spur-board 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,799 @@
+import { o as OPERATIONS } from "./src-CqH_W7D8.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-C1hJzdYE.mjs";
+import { n as loadEnrollmentConfig, t as loadClientConfig } from "./config-DQmktVi-.mjs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { Command, CommanderError } from "@commander-js/extra-typings";
+import { z } from "zod";
+import YAML from "yaml";
+import { spawn } from "node:child_process";
+import { access, cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+//#region src/manifest.ts
+const botScopes = [
+	"chat:write",
+	"chat:write.customize",
+	"groups:history",
+	"groups:read",
+	"app_mentions:read",
+	"commands",
+	"reactions:write"
+];
+function renderSlackManifest(options = {}) {
+	const appName = (options.appName ?? "spur-board").trim();
+	const command = options.command ?? "/board";
+	if (!appName) throw new CliError("usage", void 0, void 0, "Set a nonempty --app-name.");
+	if (!/^\/[a-z0-9_-]+$/.test(command)) throw new CliError("usage", void 0, void 0, "Set --command to a slash command such as /board.");
+	return YAML.stringify({
+		_metadata: {
+			major_version: 1,
+			minor_version: 1
+		},
+		display_information: {
+			name: appName,
+			description: "Board updates and commands"
+		},
+		features: {
+			bot_user: { display_name: appName },
+			slash_commands: [{
+				command,
+				description: "Show board tasks and command help",
+				usage_hint: "[task <KEY> [history]]",
+				should_escape: false
+			}]
+		},
+		oauth_config: { scopes: { bot: [...botScopes] } },
+		settings: {
+			event_subscriptions: { bot_events: ["message.groups", "app_mention"] },
+			interactivity: { is_enabled: true },
+			socket_mode_enabled: true
+		}
+	}, { lineWidth: 0 });
+}
+//#endregion
+//#region src/service.ts
+const serviceName = "spur-board.service";
+function configHome(env, home) {
+	const configured = env["XDG_CONFIG_HOME"];
+	return configured && isAbsolute(configured) ? configured : join(home, ".config");
+}
+function servicePaths(options = {}) {
+	const home = resolve(options.home ?? homedir());
+	const env = options.env ?? process.env;
+	const configDir = configHome(env, home);
+	const boardHome = env["BOARD_HOME"];
+	const secretsDir = boardHome ? resolve(boardHome) : join(configDir, "spur-board");
+	const environment = boardHome ? [`BOARD_HOME=${secretsDir}`] : [...env["XDG_CONFIG_HOME"] && isAbsolute(env["XDG_CONFIG_HOME"]) ? [`XDG_CONFIG_HOME=${configDir}`] : [], ...env["XDG_DATA_HOME"] && isAbsolute(env["XDG_DATA_HOME"]) ? [`XDG_DATA_HOME=${env["XDG_DATA_HOME"]}`] : []];
+	const packedDaemon = fileURLToPath(new URL("./daemon.mjs", import.meta.url));
+	return {
+		nodePath: options.nodePath ?? process.execPath,
+		daemonEntry: options.daemonEntry ?? (existsSync(packedDaemon) ? packedDaemon : fileURLToPath(new URL("../../daemon/src/main.ts", import.meta.url))),
+		secretsFile: join(secretsDir, "secrets.env"),
+		unitFile: join(configDir, "systemd", "user", serviceName),
+		environment
+	};
+}
+function unitArgument(value) {
+	return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
+}
+function renderUserUnit(paths) {
+	return [
+		"[Unit]",
+		"Description=spur-board daemon",
+		"After=network-online.target",
+		"Wants=network-online.target",
+		"",
+		"[Service]",
+		"Type=simple",
+		`ExecStart=${unitArgument(paths.nodePath)} ${unitArgument(paths.daemonEntry)}`,
+		...(paths.environment ?? []).map((entry) => `Environment=${unitArgument(entry)}`),
+		`EnvironmentFile=${unitArgument(paths.secretsFile)}`,
+		"Restart=on-failure",
+		"RestartSec=5s",
+		"TimeoutStopSec=15s",
+		"",
+		"[Install]",
+		"WantedBy=default.target",
+		""
+	].join("\n");
+}
+async function runCommand(command, args) {
+	return new Promise((resolveResult, reject) => {
+		const child = spawn(command, [...args], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.on("error", reject);
