@ours.network/cli 0.1.0

package/dist/chunk-IUZOQT4D.js

@@ -0,0 +1,152 @@
+import {
+  CliUsageError,
+  parseBoolean
+} from "./chunk-AXXFFER2.js";
+
+// src/operations.ts
+var str = (required = false, values) => ({ kind: "string", required, values });
+var bool = (required = false) => ({ kind: "boolean", required });
+var integer = (required = false, positive = false) => ({ kind: "integer", required, positive });
+var strings = (required = false) => ({ kind: "string[]", required });
+var integers = (required = false) => ({ kind: "integer[]", required });
+var none = {};
+var OPERATION_SPECS = {
+  "create-identity": { method: "createIdentity", fields: { name: str(true), bio: str(true), exposeLocal: bool(true), localAutoAccept: bool(true) } },
+  "create-temporary-identity": { method: "createTemporaryIdentity", fields: { name: str(), bio: str(true), exposeLocal: bool(true), localAutoAccept: bool(true) } },
+  "close-temporary-identity": { method: "closeTemporaryIdentityOp", fields: { name: str() } },
+  "create-root-identity": { method: "createRootIdentity", fields: { name: str(true), bio: str(true), exposeLocal: bool(true), localAutoAccept: bool(true), skipIfRootExists: bool(true) } },
+  "define-local-identity-file": { method: "defineLocalIdentityFile", fields: { name: str(true), path: str(true), force: bool(true), exposeLocal: bool(true), localAutoAccept: bool(true), overwrite: bool(true) } },
+  "choose-identity": { method: "chooseIdentity", fields: { name: str(true), force: bool(true) } },
+  "list-identities": { method: "listIdentities", fields: none },
+  "current-identity": { method: "currentIdentity", fields: none },
+  "remove-identity": { method: "removeIdentity", fields: { name: str(true) } },
+  "release-lease": { method: "releaseLease", fields: none },
+  "generate-invite": { method: "generateInvite", fields: { name: str(), mode: str(false, ["one_time", "public"]) } },
+  "list-invites": { method: "listInvites", fields: none },
+  "revoke-invite": { method: "revokeInvite", fields: { invite_id: str(true) } },
+  "add-contact": { method: "addContact", fields: { invite: str(true), name: str() } },
+  "list-contacts": { method: "listContacts", fields: none },
+  "list-local-contact-book": { method: "listLocalContactBook", fields: none },
+  "set-local-book-policy": {
+    method: "setLocalBookPolicy",
+    fields: { expose: bool(), auto_accept: bool() },
+    refine: (a) => {
+      if (a.expose === void 0 && a.auto_accept === void 0) throw new CliUsageError("set-local-book-policy requires expose and/or auto_accept");
+    }
+  },
+  "remove-contact": { method: "removeContact", fields: { contact: str(true) } },
+  "rename-contact": { method: "renameContact", fields: { contact: str(true), name: str(true) } },
+  "respond-to-introduction": { method: "respondToIntroduction", fields: { contact: str(true), action: str(true, ["approve", "reject"]) } },
+  "set-bio": { method: "setBio", fields: { bio: str(true) } },
+  "set-persona": { method: "setPersona", fields: { persona: str(true) } },
+  "send-message": { method: "sendMessage", fields: { contact: str(true), text: str(true), reply_to_wire_id: str(), reply_to_sentence: integer(false, true) } },
+  "send-file": {
+    method: "sendFile",
+    fields: { contact: str(true), path: str(), data_base64: str(), filename: str(), mime: str(), reply_to_wire_id: str(), reply_to_sentence: integer(false, true) },
+    refine: (a) => {
+      if (a.path === void 0 === (a.data_base64 === void 0)) throw new CliUsageError("send-file requires exactly one of path or data_base64");
+      if (a.data_base64 !== void 0 && a.filename === void 0) throw new CliUsageError("send-file requires filename with data_base64");
+    }
+  },
+  "list-incoming-messages": { method: "listIncomingMessages", fields: none },
+  "get-messages": { method: "getMessages", fields: none },
+  "defer-messages": { method: "deferMessages", fields: { msg_ids: integers(true) } },
+  "defer-files": { method: "deferFiles", fields: { file_ids: integers(true) } },
+  "get-conversation": { method: "getConversation", fields: { contact: str(true) } },
+  "get-receipts": { method: "getReceipts", fields: { contact: str(true) } },
+  "mark-read": { method: "markRead", fields: { contact: str(true) } },
+  "set-conversation-policy": { method: "setConversationPolicy", fields: { keep_history: bool(true) } },
+  "list-incoming-files": { method: "listIncomingFiles", fields: none },
+  "get-files": { method: "getFiles", fields: { wire_ids: strings() } },
+  version: { method: "version", fields: none },
