@cuna_labs/cli 0.1.0

package/dist/cli/command-help.js

@@ -0,0 +1,324 @@
+import { ROOT_HELP } from "./help.js";
+import { CLI_ROUTE_REGISTRY } from "./parser.js";
+/**
+ * Help for one command, and for one action within a command.
+ *
+ * `cuna machines --help` and `cuna machines list --help` both printed the root
+ * help and silently discarded the subcommand, so the flags a command requires
+ * were discoverable only by running it and reading the usage error — which
+ * names one missing option per attempt. `machines create` needs three, so a
+ * user learned the command by failing it three times.
+ *
+ * Keys are "<command>" and "<command> <action>"; the most specific match wins.
+ * Every entry is written against the option allowlist its command actually
+ * enforces in `commands/commands.ts`, so `--help` and the usage error cannot
+ * disagree about which flags exist. A test asserts that correspondence.
+ */
+const GLOBAL_OPTIONS = [
+    "Global options (valid on every command):",
+    "  --json              Emit versioned JSON records",
+    "  --profile NAME      Select one user profile",
+    "  --base-url URL      Override the API origin (custom origins need a development profile)",
+    "  --config-file PATH  Select the user configuration file",
+    "  --timeout-ms N      Bound each API request (base-10 integer, 100..120000)",
+    "  --no-color          Disable color",
+    "  --help              Show this help",
+].join("\n");
+function topic(usage, body) {
+    return `${usage}\n\n${body}\n\n${GLOBAL_OPTIONS}\n`;
+}
+const COMMAND_HELP = Object.freeze({
+    executions: topic("Usage:\n  cuna executions <list|get|cancel> --machine MACHINE_ID [options]", "Inspect remote commands by their durable execution IDs. Leader state and\nprocess ownership are separate: exited can still have live descendants.\nThese commands do not launch or repeat a command. Use an action's --help."),
+    "executions list": topic("Usage:\n  cuna executions list --machine MACHINE_ID [--execution-workspace-id ID] [--after ID]", "Read up to 50 executions on the exact Machine. Filter by an execution\nWorkspace ID, or continue with the returned --after cursor. No command content\nor output is returned. Reads remain available when new execution is unavailable."),
+    "executions get": topic("Usage:\n  cuna executions get EXECUTION_ID --machine MACHINE_ID", "Read one execution's authoritative leader and ownership states. An unknown\noutcome must be inspected; do not repeat the original command to discover it."),
+    "executions cancel": topic("Usage:\n  cuna executions cancel EXECUTION_ID --machine MACHINE_ID --yes", "Request cancellation of this execution and its descendants. --yes confirms\nthis mutation. Acceptance does not prove cleanup: inspect the same execution\nuntil ownership is cleared. Other executions and AgentSessions are not targets."),
+    signup: topic("Usage:\n  cuna signup", "Create a waitlist-only Cuna account through the browser, paste the displayed\ncuna_login_ code, and store it in the encrypted profile session. Never assigns\ncompute and never starts billing. Accepts no operands and no command options."),
+    login: topic("Usage:\n  cuna login", "Open the approved Cuna browser continuation, then paste the high-entropy\ncuna_login_ code displayed once by the page. The code is encrypted at rest in\nthe selected profile and exchanged for short-lived access in each process."),
+    logout: topic("Usage:\n  cuna logout", "Revoke the durable login-code family server-first, then delete both encrypted\nlocal session files. Accepts no operands."),
+    whoami: topic("Usage:\n  cuna whoami", "Exchange the encrypted profile login code for short-lived access and show the\nauthoritative account context. The login code is never sent as a product API\nbearer. Accepts no operands."),
+    access: topic("Usage:\n  cuna access status", "Print the account context as one tab-separated line: identity, admission, then\nworkspace state. `cuna whoami` runs the same read and prints the same line; only\nthe --json record name differs (access.status against whoami). The status action\nis required. No command options."),
+    observe: topic("Usage:\n  cuna observe --project PROJECT_ID", "Discover sessions shared with your signed-in account and select one read-only view. Requires an interactive terminal and human login. Escape or Ctrl+C closes only this local view. Reconnect requests fresh admission; no keyboard, resize or signal is sent to the agent."),
