@ours.network/cli 0.1.0 → 0.1.1

package/dist/chunk-QRNZFPNJ.js

@@ -0,0 +1,379 @@
+import {
+  CliUsageError,
+  parseBoolean
+} from "./chunk-6NFATG6P.js";
+
+// src/operations.ts
+var str = (help, required = false, values, valueName = "TEXT", allowEmpty = false) => ({ kind: "string", help, valueName, required, values, allowEmpty });
+var bool = (help, required = false) => ({ kind: "boolean", help, valueName: "true|false", required });
+var integer = (help, required = false, positive = false) => ({ kind: "integer", help, valueName: "N", required, positive });
+var strings = (help, required = false) => ({ kind: "string[]", help, valueName: "VALUE,...", required });
+var integers = (help, required = false) => ({ kind: "integer[]", help, valueName: "N,...", required });
+var none = {};
+var OPERATION_SPECS = {
+  "create-identity": {
+    method: "createIdentity",
+    fields: {
+      name: str("Public display name for the new identity.", true, void 0, "NAME"),
+      bio: str("Public profile text shared with contacts.", true),
+      exposeLocal: bool("Publish the identity in the host-local contact book.", true),
+      localAutoAccept: bool("Automatically approve verified local introductions.", true)
+    },
+    summary: "Create a persistent identity and bind this CLI session to it.",
+    effects: "Writes identity state. With a Human identity, the new identity becomes its role; otherwise the first persistent identity becomes the Human identity.",
+    exampleInput: { name: "BuildBot", bio: "Build coordinator", exposeLocal: true, localAutoAccept: true }
+  },
+  "create-temporary-identity": {
+    method: "createTemporaryIdentity",
+    fields: {
+      name: str("Optional public name; omit it to generate a random tmp-\u2026 name.", false, void 0, "NAME"),
+      bio: str("Public profile text shared with contacts.", true),
+      exposeLocal: bool("Publish the temporary identity in the host-local contact book.", true),
+      localAutoAccept: bool("Automatically approve verified local introductions.", true)
+    },
+    summary: "Create and bind a session-owned temporary identity.",
+    effects: "Writes temporary identity state. Session teardown or lease release closes it, sends best-effort remove-me notices, and permanently deletes its local state.",
+    exampleInput: { name: "ScratchBot", bio: "Short-lived test operator", exposeLocal: false, localAutoAccept: true }
+  },
+  "close-temporary-identity": {
+    method: "closeTemporaryIdentityOp",
+    fields: { name: str("Temporary identity to close; omit it to close the one bound by this lease.", false, void 0, "NAME") },
+    summary: "Close a temporary identity owned by this session, or reclaim one whose owner is stale.",
+    effects: "Destructive: queues best-effort remove-me notices and permanently deletes local identity state. A live owner cannot be evicted.",
+    exampleInput: { name: "ScratchBot" }
+  },
+  "create-root-identity": {
+    method: "createRootIdentity",
+    fields: {
+      name: str("Public Human identity name.", true, void 0, "NAME"),
+      bio: str("Public profile text shared through the verified identity hierarchy.", true),
+      exposeLocal: bool("Publish the identity in the host-local contact book.", true),
+      localAutoAccept: bool("Automatically approve verified local introductions.", true),
+      skipIfRootExists: bool("Return the existing-root result instead of trying to create another Human identity.", true)
+    },
+    summary: "Create the host Human identity and bind this CLI session to it.",
+    effects: "Writes identity state and may adopt existing persistent identities as roles. If a Human identity already exists, a non-skipped creation becomes a role under it.",
+    exampleInput: { name: "Alice@laptop", bio: "Alice on laptop", exposeLocal: true, localAutoAccept: true, skipIfRootExists: true }
+  },
+  "define-local-identity-file": {
+    method: "defineLocalIdentityFile",
+    fields: {
+      name: str("Identity name to suggest for this workspace.", true, void 0, "NAME"),
+      path: str("Absolute workspace directory in which to write .ours-identity.", true, void 0, "PATH"),
+      force: bool("Record that a future binder may request forced adoption; the file itself does not bind.", true),