+  "state-dir": { method: "stateDir", fields: none },
+  identities: { method: "identities", fields: none },
+  unread: { method: "unread", fields: none },
+  "watch-notifications": { method: "watchNotifications", fields: { identity: str(true), since: { kind: "cursor" } } },
+  "fetch-file": { method: "fetchFile", fields: { wire_id: str(true) } }
+};
+var operationNames = () => Object.keys(OPERATION_SPECS).sort();
+var isOperationName = (value) => Object.prototype.hasOwnProperty.call(OPERATION_SPECS, value);
+function validateInput(input, operation) {
+  const spec = OPERATION_SPECS[operation];
+  for (const key of Object.keys(input)) {
+    if (!Object.prototype.hasOwnProperty.call(spec.fields, key)) throw new CliUsageError(`${operation}: unknown input field ${JSON.stringify(key)}`);
+  }
+  for (const [name, field] of Object.entries(spec.fields)) {
+    const item = input[name];
+    if (item === void 0) {
+      if (field.required) throw new CliUsageError(`${operation}: missing required input field ${JSON.stringify(name)}`);
+      continue;
+    }
+    let valid = false;
+    if (field.kind === "string") valid = typeof item === "string" && (field.values === void 0 || field.values.includes(item));
+    else if (field.kind === "boolean") valid = typeof item === "boolean";
+    else if (field.kind === "integer") valid = Number.isSafeInteger(item) && (!field.positive || Number(item) >= 1);
+    else if (field.kind === "string[]") valid = Array.isArray(item) && item.every((v) => typeof v === "string");
+    else if (field.kind === "integer[]") valid = Array.isArray(item) && item.every((v) => Number.isSafeInteger(v));
+    else valid = item === "tip" || Number.isSafeInteger(item) && Number(item) >= 0;
+    if (!valid) {
+      const expected = field.values ? field.values.map((value) => JSON.stringify(value)).join(" or ") : field.kind;
+      throw new CliUsageError(`${operation}: input field ${JSON.stringify(name)} must be ${expected}`);
+    }
+  }
+  spec.refine?.(input);
+  return input;
+}
+function parseOperationJson(raw, operation) {
+  let value = {};
+  if (raw !== void 0) {
+    try {
+      value = JSON.parse(raw);
+    } catch (error) {
+      throw new CliUsageError(`--input is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new CliUsageError("--input must be a JSON object");
+  return validateInput(value, operation);
+}
+var fieldFlag = (name) => `--${name.replaceAll("_", "-").replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`;
+function operationValueFlags(operation) {
+  return new Set(Object.keys(OPERATION_SPECS[operation].fields).map(fieldFlag));
+}
+function operationInputFromFlags(operation, values, defaults = {}) {
+  const input = { ...defaults };
+  for (const [name, field] of Object.entries(OPERATION_SPECS[operation].fields)) {
+    const flag = fieldFlag(name);
+    const raw = values[flag];
+    if (raw === void 0) continue;
+    if (field.kind === "boolean") input[name] = parseBoolean(raw, flag);
+    else if (field.kind === "integer") input[name] = parseCliInteger(raw, flag, field.positive === true);
+    else if (field.kind === "integer[]") input[name] = raw === "" ? [] : raw.split(",").map((v) => parseCliInteger(v, flag));
+    else if (field.kind === "string[]") input[name] = raw === "" ? [] : raw.split(",");
+    else if (field.kind === "cursor") input[name] = raw === "tip" ? "tip" : parseCliInteger(raw, flag);
+    else input[name] = raw;
+  }
+  return validateInput(input, operation);
+}
+function parseCliInteger(raw, flag, positive = false) {
+  if (!/^[0-9]+$/.test(raw)) throw new CliUsageError(`${flag} must be an integer`);
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || positive && value < 1) throw new CliUsageError(`${flag} is outside the supported integer range`);
+  return value;
+}
+async function invokeOperation(client, operation, input) {
+  if (operation === "watch-notifications") throw new Error("watch-notifications is a streaming operation");
+  if (operation === "fetch-file") {
+    const bytes = await client.fetchFile(input.wire_id);
+    return { wire_id: input.wire_id, bytes: bytes.byteLength, data_base64: Buffer.from(bytes).toString("base64") };
+  }
+  const spec = OPERATION_SPECS[operation];
+  const fn = client[spec.method];
+  return Object.keys(spec.fields).length === 0 ? fn.call(client) : fn.call(client, input);
+}
+
+export {
+  OPERATION_SPECS,
+  operationNames,
+  isOperationName,
+  parseOperationJson,
+  operationValueFlags,
+  operationInputFromFlags,
+  invokeOperation
+};

