Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr agents run`

Run an agent

Usage: wovyr agents run [OPTIONS] --file <FILE>

Options:
  -f, --file <FILE>             Path to the agent YAML definition
      --input <INPUT>           Run input as JSON (e.g. '{"message":"Hi"}'). Plain text is also accepted [default: {}]
      --local                   Use the embedded local runtime instead of a server
      --server <SERVER>         Server base URL for a remote run. Falls back to stored credentials
      --stream                  Render the run as a live event stream (local mode only in v0.1)
      --tenant <TENANT>         Tenant the run acts in — scopes any plugin-tool secret resolution to this tenant's vault namespace (local mode; requires the `plugin-wasi` build)
      --max-steps <MAX_STEPS>   Override the model/tool iteration cap (default: 8). Raise this for tasks that need many tool calls to finish; a run that hits the cap without a final answer errors with "did not finish within N steps"
      --provider <PROVIDER>     Provider backend for a local run (local mode only). `auto` (default) mirrors `Gateway::from_env()` — OpenAI if `OPENAI_API_KEY` is set, then Anthropic if `ANTHROPIC_API_KEY` is set, else the deterministic mock. `anthropic` selects the native Messages-API provider explicitly (needs `ANTHROPIC_API_KEY`). `mistralrs` runs a real local model in-process via mistral.rs (needs a `--features mistralrs` build; first use downloads GGUF weights — see WOVYR_MISTRALRS_GGUF_REPO/_GGUF_FILE/_TOK_MODEL_ID) [default: auto]
      --interactive-ui          Register the `ui_present` tool (PRD-005 HIL-304) so the agent can show the human a generative-UI frame via an interactive stdin prompt and get a decision back — local mode only. This is the CLI's trusted-first-party context, so frames render unrestricted (no policy required); a hosted deployment never uses this presenter. Bare agent runs have no checkpoint to resume from at all, so this is not durable the way a workflow `ui` activity is — see `wovyr-tools`' `ui_present` module docs
      --allow-privileged-tools  Register the privileged builtins (`shell`, `fs_write`, `code_execute`) for this local run (SBX-305). They execute arbitrary commands, write arbitrary files, and run arbitrary code as your user with full host access, driven by whatever the model decides — so they are off by default and a manifest that names one fails closed without this flag. Intended for a single-operator trusted workstation, not a shared or multi-tenant host. Set `WOVYR_LOCAL_PRIVILEGED=1` to enable them for a whole session instead (that env var is also what the `workflows approve`/`signal`/`tick` resume paths honor, since they take no flag of their own)
  -h, --help                    Print help

`wovyr workflows`

Validate and run workflows

Usage: wovyr workflows <COMMAND>

Commands:
  validate  Compile-check a workflow definition
  run       Run a workflow with the embedded engine
  approve   Approve a suspended human task and resume the execution
  signal    Deliver a timer/event signal to a waiting execution and resume it
  status    Show an execution's live state (a side-effect-free query)
  list      List executions, optionally filtered by workflow/status
  show      Show an execution's status and full event timeline
  tick      Fire due wall-clock timers and start due schedules for a workflow
  schedule  Manage recurring schedules
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr workflows validate`

Compile-check a workflow definition

Usage: wovyr workflows validate --file <FILE>

Options:
  -f, --file <FILE>  Path to the workflow YAML definition
  -h, --help         Print help

`wovyr workflows run`

Run a workflow with the embedded engine

Usage: wovyr workflows run [OPTIONS] --file <FILE>

Options:
  -f, --file <FILE>              Path to the workflow YAML definition
      --input <INPUT>            Run input as JSON. Plain text is also accepted [default: {}]
      --local                    Use the embedded local runtime (the only supported mode in v0.2)
      --id <ID>                  Execution id (defaults to `wf-<workflow-name>`). Use to resume/approve
      --agents-dir <AGENTS_DIR>  Directory to resolve `agent`-typed activities' `name` against as `<agents-dir>/<name>.yaml` (defaults to the current directory). The server instead resolves `name` against a *stored* agent id — this is the CLI's file-based equivalent for local dev [default: .]
      --allow-privileged-tools   Register the privileged builtins (`shell`, `fs_write`, `code_execute`) for this local run (SBX-305). Off by default: they execute arbitrary commands, write arbitrary files, and run arbitrary code as your user with full host access, and a definition naming one (including inside a `for_each` body) fails closed without this flag. Intended for a single-operator trusted workstation. `WOVYR_LOCAL_PRIVILEGED=1` enables them for a whole session, including the `approve`/`signal`/`tick` resume paths, which take no flag
  -h, --help                     Print help