+    share: topic("Usage:\n  cuna share --project PROJECT_ID [--grant GRANT_ID]", "As the Project owner, pick one of your AgentSessions, pick a distinct member who\nalready holds observer membership, and grant read-only observation for 1, 8 or 24\nhours. The grant screen shows the exact state Cuna reports (active, revocation\nrequested but not yet effective, revoked and effective, expired); i inspects\nagain on demand and x revokes against the revision you read. --grant opens one\nexisting grant directly. Requires an interactive terminal and human login.\nThe same screen starts and stops live sharing of a session: s and e, each\nconfirmed, each stating what a watcher can and cannot see. Granting and sharing\nare separate decisions and Cuna needs both before anyone can watch; neither\nhappens as a side effect of the other.\nAn invitation or membership alone grants no observation; observation and live\nsharing grant no keyboard control. A change whose answer never arrives is shown\nas unknown and can be resent only under the same operation identity."),
+    capabilities: topic("Usage:\n  cuna capabilities [--scope SCOPE] [--resource-id ID]", [
+        "Inspect current server capability truth.",
+        "",
+        "Options:",
+        "  --scope SCOPE       account (default), machine, or agent_session",
+        "  --resource-id ID    Required when --scope is machine or agent_session,",
+        "                      and rejected when --scope is account",
+    ].join("\n")),
+    machines: topic("Usage:\n  cuna machines\n  cuna machines <list|create|start|pause|resume|stop|update-supervisor|live-update-supervisor|live-update-status|delete> [options]", [
+        "Manage owned Cuna machines. Add --help after an action for that action.",
+        "",
+        "Interactive view:",
+        "  machines                    Browse machines and their AgentSessions",
+        "                              (↑/↓ move, Enter open, n new machine, r refresh, q quit)",
+        "",
+        "Actions:",
+        "  list                        List owned machines",
+        "  create                      Create a machine when server-advertised",
+        "  start|pause|resume|stop ID  Change lifecycle when server-advertised",
+        "  update-supervisor ID         Update a stopped machine's terminal supervisor",
+        "  live-update-supervisor ID    Update a running machine's terminal supervisor",
+        "                              in place and report each AgentSession's custody",
+        "  live-update-status ID        Read what one in-place update did; sends nothing",
+        "  delete ID                   Delete when server-advertised",
+    ].join("\n")),
+    "machines list": topic("Usage:\n  cuna machines list", "List owned Cuna machines. Accepts no operands and no command options."),
+    "machines create": topic("Usage:\n  cuna machines create --name NAME --yes [options]", [
+        "Create a machine when the server advertises the capability.",
+        "",
+        "Required:",
+        "  --name NAME         1 through 80 characters, no control characters",
+        "  --yes               Confirm this mutating operation",
+        "",
+        "Options:",
+        "  --agent KIND        claude-code, codex, or opencode",
+        "  --vcpus N           Base-10 integer, 1 through 8",
+        "  --memory-mib N      Base-10 integer, 512 through 16384",
+        "  --background        Do not wait for the machine to become ready",
+        "  --idempotency-key K 8 through 128 printable ASCII characters. Generated per",
+        "                      invocation when omitted; supply it only to reconcile a",
+        "                      create whose outcome you never observed.",
+    ].join("\n")),
+    "machines start": topic("Usage:\n  cuna machines start MACHINE_ID --yes", "Start one machine when server-advertised.\n\nRequired:\n  --yes               Confirm this mutating operation"),
+    "machines pause": topic("Usage:\n  cuna machines pause MACHINE_ID --yes", "Pause one machine when server-advertised.\n\nRequired:\n  --yes               Confirm this mutating operation"),
+    "machines resume": topic("Usage:\n  cuna machines resume MACHINE_ID --yes", "Resume one machine when server-advertised.\n\nRequired:\n  --yes               Confirm this mutating operation"),
+    "machines stop": topic("Usage:\n  cuna machines stop MACHINE_ID --yes", "Stop one machine when server-advertised.\n\nRequired:\n  --yes               Confirm this mutating operation"),
+    "machines update-supervisor": topic("Usage:\n  cuna machines update-supervisor MACHINE_ID --yes", [
+        "Update the terminal supervisor on one stopped OpenCode machine when Cuna",