package/dist/chunk-YC7QBGVC.js

@@ -0,0 +1,31 @@
+// src/output.ts
+var processIo = {
+  stdout: (text) => process.stdout.write(text),
+  stderr: (text) => process.stderr.write(text)
+};
+function writeResult(io, result, json, label = "ok") {
+  if (json) {
+    io.stdout(`${JSON.stringify(result, null, 2)}
+`);
+    return;
+  }
+  if (result === void 0 || result === null) io.stdout(`${label}
+`);
+  else if (typeof result === "string" || typeof result === "number" || typeof result === "boolean") io.stdout(`${result}
+`);
+  else io.stdout(`${label}: ${JSON.stringify(result)}
+`);
+}
+function writeError(io, error, json) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (json) io.stderr(`${JSON.stringify({ error: { message, name: error instanceof Error ? error.name : "Error" } })}
+`);
+  else io.stderr(`ours: ${message}
+`);
+}
+
+export {
+  processIo,
+  writeResult,
+  writeError
+};

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+var argv = process.argv.slice(2);
+if (argv[0] === "daemon" && argv[1] === "serve") {
+  const value = (flag) => {
+    const exact = argv.indexOf(flag);
+    if (exact >= 0) return argv[exact + 1];
+    const prefix = `${flag}=`;
+    return argv.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+  };
+  const config = value("--config");
+  const port = value("--port");
+  const stateDir = value("--state-dir");
+  if (config) process.env.OURS_CONFIG = config;
+  if (port) process.env.OURS_PORT = port;
+  if (stateDir) process.env.OURS_STATE_DIR = stateDir;
+}
+var { runCli } = await import("./main.js");
+runCli(argv).then(
+  (code) => {
+    process.exitCode = code;
+  },
+  (error) => {
+    process.stderr.write(`ours: ${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  }
+);

package/dist/config-command.d.ts

@@ -0,0 +1,3 @@
+import { type SelectionOptions } from './connection.js';
+export declare function showConfig(selection: SelectionOptions): Promise<Record<string, unknown>>;
+export declare function setupConfig(path: string, patch: Record<string, unknown>, dryRun?: boolean): Record<string, unknown>;

package/dist/config-command.js

@@ -0,0 +1,9 @@
+import {
+  setupConfig,
+  showConfig
+} from "./chunk-G2GHHOYX.js";
+import "./chunk-6W3RHW3C.js";
+export {
+  setupConfig,
+  showConfig
+};

package/dist/connection.d.ts

@@ -0,0 +1,14 @@
+import { OursClient, type ResolvedDaemonConfig } from '@ours.network/sdk/client';
+export interface SelectionOptions {
+    endpoint?: string;
+    port?: number;
+    stateDir?: string;
+    configPath?: string;
+}
+export declare function defaultConfigPath(): string;
+export declare function resolveSelection(options?: SelectionOptions): ResolvedDaemonConfig;
+export declare function redactedSelection(config: ResolvedDaemonConfig): Record<string, unknown>;
+export declare function attachClient(config: ResolvedDaemonConfig, opts?: {
+    fetch?: typeof globalThis.fetch;
+    leaseToken?: string;
+}): Promise<OursClient>;