+		child.on("close", (code) => {
+			resolveResult({
+				exitCode: code ?? 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+async function requireSuccess(runner, command, args) {
+	const result = await runner(command, args);
+	if (result.exitCode !== 0) {
+		const detail = result.stderr.trim() || result.stdout.trim() || `exit ${String(result.exitCode)}`;
+		throw new Error(`${command} ${args.join(" ")} failed: ${detail}`);
+	}
+	return result;
+}
+async function preflight(paths) {
+	for (const [label, path] of [["Node executable", paths.nodePath], ["daemon entry", paths.daemonEntry]]) {
+		if (!isAbsolute(path)) throw new Error(`${label} path must be absolute: ${path}`);
+		try {
+			const file = await stat(path);
+			if (!file.isFile() || (file.mode & 292) === 0) throw new Error("not a readable file");
+			if (label === "Node executable" && (file.mode & 73) === 0) throw new Error("not executable");
+			await access(path, label === "Node executable" ? constants.R_OK | constants.X_OK : constants.R_OK);
+		} catch {
+			throw new Error(`${label} is ${label === "Node executable" ? "missing, unreadable, or not executable" : "missing or unreadable"}: ${path}`);
+		}
+	}
+	try {
+		const secrets = await stat(paths.secretsFile);
+		if (!secrets.isFile() || (secrets.mode & 511) !== 384) throw new Error("invalid mode");
+		await access(paths.secretsFile, constants.R_OK);
+	} catch {
+		throw new Error(`Secrets file must exist as a readable mode 0600 file: ${paths.secretsFile}`);
+	}
+}
+async function existingUnit(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+async function installService(options = {}) {
+	const paths = servicePaths(options);
+	await preflight(paths);
+	const runner = options.runner ?? runCommand;
+	const unit = renderUserUnit(paths);
+	const previousUnit = await existingUnit(paths.unitFile);
+	const changed = previousUnit !== unit;
+	let wasActive = false;
+	if (changed) {
+		await mkdir(dirname(paths.unitFile), { recursive: true });
+		await writeFile(paths.unitFile, unit);
+		await requireSuccess(runner, "systemctl", ["--user", "daemon-reload"]);
+		if (previousUnit !== void 0) {
+			const state = await runner("systemctl", [
+				"--user",
+				"is-active",
+				serviceName
+			]);
+			wasActive = state.exitCode === 0 && state.stdout.trim() === "active";
+		}
+	}
+	await requireSuccess(runner, "systemctl", [
+		"--user",
+		"enable",
+		"--now",
+		serviceName
+	]);
+	if (wasActive) await requireSuccess(runner, "systemctl", [
+		"--user",
+		"restart",
+		serviceName
+	]);
+	return {
+		unitFile: paths.unitFile,
+		changed
+	};
+}
+async function restartService(options = {}) {
+	await requireSuccess(options.runner ?? runCommand, "systemctl", [
+		"--user",
+		"restart",
+		serviceName
+	]);
+}
+async function statusService(options = {}) {
+	const runner = options.runner ?? runCommand;
+	const active = await runner("systemctl", [
+		"--user",
+		"is-active",
+		serviceName
+	]);
+	const enabled = await runner("systemctl", [
+		"--user",
+		"is-enabled",
+		serviceName
+	]);
+	const linger = await requireSuccess(runner, "loginctl", [
+		"show-user",
+		options.username ?? userInfo().username,
+		"--property=Linger",
+		"--value"
+	]);
+	return {
+		active: active.stdout.trim() || "unknown",
+		enabled: enabled.stdout.trim() || "unknown",
+		lingering: linger.stdout.trim() === "yes"
+	};
+}
+async function uninstallService(options = {}) {
+	const unitFile = servicePaths(options).unitFile;
+	if (await existingUnit(unitFile) === void 0) return { changed: false };
+	const runner = options.runner ?? runCommand;
+	await requireSuccess(runner, "systemctl", [
+		"--user",
+		"disable",
+		"--now",
+		serviceName
+	]);
+	await rm(unitFile);
+	await requireSuccess(runner, "systemctl", ["--user", "daemon-reload"]);
+	return { changed: true };
+}
