@4ort/cli 0.4.0 → 0.6.0

package/dist/commands/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAuCtD,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,OAAsB;IACvE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE,eAAe,EAAE;YAC/D,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE;SAC1E,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,iCAAiC;QACjC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC;QAC9B,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,GAAG,GACP,EAAE,CAAC,MAAM,KAAK,QAAQ;gBACpB,CAAC,CAAC,kBAAkB,EAAE,CAAC,WAAW,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS;oBACvB,CAAC,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;oBACtE,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW;wBACzB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,KAAK,OAAO,GAAG,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,0BAA0B;QAC1B,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC;YAC/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,MAAM,KAAK,GACT,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,GAAG,CAAC;gBAChE,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,WAAW;gBACxD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,gBAAgB,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,SAAS,CAAC,MAAM,+CAA+C,CAAC,CAAC;YACvG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,CAAC,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/vault.d.ts

@@ -0,0 +1,7 @@
+/** Link this machine to the 4ort.ai secrets vault using a token minted from the
+ * Secrets panel. The token is stored at ~/.4ort/config.json (mode 0600). */
+export declare function vaultLogin(token: string | undefined, opts: {
+    server?: string;
+}): Promise<void>;
+export declare function vaultStatus(): void;
+export declare function vaultLogout(): void;

package/dist/commands/vault.js

@@ -0,0 +1,62 @@
+import { createInterface } from "node:readline";
+import { loadConfig, saveConfig, saveVaultConfig } from "../config.js";
+const DEFAULT_VAULT_SERVER = "https://4ort.ai";
+function readLine(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((resolve) => {
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+/** Link this machine to the 4ort.ai secrets vault using a token minted from the
+ * Secrets panel. The token is stored at ~/.4ort/config.json (mode 0600). */
+export async function vaultLogin(token, opts) {
+    const server = (opts.server || DEFAULT_VAULT_SERVER).replace(/\/$/, "");
+    let tok = token;
+    if (!tok) {
+        tok = await readLine("Paste your vault token (4vt_…): ");
+    }
+    if (!tok || !tok.startsWith("4vt_")) {
+        console.error("Expected a token starting with 4vt_. Generate one in the 4ort.ai Secrets panel.");
+        process.exit(1);
+    }
+    // Verify the token against the vault (empty resolve = a cheap auth check).
+    try {
+        const res = await fetch(`${server}/api/secrets/resolve`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${tok}` },
+            body: JSON.stringify({ refs: [] }),
+        });
+        if (!res.ok) {
+            console.error(`Vault login failed (HTTP ${res.status}). Check the token and --server.`);
+            process.exit(1);
+        }
+    }
+    catch (e) {
+        console.error(`Could not reach the vault at ${server}: ${e.message}`);
+        process.exit(1);
+    }
+    saveVaultConfig({ token: tok, server });
+    console.error(`✓ Vault linked (${server}).`);
+    console.error("Use 4ort:// references in your env, then run:  4ort run -- <command>");
+}
+export function vaultStatus() {
+    const c = loadConfig();
+    if (c?.vault?.token) {
+        console.log(`Vault: linked to ${c.vault.server} (token ${c.vault.token.slice(0, 12)}…)`);
+    }
+    else {
+        console.log("Vault: not linked. Run: 4ort vault login");
+    }
+}
+export function vaultLogout() {
+    const c = loadConfig();
+    if (c?.vault) {
+        delete c.vault;
+        saveConfig(c);
+    }
+    console.log("Vault unlinked.");
+}
+//# sourceMappingURL=vault.js.map

package/dist/commands/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/commands/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAyB,EACzB,IAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,2EAA2E;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,sBAAsB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,kCAAkC,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,mBAAmB,MAAM,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,KAAK,CAAC;QACf,UAAU,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/web.d.ts

@@ -0,0 +1,6 @@
+interface WebGetOptions {
+    json?: boolean;
+    maxChars?: string;
+}
+export declare function webGet(url: string, options: WebGetOptions): Promise<void>;
+export {};

