@ours.network/cli 0.1.0

package/LICENSE

@@ -0,0 +1,98 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 Adapt Framework Solutions Ltd
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to use,
+copy, modify, create derivative works, publicly perform, publicly display and
+redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or service
+that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that
+   exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using
+   the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to the
+infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software, you
+must include a copy of or a link to these Terms and Conditions and not remove any
+copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, INCLUDING
+WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, NON-INFRINGEMENT, OR THAT THE SOFTWARE IS FREE OF DEFECTS. IN NO EVENT
+WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE,
+INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE
+BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following will
+apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -0,0 +1,129 @@
+# @ours.network/cli
+
+`ours` is the transport-neutral operator CLI for the shared ours daemon. It is a
+separate package above `@ours.network/sdk`: lifecycle commands call
+`startDaemon`, and network operations use `OursClient`. It has no dependency on
+`@ours.network/mcp`.
+
+## Install and first checks
+
+```bash
+npm install --global @ours.network/cli
+ours version
+ours config show --json
+ours daemon status --json
+```
+
+Node 20 or newer is required. `--json` emits one JSON value on stdout; errors
+are JSON on stderr. Status exits `0` while running and `3` while stopped. Usage
+errors exit `2`; other failures exit `1`.
+
+## Daemon lifecycle
+
+```bash
+ours daemon serve                         # foreground
+ours daemon start                         # detached, CLI-managed
+ours daemon status --json
+ours daemon stop
+ours daemon restart
+```
+
+`stop` and `restart` signal a process only when all three facts agree: the
+CLI-owned PID record, the PID reported by the selected daemon, and its expected
+state directory/port. A daemon started by ours-mcp, a container, systemd, or any
+other launcher remains fully attachable, but these commands refuse to signal it.
+
+Selection is coherent and credential-safe. Use a single config file or select
+both the endpoint and its state directory:
+
+```bash
+ours daemon status --config /etc/ours/config.json
+ours daemon status --endpoint http://127.0.0.1:3070 --state-dir /srv/ours-a
+```
+
+Before sending an API token, the CLI calls the unauthenticated `/state-dir`
+endpoint and verifies that the answering daemon owns the selected directory.
+Tokens are read from the SDK selection rules; there is intentionally no token
+command-line flag.
+
+## Configuration
+
+`config show` is redacted: it reports token provenance and whether secret
+sections are configured, never token or STT key values. `config setup` is
+noninteractive and changes only the named safe fields while preserving unknown
+and secret fields already in the file.
+
+```bash
+ours config setup --port 3070 --state-dir /srv/ours-a \
+  --broker-url wss://broker1.ours.network --api-visibility owner
+ours config setup --auto-start false --gc-interval-ms 3600000
+ours config setup --port 3070 --dry-run --json
+```
+
+Supported setup fields are `brokerUrl`, `port`, `stateDir`, `gcIntervalMs`,
+`autoStart`, and `apiVisibility`. Supply credentials through an operator-owned
+secret mechanism or the existing SDK configuration, not CLI arguments.
+
+## Operator commands
+
+All commands accept the selection flags `--config`, `--endpoint`, `--port`, and
+`--state-dir`; identity-scoped commands also accept `--identity NAME`, which
+binds that identity without force for the current process.
+
+```text
+identity     create | create-root | create-temporary | close-temporary
+             list | show | use | remove | release | pin
+profile      set-bio | set-persona
+invite       create | list | revoke | accept
+contact      list | local | policy | remove | rename | respond
+message      send | list | get | defer
+file         send | list | get | fetch | defer
+conversation show | receipts | mark-read | policy
+daemon       info | identities | unread | watch
+```
+
+Input fields become kebab-case flags. For example:
+
+```bash
+ours identity create --name BuildBot --bio "Build coordinator"
+ours message send --identity BuildBot --contact Peer --text "done" --json
+ours file get --identity BuildBot --wire-ids ID1,ID2 --json
+ours conversation policy --identity Human --keep-history true
+```
+
+Malformed JSON, unknown input fields, invalid booleans/integers, and incomplete
+file inputs fail closed before the request. Destructive identity/contact/invite
+operations require `--yes`.
+
+`ours api list` shows the expert fallback allowlist. Invoke one with exact SDK
+argument names, for example:
+
+```bash
+ours api send-message --identity BuildBot \
+  --input '{"contact":"Peer","text":"done"}' --json
+```
+
+The fallback deliberately excludes daemon boot internals, migration helpers,
+file fallback probes, and legacy monitoring/control-plane operations.
+
+## Service management
+
+Linux user systemd is supported through a testable adapter:
+
+```bash
+ours daemon install-service --dry-run --json
+ours daemon install-service --yes
+ours daemon uninstall-service --yes
+```
+
+The adapter owns only `~/.config/systemd/user/ours.service` files carrying its
+management marker. It refuses to overwrite or remove an unrelated unit. Other
+platforms fail explicitly; use the platform's external service manager to run
+`ours daemon serve`. Service installation is not emulated and never reports
+success on an unsupported platform.
+
+## License
+
+`@ours.network/cli` is licensed under the Functional Source License 1.1 with
+the Apache License 2.0 future license (`FSL-1.1-Apache-2.0`). The complete
+terms are included in the package as [LICENSE](LICENSE).