package/dist/connection.js

@@ -0,0 +1,12 @@
+import {
+  attachClient,
+  defaultConfigPath,
+  redactedSelection,
+  resolveSelection
+} from "./chunk-6W3RHW3C.js";
+export {
+  attachClient,
+  defaultConfigPath,
+  redactedSelection,
+  resolveSelection
+};

package/dist/lifecycle.d.ts

@@ -0,0 +1,36 @@
+import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
+import type { DaemonInfo, ResolvedDaemonConfig } from '@ours.network/sdk/client';
+import { type SelectionOptions } from './connection.js';
+export declare const MANAGED_PID_FILE = "ours-cli-daemon.json";
+export declare const DAEMON_LOG_FILE = "ours-cli-daemon.log";
+interface ManagedRecord {
+    version: 1;
+    owner: '@ours.network/cli';
+    pid: number;
+    port: number;
+    stateDir: string;
+    startedAt: string;
+}
+export interface DaemonStatus {
+    state: 'running' | 'stopped';
+    managed: boolean;
+    info: DaemonInfo | null;
+    stateDir: string;
+    pidFile: string;
+    stalePidFile: boolean;
+}
+export interface LifecycleDeps {
+    fetch: typeof globalThis.fetch;
+    spawn(executable: string, args: string[], options: Parameters<typeof nodeSpawn>[2]): ChildProcess;
+    kill(pid: number, signal: NodeJS.Signals | 0): void;
+    now(): number;
+    delay(ms: number): Promise<void>;
+    cliPath: string;
+}
+export declare function readManagedRecord(stateDir: string): ManagedRecord | null;
+export declare function writeManagedRecord(stateDir: string, port: number): string;
+export declare function inspectDaemon(config: ResolvedDaemonConfig, deps?: LifecycleDeps): Promise<DaemonStatus>;
+export declare function serveDaemon(selection: SelectionOptions, managed?: boolean): Promise<never>;
+export declare function startDaemonManaged(selection: SelectionOptions, deps?: LifecycleDeps): Promise<DaemonStatus>;
+export declare function stopDaemonManaged(config: ResolvedDaemonConfig, deps?: LifecycleDeps): Promise<DaemonStatus>;
+export {};

package/dist/lifecycle.js

@@ -0,0 +1,21 @@
+import {
+  DAEMON_LOG_FILE,
+  MANAGED_PID_FILE,
+  inspectDaemon,
+  readManagedRecord,
+  serveDaemon,
+  startDaemonManaged,
+  stopDaemonManaged,
+  writeManagedRecord
+} from "./chunk-4IFFMMQO.js";
+import "./chunk-6W3RHW3C.js";
+export {
+  DAEMON_LOG_FILE,
+  MANAGED_PID_FILE,
+  inspectDaemon,
+  readManagedRecord,
+  serveDaemon,
+  startDaemonManaged,
+  stopDaemonManaged,
+  writeManagedRecord
+};

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+import { type CliIo } from './output.js';
+export declare function runCli(argv: string[], io?: CliIo): Promise<number>;