+        "reports that exact prerequisite.",
+        "",
+        "Cuna never stops the machine or terminates AgentSessions for this action.",
+        "End only the sessions you intend to end, stop the Machine yourself, then run it.",
+        "",
+        "Required:",
+        "  --yes               Confirm this mutating operation",
+    ].join("\n")),
+    "machines live-update-status": topic("Usage:\n  cuna machines live-update-status MACHINE_ID\n  cuna machines live-update-status MACHINE_ID --operation OPERATION_ID", [
+        "Read what one in-place supervisor update did. This sends nothing to the",
+        "machine: it dispatches no installer, starts no update and changes no state.",
+        "It is the ONLY thing that can say what an update did, and a machine that",
+        "reads as running is not evidence either way.",
+        "",
+        "Without --operation it reads the operation this computer recorded when it",
+        "sent one. An update started from another computer or from the web console",
+        "has an identity this CLI never held; name it with --operation.",
+        "",
+        "It reports the phase (claimed, control rotated, installed, settled), what",
+        "the installer did or did not do, the AgentSessions the attempt measured,",
+        "the per-session account when one has settled, any recorded refusal, and the",
+        "next action. A withheld per-session account is reported as withheld, never",
+        "expanded into unknown outcomes.",
+        "",
+        "When the next action is repeat_same_operation, resolve it with",
+        "`cuna machines live-update-supervisor MACHINE_ID --resume`, which re-sends",
+        "that same identity. Starting a different update is refused while this one",
+        "is open.",
+        "",
+        "Options:",
+        "  --operation ID      Read this exact operation instead of the recorded one",
+    ].join("\n")),
+    "machines live-update-supervisor": topic("Usage:\n  cuna machines live-update-supervisor MACHINE_ID --yes\n  cuna machines live-update-supervisor MACHINE_ID --resume [--operation OPERATION_ID]\n  cuna machines live-update-supervisor MACHINE_ID --forget-unknown", [
+        "Replace the terminal supervisor on one RUNNING machine without stopping it.",
+        "",
+        "Keeping the live AgentSessions is CONDITIONAL, never promised. Cuna measures",
+        "this machine's boot, unit, installed artifacts and every live session's",
+        "process, PTY and stored master first, the installer re-measures all of them",
+        "under the install lock before it writes, and the operation refuses before",
+        "any change when they do not hold. Nothing here relaxes the stopped-machine",
+        "action: `machines update-supervisor` keeps its own boundary.",
+        "",
+        "The answer is one custody line per AgentSession that existed beforehand:",
+        "preserved, exited, did not survive, or unknown. Anything other than",
+        "preserved is reported as such and is not a completed update.",
+        "",
+        "A successful update installs software. It grants no observation or control",
+        "of any AgentSession and signs no provider in; attach and provider login stay",
+        "exactly where they were.",
+        "",
+        "Cuna chooses an operation identity before it sends, and records it on this",
+        "computer first. That is what makes a lost answer recoverable: re-sending the",
+        "SAME identity never rotates this machine's control a second time -- it",
+        "resumes an attempt that spent nothing and reconciles one that may have spent",
+        "something. A DIFFERENT identity is refused while an update is unsettled.",
+        "",
+        "So when the answer is lost, the recovery is a read and then a repeat, never",
+        "a new update and never a fallback to stopping the machine:",
+        "  cuna machines live-update-status MACHINE_ID        (sends nothing)",
+        "  cuna machines live-update-supervisor MACHINE_ID --resume",
+        "",
+        "The record covers this machine on this API for every profile on this",
+        "computer, so --profile neither clears nor bypasses it.",
+        "",
+        "Exactly one of:",
+        "  --yes               Start a NEW update. Confirms this mutating operation.",
+        "  --resume            Re-send an operation identity instead of starting a new",
+        "                      update. A deliberate repeat, not a transport retry: the",
+        "                      transport never re-sends this request on its own. Cuna",