+      exposeLocal: bool("Record the local contact-book exposure preference.", true),
+      localAutoAccept: bool("Record the local introduction approval preference.", true),
+      overwrite: bool("Replace an existing .ours-identity file.", true)
+    },
+    summary: "Write an advisory .ours-identity workspace pin.",
+    effects: "Writes only the workspace pin file. It does not create or bind an identity.",
+    exampleInput: { name: "BuildBot", path: "/srv/project", force: false, exposeLocal: true, localAutoAccept: true, overwrite: false }
+  },
+  "choose-identity": {
+    method: "chooseIdentity",
+    fields: {
+      name: str("Existing identity to bind.", true, void 0, "NAME"),
+      force: bool("Evict another live session that holds the identity.", true)
+    },
+    summary: "Bind an existing identity to this CLI lease.",
+    effects: "Changes lease ownership. Force can evict another live session; temporary identities still enforce their session owner.",
+    exampleInput: { name: "BuildBot", force: false }
+  },
+  "list-identities": { method: "listIdentities", fields: none, summary: "List identities, hierarchy, temporary ownership, and lease state.", effects: "Read-only." },
+  "current-identity": { method: "currentIdentity", fields: none, summary: "Show the identity bound to this CLI lease, including its profile and hierarchy.", effects: "Read-only." },
+  "remove-identity": {
+    method: "removeIdentity",
+    fields: { name: str("Persistent or temporary identity to remove.", true, void 0, "NAME") },
+    summary: "Permanently remove an identity.",
+    effects: "Destructive: deletes local identity state. A Human identity cannot be removed while it still has roles; temporary identities follow their close lifecycle.",
+    exampleInput: { name: "OldBot" }
+  },
+  "release-lease": {
+    method: "releaseLease",
+    fields: none,
+    summary: "Release every identity lease held by this CLI client token.",
+    effects: "Changes lease state. Owned temporary identities begin asynchronous permanent closure and best-effort contact notification."
+  },
+  "generate-invite": {
+    method: "generateInvite",
+    fields: {
+      name: str("Optional local contact name reserved for the one-time redeemer.", false, void 0, "NAME"),
+      mode: str("Invite kind: one_time is consumed once; public is reusable until revoked or daemon restart.", false, ["one_time", "public"], "MODE")
+    },
+    summary: "Generate encrypted contact-introduction material for out-of-band sharing.",
+    effects: "Creates an outstanding invite. Omitted mode defaults to one_time; public invites cannot pre-assign a name.",
+    exampleInput: { name: "Peer", mode: "one_time" }
+  },
+  "list-invites": { method: "listInvites", fields: none, summary: "List outstanding one-time and public invites.", effects: "Read-only." },
+  "revoke-invite": {
+    method: "revokeInvite",
+    fields: { invite_id: str("Invite identifier returned by invite creation or listing.", true, void 0, "ID") },
+    summary: "Revoke an outstanding invite.",
+    effects: "Destructive and idempotent. It prevents future redemption but does not remove existing contacts.",
+    exampleInput: { invite_id: "INVITE_ID" }
+  },
+  "add-contact": {
+    method: "addContact",
+    fields: {
+      invite: str("Invite material received out of band.", true, void 0, "INVITE"),
+      name: str("Optional local display name for the inviter.", false, void 0, "NAME")
+    },
+    summary: "Redeem an invite and begin an encrypted contact handshake.",
+    effects: "Sends the first handshake leg. The contact remains pending until the inviter verifies and replies.",
+    exampleInput: { invite: "<invite-from-peer>", name: "Peer" }
+  },
+  "list-contacts": { method: "listContacts", fields: none, summary: "List established contacts and pending local introductions.", effects: "Read-only." },
+  "list-local-contact-book": { method: "listLocalContactBook", fields: none, summary: "List same-host identities published for invite-free introduction.", effects: "Read-only." },
+  "set-local-book-policy": {
+    method: "setLocalBookPolicy",
+    fields: {
+      expose: bool("Publish or unpublish the bound identity in the host-local contact book."),
+      auto_accept: bool("Automatically approve or queue verified local introductions.")
