feat(cli): add pic triggers + dead-letters + secrets subcommands

Closes the audit's High-severity CLI coverage gap, raising the count
from ~25 to ~40+ subcommands and bringing the integration test count
from 63 to 73.

- pic triggers {ls, rm, create-kv, create-cron, create-dead-letter,
  create-from-json}: three per-kind wrappers cover the most common
  trigger shapes; the generic create-from-json is the escape hatch
  for docs/files/pubsub/email/queue and any future advanced retry
  knobs — body JSON inline, via @<file>, or "-" for stdin.

- pic dead-letters {ls, show, replay, resolve}: full operator
  workflow for the dispatcher's dead_letters rows, including the
  --unresolved filter and the per-row replay + manual-resolve actions.

- pic secrets {ls, set, rm}: list names + updated_at, set values
  via stdin (the only secure channel — inline values would leak
  into shell history), and delete by name. --json on set treats
  stdin as raw JSON for non-string values.

Ten new integration tests follow the established #[ignore] pattern,
gated on DATABASE_URL. All 73 ignored tests pass against the local
dev stack.

The `pic admin reset-password` server-binary subcommand exists on
the picloud binary side already; the audit's "surface it in pic
--help" note is a one-line addition deferred to Stage 6 with the
other small UX touches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/cmds/dead_letters.rs

@@ -0,0 +1,95 @@
+//! `pic dead-letters` subcommands: `ls`, `show`, `replay`, `resolve`.
+
+use anyhow::Result;
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{KvBlock, OutputMode, Table};
+
+pub async fn ls(app: &str, unresolved: bool, limit: u32, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let resp = client.dead_letters_list(app, unresolved, limit).await?;
+    let mut table = Table::new([
+        "id",
+        "source",
+        "op",
+        "attempts",
+        "resolved",
+        "last_error",
+        "created_at",
+    ]);
+    for d in resp.dead_letters {
+        let last_err = truncate(&d.last_error, 60);
+        let resolved = d.resolution.unwrap_or_else(|| "-".into());
+        table.row([
+            d.id,
+            d.source,
+            d.op,
+            d.attempt_count.to_string(),
+            resolved,
+            last_err,
+            d.created_at.to_rfc3339(),
+        ]);
+    }
+    table.print(mode);
+    Ok(())
+}
+
+pub async fn show(app: &str, dl_id: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let d = client.dead_letters_get(app, dl_id).await?;
+    let mut block = KvBlock::new();
+    block
+        .field("id", d.id)
+        .field("source", d.source)
+        .field("op", d.op)
+        .field("trigger_id", d.trigger_id.unwrap_or_else(|| "-".into()))
+        .field(
+            "script_id",
+            d.script_id
+                .map(|s| s.to_string())
+                .unwrap_or_else(|| "-".into()),
+        )
+        .field("attempt_count", d.attempt_count.to_string())
+        .field("first_attempt_at", d.first_attempt_at.to_rfc3339())
+        .field("last_attempt_at", d.last_attempt_at.to_rfc3339())
+        .field("last_error", d.last_error)
+        .field("created_at", d.created_at.to_rfc3339())
+        .field(
+            "resolved_at",
+            d.resolved_at
+                .map(|t| t.to_rfc3339())
+                .unwrap_or_else(|| "-".into()),
+        )
+        .field("resolution", d.resolution.unwrap_or_else(|| "-".into()))
+        .field("payload", d.payload.to_string());
+    block.print(mode);
+    Ok(())
+}
+
+pub async fn replay(app: &str, dl_id: &str) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    client.dead_letters_replay(app, dl_id).await?;
+    println!("Replayed dead-letter {dl_id}");
+    Ok(())
+}
+
+pub async fn resolve(app: &str, dl_id: &str, reason: &str) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    client.dead_letters_resolve(app, dl_id, reason).await?;
+    println!("Resolved dead-letter {dl_id}: {reason}");
+    Ok(())
+}
+
+fn truncate(s: &str, max: usize) -> String {
+    if s.chars().count() <= max {
+        return s.to_string();
+    }
+    let mut out: String = s.chars().take(max.saturating_sub(1)).collect();
+    out.push('…');
+    out
+}

crates/picloud-cli/src/cmds/mod.rs

@@ -1,9 +1,12 @@
 pub mod admins;
 pub mod api_keys;
 pub mod apps;
+pub mod dead_letters;
 pub mod login;
 pub mod logout;
 pub mod logs;
 pub mod routes;
 pub mod scripts;
+pub mod secrets;
+pub mod triggers;
 pub mod whoami;

crates/picloud-cli/src/cmds/secrets.rs

@@ -0,0 +1,55 @@
+//! `pic secrets` subcommands: `ls`, `set`, `rm`.
+//!
+//! Set reads the secret value from stdin (the only safe channel —
+//! inline values would leak into shell history). The value is sent
+//! as a JSON string; pass `--json` to interpret stdin as raw JSON
+//! (numbers, maps, …) instead.
+
+use std::io::Read;
+
+use anyhow::{anyhow, Context, Result};
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{OutputMode, Table};
+
+pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let resp = client.secrets_list(app).await?;
+    let mut table = Table::new(["name", "updated_at"]);
+    for s in resp.secrets {
+        table.row([s.name, s.updated_at.to_rfc3339()]);
+    }
+    table.print(mode);
+    Ok(())
+}
+
+pub async fn set(app: &str, name: &str, as_json: bool) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let mut buf = String::new();
+    std::io::stdin()
+        .read_to_string(&mut buf)
+        .context("read secret value from stdin")?;
+    let trimmed = buf.trim_end_matches(['\n', '\r']);
+    if trimmed.is_empty() {
+        return Err(anyhow!("empty stdin — secret value must not be empty"));
+    }
+    let value = if as_json {
+        serde_json::from_str(trimmed).map_err(|e| anyhow!("parse stdin as JSON: {e}"))?
+    } else {
+        serde_json::Value::String(trimmed.to_string())
+    };
+    client.secrets_set(app, name, value).await?;
+    println!("Set secret {name}");
+    Ok(())
+}
+
+pub async fn rm(app: &str, name: &str) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    client.secrets_delete(app, name).await?;
+    println!("Deleted secret {name}");
+    Ok(())
+}