+//#endregion
+//#region src/skills.ts
+const stampName = ".spur-board-install.json";
+const installId = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const skills = [{
+	source: "spur-board",
+	name: "spur-board"
+}, {
+	source: "setup",
+	name: "spur-board-setup"
+}];
+const agents = [".claude", ".codex"];
+async function packageVersion(packageRoot) {
+	const manifest = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
+	if (typeof manifest.version !== "string" || !manifest.version) throw new Error("The spur-board package has no version.");
+	return manifest.version;
+}
+async function requireSource(path) {
+	try {
+		const source = await stat(path);
+		const skillFile = await stat(join(path, "SKILL.md"));
+		if (source.isDirectory() && skillFile.isFile()) return;
+	} catch {}
+	throw new Error(`Bundled skill is missing or invalid: ${path}`);
+}
+async function currentVersion(path, version) {
+	let content;
+	try {
+		content = await readFile(join(path, stampName), "utf8");
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "EISDIR")) return false;
+		throw error;
+	}
+	try {
+		const stamp = JSON.parse(content);
+		return stamp.version === version && typeof stamp.installedAt === "string" && new Date(stamp.installedAt).toISOString() === stamp.installedAt;
+	} catch {
+		return false;
+	}
+}
+async function targetDirectory(path) {
+	try {
+		const entry = await lstat(path);
+		if (entry.isSymbolicLink() || !entry.isDirectory()) throw new Error(`Skill install target must be a directory, not a symlink: ${path}`);
+		return true;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function checkTarget(home, agent, destination) {
+	const parent = join(home, agent, "skills");
+	await targetDirectory(join(home, agent));
+	await targetDirectory(parent);
+	return targetDirectory(destination);
+}
+async function withInstallLock(home, action) {
+	const fd = openSync(join(home, ".spur-board-skills-install.lock"), constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 384);
+	try {
+		await new Promise((resolveLock, reject) => {
+			const child = spawn("flock", [
+				"-x",
+				"-w",
+				"30",
+				"3"
+			], { stdio: [
+				"ignore",
+				"ignore",
+				"pipe",
+				fd
+			] });
+			let stderr = "";
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (chunk) => {
+				stderr += chunk;
+			});
+			child.once("error", (error) => {
+				reject(/* @__PURE__ */ new Error(`flock from util-linux is required for skill installation: ${error.message}`));
+			});
+			child.once("close", (code) => {
+				if (code === 0) resolveLock();
+				else reject(/* @__PURE__ */ new Error(`Could not lock skill installation: ${stderr.trim() || `exit ${String(code)}`}`));
+			});
+		});
+		return await action();
+	} finally {
+		closeSync(fd);
+	}
+}
+async function recoverSkill(parent, destination, name) {
+	if (!await targetDirectory(parent)) return;
+	const entries = await readdir(parent);
+	const backupPrefix = `.${name}-backup-`;
+	const backups = [];
+	for (const entry of entries) {
+		if (!entry.startsWith(backupPrefix) || !entry.endsWith(".owner")) continue;
+		const id = entry.slice(backupPrefix.length, -6);
+		if (!installId.test(id)) continue;
+		const owner = join(parent, entry);
+		const ownerStat = await lstat(owner);
+		if (!ownerStat.isFile() || ownerStat.isSymbolicLink()) continue;
+		const content = await readFile(owner, "utf8");
+		const prefix = `spur-board backup ${id} `;
+		if (!content.startsWith(prefix) || !/^\d+:\d+\n$/.test(content.slice(prefix.length))) continue;
+		const path = join(parent, `${backupPrefix}${id}`);
+		if (!await targetDirectory(path)) {
+			await rm(owner);
+			continue;
+		}
+		const backupStat = await lstat(path, { bigint: true });
+		if (content !== `${prefix}${String(backupStat.dev)}:${String(backupStat.ino)}\n`) continue;
+		backups.push({
+			path,
+			owner
+		});
+	}