+    },
+    summary: "Change local contact-book exposure and/or introduction approval policy.",
+    effects: "Writes identity-local policy. At least one of expose or auto_accept is required.",
+    exampleInput: { expose: true, auto_accept: false },
+    refine: (a) => {
+      if (a.expose === void 0 && a.auto_accept === void 0) throw new CliUsageError("set-local-book-policy requires expose and/or auto_accept");
+    }
+  },
+  "remove-contact": {
+    method: "removeContact",
+    fields: { contact: str("Contact name or container ID to forget.", true, void 0, "CONTACT") },
+    summary: "Forget a contact locally.",
+    effects: "Destructive: removes the local contact and queues one best-effort remove-me notice; remote deletion is not guaranteed.",
+    exampleInput: { contact: "OldPeer" }
+  },
+  "rename-contact": {
+    method: "renameContact",
+    fields: {
+      contact: str("Current contact name or container ID.", true, void 0, "CONTACT"),
+      name: str("New local display name.", true, void 0, "NAME")
+    },
+    summary: "Rename a contact locally without changing keys or the encrypted channel.",
+    effects: "Changes only the local display name.",
+    exampleInput: { contact: "Peer", name: "PeerLaptop" }
+  },
+  "respond-to-introduction": {
+    method: "respondToIntroduction",
+    fields: {
+      contact: str("Pending contact name or container ID.", true, void 0, "CONTACT"),
+      action: str("Approve to establish the contact and release queued messages, or reject to drop them.", true, ["approve", "reject"], "ACTION")
+    },
+    summary: "Approve or reject a queued local introduction.",
+    effects: "Approval establishes the contact and moves queued messages into the inbox; rejection drops the queue.",
+    exampleInput: { contact: "LocalBot", action: "approve" }
+  },
+  "set-bio": {
+    method: "setBio",
+    fields: { bio: str("New public profile text; an empty string clears it.", true, void 0, "TEXT", true) },
+    summary: "Replace the bound identity\u2019s public bio.",
+    effects: "Writes public profile state. Updating a Human identity also refreshes its profile in role delegation chains.",
+    exampleInput: { bio: "Build coordinator" }
+  },
+  "set-persona": {
+    method: "setPersona",
+    fields: { persona: str("New local operating contract; an empty string clears it.", true, void 0, "TEXT", true) },
+    summary: "Replace the bound identity\u2019s local persona.",
+    effects: "Writes local profile state. Personas are not shared in invites.",
+    exampleInput: { persona: "Handle build coordination only." }
+  },
+  "send-message": {
+    method: "sendMessage",
+    fields: {
+      contact: str("Recipient contact name or container ID.", true, void 0, "CONTACT"),
+      text: str("Message body.", true),
+      reply_to_wire_id: str("Optional wire ID of the message or file being answered.", false, void 0, "WIRE_ID"),
+      reply_to_sentence: integer("Optional 1-based sentence number; ignored unless reply_to_wire_id is also set.", false, true)
+    },
+    summary: "Send an end-to-end-encrypted text message.",
+    effects: "Sends data. A verified same-host identity may be introduced automatically when it is not already a contact.",
+    exampleInput: { contact: "Peer", text: "Build finished." }
+  },
+  "send-file": {
+    method: "sendFile",
+    fields: {
+      contact: str("Recipient contact name or container ID.", true, void 0, "CONTACT"),
+      path: str("Local file path to read and send; mutually exclusive with data_base64.", false, void 0, "PATH"),
+      data_base64: str("Inline base64 file bytes; mutually exclusive with path.", false, void 0, "BASE64"),
+      filename: str("Filename required with data_base64; optional override with path.", false, void 0, "NAME"),
+      mime: str("Optional MIME type; inferred from a path extension when omitted.", false, void 0, "TYPE"),
+      reply_to_wire_id: str("Optional wire ID of the message or file being answered.", false, void 0, "WIRE_ID"),
+      reply_to_sentence: integer("Optional 1-based sentence number; ignored unless reply_to_wire_id is also set.", false, true)
+    },
+    summary: "Send an end-to-end-encrypted file from a path or inline base64.",
+    effects: "Reads the selected local file when path is used and sends bytes. Exactly one of path or data_base64 is required; data_base64 also requires filename.",