package/dist/commands/web.js

@@ -0,0 +1,44 @@
+/**
+ * 4ort web get <url>
+ *
+ * Fetch a URL and return its readable text — "Reader Mode" style. Tiered:
+ * our own entity pages → structured record; everything else → live fetch +
+ * Mozilla Readability. No browser, no JS. On block / paywall / binary / parse
+ * failure: ok:false + the URL, so a calling agent can fall back.
+ */
+import { webRead } from "../web-client.js";
+import { printJson } from "../kg-output.js";
+export async function webGet(url, options) {
+    const maxChars = options.maxChars ? parseInt(options.maxChars, 10) : undefined;
+    const res = await webRead(url, { maxChars });
+    if (options.json) {
+        printJson(res);
+        process.exit(res.ok ? 0 : 1);
+    }
+    if (!res.ok) {
+        console.error(`✗ ${res.reason || "failed"}`);
+        console.error(`  ${res.final_url || res.url}`);
+        process.exit(1);
+    }
+    if (res.source === "4ort.xyz" && res.entity) {
+        const e = res.entity;
+        console.log(`# ${e?.name || res.title || res.url}`);
+        console.log(`(4ort.xyz knowledge-graph entity — structured)\n`);
+        if (e?.description)
+            console.log(`${e.description}\n`);
+        printJson(e);
+        return;
+    }
+    if (res.title)
+        console.log(`# ${res.title}`);
+    if (res.byline)
+        console.log(`_by ${res.byline}_`);
+    const meta = [
+        res.word_count != null ? `${res.word_count} words` : null,
+        res.truncated ? "truncated" : null,
+        res.reason || null,
+    ].filter(Boolean).join(" · ");
+    console.log(`<${res.final_url || res.url}>${meta ? `  — ${meta}` : ""}\n`);
+    console.log(res.text || "(no text extracted)");
+}
+//# sourceMappingURL=web.js.map

package/dist/commands/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../../src/commands/web.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAO5C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,OAAsB;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAa,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACtD,SAAS,CAAC,CAAC,CAAC,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,IAAI;QACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAClC,GAAG,CAAC,MAAM,IAAI,IAAI;KACnB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,qBAAqB,CAAC,CAAC;AACjD,CAAC"}

package/dist/config.d.ts

@@ -1,10 +1,48 @@
+export interface KgConfig {
+    apiKey: string;
+    recoveryCode?: string;
+    server: string;
+    name?: string;
+    tier?: string;
+}
+export interface VaultConfig {
+    token: string;
+    server: string;
+}
+export interface MovConfig {
+    server: string;
+    accessToken: string;
+    refreshToken: string;
+    clientId: string;
+    clientSecret: string;
+    username?: string;
+}
 export interface Config {
     apiKey: string;
     recoveryCode?: string;
     server: string;
     agentName: string;
+    kg?: KgConfig;
+    vault?: VaultConfig;
+    mov?: MovConfig;
 }
 export declare function loadConfig(): Config | null;
 export declare function saveConfig(config: Config): void;
+/** Save just the KG block, preserving any existing 4ort.net config. */
+export declare function saveKgConfig(kg: KgConfig): void;
 export declare function requireConfig(): Config;
+export declare function requireKgConfig(): KgConfig;
+/**
+ * Like requireKgConfig, but never exits — for public KG endpoints (e.g.
+ * /api/v1/route). Returns the KG key if present, else the 4ort.net key, else an
+ * empty key against the canonical server. Callers should treat auth as optional.
+ */
+export declare function optionalKgConfig(): KgConfig;
 export declare function getConfigPath(): string;
+/** Save just the vault block, preserving the rest of the config. */
+export declare function saveVaultConfig(vault: VaultConfig): void;
+export declare function requireVaultConfig(): VaultConfig;
+/** Save just the mov block (4ort.mov / PeerTube), preserving the rest. */
+export declare function saveMovConfig(mov: MovConfig): void;
+/** Return the mov block or exit with a friendly hint if not logged in. */
+export declare function optionalMovConfig(): MovConfig;

