# `bin/validate-packet`

## Purpose

Commander entry point for the `validate-packet` operator command. Parses CLI
flags, prompts for any required passwords via `@suaveplan/server-keys/prompt`,
and dispatches to the matching function in
`@suaveplan/server-keys/commands/`. The body runs inside
`runFunction("validate-packet", ...)` so OTel emission, structured stderr
banners, and `exit(1)` on failure are all handled by the shared
wrapper instead of being re-implemented per bin.

This file is a thin wrapper — operator-facing behaviour lives in the
`commands/` module the bin imports. The bin's only responsibilities
are flag parsing, password prompting, and exit-code threading; the
spec compliance, error handling, and OTel emission all come from the
shared wrapper layer.

## Features

- `commander` flag parsing with `-h/--help` for every sub-command.
- Password prompts via `@inquirer/prompts` (echo-disabled).
- OTel command-total + duration histogram per invocation.
- Structured `SERVER_KEYS_*` error banners on failure.
- `process.exit(1)` on any thrown failure, after the banner.

## Usage: Basic

```bash
validate-packet --help
```

## Usage: Advanced

Run the bin from a shell with a non-TTY `stdin` (e.g. via process
substitution) to script multiple operations:

```bash
echo "mypassword" | validate-packet [flags...]
```

When invoked under a `SIGINT`-trapping shell, the bin honours the
shared `AbortController` plumbed through `runFunction`.

## API Reference

This bin exposes its surface via `commander` flags only. Run
`validate-packet --help` for the authoritative list. The library-level surface
the bin wraps is documented under the matching `commands/` module.

## Implementation Notes

The bin imports its target command lazily where possible to keep `bun
link` cold-start time short. Every prompt accepts `{ inputStream,
outputStream, signal }` via `PromptOptions` so tests can drive the
bin without a real TTY; in production the defaults resolve to
`process.stdin` / `process.stdout`.