`wovyr workflows approve`

Approve a suspended human task and resume the execution

Usage: wovyr workflows approve [OPTIONS] --file <FILE> --id <ID> --task <TASK>

Options:
  -f, --file <FILE>          Path to the workflow YAML definition
      --id <ID>              Execution id reported by `workflows run`
      --task <TASK>          The human activity id to decide
      --decision <DECISION>  The decision to record (e.g. approved / rejected) [default: approved]
  -h, --help                 Print help

`wovyr workflows signal`

Deliver a timer/event signal to a waiting execution and resume it

Usage: wovyr workflows signal [OPTIONS] --file <FILE> --id <ID>

Options:
  -f, --file <FILE>        Path to the workflow YAML definition
      --id <ID>            Execution id reported by `workflows run`
      --event <EVENT>      Name of the event to deliver (mutually exclusive with --timer)
      --timer <TIMER>      Id of the timer to fire (mutually exclusive with --event)
      --payload <PAYLOAD>  JSON payload for an event (default null) [default: null]
  -h, --help               Print help

`wovyr workflows status`

Show an execution's live state (a side-effect-free query)

Usage: wovyr workflows status --id <ID>

Options:
      --id <ID>  Execution id reported by `workflows run`
  -h, --help     Print help

`wovyr workflows list`

List executions, optionally filtered by workflow/status

Usage: wovyr workflows list [OPTIONS]

Options:
      --workflow <WORKFLOW>  Only executions of this workflow name
      --status <STATUS>      Only executions in this status (e.g. running, completed, failed)
      --limit <LIMIT>        Cap the number of executions listed
  -h, --help                 Print help

`wovyr workflows show`

Show an execution's status and full event timeline

Usage: wovyr workflows show --id <ID>

Options:
      --id <ID>  Execution id reported by `workflows run`
  -h, --help     Print help

`wovyr workflows tick`

Fire due wall-clock timers and start due schedules for a workflow

Usage: wovyr workflows tick --file <FILE>

Options:
  -f, --file <FILE>  Path to the workflow YAML definition
  -h, --help         Print help

`wovyr workflows schedule`

Manage recurring schedules

Usage: wovyr workflows schedule <COMMAND>

Commands:
  create  Register a recurring schedule that starts a workflow on an interval
  list    List registered schedules
  help    Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr workflows schedule create`

Register a recurring schedule that starts a workflow on an interval

Usage: wovyr workflows schedule create [OPTIONS] --file <FILE> --id <ID>

Options:
  -f, --file <FILE>    Path to the workflow YAML definition
      --id <ID>        Unique schedule id (also the execution-id prefix)
      --every <EVERY>  Interval between runs, in milliseconds (mutually exclusive with --cron)
      --cron <CRON>    Cron expression (5-field or @macro, UTC; mutually exclusive with --every)
      --input <INPUT>  Run input as JSON passed to each execution [default: {}]
  -h, --help           Print help

`wovyr workflows schedule list`

List registered schedules

Usage: wovyr workflows schedule list

Options:
  -h, --help  Print help

`wovyr memory`

Store and query agent memory

Usage: wovyr memory <COMMAND>

Commands:
  put      Store a memory
  query    Query memories by relevance
  compact  Consolidate stale, low-importance memories into a summary
  help     Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr memory put`

Store a memory

Usage: wovyr memory put [OPTIONS] --content <CONTENT>

Options:
      --namespace <NAMESPACE>           Namespace to store under [default: default]
      --content <CONTENT>               The memory text
      --importance <IMPORTANCE>         Intrinsic importance in [0,1] [default: 0.5]
      --tag <TAGS>                      Tags for metadata filtering (repeatable)
      --require-scope <REQUIRE_SCOPES>  Access scope a reader must be granted to retrieve this memory (repeatable)
      --sensitive                       Seal the content at rest through the platform KMS (docs/13-security/encryption.md §4)
  -h, --help                            Print help

