@graphorin/cli 0.5.0

package/dist/bin/graphorin.js

@@ -0,0 +1,606 @@
+#!/usr/bin/env node
+import { runAuditExport, runAuditPrune, runAuditVerify } from "../commands/audit.js";
+import { isOfflineMode } from "../internal/offline.js";
+import { runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "../commands/auth.js";
+import { runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "../commands/consolidator.js";
+import { runDoctor } from "../commands/doctor.js";
+import { runGuardExplain, runGuardStatus } from "../commands/guard.js";
+import { runInit } from "../commands/init.js";
+import { runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy } from "../commands/memory.js";
+import { runStart } from "../commands/start.js";
+import { runMigrate } from "../commands/migrate.js";
+import { runMigrateConfig } from "../commands/migrate-config.js";
+import { runMigrateExport } from "../commands/migrate-export.js";
+import { runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus } from "../commands/pricing.js";
+import { runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet } from "../commands/secrets.js";
+import { runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter } from "../commands/skills.js";
+import { runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus } from "../commands/storage.js";
+import { runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus } from "../commands/telemetry.js";
+import { runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify } from "../commands/token.js";
+import { runToolsLint } from "../commands/tools-lint.js";
+import { runTracesPrune, runTracesStatus } from "../commands/traces.js";
+import { runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus } from "../commands/triggers.js";
+import { VERSION } from "../index.js";
+import process from "node:process";
+import { Command } from "commander";
+
+//#region src/bin/graphorin.ts
+/**
+* `graphorin` CLI entry point. Built into `dist/bin/graphorin.js`
+* with a shebang prepended by `tsdown`; the `package.json` `bin`
+* field points npm at the compiled file.
+*
+* Phase 14a installs three subcommands grouped by lifecycle phase:
+*
+*   Bootstrap:
+*     - graphorin init
+*
+*   Maintenance:
+*     - graphorin migrate
+*
+*   Runtime:
+*     - graphorin start
+*
+* Phase 15 extends this binary with the full operator surface
+* (`doctor`, `token`, `secrets`, `audit`, `storage`, `memory`,
+* `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`,
+* `migrate-export`, `migrate-config`, `guard`, `telemetry`,
+* `tools lint`).
+*
+* `GRAPHORIN_OFFLINE=1` is honoured by every subcommand — the v0.1
+* surface never makes implicit network calls. Phase 15 commands that
+* do touch the network (e.g. `graphorin pricing refresh`) consult
+* the same flag through the helper in `../internal/offline.ts`.
+*
+* @packageDocumentation
+*/
+async function main() {
+	const program = new Command();
+	program.name("graphorin").description([
+		"Operator CLI for the Graphorin framework.",
+		"",
+		"Commands grouped by purpose:",
+		"  Bootstrap:    init, migrate, migrate-config",
+		"  Runtime:      start",
+		"  Diagnostics:  doctor, telemetry, traces, guard",
+		"  Auth:         token, secrets, auth",
+		"  Storage:      storage, audit, memory, consolidator, triggers, migrate-export",
+		"  Catalogue:    pricing, skills, tools",
+		"",
+		"Honours GRAPHORIN_OFFLINE=1 — the v0.1 surface never makes implicit network calls."