+	const exists = await targetDirectory(destination);
+	if (!exists && backups.length > 1) throw new Error(`Multiple interrupted backups exist for ${destination}`);
+	if (!exists && backups[0]) {
+		await rename(backups[0].path, destination);
+		await rm(backups[0].owner);
+	} else if (exists) for (const backup of backups) {
+		await rm(backup.path, { recursive: true });
+		await rm(backup.owner);
+	}
+	const stagePrefix = `.${name}-stage-`;
+	for (const entry of entries) {
+		if (!entry.startsWith(stagePrefix) || !entry.endsWith(".owner")) continue;
+		const id = entry.slice(stagePrefix.length, -6);
+		if (!installId.test(id)) continue;
+		const owner = join(parent, entry);
+		const ownerStat = await lstat(owner);
+		if (!ownerStat.isFile() || ownerStat.isSymbolicLink()) continue;
+		if (await readFile(owner, "utf8") !== `spur-board stage ${id}\n`) continue;
+		const staged = join(parent, `${stagePrefix}${id}`);
+		if (await targetDirectory(staged)) await rm(staged, { recursive: true });
+		await rm(owner);
+	}
+}
+async function installIntoHome(home, packageRoot, version, options) {
+	for (const agent of agents) for (const skill of skills) await checkTarget(home, agent, join(home, agent, "skills", skill.name));
+	const installedAt = (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+	const results = [];
+	for (const agent of agents) {
+		const parent = join(home, agent, "skills");
+		for (const skill of skills) {
+			const destination = join(parent, skill.name);
+			await recoverSkill(parent, destination, skill.name);
+			const changed = !await currentVersion(destination, version);
+			if (changed) {
+				await mkdir(parent, { recursive: true });
+				await checkTarget(home, agent, destination);
+				const stageId = randomUUID();
+				const staged = join(parent, `.${skill.name}-stage-${stageId}`);
+				const owner = `${staged}.owner`;
+				await writeFile(owner, `spur-board stage ${stageId}\n`, {
+					flag: "wx",
+					mode: 384
+				});
+				let stagedCreated = false;
+				try {
+					await mkdir(staged, { mode: 448 });
+					stagedCreated = true;
+					const source = join(packageRoot, "skills", skill.source);
+					if (options.copySkill) await options.copySkill(source, staged);
+					else await cp(source, staged, { recursive: true });
+					const stamp = {
+						version,
+						installedAt
+					};
+					await writeFile(join(staged, stampName), `${JSON.stringify(stamp, null, 2)}\n`);
+					if (await checkTarget(home, agent, destination)) {
+						const backupId = randomUUID();
+						const backup = join(parent, `.${skill.name}-backup-${backupId}`);
+						const backupOwner = `${backup}.owner`;
+						const original = await lstat(destination, { bigint: true });
+						await writeFile(backupOwner, `spur-board backup ${backupId} ${`${String(original.dev)}:${String(original.ino)}`}\n`, {
+							flag: "wx",
+							mode: 384
+						});
+						let backupContainsSkill = false;
+						try {
+							if (await targetDirectory(backup)) throw new Error(`Skill backup path already exists: ${backup}`);
+							await rename(destination, backup);
+							backupContainsSkill = true;
+							try {
+								await rename(staged, destination);
+							} catch (error) {
+								await rename(backup, destination);
+								backupContainsSkill = false;
+								throw error;
+							}
+							await rm(backup, { recursive: true });
+							backupContainsSkill = false;
+						} finally {
+							if (!backupContainsSkill) await rm(backupOwner);
+						}
+					} else await rename(staged, destination);
+				} finally {
+					if (stagedCreated) await rm(staged, {
+						recursive: true,
+						force: true
+					});
+					await rm(owner);
+				}
+			}
+			results.push({
+				agent: agent === ".claude" ? "claude" : "codex",
+				skill: skill.name,
+				changed
+			});
+		}
+	}
+	return results;
+}
+async function installSkills(options = {}) {