package/dist/args.d.ts

@@ -0,0 +1,12 @@
+export declare class CliUsageError extends Error {
+    readonly exitCode = 2;
+    constructor(message: string);
+}
+export interface ParsedFlags {
+    positionals: string[];
+    values: Record<string, string>;
+    booleans: Set<string>;
+}
+export declare function parseFlags(argv: string[], valueFlags: ReadonlySet<string>, booleanFlags: ReadonlySet<string>): ParsedFlags;
+export declare function parseInteger(value: string, flag: string, min?: number, max?: number): number;
+export declare function parseBoolean(value: string, flag: string): boolean;

package/dist/args.js

@@ -0,0 +1,12 @@
+import {
+  CliUsageError,
+  parseBoolean,
+  parseFlags,
+  parseInteger
+} from "./chunk-AXXFFER2.js";
+export {
+  CliUsageError,
+  parseBoolean,
+  parseFlags,
+  parseInteger
+};

package/dist/chunk-4IFFMMQO.js

@@ -0,0 +1,181 @@
+import {
+  attachClient,
+  defaultConfigPath,
+  resolveSelection
+} from "./chunk-6W3RHW3C.js";
+
+// src/lifecycle.ts
+import { spawn as nodeSpawn } from "node:child_process";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+var MANAGED_PID_FILE = "ours-cli-daemon.json";
+var DAEMON_LOG_FILE = "ours-cli-daemon.log";
+var depsDefault = {
+  fetch: globalThis.fetch,
+  spawn: nodeSpawn,
+  kill: (pid, signal) => process.kill(pid, signal),
+  now: Date.now,
+  delay: (ms) => new Promise((done) => setTimeout(done, ms)),
+  cliPath: process.argv[1]
+};
+var pidPath = (stateDir) => join(stateDir, MANAGED_PID_FILE);
+function readManagedRecord(stateDir) {
+  try {
+    const value = JSON.parse(readFileSync(pidPath(stateDir), "utf8"));
+    if (value.version !== 1 || value.owner !== "@ours.network/cli" || !Number.isInteger(value.pid) || Number(value.pid) <= 1) return null;
+    if (!Number.isInteger(value.port) || typeof value.stateDir !== "string" || typeof value.startedAt !== "string") return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+function writeManagedRecord(stateDir, port) {
+  mkdirSync(stateDir, { recursive: true });
+  const path = pidPath(stateDir);
+  const tmp = `${path}.${process.pid}.tmp`;
+  const record = {
+    version: 1,
+    owner: "@ours.network/cli",
+    pid: process.pid,
+    port,
+    stateDir: resolve(stateDir),
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync(tmp, `${JSON.stringify(record, null, 2)}
+`, { mode: 384 });
+  renameSync(tmp, path);
+  return path;
+}
+async function inspectDaemon(config, deps = depsDefault) {
+  const stateDir = resolve(config.expectStateDir);
+  const record = readManagedRecord(stateDir);
+  const base = { stateDir, pidFile: pidPath(stateDir), stalePidFile: record !== null };
+  let client;
+  try {
+    client = await attachClient(config, { fetch: deps.fetch, leaseToken: "ours-cli-status" });
+  } catch (error) {
+    if (error instanceof Error && error.name === "DaemonSelectionError" && /could not be reached/.test(error.message)) {
+      return { state: "stopped", managed: false, info: null, ...base };
+    }
+    throw error;
+  }
+  let info;
+  try {
+    info = await client.version();
+  } catch (error) {
+    if (error instanceof TypeError || /fetch failed|ECONNREFUSED|socket|connect/i.test(String(error))) {
+      return { state: "stopped", managed: false, info: null, ...base };
+    }
+    throw error;
+  }
+  if (info.name !== "ours" || !Number.isInteger(info.pid) || info.pid <= 1 || resolve(info.stateDir) !== stateDir) {
+    throw new Error("the selected endpoint did not return a valid ours daemon identity");
+  }
+  const selectedUrl = new URL(config.baseUrl.value);
+  const selectedPort = Number(selectedUrl.port || (selectedUrl.protocol === "https:" ? 443 : 80));
+  const managed = record !== null && record.pid === info.pid && resolve(record.stateDir) === stateDir && record.port === selectedPort;
+  return { state: "running", managed, info, ...base, stalePidFile: record !== null && !managed };
+}
+function childEnvironment(selection) {