`wovyr memory query`

Query memories by relevance

Usage: wovyr memory query [OPTIONS] <QUERY>

Arguments:
  <QUERY>  Query text

Options:
      --namespace <NAMESPACE>  Restrict to a namespace
      --limit <LIMIT>          Maximum results [default: 5]
      --diversity <DIVERSITY>  Result diversification via MMR in [0,1] (0 = pure relevance) [default: 0]
      --strategy <STRATEGY>    Retrieval strategy: hybrid (default), vector, or keyword. Use `keyword` offline — the mock embeddings make hybrid/vector noisy
      --grant <GRANTS>         Access scope the reader holds, for ABAC filtering (repeatable)
  -h, --help                   Print help

`wovyr memory compact`

Consolidate stale, low-importance memories into a summary

Usage: wovyr memory compact [OPTIONS]

Options:
      --namespace <NAMESPACE>
          Namespace to compact [default: default]
      --max-importance <MAX_IMPORTANCE>
          Only consolidate records with importance below this [default: 0.5]
      --keep-recent <KEEP_RECENT>
          Keep the most recent N records untouched [default: 5]
  -h, --help
          Print help

`wovyr plugin`

Install and manage plugins (extension capabilities)

Usage: wovyr plugin <COMMAND>

Commands:
  new            Scaffold a new plugin project: a buildable wasm tool + manifest (digests are computed by `wovyr plugin build`, never hand-edited)
  build          Compile a plugin project to wasm32-wasip1 and stage a digest-complete package directory ready for `sign` + `install`
  keygen         Generate an ed25519 signing keypair for a publisher
  sign           Sign a plugin manifest, producing a detached signature
  keyless-init   Set up keyless trust on this node: a dev CA + the pinned trust config (`~/.wovyr/plugins/keyless.json`, ADR-0009)
  keyless-sign   Keyless-sign a plugin manifest: a short-lived identity certificate over an ephemeral key that never touches disk (ADR-0009)
  pack           Bundle a package directory into a single distributable `.wovyrpkg` file
  trust          Trust a publisher's public key so its packages verify on install
  install        Install a plugin package directory (`plugin.yaml` + `plugin.sig` + artifacts)
  upgrade        Upgrade an installed plugin to the version in a package directory
  rollback       Roll a plugin back to its previous version
  run            Invoke an enabled plugin tool capability directly (operator test path)
  list           List installed plugins
  enable         Enable an installed plugin's capabilities
  disable        Disable a plugin's capabilities (state retained)
  uninstall      Uninstall a plugin and remove its staged artifacts
  publish        Publish a package to the marketplace registry. With `--key`, also finishes preparing it first: fills in real artifact digests, signs it, and prints the trust line an operator pastes — one command instead of hand-editing digests, `sign`, and a separate `trust` step
  search         Search the marketplace registry for published plugins
  get            Download a listed package from the marketplace and install it (disabled)
  report         File an abuse report against a marketplace listing (malware, IP infringement, deceptive metadata, etc.)
  reports        List the abuse reports filed against a marketplace listing
  resolve-abuse  Resolve an open abuse report as valid, optionally delisting the listing
  dismiss-abuse  Dismiss an open abuse report as not actionable
  help           Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr plugin new`

Scaffold a new plugin project: a buildable wasm tool + manifest (digests are computed by `wovyr plugin build`, never hand-edited)

Usage: wovyr plugin new [OPTIONS] <NAME>

Arguments:
  <NAME>  Plugin name (lowercase [a-z][a-z0-9_-]*; names the crate and the capability id)

Options:
      --publisher <PUBLISHER>  Publisher identity recorded in the manifest (the signing namespace) [default: dev]
      --dir <DIR>              Parent directory to create the project under [default: .]
      --sdk-path <SDK_PATH>    Path to a local wovyr-plugin-sdk checkout, emitted as a `path` dependency — for developing against an unreleased SDK. Omit it to depend on the published crate, which is the normal case
  -h, --help                   Print help

`wovyr plugin build`

Compile a plugin project to wasm32-wasip1 and stage a digest-complete package directory ready for `sign` + `install`

Usage: wovyr plugin build [OPTIONS] [PROJECT]

Arguments:
  [PROJECT]  Plugin project directory (from `wovyr plugin new`) [default: .]