+	const packageRoot = resolve(options.packageRoot ?? fileURLToPath(new URL("../", import.meta.url)));
+	const home = await realpath(resolve(options.home ?? homedir()));
+	const version = await packageVersion(packageRoot);
+	await Promise.all(skills.map((skill) => requireSource(join(packageRoot, "skills", skill.source))));
+	return withInstallLock(home, () => installIntoHome(home, packageRoot, version, options));
+}
+//#endregion
+//#region src/cli.ts
+const processIo = {
+	stdout: (text) => process.stdout.write(text),
+	stderr: (text) => process.stderr.write(text),
+	isTTY: process.stdout.isTTY
+};
+function branches(input) {
+	if (input instanceof z.ZodDiscriminatedUnion) return [...input.options];
+	return [input];
+}
+function fieldSchema(op, name) {
+	for (const branch of branches(op.input)) if (name in branch.shape) return branch.shape[name];
+}
+function bareSchema(schema) {
+	return schema instanceof z.ZodOptional ? schema.unwrap() : schema;
+}
+function revisionEntryArray(schema) {
+	if (schema === void 0) return false;
+	const bare = bareSchema(schema);
+	if (!(bare instanceof z.ZodArray)) return false;
+	return (bare.element instanceof z.ZodUnion ? bare.element.options : [bare.element]).some((shape) => shape instanceof z.ZodObject && Object.keys(shape.shape).sort().join(",") === "id,revision");
+}
+function positionalInput(op, field, value) {
+	if (!revisionEntryArray(fieldSchema(op, field)) || !Array.isArray(value)) return value;
+	return value.map((item) => {
+		if (typeof item !== "string") return item;
+		if (/^B[1-9][0-9]*$/.test(item)) return { id: item };
+		const match = /^([^@]+)@([1-9][0-9]*)$/.exec(item);
+		const id = match?.[1];
+		const rawRevision = match?.[2];
+		if (id === void 0 || rawRevision === void 0) return item;
+		const revision = Number(rawRevision);
+		return Number.isSafeInteger(revision) ? {
+			id,
+			revision
+		} : item;
+	});
+}
+function positionalExample(op, field, value) {
+	const values = Array.isArray(value) ? value : [value];
+	const isEntryArray = revisionEntryArray(fieldSchema(op, field));
+	return values.map((item) => {
+		if (isEntryArray && item !== null && typeof item === "object" && "id" in item && "revision" in item) return shellValue(`${String(item.id)}@${String(item.revision)}`);
+		if (isEntryArray && item !== null && typeof item === "object" && "id" in item) return shellValue(item.id);
+		return shellValue(item);
+	});
+}
+function optionName(field) {
+	return `--${field.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}`;
+}
+function optionField(flag) {
+	return flag.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function shellValue(value) {
+	const text = String(value);
+	return /^[A-Za-z0-9_./#:@-]+$/.test(text) ? text : JSON.stringify(text);
+}
+function exampleCommand(op, input) {
+	const words = ["board", op.cli.command];
+	for (const arg of op.cli.args) {
+		const value = input[arg];
+		if (value !== void 0) words.push(...positionalExample(op, arg, value));
+	}
+	const mode = op.cli.modes?.find((item) => item.mode === input["mode"]);
+	if (mode) {
+		words.push(mode.flag);
+		if (mode.value && input[mode.value] !== void 0) words.push(shellValue(input[mode.value]));
+	}
+	for (const [field, value] of Object.entries(input)) {
+		if (op.cli.args.includes(field) || field === "mode" || mode?.value === field) continue;
+		words.push(optionName(field));
+		if (Array.isArray(value)) words.push(...value.map(shellValue));
+		else if (typeof value !== "boolean") words.push(shellValue(value));
+	}
+	return words.join(" ");
+}
+function formatHuman(value, indent = 0) {
+	const prefix = " ".repeat(indent);
+	if (Array.isArray(value)) return value.map((item) => `${prefix}- ${formatHuman(item, indent + 2).trimStart()}`).join("\n");
+	if (value && typeof value === "object") {
+		const object = value;
+		return Object.entries(object).map(([key, item]) => {