+  const env = { ...process.env };
+  const configFile = selection.configPath ?? defaultConfigPath();
+  if (selection.configPath !== void 0 || existsSync(configFile)) env.OURS_CONFIG = resolve(configFile);
+  if (selection.port !== void 0) env.OURS_PORT = String(selection.port);
+  if (selection.stateDir !== void 0) env.OURS_STATE_DIR = resolve(selection.stateDir);
+  return env;
+}
+async function serveDaemon(selection, managed = false) {
+  if (selection.endpoint !== void 0) throw new Error("--endpoint selects a running daemon and cannot be used with daemon serve");
+  Object.assign(process.env, childEnvironment(selection));
+  const { startDaemon } = await import("@ours.network/sdk/daemon");
+  const handle = await startDaemon();
+  if (managed) {
+    const response = await fetch(`http://127.0.0.1:${handle.port}/state-dir`);
+    const identity = await response.json();
+    if (!response.ok || typeof identity.stateDir !== "string") {
+      await handle.close();
+      throw new Error("started daemon did not report its state directory; refusing to create a managed PID record");
+    }
+    writeManagedRecord(identity.stateDir, handle.port);
+  }
+  return await new Promise(() => void 0);
+}
+async function startDaemonManaged(selection, deps = depsDefault) {
+  if (selection.endpoint !== void 0) throw new Error("--endpoint selects an external daemon and cannot be used with daemon start");
+  const config = await resolveSelection(selection);
+  const before = await inspectDaemon(config, deps);
+  if (before.state === "running") return before;
+  mkdirSync(config.stateDir.value, { recursive: true });
+  const logPath = join(config.stateDir.value, DAEMON_LOG_FILE);
+  const logFd = openSync(logPath, "a", 384);
+  let child;
+  try {
+    child = deps.spawn(process.execPath, [deps.cliPath, "daemon", "serve", "--managed"], {
+      detached: true,
+      env: childEnvironment(selection),
+      stdio: ["ignore", logFd, logFd],
+      windowsHide: true
+    });
+  } finally {
+    closeSync(logFd);
+  }
+  if (!child.pid || child.pid <= 1) throw new Error(`daemon start failed; see ${logPath}`);
+  child.unref();
+  const deadline = deps.now() + 2e4;
+  while (deps.now() < deadline) {
+    await deps.delay(100);
+    const status = await inspectDaemon(config, deps);
+    if (status.state === "running" && status.managed && status.info?.pid === child.pid) return status;
+    try {
+      deps.kill(child.pid, 0);
+    } catch {
+      throw new Error(`daemon exited before becoming ready; see ${logPath}`);
+    }
+  }
+  try {
+    deps.kill(child.pid, "SIGTERM");
+  } catch {
+  }
+  throw new Error(`daemon did not become ready within 20 seconds and was stopped; see ${logPath}`);
+}
+function removeOwnedPidFile(status) {
+  const record = readManagedRecord(status.stateDir);
+  if (record?.owner === "@ours.network/cli") {
+    try {
+      unlinkSync(status.pidFile);
+    } catch {
+    }
+  }
+}
+async function stopDaemonManaged(config, deps = depsDefault) {
+  const status = await inspectDaemon(config, deps);
+  if (status.state === "stopped") {
+    removeOwnedPidFile(status);
+    return status;
+  }
+  if (!status.managed || !status.info) {
+    throw new Error("the daemon is running but was not started by @ours.network/cli; refusing to signal an external shared daemon");
+  }
+  deps.kill(status.info.pid, "SIGTERM");
+  const deadline = deps.now() + 1e4;
+  while (deps.now() < deadline) {
+    await deps.delay(100);
+    const current = await inspectDaemon(config, deps);
+    if (current.state === "stopped") {
+      removeOwnedPidFile(current);
+      return { ...current, stalePidFile: false };
+    }
+  }
+  throw new Error(`daemon pid ${status.info.pid} did not stop within 10 seconds`);
+}
+
+export {
+  MANAGED_PID_FILE,
+  DAEMON_LOG_FILE,
+  readManagedRecord,
+  writeManagedRecord,
+  inspectDaemon,
+  serveDaemon,
+  startDaemonManaged,
+  stopDaemonManaged
+};