package/dist/config.js

@@ -1,3 +1,24 @@
+/**
+ * Persisted CLI config at ~/.4ort/config.json (mode 0600).
+ *
+ * Layout:
+ *   {
+ *     "apiKey": "...",            // 4ort.net agent key (4n_-prefixed going forward)
+ *     "recoveryCode": "...",
+ *     "server": "https://4ort.net",
+ *     "agentName": "ryan",
+ *     "kg": {                      // 4ort.xyz knowledge graph (optional)
+ *       "apiKey": "4kg_...",
+ *       "recoveryCode": "...",
+ *       "server": "https://4ort.xyz",
+ *       "name": "my-agent",
+ *       "tier": "free"
+ *     }
+ *   }
+ *
+ * Both blocks are independent — a user can sign in to 4ort.net only,
+ * 4ort.xyz only, or both. The CLI picks the right block per command.
+ */
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -16,15 +37,90 @@ export function saveConfig(config) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
 }
+/** Save just the KG block, preserving any existing 4ort.net config. */
+export function saveKgConfig(kg) {
+    const existing = loadConfig();
+    const next = existing
+        ? { ...existing, kg }
+        : { apiKey: "", server: "https://4ort.net", agentName: "", kg };
+    saveConfig(next);
+}
 export function requireConfig() {
     const config = loadConfig();
-    if (!config) {
+    if (!config || !config.apiKey) {
         console.error("Not logged in. Run: 4ort register <name>");
         process.exit(1);
+        throw new Error("unreachable");
     }
     return config;
 }
+export function requireKgConfig() {
+    const config = loadConfig();
+    if (config?.kg?.apiKey)
+        return config.kg;
+    // Fall back to 4ort.net membership if present — federated keys validate
+    // against 4ort.net automatically.
+    if (config?.apiKey) {
+        return {
+            apiKey: config.apiKey,
+            server: "https://4ort.xyz",
+        };
+    }
+    console.error("Not signed in to 4ort.xyz. Run one of:");
+    console.error("  4ort kg register     # one-shot, no email needed");
+    console.error("  4ort kg auth login   # paste an existing key");
+    process.exit(1);
+    throw new Error("unreachable");
+}
+/**
+ * Like requireKgConfig, but never exits — for public KG endpoints (e.g.
+ * /api/v1/route). Returns the KG key if present, else the 4ort.net key, else an
+ * empty key against the canonical server. Callers should treat auth as optional.
+ */
+export function optionalKgConfig() {
+    const config = loadConfig();
+    if (config?.kg?.apiKey)
+        return config.kg;
+    if (config?.apiKey)
+        return { apiKey: config.apiKey, server: "https://4ort.xyz" };
+    return { apiKey: "", server: "https://4ort.xyz" };
+}
 export function getConfigPath() {
     return CONFIG_FILE;
 }
+/** Save just the vault block, preserving the rest of the config. */
+export function saveVaultConfig(vault) {
+    const existing = loadConfig();
+    const next = existing
+        ? { ...existing, vault }
+        : { apiKey: "", server: "https://4ort.net", agentName: "", vault };
+    saveConfig(next);
+}
+export function requireVaultConfig() {
+    const config = loadConfig();
+    if (config?.vault?.token) {
+        return config.vault;
+    }
+    console.error("Not signed in to the 4ort.ai vault. Run:");
+    console.error("  4ort vault login   # paste a token from the Secrets panel");
+    process.exit(1);
+    throw new Error("unreachable");
+}
+/** Save just the mov block (4ort.mov / PeerTube), preserving the rest. */
+export function saveMovConfig(mov) {
+    const existing = loadConfig();
+    const next = existing
+        ? { ...existing, mov }
+        : { apiKey: "", server: "https://4ort.net", agentName: "", mov };
+    saveConfig(next);
+}
+/** Return the mov block or exit with a friendly hint if not logged in. */
+export function optionalMovConfig() {
+    const config = loadConfig();
+    if (config?.mov?.accessToken)
+        return config.mov;
+    console.error("Not signed in to 4ort.mov. Run: 4ort mov login");
+    process.exit(1);
+    throw new Error("unreachable");
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AASzD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAkCzD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAW,QAAQ;QAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE;QACrB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IAClE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,EAAE,CAAC;IAEzC,wEAAwE;IACxE,kCAAkC;IAClC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,EAAE,CAAC;IACzC,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAW,QAAQ;QAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE;QACxB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACrE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAW,QAAQ;QAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE;QACtB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACnE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,GAAG,EAAE,WAAW;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IAChD,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC"}

package/dist/config.mov.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config.mov.test.js

@@ -0,0 +1,23 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+test("saveMovConfig round-trips and preserves other blocks", async () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fort-"));
+    process.env.HOME = tmp; // CONFIG_DIR derives from os.homedir()
+    const cfg = await import(`./config.js?case=${Date.now()}`);
+    cfg.saveConfig({ apiKey: "x", server: "https://4ort.net", agentName: "ryan" });
+    cfg.saveMovConfig({
+        server: "https://4ort.mov",
+        accessToken: "tok",
+        refreshToken: "ref",
+        clientId: "c",
+        clientSecret: "s",
+    });
+    const loaded = cfg.loadConfig();
+    assert.equal(loaded.apiKey, "x"); // pre-existing block preserved
+    assert.equal(loaded.mov.accessToken, "tok");
+    assert.equal(loaded.mov.server, "https://4ort.mov");
+});
+//# sourceMappingURL=config.mov.test.js.map

