@nacre.work/cli 0.14.3

package/dist/config.js

@@ -0,0 +1,70 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/** `$XDG_CONFIG_HOME/nacre/config.json`, or the usual place under `$HOME`. */
+export function configPath(env = process.env) {
+    const xdg = env.XDG_CONFIG_HOME;
+    const base = xdg !== undefined && xdg !== '' ? xdg : join(env.HOME ?? homedir(), '.config');
+    return join(base, 'nacre', 'config.json');
+}
+function readStored(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof parsed === 'object' && parsed !== null ? parsed : {};
+    }
+    catch {
+        // A missing file is the ordinary case on a first run, and an unreadable or
+        // corrupt one is not worth failing a `search` over — `login` rewrites it.
+        return {};
+    }
+}
+/**
+ * The session to use, from the environment first and the file second.
+ *
+ * Returns `undefined` rather than throwing so a command can say what to do
+ * about it. There is exactly one message for this and it names both ways in,
+ * because an operator reaching for the CLI in CI wants the variables and one on
+ * a laptop wants `nacre login`.
+ */
+export function loadSession(env = process.env) {
+    const stored = readStored(configPath(env));
+    const baseUrl = env.NACRE_API_URL ?? stored.baseUrl;
+    const token = env.NACRE_TOKEN ?? stored.token;
+    if (baseUrl === undefined || baseUrl === '' || token === undefined || token === '')
+        return undefined;
+    // Only from the file. A refresh token in the environment beside an access
+    // token would be a second credential to leak for a session the environment
+    // cannot renew anyway — nothing here would have anywhere to write the new one.
+    const refreshToken = env.NACRE_TOKEN === undefined ? stored.refreshToken : undefined;
+    return { baseUrl, token, ...(refreshToken === undefined ? {} : { refreshToken }) };
+}
+/**
+ * Write the session, readable by nobody else.
+ *
+ * `0600` on the file **and** `0700` on the directory, set explicitly rather
+ * than left to the umask: this holds a refresh token, and a refresh token is a
+ * session that renews itself, so it outlives the access token beside it by as
+ * long as the deployment allows. A default umask of `022` would leave it world
+ * readable on a shared machine, which is the one place a CLI config actually
+ * gets read by somebody else.
+ */
+export function saveSession(session, env = process.env) {
+    const path = configPath(env);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
+    // mkdirSync's mode is ignored when the directory already exists, and
+    // writeFileSync's is ignored when the file does — so neither call above is
+    // enough on its own for the second run, which is the run that matters.
+    chmodSync(dirname(path), 0o700);
+    chmodSync(path, 0o600);
+    return path;
+}
+/** Forget the session. Not a sign-out — that revokes, and this only forgets. */
+export function clearSession(env = process.env) {
+    const path = configPath(env);
+    const stored = readStored(path);
+    if (stored.baseUrl === undefined)
+        return;
+    saveSession({ baseUrl: stored.baseUrl, token: '' }, env);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAwBzC,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAA;IAC/B,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IAC3F,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC9D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAE1C,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,OAAO,CAAA;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAEpG,0EAA0E;IAC1E,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IAEpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;AACpF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,qEAAqE;IACrE,2EAA2E;IAC3E,uEAAuE;IACvE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;IAC/B,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAM;IACxC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { run, HELP } from './run.js';
+export { parse, flag, option, integer, UsageError } from './args.js';
+export type { Parsed } from './args.js';
+export { clearSession, configPath, loadSession, saveSession } from './config.js';
+export type { Session } from './config.js';
+export { ask, collect, eligible, evaluate, grant, ingest, layers, login, search, whoami } from './commands.js';
+export type { Context, Terminal } from './commands.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACpE,YAAY,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAChF,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC9G,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { run, HELP } from './run.js';
+export { parse, flag, option, integer, UsageError } from './args.js';
+export { clearSession, configPath, loadSession, saveSession } from './config.js';
+export { ask, collect, eligible, evaluate, grant, ingest, layers, login, search, whoami } from './commands.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEpE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+/**
+ * The `nacre` entry point.
+ *
+ * Everything that decides anything is in `run.ts`; this is the shell around it,
+ * and it is thin on purpose — a program whose logic lives in its entry point is
+ * a program whose logic is tested by spawning it.
+ */
+import { run } from './run.js';
+const { output, code, stdout } = await run(process.argv.slice(2));
+// Diagnostics to stderr, the answer to stdout. `nacre search q --json | jq`
+// has to work, and it cannot if a refusal is printed into the same stream as
+// the results.
+//
+// `stdout` is the third case: a command that partly worked, where the output is
+// still the answer and the code still has to say so. An ingest of a hundred
+// files with two failures is that, and putting its summary on stderr would make
+// the failure unreadable to the script that has to act on it.
+if (code === 0 || stdout === true) {
+    if (output !== '')
+        process.stdout.write(`${output}\n`);
+}
+else {
+    process.stderr.write(`${output}\n`);
+}
+process.exitCode = code;
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAE9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAEjE,4EAA4E;AAC5E,6EAA6E;AAC7E,eAAe;AACf,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAA;AACxD,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAA;AACrC,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA"}