Options:
      --out <OUT>  Output package directory (defaults to `<project>/dist`)
  -h, --help       Print help

`wovyr plugin keygen`

Generate an ed25519 signing keypair for a publisher

Usage: wovyr plugin keygen [OPTIONS] <PUBLISHER>

Arguments:
  <PUBLISHER>  Publisher name the keypair signs for

Options:
      --dir <DIR>  Directory to write the `<publisher>.key` / `.pub` files into [default: .]
  -h, --help       Print help

`wovyr plugin sign`

Sign a plugin manifest, producing a detached signature

Usage: wovyr plugin sign [OPTIONS] --key <KEY> --manifest <MANIFEST>

Options:
      --key <KEY>            PKCS#8 ed25519 private key (from `keygen`)
      --manifest <MANIFEST>  Path to the plugin manifest (`plugin.yaml`)
      --out <OUT>            Output signature path (defaults to `plugin.sig` beside the manifest)
  -h, --help                 Print help

`wovyr plugin keyless-init`

Set up keyless trust on this node: a dev CA + the pinned trust config (`~/.wovyr/plugins/keyless.json`, ADR-0009)

Usage: wovyr plugin keyless-init [OPTIONS]

Options:
      --allow <ALLOW>  Identity grant as `issuer|subject|publisher` (repeatable; `subject` and `publisher` accept a trailing `*` wildcard)
  -h, --help           Print help

`wovyr plugin keyless-sign`

Keyless-sign a plugin manifest: a short-lived identity certificate over an ephemeral key that never touches disk (ADR-0009)

Usage: wovyr plugin keyless-sign [OPTIONS] --manifest <MANIFEST> --issuer <ISSUER> --subject <SUBJECT>

Options:
      --manifest <MANIFEST>  Path to the plugin manifest (`plugin.yaml`)
      --issuer <ISSUER>      Signer identity issuer (e.g. `https://ci.example.com`)
      --subject <SUBJECT>    Signer identity subject (e.g. `release@acme.dev`)
      --rekor <REKOR>        Rekor transparency-log URL to witness the signing (requires a `--features keyless-rekor` build)
      --ca-key <CA_KEY>      CA key path (defaults to `~/.wovyr/plugins/keyless-ca.key`)
  -h, --help                 Print help

`wovyr plugin pack`

Bundle a package directory into a single distributable `.wovyrpkg` file

Usage: wovyr plugin pack [OPTIONS] <DIR>

Arguments:
  <DIR>  Path to the plugin package directory

Options:
      --out <OUT>  Output file (defaults to `<name>-<version>.wovyrpkg`)
  -h, --help       Print help

`wovyr plugin trust`

Trust a publisher's public key so its packages verify on install

Usage: wovyr plugin trust --key <KEY> <PUBLISHER>

Arguments:
  <PUBLISHER>  Publisher name to trust

Options:
      --key <KEY>  Path to the publisher's raw ed25519 public key (from `keygen`)
  -h, --help       Print help

`wovyr plugin install`

Install a plugin package directory (`plugin.yaml` + `plugin.sig` + artifacts)

Usage: wovyr plugin install [OPTIONS] <DIR>

Arguments:
  <DIR>  Path to the plugin package directory

Options:
      --grant <GRANTS>  Permission to grant the plugin (repeatable); must cover all it requests
  -h, --help            Print help

`wovyr plugin upgrade`

Upgrade an installed plugin to the version in a package directory

Usage: wovyr plugin upgrade [OPTIONS] <DIR>

Arguments:
  <DIR>  Path to the new plugin package directory

Options:
      --grant <GRANTS>  Permission to grant for the new version (repeatable); covers any new perms
  -h, --help            Print help

`wovyr plugin rollback`

Roll a plugin back to its previous version

Usage: wovyr plugin rollback <ID>

Arguments:
  <ID>  Plugin id (`publisher/name`)

Options:
  -h, --help  Print help

`wovyr plugin run`

Invoke an enabled plugin tool capability directly (operator test path)

Usage: wovyr plugin run [OPTIONS] <CAPABILITY>

Arguments:
  <CAPABILITY>  Capability id to invoke (e.g. `echo.run`)

Options:
      --input <INPUT>  Request parameters as JSON (plain text also accepted) [default: {}]
  -h, --help           Print help

`wovyr plugin list`

List installed plugins

Usage: wovyr plugin list

Options:
  -h, --help  Print help

`wovyr plugin enable`

Enable an installed plugin's capabilities

Usage: wovyr plugin enable <ID>

Arguments:
  <ID>  Plugin id (`publisher/name`)

Options:
  -h, --help  Print help

`wovyr plugin disable`

Disable a plugin's capabilities (state retained)

Usage: wovyr plugin disable <ID>

Arguments:
  <ID>  Plugin id (`publisher/name`)