+			if (key === "text" && object["untrusted"] === true && typeof item === "string") return `${prefix}${escapeTerminalControls(key)}:\n${item.split("\n").map((line) => `${prefix}> ${escapeTerminalControls(line)}`).join("\n")}`;
+			if (item && typeof item === "object") return `${prefix}${escapeTerminalControls(key)}:\n${formatHuman(item, indent + 2)}`;
+			return `${prefix}${escapeTerminalControls(key)}: ${escapeTerminalControls(String(item))}`;
+		}).join("\n");
+	}
+	return `${prefix}${escapeTerminalControls(String(value))}`;
+}
+function commandFor(root, path) {
+	let parent = root;
+	for (const segment of path.split(" ")) {
+		let child = parent.commands.find((item) => item.name() === segment);
+		if (!child) child = parent.command(segment);
+		parent = child;
+	}
+	return parent;
+}
+function registerOptions(command, op) {
+	for (const arg of op.cli.args) {
+		const schema = fieldSchema(op, arg);
+		if (!schema) throw new Error(`Catalog argument ${arg} is missing from ${op.id}.`);
+		command.argument(bareSchema(schema) instanceof z.ZodArray ? `<${arg}...>` : `<${arg}>`);
+	}
+	const modeValues = new Set(op.cli.modes?.flatMap((mode) => mode.value ? [mode.value] : []));
+	const fields = /* @__PURE__ */ new Map();
+	for (const branch of branches(op.input)) for (const [name, schema] of Object.entries(branch.shape)) fields.set(name, schema);
+	for (const [field, schema] of fields) {
+		if (op.cli.args.includes(field) || field === "mode" || modeValues.has(field)) continue;
+		const bare = bareSchema(schema);
+		const flag = optionName(field);
+		const description = schema.description ?? field;
+		if (bare instanceof z.ZodBoolean) command.option(flag, description);
+		else if (bare instanceof z.ZodArray) command.option(`${flag} <values...>`, description);
+		else if (bare instanceof z.ZodNumber) command.option(`${flag} <value>`, description, (value) => Number(value));
+		else if (bare instanceof z.ZodString || bare instanceof z.ZodEnum || bare instanceof z.ZodLiteral) command.option(`${flag} <value>`, description);
+		else throw new Error(`Unsupported CLI field ${field} in ${op.id}.`);
+	}
+	for (const mode of op.cli.modes ?? []) if (mode.value === null) command.option(mode.flag);
+	else {
+		const schema = fieldSchema(op, mode.value);
+		if (!schema) throw new Error(`Catalog mode value ${mode.value} is missing from ${op.id}.`);
+		const value = schema instanceof z.ZodOptional ? `[${mode.value}]` : `<${mode.value}>`;
+		command.option(`${mode.flag} ${value}`);
+	}
+	if (op.kind === "mutation") command.option("--key <key>", "Idempotency key for this action.");
+	command.option("--json", "Print JSON output or a JSON error.");
+}
+function buildInput(op, args, options) {
+	const input = {};
+	for (const [index, field] of op.cli.args.entries()) input[field] = positionalInput(op, field, args[index]);
+	for (const branch of branches(op.input)) for (const field of Object.keys(branch.shape)) {
+		if (field === "mode" || field in input) continue;
+		const flag = optionField(optionName(field));
+		if (options[flag] !== void 0) input[field] = options[flag];
+	}
+	const selected = op.cli.modes?.filter((mode) => options[optionField(mode.flag)] !== void 0);
+	if (selected && selected.length !== 1) throw new CliError("usage");
+	if (selected?.[0]) {
+		input["mode"] = selected[0].mode;
+		if (selected[0].value) {
+			const value = options[optionField(selected[0].flag)];
+			if (value !== true) input[selected[0].value] = value;
+		}
+	}
+	const parsed = op.input.safeParse(input);
+	if (!parsed.success) throw new CliError("usage", void 0, void 0, z.prettifyError(parsed.error));
+	return parsed.data;
+}
+function registerSetupCommands(program, options, io, env) {
+	const serviceOptions = {
+		...options.setup,
+		env
+	};
+	const print = (value) => {
+		io.stdout(`${program.opts()["json"] || !io.isTTY ? JSON.stringify(value) : formatHuman(value)}\n`);
