CLI Reference

Yamlr is architected as a high-performance native systems binary (yamlr v0.1.0). This guide details the canonical commands, governance operations, and institutional flags supported by the engine.

1. Core Resolution & Verification

Use these commands for pre-flight safety analysis, schema verification, and deterministic remediation.

`yamlr scan [path]`

Audits manifests for schema violations, deprecation drift, and cross-resource topological integrity faults.

bash
# Audit the current directory (defaults to Kubernetes 1.30 schema)
yamlr scan .

# Enforce strict CI gating (exits 1 on errors)
yamlr scan manifests/ --fail-on error

# Target specific Kubernetes OpenAPI version
yamlr scan manifests/ -k 1.31

# Standardize output for CI ingestion (SARIF 2.1.0 for GitHub Security tab)
yamlr scan manifests/ -o sarif > results.sarif

`yamlr heal [path]`

Deterministically repairs identified Kubernetes misconfigurations while preserving original comments, key order, and indentation.

bash
# Preview unified color diff of all proposed remediations without modifying files
yamlr heal manifests/ --dry-run
# or alias:
yamlr diff manifests/

# Apply verified remediations atomically to disk
yamlr heal manifests/ --apply

# Non-destructive rapid repair of syntax and deprecated API versions
yamlr fix manifests/

`yamlr fmt [path]`

Canonical Kubernetes manifest formatter. Normalizes YAML key order according to official Kubernetes schema standards (e.g. apiVersion, kind, metadata, spec, status).

bash
# Format manifests in-place
yamlr fmt manifests/ -w

2. Institutional Governance & Topology

Commands designed for platform teams, multi-repo GitOps workflows, and cryptographic provenance.

`yamlr rollback [path]`

Instantly rolls back modified files to their previous verified state using the atomic Write-Ahead Log (WAL) journal located in .yamlr/wal/.

bash
# Roll back the most recent heal operation
yamlr rollback manifests/

`yamlr sign [path]` & `yamlr verify [path]`

Cryptographically signs manifests using HMAC-SHA256 to generate tamper-proof provenance proofs, and verifies signatures against cluster tampering.

bash
# Sign manifest directory
yamlr sign manifests/ --secret-env YAMLR_SIGNING_KEY

# Forensically verify signatures in deployment pipeline
yamlr verify manifests/ --secret-env YAMLR_SIGNING_KEY

`yamlr graph [path]`

Generates a directed relational dependency graph of the cluster's topology, mapping Service-to-Pod selector bindings, ConfigMap mounts, and Ingress route targets.

bash
# Output topological dependency graph in JSON format
yamlr graph manifests/ -o json

`yamlr drift [path]`

Detects API version deprecation drift, obsolete resource kinds, and circular reference loops across manifests.

bash
yamlr drift manifests/

`yamlr dna [path]`

Computes the cryptographic structural DNA fingerprint of manifests, abstracting away cosmetic whitespace to detect actual semantic mutations.

bash
yamlr dna manifests/

`yamlr fleet`

Enterprise multi-repository GitOps automation engine. Ingests a repository manifest file, applies targeted remediations across multiple worktrees, and submits isolated pull requests.

bash
yamlr fleet --targets repos.yaml --pr

`yamlr vap`

Ingests or exports Kubernetes 1.30+ ValidatingAdmissionPolicy resources directly to and from Yamlr rules.

bash
yamlr vap export --output policies/

3. Integrations & Developer Daemon

Embed Yamlr into IDEs, local loops, or admission webhooks.

`yamlr lsp`

Runs the native Language Server Protocol (LSP) daemon over stdio JSON-RPC for real-time diagnostic squiggles and code actions in VS Code, Neovim, and JetBrains.

`yamlr mcp`

Runs the Model Context Protocol (MCP) server, allowing AI coding assistants to invoke Yamlr's deterministic healing engine safely.

`yamlr watch [path]`

Continuous filesystem watcher that triggers instant incremental scans upon file save (<15ms latency).

bash
yamlr watch ./manifests

`yamlr webhook`

Runs the in-cluster admission controller daemon (validating and mutating webhook) for runtime cluster guardrails.

`yamlr doctor`

Validates engine binary integrity, loaded OpenAPI schemas, and platform dependencies.

bash
yamlr doctor

`yamlr auth [subcommand]`

Inspects local license status, activates team credentials, or ingests air-gapped cryptographic enterprise license tokens.

bash
# Inspect active license status
yamlr auth status

# Ingest air-gapped offline token
yamlr auth offline --token <BASE64_TOKEN>

4. Standard Options & Flag Reference

Flag	Shorthand	Description	Default
`--k8s-version <VER>`	`-k`	Target Kubernetes OpenAPI schema version	`1.30`
`--output <FORMAT>`	`-o`	Output format: `text`, `json`, `sarif`	`text`
`--apply`	`-a`	Write healed manifests directly to disk	`false`
`--dry-run`	`-d`	Preview remediations without touching disk	`false`
`--fail-on <SEV>`		Exit code 1 trigger: `error`, `warning`, `info`, `none`	`error`
`--quiet`	`-q`	Suppress non-essential output for silent CI execution	`false`
`--json`	`-j`	Structured JSON output for telemetry and automation	`false`
`--version`	`-v`	Display engine release version, architecture, and build hash

CLI Reference

1. Core Resolution & Verification

yamlr scan [path]

yamlr heal [path]

yamlr fmt [path]

2. Institutional Governance & Topology

yamlr rollback [path]

yamlr sign [path] & yamlr verify [path]

yamlr graph [path]

yamlr drift [path]

yamlr dna [path]

yamlr fleet

yamlr vap