package/dist/main.js

@@ -0,0 +1,250 @@
+import {
+  createLinuxUserSystemdAdapter
+} from "./chunk-67BC2E5U.js";
+import {
+  setupConfig,
+  showConfig
+} from "./chunk-G2GHHOYX.js";
+import {
+  inspectDaemon,
+  serveDaemon,
+  startDaemonManaged,
+  stopDaemonManaged
+} from "./chunk-4IFFMMQO.js";
+import {
+  attachClient,
+  defaultConfigPath,
+  resolveSelection
+} from "./chunk-6W3RHW3C.js";
+import {
+  invokeOperation,
+  isOperationName,
+  operationInputFromFlags,
+  operationNames,
+  operationValueFlags,
+  parseOperationJson
+} from "./chunk-IUZOQT4D.js";
+import {
+  CliUsageError,
+  parseBoolean,
+  parseFlags,
+  parseInteger
+} from "./chunk-AXXFFER2.js";
+import {
+  processIo,
+  writeError,
+  writeResult
+} from "./chunk-YC7QBGVC.js";
+
+// src/main.ts
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+var CLI_VERSION = false ? "0.0.0-dev" : "0.1.0";
+var COMMON_VALUES = /* @__PURE__ */ new Set(["--endpoint", "--port", "--state-dir", "--config", "--identity"]);
+var COMMON_BOOLEANS = /* @__PURE__ */ new Set(["--json", "--yes", "--help"]);
+var DESTRUCTIVE = /* @__PURE__ */ new Set(["close-temporary-identity", "remove-identity", "revoke-invite", "remove-contact"]);
+var GROUPED = {
+  daemon: {
+    info: { operation: "version" },
+    identities: { operation: "identities" },
+    unread: { operation: "unread" },
+    watch: { operation: "watch-notifications" }
+  },
+  identity: {
+    create: { operation: "create-identity", defaults: { bio: "", exposeLocal: true, localAutoAccept: true } },
+    "create-temporary": { operation: "create-temporary-identity", defaults: { bio: "", exposeLocal: false, localAutoAccept: true } },
+    "close-temporary": { operation: "close-temporary-identity" },
+    "create-root": { operation: "create-root-identity", defaults: { bio: "", exposeLocal: true, localAutoAccept: true, skipIfRootExists: true } },
+    pin: { operation: "define-local-identity-file", defaults: { force: false, exposeLocal: true, localAutoAccept: true, overwrite: false } },
+    use: { operation: "choose-identity", defaults: { force: false } },
+    list: { operation: "list-identities" },
+    show: { operation: "current-identity" },
+    remove: { operation: "remove-identity" },
+    release: { operation: "release-lease" }
+  },
+  profile: { "set-bio": { operation: "set-bio" }, "set-persona": { operation: "set-persona" } },
+  invite: { create: { operation: "generate-invite" }, list: { operation: "list-invites" }, revoke: { operation: "revoke-invite" }, accept: { operation: "add-contact" } },
+  contact: {
+    list: { operation: "list-contacts" },
+    local: { operation: "list-local-contact-book" },
+    policy: { operation: "set-local-book-policy" },
+    remove: { operation: "remove-contact" },
+    rename: { operation: "rename-contact" },
+    respond: { operation: "respond-to-introduction" }
+  },
+  message: { send: { operation: "send-message" }, list: { operation: "list-incoming-messages" }, get: { operation: "get-messages" }, defer: { operation: "defer-messages" } },
+  file: { send: { operation: "send-file" }, list: { operation: "list-incoming-files" }, get: { operation: "get-files" }, fetch: { operation: "fetch-file" }, defer: { operation: "defer-files" } },
+  conversation: {
+    show: { operation: "get-conversation" },
+    receipts: { operation: "get-receipts" },
+    "mark-read": { operation: "mark-read" },
+    policy: { operation: "set-conversation-policy" }
+  }
+};
+var HELP = `ours ${CLI_VERSION} \u2014 operator CLI for the shared ours daemon
+
+Usage:
+  ours daemon serve|start|stop|restart|status [selection options]
+  ours daemon install-service|uninstall-service --yes [--dry-run]
+  ours daemon info|identities|unread|watch [operation options]
+  ours config show|setup [configuration options]
+  ours identity|profile|invite|contact|message|file|conversation <command> [options]
+  ours api list | ours api <operation> [--input JSON|--input-file PATH]
+  ours version
+
+Selection: --endpoint URL --port N --state-dir PATH --config PATH
+Output: --json. Destructive operations require --yes.