+	};
+	const runSetup = async (action) => {
+		try {
+			return await action();
+		} catch (error) {
+			if (error instanceof CliError) throw error;
+			if (error instanceof Error) throw new CliError("config", void 0, void 0, error.message);
+			throw error;
+		}
+	};
+	commandFor(program, "skills install").description("Install bundled skills for Claude Code and Codex.").action(async () => {
+		print(await runSetup(() => installSkills(options.setup)));
+	});
+	commandFor(program, "service install").description("Install and start the systemd user service.").action(async () => {
+		print(await runSetup(() => installService(serviceOptions)));
+	});
+	commandFor(program, "service restart").description("Restart the systemd user service.").action(async () => {
+		await runSetup(() => restartService(serviceOptions));
+		print({
+			unit: serviceName,
+			restarted: true
+		});
+	});
+	commandFor(program, "service status").description("Show the service state and whether lingering is enabled.").action(async () => {
+		print({
+			unit: serviceName,
+			...await runSetup(() => statusService(serviceOptions))
+		});
+	});
+	commandFor(program, "service uninstall").description("Stop and remove the systemd user service.").action(async () => {
+		print({
+			unit: serviceName,
+			...await runSetup(() => uninstallService(serviceOptions))
+		});
+	});
+	const manifest = commandFor(program, "slack manifest");
+	manifest.description("Print a Slack app manifest.");
+	manifest.option("--app-name <name>", "Slack app name.");
+	manifest.option("--command <command>", "Slash command, including the leading slash.");
+	manifest.action(() => {
+		const appName = manifest.opts()["appName"];
+		const command = manifest.opts()["command"];
+		if (appName !== void 0 && typeof appName !== "string" || command !== void 0 && typeof command !== "string") throw new CliError("usage");
+		io.stdout(renderSlackManifest({
+			...appName === void 0 ? {} : { appName },
+			...command === void 0 ? {} : { command }
+		}));
+	});
+}
+function createProgram(options = {}) {
+	const io = options.io ?? processIo;
+	const env = options.env ?? process.env;
+	const program = new Command();
+	program.name("board").description("Use the board from a shell.");
+	program.option("--json", "Print JSON output or a JSON error.");
+	program.configureOutput({
+		writeOut: (text) => {
+			io.stdout(text);
+		},
+		writeErr: () => {}
+	});
+	program.exitOverride();
+	registerSetupCommands(program, options, io, env);
+	for (const op of OPERATIONS) {
+		const command = commandFor(program, op.cli.command);
+		command.description(op.description);
+		registerOptions(command, op);
+		command.addHelpText("after", `\nExamples:\n${op.examples.map((example) => `  ${exampleCommand(op, example.input)} — ${example.summary}`).join("\n")}\n`);
+		command.action(async (...parts) => {
+			const invoked = parts.at(-1);
+			const json = Boolean(invoked.opts()["json"] || program.opts()["json"]);
+			const input = buildInput(op, parts.slice(0, -1), invoked.opts());
+			const keyOption = invoked.opts()["key"];
+			if (keyOption !== void 0 && typeof keyOption !== "string") throw new CliError("usage");
+			if (keyOption === "") throw new CliError("usage");
+			if (keyOption !== void 0 && escapeTerminalControls(keyOption) !== keyOption) throw new CliError("usage", void 0, void 0, "The idempotency key must contain only printable characters.");
+			if (op.kind === "mutation" && env["SPUR_SESSION"] && !keyOption) throw new CliError("usage");
+			const config = options.clientConfig ?? loadClientConfig(env);
+			const key = op.kind === "mutation" ? keyOption || randomUUID() : void 0;
+			if (key) io.stderr(`key: ${escapeTerminalControls(key)}\n`);
+			try {
+				const result = await requestOperation(op, input, key, config);
+				io.stdout(`${json || !io.isTTY ? JSON.stringify(result) : formatHuman(result)}\n`);
