token

var AclCmd = &cobra.Command{
	Use:   "acl",
	Short: "Manage access control for API tokens",
	Long: `Configure fine-grained access control for API tokens.

Three independent ACL types enforce deny-by-default:
  command  — which shell commands the token can execute via websh/exec
  server   — which servers the token can access
  file     — which file paths the token can read/write via cp

If no ACL rule exists for a given type, that access is denied entirely.`,
	RunE: func(cmd *cobra.Command, args []string) error {
		_ = cmd.Help()
		return errors.New("a subcommand is required. Run 'alpacon token acl --help' for more information")
	},
}

var TokenCmd = &cobra.Command{
	Use:   "token",
	Short: "Manage API tokens for CI/CD and automation",
	RunE: func(cmd *cobra.Command, args []string) error {
		err := cmd.Help()
		if err != nil {
			return err
		}
		return errors.New("a subcommand is required. Run 'alpacon token --help' for more information")
	},
}