package/dist/config.mov.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mov.test.js","sourceRoot":"","sources":["../src/config.mov.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,uCAAuC;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,aAAa,CAAC;QAChB,MAAM,EAAE,kBAAkB;QAC1B,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,GAAG;QACb,YAAY,EAAE,GAAG;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,+BAA+B;IACjE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -6,13 +6,31 @@ import { list } from "./commands/list.js";
 import { deleteSite } from "./commands/delete.js";
 import { whoami } from "./commands/whoami.js";
 import { checkMail, readMail, sendMail, deleteMail } from "./commands/mail.js";
-import { provisionService, provisionAll, provisionStatus, provisionCredentials, listServices } from "./commands/provision.js";
+import { provisionService, provisionAll, provisionStatus, provisionCredentials, listServices, } from "./commands/provision.js";
+import { kgRegister, kgLogin, kgStatus } from "./commands/kg/auth.js";
+import { kgSearch } from "./commands/kg/search.js";
+import { kgEntity } from "./commands/kg/entity.js";
+import { kgAsk } from "./commands/kg/ask.js";
+import { kgMatch } from "./commands/kg/match.js";
+import { kgPopularity } from "./commands/kg/popularity.js";
+import { kgTrending } from "./commands/kg/trending.js";
+import { kgAgentContext } from "./commands/kg/agent-context.js";
+import { kgArticleContext } from "./commands/kg/article-context.js";
+import { webGet } from "./commands/web.js";
+import { searchCommand } from "./commands/search.js";
+import { mcpStdioCommand, mcpServeCommand } from "./commands/mcp.js";
+import { vaultLogin, vaultStatus, vaultLogout } from "./commands/vault.js";
+import { runCommand } from "./commands/run.js";
+import { movLogin, movPublish, movList, movChannels, movDelete } from "./commands/mov.js";
 import { loadConfig, getConfigPath } from "./config.js";
 const program = new Command();
 program
     .name("4ort")
-    .description("CLI for 4ort.net — where AI agents build websites")
-    .version("0.1.0");
+    .description("Unified CLI for the 4ort ecosystem — hosting, knowledge graph, and more")
+    .version("0.6.0");
+// ─────────────────────────────────────────────────────────────────────
+// 4ort.net subdomain hosting
+// ─────────────────────────────────────────────────────────────────────
 program
     .command("register <name>")
     .description("Register a new agent and claim your subdomain")
@@ -23,47 +41,49 @@ program
     .command("push [directory]")
     .description("Deploy your site (defaults to current directory)")
     .action((dir = ".") => push(dir));
+program.command("list").description("List your sites").action(list);
+// ─────────────────────────────────────────────────────────────────────
+// Secrets vault — `4ort run` resolves 4ort:// references at runtime
+// ─────────────────────────────────────────────────────────────────────
+const vault = program
+    .command("vault")
+    .description("Link this machine to the 4ort.ai secrets vault");
+vault
+    .command("login [token]")
+    .description("Link the vault with a token from the Secrets panel")
+    .option("-s, --server <url>", "Vault server URL", "https://4ort.ai")
+    .action((token, opts) => vaultLogin(token, opts));
+vault.command("status").description("Show vault link status").action(vaultStatus);
+vault.command("logout").description("Unlink the vault").action(vaultLogout);
 program
-    .command("list")
-    .description("List your sites")
-    .action(list);
+    .command("run")
+    .description("Run a command with 4ort:// secret references resolved into env vars")
+    .argument("[parts...]", "command and args (use -- to separate, e.g. 4ort run -- node app.js)")
+    .action((parts) => runCommand(parts));
 program
     .command("delete [subdomain]")
     .description("Delete a site")
     .action(deleteSite);
-program
-    .command("whoami")
-    .description("Show current agent info")
-    .action(whoami);
+program.command("whoami").description("Show current agent info").action(whoami);
 const mail = program.command("mail").description("Manage your @4ort.net inbox");
 mail
     .command("inbox")
     .description("Check your inbox")
     .option("-u, --unread", "Show unread only")
     .action(checkMail);
-mail
-    .command("read <id>")
-    .description("Read a message")
-    .action(readMail);
+mail.command("read <id>").description("Read a message").action(readMail);
 mail
     .command("send <to>")
     .description("Send a message to another agent")
     .option("-s, --subject <subject>", "Subject line")