+	].join("\n")).version(VERSION);
+	registerLifecycleCommands(program);
+	registerDoctorCommand(program);
+	registerTokenCommands(program);
+	registerSecretsCommands(program);
+	registerStorageCommands(program);
+	registerAuditCommands(program);
+	registerMemoryCommands(program);
+	registerConsolidatorCommands(program);
+	registerTriggersCommands(program);
+	registerAuthCommands(program);
+	registerPricingCommands(program);
+	registerSkillsCommands(program);
+	registerTracesCommands(program);
+	registerMigrateExportCommand(program);
+	registerMigrateConfigCommand(program);
+	registerGuardCommands(program);
+	registerTelemetryCommands(program);
+	registerToolsCommands(program);
+	await program.parseAsync(process.argv);
+}
+function registerLifecycleCommands(program) {
+	program.command("start").description("[Runtime] Start the @graphorin/server daemon.").option("-c, --config <path>", "Path to the graphorin.config file (TS / JS / JSON).").option("-h, --host <host>", "Override the configured listen host.").option("-p, --port <port>", "Override the configured listen port.", (value) => Number.parseInt(value, 10)).option("--secrets-source <kind>", "Override secrets.source: auto | keyring | encrypted-file | env (DEC-136).").option("--strict-secrets", "Refuse to fall back to a different secrets store (DEC-136).").action(async (opts) => {
+		if (isOfflineMode()) process.stderr.write("[graphorin/cli] GRAPHORIN_OFFLINE=1 — running with no implicit network calls.\n");
+		await runStart({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.host !== void 0 ? { host: opts.host } : {},
+			...opts.port !== void 0 ? { port: opts.port } : {},
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {}
+		});
+	});
+	program.command("init").description("[Bootstrap] Generate a fresh graphorin.config.ts and a one-shot bootstrap admin token.").option("-o, --out <path>", "Output path; defaults to ./graphorin.config.ts.").option("--non-interactive", "Accept defaults / env vars without prompting.", false).option("--cloud-consent <tier>", "Cloud-upload consent tier: public-only | public-and-internal | all-with-warnings.").option("--encrypted", "Enable storage encryption opt-in.").option("--no-encrypted", "Disable storage encryption opt-in.").action(async (opts) => {
+		if (isOfflineMode()) process.stderr.write("[graphorin/cli] GRAPHORIN_OFFLINE=1 — init never reaches the network.\n");
+		await runInit({
+			...opts.out !== void 0 ? { out: opts.out } : {},
+			...opts.nonInteractive !== void 0 ? { nonInteractive: opts.nonInteractive } : {},
+			...opts.cloudConsent !== void 0 ? { cloudConsent: opts.cloudConsent } : {},
+			...opts.encrypted !== void 0 ? { encrypted: opts.encrypted } : {}
+		});
+	});
+	program.command("migrate").description("[Maintenance] Apply pending storage migrations against the configured SQLite store.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--target <version>", "Reserved for the Phase 15 partial-migration runner.").action(async (opts) => {
+		if (isOfflineMode()) process.stderr.write("[graphorin/cli] GRAPHORIN_OFFLINE=1 — migrate is a local-only operation.\n");
+		await runMigrate({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.target !== void 0 ? { target: opts.target } : {}
+		});
+	});
+}
+function registerDoctorCommand(program) {
+	program.command("doctor").description("[Diagnostics] Health check (perms + secrets + encryption + systemd).").option("--fix-perms", "Repair drifted POSIX file modes.").option("--check-perms", "Run the file-perms check.").option("--check-secrets", "Run the secrets-store check.").option("--check-encryption", "Run the audit-encryption check.").option("--check-systemd", "Run the systemd-hardening check (Linux only).").option("--all", "Run every check.").option("--json", "Emit a structured JSON report on stdout.").action(async (opts) => {
+		await runDoctor({
+			...opts.fixPerms !== void 0 ? { fixPerms: opts.fixPerms } : {},
+			...opts.checkPerms !== void 0 ? { checkPerms: opts.checkPerms } : {},
+			...opts.checkSecrets !== void 0 ? { checkSecrets: opts.checkSecrets } : {},
+			...opts.checkEncryption !== void 0 ? { checkEncryption: opts.checkEncryption } : {},
+			...opts.checkSystemd !== void 0 ? { checkSystemd: opts.checkSystemd } : {},
+			...opts.all !== void 0 ? { all: opts.all } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerTokenCommands(program) {
+	const token = program.command("token").description("[Auth] Manage server auth tokens.");
+	token.command("create").description("Mint a new token. Prints the raw value once.").requiredOption("--scopes <list>", "Comma-separated scope list.").option("--label <name>", "Optional label.").option("--expires-in <duration>", "Duration string: 30d, 12h, 90m, 45s.").option("--env <env>", "Token environment: live | test.", "live").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTokenCreate({
+			scopes: opts.scopes.split(",").map((s) => s.trim()).filter(Boolean),
+			...opts.label !== void 0 ? { label: opts.label } : {},