+    exampleInput: { contact: "Peer", path: "/tmp/report.pdf" },
+    refine: (a) => {
+      if (a.path === void 0 === (a.data_base64 === void 0)) throw new CliUsageError("send-file requires exactly one of path or data_base64");
+      if (a.data_base64 !== void 0 && a.filename === void 0) throw new CliUsageError("send-file requires filename with data_base64");
+    }
+  },
+  "list-incoming-messages": { method: "listIncomingMessages", fields: none, summary: "List inbox metadata and status without revealing message bodies.", effects: "Read-only; message status is unchanged." },
+  "get-messages": { method: "getMessages", fields: none, summary: "Return every unread message body and mark those messages processed.", effects: "Mutates inbox status. This is the only message-body read and is exactly-once unless the returned message IDs are deferred." },
+  "defer-messages": {
+    method: "deferMessages",
+    fields: { msg_ids: integers("Comma-separated numeric message IDs to return to unread state.", true) },
+    summary: "Return processed messages to the unread queue.",
+    effects: "Mutates inbox status.",
+    exampleInput: { msg_ids: [12, 13] }
+  },
+  "defer-files": {
+    method: "deferFiles",
+    fields: { file_ids: integers("Comma-separated numeric file IDs\u2014not wire IDs\u2014to return to unread state.", true) },
+    summary: "Return processed files to the unread queue.",
+    effects: "Mutates inbox status; already-unread files are left unchanged.",
+    exampleInput: { file_ids: [4, 5] }
+  },
+  "get-conversation": {
+    method: "getConversation",
+    fields: { contact: str("Contact name or container ID.", true, void 0, "CONTACT") },
+    summary: "Show retained conversation history with one contact, oldest first.",
+    effects: "Read-only. It is empty when history retention is disabled.",
+    exampleInput: { contact: "Peer" }
+  },
+  "get-receipts": {
+    method: "getReceipts",
+    fields: { contact: str("Contact name or container ID.", true, void 0, "CONTACT") },
+    summary: "Show delivered/read receipts received for sent messages.",
+    effects: "Read-only. Receipts are retained only when conversation history is enabled.",
+    exampleInput: { contact: "Peer" }
+  },
+  "mark-read": {
+    method: "markRead",
+    fields: { contact: str("Contact name or container ID.", true, void 0, "CONTACT") },
+    summary: "Mark unread inbound entries in one conversation as read.",
+    effects: "Mutates conversation state and sends read receipts for newly marked messages.",
+    exampleInput: { contact: "Peer" }
+  },
+  "set-conversation-policy": {
+    method: "setConversationPolicy",
+    fields: { keep_history: bool("Enable or disable retained conversation history and receipt support.", true) },
+    summary: "Set conversation-history policy for the bound identity.",
+    effects: "Writes identity-local policy. Existing contacts learn newly enabled receipt capability on later outbound traffic.",
+    exampleInput: { keep_history: true }
+  },
+  "list-incoming-files": { method: "listIncomingFiles", fields: none, summary: "List incoming-file metadata for authorization.", effects: "Read-only: returns no bytes and does not change file status. Authorize using the authenticated sender ID, not its display name." },
+  "get-files": {
+    method: "getFiles",
+    fields: { wire_ids: strings("Comma-separated unread file wire IDs; omit to retrieve every unread file.") },
+    summary: "Write approved unread files into the bound identity\u2019s files directory.",
+    effects: "Writes received bytes and marks retrieved files processed. An explicit selection must contain 1\u201332 unique 64-hex wire IDs.",
+    exampleInput: { wire_ids: ["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"] }
+  },
+  version: { method: "version", fields: none, summary: "Show the selected daemon\u2019s version and protocol information.", effects: "Read-only." },
+  "state-dir": { method: "stateDir", fields: none, summary: "Show the selected daemon\u2019s canonical state directory.", effects: "Read-only." },
+  identities: { method: "identities", fields: none, summary: "Show the selected daemon\u2019s identity summary.", effects: "Read-only." },