     .option("-b, --body <body>", "Message body")
     .action(sendMail);
-mail
-    .command("delete <id>")
-    .description("Delete a message")
-    .action(deleteMail);
-const provision = program.command("provision").description("Auto-provision third-party service accounts");
-provision
-    .command("run <service>")
-    .description("Provision a specific service")
-    .action(provisionService);
-provision
-    .command("all")
-    .description("Provision all available Tier A services")
-    .action(provisionAll);
+mail.command("delete <id>").description("Delete a message").action(deleteMail);
+const provision = program
+    .command("provision")
+    .description("Auto-provision third-party service accounts");
+provision.command("run <service>").description("Provision a specific service").action(provisionService);
+provision.command("all").description("Provision all available Tier A services").action(provisionAll);
 provision
     .command("status [service]")
     .description("Check provisioning status")
@@ -72,23 +92,161 @@ provision
     .command("credentials [service]")
     .description("Show stored credentials")
     .action((service) => provisionCredentials(service));
-provision
-    .command("services")
-    .description("List available services")
-    .action(listServices);
+provision.command("services").description("List available services").action(listServices);
+// ─────────────────────────────────────────────────────────────────────
+// Search — the smart router / front door (4ort.xyz entity + phonebook + web)
+// ─────────────────────────────────────────────────────────────────────
+program
+    .command("search <query>")
+    .description("Smart router: KG entity + curated sources (phonebook) + web hits")
+    .option("-p, --pages <n>", "Max web-index hits", "20")
+    .option("-s, --sources <n>", "Max authoritative-source routes", "12")
+    .option("--json", "Output the full structured payload as JSON")
+    .action(searchCommand);
+// ─────────────────────────────────────────────────────────────────────
+// 4ort knowledge graph (Popularity Graph)
+// ─────────────────────────────────────────────────────────────────────
+const kg = program
+    .command("kg")
+    .description("Query the 4ort knowledge graph (Popularity Graph)");
+kg.command("register")
+    .description("One-shot register a new 4ort.xyz API key")
+    .option("-n, --name <name>", "Display name for this key")
+    .option("-e, --email <email>", "Optional contact email for billing/recovery")
+    .option("-s, --server <url>", "KG server URL", "https://4ort.xyz")
+    .action(kgRegister);
+const kgAuth = kg.command("auth").description("Manage 4ort.xyz authentication");
+kgAuth
+    .command("login")
+    .description("Sign in by pasting an existing 4ort.xyz API key")
+    .option("-s, --server <url>", "KG server URL", "https://4ort.xyz")
+    .action(kgLogin);
+kgAuth
+    .command("status")
+    .description("Show the current 4ort.xyz identity")
+    .action(kgStatus);
+kg.command("search <query>")
+    .description("Hybrid search across the entity graph")
+    .option("-l, --limit <n>", "Max results", "20")
+    .option("--json", "Output JSON instead of a table")
+    .action(kgSearch);
+kg.command("entity <key>")
+    .description("Fetch one entity (slug, UUID, or Q-id)")
+    .option("-d, --detail <level>", "tiny | small | medium | full", "medium")
+    .option("--json", "Output JSON")
+    .action(kgEntity);
+kg.command("ask <question>")
+    .description("Ask the graph anything — streams cited tokens")
+    .option("-s, --scope <slug>", "Scope the question to one entity")
+    .option("--json", "Skip streaming, return one structured payload")
+    .option("--plain", "Strip markdown formatting (no bold, italic, code marks)")
+    .action(kgAsk);
+kg.command("match <text>")
+    .description("Resolve a string to its canonical KG entity")
+    .option("-l, --limit <n>", "Max candidates", "5")
+    .option("-t, --types <list>", "Comma-separated entity-type filter")
+    .option("--json", "Output JSON")
+    .action(kgMatch);
+kg.command("popularity <key>")
+    .description("Pageview-derived 'real-world search volume' for an entity")
+    .option("--json", "Output JSON")
+    .action(kgPopularity);
+kg.command("trending")
+    .description("Top entities by Wikipedia pageview velocity")
+    .option("-h, --hours <n>", "Window size in hours", "1")
+    .option("-l, --limit <n>", "Max results", "50")
+    .option("-d, --domain <name>", "Filter to a specific domain")
+    .option("--json", "Output JSON")
+    .action(kgTrending);
+kg.command("agent-context <key>")
+    .description("Memory-bank bundle for autonomous agents")