package/dist/chunk-67BC2E5U.js

@@ -0,0 +1,78 @@
+// src/service.ts
+import { execFile as nodeExecFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+var execFile = promisify(nodeExecFile);
+var MARKER = "# Managed by @ours.network/cli";
+var SERVICE_NAME = "ours.service";
+var defaultDeps = {
+  platform: process.platform,
+  run: async (command, args) => {
+    await execFile(command, args, { windowsHide: true });
+  }
+};
+function systemdEscapeArgument(value) {
+  if (/[\n\r]/.test(value)) throw new Error("service arguments must not contain newlines");
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
+}
+function createLinuxUserSystemdAdapter(deps = defaultDeps) {
+  if (deps.platform !== "linux") throw new Error(`service management is not supported on ${deps.platform}; use an external launcher for \`ours daemon serve\``);
+  return {
+    name: "systemd-user",
+    async install(context) {
+      const home = context.homeDir ?? homedir();
+      const serviceFile = join(home, ".config", "systemd", "user", SERVICE_NAME);
+      const args = [process.execPath, resolve(context.cliPath), "daemon", "serve"];
+      if (context.configPath) args.push("--config", resolve(context.configPath));
+      const unit = `${MARKER}
+[Unit]
+Description=ours shared daemon
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${args.map(systemdEscapeArgument).join(" ")}
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target
+`;
+      if (existsSync(serviceFile)) {
+        const previous = readFileSync(serviceFile, "utf8");
+        if (!previous.startsWith(MARKER) && !context.force) {
+          throw new Error(`${serviceFile} is not managed by @ours.network/cli; refusing to overwrite it without --force`);
+        }
+        if (previous === unit) return { adapter: this.name, action: "install", serviceFile, commands: [], changed: false, dryRun: context.dryRun === true };
+      }
+      const commands = [["systemctl", "--user", "daemon-reload"], ["systemctl", "--user", "enable", "--now", SERVICE_NAME]];
+      if (!context.dryRun) {
+        mkdirSync(dirname(serviceFile), { recursive: true });
+        writeFileSync(serviceFile, unit, { mode: 420 });
+        for (const [command, ...args2] of commands) await deps.run(command, args2);
+      }
+      return { adapter: this.name, action: "install", serviceFile, commands, changed: true, dryRun: context.dryRun === true };
+    },
+    async uninstall(context) {
+      const home = context.homeDir ?? homedir();
+      const serviceFile = join(home, ".config", "systemd", "user", SERVICE_NAME);
+      if (!existsSync(serviceFile)) return { adapter: this.name, action: "uninstall", serviceFile, commands: [], changed: false, dryRun: context.dryRun === true };
+      const previous = readFileSync(serviceFile, "utf8");
+      if (!previous.startsWith(MARKER)) throw new Error(`${serviceFile} is not managed by @ours.network/cli; refusing to remove it`);
+      const commands = [["systemctl", "--user", "disable", "--now", SERVICE_NAME], ["systemctl", "--user", "daemon-reload"]];
+      if (!context.dryRun) {
+        await deps.run(commands[0][0], commands[0].slice(1));
+        unlinkSync(serviceFile);
+        await deps.run(commands[1][0], commands[1].slice(1));
+      }
+      return { adapter: this.name, action: "uninstall", serviceFile, commands, changed: true, dryRun: context.dryRun === true };
+    }
+  };
+}
+
+export {
+  SERVICE_NAME,
+  createLinuxUserSystemdAdapter
+};

package/dist/chunk-6W3RHW3C.js

@@ -0,0 +1,43 @@
+// src/connection.ts
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import {
+  OursClient,
+  assertDaemonStateDir,
+  describeDaemonConfig,
+  resolveDaemonConfig
+} from "@ours.network/sdk/client";
+function defaultConfigPath() {
+  return process.env.OURS_CONFIG ?? join(homedir(), ".ours", "config.json");
+}
+function resolveSelection(options = {}) {
+  const fallbackConfig = defaultConfigPath();
+  const configPath = options.configPath ?? (process.env.OURS_CONFIG === void 0 && existsSync(fallbackConfig) ? fallbackConfig : void 0);
+  return resolveDaemonConfig({
+    endpoint: options.endpoint,
+    port: options.port,
+    stateDir: options.stateDir,
+    configPath
+  });
+}
+function redactedSelection(config) {
+  return describeDaemonConfig(config);
+}
+async function attachClient(config, opts = {}) {
+  await assertDaemonStateDir(config, { fetch: opts.fetch });
+  return new OursClient({
+    url: config.baseUrl.value,
+    leaseToken: opts.leaseToken ?? randomBytes(32).toString("hex"),
+    apiToken: config.token?.value,
+    fetch: opts.fetch
+  });
+}
+
+export {
+  defaultConfigPath,
+  resolveSelection,
+  redactedSelection,
+  attachClient
+};