+			...opts.expiresIn !== void 0 ? { expiresIn: opts.expiresIn } : {},
+			...opts.env !== void 0 ? { env: opts.env } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	token.command("list").description("List token metadata.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--include-revoked", "Include revoked tokens.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTokenList({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.includeRevoked !== void 0 ? { includeRevoked: opts.includeRevoked } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	token.command("revoke <id>").description("Revoke a single token.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (id, opts) => {
+		await runTokenRevoke({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	token.command("rotate <id>").description("Revoke + reissue a token with the same scopes.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--env <env>", "Token environment: live | test.", "live").option("--json", "Emit a structured JSON document on stdout.").action(async (id, opts) => {
+		await runTokenRotate({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.env !== void 0 ? { env: opts.env } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	token.command("rekey").description("Re-issue every active token (use after a known compromise).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--env <env>", "Token environment: live | test.", "live").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTokenRekey({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.env !== void 0 ? { env: opts.env } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	token.command("verify <token>").description("Offline checksum verification — never consults the store.").option("--prefix <prefix>", "Override the expected token prefix.").option("--json", "Emit a structured JSON document on stdout.").action((tok, opts) => {
+		runTokenVerify({
+			token: tok,
+			...opts.prefix !== void 0 ? { prefix: opts.prefix } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerSecretsCommands(program) {
+	const secrets = program.command("secrets").description("[Auth] Manage secrets in the configured store.");
+	const commonOpts = (cmd) => cmd.option("--secrets-source <kind>", "auto | keyring | encrypted-file | env (DEC-136).").option("--strict-secrets", "Refuse to fall back to a different secrets store.").option("--json", "Emit a structured JSON document on stdout.");
+	commonOpts(secrets.command("list").description("List secret metadata.")).action(async (opts) => {
+		await runSecretsList({
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	commonOpts(secrets.command("get <key>").description("Read a secret. Use --reveal to print the bytes.").option("--reveal", "Print the raw value.")).action(async (key, opts) => {
+		await runSecretsGet({
+			key,
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {},
+			...opts.reveal !== void 0 ? { reveal: opts.reveal } : {}
+		});
+	});
+	commonOpts(secrets.command("set <key>").description("Persist a secret. Pass --value <v> or --from-stdin.").option("--value <v>", "Inline value.").option("--from-stdin", "Read the value from stdin.")).action(async (key, opts) => {
+		await runSecretsSet({
+			key,
+			...opts.value !== void 0 ? { value: opts.value } : {},
+			...opts.fromStdin !== void 0 ? { fromStdin: opts.fromStdin } : {},
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	commonOpts(secrets.command("delete <key>").description("Delete a secret.")).action(async (key, opts) => {
+		await runSecretsDelete({
+			key,
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	commonOpts(secrets.command("ref <uri>").description("Test resolution of a SecretRef URI.").option("--reveal", "Include the resolved value in the report.")).action(async (uri, opts) => {
+		await runSecretsRef({
+			uri,
+			...opts.reveal !== void 0 ? { reveal: opts.reveal } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	commonOpts(secrets.command("rotate <key>").description("Replace an existing secret with a fresh value.").option("--new-value <v>", "Inline new value.").option("--from-stdin", "Read the new value from stdin.")).action(async (key, opts) => {
+		await runSecretsRotate({
+			key,
+			...opts.newValue !== void 0 ? { newValue: opts.newValue } : {},
+			...opts.fromStdin !== void 0 ? { fromStdin: opts.fromStdin } : {},
+			...opts.secretsSource !== void 0 ? { secretsSource: opts.secretsSource } : {},
+			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerStorageCommands(program) {
+	const storage = program.command("storage").description("[Storage] SQLite + encryption-at-rest commands.");
+	storage.command("status").description("Report current store state + cipher peer availability.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runStorageStatus({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	storage.command("encrypt").description("Encrypt the store. Requires the @graphorin/store-sqlite-encrypted sub-pack (Phase 16).").requiredOption("--passphrase-from <ref>", "SecretRef URI for the new passphrase.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--target-path <path>", "Override the encrypted output path. Default <storage>.encrypted.").option("--swap", "Atomically swap the encrypted output into the storage path; original kept under .bak.<ts>.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runStorageEncrypt({