package/dist/run.d.ts

@@ -0,0 +1,25 @@
+import { type Context } from './commands.js';
+export declare const HELP = "nacre \u2014 the command line client for a Nacre installation\n\n  nacre login --url <https://api.example>   sign in, and remember the session\n  nacre whoami                              which principal this session is\n  nacre layers                              layers you can read\n  nacre layers create <slug> [--name ...]   create one  [--workspace <slug>]\n  nacre grant <permission> <scope> --to <principal>\n  nacre ingest <file|dir>... --layer <slug> index text files, and wait for them\n                              --watch     keep indexing a directory as it changes\n  nacre search <query> [--layer <slug>] [--top-k <n>]\n  nacre eval --layer <slug> [--top-k <n>] [--floor <0..1>]\n                                            score the layer's reference queries\n\n  --json      print the response as JSON, for a script rather than a person\n  --help      this\n\nA scope is layer:<slug>, workspace:<slug> or document:<id>. A principal is\nuser:<id>, group:<id> or service_account:<id>.\n\nNACRE_API_URL and NACRE_TOKEN override the stored session, which is what a\nservice account in CI uses \u2014 there is no terminal there to log in from.\n\nPermissions are not a ladder: write does not imply read, and admin implies both.\nAn ingest-only service account holds write and cannot search back what it wrote.\n";
+/**
+ * What a command hands back: text when it worked, or text and a code when it
+ * partly did. Ingest is the only one that needs the second form today.
+ */
+export type Outcome = string | {
+    readonly output: string;
+    readonly code: number;
+};
+export interface Result {
+    readonly output: string;
+    readonly code: number;
+    /** Print on stdout despite a non-zero code — the output is still the answer. */
+    readonly stdout?: boolean;
+}
+/**
+ * One command, returning what to print and the code to exit with.
+ *
+ * Split from the entry point so the whole surface is testable without spawning
+ * a process: everything the program touches that is not the network arrives
+ * through `Context`.
+ */
+export declare function run(argv: readonly string[], overrides?: Partial<Context>): Promise<Result>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+D,KAAK,OAAO,EAAE,MAAM,eAAe,CAAA;AAGzG,eAAO,MAAM,IAAI,izCAwBhB,CAAA;AAYD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjF,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,GAAG,CACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,GAAE,OAAO,CAAC,OAAO,CAAM,GAC/B,OAAO,CAAC,MAAM,CAAC,CA2CjB"}