+        "                      reads the update first and refuses when repeating it",
+        "                      would be that identity's FIRST admission rather than",
+        "                      finishing one, and when it is already settled.",
+        "  --forget-unknown    Clear this computer's record. Reads the operation first",
+        "                      and clears it only when that operation has settled, or",
+        "                      when the account that filed the record is signed in and",
+        "                      Cuna has no such operation at all. An open one holds",
+        "                      this machine and the record holds the only identity that",
+        "                      can resolve it. Sends no mutation.",
+        "",
+        "Option:",
+        "  --operation ID      With --resume only: finish an update this computer never",
+        "                      recorded -- one started from another computer or from the",
+        "                      web console. Knowing an identity is not permission to use",
+        "                      it; Cuna answers an update outside your account exactly as",
+        "                      it answers one that does not exist.",
+        "",
+        "This operation can take minutes. --timeout-ms lowers its budget below what",
+        "the server needs and turns a slow answer into an unknown outcome -- which is",
+        "now recoverable with --resume rather than terminal.",
+    ].join("\n")),
+    "machines delete": topic("Usage:\n  cuna machines delete MACHINE_ID --yes", "Delete one machine when server-advertised.\n\nRequired:\n  --yes               Confirm this destructive operation"),
+    records: topic("Usage:\n  cuna records list", "List redacted account activity records. The list action is required. No command\noptions."),
+    authorizations: topic("Usage:\n  cuna authorizations list --machine MACHINE_ID", "List active credential injection rules for one machine.\n\nRequired:\n  --machine ID        Canonical lowercase Cuna UUID"),
+    account: topic("Usage:\n  cuna account show", "Show the public account identity. The show action is required. No command options."),
+    workspace: topic("Usage:\n  cuna workspace show", "Show workspace assignment or waitlist state. The show action is required.\nNo command options."),
+    usage: topic("Usage:\n  cuna usage show", "Show authoritative workspace estimates. The show action is required. No command\noptions."),
+    "api-keys": topic("Usage:\n  cuna api-keys <create|list|revoke> [options]", [
+        "Create, inspect and revoke API keys. Creation returns the secret exactly once; list and revoke never return it.",
+        "",
+        "Actions:",
+        "  create --name NAME --yes  Create a key from an interactive session",
+        "  list                 List API-key metadata",
+        "  revoke KEY_ID --yes  Revoke one API key when server-advertised",
+    ].join("\n")),
+    "api-keys list": topic("Usage:\n  cuna api-keys list", "List API-key metadata without secret values. No operands, no command options."),
+    "api-keys create": topic("Usage:\n  cuna api-keys create --name NAME [--expires-at RFC3339] --yes", "Create an automation credential from an interactive session. The secret is printed once and never stored by the CLI."),
+    "api-keys revoke": topic("Usage:\n  cuna api-keys revoke KEY_ID --yes", "Revoke one API key when server-advertised.\n\nRequired:\n  KEY_ID              Canonical lowercase Cuna UUID\n  --yes               Confirm this destructive operation"),
+    "agent-sessions": topic("Usage:\n  cuna agent-sessions <list|get|create|rename|terminate|attach> [options]", [
+        "Manage child agent processes. Add --help after an action for that action.",
+        "",
+        "Actions:",
+        "  list --machine ID   List child processes on one machine",
+        "  get ID              Read one child process",
+        "  create              Create a workspace-bound child when server-advertised",
+        "  rename ID --name N  Rename one child process",
+        "  terminate ID        Terminate when server-advertised",
+        "  attach ID           Attach one exact cloud session in this terminal, once",
+        "                      the server grants terminal_connections.create for it",
+    ].join("\n")),
+    "agent-sessions list": topic("Usage:\n  cuna agent-sessions list --machine MACHINE_ID [--limit N] [--cursor C]", [
+        "List child agent processes on one machine.",
+        "",
+        "Required:",
+        "  --machine ID        Opaque public Cuna machine identifier",
+        "",