+			passphraseFrom: opts.passphraseFrom,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.targetPath !== void 0 ? { targetPath: opts.targetPath } : {},
+			...opts.swap === true ? { swap: true } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	storage.command("rekey").description("Rekey an already-encrypted store.").requiredOption("--old-passphrase-from <ref>", "SecretRef URI for the existing passphrase.").requiredOption("--new-passphrase-from <ref>", "SecretRef URI for the new passphrase.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runStorageRekey({
+			oldPassphraseFrom: opts.oldPassphraseFrom,
+			newPassphraseFrom: opts.newPassphraseFrom,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	storage.command("cleanup-backups").description("Drop stale .bak / .tmp.<ts> files left by previous encrypt / rekey runs.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--dry-run", "Print what would be removed without touching the filesystem.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runStorageCleanupBackups({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.dryRun !== void 0 ? { dryRun: opts.dryRun } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerAuditCommands(program) {
+	const audit = program.command("audit").description("[Storage] Operate on the encrypted audit log.");
+	audit.command("verify").description("Replay the chain and report the first broken link (if any).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runAuditVerify({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	audit.command("prune").description("Drop entries older than --before (cutoff is required).").requiredOption("--before <date>", "ISO date / epoch ms cutoff.").option("--retain <n>", "Minimum number of entries that must survive.", (v) => Number.parseInt(v, 10)).option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runAuditPrune({
+			before: opts.before,
+			...opts.retain !== void 0 ? { retain: opts.retain } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	audit.command("export").description("Stream every audit entry as JSONL into --to.").requiredOption("--to <file>", "Output path.").option("--from-seq <n>", "Lower bound (inclusive).", (v) => Number.parseInt(v, 10)).option("--to-seq <n>", "Upper bound (inclusive).", (v) => Number.parseInt(v, 10)).option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runAuditExport({
+			to: opts.to,
+			...opts.fromSeq !== void 0 ? { fromSeq: opts.fromSeq } : {},
+			...opts.toSeq !== void 0 ? { toSeq: opts.toSeq } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerMemoryCommands(program) {
+	const memory = program.command("memory").description("[Storage] Long-term memory operator commands.");
+	memory.command("status").description("Report counts + active embedder + migration state.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runMemoryStatus({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	memory.command("migrate").description("Embedder swap. Requires --embedders module that exports the factories.").requiredOption("--from <id>", "Source embedder id.").requiredOption("--to <id>", "Target embedder id.").requiredOption("--strategy <s>", "lock-on-first | auto-migrate | multi-active.").option("--embedders <path>", "Path to a module exporting embedder factories.").option("-c, --config <path>", "Path to the graphorin.config file.").action(async (opts) => {
+		await runMemoryMigrate({
+			from: opts.from,
+			to: opts.to,
+			strategy: opts.strategy,
+			...opts.embedders !== void 0 ? { embeddersModule: opts.embedders } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {}
+		});
+	});
+	memory.command("inspect").description("Inspect one fact: supersede chain, quarantine, conflicts, citing insights.").argument("<factId>", "Id of the fact to inspect.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (factId, opts) => {
+		await runMemoryInspect({
+			factId,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	memory.command("activity").description("Store-wide consolidator / reflection activity: quarantine, history, conflicts.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--limit <n>", "Cap on recent history / conflict rows (default 20).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
+		await runMemoryActivity({
+			...limit !== void 0 && Number.isFinite(limit) ? { limit } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	memory.command("why").description("Explain why facts were recalled (ranking signals) from the persisted recall spans.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--session <id>", "Restrict to one session's recall spans.").option("--limit <n>", "Cap on the most-recent recall spans (default 5).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