+  unread: { method: "unread", fields: none, summary: "Show body-free unread counts and sender metadata.", effects: "Read-only; it never reveals message bodies or changes inbox status." },
+  "watch-notifications": {
+    method: "watchNotifications",
+    fields: {
+      identity: str("Identity whose body-free notification stream to follow.", true, void 0, "NAME"),
+      since: { kind: "cursor", help: "Byte cursor to resume from, or tip to wait only for new events; omitted defaults to tip.", valueName: "N|tip" }
+    },
+    summary: "Stream body-free notification events until interrupted.",
+    effects: "Long-running read. It does not reveal message bodies or change inbox status.",
+    exampleInput: { identity: "BuildBot", since: "tip" }
+  },
+  "fetch-file": {
+    method: "fetchFile",
+    fields: { wire_id: str("Received file wire ID.", true, void 0, "WIRE_ID") },
+    summary: "Return one already-stored received file as base64.",
+    effects: "Read-only; file bytes are emitted in the command result, so protect redirected output.",
+    exampleInput: { wire_id: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" }
+  }
+};
+var operationNames = () => Object.keys(OPERATION_SPECS).sort();
+var isOperationName = (value) => Object.prototype.hasOwnProperty.call(OPERATION_SPECS, value);
+function validateInput(input, operation) {
+  const spec = OPERATION_SPECS[operation];
+  for (const key of Object.keys(input)) {
+    if (!Object.prototype.hasOwnProperty.call(spec.fields, key)) throw new CliUsageError(`${operation}: unknown input field ${JSON.stringify(key)}`);
+  }
+  for (const [name, field] of Object.entries(spec.fields)) {
+    const item = input[name];
+    if (item === void 0) {
+      if (field.required) throw new CliUsageError(`${operation}: missing required input field ${JSON.stringify(name)}`);
+      continue;
+    }
+    let valid = false;
+    if (field.kind === "string") valid = typeof item === "string" && (field.values === void 0 || field.values.includes(item));
+    else if (field.kind === "boolean") valid = typeof item === "boolean";
+    else if (field.kind === "integer") valid = Number.isSafeInteger(item) && (!field.positive || Number(item) >= 1);
+    else if (field.kind === "string[]") valid = Array.isArray(item) && item.every((v) => typeof v === "string");
+    else if (field.kind === "integer[]") valid = Array.isArray(item) && item.every((v) => Number.isSafeInteger(v));
+    else valid = item === "tip" || Number.isSafeInteger(item) && Number(item) >= 0;
+    if (!valid) {
+      const expected = field.values ? field.values.map((value) => JSON.stringify(value)).join(" or ") : field.kind;
+      throw new CliUsageError(`${operation}: input field ${JSON.stringify(name)} must be ${expected}`);
+    }
+  }
+  spec.refine?.(input);
+  return input;
+}
+function parseOperationJson(raw, operation) {
+  let value = {};
+  if (raw !== void 0) {
+    try {
+      value = JSON.parse(raw);
+    } catch (error) {
+      throw new CliUsageError(`--input is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new CliUsageError("--input must be a JSON object");
+  return validateInput(value, operation);
+}
+var fieldFlag = (name) => `--${name.replaceAll("_", "-").replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`;
+function operationSpec(operation) {
+  return OPERATION_SPECS[operation];
+}
+function operationValueFlags(operation) {
+  return new Set(Object.keys(OPERATION_SPECS[operation].fields).map(fieldFlag));
+}
+function operationEmptyValueFlags(operation) {
+  return new Set(Object.entries(OPERATION_SPECS[operation].fields).filter(([, field]) => field.allowEmpty === true).map(([name]) => fieldFlag(name)));
+}
+function operationInputFromFlags(operation, values, defaults = {}) {
+  const input = { ...defaults };
+  for (const [name, field] of Object.entries(OPERATION_SPECS[operation].fields)) {
+    const flag = fieldFlag(name);
+    const raw = values[flag];
+    if (raw === void 0) continue;
+    if (field.kind === "boolean") input[name] = parseBoolean(raw, flag);
+    else if (field.kind === "integer") input[name] = parseCliInteger(raw, flag, field.positive === true);
+    else if (field.kind === "integer[]") input[name] = raw === "" ? [] : raw.split(",").map((v) => parseCliInteger(v, flag));