+        "Options:",
+        "  --limit N           Base-10 integer, 1 through 100",
+        "  --cursor C          Opaque page cursor, at most 512 characters",
+    ].join("\n")),
+    "agent-sessions get": topic("Usage:\n  cuna agent-sessions get SESSION_ID", "Read one child process. SESSION_ID is a canonical lowercase Cuna UUID.\nNo command options."),
+    "agent-sessions create": topic("Usage:\n  cuna agent-sessions create --machine ID --workspace-binding-id ID\n                            --workspace-generation N --agent KIND --yes [options]", [
+        "Create a workspace-bound child process when server-advertised.",
+        "",
+        "Required:",
+        "  --machine ID              Opaque public Cuna machine identifier",
+        "  --workspace-binding-id ID Canonical lowercase Cuna UUID",
+        "  --workspace-generation N  Base-10 integer, 1 or greater. This is a fencing",
+        "                            token compared exactly, so an exponent or hex form",
+        "                            is rejected rather than quietly coerced.",
+        "  --agent KIND              claude-code, codex, or opencode",
+        "  --yes                     Confirm this mutating operation",
+        "",
+        "Options:",
+        "  --name NAME               1 through 80 characters",
+        "  --cwd PATH                Absolute path inside /workspace (default /workspace)",
+        "  --auth-mode MODE          interactive_login or credential_binding",
+        "  --credential-binding ID   Required exactly when --auth-mode is",
+        "                            credential_binding, and rejected otherwise",
+        "  --idempotency-key K       Generated per invocation when omitted",
+    ].join("\n")),
+    "agent-sessions rename": topic("Usage:\n  cuna agent-sessions rename SESSION_ID --name NAME --yes", "Rename one child process.\n\nRequired:\n  --name NAME         1 through 80 characters\n  --yes               Confirm this mutating operation"),
+    "agent-sessions terminate": topic("Usage:\n  cuna agent-sessions terminate SESSION_ID --yes", "Terminate one child process when server-advertised.\n\nRequired:\n  --yes               Confirm this destructive operation"),
+    "agent-sessions attach": topic("Usage:\n  cuna agent-sessions attach SESSION_ID", "Attach one exact cloud session in this terminal.\n\nThis command is routed in this build, which is not a promise that it will run.\nIt re-reads an AgentSession-scoped capability snapshot first and refuses,\nchanging nothing, when the server does not grant terminal_connections.create\nfor that session. Check it first with\n`cuna capabilities --scope agent_session --resource-id SESSION_ID`.\n\nRequires an interactive terminal; JSON and redirected output fail closed.\nNo command options."),
+    agent: topic("Usage:\n  cuna agent logout --agent-session SESSION_ID --yes", "Sign Claude Code or Codex out of one exact AgentSession.\n\nRequired:\n  --agent-session ID  Canonical lowercase Cuna UUID\n  --yes               Confirm this mutating operation"),
+    connect: topic("Usage:\n  cuna connect SESSION_ID [SESSION_ID...]", "Attach one through four exact cloud sessions in this terminal. Session IDs must\nbe distinct canonical lowercase Cuna UUIDs.\n\nRouted in this build, and still gated per session: each attach re-reads an\nAgentSession-scoped capability snapshot and refuses, changing nothing, when the\nserver does not grant terminal_connections.create for that session.\n\nRequires an interactive terminal; JSON and redirected output fail closed.\nNo command options."),
+    config: topic("Usage:\n  cuna config get", "Show effective, redacted configuration. Configuration writes are not implemented\nin this build. No command options."),
+    "config set": topic("Usage:\n  cuna config set", "Compatibility-reserved command. Configuration mutation is not implemented in this build."),
+    doctor: topic("Usage:\n  cuna doctor [--check-browser-login] [--json]", "Report platform, Node version, runtime features, and encrypted local\nsession-store state without network access by default.\n\nOptional:\n  --check-browser-login  Probe the anonymous remote browser-login bootstrap\n\nThe local AES store and remote browser-login bootstrap are reported separately.\nRun this first when a command fails with an authentication or capability error.\nAccepts no operands."),
+    "self-test": topic("Usage:\n  cuna self-test --offline", "Verify the installed CLI without network access.\n\nRequired:\n  --offline           The only mode this build implements"),