Options:
  -h, --help  Print help

`wovyr plugin uninstall`

Uninstall a plugin and remove its staged artifacts

Usage: wovyr plugin uninstall <ID>

Arguments:
  <ID>  Plugin id (`publisher/name`)

Options:
  -h, --help  Print help

`wovyr plugin publish`

Publish a package to the marketplace registry. With `--key`, also finishes preparing it first: fills in real artifact digests, signs it, and prints the trust line an operator pastes — one command instead of hand-editing digests, `sign`, and a separate `trust` step

Usage: wovyr plugin publish [OPTIONS] <SOURCE>

Arguments:
  <SOURCE>  Package directory (required with `--key`) or a pre-signed `.wovyrpkg` file

Options:
      --key <KEY>              PKCS#8 ed25519 signing key (from `keygen`). When given, `source` must be a directory: its artifact digests are recomputed from disk, `plugin.yaml` is rewritten, and `plugin.sig` is (re)written
      --channel <CHANNEL>      Channel to publish to (default `stable`)
      --category <CATEGORIES>  Browse category (repeatable)
  -h, --help                   Print help

`wovyr plugin search`

Search the marketplace registry for published plugins

Usage: wovyr plugin search [OPTIONS] [QUERY]

Arguments:
  [QUERY]  Free-text query (matches name/publisher/description/categories)

Options:
      --category <CATEGORY>      Filter by category
      --capability <CAPABILITY>  Filter by capability kind (tool/provider/memory_backend/policy/workflow_activity)
  -h, --help                     Print help

`wovyr plugin get`

Download a listed package from the marketplace and install it (disabled)

Usage: wovyr plugin get [OPTIONS] <ID>

Arguments:
  <ID>  Listing id (`publisher/name`)

Options:
      --version <VERSION>  Specific version (default: the latest stable)
      --grant <GRANTS>     Permission to grant the plugin (repeatable); must cover all it requests
  -h, --help               Print help

`wovyr plugin report`

File an abuse report against a marketplace listing (malware, IP infringement, deceptive metadata, etc.)

Usage: wovyr plugin report [OPTIONS] <ID> <REASON>

Arguments:
  <ID>      Listing id (`publisher/name`)
  <REASON>  Why the listing is being reported

Options:
      --reporter <REPORTER>  Reporting identity (default `anonymous`)
  -h, --help                 Print help

`wovyr plugin reports`

List the abuse reports filed against a marketplace listing

Usage: wovyr plugin reports <ID>

Arguments:
  <ID>  Listing id (`publisher/name`)

Options:
  -h, --help  Print help

`wovyr plugin resolve-abuse`

Resolve an open abuse report as valid, optionally delisting the listing

Usage: wovyr plugin resolve-abuse [OPTIONS] <ID> <REPORT_ID>

Arguments:
  <ID>         Listing id (`publisher/name`)
  <REPORT_ID>  Report id (0-based, from `plugin reports`)

Options:
      --delist                 Remove the listing from discovery/download
      --moderator <MODERATOR>  Moderating identity (default `operator`)
  -h, --help                   Print help

`wovyr plugin dismiss-abuse`

Dismiss an open abuse report as not actionable

Usage: wovyr plugin dismiss-abuse [OPTIONS] <ID> <REPORT_ID> <REASON>

Arguments:
  <ID>         Listing id (`publisher/name`)
  <REPORT_ID>  Report id (0-based, from `plugin reports`)
  <REASON>     Why the report was found not actionable

Options:
      --moderator <MODERATOR>  Moderating identity (default `operator`)
  -h, --help                   Print help

`wovyr kms`

Manage the platform KMS's tenant keys (docs/13-security/encryption.md §5)

Usage: wovyr kms <COMMAND>

Commands:
  rotate   Roll a new tenant-key version. Existing wrapped data keys remain valid under their original version — nothing already sealed is re-encrypted
  destroy  Permanently crypto-shred a tenant's key material. IRREVERSIBLE — every secret/memory ever sealed under this tenant becomes unrecoverable
  help     Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr kms rotate`

Roll a new tenant-key version. Existing wrapped data keys remain valid under their original version — nothing already sealed is re-encrypted

Usage: wovyr kms rotate --tenant <TENANT>

Options:
      --tenant <TENANT>  Tenant to rotate
  -h, --help             Print help

`wovyr kms destroy`

Permanently crypto-shred a tenant's key material. IRREVERSIBLE — every secret/memory ever sealed under this tenant becomes unrecoverable