+    else if (field.kind === "string[]") input[name] = raw === "" ? [] : raw.split(",");
+    else if (field.kind === "cursor") input[name] = raw === "tip" ? "tip" : parseCliInteger(raw, flag);
+    else input[name] = raw;
+  }
+  return validateInput(input, operation);
+}
+function parseCliInteger(raw, flag, positive = false) {
+  if (!/^[0-9]+$/.test(raw)) throw new CliUsageError(`${flag} must be an integer`);
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || positive && value < 1) throw new CliUsageError(`${flag} is outside the supported integer range`);
+  return value;
+}
+async function invokeOperation(client, operation, input) {
+  if (operation === "watch-notifications") throw new Error("watch-notifications is a streaming operation");
+  if (operation === "fetch-file") {
+    const bytes = await client.fetchFile(input.wire_id);
+    return { wire_id: input.wire_id, bytes: bytes.byteLength, data_base64: Buffer.from(bytes).toString("base64") };
+  }
+  const spec = OPERATION_SPECS[operation];
+  const fn = client[spec.method];
+  return Object.keys(spec.fields).length === 0 ? fn.call(client) : fn.call(client, input);
+}
+
+export {
+  OPERATION_SPECS,
+  operationNames,
+  isOperationName,
+  parseOperationJson,
+  fieldFlag,
+  operationSpec,
+  operationValueFlags,
+  operationEmptyValueFlags,
+  operationInputFromFlags,
+  invokeOperation
+};

package/dist/chunk-YSHMCQ2B.js

@@ -0,0 +1,174 @@
+// src/commands.ts
+var operation = (name, defaults) => defaults === void 0 ? { kind: "operation", operation: name } : { kind: "operation", operation: name, defaults };
+var COMMAND_GROUPS = {
+  daemon: {
+    summary: "Run, inspect, and integrate the shared ours daemon.",
+    commands: {
+      serve: {
+        kind: "daemon",
+        handler: "serve",
+        summary: "Run the daemon in the foreground until interrupted.",
+        effects: "Starts a daemon in this process. --managed also writes the CLI-owned PID record used by stop and restart.",
+        example: "ours daemon serve --config /etc/ours/config.json"
+      },
+      start: {
+        kind: "daemon",
+        handler: "start",
+        summary: "Start a detached daemon managed by this CLI.",
+        effects: "Spawns a background process, writes a PID record and log in the selected state directory, and waits up to 20 seconds for readiness.",
+        example: "ours daemon start --config /etc/ours/config.json"
+      },
+      stop: {
+        kind: "daemon",
+        handler: "stop",
+        summary: "Stop a daemon previously started by this CLI.",
+        effects: "Signals only a process corroborated by the selected daemon and CLI-owned PID record; it refuses to signal externally managed daemons.",
+        example: "ours daemon stop --config /etc/ours/config.json"
+      },
+      restart: {
+        kind: "daemon",
+        handler: "restart",
+        summary: "Stop and start a CLI-managed daemon.",
+        effects: "Uses the same ownership checks as stop, then starts a detached replacement.",
+        example: "ours daemon restart --config /etc/ours/config.json"
+      },
+      status: {
+        kind: "daemon",
+        handler: "status",
+        summary: "Report whether the selected daemon is running and CLI-managed.",
+        effects: "Read-only. Exit status is 0 when running and 3 when stopped.",
+        example: "ours daemon status --json"
+      },
+      "install-service": {
+        kind: "daemon",
+        handler: "install-service",
+        summary: "Install and enable the Linux user systemd service.",
+        effects: "Changes ~/.config/systemd/user/ours.service and runs systemctl --user. Requires --yes unless --dry-run is used; --force may replace only an existing unowned unit.",
+        example: "ours daemon install-service --dry-run --json"
+      },
+      "uninstall-service": {
+        kind: "daemon",
+        handler: "uninstall-service",
+        summary: "Disable and remove the Linux user systemd service owned by this CLI.",
+        effects: "Changes the user service manager. Requires --yes unless --dry-run is used and refuses to remove an unowned unit.",
+        example: "ours daemon uninstall-service --dry-run --json"
+      },
+      info: operation("version"),
+      identities: operation("identities"),
+      unread: operation("unread"),
+      watch: operation("watch-notifications")