+    version: topic("Usage:\n  cuna version", "Show the CLI version, build digest, platform, and protocol range. No operands\nand no command options."),
+    shell: topic("Usage:\n  cuna shell", "Compatibility-reserved command. This build has no standalone shell runtime; use a provider terminal through `cuna`, `cuna claude`, `cuna codex`, or `cuna opencode`."),
+    sync: topic("Usage:\n  cuna sync", "Compatibility-reserved command. Workspace synchronization is composed into the provider journeys and is not exposed as a standalone command."),
+    companion: topic("Usage:\n  cuna companion", "Compatibility-reserved command. This build has no local companion process."),
+});
+function agentHelp(command) {
+    const sync = "\n  --no-sync                 Bind without synchronizing workspace contents";
+    const authOptions = command === "opencode"
+        ? [
+            "  --auth-mode MODE          interactive_login only (the default)",
+            "  Provider sign-in          In the remote OpenCode terminal, use /connect",
+            "                            to choose and sign in to a provider, then use",
+            "                            /models to select a model. Cuna does not broker",
+            "                            an OpenCode device-sign-in page. Credentials stay",
+            "                            in that remote AgentSession.",
+            "  Credential bindings       Not accepted for OpenCode.",
+        ]
+        : [
+            "  --auth-mode MODE          interactive_login or credential_binding",
+            "  --credential-binding ID   Required exactly when --auth-mode is",
+            "                            credential_binding",
+        ];
+    return topic(`Usage:\n  cuna ${command} [PATH] [--machine NAME | --new] [--new-session] [options]\n  cuna ${command} --agent-session SESSION_ID`, [
+        "Run one cloud agent from this directory, or attach one exact existing child.",
+        "",
+        "The first form validates the whole command before any effect, selects only from",
+        "fresh machine capability evidence, reconciles creation by a caller-known request",
+        "ID, binds and synchronizes the exact workspace generation, selects or creates one",
+        "AgentSession, waits for child readiness, then attaches this terminal. Ambiguous,",
+        "stale, cancelled or unknown outcomes fail closed rather than choosing a target.",
+        "",
+        "Options:",
+        "  PATH                      Local directory to bind (default: current directory)",
+        "  --machine NAME            Use one named machine",
+        "  --new                     Create a machine instead of selecting one",
+        `  --new-session             Create a child process instead of reusing one${sync}`,
+        ...authOptions,
+        "  --agent-session ID        Attach one exact child and skip reconciliation.",
+        "                            Cannot be combined with PATH, --machine, --new,",
+        "                            --new-session, --no-sync, --auth-mode or --credential-binding.",
+        "",
+        "Requires an interactive terminal; JSON and redirected output fail closed.",
+        "Ctrl+C detaches locally in one press. Use Ctrl+] c to send Ctrl+C to the agent.",
+    ].join("\n"));
+}
+/** Every topic key this module can resolve, for tests and completion. */
+export const HELP_TOPICS = Object.freeze([
+    ...Object.keys(COMMAND_HELP),
+    "claude",
+    "codex",
+    "opencode",
+]);
+/** Semantic leaves represented by complete help, derived from parser discovery. */
+export const HELP_ROUTE_KEYS = Object.freeze(CLI_ROUTE_REGISTRY.map((route) => route.key));
+/** Help for `command` plus its action operands, falling back to the root help. */
+export function commandHelp(command, operands) {
+    if (command === undefined)
+        return ROOT_HELP;
+    if (command === "claude" || command === "codex" || command === "opencode")
+        return agentHelp(command);
+    const action = operands[0];
+    if (action !== undefined) {
+        const specific = COMMAND_HELP[`${command} ${action}`];
+        if (specific !== undefined)
+            return specific;
+    }
+    return COMMAND_HELP[command] ?? ROOT_HELP;
+}
+/** The exact topic `commandHelp` resolved, for the `--json` record. */
+export function helpTopicName(command, operands) {
+    const action = operands[0];
+    if (action !== undefined && COMMAND_HELP[`${command} ${action}`] !== undefined)
+        return `${command} ${action}`;
+    return command;
+}
+//# sourceMappingURL=command-help.js.map