Usage: wovyr kms destroy [OPTIONS] --tenant <TENANT>

Options:
      --tenant <TENANT>  Tenant to destroy
      --yes              Confirm the irreversible action (required)
  -h, --help             Print help

`wovyr auth`

Manage API keys for `WOVYR_AUTH_MODE=apikey` (RM-GA-P1 SEC-101)

Usage: wovyr auth <COMMAND>

Commands:
  create-key  Mint a fresh API key that authenticates as `principal`, printed once
  list-keys   List every API key's metadata (never the secret)
  revoke      Revoke an API key by its id (immediately rejected at auth)
  rotate      Rotate an API key: mint a replacement and expire the old after a grace window
  help        Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr auth create-key`

Mint a fresh API key that authenticates as `principal`, printed once

Usage: wovyr auth create-key [OPTIONS] <PRINCIPAL>

Arguments:
  <PRINCIPAL>  The principal the minted key authenticates as

Options:
      --ttl-days <TTL_DAYS>  Optional expiry in days (omit for a non-expiring key)
  -h, --help                 Print help

`wovyr auth list-keys`

List every API key's metadata (never the secret)

Usage: wovyr auth list-keys

Options:
  -h, --help  Print help

`wovyr auth revoke`

Revoke an API key by its id (immediately rejected at auth)

Usage: wovyr auth revoke <KEY_ID>

Arguments:
  <KEY_ID>  The key id (e.g. `key_ab12cd34…`), from `create-key`/`list-keys`

Options:
  -h, --help  Print help

`wovyr auth rotate`

Rotate an API key: mint a replacement and expire the old after a grace window

Usage: wovyr auth rotate [OPTIONS] <KEY_ID>

Arguments:
  <KEY_ID>  The key id to rotate

Options:
      --grace-hours <GRACE_HOURS>  Grace window in hours before the old key lapses (default 24) [default: 24]
  -h, --help                       Print help

`wovyr admin`

Backup and restore the local `~/.wovyr` state directory (RM-GA-P2 DR-1001)

Usage: wovyr admin <COMMAND>

Commands:
  backup   Snapshot `~/.wovyr` into `<dest>` (agents, secrets, memory, workflows, tenancy, kms, and every other local store), quiescing every DUR-403-locked store directory for a consistent point-in-time copy
  restore  Restore `~/.wovyr` from a backup made by `wovyr admin backup`. Overwrites the live `~/.wovyr` — irreversible for anything written there since the backup was taken
  migrate  Apply a Postgres-backed backend's versioned schema migrations (RM-GA-P3 MIG-A1). Separate from `serve`/normal CLI use, which only ever read the resulting schema version — this is the one command that needs DDL privilege on the target database
  help     Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

`wovyr admin backup`

Snapshot `~/.wovyr` into `<dest>` (agents, secrets, memory, workflows, tenancy, kms, and every other local store), quiescing every DUR-403-locked store directory for a consistent point-in-time copy

Usage: wovyr admin backup <DEST>

Arguments:
  <DEST>  Destination directory to write the backup into (created if missing), or an `s3://bucket/prefix` URI for a remote object-storage destination (needs `WOVYR_S3_ENDPOINT`/`WOVYR_S3_ACCESS_KEY_ID`/`WOVYR_S3_SECRET_ACCESS_KEY`, and optionally `WOVYR_S3_REGION`)

Options:
  -h, --help  Print help

`wovyr admin restore`

Restore `~/.wovyr` from a backup made by `wovyr admin backup`. Overwrites the live `~/.wovyr` — irreversible for anything written there since the backup was taken

Usage: wovyr admin restore [OPTIONS] <SRC>

Arguments:
  <SRC>  Source backup directory, as produced by `wovyr admin backup`, or an `s3://bucket/prefix` URI matching a remote backup's destination

Options:
      --yes   Confirm the overwrite (required)
  -h, --help  Print help

`wovyr admin migrate`

Apply a Postgres-backed backend's versioned schema migrations (RM-GA-P3 MIG-A1). Separate from `serve`/normal CLI use, which only ever read the resulting schema version — this is the one command that needs DDL privilege on the target database

Usage: wovyr admin migrate --target <TARGET> --database-url <DATABASE_URL>

Options:
      --target <TARGET>              Which backend's schema to migrate [possible values: workflow, memory, marketplace]
      --database-url <DATABASE_URL>  Postgres connection string (e.g. postgres://user:pass@host/db)
  -h, --help                         Print help