package/dist/run.js

@@ -0,0 +1,104 @@
+import { NacreClient } from '@nacre.work/sdk';
+import { parse, UsageError } from './args.js';
+import { ask, evaluate, grant, ingest, layers, login, search, whoami } from './commands.js';
+import { saveSession } from './config.js';
+export const HELP = `nacre — the command line client for a Nacre installation
+
+  nacre login --url <https://api.example>   sign in, and remember the session
+  nacre whoami                              which principal this session is
+  nacre layers                              layers you can read
+  nacre layers create <slug> [--name ...]   create one  [--workspace <slug>]
+  nacre grant <permission> <scope> --to <principal>
+  nacre ingest <file|dir>... --layer <slug> index text files, and wait for them
+                              --watch     keep indexing a directory as it changes
+  nacre search <query> [--layer <slug>] [--top-k <n>]
+  nacre eval --layer <slug> [--top-k <n>] [--floor <0..1>]
+                                            score the layer's reference queries
+
+  --json      print the response as JSON, for a script rather than a person
+  --help      this
+
+A scope is layer:<slug>, workspace:<slug> or document:<id>. A principal is
+user:<id>, group:<id> or service_account:<id>.
+
+NACRE_API_URL and NACRE_TOKEN override the stored session, which is what a
+service account in CI uses — there is no terminal there to log in from.
+
+Permissions are not a ladder: write does not imply read, and admin implies both.
+An ingest-only service account holds write and cannot search back what it wrote.
+`;
+const COMMANDS = {
+    login,
+    whoami,
+    layers,
+    grant,
+    ingest,
+    search,
+    eval: evaluate,
+};
+/**
+ * One command, returning what to print and the code to exit with.
+ *
+ * Split from the entry point so the whole surface is testable without spawning
+ * a process: everything the program touches that is not the network arrives
+ * through `Context`.
+ */
+export async function run(argv, overrides = {}) {
+    const parsed = parse(argv);
+    const name = parsed.positional[0];
+    if (name === undefined || name === 'help' || parsed.options.has('help')) {
+        // Help is a success when it was asked for and a usage error when it is the
+        // answer to a command nobody named — a script piping `nacre` with no
+        // arguments must not read exit 0 as "it worked".
+        return { output: HELP, code: name === undefined && !parsed.options.has('help') ? 2 : 0 };
+    }
+    const command = COMMANDS[name];
+    if (command === undefined) {
+        return { output: `Unknown command ${JSON.stringify(name)}.\n\n${HELP}`, code: 2 };
+    }
+    const context = {
+        parsed,
+        env: process.env,
+        prompt: ask,
+        clientFor: defaultClient,
+        ...overrides,
+    };
+    try {
+        const outcome = await command(context);
+        return typeof outcome === 'string'
+            ? { output: outcome, code: 0 }
+            : // A command that partly worked reports on **stdout** and still exits
+                // non-zero. Ingest is the one: a directory where every document failed
+                // is not a success, and a script reading exit 0 there is the "reported
+                // success having done nothing" failure this repository keeps finding —
+                // but the per-document summary is the answer, so `--json | jq` has to
+                // keep working while the code says not everything landed.
+                { output: outcome.output, code: outcome.code, stdout: true };
+    }
+    catch (error) {
+        // Two codes, and the difference is whose fault it is: `2` means this
+        // invocation was wrong and repeating it will fail the same way, `1` means
+        // the request was refused or the network was. A script that cannot tell
+        // them apart retries the first one forever.
+        const code = error instanceof UsageError ? 2 : 1;
+        return { output: error instanceof Error ? error.message : String(error), code };
+    }
+}
+function defaultClient(session) {
+    return new NacreClient({
+        baseUrl: session.baseUrl,
+        token: session.token,
+        ...(session.refreshToken === undefined ? {} : { refreshToken: session.refreshToken }),
+        // The session renews itself and the renewal has to be written down, or the
+        // next invocation is a fresh process holding the token that just expired.
+        // This is the whole reason the CLI keeps a file rather than an env var.
+        onTokens: (tokens) => {
+            saveSession({
+                baseUrl: session.baseUrl,
+                token: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+            });
+        },
+    });
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAgB,MAAM,eAAe,CAAA;AACzG,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAA;AAEvD,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBnB,CAAA;AAED,MAAM,QAAQ,GAA2D;IACvE,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI,EAAE,QAAQ;CACf,CAAA;AAeD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAuB,EACvB,YAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,2EAA2E;QAC3E,qEAAqE;QACrE,iDAAiD;QACjD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IACnF,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,MAAM;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,aAAa;QACxB,GAAG,SAAS;KACb,CAAA;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QACtC,OAAO,OAAO,OAAO,KAAK,QAAQ;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;YAC9B,CAAC,CAAC,qEAAqE;gBACrE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,0DAA0D;gBAC1D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAA;IACjF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO,IAAI,WAAW,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,WAAW,CAAC;gBACV,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,MAAM,CAAC,WAAW;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@nacre.work/cli",
+  "version": "0.14.3",
+  "description": "Command line client for Nacre: layers, grants, ingest and search",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nacre-work/nacre.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://nacre.work",
+  "license": "Apache-2.0",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "bin": {
+    "nacre": "./dist/main.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "keywords": [
+    "nacre",
+    "cli",
+    "rag",
+    "permissions",
+    "search"
+  ],
+  "bugs": {
+    "url": "https://github.com/nacre-work/nacre/issues"
+  },
+  "author": "Nacre",
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@nacre.work/sdk": "workspace:*"
+  }
+}