package/dist/cli/command-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-help.js","sourceRoot":"","sources":["../../src/cli/command-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG;IACrB,0CAA0C;IAC1C,mDAAmD;IACnD,+CAA+C;IAC/C,2FAA2F;IAC3F,0DAA0D;IAC1D,6EAA6E;IAC7E,qCAAqC;IACrC,sCAAsC;CACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,KAAK,CAAC,KAAa,EAAE,IAAY;IACxC,OAAO,GAAG,KAAK,OAAO,IAAI,OAAO,cAAc,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnE,UAAU,EAAE,KAAK,CACf,4EAA4E,EAC5E,8NAA8N,CAC/N;IACD,iBAAiB,EAAE,KAAK,CACtB,gGAAgG,EAChG,yOAAyO,CAC1O;IACD,gBAAgB,EAAE,KAAK,CACrB,iEAAiE,EACjE,2JAA2J,CAC5J;IACD,mBAAmB,EAAE,KAAK,CACxB,0EAA0E,EAC1E,2OAA2O,CAC5O;IACD,MAAM,EAAE,KAAK,CACX,uBAAuB,EACvB,6OAA6O,CAC9O;IACD,KAAK,EAAE,KAAK,CACV,sBAAsB,EACtB,qOAAqO,CACtO;IACD,MAAM,EAAE,KAAK,CACX,uBAAuB,EACvB,0HAA0H,CAC3H;IACD,MAAM,EAAE,KAAK,CACX,uBAAuB,EACvB,2LAA2L,CAC5L;IACD,MAAM,EAAE,KAAK,CACX,8BAA8B,EAC9B,sRAAsR,CACvR;IACD,OAAO,EAAE,KAAK,CAAC,6CAA6C,EAAE,6QAA6Q,CAAC;IAC5U,KAAK,EAAE,KAAK,CAAC,8DAA8D,EAAE,s9BAAs9B,CAAC;IACpiC,YAAY,EAAE,KAAK,CACjB,gEAAgE,EAChE;QACE,0CAA0C;QAC1C,EAAE;QACF,UAAU;QACV,oEAAoE;QACpE,0EAA0E;QAC1E,4DAA4D;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,QAAQ,EAAE,KAAK,CACb,6JAA6J,EAC7J;QACE,yEAAyE;QACzE,EAAE;QACF,mBAAmB;QACnB,uEAAuE;QACvE,wFAAwF;QACxF,EAAE;QACF,UAAU;QACV,mDAAmD;QACnD,uEAAuE;QACvE,uEAAuE;QACvE,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,iFAAiF;QACjF,6DAA6D;KAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,eAAe,EAAE,KAAK,CACpB,8BAA8B,EAC9B,uEAAuE,CACxE;IACD,iBAAiB,EAAE,KAAK,CACtB,4DAA4D,EAC5D;QACE,6DAA6D;QAC7D,EAAE;QACF,WAAW;QACX,sEAAsE;QACtE,uDAAuD;QACvD,EAAE;QACF,UAAU;QACV,uDAAuD;QACvD,oDAAoD;QACpD,0DAA0D;QAC1D,mEAAmE;QACnE,+EAA+E;QAC/E,8EAA8E;QAC9E,gEAAgE;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,gBAAgB,EAAE,KAAK,CACrB,gDAAgD,EAChD,+GAA+G,CAChH;IACD,gBAAgB,EAAE,KAAK,CACrB,gDAAgD,EAChD,+GAA+G,CAChH;IACD,iBAAiB,EAAE,KAAK,CACtB,iDAAiD,EACjD,gHAAgH,CACjH;IACD,eAAe,EAAE,KAAK,CACpB,+CAA+C,EAC/C,8GAA8G,CAC/G;IACD,4BAA4B,EAAE,KAAK,CACjC,4DAA4D,EAC5D;QACE,0EAA0E;QAC1E,kCAAkC;QAClC,EAAE;QACF,2EAA2E;QAC3E,kFAAkF;QAClF,EAAE;QACF,WAAW;QACX,uDAAuD;KACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,6BAA6B,EAAE,KAAK,CAClC,+HAA+H,EAC/H;QACE,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,8CAA8C;QAC9C,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,iCAAiC;QACjC,EAAE;QACF,gEAAgE;QAChE,4EAA4E;QAC5E,2EAA2E;QAC3E,UAAU;QACV,EAAE;QACF,UAAU;QACV,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,iCAAiC,EAAE,KAAK,CACtC,4NAA4N,EAC5N;QACE,6EAA6E;QAC7E,EAAE;QACF,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,8DAA8D;QAC9D,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;QACrE,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,0BAA0B;QAC1B,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,0EAA0E;QAC1E,EAAE;QACF,6EAA6E;QAC7E,4DAA4D;QAC5D,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,sEAAsE;QACtE,wDAAwD;QACxD,EAAE;QACF,iBAAiB;QACjB,6EAA6E;QAC7E,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,sEAAsE;QACtE,+EAA+E;QAC/E,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,gFAAgF;QAChF,0DAA0D;QAC1D,EAAE;QACF,SAAS;QACT,gFAAgF;QAChF,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,2DAA2D;QAC3D,EAAE;QACF,4EAA4E;QAC5E,8EAA8E;QAC9E,qDAAqD;KACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,iBAAiB,EAAE,KAAK,CACtB,iDAAiD,EACjD,mHAAmH,CACpH;IACD,OAAO,EAAE,KAAK,CACZ,6BAA6B,EAC7B,2FAA2F,CAC5F;IACD,cAAc,EAAE,KAAK,CACnB,yDAAyD,EACzD,2HAA2H,CAC5H;IACD,OAAO,EAAE,KAAK,CACZ,6BAA6B,EAC7B,oFAAoF,CACrF;IACD,SAAS,EAAE,KAAK,CACd,+BAA+B,EAC/B,gGAAgG,CACjG;IACD,KAAK,EAAE,KAAK,CACV,2BAA2B,EAC3B,2FAA2F,CAC5F;IACD,UAAU,EAAE,KAAK,CACf,wDAAwD,EACxD;QACE,iHAAiH;QACjH,EAAE;QACF,UAAU;QACV,sEAAsE;QACtE,8CAA8C;QAC9C,kEAAkE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,eAAe,EAAE,KAAK,CACpB,8BAA8B,EAC9B,+EAA+E,CAChF;IACD,iBAAiB,EAAE,KAAK,CACtB,yEAAyE,EACzE,sHAAsH,CACvH;IACD,iBAAiB,EAAE,KAAK,CACtB,6CAA6C,EAC7C,wKAAwK,CACzK;IACD,gBAAgB,EAAE,KAAK,CACrB,mFAAmF,EACnF;QACE,2EAA2E;QAC3E,EAAE;QACF,UAAU;QACV,2DAA2D;QAC3D,8CAA8C;QAC9C,6EAA6E;QAC7E,gDAAgD;QAChD,wDAAwD;QACxD,6EAA6E;QAC7E,4EAA4E;KAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,qBAAqB,EAAE,KAAK,CAC1B,kFAAkF,EAClF;QACE,4CAA4C;QAC5C,EAAE;QACF,WAAW;QACX,6DAA6D;QAC7D,EAAE;QACF,UAAU;QACV,sDAAsD;QACtD,kEAAkE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,oBAAoB,EAAE,KAAK,CACzB,8CAA8C,EAC9C,6FAA6F,CAC9F;IACD,uBAAuB,EAAE,KAAK,CAC5B,gKAAgK,EAChK;QACE,gEAAgE;QAChE,EAAE;QACF,WAAW;QACX,mEAAmE;QACnE,2DAA2D;QAC3D,8EAA8E;QAC9E,gFAAgF;QAChF,sEAAsE;QACtE,6DAA6D;QAC7D,6DAA6D;QAC7D,EAAE;QACF,UAAU;QACV,qDAAqD;QACrD,kFAAkF;QAClF,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;KACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;IACD,uBAAuB,EAAE,KAAK,CAC5B,mEAAmE,EACnE,8IAA8I,CAC/I;IACD,0BAA0B,EAAE,KAAK,CAC/B,0DAA0D,EAC1D,4HAA4H,CAC7H;IACD,uBAAuB,EAAE,KAAK,CAC5B,iDAAiD,EACjD,2eAA2e,CAC5e;IACD,KAAK,EAAE,KAAK,CACV,8DAA8D,EAC9D,mLAAmL,CACpL;IACD,OAAO,EAAE,KAAK,CACZ,mDAAmD,EACnD,ocAAoc,CACrc;IACD,MAAM,EAAE,KAAK,CACX,2BAA2B,EAC3B,sHAAsH,CACvH;IACD,YAAY,EAAE,KAAK,CACjB,2BAA2B,EAC3B,0FAA0F,CAC3F;IACD,MAAM,EAAE,KAAK,CACX,wDAAwD,EACxD,kZAAkZ,CACnZ;IACD,WAAW,EAAE,KAAK,CAChB,oCAAoC,EACpC,0HAA0H,CAC3H;IACD,OAAO,EAAE,KAAK,CACZ,wBAAwB,EACxB,wGAAwG,CACzG;IACD,KAAK,EAAE,KAAK,CACV,sBAAsB,EACtB,sKAAsK,CACvK;IACD,IAAI,EAAE,KAAK,CACT,qBAAqB,EACrB,8IAA8I,CAC/I;IACD,SAAS,EAAE,KAAK,CACd,0BAA0B,EAC1B,4EAA4E,CAC7E;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,OAAwC;IACzD,MAAM,IAAI,GAAG,6EAA6E,CAAC;IAC3F,MAAM,WAAW,GAAG,OAAO,KAAK,UAAU;QACxC,CAAC,CAAC;YACE,kEAAkE;YAClE,2EAA2E;YAC3E,2EAA2E;YAC3E,6EAA6E;YAC7E,+EAA+E;YAC/E,0DAA0D;YAC1D,wDAAwD;SACzD;QACH,CAAC,CAAC;YACE,qEAAqE;YACrE,kEAAkE;YAClE,gDAAgD;SACjD,CAAC;IACN,OAAO,KAAK,CACV,kBAAkB,OAAO,sEAAsE,OAAO,6BAA6B,EACnI;QACE,8EAA8E;QAC9E,EAAE;QACF,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,EAAE;QACF,UAAU;QACV,kFAAkF;QAClF,mDAAmD;QACnD,uEAAuE;QACvE,4EAA4E,IAAI,EAAE;QAClF,GAAG,WAAW;QACd,6EAA6E;QAC7E,6EAA6E;QAC7E,4FAA4F;QAC5F,EAAE;QACF,2EAA2E;QAC3E,iFAAiF;KAClF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1D,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAsB,MAAM,CAAC,MAAM,CAC7D,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAC7C,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE,QAA2B;IAClF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;IAC9C,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AAC5C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAA2B;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;IAC9G,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/help.d.ts

@@ -0,0 +1,40 @@
+/** Commands printed by first-run help, ending in the guided root journey. */
+export declare const FIRST_RUN_TRANSCRIPT: readonly (readonly string[])[];
+/**
+ * Render primary discovery as the intersection of this build's provider routes
+ * and the caller's set.
+ *
+ * WHAT THE DEFAULT MEANS. Help is rendered offline, before any credential or
+ * capability request, so the only authority available to it is this build's
+ * route registry. The default therefore lists every ROUTED provider and makes
+ * no claim at all about what the server currently serves. It is not a
+ * capability filter, and the earlier comment here claimed it was one: it said
+ * this call "keeps OpenCode hidden until both halves actually exist" while
+ * production's only call site is `renderShortHelp()` with no argument, whose
+ * default is derived from the same registry it filters — a tautology that
+ * could never hide anything.
+ *
+ * The parameter is still real, and narrower than the default: a caller holding
+ * a live capability snapshot may pass the subset it proves. Nothing in this
+ * package does that today.
+ */
+export declare function renderShortHelp(routedProviderCommands?: readonly string[]): string;
+export declare const SHORT_HELP: string;
+/**
+ * The marker legend, printed immediately above the reference.
+ *
+ * Without it the bracketed word reads as a status, and a status is exactly what
+ * this CLI cannot know before it asks. Naming the authority in the same breath
+ * is the whole repair.
+ */
+export declare const COMMAND_REFERENCE_LEGEND = "  [routed]   this build dispatches the command\n  [reserved] this build accepts the name and refuses\n  Neither marker is a server answer. Run `cuna capabilities` for what the\n  server currently proves for your account, machine, or AgentSession.\n";
+/** One generated line per semantic parser route; tests parse these markers. */
+export declare const COMPLETE_COMMAND_REFERENCE: string;
+export declare const FULL_HELP: string;
+/**
+ * The root topic. Bare \`cuna\` and \`cuna --help\` answer with the short
+ * orientation; \`cuna help --all\` and \`cuna --help --all\` answer with the
+ * complete surface. Per-command help is unaffected.
+ */
+export declare const ROOT_HELP: string;
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAyDA,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAG7D,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,sBAAsB,GAAE,SAAS,MAAM,EAA8B,GACpE,MAAM,CA6BR;AAED,eAAO,MAAM,UAAU,QAAoB,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,6PAIpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QAE1B,CAAC;AAEd,eAAO,MAAM,SAAS,QAgIrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,QAAa,CAAC"}