+Run \`ours api list --json\` for the expert operation allowlist.
+`;
+function selectionFrom(values) {
+  return {
+    endpoint: values["--endpoint"],
+    port: values["--port"] === void 0 ? void 0 : parseInteger(values["--port"], "--port", 1, 65535),
+    stateDir: values["--state-dir"],
+    configPath: values["--config"]
+  };
+}
+function requireYes(operation, yes) {
+  if (DESTRUCTIVE.has(operation) && !yes) throw new CliUsageError(`${operation} is destructive; re-run with --yes`);
+}
+async function runOperation(operation, input, selection, identity, io, json) {
+  const client = await attachClient(await resolveSelection(selection));
+  if (identity !== void 0 && !["choose-identity", "create-identity", "create-temporary-identity", "create-root-identity"].includes(operation)) {
+    await client.chooseIdentity({ name: identity, force: false });
+  }
+  if (operation === "watch-notifications") {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    process.once("SIGINT", abort);
+    process.once("SIGTERM", abort);
+    try {
+      for await (const event of client.watchNotifications(input.identity, { since: input.since, signal: controller.signal })) {
+        io.stdout(`${JSON.stringify(event)}
+`);
+      }
+    } finally {
+      process.off("SIGINT", abort);
+      process.off("SIGTERM", abort);
+    }
+    return;
+  }
+  writeResult(io, await invokeOperation(client, operation, input), json, operation);
+}
+async function runApi(args, io) {
+  const operation = args[0];
+  if (operation === "list") {
+    const flags2 = parseFlags(args.filter((value) => value !== "list"), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(["--json", "--help"]));
+    writeResult(io, operationNames(), flags2.booleans.has("--json"), "operations");
+    return 0;
+  }
+  if (!operation || !isOperationName(operation)) throw new CliUsageError(`unknown API operation ${JSON.stringify(operation ?? "")}; run \`ours api list\``);
+  const valueFlags = /* @__PURE__ */ new Set([...COMMON_VALUES, "--input", "--input-file"]);
+  const flags = parseFlags(args, valueFlags, COMMON_BOOLEANS);
+  if (flags.positionals.length !== 1) throw new CliUsageError("api accepts exactly one operation");
+  if (flags.values["--input"] !== void 0 && flags.values["--input-file"] !== void 0) throw new CliUsageError("--input and --input-file are mutually exclusive");
+  const fromFile = flags.values["--input-file"];
+  const raw = fromFile === void 0 ? flags.values["--input"] : readFileSync(fromFile === "-" ? 0 : fromFile, "utf8");
+  requireYes(operation, flags.booleans.has("--yes"));
+  await runOperation(operation, parseOperationJson(raw, operation), selectionFrom(flags.values), flags.values["--identity"], io, flags.booleans.has("--json"));
+  return 0;
+}
+async function runGrouped(group, args, io) {
+  const action = args[0];
+  const spec = action === void 0 ? void 0 : GROUPED[group]?.[action];
+  if (!action || !spec) throw new CliUsageError(`unknown ${group} command ${JSON.stringify(action ?? "")}`);
+  const flags = parseFlags(args, /* @__PURE__ */ new Set([...COMMON_VALUES, ...operationValueFlags(spec.operation)]), COMMON_BOOLEANS);
+  if (flags.positionals.length !== 1) throw new CliUsageError(`${group} accepts exactly one command`);
+  requireYes(spec.operation, flags.booleans.has("--yes"));
+  const input = operationInputFromFlags(spec.operation, flags.values, spec.defaults);
+  await runOperation(spec.operation, input, selectionFrom(flags.values), flags.values["--identity"], io, flags.booleans.has("--json"));
+  return 0;
+}
+async function runConfig(args, io) {
+  const values = /* @__PURE__ */ new Set([...COMMON_VALUES, "--broker-url", "--gc-interval-ms", "--auto-start", "--api-visibility"]);
+  const flags = parseFlags(args, values, /* @__PURE__ */ new Set(["--json", "--dry-run", "--help"]));
+  const action = flags.positionals[0];
+  if (flags.positionals.length !== 1 || !["show", "setup"].includes(action)) throw new CliUsageError("config requires show or setup");
+  const json = flags.booleans.has("--json");
+  if (action === "show") {
+    writeResult(io, await showConfig(selectionFrom(flags.values)), json, "config");