+			} catch (error) {
+				if (error instanceof CliError) {
+					io.stderr(`${renderCliError(error, json, key)}\n`);
+					throw new CommanderError(errorExitCode(error), "board.error", error.message);
+				}
+				throw error;
+			}
+		});
+	}
+	const create = commandFor(program, "token create");
+	create.description("Request approval for a new token in a chosen folder.");
+	create.requiredOption("--name <name>", "Unique token name.");
+	create.requiredOption("--into <dir>", "Existing folder to hold the token file.");
+	create.option("--json", "Print JSON output or a JSON error.");
+	create.action(async (...parts) => {
+		const flags = parts.at(-1).opts();
+		const json = Boolean(flags["json"] || program.opts()["json"]);
+		const name = flags["name"];
+		const into = flags["into"];
+		if (typeof name !== "string" || !name.trim() || typeof into !== "string") throw new CliError("usage");
+		const config = loadEnrollmentConfig(env);
+		let folder;
+		try {
+			folder = realpathSync(resolve(into));
+			if (folder === realpathSync(options.home ?? homedir())) throw new CliError("usage", void 0, void 0, "Choose a folder below home, not home itself.");
+		} catch (error) {
+			if (error instanceof CliError) throw error;
+			throw new CliError("usage", void 0, void 0, "Choose an existing folder.");
+		}
+		const tokenFolder = join(folder, ".spur-board");
+		const file = join(tokenFolder, "token");
+		const secret = randomBytes(32).toString("base64url");
+		let created = false;
+		let descriptor;
+		try {
+			mkdirSync(tokenFolder, {
+				recursive: true,
+				mode: 448
+			});
+			const directory = lstatSync(tokenFolder);
+			if (!directory.isDirectory() || directory.uid !== process.getuid?.() || (directory.mode & 63) !== 0 || realpathSync(tokenFolder) !== tokenFolder) throw new Error("Token directory must be owned by the caller and private.");
+			descriptor = openSync(file, "wx", 384);
+			created = true;
+			writeFileSync(descriptor, `${secret}\n`);
+			closeSync(descriptor);
+			descriptor = void 0;
+			chmodSync(file, 384);
+		} catch {
+			if (descriptor !== void 0) closeSync(descriptor);
+			if (created) try {
+				unlinkSync(file);
+			} catch {
+				throw new CliError("config", void 0, void 0, "The new token file could not be secured or removed.");
+			}
+			throw new CliError("config", void 0, void 0, "The token file could not be created exclusively.");
+		}
+		try {
+			const result = await requestTokenEnrollment({
+				name,
+				folder,
+				host: hostname(),
+				hash: createHash("sha256").update(secret).digest("hex")
+			}, config);
+			io.stdout(`${json || !io.isTTY ? JSON.stringify(result) : formatHuman(result)}\n`);
+		} catch (error) {
+			if (error instanceof CliError && error.code === "outcome_unknown") throw new CliError("outcome_unknown", void 0, error.requestId, "The request may have reached the daemon. Keep the new token file and check the approval request before retrying.");
+			try {
+				unlinkSync(file);
+			} catch {
+				throw new CliError("config", void 0, void 0, "Registration failed and the new token file could not be removed. Remove it before retrying.");
+			}
+			throw error;
+		}
+	});
+	return program;
+}
+async function runCli(argv, options = {}) {
+	const io = options.io ?? processIo;
+	try {
+		await createProgram(options).parseAsync(argv, { from: "user" });
+		return 0;
+	} catch (error) {
+		if (error instanceof CommanderError && error.code === "board.error") return error.exitCode;
+		if (error instanceof CommanderError && error.exitCode === 0) return 0;
+		const cliError = error instanceof CliError ? error : error instanceof CommanderError ? new CliError("usage", void 0, void 0, error.message) : new CliError("unexpected");
+		io.stderr(`${renderCliError(cliError, argv.includes("--json"))}\n`);
+		return errorExitCode(cliError);
+	}
+}
+//#endregion
+export { createProgram, runCli };