package/dist/chunk-AXXFFER2.js

@@ -0,0 +1,61 @@
+// src/args.ts
+var CliUsageError = class extends Error {
+  exitCode = 2;
+  constructor(message) {
+    super(message);
+    this.name = "CliUsageError";
+  }
+};
+function parseFlags(argv, valueFlags, booleanFlags) {
+  const positionals = [];
+  const values = {};
+  const booleans = /* @__PURE__ */ new Set();
+  let positionalOnly = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (positionalOnly) {
+      positionals.push(token);
+      continue;
+    }
+    if (token === "--") {
+      positionalOnly = true;
+      continue;
+    }
+    if (!token.startsWith("--")) {
+      positionals.push(token);
+      continue;
+    }
+    const equal = token.indexOf("=");
+    const name = equal < 0 ? token : token.slice(0, equal);
+    if (booleanFlags.has(name)) {
+      if (equal >= 0) throw new CliUsageError(`${name} does not take a value`);
+      if (booleans.has(name)) throw new CliUsageError(`${name} may be given only once`);
+      booleans.add(name);
+      continue;
+    }
+    if (!valueFlags.has(name)) throw new CliUsageError(`unknown option: ${name}`);
+    const value = equal >= 0 ? token.slice(equal + 1) : argv[++i];
+    if (value === void 0 || value === "") throw new CliUsageError(`${name} requires a value`);
+    if (Object.prototype.hasOwnProperty.call(values, name)) throw new CliUsageError(`${name} may be given only once`);
+    values[name] = value;
+  }
+  return { positionals, values, booleans };
+}
+function parseInteger(value, flag, min = 0, max = Number.MAX_SAFE_INTEGER) {
+  if (!/^[0-9]+$/.test(value)) throw new CliUsageError(`${flag} must be an integer`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < min || parsed > max) throw new CliUsageError(`${flag} must be between ${min} and ${max}`);
+  return parsed;
+}
+function parseBoolean(value, flag) {
+  if (value === "true" || value === "1") return true;
+  if (value === "false" || value === "0") return false;
+  throw new CliUsageError(`${flag} must be true or false`);
+}
+
+export {
+  CliUsageError,
+  parseFlags,
+  parseInteger,
+  parseBoolean
+};

package/dist/chunk-G2GHHOYX.js

@@ -0,0 +1,66 @@
+import {
+  defaultConfigPath,
+  redactedSelection,
+  resolveSelection
+} from "./chunk-6W3RHW3C.js";
+
+// src/config-command.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+var SAFE_KEYS = /* @__PURE__ */ new Set(["brokerUrl", "port", "stateDir", "gcIntervalMs", "autoStart", "apiVisibility"]);
+async function showConfig(selection) {
+  const resolved = await resolveSelection(selection);
+  let stored = {};
+  const path = selection.configPath ?? defaultConfigPath();
+  if (existsSync(path)) {
+    try {
+      stored = JSON.parse(readFileSync(path, "utf8"));
+    } catch {
+      stored = { invalid: true };
+    }
+  }
+  return {
+    path,
+    selection: await redactedSelection(resolved),
+    daemon: Object.fromEntries(Object.entries(stored).filter(([key]) => SAFE_KEYS.has(key))),
+    apiTokenConfigured: typeof stored.apiToken === "string" && stored.apiToken.length > 0,
+    sttConfigured: stored.stt !== void 0
+  };
+}
+function setupConfig(path, patch, dryRun = false) {
+  let stored = {};
+  if (existsSync(path)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(path, "utf8"));
+    } catch (error) {
+      throw new Error(`refusing to overwrite malformed config ${path}: ${String(error)}`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`refusing to overwrite non-object config ${path}`);
+    stored = parsed;
+  }
+  for (const key of Object.keys(patch)) if (!SAFE_KEYS.has(key)) throw new Error(`unsafe config field: ${key}`);
+  const next = { ...stored, ...patch };
+  if (!dryRun) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+    renameSync(tmp, path);
+    try {
+      chmodSync(path, 384);
+    } catch {
+    }
+  }
+  return {
+    path: resolve(path),
+    dryRun,
+    daemon: Object.fromEntries(Object.entries(next).filter(([key]) => SAFE_KEYS.has(key))),
+    preservedSecretFields: ["apiToken", "stt"].filter((key) => Object.prototype.hasOwnProperty.call(next, key))
+  };
+}
+
+export {
+  showConfig,
+  setupConfig
+};