+    return 0;
+  }
+  const patch = {};
+  if (flags.values["--broker-url"]) patch.brokerUrl = flags.values["--broker-url"];
+  if (flags.values["--port"]) patch.port = parseInteger(flags.values["--port"], "--port", 1, 65535);
+  if (flags.values["--state-dir"]) patch.stateDir = resolve(flags.values["--state-dir"]);
+  if (flags.values["--gc-interval-ms"]) patch.gcIntervalMs = parseInteger(flags.values["--gc-interval-ms"], "--gc-interval-ms", 1);
+  if (flags.values["--auto-start"]) patch.autoStart = parseBoolean(flags.values["--auto-start"], "--auto-start");
+  if (flags.values["--api-visibility"]) {
+    const visibility = flags.values["--api-visibility"];
+    if (!["owner", "shared", "open"].includes(visibility)) throw new CliUsageError("--api-visibility must be owner, shared, or open");
+    patch.apiVisibility = visibility;
+  }
+  if (Object.keys(patch).length === 0) throw new CliUsageError("config setup requires at least one setting");
+  writeResult(io, setupConfig(flags.values["--config"] ?? defaultConfigPath(), patch, flags.booleans.has("--dry-run")), json, "config updated");
+  return 0;
+}
+async function runDaemon(args, io) {
+  const action = args[0];
+  if (action && GROUPED.daemon[action]) return runGrouped("daemon", args, io);
+  const values = new Set(COMMON_VALUES);
+  const booleans = /* @__PURE__ */ new Set([...COMMON_BOOLEANS, "--managed", "--dry-run", "--force"]);
+  const flags = parseFlags(args, values, booleans);
+  if (flags.positionals.length !== 1) throw new CliUsageError("daemon accepts exactly one command");
+  const selection = selectionFrom(flags.values);
+  const json = flags.booleans.has("--json");
+  if (action === "serve") return serveDaemon(selection, flags.booleans.has("--managed"));
+  if (action === "status") {
+    const status = await inspectDaemon(await resolveSelection(selection));
+    writeResult(io, status, json, status.state);
+    return status.state === "running" ? 0 : 3;
+  }
+  if (action === "start") {
+    writeResult(io, await startDaemonManaged(selection), json, "started");
+    return 0;
+  }
+  if (action === "stop") {
+    writeResult(io, await stopDaemonManaged(await resolveSelection(selection)), json, "stopped");
+    return 0;
+  }
+  if (action === "restart") {
+    await stopDaemonManaged(await resolveSelection(selection));
+    writeResult(io, await startDaemonManaged(selection), json, "restarted");
+    return 0;
+  }
+  if (action === "install-service" || action === "uninstall-service") {
+    const dryRun = flags.booleans.has("--dry-run");
+    if (!dryRun && !flags.booleans.has("--yes")) throw new CliUsageError(`${action} changes the user service manager; re-run with --yes or preview with --dry-run`);
+    const adapter = createLinuxUserSystemdAdapter();
+    const context = { cliPath: process.argv[1], configPath: selection.configPath, dryRun, force: flags.booleans.has("--force") };
+    const result = action === "install-service" ? await adapter.install(context) : await adapter.uninstall(context);
+    writeResult(io, result, json, action);
+    return 0;
+  }
+  throw new CliUsageError(`unknown daemon command ${JSON.stringify(action ?? "")}`);
+}
+async function runCli(argv, io = processIo) {
+  const wantsJson = argv.includes("--json");
+  try {
+    if (argv.length === 0 || argv.includes("--help") || argv[0] === "help") {
+      io.stdout(HELP);
+      return 0;
+    }
+    const [command, ...args] = argv;
+    if (command === "version") {
+      writeResult(io, wantsJson ? { name: "@ours.network/cli", version: CLI_VERSION } : `ours ${CLI_VERSION}`, wantsJson);
+      return 0;
+    }
+    if (command === "daemon") return await runDaemon(args, io);
+    if (command === "config") return await runConfig(args, io);
+    if (command === "api") return await runApi(args, io);
+    if (GROUPED[command]) return await runGrouped(command, args, io);
+    throw new CliUsageError(`unknown command ${JSON.stringify(command)}`);
+  } catch (error) {
+    writeError(io, error, wantsJson);
+    return error instanceof CliUsageError ? error.exitCode : 1;
+  }
+}
+export {
+  runCli
+};