crates/picloud-cli/src/cmds/triggers.rs

@@ -0,0 +1,158 @@
+//! `pic triggers` subcommands.
+//!
+//! Three per-kind create helpers cover the most common trigger shapes
+//! (KV, cron, dead_letter). For docs/files/pubsub/email/queue the
+//! generic `create-from-json` accepts a raw JSON body so headless
+//! operators don't get blocked waiting for per-kind wrappers.
+
+use anyhow::{anyhow, Context, Result};
+use serde_json::json;
+
+use crate::client::Client;
+use crate::config;
+use crate::output::{KvBlock, OutputMode, Table};
+
+pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let resp = client.triggers_list(app).await?;
+    let mut table = Table::new([
+        "id",
+        "kind",
+        "script_id",
+        "enabled",
+        "dispatch",
+        "retry_max",
+        "created_at",
+    ]);
+    for t in resp.triggers {
+        table.row([
+            t.id,
+            t.kind,
+            t.script_id.to_string(),
+            t.enabled.to_string(),
+            t.dispatch_mode,
+            t.retry_max_attempts.to_string(),
+            t.created_at.to_rfc3339(),
+        ]);
+    }
+    table.print(mode);
+    Ok(())
+}
+
+pub async fn rm(app: &str, trigger_id: &str) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    client.triggers_delete(app, trigger_id).await?;
+    println!("Deleted trigger {trigger_id}");
+    Ok(())
+}
+
+/// Common create body shape — every kind shares `script_id`,
+/// `dispatch_mode`, and the retry knobs. Per-kind fields layer on
+/// top via `serde_json::json!`.
+fn base_body(script_id: &str, dispatch: &str) -> serde_json::Value {
+    json!({
+        "script_id": script_id,
+        "dispatch_mode": dispatch,
+    })
+}
+
+pub async fn create_kv(
+    app: &str,
+    script_id: &str,
+    collection_glob: &str,
+    ops: &[String],
+    dispatch: &str,
+    mode: OutputMode,
+) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let mut body = base_body(script_id, dispatch);
+    body["collection_glob"] = json!(collection_glob);
+    if !ops.is_empty() {
+        body["ops"] = json!(ops);
+    }
+    let created = client.triggers_create(app, "kv", &body).await?;
+    print_created(&created, mode);
+    Ok(())
+}
+
+pub async fn create_cron(
+    app: &str,
+    script_id: &str,
+    schedule: &str,
+    timezone: Option<&str>,
+    dispatch: &str,
+    mode: OutputMode,
+) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let mut body = base_body(script_id, dispatch);
+    body["schedule"] = json!(schedule);
+    if let Some(tz) = timezone {
+        body["timezone"] = json!(tz);
+    }
+    let created = client.triggers_create(app, "cron", &body).await?;
+    print_created(&created, mode);
+    Ok(())
+}
+
+pub async fn create_dead_letter(
+    app: &str,
+    script_id: &str,
+    source_filter: Option<&str>,
+    trigger_id_filter: Option<&str>,
+    script_id_filter: Option<&str>,
+    dispatch: &str,
+    mode: OutputMode,
+) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let mut body = base_body(script_id, dispatch);
+    if let Some(s) = source_filter {
+        body["source_filter"] = json!(s);
+    }
+    if let Some(t) = trigger_id_filter {
+        body["trigger_id_filter"] = json!(t);
+    }
+    if let Some(s) = script_id_filter {
+        body["script_id_filter"] = json!(s);
+    }
+    let created = client.triggers_create(app, "dead_letter", &body).await?;
+    print_created(&created, mode);
+    Ok(())
+}
+
+pub async fn create_from_json(app: &str, kind: &str, body: &str, mode: OutputMode) -> Result<()> {
+    let creds = config::resolve()?;
+    let client = Client::from_creds(&creds)?;
+    let body_json: serde_json::Value = if body == "-" {
+        let mut s = String::new();
+        std::io::Read::read_to_string(&mut std::io::stdin(), &mut s)
+            .context("read body JSON from stdin")?;
+        serde_json::from_str(&s).map_err(|e| anyhow!("parse JSON from stdin: {e}"))?
+    } else if let Some(path) = body.strip_prefix('@') {
+        let raw =
+            std::fs::read_to_string(path).with_context(|| format!("read JSON body from {path}"))?;
+        serde_json::from_str(&raw).map_err(|e| anyhow!("parse JSON body in {path}: {e}"))?
+    } else {
+        serde_json::from_str(body).map_err(|e| anyhow!("parse inline JSON body: {e}"))?
+    };
+    let created = client.triggers_create(app, kind, &body_json).await?;
+    print_created(&created, mode);
+    Ok(())
+}
+
+fn print_created(t: &crate::client::TriggerDto, mode: OutputMode) {
+    let mut block = KvBlock::new();
+    block
+        .field("id", t.id.clone())
+        .field("kind", t.kind.clone())
+        .field("script_id", t.script_id.to_string())
+        .field("enabled", t.enabled.to_string())
+        .field("dispatch_mode", t.dispatch_mode.clone())
+        .field("retry_max_attempts", t.retry_max_attempts.to_string())
+        .field("created_at", t.created_at.to_rfc3339());
+    block.print(mode);
+}