+    }
+  },
+  config: {
+    summary: "Inspect redacted connection configuration or update safe daemon settings.",
+    commands: {
+      show: {
+        kind: "config",
+        handler: "show",
+        summary: "Show the resolved daemon selection and redacted stored configuration.",
+        effects: "Read-only. Reports whether token/STT sections exist but never prints their secret values.",
+        example: "ours config show --json"
+      },
+      setup: {
+        kind: "config",
+        handler: "setup",
+        summary: "Write one or more safe daemon settings noninteractively.",
+        effects: "Writes a mode-0600 JSON config unless --dry-run is used. Unknown and secret fields already present are preserved and never printed.",
+        example: "ours config setup --port 3070 --state-dir /srv/ours-a --api-visibility owner"
+      }
+    }
+  },
+  identity: {
+    summary: "Create, bind, inspect, pin, release, and remove identities.",
+    commands: {
+      create: operation("create-identity", { bio: "", exposeLocal: true, localAutoAccept: true }),
+      "create-temporary": operation("create-temporary-identity", { bio: "", exposeLocal: false, localAutoAccept: true }),
+      "close-temporary": operation("close-temporary-identity"),
+      "create-root": operation("create-root-identity", { bio: "", exposeLocal: true, localAutoAccept: true, skipIfRootExists: true }),
+      pin: operation("define-local-identity-file", { force: false, exposeLocal: true, localAutoAccept: true, overwrite: false }),
+      use: operation("choose-identity", { force: false }),
+      list: operation("list-identities"),
+      show: operation("current-identity"),
+      remove: operation("remove-identity"),
+      release: operation("release-lease")
+    }
+  },
+  profile: {
+    summary: "Update the bound identity\u2019s public bio or private local persona.",
+    commands: { "set-bio": operation("set-bio"), "set-persona": operation("set-persona") }
+  },
+  invite: {
+    summary: "Create, inspect, revoke, and accept encrypted contact invitations.",
+    commands: {
+      create: operation("generate-invite"),
+      list: operation("list-invites"),
+      revoke: operation("revoke-invite"),
+      accept: operation("add-contact")
+    }
+  },
+  contact: {
+    summary: "Inspect contacts and manage local introductions and contact policy.",
+    commands: {
+      list: operation("list-contacts"),
+      local: operation("list-local-contact-book"),
+      policy: operation("set-local-book-policy"),
+      remove: operation("remove-contact"),
+      rename: operation("rename-contact"),
+      respond: operation("respond-to-introduction")
+    }
+  },
+  message: {
+    summary: "Send encrypted text and manage the incoming message queue.",
+    commands: {
+      send: operation("send-message"),
+      list: operation("list-incoming-messages"),
+      get: operation("get-messages"),
+      defer: operation("defer-messages")
+    }
+  },
+  file: {
+    summary: "Send encrypted files and authorize, retrieve, or defer received files.",
+    commands: {
+      send: operation("send-file"),
+      list: operation("list-incoming-files"),
+      get: operation("get-files"),
+      fetch: operation("fetch-file"),
+      defer: operation("defer-files")
+    }
+  },
+  conversation: {
+    summary: "Inspect retained conversations and receipts, mark them read, and set retention policy.",
+    commands: {
+      show: operation("get-conversation"),
+      receipts: operation("get-receipts"),
+      "mark-read": operation("mark-read"),
+      policy: operation("set-conversation-policy")
+    }
+  }
+};
+var DESTRUCTIVE_OPERATIONS = /* @__PURE__ */ new Set([
+  "close-temporary-identity",
+  "remove-identity",
+  "revoke-invite",
+  "remove-contact"
+]);
+var IDENTITY_PREBIND_EXCEPTIONS = /* @__PURE__ */ new Set([
+  "choose-identity",
+  "create-identity",
+  "create-temporary-identity",
+  "create-root-identity"
+]);
+function isCommandGroup(value) {
+  return Object.prototype.hasOwnProperty.call(COMMAND_GROUPS, value);
+}
+function commandSpec(group, command) {
+  return COMMAND_GROUPS[group].commands[command];
+}
+
+export {
+  COMMAND_GROUPS,
+  DESTRUCTIVE_OPERATIONS,
+  IDENTITY_PREBIND_EXCEPTIONS,
+  isCommandGroup,
+  commandSpec
+};