+		await runMemoryWhy({
+			...opts.session !== void 0 ? { sessionId: opts.session } : {},
+			...limit !== void 0 && Number.isFinite(limit) ? { limit } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	memory.command("review").description("List quarantined memory by tier, or promote a reviewed item with --promote.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--limit <n>", "Cap on rows listed per type (default 20).").option("--promote <id>", "Promote this quarantined memory id out of quarantine.").option("--reason <text>", "Audit reason recorded with the promotion.").option("--force", "Override the injection-refusal gate (operator action, after review).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
+		await runMemoryReview({
+			...limit !== void 0 && Number.isFinite(limit) ? { limit } : {},
+			...opts.promote !== void 0 ? { promote: opts.promote } : {},
+			...opts.reason !== void 0 ? { reason: opts.reason } : {},
+			...opts.force !== void 0 ? { force: opts.force } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerConsolidatorCommands(program) {
+	const c = program.command("consolidator").description("[Storage] Inspect and steer the memory consolidator.");
+	c.command("status").description("Current tier hint + DLQ size + recent run history.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runConsolidatorStatus({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	c.command("set-tier <tier>").description("Persist a tier hint (free | cheap | standard | full | custom).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (tier, opts) => {
+		await runConsolidatorSetTier({
+			tier,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	c.command("stop").description("Persist a pause flag the running daemon honours.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runConsolidatorStop({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerTriggersCommands(program) {
+	const t = program.command("triggers").description("[Storage] Operate on the durable trigger registry.");
+	t.command("list").description("Every persisted trigger.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTriggersList({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	t.command("status <id>").description("Single-trigger detail.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (id, opts) => {
+		await runTriggersStatus({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	t.command("fire <id>").description("Operator-fired side-effect (admin only).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (id, opts) => {
+		await runTriggersFire({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	t.command("disable <id>").description("Flip the disabled column on the registry row.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (id, opts) => {
+		await runTriggersDisable({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	t.command("prune").description("Drop disabled triggers older than --before.").option("--before <date>", "ISO date / epoch ms cutoff. Defaults to 0 (drop every disabled row).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTriggersPrune({
+			...opts.before !== void 0 ? { before: opts.before } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerAuthCommands(program) {
+	const a = program.command("auth").description("[Auth] Outbound OAuth (e.g. for MCP servers).");
+	a.command("login").description("Drive an interactive login flow.").requiredOption("--server <url>", "Authorization server URL.").option("--server-id <id>", "Override the persisted server identifier.").option("--scope <scope>", "OAuth scope.").option("--device-flow", "Use the Device Authorization Grant.").option("--client-id <id>", "Pre-existing client identifier (skip DCR).").option("-c, --config <path>", "Path to the graphorin.config file.").action(async (opts) => {
+		await runAuthLogin({
+			serverUrl: opts.server,
+			...opts.serverId !== void 0 ? { serverId: opts.serverId } : {},
+			...opts.scope !== void 0 ? { scope: opts.scope } : {},
+			...opts.deviceFlow !== void 0 ? { deviceFlow: opts.deviceFlow } : {},
+			...opts.clientId !== void 0 ? { clientId: opts.clientId } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {}
+		});
+	});
+	a.command("list").description("List persisted OAuth sessions.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runAuthList({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	a.command("refresh <id>").description("Refresh a session.").option("-c, --config <path>", "Path to the graphorin.config file.").action(async (id, opts) => {
+		await runAuthRefresh({
+			id,
+			...opts.config !== void 0 ? { config: opts.config } : {}
+		});
+	});
+	a.command("revoke <id>").description("Revoke a session.").option("--reason <text>", "Optional reason persisted in the audit log.").option("-c, --config <path>", "Path to the graphorin.config file.").action(async (id, opts) => {
+		await runAuthRevoke({
+			id,