+    .option("--json", "Output JSON")
+    .action(kgAgentContext);
+kg.command("article-context <key>")
+    .description("Fat bundle for SEO writers — facts, citations, hooks")
+    .option("--json", "Output JSON")
+    .action(kgArticleContext);
+// ─────────────────────────────────────────────────────────────────────
+// 4ort.mov — AI-first video host (PeerTube). Publish + manage videos.
+// ─────────────────────────────────────────────────────────────────────
+const mov = program.command("mov").description("Publish and manage videos on 4ort.mov");
+mov
+    .command("login")
+    .description("Sign in to 4ort.mov (PeerTube) and store tokens")
+    .option("-s, --server <url>", "Instance URL", "https://4ort.mov")
+    .option("-u, --username <user>", "Username (non-interactive; or env FORT_MOV_USERNAME)")
+    .option("-p, --password <pass>", "Password (non-interactive; or env FORT_MOV_PASSWORD)")
+    .action(movLogin);
+mov
+    .command("publish <file>")
+    .description("Upload a video file")
+    .requiredOption("-t, --title <title>", "Video title")
+    .option("-c, --channel <name>", "Target channel (default: first channel)")
+    .option("-d, --description <text>", "Description")
+    .option("--thumbnail <file>", "Thumbnail image file")
+    .option("-p, --privacy <level>", "public|unlisted|private|internal", "unlisted")
+    .action(movPublish);
+mov.command("list").description("List your videos").action(movList);
+mov
+    .command("channels")
+    .description("List your channels (or create one with --create)")
+    .option("--create <name>", "Create a channel with this name")
+    .action(movChannels);
+mov.command("delete <id>").description("Delete a video by id").action(movDelete);
+// ─────────────────────────────────────────────────────────────────────
+// Web — read the public internet (Reader-Mode fetch, no browser)
+// ─────────────────────────────────────────────────────────────────────
+const web = program
+    .command("web")
+    .description("Read the public internet — Reader-Mode fetch, no browser/JS");
+web
+    .command("get <url>")
+    .description("Fetch a URL and return its readable text (our own pages → structured)")
+    .option("--json", "Output the structured payload as JSON")
+    .option("-m, --max-chars <n>", "Cap extracted text length (default 50000)")
+    .action(webGet);
+// ─────────────────────────────────────────────────────────────────────
+// MCP — expose search + web get + kg tools to MCP-native agents over stdio
+// ─────────────────────────────────────────────────────────────────────
+const mcp = program
+    .command("mcp")
+    .description("4ort MCP server — stdio (default), or `mcp serve` for Streamable HTTP");
+mcp
+    .command("stdio", { isDefault: true })
+    .description("Run over stdio — for Claude Desktop & local MCP clients that spawn the process")
+    .action(mcpStdioCommand);
+mcp
+    .command("serve")
+    .description("Run as a Streamable HTTP server (deploy behind a reverse proxy → mcp.4ort.xyz)")
+    .option("-p, --port <n>", "Port to listen on", "8003")
+    .option("-H, --host <addr>", "Bind address", "127.0.0.1")
+    .action(mcpServeCommand);
+// ─────────────────────────────────────────────────────────────────────
+// Config inspection
+// ─────────────────────────────────────────────────────────────────────
 program
     .command("config")
     .description("Show config location and current settings")
     .action(() => {
     const config = loadConfig();
     if (!config) {
-        console.log("Not configured. Run: 4ort register <name>");
+        console.log("Not configured. Run: 4ort register <name>  or  4ort kg register");
+        return;
+    }
+    console.log(`Config: ${getConfigPath()}`);
+    if (config.apiKey) {
+        console.log(`\n4ort.net`);
+        console.log(`  agent:    ${config.agentName || "(unset)"}`);
+        console.log(`  server:   ${config.server}`);
+        console.log(`  api key:  ${config.apiKey.slice(0, 12)}…`);
     }
-    else {
-        console.log(`Config: ${getConfigPath()}`);
-        console.log(`Agent: ${config.agentName}`);
-        console.log(`Server: ${config.server}`);
-        console.log(`API Key: ${config.apiKey.slice(0, 8)}...`);
+    if (config.kg?.apiKey) {
+        console.log(`\n4ort.xyz (knowledge graph)`);
+        console.log(`  name:     ${config.kg.name || "(unset)"}`);
+        console.log(`  server:   ${config.kg.server}`);
+        console.log(`  api key:  ${config.kg.apiKey.slice(0, 12)}…`);
+        if (config.kg.tier)
+            console.log(`  tier:     ${config.kg.tier}`);
     }
 });
 program.parse();