+			...opts.reason !== void 0 ? { reason: opts.reason } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {}
+		});
+	});
+	a.command("status").description("OAuth subsystem snapshot.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runAuthStatus({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerPricingCommands(program) {
+	const p = program.command("pricing").description("[Catalogue] Bundled LLM pricing snapshot.");
+	p.command("status").description("Show bundled snapshot version + entry count + digest.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runPricingStatus({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	p.command("refresh").description("Pull a fresh snapshot from --url (network).").requiredOption("--url <url>", "Snapshot URL.").option("--out <file>", "Optional path to write the refreshed snapshot to.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runPricingRefresh({
+			url: opts.url,
+			...opts.out !== void 0 ? { out: opts.out } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	p.command("diff").description("Diff a supplied snapshot against the bundled one.").requiredOption("--snapshot <file>", "JSON file containing a PricingSnapshot.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runPricingDiff({
+			snapshot: opts.snapshot,
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	p.command("lookup").description("Print the per-token price for a single (provider, model) pair.").requiredOption("--provider <name>", "Provider id.").requiredOption("--model <id>", "Model id.").option("--region <region>", "Optional region.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runPricingLookup({
+			provider: opts.provider,
+			model: opts.model,
+			...opts.region !== void 0 ? { region: opts.region } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	p.command("missing").description("Report (provider, model) pairs absent from the bundled snapshot.").requiredOption("--spans <file>", "JSON file containing trace spans (array of { attributes }).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runPricingMissing({
+			spans: opts.spans,
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerSkillsCommands(program) {
+	const s = program.command("skills").description("[Catalogue] Manage operator-managed skill packages.");
+	s.command("install <source>").description("Install a skill from npm:<name>[@version] or git:<url>.").option("--version <version>", "npm version pin.").option("--ref <ref>", "git ref (branch / tag / sha).").option("--trust-level <level>", "trusted | trusted-with-scripts | untrusted.").option("--cwd <dir>", "Working directory for npm installs.").option("--dry-run", "Skip the install; run the policy + audit pipeline only.").option("--json", "Emit a structured JSON document on stdout.").action(async (source, opts) => {
+		await runSkillsInstall({
+			source,
+			...opts.version !== void 0 ? { version: opts.version } : {},
+			...opts.ref !== void 0 ? { ref: opts.ref } : {},
+			...opts.trustLevel !== void 0 ? { trustLevel: opts.trustLevel } : {},
+			...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
+			...opts.dryRun !== void 0 ? { dryRun: opts.dryRun } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	s.command("inspect <name>").description("Print a single recorded installation.").option("--json", "Emit a structured JSON document on stdout.").action(async (name, opts) => {
+		await runSkillsInspect({
+			name,
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	s.command("audit").description("Audit every recorded installation in this process.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runSkillsAudit({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	s.command("migrate-frontmatter").description("Migrate legacy graphorin-* frontmatter fields onto upstream equivalents (DEC-156).").option("--path <dir>", "Directory to walk. Defaults to cwd.").option("--recursive", "Walk subdirectories.").option("--apply", "Actually rewrite files (default: dry-run).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runSkillsMigrateFrontmatter({
+			...opts.path !== void 0 ? { path: opts.path } : {},
+			...opts.recursive !== void 0 ? { recursive: opts.recursive } : {},
+			...opts.apply !== void 0 ? { apply: opts.apply } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerTracesCommands(program) {
+	const t = program.command("traces").description("[Diagnostics] Operate on the trace cache.");
+	t.command("status").description("Count rows + report TTL config.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTracesStatus({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	t.command("prune").description("Manual TTL enforcement (cutoff is required).").requiredOption("--before <date>", "ISO date / epoch ms cutoff.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runTracesPrune({
+			before: opts.before,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerMigrateExportCommand(program) {
+	program.command("migrate-export <input>").description("[Storage] Migrate a session export file to the current schema (DEC-155).").requiredOption("--to <file>", "Output path.").option("--to-schema <version>", "Target schema version.", "1.0").option("--writer <id>", "Writer identifier surfaced on the meta header.").option("--json", "Emit a structured JSON document on stdout.").action(async (input, opts) => {
+		await runMigrateExport({
+			input,
+			to: opts.to,
+			...opts.toSchema !== void 0 ? { toSchema: opts.toSchema } : {},
+			...opts.writer !== void 0 ? { writer: opts.writer } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerMigrateConfigCommand(program) {
+	program.command("migrate-config <input>").description("[Bootstrap] Migrate an old config file to the current schema.").option("--out <file>", "Output path. Defaults to <input>.migrated.json next to the source.").option("--json", "Emit a structured JSON document on stdout.").action(async (input, opts) => {
+		await runMigrateConfig({
+			input,
+			...opts.out !== void 0 ? { out: opts.out } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerGuardCommands(program) {
+	const g = program.command("guard").description("[Diagnostics] Inspect the memory-modification guard.");
+	g.command("status").description("Print the four guard tiers and their variants.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runGuardStatus({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	g.command("explain <toolName>").description("Derive the tier the classifier would assign to a tool with the supplied metadata.").option("--tags <list>", "Comma-separated tag list.").option("--secrets-allowed <list>", "Comma-separated secret allowlist.").option("--trust-level <level>", "built-in | user-defined | trusted | untrusted.").option("--explicit-tier <tier>", "pure | side-effecting-no-memory | memory-aware | unknown | untrusted.").option("--json", "Emit a structured JSON document on stdout.").action((toolName, opts) => {
+		runGuardExplain({
+			toolName,
+			...opts.tags !== void 0 ? { tags: opts.tags.split(",").map((s) => s.trim()).filter(Boolean) } : {},
+			...opts.secretsAllowed !== void 0 ? { secretsAllowed: opts.secretsAllowed.split(",").map((s) => s.trim()).filter(Boolean) } : {},
+			...opts.trustLevel !== void 0 ? { trustLevel: opts.trustLevel } : {},
+			...opts.explicitTier !== void 0 ? { explicitTier: opts.explicitTier } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+}
+function registerTelemetryCommands(program) {
+	const t = program.command("telemetry").description("[Diagnostics] Telemetry policy (zero-default per ADR-041).");
+	t.command("status").description("Always reports disabled.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runTelemetryStatus({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	t.command("enable").description("Refuses; opt-in collector is on the v0.2+ roadmap.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runTelemetryEnable({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	t.command("disable").description("No-op; telemetry is always disabled.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runTelemetryDisable({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+	t.command("inspect").description("Informational summary of the zero-default promise.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
+		runTelemetryInspect({ ...opts.json !== void 0 ? { json: opts.json } : {} });
+	});
+}
+function registerToolsCommands(program) {
+	program.command("tools").description("[Catalogue] Operate on the tool registry.").command("lint").description([
+		"Static AST analysis of every tool({...}) registration; per-tool grader + threshold gate (RB-49).",
+		"",
+		"Grader rubric (40 + 30 + 30 = 100 points):",
+		"  description axis (0..40): 0 if missing/placeholder/<20 chars; 16/24/32/40 by length.",
+		"  examples axis    (0..30): 0 if none or >5; 12 base + 6 per additional, cap 30; -6 per PII.",
+		"  parameter naming (0..30): 30 base; -30/N per ambiguous name; -10/N per numeric suffix.",
+		"",
+		"Exit codes (CI-friendly):",
+		"  0  every tool meets or exceeds --threshold.",
+		"  1  at least one tool falls below --threshold.",
+		"  2  invocation could not start (config missing, walker failed)."
+	].join("\n")).option("-c, --config <path>", "Optional tsconfig.json whose include overrides the file glob.").option("--threshold <n>", "Minimum acceptable per-tool score (default 60).", (v) => Number.parseInt(v, 10)).option("--format <fmt>", "text | json (default text).").option("--source <pattern>", "File glob override (e.g. src/skills/**/tools/*.ts).").action(async (opts) => {
+		await runToolsLint({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.threshold !== void 0 ? { threshold: opts.threshold } : {},
+			...opts.format !== void 0 ? { format: opts.format } : {},
+			...opts.source !== void 0 ? { source: opts.source } : {}
+		});
+	});
+}
+main().catch((err) => {
+	process.stderr.write(`[graphorin/cli] ${err.message}\n`);
+	process.exit(1);
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=graphorin.js.map